No OneTemporary
Actions

Size

4 MB

Referenced Files

None

Subscribers

None

View Options

This file is larger than 256 KB, so syntax highlighting was skipped.

	Index: head/contrib/unbound/.travis.yml
	===================================================================
	--- head/contrib/unbound/.travis.yml (nonexistent)
	+++ head/contrib/unbound/.travis.yml (revision 349720)
	@@ -0,0 +1,16 @@
	+sudo: false
	+language: c
	+compiler:
	+ - gcc
	+addons:
	+ apt:
	+ packages:
	+ - libssl-dev
	+ - libevent-dev
	+ - libexpat-dev
	+ - clang
	+script:
	+ - ./configure --enable-debug --disable-flto
	+ - make
	+ - make test
	+ - (cd testdata/clang-analysis.tdir; bash clang-analysis.test)
	Index: head/contrib/unbound/Makefile.in
	===================================================================
	--- head/contrib/unbound/Makefile.in (revision 349719)
	+++ head/contrib/unbound/Makefile.in (revision 349720)
	@@ -1,1543 +1,1464 @@
	# Copyright 2007 NLnet Labs
	# See the file LICENSE for the license

	SHELL=@SHELL@
	VERSION=@PACKAGE_VERSION@
	srcdir=@srcdir@
	prefix=@prefix@
	exec_prefix=@exec_prefix@
	bindir=@bindir@
	sbindir=@sbindir@
	mandir=@mandir@
	libdir=@libdir@
	# datarootdir is here to please some checkers, use datadir.
	datarootdir=@datarootdir@
	datadir=@datadir@
	includedir=@includedir@
	doxygen=@doxygen@
	libtool=@libtool@
	staticexe=@staticexe@
	EXEEXT=@EXEEXT@
	configfile=@ub_conf_file@
	CHECKLOCK_SRC=testcode/checklocks.c
	CHECKLOCK_OBJ=@CHECKLOCK_OBJ@
	DNSTAP_SRC=@DNSTAP_SRC@
	DNSTAP_OBJ=@DNSTAP_OBJ@
	DNSCRYPT_SRC=@DNSCRYPT_SRC@
	DNSCRYPT_OBJ=@DNSCRYPT_OBJ@
	WITH_PYTHONMODULE=@WITH_PYTHONMODULE@
	WITH_PYUNBOUND=@WITH_PYUNBOUND@
	PY_MAJOR_VERSION=@PY_MAJOR_VERSION@
	PYTHON_SITE_PKG=@PYTHON_SITE_PKG@
	PYTHONMOD_INSTALL=@PYTHONMOD_INSTALL@
	PYTHONMOD_UNINSTALL=@PYTHONMOD_UNINSTALL@
	PYUNBOUND_INSTALL=@PYUNBOUND_INSTALL@
	PYUNBOUND_UNINSTALL=@PYUNBOUND_UNINSTALL@
	UNBOUND_EVENT_INSTALL=@UNBOUND_EVENT_INSTALL@
	UNBOUND_EVENT_UNINSTALL=@UNBOUND_EVENT_UNINSTALL@
	UNBOUND_VERSION_MAJOR=@UNBOUND_VERSION_MAJOR@
	UNBOUND_VERSION_MINOR=@UNBOUND_VERSION_MINOR@
	UNBOUND_VERSION_MICRO=@UNBOUND_VERSION_MICRO@
	ALLTARGET=@ALLTARGET@
	INSTALLTARGET=@INSTALLTARGET@
	SSLLIB=@SSLLIB@

	# _unbound.la if pyunbound enabled.
	PYUNBOUND_TARGET=@PYUNBOUND_TARGET@

	# override $U variable which is used by autotools for deansification (for
	# K&R C compilers), but causes problems if $U is defined in the env).
	U=

	PROTOC_C=@PROTOC_C@
	SWIG=@SWIG@
	YACC=@YACC@
	LEX=@LEX@
	STRIP=@STRIP@
	CC=@CC@
	CPPFLAGS=-I. @CPPFLAGS@
	PYTHON_CPPFLAGS=-I. @PYTHON_CPPFLAGS@
	CFLAGS=-DSRCDIR=$(srcdir) @CFLAGS@
	LDFLAGS=@LDFLAGS@
	LIBS=@LIBS@
	LIBOBJS=@LIBOBJS@
	# filter out ctime_r from compat obj.
	LIBOBJ_WITHOUT_CTIME=@LIBOBJ_WITHOUT_CTIME@
	LIBOBJ_WITHOUT_CTIMEARC4=@LIBOBJ_WITHOUT_CTIMEARC4@
	RUNTIME_PATH=@RUNTIME_PATH@
	DEPFLAG=@DEPFLAG@
	DATE=@CONFIG_DATE@
	LIBTOOL=$(libtool)
	BUILD=build/
	UBSYMS=@UBSYMS@
	EXTRALINK=@EXTRALINK@

	WINDRES=@WINDRES@
	LINT=splint
	LINTFLAGS=+quiet -weak -warnposix -unrecog -Din_addr_t=uint32_t -Du_int=unsigned -Du_char=uint8_t -preproc -Drlimit=rlimit64 -D__gnuc_va_list=va_list -formatcode
	#-Dglob64=glob -Dglobfree64=globfree
	# compat with openssl linux edition.
	LINTFLAGS+="-DBN_ULONG=unsigned long" -Dkrb5_int32=int "-Dkrb5_ui_4=unsigned int" -DPQ_64BIT=uint64_t -DRC4_INT=unsigned -fixedformalarray -D"ENGINE=unsigned" -D"RSA=unsigned" -D"DSA=unsigned" -D"EVP_PKEY=unsigned" -D"EVP_MD=unsigned" -D"SSL=unsigned" -D"SSL_CTX=unsigned" -D"X509=unsigned" -D"RC4_KEY=unsigned" -D"EVP_MD_CTX=unsigned" -D"ECDSA_SIG=DSA_SIG" -Dfstrm_res=int
	# compat with NetBSD
	LINTFLAGS+=@NETBSD_LINTFLAGS@
	# compat with OpenBSD
	LINTFLAGS+="-Dsigset_t=long"
	# FreeBSD
	LINTFLAGS+="-D__uint16_t=uint16_t" "-DEVP_PKEY_ASN1_METHOD=int" "-D_RuneLocale=int" "-D__va_list=va_list" "-D__uint32_t=uint32_t" "-D_Alignof(x)=x" "-D__aligned(x)=" "-D__requires_exclusive(x)=" "-D__requires_unlocked(x)=" "-D__locks_exclusive(x)=" "-D__trylocks_exclusive(x)=" "-D__unlocks(x)=" "-D__locks_shared(x)=" "-D__trylocks_shared(x)="

	INSTALL=$(SHELL) $(srcdir)/install-sh

	#pythonmod.c is not here, it is mentioned by itself in its own rules,
	#makedepend fails on missing interface.h otherwise.
	PYTHONMOD_SRC=pythonmod/pythonmod_utils.c
	# pythonmod.lo pythonmod_utils.lo if python mod enabled.
	PYTHONMOD_OBJ=@PYTHONMOD_OBJ@
	PYTHONMOD_HEADER=@PYTHONMOD_HEADER@
	# libunbound/python/libunbound_wrap.c is dealt with by its own rules.
	PYUNBOUND_SRC=
	# libunbound_wrap.lo if python libunbound wrapper enabled.
	PYUNBOUND_OBJ=@PYUNBOUND_OBJ@
	SUBNET_SRC=edns-subnet/edns-subnet.c edns-subnet/subnetmod.c edns-subnet/addrtree.c edns-subnet/subnet-whitelist.c
	SUBNET_OBJ=@SUBNET_OBJ@
	SUBNET_HEADER=@SUBNET_HEADER@
	IPSECMOD_SRC=ipsecmod/ipsecmod.c ipsecmod/ipsecmod-whitelist.c
	IPSECMOD_OBJ=@IPSECMOD_OBJ@
	IPSECMOD_HEADER=@IPSECMOD_HEADER@
	COMMON_SRC=services/cache/dns.c services/cache/infra.c services/cache/rrset.c \
	util/as112.c util/data/dname.c util/data/msgencode.c util/data/msgparse.c \
	util/data/msgreply.c util/data/packed_rrset.c iterator/iterator.c \
	iterator/iter_delegpt.c iterator/iter_donotq.c iterator/iter_fwd.c \
	iterator/iter_hints.c iterator/iter_priv.c iterator/iter_resptype.c \
	iterator/iter_scrub.c iterator/iter_utils.c services/listen_dnsport.c \
	services/localzone.c services/mesh.c services/modstack.c services/view.c \
	services/outbound_list.c services/outside_network.c util/alloc.c \
	util/config_file.c util/configlexer.c util/configparser.c \
	util/shm_side/shm_main.c services/authzone.c \
	util/fptr_wlist.c util/locks.c util/log.c util/mini_event.c util/module.c \
	util/netevent.c util/net_help.c util/random.c util/rbtree.c util/regional.c \
	util/rtt.c util/edns.c util/storage/dnstree.c util/storage/lookup3.c \
	util/storage/lruhash.c util/storage/slabhash.c util/tcp_conn_limit.c \
	util/timehist.c util/tube.c \
	util/ub_event.c util/ub_event_pluggable.c util/winsock_event.c \
	validator/autotrust.c validator/val_anchor.c validator/validator.c \
	validator/val_kcache.c validator/val_kentry.c validator/val_neg.c \
	validator/val_nsec3.c validator/val_nsec.c validator/val_secalgo.c \
	validator/val_sigcrypt.c validator/val_utils.c dns64/dns64.c \
	edns-subnet/edns-subnet.c edns-subnet/subnetmod.c \
	edns-subnet/addrtree.c edns-subnet/subnet-whitelist.c \
	cachedb/cachedb.c cachedb/redis.c respip/respip.c $(CHECKLOCK_SRC) \
	$(DNSTAP_SRC) $(DNSCRYPT_SRC) $(IPSECMOD_SRC)
	COMMON_OBJ_WITHOUT_NETCALL=dns.lo infra.lo rrset.lo dname.lo msgencode.lo \
	as112.lo msgparse.lo msgreply.lo packed_rrset.lo iterator.lo iter_delegpt.lo \
	iter_donotq.lo iter_fwd.lo iter_hints.lo iter_priv.lo iter_resptype.lo \
	iter_scrub.lo iter_utils.lo localzone.lo mesh.lo modstack.lo view.lo \
	outbound_list.lo alloc.lo config_file.lo configlexer.lo configparser.lo \
	fptr_wlist.lo edns.lo locks.lo log.lo mini_event.lo module.lo net_help.lo \
	random.lo rbtree.lo regional.lo rtt.lo dnstree.lo lookup3.lo lruhash.lo \
	slabhash.lo tcp_conn_limit.lo timehist.lo tube.lo winsock_event.lo \
	autotrust.lo val_anchor.lo \
	validator.lo val_kcache.lo val_kentry.lo val_neg.lo val_nsec3.lo val_nsec.lo \
	val_secalgo.lo val_sigcrypt.lo val_utils.lo dns64.lo cachedb.lo redis.lo authzone.lo \
	$(SUBNET_OBJ) $(PYTHONMOD_OBJ) $(CHECKLOCK_OBJ) $(DNSTAP_OBJ) $(DNSCRYPT_OBJ) \
	$(IPSECMOD_OBJ) respip.lo
	COMMON_OBJ_WITHOUT_UB_EVENT=$(COMMON_OBJ_WITHOUT_NETCALL) netevent.lo listen_dnsport.lo \
	outside_network.lo
	COMMON_OBJ=$(COMMON_OBJ_WITHOUT_UB_EVENT) ub_event.lo
	# set to $COMMON_OBJ or to "" if --enableallsymbols
	COMMON_OBJ_ALL_SYMBOLS=@COMMON_OBJ_ALL_SYMBOLS@
	COMPAT_SRC=compat/ctime_r.c compat/fake-rfc2553.c compat/gmtime_r.c \
	compat/inet_aton.c compat/inet_ntop.c compat/inet_pton.c compat/malloc.c \
	compat/memcmp.c compat/memmove.c compat/snprintf.c compat/strlcat.c \
	compat/strlcpy.c compat/strptime.c compat/getentropy_linux.c \
	compat/getentropy_osx.c compat/getentropy_solaris.c compat/getentropy_win.c \
	compat/explicit_bzero.c compat/arc4random.c compat/arc4random_uniform.c \
	compat/arc4_lock.c compat/sha512.c compat/reallocarray.c compat/isblank.c \
	compat/strsep.c
	COMPAT_OBJ=$(LIBOBJS:.o=.lo)
	COMPAT_OBJ_WITHOUT_CTIME=$(LIBOBJ_WITHOUT_CTIME:.o=.lo)
	COMPAT_OBJ_WITHOUT_CTIMEARC4=$(LIBOBJ_WITHOUT_CTIMEARC4:.o=.lo)
	SLDNS_SRC=sldns/keyraw.c sldns/sbuffer.c sldns/wire2str.c sldns/parse.c \
	sldns/parseutil.c sldns/rrdef.c sldns/str2wire.c
	SLDNS_OBJ=keyraw.lo sbuffer.lo wire2str.lo parse.lo parseutil.lo rrdef.lo \
	str2wire.lo
	UNITTEST_SRC=testcode/unitanchor.c testcode/unitdname.c \
	testcode/unitlruhash.c testcode/unitmain.c testcode/unitmsgparse.c \
	testcode/unitneg.c testcode/unitregional.c testcode/unitslabhash.c \
	testcode/unitverify.c testcode/readhex.c testcode/testpkts.c testcode/unitldns.c \
	testcode/unitecs.c testcode/unitauth.c
	UNITTEST_OBJ=unitanchor.lo unitdname.lo unitlruhash.lo unitmain.lo \
	unitmsgparse.lo unitneg.lo unitregional.lo unitslabhash.lo unitverify.lo \
	readhex.lo testpkts.lo unitldns.lo unitecs.lo unitauth.lo
	UNITTEST_OBJ_LINK=$(UNITTEST_OBJ) worker_cb.lo $(COMMON_OBJ) $(SLDNS_OBJ) \
	$(COMPAT_OBJ)
	DAEMON_SRC=daemon/acl_list.c daemon/cachedump.c daemon/daemon.c \
	daemon/remote.c daemon/stats.c daemon/unbound.c daemon/worker.c @WIN_DAEMON_SRC@
	DAEMON_OBJ=acl_list.lo cachedump.lo daemon.lo \
	shm_main.lo remote.lo stats.lo unbound.lo \
	worker.lo @WIN_DAEMON_OBJ@
	DAEMON_OBJ_LINK=$(DAEMON_OBJ) $(COMMON_OBJ_ALL_SYMBOLS) $(SLDNS_OBJ) \
	$(COMPAT_OBJ) @WIN_DAEMON_OBJ_LINK@
	CHECKCONF_SRC=smallapp/unbound-checkconf.c smallapp/worker_cb.c
	CHECKCONF_OBJ=unbound-checkconf.lo worker_cb.lo
	CHECKCONF_OBJ_LINK=$(CHECKCONF_OBJ) $(COMMON_OBJ_ALL_SYMBOLS) $(SLDNS_OBJ) \
	$(COMPAT_OBJ) @WIN_CHECKCONF_OBJ_LINK@
	CONTROL_SRC=smallapp/unbound-control.c
	CONTROL_OBJ=unbound-control.lo
	CONTROL_OBJ_LINK=$(CONTROL_OBJ) worker_cb.lo $(COMMON_OBJ_ALL_SYMBOLS) \
	$(SLDNS_OBJ) $(COMPAT_OBJ) @WIN_CONTROL_OBJ_LINK@
	HOST_SRC=smallapp/unbound-host.c
	HOST_OBJ=unbound-host.lo
	HOST_OBJ_LINK=$(HOST_OBJ) $(SLDNS_OBJ) $(COMPAT_OBJ_WITHOUT_CTIMEARC4) @WIN_HOST_OBJ_LINK@
	UBANCHOR_SRC=smallapp/unbound-anchor.c
	UBANCHOR_OBJ=unbound-anchor.lo
	UBANCHOR_OBJ_LINK=$(UBANCHOR_OBJ) parseutil.lo \
	$(COMPAT_OBJ_WITHOUT_CTIME) @WIN_UBANCHOR_OBJ_LINK@
	TESTBOUND_SRC=testcode/testbound.c testcode/testpkts.c \
	daemon/worker.c daemon/acl_list.c \
	daemon/daemon.c daemon/stats.c \
	testcode/replay.c testcode/fake_event.c
	TESTBOUND_OBJ=testbound.lo replay.lo fake_event.lo
	TESTBOUND_OBJ_LINK=$(TESTBOUND_OBJ) testpkts.lo worker.lo acl_list.lo \
	daemon.lo stats.lo shm_main.lo $(COMMON_OBJ_WITHOUT_NETCALL) ub_event.lo $(SLDNS_OBJ) \
	$(COMPAT_OBJ)
	LOCKVERIFY_SRC=testcode/lock_verify.c
	LOCKVERIFY_OBJ=lock_verify.lo
	LOCKVERIFY_OBJ_LINK=$(LOCKVERIFY_OBJ) worker_cb.lo $(COMMON_OBJ) $(COMPAT_OBJ) \
	$(SLDNS_OBJ)
	PETAL_SRC=testcode/petal.c
	PETAL_OBJ=petal.lo
	PETAL_OBJ_LINK=$(PETAL_OBJ) $(COMPAT_OBJ_WITHOUT_CTIMEARC4)
	PKTVIEW_SRC=testcode/pktview.c testcode/readhex.c
	PKTVIEW_OBJ=pktview.lo
	PKTVIEW_OBJ_LINK=$(PKTVIEW_OBJ) worker_cb.lo readhex.lo $(COMMON_OBJ) \
	$(COMPAT_OBJ) $(SLDNS_OBJ)
	MEMSTATS_SRC=testcode/memstats.c
	MEMSTATS_OBJ=memstats.lo
	MEMSTATS_OBJ_LINK=$(MEMSTATS_OBJ) worker_cb.lo $(COMMON_OBJ) $(COMPAT_OBJ) \
	$(SLDNS_OBJ)
	ASYNCLOOK_SRC=testcode/asynclook.c
	ASYNCLOOK_OBJ=asynclook.lo
	ASYNCLOOK_OBJ_LINK=$(ASYNCLOOK_OBJ) log.lo locks.lo $(COMPAT_OBJ)
	STREAMTCP_SRC=testcode/streamtcp.c
	STREAMTCP_OBJ=streamtcp.lo
	STREAMTCP_OBJ_LINK=$(STREAMTCP_OBJ) worker_cb.lo $(COMMON_OBJ) $(COMPAT_OBJ) \
	$(SLDNS_OBJ)
	PERF_SRC=testcode/perf.c
	PERF_OBJ=perf.lo
	PERF_OBJ_LINK=$(PERF_OBJ) worker_cb.lo $(COMMON_OBJ) $(COMPAT_OBJ) $(SLDNS_OBJ)
	DELAYER_SRC=testcode/delayer.c
	DELAYER_OBJ=delayer.lo
	DELAYER_OBJ_LINK=$(DELAYER_OBJ) worker_cb.lo $(COMMON_OBJ) $(COMPAT_OBJ) \
	$(SLDNS_OBJ)
	LIBUNBOUND_SRC=libunbound/context.c libunbound/libunbound.c \
	libunbound/libworker.c
	LIBUNBOUND_OBJ=context.lo libunbound.lo libworker.lo ub_event_pluggable.lo
	LIBUNBOUND_OBJ_LINK=$(LIBUNBOUND_OBJ) $(COMMON_OBJ_WITHOUT_UB_EVENT) $(SLDNS_OBJ) $(COMPAT_OBJ)

	# win apps or "" if not on windows
	WINAPPS=@WINAPPS@
	WIN_DAEMON_THE_SRC=winrc/win_svc.c winrc/w_inst.c
	SVCINST_SRC=winrc/unbound-service-install.c
	SVCINST_OBJ=unbound-service-install.lo
	SVCINST_OBJ_LINK=$(SVCINST_OBJ) w_inst.lo rsrc_svcinst.o $(COMPAT_OBJ_WITHOUT_CTIMEARC4)
	SVCUNINST_SRC=winrc/unbound-service-remove.c
	SVCUNINST_OBJ=unbound-service-remove.lo
	SVCUNINST_OBJ_LINK=$(SVCUNINST_OBJ) w_inst.lo rsrc_svcuninst.o \
	$(COMPAT_OBJ_WITHOUT_CTIMEARC4)
	ANCHORUPD_SRC=winrc/anchor-update.c
	ANCHORUPD_OBJ=anchor-update.lo
	ANCHORUPD_OBJ_LINK=$(ANCHORUPD_OBJ) rsrc_anchorupd.o $(COMPAT_OBJ_WITHOUT_CTIMEARC4) wire2str.lo str2wire.lo parseutil.lo sbuffer.lo rrdef.lo keyraw.lo parse.lo
	RSRC_OBJ=rsrc_svcinst.o rsrc_svcuninst.o rsrc_anchorupd.o rsrc_unbound.o \
	rsrc_unbound_host.o rsrc_unbound_anchor.o rsrc_unbound_control.o \
	rsrc_unbound_checkconf.o

	ALL_SRC=$(COMMON_SRC) $(UNITTEST_SRC) $(DAEMON_SRC) \
	$(TESTBOUND_SRC) $(LOCKVERIFY_SRC) $(PKTVIEW_SRC) \
	$(MEMSTATS_SRC) $(CHECKCONF_SRC) $(LIBUNBOUND_SRC) $(HOST_SRC) \
	$(ASYNCLOOK_SRC) $(STREAMTCP_SRC) $(PERF_SRC) $(DELAYER_SRC) \
	$(CONTROL_SRC) $(UBANCHOR_SRC) $(PETAL_SRC) \
	$(PYTHONMOD_SRC) $(PYUNBOUND_SRC) $(WIN_DAEMON_THE_SRC)\
	$(SVCINST_SRC) $(SVCUNINST_SRC) $(ANCHORUPD_SRC) $(SLDNS_SRC)
	ALL_OBJ=$(COMMON_OBJ) $(UNITTEST_OBJ) $(DAEMON_OBJ) \
	$(TESTBOUND_OBJ) $(LOCKVERIFY_OBJ) $(PKTVIEW_OBJ) \
	$(MEMSTATS_OBJ) $(CHECKCONF_OBJ) $(LIBUNBOUND_OBJ) $(HOST_OBJ) \
	$(ASYNCLOOK_OBJ) $(STREAMTCP_OBJ) $(PERF_OBJ) $(DELAYER_OBJ) \
	$(CONTROL_OBJ) $(UBANCHOR_OBJ) $(PETAL_OBJ) \
	$(COMPAT_OBJ) $(PYUNBOUND_OBJ) \
	$(SVCINST_OBJ) $(SVCUNINST_OBJ) $(ANCHORUPD_OBJ) $(SLDNS_OBJ)

	COMPILE=$(LIBTOOL) --tag=CC --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS) @PTHREAD_CFLAGS_ONLY@
	LINK=$(LIBTOOL) --tag=CC --mode=link $(CC) $(staticexe) $(RUNTIME_PATH) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS)
	LINK_LIB=$(LIBTOOL) --tag=CC --mode=link $(CC) $(RUNTIME_PATH) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -version-info @LIBUNBOUND_CURRENT@:@LIBUNBOUND_REVISION@:@LIBUNBOUND_AGE@ -no-undefined

	.PHONY: clean realclean doc lint all install uninstall tests test strip lib longtest longcheck check alltargets

	all: $(COMMON_OBJ) $(ALLTARGET)

	alltargets: unbound$(EXEEXT) unbound-checkconf$(EXEEXT) lib unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup $(WINAPPS) $(PYUNBOUND_TARGET)

	# compat with BSD make, register suffix, and an implicit rule to actualise it.
	.SUFFIXES: .lo
	.c.lo:
	$(COMPILE) -o $@ -c $<

	$(ALL_OBJ):
	@@SOURCEDETERMINE@
	$(COMPILE) -o $@ -c @SOURCEFILE@

	$(RSRC_OBJ):
	@@SOURCEDETERMINE@
	$(WINDRES) $(CPPFLAGS) @SOURCEFILE@ $@

	rsrc_svcinst.o: $(srcdir)/winrc/rsrc_svcinst.rc config.h
	rsrc_svcuninst.o: $(srcdir)/winrc/rsrc_svcuninst.rc config.h
	rsrc_anchorupd.o: $(srcdir)/winrc/rsrc_anchorupd.rc config.h
	rsrc_unbound.o: $(srcdir)/winrc/rsrc_unbound.rc config.h
	rsrc_unbound_host.o: $(srcdir)/winrc/rsrc_unbound_host.rc config.h
	rsrc_unbound_anchor.o: $(srcdir)/winrc/rsrc_unbound_anchor.rc config.h
	rsrc_unbound_control.o: $(srcdir)/winrc/rsrc_unbound_control.rc config.h
	rsrc_unbound_checkconf.o: $(srcdir)/winrc/rsrc_unbound_checkconf.rc config.h

	TEST_BIN=asynclook$(EXEEXT) delayer$(EXEEXT) \
	lock-verify$(EXEEXT) memstats$(EXEEXT) perf$(EXEEXT) \
	petal$(EXEEXT) pktview$(EXEEXT) streamtcp$(EXEEXT) \
	testbound$(EXEEXT) unittest$(EXEEXT)
	tests: all $(TEST_BIN)

	check: test
	longcheck: longtest

	test: unittest$(EXEEXT) testbound$(EXEEXT)
	./unittest$(EXEEXT)
	./testbound$(EXEEXT) -s
	for x in $(srcdir)/testdata/*.rpl; do echo -n "$$x "; if ./testbound$(EXEEXT) -p $$x >/dev/null 2>&1; then echo OK; else echo failed; exit 1; fi done
	@echo test OK

	longtest: tests
	if test ! $(srcdir)/testdata -ef ./testdata; then rm -rf testcode testdata; mkdir testcode testdata; cp -R $(srcdir)/testdata/.sh $(srcdir)/testdata/.tdir $(srcdir)/testdata/.rpl $(srcdir)/testdata/.crpl testdata; cp $(srcdir)/testcode/*.sh testcode; if test ! -d util; then mkdir util; fi; cp $(srcdir)/util/iana_ports.inc util; fi
	if test -x "`which bash`"; then bash testcode/do-tests.sh; else sh testcode/do-tests.sh; fi

	lib: libunbound.la unbound.h

	libunbound.la: $(LIBUNBOUND_OBJ_LINK)
	$(LINK_LIB) $(UBSYMS) -o $@ $(LIBUNBOUND_OBJ_LINK) -rpath $(libdir) $(SSLLIB) $(LIBS)

	unbound$(EXEEXT): $(DAEMON_OBJ_LINK) libunbound.la
	$(LINK) -o $@ $(DAEMON_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)

	unbound-checkconf$(EXEEXT): $(CHECKCONF_OBJ_LINK) libunbound.la
	$(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)

	unbound-control$(EXEEXT): $(CONTROL_OBJ_LINK) libunbound.la
	$(LINK) -o $@ $(CONTROL_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)

	unbound-host$(EXEEXT): $(HOST_OBJ_LINK) libunbound.la
	$(LINK) -o $@ $(HOST_OBJ_LINK) -L. -L.libs -lunbound $(SSLLIB) $(LIBS)

	unbound-anchor$(EXEEXT): $(UBANCHOR_OBJ_LINK) libunbound.la
	$(LINK) -o $@ $(UBANCHOR_OBJ_LINK) -L. -L.libs -lunbound -lexpat $(SSLLIB) $(LIBS)

	unbound-service-install$(EXEEXT): $(SVCINST_OBJ_LINK)
	$(LINK) -o $@ $(SVCINST_OBJ_LINK) $(LIBS)

	unbound-service-remove$(EXEEXT): $(SVCUNINST_OBJ_LINK)
	$(LINK) -o $@ $(SVCUNINST_OBJ_LINK) $(LIBS)

	anchor-update$(EXEEXT): $(ANCHORUPD_OBJ_LINK) libunbound.la
	$(LINK) -o $@ $(ANCHORUPD_OBJ_LINK) -L. -L.libs -lunbound $(LIBS)

	unittest$(EXEEXT): $(UNITTEST_OBJ_LINK)
	$(LINK) -o $@ $(UNITTEST_OBJ_LINK) $(SSLLIB) $(LIBS)

	testbound$(EXEEXT): $(TESTBOUND_OBJ_LINK)
	$(LINK) -o $@ $(TESTBOUND_OBJ_LINK) $(SSLLIB) $(LIBS)

	lock-verify$(EXEEXT): $(LOCKVERIFY_OBJ_LINK)
	$(LINK) -o $@ $(LOCKVERIFY_OBJ_LINK) $(SSLLIB) $(LIBS)

	petal$(EXEEXT): $(PETAL_OBJ_LINK)
	$(LINK) -o $@ $(PETAL_OBJ_LINK) $(SSLLIB) $(LIBS)

	pktview$(EXEEXT): $(PKTVIEW_OBJ_LINK)
	$(LINK) -o $@ $(PKTVIEW_OBJ_LINK) $(SSLLIB) $(LIBS)

	memstats$(EXEEXT): $(MEMSTATS_OBJ_LINK)
	$(LINK) -o $@ $(MEMSTATS_OBJ_LINK) $(SSLLIB) $(LIBS)

	asynclook$(EXEEXT): $(ASYNCLOOK_OBJ_LINK) libunbound.la
	$(LINK) -o $@ $(ASYNCLOOK_OBJ_LINK) -L. -L.libs -lunbound $(SSLLIB) $(LIBS)

	streamtcp$(EXEEXT): $(STREAMTCP_OBJ_LINK)
	$(LINK) -o $@ $(STREAMTCP_OBJ_LINK) $(SSLLIB) $(LIBS)

	perf$(EXEEXT): $(PERF_OBJ_LINK)
	$(LINK) -o $@ $(PERF_OBJ_LINK) $(SSLLIB) $(LIBS)

	delayer$(EXEEXT): $(DELAYER_OBJ_LINK)
	$(LINK) -o $@ $(DELAYER_OBJ_LINK) $(SSLLIB) $(LIBS)

	signit$(EXEEXT): testcode/signit.c
	$(CC) $(CPPFLAGS) $(CFLAGS) @PTHREAD_CFLAGS_ONLY@ -o $@ testcode/signit.c $(LDFLAGS) -lldns $(SSLLIB) $(LIBS)

	unbound.h: $(srcdir)/libunbound/unbound.h
	sed -e 's/@''UNBOUND_VERSION_MAJOR@/$(UNBOUND_VERSION_MAJOR)/' -e 's/@''UNBOUND_VERSION_MINOR@/$(UNBOUND_VERSION_MINOR)/' -e 's/@''UNBOUND_VERSION_MICRO@/$(UNBOUND_VERSION_MICRO)/' < $(srcdir)/libunbound/unbound.h > $@

	unbound-control-setup: smallapp/unbound-control-setup.sh
	cp smallapp/unbound-control-setup.sh $@
	-chmod +x $@

	# dnstap
	dnstap.lo dnstap.o: $(srcdir)/dnstap/dnstap.c config.h dnstap/dnstap_config.h \
	dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h $(srcdir)/dnstap/dnstap.h \
	$(srcdir)/util/config_file.h $(srcdir)/util/log.h \
	$(srcdir)/util/netevent.h $(srcdir)/util/net_help.h

	dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h: $(srcdir)/dnstap/dnstap.proto
	@-if test ! -d dnstap; then $(INSTALL) -d dnstap; fi
	$(PROTOC_C) --c_out=. --proto_path=$(srcdir) $(srcdir)/dnstap/dnstap.proto

	dnstap.pb-c.lo dnstap.pb-c.o: dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h

	# dnscrypt
	dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h \
	dnscrypt/dnscrypt_config.h \
	$(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h \
	$(srcdir)/util/config_file.h $(srcdir)/util/log.h \
	$(srcdir)/util/netevent.h

	# Python Module
	pythonmod.lo pythonmod.o: $(srcdir)/pythonmod/pythonmod.c config.h \
	pythonmod/interface.h \
	$(srcdir)/pythonmod/pythonmod.h $(srcdir)/util/module.h \
	$(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	$(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
	$(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	$(srcdir)/services/outbound_list.h $(srcdir)/util/config_file.h \
	$(srcdir)/pythonmod/pythonmod_utils.h $(srcdir)/util/netevent.h \
	$(srcdir)/util/regional.h $(srcdir)/util/data/dname.h \
	$(srcdir)/services/cache/dns.h $(srcdir)/services/mesh.h \
	$(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h

	pythonmod/interface.h: $(srcdir)/pythonmod/interface.i config.h
	@-if test ! -d pythonmod; then $(INSTALL) -d pythonmod; fi
	$(SWIG) $(PYTHON_CPPFLAGS) -o $@ -python $(srcdir)/pythonmod/interface.i

	libunbound_wrap.lo libunbound_wrap.o: libunbound/python/libunbound_wrap.c \
	unbound.h
	libunbound/python/libunbound_wrap.c: $(srcdir)/libunbound/python/libunbound.i unbound.h
	@-if test ! -d libunbound/python; then $(INSTALL) -d libunbound/python; fi
	$(SWIG) -python -o $@ $(PYTHON_CPPFLAGS) -DPY_MAJOR_VERSION=$(PY_MAJOR_VERSION) $(srcdir)/libunbound/python/libunbound.i

	# Pyunbound python unbound wrapper
	_unbound.la: libunbound_wrap.lo libunbound.la
	$(LIBTOOL) --tag=CC --mode=link $(CC) $(RUNTIME_PATH) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -module -avoid-version -no-undefined -shared -o $@ libunbound_wrap.lo -rpath $(PYTHON_SITE_PKG) -L. -L.libs -lunbound

	util/config_file.c: util/configparser.h
	util/configlexer.c: $(srcdir)/util/configlexer.lex util/configparser.h
	@-if test ! -d util; then $(INSTALL) -d util; fi
	if test "$(LEX)" != ":"; then \
	echo "#include \"config.h\"" > $@ ;\
	echo "#include \"util/configyyrename.h\"" >> $@ ;\
	$(LEX) -t $(srcdir)/util/configlexer.lex >> $@ ;\
	fi

	util/configparser.c util/configparser.h: $(srcdir)/util/configparser.y
	@-if test ! -d util; then $(INSTALL) -d util; fi
	$(YACC) -d -o util/configparser.c $(srcdir)/util/configparser.y

	clean:
	rm -f .o .d .lo ~ tags
	rm -f unbound$(EXEEXT) unbound-checkconf$(EXEEXT) unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup libunbound.la unbound.h
	rm -f $(ALL_SRC:.c=.lint)
	rm -f _unbound.la libunbound/python/libunbound_wrap.c libunbound/python/unbound.py pythonmod/interface.h pythonmod/unboundmodule.py
	rm -rf autom4te.cache .libs build doc/html doc/xml

	realclean: clean
	rm -f config.status config.log config.h.in config.h
	rm -f configure config.sub config.guess ltmain.sh aclocal.m4 libtool
	rm -f util/configlexer.c util/configparser.c util/configparser.h
	rm -f doc/example.conf doc/libunbound.3 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound-control.8 doc/unbound.8 doc/unbound.conf.5
	rm -f $(TEST_BIN)
	rm -f Makefile

	.SUFFIXES: .lint
	.c.lint:
	$(LINT) $(LINTFLAGS) -I. -I$(srcdir) $<
	touch $@

	util/configparser.lint util/configlexer.lint pythonmod/pythonmod.lint libunbound/python/libunbound_wrap.lint dnstap/dnstap.pb-c.lint:
	# skip lint for generated code
	touch $@

	winrc/win_svc.lint winrc/w_inst.lint winrc/unbound-service-install.lint winrc/unbound-service-remove.lint:
	# skip lint for windows types
	touch $@

	lint: $(ALL_SRC:.c=.lint)

	tags: $(srcdir)/.[ch] $(srcdir)//*.[ch]
	ctags -f $(srcdir)/tags $(srcdir)/.[ch] $(srcdir)//*.[ch]

	doc:
	if test -n "$(doxygen)"; then \
	$(doxygen) $(srcdir)/doc/unbound.doxygen; fi
	if test "$(WITH_PYUNBOUND)" = "yes" -o "$(WITH_PYTHONMODULE)" = "yes"; \
	- then if test -x "`which sphinx-build 2>&1`"; then \
	- sphinx-build -b html pythonmod/doc doc/html/pythonmod; \
	- sphinx-build -b html libunbound/python/doc doc/html/pyunbound;\
	+ then if test -x "`which sphinx-build-$(PY_MAJOR_VERSION) 2>&1`"; then \
	+ sphinx-build-$(PY_MAJOR_VERSION) -b html pythonmod/doc doc/html/pythonmod; \
	+ sphinx-build-$(PY_MAJOR_VERSION) -b html libunbound/python/doc doc/html/pyunbound;\
	fi ;\
	fi

	strip:
	$(STRIP) unbound$(EXEEXT)
	$(STRIP) unbound-checkconf$(EXEEXT)
	$(STRIP) unbound-control$(EXEEXT)
	$(STRIP) unbound-host$(EXEEXT) \|\| $(STRIP) .libs/unbound-host$(EXEEXT)
	$(STRIP) unbound-anchor$(EXEEXT) \|\| $(STRIP) .libs/unbound-anchor$(EXEEXT)

	pythonmod-install:
	$(INSTALL) -m 755 -d $(DESTDIR)$(PYTHON_SITE_PKG)
	$(INSTALL) -c -m 644 pythonmod/unboundmodule.py $(DESTDIR)$(PYTHON_SITE_PKG)/unboundmodule.py

	pyunbound-install:
	$(INSTALL) -m 755 -d $(DESTDIR)$(PYTHON_SITE_PKG)
	$(INSTALL) -c -m 644 $(srcdir)/libunbound/python/unbound.py $(DESTDIR)$(PYTHON_SITE_PKG)/unbound.py
	$(LIBTOOL) --mode=install cp _unbound.la $(DESTDIR)$(PYTHON_SITE_PKG)
	$(LIBTOOL) --mode=finish $(DESTDIR)$(PYTHON_SITE_PKG)

	unbound-event-install:
	$(INSTALL) -m 755 -d $(DESTDIR)$(includedir)
	$(LIBTOOL) --mode=install cp $(srcdir)/libunbound/unbound-event.h $(DESTDIR)$(includedir)/unbound-event.h

	install: $(INSTALLTARGET)

	install-lib: lib $(UNBOUND_EVENT_INSTALL)
	$(INSTALL) -m 755 -d $(DESTDIR)$(libdir)
	$(INSTALL) -m 755 -d $(DESTDIR)$(includedir)
	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)
	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man3
	$(INSTALL) -c -m 644 doc/libunbound.3 $(DESTDIR)$(mandir)/man3
	for mpage in ub_ctx ub_result ub_ctx_create ub_ctx_delete \
	ub_ctx_set_option ub_ctx_get_option ub_ctx_config ub_ctx_set_fwd \
	ub_ctx_resolvconf ub_ctx_hosts ub_ctx_add_ta ub_ctx_add_ta_file \
	ub_ctx_trustedkeys ub_ctx_debugout ub_ctx_debuglevel ub_ctx_async \
	ub_poll ub_wait ub_fd ub_process ub_resolve ub_resolve_async ub_cancel \
	ub_resolve_free ub_strerror ub_ctx_print_local_zones ub_ctx_zone_add \
	ub_ctx_zone_remove ub_ctx_data_add ub_ctx_data_remove; \
	do \
	echo ".so man3/libunbound.3" > $(DESTDIR)$(mandir)/man3/$$mpage.3 ; \
	done
	$(LIBTOOL) --mode=install cp unbound.h $(DESTDIR)$(includedir)/unbound.h
	$(LIBTOOL) --mode=install cp libunbound.la $(DESTDIR)$(libdir)
	$(LIBTOOL) --mode=finish $(DESTDIR)$(libdir)

	install-all: all $(PYTHONMOD_INSTALL) $(PYUNBOUND_INSTALL) $(UNBOUND_EVENT_INSTALL) install-lib
	$(INSTALL) -m 755 -d $(DESTDIR)$(sbindir)
	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)
	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man8
	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man5
	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man1
	$(INSTALL) -m 755 -d $(DESTDIR)$(libdir)/pkgconfig
	$(INSTALL) -m 644 contrib/libunbound.pc $(DESTDIR)$(libdir)/pkgconfig
	$(LIBTOOL) --mode=install cp -f unbound$(EXEEXT) $(DESTDIR)$(sbindir)/unbound$(EXEEXT)
	$(LIBTOOL) --mode=install cp -f unbound-checkconf$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-checkconf$(EXEEXT)
	$(LIBTOOL) --mode=install cp -f unbound-control$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control$(EXEEXT)
	$(LIBTOOL) --mode=install cp -f unbound-host$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-host$(EXEEXT)
	$(LIBTOOL) --mode=install cp -f unbound-anchor$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-anchor$(EXEEXT)
	$(INSTALL) -c -m 644 doc/unbound.8 $(DESTDIR)$(mandir)/man8
	$(INSTALL) -c -m 644 doc/unbound-checkconf.8 $(DESTDIR)$(mandir)/man8
	$(INSTALL) -c -m 644 doc/unbound-control.8 $(DESTDIR)$(mandir)/man8
	$(INSTALL) -c -m 644 doc/unbound-control.8 $(DESTDIR)$(mandir)/man8/unbound-control-setup.8
	$(INSTALL) -c -m 644 doc/unbound-anchor.8 $(DESTDIR)$(mandir)/man8
	$(INSTALL) -c -m 644 doc/unbound.conf.5 $(DESTDIR)$(mandir)/man5
	$(INSTALL) -c -m 644 doc/unbound-host.1 $(DESTDIR)$(mandir)/man1
	$(INSTALL) -c -m 755 unbound-control-setup $(DESTDIR)$(sbindir)/unbound-control-setup
	if test ! -e $(DESTDIR)$(configfile); then $(INSTALL) -d `dirname $(DESTDIR)$(configfile)`; $(INSTALL) -c -m 644 doc/example.conf $(DESTDIR)$(configfile); fi

	pythonmod-uninstall:
	rm -f -- $(DESTDIR)$(PYTHON_SITE_PKG)/unboundmodule.py

	pyunbound-uninstall:
	rm -f -- $(DESTDIR)$(PYTHON_SITE_PKG)/unbound.py
	$(LIBTOOL) --mode=uninstall rm -f $(DESTDIR)$(PYTHON_SITE_PKG)/_unbound.la

	unbound-event-uninstall:
	rm -f -- $(DESTDIR)$(includedir)/unbound-event.h

	uninstall: $(PYTHONMOD_UNINSTALL) $(PYUNBOUND_UNINSTALL) $(UNBOUND_EVENT_UNINSTALL)
	rm -f -- $(DESTDIR)$(sbindir)/unbound$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-checkconf$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-host$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-anchor$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control-setup
	rm -f -- $(DESTDIR)$(mandir)/man8/unbound.8 $(DESTDIR)$(mandir)/man8/unbound-checkconf.8 $(DESTDIR)$(mandir)/man5/unbound.conf.5 $(DESTDIR)$(mandir)/man8/unbound-control.8 $(DESTDIR)$(mandir)/man8/unbound-anchor.8 $(DESTDIR)$(mandir)/man8/unbound-control-setup.8
	rm -f -- $(DESTDIR)$(mandir)/man1/unbound-host.1 $(DESTDIR)$(mandir)/man3/libunbound.3
	for mpage in ub_ctx ub_result ub_ctx_create ub_ctx_delete \
	ub_ctx_set_option ub_ctx_get_option ub_ctx_config ub_ctx_set_fwd \
	ub_ctx_resolvconf ub_ctx_hosts ub_ctx_add_ta ub_ctx_add_ta_file \
	ub_ctx_trustedkeys ub_ctx_debugout ub_ctx_debuglevel ub_ctx_async \
	ub_poll ub_wait ub_fd ub_process ub_resolve ub_resolve_async ub_cancel \
	ub_resolve_free ub_strerror ub_ctx_print_local_zones ub_ctx_zone_add \
	ub_ctx_zone_remove ub_ctx_data_add ub_ctx_data_remove; \
	do \
	rm -f -- $(DESTDIR)$(mandir)/man3/$$mpage.3 ; \
	done
	rm -f -- $(DESTDIR)$(includedir)/unbound.h
	$(LIBTOOL) --mode=uninstall rm -f $(DESTDIR)$(libdir)/libunbound.la
	@echo
	@echo "You still need to remove "`dirname $(DESTDIR)$(configfile)`" , $(DESTDIR)$(configfile) by hand"

	iana_update:
	curl -o port-numbers.tmp https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml --compressed
	if file port-numbers.tmp \| grep 'gzip' >/dev/null; then zcat port-numbers.tmp; else cat port-numbers.tmp; fi \| awk '/<record>/ {p=0;} /<protocol>udp/ {p=1;} /<protocol>[^u]/ {p=0;} /Decomissioned\|Decommissioned\|Removed\|De-registered\|unassigned\|Unassigned\|Reserved/ {u=1;} /<number>/ { if(u==1) {u=0;} else { if(p==1) { match($$0,/[0-9]+/); print substr($$0, RSTART, RLENGTH) ","}}}' \| sort -nu > util/iana_ports.inc
	rm -f port-numbers.tmp

	# dependency generation
	DEPEND_TMP=depend1073.tmp
	DEPEND_TMP2=depend1074.tmp
	DEPEND_TARGET=Makefile
	DEPEND_TARGET2=$(srcdir)/Makefile.in
	# actions: generate deplines from gcc,
	# then, filter out home/xx, /usr/xx and /opt/xx lines (some cc already do this)
	# then, remove empty " \" lines
	# then, add srcdir before .c and .h in deps.
	# then, remove srcdir from the (generated) parser and lexer.
	# and mention the .lo
	depend:
	(BUILDDIR=$$PWD; cd $(srcdir) ; $(CC) $(DEPFLAG) $(CPPFLAGS) $(CFLAGS) -I$$BUILDDIR @PTHREAD_CFLAGS_ONLY@ $(ALL_SRC) $(COMPAT_SRC)) \| \
	sed -e 's?'$$PWD'/config.h?config.h?g' \| \
	sed -e 's!'$$HOME'[^ ]* !!g' -e 's!'$$HOME'[^ ]*$$!!g' \
	-e 's!/usr[^ ]* !!g' -e 's!/usr[^ ]*$$!!g' \
	-e 's!/opt[^ ]* !!g' -e 's!/opt[^ ]*$$!!g' \| \
	sed -e '/^ \\$$/d' \| \
	sed -e 's? $[^ ]\.[ch]$? $$(srcdir)/\1?g' \| \
	sed -e 's? $[^ ]\.inc$? $$(srcdir)/\1?g' \| \
	sed -e 's?$$(srcdir)/config.h?config.h?g' \
	-e 's?$$(srcdir)/util/configlexer.c?util/configlexer.c?g' \
	-e 's?$$(srcdir)/util/configparser.c?util/configparser.c?g' \
	-e 's?$$(srcdir)/util/configparser.h?util/configparser.h?g' \
	-e 's?$$(srcdir)/dnstap/dnstap_config.h??g' \
	+ -e 's?$$(srcdir)/dnstap/dnstap.pb-c.c?dnstap/dnstap.pb-c.c?g' \
	+ -e 's?$$(srcdir)/dnstap/dnstap.pb-c.h?dnstap/dnstap.pb-c.h?g' \
	-e 's?$$(srcdir)/dnscrypt/dnscrypt_config.h??g' \
	-e 's?$$(srcdir)/pythonmod/pythonmod.h?$$(PYTHONMOD_HEADER)?g' \
	-e 's?$$(srcdir)/edns-subnet/subnetmod.h $$(srcdir)/edns-subnet/subnet-whitelist.h $$(srcdir)/edns-subnet/edns-subnet.h $$(srcdir)/edns-subnet/addrtree.h?$$(SUBNET_HEADER)?g' \
	-e 's?$$(srcdir)/ipsecmod/ipsecmod.h $$(srcdir)/ipsecmod/ipsecmod-whitelist.h?$$(IPSECMOD_HEADER)?g' \
	-e 's!$.$\.o[ :]!\1.lo \1.o: !g' \
	> $(DEPEND_TMP)
	cp $(DEPEND_TARGET) $(DEPEND_TMP2)
	head -`egrep -n "# Dependencies" $(DEPEND_TARGET) \| tail -1 \| sed -e 's/:.*$$//'` $(DEPEND_TMP2) > $(DEPEND_TARGET)
	cat $(DEPEND_TMP) >> $(DEPEND_TARGET)
	@if diff $(DEPEND_TARGET) $(DEPEND_TMP2); then echo " $(DEPEND_TARGET) unchanged"; else echo " Updated $(DEPEND_TARGET))"; fi
	@if test -f $(DEPEND_TARGET2); then \
	cp $(DEPEND_TARGET2) $(DEPEND_TMP2); \
	head -`egrep -n "# Dependencies" $(DEPEND_TARGET2) \| tail -1 \| sed -e 's/:.*$$//'` $(DEPEND_TMP2) > $(DEPEND_TARGET2); \
	cat $(DEPEND_TMP) >> $(DEPEND_TARGET2); \
	if diff $(DEPEND_TARGET2) $(DEPEND_TMP2); then echo " $(DEPEND_TARGET2) unchanged"; else echo " Updated $(DEPEND_TARGET2))"; fi; \
	fi
	rm -f $(DEPEND_TMP) $(DEPEND_TMP2)

	# Dependencies
	dns.lo dns.o: $(srcdir)/services/cache/dns.c config.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/util/log.h \
	$(srcdir)/validator/val_nsec.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h $(srcdir)/validator/val_utils.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/services/cache/dns.h $(srcdir)/util/data/msgreply.h $(srcdir)/services/cache/rrset.h \
	- $(srcdir)/util/storage/slabhash.h $(srcdir)/util/data/dname.h $(srcdir)/util/module.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
	- $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h
	+ $(srcdir)/util/locks.h $(srcdir)/validator/val_utils.h $(srcdir)/sldns/pkthdr.h $(srcdir)/services/cache/dns.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
	+ $(srcdir)/util/data/dname.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/rrdef.h \
	+ $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h
	infra.lo infra.o: $(srcdir)/services/cache/infra.c config.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h \
	$(srcdir)/services/cache/infra.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h \
	- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/data/dname.h \
	- $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/iterator/iterator.h \
	+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h \
	+ $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lookup3.h \
	+ $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/iterator/iterator.h \
	$(srcdir)/services/outbound_list.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h \
	$(srcdir)/sldns/pkthdr.h
	rrset.lo rrset.o: $(srcdir)/services/cache/rrset.c config.h $(srcdir)/services/cache/rrset.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/storage/slabhash.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/util/config_file.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/regional.h $(srcdir)/util/alloc.h \
	- $(srcdir)/util/net_help.h
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/slabhash.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/regional.h $(srcdir)/util/alloc.h $(srcdir)/util/net_help.h
	as112.lo as112.o: $(srcdir)/util/as112.c $(srcdir)/util/as112.h
	dname.lo dname.o: $(srcdir)/util/data/dname.c config.h $(srcdir)/util/data/dname.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/storage/lookup3.h \
	- $(srcdir)/sldns/sbuffer.h
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/storage/lookup3.h $(srcdir)/sldns/sbuffer.h
	msgencode.lo msgencode.o: $(srcdir)/util/data/msgencode.c config.h $(srcdir)/util/data/msgencode.h \
	$(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h \
	- $(srcdir)/util/net_help.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/localzone.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/sldns/sbuffer.h $(srcdir)/services/localzone.h $(srcdir)/util/rbtree.h \
	$(srcdir)/util/storage/dnstree.h $(srcdir)/util/module.h $(srcdir)/services/view.h
	msgparse.lo msgparse.o: $(srcdir)/util/data/msgparse.c config.h $(srcdir)/util/data/msgparse.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h \
	- $(srcdir)/util/regional.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	+ $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h $(srcdir)/sldns/sbuffer.h \
	+ $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h
	msgreply.lo msgreply.o: $(srcdir)/util/data/msgreply.c config.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/alloc.h \
	- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgencode.h \
	- $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/module.h $(srcdir)/util/fptr_wlist.h \
	- $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
	+ $(srcdir)/util/storage/lookup3.h $(srcdir)/util/alloc.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
	+ $(srcdir)/util/regional.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	+ $(srcdir)/util/data/msgencode.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/module.h \
	+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/services/modstack.h
	packed_rrset.lo packed_rrset.o: $(srcdir)/util/data/packed_rrset.c config.h \
	$(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h \
	- $(srcdir)/util/alloc.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h
	+ $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/alloc.h $(srcdir)/util/regional.h \
	+ $(srcdir)/util/net_help.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h
	iterator.lo iterator.o: $(srcdir)/iterator/iterator.c config.h $(srcdir)/iterator/iterator.h \
	$(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_hints.h \
	- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_fwd.h \
	- $(srcdir)/iterator/iter_donotq.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_scrub.h \
	- $(srcdir)/iterator/iter_priv.h $(srcdir)/validator/val_neg.h $(srcdir)/services/cache/dns.h \
	- $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/services/authzone.h \
	- $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
	- $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
	- $(srcdir)/util/config_file.h $(srcdir)/util/random.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h \
	- $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/sbuffer.h
	+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h \
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/iterator/iter_utils.h \
	+ $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
	+ $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_donotq.h \
	+ $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_scrub.h $(srcdir)/iterator/iter_priv.h \
	+ $(srcdir)/validator/val_neg.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/infra.h \
	+ $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
	+ $(srcdir)/services/modstack.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h \
	+ $(srcdir)/util/data/msgencode.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/config_file.h \
	+ $(srcdir)/util/random.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/parseutil.h \
	+ $(srcdir)/sldns/sbuffer.h
	iter_delegpt.lo iter_delegpt.o: $(srcdir)/iterator/iter_delegpt.c config.h $(srcdir)/iterator/iter_delegpt.h \
	$(srcdir)/util/log.h $(srcdir)/services/cache/dns.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/sldns/sbuffer.h
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/regional.h \
	+ $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h
	iter_donotq.lo iter_donotq.o: $(srcdir)/iterator/iter_donotq.c config.h $(srcdir)/iterator/iter_donotq.h \
	$(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/regional.h $(srcdir)/util/log.h \
	$(srcdir)/util/config_file.h $(srcdir)/util/net_help.h
	iter_fwd.lo iter_fwd.o: $(srcdir)/iterator/iter_fwd.c config.h $(srcdir)/iterator/iter_fwd.h \
	$(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/util/log.h $(srcdir)/util/config_file.h \
	$(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
	iter_hints.lo iter_hints.o: $(srcdir)/iterator/iter_hints.c config.h $(srcdir)/iterator/iter_hints.h \
	$(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/util/log.h \
	$(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h \
	+ $(srcdir)/sldns/wire2str.h
	iter_priv.lo iter_priv.o: $(srcdir)/iterator/iter_priv.c config.h $(srcdir)/iterator/iter_priv.h \
	$(srcdir)/util/rbtree.h $(srcdir)/util/regional.h $(srcdir)/util/log.h $(srcdir)/util/config_file.h \
	$(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/util/net_help.h $(srcdir)/util/storage/dnstree.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/sbuffer.h
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/util/storage/dnstree.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/sbuffer.h
	iter_resptype.lo iter_resptype.o: $(srcdir)/iterator/iter_resptype.c config.h \
	$(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/util/log.h \
	$(srcdir)/services/cache/dns.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/util/data/dname.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h
	iter_scrub.lo iter_scrub.o: $(srcdir)/iterator/iter_scrub.c config.h $(srcdir)/iterator/iter_scrub.h \
	$(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h \
	- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/iterator/iter_priv.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/net_help.h \
	- $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h $(srcdir)/util/alloc.h \
	- $(srcdir)/sldns/sbuffer.h
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
	+ $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	+ $(srcdir)/iterator/iter_priv.h $(srcdir)/util/rbtree.h $(srcdir)/services/cache/rrset.h \
	+ $(srcdir)/util/storage/slabhash.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
	+ $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h $(srcdir)/util/alloc.h $(srcdir)/sldns/sbuffer.h
	iter_utils.lo iter_utils.o: $(srcdir)/iterator/iter_utils.c config.h $(srcdir)/iterator/iter_utils.h \
	$(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
	$(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/iterator/iter_hints.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/iterator/iter_hints.h \
	$(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_fwd.h \
	$(srcdir)/iterator/iter_donotq.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_priv.h \
	$(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/services/cache/dns.h \
	- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/net_help.h \
	- $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h $(srcdir)/util/random.h \
	- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
	- $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_kentry.h \
	- $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/sldns/sbuffer.h \
	- $(srcdir)/sldns/str2wire.h
	+ $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
	+ $(srcdir)/util/storage/slabhash.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h \
	+ $(srcdir)/util/regional.h $(srcdir)/util/data/dname.h $(srcdir)/util/random.h $(srcdir)/util/fptr_wlist.h \
	+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/validator/val_anchor.h \
	+ $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_utils.h \
	+ $(srcdir)/validator/val_sigcrypt.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h
	listen_dnsport.lo listen_dnsport.o: $(srcdir)/services/listen_dnsport.c config.h \
	$(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
	- $(srcdir)/sldns/sbuffer.h
	+ $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/sldns/sbuffer.h $(srcdir)/services/mesh.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	+ $(srcdir)/services/modstack.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h
	localzone.lo localzone.o: $(srcdir)/services/localzone.c config.h $(srcdir)/services/localzone.h \
	- $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/str2wire.h \
	- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
	+ $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h \
	+ $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/sbuffer.h \
	+ $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
	$(srcdir)/util/data/msgencode.h $(srcdir)/util/net_help.h $(srcdir)/util/netevent.h \
	- $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h \
	- $(srcdir)/util/as112.h
	+ $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/as112.h
	mesh.lo mesh.o: $(srcdir)/services/mesh.c config.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	$(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/services/modstack.h $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/dns.h \
	- $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/timehist.h \
	- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/alloc.h $(srcdir)/util/config_file.h \
	- $(srcdir)/util/edns.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/services/localzone.h \
	- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/util/data/dname.h $(srcdir)/respip/respip.h
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h $(srcdir)/services/outbound_list.h \
	+ $(srcdir)/services/cache/dns.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
	+ $(srcdir)/util/data/msgencode.h $(srcdir)/util/timehist.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
	+ $(srcdir)/util/alloc.h $(srcdir)/util/config_file.h $(srcdir)/util/edns.h $(srcdir)/sldns/sbuffer.h \
	+ $(srcdir)/sldns/wire2str.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
	+ $(srcdir)/services/view.h $(srcdir)/util/data/dname.h $(srcdir)/respip/respip.h \
	+ $(srcdir)/services/listen_dnsport.h
	modstack.lo modstack.o: $(srcdir)/services/modstack.c config.h $(srcdir)/services/modstack.h \
	$(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/fptr_wlist.h \
	- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/dns64/dns64.h \
	- $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h \
	- $(srcdir)/validator/val_utils.h $(srcdir)/respip/respip.h $(srcdir)/services/localzone.h \
	- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(PYTHONMOD_HEADER) \
	- $(srcdir)/cachedb/cachedb.h $(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/edns-subnet/subnetmod.h \
	- $(srcdir)/util/alloc.h $(srcdir)/util/net_help.h $(srcdir)/util/storage/slabhash.h \
	- $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h
	-view.lo view.o: $(srcdir)/services/view.c config.h $(srcdir)/services/view.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/services/localzone.h \
	- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
	$(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
	+ $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/tube.h \
	+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
	+ $(srcdir)/services/outbound_list.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
	+ $(srcdir)/respip/respip.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
	+ $(srcdir)/services/view.h $(PYTHONMOD_HEADER) $(srcdir)/ipsecmod/ipsecmod.h
	+view.lo view.o: $(srcdir)/services/view.c config.h $(srcdir)/services/view.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
	+ $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h
	outbound_list.lo outbound_list.o: $(srcdir)/services/outbound_list.c config.h \
	$(srcdir)/services/outbound_list.h $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h \
	$(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \

	outside_network.lo outside_network.o: $(srcdir)/services/outside_network.c config.h \
	$(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h $(srcdir)/util/netevent.h \
	- $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h \
	- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	+ $(srcdir)/dnscrypt/dnscrypt.h \
	$(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
	- $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
	- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
	- $(srcdir)/sldns/sbuffer.h $(srcdir)/dnstap/dnstap.h \
	+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/iterator/iterator.h \
	+ $(srcdir)/services/outbound_list.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
	+ $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
	+ $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h $(srcdir)/dnstap/dnstap.h \

	alloc.lo alloc.o: $(srcdir)/util/alloc.c config.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/regional.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
	- $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h \
	- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/services/modstack.h
	+ $(srcdir)/util/regional.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
	+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
	+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
	config_file.lo config_file.o: $(srcdir)/util/config_file.c config.h $(srcdir)/util/log.h \
	$(srcdir)/util/configyyrename.h $(srcdir)/util/config_file.h util/configparser.h \
	$(srcdir)/util/net_help.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/regional.h \
	- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
	- $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/data/dname.h $(srcdir)/util/rtt.h \
	- $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/sldns/wire2str.h \
	- $(srcdir)/sldns/parseutil.h $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/util/iana_ports.inc
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/regional.h $(srcdir)/util/fptr_wlist.h \
	+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
	+ $(srcdir)/util/data/dname.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/infra.h \
	+ $(srcdir)/util/storage/dnstree.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h \
	+ $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/util/iana_ports.inc
	configlexer.lo configlexer.o: util/configlexer.c config.h $(srcdir)/util/configyyrename.h \
	$(srcdir)/util/config_file.h util/configparser.h
	configparser.lo configparser.o: util/configparser.c config.h $(srcdir)/util/configyyrename.h \
	$(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h
	shm_main.lo shm_main.o: $(srcdir)/util/shm_side/shm_main.c config.h $(srcdir)/util/shm_side/shm_main.h \
	$(srcdir)/libunbound/unbound.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
	- $(srcdir)/daemon/worker.h \
	- $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/util/module.h \
	- $(srcdir)/dnstap/dnstap.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/cache/rrset.h \
	- $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
	- $(srcdir)/util/rtt.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
	- $(srcdir)/util/config_file.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h
	+ $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
	+ $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
	+ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
	+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h \
	+ $(srcdir)/util/timehist.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/services/mesh.h \
	+ $(srcdir)/util/rbtree.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
	+ $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
	+ $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/util/config_file.h \
	+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h
	authzone.lo authzone.o: $(srcdir)/services/authzone.c config.h $(srcdir)/services/authzone.h \
	- $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
	+ $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/data/msgparse.h \
	$(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
	$(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h \
	$(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
	$(srcdir)/util/config_file.h $(srcdir)/util/random.h $(srcdir)/services/cache/dns.h \
	$(srcdir)/services/outside_network.h \
	$(srcdir)/services/listen_dnsport.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h \
	$(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/keyraw.h \
	$(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_secalgo.h
	fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/fptr_wlist.h \
	$(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/module.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	$(srcdir)/services/modstack.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
	$(srcdir)/services/outside_network.h $(srcdir)/services/localzone.h \
	$(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/services/authzone.h \
	$(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/services/cache/rrset.h \
	$(srcdir)/util/storage/slabhash.h $(srcdir)/dns64/dns64.h $(srcdir)/iterator/iterator.h \
	$(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/validator/validator.h \
	$(srcdir)/validator/val_utils.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_nsec3.h \
	$(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_neg.h \
	$(srcdir)/validator/autotrust.h $(srcdir)/libunbound/libworker.h $(srcdir)/libunbound/context.h \
	$(srcdir)/util/alloc.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h \
	$(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/respip/respip.h \
	- $(PYTHONMOD_HEADER) $(srcdir)/cachedb/cachedb.h $(srcdir)/ipsecmod/ipsecmod.h \
	- $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/util/net_help.h $(srcdir)/edns-subnet/addrtree.h \
	- $(srcdir)/edns-subnet/edns-subnet.h
	-locks.lo locks.o: $(srcdir)/util/locks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h
	-log.lo log.o: $(srcdir)/util/log.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/sldns/sbuffer.h
	+ $(PYTHONMOD_HEADER) $(srcdir)/ipsecmod/ipsecmod.h
	+locks.lo locks.o: $(srcdir)/util/locks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
	+log.lo log.o: $(srcdir)/util/log.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/sldns/sbuffer.h
	mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
	$(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/services/modstack.h
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	+ $(srcdir)/util/log.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
	+ $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h
	module.lo module.o: $(srcdir)/util/module.c config.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
	+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
	netevent.lo netevent.o: $(srcdir)/util/netevent.c config.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/ub_event.h $(srcdir)/util/net_help.h \
	- $(srcdir)/util/tcp_conn_limit.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/util/ub_event.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/util/tcp_conn_limit.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h \
	$(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
	$(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	$(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
	$(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/dnstap/dnstap.h \
	- \
	+ $(srcdir)/services/listen_dnsport.h \

	net_help.lo net_help.o: $(srcdir)/util/net_help.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
	- $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h \
	+ $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h \
	+ $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h \

	random.lo random.o: $(srcdir)/util/random.c config.h $(srcdir)/util/random.h $(srcdir)/util/log.h
	rbtree.lo rbtree.o: $(srcdir)/util/rbtree.c config.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
	$(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/module.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	$(srcdir)/services/modstack.h
	regional.lo regional.o: $(srcdir)/util/regional.c config.h $(srcdir)/util/log.h $(srcdir)/util/regional.h
	rtt.lo rtt.o: $(srcdir)/util/rtt.c config.h $(srcdir)/util/rtt.h $(srcdir)/iterator/iterator.h \
	$(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h
	-edns.lo edns.o: $(srcdir)/util/edns.c config.h $(srcdir)/util/config_file.h $(srcdir)/util/netevent.h \
	- $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h \
	- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/regional.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h
	+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h \
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h
	+edns.lo edns.o: $(srcdir)/util/edns.c config.h $(srcdir)/util/edns.h $(srcdir)/util/config_file.h \
	+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/regional.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	+ $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/packed_rrset.h
	dnstree.lo dnstree.o: $(srcdir)/util/storage/dnstree.c config.h $(srcdir)/util/storage/dnstree.h \
	$(srcdir)/util/rbtree.h $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	- $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/net_help.h
	+ $(srcdir)/util/log.h $(srcdir)/util/net_help.h
	lookup3.lo lookup3.o: $(srcdir)/util/storage/lookup3.c config.h $(srcdir)/util/storage/lookup3.h
	lruhash.lo lruhash.o: $(srcdir)/util/storage/lruhash.c config.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/fptr_wlist.h \
	- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
	+ $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/module.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	$(srcdir)/services/modstack.h
	slabhash.lo slabhash.o: $(srcdir)/util/storage/slabhash.c config.h $(srcdir)/util/storage/slabhash.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
	tcp_conn_limit.lo tcp_conn_limit.o: $(srcdir)/util/tcp_conn_limit.c config.h $(srcdir)/util/regional.h \
	$(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/tcp_conn_limit.h \
	- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/services/localzone.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/str2wire.h
	+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/services/localzone.h \
	+ $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/sldns/str2wire.h
	timehist.lo timehist.o: $(srcdir)/util/timehist.c config.h $(srcdir)/util/timehist.h $(srcdir)/util/log.h
	tube.lo tube.o: $(srcdir)/util/tube.c config.h $(srcdir)/util/tube.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
	$(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/fptr_wlist.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/sldns/rrdef.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
	- $(srcdir)/util/ub_event.h
	+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/services/modstack.h $(srcdir)/util/ub_event.h
	ub_event.lo ub_event.o: $(srcdir)/util/ub_event.c config.h $(srcdir)/util/ub_event.h $(srcdir)/util/log.h \
	$(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/tube.h \
	- $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
	+ $(srcdir)/util/tube.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
	ub_event_pluggable.lo ub_event_pluggable.o: $(srcdir)/util/ub_event_pluggable.c config.h $(srcdir)/util/ub_event.h \
	$(srcdir)/libunbound/unbound-event.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
	- $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/util/mini_event.h \
	- $(srcdir)/util/rbtree.h
	+ $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/services/modstack.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
	winsock_event.lo winsock_event.o: $(srcdir)/util/winsock_event.c config.h
	autotrust.lo autotrust.o: $(srcdir)/validator/autotrust.c config.h $(srcdir)/validator/autotrust.h \
	$(srcdir)/util/rbtree.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/validator/val_anchor.h \
	- $(srcdir)/validator/val_utils.h $(srcdir)/sldns/pkthdr.h $(srcdir)/validator/val_sigcrypt.h \
	- $(srcdir)/util/data/dname.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h \
	- $(srcdir)/util/regional.h $(srcdir)/util/random.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
	- $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h \
	+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_utils.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/util/data/dname.h $(srcdir)/util/module.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/random.h $(srcdir)/services/mesh.h \
	+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	$(srcdir)/services/modstack.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
	$(srcdir)/validator/val_kcache.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h \
	$(srcdir)/sldns/keyraw.h \

	val_anchor.lo val_anchor.o: $(srcdir)/validator/val_anchor.c config.h $(srcdir)/validator/val_anchor.h \
	- $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/validator/val_sigcrypt.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/sldns/pkthdr.h $(srcdir)/validator/autotrust.h $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_sigcrypt.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/validator/autotrust.h $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h \
	$(srcdir)/util/config_file.h $(srcdir)/util/as112.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h \
	$(srcdir)/sldns/str2wire.h
	validator.lo validator.o: $(srcdir)/validator/validator.c config.h $(srcdir)/validator/validator.h \
	$(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h \
	$(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h $(srcdir)/validator/val_kcache.h \
	$(srcdir)/util/storage/slabhash.h $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_nsec.h \
	$(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_neg.h $(srcdir)/validator/val_sigcrypt.h \
	$(srcdir)/validator/autotrust.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
	$(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h \
	$(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
	+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
	$(srcdir)/services/modstack.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
	val_kcache.lo val_kcache.o: $(srcdir)/validator/val_kcache.c config.h $(srcdir)/validator/val_kcache.h \
	$(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/validator/val_kentry.h $(srcdir)/util/config_file.h \
	- $(srcdir)/util/data/dname.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/sldns/rrdef.h
	+ $(srcdir)/validator/val_kentry.h $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h \
	+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h
	val_kentry.lo val_kentry.o: $(srcdir)/validator/val_kentry.c config.h $(srcdir)/validator/val_kentry.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h \
	- $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
	+ $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \

	val_neg.lo val_neg.o: $(srcdir)/validator/val_neg.c config.h \
	- $(srcdir)/validator/val_neg.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/rbtree.h $(srcdir)/validator/val_nsec.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_utils.h \
	- $(srcdir)/sldns/pkthdr.h $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/validator/val_neg.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/validator/val_nsec.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
	+ $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_utils.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/net_help.h \
	$(srcdir)/util/config_file.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
	$(srcdir)/services/cache/dns.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h
	val_nsec3.lo val_nsec3.o: $(srcdir)/validator/val_nsec3.c config.h $(srcdir)/validator/val_nsec3.h \
	$(srcdir)/util/rbtree.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/validator/val_secalgo.h \
	- $(srcdir)/validator/validator.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h \
	- $(srcdir)/validator/val_kentry.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
	- $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/validator/val_nsec.h \
	- $(srcdir)/sldns/sbuffer.h
	+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_secalgo.h $(srcdir)/validator/validator.h \
	+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_kentry.h \
	+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/regional.h \
	+ $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/validator/val_nsec.h $(srcdir)/sldns/sbuffer.h
	val_nsec.lo val_nsec.o: $(srcdir)/validator/val_nsec.c config.h $(srcdir)/validator/val_nsec.h \
	$(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/validator/val_utils.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/module.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/cache/rrset.h \
	- $(srcdir)/util/storage/slabhash.h
	+ $(srcdir)/validator/val_utils.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h
	val_secalgo.lo val_secalgo.o: $(srcdir)/validator/val_secalgo.c config.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/validator/val_secalgo.h $(srcdir)/validator/val_nsec3.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/validator/val_secalgo.h \
	+ $(srcdir)/validator/val_nsec3.h $(srcdir)/util/rbtree.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
	$(srcdir)/sldns/sbuffer.h \

	val_sigcrypt.lo val_sigcrypt.o: $(srcdir)/validator/val_sigcrypt.c config.h \
	$(srcdir)/validator/val_sigcrypt.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/validator/val_secalgo.h $(srcdir)/validator/validator.h $(srcdir)/util/module.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/validator/val_utils.h $(srcdir)/util/data/dname.h $(srcdir)/util/rbtree.h $(srcdir)/util/net_help.h \
	- $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h \
	+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h $(srcdir)/validator/val_secalgo.h \
	+ $(srcdir)/validator/validator.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h \
	+ $(srcdir)/util/data/dname.h $(srcdir)/util/rbtree.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
	+ $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h \
	$(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h \

	val_utils.lo val_utils.o: $(srcdir)/validator/val_utils.c config.h $(srcdir)/validator/val_utils.h \
	$(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/validator/validator.h $(srcdir)/util/module.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_anchor.h \
	- $(srcdir)/util/rbtree.h $(srcdir)/validator/val_nsec.h $(srcdir)/validator/val_neg.h \
	- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h \
	- $(srcdir)/util/data/dname.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h \
	- $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/validator/validator.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_kentry.h \
	+ $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/validator/val_nsec.h $(srcdir)/validator/val_neg.h $(srcdir)/services/cache/rrset.h \
	+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h $(srcdir)/util/data/dname.h \
	+ $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/sldns/wire2str.h \
	+ $(srcdir)/sldns/parseutil.h
	dns64.lo dns64.o: $(srcdir)/dns64/dns64.c config.h $(srcdir)/dns64/dns64.h $(srcdir)/util/module.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h \
	$(srcdir)/util/storage/slabhash.h $(srcdir)/util/config_file.h $(srcdir)/util/fptr_wlist.h \
	$(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/services/modstack.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
	- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/str2wire.h
	-edns-subnet.lo edns-subnet.o: $(srcdir)/edns-subnet/edns-subnet.c config.h \
	- $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h
	-subnetmod.lo subnetmod.o: $(srcdir)/edns-subnet/subnetmod.c config.h $(srcdir)/edns-subnet/subnetmod.h \
	- $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/services/outbound_list.h $(srcdir)/util/alloc.h $(srcdir)/util/net_help.h \
	- $(srcdir)/util/storage/slabhash.h $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h \
	- $(srcdir)/edns-subnet/subnet-whitelist.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/services/modstack.h \
	- $(srcdir)/services/cache/dns.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h
	+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
	+ $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/data/dname.h \
	+ $(srcdir)/sldns/str2wire.h
	+edns-subnet.lo edns-subnet.o: $(srcdir)/edns-subnet/edns-subnet.c config.h
	+subnetmod.lo subnetmod.o: $(srcdir)/edns-subnet/subnetmod.c config.h
	addrtree.lo addrtree.o: $(srcdir)/edns-subnet/addrtree.c config.h $(srcdir)/util/log.h \
	$(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/edns-subnet/addrtree.h
	-subnet-whitelist.lo subnet-whitelist.o: $(srcdir)/edns-subnet/subnet-whitelist.c config.h \
	- $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
	- $(srcdir)/edns-subnet/subnet-whitelist.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h
	-cachedb.lo cachedb.o: $(srcdir)/cachedb/cachedb.c config.h $(srcdir)/cachedb/cachedb.h $(srcdir)/util/module.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/cachedb/redis.h $(srcdir)/util/regional.h \
	- $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/util/data/msgencode.h \
	- $(srcdir)/services/cache/dns.h $(srcdir)/validator/val_neg.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/validator/val_secalgo.h $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h \
	- $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/sbuffer.h
	-redis.lo redis.o: $(srcdir)/cachedb/redis.c config.h $(srcdir)/cachedb/redis.h $(srcdir)/cachedb/cachedb.h \
	- $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/alloc.h \
	- $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/edns-subnet/addrtree.h
	+subnet-whitelist.lo subnet-whitelist.o: $(srcdir)/edns-subnet/subnet-whitelist.c config.h
	+cachedb.lo cachedb.o: $(srcdir)/cachedb/cachedb.c config.h
	+redis.lo redis.o: $(srcdir)/cachedb/redis.c config.h
	respip.lo respip.o: $(srcdir)/respip/respip.c config.h $(srcdir)/services/localzone.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/storage/dnstree.h \
	- $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h $(srcdir)/services/cache/dns.h $(srcdir)/sldns/str2wire.h \
	- $(srcdir)/util/config_file.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
	+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/module.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/services/view.h \
	+ $(srcdir)/services/cache/dns.h $(srcdir)/sldns/str2wire.h $(srcdir)/util/config_file.h \
	+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
	$(srcdir)/services/modstack.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h $(srcdir)/respip/respip.h
	checklocks.lo checklocks.o: $(srcdir)/testcode/checklocks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	$(srcdir)/testcode/checklocks.h
	-dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h $(srcdir)/sldns/sbuffer.h \
	+dnstap.lo dnstap.o: $(srcdir)/dnstap/dnstap.c config.h $(srcdir)/sldns/sbuffer.h \
	$(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
	- $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h \
	- $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/storage/slabhash.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/storage/lookup3.h
	+ $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/dnstap/dnstap.h \
	+ dnstap/dnstap.pb-c.h
	+dnstap.pb-c.lo dnstap.pb-c.o: dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h \
	+
	ipsecmod.lo ipsecmod.o: $(srcdir)/ipsecmod/ipsecmod.c config.h $(srcdir)/ipsecmod/ipsecmod.h \
	$(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/ipsecmod/ipsecmod-whitelist.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/fptr_wlist.h \
	- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h \
	- $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/services/cache/dns.h \
	- $(srcdir)/sldns/wire2str.h
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/rbtree.h $(srcdir)/ipsecmod/ipsecmod-whitelist.h \
	+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
	+ $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/tube.h \
	+ $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/util/config_file.h $(srcdir)/services/cache/dns.h $(srcdir)/sldns/wire2str.h
	ipsecmod-whitelist.lo ipsecmod-whitelist.o: $(srcdir)/ipsecmod/ipsecmod-whitelist.c config.h \
	$(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	- $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/sldns/rrdef.h $(srcdir)/util/rbtree.h $(srcdir)/ipsecmod/ipsecmod-whitelist.h \
	- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h \
	- $(srcdir)/util/data/dname.h $(srcdir)/sldns/str2wire.h
	+ $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/ipsecmod/ipsecmod-whitelist.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/regional.h \
	+ $(srcdir)/util/config_file.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/str2wire.h
	unitanchor.lo unitanchor.o: $(srcdir)/testcode/unitanchor.c config.h $(srcdir)/util/log.h $(srcdir)/util/data/dname.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/testcode/unitmain.h $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h $(srcdir)/sldns/sbuffer.h \
	- $(srcdir)/sldns/rrdef.h
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/testcode/unitmain.h \
	+ $(srcdir)/validator/val_anchor.h $(srcdir)/util/rbtree.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h
	unitdname.lo unitdname.o: $(srcdir)/testcode/unitdname.c config.h $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h \
	- $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
	+ $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/sbuffer.h \
	+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
	unitlruhash.lo unitlruhash.o: $(srcdir)/testcode/unitlruhash.c config.h $(srcdir)/testcode/unitmain.h \
	- $(srcdir)/util/log.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/storage/slabhash.h
	+ $(srcdir)/util/log.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/storage/slabhash.h
	unitmain.lo unitmain.o: $(srcdir)/testcode/unitmain.c config.h \
	$(srcdir)/sldns/rrdef.h $(srcdir)/sldns/keyraw.h \
	- $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/util/rtt.h \
	- $(srcdir)/util/timehist.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/libunbound/unbound.h \
	- $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/random.h $(srcdir)/respip/respip.h $(srcdir)/services/localzone.h \
	- $(srcdir)/services/view.h
	+ $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h $(srcdir)/util/alloc.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/util/config_file.h $(srcdir)/util/rtt.h $(srcdir)/util/timehist.h $(srcdir)/iterator/iterator.h \
	+ $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/libunbound/unbound.h $(srcdir)/services/cache/infra.h \
	+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/random.h $(srcdir)/respip/respip.h \
	+ $(srcdir)/services/localzone.h $(srcdir)/services/view.h
	unitmsgparse.lo unitmsgparse.o: $(srcdir)/testcode/unitmsgparse.c config.h $(srcdir)/util/log.h \
	$(srcdir)/testcode/unitmain.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h \
	- $(srcdir)/util/data/dname.h $(srcdir)/util/alloc.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
	- $(srcdir)/testcode/readhex.h $(srcdir)/testcode/testpkts.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h \
	- $(srcdir)/sldns/wire2str.h
	+ $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
	+ $(srcdir)/util/alloc.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/testcode/readhex.h \
	+ $(srcdir)/testcode/testpkts.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
	unitneg.lo unitneg.o: $(srcdir)/testcode/unitneg.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
	$(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/dname.h $(srcdir)/testcode/unitmain.h \
	- $(srcdir)/validator/val_neg.h $(srcdir)/util/rbtree.h $(srcdir)/sldns/rrdef.h
	+ $(srcdir)/util/data/dname.h $(srcdir)/testcode/unitmain.h $(srcdir)/validator/val_neg.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/sldns/rrdef.h
	unitregional.lo unitregional.o: $(srcdir)/testcode/unitregional.c config.h $(srcdir)/testcode/unitmain.h \
	$(srcdir)/util/log.h $(srcdir)/util/regional.h
	unitslabhash.lo unitslabhash.o: $(srcdir)/testcode/unitslabhash.c config.h $(srcdir)/testcode/unitmain.h \
	- $(srcdir)/util/log.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h
	+ $(srcdir)/util/log.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h
	unitverify.lo unitverify.o: $(srcdir)/testcode/unitverify.c config.h $(srcdir)/util/log.h \
	$(srcdir)/testcode/unitmain.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h \
	$(srcdir)/validator/val_secalgo.h $(srcdir)/validator/val_nsec.h $(srcdir)/validator/val_nsec3.h \
	$(srcdir)/util/rbtree.h $(srcdir)/validator/validator.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	$(srcdir)/util/data/msgparse.h $(srcdir)/sldns/rrdef.h $(srcdir)/validator/val_utils.h \
	$(srcdir)/testcode/testpkts.h $(srcdir)/util/data/dname.h $(srcdir)/util/regional.h $(srcdir)/util/alloc.h \
	$(srcdir)/util/net_help.h $(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/keyraw.h \
	$(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
	readhex.lo readhex.o: $(srcdir)/testcode/readhex.c config.h $(srcdir)/testcode/readhex.h $(srcdir)/util/log.h \
	$(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h
	testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcode/testpkts.h \
	$(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h \
	$(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
	unitldns.lo unitldns.o: $(srcdir)/testcode/unitldns.c config.h $(srcdir)/util/log.h $(srcdir)/testcode/unitmain.h \
	$(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
	-unitecs.lo unitecs.o: $(srcdir)/testcode/unitecs.c config.h $(srcdir)/util/log.h $(srcdir)/util/module.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/testcode/unitmain.h $(srcdir)/edns-subnet/addrtree.h \
	- $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/services/outbound_list.h $(srcdir)/util/alloc.h \
	- $(srcdir)/util/net_help.h $(srcdir)/util/storage/slabhash.h $(srcdir)/edns-subnet/edns-subnet.h
	+unitecs.lo unitecs.o: $(srcdir)/testcode/unitecs.c config.h
	unitauth.lo unitauth.o: $(srcdir)/testcode/unitauth.c config.h $(srcdir)/services/authzone.h \
	- $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
	+ $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/data/msgparse.h \
	$(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h \
	$(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/modstack.h \
	- $(srcdir)/testcode/unitmain.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/services/cache/dns.h \
	- $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/sbuffer.h
	+ $(srcdir)/testcode/unitmain.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/config_file.h \
	+ $(srcdir)/services/cache/dns.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/sbuffer.h
	acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/acl_list.h \
	$(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/locks.h \
	- $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h \
	- $(srcdir)/util/net_help.h $(srcdir)/services/localzone.h $(srcdir)/util/module.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
	+ $(srcdir)/util/log.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/services/localzone.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
	cachedump.lo cachedump.o: $(srcdir)/daemon/cachedump.c config.h \
	$(srcdir)/daemon/cachedump.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
	$(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/netevent.h \
	- $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h \
	- $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
	- $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
	- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/dns.h \
	- $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h \
	- $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h $(srcdir)/iterator/iterator.h \
	- $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_utils.h \
	- $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
	- $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
	-daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
	- $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
	- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
	- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h \
	$(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h \
	$(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
	- $(srcdir)/daemon/remote.h \
	+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
	+ $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
	+ $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/util/data/dname.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
	+ $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h \
	+ $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/sldns/wire2str.h \
	+ $(srcdir)/sldns/str2wire.h
	+daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
	+ $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
	+ $(srcdir)/daemon/worker.h \
	+ $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
	+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
	$(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
	$(srcdir)/util/config_file.h $(srcdir)/util/shm_side/shm_main.h $(srcdir)/util/storage/lookup3.h \
	$(srcdir)/util/storage/slabhash.h $(srcdir)/util/tcp_conn_limit.h $(srcdir)/services/listen_dnsport.h \
	$(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
	$(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/util/random.h \
	$(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h $(srcdir)/respip/respip.h
	remote.lo remote.o: $(srcdir)/daemon/remote.c config.h \
	$(srcdir)/daemon/remote.h \
	$(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
	$(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
	- $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/daemon.h \
	+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
	+ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/daemon.h \
	$(srcdir)/services/modstack.h $(srcdir)/daemon/cachedump.h $(srcdir)/util/config_file.h \
	$(srcdir)/util/net_help.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
	$(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
	$(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/services/mesh.h $(srcdir)/services/localzone.h \
	$(srcdir)/services/view.h $(srcdir)/services/authzone.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h \
	$(srcdir)/util/data/dname.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
	$(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_anchor.h \
	$(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h \
	$(srcdir)/iterator/iter_hints.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/services/outside_network.h \
	$(srcdir)/sldns/str2wire.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h
	stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
	$(srcdir)/libunbound/unbound.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
	$(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/daemon.h \
	- $(srcdir)/services/modstack.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
	+ $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	$(srcdir)/services/outside_network.h $(srcdir)/services/listen_dnsport.h $(srcdir)/util/config_file.h \
	$(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
	$(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h \
	$(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
	$(srcdir)/util/rtt.h $(srcdir)/services/authzone.h $(srcdir)/validator/val_kcache.h \
	- $(srcdir)/validator/val_neg.h
	+ $(srcdir)/validator/val_neg.h \
	+
	unbound.lo unbound.o: $(srcdir)/daemon/unbound.c config.h $(srcdir)/util/log.h $(srcdir)/daemon/daemon.h \
	- $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
	- $(srcdir)/daemon/remote.h \
	+ $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
	+ $(srcdir)/daemon/remote.h \
	$(srcdir)/util/config_file.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
	$(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
	- $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
	+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h \
	+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/util/ub_event.h
	worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
	$(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
	$(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
	- $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/daemon.h \
	+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
	+ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/daemon.h \
	$(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
	$(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
	$(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
	$(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
	$(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
	$(srcdir)/util/rtt.h $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
	$(srcdir)/services/localzone.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
	$(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/edns.h $(srcdir)/iterator/iter_fwd.h \
	$(srcdir)/iterator/iter_hints.h $(srcdir)/validator/autotrust.h $(srcdir)/validator/val_anchor.h \
	$(srcdir)/respip/respip.h $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h \
	$(srcdir)/libunbound/libworker.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/shm_side/shm_main.h
	testbound.lo testbound.o: $(srcdir)/testcode/testbound.c config.h $(srcdir)/testcode/testpkts.h \
	$(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h \
	+ $(srcdir)/util/rbtree.h $(srcdir)/testcode/fake_event.h \
	$(srcdir)/daemon/remote.h \
	- $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/daemon/unbound.c $(srcdir)/daemon/daemon.h \
	- $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
	- $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/services/listen_dnsport.h \
	- $(srcdir)/services/cache/rrset.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h \
	- $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h \
	- $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
	+ $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/daemon/unbound.c $(srcdir)/util/log.h \
	+ $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
	+ $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h \
	+ $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
	+ $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
	+ $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
	testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcode/testpkts.h \
	$(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h \
	$(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
	worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
	$(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
	$(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
	- $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/daemon.h \
	+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
	+ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/daemon.h \
	$(srcdir)/services/modstack.h $(srcdir)/daemon/remote.h \
	$(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
	$(srcdir)/util/config_file.h $(srcdir)/util/regional.h $(srcdir)/util/storage/slabhash.h \
	$(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
	$(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h \
	$(srcdir)/util/rtt.h $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
	$(srcdir)/services/localzone.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
	$(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/edns.h $(srcdir)/iterator/iter_fwd.h \
	$(srcdir)/iterator/iter_hints.h $(srcdir)/validator/autotrust.h $(srcdir)/validator/val_anchor.h \
	$(srcdir)/respip/respip.h $(srcdir)/libunbound/context.h $(srcdir)/libunbound/unbound-event.h \
	$(srcdir)/libunbound/libworker.h $(srcdir)/sldns/wire2str.h $(srcdir)/util/shm_side/shm_main.h
	acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/acl_list.h \
	$(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/locks.h \
	- $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h \
	- $(srcdir)/util/net_help.h $(srcdir)/services/localzone.h $(srcdir)/util/module.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
	+ $(srcdir)/util/log.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/services/localzone.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/str2wire.h
	daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
	- $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
	- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
	- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h \
	- $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
	- $(srcdir)/daemon/remote.h \
	+ $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
	+ $(srcdir)/daemon/worker.h \
	+ $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
	+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
	$(srcdir)/daemon/acl_list.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h \
	$(srcdir)/util/config_file.h $(srcdir)/util/shm_side/shm_main.h $(srcdir)/util/storage/lookup3.h \
	$(srcdir)/util/storage/slabhash.h $(srcdir)/util/tcp_conn_limit.h $(srcdir)/services/listen_dnsport.h \
	$(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
	$(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/util/random.h \
	$(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h $(srcdir)/respip/respip.h
	stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
	$(srcdir)/libunbound/unbound.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
	$(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/alloc.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/daemon.h \
	- $(srcdir)/services/modstack.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
	+ $(srcdir)/daemon/daemon.h $(srcdir)/services/modstack.h $(srcdir)/services/mesh.h $(srcdir)/util/rbtree.h \
	$(srcdir)/services/outside_network.h $(srcdir)/services/listen_dnsport.h $(srcdir)/util/config_file.h \
	$(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
	$(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/services/cache/rrset.h \
	$(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
	$(srcdir)/util/rtt.h $(srcdir)/services/authzone.h $(srcdir)/validator/val_kcache.h \
	- $(srcdir)/validator/val_neg.h
	+ $(srcdir)/validator/val_neg.h \
	+
	replay.lo replay.o: $(srcdir)/testcode/replay.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
	$(srcdir)/util/config_file.h $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/testcode/testpkts.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/testcode/testpkts.h $(srcdir)/util/rbtree.h \
	$(srcdir)/testcode/fake_event.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
	fake_event.lo fake_event.o: $(srcdir)/testcode/fake_event.c config.h $(srcdir)/testcode/fake_event.h \
	$(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/net_help.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h \
	+ $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
	$(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
	$(srcdir)/util/config_file.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
	$(srcdir)/util/rbtree.h $(srcdir)/services/cache/infra.h \
	$(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h $(srcdir)/testcode/replay.h $(srcdir)/testcode/testpkts.h \
	$(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
	$(srcdir)/services/modstack.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
	lock_verify.lo lock_verify.o: $(srcdir)/testcode/lock_verify.c config.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
	- $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h
	+ $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
	+ $(srcdir)/services/modstack.h
	pktview.lo pktview.o: $(srcdir)/testcode/pktview.c config.h $(srcdir)/util/log.h $(srcdir)/util/data/dname.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/testcode/unitmain.h \
	- $(srcdir)/testcode/readhex.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/testcode/unitmain.h $(srcdir)/testcode/readhex.h $(srcdir)/sldns/sbuffer.h \
	+ $(srcdir)/sldns/parseutil.h
	readhex.lo readhex.o: $(srcdir)/testcode/readhex.c config.h $(srcdir)/testcode/readhex.h $(srcdir)/util/log.h \
	$(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parseutil.h
	memstats.lo memstats.o: $(srcdir)/testcode/memstats.c config.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h \
	- $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	- $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h
	+ $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h $(srcdir)/services/mesh.h \
	+ $(srcdir)/services/modstack.h
	unbound-checkconf.lo unbound-checkconf.o: $(srcdir)/smallapp/unbound-checkconf.c config.h $(srcdir)/util/log.h \
	$(srcdir)/util/config_file.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h \
	- $(srcdir)/util/regional.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
	- $(srcdir)/iterator/iter_fwd.h $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_hints.h \
	- $(srcdir)/util/storage/dnstree.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
	- $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
	- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/services/modstack.h $(srcdir)/respip/respip.h $(srcdir)/sldns/sbuffer.h \
	- $(PYTHONMOD_HEADER) $(srcdir)/edns-subnet/subnet-whitelist.h
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h $(srcdir)/util/regional.h \
	+ $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h \
	+ $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_hints.h $(srcdir)/util/storage/dnstree.h \
	+ $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/services/localzone.h \
	+ $(srcdir)/services/view.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
	+ $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/services/modstack.h \
	+ $(srcdir)/respip/respip.h $(srcdir)/sldns/sbuffer.h $(PYTHONMOD_HEADER)
	worker_cb.lo worker_cb.o: $(srcdir)/smallapp/worker_cb.c config.h $(srcdir)/libunbound/context.h \
	- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/libunbound/worker.h \
	- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/module.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/util/tube.h $(srcdir)/services/mesh.h
	+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
	+ $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/data/packed_rrset.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
	+ $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
	+ $(srcdir)/services/mesh.h
	context.lo context.o: $(srcdir)/libunbound/context.c config.h $(srcdir)/libunbound/context.h \
	- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h \
	- $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/services/localzone.h \
	- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/services/cache/rrset.h \
	- $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
	- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/sldns/sbuffer.h
	+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
	+ $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/data/packed_rrset.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/config_file.h \
	+ $(srcdir)/util/net_help.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
	+ $(srcdir)/services/view.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
	+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
	+ $(srcdir)/sldns/sbuffer.h
	libunbound.lo libunbound.o: $(srcdir)/libunbound/libunbound.c $(srcdir)/libunbound/unbound.h \
	$(srcdir)/libunbound/unbound-event.h config.h $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h \
	- $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
	- $(srcdir)/services/modstack.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/libunbound/libworker.h $(srcdir)/util/config_file.h $(srcdir)/util/module.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/util/regional.h $(srcdir)/util/random.h $(srcdir)/util/net_help.h $(srcdir)/util/tube.h \
	- $(srcdir)/util/ub_event.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
	- $(srcdir)/services/view.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h \
	- $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h \
	- $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/authzone.h \
	- $(srcdir)/services/mesh.h $(srcdir)/sldns/sbuffer.h
	+ $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/libunbound/libworker.h \
	+ $(srcdir)/util/config_file.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/regional.h \
	+ $(srcdir)/util/random.h $(srcdir)/util/net_help.h $(srcdir)/util/tube.h $(srcdir)/util/ub_event.h \
	+ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
	+ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/services/cache/rrset.h \
	+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
	+ $(srcdir)/sldns/sbuffer.h
	libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h \
	$(srcdir)/libunbound/libworker.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h $(srcdir)/libunbound/context.h \
	- $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound.h \
	- $(srcdir)/libunbound/unbound-event.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
	- $(srcdir)/services/outside_network.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h \
	- $(srcdir)/services/mesh.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h $(srcdir)/services/localzone.h \
	- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/services/cache/rrset.h \
	- $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h $(srcdir)/services/authzone.h \
	- $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/regional.h $(srcdir)/util/random.h \
	- $(srcdir)/util/config_file.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound.h $(srcdir)/libunbound/unbound-event.h \
	+ $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/outside_network.h \
	+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/services/mesh.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h \
	+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h \
	+ $(srcdir)/services/authzone.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/regional.h \
	+ $(srcdir)/util/random.h $(srcdir)/util/config_file.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/net_help.h \
	$(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/iterator/iter_fwd.h \
	$(srcdir)/iterator/iter_hints.h $(srcdir)/sldns/str2wire.h
	unbound-host.lo unbound-host.o: $(srcdir)/smallapp/unbound-host.c config.h $(srcdir)/libunbound/unbound.h \
	$(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h \

	asynclook.lo asynclook.o: $(srcdir)/testcode/asynclook.c config.h $(srcdir)/libunbound/unbound.h \
	- $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
	- $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/data/packed_rrset.h \
	+ $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h \
	+ $(srcdir)/services/modstack.h $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/data/packed_rrset.h \
	$(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/rrdef.h \

	streamtcp.lo streamtcp.o: $(srcdir)/testcode/streamtcp.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/net_help.h $(srcdir)/util/data/msgencode.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/dname.h \
	- $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h \
	+ $(srcdir)/util/net_help.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/msgparse.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/dname.h $(srcdir)/sldns/sbuffer.h \
	+ $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h \

	-perf.lo perf.o: $(srcdir)/testcode/perf.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h \
	- $(srcdir)/testcode/checklocks.h $(srcdir)/util/net_help.h $(srcdir)/util/data/msgencode.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/packed_rrset.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h \
	- $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
	+perf.lo perf.o: $(srcdir)/testcode/perf.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h
	delayer.lo delayer.o: $(srcdir)/testcode/delayer.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
	$(srcdir)/util/config_file.h $(srcdir)/sldns/sbuffer.h
	unbound-control.lo unbound-control.o: $(srcdir)/smallapp/unbound-control.c config.h \
	- $(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/util/locks.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/net_help.h $(srcdir)/util/shm_side/shm_main.h $(srcdir)/libunbound/unbound.h \
	- $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/pkthdr.h
	+ $(srcdir)/util/log.h $(srcdir)/util/config_file.h $(srcdir)/util/locks.h $(srcdir)/util/net_help.h \
	+ $(srcdir)/util/shm_side/shm_main.h $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/stats.h \
	+ $(srcdir)/util/timehist.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/pkthdr.h
	unbound-anchor.lo unbound-anchor.o: $(srcdir)/smallapp/unbound-anchor.c config.h $(srcdir)/libunbound/unbound.h \
	$(srcdir)/sldns/rrdef.h $(srcdir)/sldns/parseutil.h \

	petal.lo petal.o: $(srcdir)/testcode/petal.c config.h \

	pythonmod_utils.lo pythonmod_utils.o: $(srcdir)/pythonmod/pythonmod_utils.c config.h $(srcdir)/util/module.h \
	- $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h \
	- $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	- $(srcdir)/dnscrypt/cert.h $(srcdir)/util/net_help.h \
	- $(srcdir)/services/cache/dns.h $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h \
	- $(srcdir)/util/regional.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/sldns/sbuffer.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/msgreply.h \
	+ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
	+ $(srcdir)/sldns/rrdef.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/net_help.h $(srcdir)/services/cache/dns.h \
	+ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/util/regional.h \
	+ $(srcdir)/iterator/iter_delegpt.h $(srcdir)/sldns/sbuffer.h \

	win_svc.lo win_svc.o: $(srcdir)/winrc/win_svc.c config.h $(srcdir)/winrc/win_svc.h $(srcdir)/winrc/w_inst.h \
	- $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/testcode/checklocks.h \
	- $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
	- $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
	- $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h \
	- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/dnscrypt/cert.h $(srcdir)/util/data/msgreply.h \
	- $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h \
	- $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h \
	- $(srcdir)/daemon/remote.h \
	+ $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
	+ $(srcdir)/daemon/worker.h \
	+ $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
	+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
	+ $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	+ $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/util/module.h \
	+ $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/remote.h \
	$(srcdir)/util/config_file.h $(srcdir)/util/ub_event.h $(srcdir)/util/net_help.h
	w_inst.lo w_inst.o: $(srcdir)/winrc/w_inst.c config.h $(srcdir)/winrc/w_inst.h $(srcdir)/winrc/win_svc.h
	unbound-service-install.lo unbound-service-install.o: $(srcdir)/winrc/unbound-service-install.c config.h \
	$(srcdir)/winrc/w_inst.h
	unbound-service-remove.lo unbound-service-remove.o: $(srcdir)/winrc/unbound-service-remove.c config.h \
	$(srcdir)/winrc/w_inst.h
	anchor-update.lo anchor-update.o: $(srcdir)/winrc/anchor-update.c config.h $(srcdir)/libunbound/unbound.h \
	$(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/wire2str.h
	keyraw.lo keyraw.o: $(srcdir)/sldns/keyraw.c config.h $(srcdir)/sldns/keyraw.h \
	$(srcdir)/sldns/rrdef.h \

	sbuffer.lo sbuffer.o: $(srcdir)/sldns/sbuffer.c config.h $(srcdir)/sldns/sbuffer.h
	wire2str.lo wire2str.o: $(srcdir)/sldns/wire2str.c config.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h \
	$(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/sbuffer.h \
	$(srcdir)/sldns/keyraw.h \

	parse.lo parse.o: $(srcdir)/sldns/parse.c config.h $(srcdir)/sldns/parse.h $(srcdir)/sldns/parseutil.h \
	$(srcdir)/sldns/sbuffer.h
	parseutil.lo parseutil.o: $(srcdir)/sldns/parseutil.c config.h $(srcdir)/sldns/parseutil.h
	rrdef.lo rrdef.o: $(srcdir)/sldns/rrdef.c config.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/parseutil.h
	str2wire.lo str2wire.o: $(srcdir)/sldns/str2wire.c config.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h \
	$(srcdir)/sldns/wire2str.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/parse.h $(srcdir)/sldns/parseutil.h
	-ctime_r.lo ctime_r.o: $(srcdir)/compat/ctime_r.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
	- $(srcdir)/testcode/checklocks.h
	+ctime_r.lo ctime_r.o: $(srcdir)/compat/ctime_r.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
	fake-rfc2553.lo fake-rfc2553.o: $(srcdir)/compat/fake-rfc2553.c $(srcdir)/compat/fake-rfc2553.h config.h
	gmtime_r.lo gmtime_r.o: $(srcdir)/compat/gmtime_r.c config.h
	inet_aton.lo inet_aton.o: $(srcdir)/compat/inet_aton.c config.h
	inet_ntop.lo inet_ntop.o: $(srcdir)/compat/inet_ntop.c config.h
	inet_pton.lo inet_pton.o: $(srcdir)/compat/inet_pton.c config.h
	malloc.lo malloc.o: $(srcdir)/compat/malloc.c config.h
	memcmp.lo memcmp.o: $(srcdir)/compat/memcmp.c config.h
	memmove.lo memmove.o: $(srcdir)/compat/memmove.c config.h
	snprintf.lo snprintf.o: $(srcdir)/compat/snprintf.c config.h
	strlcat.lo strlcat.o: $(srcdir)/compat/strlcat.c config.h
	strlcpy.lo strlcpy.o: $(srcdir)/compat/strlcpy.c config.h
	strptime.lo strptime.o: $(srcdir)/compat/strptime.c config.h
	getentropy_linux.lo getentropy_linux.o: $(srcdir)/compat/getentropy_linux.c config.h \

	getentropy_osx.lo getentropy_osx.o: $(srcdir)/compat/getentropy_osx.c config.h
	getentropy_solaris.lo getentropy_solaris.o: $(srcdir)/compat/getentropy_solaris.c config.h \

	getentropy_win.lo getentropy_win.o: $(srcdir)/compat/getentropy_win.c
	explicit_bzero.lo explicit_bzero.o: $(srcdir)/compat/explicit_bzero.c config.h
	arc4random.lo arc4random.o: $(srcdir)/compat/arc4random.c config.h $(srcdir)/compat/chacha_private.h
	arc4random_uniform.lo arc4random_uniform.o: $(srcdir)/compat/arc4random_uniform.c config.h
	arc4_lock.lo arc4_lock.o: $(srcdir)/compat/arc4_lock.c config.h $(srcdir)/util/locks.h
	sha512.lo sha512.o: $(srcdir)/compat/sha512.c config.h
	reallocarray.lo reallocarray.o: $(srcdir)/compat/reallocarray.c config.h
	isblank.lo isblank.o: $(srcdir)/compat/isblank.c config.h
	strsep.lo strsep.o: $(srcdir)/compat/strsep.c config.h
	Index: head/contrib/unbound/README.md
	===================================================================
	--- head/contrib/unbound/README.md (nonexistent)
	+++ head/contrib/unbound/README.md (revision 349720)
	@@ -0,0 +1,37 @@
	+# Unbound
	+
	+[![Travis Build Status](https://travis-ci.org/NLnetLabs/unbound.svg?branch=master)](https://travis-ci.org/NLnetLabs/unbound)
	+[![Packaging status](https://repology.org/badge/tiny-repos/unbound.svg)](https://repology.org/project/unbound/versions)
	+
	+Unbound is a validating, recursive, caching DNS resolver. It is designed to be
	+fast and lean and incorporates modern features based on open standards. If you
	+have any feedback, we would love to hear from you. Don’t hesitate to
	+[create an issue on Github](https://github.com/NLnetLabs/unbound/issues/new)
	+or post a message on the [Unbound mailing list](https://nlnetlabs.nl/mailman/listinfo/unbound-users).
	+You can lean more about Unbound by reading our
	+[documentation](https://nlnetlabs.nl/documentation/unbound/).
	+
	+## Compiling
	+
	+Make sure you have the C toolchain, OpenSSL and its include files, and libexpat
	+installed. Unbound can be compiled and installed using:
	+
	+```
	+./configure && make && make install
	+```
	+
	+You can use libevent if you want. libevent is useful when using many (10000)
	+outgoing ports. By default max 256 ports are opened at the same time and the
	+builtin alternative is equally capable and a little faster.
	+
	+Use the `--with-libevent=dir` configure option to compile Unbound with libevent
	+support.
	+
	+## Unbound configuration
	+
	+All of Unbound's configuration options are described in the man pages, which
	+will be installed and are available on the Unbound
	+[documentation page](https://nlnetlabs.nl/documentation/unbound/).
	+
	+An example configuration file is located in
	+[doc/example.conf](https://github.com/NLnetLabs/unbound/blob/master/doc/example.conf.in).
	Index: head/contrib/unbound/aclocal.m4
	===================================================================
	--- head/contrib/unbound/aclocal.m4 (revision 349719)
	+++ head/contrib/unbound/aclocal.m4 (revision 349720)
	@@ -1,9440 +1,9440 @@
	-# generated automatically by aclocal 1.15.1 -- Autoconf --
	+# generated automatically by aclocal 1.16.1 -- Autoconf --

	-# Copyright (C) 1996-2017 Free Software Foundation, Inc.
	+# Copyright (C) 1996-2018 Free Software Foundation, Inc.

	# This file is free software; the Free Software Foundation
	# gives unlimited permission to copy and/or distribute it,
	# with or without modifications, as long as this notice is preserved.

	# This program is distributed in the hope that it will be useful,
	# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
	# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
	# PARTICULAR PURPOSE.

	m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
	# libtool.m4 - Configure libtool for the host system. --Autoconf--
	#
	# Copyright (C) 1996-2001, 2003-2015 Free Software Foundation, Inc.
	# Written by Gordon Matzigkeit, 1996
	#
	# This file is free software; the Free Software Foundation gives
	# unlimited permission to copy and/or distribute it, with or without
	# modifications, as long as this notice is preserved.

	m4_define([_LT_COPYING], [dnl
	# Copyright (C) 2014 Free Software Foundation, Inc.
	# This is free software; see the source for copying conditions. There is NO
	# warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

	# GNU Libtool is free software; you can redistribute it and/or modify
	# it under the terms of the GNU General Public License as published by
	# the Free Software Foundation; either version 2 of of the License, or
	# (at your option) any later version.
	#
	# As a special exception to the GNU General Public License, if you
	# distribute this file as part of a program or library that is built
	# using GNU Libtool, you may include this file under the same
	# distribution terms that you use for the rest of that program.
	#
	# GNU Libtool is distributed in the hope that it will be useful, but
	# WITHOUT ANY WARRANTY; without even the implied warranty of
	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	# GNU General Public License for more details.
	#
	# You should have received a copy of the GNU General Public License
	# along with this program. If not, see <http://www.gnu.org/licenses/>.
	])

	# serial 58 LT_INIT


	# LT_PREREQ(VERSION)
	# ------------------
	# Complain and exit if this libtool version is less that VERSION.
	m4_defun([LT_PREREQ],
	[m4_if(m4_version_compare(m4_defn([LT_PACKAGE_VERSION]), [$1]), -1,
	[m4_default([$3],
	[m4_fatal([Libtool version $1 or higher is required],
	63)])],
	[$2])])


	# _LT_CHECK_BUILDDIR
	# ------------------
	# Complain if the absolute build directory name contains unusual characters
	m4_defun([_LT_CHECK_BUILDDIR],
	[case `pwd` in
	\ \| \ )
	AC_MSG_WARN([Libtool does not cope well with whitespace in `pwd`]) ;;
	esac
	])


	# LT_INIT([OPTIONS])
	# ------------------
	AC_DEFUN([LT_INIT],
	[AC_PREREQ([2.62])dnl We use AC_PATH_PROGS_FEATURE_CHECK
	AC_REQUIRE([AC_CONFIG_AUX_DIR_DEFAULT])dnl
	AC_BEFORE([$0], [LT_LANG])dnl
	AC_BEFORE([$0], [LT_OUTPUT])dnl
	AC_BEFORE([$0], [LTDL_INIT])dnl
	m4_require([_LT_CHECK_BUILDDIR])dnl

	dnl Autoconf doesn't catch unexpanded LT_ macros by default:
	m4_pattern_forbid([^_?LT_[A-Z_]+$])dnl
	m4_pattern_allow([^(_LT_EOF\|LT_DLGLOBAL\|LT_DLLAZY_OR_NOW\|LT_MULTI_MODULE)$])dnl
	dnl aclocal doesn't pull ltoptions.m4, ltsugar.m4, or ltversion.m4
	dnl unless we require an AC_DEFUNed macro:
	AC_REQUIRE([LTOPTIONS_VERSION])dnl
	AC_REQUIRE([LTSUGAR_VERSION])dnl
	AC_REQUIRE([LTVERSION_VERSION])dnl
	AC_REQUIRE([LTOBSOLETE_VERSION])dnl
	m4_require([_LT_PROG_LTMAIN])dnl

	_LT_SHELL_INIT([SHELL=${CONFIG_SHELL-/bin/sh}])

	dnl Parse OPTIONS
	_LT_SET_OPTIONS([$0], [$1])

	# This can be used to rebuild libtool when needed
	LIBTOOL_DEPS=$ltmain

	# Always use our own libtool.
	LIBTOOL='$(SHELL) $(top_builddir)/libtool'
	AC_SUBST(LIBTOOL)dnl

	_LT_SETUP

	# Only expand once:
	m4_define([LT_INIT])
	])# LT_INIT

	# Old names:
	AU_ALIAS([AC_PROG_LIBTOOL], [LT_INIT])
	AU_ALIAS([AM_PROG_LIBTOOL], [LT_INIT])
	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([AC_PROG_LIBTOOL], [])
	dnl AC_DEFUN([AM_PROG_LIBTOOL], [])


	# _LT_PREPARE_CC_BASENAME
	# -----------------------
	m4_defun([_LT_PREPARE_CC_BASENAME], [
	# Calculate cc_basename. Skip known compiler wrappers and cross-prefix.
	func_cc_basename ()
	{
	for cc_temp in @S\|@*""; do
	case $cc_temp in
	compile \| [[\\/]]compile \| ccache \| [[\\/]]ccache ) ;;
	distcc \| [[\\/]]distcc \| purify \| [[\\/]]purify ) ;;
	\-*) ;;
	*) break;;
	esac
	done
	func_cc_basename_result=`$ECHO "$cc_temp" \| $SED "s%.*/%%; s%^$host_alias-%%"`
	}
	])# _LT_PREPARE_CC_BASENAME


	# _LT_CC_BASENAME(CC)
	# -------------------
	# It would be clearer to call AC_REQUIREs from _LT_PREPARE_CC_BASENAME,
	# but that macro is also expanded into generated libtool script, which
	# arranges for $SED and $ECHO to be set by different means.
	m4_defun([_LT_CC_BASENAME],
	[m4_require([_LT_PREPARE_CC_BASENAME])dnl
	AC_REQUIRE([_LT_DECL_SED])dnl
	AC_REQUIRE([_LT_PROG_ECHO_BACKSLASH])dnl
	func_cc_basename $1
	cc_basename=$func_cc_basename_result
	])


	# _LT_FILEUTILS_DEFAULTS
	# ----------------------
	# It is okay to use these file commands and assume they have been set
	# sensibly after 'm4_require([_LT_FILEUTILS_DEFAULTS])'.
	m4_defun([_LT_FILEUTILS_DEFAULTS],
	[: ${CP="cp -f"}
	: ${MV="mv -f"}
	: ${RM="rm -f"}
	])# _LT_FILEUTILS_DEFAULTS


	# _LT_SETUP
	# ---------
	m4_defun([_LT_SETUP],
	[AC_REQUIRE([AC_CANONICAL_HOST])dnl
	AC_REQUIRE([AC_CANONICAL_BUILD])dnl
	AC_REQUIRE([_LT_PREPARE_SED_QUOTE_VARS])dnl
	AC_REQUIRE([_LT_PROG_ECHO_BACKSLASH])dnl

	_LT_DECL([], [PATH_SEPARATOR], [1], [The PATH separator for the build system])dnl
	dnl
	_LT_DECL([], [host_alias], [0], [The host system])dnl
	_LT_DECL([], [host], [0])dnl
	_LT_DECL([], [host_os], [0])dnl
	dnl
	_LT_DECL([], [build_alias], [0], [The build system])dnl
	_LT_DECL([], [build], [0])dnl
	_LT_DECL([], [build_os], [0])dnl
	dnl
	AC_REQUIRE([AC_PROG_CC])dnl
	AC_REQUIRE([LT_PATH_LD])dnl
	AC_REQUIRE([LT_PATH_NM])dnl
	dnl
	AC_REQUIRE([AC_PROG_LN_S])dnl
	test -z "$LN_S" && LN_S="ln -s"
	_LT_DECL([], [LN_S], [1], [Whether we need soft or hard links])dnl
	dnl
	AC_REQUIRE([LT_CMD_MAX_LEN])dnl
	_LT_DECL([objext], [ac_objext], [0], [Object file suffix (normally "o")])dnl
	_LT_DECL([], [exeext], [0], [Executable file suffix (normally "")])dnl
	dnl
	m4_require([_LT_FILEUTILS_DEFAULTS])dnl
	m4_require([_LT_CHECK_SHELL_FEATURES])dnl
	m4_require([_LT_PATH_CONVERSION_FUNCTIONS])dnl
	m4_require([_LT_CMD_RELOAD])dnl
	m4_require([_LT_CHECK_MAGIC_METHOD])dnl
	m4_require([_LT_CHECK_SHAREDLIB_FROM_LINKLIB])dnl
	m4_require([_LT_CMD_OLD_ARCHIVE])dnl
	m4_require([_LT_CMD_GLOBAL_SYMBOLS])dnl
	m4_require([_LT_WITH_SYSROOT])dnl
	m4_require([_LT_CMD_TRUNCATE])dnl

	_LT_CONFIG_LIBTOOL_INIT([
	# See if we are running on zsh, and set the options that allow our
	# commands through without removal of \ escapes INIT.
	if test -n "\${ZSH_VERSION+set}"; then
	setopt NO_GLOB_SUBST
	fi
	])
	if test -n "${ZSH_VERSION+set}"; then
	setopt NO_GLOB_SUBST
	fi

	_LT_CHECK_OBJDIR

	m4_require([_LT_TAG_COMPILER])dnl

	case $host_os in
	aix3*)
	# AIX sometimes has problems with the GCC collect2 program. For some
	# reason, if we set the COLLECT_NAMES environment variable, the problems
	# vanish in a puff of smoke.
	if test set != "${COLLECT_NAMES+set}"; then
	COLLECT_NAMES=
	export COLLECT_NAMES
	fi
	;;
	esac

	# Global variables:
	ofile=libtool
	can_build_shared=yes

	# All known linkers require a '.a' archive for static linking (except MSVC,
	# which needs '.lib').
	libext=a

	with_gnu_ld=$lt_cv_prog_gnu_ld

	old_CC=$CC
	old_CFLAGS=$CFLAGS

	# Set sane defaults for various variables
	test -z "$CC" && CC=cc
	test -z "$LTCC" && LTCC=$CC
	test -z "$LTCFLAGS" && LTCFLAGS=$CFLAGS
	test -z "$LD" && LD=ld
	test -z "$ac_objext" && ac_objext=o

	_LT_CC_BASENAME([$compiler])

	# Only perform the check for file, if the check method requires it
	test -z "$MAGIC_CMD" && MAGIC_CMD=file
	case $deplibs_check_method in
	file_magic*)
	if test "$file_magic_cmd" = '$MAGIC_CMD'; then
	_LT_PATH_MAGIC
	fi
	;;
	esac

	# Use C for the default configuration in the libtool script
	LT_SUPPORTED_TAG([CC])
	_LT_LANG_C_CONFIG
	_LT_LANG_DEFAULT_CONFIG
	_LT_CONFIG_COMMANDS
	])# _LT_SETUP


	# _LT_PREPARE_SED_QUOTE_VARS
	# --------------------------
	# Define a few sed substitution that help us do robust quoting.
	m4_defun([_LT_PREPARE_SED_QUOTE_VARS],
	[# Backslashify metacharacters that are still active within
	# double-quoted strings.
	sed_quote_subst='s/$[["`$\\]]$/\\\1/g'

	# Same as above, but do not quote variable references.
	double_quote_subst='s/$[["`\\]]$/\\\1/g'

	# Sed substitution to delay expansion of an escaped shell variable in a
	# double_quote_subst'ed string.
	delay_variable_subst='s/\\\\\\\\\\\$/\\\\\\$/g'

	# Sed substitution to delay expansion of an escaped single quote.
	delay_single_quote_subst='s/'\''/'\'\\\\\\\'\''/g'

	# Sed substitution to avoid accidental globbing in evaled expressions
	no_glob_subst='s/\/\\\/g'
	])

	# _LT_PROG_LTMAIN
	# ---------------
	# Note that this code is called both from 'configure', and 'config.status'
	# now that we use AC_CONFIG_COMMANDS to generate libtool. Notably,
	# 'config.status' has no value for ac_aux_dir unless we are using Automake,
	# so we pass a copy along to make sure it has a sensible value anyway.
	m4_defun([_LT_PROG_LTMAIN],
	[m4_ifdef([AC_REQUIRE_AUX_FILE], [AC_REQUIRE_AUX_FILE([ltmain.sh])])dnl
	_LT_CONFIG_LIBTOOL_INIT([ac_aux_dir='$ac_aux_dir'])
	ltmain=$ac_aux_dir/ltmain.sh
	])# _LT_PROG_LTMAIN



	# So that we can recreate a full libtool script including additional
	# tags, we accumulate the chunks of code to send to AC_CONFIG_COMMANDS
	# in macros and then make a single call at the end using the 'libtool'
	# label.


	# _LT_CONFIG_LIBTOOL_INIT([INIT-COMMANDS])
	# ----------------------------------------
	# Register INIT-COMMANDS to be passed to AC_CONFIG_COMMANDS later.
	m4_define([_LT_CONFIG_LIBTOOL_INIT],
	[m4_ifval([$1],
	[m4_append([_LT_OUTPUT_LIBTOOL_INIT],
	[$1
	])])])

	# Initialize.
	m4_define([_LT_OUTPUT_LIBTOOL_INIT])


	# _LT_CONFIG_LIBTOOL([COMMANDS])
	# ------------------------------
	# Register COMMANDS to be passed to AC_CONFIG_COMMANDS later.
	m4_define([_LT_CONFIG_LIBTOOL],
	[m4_ifval([$1],
	[m4_append([_LT_OUTPUT_LIBTOOL_COMMANDS],
	[$1
	])])])

	# Initialize.
	m4_define([_LT_OUTPUT_LIBTOOL_COMMANDS])


	# _LT_CONFIG_SAVE_COMMANDS([COMMANDS], [INIT_COMMANDS])
	# -----------------------------------------------------
	m4_defun([_LT_CONFIG_SAVE_COMMANDS],
	[_LT_CONFIG_LIBTOOL([$1])
	_LT_CONFIG_LIBTOOL_INIT([$2])
	])


	# _LT_FORMAT_COMMENT([COMMENT])
	# -----------------------------
	# Add leading comment marks to the start of each line, and a trailing
	# full-stop to the whole comment if one is not present already.
	m4_define([_LT_FORMAT_COMMENT],
	[m4_ifval([$1], [
	m4_bpatsubst([m4_bpatsubst([$1], [^ *], [# ])],
	[['`$\]], [\\\&])]m4_bmatch([$1], [[!?.]$], [], [.])
	)])





	# _LT_DECL([CONFIGNAME], VARNAME, VALUE, [DESCRIPTION], [IS-TAGGED?])
	# -------------------------------------------------------------------
	# CONFIGNAME is the name given to the value in the libtool script.
	# VARNAME is the (base) name used in the configure script.
	# VALUE may be 0, 1 or 2 for a computed quote escaped value based on
	# VARNAME. Any other value will be used directly.
	m4_define([_LT_DECL],
	[lt_if_append_uniq([lt_decl_varnames], [$2], [, ],
	[lt_dict_add_subkey([lt_decl_dict], [$2], [libtool_name],
	[m4_ifval([$1], [$1], [$2])])
	lt_dict_add_subkey([lt_decl_dict], [$2], [value], [$3])
	m4_ifval([$4],
	[lt_dict_add_subkey([lt_decl_dict], [$2], [description], [$4])])
	lt_dict_add_subkey([lt_decl_dict], [$2],
	[tagged?], [m4_ifval([$5], [yes], [no])])])
	])


	# _LT_TAGDECL([CONFIGNAME], VARNAME, VALUE, [DESCRIPTION])
	# --------------------------------------------------------
	m4_define([_LT_TAGDECL], [_LT_DECL([$1], [$2], [$3], [$4], [yes])])


	# lt_decl_tag_varnames([SEPARATOR], [VARNAME1...])
	# ------------------------------------------------
	m4_define([lt_decl_tag_varnames],
	[_lt_decl_filter([tagged?], [yes], $@)])


	# _lt_decl_filter(SUBKEY, VALUE, [SEPARATOR], [VARNAME1..])
	# ---------------------------------------------------------
	m4_define([_lt_decl_filter],
	[m4_case([$#],
	[0], [m4_fatal([$0: too few arguments: $#])],
	[1], [m4_fatal([$0: too few arguments: $#: $1])],
	[2], [lt_dict_filter([lt_decl_dict], [$1], [$2], [], lt_decl_varnames)],
	[3], [lt_dict_filter([lt_decl_dict], [$1], [$2], [$3], lt_decl_varnames)],
	[lt_dict_filter([lt_decl_dict], $@)])[]dnl
	])


	# lt_decl_quote_varnames([SEPARATOR], [VARNAME1...])
	# --------------------------------------------------
	m4_define([lt_decl_quote_varnames],
	[_lt_decl_filter([value], [1], $@)])


	# lt_decl_dquote_varnames([SEPARATOR], [VARNAME1...])
	# ---------------------------------------------------
	m4_define([lt_decl_dquote_varnames],
	[_lt_decl_filter([value], [2], $@)])


	# lt_decl_varnames_tagged([SEPARATOR], [VARNAME1...])
	# ---------------------------------------------------
	m4_define([lt_decl_varnames_tagged],
	[m4_assert([$# <= 2])dnl
	_$0(m4_quote(m4_default([$1], [[, ]])),
	m4_ifval([$2], [[$2]], [m4_dquote(lt_decl_tag_varnames)]),
	m4_split(m4_normalize(m4_quote(_LT_TAGS)), [ ]))])
	m4_define([_lt_decl_varnames_tagged],
	[m4_ifval([$3], [lt_combine([$1], [$2], [_], $3)])])


	# lt_decl_all_varnames([SEPARATOR], [VARNAME1...])
	# ------------------------------------------------
	m4_define([lt_decl_all_varnames],
	[_$0(m4_quote(m4_default([$1], [[, ]])),
	m4_if([$2], [],
	m4_quote(lt_decl_varnames),
	m4_quote(m4_shift($@))))[]dnl
	])
	m4_define([_lt_decl_all_varnames],
	[lt_join($@, lt_decl_varnames_tagged([$1],
	lt_decl_tag_varnames([[, ]], m4_shift($@))))dnl
	])


	# _LT_CONFIG_STATUS_DECLARE([VARNAME])
	# ------------------------------------
	# Quote a variable value, and forward it to 'config.status' so that its
	# declaration there will have the same value as in 'configure'. VARNAME
	# must have a single quote delimited value for this to work.
	m4_define([_LT_CONFIG_STATUS_DECLARE],
	[$1='`$ECHO "$][$1" \| $SED "$delay_single_quote_subst"`'])


	# _LT_CONFIG_STATUS_DECLARATIONS
	# ------------------------------
	# We delimit libtool config variables with single quotes, so when
	# we write them to config.status, we have to be sure to quote all
	# embedded single quotes properly. In configure, this macro expands
	# each variable declared with _LT_DECL (and _LT_TAGDECL) into:
	#
	# <var>='`$ECHO "$<var>" \| $SED "$delay_single_quote_subst"`'
	m4_defun([_LT_CONFIG_STATUS_DECLARATIONS],
	[m4_foreach([_lt_var], m4_quote(lt_decl_all_varnames),
	[m4_n([_LT_CONFIG_STATUS_DECLARE(_lt_var)])])])


	# _LT_LIBTOOL_TAGS
	# ----------------
	# Output comment and list of tags supported by the script
	m4_defun([_LT_LIBTOOL_TAGS],
	[_LT_FORMAT_COMMENT([The names of the tagged configurations supported by this script])dnl
	available_tags='_LT_TAGS'dnl
	])


	# _LT_LIBTOOL_DECLARE(VARNAME, [TAG])
	# -----------------------------------
	# Extract the dictionary values for VARNAME (optionally with TAG) and
	# expand to a commented shell variable setting:
	#
	# # Some comment about what VAR is for.
	# visible_name=$lt_internal_name
	m4_define([_LT_LIBTOOL_DECLARE],
	[_LT_FORMAT_COMMENT(m4_quote(lt_dict_fetch([lt_decl_dict], [$1],
	[description])))[]dnl
	m4_pushdef([_libtool_name],
	m4_quote(lt_dict_fetch([lt_decl_dict], [$1], [libtool_name])))[]dnl
	m4_case(m4_quote(lt_dict_fetch([lt_decl_dict], [$1], [value])),
	[0], [_libtool_name=[$]$1],
	[1], [_libtool_name=$lt_[]$1],
	[2], [_libtool_name=$lt_[]$1],
	[_libtool_name=lt_dict_fetch([lt_decl_dict], [$1], [value])])[]dnl
	m4_ifval([$2], [_$2])[]m4_popdef([_libtool_name])[]dnl
	])


	# _LT_LIBTOOL_CONFIG_VARS
	# -----------------------
	# Produce commented declarations of non-tagged libtool config variables
	# suitable for insertion in the LIBTOOL CONFIG section of the 'libtool'
	# script. Tagged libtool config variables (even for the LIBTOOL CONFIG
	# section) are produced by _LT_LIBTOOL_TAG_VARS.
	m4_defun([_LT_LIBTOOL_CONFIG_VARS],
	[m4_foreach([_lt_var],
	m4_quote(_lt_decl_filter([tagged?], [no], [], lt_decl_varnames)),
	[m4_n([_LT_LIBTOOL_DECLARE(_lt_var)])])])


	# _LT_LIBTOOL_TAG_VARS(TAG)
	# -------------------------
	m4_define([_LT_LIBTOOL_TAG_VARS],
	[m4_foreach([_lt_var], m4_quote(lt_decl_tag_varnames),
	[m4_n([_LT_LIBTOOL_DECLARE(_lt_var, [$1])])])])


	# _LT_TAGVAR(VARNAME, [TAGNAME])
	# ------------------------------
	m4_define([_LT_TAGVAR], [m4_ifval([$2], [$1_$2], [$1])])


	# _LT_CONFIG_COMMANDS
	# -------------------
	# Send accumulated output to $CONFIG_STATUS. Thanks to the lists of
	# variables for single and double quote escaping we saved from calls
	# to _LT_DECL, we can put quote escaped variables declarations
	# into 'config.status', and then the shell code to quote escape them in
	# for loops in 'config.status'. Finally, any additional code accumulated
	# from calls to _LT_CONFIG_LIBTOOL_INIT is expanded.
	m4_defun([_LT_CONFIG_COMMANDS],
	[AC_PROVIDE_IFELSE([LT_OUTPUT],
	dnl If the libtool generation code has been placed in $CONFIG_LT,
	dnl instead of duplicating it all over again into config.status,
	dnl then we will have config.status run $CONFIG_LT later, so it
	dnl needs to know what name is stored there:
	[AC_CONFIG_COMMANDS([libtool],
	[$SHELL $CONFIG_LT \|\| AS_EXIT(1)], [CONFIG_LT='$CONFIG_LT'])],
	dnl If the libtool generation code is destined for config.status,
	dnl expand the accumulated commands and init code now:
	[AC_CONFIG_COMMANDS([libtool],
	[_LT_OUTPUT_LIBTOOL_COMMANDS], [_LT_OUTPUT_LIBTOOL_COMMANDS_INIT])])
	])#_LT_CONFIG_COMMANDS


	# Initialize.
	m4_define([_LT_OUTPUT_LIBTOOL_COMMANDS_INIT],
	[

	# The HP-UX ksh and POSIX shell print the target directory to stdout
	# if CDPATH is set.
	(unset CDPATH) >/dev/null 2>&1 && unset CDPATH

	sed_quote_subst='$sed_quote_subst'
	double_quote_subst='$double_quote_subst'
	delay_variable_subst='$delay_variable_subst'
	_LT_CONFIG_STATUS_DECLARATIONS
	LTCC='$LTCC'
	LTCFLAGS='$LTCFLAGS'
	compiler='$compiler_DEFAULT'

	# A function that is used when there is no print builtin or printf.
	func_fallback_echo ()
	{
	eval 'cat <<_LTECHO_EOF
	\$[]1
	_LTECHO_EOF'
	}

	# Quote evaled strings.
	for var in lt_decl_all_varnames([[ \
	]], lt_decl_quote_varnames); do
	case \`eval \\\\\$ECHO \\\\""\\\\\$\$var"\\\\"\` in
	[[\\\\\\\`\\"\\\$]])
	eval "lt_\$var=\\\\\\"\\\`\\\$ECHO \\"\\\$\$var\\" \| \\\$SED \\"\\\$sed_quote_subst\\"\\\`\\\\\\"" ## exclude from sc_prohibit_nested_quotes
	;;
	*)
	eval "lt_\$var=\\\\\\"\\\$\$var\\\\\\""
	;;
	esac
	done

	# Double-quote double-evaled strings.
	for var in lt_decl_all_varnames([[ \
	]], lt_decl_dquote_varnames); do
	case \`eval \\\\\$ECHO \\\\""\\\\\$\$var"\\\\"\` in
	[[\\\\\\\`\\"\\\$]])
	eval "lt_\$var=\\\\\\"\\\`\\\$ECHO \\"\\\$\$var\\" \| \\\$SED -e \\"\\\$double_quote_subst\\" -e \\"\\\$sed_quote_subst\\" -e \\"\\\$delay_variable_subst\\"\\\`\\\\\\"" ## exclude from sc_prohibit_nested_quotes
	;;
	*)
	eval "lt_\$var=\\\\\\"\\\$\$var\\\\\\""
	;;
	esac
	done

	_LT_OUTPUT_LIBTOOL_INIT
	])

	# _LT_GENERATED_FILE_INIT(FILE, [COMMENT])
	# ------------------------------------
	# Generate a child script FILE with all initialization necessary to
	# reuse the environment learned by the parent script, and make the
	# file executable. If COMMENT is supplied, it is inserted after the
	# '#!' sequence but before initialization text begins. After this
	# macro, additional text can be appended to FILE to form the body of
	# the child script. The macro ends with non-zero status if the
	# file could not be fully written (such as if the disk is full).
	m4_ifdef([AS_INIT_GENERATED],
	[m4_defun([_LT_GENERATED_FILE_INIT],[AS_INIT_GENERATED($@)])],
	[m4_defun([_LT_GENERATED_FILE_INIT],
	[m4_require([AS_PREPARE])]dnl
	[m4_pushdef([AS_MESSAGE_LOG_FD])]dnl
	[lt_write_fail=0
	cat >$1 <<_ASEOF \|\| lt_write_fail=1
	#! $SHELL
	# Generated by $as_me.
	$2
	SHELL=\${CONFIG_SHELL-$SHELL}
	export SHELL
	_ASEOF
	cat >>$1 <<\_ASEOF \|\| lt_write_fail=1
	AS_SHELL_SANITIZE
	_AS_PREPARE
	exec AS_MESSAGE_FD>&1
	_ASEOF
	test 0 = "$lt_write_fail" && chmod +x $1[]dnl
	m4_popdef([AS_MESSAGE_LOG_FD])])])# _LT_GENERATED_FILE_INIT

	# LT_OUTPUT
	# ---------
	# This macro allows early generation of the libtool script (before
	# AC_OUTPUT is called), incase it is used in configure for compilation
	# tests.
	AC_DEFUN([LT_OUTPUT],
	[: ${CONFIG_LT=./config.lt}
	AC_MSG_NOTICE([creating $CONFIG_LT])
	_LT_GENERATED_FILE_INIT(["$CONFIG_LT"],
	[# Run this file to recreate a libtool stub with the current configuration.])

	cat >>"$CONFIG_LT" <<\_LTEOF
	lt_cl_silent=false
	exec AS_MESSAGE_LOG_FD>>config.log
	{
	echo
	AS_BOX([Running $as_me.])
	} >&AS_MESSAGE_LOG_FD

	lt_cl_help="\
	'$as_me' creates a local libtool stub from the current configuration,
	for use in further configure time tests before the real libtool is
	generated.

	Usage: $[0] [[OPTIONS]]

	-h, --help print this help, then exit
	-V, --version print version number, then exit
	-q, --quiet do not print progress messages
	-d, --debug don't remove temporary files

	Report bugs to <bug-libtool@gnu.org>."

	lt_cl_version="\
	m4_ifset([AC_PACKAGE_NAME], [AC_PACKAGE_NAME ])config.lt[]dnl
	m4_ifset([AC_PACKAGE_VERSION], [ AC_PACKAGE_VERSION])
	configured by $[0], generated by m4_PACKAGE_STRING.

	Copyright (C) 2011 Free Software Foundation, Inc.
	This config.lt script is free software; the Free Software Foundation
	gives unlimited permision to copy, distribute and modify it."

	while test 0 != $[#]
	do
	case $[1] in
	--version \| --v* \| -V )
	echo "$lt_cl_version"; exit 0 ;;
	--help \| --h* \| -h )
	echo "$lt_cl_help"; exit 0 ;;
	--debug \| --d* \| -d )
	debug=: ;;
	--quiet \| --q* \| --silent \| --s* \| -q )
	lt_cl_silent=: ;;

	-*) AC_MSG_ERROR([unrecognized option: $[1]
	Try '$[0] --help' for more information.]) ;;

	*) AC_MSG_ERROR([unrecognized argument: $[1]
	Try '$[0] --help' for more information.]) ;;
	esac
	shift
	done

	if $lt_cl_silent; then
	exec AS_MESSAGE_FD>/dev/null
	fi
	_LTEOF

	cat >>"$CONFIG_LT" <<_LTEOF
	_LT_OUTPUT_LIBTOOL_COMMANDS_INIT
	_LTEOF

	cat >>"$CONFIG_LT" <<\_LTEOF
	AC_MSG_NOTICE([creating $ofile])
	_LT_OUTPUT_LIBTOOL_COMMANDS
	AS_EXIT(0)
	_LTEOF
	chmod +x "$CONFIG_LT"

	# configure is writing to config.log, but config.lt does its own redirection,
	# appending to config.log, which fails on DOS, as config.log is still kept
	# open by configure. Here we exec the FD to /dev/null, effectively closing
	# config.log, so it can be properly (re)opened and appended to by config.lt.
	lt_cl_success=:
	test yes = "$silent" &&
	lt_config_lt_args="$lt_config_lt_args --quiet"
	exec AS_MESSAGE_LOG_FD>/dev/null
	$SHELL "$CONFIG_LT" $lt_config_lt_args \|\| lt_cl_success=false
	exec AS_MESSAGE_LOG_FD>>config.log
	$lt_cl_success \|\| AS_EXIT(1)
	])# LT_OUTPUT


	# _LT_CONFIG(TAG)
	# ---------------
	# If TAG is the built-in tag, create an initial libtool script with a
	# default configuration from the untagged config vars. Otherwise add code
	# to config.status for appending the configuration named by TAG from the
	# matching tagged config vars.
	m4_defun([_LT_CONFIG],
	[m4_require([_LT_FILEUTILS_DEFAULTS])dnl
	_LT_CONFIG_SAVE_COMMANDS([
	m4_define([_LT_TAG], m4_if([$1], [], [C], [$1]))dnl
	m4_if(_LT_TAG, [C], [
	# See if we are running on zsh, and set the options that allow our
	# commands through without removal of \ escapes.
	if test -n "${ZSH_VERSION+set}"; then
	setopt NO_GLOB_SUBST
	fi

	cfgfile=${ofile}T
	trap "$RM \"$cfgfile\"; exit 1" 1 2 15
	$RM "$cfgfile"

	cat <<_LT_EOF >> "$cfgfile"
	#! $SHELL
	# Generated automatically by $as_me ($PACKAGE) $VERSION
	# Libtool was configured on host `(hostname \|\| uname -n) 2>/dev/null \| sed 1q`:
	# NOTE: Changes made to this file will be lost: look at ltmain.sh.

	# Provide generalized library-building support services.
	# Written by Gordon Matzigkeit, 1996

	_LT_COPYING
	_LT_LIBTOOL_TAGS

	# Configured defaults for sys_lib_dlsearch_path munging.
	: \${LT_SYS_LIBRARY_PATH="$configure_time_lt_sys_library_path"}

	# ### BEGIN LIBTOOL CONFIG
	_LT_LIBTOOL_CONFIG_VARS
	_LT_LIBTOOL_TAG_VARS
	# ### END LIBTOOL CONFIG

	_LT_EOF

	cat <<'_LT_EOF' >> "$cfgfile"

	# ### BEGIN FUNCTIONS SHARED WITH CONFIGURE

	_LT_PREPARE_MUNGE_PATH_LIST
	_LT_PREPARE_CC_BASENAME

	# ### END FUNCTIONS SHARED WITH CONFIGURE

	_LT_EOF

	case $host_os in
	aix3*)
	cat <<\_LT_EOF >> "$cfgfile"
	# AIX sometimes has problems with the GCC collect2 program. For some
	# reason, if we set the COLLECT_NAMES environment variable, the problems
	# vanish in a puff of smoke.
	if test set != "${COLLECT_NAMES+set}"; then
	COLLECT_NAMES=
	export COLLECT_NAMES
	fi
	_LT_EOF
	;;
	esac

	_LT_PROG_LTMAIN

	# We use sed instead of cat because bash on DJGPP gets confused if
	# if finds mixed CR/LF and LF-only lines. Since sed operates in
	# text mode, it properly converts lines to CR/LF. This bash problem
	# is reportedly fixed, but why not run on old versions too?
	sed '$q' "$ltmain" >> "$cfgfile" \
	\|\| (rm -f "$cfgfile"; exit 1)

	mv -f "$cfgfile" "$ofile" \|\|
	(rm -f "$ofile" && cp "$cfgfile" "$ofile" && rm -f "$cfgfile")
	chmod +x "$ofile"
	],
	[cat <<_LT_EOF >> "$ofile"

	dnl Unfortunately we have to use $1 here, since _LT_TAG is not expanded
	dnl in a comment (ie after a #).
	# ### BEGIN LIBTOOL TAG CONFIG: $1
	_LT_LIBTOOL_TAG_VARS(_LT_TAG)
	# ### END LIBTOOL TAG CONFIG: $1
	_LT_EOF
	])dnl /m4_if
	],
	[m4_if([$1], [], [
	PACKAGE='$PACKAGE'
	VERSION='$VERSION'
	RM='$RM'
	ofile='$ofile'], [])
	])dnl /_LT_CONFIG_SAVE_COMMANDS
	])# _LT_CONFIG


	# LT_SUPPORTED_TAG(TAG)
	# ---------------------
	# Trace this macro to discover what tags are supported by the libtool
	# --tag option, using:
	# autoconf --trace 'LT_SUPPORTED_TAG:$1'
	AC_DEFUN([LT_SUPPORTED_TAG], [])


	# C support is built-in for now
	m4_define([_LT_LANG_C_enabled], [])
	m4_define([_LT_TAGS], [])


	# LT_LANG(LANG)
	# -------------
	# Enable libtool support for the given language if not already enabled.
	AC_DEFUN([LT_LANG],
	[AC_BEFORE([$0], [LT_OUTPUT])dnl
	m4_case([$1],
	[C], [_LT_LANG(C)],
	[C++], [_LT_LANG(CXX)],
	[Go], [_LT_LANG(GO)],
	[Java], [_LT_LANG(GCJ)],
	[Fortran 77], [_LT_LANG(F77)],
	[Fortran], [_LT_LANG(FC)],
	[Windows Resource], [_LT_LANG(RC)],
	[m4_ifdef([_LT_LANG_]$1[_CONFIG],
	[_LT_LANG($1)],
	[m4_fatal([$0: unsupported language: "$1"])])])dnl
	])# LT_LANG


	# _LT_LANG(LANGNAME)
	# ------------------
	m4_defun([_LT_LANG],
	[m4_ifdef([_LT_LANG_]$1[_enabled], [],
	[LT_SUPPORTED_TAG([$1])dnl
	m4_append([_LT_TAGS], [$1 ])dnl
	m4_define([_LT_LANG_]$1[_enabled], [])dnl
	_LT_LANG_$1_CONFIG($1)])dnl
	])# _LT_LANG


	m4_ifndef([AC_PROG_GO], [
	# NOTE: This macro has been submitted for inclusion into #
	# GNU Autoconf as AC_PROG_GO. When it is available in #
	# a released version of Autoconf we should remove this #
	# macro and use it instead. #
	m4_defun([AC_PROG_GO],
	[AC_LANG_PUSH(Go)dnl
	AC_ARG_VAR([GOC], [Go compiler command])dnl
	AC_ARG_VAR([GOFLAGS], [Go compiler flags])dnl
	_AC_ARG_VAR_LDFLAGS()dnl
	AC_CHECK_TOOL(GOC, gccgo)
	if test -z "$GOC"; then
	if test -n "$ac_tool_prefix"; then
	AC_CHECK_PROG(GOC, [${ac_tool_prefix}gccgo], [${ac_tool_prefix}gccgo])
	fi
	fi
	if test -z "$GOC"; then
	AC_CHECK_PROG(GOC, gccgo, gccgo, false)
	fi
	])#m4_defun
	])#m4_ifndef


	# _LT_LANG_DEFAULT_CONFIG
	# -----------------------
	m4_defun([_LT_LANG_DEFAULT_CONFIG],
	[AC_PROVIDE_IFELSE([AC_PROG_CXX],
	[LT_LANG(CXX)],
	[m4_define([AC_PROG_CXX], defn([AC_PROG_CXX])[LT_LANG(CXX)])])

	AC_PROVIDE_IFELSE([AC_PROG_F77],
	[LT_LANG(F77)],
	[m4_define([AC_PROG_F77], defn([AC_PROG_F77])[LT_LANG(F77)])])

	AC_PROVIDE_IFELSE([AC_PROG_FC],
	[LT_LANG(FC)],
	[m4_define([AC_PROG_FC], defn([AC_PROG_FC])[LT_LANG(FC)])])

	dnl The call to [A][M_PROG_GCJ] is quoted like that to stop aclocal
	dnl pulling things in needlessly.
	AC_PROVIDE_IFELSE([AC_PROG_GCJ],
	[LT_LANG(GCJ)],
	[AC_PROVIDE_IFELSE([A][M_PROG_GCJ],
	[LT_LANG(GCJ)],
	[AC_PROVIDE_IFELSE([LT_PROG_GCJ],
	[LT_LANG(GCJ)],
	[m4_ifdef([AC_PROG_GCJ],
	[m4_define([AC_PROG_GCJ], defn([AC_PROG_GCJ])[LT_LANG(GCJ)])])
	m4_ifdef([A][M_PROG_GCJ],
	[m4_define([A][M_PROG_GCJ], defn([A][M_PROG_GCJ])[LT_LANG(GCJ)])])
	m4_ifdef([LT_PROG_GCJ],
	[m4_define([LT_PROG_GCJ], defn([LT_PROG_GCJ])[LT_LANG(GCJ)])])])])])

	AC_PROVIDE_IFELSE([AC_PROG_GO],
	[LT_LANG(GO)],
	[m4_define([AC_PROG_GO], defn([AC_PROG_GO])[LT_LANG(GO)])])

	AC_PROVIDE_IFELSE([LT_PROG_RC],
	[LT_LANG(RC)],
	[m4_define([LT_PROG_RC], defn([LT_PROG_RC])[LT_LANG(RC)])])
	])# _LT_LANG_DEFAULT_CONFIG

	# Obsolete macros:
	AU_DEFUN([AC_LIBTOOL_CXX], [LT_LANG(C++)])
	AU_DEFUN([AC_LIBTOOL_F77], [LT_LANG(Fortran 77)])
	AU_DEFUN([AC_LIBTOOL_FC], [LT_LANG(Fortran)])
	AU_DEFUN([AC_LIBTOOL_GCJ], [LT_LANG(Java)])
	AU_DEFUN([AC_LIBTOOL_RC], [LT_LANG(Windows Resource)])
	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([AC_LIBTOOL_CXX], [])
	dnl AC_DEFUN([AC_LIBTOOL_F77], [])
	dnl AC_DEFUN([AC_LIBTOOL_FC], [])
	dnl AC_DEFUN([AC_LIBTOOL_GCJ], [])
	dnl AC_DEFUN([AC_LIBTOOL_RC], [])


	# _LT_TAG_COMPILER
	# ----------------
	m4_defun([_LT_TAG_COMPILER],
	[AC_REQUIRE([AC_PROG_CC])dnl

	_LT_DECL([LTCC], [CC], [1], [A C compiler])dnl
	_LT_DECL([LTCFLAGS], [CFLAGS], [1], [LTCC compiler flags])dnl
	_LT_TAGDECL([CC], [compiler], [1], [A language specific compiler])dnl
	_LT_TAGDECL([with_gcc], [GCC], [0], [Is the compiler the GNU compiler?])dnl

	# If no C compiler was specified, use CC.
	LTCC=${LTCC-"$CC"}

	# If no C compiler flags were specified, use CFLAGS.
	LTCFLAGS=${LTCFLAGS-"$CFLAGS"}

	# Allow CC to be a program name with arguments.
	compiler=$CC
	])# _LT_TAG_COMPILER


	# _LT_COMPILER_BOILERPLATE
	# ------------------------
	# Check for compiler boilerplate output or warnings with
	# the simple compiler test code.
	m4_defun([_LT_COMPILER_BOILERPLATE],
	[m4_require([_LT_DECL_SED])dnl
	ac_outfile=conftest.$ac_objext
	echo "$lt_simple_compile_test_code" >conftest.$ac_ext
	eval "$ac_compile" 2>&1 >/dev/null \| $SED '/^$/d; /^ *+/d' >conftest.err
	_lt_compiler_boilerplate=`cat conftest.err`
	$RM conftest*
	])# _LT_COMPILER_BOILERPLATE


	# _LT_LINKER_BOILERPLATE
	# ----------------------
	# Check for linker boilerplate output or warnings with
	# the simple link test code.
	m4_defun([_LT_LINKER_BOILERPLATE],
	[m4_require([_LT_DECL_SED])dnl
	ac_outfile=conftest.$ac_objext
	echo "$lt_simple_link_test_code" >conftest.$ac_ext
	eval "$ac_link" 2>&1 >/dev/null \| $SED '/^$/d; /^ *+/d' >conftest.err
	_lt_linker_boilerplate=`cat conftest.err`
	$RM -r conftest*
	])# _LT_LINKER_BOILERPLATE

	# _LT_REQUIRED_DARWIN_CHECKS
	# -------------------------
	m4_defun_once([_LT_REQUIRED_DARWIN_CHECKS],[
	case $host_os in
	rhapsody* \| darwin*)
	AC_CHECK_TOOL([DSYMUTIL], [dsymutil], [:])
	AC_CHECK_TOOL([NMEDIT], [nmedit], [:])
	AC_CHECK_TOOL([LIPO], [lipo], [:])
	AC_CHECK_TOOL([OTOOL], [otool], [:])
	AC_CHECK_TOOL([OTOOL64], [otool64], [:])
	_LT_DECL([], [DSYMUTIL], [1],
	[Tool to manipulate archived DWARF debug symbol files on Mac OS X])
	_LT_DECL([], [NMEDIT], [1],
	[Tool to change global to local symbols on Mac OS X])
	_LT_DECL([], [LIPO], [1],
	[Tool to manipulate fat objects and archives on Mac OS X])
	_LT_DECL([], [OTOOL], [1],
	[ldd/readelf like tool for Mach-O binaries on Mac OS X])
	_LT_DECL([], [OTOOL64], [1],
	[ldd/readelf like tool for 64 bit Mach-O binaries on Mac OS X 10.4])

	AC_CACHE_CHECK([for -single_module linker flag],[lt_cv_apple_cc_single_mod],
	[lt_cv_apple_cc_single_mod=no
	if test -z "$LT_MULTI_MODULE"; then
	# By default we will add the -single_module flag. You can override
	# by either setting the environment variable LT_MULTI_MODULE
	# non-empty at configure time, or by adding -multi_module to the
	# link flags.
	rm -rf libconftest.dylib*
	echo "int foo(void){return 1;}" > conftest.c
	echo "$LTCC $LTCFLAGS $LDFLAGS -o libconftest.dylib \
	-dynamiclib -Wl,-single_module conftest.c" >&AS_MESSAGE_LOG_FD
	$LTCC $LTCFLAGS $LDFLAGS -o libconftest.dylib \
	-dynamiclib -Wl,-single_module conftest.c 2>conftest.err
	_lt_result=$?
	# If there is a non-empty error log, and "single_module"
	# appears in it, assume the flag caused a linker warning
	if test -s conftest.err && $GREP single_module conftest.err; then
	cat conftest.err >&AS_MESSAGE_LOG_FD
	# Otherwise, if the output was created with a 0 exit code from
	# the compiler, it worked.
	elif test -f libconftest.dylib && test 0 = "$_lt_result"; then
	lt_cv_apple_cc_single_mod=yes
	else
	cat conftest.err >&AS_MESSAGE_LOG_FD
	fi
	rm -rf libconftest.dylib*
	rm -f conftest.*
	fi])

	AC_CACHE_CHECK([for -exported_symbols_list linker flag],
	[lt_cv_ld_exported_symbols_list],
	[lt_cv_ld_exported_symbols_list=no
	save_LDFLAGS=$LDFLAGS
	echo "_main" > conftest.sym
	LDFLAGS="$LDFLAGS -Wl,-exported_symbols_list,conftest.sym"
	AC_LINK_IFELSE([AC_LANG_PROGRAM([],[])],
	[lt_cv_ld_exported_symbols_list=yes],
	[lt_cv_ld_exported_symbols_list=no])
	LDFLAGS=$save_LDFLAGS
	])

	AC_CACHE_CHECK([for -force_load linker flag],[lt_cv_ld_force_load],
	[lt_cv_ld_force_load=no
	cat > conftest.c << _LT_EOF
	int forced_loaded() { return 2;}
	_LT_EOF
	echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&AS_MESSAGE_LOG_FD
	$LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&AS_MESSAGE_LOG_FD
	echo "$AR cru libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
	$AR cru libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
	echo "$RANLIB libconftest.a" >&AS_MESSAGE_LOG_FD
	$RANLIB libconftest.a 2>&AS_MESSAGE_LOG_FD
	cat > conftest.c << _LT_EOF
	int main() { return 0;}
	_LT_EOF
	echo "$LTCC $LTCFLAGS $LDFLAGS -o conftest conftest.c -Wl,-force_load,./libconftest.a" >&AS_MESSAGE_LOG_FD
	$LTCC $LTCFLAGS $LDFLAGS -o conftest conftest.c -Wl,-force_load,./libconftest.a 2>conftest.err
	_lt_result=$?
	if test -s conftest.err && $GREP force_load conftest.err; then
	cat conftest.err >&AS_MESSAGE_LOG_FD
	elif test -f conftest && test 0 = "$_lt_result" && $GREP forced_load conftest >/dev/null 2>&1; then
	lt_cv_ld_force_load=yes
	else
	cat conftest.err >&AS_MESSAGE_LOG_FD
	fi
	rm -f conftest.err libconftest.a conftest conftest.c
	rm -rf conftest.dSYM
	])
	case $host_os in
	rhapsody* \| darwin1.[[012]])
	_lt_dar_allow_undefined='$wl-undefined ${wl}suppress' ;;
	darwin1.*)
	_lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
	darwin*) # darwin 5.x on
	# if running on 10.5 or later, the deployment target defaults
	# to the OS version, if on x86, and 10.4, the deployment
	# target defaults to 10.4. Don't you love it?
	case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in
	10.0,86-darwin8\|10.0,-darwin[[91]]*)
	_lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
	10.[[012]][[,.]]*)
	_lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
	10.*)
	_lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
	esac
	;;
	esac
	if test yes = "$lt_cv_apple_cc_single_mod"; then
	_lt_dar_single_mod='$single_module'
	fi
	if test yes = "$lt_cv_ld_exported_symbols_list"; then
	_lt_dar_export_syms=' $wl-exported_symbols_list,$output_objdir/$libname-symbols.expsym'
	else
	_lt_dar_export_syms='~$NMEDIT -s $output_objdir/$libname-symbols.expsym $lib'
	fi
	if test : != "$DSYMUTIL" && test no = "$lt_cv_ld_force_load"; then
	_lt_dsymutil='~$DSYMUTIL $lib \|\| :'
	else
	_lt_dsymutil=
	fi
	;;
	esac
	])


	# _LT_DARWIN_LINKER_FEATURES([TAG])
	# ---------------------------------
	# Checks for linker and compiler features on darwin
	m4_defun([_LT_DARWIN_LINKER_FEATURES],
	[
	m4_require([_LT_REQUIRED_DARWIN_CHECKS])
	_LT_TAGVAR(archive_cmds_need_lc, $1)=no
	_LT_TAGVAR(hardcode_direct, $1)=no
	_LT_TAGVAR(hardcode_automatic, $1)=yes
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=unsupported
	if test yes = "$lt_cv_ld_force_load"; then
	_LT_TAGVAR(whole_archive_flag_spec, $1)='`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience $wl-force_load,$conv\"; done; func_echo_all \"$new_convenience\"`'
	m4_case([$1], [F77], [_LT_TAGVAR(compiler_needs_object, $1)=yes],
	[FC], [_LT_TAGVAR(compiler_needs_object, $1)=yes])
	else
	_LT_TAGVAR(whole_archive_flag_spec, $1)=''
	fi
	_LT_TAGVAR(link_all_deplibs, $1)=yes
	_LT_TAGVAR(allow_undefined_flag, $1)=$_lt_dar_allow_undefined
	case $cc_basename in
	ifort\|nagfor) _lt_dar_can_shared=yes ;;
	*) _lt_dar_can_shared=$GCC ;;
	esac
	if test yes = "$_lt_dar_can_shared"; then
	output_verbose_link_cmd=func_echo_all
	_LT_TAGVAR(archive_cmds, $1)="\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dsymutil"
	_LT_TAGVAR(module_cmds, $1)="\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dsymutil"
	_LT_TAGVAR(archive_expsym_cmds, $1)="sed 's\|^\|_\|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
	_LT_TAGVAR(module_expsym_cmds, $1)="sed -e 's\|^\|_\|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
	m4_if([$1], [CXX],
	[ if test yes != "$lt_cv_apple_cc_single_mod"; then
	_LT_TAGVAR(archive_cmds, $1)="\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dsymutil"
	_LT_TAGVAR(archive_expsym_cmds, $1)="sed 's\|^\|_\|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil"
	fi
	],[])
	else
	_LT_TAGVAR(ld_shlibs, $1)=no
	fi
	])

	# _LT_SYS_MODULE_PATH_AIX([TAGNAME])
	# ----------------------------------
	# Links a minimal program and checks the executable
	# for the system default hardcoded library path. In most cases,
	# this is /usr/lib:/lib, but when the MPI compilers are used
	# the location of the communication and MPI libs are included too.
	# If we don't find anything, use the default library path according
	# to the aix ld manual.
	# Store the results from the different compilers for each TAGNAME.
	# Allow to override them for all tags through lt_cv_aix_libpath.
	m4_defun([_LT_SYS_MODULE_PATH_AIX],
	[m4_require([_LT_DECL_SED])dnl
	if test set = "${lt_cv_aix_libpath+set}"; then
	aix_libpath=$lt_cv_aix_libpath
	else
	AC_CACHE_VAL([_LT_TAGVAR([lt_cv_aix_libpath_], [$1])],
	[AC_LINK_IFELSE([AC_LANG_PROGRAM],[
	lt_aix_libpath_sed='[
	/Import File Strings/,/^$/ {
	/^0/ {
	s/^0 $[^ ]$ *$/\1/
	p
	}
	}]'
	_LT_TAGVAR([lt_cv_aix_libpath_], [$1])=`dump -H conftest$ac_exeext 2>/dev/null \| $SED -n -e "$lt_aix_libpath_sed"`
	# Check for a 64-bit object if we didn't find anything.
	if test -z "$_LT_TAGVAR([lt_cv_aix_libpath_], [$1])"; then
	_LT_TAGVAR([lt_cv_aix_libpath_], [$1])=`dump -HX64 conftest$ac_exeext 2>/dev/null \| $SED -n -e "$lt_aix_libpath_sed"`
	fi],[])
	if test -z "$_LT_TAGVAR([lt_cv_aix_libpath_], [$1])"; then
	_LT_TAGVAR([lt_cv_aix_libpath_], [$1])=/usr/lib:/lib
	fi
	])
	aix_libpath=$_LT_TAGVAR([lt_cv_aix_libpath_], [$1])
	fi
	])# _LT_SYS_MODULE_PATH_AIX


	# _LT_SHELL_INIT(ARG)
	# -------------------
	m4_define([_LT_SHELL_INIT],
	[m4_divert_text([M4SH-INIT], [$1
	])])# _LT_SHELL_INIT



	# _LT_PROG_ECHO_BACKSLASH
	# -----------------------
	# Find how we can fake an echo command that does not interpret backslash.
	# In particular, with Autoconf 2.60 or later we add some code to the start
	# of the generated configure script that will find a shell with a builtin
	# printf (that we can use as an echo command).
	m4_defun([_LT_PROG_ECHO_BACKSLASH],
	[ECHO='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
	ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO
	ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO$ECHO

	AC_MSG_CHECKING([how to print strings])
	# Test print first, because it will be a builtin if present.
	if test "X`( print -r -- -n ) 2>/dev/null`" = X-n && \
	test "X`print -r -- $ECHO 2>/dev/null`" = "X$ECHO"; then
	ECHO='print -r --'
	elif test "X`printf %s $ECHO 2>/dev/null`" = "X$ECHO"; then
	ECHO='printf %s\n'
	else
	# Use this function as a fallback that always works.
	func_fallback_echo ()
	{
	eval 'cat <<_LTECHO_EOF
	$[]1
	_LTECHO_EOF'
	}
	ECHO='func_fallback_echo'
	fi

	# func_echo_all arg...
	# Invoke $ECHO with all args, space-separated.
	func_echo_all ()
	{
	$ECHO "$*"
	}

	case $ECHO in
	printf*) AC_MSG_RESULT([printf]) ;;
	print*) AC_MSG_RESULT([print -r]) ;;
	*) AC_MSG_RESULT([cat]) ;;
	esac

	m4_ifdef([_AS_DETECT_SUGGESTED],
	[_AS_DETECT_SUGGESTED([
	test -n "${ZSH_VERSION+set}${BASH_VERSION+set}" \|\| (
	ECHO='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
	ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO
	ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO$ECHO
	PATH=/empty FPATH=/empty; export PATH FPATH
	test "X`printf %s $ECHO`" = "X$ECHO" \
	\|\| test "X`print -r -- $ECHO`" = "X$ECHO" )])])

	_LT_DECL([], [SHELL], [1], [Shell to use when invoking shell scripts])
	_LT_DECL([], [ECHO], [1], [An echo program that protects backslashes])
	])# _LT_PROG_ECHO_BACKSLASH


	# _LT_WITH_SYSROOT
	# ----------------
	AC_DEFUN([_LT_WITH_SYSROOT],
	[AC_MSG_CHECKING([for sysroot])
	AC_ARG_WITH([sysroot],
	[AS_HELP_STRING([--with-sysroot@<:@=DIR@:>@],
	[Search for dependent libraries within DIR (or the compiler's sysroot
	if not specified).])],
	[], [with_sysroot=no])

	dnl lt_sysroot will always be passed unquoted. We quote it here
	dnl in case the user passed a directory name.
	lt_sysroot=
	case $with_sysroot in #(
	yes)
	if test yes = "$GCC"; then
	lt_sysroot=`$CC --print-sysroot 2>/dev/null`
	fi
	;; #(
	/*)
	lt_sysroot=`echo "$with_sysroot" \| sed -e "$sed_quote_subst"`
	;; #(
	no\|'')
	;; #(
	*)
	AC_MSG_RESULT([$with_sysroot])
	AC_MSG_ERROR([The sysroot must be an absolute path.])
	;;
	esac

	AC_MSG_RESULT([${lt_sysroot:-no}])
	_LT_DECL([], [lt_sysroot], [0], [The root where to search for ]dnl
	[dependent libraries, and where our libraries should be installed.])])

	# _LT_ENABLE_LOCK
	# ---------------
	m4_defun([_LT_ENABLE_LOCK],
	[AC_ARG_ENABLE([libtool-lock],
	[AS_HELP_STRING([--disable-libtool-lock],
	[avoid locking (might break parallel builds)])])
	test no = "$enable_libtool_lock" \|\| enable_libtool_lock=yes

	# Some flags need to be propagated to the compiler or linker for good
	# libtool support.
	case $host in
	ia64--hpux)
	# Find out what ABI is being produced by ac_compile, and set mode
	# options accordingly.
	echo 'int i;' > conftest.$ac_ext
	if AC_TRY_EVAL(ac_compile); then
	case `/usr/bin/file conftest.$ac_objext` in
	ELF-32)
	HPUX_IA64_MODE=32
	;;
	ELF-64)
	HPUX_IA64_MODE=64
	;;
	esac
	fi
	rm -rf conftest*
	;;
	--irix6*)
	# Find out what ABI is being produced by ac_compile, and set linker
	# options accordingly.
	echo '[#]line '$LINENO' "configure"' > conftest.$ac_ext
	if AC_TRY_EVAL(ac_compile); then
	if test yes = "$lt_cv_prog_gnu_ld"; then
	case `/usr/bin/file conftest.$ac_objext` in
	32-bit)
	LD="${LD-ld} -melf32bsmip"
	;;
	N32)
	LD="${LD-ld} -melf32bmipn32"
	;;
	64-bit)
	LD="${LD-ld} -melf64bmip"
	;;
	esac
	else
	case `/usr/bin/file conftest.$ac_objext` in
	32-bit)
	LD="${LD-ld} -32"
	;;
	N32)
	LD="${LD-ld} -n32"
	;;
	64-bit)
	LD="${LD-ld} -64"
	;;
	esac
	fi
	fi
	rm -rf conftest*
	;;

	mips64-linux*)
	# Find out what ABI is being produced by ac_compile, and set linker
	# options accordingly.
	echo '[#]line '$LINENO' "configure"' > conftest.$ac_ext
	if AC_TRY_EVAL(ac_compile); then
	emul=elf
	case `/usr/bin/file conftest.$ac_objext` in
	32-bit)
	emul="${emul}32"
	;;
	64-bit)
	emul="${emul}64"
	;;
	esac
	case `/usr/bin/file conftest.$ac_objext` in
	MSB)
	emul="${emul}btsmip"
	;;
	LSB)
	emul="${emul}ltsmip"
	;;
	esac
	case `/usr/bin/file conftest.$ac_objext` in
	N32)
	emul="${emul}n32"
	;;
	esac
	LD="${LD-ld} -m $emul"
	fi
	rm -rf conftest*
	;;

	x86_64-kfreebsd-gnu\|x86_64-linux\|powerpc-linux*\| \
	s390-linux\|s390-tpf\|sparc-linux*)
	# Find out what ABI is being produced by ac_compile, and set linker
	# options accordingly. Note that the listed cases only cover the
	# situations where additional linker options are needed (such as when
	# doing 32-bit compilation for a host where ld defaults to 64-bit, or
	# vice versa); the common cases where no linker options are needed do
	# not appear in the list.
	echo 'int i;' > conftest.$ac_ext
	if AC_TRY_EVAL(ac_compile); then
	case `/usr/bin/file conftest.o` in
	32-bit)
	case $host in
	x86_64-kfreebsd-gnu)
	LD="${LD-ld} -m elf_i386_fbsd"
	;;
	x86_64-linux)
	case `/usr/bin/file conftest.o` in
	x86-64)
	LD="${LD-ld} -m elf32_x86_64"
	;;
	*)
	LD="${LD-ld} -m elf_i386"
	;;
	esac
	;;
	powerpc64le-linux)
	LD="${LD-ld} -m elf32lppclinux"
	;;
	powerpc64-linux)
	LD="${LD-ld} -m elf32ppclinux"
	;;
	s390x-linux)
	LD="${LD-ld} -m elf_s390"
	;;
	sparc64-linux)
	LD="${LD-ld} -m elf32_sparc"
	;;
	esac
	;;
	64-bit)
	case $host in
	x86_64-kfreebsd-gnu)
	LD="${LD-ld} -m elf_x86_64_fbsd"
	;;
	x86_64-linux)
	LD="${LD-ld} -m elf_x86_64"
	;;
	powerpcle-linux)
	LD="${LD-ld} -m elf64lppc"
	;;
	powerpc-linux)
	LD="${LD-ld} -m elf64ppc"
	;;
	s390-linux\|s390-tpf)
	LD="${LD-ld} -m elf64_s390"
	;;
	sparc-linux*)
	LD="${LD-ld} -m elf64_sparc"
	;;
	esac
	;;
	esac
	fi
	rm -rf conftest*
	;;

	--sco3.2v5*)
	# On SCO OpenServer 5, we need -belf to get full-featured binaries.
	SAVE_CFLAGS=$CFLAGS
	CFLAGS="$CFLAGS -belf"
	AC_CACHE_CHECK([whether the C compiler needs -belf], lt_cv_cc_needs_belf,
	[AC_LANG_PUSH(C)
	AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],[[]])],[lt_cv_cc_needs_belf=yes],[lt_cv_cc_needs_belf=no])
	AC_LANG_POP])
	if test yes != "$lt_cv_cc_needs_belf"; then
	# this is probably gcc 2.8.0, egcs 1.0 or newer; no need for -belf
	CFLAGS=$SAVE_CFLAGS
	fi
	;;
	-solaris*)
	# Find out what ABI is being produced by ac_compile, and set linker
	# options accordingly.
	echo 'int i;' > conftest.$ac_ext
	if AC_TRY_EVAL(ac_compile); then
	case `/usr/bin/file conftest.o` in
	64-bit)
	case $lt_cv_prog_gnu_ld in
	yes*)
	case $host in
	i?86--solaris\|x86_64--solaris)
	LD="${LD-ld} -m elf_x86_64"
	;;
	sparc--solaris*)
	LD="${LD-ld} -m elf64_sparc"
	;;
	esac
	# GNU ld 2.21 introduced _sol2 emulations. Use them if available.
	if ${LD-ld} -V \| grep _sol2 >/dev/null 2>&1; then
	LD=${LD-ld}_sol2
	fi
	;;
	*)
	if ${LD-ld} -64 -r -o conftest2.o conftest.o >/dev/null 2>&1; then
	LD="${LD-ld} -64"
	fi
	;;
	esac
	;;
	esac
	fi
	rm -rf conftest*
	;;
	esac

	need_locks=$enable_libtool_lock
	])# _LT_ENABLE_LOCK


	# _LT_PROG_AR
	# -----------
	m4_defun([_LT_PROG_AR],
	[AC_CHECK_TOOLS(AR, [ar], false)
	: ${AR=ar}
	: ${AR_FLAGS=cru}
	_LT_DECL([], [AR], [1], [The archiver])
	_LT_DECL([], [AR_FLAGS], [1], [Flags to create an archive])

	AC_CACHE_CHECK([for archiver @FILE support], [lt_cv_ar_at_file],
	[lt_cv_ar_at_file=no
	AC_COMPILE_IFELSE([AC_LANG_PROGRAM],
	[echo conftest.$ac_objext > conftest.lst
	lt_ar_try='$AR $AR_FLAGS libconftest.a @conftest.lst >&AS_MESSAGE_LOG_FD'
	AC_TRY_EVAL([lt_ar_try])
	if test 0 -eq "$ac_status"; then
	# Ensure the archiver fails upon bogus file names.
	rm -f conftest.$ac_objext libconftest.a
	AC_TRY_EVAL([lt_ar_try])
	if test 0 -ne "$ac_status"; then
	lt_cv_ar_at_file=@
	fi
	fi
	rm -f conftest.* libconftest.a
	])
	])

	if test no = "$lt_cv_ar_at_file"; then
	archiver_list_spec=
	else
	archiver_list_spec=$lt_cv_ar_at_file
	fi
	_LT_DECL([], [archiver_list_spec], [1],
	[How to feed a file listing to the archiver])
	])# _LT_PROG_AR


	# _LT_CMD_OLD_ARCHIVE
	# -------------------
	m4_defun([_LT_CMD_OLD_ARCHIVE],
	[_LT_PROG_AR

	AC_CHECK_TOOL(STRIP, strip, :)
	test -z "$STRIP" && STRIP=:
	_LT_DECL([], [STRIP], [1], [A symbol stripping program])

	AC_CHECK_TOOL(RANLIB, ranlib, :)
	test -z "$RANLIB" && RANLIB=:
	_LT_DECL([], [RANLIB], [1],
	[Commands used to install an old-style archive])

	# Determine commands to create old-style static archives.
	old_archive_cmds='$AR $AR_FLAGS $oldlib$oldobjs'
	old_postinstall_cmds='chmod 644 $oldlib'
	old_postuninstall_cmds=

	if test -n "$RANLIB"; then
	case $host_os in
	bitrig* \| openbsd*)
	old_postinstall_cmds="$old_postinstall_cmds~\$RANLIB -t \$tool_oldlib"
	;;
	*)
	old_postinstall_cmds="$old_postinstall_cmds~\$RANLIB \$tool_oldlib"
	;;
	esac
	old_archive_cmds="$old_archive_cmds~\$RANLIB \$tool_oldlib"
	fi

	case $host_os in
	darwin*)
	lock_old_archive_extraction=yes ;;
	*)
	lock_old_archive_extraction=no ;;
	esac
	_LT_DECL([], [old_postinstall_cmds], [2])
	_LT_DECL([], [old_postuninstall_cmds], [2])
	_LT_TAGDECL([], [old_archive_cmds], [2],
	[Commands used to build an old-style archive])
	_LT_DECL([], [lock_old_archive_extraction], [0],
	[Whether to use a lock for old archive extraction])
	])# _LT_CMD_OLD_ARCHIVE


	# _LT_COMPILER_OPTION(MESSAGE, VARIABLE-NAME, FLAGS,
	# [OUTPUT-FILE], [ACTION-SUCCESS], [ACTION-FAILURE])
	# ----------------------------------------------------------------
	# Check whether the given compiler option works
	AC_DEFUN([_LT_COMPILER_OPTION],
	[m4_require([_LT_FILEUTILS_DEFAULTS])dnl
	m4_require([_LT_DECL_SED])dnl
	AC_CACHE_CHECK([$1], [$2],
	[$2=no
	m4_if([$4], , [ac_outfile=conftest.$ac_objext], [ac_outfile=$4])
	echo "$lt_simple_compile_test_code" > conftest.$ac_ext
	lt_compiler_flag="$3" ## exclude from sc_useless_quotes_in_assignment
	# Insert the option either (1) after the last *FLAGS variable, or
	# (2) before a word containing "conftest.", or (3) at the end.
	# Note that $ac_compile itself does not contain backslashes and begins
	# with a dollar sign (not a hyphen), so the echo should work correctly.
	# The option is referenced via a variable to avoid confusing sed.
	lt_compile=`echo "$ac_compile" \| $SED \
	-e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
	-e 's: [[^ ]]*conftest\.: $lt_compiler_flag&:; t' \
	-e 's:$: $lt_compiler_flag:'`
	(eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&AS_MESSAGE_LOG_FD)
	(eval "$lt_compile" 2>conftest.err)
	ac_status=$?
	cat conftest.err >&AS_MESSAGE_LOG_FD
	echo "$as_me:$LINENO: \$? = $ac_status" >&AS_MESSAGE_LOG_FD
	if (exit $ac_status) && test -s "$ac_outfile"; then
	# The compiler can only warn and ignore the option if not recognized
	# So say no if there are warnings other than the usual output.
	$ECHO "$_lt_compiler_boilerplate" \| $SED '/^$/d' >conftest.exp
	$SED '/^$/d; /^ *+/d' conftest.err >conftest.er2
	if test ! -s conftest.er2 \|\| diff conftest.exp conftest.er2 >/dev/null; then
	$2=yes
	fi
	fi
	$RM conftest*
	])

	if test yes = "[$]$2"; then
	m4_if([$5], , :, [$5])
	else
	m4_if([$6], , :, [$6])
	fi
	])# _LT_COMPILER_OPTION

	# Old name:
	AU_ALIAS([AC_LIBTOOL_COMPILER_OPTION], [_LT_COMPILER_OPTION])
	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([AC_LIBTOOL_COMPILER_OPTION], [])


	# _LT_LINKER_OPTION(MESSAGE, VARIABLE-NAME, FLAGS,
	# [ACTION-SUCCESS], [ACTION-FAILURE])
	# ----------------------------------------------------
	# Check whether the given linker option works
	AC_DEFUN([_LT_LINKER_OPTION],
	[m4_require([_LT_FILEUTILS_DEFAULTS])dnl
	m4_require([_LT_DECL_SED])dnl
	AC_CACHE_CHECK([$1], [$2],
	[$2=no
	save_LDFLAGS=$LDFLAGS
	LDFLAGS="$LDFLAGS $3"
	echo "$lt_simple_link_test_code" > conftest.$ac_ext
	if (eval $ac_link 2>conftest.err) && test -s conftest$ac_exeext; then
	# The linker can only warn and ignore the option if not recognized
	# So say no if there are warnings
	if test -s conftest.err; then
	# Append any errors to the config.log.
	cat conftest.err 1>&AS_MESSAGE_LOG_FD
	$ECHO "$_lt_linker_boilerplate" \| $SED '/^$/d' > conftest.exp
	$SED '/^$/d; /^ *+/d' conftest.err >conftest.er2
	if diff conftest.exp conftest.er2 >/dev/null; then
	$2=yes
	fi
	else
	$2=yes
	fi
	fi
	$RM -r conftest*
	LDFLAGS=$save_LDFLAGS
	])

	if test yes = "[$]$2"; then
	m4_if([$4], , :, [$4])
	else
	m4_if([$5], , :, [$5])
	fi
	])# _LT_LINKER_OPTION

	# Old name:
	AU_ALIAS([AC_LIBTOOL_LINKER_OPTION], [_LT_LINKER_OPTION])
	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([AC_LIBTOOL_LINKER_OPTION], [])


	# LT_CMD_MAX_LEN
	#---------------
	AC_DEFUN([LT_CMD_MAX_LEN],
	[AC_REQUIRE([AC_CANONICAL_HOST])dnl
	# find the maximum length of command line arguments
	AC_MSG_CHECKING([the maximum length of command line arguments])
	AC_CACHE_VAL([lt_cv_sys_max_cmd_len], [dnl
	i=0
	teststring=ABCD

	case $build_os in
	msdosdjgpp*)
	# On DJGPP, this test can blow up pretty badly due to problems in libc
	# (any single argument exceeding 2000 bytes causes a buffer overrun
	# during glob expansion). Even if it were fixed, the result of this
	# check would be larger than it should be.
	lt_cv_sys_max_cmd_len=12288; # 12K is about right
	;;

	gnu*)
	# Under GNU Hurd, this test is not required because there is
	# no limit to the length of command line arguments.
	# Libtool will interpret -1 as no limit whatsoever
	lt_cv_sys_max_cmd_len=-1;
	;;

	cygwin* \| mingw* \| cegcc*)
	# On Win9x/ME, this test blows up -- it succeeds, but takes
	# about 5 minutes as the teststring grows exponentially.
	# Worse, since 9x/ME are not pre-emptively multitasking,
	# you end up with a "frozen" computer, even though with patience
	# the test eventually succeeds (with a max line length of 256k).
	# Instead, let's just punt: use the minimum linelength reported by
	# all of the supported platforms: 8192 (on NT/2K/XP).
	lt_cv_sys_max_cmd_len=8192;
	;;

	mint*)
	# On MiNT this can take a long time and run out of memory.
	lt_cv_sys_max_cmd_len=8192;
	;;

	amigaos*)
	# On AmigaOS with pdksh, this test takes hours, literally.
	# So we just punt and use a minimum line length of 8192.
	lt_cv_sys_max_cmd_len=8192;
	;;

	bitrig* \| darwin* \| dragonfly* \| freebsd* \| netbsd* \| openbsd*)
	# This has been around since 386BSD, at least. Likely further.
	if test -x /sbin/sysctl; then
	lt_cv_sys_max_cmd_len=`/sbin/sysctl -n kern.argmax`
	elif test -x /usr/sbin/sysctl; then
	lt_cv_sys_max_cmd_len=`/usr/sbin/sysctl -n kern.argmax`
	else
	lt_cv_sys_max_cmd_len=65536 # usable default for all BSDs
	fi
	# And add a safety zone
	lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 4`
	lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \* 3`
	;;

	interix*)
	# We know the value 262144 and hardcode it with a safety zone (like BSD)
	lt_cv_sys_max_cmd_len=196608
	;;

	os2*)
	# The test takes a long time on OS/2.
	lt_cv_sys_max_cmd_len=8192
	;;

	osf*)
	# Dr. Hans Ekkehard Plesser reports seeing a kernel panic running configure
	# due to this test when exec_disable_arg_limit is 1 on Tru64. It is not
	# nice to cause kernel panics so lets avoid the loop below.
	# First set a reasonable default.
	lt_cv_sys_max_cmd_len=16384
	#
	if test -x /sbin/sysconfig; then
	case `/sbin/sysconfig -q proc exec_disable_arg_limit` in
	1) lt_cv_sys_max_cmd_len=-1 ;;
	esac
	fi
	;;
	sco3.2v5*)
	lt_cv_sys_max_cmd_len=102400
	;;
	sysv5* \| sco5v6* \| sysv4.2uw2*)
	kargmax=`grep ARG_MAX /etc/conf/cf.d/stune 2>/dev/null`
	if test -n "$kargmax"; then
	lt_cv_sys_max_cmd_len=`echo $kargmax \| sed 's/.*[[ ]]//'`
	else
	lt_cv_sys_max_cmd_len=32768
	fi
	;;
	*)
	lt_cv_sys_max_cmd_len=`(getconf ARG_MAX) 2> /dev/null`
	if test -n "$lt_cv_sys_max_cmd_len" && \
	test undefined != "$lt_cv_sys_max_cmd_len"; then
	lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 4`
	lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \* 3`
	else
	# Make teststring a little bigger before we do anything with it.
	# a 1K string should be a reasonable start.
	for i in 1 2 3 4 5 6 7 8; do
	teststring=$teststring$teststring
	done
	SHELL=${SHELL-${CONFIG_SHELL-/bin/sh}}
	# If test is not a shell built-in, we'll probably end up computing a
	# maximum length that is only half of the actual maximum length, but
	# we can't tell.
	while { test X`env echo "$teststring$teststring" 2>/dev/null` \
	= "X$teststring$teststring"; } >/dev/null 2>&1 &&
	test 17 != "$i" # 1/2 MB should be enough
	do
	i=`expr $i + 1`
	teststring=$teststring$teststring
	done
	# Only check the string length outside the loop.
	lt_cv_sys_max_cmd_len=`expr "X$teststring" : ".*" 2>&1`
	teststring=
	# Add a significant safety factor because C++ compilers can tack on
	# massive amounts of additional arguments before passing them to the
	# linker. It appears as though 1/2 is a usable value.
	lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 2`
	fi
	;;
	esac
	])
	if test -n "$lt_cv_sys_max_cmd_len"; then
	AC_MSG_RESULT($lt_cv_sys_max_cmd_len)
	else
	AC_MSG_RESULT(none)
	fi
	max_cmd_len=$lt_cv_sys_max_cmd_len
	_LT_DECL([], [max_cmd_len], [0],
	[What is the maximum length of a command?])
	])# LT_CMD_MAX_LEN

	# Old name:
	AU_ALIAS([AC_LIBTOOL_SYS_MAX_CMD_LEN], [LT_CMD_MAX_LEN])
	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([AC_LIBTOOL_SYS_MAX_CMD_LEN], [])


	# _LT_HEADER_DLFCN
	# ----------------
	m4_defun([_LT_HEADER_DLFCN],
	[AC_CHECK_HEADERS([dlfcn.h], [], [], [AC_INCLUDES_DEFAULT])dnl
	])# _LT_HEADER_DLFCN


	# _LT_TRY_DLOPEN_SELF (ACTION-IF-TRUE, ACTION-IF-TRUE-W-USCORE,
	# ACTION-IF-FALSE, ACTION-IF-CROSS-COMPILING)
	# ----------------------------------------------------------------
	m4_defun([_LT_TRY_DLOPEN_SELF],
	[m4_require([_LT_HEADER_DLFCN])dnl
	if test yes = "$cross_compiling"; then :
	[$4]
	else
	lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
	lt_status=$lt_dlunknown
	cat > conftest.$ac_ext <<_LT_EOF
	[#line $LINENO "configure"
	#include "confdefs.h"

	#if HAVE_DLFCN_H
	#include <dlfcn.h>
	#endif

	#include <stdio.h>

	#ifdef RTLD_GLOBAL
	# define LT_DLGLOBAL RTLD_GLOBAL
	#else
	# ifdef DL_GLOBAL
	# define LT_DLGLOBAL DL_GLOBAL
	# else
	# define LT_DLGLOBAL 0
	# endif
	#endif

	/* We may have to define LT_DLLAZY_OR_NOW in the command line if we
	find out it does not work in some platform. */
	#ifndef LT_DLLAZY_OR_NOW
	# ifdef RTLD_LAZY
	# define LT_DLLAZY_OR_NOW RTLD_LAZY
	# else
	# ifdef DL_LAZY
	# define LT_DLLAZY_OR_NOW DL_LAZY
	# else
	# ifdef RTLD_NOW
	# define LT_DLLAZY_OR_NOW RTLD_NOW
	# else
	# ifdef DL_NOW
	# define LT_DLLAZY_OR_NOW DL_NOW
	# else
	# define LT_DLLAZY_OR_NOW 0
	# endif
	# endif
	# endif
	# endif
	#endif

	/* When -fvisibility=hidden is used, assume the code has been annotated
	correspondingly for the symbols needed. */
	#if defined __GNUC__ && (((__GNUC__ == 3) && (__GNUC_MINOR__ >= 3)) \|\| (__GNUC__ > 3))
	int fnord () __attribute__((visibility("default")));
	#endif

	int fnord () { return 42; }
	int main ()
	{
	void *self = dlopen (0, LT_DLGLOBAL\|LT_DLLAZY_OR_NOW);
	int status = $lt_dlunknown;

	if (self)
	{
	if (dlsym (self,"fnord")) status = $lt_dlno_uscore;
	else
	{
	if (dlsym( self,"_fnord")) status = $lt_dlneed_uscore;
	else puts (dlerror ());
	}
	/* dlclose (self); */
	}
	else
	puts (dlerror ());

	return status;
	}]
	_LT_EOF
	if AC_TRY_EVAL(ac_link) && test -s "conftest$ac_exeext" 2>/dev/null; then
	(./conftest; exit; ) >&AS_MESSAGE_LOG_FD 2>/dev/null
	lt_status=$?
	case x$lt_status in
	x$lt_dlno_uscore) $1 ;;
	x$lt_dlneed_uscore) $2 ;;
	x$lt_dlunknown\|x*) $3 ;;
	esac
	else :
	# compilation failed
	$3
	fi
	fi
	rm -fr conftest*
	])# _LT_TRY_DLOPEN_SELF


	# LT_SYS_DLOPEN_SELF
	# ------------------
	AC_DEFUN([LT_SYS_DLOPEN_SELF],
	[m4_require([_LT_HEADER_DLFCN])dnl
	if test yes != "$enable_dlopen"; then
	enable_dlopen=unknown
	enable_dlopen_self=unknown
	enable_dlopen_self_static=unknown
	else
	lt_cv_dlopen=no
	lt_cv_dlopen_libs=

	case $host_os in
	beos*)
	lt_cv_dlopen=load_add_on
	lt_cv_dlopen_libs=
	lt_cv_dlopen_self=yes
	;;

	mingw* \| pw32* \| cegcc*)
	lt_cv_dlopen=LoadLibrary
	lt_cv_dlopen_libs=
	;;

	cygwin*)
	lt_cv_dlopen=dlopen
	lt_cv_dlopen_libs=
	;;

	darwin*)
	# if libdl is installed we need to link against it
	AC_CHECK_LIB([dl], [dlopen],
	[lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-ldl],[
	lt_cv_dlopen=dyld
	lt_cv_dlopen_libs=
	lt_cv_dlopen_self=yes
	])
	;;

	tpf*)
	# Don't try to run any link tests for TPF. We know it's impossible
	# because TPF is a cross-compiler, and we know how we open DSOs.
	lt_cv_dlopen=dlopen
	lt_cv_dlopen_libs=
	lt_cv_dlopen_self=no
	;;

	*)
	AC_CHECK_FUNC([shl_load],
	[lt_cv_dlopen=shl_load],
	[AC_CHECK_LIB([dld], [shl_load],
	[lt_cv_dlopen=shl_load lt_cv_dlopen_libs=-ldld],
	[AC_CHECK_FUNC([dlopen],
	[lt_cv_dlopen=dlopen],
	[AC_CHECK_LIB([dl], [dlopen],
	[lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-ldl],
	[AC_CHECK_LIB([svld], [dlopen],
	[lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-lsvld],
	[AC_CHECK_LIB([dld], [dld_link],
	[lt_cv_dlopen=dld_link lt_cv_dlopen_libs=-ldld])
	])
	])
	])
	])
	])
	;;
	esac

	if test no = "$lt_cv_dlopen"; then
	enable_dlopen=no
	else
	enable_dlopen=yes
	fi

	case $lt_cv_dlopen in
	dlopen)
	save_CPPFLAGS=$CPPFLAGS
	test yes = "$ac_cv_header_dlfcn_h" && CPPFLAGS="$CPPFLAGS -DHAVE_DLFCN_H"

	save_LDFLAGS=$LDFLAGS
	wl=$lt_prog_compiler_wl eval LDFLAGS=\"\$LDFLAGS $export_dynamic_flag_spec\"

	save_LIBS=$LIBS
	LIBS="$lt_cv_dlopen_libs $LIBS"

	AC_CACHE_CHECK([whether a program can dlopen itself],
	lt_cv_dlopen_self, [dnl
	_LT_TRY_DLOPEN_SELF(
	lt_cv_dlopen_self=yes, lt_cv_dlopen_self=yes,
	lt_cv_dlopen_self=no, lt_cv_dlopen_self=cross)
	])

	if test yes = "$lt_cv_dlopen_self"; then
	wl=$lt_prog_compiler_wl eval LDFLAGS=\"\$LDFLAGS $lt_prog_compiler_static\"
	AC_CACHE_CHECK([whether a statically linked program can dlopen itself],
	lt_cv_dlopen_self_static, [dnl
	_LT_TRY_DLOPEN_SELF(
	lt_cv_dlopen_self_static=yes, lt_cv_dlopen_self_static=yes,
	lt_cv_dlopen_self_static=no, lt_cv_dlopen_self_static=cross)
	])
	fi

	CPPFLAGS=$save_CPPFLAGS
	LDFLAGS=$save_LDFLAGS
	LIBS=$save_LIBS
	;;
	esac

	case $lt_cv_dlopen_self in
	yes\|no) enable_dlopen_self=$lt_cv_dlopen_self ;;
	*) enable_dlopen_self=unknown ;;
	esac

	case $lt_cv_dlopen_self_static in
	yes\|no) enable_dlopen_self_static=$lt_cv_dlopen_self_static ;;
	*) enable_dlopen_self_static=unknown ;;
	esac
	fi
	_LT_DECL([dlopen_support], [enable_dlopen], [0],
	[Whether dlopen is supported])
	_LT_DECL([dlopen_self], [enable_dlopen_self], [0],
	[Whether dlopen of programs is supported])
	_LT_DECL([dlopen_self_static], [enable_dlopen_self_static], [0],
	[Whether dlopen of statically linked programs is supported])
	])# LT_SYS_DLOPEN_SELF

	# Old name:
	AU_ALIAS([AC_LIBTOOL_DLOPEN_SELF], [LT_SYS_DLOPEN_SELF])
	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([AC_LIBTOOL_DLOPEN_SELF], [])


	# _LT_COMPILER_C_O([TAGNAME])
	# ---------------------------
	# Check to see if options -c and -o are simultaneously supported by compiler.
	# This macro does not hard code the compiler like AC_PROG_CC_C_O.
	m4_defun([_LT_COMPILER_C_O],
	[m4_require([_LT_DECL_SED])dnl
	m4_require([_LT_FILEUTILS_DEFAULTS])dnl
	m4_require([_LT_TAG_COMPILER])dnl
	AC_CACHE_CHECK([if $compiler supports -c -o file.$ac_objext],
	[_LT_TAGVAR(lt_cv_prog_compiler_c_o, $1)],
	[_LT_TAGVAR(lt_cv_prog_compiler_c_o, $1)=no
	$RM -r conftest 2>/dev/null
	mkdir conftest
	cd conftest
	mkdir out
	echo "$lt_simple_compile_test_code" > conftest.$ac_ext

	lt_compiler_flag="-o out/conftest2.$ac_objext"
	# Insert the option either (1) after the last *FLAGS variable, or
	# (2) before a word containing "conftest.", or (3) at the end.
	# Note that $ac_compile itself does not contain backslashes and begins
	# with a dollar sign (not a hyphen), so the echo should work correctly.
	lt_compile=`echo "$ac_compile" \| $SED \
	-e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
	-e 's: [[^ ]]*conftest\.: $lt_compiler_flag&:; t' \
	-e 's:$: $lt_compiler_flag:'`
	(eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&AS_MESSAGE_LOG_FD)
	(eval "$lt_compile" 2>out/conftest.err)
	ac_status=$?
	cat out/conftest.err >&AS_MESSAGE_LOG_FD
	echo "$as_me:$LINENO: \$? = $ac_status" >&AS_MESSAGE_LOG_FD
	if (exit $ac_status) && test -s out/conftest2.$ac_objext
	then
	# The compiler can only warn and ignore the option if not recognized
	# So say no if there are warnings
	$ECHO "$_lt_compiler_boilerplate" \| $SED '/^$/d' > out/conftest.exp
	$SED '/^$/d; /^ *+/d' out/conftest.err >out/conftest.er2
	if test ! -s out/conftest.er2 \|\| diff out/conftest.exp out/conftest.er2 >/dev/null; then
	_LT_TAGVAR(lt_cv_prog_compiler_c_o, $1)=yes
	fi
	fi
	chmod u+w . 2>&AS_MESSAGE_LOG_FD
	$RM conftest*
	# SGI C++ compiler will create directory out/ii_files/ for
	# template instantiation
	test -d out/ii_files && $RM out/ii_files/* && rmdir out/ii_files
	$RM out/* && rmdir out
	cd ..
	$RM -r conftest
	$RM conftest*
	])
	_LT_TAGDECL([compiler_c_o], [lt_cv_prog_compiler_c_o], [1],
	[Does compiler simultaneously support -c and -o options?])
	])# _LT_COMPILER_C_O


	# _LT_COMPILER_FILE_LOCKS([TAGNAME])
	# ----------------------------------
	# Check to see if we can do hard links to lock some files if needed
	m4_defun([_LT_COMPILER_FILE_LOCKS],
	[m4_require([_LT_ENABLE_LOCK])dnl
	m4_require([_LT_FILEUTILS_DEFAULTS])dnl
	_LT_COMPILER_C_O([$1])

	hard_links=nottested
	if test no = "$_LT_TAGVAR(lt_cv_prog_compiler_c_o, $1)" && test no != "$need_locks"; then
	# do not overwrite the value of need_locks provided by the user
	AC_MSG_CHECKING([if we can lock with hard links])
	hard_links=yes
	$RM conftest*
	ln conftest.a conftest.b 2>/dev/null && hard_links=no
	touch conftest.a
	ln conftest.a conftest.b 2>&5 \|\| hard_links=no
	ln conftest.a conftest.b 2>/dev/null && hard_links=no
	AC_MSG_RESULT([$hard_links])
	if test no = "$hard_links"; then
	AC_MSG_WARN(['$CC' does not support '-c -o', so 'make -j' may be unsafe])
	need_locks=warn
	fi
	else
	need_locks=no
	fi
	_LT_DECL([], [need_locks], [1], [Must we lock files when doing compilation?])
	])# _LT_COMPILER_FILE_LOCKS


	# _LT_CHECK_OBJDIR
	# ----------------
	m4_defun([_LT_CHECK_OBJDIR],
	[AC_CACHE_CHECK([for objdir], [lt_cv_objdir],
	[rm -f .libs 2>/dev/null
	mkdir .libs 2>/dev/null
	if test -d .libs; then
	lt_cv_objdir=.libs
	else
	# MS-DOS does not allow filenames that begin with a dot.
	lt_cv_objdir=_libs
	fi
	rmdir .libs 2>/dev/null])
	objdir=$lt_cv_objdir
	_LT_DECL([], [objdir], [0],
	[The name of the directory that contains temporary libtool files])dnl
	m4_pattern_allow([LT_OBJDIR])dnl
	AC_DEFINE_UNQUOTED([LT_OBJDIR], "$lt_cv_objdir/",
	[Define to the sub-directory where libtool stores uninstalled libraries.])
	])# _LT_CHECK_OBJDIR


	# _LT_LINKER_HARDCODE_LIBPATH([TAGNAME])
	# --------------------------------------
	# Check hardcoding attributes.
	m4_defun([_LT_LINKER_HARDCODE_LIBPATH],
	[AC_MSG_CHECKING([how to hardcode library paths into programs])
	_LT_TAGVAR(hardcode_action, $1)=
	if test -n "$_LT_TAGVAR(hardcode_libdir_flag_spec, $1)" \|\|
	test -n "$_LT_TAGVAR(runpath_var, $1)" \|\|
	test yes = "$_LT_TAGVAR(hardcode_automatic, $1)"; then

	# We can hardcode non-existent directories.
	if test no != "$_LT_TAGVAR(hardcode_direct, $1)" &&
	# If the only mechanism to avoid hardcoding is shlibpath_var, we
	# have to relink, otherwise we might link with an installed library
	# when we should be linking with a yet-to-be-installed one
	## test no != "$_LT_TAGVAR(hardcode_shlibpath_var, $1)" &&
	test no != "$_LT_TAGVAR(hardcode_minus_L, $1)"; then
	# Linking always hardcodes the temporary library directory.
	_LT_TAGVAR(hardcode_action, $1)=relink
	else
	# We can link without hardcoding, and we can hardcode nonexisting dirs.
	_LT_TAGVAR(hardcode_action, $1)=immediate
	fi
	else
	# We cannot hardcode anything, or else we can only hardcode existing
	# directories.
	_LT_TAGVAR(hardcode_action, $1)=unsupported
	fi
	AC_MSG_RESULT([$_LT_TAGVAR(hardcode_action, $1)])

	if test relink = "$_LT_TAGVAR(hardcode_action, $1)" \|\|
	test yes = "$_LT_TAGVAR(inherit_rpath, $1)"; then
	# Fast installation is not supported
	enable_fast_install=no
	elif test yes = "$shlibpath_overrides_runpath" \|\|
	test no = "$enable_shared"; then
	# Fast installation is not necessary
	enable_fast_install=needless
	fi
	_LT_TAGDECL([], [hardcode_action], [0],
	[How to hardcode a shared library path into an executable])
	])# _LT_LINKER_HARDCODE_LIBPATH


	# _LT_CMD_STRIPLIB
	# ----------------
	m4_defun([_LT_CMD_STRIPLIB],
	[m4_require([_LT_DECL_EGREP])
	striplib=
	old_striplib=
	AC_MSG_CHECKING([whether stripping libraries is possible])
	if test -n "$STRIP" && $STRIP -V 2>&1 \| $GREP "GNU strip" >/dev/null; then
	test -z "$old_striplib" && old_striplib="$STRIP --strip-debug"
	test -z "$striplib" && striplib="$STRIP --strip-unneeded"
	AC_MSG_RESULT([yes])
	else
	# FIXME - insert some real tests, host_os isn't really good enough
	case $host_os in
	darwin*)
	if test -n "$STRIP"; then
	striplib="$STRIP -x"
	old_striplib="$STRIP -S"
	AC_MSG_RESULT([yes])
	else
	AC_MSG_RESULT([no])
	fi
	;;
	*)
	AC_MSG_RESULT([no])
	;;
	esac
	fi
	_LT_DECL([], [old_striplib], [1], [Commands to strip libraries])
	_LT_DECL([], [striplib], [1])
	])# _LT_CMD_STRIPLIB


	# _LT_PREPARE_MUNGE_PATH_LIST
	# ---------------------------
	# Make sure func_munge_path_list() is defined correctly.
	m4_defun([_LT_PREPARE_MUNGE_PATH_LIST],
	[[# func_munge_path_list VARIABLE PATH
	# -----------------------------------
	# VARIABLE is name of variable containing _space_ separated list of
	# directories to be munged by the contents of PATH, which is string
	# having a format:
	# "DIR[:DIR]:"
	# string "DIR[ DIR]" will be prepended to VARIABLE
	# ":DIR[:DIR]"
	# string "DIR[ DIR]" will be appended to VARIABLE
	# "DIRP[:DIRP]::[DIRA:]DIRA"
	# string "DIRP[ DIRP]" will be prepended to VARIABLE and string
	# "DIRA[ DIRA]" will be appended to VARIABLE
	# "DIR[:DIR]"
	# VARIABLE will be replaced by "DIR[ DIR]"
	func_munge_path_list ()
	{
	case x@S\|@2 in
	x)
	;;
	*:)
	eval @S\|@1=\"`$ECHO @S\|@2 \| $SED 's/:/ /g'` \@S\|@@S\|@1\"
	;;
	x:*)
	eval @S\|@1=\"\@S\|@@S\|@1 `$ECHO @S\|@2 \| $SED 's/:/ /g'`\"
	;;
	::)
	eval @S\|@1=\"\@S\|@@S\|@1\ `$ECHO @S\|@2 \| $SED -e 's/.*:://' -e 's/:/ /g'`\"
	eval @S\|@1=\"`$ECHO @S\|@2 \| $SED -e 's/::.*//' -e 's/:/ /g'`\ \@S\|@@S\|@1\"
	;;
	*)
	eval @S\|@1=\"`$ECHO @S\|@2 \| $SED 's/:/ /g'`\"
	;;
	esac
	}
	]])# _LT_PREPARE_PATH_LIST


	# _LT_SYS_DYNAMIC_LINKER([TAG])
	# -----------------------------
	# PORTME Fill in your ld.so characteristics
	m4_defun([_LT_SYS_DYNAMIC_LINKER],
	[AC_REQUIRE([AC_CANONICAL_HOST])dnl
	m4_require([_LT_DECL_EGREP])dnl
	m4_require([_LT_FILEUTILS_DEFAULTS])dnl
	m4_require([_LT_DECL_OBJDUMP])dnl
	m4_require([_LT_DECL_SED])dnl
	m4_require([_LT_CHECK_SHELL_FEATURES])dnl
	m4_require([_LT_PREPARE_MUNGE_PATH_LIST])dnl
	AC_MSG_CHECKING([dynamic linker characteristics])
	m4_if([$1],
	[], [
	if test yes = "$GCC"; then
	case $host_os in
	darwin*) lt_awk_arg='/^libraries:/,/LR/' ;;
	*) lt_awk_arg='/^libraries:/' ;;
	esac
	case $host_os in
	mingw* \| cegcc*) lt_sed_strip_eq='s\|=$[[A-Za-z]]:$\|\1\|g' ;;
	*) lt_sed_strip_eq='s\|=/\|/\|g' ;;
	esac
	lt_search_path_spec=`$CC -print-search-dirs \| awk $lt_awk_arg \| $SED -e "s/^libraries://" -e $lt_sed_strip_eq`
	case $lt_search_path_spec in
	\;)
	# if the path contains ";" then we assume it to be the separator
	# otherwise default to the standard path separator (i.e. ":") - it is
	# assumed that no part of a normal pathname contains ";" but that should
	# okay in the real world where ";" in dirpaths is itself problematic.
	lt_search_path_spec=`$ECHO "$lt_search_path_spec" \| $SED 's/;/ /g'`
	;;
	*)
	lt_search_path_spec=`$ECHO "$lt_search_path_spec" \| $SED "s/$PATH_SEPARATOR/ /g"`
	;;
	esac
	# Ok, now we have the path, separated by spaces, we can step through it
	# and add multilib dir if necessary...
	lt_tmp_lt_search_path_spec=
	lt_multi_os_dir=/`$CC $CPPFLAGS $CFLAGS $LDFLAGS -print-multi-os-directory 2>/dev/null`
	# ...but if some path component already ends with the multilib dir we assume
	# that all is fine and trust -print-search-dirs as is (GCC 4.2? or newer).
	case "$lt_multi_os_dir; $lt_search_path_spec " in
	"/; "* \| "/.; "* \| "/./; "* \| "$lt_multi_os_dir " \| "$lt_multi_os_dir/ ")
	lt_multi_os_dir=
	;;
	esac
	for lt_sys_path in $lt_search_path_spec; do
	if test -d "$lt_sys_path$lt_multi_os_dir"; then
	lt_tmp_lt_search_path_spec="$lt_tmp_lt_search_path_spec $lt_sys_path$lt_multi_os_dir"
	elif test -n "$lt_multi_os_dir"; then
	test -d "$lt_sys_path" && \
	lt_tmp_lt_search_path_spec="$lt_tmp_lt_search_path_spec $lt_sys_path"
	fi
	done
	lt_search_path_spec=`$ECHO "$lt_tmp_lt_search_path_spec" \| awk '
	BEGIN {RS = " "; FS = "/\|\n";} {
	lt_foo = "";
	lt_count = 0;
	for (lt_i = NF; lt_i > 0; lt_i--) {
	if ($lt_i != "" && $lt_i != ".") {
	if ($lt_i == "..") {
	lt_count++;
	} else {
	if (lt_count == 0) {
	lt_foo = "/" $lt_i lt_foo;
	} else {
	lt_count--;
	}
	}
	}
	}
	if (lt_foo != "") { lt_freq[[lt_foo]]++; }
	if (lt_freq[[lt_foo]] == 1) { print lt_foo; }
	}'`
	# AWK program above erroneously prepends '/' to C:/dos/paths
	# for these hosts.
	case $host_os in
	mingw* \| cegcc*) lt_search_path_spec=`$ECHO "$lt_search_path_spec" \|\
	$SED 's\|/$[[A-Za-z]]:$\|\1\|g'` ;;
	esac
	sys_lib_search_path_spec=`$ECHO "$lt_search_path_spec" \| $lt_NL2SP`
	else
	sys_lib_search_path_spec="/lib /usr/lib /usr/local/lib"
	fi])
	library_names_spec=
	libname_spec='lib$name'
	soname_spec=
	shrext_cmds=.so
	postinstall_cmds=
	postuninstall_cmds=
	finish_cmds=
	finish_eval=
	shlibpath_var=
	shlibpath_overrides_runpath=unknown
	version_type=none
	dynamic_linker="$host_os ld.so"
	sys_lib_dlsearch_path_spec="/lib /usr/lib"
	need_lib_prefix=unknown
	hardcode_into_libs=no

	# when you set need_version to no, make sure it does not cause -set_version
	# flags to be left without arguments
	need_version=unknown

	AC_ARG_VAR([LT_SYS_LIBRARY_PATH],
	[User-defined run-time library search path.])

	case $host_os in
	aix3*)
	version_type=linux # correct to gnu/linux during the next big refactor
	library_names_spec='$libname$release$shared_ext$versuffix $libname.a'
	shlibpath_var=LIBPATH

	# AIX 3 has no versioning support, so we append a major version to the name.
	soname_spec='$libname$release$shared_ext$major'
	;;

	aix[[4-9]]*)
	version_type=linux # correct to gnu/linux during the next big refactor
	need_lib_prefix=no
	need_version=no
	hardcode_into_libs=yes
	if test ia64 = "$host_cpu"; then
	# AIX 5 supports IA64
	library_names_spec='$libname$release$shared_ext$major $libname$release$shared_ext$versuffix $libname$shared_ext'
	shlibpath_var=LD_LIBRARY_PATH
	else
	# With GCC up to 2.95.x, collect2 would create an import file
	# for dependence libraries. The import file would start with
	# the line '#! .'. This would cause the generated library to
	# depend on '.', always an invalid library. This was fixed in
	# development snapshots of GCC prior to 3.0.
	case $host_os in
	aix4 \| aix4.[[01]] \| aix4.[[01]].*)
	if { echo '#if __GNUC__ > 2 \|\| (__GNUC__ == 2 && __GNUC_MINOR__ >= 97)'
	echo ' yes '
	echo '#endif'; } \| $CC -E - \| $GREP yes > /dev/null; then
	:
	else
	can_build_shared=no
	fi
	;;
	esac
	# Using Import Files as archive members, it is possible to support
	# filename-based versioning of shared library archives on AIX. While
	# this would work for both with and without runtime linking, it will
	# prevent static linking of such archives. So we do filename-based
	# shared library versioning with .so extension only, which is used
	# when both runtime linking and shared linking is enabled.
	# Unfortunately, runtime linking may impact performance, so we do
	# not want this to be the default eventually. Also, we use the
	# versioned .so libs for executables only if there is the -brtl
	# linker flag in LDFLAGS as well, or --with-aix-soname=svr4 only.
	# To allow for filename-based versioning support, we need to create
	# libNAME.so.V as an archive file, containing:
	# *) an Import File, referring to the versioned filename of the
	# archive as well as the shared archive member, telling the
	# bitwidth (32 or 64) of that shared object, and providing the
	# list of exported symbols of that shared object, eventually
	# decorated with the 'weak' keyword
	# *) the shared object with the F_LOADONLY flag set, to really avoid
	# it being seen by the linker.
	# At run time we better use the real file rather than another symlink,
	# but for link time we create the symlink libNAME.so -> libNAME.so.V

	case $with_aix_soname,$aix_use_runtimelinking in
	# AIX (on Power*) has no versioning support, so currently we cannot hardcode correct
	# soname into executable. Probably we can add versioning support to
	# collect2, so additional links can be useful in future.
	aix,yes) # traditional libtool
	dynamic_linker='AIX unversionable lib.so'
	# If using run time linking (on AIX 4.2 or later) use lib<name>.so
	# instead of lib<name>.a to let people know that these are not
	# typical AIX shared libraries.
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	;;
	aix,no) # traditional AIX only
	dynamic_linker='AIX lib.a[(]lib.so.V[)]'
	# We preserve .a as extension for shared libraries through AIX4.2
	# and later when we are not doing run time linking.
	library_names_spec='$libname$release.a $libname.a'
	soname_spec='$libname$release$shared_ext$major'
	;;
	svr4,*) # full svr4 only
	dynamic_linker="AIX lib.so.V[(]$shared_archive_member_spec.o[)]"
	library_names_spec='$libname$release$shared_ext$major $libname$shared_ext'
	# We do not specify a path in Import Files, so LIBPATH fires.
	shlibpath_overrides_runpath=yes
	;;
	*,yes) # both, prefer svr4
	dynamic_linker="AIX lib.so.V[(]$shared_archive_member_spec.o[)], lib.a[(]lib.so.V[)]"
	library_names_spec='$libname$release$shared_ext$major $libname$shared_ext'
	# unpreferred sharedlib libNAME.a needs extra handling
	postinstall_cmds='test -n "$linkname" \|\| linkname="$realname"~func_stripname "" ".so" "$linkname"~$install_shared_prog "$dir/$func_stripname_result.$libext" "$destdir/$func_stripname_result.$libext"~test -z "$tstripme" \|\| test -z "$striplib" \|\| $striplib "$destdir/$func_stripname_result.$libext"'
	postuninstall_cmds='for n in $library_names $old_library; do :; done~func_stripname "" ".so" "$n"~test "$func_stripname_result" = "$n" \|\| func_append rmfiles " $odir/$func_stripname_result.$libext"'
	# We do not specify a path in Import Files, so LIBPATH fires.
	shlibpath_overrides_runpath=yes
	;;
	*,no) # both, prefer aix
	dynamic_linker="AIX lib.a[(]lib.so.V[)], lib.so.V[(]$shared_archive_member_spec.o[)]"
	library_names_spec='$libname$release.a $libname.a'
	soname_spec='$libname$release$shared_ext$major'
	# unpreferred sharedlib libNAME.so.V and symlink libNAME.so need extra handling
	postinstall_cmds='test -z "$dlname" \|\| $install_shared_prog $dir/$dlname $destdir/$dlname~test -z "$tstripme" \|\| test -z "$striplib" \|\| $striplib $destdir/$dlname~test -n "$linkname" \|\| linkname=$realname~func_stripname "" ".a" "$linkname"~(cd "$destdir" && $LN_S -f $dlname $func_stripname_result.so)'
	postuninstall_cmds='test -z "$dlname" \|\| func_append rmfiles " $odir/$dlname"~for n in $old_library $library_names; do :; done~func_stripname "" ".a" "$n"~func_append rmfiles " $odir/$func_stripname_result.so"'
	;;
	esac
	shlibpath_var=LIBPATH
	fi
	;;

	amigaos*)
	case $host_cpu in
	powerpc)
	# Since July 2007 AmigaOS4 officially supports .so libraries.
	# When compiling the executable, add -use-dynld -Lsobjs: to the compileline.
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	;;
	m68k)
	library_names_spec='$libname.ixlibrary $libname.a'
	# Create ${libname}_ixlibrary.a entries in /sys/libs.
	finish_eval='for lib in `ls $libdir/.ixlibrary 2>/dev/null`; do libname=`func_echo_all "$lib" \| $SED '\''s%^./$[[^/]]*$\.ixlibrary$%\1%'\''`; $RM /sys/libs/${libname}_ixlibrary.a; $show "cd /sys/libs && $LN_S $lib ${libname}_ixlibrary.a"; cd /sys/libs && $LN_S $lib ${libname}_ixlibrary.a \|\| exit 1; done'
	;;
	esac
	;;

	beos*)
	library_names_spec='$libname$shared_ext'
	dynamic_linker="$host_os ld.so"
	shlibpath_var=LIBRARY_PATH
	;;

	bsdi[[45]]*)
	version_type=linux # correct to gnu/linux during the next big refactor
	need_version=no
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	finish_cmds='PATH="\$PATH:/sbin" ldconfig $libdir'
	shlibpath_var=LD_LIBRARY_PATH
	sys_lib_search_path_spec="/shlib /usr/lib /usr/X11/lib /usr/contrib/lib /lib /usr/local/lib"
	sys_lib_dlsearch_path_spec="/shlib /usr/lib /usr/local/lib"
	# the default ld.so.conf also contains /usr/contrib/lib and
	# /usr/X11R6/lib (/usr/X11 is a link to /usr/X11R6), but let us allow
	# libtool to hard-code these into programs
	;;

	cygwin* \| mingw* \| pw32* \| cegcc*)
	version_type=windows
	shrext_cmds=.dll
	need_version=no
	need_lib_prefix=no

	case $GCC,$cc_basename in
	yes,*)
	# gcc
	library_names_spec='$libname.dll.a'
	# DLL is installed to $(libdir)/../bin by postinstall_cmds
	postinstall_cmds='base_file=`basename \$file`~
	dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; echo \$dlname'\''`~
	dldir=$destdir/`dirname \$dlpath`~
	test -d \$dldir \|\| mkdir -p \$dldir~
	$install_prog $dir/$dlname \$dldir/$dlname~
	chmod a+x \$dldir/$dlname~
	if test -n '\''$stripme'\'' && test -n '\''$striplib'\''; then
	eval '\''$striplib \$dldir/$dlname'\'' \|\| exit \$?;
	fi'
	postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; echo \$dlname'\''`~
	dlpath=$dir/\$dldll~
	$RM \$dlpath'
	shlibpath_overrides_runpath=yes

	case $host_os in
	cygwin*)
	# Cygwin DLLs use 'cyg' prefix rather than 'lib'
	soname_spec='`echo $libname \| sed -e 's/^lib/cyg/'``echo $release \| $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
	m4_if([$1], [],[
	sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/lib/w32api"])
	;;
	mingw* \| cegcc*)
	# MinGW DLLs use traditional 'lib' prefix
	soname_spec='$libname`echo $release \| $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
	;;
	pw32*)
	# pw32 DLLs use 'pw' prefix rather than 'lib'
	library_names_spec='`echo $libname \| sed -e 's/^lib/pw/'``echo $release \| $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
	;;
	esac
	dynamic_linker='Win32 ld.exe'
	;;

	,cl)
	# Native MSVC
	libname_spec='$name'
	soname_spec='$libname`echo $release \| $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
	library_names_spec='$libname.dll.lib'

	case $build_os in
	mingw*)
	sys_lib_search_path_spec=
	lt_save_ifs=$IFS
	IFS=';'
	for lt_path in $LIB
	do
	IFS=$lt_save_ifs
	# Let DOS variable expansion print the short 8.3 style file name.
	lt_path=`cd "$lt_path" 2>/dev/null && cmd //C "for %i in (".") do @echo %~si"`
	sys_lib_search_path_spec="$sys_lib_search_path_spec $lt_path"
	done
	IFS=$lt_save_ifs
	# Convert to MSYS style.
	sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" \| sed -e 's\|\\\\\|/\|g' -e 's\| \$[[a-zA-Z]]\$:\| /\\1\|g' -e 's\|^ \|\|'`
	;;
	cygwin*)
	# Convert to unix form, then to dos form, then back to unix form
	# but this time dos style (no spaces!) so that the unix form looks
	# like /cygdrive/c/PROGRA~1:/cygdr...
	sys_lib_search_path_spec=`cygpath --path --unix "$LIB"`
	sys_lib_search_path_spec=`cygpath --path --dos "$sys_lib_search_path_spec" 2>/dev/null`
	sys_lib_search_path_spec=`cygpath --path --unix "$sys_lib_search_path_spec" \| $SED -e "s/$PATH_SEPARATOR/ /g"`
	;;
	*)
	sys_lib_search_path_spec=$LIB
	if $ECHO "$sys_lib_search_path_spec" \| [$GREP ';[c-zC-Z]:/' >/dev/null]; then
	# It is most probably a Windows format PATH.
	sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" \| $SED -e 's/;/ /g'`
	else
	sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" \| $SED -e "s/$PATH_SEPARATOR/ /g"`
	fi
	# FIXME: find the short name or the path components, as spaces are
	# common. (e.g. "Program Files" -> "PROGRA~1")
	;;
	esac

	# DLL is installed to $(libdir)/../bin by postinstall_cmds
	postinstall_cmds='base_file=`basename \$file`~
	dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; echo \$dlname'\''`~
	dldir=$destdir/`dirname \$dlpath`~
	test -d \$dldir \|\| mkdir -p \$dldir~
	$install_prog $dir/$dlname \$dldir/$dlname'
	postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; echo \$dlname'\''`~
	dlpath=$dir/\$dldll~
	$RM \$dlpath'
	shlibpath_overrides_runpath=yes
	dynamic_linker='Win32 link.exe'
	;;

	*)
	# Assume MSVC wrapper
	library_names_spec='$libname`echo $release \| $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext $libname.lib'
	dynamic_linker='Win32 ld.exe'
	;;
	esac
	# FIXME: first we should search . and the directory the executable is in
	shlibpath_var=PATH
	;;

	darwin* \| rhapsody*)
	dynamic_linker="$host_os dyld"
	version_type=darwin
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$major$shared_ext $libname$shared_ext'
	soname_spec='$libname$release$major$shared_ext'
	shlibpath_overrides_runpath=yes
	shlibpath_var=DYLD_LIBRARY_PATH
	shrext_cmds='`test .$module = .yes && echo .so \|\| echo .dylib`'
	m4_if([$1], [],[
	sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/local/lib"])
	sys_lib_dlsearch_path_spec='/usr/local/lib /lib /usr/lib'
	;;

	dgux*)
	version_type=linux # correct to gnu/linux during the next big refactor
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	shlibpath_var=LD_LIBRARY_PATH
	;;

	freebsd* \| dragonfly*)
	# DragonFly does not have aout. When/if they implement a new
	# versioning mechanism, adjust this.
	if test -x /usr/bin/objformat; then
	objformat=`/usr/bin/objformat`
	else
	case $host_os in
	freebsd[[23]].*) objformat=aout ;;
	*) objformat=elf ;;
	esac
	fi
	version_type=freebsd-$objformat
	case $version_type in
	freebsd-elf*)
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	need_version=no
	need_lib_prefix=no
	;;
	freebsd-*)
	library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix'
	need_version=yes
	;;
	esac
	shlibpath_var=LD_LIBRARY_PATH
	case $host_os in
	freebsd2.*)
	shlibpath_overrides_runpath=yes
	;;
	freebsd3.[[01]]* \| freebsdelf3.[[01]]*)
	shlibpath_overrides_runpath=yes
	hardcode_into_libs=yes
	;;
	freebsd3.[[2-9]]* \| freebsdelf3.[[2-9]]* \| \
	freebsd4.[[0-5]] \| freebsdelf4.[[0-5]] \| freebsd4.1.1 \| freebsdelf4.1.1)
	shlibpath_overrides_runpath=no
	hardcode_into_libs=yes
	;;
	*) # from 4.6 on, and DragonFly
	shlibpath_overrides_runpath=yes
	hardcode_into_libs=yes
	;;
	esac
	;;

	haiku*)
	version_type=linux # correct to gnu/linux during the next big refactor
	need_lib_prefix=no
	need_version=no
	dynamic_linker="$host_os runtime_loader"
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	shlibpath_var=LIBRARY_PATH
	shlibpath_overrides_runpath=no
	sys_lib_dlsearch_path_spec='/boot/home/config/lib /boot/common/lib /boot/system/lib'
	hardcode_into_libs=yes
	;;

	hpux9* \| hpux10* \| hpux11*)
	# Give a soname corresponding to the major version so that dld.sl refuses to
	# link against other versions.
	version_type=sunos
	need_lib_prefix=no
	need_version=no
	case $host_cpu in
	ia64*)
	shrext_cmds='.so'
	hardcode_into_libs=yes
	dynamic_linker="$host_os dld.so"
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	if test 32 = "$HPUX_IA64_MODE"; then
	sys_lib_search_path_spec="/usr/lib/hpux32 /usr/local/lib/hpux32 /usr/local/lib"
	sys_lib_dlsearch_path_spec=/usr/lib/hpux32
	else
	sys_lib_search_path_spec="/usr/lib/hpux64 /usr/local/lib/hpux64"
	sys_lib_dlsearch_path_spec=/usr/lib/hpux64
	fi
	;;
	hppa64)
	shrext_cmds='.sl'
	hardcode_into_libs=yes
	dynamic_linker="$host_os dld.sl"
	shlibpath_var=LD_LIBRARY_PATH # How should we handle SHLIB_PATH
	shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	sys_lib_search_path_spec="/usr/lib/pa20_64 /usr/ccs/lib/pa20_64"
	sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec
	;;
	*)
	shrext_cmds='.sl'
	dynamic_linker="$host_os dld.sl"
	shlibpath_var=SHLIB_PATH
	shlibpath_overrides_runpath=no # +s is required to enable SHLIB_PATH
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	;;
	esac
	# HP-UX runs really slowly unless shared libraries are mode 555, ...
	postinstall_cmds='chmod 555 $lib'
	# or fails outright, so override atomically:
	install_override_mode=555
	;;

	interix[[3-9]]*)
	version_type=linux # correct to gnu/linux during the next big refactor
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	dynamic_linker='Interix 3.x ld.so.1 (PE, like ELF)'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=no
	hardcode_into_libs=yes
	;;

	irix5* \| irix6* \| nonstopux*)
	case $host_os in
	nonstopux*) version_type=nonstopux ;;
	*)
	if test yes = "$lt_cv_prog_gnu_ld"; then
	version_type=linux # correct to gnu/linux during the next big refactor
	else
	version_type=irix
	fi ;;
	esac
	need_lib_prefix=no
	need_version=no
	soname_spec='$libname$release$shared_ext$major'
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$release$shared_ext $libname$shared_ext'
	case $host_os in
	irix5* \| nonstopux*)
	libsuff= shlibsuff=
	;;
	*)
	case $LD in # libtool.m4 will add one of these switches to LD
	-32\|"-32 "\|-melf32bsmip\|"-melf32bsmip ")
	libsuff= shlibsuff= libmagic=32-bit;;
	-n32\|"-n32 "\|-melf32bmipn32\|"-melf32bmipn32 ")
	libsuff=32 shlibsuff=N32 libmagic=N32;;
	-64\|"-64 "\|-melf64bmip\|"-melf64bmip ")
	libsuff=64 shlibsuff=64 libmagic=64-bit;;
	*) libsuff= shlibsuff= libmagic=never-match;;
	esac
	;;
	esac
	shlibpath_var=LD_LIBRARY${shlibsuff}_PATH
	shlibpath_overrides_runpath=no
	sys_lib_search_path_spec="/usr/lib$libsuff /lib$libsuff /usr/local/lib$libsuff"
	sys_lib_dlsearch_path_spec="/usr/lib$libsuff /lib$libsuff"
	hardcode_into_libs=yes
	;;

	# No shared lib support for Linux oldld, aout, or coff.
	linuxoldld \| linuxaout \| linuxcoff)
	dynamic_linker=no
	;;

	linuxandroid)
	version_type=none # Android doesn't support versioned libraries.
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$shared_ext'
	soname_spec='$libname$release$shared_ext'
	finish_cmds=
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=yes

	# This implies no fast_install, which is unacceptable.
	# Some rework will be needed to allow for fast_install
	# before this can be enabled.
	hardcode_into_libs=yes

	dynamic_linker='Android linker'
	# Don't embed -rpath directories since the linker doesn't support them.
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir'
	;;

	# This must be glibc/ELF.
	linux* \| kbsd-gnu \| kopensolaris-gnu \| gnu)
	version_type=linux # correct to gnu/linux during the next big refactor
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	finish_cmds='PATH="\$PATH:/sbin" ldconfig -n $libdir'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=no

	# Some binutils ld are patched to set DT_RUNPATH
	AC_CACHE_VAL([lt_cv_shlibpath_overrides_runpath],
	[lt_cv_shlibpath_overrides_runpath=no
	save_LDFLAGS=$LDFLAGS
	save_libdir=$libdir
	eval "libdir=/foo; wl=\"$_LT_TAGVAR(lt_prog_compiler_wl, $1)\"; \
	LDFLAGS=\"\$LDFLAGS $_LT_TAGVAR(hardcode_libdir_flag_spec, $1)\""
	AC_LINK_IFELSE([AC_LANG_PROGRAM([],[])],
	[AS_IF([ ($OBJDUMP -p conftest$ac_exeext) 2>/dev/null \| grep "RUNPATH.*$libdir" >/dev/null],
	[lt_cv_shlibpath_overrides_runpath=yes])])
	LDFLAGS=$save_LDFLAGS
	libdir=$save_libdir
	])
	shlibpath_overrides_runpath=$lt_cv_shlibpath_overrides_runpath

	# This implies no fast_install, which is unacceptable.
	# Some rework will be needed to allow for fast_install
	# before this can be enabled.
	hardcode_into_libs=yes

	# Add ABI-specific directories to the system library path.
	sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /lib /usr/lib"

	# Ideally, we could use ldconfig to report all directores which are
	# searched for libraries, however this is still not possible. Aside from not
	# being certain /sbin/ldconfig is available, command
	# 'ldconfig -N -X -v \| grep ^/' on 64bit Fedora does not report /usr/lib64,
	# even though it is searched at run-time. Try to do the best guess by
	# appending ld.so.conf contents (and includes) to the search path.
	if test -f /etc/ld.so.conf; then
	lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \[$]2)); skip = 1; } { if (!skip) print \[$]0; skip = 0; }' < /etc/ld.so.conf \| $SED -e 's/#.//;/^[ ]hwcap[ ]/d;s/[:, ]/ /g;s/=[^=]$//;s/=[^= ] / /g;s/"//g;/^$/d' \| tr '\n' ' '`
	sys_lib_dlsearch_path_spec="$sys_lib_dlsearch_path_spec $lt_ld_extra"
	fi

	# We used to test for /lib/ld.so.1 and disable shared libraries on
	# powerpc, because MkLinux only supported shared libraries with the
	# GNU dynamic linker. Since this was broken with cross compilers,
	# most powerpc-linux boxes support dynamic linking these days and
	# people can always --disable-shared, the test was removed, and we
	# assume the GNU/Linux dynamic linker is in use.
	dynamic_linker='GNU/Linux ld.so'
	;;

	netbsd*)
	version_type=sunos
	need_lib_prefix=no
	need_version=no
	if echo __ELF__ \| $CC -E - \| $GREP __ELF__ >/dev/null; then
	library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix'
	finish_cmds='PATH="\$PATH:/sbin" ldconfig -m $libdir'
	dynamic_linker='NetBSD (a.out) ld.so'
	else
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	dynamic_linker='NetBSD ld.elf_so'
	fi
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=yes
	hardcode_into_libs=yes
	;;

	newsos6)
	version_type=linux # correct to gnu/linux during the next big refactor
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=yes
	;;

	nto \| qnx)
	version_type=qnx
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=no
	hardcode_into_libs=yes
	dynamic_linker='ldqnx.so'
	;;

	openbsd* \| bitrig*)
	version_type=sunos
	sys_lib_dlsearch_path_spec=/usr/lib
	need_lib_prefix=no
	if test -z "`echo __ELF__ \| $CC -E - \| $GREP __ELF__`"; then
	need_version=no
	else
	need_version=yes
	fi
	library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix'
	finish_cmds='PATH="\$PATH:/sbin" ldconfig -m $libdir'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=yes
	;;

	os2*)
	libname_spec='$name'
	version_type=windows
	shrext_cmds=.dll
	need_version=no
	need_lib_prefix=no
	# OS/2 can only load a DLL with a base name of 8 characters or less.
	soname_spec='`test -n "$os2dllname" && libname="$os2dllname";
	v=$($ECHO $release$versuffix \| tr -d .-);
	n=$($ECHO $libname \| cut -b -$((8 - ${#v})) \| tr . _);
	$ECHO $n$v`$shared_ext'
	library_names_spec='${libname}_dll.$libext'
	dynamic_linker='OS/2 ld.exe'
	shlibpath_var=BEGINLIBPATH
	sys_lib_search_path_spec="/lib /usr/lib /usr/local/lib"
	sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec
	postinstall_cmds='base_file=`basename \$file`~
	dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; $ECHO \$dlname'\''`~
	dldir=$destdir/`dirname \$dlpath`~
	test -d \$dldir \|\| mkdir -p \$dldir~
	$install_prog $dir/$dlname \$dldir/$dlname~
	chmod a+x \$dldir/$dlname~
	if test -n '\''$stripme'\'' && test -n '\''$striplib'\''; then
	eval '\''$striplib \$dldir/$dlname'\'' \|\| exit \$?;
	fi'
	postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; $ECHO \$dlname'\''`~
	dlpath=$dir/\$dldll~
	$RM \$dlpath'
	;;

	osf3* \| osf4* \| osf5*)
	version_type=osf
	need_lib_prefix=no
	need_version=no
	soname_spec='$libname$release$shared_ext$major'
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	shlibpath_var=LD_LIBRARY_PATH
	sys_lib_search_path_spec="/usr/shlib /usr/ccs/lib /usr/lib/cmplrs/cc /usr/lib /usr/local/lib /var/shlib"
	sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec
	;;

	rdos*)
	dynamic_linker=no
	;;

	solaris*)
	version_type=linux # correct to gnu/linux during the next big refactor
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=yes
	hardcode_into_libs=yes
	# ldd complains unless libraries are executable
	postinstall_cmds='chmod +x $lib'
	;;

	sunos4*)
	version_type=sunos
	library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix'
	finish_cmds='PATH="\$PATH:/usr/etc" ldconfig $libdir'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=yes
	if test yes = "$with_gnu_ld"; then
	need_lib_prefix=no
	fi
	need_version=yes
	;;

	sysv4 \| sysv4.3*)
	version_type=linux # correct to gnu/linux during the next big refactor
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	shlibpath_var=LD_LIBRARY_PATH
	case $host_vendor in
	sni)
	shlibpath_overrides_runpath=no
	need_lib_prefix=no
	runpath_var=LD_RUN_PATH
	;;
	siemens)
	need_lib_prefix=no
	;;
	motorola)
	need_lib_prefix=no
	need_version=no
	shlibpath_overrides_runpath=no
	sys_lib_search_path_spec='/lib /usr/lib /usr/ccs/lib'
	;;
	esac
	;;

	sysv4MP)
	if test -d /usr/nec; then
	version_type=linux # correct to gnu/linux during the next big refactor
	library_names_spec='$libname$shared_ext.$versuffix $libname$shared_ext.$major $libname$shared_ext'
	soname_spec='$libname$shared_ext.$major'
	shlibpath_var=LD_LIBRARY_PATH
	fi
	;;

	sysv5* \| sco3.2v5* \| sco5v6* \| unixware* \| OpenUNIX* \| sysv4uw2)
	version_type=sco
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=yes
	hardcode_into_libs=yes
	if test yes = "$with_gnu_ld"; then
	sys_lib_search_path_spec='/usr/local/lib /usr/gnu/lib /usr/ccs/lib /usr/lib /lib'
	else
	sys_lib_search_path_spec='/usr/ccs/lib /usr/lib'
	case $host_os in
	sco3.2v5*)
	sys_lib_search_path_spec="$sys_lib_search_path_spec /lib"
	;;
	esac
	fi
	sys_lib_dlsearch_path_spec='/usr/lib'
	;;

	tpf*)
	# TPF is a cross-target only. Preferred cross-host = GNU/Linux.
	version_type=linux # correct to gnu/linux during the next big refactor
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=no
	hardcode_into_libs=yes
	;;

	uts4*)
	version_type=linux # correct to gnu/linux during the next big refactor
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	shlibpath_var=LD_LIBRARY_PATH
	;;

	*)
	dynamic_linker=no
	;;
	esac
	AC_MSG_RESULT([$dynamic_linker])
	test no = "$dynamic_linker" && can_build_shared=no

	variables_saved_for_relink="PATH $shlibpath_var $runpath_var"
	if test yes = "$GCC"; then
	variables_saved_for_relink="$variables_saved_for_relink GCC_EXEC_PREFIX COMPILER_PATH LIBRARY_PATH"
	fi

	if test set = "${lt_cv_sys_lib_search_path_spec+set}"; then
	sys_lib_search_path_spec=$lt_cv_sys_lib_search_path_spec
	fi

	if test set = "${lt_cv_sys_lib_dlsearch_path_spec+set}"; then
	sys_lib_dlsearch_path_spec=$lt_cv_sys_lib_dlsearch_path_spec
	fi

	# remember unaugmented sys_lib_dlsearch_path content for libtool script decls...
	configure_time_dlsearch_path=$sys_lib_dlsearch_path_spec

	# ... but it needs LT_SYS_LIBRARY_PATH munging for other configure-time code
	func_munge_path_list sys_lib_dlsearch_path_spec "$LT_SYS_LIBRARY_PATH"

	# to be used as default LT_SYS_LIBRARY_PATH value in generated libtool
	configure_time_lt_sys_library_path=$LT_SYS_LIBRARY_PATH

	_LT_DECL([], [variables_saved_for_relink], [1],
	[Variables whose values should be saved in libtool wrapper scripts and
	restored at link time])
	_LT_DECL([], [need_lib_prefix], [0],
	[Do we need the "lib" prefix for modules?])
	_LT_DECL([], [need_version], [0], [Do we need a version for libraries?])
	_LT_DECL([], [version_type], [0], [Library versioning type])
	_LT_DECL([], [runpath_var], [0], [Shared library runtime path variable])
	_LT_DECL([], [shlibpath_var], [0],[Shared library path variable])
	_LT_DECL([], [shlibpath_overrides_runpath], [0],
	[Is shlibpath searched before the hard-coded library search path?])
	_LT_DECL([], [libname_spec], [1], [Format of library name prefix])
	_LT_DECL([], [library_names_spec], [1],
	[[List of archive names. First name is the real one, the rest are links.
	The last name is the one that the linker finds with -lNAME]])
	_LT_DECL([], [soname_spec], [1],
	[[The coded name of the library, if different from the real name]])
	_LT_DECL([], [install_override_mode], [1],
	[Permission mode override for installation of shared libraries])
	_LT_DECL([], [postinstall_cmds], [2],
	[Command to use after installation of a shared archive])
	_LT_DECL([], [postuninstall_cmds], [2],
	[Command to use after uninstallation of a shared archive])
	_LT_DECL([], [finish_cmds], [2],
	[Commands used to finish a libtool library installation in a directory])
	_LT_DECL([], [finish_eval], [1],
	[[As "finish_cmds", except a single script fragment to be evaled but
	not shown]])
	_LT_DECL([], [hardcode_into_libs], [0],
	[Whether we should hardcode library paths into libraries])
	_LT_DECL([], [sys_lib_search_path_spec], [2],
	[Compile-time system search path for libraries])
	_LT_DECL([sys_lib_dlsearch_path_spec], [configure_time_dlsearch_path], [2],
	[Detected run-time system search path for libraries])
	_LT_DECL([], [configure_time_lt_sys_library_path], [2],
	[Explicit LT_SYS_LIBRARY_PATH set during ./configure time])
	])# _LT_SYS_DYNAMIC_LINKER


	# _LT_PATH_TOOL_PREFIX(TOOL)
	# --------------------------
	# find a file program that can recognize shared library
	AC_DEFUN([_LT_PATH_TOOL_PREFIX],
	[m4_require([_LT_DECL_EGREP])dnl
	AC_MSG_CHECKING([for $1])
	AC_CACHE_VAL(lt_cv_path_MAGIC_CMD,
	[case $MAGIC_CMD in
	[[\\/] \| ?:[\\/]])
	lt_cv_path_MAGIC_CMD=$MAGIC_CMD # Let the user override the test with a path.
	;;
	*)
	lt_save_MAGIC_CMD=$MAGIC_CMD
	lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR
	dnl $ac_dummy forces splitting on constant user-supplied paths.
	dnl POSIX.2 word splitting is done only on the output of word expansions,
	dnl not every word. This closes a longstanding sh security hole.
	ac_dummy="m4_if([$2], , $PATH, [$2])"
	for ac_dir in $ac_dummy; do
	IFS=$lt_save_ifs
	test -z "$ac_dir" && ac_dir=.
	if test -f "$ac_dir/$1"; then
	lt_cv_path_MAGIC_CMD=$ac_dir/"$1"
	if test -n "$file_magic_test_file"; then
	case $deplibs_check_method in
	"file_magic "*)
	file_magic_regex=`expr "$deplibs_check_method" : "file_magic $.*$"`
	MAGIC_CMD=$lt_cv_path_MAGIC_CMD
	if eval $file_magic_cmd \$file_magic_test_file 2> /dev/null \|
	$EGREP "$file_magic_regex" > /dev/null; then
	:
	else
	cat <<_LT_EOF 1>&2

	*** Warning: the command libtool uses to detect shared libraries,
	*** $file_magic_cmd, produces output that libtool cannot recognize.
	*** The result is that libtool may fail to recognize shared libraries
	*** as such. This will affect the creation of libtool libraries that
	*** depend on shared libraries, but programs linked with such libtool
	*** libraries will work regardless of this problem. Nevertheless, you
	*** may want to report the problem to your system manager and/or to
	*** bug-libtool@gnu.org

	_LT_EOF
	fi ;;
	esac
	fi
	break
	fi
	done
	IFS=$lt_save_ifs
	MAGIC_CMD=$lt_save_MAGIC_CMD
	;;
	esac])
	MAGIC_CMD=$lt_cv_path_MAGIC_CMD
	if test -n "$MAGIC_CMD"; then
	AC_MSG_RESULT($MAGIC_CMD)
	else
	AC_MSG_RESULT(no)
	fi
	_LT_DECL([], [MAGIC_CMD], [0],
	[Used to examine libraries when file_magic_cmd begins with "file"])dnl
	])# _LT_PATH_TOOL_PREFIX

	# Old name:
	AU_ALIAS([AC_PATH_TOOL_PREFIX], [_LT_PATH_TOOL_PREFIX])
	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([AC_PATH_TOOL_PREFIX], [])


	# _LT_PATH_MAGIC
	# --------------
	# find a file program that can recognize a shared library
	m4_defun([_LT_PATH_MAGIC],
	[_LT_PATH_TOOL_PREFIX(${ac_tool_prefix}file, /usr/bin$PATH_SEPARATOR$PATH)
	if test -z "$lt_cv_path_MAGIC_CMD"; then
	if test -n "$ac_tool_prefix"; then
	_LT_PATH_TOOL_PREFIX(file, /usr/bin$PATH_SEPARATOR$PATH)
	else
	MAGIC_CMD=:
	fi
	fi
	])# _LT_PATH_MAGIC


	# LT_PATH_LD
	# ----------
	# find the pathname to the GNU or non-GNU linker
	AC_DEFUN([LT_PATH_LD],
	[AC_REQUIRE([AC_PROG_CC])dnl
	AC_REQUIRE([AC_CANONICAL_HOST])dnl
	AC_REQUIRE([AC_CANONICAL_BUILD])dnl
	m4_require([_LT_DECL_SED])dnl
	m4_require([_LT_DECL_EGREP])dnl
	m4_require([_LT_PROG_ECHO_BACKSLASH])dnl

	AC_ARG_WITH([gnu-ld],
	[AS_HELP_STRING([--with-gnu-ld],
	[assume the C compiler uses GNU ld @<:@default=no@:>@])],
	[test no = "$withval" \|\| with_gnu_ld=yes],
	[with_gnu_ld=no])dnl

	ac_prog=ld
	if test yes = "$GCC"; then
	# Check if gcc -print-prog-name=ld gives a path.
	AC_MSG_CHECKING([for ld used by $CC])
	case $host in
	--mingw*)
	# gcc leaves a trailing carriage return, which upsets mingw
	ac_prog=`($CC -print-prog-name=ld) 2>&5 \| tr -d '\015'` ;;
	*)
	ac_prog=`($CC -print-prog-name=ld) 2>&5` ;;
	esac
	case $ac_prog in
	# Accept absolute paths.
	[[\\/]]* \| ?:[[\\/]]*)
	re_direlt='/[[^/]][[^/]]*/\.\./'
	# Canonicalize the pathname of ld
	ac_prog=`$ECHO "$ac_prog"\| $SED 's%\\\\%/%g'`
	while $ECHO "$ac_prog" \| $GREP "$re_direlt" > /dev/null 2>&1; do
	ac_prog=`$ECHO $ac_prog\| $SED "s%$re_direlt%/%"`
	done
	test -z "$LD" && LD=$ac_prog
	;;
	"")
	# If it fails, then pretend we aren't using GCC.
	ac_prog=ld
	;;
	*)
	# If it is relative, then search for the first ld in PATH.
	with_gnu_ld=unknown
	;;
	esac
	elif test yes = "$with_gnu_ld"; then
	AC_MSG_CHECKING([for GNU ld])
	else
	AC_MSG_CHECKING([for non-GNU ld])
	fi
	AC_CACHE_VAL(lt_cv_path_LD,
	[if test -z "$LD"; then
	lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR
	for ac_dir in $PATH; do
	IFS=$lt_save_ifs
	test -z "$ac_dir" && ac_dir=.
	if test -f "$ac_dir/$ac_prog" \|\| test -f "$ac_dir/$ac_prog$ac_exeext"; then
	lt_cv_path_LD=$ac_dir/$ac_prog
	# Check to see if the program is GNU ld. I'd rather use --version,
	# but apparently some variants of GNU ld only accept -v.
	# Break only if it was the GNU/non-GNU ld that we prefer.
	case `"$lt_cv_path_LD" -v 2>&1 </dev/null` in
	GNU \| 'with BFD')
	test no != "$with_gnu_ld" && break
	;;
	*)
	test yes != "$with_gnu_ld" && break
	;;
	esac
	fi
	done
	IFS=$lt_save_ifs
	else
	lt_cv_path_LD=$LD # Let the user override the test with a path.
	fi])
	LD=$lt_cv_path_LD
	if test -n "$LD"; then
	AC_MSG_RESULT($LD)
	else
	AC_MSG_RESULT(no)
	fi
	test -z "$LD" && AC_MSG_ERROR([no acceptable ld found in \$PATH])
	_LT_PATH_LD_GNU
	AC_SUBST([LD])

	_LT_TAGDECL([], [LD], [1], [The linker used to build libraries])
	])# LT_PATH_LD

	# Old names:
	AU_ALIAS([AM_PROG_LD], [LT_PATH_LD])
	AU_ALIAS([AC_PROG_LD], [LT_PATH_LD])
	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([AM_PROG_LD], [])
	dnl AC_DEFUN([AC_PROG_LD], [])


	# _LT_PATH_LD_GNU
	#- --------------
	m4_defun([_LT_PATH_LD_GNU],
	[AC_CACHE_CHECK([if the linker ($LD) is GNU ld], lt_cv_prog_gnu_ld,
	[# I'd rather use --version here, but apparently some GNU lds only accept -v.
	case `$LD -v 2>&1 </dev/null` in
	GNU \| 'with BFD')
	lt_cv_prog_gnu_ld=yes
	;;
	*)
	lt_cv_prog_gnu_ld=no
	;;
	esac])
	with_gnu_ld=$lt_cv_prog_gnu_ld
	])# _LT_PATH_LD_GNU


	# _LT_CMD_RELOAD
	# --------------
	# find reload flag for linker
	# -- PORTME Some linkers may need a different reload flag.
	m4_defun([_LT_CMD_RELOAD],
	[AC_CACHE_CHECK([for $LD option to reload object files],
	lt_cv_ld_reload_flag,
	[lt_cv_ld_reload_flag='-r'])
	reload_flag=$lt_cv_ld_reload_flag
	case $reload_flag in
	"" \| " "*) ;;
	*) reload_flag=" $reload_flag" ;;
	esac
	reload_cmds='$LD$reload_flag -o $output$reload_objs'
	case $host_os in
	cygwin* \| mingw* \| pw32* \| cegcc*)
	if test yes != "$GCC"; then
	reload_cmds=false
	fi
	;;
	darwin*)
	if test yes = "$GCC"; then
	reload_cmds='$LTCC $LTCFLAGS -nostdlib $wl-r -o $output$reload_objs'
	else
	reload_cmds='$LD$reload_flag -o $output$reload_objs'
	fi
	;;
	esac
	_LT_TAGDECL([], [reload_flag], [1], [How to create reloadable object files])dnl
	_LT_TAGDECL([], [reload_cmds], [2])dnl
	])# _LT_CMD_RELOAD


	# _LT_PATH_DD
	# -----------
	# find a working dd
	m4_defun([_LT_PATH_DD],
	[AC_CACHE_CHECK([for a working dd], [ac_cv_path_lt_DD],
	[printf 0123456789abcdef0123456789abcdef >conftest.i
	cat conftest.i conftest.i >conftest2.i
	: ${lt_DD:=$DD}
	AC_PATH_PROGS_FEATURE_CHECK([lt_DD], [dd],
	[if "$ac_path_lt_DD" bs=32 count=1 <conftest2.i >conftest.out 2>/dev/null; then
	cmp -s conftest.i conftest.out \
	&& ac_cv_path_lt_DD="$ac_path_lt_DD" ac_path_lt_DD_found=:
	fi])
	rm -f conftest.i conftest2.i conftest.out])
	])# _LT_PATH_DD


	# _LT_CMD_TRUNCATE
	# ----------------
	# find command to truncate a binary pipe
	m4_defun([_LT_CMD_TRUNCATE],
	[m4_require([_LT_PATH_DD])
	AC_CACHE_CHECK([how to truncate binary pipes], [lt_cv_truncate_bin],
	[printf 0123456789abcdef0123456789abcdef >conftest.i
	cat conftest.i conftest.i >conftest2.i
	lt_cv_truncate_bin=
	if "$ac_cv_path_lt_DD" bs=32 count=1 <conftest2.i >conftest.out 2>/dev/null; then
	cmp -s conftest.i conftest.out \
	&& lt_cv_truncate_bin="$ac_cv_path_lt_DD bs=4096 count=1"
	fi
	rm -f conftest.i conftest2.i conftest.out
	test -z "$lt_cv_truncate_bin" && lt_cv_truncate_bin="$SED -e 4q"])
	_LT_DECL([lt_truncate_bin], [lt_cv_truncate_bin], [1],
	[Command to truncate a binary pipe])
	])# _LT_CMD_TRUNCATE


	# _LT_CHECK_MAGIC_METHOD
	# ----------------------
	# how to check for library dependencies
	# -- PORTME fill in with the dynamic library characteristics
	m4_defun([_LT_CHECK_MAGIC_METHOD],
	[m4_require([_LT_DECL_EGREP])
	m4_require([_LT_DECL_OBJDUMP])
	AC_CACHE_CHECK([how to recognize dependent libraries],
	lt_cv_deplibs_check_method,
	[lt_cv_file_magic_cmd='$MAGIC_CMD'
	lt_cv_file_magic_test_file=
	lt_cv_deplibs_check_method='unknown'
	# Need to set the preceding variable on all platforms that support
	# interlibrary dependencies.
	# 'none' -- dependencies not supported.
	# 'unknown' -- same as none, but documents that we really don't know.
	# 'pass_all' -- all dependencies passed with no checks.
	# 'test_compile' -- check by making test program.
	# 'file_magic [[regex]]' -- check by looking for files in library path
	# that responds to the $file_magic_cmd with a given extended regex.
	# If you have 'file' or equivalent on your system and you're not sure
	# whether 'pass_all' will always work, you probably want this one.

	case $host_os in
	aix[[4-9]]*)
	lt_cv_deplibs_check_method=pass_all
	;;

	beos*)
	lt_cv_deplibs_check_method=pass_all
	;;

	bsdi[[45]]*)
	lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (shared object\|dynamic lib)'
	lt_cv_file_magic_cmd='/usr/bin/file -L'
	lt_cv_file_magic_test_file=/shlib/libc.so
	;;

	cygwin*)
	# func_win32_libid is a shell function defined in ltmain.sh
	lt_cv_deplibs_check_method='file_magic ^x86 archive import\|^x86 DLL'
	lt_cv_file_magic_cmd='func_win32_libid'
	;;

	mingw* \| pw32*)
	# Base MSYS/MinGW do not provide the 'file' command needed by
	# func_win32_libid shell function, so use a weaker test based on 'objdump',
	# unless we find 'file', for example because we are cross-compiling.
	if ( file / ) >/dev/null 2>&1; then
	lt_cv_deplibs_check_method='file_magic ^x86 archive import\|^x86 DLL'
	lt_cv_file_magic_cmd='func_win32_libid'
	else
	# Keep this pattern in sync with the one in func_win32_libid.
	lt_cv_deplibs_check_method='file_magic file format (pei-i386(.architecture: i386)?\|pe-arm-wince\|pe-x86-64)'
	lt_cv_file_magic_cmd='$OBJDUMP -f'
	fi
	;;

	cegcc*)
	# use the weaker test based on 'objdump'. See mingw*.
	lt_cv_deplibs_check_method='file_magic file format pe-arm-.little(.architecture: arm)?'
	lt_cv_file_magic_cmd='$OBJDUMP -f'
	;;

	darwin* \| rhapsody*)
	lt_cv_deplibs_check_method=pass_all
	;;

	freebsd* \| dragonfly*)
	if echo __ELF__ \| $CC -E - \| $GREP __ELF__ > /dev/null; then
	case $host_cpu in
	i*86 )
	# Not sure whether the presence of OpenBSD here was a mistake.
	# Let's accept both of them until this is cleared up.
	lt_cv_deplibs_check_method='file_magic (FreeBSD\|OpenBSD\|DragonFly)/i[[3-9]]86 (compact )?demand paged shared library'
	lt_cv_file_magic_cmd=/usr/bin/file
	lt_cv_file_magic_test_file=`echo /usr/lib/libc.so.*`
	;;
	esac
	else
	lt_cv_deplibs_check_method=pass_all
	fi
	;;

	haiku*)
	lt_cv_deplibs_check_method=pass_all
	;;

	hpux10.20* \| hpux11*)
	lt_cv_file_magic_cmd=/usr/bin/file
	case $host_cpu in
	ia64*)
	lt_cv_deplibs_check_method='file_magic (s[[0-9]][[0-9]][[0-9]]\|ELF-[[0-9]][[0-9]]) shared object file - IA64'
	lt_cv_file_magic_test_file=/usr/lib/hpux32/libc.so
	;;
	hppa64)
	[lt_cv_deplibs_check_method='file_magic (s[0-9][0-9][0-9]\|ELF[ -][0-9][0-9])(-bit)?( [LM]SB)? shared object( file)?[, -]* PA-RISC [0-9]\.[0-9]']
	lt_cv_file_magic_test_file=/usr/lib/pa20_64/libc.sl
	;;
	*)
	lt_cv_deplibs_check_method='file_magic (s[[0-9]][[0-9]][[0-9]]\|PA-RISC[[0-9]]\.[[0-9]]) shared library'
	lt_cv_file_magic_test_file=/usr/lib/libc.sl
	;;
	esac
	;;

	interix[[3-9]]*)
	# PIC code is broken on Interix 3.x, that's why \|\.a not \|_pic\.a here
	lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\|\.a)$'
	;;

	irix5* \| irix6* \| nonstopux*)
	case $LD in
	-32\|"-32 ") libmagic=32-bit;;
	-n32\|"-n32 ") libmagic=N32;;
	-64\|"-64 ") libmagic=64-bit;;
	*) libmagic=never-match;;
	esac
	lt_cv_deplibs_check_method=pass_all
	;;

	# This must be glibc/ELF.
	linux* \| kbsd-gnu \| kopensolaris-gnu \| gnu)
	lt_cv_deplibs_check_method=pass_all
	;;

	netbsd*)
	if echo __ELF__ \| $CC -E - \| $GREP __ELF__ > /dev/null; then
	lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\.[[0-9]]+\.[[0-9]]+\|_pic\.a)$'
	else
	lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\|_pic\.a)$'
	fi
	;;

	newos6*)
	lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (executable\|dynamic lib)'
	lt_cv_file_magic_cmd=/usr/bin/file
	lt_cv_file_magic_test_file=/usr/lib/libnls.so
	;;

	nto \| qnx)
	lt_cv_deplibs_check_method=pass_all
	;;

	openbsd* \| bitrig*)
	if test -z "`echo __ELF__ \| $CC -E - \| $GREP __ELF__`"; then
	lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\.[[0-9]]+\.[[0-9]]+\|\.so\|_pic\.a)$'
	else
	lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\.[[0-9]]+\.[[0-9]]+\|_pic\.a)$'
	fi
	;;

	osf3* \| osf4* \| osf5*)
	lt_cv_deplibs_check_method=pass_all
	;;

	rdos*)
	lt_cv_deplibs_check_method=pass_all
	;;

	solaris*)
	lt_cv_deplibs_check_method=pass_all
	;;

	sysv5* \| sco3.2v5* \| sco5v6* \| unixware* \| OpenUNIX* \| sysv4uw2)
	lt_cv_deplibs_check_method=pass_all
	;;

	sysv4 \| sysv4.3*)
	case $host_vendor in
	motorola)
	lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]-bit [[ML]]SB (shared object\|dynamic lib) M[[0-9]][[0-9]] Version [[0-9]]'
	lt_cv_file_magic_test_file=`echo /usr/lib/libc.so*`
	;;
	ncr)
	lt_cv_deplibs_check_method=pass_all
	;;
	sequent)
	lt_cv_file_magic_cmd='/bin/file'
	lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[LM]]SB (shared object\|dynamic lib )'
	;;
	sni)
	lt_cv_file_magic_cmd='/bin/file'
	lt_cv_deplibs_check_method="file_magic ELF [[0-9]][[0-9]]*-bit [[LM]]SB dynamic lib"
	lt_cv_file_magic_test_file=/lib/libc.so
	;;
	siemens)
	lt_cv_deplibs_check_method=pass_all
	;;
	pc)
	lt_cv_deplibs_check_method=pass_all
	;;
	esac
	;;

	tpf*)
	lt_cv_deplibs_check_method=pass_all
	;;
	os2*)
	lt_cv_deplibs_check_method=pass_all
	;;
	esac
	])

	file_magic_glob=
	want_nocaseglob=no
	if test "$build" = "$host"; then
	case $host_os in
	mingw* \| pw32*)
	if ( shopt \| grep nocaseglob ) >/dev/null 2>&1; then
	want_nocaseglob=yes
	else
	file_magic_glob=`echo aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ \| $SED -e "s/$..$/s\/[[\1]]\/[[\1]]\/g;/g"`
	fi
	;;
	esac
	fi

	file_magic_cmd=$lt_cv_file_magic_cmd
	deplibs_check_method=$lt_cv_deplibs_check_method
	test -z "$deplibs_check_method" && deplibs_check_method=unknown

	_LT_DECL([], [deplibs_check_method], [1],
	[Method to check whether dependent libraries are shared objects])
	_LT_DECL([], [file_magic_cmd], [1],
	[Command to use when deplibs_check_method = "file_magic"])
	_LT_DECL([], [file_magic_glob], [1],
	[How to find potential files when deplibs_check_method = "file_magic"])
	_LT_DECL([], [want_nocaseglob], [1],
	[Find potential files using nocaseglob when deplibs_check_method = "file_magic"])
	])# _LT_CHECK_MAGIC_METHOD


	# LT_PATH_NM
	# ----------
	# find the pathname to a BSD- or MS-compatible name lister
	AC_DEFUN([LT_PATH_NM],
	[AC_REQUIRE([AC_PROG_CC])dnl
	AC_CACHE_CHECK([for BSD- or MS-compatible name lister (nm)], lt_cv_path_NM,
	[if test -n "$NM"; then
	# Let the user override the test.
	lt_cv_path_NM=$NM
	else
	lt_nm_to_check=${ac_tool_prefix}nm
	if test -n "$ac_tool_prefix" && test "$build" = "$host"; then
	lt_nm_to_check="$lt_nm_to_check nm"
	fi
	for lt_tmp_nm in $lt_nm_to_check; do
	lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR
	for ac_dir in $PATH /usr/ccs/bin/elf /usr/ccs/bin /usr/ucb /bin; do
	IFS=$lt_save_ifs
	test -z "$ac_dir" && ac_dir=.
	tmp_nm=$ac_dir/$lt_tmp_nm
	if test -f "$tmp_nm" \|\| test -f "$tmp_nm$ac_exeext"; then
	# Check to see if the nm accepts a BSD-compat flag.
	# Adding the 'sed 1q' prevents false positives on HP-UX, which says:
	# nm: unknown option "B" ignored
	# Tru64's nm complains that /dev/null is an invalid object file
	# MSYS converts /dev/null to NUL, MinGW nm treats NUL as empty
	case $build_os in
	mingw*) lt_bad_file=conftest.nm/nofile ;;
	*) lt_bad_file=/dev/null ;;
	esac
	case `"$tmp_nm" -B $lt_bad_file 2>&1 \| sed '1q'` in
	$lt_bad_file \| 'Invalid file or object type')
	lt_cv_path_NM="$tmp_nm -B"
	break 2
	;;
	*)
	case `"$tmp_nm" -p /dev/null 2>&1 \| sed '1q'` in
	/dev/null)
	lt_cv_path_NM="$tmp_nm -p"
	break 2
	;;
	*)
	lt_cv_path_NM=${lt_cv_path_NM="$tmp_nm"} # keep the first match, but
	continue # so that we can try to find one that supports BSD flags
	;;
	esac
	;;
	esac
	fi
	done
	IFS=$lt_save_ifs
	done
	: ${lt_cv_path_NM=no}
	fi])
	if test no != "$lt_cv_path_NM"; then
	NM=$lt_cv_path_NM
	else
	# Didn't find any BSD compatible name lister, look for dumpbin.
	if test -n "$DUMPBIN"; then :
	# Let the user override the test.
	else
	AC_CHECK_TOOLS(DUMPBIN, [dumpbin "link -dump"], :)
	case `$DUMPBIN -symbols -headers /dev/null 2>&1 \| sed '1q'` in
	COFF)
	DUMPBIN="$DUMPBIN -symbols -headers"
	;;
	*)
	DUMPBIN=:
	;;
	esac
	fi
	AC_SUBST([DUMPBIN])
	if test : != "$DUMPBIN"; then
	NM=$DUMPBIN
	fi
	fi
	test -z "$NM" && NM=nm
	AC_SUBST([NM])
	_LT_DECL([], [NM], [1], [A BSD- or MS-compatible name lister])dnl

	AC_CACHE_CHECK([the name lister ($NM) interface], [lt_cv_nm_interface],
	[lt_cv_nm_interface="BSD nm"
	echo "int some_variable = 0;" > conftest.$ac_ext
	(eval echo "\"\$as_me:$LINENO: $ac_compile\"" >&AS_MESSAGE_LOG_FD)
	(eval "$ac_compile" 2>conftest.err)
	cat conftest.err >&AS_MESSAGE_LOG_FD
	(eval echo "\"\$as_me:$LINENO: $NM \\\"conftest.$ac_objext\\\"\"" >&AS_MESSAGE_LOG_FD)
	(eval "$NM \"conftest.$ac_objext\"" 2>conftest.err > conftest.out)
	cat conftest.err >&AS_MESSAGE_LOG_FD
	(eval echo "\"\$as_me:$LINENO: output\"" >&AS_MESSAGE_LOG_FD)
	cat conftest.out >&AS_MESSAGE_LOG_FD
	if $GREP 'External.*some_variable' conftest.out > /dev/null; then
	lt_cv_nm_interface="MS dumpbin"
	fi
	rm -f conftest*])
	])# LT_PATH_NM

	# Old names:
	AU_ALIAS([AM_PROG_NM], [LT_PATH_NM])
	AU_ALIAS([AC_PROG_NM], [LT_PATH_NM])
	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([AM_PROG_NM], [])
	dnl AC_DEFUN([AC_PROG_NM], [])

	# _LT_CHECK_SHAREDLIB_FROM_LINKLIB
	# --------------------------------
	# how to determine the name of the shared library
	# associated with a specific link library.
	# -- PORTME fill in with the dynamic library characteristics
	m4_defun([_LT_CHECK_SHAREDLIB_FROM_LINKLIB],
	[m4_require([_LT_DECL_EGREP])
	m4_require([_LT_DECL_OBJDUMP])
	m4_require([_LT_DECL_DLLTOOL])
	AC_CACHE_CHECK([how to associate runtime and link libraries],
	lt_cv_sharedlib_from_linklib_cmd,
	[lt_cv_sharedlib_from_linklib_cmd='unknown'

	case $host_os in
	cygwin* \| mingw* \| pw32* \| cegcc*)
	# two different shell functions defined in ltmain.sh;
	# decide which one to use based on capabilities of $DLLTOOL
	case `$DLLTOOL --help 2>&1` in
	--identify-strict)
	lt_cv_sharedlib_from_linklib_cmd=func_cygming_dll_for_implib
	;;
	*)
	lt_cv_sharedlib_from_linklib_cmd=func_cygming_dll_for_implib_fallback
	;;
	esac
	;;
	*)
	# fallback: assume linklib IS sharedlib
	lt_cv_sharedlib_from_linklib_cmd=$ECHO
	;;
	esac
	])
	sharedlib_from_linklib_cmd=$lt_cv_sharedlib_from_linklib_cmd
	test -z "$sharedlib_from_linklib_cmd" && sharedlib_from_linklib_cmd=$ECHO

	_LT_DECL([], [sharedlib_from_linklib_cmd], [1],
	[Command to associate shared and link libraries])
	])# _LT_CHECK_SHAREDLIB_FROM_LINKLIB


	# _LT_PATH_MANIFEST_TOOL
	# ----------------------
	# locate the manifest tool
	m4_defun([_LT_PATH_MANIFEST_TOOL],
	[AC_CHECK_TOOL(MANIFEST_TOOL, mt, :)
	test -z "$MANIFEST_TOOL" && MANIFEST_TOOL=mt
	AC_CACHE_CHECK([if $MANIFEST_TOOL is a manifest tool], [lt_cv_path_mainfest_tool],
	[lt_cv_path_mainfest_tool=no
	echo "$as_me:$LINENO: $MANIFEST_TOOL '-?'" >&AS_MESSAGE_LOG_FD
	$MANIFEST_TOOL '-?' 2>conftest.err > conftest.out
	cat conftest.err >&AS_MESSAGE_LOG_FD
	if $GREP 'Manifest Tool' conftest.out > /dev/null; then
	lt_cv_path_mainfest_tool=yes
	fi
	rm -f conftest*])
	if test yes != "$lt_cv_path_mainfest_tool"; then
	MANIFEST_TOOL=:
	fi
	_LT_DECL([], [MANIFEST_TOOL], [1], [Manifest tool])dnl
	])# _LT_PATH_MANIFEST_TOOL


	# _LT_DLL_DEF_P([FILE])
	# ---------------------
	# True iff FILE is a Windows DLL '.def' file.
	# Keep in sync with func_dll_def_p in the libtool script
	AC_DEFUN([_LT_DLL_DEF_P],
	[dnl
	test DEF = "`$SED -n dnl
	-e '\''s/^[[ ]]*//'\'' dnl Strip leading whitespace
	-e '\''/^$;.$$/d'\'' dnl Delete empty lines and comments
	-e '\''s/^$EXPORTS\\|LIBRARY$$[[ ]].$$/DEF/p'\'' dnl
	-e q dnl Only consider the first "real" line
	$1`" dnl
	])# _LT_DLL_DEF_P


	# LT_LIB_M
	# --------
	# check for math library
	AC_DEFUN([LT_LIB_M],
	[AC_REQUIRE([AC_CANONICAL_HOST])dnl
	LIBM=
	case $host in
	--beos* \| --cegcc* \| --cygwin* \| --haiku* \| --pw32* \| --darwin*)
	# These system don't have libm, or don't need it
	;;
	-ncr-sysv4.3)
	AC_CHECK_LIB(mw, _mwvalidcheckl, LIBM=-lmw)
	AC_CHECK_LIB(m, cos, LIBM="$LIBM -lm")
	;;
	*)
	AC_CHECK_LIB(m, cos, LIBM=-lm)
	;;
	esac
	AC_SUBST([LIBM])
	])# LT_LIB_M

	# Old name:
	AU_ALIAS([AC_CHECK_LIBM], [LT_LIB_M])
	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([AC_CHECK_LIBM], [])


	# _LT_COMPILER_NO_RTTI([TAGNAME])
	# -------------------------------
	m4_defun([_LT_COMPILER_NO_RTTI],
	[m4_require([_LT_TAG_COMPILER])dnl

	_LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)=

	if test yes = "$GCC"; then
	case $cc_basename in
	nvcc*)
	_LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)=' -Xcompiler -fno-builtin' ;;
	*)
	_LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)=' -fno-builtin' ;;
	esac

	_LT_COMPILER_OPTION([if $compiler supports -fno-rtti -fno-exceptions],
	lt_cv_prog_compiler_rtti_exceptions,
	[-fno-rtti -fno-exceptions], [],
	[_LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)="$_LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1) -fno-rtti -fno-exceptions"])
	fi
	_LT_TAGDECL([no_builtin_flag], [lt_prog_compiler_no_builtin_flag], [1],
	[Compiler flag to turn off builtin functions])
	])# _LT_COMPILER_NO_RTTI


	# _LT_CMD_GLOBAL_SYMBOLS
	# ----------------------
	m4_defun([_LT_CMD_GLOBAL_SYMBOLS],
	[AC_REQUIRE([AC_CANONICAL_HOST])dnl
	AC_REQUIRE([AC_PROG_CC])dnl
	AC_REQUIRE([AC_PROG_AWK])dnl
	AC_REQUIRE([LT_PATH_NM])dnl
	AC_REQUIRE([LT_PATH_LD])dnl
	m4_require([_LT_DECL_SED])dnl
	m4_require([_LT_DECL_EGREP])dnl
	m4_require([_LT_TAG_COMPILER])dnl

	# Check for command to grab the raw symbol name followed by C symbol from nm.
	AC_MSG_CHECKING([command to parse $NM output from $compiler object])
	AC_CACHE_VAL([lt_cv_sys_global_symbol_pipe],
	[
	# These are sane defaults that work on at least a few old systems.
	# [They come from Ultrix. What could be older than Ultrix?!! ;)]

	# Character class describing NM global symbol codes.
	symcode='[[BCDEGRST]]'

	# Regexp to match symbols that can be accessed directly from C.
	sympat='$[[_A-Za-z]][[_A-Za-z0-9]]*$'

	# Define system-specific variables.
	case $host_os in
	aix*)
	symcode='[[BCDT]]'
	;;
	cygwin* \| mingw* \| pw32* \| cegcc*)
	symcode='[[ABCDGISTW]]'
	;;
	hpux*)
	if test ia64 = "$host_cpu"; then
	symcode='[[ABCDEGRST]]'
	fi
	;;
	irix* \| nonstopux*)
	symcode='[[BCDEGRST]]'
	;;
	osf*)
	symcode='[[BCDEGQRST]]'
	;;
	solaris*)
	symcode='[[BDRT]]'
	;;
	sco3.2v5*)
	symcode='[[DT]]'
	;;
	sysv4.2uw2*)
	symcode='[[DT]]'
	;;
	sysv5* \| sco5v6* \| unixware* \| OpenUNIX*)
	symcode='[[ABDT]]'
	;;
	sysv4)
	symcode='[[DFNSTU]]'
	;;
	esac

	# If we're using GNU nm, then use its standard symbol codes.
	case `$NM -V 2>&1` in
	GNU \| 'with BFD')
	symcode='[[ABCDGIRSTW]]' ;;
	esac

	if test "$lt_cv_nm_interface" = "MS dumpbin"; then
	# Gets list of data symbols to import.
	lt_cv_sys_global_symbol_to_import="sed -n -e 's/^I .* $.*$$/\1/p'"
	# Adjust the below global symbol transforms to fixup imported variables.
	lt_cdecl_hook=" -e 's/^I .* $.*$$/extern __declspec(dllimport) char \1;/p'"
	lt_c_name_hook=" -e 's/^I .* $.$$/ {\"\1\", (void ) 0},/p'"
	lt_c_name_lib_hook="\
	-e 's/^I .* $lib.$$/ {\"\1\", (void ) 0},/p'\
	-e 's/^I .* $.$$/ {\"lib\1\", (void ) 0},/p'"
	else
	# Disable hooks by default.
	lt_cv_sys_global_symbol_to_import=
	lt_cdecl_hook=
	lt_c_name_hook=
	lt_c_name_lib_hook=
	fi

	# Transform an extracted symbol line into a proper C declaration.
	# Some systems (esp. on ia64) link data and code symbols differently,
	# so use this general approach.
	lt_cv_sys_global_symbol_to_cdecl="sed -n"\
	$lt_cdecl_hook\
	" -e 's/^T .* $.*$$/extern int \1();/p'"\
	" -e 's/^$symcode$symcode* .* $.*$$/extern char \1;/p'"

	# Transform an extracted symbol line into symbol name and symbol address
	lt_cv_sys_global_symbol_to_c_name_address="sed -n"\
	$lt_c_name_hook\
	" -e 's/^: $.$ .$/ {\"\1\", (void *) 0},/p'"\
	" -e 's/^$symcode$symcode* .* $.$$/ {\"\1\", (void ) \&\1},/p'"

	# Transform an extracted symbol line into symbol name with lib prefix and
	# symbol address.
	lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="sed -n"\
	$lt_c_name_lib_hook\
	" -e 's/^: $.$ .$/ {\"\1\", (void *) 0},/p'"\
	" -e 's/^$symcode$symcode* .* $lib.$$/ {\"\1\", (void ) \&\1},/p'"\
	" -e 's/^$symcode$symcode* .* $.$$/ {\"lib\1\", (void ) \&\1},/p'"

	# Handle CRLF in mingw tool chain
	opt_cr=
	case $build_os in
	mingw*)
	opt_cr=`$ECHO 'x\{0,1\}' \| tr x '\015'` # option cr in regexp
	;;
	esac

	# Try without a prefix underscore, then with it.
	for ac_symprfx in "" "_"; do

	# Transform symcode, sympat, and symprfx into a raw symbol and a C symbol.
	symxfrm="\\1 $ac_symprfx\\2 \\2"

	# Write the raw and C identifiers.
	if test "$lt_cv_nm_interface" = "MS dumpbin"; then
	# Fake it for dumpbin and say T for any non-static function,
	# D for any global variable and I for any imported variable.
	# Also find C++ and __fastcall symbols from MSVC++,
	# which start with @ or ?.
	lt_cv_sys_global_symbol_pipe="$AWK ['"\
	" {last_section=section; section=\$ 3};"\
	" /^COFF SYMBOL TABLE/{for(i in hide) delete hide[i]};"\
	" /Section length .#relocs.(pick any)/{hide[last_section]=1};"\
	" /^ Symbol name : /{split(\$ 0,sn,\":\"); si=substr(sn[2],2)};"\
	" /^ Type : code/{print \"T\",si,substr(si,length(prfx))};"\
	" /^ Type : data/{print \"I\",si,substr(si,length(prfx))};"\
	" \$ 0!~/External *\\|/{next};"\
	" / 0+ UNDEF /{next}; / UNDEF $[^\|]$*()/{next};"\
	" {if(hide[section]) next};"\
	" {f=\"D\"}; \$ 0~/.*\\|/{f=\"T\"};"\
	" {split(\$ 0,a,/\\|\|\r/); split(a[2],s)};"\
	" s[1]~/^[@?]/{print f,s[1],s[1]; next};"\
	" s[1]~prfx {split(s[1],t,\"@\"); print f,t[1],substr(t[1],length(prfx))}"\
	" ' prfx=^$ac_symprfx]"
	else
	lt_cv_sys_global_symbol_pipe="sed -n -e 's/^.[[ ]]$$symcode$symcode$[[ ]][[ ]]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'"
	fi
	lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe \| sed '/ __gnu_lto/d'"

	# Check to see that the pipe works correctly.
	pipe_works=no

	rm -f conftest*
	cat > conftest.$ac_ext <<_LT_EOF
	#ifdef __cplusplus
	extern "C" {
	#endif
	char nm_test_var;
	void nm_test_func(void);
	void nm_test_func(void){}
	#ifdef __cplusplus
	}
	#endif
	int main(){nm_test_var='a';nm_test_func();return(0);}
	_LT_EOF

	if AC_TRY_EVAL(ac_compile); then
	# Now try to grab the symbols.
	nlist=conftest.nm
	if AC_TRY_EVAL(NM conftest.$ac_objext \\| "$lt_cv_sys_global_symbol_pipe" \> $nlist) && test -s "$nlist"; then
	# Try sorting and uniquifying the output.
	if sort "$nlist" \| uniq > "$nlist"T; then
	mv -f "$nlist"T "$nlist"
	else
	rm -f "$nlist"T
	fi

	# Make sure that we snagged all the symbols we need.
	if $GREP ' nm_test_var$' "$nlist" >/dev/null; then
	if $GREP ' nm_test_func$' "$nlist" >/dev/null; then
	cat <<_LT_EOF > conftest.$ac_ext
	/* Keep this code in sync between libtool.m4, ltmain, lt_system.h, and tests. */
	#if defined _WIN32 \|\| defined __CYGWIN__ \|\| defined _WIN32_WCE
	/* DATA imports from DLLs on WIN32 can't be const, because runtime
	relocations are performed -- see ld's documentation on pseudo-relocs. */
	# define LT@&t@_DLSYM_CONST
	#elif defined __osf__
	/* This system does not cope well with relocations in const data. */
	# define LT@&t@_DLSYM_CONST
	#else
	# define LT@&t@_DLSYM_CONST const
	#endif

	#ifdef __cplusplus
	extern "C" {
	#endif

	_LT_EOF
	# Now generate the symbol file.
	eval "$lt_cv_sys_global_symbol_to_cdecl"' < "$nlist" \| $GREP -v main >> conftest.$ac_ext'

	cat <<_LT_EOF >> conftest.$ac_ext

	/* The mapping between symbol names and symbols. */
	LT@&t@_DLSYM_CONST struct {
	const char *name;
	void *address;
	}
	lt__PROGRAM__LTX_preloaded_symbols[[]] =
	{
	{ "@PROGRAM@", (void *) 0 },
	_LT_EOF
	$SED "s/^$symcode$symcode* .* $.$$/ {\"\1\", (void ) \&\1},/" < "$nlist" \| $GREP -v main >> conftest.$ac_ext
	cat <<\_LT_EOF >> conftest.$ac_ext
	{0, (void *) 0}
	};

	/* This works around a problem in FreeBSD linker */
	#ifdef FREEBSD_WORKAROUND
	static const void *lt_preloaded_setup() {
	return lt__PROGRAM__LTX_preloaded_symbols;
	}
	#endif

	#ifdef __cplusplus
	}
	#endif
	_LT_EOF
	# Now try linking the two files.
	mv conftest.$ac_objext conftstm.$ac_objext
	lt_globsym_save_LIBS=$LIBS
	lt_globsym_save_CFLAGS=$CFLAGS
	LIBS=conftstm.$ac_objext
	CFLAGS="$CFLAGS$_LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)"
	if AC_TRY_EVAL(ac_link) && test -s conftest$ac_exeext; then
	pipe_works=yes
	fi
	LIBS=$lt_globsym_save_LIBS
	CFLAGS=$lt_globsym_save_CFLAGS
	else
	echo "cannot find nm_test_func in $nlist" >&AS_MESSAGE_LOG_FD
	fi
	else
	echo "cannot find nm_test_var in $nlist" >&AS_MESSAGE_LOG_FD
	fi
	else
	echo "cannot run $lt_cv_sys_global_symbol_pipe" >&AS_MESSAGE_LOG_FD
	fi
	else
	echo "$progname: failed program was:" >&AS_MESSAGE_LOG_FD
	cat conftest.$ac_ext >&5
	fi
	rm -rf conftest* conftst*

	# Do not use the global_symbol_pipe unless it works.
	if test yes = "$pipe_works"; then
	break
	else
	lt_cv_sys_global_symbol_pipe=
	fi
	done
	])
	if test -z "$lt_cv_sys_global_symbol_pipe"; then
	lt_cv_sys_global_symbol_to_cdecl=
	fi
	if test -z "$lt_cv_sys_global_symbol_pipe$lt_cv_sys_global_symbol_to_cdecl"; then
	AC_MSG_RESULT(failed)
	else
	AC_MSG_RESULT(ok)
	fi

	# Response file support.
	if test "$lt_cv_nm_interface" = "MS dumpbin"; then
	nm_file_list_spec='@'
	elif $NM --help 2>/dev/null \| grep '[[@]]FILE' >/dev/null; then
	nm_file_list_spec='@'
	fi

	_LT_DECL([global_symbol_pipe], [lt_cv_sys_global_symbol_pipe], [1],
	[Take the output of nm and produce a listing of raw symbols and C names])
	_LT_DECL([global_symbol_to_cdecl], [lt_cv_sys_global_symbol_to_cdecl], [1],
	[Transform the output of nm in a proper C declaration])
	_LT_DECL([global_symbol_to_import], [lt_cv_sys_global_symbol_to_import], [1],
	[Transform the output of nm into a list of symbols to manually relocate])
	_LT_DECL([global_symbol_to_c_name_address],
	[lt_cv_sys_global_symbol_to_c_name_address], [1],
	[Transform the output of nm in a C name address pair])
	_LT_DECL([global_symbol_to_c_name_address_lib_prefix],
	[lt_cv_sys_global_symbol_to_c_name_address_lib_prefix], [1],
	[Transform the output of nm in a C name address pair when lib prefix is needed])
	_LT_DECL([nm_interface], [lt_cv_nm_interface], [1],
	[The name lister interface])
	_LT_DECL([], [nm_file_list_spec], [1],
	[Specify filename containing input files for $NM])
	]) # _LT_CMD_GLOBAL_SYMBOLS


	# _LT_COMPILER_PIC([TAGNAME])
	# ---------------------------
	m4_defun([_LT_COMPILER_PIC],
	[m4_require([_LT_TAG_COMPILER])dnl
	_LT_TAGVAR(lt_prog_compiler_wl, $1)=
	_LT_TAGVAR(lt_prog_compiler_pic, $1)=
	_LT_TAGVAR(lt_prog_compiler_static, $1)=

	m4_if([$1], [CXX], [
	# C++ specific cases for pic, static, wl, etc.
	if test yes = "$GXX"; then
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'

	case $host_os in
	aix*)
	# All AIX code is PIC.
	if test ia64 = "$host_cpu"; then
	# AIX 5 now supports IA64 processor
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	fi
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
	;;

	amigaos*)
	case $host_cpu in
	powerpc)
	# see comment about AmigaOS4 .so support
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
	;;
	m68k)
	# FIXME: we need at least 68020 code to build shared libraries, but
	# adding the '-m68020' flag to GCC prevents building anything better,
	# like '-m68040'.
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-m68020 -resident32 -malways-restore-a4'
	;;
	esac
	;;

	beos* \| irix5* \| irix6* \| nonstopux* \| osf3* \| osf4* \| osf5*)
	# PIC is the default for these OSes.
	;;
	mingw* \| cygwin* \| os2* \| pw32* \| cegcc*)
	# This hack is so that the source file can tell whether it is being
	# built for inclusion in a dll (and should export symbols for example).
	# Although the cygwin gcc ignores -fPIC, still need this for old-style
	# (--disable-auto-import) libraries
	m4_if([$1], [GCJ], [],
	[_LT_TAGVAR(lt_prog_compiler_pic, $1)='-DDLL_EXPORT'])
	case $host_os in
	os2*)
	_LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-static'
	;;
	esac
	;;
	darwin* \| rhapsody*)
	# PIC is the default on this platform
	# Common symbols not allowed in MH_DYLIB files
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fno-common'
	;;
	djgpp)
	# DJGPP does not support shared libraries at all
	_LT_TAGVAR(lt_prog_compiler_pic, $1)=
	;;
	haiku*)
	# PIC is the default for Haiku.
	# The "-static" flag exists, but is broken.
	_LT_TAGVAR(lt_prog_compiler_static, $1)=
	;;
	interix[[3-9]]*)
	# Interix 3.x gcc -fpic/-fPIC options generate broken code.
	# Instead, we relocate shared libraries at runtime.
	;;
	sysv4MP)
	if test -d /usr/nec; then
	_LT_TAGVAR(lt_prog_compiler_pic, $1)=-Kconform_pic
	fi
	;;
	hpux*)
	# PIC is the default for 64-bit PA HP-UX, but not for 32-bit
	# PA HP-UX. On IA64 HP-UX, PIC is the default but the pic flag
	# sets the default TLS model and affects inlining.
	case $host_cpu in
	hppa64)
	;;
	*)
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
	;;
	esac
	;;
	qnx \| nto)
	# QNX uses GNU C++, but need to define -shared option too, otherwise
	# it will coredump.
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC -shared'
	;;
	*)
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
	;;
	esac
	else
	case $host_os in
	aix[[4-9]]*)
	# All AIX code is PIC.
	if test ia64 = "$host_cpu"; then
	# AIX 5 now supports IA64 processor
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	else
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-bnso -bI:/lib/syscalls.exp'
	fi
	;;
	chorus*)
	case $cc_basename in
	cxch68*)
	# Green Hills C++ Compiler
	# _LT_TAGVAR(lt_prog_compiler_static, $1)="--no_auto_instantiation -u __main -u __premain -u _abort -r $COOL_DIR/lib/libOrb.a $MVME_DIR/lib/CC/libC.a $MVME_DIR/lib/classix/libcx.s.a"
	;;
	esac
	;;
	mingw* \| cygwin* \| os2* \| pw32* \| cegcc*)
	# This hack is so that the source file can tell whether it is being
	# built for inclusion in a dll (and should export symbols for example).
	m4_if([$1], [GCJ], [],
	[_LT_TAGVAR(lt_prog_compiler_pic, $1)='-DDLL_EXPORT'])
	;;
	dgux*)
	case $cc_basename in
	ec++*)
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
	;;
	ghcx*)
	# Green Hills C++ Compiler
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-pic'
	;;
	*)
	;;
	esac
	;;
	freebsd* \| dragonfly*)
	# FreeBSD uses GNU C++
	;;
	hpux9* \| hpux10* \| hpux11*)
	case $cc_basename in
	CC*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-a ${wl}archive'
	if test ia64 != "$host_cpu"; then
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='+Z'
	fi
	;;
	aCC*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-a ${wl}archive'
	case $host_cpu in
	hppa64\|ia64*)
	# +Z the default
	;;
	*)
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='+Z'
	;;
	esac
	;;
	*)
	;;
	esac
	;;
	interix*)
	# This is c89, which is MS Visual C++ (no shared libs)
	# Anyone wants to do a port?
	;;
	irix5* \| irix6* \| nonstopux*)
	case $cc_basename in
	CC*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared'
	# CC pic flag -KPIC is the default.
	;;
	*)
	;;
	esac
	;;
	linux* \| kbsd-gnu \| kopensolaris-gnu \| gnu)
	case $cc_basename in
	KCC*)
	# KAI C++ Compiler
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='--backend -Wl,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
	;;
	ecpc* )
	# old Intel C++ for x86_64, which still supported -KPIC.
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
	;;
	icpc* )
	# Intel C++, used to be incompatible with GCC.
	# ICC 10 doesn't accept -KPIC any more.
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
	;;
	pgCC* \| pgcpp*)
	# Portland Group C++ compiler
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fpic'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	;;
	cxx*)
	# Compaq C++
	# Make sure the PIC flag is empty. It appears that all Alpha
	# Linux and Compaq Tru64 Unix objects are PIC.
	_LT_TAGVAR(lt_prog_compiler_pic, $1)=
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared'
	;;
	xlc* \| xlC* \| bgxl[[cC]]* \| mpixl[[cC]]*)
	# IBM XL 8.0, 9.0 on PPC and BlueGene
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-qpic'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-qstaticlink'
	;;
	*)
	case `$CC -V 2>&1 \| sed 5q` in
	Sun\ C)
	# Sun C++ 5.9
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Qoption ld '
	;;
	esac
	;;
	esac
	;;
	lynxos*)
	;;
	m88k*)
	;;
	mvs*)
	case $cc_basename in
	cxx*)
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-W c,exportall'
	;;
	*)
	;;
	esac
	;;
	netbsd*)
	;;
	qnx \| nto)
	# QNX uses GNU C++, but need to define -shared option too, otherwise
	# it will coredump.
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC -shared'
	;;
	osf3* \| osf4* \| osf5*)
	case $cc_basename in
	KCC*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='--backend -Wl,'
	;;
	RCC*)
	# Rational C++ 2.4.1
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-pic'
	;;
	cxx*)
	# Digital/Compaq C++
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	# Make sure the PIC flag is empty. It appears that all Alpha
	# Linux and Compaq Tru64 Unix objects are PIC.
	_LT_TAGVAR(lt_prog_compiler_pic, $1)=
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared'
	;;
	*)
	;;
	esac
	;;
	psos*)
	;;
	solaris*)
	case $cc_basename in
	CC* \| sunCC*)
	# Sun C++ 4.2, 5.x and Centerline C++
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Qoption ld '
	;;
	gcx*)
	# Green Hills C++ Compiler
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-PIC'
	;;
	*)
	;;
	esac
	;;
	sunos4*)
	case $cc_basename in
	CC*)
	# Sun C++ 4.x
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-pic'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	;;
	lcc*)
	# Lucid
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-pic'
	;;
	*)
	;;
	esac
	;;
	sysv5* \| unixware* \| sco3.2v5* \| sco5v6* \| OpenUNIX*)
	case $cc_basename in
	CC*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	;;
	esac
	;;
	tandem*)
	case $cc_basename in
	NCC*)
	# NonStop-UX NCC 3.20
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
	;;
	*)
	;;
	esac
	;;
	vxworks*)
	;;
	*)
	_LT_TAGVAR(lt_prog_compiler_can_build_shared, $1)=no
	;;
	esac
	fi
	],
	[
	if test yes = "$GCC"; then
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'

	case $host_os in
	aix*)
	# All AIX code is PIC.
	if test ia64 = "$host_cpu"; then
	# AIX 5 now supports IA64 processor
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	fi
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
	;;

	amigaos*)
	case $host_cpu in
	powerpc)
	# see comment about AmigaOS4 .so support
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
	;;
	m68k)
	# FIXME: we need at least 68020 code to build shared libraries, but
	# adding the '-m68020' flag to GCC prevents building anything better,
	# like '-m68040'.
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-m68020 -resident32 -malways-restore-a4'
	;;
	esac
	;;

	beos* \| irix5* \| irix6* \| nonstopux* \| osf3* \| osf4* \| osf5*)
	# PIC is the default for these OSes.
	;;

	mingw* \| cygwin* \| pw32* \| os2* \| cegcc*)
	# This hack is so that the source file can tell whether it is being
	# built for inclusion in a dll (and should export symbols for example).
	# Although the cygwin gcc ignores -fPIC, still need this for old-style
	# (--disable-auto-import) libraries
	m4_if([$1], [GCJ], [],
	[_LT_TAGVAR(lt_prog_compiler_pic, $1)='-DDLL_EXPORT'])
	case $host_os in
	os2*)
	_LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-static'
	;;
	esac
	;;

	darwin* \| rhapsody*)
	# PIC is the default on this platform
	# Common symbols not allowed in MH_DYLIB files
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fno-common'
	;;

	haiku*)
	# PIC is the default for Haiku.
	# The "-static" flag exists, but is broken.
	_LT_TAGVAR(lt_prog_compiler_static, $1)=
	;;

	hpux*)
	# PIC is the default for 64-bit PA HP-UX, but not for 32-bit
	# PA HP-UX. On IA64 HP-UX, PIC is the default but the pic flag
	# sets the default TLS model and affects inlining.
	case $host_cpu in
	hppa64)
	# +Z the default
	;;
	*)
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
	;;
	esac
	;;

	interix[[3-9]]*)
	# Interix 3.x gcc -fpic/-fPIC options generate broken code.
	# Instead, we relocate shared libraries at runtime.
	;;

	msdosdjgpp*)
	# Just because we use GCC doesn't mean we suddenly get shared libraries
	# on systems that don't support them.
	_LT_TAGVAR(lt_prog_compiler_can_build_shared, $1)=no
	enable_shared=no
	;;

	nto \| qnx)
	# QNX uses GNU C++, but need to define -shared option too, otherwise
	# it will coredump.
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC -shared'
	;;

	sysv4MP)
	if test -d /usr/nec; then
	_LT_TAGVAR(lt_prog_compiler_pic, $1)=-Kconform_pic
	fi
	;;

	*)
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
	;;
	esac

	case $cc_basename in
	nvcc*) # Cuda Compiler Driver 2.2
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Xlinker '
	if test -n "$_LT_TAGVAR(lt_prog_compiler_pic, $1)"; then
	_LT_TAGVAR(lt_prog_compiler_pic, $1)="-Xcompiler $_LT_TAGVAR(lt_prog_compiler_pic, $1)"
	fi
	;;
	esac
	else
	# PORTME Check for flag to pass linker flags through the system compiler.
	case $host_os in
	aix*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	if test ia64 = "$host_cpu"; then
	# AIX 5 now supports IA64 processor
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	else
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-bnso -bI:/lib/syscalls.exp'
	fi
	;;

	darwin* \| rhapsody*)
	# PIC is the default on this platform
	# Common symbols not allowed in MH_DYLIB files
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fno-common'
	case $cc_basename in
	nagfor*)
	# NAG Fortran compiler
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,-Wl,,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-PIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	;;
	esac
	;;

	mingw* \| cygwin* \| pw32* \| os2* \| cegcc*)
	# This hack is so that the source file can tell whether it is being
	# built for inclusion in a dll (and should export symbols for example).
	m4_if([$1], [GCJ], [],
	[_LT_TAGVAR(lt_prog_compiler_pic, $1)='-DDLL_EXPORT'])
	case $host_os in
	os2*)
	_LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-static'
	;;
	esac
	;;

	hpux9* \| hpux10* \| hpux11*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	# PIC is the default for IA64 HP-UX and 64-bit HP-UX, but
	# not for PA HP-UX.
	case $host_cpu in
	hppa64\|ia64*)
	# +Z the default
	;;
	*)
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='+Z'
	;;
	esac
	# Is there a better lt_prog_compiler_static that works with the bundled CC?
	_LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-a ${wl}archive'
	;;

	irix5* \| irix6* \| nonstopux*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	# PIC (with -KPIC) is the default.
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared'
	;;

	linux* \| kbsd-gnu \| kopensolaris-gnu \| gnu)
	case $cc_basename in
	# old Intel for x86_64, which still supported -KPIC.
	ecc*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
	;;
	# icc used to be incompatible with GCC.
	# ICC 10 doesn't accept -KPIC any more.
	icc* \| ifort*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
	;;
	# Lahey Fortran 8.1.
	lf95*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='--shared'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='--static'
	;;
	nagfor*)
	# NAG Fortran compiler
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,-Wl,,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-PIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	;;
	tcc*)
	# Fabrice Bellard et al's Tiny C Compiler
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
	;;
	pgcc* \| pgf77* \| pgf90* \| pgf95* \| pgfortran*)
	# Portland Group compilers (not the Pentium gcc compiler,
	# which looks to be a dead project)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fpic'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	;;
	ccc*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	# All Alpha code is PIC.
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared'
	;;
	xl* \| bgxl* \| bgf* \| mpixl*)
	# IBM XL C 8.0/Fortran 10.1, 11.1 on PPC and BlueGene
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-qpic'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-qstaticlink'
	;;
	*)
	case `$CC -V 2>&1 \| sed 5q` in
	Sun\ Ceres\ Fortran \| SunFortran\ [[1-7]]. \| SunFortran\ 8.[[0-3]])
	# Sun Fortran 8.3 passes all unrecognized flags to the linker
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	_LT_TAGVAR(lt_prog_compiler_wl, $1)=''
	;;
	Sun\ F \| SunFortran*)
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Qoption ld '
	;;
	Sun\ C)
	# Sun C 5.9
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	;;
	Intel\ [[CF]]Compiler)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
	;;
	Portland\ Group)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fpic'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	;;
	esac
	;;
	esac
	;;

	newsos6)
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	;;

	nto \| qnx)
	# QNX uses GNU C++, but need to define -shared option too, otherwise
	# it will coredump.
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC -shared'
	;;

	osf3* \| osf4* \| osf5*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	# All OSF/1 code is PIC.
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared'
	;;

	rdos*)
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared'
	;;

	solaris*)
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	case $cc_basename in
	f77* \| f90* \| f95* \| sunf77* \| sunf90* \| sunf95*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Qoption ld ';;
	*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,';;
	esac
	;;

	sunos4*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Qoption ld '
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-PIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	;;

	sysv4 \| sysv4.2uw2* \| sysv4.3*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	;;

	sysv4MP)
	if test -d /usr/nec; then
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-Kconform_pic'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	fi
	;;

	sysv5* \| unixware* \| sco3.2v5* \| sco5v6* \| OpenUNIX*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	;;

	unicos*)
	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
	_LT_TAGVAR(lt_prog_compiler_can_build_shared, $1)=no
	;;

	uts4*)
	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-pic'
	_LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic'
	;;

	*)
	_LT_TAGVAR(lt_prog_compiler_can_build_shared, $1)=no
	;;
	esac
	fi
	])
	case $host_os in
	# For platforms that do not support PIC, -DPIC is meaningless:
	djgpp)
	_LT_TAGVAR(lt_prog_compiler_pic, $1)=
	;;
	*)
	_LT_TAGVAR(lt_prog_compiler_pic, $1)="$_LT_TAGVAR(lt_prog_compiler_pic, $1)@&t@m4_if([$1],[],[ -DPIC],[m4_if([$1],[CXX],[ -DPIC],[])])"
	;;
	esac

	AC_CACHE_CHECK([for $compiler option to produce PIC],
	[_LT_TAGVAR(lt_cv_prog_compiler_pic, $1)],
	[_LT_TAGVAR(lt_cv_prog_compiler_pic, $1)=$_LT_TAGVAR(lt_prog_compiler_pic, $1)])
	_LT_TAGVAR(lt_prog_compiler_pic, $1)=$_LT_TAGVAR(lt_cv_prog_compiler_pic, $1)

	#
	# Check to make sure the PIC flag actually works.
	#
	if test -n "$_LT_TAGVAR(lt_prog_compiler_pic, $1)"; then
	_LT_COMPILER_OPTION([if $compiler PIC flag $_LT_TAGVAR(lt_prog_compiler_pic, $1) works],
	[_LT_TAGVAR(lt_cv_prog_compiler_pic_works, $1)],
	[$_LT_TAGVAR(lt_prog_compiler_pic, $1)@&t@m4_if([$1],[],[ -DPIC],[m4_if([$1],[CXX],[ -DPIC],[])])], [],
	[case $_LT_TAGVAR(lt_prog_compiler_pic, $1) in
	"" \| " "*) ;;
	*) _LT_TAGVAR(lt_prog_compiler_pic, $1)=" $_LT_TAGVAR(lt_prog_compiler_pic, $1)" ;;
	esac],
	[_LT_TAGVAR(lt_prog_compiler_pic, $1)=
	_LT_TAGVAR(lt_prog_compiler_can_build_shared, $1)=no])
	fi
	_LT_TAGDECL([pic_flag], [lt_prog_compiler_pic], [1],
	[Additional compiler flags for building library objects])

	_LT_TAGDECL([wl], [lt_prog_compiler_wl], [1],
	[How to pass a linker flag through the compiler])
	#
	# Check to make sure the static flag actually works.
	#
	wl=$_LT_TAGVAR(lt_prog_compiler_wl, $1) eval lt_tmp_static_flag=\"$_LT_TAGVAR(lt_prog_compiler_static, $1)\"
	_LT_LINKER_OPTION([if $compiler static flag $lt_tmp_static_flag works],
	_LT_TAGVAR(lt_cv_prog_compiler_static_works, $1),
	$lt_tmp_static_flag,
	[],
	[_LT_TAGVAR(lt_prog_compiler_static, $1)=])
	_LT_TAGDECL([link_static_flag], [lt_prog_compiler_static], [1],
	[Compiler flag to prevent dynamic linking])
	])# _LT_COMPILER_PIC


	# _LT_LINKER_SHLIBS([TAGNAME])
	# ----------------------------
	# See if the linker supports building shared libraries.
	m4_defun([_LT_LINKER_SHLIBS],
	[AC_REQUIRE([LT_PATH_LD])dnl
	AC_REQUIRE([LT_PATH_NM])dnl
	m4_require([_LT_PATH_MANIFEST_TOOL])dnl
	m4_require([_LT_FILEUTILS_DEFAULTS])dnl
	m4_require([_LT_DECL_EGREP])dnl
	m4_require([_LT_DECL_SED])dnl
	m4_require([_LT_CMD_GLOBAL_SYMBOLS])dnl
	m4_require([_LT_TAG_COMPILER])dnl
	AC_MSG_CHECKING([whether the $compiler linker ($LD) supports shared libraries])
	m4_if([$1], [CXX], [
	_LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience \| $global_symbol_pipe \| $SED '\''s/.* //'\'' \| sort \| uniq > $export_symbols'
	_LT_TAGVAR(exclude_expsyms, $1)=['_GLOBAL_OFFSET_TABLE_\|_GLOBAL__F[ID]_.*']
	case $host_os in
	aix[[4-9]]*)
	# If we're using GNU nm, then we don't want the "-C" option.
	# -C means demangle to GNU nm, but means don't demangle to AIX nm.
	# Without the "-l" option, or with the "-B" option, AIX nm treats
	# weak defined symbols like other global defined symbols, whereas
	# GNU nm marks them as "W".
	# While the 'weak' keyword is ignored in the Export File, we need
	# it in the Import File for the 'aix-soname' feature, so we have
	# to replace the "-B" option with "-P" for AIX nm.
	if $NM -V 2>&1 \| $GREP 'GNU' > /dev/null; then
	_LT_TAGVAR(export_symbols_cmds, $1)='$NM -Bpg $libobjs $convenience \| awk '\''{ if (((\$ 2 == "T") \|\| (\$ 2 == "D") \|\| (\$ 2 == "B") \|\| (\$ 2 == "W")) && ([substr](\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' \| sort -u > $export_symbols'
	else
	_LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM \| $SED -e '\''s/B$[[^B]]*$$/P\1/'\''` -PCpgl $libobjs $convenience \| awk '\''{ if (((\$ 2 == "T") \|\| (\$ 2 == "D") \|\| (\$ 2 == "B") \|\| (\$ 2 == "W") \|\| (\$ 2 == "V") \|\| (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") \|\| (\$ 2 == "V") \|\| (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' \| sort -u > $export_symbols'
	fi
	;;
	pw32*)
	_LT_TAGVAR(export_symbols_cmds, $1)=$ltdll_cmds
	;;
	cygwin* \| mingw* \| cegcc*)
	case $cc_basename in
	cl*)
	_LT_TAGVAR(exclude_expsyms, $1)='_NULL_IMPORT_DESCRIPTOR\|_IMPORT_DESCRIPTOR_.*'
	;;
	*)
	_LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience \| $global_symbol_pipe \| $SED -e '\''/^[[BCDGRS]][[ ]]/s/.[[ ]]$[[^ ]]$/\1 DATA/;s/^.[[ ]]__nm__$[[^ ]]$[[ ]][[^ ]]/\1 DATA/;/^I[[ ]]/d;/^[[AITW]][[ ]]/s/. //'\'' \| sort \| uniq > $export_symbols'
	_LT_TAGVAR(exclude_expsyms, $1)=['[_]+GLOBAL_OFFSET_TABLE_\|[_]+GLOBAL__[FID]_.*\|[_]+head_[A-Za-z0-9_]+_dll\|[A-Za-z0-9_]+_dll_iname']
	;;
	esac
	;;
	*)
	_LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience \| $global_symbol_pipe \| $SED '\''s/.* //'\'' \| sort \| uniq > $export_symbols'
	;;
	esac
	], [
	runpath_var=
	_LT_TAGVAR(allow_undefined_flag, $1)=
	_LT_TAGVAR(always_export_symbols, $1)=no
	_LT_TAGVAR(archive_cmds, $1)=
	_LT_TAGVAR(archive_expsym_cmds, $1)=
	_LT_TAGVAR(compiler_needs_object, $1)=no
	_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=no
	_LT_TAGVAR(export_dynamic_flag_spec, $1)=
	_LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience \| $global_symbol_pipe \| $SED '\''s/.* //'\'' \| sort \| uniq > $export_symbols'
	_LT_TAGVAR(hardcode_automatic, $1)=no
	_LT_TAGVAR(hardcode_direct, $1)=no
	_LT_TAGVAR(hardcode_direct_absolute, $1)=no
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=
	_LT_TAGVAR(hardcode_libdir_separator, $1)=
	_LT_TAGVAR(hardcode_minus_L, $1)=no
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=unsupported
	_LT_TAGVAR(inherit_rpath, $1)=no
	_LT_TAGVAR(link_all_deplibs, $1)=unknown
	_LT_TAGVAR(module_cmds, $1)=
	_LT_TAGVAR(module_expsym_cmds, $1)=
	_LT_TAGVAR(old_archive_from_new_cmds, $1)=
	_LT_TAGVAR(old_archive_from_expsyms_cmds, $1)=
	_LT_TAGVAR(thread_safe_flag_spec, $1)=
	_LT_TAGVAR(whole_archive_flag_spec, $1)=
	# include_expsyms should be a list of space-separated symbols to be always
	# included in the symbol list
	_LT_TAGVAR(include_expsyms, $1)=
	# exclude_expsyms can be an extended regexp of symbols to exclude
	# it will be wrapped by ' (' and ')$', so one must not match beginning or
	# end of line. Example: 'a\|bc\|.d.' will exclude the symbols 'a' and 'bc',
	# as well as any symbol that contains 'd'.
	_LT_TAGVAR(exclude_expsyms, $1)=['_GLOBAL_OFFSET_TABLE_\|_GLOBAL__F[ID]_.*']
	# Although _GLOBAL_OFFSET_TABLE_ is a valid symbol C name, most a.out
	# platforms (ab)use it in PIC code, but their linkers get confused if
	# the symbol is explicitly referenced. Since portable code cannot
	# rely on this symbol name, it's probably fine to never include it in
	# preloaded symbol tables.
	# Exclude shared library initialization/finalization symbols.
	dnl Note also adjust exclude_expsyms for C++ above.
	extract_expsyms_cmds=

	case $host_os in
	cygwin* \| mingw* \| pw32* \| cegcc*)
	# FIXME: the MSVC++ port hasn't been tested in a loooong time
	# When not using gcc, we currently assume that we are using
	# Microsoft Visual C++.
	if test yes != "$GCC"; then
	with_gnu_ld=no
	fi
	;;
	interix*)
	# we just hope/assume this is gcc and not c89 (= MSVC++)
	with_gnu_ld=yes
	;;
	openbsd* \| bitrig*)
	with_gnu_ld=no
	;;
	esac

	_LT_TAGVAR(ld_shlibs, $1)=yes

	# On some targets, GNU ld is compatible enough with the native linker
	# that we're better off using the native interface for both.
	lt_use_gnu_ld_interface=no
	if test yes = "$with_gnu_ld"; then
	case $host_os in
	aix*)
	# The AIX port of GNU ld has always aspired to compatibility
	# with the native linker. However, as the warning in the GNU ld
	# block says, versions before 2.19.5* couldn't really create working
	# shared libraries, regardless of the interface used.
	case `$LD -v 2>&1` in
	\ $GNU\ Binutils$\ 2.19.5) ;;
	\ $GNU\ Binutils$\ 2.[[2-9]]) ;;
	\ $GNU\ Binutils$\ [[3-9]]) ;;
	*)
	lt_use_gnu_ld_interface=yes
	;;
	esac
	;;
	*)
	lt_use_gnu_ld_interface=yes
	;;
	esac
	fi

	if test yes = "$lt_use_gnu_ld_interface"; then
	# If archive_cmds runs LD, not CC, wlarc should be empty
	wlarc='$wl'

	# Set some defaults for GNU ld with shared library support. These
	# are reset later if shared libraries are not supported. Putting them
	# here allows them to be overridden if necessary.
	runpath_var=LD_RUN_PATH
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir'
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic'
	# ancient GNU ld didn't support --whole-archive et. al.
	if $LD --help 2>&1 \| $GREP 'no-whole-archive' > /dev/null; then
	_LT_TAGVAR(whole_archive_flag_spec, $1)=$wlarc'--whole-archive$convenience '$wlarc'--no-whole-archive'
	else
	_LT_TAGVAR(whole_archive_flag_spec, $1)=
	fi
	supports_anon_versioning=no
	case `$LD -v \| $SED -e 's/([^)]\+)\s\+//' 2>&1` in
	GNU\ gold) supports_anon_versioning=yes ;;
	\ [[01]]. \| \ 2.[[0-9]]. \| \ 2.10.) ;; # catch versions < 2.11
	\ 2.11.93.0.2\ ) supports_anon_versioning=yes ;; # RH7.3 ...
	\ 2.11.92.0.12\ ) supports_anon_versioning=yes ;; # Mandrake 8.2 ...
	\ 2.11.) ;; # other 2.11 versions
	*) supports_anon_versioning=yes ;;
	esac

	# See if GNU ld supports shared libraries.
	case $host_os in
	aix[[3-9]]*)
	# On AIX/PPC, the GNU linker is very broken
	if test ia64 != "$host_cpu"; then
	_LT_TAGVAR(ld_shlibs, $1)=no
	cat <<_LT_EOF 1>&2

	*** Warning: the GNU linker, at least up to release 2.19, is reported
	*** to be unable to reliably create shared libraries on AIX.
	*** Therefore, libtool is disabling shared libraries support. If you
	*** really care for shared libraries, you may want to install binutils
	*** 2.20 or above, or modify your PATH so that a non-GNU linker is found.
	*** You will then need to restart the configuration process.

	_LT_EOF
	fi
	;;

	amigaos*)
	case $host_cpu in
	powerpc)
	# see comment about AmigaOS4 .so support
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)=''
	;;
	m68k)
	_LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/a2ixlibrary.data~$ECHO "#define NAME $libname" > $output_objdir/a2ixlibrary.data~$ECHO "#define LIBRARY_ID 1" >> $output_objdir/a2ixlibrary.data~$ECHO "#define VERSION $major" >> $output_objdir/a2ixlibrary.data~$ECHO "#define REVISION $revision" >> $output_objdir/a2ixlibrary.data~$AR $AR_FLAGS $lib $libobjs~$RANLIB $lib~(cd $output_objdir && a2ixlibrary -32)'
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir'
	_LT_TAGVAR(hardcode_minus_L, $1)=yes
	;;
	esac
	;;

	beos*)
	if $LD --help 2>&1 \| $GREP ': supported targets:.* elf' > /dev/null; then
	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
	# Joseph Beckenbach <jrb3@best.com> says some releases of gcc
	# support --undefined. This deserves some investigation. FIXME
	_LT_TAGVAR(archive_cmds, $1)='$CC -nostart $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	else
	_LT_TAGVAR(ld_shlibs, $1)=no
	fi
	;;

	cygwin* \| mingw* \| pw32* \| cegcc*)
	# _LT_TAGVAR(hardcode_libdir_flag_spec, $1) is actually meaningless,
	# as there is no search path for DLLs.
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir'
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-all-symbols'
	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
	_LT_TAGVAR(always_export_symbols, $1)=no
	_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
	_LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience \| $global_symbol_pipe \| $SED -e '\''/^[[BCDGRS]][[ ]]/s/.[[ ]]$[[^ ]]$/\1 DATA/;s/^.[[ ]]__nm__$[[^ ]]$[[ ]][[^ ]]/\1 DATA/;/^I[[ ]]/d;/^[[AITW]][[ ]]/s/. //'\'' \| sort \| uniq > $export_symbols'
	_LT_TAGVAR(exclude_expsyms, $1)=['[_]+GLOBAL_OFFSET_TABLE_\|[_]+GLOBAL__[FID]_.*\|[_]+head_[A-Za-z0-9_]+_dll\|[A-Za-z0-9_]+_dll_iname']

	if $LD --help 2>&1 \| $GREP 'auto-import' > /dev/null; then
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib'
	# If the export-symbols file already is a .def file, use it as
	# is; otherwise, prepend EXPORTS...
	_LT_TAGVAR(archive_expsym_cmds, $1)='if _LT_DLL_DEF_P([$export_symbols]); then
	cp $export_symbols $output_objdir/$soname.def;
	else
	echo EXPORTS > $output_objdir/$soname.def;
	cat $export_symbols >> $output_objdir/$soname.def;
	fi~
	$CC -shared $output_objdir/$soname.def $libobjs $deplibs $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib'
	else
	_LT_TAGVAR(ld_shlibs, $1)=no
	fi
	;;

	haiku*)
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	_LT_TAGVAR(link_all_deplibs, $1)=yes
	;;

	os2*)
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir'
	_LT_TAGVAR(hardcode_minus_L, $1)=yes
	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
	shrext_cmds=.dll
	_LT_TAGVAR(archive_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~
	$ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~
	$ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~
	$ECHO EXPORTS >> $output_objdir/$libname.def~
	emxexp $libobjs \| $SED /"_DLL_InitTerm"/d >> $output_objdir/$libname.def~
	$CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~
	emximp -o $lib $output_objdir/$libname.def'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~
	$ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~
	$ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~
	$ECHO EXPORTS >> $output_objdir/$libname.def~
	prefix_cmds="$SED"~
	if test EXPORTS = "`$SED 1q $export_symbols`"; then
	prefix_cmds="$prefix_cmds -e 1d";
	fi~
	prefix_cmds="$prefix_cmds -e \"s/^$.*$$/_\1/g\""~
	cat $export_symbols \| $prefix_cmds >> $output_objdir/$libname.def~
	$CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~
	emximp -o $lib $output_objdir/$libname.def'
	_LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
	_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
	;;

	interix[[3-9]]*)
	_LT_TAGVAR(hardcode_direct, $1)=no
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir'
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E'
	# Hack: On Interix 3.x, we cannot compile PIC because of a broken gcc.
	# Instead, shared libraries are loaded at an image base (0x10000000 by
	# default) and relocated if they conflict, which is a slow very memory
	# consuming and fragmenting process. To avoid this, we pick a random,
	# 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link
	# time. Moving up from 0x10000000 also allows more sbrk(2) space.
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='sed "s\|^\|_\|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
	;;

	gnu* \| linux* \| tpf* \| kbsd-gnu \| kopensolaris*-gnu)
	tmp_diet=no
	if test linux-dietlibc = "$host_os"; then
	case $cc_basename in
	diet\ *) tmp_diet=yes;; # linux-dietlibc with static linking (!diet-dyn)
	esac
	fi
	if $LD --help 2>&1 \| $EGREP ': supported targets:.* elf' > /dev/null \
	&& test no = "$tmp_diet"
	then
	tmp_addflag=' $pic_flag'
	tmp_sharedflag='-shared'
	case $cc_basename,$host_cpu in
	pgcc*) # Portland Group C compiler
	_LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive'
	tmp_addflag=' $pic_flag'
	;;
	pgf77* \| pgf90* \| pgf95* \| pgfortran*)
	# Portland Group f77 and f90 compilers
	_LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive'
	tmp_addflag=' $pic_flag -Mnomain' ;;
	ecc,ia64 \| icc,ia64) # Intel C compiler on ia64
	tmp_addflag=' -i_dynamic' ;;
	efc,ia64 \| ifort,ia64) # Intel Fortran compiler on ia64
	tmp_addflag=' -i_dynamic -nofor_main' ;;
	ifc* \| ifort*) # Intel Fortran compiler
	tmp_addflag=' -nofor_main' ;;
	lf95*) # Lahey Fortran 8.1
	_LT_TAGVAR(whole_archive_flag_spec, $1)=
	tmp_sharedflag='--shared' ;;
	nagfor*) # NAGFOR 5.3
	tmp_sharedflag='-Wl,-shared' ;;
	xl[[cC]]* \| bgxl[[cC]]* \| mpixl[[cC]]*) # IBM XL C 8.0 on PPC (deal with xlf below)
	tmp_sharedflag='-qmkshrobj'
	tmp_addflag= ;;
	nvcc*) # Cuda Compiler Driver 2.2
	_LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive'
	_LT_TAGVAR(compiler_needs_object, $1)=yes
	;;
	esac
	case `$CC -V 2>&1 \| sed 5q` in
	Sun\ C) # Sun C 5.9
	_LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`new_convenience=; for conv in $convenience\"\"; do test -z \"$conv\" \|\| new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive'
	_LT_TAGVAR(compiler_needs_object, $1)=yes
	tmp_sharedflag='-G' ;;
	Sun\ F) # Sun Fortran 8.3
	tmp_sharedflag='-G' ;;
	esac
	_LT_TAGVAR(archive_cmds, $1)='$CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'

	if test yes = "$supports_anon_versioning"; then
	_LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
	cat $export_symbols \| sed -e "s/$.*$/\1;/" >> $output_objdir/$libname.ver~
	echo "local: *; };" >> $output_objdir/$libname.ver~
	$CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib'
	fi

	case $cc_basename in
	tcc*)
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='-rdynamic'
	;;
	xlf* \| bgf* \| bgxlf* \| mpixlf*)
	# IBM XL Fortran 10.1 on PPC cannot create shared libs itself
	_LT_TAGVAR(whole_archive_flag_spec, $1)='--whole-archive$convenience --no-whole-archive'
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir'
	_LT_TAGVAR(archive_cmds, $1)='$LD -shared $libobjs $deplibs $linker_flags -soname $soname -o $lib'
	if test yes = "$supports_anon_versioning"; then
	_LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
	cat $export_symbols \| sed -e "s/$.*$/\1;/" >> $output_objdir/$libname.ver~
	echo "local: *; };" >> $output_objdir/$libname.ver~
	$LD -shared $libobjs $deplibs $linker_flags -soname $soname -version-script $output_objdir/$libname.ver -o $lib'
	fi
	;;
	esac
	else
	_LT_TAGVAR(ld_shlibs, $1)=no
	fi
	;;

	netbsd*)
	if echo __ELF__ \| $CC -E - \| $GREP __ELF__ >/dev/null; then
	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib'
	wlarc=
	else
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib'
	fi
	;;

	solaris*)
	if $LD -v 2>&1 \| $GREP 'BFD 2\.8' > /dev/null; then
	_LT_TAGVAR(ld_shlibs, $1)=no
	cat <<_LT_EOF 1>&2

	*** Warning: The releases 2.8.* of the GNU linker cannot reliably
	*** create shared libraries on Solaris systems. Therefore, libtool
	*** is disabling shared libraries support. We urge you to upgrade GNU
	*** binutils to release 2.9.1 or newer. Another option is to modify
	*** your PATH or compiler configuration so that the native linker is
	*** used, and then restart.

	_LT_EOF
	elif $LD --help 2>&1 \| $GREP ': supported targets:.* elf' > /dev/null; then
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib'
	else
	_LT_TAGVAR(ld_shlibs, $1)=no
	fi
	;;

	sysv5* \| sco3.2v5* \| sco5v6* \| unixware* \| OpenUNIX*)
	case `$LD -v 2>&1` in
	\ [[01]]. \| \ 2.[[0-9]]. \| \ 2.1[[0-5]].)
	_LT_TAGVAR(ld_shlibs, $1)=no
	cat <<_LT_EOF 1>&2

	*** Warning: Releases of the GNU linker prior to 2.16.91.0.3 cannot
	*** reliably create shared libraries on SCO systems. Therefore, libtool
	*** is disabling shared libraries support. We urge you to upgrade GNU
	*** binutils to release 2.16.91.0.3 or newer. Another option is to modify
	*** your PATH or compiler configuration so that the native linker is
	*** used, and then restart.

	_LT_EOF
	;;
	*)
	# For security reasons, it is highly recommended that you always
	# use absolute paths for naming shared libraries, and exclude the
	# DT_RUNPATH tag from executables and libraries. But doing so
	# requires that you compile everything twice, which is a pain.
	if $LD --help 2>&1 \| $GREP ': supported targets:.* elf' > /dev/null; then
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir'
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib'
	else
	_LT_TAGVAR(ld_shlibs, $1)=no
	fi
	;;
	esac
	;;

	sunos4*)
	_LT_TAGVAR(archive_cmds, $1)='$LD -assert pure-text -Bshareable -o $lib $libobjs $deplibs $linker_flags'
	wlarc=
	_LT_TAGVAR(hardcode_direct, $1)=yes
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	;;

	*)
	if $LD --help 2>&1 \| $GREP ': supported targets:.* elf' > /dev/null; then
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib'
	else
	_LT_TAGVAR(ld_shlibs, $1)=no
	fi
	;;
	esac

	if test no = "$_LT_TAGVAR(ld_shlibs, $1)"; then
	runpath_var=
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=
	_LT_TAGVAR(export_dynamic_flag_spec, $1)=
	_LT_TAGVAR(whole_archive_flag_spec, $1)=
	fi
	else
	# PORTME fill in a description of your system's linker (not GNU ld)
	case $host_os in
	aix3*)
	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
	_LT_TAGVAR(always_export_symbols, $1)=yes
	_LT_TAGVAR(archive_expsym_cmds, $1)='$LD -o $output_objdir/$soname $libobjs $deplibs $linker_flags -bE:$export_symbols -T512 -H512 -bM:SRE~$AR $AR_FLAGS $lib $output_objdir/$soname'
	# Note: this linker hardcodes the directories in LIBPATH if there
	# are no directories specified by -L.
	_LT_TAGVAR(hardcode_minus_L, $1)=yes
	if test yes = "$GCC" && test -z "$lt_prog_compiler_static"; then
	# Neither direct hardcoding nor static linking is supported with a
	# broken collect2.
	_LT_TAGVAR(hardcode_direct, $1)=unsupported
	fi
	;;

	aix[[4-9]]*)
	if test ia64 = "$host_cpu"; then
	# On IA64, the linker does run time linking by default, so we don't
	# have to do anything special.
	aix_use_runtimelinking=no
	exp_sym_flag='-Bexport'
	no_entry_flag=
	else
	# If we're using GNU nm, then we don't want the "-C" option.
	# -C means demangle to GNU nm, but means don't demangle to AIX nm.
	# Without the "-l" option, or with the "-B" option, AIX nm treats
	# weak defined symbols like other global defined symbols, whereas
	# GNU nm marks them as "W".
	# While the 'weak' keyword is ignored in the Export File, we need
	# it in the Import File for the 'aix-soname' feature, so we have
	# to replace the "-B" option with "-P" for AIX nm.
	if $NM -V 2>&1 \| $GREP 'GNU' > /dev/null; then
	_LT_TAGVAR(export_symbols_cmds, $1)='$NM -Bpg $libobjs $convenience \| awk '\''{ if (((\$ 2 == "T") \|\| (\$ 2 == "D") \|\| (\$ 2 == "B") \|\| (\$ 2 == "W")) && ([substr](\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' \| sort -u > $export_symbols'
	else
	_LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM \| $SED -e '\''s/B$[[^B]]*$$/P\1/'\''` -PCpgl $libobjs $convenience \| awk '\''{ if (((\$ 2 == "T") \|\| (\$ 2 == "D") \|\| (\$ 2 == "B") \|\| (\$ 2 == "W") \|\| (\$ 2 == "V") \|\| (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") \|\| (\$ 2 == "V") \|\| (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' \| sort -u > $export_symbols'
	fi
	aix_use_runtimelinking=no

	# Test if we are trying to use run time linking or normal
	# AIX style linking. If -brtl is somewhere in LDFLAGS, we
	# have runtime linking enabled, and use it for executables.
	# For shared libraries, we enable/disable runtime linking
	# depending on the kind of the shared library created -
	# when "with_aix_soname,aix_use_runtimelinking" is:
	# "aix,no" lib.a(lib.so.V) shared, rtl:no, for executables
	# "aix,yes" lib.so shared, rtl:yes, for executables
	# lib.a static archive
	# "both,no" lib.so.V(shr.o) shared, rtl:yes
	# lib.a(lib.so.V) shared, rtl:no, for executables
	# "both,yes" lib.so.V(shr.o) shared, rtl:yes, for executables
	# lib.a(lib.so.V) shared, rtl:no
	# "svr4,*" lib.so.V(shr.o) shared, rtl:yes, for executables
	# lib.a static archive
	case $host_os in aix4.[[23]]\|aix4.[[23]].\|aix[[5-9]])
	for ld_flag in $LDFLAGS; do
	if (test x-brtl = "x$ld_flag" \|\| test x-Wl,-brtl = "x$ld_flag"); then
	aix_use_runtimelinking=yes
	break
	fi
	done
	if test svr4,no = "$with_aix_soname,$aix_use_runtimelinking"; then
	# With aix-soname=svr4, we create the lib.so.V shared archives only,
	# so we don't have lib.a shared libs to link our executables.
	# We have to force runtime linking in this case.
	aix_use_runtimelinking=yes
	LDFLAGS="$LDFLAGS -Wl,-brtl"
	fi
	;;
	esac

	exp_sym_flag='-bexport'
	no_entry_flag='-bnoentry'
	fi

	# When large executables or shared objects are built, AIX ld can
	# have problems creating the table of contents. If linking a library
	# or program results in "error TOC overflow" add -mminimal-toc to
	# CXXFLAGS/CFLAGS for g++/gcc. In the cases where that is not
	# enough to fix the problem, add -Wl,-bbigtoc to LDFLAGS.

	_LT_TAGVAR(archive_cmds, $1)=''
	_LT_TAGVAR(hardcode_direct, $1)=yes
	_LT_TAGVAR(hardcode_direct_absolute, $1)=yes
	_LT_TAGVAR(hardcode_libdir_separator, $1)=':'
	_LT_TAGVAR(link_all_deplibs, $1)=yes
	_LT_TAGVAR(file_list_spec, $1)='$wl-f,'
	case $with_aix_soname,$aix_use_runtimelinking in
	aix,*) ;; # traditional, no import file
	svr4,* \| *,yes) # use import file
	# The Import File defines what to hardcode.
	_LT_TAGVAR(hardcode_direct, $1)=no
	_LT_TAGVAR(hardcode_direct_absolute, $1)=no
	;;
	esac

	if test yes = "$GCC"; then
	case $host_os in aix4.[[012]]\|aix4.[[012]].*)
	# We only want to do this on AIX 4.2 and lower, the check
	# below for broken collect2 doesn't work under 4.3+
	collect2name=`$CC -print-prog-name=collect2`
	if test -f "$collect2name" &&
	strings "$collect2name" \| $GREP resolve_lib_name >/dev/null
	then
	# We have reworked collect2
	:
	else
	# We have old collect2
	_LT_TAGVAR(hardcode_direct, $1)=unsupported
	# It fails to find uninstalled libraries when the uninstalled
	# path is not listed in the libpath. Setting hardcode_minus_L
	# to unsupported forces relinking
	_LT_TAGVAR(hardcode_minus_L, $1)=yes
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=
	fi
	;;
	esac
	shared_flag='-shared'
	if test yes = "$aix_use_runtimelinking"; then
	shared_flag="$shared_flag "'$wl-G'
	fi
	# Need to ensure runtime linking is disabled for the traditional
	# shared library, or the linker may eventually find shared libraries
	# /with/ Import File - we do not want to mix them.
	shared_flag_aix='-shared'
	shared_flag_svr4='-shared $wl-G'
	else
	# not using gcc
	if test ia64 = "$host_cpu"; then
	# VisualAge C++, Version 5.5 for AIX 5L for IA-64, Beta 3 Release
	# chokes on -Wl,-G. The following line is correct:
	shared_flag='-G'
	else
	if test yes = "$aix_use_runtimelinking"; then
	shared_flag='$wl-G'
	else
	shared_flag='$wl-bM:SRE'
	fi
	shared_flag_aix='$wl-bM:SRE'
	shared_flag_svr4='$wl-G'
	fi
	fi

	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-bexpall'
	# It seems that -bexpall does not export symbols beginning with
	# underscore (_), so it is better to generate a list of symbols to export.
	_LT_TAGVAR(always_export_symbols, $1)=yes
	if test aix,yes = "$with_aix_soname,$aix_use_runtimelinking"; then
	# Warning - without using the other runtime loading flags (-brtl),
	# -berok will link without error, but may produce a broken library.
	_LT_TAGVAR(allow_undefined_flag, $1)='-berok'
	# Determine the default libpath from the value encoded in an
	# empty executable.
	_LT_SYS_MODULE_PATH_AIX([$1])
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-blibpath:$libdir:'"$aix_libpath"
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -o $output_objdir/$soname $libobjs $deplibs $wl'$no_entry_flag' $compiler_flags `if test -n "$allow_undefined_flag"; then func_echo_all "$wl$allow_undefined_flag"; else :; fi` $wl'$exp_sym_flag:\$export_symbols' '$shared_flag
	else
	if test ia64 = "$host_cpu"; then
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R $libdir:/usr/lib:/lib'
	_LT_TAGVAR(allow_undefined_flag, $1)="-z nodefs"
	_LT_TAGVAR(archive_expsym_cmds, $1)="\$CC $shared_flag"' -o $output_objdir/$soname $libobjs $deplibs '"\$wl$no_entry_flag"' $compiler_flags $wl$allow_undefined_flag '"\$wl$exp_sym_flag:\$export_symbols"
	else
	# Determine the default libpath from the value encoded in an
	# empty executable.
	_LT_SYS_MODULE_PATH_AIX([$1])
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-blibpath:$libdir:'"$aix_libpath"
	# Warning - without using the other run time loading flags,
	# -berok will link without error, but may produce a broken library.
	_LT_TAGVAR(no_undefined_flag, $1)=' $wl-bernotok'
	_LT_TAGVAR(allow_undefined_flag, $1)=' $wl-berok'
	if test yes = "$with_gnu_ld"; then
	# We only use this code for GNU lds that support --whole-archive.
	_LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive$convenience $wl--no-whole-archive'
	else
	# Exported symbols can be pulled into shared objects from archives
	_LT_TAGVAR(whole_archive_flag_spec, $1)='$convenience'
	fi
	_LT_TAGVAR(archive_cmds_need_lc, $1)=yes
	_LT_TAGVAR(archive_expsym_cmds, $1)='$RM -r $output_objdir/$realname.d~$MKDIR $output_objdir/$realname.d'
	# -brtl affects multiple linker settings, -berok does not and is overridden later
	compiler_flags_filtered='`func_echo_all "$compiler_flags " \| $SED -e "s%-brtl\$[[, ]]\$%-berok\\1%g"`'
	if test svr4 != "$with_aix_soname"; then
	# This is similar to how AIX traditionally builds its shared libraries.
	_LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$CC '$shared_flag_aix' -o $output_objdir/$realname.d/$soname $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$AR $AR_FLAGS $output_objdir/$libname$release.a $output_objdir/$realname.d/$soname'
	fi
	if test aix != "$with_aix_soname"; then
	_LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$CC '$shared_flag_svr4' -o $output_objdir/$realname.d/$shared_archive_member_spec.o $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$STRIP -e $output_objdir/$realname.d/$shared_archive_member_spec.o~( func_echo_all "#! $soname($shared_archive_member_spec.o)"; if test shr_64 = "$shared_archive_member_spec"; then func_echo_all "# 64"; else func_echo_all "# 32"; fi; cat $export_symbols ) > $output_objdir/$realname.d/$shared_archive_member_spec.imp~$AR $AR_FLAGS $output_objdir/$soname $output_objdir/$realname.d/$shared_archive_member_spec.o $output_objdir/$realname.d/$shared_archive_member_spec.imp'
	else
	# used by -dlpreopen to get the symbols
	_LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$MV $output_objdir/$realname.d/$soname $output_objdir'
	fi
	_LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$RM -r $output_objdir/$realname.d'
	fi
	fi
	;;

	amigaos*)
	case $host_cpu in
	powerpc)
	# see comment about AmigaOS4 .so support
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)=''
	;;
	m68k)
	_LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/a2ixlibrary.data~$ECHO "#define NAME $libname" > $output_objdir/a2ixlibrary.data~$ECHO "#define LIBRARY_ID 1" >> $output_objdir/a2ixlibrary.data~$ECHO "#define VERSION $major" >> $output_objdir/a2ixlibrary.data~$ECHO "#define REVISION $revision" >> $output_objdir/a2ixlibrary.data~$AR $AR_FLAGS $lib $libobjs~$RANLIB $lib~(cd $output_objdir && a2ixlibrary -32)'
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir'
	_LT_TAGVAR(hardcode_minus_L, $1)=yes
	;;
	esac
	;;

	bsdi[[45]]*)
	_LT_TAGVAR(export_dynamic_flag_spec, $1)=-rdynamic
	;;

	cygwin* \| mingw* \| pw32* \| cegcc*)
	# When not using gcc, we currently assume that we are using
	# Microsoft Visual C++.
	# hardcode_libdir_flag_spec is actually meaningless, as there is
	# no search path for DLLs.
	case $cc_basename in
	cl*)
	# Native MSVC
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
	_LT_TAGVAR(always_export_symbols, $1)=yes
	_LT_TAGVAR(file_list_spec, $1)='@'
	# Tell ltmain to make .lib files, not .a files.
	libext=lib
	# Tell ltmain to make .dll files, not .so files.
	shrext_cmds=.dll
	# FIXME: Setting linknames here is a bad hack.
	_LT_TAGVAR(archive_cmds, $1)='$CC -o $output_objdir/$soname $libobjs $compiler_flags $deplibs -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~linknames='
	_LT_TAGVAR(archive_expsym_cmds, $1)='if _LT_DLL_DEF_P([$export_symbols]); then
	cp "$export_symbols" "$output_objdir/$soname.def";
	echo "$tool_output_objdir$soname.def" > "$output_objdir/$soname.exp";
	else
	$SED -e '\''s/^/-link -EXPORT:/'\'' < $export_symbols > $output_objdir/$soname.exp;
	fi~
	$CC -o $tool_output_objdir$soname $libobjs $compiler_flags $deplibs "@$tool_output_objdir$soname.exp" -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~
	linknames='
	# The linker will not automatically build a static lib if we build a DLL.
	# _LT_TAGVAR(old_archive_from_new_cmds, $1)='true'
	_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
	_LT_TAGVAR(exclude_expsyms, $1)='_NULL_IMPORT_DESCRIPTOR\|_IMPORT_DESCRIPTOR_.*'
	_LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience \| $global_symbol_pipe \| $SED -e '\''/^[[BCDGRS]][[ ]]/s/.[[ ]]$[[^ ]]$/\1,DATA/'\'' \| $SED -e '\''/^[[AITW]][[ ]]/s/.*[[ ]]//'\'' \| sort \| uniq > $export_symbols'
	# Don't use ranlib
	_LT_TAGVAR(old_postinstall_cmds, $1)='chmod 644 $oldlib'
	_LT_TAGVAR(postlink_cmds, $1)='lt_outputfile="@OUTPUT@"~
	lt_tool_outputfile="@TOOL_OUTPUT@"~
	case $lt_outputfile in
	.exe\|.EXE) ;;
	*)
	lt_outputfile=$lt_outputfile.exe
	lt_tool_outputfile=$lt_tool_outputfile.exe
	;;
	esac~
	if test : != "$MANIFEST_TOOL" && test -f "$lt_outputfile.manifest"; then
	$MANIFEST_TOOL -manifest "$lt_tool_outputfile.manifest" -outputresource:"$lt_tool_outputfile" \|\| exit 1;
	$RM "$lt_outputfile.manifest";
	fi'
	;;
	*)
	# Assume MSVC wrapper
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
	# Tell ltmain to make .lib files, not .a files.
	libext=lib
	# Tell ltmain to make .dll files, not .so files.
	shrext_cmds=.dll
	# FIXME: Setting linknames here is a bad hack.
	_LT_TAGVAR(archive_cmds, $1)='$CC -o $lib $libobjs $compiler_flags `func_echo_all "$deplibs" \| $SED '\''s/ -lc$//'\''` -link -dll~linknames='
	# The linker will automatically build a .lib file if we build a DLL.
	_LT_TAGVAR(old_archive_from_new_cmds, $1)='true'
	# FIXME: Should let the user specify the lib program.
	_LT_TAGVAR(old_archive_cmds, $1)='lib -OUT:$oldlib$oldobjs$old_deplibs'
	_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
	;;
	esac
	;;

	darwin* \| rhapsody*)
	_LT_DARWIN_LINKER_FEATURES($1)
	;;

	dgux*)
	_LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir'
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	;;

	# FreeBSD 2.2.[012] allows us to include c++rt0.o to get C++ constructor
	# support. Future versions do this automatically, but an explicit c++rt0.o
	# does not break anything, and helps significantly (at the cost of a little
	# extra space).
	freebsd2.2*)
	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags /usr/lib/c++rt0.o'
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir'
	_LT_TAGVAR(hardcode_direct, $1)=yes
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	;;

	# Unfortunately, older versions of FreeBSD 2 do not have this feature.
	freebsd2.*)
	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags'
	_LT_TAGVAR(hardcode_direct, $1)=yes
	_LT_TAGVAR(hardcode_minus_L, $1)=yes
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	;;

	# FreeBSD 3 and greater uses gcc -shared to do shared libraries.
	freebsd* \| dragonfly*)
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir'
	_LT_TAGVAR(hardcode_direct, $1)=yes
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	;;

	hpux9*)
	if test yes = "$GCC"; then
	_LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/$soname~$CC -shared $pic_flag $wl+b $wl$install_libdir -o $output_objdir/$soname $libobjs $deplibs $compiler_flags~test "x$output_objdir/$soname" = "x$lib" \|\| mv $output_objdir/$soname $lib'
	else
	_LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/$soname~$LD -b +b $install_libdir -o $output_objdir/$soname $libobjs $deplibs $linker_flags~test "x$output_objdir/$soname" = "x$lib" \|\| mv $output_objdir/$soname $lib'
	fi
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl+b $wl$libdir'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=:
	_LT_TAGVAR(hardcode_direct, $1)=yes

	# hardcode_minus_L: Not really in the search PATH,
	# but as the default location of the library.
	_LT_TAGVAR(hardcode_minus_L, $1)=yes
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E'
	;;

	hpux10*)
	if test yes,no = "$GCC,$with_gnu_ld"; then
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags'
	else
	_LT_TAGVAR(archive_cmds, $1)='$LD -b +h $soname +b $install_libdir -o $lib $libobjs $deplibs $linker_flags'
	fi
	if test no = "$with_gnu_ld"; then
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl+b $wl$libdir'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=:
	_LT_TAGVAR(hardcode_direct, $1)=yes
	_LT_TAGVAR(hardcode_direct_absolute, $1)=yes
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E'
	# hardcode_minus_L: Not really in the search PATH,
	# but as the default location of the library.
	_LT_TAGVAR(hardcode_minus_L, $1)=yes
	fi
	;;

	hpux11*)
	if test yes,no = "$GCC,$with_gnu_ld"; then
	case $host_cpu in
	hppa64)
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $wl+h $wl$soname -o $lib $libobjs $deplibs $compiler_flags'
	;;
	ia64*)
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $wl+h $wl$soname $wl+nodefaultrpath -o $lib $libobjs $deplibs $compiler_flags'
	;;
	*)
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags'
	;;
	esac
	else
	case $host_cpu in
	hppa64)
	_LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname -o $lib $libobjs $deplibs $compiler_flags'
	;;
	ia64*)
	_LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname $wl+nodefaultrpath -o $lib $libobjs $deplibs $compiler_flags'
	;;
	*)
	m4_if($1, [], [
	# Older versions of the 11.00 compiler do not understand -b yet
	# (HP92453-01 A.11.01.20 doesn't, HP92453-01 B.11.X.35175-35176.GP does)
	_LT_LINKER_OPTION([if $CC understands -b],
	_LT_TAGVAR(lt_cv_prog_compiler__b, $1), [-b],
	[_LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags'],
	[_LT_TAGVAR(archive_cmds, $1)='$LD -b +h $soname +b $install_libdir -o $lib $libobjs $deplibs $linker_flags'])],
	[_LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags'])
	;;
	esac
	fi
	if test no = "$with_gnu_ld"; then
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl+b $wl$libdir'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=:

	case $host_cpu in
	hppa64\|ia64*)
	_LT_TAGVAR(hardcode_direct, $1)=no
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	;;
	*)
	_LT_TAGVAR(hardcode_direct, $1)=yes
	_LT_TAGVAR(hardcode_direct_absolute, $1)=yes
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E'

	# hardcode_minus_L: Not really in the search PATH,
	# but as the default location of the library.
	_LT_TAGVAR(hardcode_minus_L, $1)=yes
	;;
	esac
	fi
	;;

	irix5* \| irix6* \| nonstopux*)
	if test yes = "$GCC"; then
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib'
	# Try to use the -exported_symbol ld option, if it does not
	# work, assume that -exports_file does not work either and
	# implicitly export all symbols.
	# This should be the same for all languages, so no per-tag cache variable.
	AC_CACHE_CHECK([whether the $host_os linker accepts -exported_symbol],
	[lt_cv_irix_exported_symbol],
	[save_LDFLAGS=$LDFLAGS
	LDFLAGS="$LDFLAGS -shared $wl-exported_symbol ${wl}foo $wl-update_registry $wl/dev/null"
	AC_LINK_IFELSE(
	[AC_LANG_SOURCE(
	[AC_LANG_CASE([C], [[int foo (void) { return 0; }]],
	[C++], [[int foo (void) { return 0; }]],
	[Fortran 77], [[
	subroutine foo
	end]],
	[Fortran], [[
	subroutine foo
	end]])])],
	[lt_cv_irix_exported_symbol=yes],
	[lt_cv_irix_exported_symbol=no])
	LDFLAGS=$save_LDFLAGS])
	if test yes = "$lt_cv_irix_exported_symbol"; then
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib'
	fi
	else
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -exports_file $export_symbols -o $lib'
	fi
	_LT_TAGVAR(archive_cmds_need_lc, $1)='no'
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=:
	_LT_TAGVAR(inherit_rpath, $1)=yes
	_LT_TAGVAR(link_all_deplibs, $1)=yes
	;;

	linux*)
	case $cc_basename in
	tcc*)
	# Fabrice Bellard et al's Tiny C Compiler
	_LT_TAGVAR(ld_shlibs, $1)=yes
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
	;;
	esac
	;;

	netbsd*)
	if echo __ELF__ \| $CC -E - \| $GREP __ELF__ >/dev/null; then
	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags' # a.out
	else
	_LT_TAGVAR(archive_cmds, $1)='$LD -shared -o $lib $libobjs $deplibs $linker_flags' # ELF
	fi
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir'
	_LT_TAGVAR(hardcode_direct, $1)=yes
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	;;

	newsos6)
	_LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
	_LT_TAGVAR(hardcode_direct, $1)=yes
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=:
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	;;

	nto \| qnx)
	;;

	openbsd* \| bitrig*)
	if test -f /usr/libexec/ld.so; then
	_LT_TAGVAR(hardcode_direct, $1)=yes
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	_LT_TAGVAR(hardcode_direct_absolute, $1)=yes
	if test -z "`echo __ELF__ \| $CC -E - \| $GREP __ELF__`"; then
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags $wl-retain-symbols-file,$export_symbols'
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir'
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E'
	else
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir'
	fi
	else
	_LT_TAGVAR(ld_shlibs, $1)=no
	fi
	;;

	os2*)
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir'
	_LT_TAGVAR(hardcode_minus_L, $1)=yes
	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
	shrext_cmds=.dll
	_LT_TAGVAR(archive_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~
	$ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~
	$ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~
	$ECHO EXPORTS >> $output_objdir/$libname.def~
	emxexp $libobjs \| $SED /"_DLL_InitTerm"/d >> $output_objdir/$libname.def~
	$CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~
	emximp -o $lib $output_objdir/$libname.def'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~
	$ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~
	$ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~
	$ECHO EXPORTS >> $output_objdir/$libname.def~
	prefix_cmds="$SED"~
	if test EXPORTS = "`$SED 1q $export_symbols`"; then
	prefix_cmds="$prefix_cmds -e 1d";
	fi~
	prefix_cmds="$prefix_cmds -e \"s/^$.*$$/_\1/g\""~
	cat $export_symbols \| $prefix_cmds >> $output_objdir/$libname.def~
	$CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~
	emximp -o $lib $output_objdir/$libname.def'
	_LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
	_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
	;;

	osf3*)
	if test yes = "$GCC"; then
	_LT_TAGVAR(allow_undefined_flag, $1)=' $wl-expect_unresolved $wl\*'
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib'
	else
	_LT_TAGVAR(allow_undefined_flag, $1)=' -expect_unresolved \*'
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
	fi
	_LT_TAGVAR(archive_cmds_need_lc, $1)='no'
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=:
	;;

	osf4* \| osf5) # as osf3 with the addition of -msym flag
	if test yes = "$GCC"; then
	_LT_TAGVAR(allow_undefined_flag, $1)=' $wl-expect_unresolved $wl\*'
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $pic_flag $libobjs $deplibs $compiler_flags $wl-msym $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib'
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir'
	else
	_LT_TAGVAR(allow_undefined_flag, $1)=' -expect_unresolved \*'
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags -msym -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='for i in `cat $export_symbols`; do printf "%s %s\\n" -exported_symbol "\$i" >> $lib.exp; done; printf "%s\\n" "-hidden">> $lib.exp~
	$CC -shared$allow_undefined_flag $wl-input $wl$lib.exp $compiler_flags $libobjs $deplibs -soname $soname `test -n "$verstring" && $ECHO "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib~$RM $lib.exp'

	# Both c and cxx compiler support -rpath directly
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-rpath $libdir'
	fi
	_LT_TAGVAR(archive_cmds_need_lc, $1)='no'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=:
	;;

	solaris*)
	_LT_TAGVAR(no_undefined_flag, $1)=' -z defs'
	if test yes = "$GCC"; then
	wlarc='$wl'
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $wl-z ${wl}text $wl-h $wl$soname -o $lib $libobjs $deplibs $compiler_flags'
	_LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols \| $SED -e "s/$.$/\1;/" >> $lib.exp~echo "local: ; };" >> $lib.exp~
	$CC -shared $pic_flag $wl-z ${wl}text $wl-M $wl$lib.exp $wl-h $wl$soname -o $lib $libobjs $deplibs $compiler_flags~$RM $lib.exp'
	else
	case `$CC -V 2>&1` in
	"Compilers 5.0")
	wlarc=''
	_LT_TAGVAR(archive_cmds, $1)='$LD -G$allow_undefined_flag -h $soname -o $lib $libobjs $deplibs $linker_flags'
	_LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols \| $SED -e "s/$.$/\1;/" >> $lib.exp~echo "local: ; };" >> $lib.exp~
	$LD -G$allow_undefined_flag -M $lib.exp -h $soname -o $lib $libobjs $deplibs $linker_flags~$RM $lib.exp'
	;;
	*)
	wlarc='$wl'
	_LT_TAGVAR(archive_cmds, $1)='$CC -G$allow_undefined_flag -h $soname -o $lib $libobjs $deplibs $compiler_flags'
	_LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols \| $SED -e "s/$.$/\1;/" >> $lib.exp~echo "local: ; };" >> $lib.exp~
	$CC -G$allow_undefined_flag -M $lib.exp -h $soname -o $lib $libobjs $deplibs $compiler_flags~$RM $lib.exp'
	;;
	esac
	fi
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir'
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	case $host_os in
	solaris2.[[0-5]] \| solaris2.[[0-5]].*) ;;
	*)
	# The compiler driver will combine and reorder linker options,
	# but understands '-z linker_flag'. GCC discards it without '$wl',
	# but is careful enough not to reorder.
	# Supported since Solaris 2.6 (maybe 2.5.1?)
	if test yes = "$GCC"; then
	_LT_TAGVAR(whole_archive_flag_spec, $1)='$wl-z ${wl}allextract$convenience $wl-z ${wl}defaultextract'
	else
	_LT_TAGVAR(whole_archive_flag_spec, $1)='-z allextract$convenience -z defaultextract'
	fi
	;;
	esac
	_LT_TAGVAR(link_all_deplibs, $1)=yes
	;;

	sunos4*)
	if test sequent = "$host_vendor"; then
	# Use $CC to link under sequent, because it throws in some extra .o
	# files that make .init and .fini sections work.
	_LT_TAGVAR(archive_cmds, $1)='$CC -G $wl-h $soname -o $lib $libobjs $deplibs $compiler_flags'
	else
	_LT_TAGVAR(archive_cmds, $1)='$LD -assert pure-text -Bstatic -o $lib $libobjs $deplibs $linker_flags'
	fi
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir'
	_LT_TAGVAR(hardcode_direct, $1)=yes
	_LT_TAGVAR(hardcode_minus_L, $1)=yes
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	;;

	sysv4)
	case $host_vendor in
	sni)
	_LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
	_LT_TAGVAR(hardcode_direct, $1)=yes # is this really true???
	;;
	siemens)
	## LD is ld it makes a PLAMLIB
	## CC just makes a GrossModule.
	_LT_TAGVAR(archive_cmds, $1)='$LD -G -o $lib $libobjs $deplibs $linker_flags'
	_LT_TAGVAR(reload_cmds, $1)='$CC -r -o $output$reload_objs'
	_LT_TAGVAR(hardcode_direct, $1)=no
	;;
	motorola)
	_LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
	_LT_TAGVAR(hardcode_direct, $1)=no #Motorola manual says yes, but my tests say they lie
	;;
	esac
	runpath_var='LD_RUN_PATH'
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	;;

	sysv4.3*)
	_LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='-Bexport'
	;;

	sysv4MP)
	if test -d /usr/nec; then
	_LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	runpath_var=LD_RUN_PATH
	hardcode_runpath_var=yes
	_LT_TAGVAR(ld_shlibs, $1)=yes
	fi
	;;

	sysv4uw2 \| sysv5OpenUNIX* \| sysv5UnixWare7.[[01]].[[10]]* \| unixware7* \| sco3.2v5.0.[[024]]*)
	_LT_TAGVAR(no_undefined_flag, $1)='$wl-z,text'
	_LT_TAGVAR(archive_cmds_need_lc, $1)=no
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	runpath_var='LD_RUN_PATH'

	if test yes = "$GCC"; then
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	else
	_LT_TAGVAR(archive_cmds, $1)='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	fi
	;;

	sysv5* \| sco3.2v5* \| sco5v6*)
	# Note: We CANNOT use -z defs as we might desire, because we do not
	# link with -lc, and that would cause any symbols used from libc to
	# always be unresolved, which means just about no library would
	# ever link correctly. If we're not using GNU ld we use -z text
	# though, which does catch some bad symbols but isn't as heavy-handed
	# as -z defs.
	_LT_TAGVAR(no_undefined_flag, $1)='$wl-z,text'
	_LT_TAGVAR(allow_undefined_flag, $1)='$wl-z,nodefs'
	_LT_TAGVAR(archive_cmds_need_lc, $1)=no
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R,$libdir'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=':'
	_LT_TAGVAR(link_all_deplibs, $1)=yes
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-Bexport'
	runpath_var='LD_RUN_PATH'

	if test yes = "$GCC"; then
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	else
	_LT_TAGVAR(archive_cmds, $1)='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	fi
	;;

	uts4*)
	_LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir'
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	;;

	*)
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	esac

	if test sni = "$host_vendor"; then
	case $host in
	sysv4 \| sysv4.2uw2* \| sysv4.3* \| sysv5*)
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-Blargedynsym'
	;;
	esac
	fi
	fi
	])
	AC_MSG_RESULT([$_LT_TAGVAR(ld_shlibs, $1)])
	test no = "$_LT_TAGVAR(ld_shlibs, $1)" && can_build_shared=no

	_LT_TAGVAR(with_gnu_ld, $1)=$with_gnu_ld

	_LT_DECL([], [libext], [0], [Old archive suffix (normally "a")])dnl
	_LT_DECL([], [shrext_cmds], [1], [Shared library suffix (normally ".so")])dnl
	_LT_DECL([], [extract_expsyms_cmds], [2],
	[The commands to extract the exported symbol list from a shared archive])

	#
	# Do we need to explicitly link libc?
	#
	case "x$_LT_TAGVAR(archive_cmds_need_lc, $1)" in
	x\|xyes)
	# Assume -lc should be added
	_LT_TAGVAR(archive_cmds_need_lc, $1)=yes

	if test yes,yes = "$GCC,$enable_shared"; then
	case $_LT_TAGVAR(archive_cmds, $1) in
	'~')
	# FIXME: we may have to deal with multi-command sequences.
	;;
	'$CC '*)
	# Test whether the compiler implicitly links with -lc since on some
	# systems, -lgcc has to come before -lc. If gcc already passes -lc
	# to ld, don't add -lc before -lgcc.
	AC_CACHE_CHECK([whether -lc should be explicitly linked in],
	[lt_cv_]_LT_TAGVAR(archive_cmds_need_lc, $1),
	[$RM conftest*
	echo "$lt_simple_compile_test_code" > conftest.$ac_ext

	if AC_TRY_EVAL(ac_compile) 2>conftest.err; then
	soname=conftest
	lib=conftest
	libobjs=conftest.$ac_objext
	deplibs=
	wl=$_LT_TAGVAR(lt_prog_compiler_wl, $1)
	pic_flag=$_LT_TAGVAR(lt_prog_compiler_pic, $1)
	compiler_flags=-v
	linker_flags=-v
	verstring=
	output_objdir=.
	libname=conftest
	lt_save_allow_undefined_flag=$_LT_TAGVAR(allow_undefined_flag, $1)
	_LT_TAGVAR(allow_undefined_flag, $1)=
	if AC_TRY_EVAL(_LT_TAGVAR(archive_cmds, $1) 2\>\&1 \\| $GREP \" -lc \" \>/dev/null 2\>\&1)
	then
	lt_cv_[]_LT_TAGVAR(archive_cmds_need_lc, $1)=no
	else
	lt_cv_[]_LT_TAGVAR(archive_cmds_need_lc, $1)=yes
	fi
	_LT_TAGVAR(allow_undefined_flag, $1)=$lt_save_allow_undefined_flag
	else
	cat conftest.err 1>&5
	fi
	$RM conftest*
	])
	_LT_TAGVAR(archive_cmds_need_lc, $1)=$lt_cv_[]_LT_TAGVAR(archive_cmds_need_lc, $1)
	;;
	esac
	fi
	;;
	esac

	_LT_TAGDECL([build_libtool_need_lc], [archive_cmds_need_lc], [0],
	[Whether or not to add -lc for building shared libraries])
	_LT_TAGDECL([allow_libtool_libs_with_static_runtimes],
	[enable_shared_with_static_runtimes], [0],
	[Whether or not to disallow shared libs when runtime libs are static])
	_LT_TAGDECL([], [export_dynamic_flag_spec], [1],
	[Compiler flag to allow reflexive dlopens])
	_LT_TAGDECL([], [whole_archive_flag_spec], [1],
	[Compiler flag to generate shared objects directly from archives])
	_LT_TAGDECL([], [compiler_needs_object], [1],
	[Whether the compiler copes with passing no objects directly])
	_LT_TAGDECL([], [old_archive_from_new_cmds], [2],
	[Create an old-style archive from a shared archive])
	_LT_TAGDECL([], [old_archive_from_expsyms_cmds], [2],
	[Create a temporary old-style archive to link instead of a shared archive])
	_LT_TAGDECL([], [archive_cmds], [2], [Commands used to build a shared archive])
	_LT_TAGDECL([], [archive_expsym_cmds], [2])
	_LT_TAGDECL([], [module_cmds], [2],
	[Commands used to build a loadable module if different from building
	a shared archive.])
	_LT_TAGDECL([], [module_expsym_cmds], [2])
	_LT_TAGDECL([], [with_gnu_ld], [1],
	[Whether we are building with GNU ld or not])
	_LT_TAGDECL([], [allow_undefined_flag], [1],
	[Flag that allows shared libraries with undefined symbols to be built])
	_LT_TAGDECL([], [no_undefined_flag], [1],
	[Flag that enforces no undefined symbols])
	_LT_TAGDECL([], [hardcode_libdir_flag_spec], [1],
	[Flag to hardcode $libdir into a binary during linking.
	This must work even if $libdir does not exist])
	_LT_TAGDECL([], [hardcode_libdir_separator], [1],
	[Whether we need a single "-rpath" flag with a separated argument])
	_LT_TAGDECL([], [hardcode_direct], [0],
	[Set to "yes" if using DIR/libNAME$shared_ext during linking hardcodes
	DIR into the resulting binary])
	_LT_TAGDECL([], [hardcode_direct_absolute], [0],
	[Set to "yes" if using DIR/libNAME$shared_ext during linking hardcodes
	DIR into the resulting binary and the resulting library dependency is
	"absolute", i.e impossible to change by setting $shlibpath_var if the
	library is relocated])
	_LT_TAGDECL([], [hardcode_minus_L], [0],
	[Set to "yes" if using the -LDIR flag during linking hardcodes DIR
	into the resulting binary])
	_LT_TAGDECL([], [hardcode_shlibpath_var], [0],
	[Set to "yes" if using SHLIBPATH_VAR=DIR during linking hardcodes DIR
	into the resulting binary])
	_LT_TAGDECL([], [hardcode_automatic], [0],
	[Set to "yes" if building a shared library automatically hardcodes DIR
	into the library and all subsequent libraries and executables linked
	against it])
	_LT_TAGDECL([], [inherit_rpath], [0],
	[Set to yes if linker adds runtime paths of dependent libraries
	to runtime path list])
	_LT_TAGDECL([], [link_all_deplibs], [0],
	[Whether libtool must link a program against all its dependency libraries])
	_LT_TAGDECL([], [always_export_symbols], [0],
	[Set to "yes" if exported symbols are required])
	_LT_TAGDECL([], [export_symbols_cmds], [2],
	[The commands to list exported symbols])
	_LT_TAGDECL([], [exclude_expsyms], [1],
	[Symbols that should not be listed in the preloaded symbols])
	_LT_TAGDECL([], [include_expsyms], [1],
	[Symbols that must always be exported])
	_LT_TAGDECL([], [prelink_cmds], [2],
	[Commands necessary for linking programs (against libraries) with templates])
	_LT_TAGDECL([], [postlink_cmds], [2],
	[Commands necessary for finishing linking programs])
	_LT_TAGDECL([], [file_list_spec], [1],
	[Specify filename containing input files])
	dnl FIXME: Not yet implemented
	dnl _LT_TAGDECL([], [thread_safe_flag_spec], [1],
	dnl [Compiler flag to generate thread safe objects])
	])# _LT_LINKER_SHLIBS


	# _LT_LANG_C_CONFIG([TAG])
	# ------------------------
	# Ensure that the configuration variables for a C compiler are suitably
	# defined. These variables are subsequently used by _LT_CONFIG to write
	# the compiler configuration to 'libtool'.
	m4_defun([_LT_LANG_C_CONFIG],
	[m4_require([_LT_DECL_EGREP])dnl
	lt_save_CC=$CC
	AC_LANG_PUSH(C)

	# Source file extension for C test sources.
	ac_ext=c

	# Object file extension for compiled C test sources.
	objext=o
	_LT_TAGVAR(objext, $1)=$objext

	# Code to be used in simple compile tests
	lt_simple_compile_test_code="int some_variable = 0;"

	# Code to be used in simple link tests
	lt_simple_link_test_code='int main(){return(0);}'

	_LT_TAG_COMPILER
	# Save the default compiler, since it gets overwritten when the other
	# tags are being tested, and _LT_TAGVAR(compiler, []) is a NOP.
	compiler_DEFAULT=$CC

	# save warnings/boilerplate of simple test code
	_LT_COMPILER_BOILERPLATE
	_LT_LINKER_BOILERPLATE

	if test -n "$compiler"; then
	_LT_COMPILER_NO_RTTI($1)
	_LT_COMPILER_PIC($1)
	_LT_COMPILER_C_O($1)
	_LT_COMPILER_FILE_LOCKS($1)
	_LT_LINKER_SHLIBS($1)
	_LT_SYS_DYNAMIC_LINKER($1)
	_LT_LINKER_HARDCODE_LIBPATH($1)
	LT_SYS_DLOPEN_SELF
	_LT_CMD_STRIPLIB

	# Report what library types will actually be built
	AC_MSG_CHECKING([if libtool supports shared libraries])
	AC_MSG_RESULT([$can_build_shared])

	AC_MSG_CHECKING([whether to build shared libraries])
	test no = "$can_build_shared" && enable_shared=no

	# On AIX, shared libraries and static libraries use the same namespace, and
	# are all built from PIC.
	case $host_os in
	aix3*)
	test yes = "$enable_shared" && enable_static=no
	if test -n "$RANLIB"; then
	archive_cmds="$archive_cmds~\$RANLIB \$lib"
	postinstall_cmds='$RANLIB $lib'
	fi
	;;

	aix[[4-9]]*)
	if test ia64 != "$host_cpu"; then
	case $enable_shared,$with_aix_soname,$aix_use_runtimelinking in
	yes,aix,yes) ;; # shared object as lib.so file only
	yes,svr4,*) ;; # shared object as lib.so archive member only
	yes,*) enable_static=no ;; # shared object in lib.a archive as well
	esac
	fi
	;;
	esac
	AC_MSG_RESULT([$enable_shared])

	AC_MSG_CHECKING([whether to build static libraries])
	# Make sure either enable_shared or enable_static is yes.
	test yes = "$enable_shared" \|\| enable_static=yes
	AC_MSG_RESULT([$enable_static])

	_LT_CONFIG($1)
	fi
	AC_LANG_POP
	CC=$lt_save_CC
	])# _LT_LANG_C_CONFIG


	# _LT_LANG_CXX_CONFIG([TAG])
	# --------------------------
	# Ensure that the configuration variables for a C++ compiler are suitably
	# defined. These variables are subsequently used by _LT_CONFIG to write
	# the compiler configuration to 'libtool'.
	m4_defun([_LT_LANG_CXX_CONFIG],
	[m4_require([_LT_FILEUTILS_DEFAULTS])dnl
	m4_require([_LT_DECL_EGREP])dnl
	m4_require([_LT_PATH_MANIFEST_TOOL])dnl
	if test -n "$CXX" && ( test no != "$CXX" &&
	( (test g++ = "$CXX" && `g++ -v >/dev/null 2>&1` ) \|\|
	(test g++ != "$CXX"))); then
	AC_PROG_CXXCPP
	else
	_lt_caught_CXX_error=yes
	fi

	AC_LANG_PUSH(C++)
	_LT_TAGVAR(archive_cmds_need_lc, $1)=no
	_LT_TAGVAR(allow_undefined_flag, $1)=
	_LT_TAGVAR(always_export_symbols, $1)=no
	_LT_TAGVAR(archive_expsym_cmds, $1)=
	_LT_TAGVAR(compiler_needs_object, $1)=no
	_LT_TAGVAR(export_dynamic_flag_spec, $1)=
	_LT_TAGVAR(hardcode_direct, $1)=no
	_LT_TAGVAR(hardcode_direct_absolute, $1)=no
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=
	_LT_TAGVAR(hardcode_libdir_separator, $1)=
	_LT_TAGVAR(hardcode_minus_L, $1)=no
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=unsupported
	_LT_TAGVAR(hardcode_automatic, $1)=no
	_LT_TAGVAR(inherit_rpath, $1)=no
	_LT_TAGVAR(module_cmds, $1)=
	_LT_TAGVAR(module_expsym_cmds, $1)=
	_LT_TAGVAR(link_all_deplibs, $1)=unknown
	_LT_TAGVAR(old_archive_cmds, $1)=$old_archive_cmds
	_LT_TAGVAR(reload_flag, $1)=$reload_flag
	_LT_TAGVAR(reload_cmds, $1)=$reload_cmds
	_LT_TAGVAR(no_undefined_flag, $1)=
	_LT_TAGVAR(whole_archive_flag_spec, $1)=
	_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=no

	# Source file extension for C++ test sources.
	ac_ext=cpp

	# Object file extension for compiled C++ test sources.
	objext=o
	_LT_TAGVAR(objext, $1)=$objext

	# No sense in running all these tests if we already determined that
	# the CXX compiler isn't working. Some variables (like enable_shared)
	# are currently assumed to apply to all compilers on this platform,
	# and will be corrupted by setting them based on a non-working compiler.
	if test yes != "$_lt_caught_CXX_error"; then
	# Code to be used in simple compile tests
	lt_simple_compile_test_code="int some_variable = 0;"

	# Code to be used in simple link tests
	lt_simple_link_test_code='int main(int, char *[[]]) { return(0); }'

	# ltmain only uses $CC for tagged configurations so make sure $CC is set.
	_LT_TAG_COMPILER

	# save warnings/boilerplate of simple test code
	_LT_COMPILER_BOILERPLATE
	_LT_LINKER_BOILERPLATE

	# Allow CC to be a program name with arguments.
	lt_save_CC=$CC
	lt_save_CFLAGS=$CFLAGS
	lt_save_LD=$LD
	lt_save_GCC=$GCC
	GCC=$GXX
	lt_save_with_gnu_ld=$with_gnu_ld
	lt_save_path_LD=$lt_cv_path_LD
	if test -n "${lt_cv_prog_gnu_ldcxx+set}"; then
	lt_cv_prog_gnu_ld=$lt_cv_prog_gnu_ldcxx
	else
	$as_unset lt_cv_prog_gnu_ld
	fi
	if test -n "${lt_cv_path_LDCXX+set}"; then
	lt_cv_path_LD=$lt_cv_path_LDCXX
	else
	$as_unset lt_cv_path_LD
	fi
	test -z "${LDCXX+set}" \|\| LD=$LDCXX
	CC=${CXX-"c++"}
	CFLAGS=$CXXFLAGS
	compiler=$CC
	_LT_TAGVAR(compiler, $1)=$CC
	_LT_CC_BASENAME([$compiler])

	if test -n "$compiler"; then
	# We don't want -fno-exception when compiling C++ code, so set the
	# no_builtin_flag separately
	if test yes = "$GXX"; then
	_LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)=' -fno-builtin'
	else
	_LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)=
	fi

	if test yes = "$GXX"; then
	# Set up default GNU C++ configuration

	LT_PATH_LD

	# Check if GNU C++ uses GNU ld as the underlying linker, since the
	# archiving commands below assume that GNU ld is being used.
	if test yes = "$with_gnu_ld"; then
	_LT_TAGVAR(archive_cmds, $1)='$CC $pic_flag -shared -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC $pic_flag -shared -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib'

	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir'
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic'

	# If archive_cmds runs LD, not CC, wlarc should be empty
	# XXX I think wlarc can be eliminated in ltcf-cxx, but I need to
	# investigate it a little bit more. (MM)
	wlarc='$wl'

	# ancient GNU ld didn't support --whole-archive et. al.
	if eval "`$CC -print-prog-name=ld` --help 2>&1" \|
	$GREP 'no-whole-archive' > /dev/null; then
	_LT_TAGVAR(whole_archive_flag_spec, $1)=$wlarc'--whole-archive$convenience '$wlarc'--no-whole-archive'
	else
	_LT_TAGVAR(whole_archive_flag_spec, $1)=
	fi
	else
	with_gnu_ld=no
	wlarc=

	# A generic and very simple default shared library creation
	# command for GNU C++ for the case where it uses the native
	# linker, instead of GNU ld. If possible, this setting should
	# overridden to take advantage of the native linker features on
	# the platform it is being used on.
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -o $lib'
	fi

	# Commands to make compiler produce verbose output that lists
	# what "hidden" libraries, object files and flags are used when
	# linking a shared library.
	output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 \| $GREP -v "^Configured with:" \| $GREP "\-L"'

	else
	GXX=no
	with_gnu_ld=no
	wlarc=
	fi

	# PORTME: fill in a description of your system's C++ link characteristics
	AC_MSG_CHECKING([whether the $compiler linker ($LD) supports shared libraries])
	_LT_TAGVAR(ld_shlibs, $1)=yes
	case $host_os in
	aix3*)
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	aix[[4-9]]*)
	if test ia64 = "$host_cpu"; then
	# On IA64, the linker does run time linking by default, so we don't
	# have to do anything special.
	aix_use_runtimelinking=no
	exp_sym_flag='-Bexport'
	no_entry_flag=
	else
	aix_use_runtimelinking=no

	# Test if we are trying to use run time linking or normal
	# AIX style linking. If -brtl is somewhere in LDFLAGS, we
	# have runtime linking enabled, and use it for executables.
	# For shared libraries, we enable/disable runtime linking
	# depending on the kind of the shared library created -
	# when "with_aix_soname,aix_use_runtimelinking" is:
	# "aix,no" lib.a(lib.so.V) shared, rtl:no, for executables
	# "aix,yes" lib.so shared, rtl:yes, for executables
	# lib.a static archive
	# "both,no" lib.so.V(shr.o) shared, rtl:yes
	# lib.a(lib.so.V) shared, rtl:no, for executables
	# "both,yes" lib.so.V(shr.o) shared, rtl:yes, for executables
	# lib.a(lib.so.V) shared, rtl:no
	# "svr4,*" lib.so.V(shr.o) shared, rtl:yes, for executables
	# lib.a static archive
	case $host_os in aix4.[[23]]\|aix4.[[23]].\|aix[[5-9]])
	for ld_flag in $LDFLAGS; do
	case $ld_flag in
	-brtl)
	aix_use_runtimelinking=yes
	break
	;;
	esac
	done
	if test svr4,no = "$with_aix_soname,$aix_use_runtimelinking"; then
	# With aix-soname=svr4, we create the lib.so.V shared archives only,
	# so we don't have lib.a shared libs to link our executables.
	# We have to force runtime linking in this case.
	aix_use_runtimelinking=yes
	LDFLAGS="$LDFLAGS -Wl,-brtl"
	fi
	;;
	esac

	exp_sym_flag='-bexport'
	no_entry_flag='-bnoentry'
	fi

	# When large executables or shared objects are built, AIX ld can
	# have problems creating the table of contents. If linking a library
	# or program results in "error TOC overflow" add -mminimal-toc to
	# CXXFLAGS/CFLAGS for g++/gcc. In the cases where that is not
	# enough to fix the problem, add -Wl,-bbigtoc to LDFLAGS.

	_LT_TAGVAR(archive_cmds, $1)=''
	_LT_TAGVAR(hardcode_direct, $1)=yes
	_LT_TAGVAR(hardcode_direct_absolute, $1)=yes
	_LT_TAGVAR(hardcode_libdir_separator, $1)=':'
	_LT_TAGVAR(link_all_deplibs, $1)=yes
	_LT_TAGVAR(file_list_spec, $1)='$wl-f,'
	case $with_aix_soname,$aix_use_runtimelinking in
	aix,*) ;; # no import file
	svr4,* \| *,yes) # use import file
	# The Import File defines what to hardcode.
	_LT_TAGVAR(hardcode_direct, $1)=no
	_LT_TAGVAR(hardcode_direct_absolute, $1)=no
	;;
	esac

	if test yes = "$GXX"; then
	case $host_os in aix4.[[012]]\|aix4.[[012]].*)
	# We only want to do this on AIX 4.2 and lower, the check
	# below for broken collect2 doesn't work under 4.3+
	collect2name=`$CC -print-prog-name=collect2`
	if test -f "$collect2name" &&
	strings "$collect2name" \| $GREP resolve_lib_name >/dev/null
	then
	# We have reworked collect2
	:
	else
	# We have old collect2
	_LT_TAGVAR(hardcode_direct, $1)=unsupported
	# It fails to find uninstalled libraries when the uninstalled
	# path is not listed in the libpath. Setting hardcode_minus_L
	# to unsupported forces relinking
	_LT_TAGVAR(hardcode_minus_L, $1)=yes
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=
	fi
	esac
	shared_flag='-shared'
	if test yes = "$aix_use_runtimelinking"; then
	shared_flag=$shared_flag' $wl-G'
	fi
	# Need to ensure runtime linking is disabled for the traditional
	# shared library, or the linker may eventually find shared libraries
	# /with/ Import File - we do not want to mix them.
	shared_flag_aix='-shared'
	shared_flag_svr4='-shared $wl-G'
	else
	# not using gcc
	if test ia64 = "$host_cpu"; then
	# VisualAge C++, Version 5.5 for AIX 5L for IA-64, Beta 3 Release
	# chokes on -Wl,-G. The following line is correct:
	shared_flag='-G'
	else
	if test yes = "$aix_use_runtimelinking"; then
	shared_flag='$wl-G'
	else
	shared_flag='$wl-bM:SRE'
	fi
	shared_flag_aix='$wl-bM:SRE'
	shared_flag_svr4='$wl-G'
	fi
	fi

	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-bexpall'
	# It seems that -bexpall does not export symbols beginning with
	# underscore (_), so it is better to generate a list of symbols to
	# export.
	_LT_TAGVAR(always_export_symbols, $1)=yes
	if test aix,yes = "$with_aix_soname,$aix_use_runtimelinking"; then
	# Warning - without using the other runtime loading flags (-brtl),
	# -berok will link without error, but may produce a broken library.
	# The "-G" linker flag allows undefined symbols.
	_LT_TAGVAR(no_undefined_flag, $1)='-bernotok'
	# Determine the default libpath from the value encoded in an empty
	# executable.
	_LT_SYS_MODULE_PATH_AIX([$1])
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-blibpath:$libdir:'"$aix_libpath"

	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -o $output_objdir/$soname $libobjs $deplibs $wl'$no_entry_flag' $compiler_flags `if test -n "$allow_undefined_flag"; then func_echo_all "$wl$allow_undefined_flag"; else :; fi` $wl'$exp_sym_flag:\$export_symbols' '$shared_flag
	else
	if test ia64 = "$host_cpu"; then
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R $libdir:/usr/lib:/lib'
	_LT_TAGVAR(allow_undefined_flag, $1)="-z nodefs"
	_LT_TAGVAR(archive_expsym_cmds, $1)="\$CC $shared_flag"' -o $output_objdir/$soname $libobjs $deplibs '"\$wl$no_entry_flag"' $compiler_flags $wl$allow_undefined_flag '"\$wl$exp_sym_flag:\$export_symbols"
	else
	# Determine the default libpath from the value encoded in an
	# empty executable.
	_LT_SYS_MODULE_PATH_AIX([$1])
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-blibpath:$libdir:'"$aix_libpath"
	# Warning - without using the other run time loading flags,
	# -berok will link without error, but may produce a broken library.
	_LT_TAGVAR(no_undefined_flag, $1)=' $wl-bernotok'
	_LT_TAGVAR(allow_undefined_flag, $1)=' $wl-berok'
	if test yes = "$with_gnu_ld"; then
	# We only use this code for GNU lds that support --whole-archive.
	_LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive$convenience $wl--no-whole-archive'
	else
	# Exported symbols can be pulled into shared objects from archives
	_LT_TAGVAR(whole_archive_flag_spec, $1)='$convenience'
	fi
	_LT_TAGVAR(archive_cmds_need_lc, $1)=yes
	_LT_TAGVAR(archive_expsym_cmds, $1)='$RM -r $output_objdir/$realname.d~$MKDIR $output_objdir/$realname.d'
	# -brtl affects multiple linker settings, -berok does not and is overridden later
	compiler_flags_filtered='`func_echo_all "$compiler_flags " \| $SED -e "s%-brtl\$[[, ]]\$%-berok\\1%g"`'
	if test svr4 != "$with_aix_soname"; then
	# This is similar to how AIX traditionally builds its shared
	# libraries. Need -bnortl late, we may have -brtl in LDFLAGS.
	_LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$CC '$shared_flag_aix' -o $output_objdir/$realname.d/$soname $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$AR $AR_FLAGS $output_objdir/$libname$release.a $output_objdir/$realname.d/$soname'
	fi
	if test aix != "$with_aix_soname"; then
	_LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$CC '$shared_flag_svr4' -o $output_objdir/$realname.d/$shared_archive_member_spec.o $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$STRIP -e $output_objdir/$realname.d/$shared_archive_member_spec.o~( func_echo_all "#! $soname($shared_archive_member_spec.o)"; if test shr_64 = "$shared_archive_member_spec"; then func_echo_all "# 64"; else func_echo_all "# 32"; fi; cat $export_symbols ) > $output_objdir/$realname.d/$shared_archive_member_spec.imp~$AR $AR_FLAGS $output_objdir/$soname $output_objdir/$realname.d/$shared_archive_member_spec.o $output_objdir/$realname.d/$shared_archive_member_spec.imp'
	else
	# used by -dlpreopen to get the symbols
	_LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$MV $output_objdir/$realname.d/$soname $output_objdir'
	fi
	_LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$RM -r $output_objdir/$realname.d'
	fi
	fi
	;;

	beos*)
	if $LD --help 2>&1 \| $GREP ': supported targets:.* elf' > /dev/null; then
	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
	# Joseph Beckenbach <jrb3@best.com> says some releases of gcc
	# support --undefined. This deserves some investigation. FIXME
	_LT_TAGVAR(archive_cmds, $1)='$CC -nostart $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	else
	_LT_TAGVAR(ld_shlibs, $1)=no
	fi
	;;

	chorus*)
	case $cc_basename in
	*)
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	esac
	;;

	cygwin* \| mingw* \| pw32* \| cegcc*)
	case $GXX,$cc_basename in
	,cl* \| no,cl*)
	# Native MSVC
	# hardcode_libdir_flag_spec is actually meaningless, as there is
	# no search path for DLLs.
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
	_LT_TAGVAR(always_export_symbols, $1)=yes
	_LT_TAGVAR(file_list_spec, $1)='@'
	# Tell ltmain to make .lib files, not .a files.
	libext=lib
	# Tell ltmain to make .dll files, not .so files.
	shrext_cmds=.dll
	# FIXME: Setting linknames here is a bad hack.
	_LT_TAGVAR(archive_cmds, $1)='$CC -o $output_objdir/$soname $libobjs $compiler_flags $deplibs -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~linknames='
	_LT_TAGVAR(archive_expsym_cmds, $1)='if _LT_DLL_DEF_P([$export_symbols]); then
	cp "$export_symbols" "$output_objdir/$soname.def";
	echo "$tool_output_objdir$soname.def" > "$output_objdir/$soname.exp";
	else
	$SED -e '\''s/^/-link -EXPORT:/'\'' < $export_symbols > $output_objdir/$soname.exp;
	fi~
	$CC -o $tool_output_objdir$soname $libobjs $compiler_flags $deplibs "@$tool_output_objdir$soname.exp" -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~
	linknames='
	# The linker will not automatically build a static lib if we build a DLL.
	# _LT_TAGVAR(old_archive_from_new_cmds, $1)='true'
	_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
	# Don't use ranlib
	_LT_TAGVAR(old_postinstall_cmds, $1)='chmod 644 $oldlib'
	_LT_TAGVAR(postlink_cmds, $1)='lt_outputfile="@OUTPUT@"~
	lt_tool_outputfile="@TOOL_OUTPUT@"~
	case $lt_outputfile in
	.exe\|.EXE) ;;
	*)
	lt_outputfile=$lt_outputfile.exe
	lt_tool_outputfile=$lt_tool_outputfile.exe
	;;
	esac~
	func_to_tool_file "$lt_outputfile"~
	if test : != "$MANIFEST_TOOL" && test -f "$lt_outputfile.manifest"; then
	$MANIFEST_TOOL -manifest "$lt_tool_outputfile.manifest" -outputresource:"$lt_tool_outputfile" \|\| exit 1;
	$RM "$lt_outputfile.manifest";
	fi'
	;;
	*)
	# g++
	# _LT_TAGVAR(hardcode_libdir_flag_spec, $1) is actually meaningless,
	# as there is no search path for DLLs.
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir'
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-all-symbols'
	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
	_LT_TAGVAR(always_export_symbols, $1)=no
	_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes

	if $LD --help 2>&1 \| $GREP 'auto-import' > /dev/null; then
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib'
	# If the export-symbols file already is a .def file, use it as
	# is; otherwise, prepend EXPORTS...
	_LT_TAGVAR(archive_expsym_cmds, $1)='if _LT_DLL_DEF_P([$export_symbols]); then
	cp $export_symbols $output_objdir/$soname.def;
	else
	echo EXPORTS > $output_objdir/$soname.def;
	cat $export_symbols >> $output_objdir/$soname.def;
	fi~
	$CC -shared -nostdlib $output_objdir/$soname.def $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib'
	else
	_LT_TAGVAR(ld_shlibs, $1)=no
	fi
	;;
	esac
	;;
	darwin* \| rhapsody*)
	_LT_DARWIN_LINKER_FEATURES($1)
	;;

	os2*)
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir'
	_LT_TAGVAR(hardcode_minus_L, $1)=yes
	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
	shrext_cmds=.dll
	_LT_TAGVAR(archive_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~
	$ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~
	$ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~
	$ECHO EXPORTS >> $output_objdir/$libname.def~
	emxexp $libobjs \| $SED /"_DLL_InitTerm"/d >> $output_objdir/$libname.def~
	$CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~
	emximp -o $lib $output_objdir/$libname.def'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~
	$ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~
	$ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~
	$ECHO EXPORTS >> $output_objdir/$libname.def~
	prefix_cmds="$SED"~
	if test EXPORTS = "`$SED 1q $export_symbols`"; then
	prefix_cmds="$prefix_cmds -e 1d";
	fi~
	prefix_cmds="$prefix_cmds -e \"s/^$.*$$/_\1/g\""~
	cat $export_symbols \| $prefix_cmds >> $output_objdir/$libname.def~
	$CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~
	emximp -o $lib $output_objdir/$libname.def'
	_LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
	_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
	;;

	dgux*)
	case $cc_basename in
	ec++*)
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	ghcx*)
	# Green Hills C++ Compiler
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	*)
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	esac
	;;

	freebsd2.*)
	# C++ shared libraries reported to be fairly broken before
	# switch to ELF
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;

	freebsd-elf*)
	_LT_TAGVAR(archive_cmds_need_lc, $1)=no
	;;

	freebsd* \| dragonfly*)
	# FreeBSD 3 and later use GNU C++ and GNU ld with standard ELF
	# conventions
	_LT_TAGVAR(ld_shlibs, $1)=yes
	;;

	haiku*)
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	_LT_TAGVAR(link_all_deplibs, $1)=yes
	;;

	hpux9*)
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl+b $wl$libdir'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=:
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E'
	_LT_TAGVAR(hardcode_direct, $1)=yes
	_LT_TAGVAR(hardcode_minus_L, $1)=yes # Not in the search PATH,
	# but as the default
	# location of the library.

	case $cc_basename in
	CC*)
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	aCC*)
	_LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/$soname~$CC -b $wl+b $wl$install_libdir -o $output_objdir/$soname $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~test "x$output_objdir/$soname" = "x$lib" \|\| mv $output_objdir/$soname $lib'
	# Commands to make compiler produce verbose output that lists
	# what "hidden" libraries, object files and flags are used when
	# linking a shared library.
	#
	# There doesn't appear to be a way to prevent this compiler from
	# explicitly linking system object files so we need to strip them
	# from the output so that they don't get included in the library
	# dependencies.
	output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) \| $EGREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; .$objext);; ) list="$list $z";;esac; done; func_echo_all "$list"'
	;;
	*)
	if test yes = "$GXX"; then
	_LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/$soname~$CC -shared -nostdlib $pic_flag $wl+b $wl$install_libdir -o $output_objdir/$soname $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~test "x$output_objdir/$soname" = "x$lib" \|\| mv $output_objdir/$soname $lib'
	else
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	fi
	;;
	esac
	;;

	hpux10\|hpux11)
	if test no = "$with_gnu_ld"; then
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl+b $wl$libdir'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=:

	case $host_cpu in
	hppa64\|ia64*)
	;;
	*)
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E'
	;;
	esac
	fi
	case $host_cpu in
	hppa64\|ia64*)
	_LT_TAGVAR(hardcode_direct, $1)=no
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	;;
	*)
	_LT_TAGVAR(hardcode_direct, $1)=yes
	_LT_TAGVAR(hardcode_direct_absolute, $1)=yes
	_LT_TAGVAR(hardcode_minus_L, $1)=yes # Not in the search PATH,
	# but as the default
	# location of the library.
	;;
	esac

	case $cc_basename in
	CC*)
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	aCC*)
	case $host_cpu in
	hppa64)
	_LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
	;;
	ia64*)
	_LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname $wl+nodefaultrpath -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
	;;
	*)
	_LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
	;;
	esac
	# Commands to make compiler produce verbose output that lists
	# what "hidden" libraries, object files and flags are used when
	# linking a shared library.
	#
	# There doesn't appear to be a way to prevent this compiler from
	# explicitly linking system object files so we need to strip them
	# from the output so that they don't get included in the library
	# dependencies.
	output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) \| $GREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; .$objext);; ) list="$list $z";;esac; done; func_echo_all "$list"'
	;;
	*)
	if test yes = "$GXX"; then
	if test no = "$with_gnu_ld"; then
	case $host_cpu in
	hppa64)
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib -fPIC $wl+h $wl$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
	;;
	ia64*)
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib $pic_flag $wl+h $wl$soname $wl+nodefaultrpath -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
	;;
	*)
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib $pic_flag $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
	;;
	esac
	fi
	else
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	fi
	;;
	esac
	;;

	interix[[3-9]]*)
	_LT_TAGVAR(hardcode_direct, $1)=no
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir'
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E'
	# Hack: On Interix 3.x, we cannot compile PIC because of a broken gcc.
	# Instead, shared libraries are loaded at an image base (0x10000000 by
	# default) and relocated if they conflict, which is a slow very memory
	# consuming and fragmenting process. To avoid this, we pick a random,
	# 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link
	# time. Moving up from 0x10000000 also allows more sbrk(2) space.
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='sed "s\|^\|_\|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
	;;
	irix5* \| irix6*)
	case $cc_basename in
	CC*)
	# SGI C++
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared -all -multigot $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'

	# Archives containing C++ object files must be created using
	# "CC -ar", where "CC" is the IRIX C++ compiler. This is
	# necessary to make sure instantiated templates are included
	# in the archive.
	_LT_TAGVAR(old_archive_cmds, $1)='$CC -ar -WR,-u -o $oldlib $oldobjs'
	;;
	*)
	if test yes = "$GXX"; then
	if test no = "$with_gnu_ld"; then
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib'
	else
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` -o $lib'
	fi
	fi
	_LT_TAGVAR(link_all_deplibs, $1)=yes
	;;
	esac
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=:
	_LT_TAGVAR(inherit_rpath, $1)=yes
	;;

	linux* \| kbsd-gnu \| kopensolaris-gnu \| gnu)
	case $cc_basename in
	KCC*)
	# Kuck and Associates, Inc. (KAI) C++ Compiler

	# KCC will only create a shared library if the output file
	# ends with ".so" (or ".sl" for HP-UX), so rename the library
	# to its proper name (with version) after linking.
	_LT_TAGVAR(archive_cmds, $1)='tempext=`echo $shared_ext \| $SED -e '\''s/$[[^()0-9A-Za-z{}]]$/\\\\\1/g'\''`; templib=`echo $lib \| $SED -e "s/\$tempext\..*/.so/"`; $CC $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags --soname $soname -o \$templib; mv \$templib $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='tempext=`echo $shared_ext \| $SED -e '\''s/$[[^()0-9A-Za-z{}]]$/\\\\\1/g'\''`; templib=`echo $lib \| $SED -e "s/\$tempext\..*/.so/"`; $CC $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags --soname $soname -o \$templib $wl-retain-symbols-file,$export_symbols; mv \$templib $lib'
	# Commands to make compiler produce verbose output that lists
	# what "hidden" libraries, object files and flags are used when
	# linking a shared library.
	#
	# There doesn't appear to be a way to prevent this compiler from
	# explicitly linking system object files so we need to strip them
	# from the output so that they don't get included in the library
	# dependencies.
	output_verbose_link_cmd='templist=`$CC $CFLAGS -v conftest.$objext -o libconftest$shared_ext 2>&1 \| $GREP "ld"`; rm -f libconftest$shared_ext; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; .$objext);; ) list="$list $z";;esac; done; func_echo_all "$list"'

	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir'
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic'

	# Archives containing C++ object files must be created using
	# "CC -Bstatic", where "CC" is the KAI C++ compiler.
	_LT_TAGVAR(old_archive_cmds, $1)='$CC -Bstatic -o $oldlib $oldobjs'
	;;
	icpc* \| ecpc* )
	# Intel C++
	with_gnu_ld=yes
	# version 8.0 and above of icpc choke on multiply defined symbols
	# if we add $predep_objects and $postdep_objects, however 7.1 and
	# earlier do not add the objects themselves.
	case `$CC -V 2>&1` in
	"Version 7.")
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib'
	;;
	*) # Version 8.0 or newer
	tmp_idyn=
	case $host_cpu in
	ia64*) tmp_idyn=' -i_dynamic';;
	esac
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared'"$tmp_idyn"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared'"$tmp_idyn"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib'
	;;
	esac
	_LT_TAGVAR(archive_cmds_need_lc, $1)=no
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir'
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic'
	_LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive$convenience $wl--no-whole-archive'
	;;
	pgCC* \| pgcpp*)
	# Portland Group C++ compiler
	case `$CC -V` in
	pgCC\ [[1-5]]. \| pgcpp\ [[1-5]].)
	_LT_TAGVAR(prelink_cmds, $1)='tpldir=Template.dir~
	rm -rf $tpldir~
	$CC --prelink_objects --instantiation_dir $tpldir $objs $libobjs $compile_deplibs~
	compile_command="$compile_command `find $tpldir -name \*.o \| sort \| $NL2SP`"'
	_LT_TAGVAR(old_archive_cmds, $1)='tpldir=Template.dir~
	rm -rf $tpldir~
	$CC --prelink_objects --instantiation_dir $tpldir $oldobjs$old_deplibs~
	$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o \| sort \| $NL2SP`~
	$RANLIB $oldlib'
	_LT_TAGVAR(archive_cmds, $1)='tpldir=Template.dir~
	rm -rf $tpldir~
	$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
	$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o \| sort \| $NL2SP` $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='tpldir=Template.dir~
	rm -rf $tpldir~
	$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
	$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o \| sort \| $NL2SP` $postdep_objects $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib'
	;;
	*) # Version 6 and above use weak symbols
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib'
	;;
	esac

	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl--rpath $wl$libdir'
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic'
	_LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive'
	;;
	cxx*)
	# Compaq C++
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib $wl-retain-symbols-file $wl$export_symbols'

	runpath_var=LD_RUN_PATH
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-rpath $libdir'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=:

	# Commands to make compiler produce verbose output that lists
	# what "hidden" libraries, object files and flags are used when
	# linking a shared library.
	#
	# There doesn't appear to be a way to prevent this compiler from
	# explicitly linking system object files so we need to strip them
	# from the output so that they don't get included in the library
	# dependencies.
	output_verbose_link_cmd='templist=`$CC -shared $CFLAGS -v conftest.$objext 2>&1 \| $GREP "ld"`; templist=`func_echo_all "$templist" \| $SED "s/$^.ld.$$ .ld .$$/\1/"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; .$objext);; ) list="$list $z";;esac; done; func_echo_all "X$list" \| $Xsed'
	;;
	xl* \| mpixl* \| bgxl*)
	# IBM XL 8.0 on PPC, with GNU ld
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir'
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic'
	_LT_TAGVAR(archive_cmds, $1)='$CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	if test yes = "$supports_anon_versioning"; then
	_LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
	cat $export_symbols \| sed -e "s/$.*$/\1;/" >> $output_objdir/$libname.ver~
	echo "local: *; };" >> $output_objdir/$libname.ver~
	$CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib'
	fi
	;;
	*)
	case `$CC -V 2>&1 \| sed 5q` in
	Sun\ C)
	# Sun C++ 5.9
	_LT_TAGVAR(no_undefined_flag, $1)=' -zdefs'
	_LT_TAGVAR(archive_cmds, $1)='$CC -G$allow_undefined_flag -h$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -G$allow_undefined_flag -h$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-retain-symbols-file $wl$export_symbols'
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir'
	_LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`new_convenience=; for conv in $convenience\"\"; do test -z \"$conv\" \|\| new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive'
	_LT_TAGVAR(compiler_needs_object, $1)=yes

	# Not sure whether something based on
	# $CC $CFLAGS -v conftest.$objext -o libconftest$shared_ext 2>&1
	# would be better.
	output_verbose_link_cmd='func_echo_all'

	# Archives containing C++ object files must be created using
	# "CC -xar", where "CC" is the Sun C++ compiler. This is
	# necessary to make sure instantiated templates are included
	# in the archive.
	_LT_TAGVAR(old_archive_cmds, $1)='$CC -xar -o $oldlib $oldobjs'
	;;
	esac
	;;
	esac
	;;

	lynxos*)
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;

	m88k*)
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;

	mvs*)
	case $cc_basename in
	cxx*)
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	*)
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	esac
	;;

	netbsd*)
	if echo __ELF__ \| $CC -E - \| $GREP __ELF__ >/dev/null; then
	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $predep_objects $libobjs $deplibs $postdep_objects $linker_flags'
	wlarc=
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir'
	_LT_TAGVAR(hardcode_direct, $1)=yes
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	fi
	# Workaround some broken pre-1.5 toolchains
	output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 \| $GREP conftest.$objext \| $SED -e "s:-lgcc -lc -lgcc::"'
	;;

	nto \| qnx)
	_LT_TAGVAR(ld_shlibs, $1)=yes
	;;

	openbsd* \| bitrig*)
	if test -f /usr/libexec/ld.so; then
	_LT_TAGVAR(hardcode_direct, $1)=yes
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	_LT_TAGVAR(hardcode_direct_absolute, $1)=yes
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -o $lib'
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir'
	if test -z "`echo __ELF__ \| $CC -E - \| grep __ELF__`"; then
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-retain-symbols-file,$export_symbols -o $lib'
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E'
	_LT_TAGVAR(whole_archive_flag_spec, $1)=$wlarc'--whole-archive$convenience '$wlarc'--no-whole-archive'
	fi
	output_verbose_link_cmd=func_echo_all
	else
	_LT_TAGVAR(ld_shlibs, $1)=no
	fi
	;;

	osf3* \| osf4* \| osf5*)
	case $cc_basename in
	KCC*)
	# Kuck and Associates, Inc. (KAI) C++ Compiler

	# KCC will only create a shared library if the output file
	# ends with ".so" (or ".sl" for HP-UX), so rename the library
	# to its proper name (with version) after linking.
	_LT_TAGVAR(archive_cmds, $1)='tempext=`echo $shared_ext \| $SED -e '\''s/$[[^()0-9A-Za-z{}]]$/\\\\\1/g'\''`; templib=`echo "$lib" \| $SED -e "s/\$tempext\..*/.so/"`; $CC $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags --soname $soname -o \$templib; mv \$templib $lib'

	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=:

	# Archives containing C++ object files must be created using
	# the KAI C++ compiler.
	case $host in
	osf3*) _LT_TAGVAR(old_archive_cmds, $1)='$CC -Bstatic -o $oldlib $oldobjs' ;;
	*) _LT_TAGVAR(old_archive_cmds, $1)='$CC -o $oldlib $oldobjs' ;;
	esac
	;;
	RCC*)
	# Rational C++ 2.4.1
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	cxx*)
	case $host in
	osf3*)
	_LT_TAGVAR(allow_undefined_flag, $1)=' $wl-expect_unresolved $wl\*'
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $soname `test -n "$verstring" && func_echo_all "$wl-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir'
	;;
	*)
	_LT_TAGVAR(allow_undefined_flag, $1)=' -expect_unresolved \*'
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -msym -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='for i in `cat $export_symbols`; do printf "%s %s\\n" -exported_symbol "\$i" >> $lib.exp; done~
	echo "-hidden">> $lib.exp~
	$CC -shared$allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -msym -soname $soname $wl-input $wl$lib.exp `test -n "$verstring" && $ECHO "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib~
	$RM $lib.exp'
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-rpath $libdir'
	;;
	esac

	_LT_TAGVAR(hardcode_libdir_separator, $1)=:

	# Commands to make compiler produce verbose output that lists
	# what "hidden" libraries, object files and flags are used when
	# linking a shared library.
	#
	# There doesn't appear to be a way to prevent this compiler from
	# explicitly linking system object files so we need to strip them
	# from the output so that they don't get included in the library
	# dependencies.
	output_verbose_link_cmd='templist=`$CC -shared $CFLAGS -v conftest.$objext 2>&1 \| $GREP "ld" \| $GREP -v "ld:"`; templist=`func_echo_all "$templist" \| $SED "s/$^.ld.$$ .ld.$$/\1/"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; .$objext);; ) list="$list $z";;esac; done; func_echo_all "$list"'
	;;
	*)
	if test yes,no = "$GXX,$with_gnu_ld"; then
	_LT_TAGVAR(allow_undefined_flag, $1)=' $wl-expect_unresolved $wl\*'
	case $host in
	osf3*)
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib $allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib'
	;;
	*)
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -nostdlib $allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-msym $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib'
	;;
	esac

	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=:

	# Commands to make compiler produce verbose output that lists
	# what "hidden" libraries, object files and flags are used when
	# linking a shared library.
	output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 \| $GREP -v "^Configured with:" \| $GREP "\-L"'

	else
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	fi
	;;
	esac
	;;

	psos*)
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;

	sunos4*)
	case $cc_basename in
	CC*)
	# Sun C++ 4.x
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	lcc*)
	# Lucid
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	*)
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	esac
	;;

	solaris*)
	case $cc_basename in
	CC* \| sunCC*)
	# Sun C++ 4.2, 5.x and Centerline C++
	_LT_TAGVAR(archive_cmds_need_lc,$1)=yes
	_LT_TAGVAR(no_undefined_flag, $1)=' -zdefs'
	_LT_TAGVAR(archive_cmds, $1)='$CC -G$allow_undefined_flag -h$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
	_LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols \| $SED -e "s/$.$/\1;/" >> $lib.exp~echo "local: ; };" >> $lib.exp~
	$CC -G$allow_undefined_flag $wl-M $wl$lib.exp -h$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~$RM $lib.exp'

	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir'
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	case $host_os in
	solaris2.[[0-5]] \| solaris2.[[0-5]].*) ;;
	*)
	# The compiler driver will combine and reorder linker options,
	# but understands '-z linker_flag'.
	# Supported since Solaris 2.6 (maybe 2.5.1?)
	_LT_TAGVAR(whole_archive_flag_spec, $1)='-z allextract$convenience -z defaultextract'
	;;
	esac
	_LT_TAGVAR(link_all_deplibs, $1)=yes

	output_verbose_link_cmd='func_echo_all'

	# Archives containing C++ object files must be created using
	# "CC -xar", where "CC" is the Sun C++ compiler. This is
	# necessary to make sure instantiated templates are included
	# in the archive.
	_LT_TAGVAR(old_archive_cmds, $1)='$CC -xar -o $oldlib $oldobjs'
	;;
	gcx*)
	# Green Hills C++ Compiler
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-h $wl$soname -o $lib'

	# The C++ compiler must be used to create the archive.
	_LT_TAGVAR(old_archive_cmds, $1)='$CC $LDFLAGS -archive -o $oldlib $oldobjs'
	;;
	*)
	# GNU C++ compiler with Solaris linker
	if test yes,no = "$GXX,$with_gnu_ld"; then
	_LT_TAGVAR(no_undefined_flag, $1)=' $wl-z ${wl}defs'
	if $CC --version \| $GREP -v '^2\.7' > /dev/null; then
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-h $wl$soname -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols \| $SED -e "s/$.$/\1;/" >> $lib.exp~echo "local: ; };" >> $lib.exp~
	$CC -shared $pic_flag -nostdlib $wl-M $wl$lib.exp $wl-h $wl$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~$RM $lib.exp'

	# Commands to make compiler produce verbose output that lists
	# what "hidden" libraries, object files and flags are used when
	# linking a shared library.
	output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 \| $GREP -v "^Configured with:" \| $GREP "\-L"'
	else
	# g++ 2.7 appears to require '-G' NOT '-shared' on this
	# platform.
	_LT_TAGVAR(archive_cmds, $1)='$CC -G -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-h $wl$soname -o $lib'
	_LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols \| $SED -e "s/$.$/\1;/" >> $lib.exp~echo "local: ; };" >> $lib.exp~
	$CC -G -nostdlib $wl-M $wl$lib.exp $wl-h $wl$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~$RM $lib.exp'

	# Commands to make compiler produce verbose output that lists
	# what "hidden" libraries, object files and flags are used when
	# linking a shared library.
	output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 \| $GREP -v "^Configured with:" \| $GREP "\-L"'
	fi

	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R $wl$libdir'
	case $host_os in
	solaris2.[[0-5]] \| solaris2.[[0-5]].*) ;;
	*)
	_LT_TAGVAR(whole_archive_flag_spec, $1)='$wl-z ${wl}allextract$convenience $wl-z ${wl}defaultextract'
	;;
	esac
	fi
	;;
	esac
	;;

	sysv4uw2 \| sysv5OpenUNIX* \| sysv5UnixWare7.[[01]].[[10]]* \| unixware7* \| sco3.2v5.0.[[024]]*)
	_LT_TAGVAR(no_undefined_flag, $1)='$wl-z,text'
	_LT_TAGVAR(archive_cmds_need_lc, $1)=no
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	runpath_var='LD_RUN_PATH'

	case $cc_basename in
	CC*)
	_LT_TAGVAR(archive_cmds, $1)='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	;;
	*)
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	;;
	esac
	;;

	sysv5* \| sco3.2v5* \| sco5v6*)
	# Note: We CANNOT use -z defs as we might desire, because we do not
	# link with -lc, and that would cause any symbols used from libc to
	# always be unresolved, which means just about no library would
	# ever link correctly. If we're not using GNU ld we use -z text
	# though, which does catch some bad symbols but isn't as heavy-handed
	# as -z defs.
	_LT_TAGVAR(no_undefined_flag, $1)='$wl-z,text'
	_LT_TAGVAR(allow_undefined_flag, $1)='$wl-z,nodefs'
	_LT_TAGVAR(archive_cmds_need_lc, $1)=no
	_LT_TAGVAR(hardcode_shlibpath_var, $1)=no
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R,$libdir'
	_LT_TAGVAR(hardcode_libdir_separator, $1)=':'
	_LT_TAGVAR(link_all_deplibs, $1)=yes
	_LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-Bexport'
	runpath_var='LD_RUN_PATH'

	case $cc_basename in
	CC*)
	_LT_TAGVAR(archive_cmds, $1)='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	_LT_TAGVAR(old_archive_cmds, $1)='$CC -Tprelink_objects $oldobjs~
	'"$_LT_TAGVAR(old_archive_cmds, $1)"
	_LT_TAGVAR(reload_cmds, $1)='$CC -Tprelink_objects $reload_objs~
	'"$_LT_TAGVAR(reload_cmds, $1)"
	;;
	*)
	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	;;
	esac
	;;

	tandem*)
	case $cc_basename in
	NCC*)
	# NonStop-UX NCC 3.20
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	*)
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	esac
	;;

	vxworks*)
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;

	*)
	# FIXME: insert proper C++ library support
	_LT_TAGVAR(ld_shlibs, $1)=no
	;;
	esac

	AC_MSG_RESULT([$_LT_TAGVAR(ld_shlibs, $1)])
	test no = "$_LT_TAGVAR(ld_shlibs, $1)" && can_build_shared=no

	_LT_TAGVAR(GCC, $1)=$GXX
	_LT_TAGVAR(LD, $1)=$LD

	## CAVEAT EMPTOR:
	## There is no encapsulation within the following macros, do not change
	## the running order or otherwise move them around unless you know exactly
	## what you are doing...
	_LT_SYS_HIDDEN_LIBDEPS($1)
	_LT_COMPILER_PIC($1)
	_LT_COMPILER_C_O($1)
	_LT_COMPILER_FILE_LOCKS($1)
	_LT_LINKER_SHLIBS($1)
	_LT_SYS_DYNAMIC_LINKER($1)
	_LT_LINKER_HARDCODE_LIBPATH($1)

	_LT_CONFIG($1)
	fi # test -n "$compiler"

	CC=$lt_save_CC
	CFLAGS=$lt_save_CFLAGS
	LDCXX=$LD
	LD=$lt_save_LD
	GCC=$lt_save_GCC
	with_gnu_ld=$lt_save_with_gnu_ld
	lt_cv_path_LDCXX=$lt_cv_path_LD
	lt_cv_path_LD=$lt_save_path_LD
	lt_cv_prog_gnu_ldcxx=$lt_cv_prog_gnu_ld
	lt_cv_prog_gnu_ld=$lt_save_with_gnu_ld
	fi # test yes != "$_lt_caught_CXX_error"

	AC_LANG_POP
	])# _LT_LANG_CXX_CONFIG


	# _LT_FUNC_STRIPNAME_CNF
	# ----------------------
	# func_stripname_cnf prefix suffix name
	# strip PREFIX and SUFFIX off of NAME.
	# PREFIX and SUFFIX must not contain globbing or regex special
	# characters, hashes, percent signs, but SUFFIX may contain a leading
	# dot (in which case that matches only a dot).
	#
	# This function is identical to the (non-XSI) version of func_stripname,
	# except this one can be used by m4 code that may be executed by configure,
	# rather than the libtool script.
	m4_defun([_LT_FUNC_STRIPNAME_CNF],[dnl
	AC_REQUIRE([_LT_DECL_SED])
	AC_REQUIRE([_LT_PROG_ECHO_BACKSLASH])
	func_stripname_cnf ()
	{
	case @S\|@2 in
	.*) func_stripname_result=`$ECHO "@S\|@3" \| $SED "s%^@S\|@1%%; s%\\\\@S\|@2\$%%"`;;
	*) func_stripname_result=`$ECHO "@S\|@3" \| $SED "s%^@S\|@1%%; s%@S\|@2\$%%"`;;
	esac
	} # func_stripname_cnf
	])# _LT_FUNC_STRIPNAME_CNF


	# _LT_SYS_HIDDEN_LIBDEPS([TAGNAME])
	# ---------------------------------
	# Figure out "hidden" library dependencies from verbose
	# compiler output when linking a shared library.
	# Parse the compiler output and extract the necessary
	# objects, libraries and library flags.
	m4_defun([_LT_SYS_HIDDEN_LIBDEPS],
	[m4_require([_LT_FILEUTILS_DEFAULTS])dnl
	AC_REQUIRE([_LT_FUNC_STRIPNAME_CNF])dnl
	# Dependencies to place before and after the object being linked:
	_LT_TAGVAR(predep_objects, $1)=
	_LT_TAGVAR(postdep_objects, $1)=
	_LT_TAGVAR(predeps, $1)=
	_LT_TAGVAR(postdeps, $1)=
	_LT_TAGVAR(compiler_lib_search_path, $1)=

	dnl we can't use the lt_simple_compile_test_code here,
	dnl because it contains code intended for an executable,
	dnl not a library. It's possible we should let each
	dnl tag define a new lt_????_link_test_code variable,
	dnl but it's only used here...
	m4_if([$1], [], [cat > conftest.$ac_ext <<_LT_EOF
	int a;
	void foo (void) { a = 0; }
	_LT_EOF
	], [$1], [CXX], [cat > conftest.$ac_ext <<_LT_EOF
	class Foo
	{
	public:
	Foo (void) { a = 0; }
	private:
	int a;
	};
	_LT_EOF
	], [$1], [F77], [cat > conftest.$ac_ext <<_LT_EOF
	subroutine foo
	implicit none
	integer*4 a
	a=0
	return
	end
	_LT_EOF
	], [$1], [FC], [cat > conftest.$ac_ext <<_LT_EOF
	subroutine foo
	implicit none
	integer a
	a=0
	return
	end
	_LT_EOF
	], [$1], [GCJ], [cat > conftest.$ac_ext <<_LT_EOF
	public class foo {
	private int a;
	public void bar (void) {
	a = 0;
	}
	};
	_LT_EOF
	], [$1], [GO], [cat > conftest.$ac_ext <<_LT_EOF
	package foo
	func foo() {
	}
	_LT_EOF
	])

	_lt_libdeps_save_CFLAGS=$CFLAGS
	case "$CC $CFLAGS " in #(
	\ -flto\ *) CFLAGS="$CFLAGS -fno-lto" ;;
	\ -fwhopr\ *) CFLAGS="$CFLAGS -fno-whopr" ;;
	\ -fuse-linker-plugin\ *) CFLAGS="$CFLAGS -fno-use-linker-plugin" ;;
	esac

	dnl Parse the compiler output and extract the necessary
	dnl objects, libraries and library flags.
	if AC_TRY_EVAL(ac_compile); then
	# Parse the compiler output and extract the necessary
	# objects, libraries and library flags.

	# Sentinel used to keep track of whether or not we are before
	# the conftest object file.
	pre_test_object_deps_done=no

	for p in `eval "$output_verbose_link_cmd"`; do
	case $prev$p in

	-L* \| -R* \| -l*)
	# Some compilers place space between "-{L,R}" and the path.
	# Remove the space.
	if test x-L = "$p" \|\|
	test x-R = "$p"; then
	prev=$p
	continue
	fi

	# Expand the sysroot to ease extracting the directories later.
	if test -z "$prev"; then
	case $p in
	-L*) func_stripname_cnf '-L' '' "$p"; prev=-L; p=$func_stripname_result ;;
	-R*) func_stripname_cnf '-R' '' "$p"; prev=-R; p=$func_stripname_result ;;
	-l*) func_stripname_cnf '-l' '' "$p"; prev=-l; p=$func_stripname_result ;;
	esac
	fi
	case $p in
	=*) func_stripname_cnf '=' '' "$p"; p=$lt_sysroot$func_stripname_result ;;
	esac
	if test no = "$pre_test_object_deps_done"; then
	case $prev in
	-L \| -R)
	# Internal compiler library paths should come after those
	# provided the user. The postdeps already come after the
	# user supplied libs so there is no need to process them.
	if test -z "$_LT_TAGVAR(compiler_lib_search_path, $1)"; then
	_LT_TAGVAR(compiler_lib_search_path, $1)=$prev$p
	else
	_LT_TAGVAR(compiler_lib_search_path, $1)="${_LT_TAGVAR(compiler_lib_search_path, $1)} $prev$p"
	fi
	;;
	# The "-l" case would never come before the object being
	# linked, so don't bother handling this case.
	esac
	else
	if test -z "$_LT_TAGVAR(postdeps, $1)"; then
	_LT_TAGVAR(postdeps, $1)=$prev$p
	else
	_LT_TAGVAR(postdeps, $1)="${_LT_TAGVAR(postdeps, $1)} $prev$p"
	fi
	fi
	prev=
	;;

	*.lto.$objext) ;; # Ignore GCC LTO objects
	*.$objext)
	# This assumes that the test object file only shows up
	# once in the compiler output.
	if test "$p" = "conftest.$objext"; then
	pre_test_object_deps_done=yes
	continue
	fi

	if test no = "$pre_test_object_deps_done"; then
	if test -z "$_LT_TAGVAR(predep_objects, $1)"; then
	_LT_TAGVAR(predep_objects, $1)=$p
	else
	_LT_TAGVAR(predep_objects, $1)="$_LT_TAGVAR(predep_objects, $1) $p"
	fi
	else
	if test -z "$_LT_TAGVAR(postdep_objects, $1)"; then
	_LT_TAGVAR(postdep_objects, $1)=$p
	else
	_LT_TAGVAR(postdep_objects, $1)="$_LT_TAGVAR(postdep_objects, $1) $p"
	fi
	fi
	;;

	*) ;; # Ignore the rest.

	esac
	done

	# Clean up.
	rm -f a.out a.exe
	else
	echo "libtool.m4: error: problem compiling $1 test program"
	fi

	$RM -f confest.$objext
	CFLAGS=$_lt_libdeps_save_CFLAGS

	# PORTME: override above test on systems where it is broken
	m4_if([$1], [CXX],
	[case $host_os in
	interix[[3-9]]*)
	# Interix 3.5 installs completely hosed .la files for C++, so rather than
	# hack all around it, let's just trust "g++" to DTRT.
	_LT_TAGVAR(predep_objects,$1)=
	_LT_TAGVAR(postdep_objects,$1)=
	_LT_TAGVAR(postdeps,$1)=
	;;
	esac
	])

	case " $_LT_TAGVAR(postdeps, $1) " in
	" -lc ") _LT_TAGVAR(archive_cmds_need_lc, $1)=no ;;
	esac
	_LT_TAGVAR(compiler_lib_search_dirs, $1)=
	if test -n "${_LT_TAGVAR(compiler_lib_search_path, $1)}"; then
	_LT_TAGVAR(compiler_lib_search_dirs, $1)=`echo " ${_LT_TAGVAR(compiler_lib_search_path, $1)}" \| $SED -e 's! -L! !g' -e 's!^ !!'`
	fi
	_LT_TAGDECL([], [compiler_lib_search_dirs], [1],
	[The directories searched by this compiler when creating a shared library])
	_LT_TAGDECL([], [predep_objects], [1],
	[Dependencies to place before and after the objects being linked to
	create a shared library])
	_LT_TAGDECL([], [postdep_objects], [1])
	_LT_TAGDECL([], [predeps], [1])
	_LT_TAGDECL([], [postdeps], [1])
	_LT_TAGDECL([], [compiler_lib_search_path], [1],
	[The library search path used internally by the compiler when linking
	a shared library])
	])# _LT_SYS_HIDDEN_LIBDEPS


	# _LT_LANG_F77_CONFIG([TAG])
	# --------------------------
	# Ensure that the configuration variables for a Fortran 77 compiler are
	# suitably defined. These variables are subsequently used by _LT_CONFIG
	# to write the compiler configuration to 'libtool'.
	m4_defun([_LT_LANG_F77_CONFIG],
	[AC_LANG_PUSH(Fortran 77)
	if test -z "$F77" \|\| test no = "$F77"; then
	_lt_disable_F77=yes
	fi

	_LT_TAGVAR(archive_cmds_need_lc, $1)=no
	_LT_TAGVAR(allow_undefined_flag, $1)=
	_LT_TAGVAR(always_export_symbols, $1)=no
	_LT_TAGVAR(archive_expsym_cmds, $1)=
	_LT_TAGVAR(export_dynamic_flag_spec, $1)=
	_LT_TAGVAR(hardcode_direct, $1)=no
	_LT_TAGVAR(hardcode_direct_absolute, $1)=no
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=
	_LT_TAGVAR(hardcode_libdir_separator, $1)=
	_LT_TAGVAR(hardcode_minus_L, $1)=no
	_LT_TAGVAR(hardcode_automatic, $1)=no
	_LT_TAGVAR(inherit_rpath, $1)=no
	_LT_TAGVAR(module_cmds, $1)=
	_LT_TAGVAR(module_expsym_cmds, $1)=
	_LT_TAGVAR(link_all_deplibs, $1)=unknown
	_LT_TAGVAR(old_archive_cmds, $1)=$old_archive_cmds
	_LT_TAGVAR(reload_flag, $1)=$reload_flag
	_LT_TAGVAR(reload_cmds, $1)=$reload_cmds
	_LT_TAGVAR(no_undefined_flag, $1)=
	_LT_TAGVAR(whole_archive_flag_spec, $1)=
	_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=no

	# Source file extension for f77 test sources.
	ac_ext=f

	# Object file extension for compiled f77 test sources.
	objext=o
	_LT_TAGVAR(objext, $1)=$objext

	# No sense in running all these tests if we already determined that
	# the F77 compiler isn't working. Some variables (like enable_shared)
	# are currently assumed to apply to all compilers on this platform,
	# and will be corrupted by setting them based on a non-working compiler.
	if test yes != "$_lt_disable_F77"; then
	# Code to be used in simple compile tests
	lt_simple_compile_test_code="\
	subroutine t
	return
	end
	"

	# Code to be used in simple link tests
	lt_simple_link_test_code="\
	program t
	end
	"

	# ltmain only uses $CC for tagged configurations so make sure $CC is set.
	_LT_TAG_COMPILER

	# save warnings/boilerplate of simple test code
	_LT_COMPILER_BOILERPLATE
	_LT_LINKER_BOILERPLATE

	# Allow CC to be a program name with arguments.
	lt_save_CC=$CC
	lt_save_GCC=$GCC
	lt_save_CFLAGS=$CFLAGS
	CC=${F77-"f77"}
	CFLAGS=$FFLAGS
	compiler=$CC
	_LT_TAGVAR(compiler, $1)=$CC
	_LT_CC_BASENAME([$compiler])
	GCC=$G77
	if test -n "$compiler"; then
	AC_MSG_CHECKING([if libtool supports shared libraries])
	AC_MSG_RESULT([$can_build_shared])

	AC_MSG_CHECKING([whether to build shared libraries])
	test no = "$can_build_shared" && enable_shared=no

	# On AIX, shared libraries and static libraries use the same namespace, and
	# are all built from PIC.
	case $host_os in
	aix3*)
	test yes = "$enable_shared" && enable_static=no
	if test -n "$RANLIB"; then
	archive_cmds="$archive_cmds~\$RANLIB \$lib"
	postinstall_cmds='$RANLIB $lib'
	fi
	;;
	aix[[4-9]]*)
	if test ia64 != "$host_cpu"; then
	case $enable_shared,$with_aix_soname,$aix_use_runtimelinking in
	yes,aix,yes) ;; # shared object as lib.so file only
	yes,svr4,*) ;; # shared object as lib.so archive member only
	yes,*) enable_static=no ;; # shared object in lib.a archive as well
	esac
	fi
	;;
	esac
	AC_MSG_RESULT([$enable_shared])

	AC_MSG_CHECKING([whether to build static libraries])
	# Make sure either enable_shared or enable_static is yes.
	test yes = "$enable_shared" \|\| enable_static=yes
	AC_MSG_RESULT([$enable_static])

	_LT_TAGVAR(GCC, $1)=$G77
	_LT_TAGVAR(LD, $1)=$LD

	## CAVEAT EMPTOR:
	## There is no encapsulation within the following macros, do not change
	## the running order or otherwise move them around unless you know exactly
	## what you are doing...
	_LT_COMPILER_PIC($1)
	_LT_COMPILER_C_O($1)
	_LT_COMPILER_FILE_LOCKS($1)
	_LT_LINKER_SHLIBS($1)
	_LT_SYS_DYNAMIC_LINKER($1)
	_LT_LINKER_HARDCODE_LIBPATH($1)

	_LT_CONFIG($1)
	fi # test -n "$compiler"

	GCC=$lt_save_GCC
	CC=$lt_save_CC
	CFLAGS=$lt_save_CFLAGS
	fi # test yes != "$_lt_disable_F77"

	AC_LANG_POP
	])# _LT_LANG_F77_CONFIG


	# _LT_LANG_FC_CONFIG([TAG])
	# -------------------------
	# Ensure that the configuration variables for a Fortran compiler are
	# suitably defined. These variables are subsequently used by _LT_CONFIG
	# to write the compiler configuration to 'libtool'.
	m4_defun([_LT_LANG_FC_CONFIG],
	[AC_LANG_PUSH(Fortran)

	if test -z "$FC" \|\| test no = "$FC"; then
	_lt_disable_FC=yes
	fi

	_LT_TAGVAR(archive_cmds_need_lc, $1)=no
	_LT_TAGVAR(allow_undefined_flag, $1)=
	_LT_TAGVAR(always_export_symbols, $1)=no
	_LT_TAGVAR(archive_expsym_cmds, $1)=
	_LT_TAGVAR(export_dynamic_flag_spec, $1)=
	_LT_TAGVAR(hardcode_direct, $1)=no
	_LT_TAGVAR(hardcode_direct_absolute, $1)=no
	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=
	_LT_TAGVAR(hardcode_libdir_separator, $1)=
	_LT_TAGVAR(hardcode_minus_L, $1)=no
	_LT_TAGVAR(hardcode_automatic, $1)=no
	_LT_TAGVAR(inherit_rpath, $1)=no
	_LT_TAGVAR(module_cmds, $1)=
	_LT_TAGVAR(module_expsym_cmds, $1)=
	_LT_TAGVAR(link_all_deplibs, $1)=unknown
	_LT_TAGVAR(old_archive_cmds, $1)=$old_archive_cmds
	_LT_TAGVAR(reload_flag, $1)=$reload_flag
	_LT_TAGVAR(reload_cmds, $1)=$reload_cmds
	_LT_TAGVAR(no_undefined_flag, $1)=
	_LT_TAGVAR(whole_archive_flag_spec, $1)=
	_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=no

	# Source file extension for fc test sources.
	ac_ext=${ac_fc_srcext-f}

	# Object file extension for compiled fc test sources.
	objext=o
	_LT_TAGVAR(objext, $1)=$objext

	# No sense in running all these tests if we already determined that
	# the FC compiler isn't working. Some variables (like enable_shared)
	# are currently assumed to apply to all compilers on this platform,
	# and will be corrupted by setting them based on a non-working compiler.
	if test yes != "$_lt_disable_FC"; then
	# Code to be used in simple compile tests
	lt_simple_compile_test_code="\
	subroutine t
	return
	end
	"

	# Code to be used in simple link tests
	lt_simple_link_test_code="\
	program t
	end
	"

	# ltmain only uses $CC for tagged configurations so make sure $CC is set.
	_LT_TAG_COMPILER

	# save warnings/boilerplate of simple test code
	_LT_COMPILER_BOILERPLATE
	_LT_LINKER_BOILERPLATE

	# Allow CC to be a program name with arguments.
	lt_save_CC=$CC
	lt_save_GCC=$GCC
	lt_save_CFLAGS=$CFLAGS
	CC=${FC-"f95"}
	CFLAGS=$FCFLAGS
	compiler=$CC
	GCC=$ac_cv_fc_compiler_gnu

	_LT_TAGVAR(compiler, $1)=$CC
	_LT_CC_BASENAME([$compiler])

	if test -n "$compiler"; then
	AC_MSG_CHECKING([if libtool supports shared libraries])
	AC_MSG_RESULT([$can_build_shared])

	AC_MSG_CHECKING([whether to build shared libraries])
	test no = "$can_build_shared" && enable_shared=no

	# On AIX, shared libraries and static libraries use the same namespace, and
	# are all built from PIC.
	case $host_os in
	aix3*)
	test yes = "$enable_shared" && enable_static=no
	if test -n "$RANLIB"; then
	archive_cmds="$archive_cmds~\$RANLIB \$lib"
	postinstall_cmds='$RANLIB $lib'
	fi
	;;
	aix[[4-9]]*)
	if test ia64 != "$host_cpu"; then
	case $enable_shared,$with_aix_soname,$aix_use_runtimelinking in
	yes,aix,yes) ;; # shared object as lib.so file only
	yes,svr4,*) ;; # shared object as lib.so archive member only
	yes,*) enable_static=no ;; # shared object in lib.a archive as well
	esac
	fi
	;;
	esac
	AC_MSG_RESULT([$enable_shared])

	AC_MSG_CHECKING([whether to build static libraries])
	# Make sure either enable_shared or enable_static is yes.
	test yes = "$enable_shared" \|\| enable_static=yes
	AC_MSG_RESULT([$enable_static])

	_LT_TAGVAR(GCC, $1)=$ac_cv_fc_compiler_gnu
	_LT_TAGVAR(LD, $1)=$LD

	## CAVEAT EMPTOR:
	## There is no encapsulation within the following macros, do not change
	## the running order or otherwise move them around unless you know exactly
	## what you are doing...
	_LT_SYS_HIDDEN_LIBDEPS($1)
	_LT_COMPILER_PIC($1)
	_LT_COMPILER_C_O($1)
	_LT_COMPILER_FILE_LOCKS($1)
	_LT_LINKER_SHLIBS($1)
	_LT_SYS_DYNAMIC_LINKER($1)
	_LT_LINKER_HARDCODE_LIBPATH($1)

	_LT_CONFIG($1)
	fi # test -n "$compiler"

	GCC=$lt_save_GCC
	CC=$lt_save_CC
	CFLAGS=$lt_save_CFLAGS
	fi # test yes != "$_lt_disable_FC"

	AC_LANG_POP
	])# _LT_LANG_FC_CONFIG


	# _LT_LANG_GCJ_CONFIG([TAG])
	# --------------------------
	# Ensure that the configuration variables for the GNU Java Compiler compiler
	# are suitably defined. These variables are subsequently used by _LT_CONFIG
	# to write the compiler configuration to 'libtool'.
	m4_defun([_LT_LANG_GCJ_CONFIG],
	[AC_REQUIRE([LT_PROG_GCJ])dnl
	AC_LANG_SAVE

	# Source file extension for Java test sources.
	ac_ext=java

	# Object file extension for compiled Java test sources.
	objext=o
	_LT_TAGVAR(objext, $1)=$objext

	# Code to be used in simple compile tests
	lt_simple_compile_test_code="class foo {}"

	# Code to be used in simple link tests
	lt_simple_link_test_code='public class conftest { public static void main(String[[]] argv) {}; }'

	# ltmain only uses $CC for tagged configurations so make sure $CC is set.
	_LT_TAG_COMPILER

	# save warnings/boilerplate of simple test code
	_LT_COMPILER_BOILERPLATE
	_LT_LINKER_BOILERPLATE

	# Allow CC to be a program name with arguments.
	lt_save_CC=$CC
	lt_save_CFLAGS=$CFLAGS
	lt_save_GCC=$GCC
	GCC=yes
	CC=${GCJ-"gcj"}
	CFLAGS=$GCJFLAGS
	compiler=$CC
	_LT_TAGVAR(compiler, $1)=$CC
	_LT_TAGVAR(LD, $1)=$LD
	_LT_CC_BASENAME([$compiler])

	# GCJ did not exist at the time GCC didn't implicitly link libc in.
	_LT_TAGVAR(archive_cmds_need_lc, $1)=no

	_LT_TAGVAR(old_archive_cmds, $1)=$old_archive_cmds
	_LT_TAGVAR(reload_flag, $1)=$reload_flag
	_LT_TAGVAR(reload_cmds, $1)=$reload_cmds

	if test -n "$compiler"; then
	_LT_COMPILER_NO_RTTI($1)
	_LT_COMPILER_PIC($1)
	_LT_COMPILER_C_O($1)
	_LT_COMPILER_FILE_LOCKS($1)
	_LT_LINKER_SHLIBS($1)
	_LT_LINKER_HARDCODE_LIBPATH($1)

	_LT_CONFIG($1)
	fi

	AC_LANG_RESTORE

	GCC=$lt_save_GCC
	CC=$lt_save_CC
	CFLAGS=$lt_save_CFLAGS
	])# _LT_LANG_GCJ_CONFIG


	# _LT_LANG_GO_CONFIG([TAG])
	# --------------------------
	# Ensure that the configuration variables for the GNU Go compiler
	# are suitably defined. These variables are subsequently used by _LT_CONFIG
	# to write the compiler configuration to 'libtool'.
	m4_defun([_LT_LANG_GO_CONFIG],
	[AC_REQUIRE([LT_PROG_GO])dnl
	AC_LANG_SAVE

	# Source file extension for Go test sources.
	ac_ext=go

	# Object file extension for compiled Go test sources.
	objext=o
	_LT_TAGVAR(objext, $1)=$objext

	# Code to be used in simple compile tests
	lt_simple_compile_test_code="package main; func main() { }"

	# Code to be used in simple link tests
	lt_simple_link_test_code='package main; func main() { }'

	# ltmain only uses $CC for tagged configurations so make sure $CC is set.
	_LT_TAG_COMPILER

	# save warnings/boilerplate of simple test code
	_LT_COMPILER_BOILERPLATE
	_LT_LINKER_BOILERPLATE

	# Allow CC to be a program name with arguments.
	lt_save_CC=$CC
	lt_save_CFLAGS=$CFLAGS
	lt_save_GCC=$GCC
	GCC=yes
	CC=${GOC-"gccgo"}
	CFLAGS=$GOFLAGS
	compiler=$CC
	_LT_TAGVAR(compiler, $1)=$CC
	_LT_TAGVAR(LD, $1)=$LD
	_LT_CC_BASENAME([$compiler])

	# Go did not exist at the time GCC didn't implicitly link libc in.
	_LT_TAGVAR(archive_cmds_need_lc, $1)=no

	_LT_TAGVAR(old_archive_cmds, $1)=$old_archive_cmds
	_LT_TAGVAR(reload_flag, $1)=$reload_flag
	_LT_TAGVAR(reload_cmds, $1)=$reload_cmds

	if test -n "$compiler"; then
	_LT_COMPILER_NO_RTTI($1)
	_LT_COMPILER_PIC($1)
	_LT_COMPILER_C_O($1)
	_LT_COMPILER_FILE_LOCKS($1)
	_LT_LINKER_SHLIBS($1)
	_LT_LINKER_HARDCODE_LIBPATH($1)

	_LT_CONFIG($1)
	fi

	AC_LANG_RESTORE

	GCC=$lt_save_GCC
	CC=$lt_save_CC
	CFLAGS=$lt_save_CFLAGS
	])# _LT_LANG_GO_CONFIG


	# _LT_LANG_RC_CONFIG([TAG])
	# -------------------------
	# Ensure that the configuration variables for the Windows resource compiler
	# are suitably defined. These variables are subsequently used by _LT_CONFIG
	# to write the compiler configuration to 'libtool'.
	m4_defun([_LT_LANG_RC_CONFIG],
	[AC_REQUIRE([LT_PROG_RC])dnl
	AC_LANG_SAVE

	# Source file extension for RC test sources.
	ac_ext=rc

	# Object file extension for compiled RC test sources.
	objext=o
	_LT_TAGVAR(objext, $1)=$objext

	# Code to be used in simple compile tests
	lt_simple_compile_test_code='sample MENU { MENUITEM "&Soup", 100, CHECKED }'

	# Code to be used in simple link tests
	lt_simple_link_test_code=$lt_simple_compile_test_code

	# ltmain only uses $CC for tagged configurations so make sure $CC is set.
	_LT_TAG_COMPILER

	# save warnings/boilerplate of simple test code
	_LT_COMPILER_BOILERPLATE
	_LT_LINKER_BOILERPLATE

	# Allow CC to be a program name with arguments.
	lt_save_CC=$CC
	lt_save_CFLAGS=$CFLAGS
	lt_save_GCC=$GCC
	GCC=
	CC=${RC-"windres"}
	CFLAGS=
	compiler=$CC
	_LT_TAGVAR(compiler, $1)=$CC
	_LT_CC_BASENAME([$compiler])
	_LT_TAGVAR(lt_cv_prog_compiler_c_o, $1)=yes

	if test -n "$compiler"; then
	:
	_LT_CONFIG($1)
	fi

	GCC=$lt_save_GCC
	AC_LANG_RESTORE
	CC=$lt_save_CC
	CFLAGS=$lt_save_CFLAGS
	])# _LT_LANG_RC_CONFIG


	# LT_PROG_GCJ
	# -----------
	AC_DEFUN([LT_PROG_GCJ],
	[m4_ifdef([AC_PROG_GCJ], [AC_PROG_GCJ],
	[m4_ifdef([A][M_PROG_GCJ], [A][M_PROG_GCJ],
	[AC_CHECK_TOOL(GCJ, gcj,)
	test set = "${GCJFLAGS+set}" \|\| GCJFLAGS="-g -O2"
	AC_SUBST(GCJFLAGS)])])[]dnl
	])

	# Old name:
	AU_ALIAS([LT_AC_PROG_GCJ], [LT_PROG_GCJ])
	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([LT_AC_PROG_GCJ], [])


	# LT_PROG_GO
	# ----------
	AC_DEFUN([LT_PROG_GO],
	[AC_CHECK_TOOL(GOC, gccgo,)
	])


	# LT_PROG_RC
	# ----------
	AC_DEFUN([LT_PROG_RC],
	[AC_CHECK_TOOL(RC, windres,)
	])

	# Old name:
	AU_ALIAS([LT_AC_PROG_RC], [LT_PROG_RC])
	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([LT_AC_PROG_RC], [])


	# _LT_DECL_EGREP
	# --------------
	# If we don't have a new enough Autoconf to choose the best grep
	# available, choose the one first in the user's PATH.
	m4_defun([_LT_DECL_EGREP],
	[AC_REQUIRE([AC_PROG_EGREP])dnl
	AC_REQUIRE([AC_PROG_FGREP])dnl
	test -z "$GREP" && GREP=grep
	_LT_DECL([], [GREP], [1], [A grep program that handles long lines])
	_LT_DECL([], [EGREP], [1], [An ERE matcher])
	_LT_DECL([], [FGREP], [1], [A literal string matcher])
	dnl Non-bleeding-edge autoconf doesn't subst GREP, so do it here too
	AC_SUBST([GREP])
	])


	# _LT_DECL_OBJDUMP
	# --------------
	# If we don't have a new enough Autoconf to choose the best objdump
	# available, choose the one first in the user's PATH.
	m4_defun([_LT_DECL_OBJDUMP],
	[AC_CHECK_TOOL(OBJDUMP, objdump, false)
	test -z "$OBJDUMP" && OBJDUMP=objdump
	_LT_DECL([], [OBJDUMP], [1], [An object symbol dumper])
	AC_SUBST([OBJDUMP])
	])

	# _LT_DECL_DLLTOOL
	# ----------------
	# Ensure DLLTOOL variable is set.
	m4_defun([_LT_DECL_DLLTOOL],
	[AC_CHECK_TOOL(DLLTOOL, dlltool, false)
	test -z "$DLLTOOL" && DLLTOOL=dlltool
	_LT_DECL([], [DLLTOOL], [1], [DLL creation program])
	AC_SUBST([DLLTOOL])
	])

	# _LT_DECL_SED
	# ------------
	# Check for a fully-functional sed program, that truncates
	# as few characters as possible. Prefer GNU sed if found.
	m4_defun([_LT_DECL_SED],
	[AC_PROG_SED
	test -z "$SED" && SED=sed
	Xsed="$SED -e 1s/^X//"
	_LT_DECL([], [SED], [1], [A sed program that does not truncate output])
	_LT_DECL([], [Xsed], ["\$SED -e 1s/^X//"],
	[Sed that helps us avoid accidentally triggering echo(1) options like -n])
	])# _LT_DECL_SED

	m4_ifndef([AC_PROG_SED], [
	# NOTE: This macro has been submitted for inclusion into #
	# GNU Autoconf as AC_PROG_SED. When it is available in #
	# a released version of Autoconf we should remove this #
	# macro and use it instead. #

	m4_defun([AC_PROG_SED],
	[AC_MSG_CHECKING([for a sed that does not truncate output])
	AC_CACHE_VAL(lt_cv_path_SED,
	[# Loop through the user's path and test for sed and gsed.
	# Then use that list of sed's as ones to test for truncation.
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for lt_ac_prog in sed gsed; do
	for ac_exec_ext in '' $ac_executable_extensions; do
	if $as_executable_p "$as_dir/$lt_ac_prog$ac_exec_ext"; then
	lt_ac_sed_list="$lt_ac_sed_list $as_dir/$lt_ac_prog$ac_exec_ext"
	fi
	done
	done
	done
	IFS=$as_save_IFS
	lt_ac_max=0
	lt_ac_count=0
	# Add /usr/xpg4/bin/sed as it is typically found on Solaris
	# along with /bin/sed that truncates output.
	for lt_ac_sed in $lt_ac_sed_list /usr/xpg4/bin/sed; do
	test ! -f "$lt_ac_sed" && continue
	cat /dev/null > conftest.in
	lt_ac_count=0
	echo $ECHO_N "0123456789$ECHO_C" >conftest.in
	# Check for GNU sed and select it if it is found.
	if "$lt_ac_sed" --version 2>&1 < /dev/null \| grep 'GNU' > /dev/null; then
	lt_cv_path_SED=$lt_ac_sed
	break
	fi
	while true; do
	cat conftest.in conftest.in >conftest.tmp
	mv conftest.tmp conftest.in
	cp conftest.in conftest.nl
	echo >>conftest.nl
	$lt_ac_sed -e 's/a$//' < conftest.nl >conftest.out \|\| break
	cmp -s conftest.out conftest.nl \|\| break
	# 10000 chars as input seems more than enough
	test 10 -lt "$lt_ac_count" && break
	lt_ac_count=`expr $lt_ac_count + 1`
	if test "$lt_ac_count" -gt "$lt_ac_max"; then
	lt_ac_max=$lt_ac_count
	lt_cv_path_SED=$lt_ac_sed
	fi
	done
	done
	])
	SED=$lt_cv_path_SED
	AC_SUBST([SED])
	AC_MSG_RESULT([$SED])
	])#AC_PROG_SED
	])#m4_ifndef

	# Old name:
	AU_ALIAS([LT_AC_PROG_SED], [AC_PROG_SED])
	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([LT_AC_PROG_SED], [])


	# _LT_CHECK_SHELL_FEATURES
	# ------------------------
	# Find out whether the shell is Bourne or XSI compatible,
	# or has some other useful features.
	m4_defun([_LT_CHECK_SHELL_FEATURES],
	[if ( (MAIL=60; unset MAIL) \|\| exit) >/dev/null 2>&1; then
	lt_unset=unset
	else
	lt_unset=false
	fi
	_LT_DECL([], [lt_unset], [0], [whether the shell understands "unset"])dnl

	# test EBCDIC or ASCII
	case `echo X\|tr X '\101'` in
	A) # ASCII based system
	# \n is not interpreted correctly by Solaris 8 /usr/ucb/tr
	lt_SP2NL='tr \040 \012'
	lt_NL2SP='tr \015\012 \040\040'
	;;
	*) # EBCDIC based system
	lt_SP2NL='tr \100 \n'
	lt_NL2SP='tr \r\n \100\100'
	;;
	esac
	_LT_DECL([SP2NL], [lt_SP2NL], [1], [turn spaces into newlines])dnl
	_LT_DECL([NL2SP], [lt_NL2SP], [1], [turn newlines into spaces])dnl
	])# _LT_CHECK_SHELL_FEATURES


	# _LT_PATH_CONVERSION_FUNCTIONS
	# -----------------------------
	# Determine what file name conversion functions should be used by
	# func_to_host_file (and, implicitly, by func_to_host_path). These are needed
	# for certain cross-compile configurations and native mingw.
	m4_defun([_LT_PATH_CONVERSION_FUNCTIONS],
	[AC_REQUIRE([AC_CANONICAL_HOST])dnl
	AC_REQUIRE([AC_CANONICAL_BUILD])dnl
	AC_MSG_CHECKING([how to convert $build file names to $host format])
	AC_CACHE_VAL(lt_cv_to_host_file_cmd,
	[case $host in
	--mingw* )
	case $build in
	--mingw* ) # actually msys
	lt_cv_to_host_file_cmd=func_convert_file_msys_to_w32
	;;
	--cygwin* )
	lt_cv_to_host_file_cmd=func_convert_file_cygwin_to_w32
	;;
	* ) # otherwise, assume *nix
	lt_cv_to_host_file_cmd=func_convert_file_nix_to_w32
	;;
	esac
	;;
	--cygwin* )
	case $build in
	--mingw* ) # actually msys
	lt_cv_to_host_file_cmd=func_convert_file_msys_to_cygwin
	;;
	--cygwin* )
	lt_cv_to_host_file_cmd=func_convert_file_noop
	;;
	* ) # otherwise, assume *nix
	lt_cv_to_host_file_cmd=func_convert_file_nix_to_cygwin
	;;
	esac
	;;
	* ) # unhandled hosts (and "normal" native builds)
	lt_cv_to_host_file_cmd=func_convert_file_noop
	;;
	esac
	])
	to_host_file_cmd=$lt_cv_to_host_file_cmd
	AC_MSG_RESULT([$lt_cv_to_host_file_cmd])
	_LT_DECL([to_host_file_cmd], [lt_cv_to_host_file_cmd],
	[0], [convert $build file names to $host format])dnl

	AC_MSG_CHECKING([how to convert $build file names to toolchain format])
	AC_CACHE_VAL(lt_cv_to_tool_file_cmd,
	[#assume ordinary cross tools, or native build.
	lt_cv_to_tool_file_cmd=func_convert_file_noop
	case $host in
	--mingw* )
	case $build in
	--mingw* ) # actually msys
	lt_cv_to_tool_file_cmd=func_convert_file_msys_to_w32
	;;
	esac
	;;
	esac
	])
	to_tool_file_cmd=$lt_cv_to_tool_file_cmd
	AC_MSG_RESULT([$lt_cv_to_tool_file_cmd])
	_LT_DECL([to_tool_file_cmd], [lt_cv_to_tool_file_cmd],
	[0], [convert $build files to toolchain format])dnl
	])# _LT_PATH_CONVERSION_FUNCTIONS

	# Helper functions for option handling. -- Autoconf --
	#
	# Copyright (C) 2004-2005, 2007-2009, 2011-2015 Free Software
	# Foundation, Inc.
	# Written by Gary V. Vaughan, 2004
	#
	# This file is free software; the Free Software Foundation gives
	# unlimited permission to copy and/or distribute it, with or without
	# modifications, as long as this notice is preserved.

	# serial 8 ltoptions.m4

	# This is to help aclocal find these macros, as it can't see m4_define.
	AC_DEFUN([LTOPTIONS_VERSION], [m4_if([1])])


	# _LT_MANGLE_OPTION(MACRO-NAME, OPTION-NAME)
	# ------------------------------------------
	m4_define([_LT_MANGLE_OPTION],
	[[_LT_OPTION_]m4_bpatsubst($1__$2, [[^a-zA-Z0-9_]], [_])])


	# _LT_SET_OPTION(MACRO-NAME, OPTION-NAME)
	# ---------------------------------------
	# Set option OPTION-NAME for macro MACRO-NAME, and if there is a
	# matching handler defined, dispatch to it. Other OPTION-NAMEs are
	# saved as a flag.
	m4_define([_LT_SET_OPTION],
	[m4_define(_LT_MANGLE_OPTION([$1], [$2]))dnl
	m4_ifdef(_LT_MANGLE_DEFUN([$1], [$2]),
	_LT_MANGLE_DEFUN([$1], [$2]),
	[m4_warning([Unknown $1 option '$2'])])[]dnl
	])


	# _LT_IF_OPTION(MACRO-NAME, OPTION-NAME, IF-SET, [IF-NOT-SET])
	# ------------------------------------------------------------
	# Execute IF-SET if OPTION is set, IF-NOT-SET otherwise.
	m4_define([_LT_IF_OPTION],
	[m4_ifdef(_LT_MANGLE_OPTION([$1], [$2]), [$3], [$4])])


	# _LT_UNLESS_OPTIONS(MACRO-NAME, OPTION-LIST, IF-NOT-SET)
	# -------------------------------------------------------
	# Execute IF-NOT-SET unless all options in OPTION-LIST for MACRO-NAME
	# are set.
	m4_define([_LT_UNLESS_OPTIONS],
	[m4_foreach([_LT_Option], m4_split(m4_normalize([$2])),
	[m4_ifdef(_LT_MANGLE_OPTION([$1], _LT_Option),
	[m4_define([$0_found])])])[]dnl
	m4_ifdef([$0_found], [m4_undefine([$0_found])], [$3
	])[]dnl
	])


	# _LT_SET_OPTIONS(MACRO-NAME, OPTION-LIST)
	# ----------------------------------------
	# OPTION-LIST is a space-separated list of Libtool options associated
	# with MACRO-NAME. If any OPTION has a matching handler declared with
	# LT_OPTION_DEFINE, dispatch to that macro; otherwise complain about
	# the unknown option and exit.
	m4_defun([_LT_SET_OPTIONS],
	[# Set options
	m4_foreach([_LT_Option], m4_split(m4_normalize([$2])),
	[_LT_SET_OPTION([$1], _LT_Option)])

	m4_if([$1],[LT_INIT],[
	dnl
	dnl Simply set some default values (i.e off) if boolean options were not
	dnl specified:
	_LT_UNLESS_OPTIONS([LT_INIT], [dlopen], [enable_dlopen=no
	])
	_LT_UNLESS_OPTIONS([LT_INIT], [win32-dll], [enable_win32_dll=no
	])
	dnl
	dnl If no reference was made to various pairs of opposing options, then
	dnl we run the default mode handler for the pair. For example, if neither
	dnl 'shared' nor 'disable-shared' was passed, we enable building of shared
	dnl archives by default:
	_LT_UNLESS_OPTIONS([LT_INIT], [shared disable-shared], [_LT_ENABLE_SHARED])
	_LT_UNLESS_OPTIONS([LT_INIT], [static disable-static], [_LT_ENABLE_STATIC])
	_LT_UNLESS_OPTIONS([LT_INIT], [pic-only no-pic], [_LT_WITH_PIC])
	_LT_UNLESS_OPTIONS([LT_INIT], [fast-install disable-fast-install],
	[_LT_ENABLE_FAST_INSTALL])
	_LT_UNLESS_OPTIONS([LT_INIT], [aix-soname=aix aix-soname=both aix-soname=svr4],
	[_LT_WITH_AIX_SONAME([aix])])
	])
	])# _LT_SET_OPTIONS



	# _LT_MANGLE_DEFUN(MACRO-NAME, OPTION-NAME)
	# -----------------------------------------
	m4_define([_LT_MANGLE_DEFUN],
	[[_LT_OPTION_DEFUN_]m4_bpatsubst(m4_toupper([$1__$2]), [[^A-Z0-9_]], [_])])


	# LT_OPTION_DEFINE(MACRO-NAME, OPTION-NAME, CODE)
	# -----------------------------------------------
	m4_define([LT_OPTION_DEFINE],
	[m4_define(_LT_MANGLE_DEFUN([$1], [$2]), [$3])[]dnl
	])# LT_OPTION_DEFINE


	# dlopen
	# ------
	LT_OPTION_DEFINE([LT_INIT], [dlopen], [enable_dlopen=yes
	])

	AU_DEFUN([AC_LIBTOOL_DLOPEN],
	[_LT_SET_OPTION([LT_INIT], [dlopen])
	AC_DIAGNOSE([obsolete],
	[$0: Remove this warning and the call to _LT_SET_OPTION when you
	put the 'dlopen' option into LT_INIT's first parameter.])
	])

	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([AC_LIBTOOL_DLOPEN], [])


	# win32-dll
	# ---------
	# Declare package support for building win32 dll's.
	LT_OPTION_DEFINE([LT_INIT], [win32-dll],
	[enable_win32_dll=yes

	case $host in
	--cygwin* \| --mingw* \| --pw32* \| --cegcc*)
	AC_CHECK_TOOL(AS, as, false)
	AC_CHECK_TOOL(DLLTOOL, dlltool, false)
	AC_CHECK_TOOL(OBJDUMP, objdump, false)
	;;
	esac

	test -z "$AS" && AS=as
	_LT_DECL([], [AS], [1], [Assembler program])dnl

	test -z "$DLLTOOL" && DLLTOOL=dlltool
	_LT_DECL([], [DLLTOOL], [1], [DLL creation program])dnl

	test -z "$OBJDUMP" && OBJDUMP=objdump
	_LT_DECL([], [OBJDUMP], [1], [Object dumper program])dnl
	])# win32-dll

	AU_DEFUN([AC_LIBTOOL_WIN32_DLL],
	[AC_REQUIRE([AC_CANONICAL_HOST])dnl
	_LT_SET_OPTION([LT_INIT], [win32-dll])
	AC_DIAGNOSE([obsolete],
	[$0: Remove this warning and the call to _LT_SET_OPTION when you
	put the 'win32-dll' option into LT_INIT's first parameter.])
	])

	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([AC_LIBTOOL_WIN32_DLL], [])


	# _LT_ENABLE_SHARED([DEFAULT])
	# ----------------------------
	# implement the --enable-shared flag, and supports the 'shared' and
	# 'disable-shared' LT_INIT options.
	# DEFAULT is either 'yes' or 'no'. If omitted, it defaults to 'yes'.
	m4_define([_LT_ENABLE_SHARED],
	[m4_define([_LT_ENABLE_SHARED_DEFAULT], [m4_if($1, no, no, yes)])dnl
	AC_ARG_ENABLE([shared],
	[AS_HELP_STRING([--enable-shared@<:@=PKGS@:>@],
	[build shared libraries @<:@default=]_LT_ENABLE_SHARED_DEFAULT[@:>@])],
	[p=${PACKAGE-default}
	case $enableval in
	yes) enable_shared=yes ;;
	no) enable_shared=no ;;
	*)
	enable_shared=no
	# Look at the argument we got. We use all the common list separators.
	lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR,
	for pkg in $enableval; do
	IFS=$lt_save_ifs
	if test "X$pkg" = "X$p"; then
	enable_shared=yes
	fi
	done
	IFS=$lt_save_ifs
	;;
	esac],
	[enable_shared=]_LT_ENABLE_SHARED_DEFAULT)

	_LT_DECL([build_libtool_libs], [enable_shared], [0],
	[Whether or not to build shared libraries])
	])# _LT_ENABLE_SHARED

	LT_OPTION_DEFINE([LT_INIT], [shared], [_LT_ENABLE_SHARED([yes])])
	LT_OPTION_DEFINE([LT_INIT], [disable-shared], [_LT_ENABLE_SHARED([no])])

	# Old names:
	AC_DEFUN([AC_ENABLE_SHARED],
	[_LT_SET_OPTION([LT_INIT], m4_if([$1], [no], [disable-])[shared])
	])

	AC_DEFUN([AC_DISABLE_SHARED],
	[_LT_SET_OPTION([LT_INIT], [disable-shared])
	])

	AU_DEFUN([AM_ENABLE_SHARED], [AC_ENABLE_SHARED($@)])
	AU_DEFUN([AM_DISABLE_SHARED], [AC_DISABLE_SHARED($@)])

	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([AM_ENABLE_SHARED], [])
	dnl AC_DEFUN([AM_DISABLE_SHARED], [])



	# _LT_ENABLE_STATIC([DEFAULT])
	# ----------------------------
	# implement the --enable-static flag, and support the 'static' and
	# 'disable-static' LT_INIT options.
	# DEFAULT is either 'yes' or 'no'. If omitted, it defaults to 'yes'.
	m4_define([_LT_ENABLE_STATIC],
	[m4_define([_LT_ENABLE_STATIC_DEFAULT], [m4_if($1, no, no, yes)])dnl
	AC_ARG_ENABLE([static],
	[AS_HELP_STRING([--enable-static@<:@=PKGS@:>@],
	[build static libraries @<:@default=]_LT_ENABLE_STATIC_DEFAULT[@:>@])],
	[p=${PACKAGE-default}
	case $enableval in
	yes) enable_static=yes ;;
	no) enable_static=no ;;
	*)
	enable_static=no
	# Look at the argument we got. We use all the common list separators.
	lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR,
	for pkg in $enableval; do
	IFS=$lt_save_ifs
	if test "X$pkg" = "X$p"; then
	enable_static=yes
	fi
	done
	IFS=$lt_save_ifs
	;;
	esac],
	[enable_static=]_LT_ENABLE_STATIC_DEFAULT)

	_LT_DECL([build_old_libs], [enable_static], [0],
	[Whether or not to build static libraries])
	])# _LT_ENABLE_STATIC

	LT_OPTION_DEFINE([LT_INIT], [static], [_LT_ENABLE_STATIC([yes])])
	LT_OPTION_DEFINE([LT_INIT], [disable-static], [_LT_ENABLE_STATIC([no])])

	# Old names:
	AC_DEFUN([AC_ENABLE_STATIC],
	[_LT_SET_OPTION([LT_INIT], m4_if([$1], [no], [disable-])[static])
	])

	AC_DEFUN([AC_DISABLE_STATIC],
	[_LT_SET_OPTION([LT_INIT], [disable-static])
	])

	AU_DEFUN([AM_ENABLE_STATIC], [AC_ENABLE_STATIC($@)])
	AU_DEFUN([AM_DISABLE_STATIC], [AC_DISABLE_STATIC($@)])

	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([AM_ENABLE_STATIC], [])
	dnl AC_DEFUN([AM_DISABLE_STATIC], [])



	# _LT_ENABLE_FAST_INSTALL([DEFAULT])
	# ----------------------------------
	# implement the --enable-fast-install flag, and support the 'fast-install'
	# and 'disable-fast-install' LT_INIT options.
	# DEFAULT is either 'yes' or 'no'. If omitted, it defaults to 'yes'.
	m4_define([_LT_ENABLE_FAST_INSTALL],
	[m4_define([_LT_ENABLE_FAST_INSTALL_DEFAULT], [m4_if($1, no, no, yes)])dnl
	AC_ARG_ENABLE([fast-install],
	[AS_HELP_STRING([--enable-fast-install@<:@=PKGS@:>@],
	[optimize for fast installation @<:@default=]_LT_ENABLE_FAST_INSTALL_DEFAULT[@:>@])],
	[p=${PACKAGE-default}
	case $enableval in
	yes) enable_fast_install=yes ;;
	no) enable_fast_install=no ;;
	*)
	enable_fast_install=no
	# Look at the argument we got. We use all the common list separators.
	lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR,
	for pkg in $enableval; do
	IFS=$lt_save_ifs
	if test "X$pkg" = "X$p"; then
	enable_fast_install=yes
	fi
	done
	IFS=$lt_save_ifs
	;;
	esac],
	[enable_fast_install=]_LT_ENABLE_FAST_INSTALL_DEFAULT)

	_LT_DECL([fast_install], [enable_fast_install], [0],
	[Whether or not to optimize for fast installation])dnl
	])# _LT_ENABLE_FAST_INSTALL

	LT_OPTION_DEFINE([LT_INIT], [fast-install], [_LT_ENABLE_FAST_INSTALL([yes])])
	LT_OPTION_DEFINE([LT_INIT], [disable-fast-install], [_LT_ENABLE_FAST_INSTALL([no])])

	# Old names:
	AU_DEFUN([AC_ENABLE_FAST_INSTALL],
	[_LT_SET_OPTION([LT_INIT], m4_if([$1], [no], [disable-])[fast-install])
	AC_DIAGNOSE([obsolete],
	[$0: Remove this warning and the call to _LT_SET_OPTION when you put
	the 'fast-install' option into LT_INIT's first parameter.])
	])

	AU_DEFUN([AC_DISABLE_FAST_INSTALL],
	[_LT_SET_OPTION([LT_INIT], [disable-fast-install])
	AC_DIAGNOSE([obsolete],
	[$0: Remove this warning and the call to _LT_SET_OPTION when you put
	the 'disable-fast-install' option into LT_INIT's first parameter.])
	])

	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([AC_ENABLE_FAST_INSTALL], [])
	dnl AC_DEFUN([AM_DISABLE_FAST_INSTALL], [])


	# _LT_WITH_AIX_SONAME([DEFAULT])
	# ----------------------------------
	# implement the --with-aix-soname flag, and support the `aix-soname=aix'
	# and `aix-soname=both' and `aix-soname=svr4' LT_INIT options. DEFAULT
	# is either `aix', `both' or `svr4'. If omitted, it defaults to `aix'.
	m4_define([_LT_WITH_AIX_SONAME],
	[m4_define([_LT_WITH_AIX_SONAME_DEFAULT], [m4_if($1, svr4, svr4, m4_if($1, both, both, aix))])dnl
	shared_archive_member_spec=
	case $host,$enable_shared in
	power--aix[[5-9]]*,yes)
	AC_MSG_CHECKING([which variant of shared library versioning to provide])
	AC_ARG_WITH([aix-soname],
	[AS_HELP_STRING([--with-aix-soname=aix\|svr4\|both],
	[shared library versioning (aka "SONAME") variant to provide on AIX, @<:@default=]_LT_WITH_AIX_SONAME_DEFAULT[@:>@.])],
	[case $withval in
	aix\|svr4\|both)
	;;
	*)
	AC_MSG_ERROR([Unknown argument to --with-aix-soname])
	;;
	esac
	lt_cv_with_aix_soname=$with_aix_soname],
	[AC_CACHE_VAL([lt_cv_with_aix_soname],
	[lt_cv_with_aix_soname=]_LT_WITH_AIX_SONAME_DEFAULT)
	with_aix_soname=$lt_cv_with_aix_soname])
	AC_MSG_RESULT([$with_aix_soname])
	if test aix != "$with_aix_soname"; then
	# For the AIX way of multilib, we name the shared archive member
	# based on the bitwidth used, traditionally 'shr.o' or 'shr_64.o',
	# and 'shr.imp' or 'shr_64.imp', respectively, for the Import File.
	# Even when GNU compilers ignore OBJECT_MODE but need '-maix64' flag,
	# the AIX toolchain works better with OBJECT_MODE set (default 32).
	if test 64 = "${OBJECT_MODE-32}"; then
	shared_archive_member_spec=shr_64
	else
	shared_archive_member_spec=shr
	fi
	fi
	;;
	*)
	with_aix_soname=aix
	;;
	esac

	_LT_DECL([], [shared_archive_member_spec], [0],
	[Shared archive member basename, for filename based shared library versioning on AIX])dnl
	])# _LT_WITH_AIX_SONAME

	LT_OPTION_DEFINE([LT_INIT], [aix-soname=aix], [_LT_WITH_AIX_SONAME([aix])])
	LT_OPTION_DEFINE([LT_INIT], [aix-soname=both], [_LT_WITH_AIX_SONAME([both])])
	LT_OPTION_DEFINE([LT_INIT], [aix-soname=svr4], [_LT_WITH_AIX_SONAME([svr4])])


	# _LT_WITH_PIC([MODE])
	# --------------------
	# implement the --with-pic flag, and support the 'pic-only' and 'no-pic'
	# LT_INIT options.
	# MODE is either 'yes' or 'no'. If omitted, it defaults to 'both'.
	m4_define([_LT_WITH_PIC],
	[AC_ARG_WITH([pic],
	[AS_HELP_STRING([--with-pic@<:@=PKGS@:>@],
	[try to use only PIC/non-PIC objects @<:@default=use both@:>@])],
	[lt_p=${PACKAGE-default}
	case $withval in
	yes\|no) pic_mode=$withval ;;
	*)
	pic_mode=default
	# Look at the argument we got. We use all the common list separators.
	lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR,
	for lt_pkg in $withval; do
	IFS=$lt_save_ifs
	if test "X$lt_pkg" = "X$lt_p"; then
	pic_mode=yes
	fi
	done
	IFS=$lt_save_ifs
	;;
	esac],
	[pic_mode=m4_default([$1], [default])])

	_LT_DECL([], [pic_mode], [0], [What type of objects to build])dnl
	])# _LT_WITH_PIC

	LT_OPTION_DEFINE([LT_INIT], [pic-only], [_LT_WITH_PIC([yes])])
	LT_OPTION_DEFINE([LT_INIT], [no-pic], [_LT_WITH_PIC([no])])

	# Old name:
	AU_DEFUN([AC_LIBTOOL_PICMODE],
	[_LT_SET_OPTION([LT_INIT], [pic-only])
	AC_DIAGNOSE([obsolete],
	[$0: Remove this warning and the call to _LT_SET_OPTION when you
	put the 'pic-only' option into LT_INIT's first parameter.])
	])

	dnl aclocal-1.4 backwards compatibility:
	dnl AC_DEFUN([AC_LIBTOOL_PICMODE], [])


	m4_define([_LTDL_MODE], [])
	LT_OPTION_DEFINE([LTDL_INIT], [nonrecursive],
	[m4_define([_LTDL_MODE], [nonrecursive])])
	LT_OPTION_DEFINE([LTDL_INIT], [recursive],
	[m4_define([_LTDL_MODE], [recursive])])
	LT_OPTION_DEFINE([LTDL_INIT], [subproject],
	[m4_define([_LTDL_MODE], [subproject])])

	m4_define([_LTDL_TYPE], [])
	LT_OPTION_DEFINE([LTDL_INIT], [installable],
	[m4_define([_LTDL_TYPE], [installable])])
	LT_OPTION_DEFINE([LTDL_INIT], [convenience],
	[m4_define([_LTDL_TYPE], [convenience])])

	# ltsugar.m4 -- libtool m4 base layer. --Autoconf--
	#
	# Copyright (C) 2004-2005, 2007-2008, 2011-2015 Free Software
	# Foundation, Inc.
	# Written by Gary V. Vaughan, 2004
	#
	# This file is free software; the Free Software Foundation gives
	# unlimited permission to copy and/or distribute it, with or without
	# modifications, as long as this notice is preserved.

	# serial 6 ltsugar.m4

	# This is to help aclocal find these macros, as it can't see m4_define.
	AC_DEFUN([LTSUGAR_VERSION], [m4_if([0.1])])


	# lt_join(SEP, ARG1, [ARG2...])
	# -----------------------------
	# Produce ARG1SEPARG2...SEPARGn, omitting [] arguments and their
	# associated separator.
	# Needed until we can rely on m4_join from Autoconf 2.62, since all earlier
	# versions in m4sugar had bugs.
	m4_define([lt_join],
	[m4_if([$#], [1], [],
	[$#], [2], [[$2]],
	[m4_if([$2], [], [], [[$2]_])$0([$1], m4_shift(m4_shift($@)))])])
	m4_define([_lt_join],
	[m4_if([$#$2], [2], [],
	[m4_if([$2], [], [], [[$1$2]])$0([$1], m4_shift(m4_shift($@)))])])


	# lt_car(LIST)
	# lt_cdr(LIST)
	# ------------
	# Manipulate m4 lists.
	# These macros are necessary as long as will still need to support
	# Autoconf-2.59, which quotes differently.
	m4_define([lt_car], [[$1]])
	m4_define([lt_cdr],
	[m4_if([$#], 0, [m4_fatal([$0: cannot be called without arguments])],
	[$#], 1, [],
	[m4_dquote(m4_shift($@))])])
	m4_define([lt_unquote], $1)


	# lt_append(MACRO-NAME, STRING, [SEPARATOR])
	# ------------------------------------------
	# Redefine MACRO-NAME to hold its former content plus 'SEPARATOR''STRING'.
	# Note that neither SEPARATOR nor STRING are expanded; they are appended
	# to MACRO-NAME as is (leaving the expansion for when MACRO-NAME is invoked).
	# No SEPARATOR is output if MACRO-NAME was previously undefined (different
	# than defined and empty).
	#
	# This macro is needed until we can rely on Autoconf 2.62, since earlier
	# versions of m4sugar mistakenly expanded SEPARATOR but not STRING.
	m4_define([lt_append],
	[m4_define([$1],
	m4_ifdef([$1], [m4_defn([$1])[$3]])[$2])])



	# lt_combine(SEP, PREFIX-LIST, INFIX, SUFFIX1, [SUFFIX2...])
	# ----------------------------------------------------------
	# Produce a SEP delimited list of all paired combinations of elements of
	# PREFIX-LIST with SUFFIX1 through SUFFIXn. Each element of the list
	# has the form PREFIXmINFIXSUFFIXn.
	# Needed until we can rely on m4_combine added in Autoconf 2.62.
	m4_define([lt_combine],
	[m4_if(m4_eval([$# > 3]), [1],
	[m4_pushdef([_Lt_sep], [m4_define([_Lt_sep], m4_defn([lt_car]))])]]dnl
	[[m4_foreach([_Lt_prefix], [$2],
	[m4_foreach([_Lt_suffix],
	]m4_dquote(m4_dquote(m4_shift(m4_shift(m4_shift($@)))))[,
	[_Lt_sep([$1])[]m4_defn([_Lt_prefix])[$3]m4_defn([_Lt_suffix])])])])])


	# lt_if_append_uniq(MACRO-NAME, VARNAME, [SEPARATOR], [UNIQ], [NOT-UNIQ])
	# -----------------------------------------------------------------------
	# Iff MACRO-NAME does not yet contain VARNAME, then append it (delimited
	# by SEPARATOR if supplied) and expand UNIQ, else NOT-UNIQ.
	m4_define([lt_if_append_uniq],
	[m4_ifdef([$1],
	[m4_if(m4_index([$3]m4_defn([$1])[$3], [$3$2$3]), [-1],
	[lt_append([$1], [$2], [$3])$4],
	[$5])],
	[lt_append([$1], [$2], [$3])$4])])


	# lt_dict_add(DICT, KEY, VALUE)
	# -----------------------------
	m4_define([lt_dict_add],
	[m4_define([$1($2)], [$3])])


	# lt_dict_add_subkey(DICT, KEY, SUBKEY, VALUE)
	# --------------------------------------------
	m4_define([lt_dict_add_subkey],
	[m4_define([$1($2:$3)], [$4])])


	# lt_dict_fetch(DICT, KEY, [SUBKEY])
	# ----------------------------------
	m4_define([lt_dict_fetch],
	[m4_ifval([$3],
	m4_ifdef([$1($2:$3)], [m4_defn([$1($2:$3)])]),
	m4_ifdef([$1($2)], [m4_defn([$1($2)])]))])


	# lt_if_dict_fetch(DICT, KEY, [SUBKEY], VALUE, IF-TRUE, [IF-FALSE])
	# -----------------------------------------------------------------
	m4_define([lt_if_dict_fetch],
	[m4_if(lt_dict_fetch([$1], [$2], [$3]), [$4],
	[$5],
	[$6])])


	# lt_dict_filter(DICT, [SUBKEY], VALUE, [SEPARATOR], KEY, [...])
	# --------------------------------------------------------------
	m4_define([lt_dict_filter],
	[m4_if([$5], [], [],
	[lt_join(m4_quote(m4_default([$4], [[, ]])),
	lt_unquote(m4_split(m4_normalize(m4_foreach(_Lt_key, lt_car([m4_shiftn(4, $@)]),
	[lt_if_dict_fetch([$1], _Lt_key, [$2], [$3], [_Lt_key ])])))))])[]dnl
	])

	# ltversion.m4 -- version numbers -- Autoconf --
	#
	# Copyright (C) 2004, 2011-2015 Free Software Foundation, Inc.
	# Written by Scott James Remnant, 2004
	#
	# This file is free software; the Free Software Foundation gives
	# unlimited permission to copy and/or distribute it, with or without
	# modifications, as long as this notice is preserved.

	# @configure_input@

	# serial 4179 ltversion.m4
	# This file is part of GNU Libtool

	m4_define([LT_PACKAGE_VERSION], [2.4.6])
	m4_define([LT_PACKAGE_REVISION], [2.4.6])

	AC_DEFUN([LTVERSION_VERSION],
	[macro_version='2.4.6'
	macro_revision='2.4.6'
	_LT_DECL(, macro_version, 0, [Which release of libtool.m4 was used?])
	_LT_DECL(, macro_revision, 0)
	])

	# lt~obsolete.m4 -- aclocal satisfying obsolete definitions. --Autoconf--
	#
	# Copyright (C) 2004-2005, 2007, 2009, 2011-2015 Free Software
	# Foundation, Inc.
	# Written by Scott James Remnant, 2004.
	#
	# This file is free software; the Free Software Foundation gives
	# unlimited permission to copy and/or distribute it, with or without
	# modifications, as long as this notice is preserved.

	# serial 5 lt~obsolete.m4

	# These exist entirely to fool aclocal when bootstrapping libtool.
	#
	# In the past libtool.m4 has provided macros via AC_DEFUN (or AU_DEFUN),
	# which have later been changed to m4_define as they aren't part of the
	# exported API, or moved to Autoconf or Automake where they belong.
	#
	# The trouble is, aclocal is a bit thick. It'll see the old AC_DEFUN
	# in /usr/share/aclocal/libtool.m4 and remember it, then when it sees us
	# using a macro with the same name in our local m4/libtool.m4 it'll
	# pull the old libtool.m4 in (it doesn't see our shiny new m4_define
	# and doesn't know about Autoconf macros at all.)
	#
	# So we provide this file, which has a silly filename so it's always
	# included after everything else. This provides aclocal with the
	# AC_DEFUNs it wants, but when m4 processes it, it doesn't do anything
	# because those macros already exist, or will be overwritten later.
	# We use AC_DEFUN over AU_DEFUN for compatibility with aclocal-1.6.
	#
	# Anytime we withdraw an AC_DEFUN or AU_DEFUN, remember to add it here.
	# Yes, that means every name once taken will need to remain here until
	# we give up compatibility with versions before 1.7, at which point
	# we need to keep only those names which we still refer to.

	# This is to help aclocal find these macros, as it can't see m4_define.
	AC_DEFUN([LTOBSOLETE_VERSION], [m4_if([1])])

	m4_ifndef([AC_LIBTOOL_LINKER_OPTION], [AC_DEFUN([AC_LIBTOOL_LINKER_OPTION])])
	m4_ifndef([AC_PROG_EGREP], [AC_DEFUN([AC_PROG_EGREP])])
	m4_ifndef([_LT_AC_PROG_ECHO_BACKSLASH], [AC_DEFUN([_LT_AC_PROG_ECHO_BACKSLASH])])
	m4_ifndef([_LT_AC_SHELL_INIT], [AC_DEFUN([_LT_AC_SHELL_INIT])])
	m4_ifndef([_LT_AC_SYS_LIBPATH_AIX], [AC_DEFUN([_LT_AC_SYS_LIBPATH_AIX])])
	m4_ifndef([_LT_PROG_LTMAIN], [AC_DEFUN([_LT_PROG_LTMAIN])])
	m4_ifndef([_LT_AC_TAGVAR], [AC_DEFUN([_LT_AC_TAGVAR])])
	m4_ifndef([AC_LTDL_ENABLE_INSTALL], [AC_DEFUN([AC_LTDL_ENABLE_INSTALL])])
	m4_ifndef([AC_LTDL_PREOPEN], [AC_DEFUN([AC_LTDL_PREOPEN])])
	m4_ifndef([_LT_AC_SYS_COMPILER], [AC_DEFUN([_LT_AC_SYS_COMPILER])])
	m4_ifndef([_LT_AC_LOCK], [AC_DEFUN([_LT_AC_LOCK])])
	m4_ifndef([AC_LIBTOOL_SYS_OLD_ARCHIVE], [AC_DEFUN([AC_LIBTOOL_SYS_OLD_ARCHIVE])])
	m4_ifndef([_LT_AC_TRY_DLOPEN_SELF], [AC_DEFUN([_LT_AC_TRY_DLOPEN_SELF])])
	m4_ifndef([AC_LIBTOOL_PROG_CC_C_O], [AC_DEFUN([AC_LIBTOOL_PROG_CC_C_O])])
	m4_ifndef([AC_LIBTOOL_SYS_HARD_LINK_LOCKS], [AC_DEFUN([AC_LIBTOOL_SYS_HARD_LINK_LOCKS])])
	m4_ifndef([AC_LIBTOOL_OBJDIR], [AC_DEFUN([AC_LIBTOOL_OBJDIR])])
	m4_ifndef([AC_LTDL_OBJDIR], [AC_DEFUN([AC_LTDL_OBJDIR])])
	m4_ifndef([AC_LIBTOOL_PROG_LD_HARDCODE_LIBPATH], [AC_DEFUN([AC_LIBTOOL_PROG_LD_HARDCODE_LIBPATH])])
	m4_ifndef([AC_LIBTOOL_SYS_LIB_STRIP], [AC_DEFUN([AC_LIBTOOL_SYS_LIB_STRIP])])
	m4_ifndef([AC_PATH_MAGIC], [AC_DEFUN([AC_PATH_MAGIC])])
	m4_ifndef([AC_PROG_LD_GNU], [AC_DEFUN([AC_PROG_LD_GNU])])
	m4_ifndef([AC_PROG_LD_RELOAD_FLAG], [AC_DEFUN([AC_PROG_LD_RELOAD_FLAG])])
	m4_ifndef([AC_DEPLIBS_CHECK_METHOD], [AC_DEFUN([AC_DEPLIBS_CHECK_METHOD])])
	m4_ifndef([AC_LIBTOOL_PROG_COMPILER_NO_RTTI], [AC_DEFUN([AC_LIBTOOL_PROG_COMPILER_NO_RTTI])])
	m4_ifndef([AC_LIBTOOL_SYS_GLOBAL_SYMBOL_PIPE], [AC_DEFUN([AC_LIBTOOL_SYS_GLOBAL_SYMBOL_PIPE])])
	m4_ifndef([AC_LIBTOOL_PROG_COMPILER_PIC], [AC_DEFUN([AC_LIBTOOL_PROG_COMPILER_PIC])])
	m4_ifndef([AC_LIBTOOL_PROG_LD_SHLIBS], [AC_DEFUN([AC_LIBTOOL_PROG_LD_SHLIBS])])
	m4_ifndef([AC_LIBTOOL_POSTDEP_PREDEP], [AC_DEFUN([AC_LIBTOOL_POSTDEP_PREDEP])])
	m4_ifndef([LT_AC_PROG_EGREP], [AC_DEFUN([LT_AC_PROG_EGREP])])
	m4_ifndef([LT_AC_PROG_SED], [AC_DEFUN([LT_AC_PROG_SED])])
	m4_ifndef([_LT_CC_BASENAME], [AC_DEFUN([_LT_CC_BASENAME])])
	m4_ifndef([_LT_COMPILER_BOILERPLATE], [AC_DEFUN([_LT_COMPILER_BOILERPLATE])])
	m4_ifndef([_LT_LINKER_BOILERPLATE], [AC_DEFUN([_LT_LINKER_BOILERPLATE])])
	m4_ifndef([_AC_PROG_LIBTOOL], [AC_DEFUN([_AC_PROG_LIBTOOL])])
	m4_ifndef([AC_LIBTOOL_SETUP], [AC_DEFUN([AC_LIBTOOL_SETUP])])
	m4_ifndef([_LT_AC_CHECK_DLFCN], [AC_DEFUN([_LT_AC_CHECK_DLFCN])])
	m4_ifndef([AC_LIBTOOL_SYS_DYNAMIC_LINKER], [AC_DEFUN([AC_LIBTOOL_SYS_DYNAMIC_LINKER])])
	m4_ifndef([_LT_AC_TAGCONFIG], [AC_DEFUN([_LT_AC_TAGCONFIG])])
	m4_ifndef([AC_DISABLE_FAST_INSTALL], [AC_DEFUN([AC_DISABLE_FAST_INSTALL])])
	m4_ifndef([_LT_AC_LANG_CXX], [AC_DEFUN([_LT_AC_LANG_CXX])])
	m4_ifndef([_LT_AC_LANG_F77], [AC_DEFUN([_LT_AC_LANG_F77])])
	m4_ifndef([_LT_AC_LANG_GCJ], [AC_DEFUN([_LT_AC_LANG_GCJ])])
	m4_ifndef([AC_LIBTOOL_LANG_C_CONFIG], [AC_DEFUN([AC_LIBTOOL_LANG_C_CONFIG])])
	m4_ifndef([_LT_AC_LANG_C_CONFIG], [AC_DEFUN([_LT_AC_LANG_C_CONFIG])])
	m4_ifndef([AC_LIBTOOL_LANG_CXX_CONFIG], [AC_DEFUN([AC_LIBTOOL_LANG_CXX_CONFIG])])
	m4_ifndef([_LT_AC_LANG_CXX_CONFIG], [AC_DEFUN([_LT_AC_LANG_CXX_CONFIG])])
	m4_ifndef([AC_LIBTOOL_LANG_F77_CONFIG], [AC_DEFUN([AC_LIBTOOL_LANG_F77_CONFIG])])
	m4_ifndef([_LT_AC_LANG_F77_CONFIG], [AC_DEFUN([_LT_AC_LANG_F77_CONFIG])])
	m4_ifndef([AC_LIBTOOL_LANG_GCJ_CONFIG], [AC_DEFUN([AC_LIBTOOL_LANG_GCJ_CONFIG])])
	m4_ifndef([_LT_AC_LANG_GCJ_CONFIG], [AC_DEFUN([_LT_AC_LANG_GCJ_CONFIG])])
	m4_ifndef([AC_LIBTOOL_LANG_RC_CONFIG], [AC_DEFUN([AC_LIBTOOL_LANG_RC_CONFIG])])
	m4_ifndef([_LT_AC_LANG_RC_CONFIG], [AC_DEFUN([_LT_AC_LANG_RC_CONFIG])])
	m4_ifndef([AC_LIBTOOL_CONFIG], [AC_DEFUN([AC_LIBTOOL_CONFIG])])
	m4_ifndef([_LT_AC_FILE_LTDLL_C], [AC_DEFUN([_LT_AC_FILE_LTDLL_C])])
	m4_ifndef([_LT_REQUIRED_DARWIN_CHECKS], [AC_DEFUN([_LT_REQUIRED_DARWIN_CHECKS])])
	m4_ifndef([_LT_AC_PROG_CXXCPP], [AC_DEFUN([_LT_AC_PROG_CXXCPP])])
	m4_ifndef([_LT_PREPARE_SED_QUOTE_VARS], [AC_DEFUN([_LT_PREPARE_SED_QUOTE_VARS])])
	m4_ifndef([_LT_PROG_ECHO_BACKSLASH], [AC_DEFUN([_LT_PROG_ECHO_BACKSLASH])])
	m4_ifndef([_LT_PROG_F77], [AC_DEFUN([_LT_PROG_F77])])
	m4_ifndef([_LT_PROG_FC], [AC_DEFUN([_LT_PROG_FC])])
	m4_ifndef([_LT_PROG_CXX], [AC_DEFUN([_LT_PROG_CXX])])

	# pkg.m4 - Macros to locate and utilise pkg-config. -- Autoconf --
	# serial 11 (pkg-config-0.29.1)

	dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
	dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
	dnl
	dnl This program is free software; you can redistribute it and/or modify
	dnl it under the terms of the GNU General Public License as published by
	dnl the Free Software Foundation; either version 2 of the License, or
	dnl (at your option) any later version.
	dnl
	dnl This program is distributed in the hope that it will be useful, but
	dnl WITHOUT ANY WARRANTY; without even the implied warranty of
	dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	dnl General Public License for more details.
	dnl
	dnl You should have received a copy of the GNU General Public License
	dnl along with this program; if not, write to the Free Software
	dnl Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
	dnl 02111-1307, USA.
	dnl
	dnl As a special exception to the GNU General Public License, if you
	dnl distribute this file as part of a program that contains a
	dnl configuration script generated by Autoconf, you may include it under
	dnl the same distribution terms that you use for the rest of that
	dnl program.

	dnl PKG_PREREQ(MIN-VERSION)
	dnl -----------------------
	dnl Since: 0.29
	dnl
	dnl Verify that the version of the pkg-config macros are at least
	dnl MIN-VERSION. Unlike PKG_PROG_PKG_CONFIG, which checks the user's
	dnl installed version of pkg-config, this checks the developer's version
	dnl of pkg.m4 when generating configure.
	dnl
	dnl To ensure that this macro is defined, also add:
	dnl m4_ifndef([PKG_PREREQ],
	dnl [m4_fatal([must install pkg-config 0.29 or later before running autoconf/autogen])])
	dnl
	dnl See the "Since" comment for each macro you use to see what version
	dnl of the macros you require.
	m4_defun([PKG_PREREQ],
	[m4_define([PKG_MACROS_VERSION], [0.29.1])
	m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1,
	[m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])])
	])dnl PKG_PREREQ

	dnl PKG_PROG_PKG_CONFIG([MIN-VERSION])
	dnl ----------------------------------
	dnl Since: 0.16
	dnl
	dnl Search for the pkg-config tool and set the PKG_CONFIG variable to
	dnl first found in the path. Checks that the version of pkg-config found
	dnl is at least MIN-VERSION. If MIN-VERSION is not specified, 0.9.0 is
	dnl used since that's the first version where most current features of
	dnl pkg-config existed.
	AC_DEFUN([PKG_PROG_PKG_CONFIG],
	[m4_pattern_forbid([^_?PKG_[A-Z_]+$])
	m4_pattern_allow([^PKG_CONFIG(_(PATH\|LIBDIR\|SYSROOT_DIR\|ALLOW_SYSTEM_(CFLAGS\|LIBS)))?$])
	m4_pattern_allow([^PKG_CONFIG_(DISABLE_UNINSTALLED\|TOP_BUILD_DIR\|DEBUG_SPEW)$])
	AC_ARG_VAR([PKG_CONFIG], [path to pkg-config utility])
	AC_ARG_VAR([PKG_CONFIG_PATH], [directories to add to pkg-config's search path])
	AC_ARG_VAR([PKG_CONFIG_LIBDIR], [path overriding pkg-config's built-in search path])

	if test "x$ac_cv_env_PKG_CONFIG_set" != "xset"; then
	AC_PATH_TOOL([PKG_CONFIG], [pkg-config])
	fi
	if test -n "$PKG_CONFIG"; then
	_pkg_min_version=m4_default([$1], [0.9.0])
	AC_MSG_CHECKING([pkg-config is at least version $_pkg_min_version])
	if $PKG_CONFIG --atleast-pkgconfig-version $_pkg_min_version; then
	AC_MSG_RESULT([yes])
	else
	AC_MSG_RESULT([no])
	PKG_CONFIG=""
	fi
	fi[]dnl
	])dnl PKG_PROG_PKG_CONFIG

	dnl PKG_CHECK_EXISTS(MODULES, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
	dnl -------------------------------------------------------------------
	dnl Since: 0.18
	dnl
	dnl Check to see whether a particular set of modules exists. Similar to
	dnl PKG_CHECK_MODULES(), but does not set variables or print errors.
	dnl
	dnl Please remember that m4 expands AC_REQUIRE([PKG_PROG_PKG_CONFIG])
	dnl only at the first occurence in configure.ac, so if the first place
	dnl it's called might be skipped (such as if it is within an "if", you
	dnl have to call PKG_CHECK_EXISTS manually
	AC_DEFUN([PKG_CHECK_EXISTS],
	[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
	if test -n "$PKG_CONFIG" && \
	AC_RUN_LOG([$PKG_CONFIG --exists --print-errors "$1"]); then
	m4_default([$2], [:])
	m4_ifvaln([$3], [else
	$3])dnl
	fi])

	dnl _PKG_CONFIG([VARIABLE], [COMMAND], [MODULES])
	dnl ---------------------------------------------
	dnl Internal wrapper calling pkg-config via PKG_CONFIG and setting
	dnl pkg_failed based on the result.
	m4_define([_PKG_CONFIG],
	[if test -n "$$1"; then
	pkg_cv_[]$1="$$1"
	elif test -n "$PKG_CONFIG"; then
	PKG_CHECK_EXISTS([$3],
	[pkg_cv_[]$1=`$PKG_CONFIG --[]$2 "$3" 2>/dev/null`
	test "x$?" != "x0" && pkg_failed=yes ],
	[pkg_failed=yes])
	else
	pkg_failed=untried
	fi[]dnl
	])dnl _PKG_CONFIG

	dnl _PKG_SHORT_ERRORS_SUPPORTED
	dnl ---------------------------
	dnl Internal check to see if pkg-config supports short errors.
	AC_DEFUN([_PKG_SHORT_ERRORS_SUPPORTED],
	[AC_REQUIRE([PKG_PROG_PKG_CONFIG])
	if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
	_pkg_short_errors_supported=yes
	else
	_pkg_short_errors_supported=no
	fi[]dnl
	])dnl _PKG_SHORT_ERRORS_SUPPORTED


	dnl PKG_CHECK_MODULES(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND],
	dnl [ACTION-IF-NOT-FOUND])
	dnl --------------------------------------------------------------
	dnl Since: 0.4.0
	dnl
	dnl Note that if there is a possibility the first call to
	dnl PKG_CHECK_MODULES might not happen, you should be sure to include an
	dnl explicit call to PKG_PROG_PKG_CONFIG in your configure.ac
	AC_DEFUN([PKG_CHECK_MODULES],
	[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
	AC_ARG_VAR([$1][_CFLAGS], [C compiler flags for $1, overriding pkg-config])dnl
	AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl

	pkg_failed=no
	AC_MSG_CHECKING([for $1])

	_PKG_CONFIG([$1][_CFLAGS], [cflags], [$2])
	_PKG_CONFIG([$1][_LIBS], [libs], [$2])

	m4_define([_PKG_TEXT], [Alternatively, you may set the environment variables $1[]_CFLAGS
	and $1[]_LIBS to avoid the need to call pkg-config.
	See the pkg-config man page for more details.])

	if test $pkg_failed = yes; then
	AC_MSG_RESULT([no])
	_PKG_SHORT_ERRORS_SUPPORTED
	if test $_pkg_short_errors_supported = yes; then
	$1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
	else
	$1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
	fi
	# Put the nasty error message in config.log where it belongs
	echo "$$1[]_PKG_ERRORS" >&AS_MESSAGE_LOG_FD

	m4_default([$4], [AC_MSG_ERROR(
	[Package requirements ($2) were not met:

	$$1_PKG_ERRORS

	Consider adjusting the PKG_CONFIG_PATH environment variable if you
	installed software in a non-standard prefix.

	_PKG_TEXT])[]dnl
	])
	elif test $pkg_failed = untried; then
	AC_MSG_RESULT([no])
	m4_default([$4], [AC_MSG_FAILURE(
	[The pkg-config script could not be found or is too old. Make sure it
	is in your PATH or set the PKG_CONFIG environment variable to the full
	path to pkg-config.

	_PKG_TEXT

	To get pkg-config, see <http://pkg-config.freedesktop.org/>.])[]dnl
	])
	else
	$1[]_CFLAGS=$pkg_cv_[]$1[]_CFLAGS
	$1[]_LIBS=$pkg_cv_[]$1[]_LIBS
	AC_MSG_RESULT([yes])
	$3
	fi[]dnl
	])dnl PKG_CHECK_MODULES


	dnl PKG_CHECK_MODULES_STATIC(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND],
	dnl [ACTION-IF-NOT-FOUND])
	dnl ---------------------------------------------------------------------
	dnl Since: 0.29
	dnl
	dnl Checks for existence of MODULES and gathers its build flags with
	dnl static libraries enabled. Sets VARIABLE-PREFIX_CFLAGS from --cflags
	dnl and VARIABLE-PREFIX_LIBS from --libs.
	dnl
	dnl Note that if there is a possibility the first call to
	dnl PKG_CHECK_MODULES_STATIC might not happen, you should be sure to
	dnl include an explicit call to PKG_PROG_PKG_CONFIG in your
	dnl configure.ac.
	AC_DEFUN([PKG_CHECK_MODULES_STATIC],
	[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
	_save_PKG_CONFIG=$PKG_CONFIG
	PKG_CONFIG="$PKG_CONFIG --static"
	PKG_CHECK_MODULES($@)
	PKG_CONFIG=$_save_PKG_CONFIG[]dnl
	])dnl PKG_CHECK_MODULES_STATIC


	dnl PKG_INSTALLDIR([DIRECTORY])
	dnl -------------------------
	dnl Since: 0.27
	dnl
	dnl Substitutes the variable pkgconfigdir as the location where a module
	dnl should install pkg-config .pc files. By default the directory is
	dnl $libdir/pkgconfig, but the default can be changed by passing
	dnl DIRECTORY. The user can override through the --with-pkgconfigdir
	dnl parameter.
	AC_DEFUN([PKG_INSTALLDIR],
	[m4_pushdef([pkg_default], [m4_default([$1], ['${libdir}/pkgconfig'])])
	m4_pushdef([pkg_description],
	[pkg-config installation directory @<:@]pkg_default[@:>@])
	AC_ARG_WITH([pkgconfigdir],
	[AS_HELP_STRING([--with-pkgconfigdir], pkg_description)],,
	[with_pkgconfigdir=]pkg_default)
	AC_SUBST([pkgconfigdir], [$with_pkgconfigdir])
	m4_popdef([pkg_default])
	m4_popdef([pkg_description])
	])dnl PKG_INSTALLDIR


	dnl PKG_NOARCH_INSTALLDIR([DIRECTORY])
	dnl --------------------------------
	dnl Since: 0.27
	dnl
	dnl Substitutes the variable noarch_pkgconfigdir as the location where a
	dnl module should install arch-independent pkg-config .pc files. By
	dnl default the directory is $datadir/pkgconfig, but the default can be
	dnl changed by passing DIRECTORY. The user can override through the
	dnl --with-noarch-pkgconfigdir parameter.
	AC_DEFUN([PKG_NOARCH_INSTALLDIR],
	[m4_pushdef([pkg_default], [m4_default([$1], ['${datadir}/pkgconfig'])])
	m4_pushdef([pkg_description],
	[pkg-config arch-independent installation directory @<:@]pkg_default[@:>@])
	AC_ARG_WITH([noarch-pkgconfigdir],
	[AS_HELP_STRING([--with-noarch-pkgconfigdir], pkg_description)],,
	[with_noarch_pkgconfigdir=]pkg_default)
	AC_SUBST([noarch_pkgconfigdir], [$with_noarch_pkgconfigdir])
	m4_popdef([pkg_default])
	m4_popdef([pkg_description])
	])dnl PKG_NOARCH_INSTALLDIR


	dnl PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE,
	dnl [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
	dnl -------------------------------------------
	dnl Since: 0.28
	dnl
	dnl Retrieves the value of the pkg-config variable for the given module.
	AC_DEFUN([PKG_CHECK_VAR],
	[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
	AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl

	_PKG_CONFIG([$1], [variable="][$3]["], [$2])
	AS_VAR_COPY([$1], [pkg_cv_][$1])

	AS_VAR_IF([$1], [""], [$5], [$4])dnl
	])dnl PKG_CHECK_VAR

	dnl PKG_WITH_MODULES(VARIABLE-PREFIX, MODULES,
	dnl [ACTION-IF-FOUND],[ACTION-IF-NOT-FOUND],
	dnl [DESCRIPTION], [DEFAULT])
	dnl ------------------------------------------
	dnl
	dnl Prepare a "--with-" configure option using the lowercase
	dnl [VARIABLE-PREFIX] name, merging the behaviour of AC_ARG_WITH and
	dnl PKG_CHECK_MODULES in a single macro.
	AC_DEFUN([PKG_WITH_MODULES],
	[
	m4_pushdef([with_arg], m4_tolower([$1]))

	m4_pushdef([description],
	[m4_default([$5], [build with ]with_arg[ support])])

	m4_pushdef([def_arg], [m4_default([$6], [auto])])
	m4_pushdef([def_action_if_found], [AS_TR_SH([with_]with_arg)=yes])
	m4_pushdef([def_action_if_not_found], [AS_TR_SH([with_]with_arg)=no])

	m4_case(def_arg,
	[yes],[m4_pushdef([with_without], [--without-]with_arg)],
	[m4_pushdef([with_without],[--with-]with_arg)])

	AC_ARG_WITH(with_arg,
	AS_HELP_STRING(with_without, description[ @<:@default=]def_arg[@:>@]),,
	[AS_TR_SH([with_]with_arg)=def_arg])

	AS_CASE([$AS_TR_SH([with_]with_arg)],
	[yes],[PKG_CHECK_MODULES([$1],[$2],$3,$4)],
	[auto],[PKG_CHECK_MODULES([$1],[$2],
	[m4_n([def_action_if_found]) $3],
	[m4_n([def_action_if_not_found]) $4])])

	m4_popdef([with_arg])
	m4_popdef([description])
	m4_popdef([def_arg])

	])dnl PKG_WITH_MODULES

	dnl PKG_HAVE_WITH_MODULES(VARIABLE-PREFIX, MODULES,
	dnl [DESCRIPTION], [DEFAULT])
	dnl -----------------------------------------------
	dnl
	dnl Convenience macro to trigger AM_CONDITIONAL after PKG_WITH_MODULES
	dnl check._[VARIABLE-PREFIX] is exported as make variable.
	AC_DEFUN([PKG_HAVE_WITH_MODULES],
	[
	PKG_WITH_MODULES([$1],[$2],,,[$3],[$4])

	AM_CONDITIONAL([HAVE_][$1],
	[test "$AS_TR_SH([with_]m4_tolower([$1]))" = "yes"])
	])dnl PKG_HAVE_WITH_MODULES

	dnl PKG_HAVE_DEFINE_WITH_MODULES(VARIABLE-PREFIX, MODULES,
	dnl [DESCRIPTION], [DEFAULT])
	dnl ------------------------------------------------------
	dnl
	dnl Convenience macro to run AM_CONDITIONAL and AC_DEFINE after
	dnl PKG_WITH_MODULES check. HAVE_[VARIABLE-PREFIX] is exported as make
	dnl and preprocessor variable.
	AC_DEFUN([PKG_HAVE_DEFINE_WITH_MODULES],
	[
	PKG_HAVE_WITH_MODULES([$1],[$2],[$3],[$4])

	AS_IF([test "$AS_TR_SH([with_]m4_tolower([$1]))" = "yes"],
	[AC_DEFINE([HAVE_][$1], 1, [Enable ]m4_tolower([$1])[ support])])
	])dnl PKG_HAVE_DEFINE_WITH_MODULES

	# AM_CONDITIONAL -- Autoconf --

	-# Copyright (C) 1997-2017 Free Software Foundation, Inc.
	+# Copyright (C) 1997-2018 Free Software Foundation, Inc.
	#
	# This file is free software; the Free Software Foundation
	# gives unlimited permission to copy and/or distribute it,
	# with or without modifications, as long as this notice is preserved.

	# AM_CONDITIONAL(NAME, SHELL-CONDITION)
	# -------------------------------------
	# Define a conditional.
	AC_DEFUN([AM_CONDITIONAL],
	[AC_PREREQ([2.52])dnl
	m4_if([$1], [TRUE], [AC_FATAL([$0: invalid condition: $1])],
	[$1], [FALSE], [AC_FATAL([$0: invalid condition: $1])])dnl
	AC_SUBST([$1_TRUE])dnl
	AC_SUBST([$1_FALSE])dnl
	_AM_SUBST_NOTMAKE([$1_TRUE])dnl
	_AM_SUBST_NOTMAKE([$1_FALSE])dnl
	m4_define([_AM_COND_VALUE_$1], [$2])dnl
	if $2; then
	$1_TRUE=
	$1_FALSE='#'
	else
	$1_TRUE='#'
	$1_FALSE=
	fi
	AC_CONFIG_COMMANDS_PRE(
	[if test -z "${$1_TRUE}" && test -z "${$1_FALSE}"; then
	AC_MSG_ERROR([[conditional "$1" was never defined.
	Usually this means the macro was only invoked conditionally.]])
	fi])])

	-# Copyright (C) 2006-2017 Free Software Foundation, Inc.
	+# Copyright (C) 2006-2018 Free Software Foundation, Inc.
	#
	# This file is free software; the Free Software Foundation
	# gives unlimited permission to copy and/or distribute it,
	# with or without modifications, as long as this notice is preserved.

	# _AM_SUBST_NOTMAKE(VARIABLE)
	# ---------------------------
	# Prevent Automake from outputting VARIABLE = @VARIABLE@ in Makefile.in.
	# This macro is traced by Automake.
	AC_DEFUN([_AM_SUBST_NOTMAKE])

	# AM_SUBST_NOTMAKE(VARIABLE)
	# --------------------------
	# Public sister of _AM_SUBST_NOTMAKE.
	AC_DEFUN([AM_SUBST_NOTMAKE], [_AM_SUBST_NOTMAKE($@)])

	Index: head/contrib/unbound/cachedb/cachedb.c
	===================================================================
	--- head/contrib/unbound/cachedb/cachedb.c (revision 349719)
	+++ head/contrib/unbound/cachedb/cachedb.c (revision 349720)
	@@ -1,810 +1,823 @@
	/*
	* cachedb/cachedb.c - cache from a database external to the program module
	*
	* Copyright (c) 2016, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains a module that uses an external database to cache
	* dns responses.
	*/

	#include "config.h"
	#ifdef USE_CACHEDB
	#include "cachedb/cachedb.h"
	#include "cachedb/redis.h"
	#include "util/regional.h"
	#include "util/net_help.h"
	#include "util/config_file.h"
	#include "util/data/msgreply.h"
	#include "util/data/msgencode.h"
	#include "services/cache/dns.h"
	#include "validator/val_neg.h"
	#include "validator/val_secalgo.h"
	#include "iterator/iter_utils.h"
	#include "sldns/parseutil.h"
	#include "sldns/wire2str.h"
	#include "sldns/sbuffer.h"

	/* header file for htobe64 */
	#ifdef HAVE_ENDIAN_H
	# include <endian.h>
	#endif
	#ifdef HAVE_SYS_ENDIAN_H
	# include <sys/endian.h>
	#endif
	#ifdef HAVE_LIBKERN_OSBYTEORDER_H
	/* In practice this is specific to MacOS X. We assume it doesn't have
	* htobe64/be64toh but has alternatives with a different name. */
	# include <libkern/OSByteOrder.h>
	# define htobe64(x) OSSwapHostToBigInt64(x)
	# define be64toh(x) OSSwapBigToHostInt64(x)
	#endif

	+/* Some compilers do not define __BYTE_ORDER__, like IBM XLC on AIX */
	+#ifndef be64toh
	+#if defined(__sun) \|\| defined(_AIX)
	+# if __BIG_ENDIAN__
	+# define be64toh(n) (n)
	+# define htobe64(n) (n)
	+# else
	+# define be64toh(n) (((uint64_t)htonl((n) & 0xFFFFFFFF) << 32) \| htonl((n) >> 32))
	+# define htobe64(n) (((uint64_t)htonl((n) & 0xFFFFFFFF) << 32) \| htonl((n) >> 32))
	+# endif
	+#endif
	+#endif /* be64toh */
	+
	/** the unit test testframe for cachedb, its module state contains
	* a cache for a couple queries (in memory). */
	struct testframe_moddata {
	/** lock for mutex */
	lock_basic_type lock;
	/** key for single stored data element, NULL if none */
	char* stored_key;
	/** data for single stored data element, NULL if none */
	uint8_t* stored_data;
	/** length of stored data */
	size_t stored_datalen;
	};

	static int
	testframe_init(struct module_env* env, struct cachedb_env* cachedb_env)
	{
	struct testframe_moddata* d;
	(void)env;
	verbose(VERB_ALGO, "testframe_init");
	d = (struct testframe_moddata*)calloc(1,
	sizeof(struct testframe_moddata));
	cachedb_env->backend_data = (void*)d;
	if(!cachedb_env->backend_data) {
	log_err("out of memory");
	return 0;
	}
	lock_basic_init(&d->lock);
	lock_protect(&d->lock, d, sizeof(*d));
	return 1;
	}

	static void
	testframe_deinit(struct module_env* env, struct cachedb_env* cachedb_env)
	{
	struct testframe_moddata* d = (struct testframe_moddata*)
	cachedb_env->backend_data;
	(void)env;
	verbose(VERB_ALGO, "testframe_deinit");
	if(!d)
	return;
	lock_basic_destroy(&d->lock);
	free(d->stored_key);
	free(d->stored_data);
	free(d);
	}

	static int
	testframe_lookup(struct module_env* env, struct cachedb_env* cachedb_env,
	char* key, struct sldns_buffer* result_buffer)
	{
	struct testframe_moddata* d = (struct testframe_moddata*)
	cachedb_env->backend_data;
	(void)env;
	verbose(VERB_ALGO, "testframe_lookup of %s", key);
	lock_basic_lock(&d->lock);
	if(d->stored_key && strcmp(d->stored_key, key) == 0) {
	if(d->stored_datalen > sldns_buffer_capacity(result_buffer)) {
	lock_basic_unlock(&d->lock);
	return 0; /* too large */
	}
	verbose(VERB_ALGO, "testframe_lookup found %d bytes",
	(int)d->stored_datalen);
	sldns_buffer_clear(result_buffer);
	sldns_buffer_write(result_buffer, d->stored_data,
	d->stored_datalen);
	sldns_buffer_flip(result_buffer);
	lock_basic_unlock(&d->lock);
	return 1;
	}
	lock_basic_unlock(&d->lock);
	return 0;
	}

	static void
	testframe_store(struct module_env* env, struct cachedb_env* cachedb_env,
	char* key, uint8_t* data, size_t data_len)
	{
	struct testframe_moddata* d = (struct testframe_moddata*)
	cachedb_env->backend_data;
	(void)env;
	lock_basic_lock(&d->lock);
	verbose(VERB_ALGO, "testframe_store %s (%d bytes)", key, (int)data_len);

	/* free old data element (if any) */
	free(d->stored_key);
	d->stored_key = NULL;
	free(d->stored_data);
	d->stored_data = NULL;
	d->stored_datalen = 0;

	d->stored_data = memdup(data, data_len);
	if(!d->stored_data) {
	lock_basic_unlock(&d->lock);
	log_err("out of memory");
	return;
	}
	d->stored_datalen = data_len;
	d->stored_key = strdup(key);
	if(!d->stored_key) {
	free(d->stored_data);
	d->stored_data = NULL;
	d->stored_datalen = 0;
	lock_basic_unlock(&d->lock);
	return;
	}
	lock_basic_unlock(&d->lock);
	/* (key,data) successfully stored */
	}

	/** The testframe backend is for unit tests */
	static struct cachedb_backend testframe_backend = { "testframe",
	testframe_init, testframe_deinit, testframe_lookup, testframe_store
	};

	/** find a particular backend from possible backends */
	static struct cachedb_backend*
	cachedb_find_backend(const char* str)
	{
	#ifdef USE_REDIS
	if(strcmp(str, redis_backend.name) == 0)
	return &redis_backend;
	#endif
	if(strcmp(str, testframe_backend.name) == 0)
	return &testframe_backend;
	/* TODO add more backends here */
	return NULL;
	}

	/** apply configuration to cachedb module 'global' state */
	static int
	cachedb_apply_cfg(struct cachedb_env* cachedb_env, struct config_file* cfg)
	{
	const char* backend_str = cfg->cachedb_backend;

	/* If unspecified we use the in-memory test DB. */
	if(!backend_str)
	backend_str = "testframe";
	cachedb_env->backend = cachedb_find_backend(backend_str);
	if(!cachedb_env->backend) {
	log_err("cachedb: cannot find backend name '%s'", backend_str);
	return 0;
	}

	/* TODO see if more configuration needs to be applied or not */
	return 1;
	}

	int
	cachedb_init(struct module_env* env, int id)
	{
	struct cachedb_env* cachedb_env = (struct cachedb_env*)calloc(1,
	sizeof(struct cachedb_env));
	if(!cachedb_env) {
	log_err("malloc failure");
	return 0;
	}
	env->modinfo[id] = (void*)cachedb_env;
	if(!cachedb_apply_cfg(cachedb_env, env->cfg)) {
	log_err("cachedb: could not apply configuration settings.");
	return 0;
	}
	/* see if a backend is selected */
	if(!cachedb_env->backend \|\| !cachedb_env->backend->name)
	return 1;
	if(!(*cachedb_env->backend->init)(env, cachedb_env)) {
	log_err("cachedb: could not init %s backend",
	cachedb_env->backend->name);
	return 0;
	}
	cachedb_env->enabled = 1;
	return 1;
	}

	void
	cachedb_deinit(struct module_env* env, int id)
	{
	struct cachedb_env* cachedb_env;
	if(!env \|\| !env->modinfo[id])
	return;
	cachedb_env = (struct cachedb_env*)env->modinfo[id];
	/* free contents */
	/* TODO */
	if(cachedb_env->enabled) {
	(*cachedb_env->backend->deinit)(env, cachedb_env);
	}

	free(cachedb_env);
	env->modinfo[id] = NULL;
	}

	/** new query for cachedb */
	static int
	cachedb_new(struct module_qstate* qstate, int id)
	{
	struct cachedb_qstate* iq = (struct cachedb_qstate*)regional_alloc(
	qstate->region, sizeof(struct cachedb_qstate));
	qstate->minfo[id] = iq;
	if(!iq)
	return 0;
	memset(iq, 0, sizeof(*iq));
	/* initialise it */
	/* TODO */

	return 1;
	}

	/**
	* Return an error
	* @param qstate: our query state
	* @param id: module id
	* @param rcode: error code (DNS errcode).
	* @return: 0 for use by caller, to make notation easy, like:
	* return error_response(..).
	*/
	static int
	error_response(struct module_qstate* qstate, int id, int rcode)
	{
	verbose(VERB_QUERY, "return error response %s",
	sldns_lookup_by_id(sldns_rcodes, rcode)?
	sldns_lookup_by_id(sldns_rcodes, rcode)->name:"??");
	qstate->return_rcode = rcode;
	qstate->return_msg = NULL;
	qstate->ext_state[id] = module_finished;
	return 0;
	}

	/**
	* Hash the query name, type, class and dbacess-secret into lookup buffer.
	* @param qstate: query state with query info
	* and env->cfg with secret.
	* @param buf: returned buffer with hash to lookup
	* @param len: length of the buffer.
	*/
	static void
	calc_hash(struct module_qstate* qstate, char* buf, size_t len)
	{
	uint8_t clear[1024];
	size_t clen = 0;
	uint8_t hash[CACHEDB_HASHSIZE/8];
	const char* hex = "0123456789ABCDEF";
	const char* secret = qstate->env->cfg->cachedb_secret ?
	qstate->env->cfg->cachedb_secret : "default";
	size_t i;

	/* copy the hash info into the clear buffer */
	if(clen + qstate->qinfo.qname_len < sizeof(clear)) {
	memmove(clear+clen, qstate->qinfo.qname,
	qstate->qinfo.qname_len);
	clen += qstate->qinfo.qname_len;
	}
	if(clen + 4 < sizeof(clear)) {
	uint16_t t = htons(qstate->qinfo.qtype);
	uint16_t c = htons(qstate->qinfo.qclass);
	memmove(clear+clen, &t, 2);
	memmove(clear+clen+2, &c, 2);
	clen += 4;
	}
	if(secret && secret[0] && clen + strlen(secret) < sizeof(clear)) {
	memmove(clear+clen, secret, strlen(secret));
	clen += strlen(secret);
	}

	/* hash the buffer */
	secalgo_hash_sha256(clear, clen, hash);
	memset(clear, 0, clen);

	/* hex encode output for portability (some online dbs need
	* no nulls, no control characters, and so on) */
	log_assert(len >= sizeof(hash)*2 + 1);
	(void)len;
	for(i=0; i<sizeof(hash); i++) {
	buf[i*2] = hex[(hash[i]&0xf0)>>4];
	buf[i*2+1] = hex[hash[i]&0x0f];
	}
	buf[sizeof(hash)*2] = 0;
	}

	/** convert data from return_msg into the data buffer */
	static int
	prep_data(struct module_qstate* qstate, struct sldns_buffer* buf)
	{
	uint64_t timestamp, expiry;
	size_t oldlim;
	struct edns_data edns;
	memset(&edns, 0, sizeof(edns));
	edns.edns_present = 1;
	edns.bits = EDNS_DO;
	edns.ext_rcode = 0;
	edns.edns_version = EDNS_ADVERTISED_VERSION;
	edns.udp_size = EDNS_ADVERTISED_SIZE;

	if(!qstate->return_msg \|\| !qstate->return_msg->rep)
	return 0;
	/* We don't store the reply if its TTL is 0 unless serve-expired is
	* enabled. Such a reply won't be reusable and simply be a waste for
	* the backend. It's also compatible with the default behavior of
	* dns_cache_store_msg(). */
	if(qstate->return_msg->rep->ttl == 0 &&
	!qstate->env->cfg->serve_expired)
	return 0;
	if(verbosity >= VERB_ALGO)
	log_dns_msg("cachedb encoding", &qstate->return_msg->qinfo,
	qstate->return_msg->rep);
	if(!reply_info_answer_encode(&qstate->return_msg->qinfo,
	qstate->return_msg->rep, 0, qstate->query_flags,
	buf, 0, 1, qstate->env->scratch, 65535, &edns, 1, 0))
	return 0;

	/* TTLs in the return_msg are relative to time(0) so we have to
	* store that, we also store the smallest ttl in the packet+time(0)
	* as the packet expiry time */
	/* qstate->return_msg->rep->ttl contains that relative shortest ttl */
	timestamp = (uint64_t)*qstate->env->now;
	expiry = timestamp + (uint64_t)qstate->return_msg->rep->ttl;
	timestamp = htobe64(timestamp);
	expiry = htobe64(expiry);
	oldlim = sldns_buffer_limit(buf);
	if(oldlim + sizeof(timestamp)+sizeof(expiry) >=
	sldns_buffer_capacity(buf))
	return 0; /* doesn't fit. */
	sldns_buffer_set_limit(buf, oldlim + sizeof(timestamp)+sizeof(expiry));
	sldns_buffer_write_at(buf, oldlim, &timestamp, sizeof(timestamp));
	sldns_buffer_write_at(buf, oldlim+sizeof(timestamp), &expiry,
	sizeof(expiry));

	return 1;
	}

	/** check expiry, return true if matches OK */
	static int
	good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
	{
	uint64_t expiry;
	/* the expiry time is the last bytes of the buffer */
	if(sldns_buffer_limit(buf) < sizeof(expiry))
	return 0;
	sldns_buffer_read_at(buf, sldns_buffer_limit(buf)-sizeof(expiry),
	&expiry, sizeof(expiry));
	expiry = be64toh(expiry);

	if((time_t)expiry < *qstate->env->now &&
	!qstate->env->cfg->serve_expired)
	return 0;

	return 1;
	}

	/* Adjust the TTL of the given RRset by 'subtract'. If 'subtract' is
	* negative, set the TTL to 0. */
	static void
	packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract)
	{
	size_t i;
	size_t total = data->count + data->rrsig_count;
	if(subtract >= 0 && data->ttl > subtract)
	data->ttl -= subtract;
	else data->ttl = 0;
	for(i=0; i<total; i++) {
	if(subtract >= 0 && data->rr_ttl[i] > subtract)
	data->rr_ttl[i] -= subtract;
	else data->rr_ttl[i] = 0;
	}
	}

	/* Adjust the TTL of a DNS message and its RRs by 'adjust'. If 'adjust' is
	* negative, set the TTLs to 0. */
	static void
	adjust_msg_ttl(struct dns_msg* msg, time_t adjust)
	{
	size_t i;
	if(adjust >= 0 && msg->rep->ttl > adjust)
	msg->rep->ttl -= adjust;
	else msg->rep->ttl = 0;
	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;

	for(i=0; i<msg->rep->rrset_count; i++) {
	packed_rrset_ttl_subtract((struct packed_rrset_data*)msg->
	rep->rrsets[i]->entry.data, adjust);
	}
	}

	/** convert dns message in buffer to return_msg */
	static int
	parse_data(struct module_qstate* qstate, struct sldns_buffer* buf)
	{
	struct msg_parse* prs;
	struct edns_data edns;
	uint64_t timestamp, expiry;
	time_t adjust;
	size_t lim = sldns_buffer_limit(buf);
	if(lim < LDNS_HEADER_SIZE+sizeof(timestamp)+sizeof(expiry))
	return 0; /* too short */

	/* remove timestamp and expiry from end */
	sldns_buffer_read_at(buf, lim-sizeof(expiry), &expiry, sizeof(expiry));
	sldns_buffer_read_at(buf, lim-sizeof(expiry)-sizeof(timestamp),
	&timestamp, sizeof(timestamp));
	expiry = be64toh(expiry);
	timestamp = be64toh(timestamp);

	/* parse DNS packet */
	regional_free_all(qstate->env->scratch);
	prs = (struct msg_parse*)regional_alloc(qstate->env->scratch,
	sizeof(struct msg_parse));
	if(!prs)
	return 0; /* out of memory */
	memset(prs, 0, sizeof(*prs));
	memset(&edns, 0, sizeof(edns));
	sldns_buffer_set_limit(buf, lim - sizeof(expiry)-sizeof(timestamp));
	if(parse_packet(buf, prs, qstate->env->scratch) != LDNS_RCODE_NOERROR) {
	sldns_buffer_set_limit(buf, lim);
	return 0;
	}
	if(parse_extract_edns(prs, &edns, qstate->env->scratch) !=
	LDNS_RCODE_NOERROR) {
	sldns_buffer_set_limit(buf, lim);
	return 0;
	}

	qstate->return_msg = dns_alloc_msg(buf, prs, qstate->region);
	sldns_buffer_set_limit(buf, lim);
	if(!qstate->return_msg)
	return 0;

	qstate->return_rcode = LDNS_RCODE_NOERROR;

	/* see how much of the TTL expired, and remove it */
	if(*qstate->env->now <= (time_t)timestamp) {
	verbose(VERB_ALGO, "cachedb msg adjust by zero");
	return 1; /* message from the future (clock skew?) */
	}
	adjust = *qstate->env->now - (time_t)timestamp;
	if(qstate->return_msg->rep->ttl < adjust) {
	verbose(VERB_ALGO, "cachedb msg expired");
	/* If serve-expired is enabled, we still use an expired message
	* setting the TTL to 0. */
	if(qstate->env->cfg->serve_expired)
	adjust = -1;
	else
	return 0; /* message expired */
	}
	verbose(VERB_ALGO, "cachedb msg adjusted down by %d", (int)adjust);
	adjust_msg_ttl(qstate->return_msg, adjust);

	/* Similar to the unbound worker, if serve-expired is enabled and
	* the msg would be considered to be expired, mark the state so a
	* refetch will be scheduled. The comparison between 'expiry' and
	* 'now' should be redundant given how these values were calculated,
	* but we check it just in case as does good_expiry_and_qinfo(). */
	if(qstate->env->cfg->serve_expired &&
	(adjust == -1 \|\| (time_t)expiry < *qstate->env->now)) {
	qstate->need_refetch = 1;
	}

	return 1;
	}

	/**
	* Lookup the qstate.qinfo in extcache, store in qstate.return_msg.
	* return true if lookup was successful.
	*/
	static int
	cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie)
	{
	char key[(CACHEDB_HASHSIZE/8)*2+1];
	calc_hash(qstate, key, sizeof(key));

	/* call backend to fetch data for key into scratch buffer */
	if( !(*ie->backend->lookup)(qstate->env, ie, key,
	qstate->env->scratch_buffer)) {
	return 0;
	}

	/* check expiry date and check if query-data matches */
	if( !good_expiry_and_qinfo(qstate, qstate->env->scratch_buffer) ) {
	return 0;
	}

	/* parse dns message into return_msg */
	if( !parse_data(qstate, qstate->env->scratch_buffer) ) {
	return 0;
	}
	return 1;
	}

	/**
	* Store the qstate.return_msg in extcache for key qstate.info
	*/
	static void
	cachedb_extcache_store(struct module_qstate* qstate, struct cachedb_env* ie)
	{
	char key[(CACHEDB_HASHSIZE/8)*2+1];
	calc_hash(qstate, key, sizeof(key));

	/* prepare data in scratch buffer */
	if(!prep_data(qstate, qstate->env->scratch_buffer))
	return;

	/* call backend */
	(*ie->backend->store)(qstate->env, ie, key,
	sldns_buffer_begin(qstate->env->scratch_buffer),
	sldns_buffer_limit(qstate->env->scratch_buffer));
	}

	/**
	* See if unbound's internal cache can answer the query
	*/
	static int
	cachedb_intcache_lookup(struct module_qstate* qstate)
	{
	struct dns_msg* msg;
	msg = dns_cache_lookup(qstate->env, qstate->qinfo.qname,
	qstate->qinfo.qname_len, qstate->qinfo.qtype,
	qstate->qinfo.qclass, qstate->query_flags,
	qstate->region, qstate->env->scratch,
	1 /* no partial messages with only a CNAME */
	);
	if(!msg && qstate->env->neg_cache &&
	iter_qname_indicates_dnssec(qstate->env, &qstate->qinfo)) {
	/* lookup in negative cache; may result in
	* NOERROR/NODATA or NXDOMAIN answers that need validation */
	msg = val_neg_getmsg(qstate->env->neg_cache, &qstate->qinfo,
	qstate->region, qstate->env->rrset_cache,
	qstate->env->scratch_buffer,
	qstate->env->now, 1/add SOA*/, NULL,
	qstate->env->cfg);
	}
	if(!msg)
	return 0;
	/* this is the returned msg */
	qstate->return_rcode = LDNS_RCODE_NOERROR;
	qstate->return_msg = msg;
	return 1;
	}

	/**
	* Store query into the internal cache of unbound.
	*/
	static void
	cachedb_intcache_store(struct module_qstate* qstate)
	{
	uint32_t store_flags = qstate->query_flags;

	if(qstate->env->cfg->serve_expired)
	store_flags \|= DNSCACHE_STORE_ZEROTTL;
	if(!qstate->return_msg)
	return;
	(void)dns_cache_store(qstate->env, &qstate->qinfo,
	qstate->return_msg->rep, 0, qstate->prefetch_leeway, 0,
	qstate->region, store_flags);
	}

	/**
	* Handle a cachedb module event with a query
	* @param qstate: query state (from the mesh), passed between modules.
	* contains qstate->env module environment with global caches and so on.
	* @param iq: query state specific for this module. per-query.
	* @param ie: environment specific for this module. global.
	* @param id: module id.
	*/
	static void
	cachedb_handle_query(struct module_qstate* qstate,
	struct cachedb_qstate* ATTR_UNUSED(iq),
	struct cachedb_env* ie, int id)
	{
	/* check if we are enabled, and skip if so */
	if(!ie->enabled) {
	/* pass request to next module */
	qstate->ext_state[id] = module_wait_module;
	return;
	}

	if(qstate->blacklist \|\| qstate->no_cache_lookup) {
	/* cache is blacklisted or we are instructed from edns to not look */
	/* pass request to next module */
	qstate->ext_state[id] = module_wait_module;
	return;
	}

	/* lookup inside unbound's internal cache */
	if(cachedb_intcache_lookup(qstate)) {
	if(verbosity >= VERB_ALGO) {
	if(qstate->return_msg->rep)
	log_dns_msg("cachedb internal cache lookup",
	&qstate->return_msg->qinfo,
	qstate->return_msg->rep);
	else log_info("cachedb internal cache lookup: rcode %s",
	sldns_lookup_by_id(sldns_rcodes, qstate->return_rcode)?
	sldns_lookup_by_id(sldns_rcodes, qstate->return_rcode)->name:"??");
	}
	/* we are done with the query */
	qstate->ext_state[id] = module_finished;
	return;
	}

	/* ask backend cache to see if we have data */
	if(cachedb_extcache_lookup(qstate, ie)) {
	if(verbosity >= VERB_ALGO)
	log_dns_msg(ie->backend->name,
	&qstate->return_msg->qinfo,
	qstate->return_msg->rep);
	/* store this result in internal cache */
	cachedb_intcache_store(qstate);
	/* we are done with the query */
	qstate->ext_state[id] = module_finished;
	return;
	}

	/* no cache fetches */
	/* pass request to next module */
	qstate->ext_state[id] = module_wait_module;
	}

	/**
	* Handle a cachedb module event with a response from the iterator.
	* @param qstate: query state (from the mesh), passed between modules.
	* contains qstate->env module environment with global caches and so on.
	* @param iq: query state specific for this module. per-query.
	* @param ie: environment specific for this module. global.
	* @param id: module id.
	*/
	static void
	cachedb_handle_response(struct module_qstate* qstate,
	struct cachedb_qstate* ATTR_UNUSED(iq), struct cachedb_env* ie, int id)
	{
	/* check if we are not enabled or instructed to not cache, and skip */
	if(!ie->enabled \|\| qstate->no_cache_store) {
	/* we are done with the query */
	qstate->ext_state[id] = module_finished;
	return;
	}

	/* store the item into the backend cache */
	cachedb_extcache_store(qstate, ie);

	/* we are done with the query */
	qstate->ext_state[id] = module_finished;
	}

	void
	cachedb_operate(struct module_qstate* qstate, enum module_ev event, int id,
	struct outbound_entry* outbound)
	{
	struct cachedb_env* ie = (struct cachedb_env*)qstate->env->modinfo[id];
	struct cachedb_qstate* iq = (struct cachedb_qstate*)qstate->minfo[id];
	verbose(VERB_QUERY, "cachedb[module %d] operate: extstate:%s event:%s",
	id, strextstate(qstate->ext_state[id]), strmodulevent(event));
	if(iq) log_query_info(VERB_QUERY, "cachedb operate: query",
	&qstate->qinfo);

	/* perform cachedb state machine */
	if((event == module_event_new \|\| event == module_event_pass) &&
	iq == NULL) {
	if(!cachedb_new(qstate, id)) {
	(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	return;
	}
	iq = (struct cachedb_qstate*)qstate->minfo[id];
	}
	if(iq && (event == module_event_pass \|\| event == module_event_new)) {
	cachedb_handle_query(qstate, iq, ie, id);
	return;
	}
	if(iq && (event == module_event_moddone)) {
	cachedb_handle_response(qstate, iq, ie, id);
	return;
	}
	if(iq && outbound) {
	/* cachedb does not need to process responses at this time
	* ignore it.
	cachedb_process_response(qstate, iq, ie, id, outbound, event);
	*/
	return;
	}
	if(event == module_event_error) {
	verbose(VERB_ALGO, "got called with event error, giving up");
	(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	return;
	}
	if(!iq && (event == module_event_moddone)) {
	/* during priming, module done but we never started */
	qstate->ext_state[id] = module_finished;
	return;
	}

	log_err("bad event for cachedb");
	(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}

	void
	cachedb_inform_super(struct module_qstate* ATTR_UNUSED(qstate),
	int ATTR_UNUSED(id), struct module_qstate* ATTR_UNUSED(super))
	{
	/* cachedb does not use subordinate requests at this time */
	verbose(VERB_ALGO, "cachedb inform_super was called");
	}

	void
	cachedb_clear(struct module_qstate* qstate, int id)
	{
	struct cachedb_qstate* iq;
	if(!qstate)
	return;
	iq = (struct cachedb_qstate*)qstate->minfo[id];
	if(iq) {
	/* free contents of iq */
	/* TODO */
	}
	qstate->minfo[id] = NULL;
	}

	size_t
	cachedb_get_mem(struct module_env* env, int id)
	{
	struct cachedb_env* ie = (struct cachedb_env*)env->modinfo[id];
	if(!ie)
	return 0;
	return sizeof(ie); / TODO - more mem */
	}

	/**
	* The cachedb function block
	*/
	static struct module_func_block cachedb_block = {
	"cachedb",
	&cachedb_init, &cachedb_deinit, &cachedb_operate,
	&cachedb_inform_super, &cachedb_clear, &cachedb_get_mem
	};

	struct module_func_block*
	cachedb_get_funcblock(void)
	{
	return &cachedb_block;
	}
	#endif /* USE_CACHEDB */
	Index: head/contrib/unbound/compat/arc4random.c
	===================================================================
	--- head/contrib/unbound/compat/arc4random.c (revision 349719)
	+++ head/contrib/unbound/compat/arc4random.c (revision 349720)
	@@ -1,305 +1,306 @@
	/* $OpenBSD: arc4random.c,v 1.41 2014/07/12 13:24:54 deraadt Exp $ */

	/*
	* Copyright (c) 1996, David Mazieres <dm@uun.org>
	* Copyright (c) 2008, Damien Miller <djm@openbsd.org>
	* Copyright (c) 2013, Markus Friedl <markus@openbsd.org>
	*
	* Permission to use, copy, modify, and distribute this software for any
	* purpose with or without fee is hereby granted, provided that the above
	* copyright notice and this permission notice appear in all copies.
	*
	* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
	* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
	* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
	* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
	* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
	* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
	*/
	#include "config.h"

	/*
	* ChaCha based random number generator for OpenBSD.
	*/

	#include <fcntl.h>
	#include <limits.h>
	#include <signal.h>
	#ifdef HAVE_STDINT_H
	#include <stdint.h>
	#endif
	#include <stdlib.h>
	#include <string.h>
	#include <unistd.h>
	#include <sys/types.h>
	#include <sys/param.h>
	#include <sys/time.h>
	#ifndef UB_ON_WINDOWS
	#include <sys/mman.h>
	#endif

	#define KEYSTREAM_ONLY
	#include "chacha_private.h"

	#define arc4_min(a, b) ((a) < (b) ? (a) : (b))
	#ifdef __GNUC__
	#define inline __inline
	#else /* !__GNUC__ */
	#define inline
	#endif /* !__GNUC__ */
	#ifndef MAP_ANON
	#define MAP_ANON MAP_ANONYMOUS
	#endif

	#define KEYSZ 32
	#define IVSZ 8
	#define BLOCKSZ 64
	#define RSBUFSZ (16*BLOCKSZ)

	/* Marked MAP_INHERIT_ZERO, so zero'd out in fork children. */
	static struct {
	size_t rs_have; /* valid bytes at end of rs_buf */
	size_t rs_count; /* bytes till reseed */
	} *rs;

	/* Preserved in fork children. */
	static struct {
	chacha_ctx rs_chacha; /* chacha context for random keystream */
	u_char rs_buf[RSBUFSZ]; /* keystream blocks */
	} *rsx;

	static inline void _rs_rekey(u_char *dat, size_t datlen);

	/*
	* Basic sanity checking; wish we could do better.
	*/
	static int
	fallback_gotdata(char *buf, size_t len)
	{
	char any_set = 0;
	size_t i;

	for (i = 0; i < len; ++i)
	any_set \|= buf[i];
	if (any_set == 0)
	return -1;
	return 0;
	}

	/* fallback for getentropy in case libc returns failure */
	static int
	fallback_getentropy_urandom(void *buf, size_t len)
	{
	size_t i;
	int fd, flags;
	int save_errno = errno;

	start:

	flags = O_RDONLY;
	#ifdef O_NOFOLLOW
	flags \|= O_NOFOLLOW;
	#endif
	#ifdef O_CLOEXEC
	flags \|= O_CLOEXEC;
	#endif
	fd = open("/dev/urandom", flags, 0);
	if (fd == -1) {
	if (errno == EINTR)
	goto start;
	goto nodevrandom;
	}
	#ifndef O_CLOEXEC
	# ifdef HAVE_FCNTL
	fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) \| FD_CLOEXEC);
	# endif
	#endif
	for (i = 0; i < len; ) {
	size_t wanted = len - i;
	ssize_t ret = read(fd, (char*)buf + i, wanted);

	if (ret == -1) {
	if (errno == EAGAIN \|\| errno == EINTR)
	continue;
	close(fd);
	goto nodevrandom;
	}
	i += ret;
	}
	close(fd);
	if (fallback_gotdata(buf, len) == 0) {
	errno = save_errno;
	return 0; /* satisfied */
	}
	nodevrandom:
	errno = EIO;
	return -1;
	}

	static inline void
	_rs_init(u_char *buf, size_t n)
	{
	+ assert(buf);
	if (n < KEYSZ + IVSZ)
	return;

	if (rs == NULL) {
	#ifndef UB_ON_WINDOWS
	if ((rs = mmap(NULL, sizeof(*rs), PROT_READ\|PROT_WRITE,
	MAP_ANON\|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
	abort();
	#ifdef MAP_INHERIT_ZERO
	if (minherit(rs, sizeof(*rs), MAP_INHERIT_ZERO) == -1)
	abort();
	#endif
	#else /* WINDOWS */
	rs = malloc(sizeof(*rs));
	if(!rs)
	abort();
	#endif
	}
	if (rsx == NULL) {
	#ifndef UB_ON_WINDOWS
	if ((rsx = mmap(NULL, sizeof(*rsx), PROT_READ\|PROT_WRITE,
	MAP_ANON\|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
	abort();
	#else /* WINDOWS */
	rsx = malloc(sizeof(*rsx));
	if(!rsx)
	abort();
	#endif
	}

	chacha_keysetup(&rsx->rs_chacha, buf, KEYSZ * 8, 0);
	chacha_ivsetup(&rsx->rs_chacha, buf + KEYSZ);
	}

	static void
	_rs_stir(void)
	{
	u_char rnd[KEYSZ + IVSZ];

	if (getentropy(rnd, sizeof rnd) == -1) {
	if(errno != ENOSYS \|\|
	fallback_getentropy_urandom(rnd, sizeof rnd) == -1) {
	#ifdef SIGKILL
	raise(SIGKILL);
	#else
	exit(9); /* windows */
	#endif
	}
	}

	if (!rs)
	_rs_init(rnd, sizeof(rnd));
	else
	_rs_rekey(rnd, sizeof(rnd));
	explicit_bzero(rnd, sizeof(rnd)); /* discard source seed */

	/* invalidate rs_buf */
	rs->rs_have = 0;
	memset(rsx->rs_buf, 0, sizeof(rsx->rs_buf));

	rs->rs_count = 1600000;
	}

	static inline void
	_rs_stir_if_needed(size_t len)
	{
	#ifndef MAP_INHERIT_ZERO
	static pid_t _rs_pid = 0;
	pid_t pid = getpid();

	/* If a system lacks MAP_INHERIT_ZERO, resort to getpid() */
	if (_rs_pid == 0 \|\| _rs_pid != pid) {
	_rs_pid = pid;
	if (rs)
	rs->rs_count = 0;
	}
	#endif
	if (!rs \|\| rs->rs_count <= len)
	_rs_stir();
	if (rs->rs_count <= len)
	rs->rs_count = 0;
	else
	rs->rs_count -= len;
	}

	static inline void
	_rs_rekey(u_char *dat, size_t datlen)
	{
	#ifndef KEYSTREAM_ONLY
	memset(rsx->rs_buf, 0, sizeof(rsx->rs_buf));
	#endif
	/* fill rs_buf with the keystream */
	chacha_encrypt_bytes(&rsx->rs_chacha, rsx->rs_buf,
	rsx->rs_buf, sizeof(rsx->rs_buf));
	/* mix in optional user provided data */
	if (dat) {
	size_t i, m;

	m = arc4_min(datlen, KEYSZ + IVSZ);
	for (i = 0; i < m; i++)
	rsx->rs_buf[i] ^= dat[i];
	}
	/* immediately reinit for backtracking resistance */
	_rs_init(rsx->rs_buf, KEYSZ + IVSZ);
	memset(rsx->rs_buf, 0, KEYSZ + IVSZ);
	rs->rs_have = sizeof(rsx->rs_buf) - KEYSZ - IVSZ;
	}

	static inline void
	_rs_random_buf(void *_buf, size_t n)
	{
	u_char buf = (u_char )_buf;
	u_char *keystream;
	size_t m;

	_rs_stir_if_needed(n);
	while (n > 0) {
	if (rs->rs_have > 0) {
	m = arc4_min(n, rs->rs_have);
	keystream = rsx->rs_buf + sizeof(rsx->rs_buf)
	- rs->rs_have;
	memcpy(buf, keystream, m);
	memset(keystream, 0, m);
	buf += m;
	n -= m;
	rs->rs_have -= m;
	}
	if (rs->rs_have == 0)
	_rs_rekey(NULL, 0);
	}
	}

	static inline void
	_rs_random_u32(uint32_t *val)
	{
	u_char *keystream;
	_rs_stir_if_needed(sizeof(*val));
	if (rs->rs_have < sizeof(*val))
	_rs_rekey(NULL, 0);
	keystream = rsx->rs_buf + sizeof(rsx->rs_buf) - rs->rs_have;
	memcpy(val, keystream, sizeof(*val));
	memset(keystream, 0, sizeof(*val));
	rs->rs_have -= sizeof(*val);
	}

	uint32_t
	arc4random(void)
	{
	uint32_t val;

	_ARC4_LOCK();
	_rs_random_u32(&val);
	_ARC4_UNLOCK();
	return val;
	}

	void
	arc4random_buf(void *buf, size_t n)
	{
	_ARC4_LOCK();
	_rs_random_buf(buf, n);
	_ARC4_UNLOCK();
	}
	Index: head/contrib/unbound/config.guess
	===================================================================
	--- head/contrib/unbound/config.guess (revision 349719)
	+++ head/contrib/unbound/config.guess (revision 349720)
	@@ -1,1462 +1,1462 @@
	-#! /bin/sh
	+#!/usr/bin/sh
	# Attempt to guess a canonical system name.
	# Copyright 1992-2016 Free Software Foundation, Inc.

	timestamp='2016-10-02'

	# This file is free software; you can redistribute it and/or modify it
	# under the terms of the GNU General Public License as published by
	# the Free Software Foundation; either version 3 of the License, or
	# (at your option) any later version.
	#
	# This program is distributed in the hope that it will be useful, but
	# WITHOUT ANY WARRANTY; without even the implied warranty of
	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	# General Public License for more details.
	#
	# You should have received a copy of the GNU General Public License
	# along with this program; if not, see <http://www.gnu.org/licenses/>.
	#
	# As a special exception to the GNU General Public License, if you
	# distribute this file as part of a program that contains a
	# configuration script generated by Autoconf, you may include it under
	# the same distribution terms that you use for the rest of that
	# program. This Exception is an additional permission under section 7
	# of the GNU General Public License, version 3 ("GPLv3").
	#
	# Originally written by Per Bothner; maintained since 2000 by Ben Elliston.
	#
	# You can get the latest version of this script from:
	# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
	#
	# Please send patches to <config-patches@gnu.org>.


	me=`echo "$0" \| sed -e 's,.*/,,'`

	usage="\
	Usage: $0 [OPTION]

	Output the configuration name of the system \`$me' is run on.

	Operation modes:
	-h, --help print this help, then exit
	-t, --time-stamp print date of last modification, then exit
	-v, --version print version number, then exit

	Report bugs and patches to <config-patches@gnu.org>."

	version="\
	GNU config.guess ($timestamp)

	Originally written by Per Bothner.
	Copyright 1992-2016 Free Software Foundation, Inc.

	This is free software; see the source for copying conditions. There is NO
	warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."

	help="
	Try \`$me --help' for more information."

	# Parse command line
	while test $# -gt 0 ; do
	case $1 in
	--time-stamp \| --time* \| -t )
	echo "$timestamp" ; exit ;;
	--version \| -v )
	echo "$version" ; exit ;;
	--help \| --h* \| -h )
	echo "$usage"; exit ;;
	-- ) # Stop option processing
	shift; break ;;
	- ) # Use stdin as input.
	break ;;
	-* )
	echo "$me: invalid option $1$help" >&2
	exit 1 ;;
	* )
	break ;;
	esac
	done

	if test $# != 0; then
	echo "$me: too many arguments$help" >&2
	exit 1
	fi

	trap 'exit 1' 1 2 15

	# CC_FOR_BUILD -- compiler used by this script. Note that the use of a
	# compiler to aid in system detection is discouraged as it requires
	# temporary files to be created and, as you can see below, it is a
	# headache to deal with in a portable fashion.

	# Historically, `CC_FOR_BUILD' used to be named `HOST_CC'. We still
	# use `HOST_CC' if defined, but it is deprecated.

	# Portable tmp directory creation inspired by the Autoconf team.

	set_cc_for_build='
	trap "exitcode=\$?; (rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null) && exit \$exitcode" 0 ;
	trap "rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null; exit 1" 1 2 13 15 ;
	: ${TMPDIR=/tmp} ;
	{ tmp=`(umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" ; } \|\|
	{ test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && mkdir $tmp) ; } \|\|
	{ tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir $tmp) && echo "Warning: creating insecure temp directory" >&2 ; } \|\|
	{ echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; exit 1 ; } ;
	dummy=$tmp/dummy ;
	tmpfiles="$dummy.c $dummy.o $dummy.rel $dummy" ;
	case $CC_FOR_BUILD,$HOST_CC,$CC in
	,,) echo "int x;" > $dummy.c ;
	for c in cc gcc c89 c99 ; do
	if ($c -c -o $dummy.o $dummy.c) >/dev/null 2>&1 ; then
	CC_FOR_BUILD="$c"; break ;
	fi ;
	done ;
	if test x"$CC_FOR_BUILD" = x ; then
	CC_FOR_BUILD=no_compiler_found ;
	fi
	;;
	,,*) CC_FOR_BUILD=$CC ;;
	,,) CC_FOR_BUILD=$HOST_CC ;;
	esac ; set_cc_for_build= ;'

	# This is needed to find uname on a Pyramid OSx when run in the BSD universe.
	# (ghazi@noc.rutgers.edu 1994-08-24)
	if (test -f /.attbin/uname) >/dev/null 2>&1 ; then
	PATH=$PATH:/.attbin ; export PATH
	fi

	UNAME_MACHINE=`(uname -m) 2>/dev/null` \|\| UNAME_MACHINE=unknown
	UNAME_RELEASE=`(uname -r) 2>/dev/null` \|\| UNAME_RELEASE=unknown
	UNAME_SYSTEM=`(uname -s) 2>/dev/null` \|\| UNAME_SYSTEM=unknown
	UNAME_VERSION=`(uname -v) 2>/dev/null` \|\| UNAME_VERSION=unknown

	case "${UNAME_SYSTEM}" in
	Linux\|GNU\|GNU/*)
	# If the system lacks a compiler, then just pick glibc.
	# We could probably try harder.
	LIBC=gnu

	eval $set_cc_for_build
	cat <<-EOF > $dummy.c
	#include <features.h>
	#if defined(__UCLIBC__)
	LIBC=uclibc
	#elif defined(__dietlibc__)
	LIBC=dietlibc
	#else
	LIBC=gnu
	#endif
	EOF
	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null \| grep '^LIBC' \| sed 's, ,,g'`
	;;
	esac

	# Note: order is significant - the case branches are not exclusive.

	case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
	:NetBSD::*)
	# NetBSD (nbsd) targets should (where applicable) match one or
	# more of the tuples: --netbsdelf, --netbsdaout,
	# --netbsdecoff* and --netbsd*. For targets that recently
	# switched to ELF, --netbsd* would select the old
	# object file format. This provides both forward
	# compatibility and a consistent mechanism for selecting the
	# object file format.
	#
	# Note: NetBSD doesn't particularly care about the vendor
	# portion of the name. We always set it to "unknown".
	sysctl="sysctl -n hw.machine_arch"
	UNAME_MACHINE_ARCH=`(uname -p 2>/dev/null \|\| \
	/sbin/$sysctl 2>/dev/null \|\| \
	/usr/sbin/$sysctl 2>/dev/null \|\| \
	echo unknown)`
	case "${UNAME_MACHINE_ARCH}" in
	armeb) machine=armeb-unknown ;;
	arm*) machine=arm-unknown ;;
	sh3el) machine=shl-unknown ;;
	sh3eb) machine=sh-unknown ;;
	sh5el) machine=sh5le-unknown ;;
	earmv*)
	arch=`echo ${UNAME_MACHINE_ARCH} \| sed -e 's,^e$armv[0-9]$.*$,\1,'`
	endian=`echo ${UNAME_MACHINE_ARCH} \| sed -ne 's,^.*$eb$$,\1,p'`
	machine=${arch}${endian}-unknown
	;;
	*) machine=${UNAME_MACHINE_ARCH}-unknown ;;
	esac
	# The Operating System including object format, if it has switched
	# to ELF recently (or will in the future) and ABI.
	case "${UNAME_MACHINE_ARCH}" in
	earm*)
	os=netbsdelf
	;;
	arm\|i386\|m68k\|ns32k\|sh3\|sparc\|vax)
	eval $set_cc_for_build
	if echo __ELF__ \| $CC_FOR_BUILD -E - 2>/dev/null \
	\| grep -q __ELF__
	then
	# Once all utilities can be ECOFF (netbsdecoff) or a.out (netbsdaout).
	# Return netbsd for either. FIX?
	os=netbsd
	else
	os=netbsdelf
	fi
	;;
	*)
	os=netbsd
	;;
	esac
	# Determine ABI tags.
	case "${UNAME_MACHINE_ARCH}" in
	earm*)
	expr='s/^earmv[0-9]/-eabi/;s/eb$//'
	abi=`echo ${UNAME_MACHINE_ARCH} \| sed -e "$expr"`
	;;
	esac
	# The OS release
	# Debian GNU/NetBSD machines have a different userland, and
	# thus, need a distinct triplet. However, they do not need
	# kernel version information, so it can be replaced with a
	# suitable tag, in the style of linux-gnu.
	case "${UNAME_VERSION}" in
	Debian*)
	release='-gnu'
	;;
	*)
	release=`echo ${UNAME_RELEASE} \| sed -e 's/[-_].*//' \| cut -d. -f1,2`
	;;
	esac
	# Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM:
	# contains redundant information, the shorter form:
	# CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used.
	echo "${machine}-${os}${release}${abi}"
	exit ;;
	:Bitrig::*)
	UNAME_MACHINE_ARCH=`arch \| sed 's/Bitrig.//'`
	echo ${UNAME_MACHINE_ARCH}-unknown-bitrig${UNAME_RELEASE}
	exit ;;
	:OpenBSD::*)
	UNAME_MACHINE_ARCH=`arch \| sed 's/OpenBSD.//'`
	echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE}
	exit ;;
	:LibertyBSD::*)
	UNAME_MACHINE_ARCH=`arch \| sed 's/^.*BSD\.//'`
	echo ${UNAME_MACHINE_ARCH}-unknown-libertybsd${UNAME_RELEASE}
	exit ;;
	:ekkoBSD::*)
	echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE}
	exit ;;
	:SolidBSD::*)
	echo ${UNAME_MACHINE}-unknown-solidbsd${UNAME_RELEASE}
	exit ;;
	macppc:MirBSD::)
	echo powerpc-unknown-mirbsd${UNAME_RELEASE}
	exit ;;
	:MirBSD::*)
	echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE}
	exit ;;
	:Sortix::*)
	echo ${UNAME_MACHINE}-unknown-sortix
	exit ;;
	alpha:OSF1::)
	case $UNAME_RELEASE in
	*4.0)
	UNAME_RELEASE=`/usr/sbin/sizer -v \| awk '{print $3}'`
	;;
	5.)
	UNAME_RELEASE=`/usr/sbin/sizer -v \| awk '{print $4}'`
	;;
	esac
	# According to Compaq, /usr/sbin/psrinfo has been available on
	# OSF/1 and Tru64 systems produced since 1995. I hope that
	# covers most systems running today. This code pipes the CPU
	# types through head -n 1, so we only detect the type of CPU 0.
	ALPHA_CPU_TYPE=`/usr/sbin/psrinfo -v \| sed -n -e 's/^ The alpha $.$ processor.$/\1/p' \| head -n 1`
	case "$ALPHA_CPU_TYPE" in
	"EV4 (21064)")
	UNAME_MACHINE=alpha ;;
	"EV4.5 (21064)")
	UNAME_MACHINE=alpha ;;
	"LCA4 (21066/21068)")
	UNAME_MACHINE=alpha ;;
	"EV5 (21164)")
	UNAME_MACHINE=alphaev5 ;;
	"EV5.6 (21164A)")
	UNAME_MACHINE=alphaev56 ;;
	"EV5.6 (21164PC)")
	UNAME_MACHINE=alphapca56 ;;
	"EV5.7 (21164PC)")
	UNAME_MACHINE=alphapca57 ;;
	"EV6 (21264)")
	UNAME_MACHINE=alphaev6 ;;
	"EV6.7 (21264A)")
	UNAME_MACHINE=alphaev67 ;;
	"EV6.8CB (21264C)")
	UNAME_MACHINE=alphaev68 ;;
	"EV6.8AL (21264B)")
	UNAME_MACHINE=alphaev68 ;;
	"EV6.8CX (21264D)")
	UNAME_MACHINE=alphaev68 ;;
	"EV6.9A (21264/EV69A)")
	UNAME_MACHINE=alphaev69 ;;
	"EV7 (21364)")
	UNAME_MACHINE=alphaev7 ;;
	"EV7.9 (21364A)")
	UNAME_MACHINE=alphaev79 ;;
	esac
	# A Pn.n version is a patched version.
	# A Vn.n version is a released version.
	# A Tn.n version is a released field test version.
	# A Xn.n version is an unreleased experimental baselevel.
	# 1.2 uses "1.2" for uname -r.
	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} \| sed -e 's/^[PVTX]//' \| tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
	# Reset EXIT trap before exiting to avoid spurious non-zero exit code.
	exitcode=$?
	trap '' 0
	exit $exitcode ;;
	Alpha\ :Windows_NT:*)
	# How do we know it's Interix rather than the generic POSIX subsystem?
	# Should we change UNAME_MACHINE based on the output of uname instead
	# of the specific Alpha model?
	echo alpha-pc-interix
	exit ;;
	21064:Windows_NT:50:3)
	echo alpha-dec-winnt3.5
	exit ;;
	Amiga:UNIX_System_V:4.0:)
	echo m68k-unknown-sysv4
	exit ;;
	:[Aa]miga[Oo][Ss]::*)
	echo ${UNAME_MACHINE}-unknown-amigaos
	exit ;;
	:[Mm]orph[Oo][Ss]::*)
	echo ${UNAME_MACHINE}-unknown-morphos
	exit ;;
	:OS/390::*)
	echo i370-ibm-openedition
	exit ;;
	:z/VM::*)
	echo s390-ibm-zvmoe
	exit ;;
	:OS400::*)
	echo powerpc-ibm-os400
	exit ;;
	arm:RISC:1.[012]:\|arm:riscix:1.[012]:*)
	echo arm-acorn-riscix${UNAME_RELEASE}
	exit ;;
	arm:riscos::\|arm:RISCOS::)
	echo arm-unknown-riscos
	exit ;;
	SR2?01:HI-UX/MPP:: \| SR8000:HI-UX/MPP::)
	echo hppa1.1-hitachi-hiuxmpp
	exit ;;
	Pyramid:OSx:: \| MIS:OSx:: \| MIS:SMP_DC-OSx::)
	# akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE.
	if test "`(/bin/universe) 2>/dev/null`" = att ; then
	echo pyramid-pyramid-sysv3
	else
	echo pyramid-pyramid-bsd
	fi
	exit ;;
	NILE::*:dcosx)
	echo pyramid-pyramid-svr4
	exit ;;
	DRS?6000:unix:4.0:6*)
	echo sparc-icl-nx6
	exit ;;
	DRS?6000:UNIX_SV:4.2:7 \| DRS?6000:isis:4.2:7)
	case `/usr/bin/uname -p` in
	sparc) echo sparc-icl-nx7; exit ;;
	esac ;;
	s390x:SunOS::)
	echo ${UNAME_MACHINE}-ibm-solaris2`echo ${UNAME_RELEASE}\|sed -e 's/[^.]*//'`
	exit ;;
	sun4H:SunOS:5.:)
	echo sparc-hal-solaris2`echo ${UNAME_RELEASE}\|sed -e 's/[^.]*//'`
	exit ;;
	sun4:SunOS:5.:* \| tadpole:SunOS:5.:*)
	echo sparc-sun-solaris2`echo ${UNAME_RELEASE}\|sed -e 's/[^.]*//'`
	exit ;;
	i86pc:AuroraUX:5.: \| i86xen:AuroraUX:5.:)
	echo i386-pc-auroraux${UNAME_RELEASE}
	exit ;;
	i86pc:SunOS:5.: \| i86xen:SunOS:5.:)
	eval $set_cc_for_build
	SUN_ARCH=i386
	# If there is a compiler, see if it is configured for 64-bit objects.
	# Note that the Sun cc does not turn __LP64__ into 1 like gcc does.
	# This test works for both compilers.
	if [ "$CC_FOR_BUILD" != no_compiler_found ]; then
	if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') \| \
	(CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) \| \
	grep IS_64BIT_ARCH >/dev/null
	then
	SUN_ARCH=x86_64
	fi
	fi
	echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}\|sed -e 's/[^.]*//'`
	exit ;;
	sun4:SunOS:6:*)
	# According to config.sub, this is the proper way to canonicalize
	# SunOS6. Hard to guess exactly what SunOS6 will be like, but
	# it's likely to be more like Solaris than SunOS4.
	echo sparc-sun-solaris3`echo ${UNAME_RELEASE}\|sed -e 's/[^.]*//'`
	exit ;;
	sun4:SunOS::*)
	case "`/usr/bin/arch -k`" in
	Series\|S4)
	UNAME_RELEASE=`uname -v`
	;;
	esac
	# Japanese Language versions have a version number like `4.1.3-JL'.
	echo sparc-sun-sunos`echo ${UNAME_RELEASE}\|sed -e 's/-/_/'`
	exit ;;
	sun3:SunOS::*)
	echo m68k-sun-sunos${UNAME_RELEASE}
	exit ;;
	sun::4.2BSD:*)
	UNAME_RELEASE=`(sed 1q /etc/motd \| awk '{print substr($5,1,3)}') 2>/dev/null`
	test "x${UNAME_RELEASE}" = x && UNAME_RELEASE=3
	case "`/bin/arch`" in
	sun3)
	echo m68k-sun-sunos${UNAME_RELEASE}
	;;
	sun4)
	echo sparc-sun-sunos${UNAME_RELEASE}
	;;
	esac
	exit ;;
	aushp:SunOS::)
	echo sparc-auspex-sunos${UNAME_RELEASE}
	exit ;;
	# The situation for MiNT is a little confusing. The machine name
	# can be virtually everything (everything which is not
	# "atarist" or "atariste" at least should have a processor
	# > m68000). The system name ranges from "MiNT" over "FreeMiNT"
	# to the lowercase version "mint" (or "freemint"). Finally
	# the system name "TOS" denotes a system which is actually not
	# MiNT. But MiNT is downward compatible to TOS, so this should
	# be no problem.
	atarist[e]:MiNT::* \| atarist[e]:mint::* \| atarist[e]:TOS::*)
	echo m68k-atari-mint${UNAME_RELEASE}
	exit ;;
	atari:MiNT:: \| atari:mint:: \| atarist[e]:TOS::*)
	echo m68k-atari-mint${UNAME_RELEASE}
	exit ;;
	falcon:MiNT::* \| falcon:mint::* \| falcon:TOS::*)
	echo m68k-atari-mint${UNAME_RELEASE}
	exit ;;
	milan:MiNT:: \| milan:mint:: \| milan:TOS::*)
	echo m68k-milan-mint${UNAME_RELEASE}
	exit ;;
	hades:MiNT:: \| hades:mint:: \| hades:TOS::*)
	echo m68k-hades-mint${UNAME_RELEASE}
	exit ;;
	:MiNT:: \| :mint:: \| :TOS::)
	echo m68k-unknown-mint${UNAME_RELEASE}
	exit ;;
	m68k:machten::)
	echo m68k-apple-machten${UNAME_RELEASE}
	exit ;;
	powerpc:machten::)
	echo powerpc-apple-machten${UNAME_RELEASE}
	exit ;;
	RISC:Mach::*)
	echo mips-dec-mach_bsd4.3
	exit ;;
	RISC:ULTRIX::*)
	echo mips-dec-ultrix${UNAME_RELEASE}
	exit ;;
	VAX:ULTRIX::)
	echo vax-dec-ultrix${UNAME_RELEASE}
	exit ;;
	2020:CLIX:: \| 2430:CLIX::)
	echo clipper-intergraph-clix${UNAME_RELEASE}
	exit ;;
	mips:::UMIPS \| mips:::RISCos)
	eval $set_cc_for_build
	sed 's/^ //' << EOF >$dummy.c
	#ifdef __cplusplus
	#include <stdio.h> /* for printf() prototype */
	int main (int argc, char *argv[]) {
	#else
	int main (argc, argv) int argc; char *argv[]; {
	#endif
	#if defined (host_mips) && defined (MIPSEB)
	#if defined (SYSTYPE_SYSV)
	printf ("mips-mips-riscos%ssysv\n", argv[1]); exit (0);
	#endif
	#if defined (SYSTYPE_SVR4)
	printf ("mips-mips-riscos%ssvr4\n", argv[1]); exit (0);
	#endif
	#if defined (SYSTYPE_BSD43) \|\| defined(SYSTYPE_BSD)
	printf ("mips-mips-riscos%sbsd\n", argv[1]); exit (0);
	#endif
	#endif
	exit (-1);
	}
	EOF
	$CC_FOR_BUILD -o $dummy $dummy.c &&
	dummyarg=`echo "${UNAME_RELEASE}" \| sed -n 's/$[0-9]$./\1/p'` &&
	SYSTEM_NAME=`$dummy $dummyarg` &&
	{ echo "$SYSTEM_NAME"; exit; }
	echo mips-mips-riscos${UNAME_RELEASE}
	exit ;;
	Motorola:PowerMAX_OS::)
	echo powerpc-motorola-powermax
	exit ;;
	Motorola::4.3:PL8-)
	echo powerpc-harris-powermax
	exit ;;
	Night_Hawk:::PowerMAX_OS \| Synergy:PowerMAX_OS::)
	echo powerpc-harris-powermax
	exit ;;
	Night_Hawk:Power_UNIX::)
	echo powerpc-harris-powerunix
	exit ;;
	m88k:CX/UX:7:)
	echo m88k-harris-cxux7
	exit ;;
	m88k::4:R4*)
	echo m88k-motorola-sysv4
	exit ;;
	m88k::3:R3*)
	echo m88k-motorola-sysv3
	exit ;;
	AViiON:dgux::)
	# DG/UX returns AViiON for all architectures
	UNAME_PROCESSOR=`/usr/bin/uname -p`
	if [ $UNAME_PROCESSOR = mc88100 ] \|\| [ $UNAME_PROCESSOR = mc88110 ]
	then
	if [ ${TARGET_BINARY_INTERFACE}x = m88kdguxelfx ] \|\| \
	[ ${TARGET_BINARY_INTERFACE}x = x ]
	then
	echo m88k-dg-dgux${UNAME_RELEASE}
	else
	echo m88k-dg-dguxbcs${UNAME_RELEASE}
	fi
	else
	echo i586-dg-dgux${UNAME_RELEASE}
	fi
	exit ;;
	M88:DolphinOS::*) # DolphinOS (SVR3)
	echo m88k-dolphin-sysv3
	exit ;;
	M88::R3:)
	# Delta 88k system running SVR3
	echo m88k-motorola-sysv3
	exit ;;
	XD88:::) # Tektronix XD88 system running UTekV (SVR3)
	echo m88k-tektronix-sysv3
	exit ;;
	Tek43[0-9][0-9]:UTek::) # Tektronix 4300 system running UTek (BSD)
	echo m68k-tektronix-bsd
	exit ;;
	:IRIX::)
	echo mips-sgi-irix`echo ${UNAME_RELEASE}\|sed -e 's/-/_/g'`
	exit ;;
	????????:AIX?:[12].1:2) # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX.
	echo romp-ibm-aix # uname -m gives an 8 hex-code CPU id
	exit ;; # Note that: echo "'`uname -s`'" gives 'AIX '
	i86:AIX::*)
	echo i386-ibm-aix
	exit ;;
	ia64:AIX::)
	if [ -x /usr/bin/oslevel ] ; then
	IBM_REV=`/usr/bin/oslevel`
	else
	IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
	fi
	echo ${UNAME_MACHINE}-ibm-aix${IBM_REV}
	exit ;;
	*:AIX:2:3)
	if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then
	eval $set_cc_for_build
	sed 's/^ //' << EOF >$dummy.c
	#include <sys/systemcfg.h>

	main()
	{
	if (!__power_pc())
	exit(1);
	puts("powerpc-ibm-aix3.2.5");
	exit(0);
	}
	EOF
	if $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy`
	then
	echo "$SYSTEM_NAME"
	else
	echo rs6000-ibm-aix3.2.5
	fi
	elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then
	echo rs6000-ibm-aix3.2.4
	else
	echo rs6000-ibm-aix3.2
	fi
	exit ;;
	:AIX::[4567])
	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available \| sed 1q \| awk '{ print $1 }'`
	if /usr/sbin/lsattr -El ${IBM_CPU_ID} \| grep ' POWER' >/dev/null 2>&1; then
	IBM_ARCH=rs6000
	else
	IBM_ARCH=powerpc
	fi
	if [ -x /usr/bin/lslpp ] ; then
	IBM_REV=`/usr/bin/lslpp -Lqc bos.rte.libc \|
	awk -F: '{ print $3 }' \| sed s/[0-9]*$/0/`
	else
	IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
	fi
	echo ${IBM_ARCH}-ibm-aix${IBM_REV}
	exit ;;
	:AIX::*)
	echo rs6000-ibm-aix
	exit ;;
	ibmrt:4.4BSD:\|romp-ibm:BSD:)
	echo romp-ibm-bsd4.4
	exit ;;
	ibmrt:BSD:\|romp-ibm:BSD:*) # covers RT/PC BSD and
	echo romp-ibm-bsd${UNAME_RELEASE} # 4.3 with uname added to
	exit ;; # report: romp-ibm BSD 4.3
	:BOSX::*)
	echo rs6000-bull-bosx
	exit ;;
	DPX/2?00:B.O.S.::)
	echo m68k-bull-sysv3
	exit ;;
	9000/[34]??:4.3bsd:1.:)
	echo m68k-hp-bsd
	exit ;;
	hp300:4.4BSD:: \| 9000/[34]??:4.3bsd:2.:)
	echo m68k-hp-bsd4.4
	exit ;;
	9000/[34678]??:HP-UX::)
	HPUX_REV=`echo ${UNAME_RELEASE}\|sed -e 's/[^.].[0B]//'`
	case "${UNAME_MACHINE}" in
	9000/31? ) HP_ARCH=m68000 ;;
	9000/[34]?? ) HP_ARCH=m68k ;;
	9000/[678][0-9][0-9])
	if [ -x /usr/bin/getconf ]; then
	sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null`
	sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null`
	case "${sc_cpu_version}" in
	523) HP_ARCH=hppa1.0 ;; # CPU_PA_RISC1_0
	528) HP_ARCH=hppa1.1 ;; # CPU_PA_RISC1_1
	532) # CPU_PA_RISC2_0
	case "${sc_kernel_bits}" in
	32) HP_ARCH=hppa2.0n ;;
	64) HP_ARCH=hppa2.0w ;;
	'') HP_ARCH=hppa2.0 ;; # HP-UX 10.20
	esac ;;
	esac
	fi
	if [ "${HP_ARCH}" = "" ]; then
	eval $set_cc_for_build
	sed 's/^ //' << EOF >$dummy.c

	#define _HPUX_SOURCE
	#include <stdlib.h>
	#include <unistd.h>

	int main ()
	{
	#if defined(_SC_KERNEL_BITS)
	long bits = sysconf(_SC_KERNEL_BITS);
	#endif
	long cpu = sysconf (_SC_CPU_VERSION);

	switch (cpu)
	{
	case CPU_PA_RISC1_0: puts ("hppa1.0"); break;
	case CPU_PA_RISC1_1: puts ("hppa1.1"); break;
	case CPU_PA_RISC2_0:
	#if defined(_SC_KERNEL_BITS)
	switch (bits)
	{
	case 64: puts ("hppa2.0w"); break;
	case 32: puts ("hppa2.0n"); break;
	default: puts ("hppa2.0"); break;
	} break;
	#else /* !defined(_SC_KERNEL_BITS) */
	puts ("hppa2.0"); break;
	#endif
	default: puts ("hppa1.0"); break;
	}
	exit (0);
	}
	EOF
	(CCOPTS="" $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy`
	test -z "$HP_ARCH" && HP_ARCH=hppa
	fi ;;
	esac
	if [ ${HP_ARCH} = hppa2.0w ]
	then
	eval $set_cc_for_build

	# hppa2.0w-hp-hpux* has a 64-bit kernel and a compiler generating
	# 32-bit code. hppa64-hp-hpux* has the same kernel and a compiler
	# generating 64-bit code. GNU and HP use different nomenclature:
	#
	# $ CC_FOR_BUILD=cc ./config.guess
	# => hppa2.0w-hp-hpux11.23
	# $ CC_FOR_BUILD="cc +DA2.0w" ./config.guess
	# => hppa64-hp-hpux11.23

	if echo __LP64__ \| (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) \|
	grep -q __LP64__
	then
	HP_ARCH=hppa2.0w
	else
	HP_ARCH=hppa64
	fi
	fi
	echo ${HP_ARCH}-hp-hpux${HPUX_REV}
	exit ;;
	ia64:HP-UX::)
	HPUX_REV=`echo ${UNAME_RELEASE}\|sed -e 's/[^.].[0B]//'`
	echo ia64-hp-hpux${HPUX_REV}
	exit ;;
	3050:HI-UX::*)
	eval $set_cc_for_build
	sed 's/^ //' << EOF >$dummy.c
	#include <unistd.h>
	int
	main ()
	{
	long cpu = sysconf (_SC_CPU_VERSION);
	/* The order matters, because CPU_IS_HP_MC68K erroneously returns
	true for CPU_PA_RISC1_0. CPU_IS_PA_RISC returns correct
	results, however. */
	if (CPU_IS_PA_RISC (cpu))
	{
	switch (cpu)
	{
	case CPU_PA_RISC1_0: puts ("hppa1.0-hitachi-hiuxwe2"); break;
	case CPU_PA_RISC1_1: puts ("hppa1.1-hitachi-hiuxwe2"); break;
	case CPU_PA_RISC2_0: puts ("hppa2.0-hitachi-hiuxwe2"); break;
	default: puts ("hppa-hitachi-hiuxwe2"); break;
	}
	}
	else if (CPU_IS_HP_MC68K (cpu))
	puts ("m68k-hitachi-hiuxwe2");
	else puts ("unknown-hitachi-hiuxwe2");
	exit (0);
	}
	EOF
	$CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy` &&
	{ echo "$SYSTEM_NAME"; exit; }
	echo unknown-hitachi-hiuxwe2
	exit ;;
	9000/7??:4.3bsd:: \| 9000/8?[79]:4.3bsd:: )
	echo hppa1.1-hp-bsd
	exit ;;
	9000/8??:4.3bsd::)
	echo hppa1.0-hp-bsd
	exit ;;
	9??:MPE/iX:: \| 3000:MPE/iX::)
	echo hppa1.0-hp-mpeix
	exit ;;
	hp7??:OSF1:: \| hp8?[79]:OSF1:: )
	echo hppa1.1-hp-osf
	exit ;;
	hp8??:OSF1::)
	echo hppa1.0-hp-osf
	exit ;;
	i86:OSF1::*)
	if [ -x /usr/sbin/sysversion ] ; then
	echo ${UNAME_MACHINE}-unknown-osf1mk
	else
	echo ${UNAME_MACHINE}-unknown-osf1
	fi
	exit ;;
	parisc:Lites::)
	echo hppa1.1-hp-lites
	exit ;;
	C1:ConvexOS::* \| convex:ConvexOS:C1:)
	echo c1-convex-bsd
	exit ;;
	C2:ConvexOS::* \| convex:ConvexOS:C2:)
	if getsysinfo -f scalar_acc
	then echo c32-convex-bsd
	else echo c2-convex-bsd
	fi
	exit ;;
	C34:ConvexOS::* \| convex:ConvexOS:C34:)
	echo c34-convex-bsd
	exit ;;
	C38:ConvexOS::* \| convex:ConvexOS:C38:)
	echo c38-convex-bsd
	exit ;;
	C4:ConvexOS::* \| convex:ConvexOS:C4:)
	echo c4-convex-bsd
	exit ;;
	CRAYY-MP:::)
	echo ymp-cray-unicos${UNAME_RELEASE} \| sed -e 's/\.[^.]*$/.X/'
	exit ;;
	CRAY[A-Z]90:::)
	echo ${UNAME_MACHINE}-cray-unicos${UNAME_RELEASE} \
	\| sed -e 's/CRAY.*$[A-Z]90$/\1/' \
	-e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ \
	-e 's/\.[^.]*$/.X/'
	exit ;;
	CRAYTS:::)
	echo t90-cray-unicos${UNAME_RELEASE} \| sed -e 's/\.[^.]*$/.X/'
	exit ;;
	CRAYT3E:::)
	echo alphaev5-cray-unicosmk${UNAME_RELEASE} \| sed -e 's/\.[^.]*$/.X/'
	exit ;;
	CRAYSV1:::)
	echo sv1-cray-unicos${UNAME_RELEASE} \| sed -e 's/\.[^.]*$/.X/'
	exit ;;
	:UNICOS/mp::*)
	echo craynv-cray-unicosmp${UNAME_RELEASE} \| sed -e 's/\.[^.]*$/.X/'
	exit ;;
	F30[01]:UNIX_System_V:: \| F700:UNIX_System_V::)
	FUJITSU_PROC=`uname -m \| tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
	FUJITSU_SYS=`uname -p \| tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz \| sed -e 's/\///'`
	FUJITSU_REL=`echo ${UNAME_RELEASE} \| sed -e 's/ /_/'`
	echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
	exit ;;
	5000:UNIX_System_V:4.:)
	FUJITSU_SYS=`uname -p \| tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz \| sed -e 's/\///'`
	FUJITSU_REL=`echo ${UNAME_RELEASE} \| tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz \| sed -e 's/ /_/'`
	echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
	exit ;;
	i86:BSD/386::* \| i86:BSD/OS::* \| :Ascend\ Embedded/OS::*)
	echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE}
	exit ;;
	sparc:BSD/OS::*)
	echo sparc-unknown-bsdi${UNAME_RELEASE}
	exit ;;
	:BSD/OS::*)
	echo ${UNAME_MACHINE}-unknown-bsdi${UNAME_RELEASE}
	exit ;;
	:FreeBSD::*)
	UNAME_PROCESSOR=`/usr/bin/uname -p`
	case ${UNAME_PROCESSOR} in
	amd64)
	echo x86_64-unknown-freebsd`echo ${UNAME_RELEASE}\|sed -e 's/[-(].*//'` ;;
	*)
	echo ${UNAME_PROCESSOR}-unknown-freebsd`echo ${UNAME_RELEASE}\|sed -e 's/[-(].*//'` ;;
	esac
	exit ;;
	i:CYGWIN:*)
	echo ${UNAME_MACHINE}-pc-cygwin
	exit ;;
	:MINGW64:*)
	echo ${UNAME_MACHINE}-pc-mingw64
	exit ;;
	:MINGW:*)
	echo ${UNAME_MACHINE}-pc-mingw32
	exit ;;
	:MSYS:*)
	echo ${UNAME_MACHINE}-pc-msys
	exit ;;
	i:windows32:*)
	# uname -m includes "-pc" on this system.
	echo ${UNAME_MACHINE}-mingw32
	exit ;;
	i:PW:*)
	echo ${UNAME_MACHINE}-pc-pw32
	exit ;;
	:Interix:*)
	case ${UNAME_MACHINE} in
	x86)
	echo i586-pc-interix${UNAME_RELEASE}
	exit ;;
	authenticamd \| genuineintel \| EM64T)
	echo x86_64-unknown-interix${UNAME_RELEASE}
	exit ;;
	IA64)
	echo ia64-unknown-interix${UNAME_RELEASE}
	exit ;;
	esac ;;
	[345]86:Windows_95:* \| [345]86:Windows_98:* \| [345]86:Windows_NT:*)
	echo i${UNAME_MACHINE}-pc-mks
	exit ;;
	8664:Windows_NT:*)
	echo x86_64-pc-mks
	exit ;;
	i:Windows_NT:* \| Pentium:Windows_NT:*)
	# How do we know it's Interix rather than the generic POSIX subsystem?
	# It also conflicts with pre-2.0 versions of AT&T UWIN. Should we
	# UNAME_MACHINE based on the output of uname instead of i386?
	echo i586-pc-interix
	exit ;;
	i:UWIN:*)
	echo ${UNAME_MACHINE}-pc-uwin
	exit ;;
	amd64:CYGWIN::* \| x86_64:CYGWIN::*)
	echo x86_64-unknown-cygwin
	exit ;;
	p:CYGWIN:*)
	echo powerpcle-unknown-cygwin
	exit ;;
	prep:SunOS:5.:*)
	echo powerpcle-unknown-solaris2`echo ${UNAME_RELEASE}\|sed -e 's/[^.]*//'`
	exit ;;
	:GNU::*)
	# the GNU system
	echo `echo ${UNAME_MACHINE}\|sed -e 's,[-/].$,,'`-unknown-${LIBC}`echo ${UNAME_RELEASE}\|sed -e 's,/.$,,'`
	exit ;;
	:GNU/::)
	# other systems with GNU libc and userland
	echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} \| sed 's,^[^/]/,,' \| tr "[:upper:]" "[:lower:]"``echo ${UNAME_RELEASE}\|sed -e 's/[-(].//'`-${LIBC}
	exit ;;
	i86:Minix::*)
	echo ${UNAME_MACHINE}-pc-minix
	exit ;;
	aarch64:Linux::)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	aarch64_be:Linux::)
	UNAME_MACHINE=aarch64_be
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	alpha:Linux::)
	case `sed -n '/^cpu model/s/^.: $.$/\1/p' < /proc/cpuinfo` in
	EV5) UNAME_MACHINE=alphaev5 ;;
	EV56) UNAME_MACHINE=alphaev56 ;;
	PCA56) UNAME_MACHINE=alphapca56 ;;
	PCA57) UNAME_MACHINE=alphapca56 ;;
	EV6) UNAME_MACHINE=alphaev6 ;;
	EV67) UNAME_MACHINE=alphaev67 ;;
	EV68*) UNAME_MACHINE=alphaev68 ;;
	esac
	objdump --private-headers /bin/sh \| grep -q ld.so.1
	if test "$?" = 0 ; then LIBC=gnulibc1 ; fi
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	arc:Linux:: \| arceb:Linux::)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	arm:Linux::*)
	eval $set_cc_for_build
	if echo __ARM_EABI__ \| $CC_FOR_BUILD -E - 2>/dev/null \
	\| grep -q __ARM_EABI__
	then
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	else
	if echo __ARM_PCS_VFP \| $CC_FOR_BUILD -E - 2>/dev/null \
	\| grep -q __ARM_PCS_VFP
	then
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabi
	else
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabihf
	fi
	fi
	exit ;;
	avr32:Linux::*)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	cris:Linux::)
	echo ${UNAME_MACHINE}-axis-linux-${LIBC}
	exit ;;
	crisv32:Linux::)
	echo ${UNAME_MACHINE}-axis-linux-${LIBC}
	exit ;;
	e2k:Linux::)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	frv:Linux::)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	hexagon:Linux::)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	i86:Linux::*)
	echo ${UNAME_MACHINE}-pc-linux-${LIBC}
	exit ;;
	ia64:Linux::)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	k1om:Linux::)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	m32r:Linux::*)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	m68:Linux::*)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	mips:Linux:: \| mips64:Linux::)
	eval $set_cc_for_build
	sed 's/^ //' << EOF >$dummy.c
	#undef CPU
	#undef ${UNAME_MACHINE}
	#undef ${UNAME_MACHINE}el
	#if defined(__MIPSEL__) \|\| defined(__MIPSEL) \|\| defined(_MIPSEL) \|\| defined(MIPSEL)
	CPU=${UNAME_MACHINE}el
	#else
	#if defined(__MIPSEB__) \|\| defined(__MIPSEB) \|\| defined(_MIPSEB) \|\| defined(MIPSEB)
	CPU=${UNAME_MACHINE}
	#else
	CPU=
	#endif
	#endif
	EOF
	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null \| grep '^CPU'`
	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; }
	;;
	mips64el:Linux::)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	openrisc:Linux::*)
	echo or1k-unknown-linux-${LIBC}
	exit ;;
	or32:Linux:: \| or1k:Linux::*)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	padre:Linux::)
	echo sparc-unknown-linux-${LIBC}
	exit ;;
	parisc64:Linux:: \| hppa64:Linux::)
	echo hppa64-unknown-linux-${LIBC}
	exit ;;
	parisc:Linux:: \| hppa:Linux::)
	# Look for CPU level
	case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null \| cut -d' ' -f2` in
	PA7*) echo hppa1.1-unknown-linux-${LIBC} ;;
	PA8*) echo hppa2.0-unknown-linux-${LIBC} ;;
	*) echo hppa-unknown-linux-${LIBC} ;;
	esac
	exit ;;
	ppc64:Linux::)
	echo powerpc64-unknown-linux-${LIBC}
	exit ;;
	ppc:Linux::)
	echo powerpc-unknown-linux-${LIBC}
	exit ;;
	ppc64le:Linux::)
	echo powerpc64le-unknown-linux-${LIBC}
	exit ;;
	ppcle:Linux::)
	echo powerpcle-unknown-linux-${LIBC}
	exit ;;
	riscv32:Linux:: \| riscv64:Linux::)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	s390:Linux:: \| s390x:Linux::)
	echo ${UNAME_MACHINE}-ibm-linux-${LIBC}
	exit ;;
	sh64:Linux::*)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	sh:Linux::*)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	sparc:Linux:: \| sparc64:Linux::)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	tile:Linux::*)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	vax:Linux::)
	echo ${UNAME_MACHINE}-dec-linux-${LIBC}
	exit ;;
	x86_64:Linux::)
	echo ${UNAME_MACHINE}-pc-linux-${LIBC}
	exit ;;
	xtensa:Linux::*)
	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
	exit ;;
	i86:DYNIX/ptx:4:*)
	# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
	# earlier versions are messed up and put the nodename in both
	# sysname and nodename.
	echo i386-sequent-sysv4
	exit ;;
	i86:UNIX_SV:4.2MP:2.)
	# Unixware is an offshoot of SVR4, but it has its own version
	# number series starting with 2...
	# I am not positive that other SVR4 systems won't match this,
	# I just have to hope. -- rms.
	# Use sysv4.2uw... so that sysv4* matches it.
	echo ${UNAME_MACHINE}-pc-sysv4.2uw${UNAME_VERSION}
	exit ;;
	i86:OS/2::*)
	# If we were able to find `uname', then EMX Unix compatibility
	# is probably installed.
	echo ${UNAME_MACHINE}-pc-os2-emx
	exit ;;
	i86:XTS-300::STOP)
	echo ${UNAME_MACHINE}-unknown-stop
	exit ;;
	i86:atheos::*)
	echo ${UNAME_MACHINE}-unknown-atheos
	exit ;;
	i86:syllable::*)
	echo ${UNAME_MACHINE}-pc-syllable
	exit ;;
	i86:LynxOS:2.:* \| i86:LynxOS:3.[01]:* \| i86:LynxOS:4.[02]:*)
	echo i386-unknown-lynxos${UNAME_RELEASE}
	exit ;;
	i86:DOS::)
	echo ${UNAME_MACHINE}-pc-msdosdjgpp
	exit ;;
	i86::4.: \| i86:SYSTEM_V:4.:*)
	UNAME_REL=`echo ${UNAME_RELEASE} \| sed 's/\/MP$//'`
	if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then
	echo ${UNAME_MACHINE}-univel-sysv${UNAME_REL}
	else
	echo ${UNAME_MACHINE}-pc-sysv${UNAME_REL}
	fi
	exit ;;
	i86::5:[678]*)
	# UnixWare 7.x, OpenUNIX and OpenServer 6.
	case `/bin/uname -X \| grep "^Machine"` in
	486) UNAME_MACHINE=i486 ;;
	*Pentium) UNAME_MACHINE=i586 ;;
	Pent\|*Celeron) UNAME_MACHINE=i686 ;;
	esac
	echo ${UNAME_MACHINE}-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION}
	exit ;;
	i86::3.2:*)
	if test -f /usr/options/cb.name; then
	UNAME_REL=`sed -n 's/.*Version //p' </usr/options/cb.name`
	echo ${UNAME_MACHINE}-pc-isc$UNAME_REL
	elif /bin/uname -X 2>/dev/null >/dev/null ; then
	UNAME_REL=`(/bin/uname -X\|grep Release\|sed -e 's/.*= //')`
	(/bin/uname -X\|grep i80486 >/dev/null) && UNAME_MACHINE=i486
	(/bin/uname -X\|grep '^Machine.*Pentium' >/dev/null) \
	&& UNAME_MACHINE=i586
	(/bin/uname -X\|grep '^Machine.Pent II' >/dev/null) \
	&& UNAME_MACHINE=i686
	(/bin/uname -X\|grep '^Machine.*Pentium Pro' >/dev/null) \
	&& UNAME_MACHINE=i686
	echo ${UNAME_MACHINE}-pc-sco$UNAME_REL
	else
	echo ${UNAME_MACHINE}-pc-sysv32
	fi
	exit ;;
	pc:::*)
	# Left here for compatibility:
	# uname -m prints for DJGPP always 'pc', but it prints nothing about
	# the processor, so we play safe by assuming i586.
	# Note: whatever this is, it MUST be the same as what config.sub
	# prints for the "djgpp" host, or else GDB configure will decide that
	# this is a cross-build.
	echo i586-pc-msdosdjgpp
	exit ;;
	Intel:Mach:3:)
	echo i386-pc-mach3
	exit ;;
	paragon:::*)
	echo i860-intel-osf1
	exit ;;
	i860::4.:*) # i860-SVR4
	if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then
	echo i860-stardent-sysv${UNAME_RELEASE} # Stardent Vistra i860-SVR4
	else # Add other i860-SVR4 vendors below as they are discovered.
	echo i860-unknown-sysv${UNAME_RELEASE} # Unknown i860-SVR4
	fi
	exit ;;
	mini:CTIX:SYS5:*)
	# "miniframe"
	echo m68010-convergent-sysv
	exit ;;
	mc68k:UNIX:SYSTEM5:3.51m)
	echo m68k-convergent-sysv
	exit ;;
	M680?0:D-NIX:5.3:*)
	echo m68k-diab-dnix
	exit ;;
	M68::R3V[5678]:)
	test -r /sysV68 && { echo 'm68k-motorola-sysv'; exit; } ;;
	3[345]??::4.0:3.0 \| 3[34]??A::4.0:3.0 \| 3[34]??,::4.0:3.0 \| 3[34]??/::4.0:3.0 \| 4400::4.0:3.0 \| 4850::4.0:3.0 \| SKA40::4.0:3.0 \| SDS2::4.0:3.0 \| SHG2::4.0:3.0 \| S7501:*:4.0:3.0)
	OS_REL=''
	test -r /etc/.relid \
	&& OS_REL=.`sed -n 's/[^ ]* [^ ]* $[0-9][0-9]$.*/\1/p' < /etc/.relid`
	/bin/uname -p 2>/dev/null \| grep 86 >/dev/null \
	&& { echo i486-ncr-sysv4.3${OS_REL}; exit; }
	/bin/uname -p 2>/dev/null \| /bin/grep entium >/dev/null \
	&& { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
	3[34]??::4.0: \| 3[34]??,::4.0:*)
	/bin/uname -p 2>/dev/null \| grep 86 >/dev/null \
	&& { echo i486-ncr-sysv4; exit; } ;;
	NCR::4.2:* \| MPRAS::4.2:*)
	OS_REL='.3'
	test -r /etc/.relid \
	&& OS_REL=.`sed -n 's/[^ ]* [^ ]* $[0-9][0-9]$.*/\1/p' < /etc/.relid`
	/bin/uname -p 2>/dev/null \| grep 86 >/dev/null \
	&& { echo i486-ncr-sysv4.3${OS_REL}; exit; }
	/bin/uname -p 2>/dev/null \| /bin/grep entium >/dev/null \
	&& { echo i586-ncr-sysv4.3${OS_REL}; exit; }
	/bin/uname -p 2>/dev/null \| /bin/grep pteron >/dev/null \
	&& { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
	m68:LynxOS:2.:* \| m68:LynxOS:3.0:*)
	echo m68k-unknown-lynxos${UNAME_RELEASE}
	exit ;;
	mc68030:UNIX_System_V:4.:)
	echo m68k-atari-sysv4
	exit ;;
	TSUNAMI:LynxOS:2.:)
	echo sparc-unknown-lynxos${UNAME_RELEASE}
	exit ;;
	rs6000:LynxOS:2.:)
	echo rs6000-unknown-lynxos${UNAME_RELEASE}
	exit ;;
	PowerPC:LynxOS:2.: \| PowerPC:LynxOS:3.[01]: \| PowerPC:LynxOS:4.[02]:)
	echo powerpc-unknown-lynxos${UNAME_RELEASE}
	exit ;;
	SM[BE]S:UNIX_SV::)
	echo mips-dde-sysv${UNAME_RELEASE}
	exit ;;
	RM:ReliantUNIX-::)
	echo mips-sni-sysv4
	exit ;;
	RM:SINIX-::)
	echo mips-sni-sysv4
	exit ;;
	:SINIX-::)
	if uname -p 2>/dev/null >/dev/null ; then
	UNAME_MACHINE=`(uname -p) 2>/dev/null`
	echo ${UNAME_MACHINE}-sni-sysv4
	else
	echo ns32k-sni-sysv
	fi
	exit ;;
	PENTIUM::4.0:*) # Unisys `ClearPath HMP IX 4000' SVR4/MP effort
	# says <Richard.M.Bartel@ccMail.Census.GOV>
	echo i586-unisys-sysv4
	exit ;;
	:UNIX_System_V:4:FTX*)
	# From Gerald Hewes <hewes@openmarket.com>.
	# How about differentiating between stratus architectures? -djm
	echo hppa1.1-stratus-sysv4
	exit ;;
	:::FTX)
	# From seanf@swdc.stratus.com.
	echo i860-stratus-sysv4
	exit ;;
	i86:VOS::*)
	# From Paul.Green@stratus.com.
	echo ${UNAME_MACHINE}-stratus-vos
	exit ;;
	:VOS::*)
	# From Paul.Green@stratus.com.
	echo hppa1.1-stratus-vos
	exit ;;
	mc68:A/UX::*)
	echo m68k-apple-aux${UNAME_RELEASE}
	exit ;;
	news:NEWS-OS:6:*)
	echo mips-sony-newsos6
	exit ;;
	R[34]000:System_V:: \| R4000:UNIX_SYSV:: \| R000:UNIX_SV::*)
	if [ -d /usr/nec ]; then
	echo mips-nec-sysv${UNAME_RELEASE}
	else
	echo mips-unknown-sysv${UNAME_RELEASE}
	fi
	exit ;;
	BeBox:BeOS::) # BeOS running on hardware made by Be, PPC only.
	echo powerpc-be-beos
	exit ;;
	BeMac:BeOS::) # BeOS running on Mac or Mac clone, PPC only.
	echo powerpc-apple-beos
	exit ;;
	BePC:BeOS::) # BeOS running on Intel PC compatible.
	echo i586-pc-beos
	exit ;;
	BePC:Haiku::) # Haiku running on Intel PC compatible.
	echo i586-pc-haiku
	exit ;;
	x86_64:Haiku::)
	echo x86_64-unknown-haiku
	exit ;;
	SX-4:SUPER-UX::)
	echo sx4-nec-superux${UNAME_RELEASE}
	exit ;;
	SX-5:SUPER-UX::)
	echo sx5-nec-superux${UNAME_RELEASE}
	exit ;;
	SX-6:SUPER-UX::)
	echo sx6-nec-superux${UNAME_RELEASE}
	exit ;;
	SX-7:SUPER-UX::)
	echo sx7-nec-superux${UNAME_RELEASE}
	exit ;;
	SX-8:SUPER-UX::)
	echo sx8-nec-superux${UNAME_RELEASE}
	exit ;;
	SX-8R:SUPER-UX::)
	echo sx8r-nec-superux${UNAME_RELEASE}
	exit ;;
	SX-ACE:SUPER-UX::)
	echo sxace-nec-superux${UNAME_RELEASE}
	exit ;;
	Power:Rhapsody::*)
	echo powerpc-apple-rhapsody${UNAME_RELEASE}
	exit ;;
	:Rhapsody::*)
	echo ${UNAME_MACHINE}-apple-rhapsody${UNAME_RELEASE}
	exit ;;
	:Darwin::*)
	UNAME_PROCESSOR=`uname -p` \|\| UNAME_PROCESSOR=unknown
	eval $set_cc_for_build
	if test "$UNAME_PROCESSOR" = unknown ; then
	UNAME_PROCESSOR=powerpc
	fi
	if test `echo "$UNAME_RELEASE" \| sed -e 's/\..*//'` -le 10 ; then
	if [ "$CC_FOR_BUILD" != no_compiler_found ]; then
	if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') \| \
	(CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) \| \
	grep IS_64BIT_ARCH >/dev/null
	then
	case $UNAME_PROCESSOR in
	i386) UNAME_PROCESSOR=x86_64 ;;
	powerpc) UNAME_PROCESSOR=powerpc64 ;;
	esac
	fi
	fi
	elif test "$UNAME_PROCESSOR" = i386 ; then
	# Avoid executing cc on OS X 10.9, as it ships with a stub
	# that puts up a graphical alert prompting to install
	# developer tools. Any system running Mac OS X 10.7 or
	# later (Darwin 11 and later) is required to have a 64-bit
	# processor. This is not true of the ARM version of Darwin
	# that Apple uses in portable devices.
	UNAME_PROCESSOR=x86_64
	fi
	echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
	exit ;;
	:procnto:: \| :QNX:[0123456789]:*)
	UNAME_PROCESSOR=`uname -p`
	if test "$UNAME_PROCESSOR" = x86; then
	UNAME_PROCESSOR=i386
	UNAME_MACHINE=pc
	fi
	echo ${UNAME_PROCESSOR}-${UNAME_MACHINE}-nto-qnx${UNAME_RELEASE}
	exit ;;
	:QNX::4*)
	echo i386-pc-qnx
	exit ;;
	NEO-?:NONSTOP_KERNEL::)
	echo neo-tandem-nsk${UNAME_RELEASE}
	exit ;;
	NSE-:NONSTOP_KERNEL::*)
	echo nse-tandem-nsk${UNAME_RELEASE}
	exit ;;
	NSR-?:NONSTOP_KERNEL::)
	echo nsr-tandem-nsk${UNAME_RELEASE}
	exit ;;
	:NonStop-UX::*)
	echo mips-compaq-nonstopux
	exit ;;
	BS2000:POSIX::*)
	echo bs2000-siemens-sysv
	exit ;;
	DS/:UNIX_System_V::*)
	echo ${UNAME_MACHINE}-${UNAME_SYSTEM}-${UNAME_RELEASE}
	exit ;;
	:Plan9::*)
	# "uname -m" is not consistent, so use $cputype instead. 386
	# is converted to i386 for consistency with other x86
	# operating systems.
	if test "$cputype" = 386; then
	UNAME_MACHINE=i386
	else
	UNAME_MACHINE="$cputype"
	fi
	echo ${UNAME_MACHINE}-unknown-plan9
	exit ;;
	:TOPS-10::*)
	echo pdp10-unknown-tops10
	exit ;;
	:TENEX::*)
	echo pdp10-unknown-tenex
	exit ;;
	KS10:TOPS-20:: \| KL10:TOPS-20:: \| TYPE4:TOPS-20::)
	echo pdp10-dec-tops20
	exit ;;
	XKL-1:TOPS-20:: \| TYPE5:TOPS-20::)
	echo pdp10-xkl-tops20
	exit ;;
	:TOPS-20::*)
	echo pdp10-unknown-tops20
	exit ;;
	:ITS::*)
	echo pdp10-unknown-its
	exit ;;
	SEI:::SEIUX)
	echo mips-sei-seiux${UNAME_RELEASE}
	exit ;;
	:DragonFly::*)
	echo ${UNAME_MACHINE}-unknown-dragonfly`echo ${UNAME_RELEASE}\|sed -e 's/[-(].*//'`
	exit ;;
	:VMS::)
	UNAME_MACHINE=`(uname -p) 2>/dev/null`
	case "${UNAME_MACHINE}" in
	A*) echo alpha-dec-vms ; exit ;;
	I*) echo ia64-dec-vms ; exit ;;
	V*) echo vax-dec-vms ; exit ;;
	esac ;;
	:XENIX::SysV)
	echo i386-pc-xenix
	exit ;;
	i86:skyos::*)
	echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE} \| sed -e 's/ .*$//'`
	exit ;;
	i86:rdos::*)
	echo ${UNAME_MACHINE}-pc-rdos
	exit ;;
	i86:AROS::*)
	echo ${UNAME_MACHINE}-pc-aros
	exit ;;
	x86_64:VMkernel::)
	echo ${UNAME_MACHINE}-unknown-esx
	exit ;;
	amd64:Isilon\ OneFS::)
	echo x86_64-unknown-onefs
	exit ;;
	esac

	cat >&2 <<EOF
	$0: unable to guess system type

	This script (version $timestamp), has failed to recognize the
	operating system you are using. If your script is old, overwrite
	config.guess and config.sub with the latest versions from:

	http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
	and
	http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub

	If $0 has already been updated, send the following data and any
	information you think might be pertinent to config-patches@gnu.org to
	provide the necessary information to handle your system.

	config.guess timestamp = $timestamp

	uname -m = `(uname -m) 2>/dev/null \|\| echo unknown`
	uname -r = `(uname -r) 2>/dev/null \|\| echo unknown`
	uname -s = `(uname -s) 2>/dev/null \|\| echo unknown`
	uname -v = `(uname -v) 2>/dev/null \|\| echo unknown`

	/usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null`
	/bin/uname -X = `(/bin/uname -X) 2>/dev/null`

	hostinfo = `(hostinfo) 2>/dev/null`
	/bin/universe = `(/bin/universe) 2>/dev/null`
	/usr/bin/arch -k = `(/usr/bin/arch -k) 2>/dev/null`
	/bin/arch = `(/bin/arch) 2>/dev/null`
	/usr/bin/oslevel = `(/usr/bin/oslevel) 2>/dev/null`
	/usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null`

	UNAME_MACHINE = ${UNAME_MACHINE}
	UNAME_RELEASE = ${UNAME_RELEASE}
	UNAME_SYSTEM = ${UNAME_SYSTEM}
	UNAME_VERSION = ${UNAME_VERSION}
	EOF

	exit 1

	# Local variables:
	# eval: (add-hook 'write-file-hooks 'time-stamp)
	# time-stamp-start: "timestamp='"
	# time-stamp-format: "%:y-%02m-%02d"
	# time-stamp-end: "'"
	# End:
	Index: head/contrib/unbound/config.h
	===================================================================
	--- head/contrib/unbound/config.h (revision 349719)
	+++ head/contrib/unbound/config.h (revision 349720)
	@@ -1,1279 +1,1313 @@
	/* config.h. Generated from config.h.in by configure. */
	/* config.h.in. Generated from configure.ac by autoheader. */

	/* apply the noreturn attribute to a function that exits the program */
	#define ATTR_NORETURN __attribute__((__noreturn__))

	/* apply the weak attribute to a symbol */
	#define ATTR_WEAK __attribute__((weak))

	/* Directory to chroot to */
	#define CHROOT_DIR "/var/unbound"

	/* Define this to enable client subnet option. */
	/* #undef CLIENT_SUBNET */

	/* Do sha512 definitions in config.h */
	/* #undef COMPAT_SHA512 */

	/* Pathname to the Unbound configuration file */
	#define CONFIGFILE "/var/unbound/unbound.conf"

	/* Define this if on macOSX10.4-darwin8 and setreuid and setregid do not work
	*/
	/* #undef DARWIN_BROKEN_SETREUID */

	/* Whether daemon is deprecated */
	/* #undef DEPRECATED_DAEMON */

	/* default dnstap socket path */
	/* #undef DNSTAP_SOCKET_PATH */

	/* Define if you want to use debug lock checking (slow). */
	/* #undef ENABLE_LOCK_CHECKS */

	/* Define this if you enabled-allsymbols from libunbound to link binaries to
	it for smaller install size, but the libunbound export table is polluted by
	internal symbols */
	/* #undef EXPORT_ALL_SYMBOLS */

	/* Define to 1 if you have the `accept4' function. */
	#define HAVE_ACCEPT4 1

	/* Define to 1 if you have the `arc4random' function. */
	#define HAVE_ARC4RANDOM 1

	/* Define to 1 if you have the `arc4random_uniform' function. */
	#define HAVE_ARC4RANDOM_UNIFORM 1

	/* Define to 1 if you have the <arpa/inet.h> header file. */
	#define HAVE_ARPA_INET_H 1

	/* Whether the C compiler accepts the "format" attribute */
	#define HAVE_ATTR_FORMAT 1

	/* Whether the C compiler accepts the "noreturn" attribute */
	#define HAVE_ATTR_NORETURN 1

	/* Whether the C compiler accepts the "unused" attribute */
	#define HAVE_ATTR_UNUSED 1

	/* Whether the C compiler accepts the "weak" attribute */
	#define HAVE_ATTR_WEAK 1

	/* Define to 1 if you have the `chown' function. */
	#define HAVE_CHOWN 1

	/* Define to 1 if you have the `chroot' function. */
	#define HAVE_CHROOT 1

	/* Define to 1 if you have the `CRYPTO_cleanup_all_ex_data' function. */
	/* #undef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA */

	+/* Define to 1 if you have the `CRYPTO_THREADID_set_callback' function. */
	+/* #undef HAVE_CRYPTO_THREADID_SET_CALLBACK */
	+
	/* Define to 1 if you have the `ctime_r' function. */
	#define HAVE_CTIME_R 1

	/* Define to 1 if you have the `daemon' function. */
	#define HAVE_DAEMON 1

	/* Define to 1 if you have the declaration of `arc4random', and to 0 if you
	don't. */
	/* #undef HAVE_DECL_ARC4RANDOM */

	/* Define to 1 if you have the declaration of `arc4random_uniform', and to 0
	if you don't. */
	/* #undef HAVE_DECL_ARC4RANDOM_UNIFORM */

	+/* Define to 1 if you have the declaration of `evsignal_assign', and to 0 if
	+ you don't. */
	+/* #undef HAVE_DECL_EVSIGNAL_ASSIGN */
	+
	/* Define to 1 if you have the declaration of `inet_ntop', and to 0 if you
	don't. */
	#define HAVE_DECL_INET_NTOP 1

	/* Define to 1 if you have the declaration of `inet_pton', and to 0 if you
	don't. */
	#define HAVE_DECL_INET_PTON 1

	/* Define to 1 if you have the declaration of `NID_ED25519', and to 0 if you
	don't. */
	#define HAVE_DECL_NID_ED25519 1

	/* Define to 1 if you have the declaration of `NID_ED448', and to 0 if you
	don't. */
	#define HAVE_DECL_NID_ED448 1

	/* Define to 1 if you have the declaration of `NID_secp384r1', and to 0 if you
	don't. */
	#define HAVE_DECL_NID_SECP384R1 1

	/* Define to 1 if you have the declaration of `NID_X9_62_prime256v1', and to 0
	if you don't. */
	#define HAVE_DECL_NID_X9_62_PRIME256V1 1

	/* Define to 1 if you have the declaration of `reallocarray', and to 0 if you
	don't. */
	/* #undef HAVE_DECL_REALLOCARRAY */

	/* Define to 1 if you have the declaration of `redisConnect', and to 0 if you
	don't. */
	/* #undef HAVE_DECL_REDISCONNECT */

	/* Define to 1 if you have the declaration of `sk_SSL_COMP_pop_free', and to 0
	if you don't. */
	#define HAVE_DECL_SK_SSL_COMP_POP_FREE 1

	/* Define to 1 if you have the declaration of
	`SSL_COMP_get_compression_methods', and to 0 if you don't. */
	#define HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS 1

	/* Define to 1 if you have the declaration of `SSL_CTX_set_ecdh_auto', and to
	0 if you don't. */
	#define HAVE_DECL_SSL_CTX_SET_ECDH_AUTO 1

	/* Define to 1 if you have the declaration of `strlcat', and to 0 if you
	don't. */
	/* #undef HAVE_DECL_STRLCAT */

	/* Define to 1 if you have the declaration of `strlcpy', and to 0 if you
	don't. */
	/* #undef HAVE_DECL_STRLCPY */

	/* Define to 1 if you have the declaration of `XML_StopParser', and to 0 if
	you don't. */
	#define HAVE_DECL_XML_STOPPARSER 1

	/* Define to 1 if you have the <dlfcn.h> header file. */
	#define HAVE_DLFCN_H 1

	/* Define to 1 if you have the `DSA_SIG_set0' function. */
	#define HAVE_DSA_SIG_SET0 1

	/* Define to 1 if you have the <endian.h> header file. */
	/* #undef HAVE_ENDIAN_H */

	/* Define to 1 if you have the `endprotoent' function. */
	#define HAVE_ENDPROTOENT 1

	/* Define to 1 if you have the `endpwent' function. */
	#define HAVE_ENDPWENT 1

	/* Define to 1 if you have the `endservent' function. */
	#define HAVE_ENDSERVENT 1

	/* Define to 1 if you have the `ERR_free_strings' function. */
	/* #undef HAVE_ERR_FREE_STRINGS */

	/* Define to 1 if you have the `ERR_load_crypto_strings' function. */
	/* #undef HAVE_ERR_LOAD_CRYPTO_STRINGS */

	+/* Define to 1 if you have the `event_assign' function. */
	+/* #undef HAVE_EVENT_ASSIGN */
	+
	/* Define to 1 if you have the `event_base_free' function. */
	/* #undef HAVE_EVENT_BASE_FREE */

	/* Define to 1 if you have the `event_base_get_method' function. */
	/* #undef HAVE_EVENT_BASE_GET_METHOD */

	/* Define to 1 if you have the `event_base_new' function. */
	/* #undef HAVE_EVENT_BASE_NEW */

	/* Define to 1 if you have the `event_base_once' function. */
	/* #undef HAVE_EVENT_BASE_ONCE */

	/* Define to 1 if you have the <event.h> header file. */
	/* #undef HAVE_EVENT_H */

	+/* Define to 1 if you have the `EVP_aes_256_cbc' function. */
	+#define HAVE_EVP_AES_256_CBC 1
	+
	/* Define to 1 if you have the `EVP_cleanup' function. */
	/* #undef HAVE_EVP_CLEANUP */

	/* Define to 1 if you have the `EVP_DigestVerify' function. */
	#define HAVE_EVP_DIGESTVERIFY 1

	/* Define to 1 if you have the `EVP_dss1' function. */
	/* #undef HAVE_EVP_DSS1 */

	+/* Define to 1 if you have the `EVP_EncryptInit_ex' function. */
	+#define HAVE_EVP_ENCRYPTINIT_EX 1
	+
	/* Define to 1 if you have the `EVP_MD_CTX_new' function. */
	#define HAVE_EVP_MD_CTX_NEW 1

	/* Define to 1 if you have the `EVP_sha1' function. */
	#define HAVE_EVP_SHA1 1

	/* Define to 1 if you have the `EVP_sha256' function. */
	#define HAVE_EVP_SHA256 1

	/* Define to 1 if you have the `EVP_sha512' function. */
	#define HAVE_EVP_SHA512 1

	/* Define to 1 if you have the `ev_default_loop' function. */
	/* #undef HAVE_EV_DEFAULT_LOOP */

	/* Define to 1 if you have the `ev_loop' function. */
	/* #undef HAVE_EV_LOOP */

	/* Define to 1 if you have the <expat.h> header file. */
	#define HAVE_EXPAT_H 1

	/* Define to 1 if you have the `explicit_bzero' function. */
	#define HAVE_EXPLICIT_BZERO 1

	/* Define to 1 if you have the `fcntl' function. */
	#define HAVE_FCNTL 1

	/* Define to 1 if you have the `FIPS_mode' function. */
	#define HAVE_FIPS_MODE 1

	/* Define to 1 if you have the `fork' function. */
	#define HAVE_FORK 1

	/* Define to 1 if fseeko (and presumably ftello) exists and is declared. */
	#define HAVE_FSEEKO 1

	/* Define to 1 if you have the `fsync' function. */
	#define HAVE_FSYNC 1

	/* Whether getaddrinfo is available */
	#define HAVE_GETADDRINFO 1

	/* Define to 1 if you have the `getauxval' function. */
	/* #undef HAVE_GETAUXVAL */

	/* Define to 1 if you have the `getentropy' function. */
	/* #undef HAVE_GETENTROPY */

	/* Define to 1 if you have the <getopt.h> header file. */
	#define HAVE_GETOPT_H 1

	/* Define to 1 if you have the `getpwnam' function. */
	#define HAVE_GETPWNAM 1

	/* Define to 1 if you have the `getrlimit' function. */
	#define HAVE_GETRLIMIT 1

	/* Define to 1 if you have the `glob' function. */
	#define HAVE_GLOB 1

	/* Define to 1 if you have the <glob.h> header file. */
	#define HAVE_GLOB_H 1

	/* Define to 1 if you have the `gmtime_r' function. */
	#define HAVE_GMTIME_R 1

	/* Define to 1 if you have the <grp.h> header file. */
	#define HAVE_GRP_H 1

	/* Define to 1 if you have the <hiredis/hiredis.h> header file. */
	/* #undef HAVE_HIREDIS_HIREDIS_H */

	+/* Define to 1 if you have the `HMAC_Init_ex' function. */
	+#define HAVE_HMAC_INIT_EX 1
	+
	/* If you have HMAC_Update */
	#define HAVE_HMAC_UPDATE 1

	/* Define to 1 if you have the `inet_aton' function. */
	#define HAVE_INET_ATON 1

	/* Define to 1 if you have the `inet_ntop' function. */
	#define HAVE_INET_NTOP 1

	/* Define to 1 if you have the `inet_pton' function. */
	#define HAVE_INET_PTON 1

	/* Define to 1 if you have the `initgroups' function. */
	#define HAVE_INITGROUPS 1

	/* Define to 1 if you have the <inttypes.h> header file. */
	#define HAVE_INTTYPES_H 1

	/* if the function 'ioctlsocket' is available */
	/* #undef HAVE_IOCTLSOCKET */

	/* Define to 1 if you have the <iphlpapi.h> header file. */
	/* #undef HAVE_IPHLPAPI_H */

	/* Define to 1 if you have the `isblank' function. */
	#define HAVE_ISBLANK 1

	/* Define to 1 if you have the `kill' function. */
	#define HAVE_KILL 1

	/* Define to 1 if you have the <libkern/OSByteOrder.h> header file. */
	/* #undef HAVE_LIBKERN_OSBYTEORDER_H */

	/* Define if we have LibreSSL */
	/* #undef HAVE_LIBRESSL */

	/* Define to 1 if you have the `localtime_r' function. */
	#define HAVE_LOCALTIME_R 1

	/* Define to 1 if you have the <login_cap.h> header file. */
	#define HAVE_LOGIN_CAP_H 1

	/* If have GNU libc compatible malloc */
	#define HAVE_MALLOC 1

	/* Define to 1 if you have the `memmove' function. */
	#define HAVE_MEMMOVE 1

	/* Define to 1 if you have the <memory.h> header file. */
	#define HAVE_MEMORY_H 1

	/* Define to 1 if you have the <netdb.h> header file. */
	#define HAVE_NETDB_H 1

	/* Define to 1 if you have the <netinet/in.h> header file. */
	#define HAVE_NETINET_IN_H 1

	/* Define to 1 if you have the <netinet/tcp.h> header file. */
	#define HAVE_NETINET_TCP_H 1

	/* Use libnettle for crypto */
	/* #undef HAVE_NETTLE */

	/* Define to 1 if you have the <nettle/dsa-compat.h> header file. */
	/* #undef HAVE_NETTLE_DSA_COMPAT_H */

	/* Define to 1 if you have the <nettle/eddsa.h> header file. */
	/* #undef HAVE_NETTLE_EDDSA_H */

	/* Use libnss for crypto */
	/* #undef HAVE_NSS */

	/* Define to 1 if you have the `OpenSSL_add_all_digests' function. */
	/* #undef HAVE_OPENSSL_ADD_ALL_DIGESTS */

	/* Define to 1 if you have the <openssl/bn.h> header file. */
	#define HAVE_OPENSSL_BN_H 1

	/* Define to 1 if you have the `OPENSSL_config' function. */
	#define HAVE_OPENSSL_CONFIG 1

	/* Define to 1 if you have the <openssl/conf.h> header file. */
	#define HAVE_OPENSSL_CONF_H 1

	/* Define to 1 if you have the <openssl/dh.h> header file. */
	#define HAVE_OPENSSL_DH_H 1

	/* Define to 1 if you have the <openssl/dsa.h> header file. */
	#define HAVE_OPENSSL_DSA_H 1

	/* Define to 1 if you have the <openssl/engine.h> header file. */
	#define HAVE_OPENSSL_ENGINE_H 1

	/* Define to 1 if you have the <openssl/err.h> header file. */
	#define HAVE_OPENSSL_ERR_H 1

	/* Define to 1 if you have the `OPENSSL_init_crypto' function. */
	#define HAVE_OPENSSL_INIT_CRYPTO 1

	/* Define to 1 if you have the `OPENSSL_init_ssl' function. */
	#define HAVE_OPENSSL_INIT_SSL 1

	/* Define to 1 if you have the <openssl/rand.h> header file. */
	#define HAVE_OPENSSL_RAND_H 1

	/* Define to 1 if you have the <openssl/rsa.h> header file. */
	#define HAVE_OPENSSL_RSA_H 1

	/* Define to 1 if you have the <openssl/ssl.h> header file. */
	#define HAVE_OPENSSL_SSL_H 1

	/* Define if you have POSIX threads libraries and header files. */
	#define HAVE_PTHREAD 1

	/* Have PTHREAD_PRIO_INHERIT. */
	#define HAVE_PTHREAD_PRIO_INHERIT 1

	/* Define to 1 if the system has the type `pthread_rwlock_t'. */
	#define HAVE_PTHREAD_RWLOCK_T 1

	/* Define to 1 if the system has the type `pthread_spinlock_t'. */
	#define HAVE_PTHREAD_SPINLOCK_T 1

	/* Define to 1 if you have the <pwd.h> header file. */
	#define HAVE_PWD_H 1

	/* Define if you have Python libraries and header files. */
	/* #undef HAVE_PYTHON */

	/* Define to 1 if you have the `random' function. */
	#define HAVE_RANDOM 1

	/* Define to 1 if you have the `RAND_cleanup' function. */
	/* #undef HAVE_RAND_CLEANUP */

	-/* Define to 1 if you have the `reallocarray' function. */
	+/* If we have reallocarray(3) */
	#define HAVE_REALLOCARRAY 1

	/* Define to 1 if you have the `recvmsg' function. */
	#define HAVE_RECVMSG 1

	/* Define to 1 if you have the `sendmsg' function. */
	#define HAVE_SENDMSG 1

	/* Define to 1 if you have the `setregid' function. */
	/* #undef HAVE_SETREGID */

	/* Define to 1 if you have the `setresgid' function. */
	#define HAVE_SETRESGID 1

	/* Define to 1 if you have the `setresuid' function. */
	#define HAVE_SETRESUID 1

	/* Define to 1 if you have the `setreuid' function. */
	/* #undef HAVE_SETREUID */

	/* Define to 1 if you have the `setrlimit' function. */
	#define HAVE_SETRLIMIT 1

	/* Define to 1 if you have the `setsid' function. */
	#define HAVE_SETSID 1

	/* Define to 1 if you have the `setusercontext' function. */
	#define HAVE_SETUSERCONTEXT 1

	/* Define to 1 if you have the `SHA512_Update' function. */
	/* #undef HAVE_SHA512_UPDATE */

	/* Define to 1 if you have the `shmget' function. */
	#define HAVE_SHMGET 1

	/* Define to 1 if you have the `sigprocmask' function. */
	#define HAVE_SIGPROCMASK 1

	/* Define to 1 if you have the `sleep' function. */
	#define HAVE_SLEEP 1

	/* Define to 1 if you have the `snprintf' function. */
	#define HAVE_SNPRINTF 1

	/* Define to 1 if you have the `socketpair' function. */
	#define HAVE_SOCKETPAIR 1

	/* Using Solaris threads */
	/* #undef HAVE_SOLARIS_THREADS */

	/* Define to 1 if you have the `srandom' function. */
	#define HAVE_SRANDOM 1

	/* Define if you have the SSL libraries installed. */
	#define HAVE_SSL /**/

	+/* Define to 1 if you have the `SSL_CTX_set_ciphersuites' function. */
	+#define HAVE_SSL_CTX_SET_CIPHERSUITES 1
	+
	/* Define to 1 if you have the `SSL_CTX_set_security_level' function. */
	#define HAVE_SSL_CTX_SET_SECURITY_LEVEL 1

	+/* Define to 1 if you have the `SSL_CTX_set_tlsext_ticket_key_cb' function. */
	+/* #undef HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_CB */
	+
	/* Define to 1 if you have the `SSL_get0_peername' function. */
	#define HAVE_SSL_GET0_PEERNAME 1

	/* Define to 1 if you have the `SSL_set1_host' function. */
	#define HAVE_SSL_SET1_HOST 1

	/* Define to 1 if you have the <stdarg.h> header file. */
	#define HAVE_STDARG_H 1

	/* Define to 1 if you have the <stdbool.h> header file. */
	#define HAVE_STDBOOL_H 1

	/* Define to 1 if you have the <stdint.h> header file. */
	#define HAVE_STDINT_H 1

	/* Define to 1 if you have the <stdlib.h> header file. */
	#define HAVE_STDLIB_H 1

	/* Define to 1 if you have the `strftime' function. */
	#define HAVE_STRFTIME 1

	/* Define to 1 if you have the <strings.h> header file. */
	#define HAVE_STRINGS_H 1

	/* Define to 1 if you have the <string.h> header file. */
	#define HAVE_STRING_H 1

	/* Define to 1 if you have the `strlcat' function. */
	#define HAVE_STRLCAT 1

	/* Define to 1 if you have the `strlcpy' function. */
	#define HAVE_STRLCPY 1

	/* Define to 1 if you have the `strptime' function. */
	#define HAVE_STRPTIME 1

	/* Define to 1 if you have the `strsep' function. */
	#define HAVE_STRSEP 1

	/* Define to 1 if `ipi_spec_dst' is a member of `struct in_pktinfo'. */
	/* #undef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST */

	/* Define to 1 if `sun_len' is a member of `struct sockaddr_un'. */
	#define HAVE_STRUCT_SOCKADDR_UN_SUN_LEN 1

	/* Define if you have Swig libraries and header files. */
	/* #undef HAVE_SWIG */

	/* Define to 1 if you have the <syslog.h> header file. */
	#define HAVE_SYSLOG_H 1

	/* Define to 1 if systemd should be used */
	/* #undef HAVE_SYSTEMD */

	/* Define to 1 if you have the <sys/endian.h> header file. */
	#define HAVE_SYS_ENDIAN_H 1

	/* Define to 1 if you have the <sys/ipc.h> header file. */
	#define HAVE_SYS_IPC_H 1

	/* Define to 1 if you have the <sys/param.h> header file. */
	#define HAVE_SYS_PARAM_H 1

	/* Define to 1 if you have the <sys/resource.h> header file. */
	#define HAVE_SYS_RESOURCE_H 1

	/* Define to 1 if you have the <sys/sha2.h> header file. */
	/* #undef HAVE_SYS_SHA2_H */

	/* Define to 1 if you have the <sys/shm.h> header file. */
	#define HAVE_SYS_SHM_H 1

	/* Define to 1 if you have the <sys/socket.h> header file. */
	#define HAVE_SYS_SOCKET_H 1

	/* Define to 1 if you have the <sys/stat.h> header file. */
	#define HAVE_SYS_STAT_H 1

	/* Define to 1 if you have the <sys/sysctl.h> header file. */
	/* #undef HAVE_SYS_SYSCTL_H */

	/* Define to 1 if you have the <sys/types.h> header file. */
	#define HAVE_SYS_TYPES_H 1

	/* Define to 1 if you have the <sys/uio.h> header file. */
	#define HAVE_SYS_UIO_H 1

	/* Define to 1 if you have the <sys/un.h> header file. */
	#define HAVE_SYS_UN_H 1

	/* Define to 1 if you have the <sys/wait.h> header file. */
	#define HAVE_SYS_WAIT_H 1

	/* Define to 1 if you have the <time.h> header file. */
	#define HAVE_TIME_H 1

	/* Define to 1 if you have the `tzset' function. */
	#define HAVE_TZSET 1

	/* Define to 1 if you have the <unistd.h> header file. */
	#define HAVE_UNISTD_H 1

	/* Define to 1 if you have the `usleep' function. */
	#define HAVE_USLEEP 1

	/* Define to 1 if you have the `vfork' function. */
	#define HAVE_VFORK 1

	/* Define to 1 if you have the <vfork.h> header file. */
	/* #undef HAVE_VFORK_H */

	/* Define to 1 if you have the <windows.h> header file. */
	/* #undef HAVE_WINDOWS_H */

	/* Using Windows threads */
	/* #undef HAVE_WINDOWS_THREADS */

	/* Define to 1 if you have the <winsock2.h> header file. */
	/* #undef HAVE_WINSOCK2_H */

	/* Define to 1 if `fork' works. */
	#define HAVE_WORKING_FORK 1

	/* Define to 1 if `vfork' works. */
	#define HAVE_WORKING_VFORK 1

	/* Define to 1 if you have the `writev' function. */
	#define HAVE_WRITEV 1

	/* Define to 1 if you have the <ws2tcpip.h> header file. */
	/* #undef HAVE_WS2TCPIP_H */

	+/* Define to 1 if you have the `X509_VERIFY_PARAM_set1_host' function. */
	+#define HAVE_X509_VERIFY_PARAM_SET1_HOST 1
	+
	/* Define to 1 if you have the `_beginthreadex' function. */
	/* #undef HAVE__BEGINTHREADEX */

	/* if lex has yylex_destroy */
	#define LEX_HAS_YYLEX_DESTROY 1

	/* Define to the sub-directory where libtool stores uninstalled libraries. */
	#define LT_OBJDIR ".libs/"

	/* Define to the maximum message length to pass to syslog. */
	#define MAXSYSLOGMSGLEN 10240

	/* Define if memcmp() does not compare unsigned bytes */
	/* #undef MEMCMP_IS_BROKEN */

	/* Define if mkdir has one argument. */
	/* #undef MKDIR_HAS_ONE_ARG */

	/* Define if the network stack does not fully support nonblocking io (causes
	lower performance). */
	/* #undef NONBLOCKING_IS_BROKEN */

	/* Put -D_ALL_SOURCE define in config.h */
	/* #undef OMITTED__D_ALL_SOURCE */

	/* Put -D_BSD_SOURCE define in config.h */
	/* #undef OMITTED__D_BSD_SOURCE */

	/* Put -D_DEFAULT_SOURCE define in config.h */
	/* #undef OMITTED__D_DEFAULT_SOURCE */

	/* Put -D_GNU_SOURCE define in config.h */
	/* #undef OMITTED__D_GNU_SOURCE */

	/* Put -D_LARGEFILE_SOURCE=1 define in config.h */
	/* #undef OMITTED__D_LARGEFILE_SOURCE_1 */

	/* Put -D_POSIX_C_SOURCE=200112 define in config.h */
	/* #undef OMITTED__D_POSIX_C_SOURCE_200112 */

	/* Put -D_XOPEN_SOURCE=600 define in config.h */
	/* #undef OMITTED__D_XOPEN_SOURCE_600 */

	/* Put -D_XOPEN_SOURCE_EXTENDED=1 define in config.h */
	/* #undef OMITTED__D_XOPEN_SOURCE_EXTENDED_1 */

	/* Put -D__EXTENSIONS__ define in config.h */
	/* #undef OMITTED__D__EXTENSIONS__ */

	/* Define to the address where bug reports for this package should be sent. */
	#define PACKAGE_BUGREPORT "unbound-bugs@nlnetlabs.nl"

	/* Define to the full name of this package. */
	#define PACKAGE_NAME "unbound"

	/* Define to the full name and version of this package. */
	-#define PACKAGE_STRING "unbound 1.8.1"
	+#define PACKAGE_STRING "unbound 1.9.2"

	/* Define to the one symbol short name of this package. */
	#define PACKAGE_TARNAME "unbound"

	/* Define to the home page for this package. */
	#define PACKAGE_URL ""

	/* Define to the version of this package. */
	-#define PACKAGE_VERSION "1.8.1"
	+#define PACKAGE_VERSION "1.9.2"

	/* default pidfile location */
	#define PIDFILE "/var/unbound/unbound.pid"

	/* Define to necessary symbol if this constant uses a non-standard name on
	your system. */
	/* #undef PTHREAD_CREATE_JOINABLE */

	/* Define as the return type of signal handlers (`int' or `void'). */
	#define RETSIGTYPE void

	/* if REUSEPORT is enabled by default */
	#define REUSEPORT_DEFAULT 0

	/* default rootkey location */
	#define ROOT_ANCHOR_FILE "/var/unbound/root.key"

	/* default rootcert location */
	#define ROOT_CERT_FILE "/var/unbound/icannbundle.pem"

	/* version number for resource files */
	-#define RSRC_PACKAGE_VERSION 1,8,1,0
	+#define RSRC_PACKAGE_VERSION 1,9,2,0

	/* Directory to chdir to */
	#define RUN_DIR "/var/unbound"

	/* Shared data */
	#define SHARE_DIR "/var/unbound"

	/* The size of `time_t', as computed by sizeof. */
	#define SIZEOF_TIME_T 8

	/* define if (v)snprintf does not return length needed, (but length used) */
	/* #undef SNPRINTF_RET_BROKEN */

	/* Define to 1 if libsodium supports sodium_set_misuse_handler */
	/* #undef SODIUM_MISUSE_HANDLER */

	/* Define to 1 if you have the ANSI C header files. */
	#define STDC_HEADERS 1

	/* use default strptime. */
	#define STRPTIME_WORKS 1

	/* Use win32 resources and API */
	/* #undef UB_ON_WINDOWS */

	/* default username */
	#define UB_USERNAME "unbound"

	/* use to enable lightweight alloc assertions, for debug use */
	/* #undef UNBOUND_ALLOC_LITE */

	/* use malloc not regions, for debug use */
	/* #undef UNBOUND_ALLOC_NONREGIONAL */

	/* use statistics for allocs and frees, for debug use */
	/* #undef UNBOUND_ALLOC_STATS */

	/* define this to enable debug checks. */
	/* #undef UNBOUND_DEBUG */

	/* Define to 1 to use cachedb support */
	/* #undef USE_CACHEDB */

	/* Define to 1 to enable dnscrypt support */
	/* #undef USE_DNSCRYPT */

	/* Define to 1 to enable dnscrypt with xchacha20 support */
	/* #undef USE_DNSCRYPT_XCHACHA20 */

	/* Define to 1 to enable dnstap support */
	/* #undef USE_DNSTAP */

	/* Define this to enable DSA support. */
	#define USE_DSA 1

	/* Define this to enable ECDSA support. */
	#define USE_ECDSA 1

	/* Define this to enable an EVP workaround for older openssl */
	/* #undef USE_ECDSA_EVP_WORKAROUND */

	/* Define this to enable ED25519 support. */
	#define USE_ED25519 1

	/* Define this to enable ED448 support. */
	#define USE_ED448 1

	/* Define this to enable GOST support. */
	/* #undef USE_GOST */

	/* Define to 1 to use ipsecmod support. */
	/* #undef USE_IPSECMOD */

	/* Define if you want to use internal select based events */
	#define USE_MINI_EVENT 1

	/* Define this to enable client TCP Fast Open. */
	/* #undef USE_MSG_FASTOPEN */

	/* Define this to enable client TCP Fast Open. */
	/* #undef USE_OSX_MSG_FASTOPEN */

	/* Define this to use hiredis client. */
	/* #undef USE_REDIS */

	/* Define this to enable SHA1 support. */
	#define USE_SHA1 1

	/* Define this to enable SHA256 and SHA512 support. */
	#define USE_SHA2 1

	/* Enable extensions on AIX 3, Interix. */
	#ifndef _ALL_SOURCE
	# define _ALL_SOURCE 1
	#endif
	/* Enable GNU extensions on systems that have them. */
	#ifndef _GNU_SOURCE
	# define _GNU_SOURCE 1
	#endif
	/* Enable threading extensions on Solaris. */
	#ifndef _POSIX_PTHREAD_SEMANTICS
	# define _POSIX_PTHREAD_SEMANTICS 1
	#endif
	/* Enable extensions on HP NonStop. */
	#ifndef _TANDEM_SOURCE
	# define _TANDEM_SOURCE 1
	#endif
	/* Enable general extensions on Solaris. */
	#ifndef __EXTENSIONS__
	# define __EXTENSIONS__ 1
	#endif


	/* Define this to enable server TCP Fast Open. */
	/* #undef USE_TCP_FASTOPEN */

	/* Whether the windows socket API is used */
	/* #undef USE_WINSOCK */

	/* the version of the windows API enabled */
	#define WINVER 0x0502

	/* Define if you want Python module. */
	/* #undef WITH_PYTHONMODULE */

	/* Define if you want PyUnbound. */
	/* #undef WITH_PYUNBOUND */

	/* Define to 1 if `lex' declares `yytext' as a `char *' by default, not a
	`char[]'. */
	#define YYTEXT_POINTER 1

	/* Enable large inode numbers on Mac OS X 10.5. */
	#ifndef _DARWIN_USE_64_BIT_INODE
	# define _DARWIN_USE_64_BIT_INODE 1
	#endif

	/* Number of bits in a file offset, on hosts where this is settable. */
	/* #undef _FILE_OFFSET_BITS */

	/* Define to 1 to make fseeko visible on some hosts (e.g. glibc 2.2). */
	/* #undef _LARGEFILE_SOURCE */

	/* Define for large files, on AIX-style hosts. */
	/* #undef _LARGE_FILES */

	/* Define to 1 if on MINIX. */
	/* #undef _MINIX */

	/* Enable for compile on Minix */
	/* #undef _NETBSD_SOURCE */

	/* Define to 2 if the system does not provide POSIX.1 features except with
	this defined. */
	/* #undef _POSIX_1_SOURCE */

	/* Define to 1 if you need to in order for `stat' and other things to work. */
	/* #undef _POSIX_SOURCE */

	/* Define to empty if `const' does not conform to ANSI C. */
	/* #undef const */

	/* Define to `int' if <sys/types.h> doesn't define. */
	/* #undef gid_t */

	/* in_addr_t */
	/* #undef in_addr_t */

	/* in_port_t */
	/* #undef in_port_t */

	/* Define to `__inline__' or `__inline' if that's what the C compiler
	calls it, or to nothing if 'inline' is not supported under any name. */
	#ifndef __cplusplus
	/* #undef inline */
	#endif

	/* Define to `short' if <sys/types.h> does not define. */
	/* #undef int16_t */

	/* Define to `int' if <sys/types.h> does not define. */
	/* #undef int32_t */

	/* Define to `long long' if <sys/types.h> does not define. */
	/* #undef int64_t */

	/* Define to `signed char' if <sys/types.h> does not define. */
	/* #undef int8_t */

	/* Define if replacement function should be used. */
	/* #undef malloc */

	/* Define to `long int' if <sys/types.h> does not define. */
	/* #undef off_t */

	/* Define to `int' if <sys/types.h> does not define. */
	/* #undef pid_t */

	/* Define to 'int' if not defined */
	/* #undef rlim_t */

	/* Define to `unsigned int' if <sys/types.h> does not define. */
	/* #undef size_t */

	/* Define to 'int' if not defined */
	/* #undef socklen_t */

	/* Define to `int' if <sys/types.h> does not define. */
	/* #undef ssize_t */

	/* Define to 'unsigned char if not defined */
	/* #undef u_char */

	/* Define to `int' if <sys/types.h> doesn't define. */
	/* #undef uid_t */

	/* Define to `unsigned short' if <sys/types.h> does not define. */
	/* #undef uint16_t */

	/* Define to `unsigned int' if <sys/types.h> does not define. */
	/* #undef uint32_t */

	/* Define to `unsigned long long' if <sys/types.h> does not define. */
	/* #undef uint64_t */

	/* Define to `unsigned char' if <sys/types.h> does not define. */
	/* #undef uint8_t */

	/* Define as `fork' if `vfork' does not work. */
	/* #undef vfork */

	#if defined(OMITTED__D_GNU_SOURCE) && !defined(_GNU_SOURCE)
	#define _GNU_SOURCE 1
	#endif

	#if defined(OMITTED__D_BSD_SOURCE) && !defined(_BSD_SOURCE)
	#define _BSD_SOURCE 1
	#endif

	#if defined(OMITTED__D_DEFAULT_SOURCE) && !defined(_DEFAULT_SOURCE)
	#define _DEFAULT_SOURCE 1
	#endif

	#if defined(OMITTED__D__EXTENSIONS__) && !defined(__EXTENSIONS__)
	#define __EXTENSIONS__ 1
	#endif

	#if defined(OMITTED__D_POSIX_C_SOURCE_200112) && !defined(_POSIX_C_SOURCE)
	#define _POSIX_C_SOURCE 200112
	#endif

	#if defined(OMITTED__D_XOPEN_SOURCE_600) && !defined(_XOPEN_SOURCE)
	#define _XOPEN_SOURCE 600
	#endif

	#if defined(OMITTED__D_XOPEN_SOURCE_EXTENDED_1) && !defined(_XOPEN_SOURCE_EXTENDED)
	#define _XOPEN_SOURCE_EXTENDED 1
	#endif

	#if defined(OMITTED__D_ALL_SOURCE) && !defined(_ALL_SOURCE)
	#define _ALL_SOURCE 1
	#endif

	#if defined(OMITTED__D_LARGEFILE_SOURCE_1) && !defined(_LARGEFILE_SOURCE)
	#define _LARGEFILE_SOURCE 1
	#endif




	+#ifndef _OPENBSD_SOURCE
	+#define _OPENBSD_SOURCE 1
	+#endif
	+
	#ifndef UNBOUND_DEBUG
	+# ifndef NDEBUG
	# define NDEBUG
	+# endif
	#endif

	/** Use small-ldns codebase */
	#define USE_SLDNS 1
	#ifdef HAVE_SSL
	# define LDNS_BUILD_CONFIG_HAVE_SSL 1
	#endif

	#include <stdio.h>
	#include <string.h>
	#include <unistd.h>
	#include <assert.h>

	#if STDC_HEADERS
	#include <stdlib.h>
	#include <stddef.h>
	#endif

	#ifdef HAVE_STDARG_H
	#include <stdarg.h>
	#endif

	#ifdef HAVE_STDINT_H
	#include <stdint.h>
	#endif

	#include <errno.h>

	#if HAVE_SYS_PARAM_H
	#include <sys/param.h>
	#endif

	#ifdef HAVE_SYS_SOCKET_H
	#include <sys/socket.h>
	#endif

	#ifdef HAVE_SYS_UIO_H
	#include <sys/uio.h>
	#endif

	#ifdef HAVE_NETINET_IN_H
	#include <netinet/in.h>
	#endif

	#ifdef HAVE_NETINET_TCP_H
	#include <netinet/tcp.h>
	#endif

	#ifdef HAVE_ARPA_INET_H
	#include <arpa/inet.h>
	#endif

	#ifdef HAVE_WINSOCK2_H
	#include <winsock2.h>
	#endif

	#ifdef HAVE_WS2TCPIP_H
	#include <ws2tcpip.h>
	#endif

	#ifndef USE_WINSOCK
	#define ARG_LL "%ll"
	#else
	#define ARG_LL "%I64"
	#endif

	#ifndef AF_LOCAL
	#define AF_LOCAL AF_UNIX
	#endif



	#ifdef HAVE_ATTR_FORMAT
	# define ATTR_FORMAT(archetype, string_index, first_to_check) \
	__attribute__ ((format (archetype, string_index, first_to_check)))
	#else /* !HAVE_ATTR_FORMAT */
	# define ATTR_FORMAT(archetype, string_index, first_to_check) /* empty */
	#endif /* !HAVE_ATTR_FORMAT */


	#if defined(DOXYGEN)
	# define ATTR_UNUSED(x) x
	#elif defined(__cplusplus)
	# define ATTR_UNUSED(x)
	#elif defined(HAVE_ATTR_UNUSED)
	# define ATTR_UNUSED(x) x __attribute__((unused))
	#else /* !HAVE_ATTR_UNUSED */
	# define ATTR_UNUSED(x) x
	#endif /* !HAVE_ATTR_UNUSED */


	#ifndef HAVE_FSEEKO
	#define fseeko fseek
	#define ftello ftell
	#endif /* HAVE_FSEEKO */


	#ifndef MAXHOSTNAMELEN
	#define MAXHOSTNAMELEN 256
	#endif

	#if !defined(HAVE_SNPRINTF) \|\| defined(SNPRINTF_RET_BROKEN)
	#define snprintf snprintf_unbound
	#define vsnprintf vsnprintf_unbound
	#include <stdarg.h>
	int snprintf (char str, size_t count, const char fmt, ...);
	int vsnprintf (char str, size_t count, const char fmt, va_list arg);
	#endif /* HAVE_SNPRINTF or SNPRINTF_RET_BROKEN */

	#ifndef HAVE_INET_PTON
	#define inet_pton inet_pton_unbound
	int inet_pton(int af, const char* src, void* dst);
	#endif /* HAVE_INET_PTON */


	#ifndef HAVE_INET_NTOP
	#define inet_ntop inet_ntop_unbound
	const char inet_ntop(int af, const void src, char *dst, size_t size);
	#endif


	#ifndef HAVE_INET_ATON
	#define inet_aton inet_aton_unbound
	int inet_aton(const char cp, struct in_addr addr);
	#endif


	#ifndef HAVE_MEMMOVE
	#define memmove memmove_unbound
	void memmove(void dest, const void *src, size_t n);
	#endif


	#ifndef HAVE_STRLCAT
	#define strlcat strlcat_unbound
	size_t strlcat(char dst, const char src, size_t siz);
	#endif


	#ifndef HAVE_STRLCPY
	#define strlcpy strlcpy_unbound
	size_t strlcpy(char dst, const char src, size_t siz);
	#endif


	#ifndef HAVE_GMTIME_R
	#define gmtime_r gmtime_r_unbound
	struct tm gmtime_r(const time_t timep, struct tm *result);
	#endif


	#ifndef HAVE_REALLOCARRAY
	#define reallocarray reallocarrayunbound
	void* reallocarray(void *ptr, size_t nmemb, size_t size);
	#endif


	#if !defined(HAVE_SLEEP) \|\| defined(HAVE_WINDOWS_H)
	#define sleep(x) Sleep((x)1000) / on win32 */
	#endif /* HAVE_SLEEP */


	#ifndef HAVE_USLEEP
	#define usleep(x) Sleep((x)/1000 + 1) /* on win32 */
	#endif /* HAVE_USLEEP */


	#ifndef HAVE_RANDOM
	#define random rand /* on win32, for tests only (bad random) */
	#endif /* HAVE_RANDOM */


	#ifndef HAVE_SRANDOM
	#define srandom(x) srand(x) /* on win32, for tests only (bad random) */
	#endif /* HAVE_SRANDOM */


	/* detect if we need to cast to unsigned int for FD_SET to avoid warnings */
	#ifdef HAVE_WINSOCK2_H
	#define FD_SET_T (u_int)
	#else
	#define FD_SET_T
	#endif


	#ifndef IPV6_MIN_MTU
	#define IPV6_MIN_MTU 1280
	#endif /* IPV6_MIN_MTU */


	#ifdef MEMCMP_IS_BROKEN
	#include "compat/memcmp.h"
	#define memcmp memcmp_unbound
	int memcmp(const void x, const void y, size_t n);
	#endif



	#ifndef HAVE_CTIME_R
	#define ctime_r unbound_ctime_r
	char ctime_r(const time_t timep, char *buf);
	#endif

	#ifndef HAVE_STRSEP
	#define strsep unbound_strsep
	char strsep(char stringp, const char delim);
	#endif

	#ifndef HAVE_ISBLANK
	#define isblank unbound_isblank
	int isblank(int c);
	#endif

	#ifndef HAVE_EXPLICIT_BZERO
	#define explicit_bzero unbound_explicit_bzero
	void explicit_bzero(void* buf, size_t len);
	#endif

	#if defined(HAVE_INET_NTOP) && !HAVE_DECL_INET_NTOP
	const char inet_ntop(int af, const void src, char *dst, size_t size);
	#endif

	#if defined(HAVE_INET_PTON) && !HAVE_DECL_INET_PTON
	int inet_pton(int af, const char* src, void* dst);
	#endif

	#if !defined(HAVE_STRPTIME) \|\| !defined(STRPTIME_WORKS)
	#define strptime unbound_strptime
	struct tm;
	char strptime(const char s, const char format, struct tm tm);
	#endif

	#ifdef HAVE_LIBRESSL
	# if !HAVE_DECL_STRLCPY
	size_t strlcpy(char dst, const char src, size_t siz);
	# endif
	# if !HAVE_DECL_STRLCAT
	size_t strlcat(char dst, const char src, size_t siz);
	# endif
	# if !HAVE_DECL_ARC4RANDOM && defined(HAVE_ARC4RANDOM)
	uint32_t arc4random(void);
	# endif
	# if !HAVE_DECL_ARC4RANDOM_UNIFORM && defined(HAVE_ARC4RANDOM_UNIFORM)
	uint32_t arc4random_uniform(uint32_t upper_bound);
	# endif
	# if !HAVE_DECL_REALLOCARRAY
	void reallocarray(void ptr, size_t nmemb, size_t size);
	# endif
	#endif /* HAVE_LIBRESSL */
	#ifndef HAVE_ARC4RANDOM
	int getentropy(void* buf, size_t len);
	uint32_t arc4random(void);
	void arc4random_buf(void* buf, size_t n);
	void _ARC4_LOCK(void);
	void _ARC4_UNLOCK(void);
	void _ARC4_LOCK_DESTROY(void);
	#endif
	#ifndef HAVE_ARC4RANDOM_UNIFORM
	uint32_t arc4random_uniform(uint32_t upper_bound);
	#endif
	#ifdef COMPAT_SHA512
	#ifndef SHA512_DIGEST_LENGTH
	#define SHA512_BLOCK_LENGTH 128
	#define SHA512_DIGEST_LENGTH 64
	#define SHA512_DIGEST_STRING_LENGTH (SHA512_DIGEST_LENGTH * 2 + 1)
	typedef struct _SHA512_CTX {
	uint64_t state[8];
	uint64_t bitcount[2];
	uint8_t buffer[SHA512_BLOCK_LENGTH];
	} SHA512_CTX;
	#endif /* SHA512_DIGEST_LENGTH */
	void SHA512_Init(SHA512_CTX*);
	void SHA512_Update(SHA512_CTX, void, size_t);
	void SHA512_Final(uint8_t[SHA512_DIGEST_LENGTH], SHA512_CTX*);
	unsigned char SHA512(void data, unsigned int data_len, unsigned char *digest);
	#endif /* COMPAT_SHA512 */



	#if defined(HAVE_EVENT_H) && !defined(HAVE_EVENT_BASE_ONCE) && !(defined(HAVE_EV_LOOP) \|\| defined(HAVE_EV_DEFAULT_LOOP)) && (defined(HAVE_PTHREAD) \|\| defined(HAVE_SOLARIS_THREADS))
	/* using version of libevent that is not threadsafe. */
	# define LIBEVENT_SIGNAL_PROBLEM 1
	#endif

	#ifndef CHECKED_INET6
	# define CHECKED_INET6
	# ifdef AF_INET6
	# define INET6
	# else
	# define AF_INET6 28
	# endif
	#endif /* CHECKED_INET6 */

	#ifndef HAVE_GETADDRINFO
	struct sockaddr_storage;
	#include "compat/fake-rfc2553.h"
	#endif

	#ifdef UNBOUND_ALLOC_STATS
	# define malloc(s) unbound_stat_malloc_log(s, __FILE__, __LINE__, __func__)
	# define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
	# define free(p) unbound_stat_free_log(p, __FILE__, __LINE__, __func__)
	# define realloc(p,s) unbound_stat_realloc_log(p, s, __FILE__, __LINE__, __func__)
	void *unbound_stat_malloc(size_t size);
	void *unbound_stat_calloc(size_t nmemb, size_t size);
	void unbound_stat_free(void *ptr);
	void unbound_stat_realloc(void ptr, size_t size);
	void unbound_stat_malloc_log(size_t size, const char file, int line,
	const char* func);
	void unbound_stat_calloc_log(size_t nmemb, size_t size, const char file,
	int line, const char* func);
	void unbound_stat_free_log(void ptr, const char file, int line,
	const char* func);
	void unbound_stat_realloc_log(void ptr, size_t size, const char* file,
	int line, const char* func);
	#elif defined(UNBOUND_ALLOC_LITE)
	# include "util/alloc.h"
	#endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */

	/** default port for DNS traffic. */
	#define UNBOUND_DNS_PORT 53
	/** default port for DNS over TLS traffic. */
	#define UNBOUND_DNS_OVER_TLS_PORT 853
	/** default port for unbound control traffic, registered port with IANA,
	ub-dns-control 8953/tcp unbound dns nameserver control */
	#define UNBOUND_CONTROL_PORT 8953
	/** the version of unbound-control that this software implements */
	#define UNBOUND_CONTROL_VERSION 1


	Index: head/contrib/unbound/config.h.in
	===================================================================
	--- head/contrib/unbound/config.h.in (revision 349719)
	+++ head/contrib/unbound/config.h.in (revision 349720)
	@@ -1,1278 +1,1312 @@
	/* config.h.in. Generated from configure.ac by autoheader. */

	/* apply the noreturn attribute to a function that exits the program */
	#undef ATTR_NORETURN

	/* apply the weak attribute to a symbol */
	#undef ATTR_WEAK

	/* Directory to chroot to */
	#undef CHROOT_DIR

	/* Define this to enable client subnet option. */
	#undef CLIENT_SUBNET

	/* Do sha512 definitions in config.h */
	#undef COMPAT_SHA512

	/* Pathname to the Unbound configuration file */
	#undef CONFIGFILE

	/* Define this if on macOSX10.4-darwin8 and setreuid and setregid do not work
	*/
	#undef DARWIN_BROKEN_SETREUID

	/* Whether daemon is deprecated */
	#undef DEPRECATED_DAEMON

	/* default dnstap socket path */
	#undef DNSTAP_SOCKET_PATH

	/* Define if you want to use debug lock checking (slow). */
	#undef ENABLE_LOCK_CHECKS

	/* Define this if you enabled-allsymbols from libunbound to link binaries to
	it for smaller install size, but the libunbound export table is polluted by
	internal symbols */
	#undef EXPORT_ALL_SYMBOLS

	/* Define to 1 if you have the `accept4' function. */
	#undef HAVE_ACCEPT4

	/* Define to 1 if you have the `arc4random' function. */
	#undef HAVE_ARC4RANDOM

	/* Define to 1 if you have the `arc4random_uniform' function. */
	#undef HAVE_ARC4RANDOM_UNIFORM

	/* Define to 1 if you have the <arpa/inet.h> header file. */
	#undef HAVE_ARPA_INET_H

	/* Whether the C compiler accepts the "format" attribute */
	#undef HAVE_ATTR_FORMAT

	/* Whether the C compiler accepts the "noreturn" attribute */
	#undef HAVE_ATTR_NORETURN

	/* Whether the C compiler accepts the "unused" attribute */
	#undef HAVE_ATTR_UNUSED

	/* Whether the C compiler accepts the "weak" attribute */
	#undef HAVE_ATTR_WEAK

	/* Define to 1 if you have the `chown' function. */
	#undef HAVE_CHOWN

	/* Define to 1 if you have the `chroot' function. */
	#undef HAVE_CHROOT

	/* Define to 1 if you have the `CRYPTO_cleanup_all_ex_data' function. */
	#undef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA

	+/* Define to 1 if you have the `CRYPTO_THREADID_set_callback' function. */
	+#undef HAVE_CRYPTO_THREADID_SET_CALLBACK
	+
	/* Define to 1 if you have the `ctime_r' function. */
	#undef HAVE_CTIME_R

	/* Define to 1 if you have the `daemon' function. */
	#undef HAVE_DAEMON

	/* Define to 1 if you have the declaration of `arc4random', and to 0 if you
	don't. */
	#undef HAVE_DECL_ARC4RANDOM

	/* Define to 1 if you have the declaration of `arc4random_uniform', and to 0
	if you don't. */
	#undef HAVE_DECL_ARC4RANDOM_UNIFORM

	+/* Define to 1 if you have the declaration of `evsignal_assign', and to 0 if
	+ you don't. */
	+#undef HAVE_DECL_EVSIGNAL_ASSIGN
	+
	/* Define to 1 if you have the declaration of `inet_ntop', and to 0 if you
	don't. */
	#undef HAVE_DECL_INET_NTOP

	/* Define to 1 if you have the declaration of `inet_pton', and to 0 if you
	don't. */
	#undef HAVE_DECL_INET_PTON

	/* Define to 1 if you have the declaration of `NID_ED25519', and to 0 if you
	don't. */
	#undef HAVE_DECL_NID_ED25519

	/* Define to 1 if you have the declaration of `NID_ED448', and to 0 if you
	don't. */
	#undef HAVE_DECL_NID_ED448

	/* Define to 1 if you have the declaration of `NID_secp384r1', and to 0 if you
	don't. */
	#undef HAVE_DECL_NID_SECP384R1

	/* Define to 1 if you have the declaration of `NID_X9_62_prime256v1', and to 0
	if you don't. */
	#undef HAVE_DECL_NID_X9_62_PRIME256V1

	/* Define to 1 if you have the declaration of `reallocarray', and to 0 if you
	don't. */
	#undef HAVE_DECL_REALLOCARRAY

	/* Define to 1 if you have the declaration of `redisConnect', and to 0 if you
	don't. */
	#undef HAVE_DECL_REDISCONNECT

	/* Define to 1 if you have the declaration of `sk_SSL_COMP_pop_free', and to 0
	if you don't. */
	#undef HAVE_DECL_SK_SSL_COMP_POP_FREE

	/* Define to 1 if you have the declaration of
	`SSL_COMP_get_compression_methods', and to 0 if you don't. */
	#undef HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS

	/* Define to 1 if you have the declaration of `SSL_CTX_set_ecdh_auto', and to
	0 if you don't. */
	#undef HAVE_DECL_SSL_CTX_SET_ECDH_AUTO

	/* Define to 1 if you have the declaration of `strlcat', and to 0 if you
	don't. */
	#undef HAVE_DECL_STRLCAT

	/* Define to 1 if you have the declaration of `strlcpy', and to 0 if you
	don't. */
	#undef HAVE_DECL_STRLCPY

	/* Define to 1 if you have the declaration of `XML_StopParser', and to 0 if
	you don't. */
	#undef HAVE_DECL_XML_STOPPARSER

	/* Define to 1 if you have the <dlfcn.h> header file. */
	#undef HAVE_DLFCN_H

	/* Define to 1 if you have the `DSA_SIG_set0' function. */
	#undef HAVE_DSA_SIG_SET0

	/* Define to 1 if you have the <endian.h> header file. */
	#undef HAVE_ENDIAN_H

	/* Define to 1 if you have the `endprotoent' function. */
	#undef HAVE_ENDPROTOENT

	/* Define to 1 if you have the `endpwent' function. */
	#undef HAVE_ENDPWENT

	/* Define to 1 if you have the `endservent' function. */
	#undef HAVE_ENDSERVENT

	/* Define to 1 if you have the `ERR_free_strings' function. */
	#undef HAVE_ERR_FREE_STRINGS

	/* Define to 1 if you have the `ERR_load_crypto_strings' function. */
	#undef HAVE_ERR_LOAD_CRYPTO_STRINGS

	+/* Define to 1 if you have the `event_assign' function. */
	+#undef HAVE_EVENT_ASSIGN
	+
	/* Define to 1 if you have the `event_base_free' function. */
	#undef HAVE_EVENT_BASE_FREE

	/* Define to 1 if you have the `event_base_get_method' function. */
	#undef HAVE_EVENT_BASE_GET_METHOD

	/* Define to 1 if you have the `event_base_new' function. */
	#undef HAVE_EVENT_BASE_NEW

	/* Define to 1 if you have the `event_base_once' function. */
	#undef HAVE_EVENT_BASE_ONCE

	/* Define to 1 if you have the <event.h> header file. */
	#undef HAVE_EVENT_H

	+/* Define to 1 if you have the `EVP_aes_256_cbc' function. */
	+#undef HAVE_EVP_AES_256_CBC
	+
	/* Define to 1 if you have the `EVP_cleanup' function. */
	#undef HAVE_EVP_CLEANUP

	/* Define to 1 if you have the `EVP_DigestVerify' function. */
	#undef HAVE_EVP_DIGESTVERIFY

	/* Define to 1 if you have the `EVP_dss1' function. */
	#undef HAVE_EVP_DSS1

	+/* Define to 1 if you have the `EVP_EncryptInit_ex' function. */
	+#undef HAVE_EVP_ENCRYPTINIT_EX
	+
	/* Define to 1 if you have the `EVP_MD_CTX_new' function. */
	#undef HAVE_EVP_MD_CTX_NEW

	/* Define to 1 if you have the `EVP_sha1' function. */
	#undef HAVE_EVP_SHA1

	/* Define to 1 if you have the `EVP_sha256' function. */
	#undef HAVE_EVP_SHA256

	/* Define to 1 if you have the `EVP_sha512' function. */
	#undef HAVE_EVP_SHA512

	/* Define to 1 if you have the `ev_default_loop' function. */
	#undef HAVE_EV_DEFAULT_LOOP

	/* Define to 1 if you have the `ev_loop' function. */
	#undef HAVE_EV_LOOP

	/* Define to 1 if you have the <expat.h> header file. */
	#undef HAVE_EXPAT_H

	/* Define to 1 if you have the `explicit_bzero' function. */
	#undef HAVE_EXPLICIT_BZERO

	/* Define to 1 if you have the `fcntl' function. */
	#undef HAVE_FCNTL

	/* Define to 1 if you have the `FIPS_mode' function. */
	#undef HAVE_FIPS_MODE

	/* Define to 1 if you have the `fork' function. */
	#undef HAVE_FORK

	/* Define to 1 if fseeko (and presumably ftello) exists and is declared. */
	#undef HAVE_FSEEKO

	/* Define to 1 if you have the `fsync' function. */
	#undef HAVE_FSYNC

	/* Whether getaddrinfo is available */
	#undef HAVE_GETADDRINFO

	/* Define to 1 if you have the `getauxval' function. */
	#undef HAVE_GETAUXVAL

	/* Define to 1 if you have the `getentropy' function. */
	#undef HAVE_GETENTROPY

	/* Define to 1 if you have the <getopt.h> header file. */
	#undef HAVE_GETOPT_H

	/* Define to 1 if you have the `getpwnam' function. */
	#undef HAVE_GETPWNAM

	/* Define to 1 if you have the `getrlimit' function. */
	#undef HAVE_GETRLIMIT

	/* Define to 1 if you have the `glob' function. */
	#undef HAVE_GLOB

	/* Define to 1 if you have the <glob.h> header file. */
	#undef HAVE_GLOB_H

	/* Define to 1 if you have the `gmtime_r' function. */
	#undef HAVE_GMTIME_R

	/* Define to 1 if you have the <grp.h> header file. */
	#undef HAVE_GRP_H

	/* Define to 1 if you have the <hiredis/hiredis.h> header file. */
	#undef HAVE_HIREDIS_HIREDIS_H

	+/* Define to 1 if you have the `HMAC_Init_ex' function. */
	+#undef HAVE_HMAC_INIT_EX
	+
	/* If you have HMAC_Update */
	#undef HAVE_HMAC_UPDATE

	/* Define to 1 if you have the `inet_aton' function. */
	#undef HAVE_INET_ATON

	/* Define to 1 if you have the `inet_ntop' function. */
	#undef HAVE_INET_NTOP

	/* Define to 1 if you have the `inet_pton' function. */
	#undef HAVE_INET_PTON

	/* Define to 1 if you have the `initgroups' function. */
	#undef HAVE_INITGROUPS

	/* Define to 1 if you have the <inttypes.h> header file. */
	#undef HAVE_INTTYPES_H

	/* if the function 'ioctlsocket' is available */
	#undef HAVE_IOCTLSOCKET

	/* Define to 1 if you have the <iphlpapi.h> header file. */
	#undef HAVE_IPHLPAPI_H

	/* Define to 1 if you have the `isblank' function. */
	#undef HAVE_ISBLANK

	/* Define to 1 if you have the `kill' function. */
	#undef HAVE_KILL

	/* Define to 1 if you have the <libkern/OSByteOrder.h> header file. */
	#undef HAVE_LIBKERN_OSBYTEORDER_H

	/* Define if we have LibreSSL */
	#undef HAVE_LIBRESSL

	/* Define to 1 if you have the `localtime_r' function. */
	#undef HAVE_LOCALTIME_R

	/* Define to 1 if you have the <login_cap.h> header file. */
	#undef HAVE_LOGIN_CAP_H

	/* If have GNU libc compatible malloc */
	#undef HAVE_MALLOC

	/* Define to 1 if you have the `memmove' function. */
	#undef HAVE_MEMMOVE

	/* Define to 1 if you have the <memory.h> header file. */
	#undef HAVE_MEMORY_H

	/* Define to 1 if you have the <netdb.h> header file. */
	#undef HAVE_NETDB_H

	/* Define to 1 if you have the <netinet/in.h> header file. */
	#undef HAVE_NETINET_IN_H

	/* Define to 1 if you have the <netinet/tcp.h> header file. */
	#undef HAVE_NETINET_TCP_H

	/* Use libnettle for crypto */
	#undef HAVE_NETTLE

	/* Define to 1 if you have the <nettle/dsa-compat.h> header file. */
	#undef HAVE_NETTLE_DSA_COMPAT_H

	/* Define to 1 if you have the <nettle/eddsa.h> header file. */
	#undef HAVE_NETTLE_EDDSA_H

	/* Use libnss for crypto */
	#undef HAVE_NSS

	/* Define to 1 if you have the `OpenSSL_add_all_digests' function. */
	#undef HAVE_OPENSSL_ADD_ALL_DIGESTS

	/* Define to 1 if you have the <openssl/bn.h> header file. */
	#undef HAVE_OPENSSL_BN_H

	/* Define to 1 if you have the `OPENSSL_config' function. */
	#undef HAVE_OPENSSL_CONFIG

	/* Define to 1 if you have the <openssl/conf.h> header file. */
	#undef HAVE_OPENSSL_CONF_H

	/* Define to 1 if you have the <openssl/dh.h> header file. */
	#undef HAVE_OPENSSL_DH_H

	/* Define to 1 if you have the <openssl/dsa.h> header file. */
	#undef HAVE_OPENSSL_DSA_H

	/* Define to 1 if you have the <openssl/engine.h> header file. */
	#undef HAVE_OPENSSL_ENGINE_H

	/* Define to 1 if you have the <openssl/err.h> header file. */
	#undef HAVE_OPENSSL_ERR_H

	/* Define to 1 if you have the `OPENSSL_init_crypto' function. */
	#undef HAVE_OPENSSL_INIT_CRYPTO

	/* Define to 1 if you have the `OPENSSL_init_ssl' function. */
	#undef HAVE_OPENSSL_INIT_SSL

	/* Define to 1 if you have the <openssl/rand.h> header file. */
	#undef HAVE_OPENSSL_RAND_H

	/* Define to 1 if you have the <openssl/rsa.h> header file. */
	#undef HAVE_OPENSSL_RSA_H

	/* Define to 1 if you have the <openssl/ssl.h> header file. */
	#undef HAVE_OPENSSL_SSL_H

	/* Define if you have POSIX threads libraries and header files. */
	#undef HAVE_PTHREAD

	/* Have PTHREAD_PRIO_INHERIT. */
	#undef HAVE_PTHREAD_PRIO_INHERIT

	/* Define to 1 if the system has the type `pthread_rwlock_t'. */
	#undef HAVE_PTHREAD_RWLOCK_T

	/* Define to 1 if the system has the type `pthread_spinlock_t'. */
	#undef HAVE_PTHREAD_SPINLOCK_T

	/* Define to 1 if you have the <pwd.h> header file. */
	#undef HAVE_PWD_H

	/* Define if you have Python libraries and header files. */
	#undef HAVE_PYTHON

	/* Define to 1 if you have the `random' function. */
	#undef HAVE_RANDOM

	/* Define to 1 if you have the `RAND_cleanup' function. */
	#undef HAVE_RAND_CLEANUP

	-/* Define to 1 if you have the `reallocarray' function. */
	+/* If we have reallocarray(3) */
	#undef HAVE_REALLOCARRAY

	/* Define to 1 if you have the `recvmsg' function. */
	#undef HAVE_RECVMSG

	/* Define to 1 if you have the `sendmsg' function. */
	#undef HAVE_SENDMSG

	/* Define to 1 if you have the `setregid' function. */
	#undef HAVE_SETREGID

	/* Define to 1 if you have the `setresgid' function. */
	#undef HAVE_SETRESGID

	/* Define to 1 if you have the `setresuid' function. */
	#undef HAVE_SETRESUID

	/* Define to 1 if you have the `setreuid' function. */
	#undef HAVE_SETREUID

	/* Define to 1 if you have the `setrlimit' function. */
	#undef HAVE_SETRLIMIT

	/* Define to 1 if you have the `setsid' function. */
	#undef HAVE_SETSID

	/* Define to 1 if you have the `setusercontext' function. */
	#undef HAVE_SETUSERCONTEXT

	/* Define to 1 if you have the `SHA512_Update' function. */
	#undef HAVE_SHA512_UPDATE

	/* Define to 1 if you have the `shmget' function. */
	#undef HAVE_SHMGET

	/* Define to 1 if you have the `sigprocmask' function. */
	#undef HAVE_SIGPROCMASK

	/* Define to 1 if you have the `sleep' function. */
	#undef HAVE_SLEEP

	/* Define to 1 if you have the `snprintf' function. */
	#undef HAVE_SNPRINTF

	/* Define to 1 if you have the `socketpair' function. */
	#undef HAVE_SOCKETPAIR

	/* Using Solaris threads */
	#undef HAVE_SOLARIS_THREADS

	/* Define to 1 if you have the `srandom' function. */
	#undef HAVE_SRANDOM

	/* Define if you have the SSL libraries installed. */
	#undef HAVE_SSL

	+/* Define to 1 if you have the `SSL_CTX_set_ciphersuites' function. */
	+#undef HAVE_SSL_CTX_SET_CIPHERSUITES
	+
	/* Define to 1 if you have the `SSL_CTX_set_security_level' function. */
	#undef HAVE_SSL_CTX_SET_SECURITY_LEVEL

	+/* Define to 1 if you have the `SSL_CTX_set_tlsext_ticket_key_cb' function. */
	+#undef HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_CB
	+
	/* Define to 1 if you have the `SSL_get0_peername' function. */
	#undef HAVE_SSL_GET0_PEERNAME

	/* Define to 1 if you have the `SSL_set1_host' function. */
	#undef HAVE_SSL_SET1_HOST

	/* Define to 1 if you have the <stdarg.h> header file. */
	#undef HAVE_STDARG_H

	/* Define to 1 if you have the <stdbool.h> header file. */
	#undef HAVE_STDBOOL_H

	/* Define to 1 if you have the <stdint.h> header file. */
	#undef HAVE_STDINT_H

	/* Define to 1 if you have the <stdlib.h> header file. */
	#undef HAVE_STDLIB_H

	/* Define to 1 if you have the `strftime' function. */
	#undef HAVE_STRFTIME

	/* Define to 1 if you have the <strings.h> header file. */
	#undef HAVE_STRINGS_H

	/* Define to 1 if you have the <string.h> header file. */
	#undef HAVE_STRING_H

	/* Define to 1 if you have the `strlcat' function. */
	#undef HAVE_STRLCAT

	/* Define to 1 if you have the `strlcpy' function. */
	#undef HAVE_STRLCPY

	/* Define to 1 if you have the `strptime' function. */
	#undef HAVE_STRPTIME

	/* Define to 1 if you have the `strsep' function. */
	#undef HAVE_STRSEP

	/* Define to 1 if `ipi_spec_dst' is a member of `struct in_pktinfo'. */
	#undef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST

	/* Define to 1 if `sun_len' is a member of `struct sockaddr_un'. */
	#undef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN

	/* Define if you have Swig libraries and header files. */
	#undef HAVE_SWIG

	/* Define to 1 if you have the <syslog.h> header file. */
	#undef HAVE_SYSLOG_H

	/* Define to 1 if systemd should be used */
	#undef HAVE_SYSTEMD

	/* Define to 1 if you have the <sys/endian.h> header file. */
	#undef HAVE_SYS_ENDIAN_H

	/* Define to 1 if you have the <sys/ipc.h> header file. */
	#undef HAVE_SYS_IPC_H

	/* Define to 1 if you have the <sys/param.h> header file. */
	#undef HAVE_SYS_PARAM_H

	/* Define to 1 if you have the <sys/resource.h> header file. */
	#undef HAVE_SYS_RESOURCE_H

	/* Define to 1 if you have the <sys/sha2.h> header file. */
	#undef HAVE_SYS_SHA2_H

	/* Define to 1 if you have the <sys/shm.h> header file. */
	#undef HAVE_SYS_SHM_H

	/* Define to 1 if you have the <sys/socket.h> header file. */
	#undef HAVE_SYS_SOCKET_H

	/* Define to 1 if you have the <sys/stat.h> header file. */
	#undef HAVE_SYS_STAT_H

	/* Define to 1 if you have the <sys/sysctl.h> header file. */
	#undef HAVE_SYS_SYSCTL_H

	/* Define to 1 if you have the <sys/types.h> header file. */
	#undef HAVE_SYS_TYPES_H

	/* Define to 1 if you have the <sys/uio.h> header file. */
	#undef HAVE_SYS_UIO_H

	/* Define to 1 if you have the <sys/un.h> header file. */
	#undef HAVE_SYS_UN_H

	/* Define to 1 if you have the <sys/wait.h> header file. */
	#undef HAVE_SYS_WAIT_H

	/* Define to 1 if you have the <time.h> header file. */
	#undef HAVE_TIME_H

	/* Define to 1 if you have the `tzset' function. */
	#undef HAVE_TZSET

	/* Define to 1 if you have the <unistd.h> header file. */
	#undef HAVE_UNISTD_H

	/* Define to 1 if you have the `usleep' function. */
	#undef HAVE_USLEEP

	/* Define to 1 if you have the `vfork' function. */
	#undef HAVE_VFORK

	/* Define to 1 if you have the <vfork.h> header file. */
	#undef HAVE_VFORK_H

	/* Define to 1 if you have the <windows.h> header file. */
	#undef HAVE_WINDOWS_H

	/* Using Windows threads */
	#undef HAVE_WINDOWS_THREADS

	/* Define to 1 if you have the <winsock2.h> header file. */
	#undef HAVE_WINSOCK2_H

	/* Define to 1 if `fork' works. */
	#undef HAVE_WORKING_FORK

	/* Define to 1 if `vfork' works. */
	#undef HAVE_WORKING_VFORK

	/* Define to 1 if you have the `writev' function. */
	#undef HAVE_WRITEV

	/* Define to 1 if you have the <ws2tcpip.h> header file. */
	#undef HAVE_WS2TCPIP_H

	+/* Define to 1 if you have the `X509_VERIFY_PARAM_set1_host' function. */
	+#undef HAVE_X509_VERIFY_PARAM_SET1_HOST
	+
	/* Define to 1 if you have the `_beginthreadex' function. */
	#undef HAVE__BEGINTHREADEX

	/* if lex has yylex_destroy */
	#undef LEX_HAS_YYLEX_DESTROY

	/* Define to the sub-directory where libtool stores uninstalled libraries. */
	#undef LT_OBJDIR

	/* Define to the maximum message length to pass to syslog. */
	#undef MAXSYSLOGMSGLEN

	/* Define if memcmp() does not compare unsigned bytes */
	#undef MEMCMP_IS_BROKEN

	/* Define if mkdir has one argument. */
	#undef MKDIR_HAS_ONE_ARG

	/* Define if the network stack does not fully support nonblocking io (causes
	lower performance). */
	#undef NONBLOCKING_IS_BROKEN

	/* Put -D_ALL_SOURCE define in config.h */
	#undef OMITTED__D_ALL_SOURCE

	/* Put -D_BSD_SOURCE define in config.h */
	#undef OMITTED__D_BSD_SOURCE

	/* Put -D_DEFAULT_SOURCE define in config.h */
	#undef OMITTED__D_DEFAULT_SOURCE

	/* Put -D_GNU_SOURCE define in config.h */
	#undef OMITTED__D_GNU_SOURCE

	/* Put -D_LARGEFILE_SOURCE=1 define in config.h */
	#undef OMITTED__D_LARGEFILE_SOURCE_1

	/* Put -D_POSIX_C_SOURCE=200112 define in config.h */
	#undef OMITTED__D_POSIX_C_SOURCE_200112

	/* Put -D_XOPEN_SOURCE=600 define in config.h */
	#undef OMITTED__D_XOPEN_SOURCE_600

	/* Put -D_XOPEN_SOURCE_EXTENDED=1 define in config.h */
	#undef OMITTED__D_XOPEN_SOURCE_EXTENDED_1

	/* Put -D__EXTENSIONS__ define in config.h */
	#undef OMITTED__D__EXTENSIONS__

	/* Define to the address where bug reports for this package should be sent. */
	#undef PACKAGE_BUGREPORT

	/* Define to the full name of this package. */
	#undef PACKAGE_NAME

	/* Define to the full name and version of this package. */
	#undef PACKAGE_STRING

	/* Define to the one symbol short name of this package. */
	#undef PACKAGE_TARNAME

	/* Define to the home page for this package. */
	#undef PACKAGE_URL

	/* Define to the version of this package. */
	#undef PACKAGE_VERSION

	/* default pidfile location */
	#undef PIDFILE

	/* Define to necessary symbol if this constant uses a non-standard name on
	your system. */
	#undef PTHREAD_CREATE_JOINABLE

	/* Define as the return type of signal handlers (`int' or `void'). */
	#undef RETSIGTYPE

	/* if REUSEPORT is enabled by default */
	#undef REUSEPORT_DEFAULT

	/* default rootkey location */
	#undef ROOT_ANCHOR_FILE

	/* default rootcert location */
	#undef ROOT_CERT_FILE

	/* version number for resource files */
	#undef RSRC_PACKAGE_VERSION

	/* Directory to chdir to */
	#undef RUN_DIR

	/* Shared data */
	#undef SHARE_DIR

	/* The size of `time_t', as computed by sizeof. */
	#undef SIZEOF_TIME_T

	/* define if (v)snprintf does not return length needed, (but length used) */
	#undef SNPRINTF_RET_BROKEN

	/* Define to 1 if libsodium supports sodium_set_misuse_handler */
	#undef SODIUM_MISUSE_HANDLER

	/* Define to 1 if you have the ANSI C header files. */
	#undef STDC_HEADERS

	/* use default strptime. */
	#undef STRPTIME_WORKS

	/* Use win32 resources and API */
	#undef UB_ON_WINDOWS

	/* default username */
	#undef UB_USERNAME

	/* use to enable lightweight alloc assertions, for debug use */
	#undef UNBOUND_ALLOC_LITE

	/* use malloc not regions, for debug use */
	#undef UNBOUND_ALLOC_NONREGIONAL

	/* use statistics for allocs and frees, for debug use */
	#undef UNBOUND_ALLOC_STATS

	/* define this to enable debug checks. */
	#undef UNBOUND_DEBUG

	/* Define to 1 to use cachedb support */
	#undef USE_CACHEDB

	/* Define to 1 to enable dnscrypt support */
	#undef USE_DNSCRYPT

	/* Define to 1 to enable dnscrypt with xchacha20 support */
	#undef USE_DNSCRYPT_XCHACHA20

	/* Define to 1 to enable dnstap support */
	#undef USE_DNSTAP

	/* Define this to enable DSA support. */
	#undef USE_DSA

	/* Define this to enable ECDSA support. */
	#undef USE_ECDSA

	/* Define this to enable an EVP workaround for older openssl */
	#undef USE_ECDSA_EVP_WORKAROUND

	/* Define this to enable ED25519 support. */
	#undef USE_ED25519

	/* Define this to enable ED448 support. */
	#undef USE_ED448

	/* Define this to enable GOST support. */
	#undef USE_GOST

	/* Define to 1 to use ipsecmod support. */
	#undef USE_IPSECMOD

	/* Define if you want to use internal select based events */
	#undef USE_MINI_EVENT

	/* Define this to enable client TCP Fast Open. */
	#undef USE_MSG_FASTOPEN

	/* Define this to enable client TCP Fast Open. */
	#undef USE_OSX_MSG_FASTOPEN

	/* Define this to use hiredis client. */
	#undef USE_REDIS

	/* Define this to enable SHA1 support. */
	#undef USE_SHA1

	/* Define this to enable SHA256 and SHA512 support. */
	#undef USE_SHA2

	/* Enable extensions on AIX 3, Interix. */
	#ifndef _ALL_SOURCE
	# undef _ALL_SOURCE
	#endif
	/* Enable GNU extensions on systems that have them. */
	#ifndef _GNU_SOURCE
	# undef _GNU_SOURCE
	#endif
	/* Enable threading extensions on Solaris. */
	#ifndef _POSIX_PTHREAD_SEMANTICS
	# undef _POSIX_PTHREAD_SEMANTICS
	#endif
	/* Enable extensions on HP NonStop. */
	#ifndef _TANDEM_SOURCE
	# undef _TANDEM_SOURCE
	#endif
	/* Enable general extensions on Solaris. */
	#ifndef __EXTENSIONS__
	# undef __EXTENSIONS__
	#endif


	/* Define this to enable server TCP Fast Open. */
	#undef USE_TCP_FASTOPEN

	/* Whether the windows socket API is used */
	#undef USE_WINSOCK

	/* the version of the windows API enabled */
	#undef WINVER

	/* Define if you want Python module. */
	#undef WITH_PYTHONMODULE

	/* Define if you want PyUnbound. */
	#undef WITH_PYUNBOUND

	/* Define to 1 if `lex' declares `yytext' as a `char *' by default, not a
	`char[]'. */
	#undef YYTEXT_POINTER

	/* Enable large inode numbers on Mac OS X 10.5. */
	#ifndef _DARWIN_USE_64_BIT_INODE
	# define _DARWIN_USE_64_BIT_INODE 1
	#endif

	/* Number of bits in a file offset, on hosts where this is settable. */
	#undef _FILE_OFFSET_BITS

	/* Define to 1 to make fseeko visible on some hosts (e.g. glibc 2.2). */
	#undef _LARGEFILE_SOURCE

	/* Define for large files, on AIX-style hosts. */
	#undef _LARGE_FILES

	/* Define to 1 if on MINIX. */
	#undef _MINIX

	/* Enable for compile on Minix */
	#undef _NETBSD_SOURCE

	/* Define to 2 if the system does not provide POSIX.1 features except with
	this defined. */
	#undef _POSIX_1_SOURCE

	/* Define to 1 if you need to in order for `stat' and other things to work. */
	#undef _POSIX_SOURCE

	/* Define to empty if `const' does not conform to ANSI C. */
	#undef const

	/* Define to `int' if <sys/types.h> doesn't define. */
	#undef gid_t

	/* in_addr_t */
	#undef in_addr_t

	/* in_port_t */
	#undef in_port_t

	/* Define to `__inline__' or `__inline' if that's what the C compiler
	calls it, or to nothing if 'inline' is not supported under any name. */
	#ifndef __cplusplus
	#undef inline
	#endif

	/* Define to `short' if <sys/types.h> does not define. */
	#undef int16_t

	/* Define to `int' if <sys/types.h> does not define. */
	#undef int32_t

	/* Define to `long long' if <sys/types.h> does not define. */
	#undef int64_t

	/* Define to `signed char' if <sys/types.h> does not define. */
	#undef int8_t

	/* Define if replacement function should be used. */
	#undef malloc

	/* Define to `long int' if <sys/types.h> does not define. */
	#undef off_t

	/* Define to `int' if <sys/types.h> does not define. */
	#undef pid_t

	/* Define to 'int' if not defined */
	#undef rlim_t

	/* Define to `unsigned int' if <sys/types.h> does not define. */
	#undef size_t

	/* Define to 'int' if not defined */
	#undef socklen_t

	/* Define to `int' if <sys/types.h> does not define. */
	#undef ssize_t

	/* Define to 'unsigned char if not defined */
	#undef u_char

	/* Define to `int' if <sys/types.h> doesn't define. */
	#undef uid_t

	/* Define to `unsigned short' if <sys/types.h> does not define. */
	#undef uint16_t

	/* Define to `unsigned int' if <sys/types.h> does not define. */
	#undef uint32_t

	/* Define to `unsigned long long' if <sys/types.h> does not define. */
	#undef uint64_t

	/* Define to `unsigned char' if <sys/types.h> does not define. */
	#undef uint8_t

	/* Define as `fork' if `vfork' does not work. */
	#undef vfork

	#if defined(OMITTED__D_GNU_SOURCE) && !defined(_GNU_SOURCE)
	#define _GNU_SOURCE 1
	#endif

	#if defined(OMITTED__D_BSD_SOURCE) && !defined(_BSD_SOURCE)
	#define _BSD_SOURCE 1
	#endif

	#if defined(OMITTED__D_DEFAULT_SOURCE) && !defined(_DEFAULT_SOURCE)
	#define _DEFAULT_SOURCE 1
	#endif

	#if defined(OMITTED__D__EXTENSIONS__) && !defined(__EXTENSIONS__)
	#define __EXTENSIONS__ 1
	#endif

	#if defined(OMITTED__D_POSIX_C_SOURCE_200112) && !defined(_POSIX_C_SOURCE)
	#define _POSIX_C_SOURCE 200112
	#endif

	#if defined(OMITTED__D_XOPEN_SOURCE_600) && !defined(_XOPEN_SOURCE)
	#define _XOPEN_SOURCE 600
	#endif

	#if defined(OMITTED__D_XOPEN_SOURCE_EXTENDED_1) && !defined(_XOPEN_SOURCE_EXTENDED)
	#define _XOPEN_SOURCE_EXTENDED 1
	#endif

	#if defined(OMITTED__D_ALL_SOURCE) && !defined(_ALL_SOURCE)
	#define _ALL_SOURCE 1
	#endif

	#if defined(OMITTED__D_LARGEFILE_SOURCE_1) && !defined(_LARGEFILE_SOURCE)
	#define _LARGEFILE_SOURCE 1
	#endif




	+#ifndef _OPENBSD_SOURCE
	+#define _OPENBSD_SOURCE 1
	+#endif
	+
	#ifndef UNBOUND_DEBUG
	+# ifndef NDEBUG
	# define NDEBUG
	+# endif
	#endif

	/** Use small-ldns codebase */
	#define USE_SLDNS 1
	#ifdef HAVE_SSL
	# define LDNS_BUILD_CONFIG_HAVE_SSL 1
	#endif

	#include <stdio.h>
	#include <string.h>
	#include <unistd.h>
	#include <assert.h>

	#if STDC_HEADERS
	#include <stdlib.h>
	#include <stddef.h>
	#endif

	#ifdef HAVE_STDARG_H
	#include <stdarg.h>
	#endif

	#ifdef HAVE_STDINT_H
	#include <stdint.h>
	#endif

	#include <errno.h>

	#if HAVE_SYS_PARAM_H
	#include <sys/param.h>
	#endif

	#ifdef HAVE_SYS_SOCKET_H
	#include <sys/socket.h>
	#endif

	#ifdef HAVE_SYS_UIO_H
	#include <sys/uio.h>
	#endif

	#ifdef HAVE_NETINET_IN_H
	#include <netinet/in.h>
	#endif

	#ifdef HAVE_NETINET_TCP_H
	#include <netinet/tcp.h>
	#endif

	#ifdef HAVE_ARPA_INET_H
	#include <arpa/inet.h>
	#endif

	#ifdef HAVE_WINSOCK2_H
	#include <winsock2.h>
	#endif

	#ifdef HAVE_WS2TCPIP_H
	#include <ws2tcpip.h>
	#endif

	#ifndef USE_WINSOCK
	#define ARG_LL "%ll"
	#else
	#define ARG_LL "%I64"
	#endif

	#ifndef AF_LOCAL
	#define AF_LOCAL AF_UNIX
	#endif



	#ifdef HAVE_ATTR_FORMAT
	# define ATTR_FORMAT(archetype, string_index, first_to_check) \
	__attribute__ ((format (archetype, string_index, first_to_check)))
	#else /* !HAVE_ATTR_FORMAT */
	# define ATTR_FORMAT(archetype, string_index, first_to_check) /* empty */
	#endif /* !HAVE_ATTR_FORMAT */


	#if defined(DOXYGEN)
	# define ATTR_UNUSED(x) x
	#elif defined(__cplusplus)
	# define ATTR_UNUSED(x)
	#elif defined(HAVE_ATTR_UNUSED)
	# define ATTR_UNUSED(x) x __attribute__((unused))
	#else /* !HAVE_ATTR_UNUSED */
	# define ATTR_UNUSED(x) x
	#endif /* !HAVE_ATTR_UNUSED */


	#ifndef HAVE_FSEEKO
	#define fseeko fseek
	#define ftello ftell
	#endif /* HAVE_FSEEKO */


	#ifndef MAXHOSTNAMELEN
	#define MAXHOSTNAMELEN 256
	#endif

	#if !defined(HAVE_SNPRINTF) \|\| defined(SNPRINTF_RET_BROKEN)
	#define snprintf snprintf_unbound
	#define vsnprintf vsnprintf_unbound
	#include <stdarg.h>
	int snprintf (char str, size_t count, const char fmt, ...);
	int vsnprintf (char str, size_t count, const char fmt, va_list arg);
	#endif /* HAVE_SNPRINTF or SNPRINTF_RET_BROKEN */

	#ifndef HAVE_INET_PTON
	#define inet_pton inet_pton_unbound
	int inet_pton(int af, const char* src, void* dst);
	#endif /* HAVE_INET_PTON */


	#ifndef HAVE_INET_NTOP
	#define inet_ntop inet_ntop_unbound
	const char inet_ntop(int af, const void src, char *dst, size_t size);
	#endif


	#ifndef HAVE_INET_ATON
	#define inet_aton inet_aton_unbound
	int inet_aton(const char cp, struct in_addr addr);
	#endif


	#ifndef HAVE_MEMMOVE
	#define memmove memmove_unbound
	void memmove(void dest, const void *src, size_t n);
	#endif


	#ifndef HAVE_STRLCAT
	#define strlcat strlcat_unbound
	size_t strlcat(char dst, const char src, size_t siz);
	#endif


	#ifndef HAVE_STRLCPY
	#define strlcpy strlcpy_unbound
	size_t strlcpy(char dst, const char src, size_t siz);
	#endif


	#ifndef HAVE_GMTIME_R
	#define gmtime_r gmtime_r_unbound
	struct tm gmtime_r(const time_t timep, struct tm *result);
	#endif


	#ifndef HAVE_REALLOCARRAY
	#define reallocarray reallocarrayunbound
	void* reallocarray(void *ptr, size_t nmemb, size_t size);
	#endif


	#if !defined(HAVE_SLEEP) \|\| defined(HAVE_WINDOWS_H)
	#define sleep(x) Sleep((x)1000) / on win32 */
	#endif /* HAVE_SLEEP */


	#ifndef HAVE_USLEEP
	#define usleep(x) Sleep((x)/1000 + 1) /* on win32 */
	#endif /* HAVE_USLEEP */


	#ifndef HAVE_RANDOM
	#define random rand /* on win32, for tests only (bad random) */
	#endif /* HAVE_RANDOM */


	#ifndef HAVE_SRANDOM
	#define srandom(x) srand(x) /* on win32, for tests only (bad random) */
	#endif /* HAVE_SRANDOM */


	/* detect if we need to cast to unsigned int for FD_SET to avoid warnings */
	#ifdef HAVE_WINSOCK2_H
	#define FD_SET_T (u_int)
	#else
	#define FD_SET_T
	#endif


	#ifndef IPV6_MIN_MTU
	#define IPV6_MIN_MTU 1280
	#endif /* IPV6_MIN_MTU */


	#ifdef MEMCMP_IS_BROKEN
	#include "compat/memcmp.h"
	#define memcmp memcmp_unbound
	int memcmp(const void x, const void y, size_t n);
	#endif



	#ifndef HAVE_CTIME_R
	#define ctime_r unbound_ctime_r
	char ctime_r(const time_t timep, char *buf);
	#endif

	#ifndef HAVE_STRSEP
	#define strsep unbound_strsep
	char strsep(char stringp, const char delim);
	#endif

	#ifndef HAVE_ISBLANK
	#define isblank unbound_isblank
	int isblank(int c);
	#endif

	#ifndef HAVE_EXPLICIT_BZERO
	#define explicit_bzero unbound_explicit_bzero
	void explicit_bzero(void* buf, size_t len);
	#endif

	#if defined(HAVE_INET_NTOP) && !HAVE_DECL_INET_NTOP
	const char inet_ntop(int af, const void src, char *dst, size_t size);
	#endif

	#if defined(HAVE_INET_PTON) && !HAVE_DECL_INET_PTON
	int inet_pton(int af, const char* src, void* dst);
	#endif

	#if !defined(HAVE_STRPTIME) \|\| !defined(STRPTIME_WORKS)
	#define strptime unbound_strptime
	struct tm;
	char strptime(const char s, const char format, struct tm tm);
	#endif

	#ifdef HAVE_LIBRESSL
	# if !HAVE_DECL_STRLCPY
	size_t strlcpy(char dst, const char src, size_t siz);
	# endif
	# if !HAVE_DECL_STRLCAT
	size_t strlcat(char dst, const char src, size_t siz);
	# endif
	# if !HAVE_DECL_ARC4RANDOM && defined(HAVE_ARC4RANDOM)
	uint32_t arc4random(void);
	# endif
	# if !HAVE_DECL_ARC4RANDOM_UNIFORM && defined(HAVE_ARC4RANDOM_UNIFORM)
	uint32_t arc4random_uniform(uint32_t upper_bound);
	# endif
	# if !HAVE_DECL_REALLOCARRAY
	void reallocarray(void ptr, size_t nmemb, size_t size);
	# endif
	#endif /* HAVE_LIBRESSL */
	#ifndef HAVE_ARC4RANDOM
	int getentropy(void* buf, size_t len);
	uint32_t arc4random(void);
	void arc4random_buf(void* buf, size_t n);
	void _ARC4_LOCK(void);
	void _ARC4_UNLOCK(void);
	void _ARC4_LOCK_DESTROY(void);
	#endif
	#ifndef HAVE_ARC4RANDOM_UNIFORM
	uint32_t arc4random_uniform(uint32_t upper_bound);
	#endif
	#ifdef COMPAT_SHA512
	#ifndef SHA512_DIGEST_LENGTH
	#define SHA512_BLOCK_LENGTH 128
	#define SHA512_DIGEST_LENGTH 64
	#define SHA512_DIGEST_STRING_LENGTH (SHA512_DIGEST_LENGTH * 2 + 1)
	typedef struct _SHA512_CTX {
	uint64_t state[8];
	uint64_t bitcount[2];
	uint8_t buffer[SHA512_BLOCK_LENGTH];
	} SHA512_CTX;
	#endif /* SHA512_DIGEST_LENGTH */
	void SHA512_Init(SHA512_CTX*);
	void SHA512_Update(SHA512_CTX, void, size_t);
	void SHA512_Final(uint8_t[SHA512_DIGEST_LENGTH], SHA512_CTX*);
	unsigned char SHA512(void data, unsigned int data_len, unsigned char *digest);
	#endif /* COMPAT_SHA512 */



	#if defined(HAVE_EVENT_H) && !defined(HAVE_EVENT_BASE_ONCE) && !(defined(HAVE_EV_LOOP) \|\| defined(HAVE_EV_DEFAULT_LOOP)) && (defined(HAVE_PTHREAD) \|\| defined(HAVE_SOLARIS_THREADS))
	/* using version of libevent that is not threadsafe. */
	# define LIBEVENT_SIGNAL_PROBLEM 1
	#endif

	#ifndef CHECKED_INET6
	# define CHECKED_INET6
	# ifdef AF_INET6
	# define INET6
	# else
	# define AF_INET6 28
	# endif
	#endif /* CHECKED_INET6 */

	#ifndef HAVE_GETADDRINFO
	struct sockaddr_storage;
	#include "compat/fake-rfc2553.h"
	#endif

	#ifdef UNBOUND_ALLOC_STATS
	# define malloc(s) unbound_stat_malloc_log(s, __FILE__, __LINE__, __func__)
	# define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
	# define free(p) unbound_stat_free_log(p, __FILE__, __LINE__, __func__)
	# define realloc(p,s) unbound_stat_realloc_log(p, s, __FILE__, __LINE__, __func__)
	void *unbound_stat_malloc(size_t size);
	void *unbound_stat_calloc(size_t nmemb, size_t size);
	void unbound_stat_free(void *ptr);
	void unbound_stat_realloc(void ptr, size_t size);
	void unbound_stat_malloc_log(size_t size, const char file, int line,
	const char* func);
	void unbound_stat_calloc_log(size_t nmemb, size_t size, const char file,
	int line, const char* func);
	void unbound_stat_free_log(void ptr, const char file, int line,
	const char* func);
	void unbound_stat_realloc_log(void ptr, size_t size, const char* file,
	int line, const char* func);
	#elif defined(UNBOUND_ALLOC_LITE)
	# include "util/alloc.h"
	#endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */

	/** default port for DNS traffic. */
	#define UNBOUND_DNS_PORT 53
	/** default port for DNS over TLS traffic. */
	#define UNBOUND_DNS_OVER_TLS_PORT 853
	/** default port for unbound control traffic, registered port with IANA,
	ub-dns-control 8953/tcp unbound dns nameserver control */
	#define UNBOUND_CONTROL_PORT 8953
	/** the version of unbound-control that this software implements */
	#define UNBOUND_CONTROL_VERSION 1


	Index: head/contrib/unbound/config.sub
	===================================================================
	--- head/contrib/unbound/config.sub (revision 349719)
	+++ head/contrib/unbound/config.sub (revision 349720)
	@@ -1,1823 +1,1823 @@
	-#! /bin/sh
	+#!/usr/bin/sh
	# Configuration validation subroutine script.
	# Copyright 1992-2016 Free Software Foundation, Inc.

	timestamp='2016-09-05'

	# This file is free software; you can redistribute it and/or modify it
	# under the terms of the GNU General Public License as published by
	# the Free Software Foundation; either version 3 of the License, or
	# (at your option) any later version.
	#
	# This program is distributed in the hope that it will be useful, but
	# WITHOUT ANY WARRANTY; without even the implied warranty of
	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	# General Public License for more details.
	#
	# You should have received a copy of the GNU General Public License
	# along with this program; if not, see <http://www.gnu.org/licenses/>.
	#
	# As a special exception to the GNU General Public License, if you
	# distribute this file as part of a program that contains a
	# configuration script generated by Autoconf, you may include it under
	# the same distribution terms that you use for the rest of that
	# program. This Exception is an additional permission under section 7
	# of the GNU General Public License, version 3 ("GPLv3").


	# Please send patches to <config-patches@gnu.org>.
	#
	# Configuration subroutine to validate and canonicalize a configuration type.
	# Supply the specified configuration type as an argument.
	# If it is invalid, we print an error message on stderr and exit with code 1.
	# Otherwise, we print the canonical config type on stdout and succeed.

	# You can get the latest version of this script from:
	# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub

	# This file is supposed to be the same for all GNU packages
	# and recognize all the CPU types, system types and aliases
	# that are meaningful with any GNU software.
	# Each package is responsible for reporting which valid configurations
	# it does not support. The user should be able to distinguish
	# a failure to support a valid configuration from a meaningless
	# configuration.

	# The goal of this file is to map all the various variations of a given
	# machine specification into a single specification in the form:
	# CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM
	# or in some cases, the newer four-part form:
	# CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM
	# It is wrong to echo any other type of specification.

	me=`echo "$0" \| sed -e 's,.*/,,'`

	usage="\
	Usage: $0 [OPTION] CPU-MFR-OPSYS or ALIAS

	Canonicalize a configuration name.

	Operation modes:
	-h, --help print this help, then exit
	-t, --time-stamp print date of last modification, then exit
	-v, --version print version number, then exit

	Report bugs and patches to <config-patches@gnu.org>."

	version="\
	GNU config.sub ($timestamp)

	Copyright 1992-2016 Free Software Foundation, Inc.

	This is free software; see the source for copying conditions. There is NO
	warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."

	help="
	Try \`$me --help' for more information."

	# Parse command line
	while test $# -gt 0 ; do
	case $1 in
	--time-stamp \| --time* \| -t )
	echo "$timestamp" ; exit ;;
	--version \| -v )
	echo "$version" ; exit ;;
	--help \| --h* \| -h )
	echo "$usage"; exit ;;
	-- ) # Stop option processing
	shift; break ;;
	- ) # Use stdin as input.
	break ;;
	-* )
	echo "$me: invalid option $1$help"
	exit 1 ;;

	local)
	# First pass through any local machine types.
	echo $1
	exit ;;

	* )
	break ;;
	esac
	done

	case $# in
	0) echo "$me: missing argument$help" >&2
	exit 1;;
	1) ;;
	*) echo "$me: too many arguments$help" >&2
	exit 1;;
	esac

	# Separate what the user gave into CPU-COMPANY and OS or KERNEL-OS (if any).
	# Here we must recognize all the valid KERNEL-OS combinations.
	maybe_os=`echo $1 \| sed 's/^$.$-$[^-]-[^-]*$$/\2/'`
	case $maybe_os in
	nto-qnx* \| linux-gnu* \| linux-android* \| linux-dietlibc \| linux-newlib* \| \
	linux-musl* \| linux-uclibc* \| uclinux-uclibc* \| uclinux-gnu* \| kfreebsd-gnu \| \
	knetbsd-gnu \| netbsd-gnu \| netbsd-eabi \| \
	kopensolaris-gnu \| cloudabi-eabi \| \
	storm-chaos* \| os2-emx* \| rtmk-nova*)
	os=-$maybe_os
	basic_machine=`echo $1 \| sed 's/^$.$-$[^-]-[^-]*$$/\1/'`
	;;
	android-linux)
	os=-linux-android
	basic_machine=`echo $1 \| sed 's/^$.$-$[^-]-[^-]*$$/\1/'`-unknown
	;;
	*)
	basic_machine=`echo $1 \| sed 's/-[^-]*$//'`
	if [ $basic_machine != $1 ]
	then os=`echo $1 \| sed 's/.*-/-/'`
	else os=; fi
	;;
	esac

	### Let's recognize common machines as not being operating systems so
	### that things like config.sub decstation-3100 work. We also
	### recognize some manufacturers as not being operating systems, so we
	### can provide default operating systems below.
	case $os in
	-sunos)
	# Prevent following clause from handling this invalid input.
	;;
	-dec* \| -mips* \| -sequent* \| -encore* \| -pc532* \| -sgi* \| -sony* \| \
	-att* \| -7300* \| -3300* \| -delta* \| -motorola* \| -sun[234]* \| \
	-unicom* \| -ibm* \| -next \| -hp \| -isi* \| -apollo \| -altos* \| \
	-convergent* \| -ncr* \| -news \| -32* \| -3600* \| -3100* \| -hitachi* \|\
	-c[123]* \| -convex* \| -sun \| -crds \| -omron* \| -dg \| -ultra \| -tti* \| \
	-harris \| -dolphin \| -highlevel \| -gould \| -cbm \| -ns \| -masscomp \| \
	-apple \| -axis \| -knuth \| -cray \| -microblaze*)
	os=
	basic_machine=$1
	;;
	-bluegene*)
	os=-cnk
	;;
	-sim \| -cisco \| -oki \| -wec \| -winbond)
	os=
	basic_machine=$1
	;;
	-scout)
	;;
	-wrs)
	os=-vxworks
	basic_machine=$1
	;;
	-chorusos*)
	os=-chorusos
	basic_machine=$1
	;;
	-chorusrdb)
	os=-chorusrdb
	basic_machine=$1
	;;
	-hiux*)
	os=-hiuxwe2
	;;
	-sco6)
	os=-sco5v6
	basic_machine=`echo $1 \| sed -e 's/86-.*/86-pc/'`
	;;
	-sco5)
	os=-sco3.2v5
	basic_machine=`echo $1 \| sed -e 's/86-.*/86-pc/'`
	;;
	-sco4)
	os=-sco3.2v4
	basic_machine=`echo $1 \| sed -e 's/86-.*/86-pc/'`
	;;
	-sco3.2.[4-9]*)
	os=`echo $os \| sed -e 's/sco3.2./sco3.2v/'`
	basic_machine=`echo $1 \| sed -e 's/86-.*/86-pc/'`
	;;
	-sco3.2v[4-9]*)
	# Don't forget version if it is 3.2v4 or newer.
	basic_machine=`echo $1 \| sed -e 's/86-.*/86-pc/'`
	;;
	-sco5v6*)
	# Don't forget version if it is 3.2v4 or newer.
	basic_machine=`echo $1 \| sed -e 's/86-.*/86-pc/'`
	;;
	-sco*)
	os=-sco3.2v2
	basic_machine=`echo $1 \| sed -e 's/86-.*/86-pc/'`
	;;
	-udk*)
	basic_machine=`echo $1 \| sed -e 's/86-.*/86-pc/'`
	;;
	-isc)
	os=-isc2.2
	basic_machine=`echo $1 \| sed -e 's/86-.*/86-pc/'`
	;;
	-clix*)
	basic_machine=clipper-intergraph
	;;
	-isc*)
	basic_machine=`echo $1 \| sed -e 's/86-.*/86-pc/'`
	;;
	-lynx*178)
	os=-lynxos178
	;;
	-lynx*5)
	os=-lynxos5
	;;
	-lynx*)
	os=-lynxos
	;;
	-ptx*)
	basic_machine=`echo $1 \| sed -e 's/86-.*/86-sequent/'`
	;;
	-windowsnt*)
	os=`echo $os \| sed -e 's/windowsnt/winnt/'`
	;;
	-psos*)
	os=-psos
	;;
	-mint \| -mint[0-9]*)
	basic_machine=m68k-atari
	os=-mint
	;;
	esac

	# Decode aliases for certain CPU-COMPANY combinations.
	case $basic_machine in
	# Recognize the basic CPU types without company name.
	# Some are omitted here because they have special meanings below.
	1750a \| 580 \
	\| a29k \
	\| aarch64 \| aarch64_be \
	\| alpha \| alphaev[4-8] \| alphaev56 \| alphaev6[78] \| alphapca5[67] \
	\| alpha64 \| alpha64ev[4-8] \| alpha64ev56 \| alpha64ev6[78] \| alpha64pca5[67] \
	\| am33_2.0 \
	\| arc \| arceb \
	\| arm \| arm[bl]e \| arme[lb] \| armv[2-8] \| armv[3-8][lb] \| armv7[arm] \
	\| avr \| avr32 \
	\| ba \
	\| be32 \| be64 \
	\| bfin \
	\| c4x \| c8051 \| clipper \
	\| d10v \| d30v \| dlx \| dsp16xx \
	\| e2k \| epiphany \
	\| fido \| fr30 \| frv \| ft32 \
	\| h8300 \| h8500 \| hppa \| hppa1.[01] \| hppa2.0 \| hppa2.0[nw] \| hppa64 \
	\| hexagon \
	\| i370 \| i860 \| i960 \| ia64 \
	\| ip2k \| iq2000 \
	\| k1om \
	\| le32 \| le64 \
	\| lm32 \
	\| m32c \| m32r \| m32rle \| m68000 \| m68k \| m88k \
	\| maxq \| mb \| microblaze \| microblazeel \| mcore \| mep \| metag \
	\| mips \| mipsbe \| mipseb \| mipsel \| mipsle \
	\| mips16 \
	\| mips64 \| mips64el \
	\| mips64octeon \| mips64octeonel \
	\| mips64orion \| mips64orionel \
	\| mips64r5900 \| mips64r5900el \
	\| mips64vr \| mips64vrel \
	\| mips64vr4100 \| mips64vr4100el \
	\| mips64vr4300 \| mips64vr4300el \
	\| mips64vr5000 \| mips64vr5000el \
	\| mips64vr5900 \| mips64vr5900el \
	\| mipsisa32 \| mipsisa32el \
	\| mipsisa32r2 \| mipsisa32r2el \
	\| mipsisa32r6 \| mipsisa32r6el \
	\| mipsisa64 \| mipsisa64el \
	\| mipsisa64r2 \| mipsisa64r2el \
	\| mipsisa64r6 \| mipsisa64r6el \
	\| mipsisa64sb1 \| mipsisa64sb1el \
	\| mipsisa64sr71k \| mipsisa64sr71kel \
	\| mipsr5900 \| mipsr5900el \
	\| mipstx39 \| mipstx39el \
	\| mn10200 \| mn10300 \
	\| moxie \
	\| mt \
	\| msp430 \
	\| nds32 \| nds32le \| nds32be \
	\| nios \| nios2 \| nios2eb \| nios2el \
	\| ns16k \| ns32k \
	\| open8 \| or1k \| or1knd \| or32 \
	\| pdp10 \| pdp11 \| pj \| pjl \
	\| powerpc \| powerpc64 \| powerpc64le \| powerpcle \
	\| pyramid \
	\| riscv32 \| riscv64 \
	\| rl78 \| rx \
	\| score \
	\| sh \| sh[1234] \| sh[24]a \| sh[24]aeb \| sh[23]e \| sh[234]eb \| sheb \| shbe \| shle \| sh[1234]le \| sh3ele \
	\| sh64 \| sh64le \
	\| sparc \| sparc64 \| sparc64b \| sparc64v \| sparc86x \| sparclet \| sparclite \
	\| sparcv8 \| sparcv9 \| sparcv9b \| sparcv9v \
	\| spu \
	\| tahoe \| tic4x \| tic54x \| tic55x \| tic6x \| tic80 \| tron \
	\| ubicom32 \
	\| v850 \| v850e \| v850e1 \| v850e2 \| v850es \| v850e2v3 \
	\| visium \
	\| we32k \
	\| x86 \| xc16x \| xstormy16 \| xtensa \
	\| z8k \| z80)
	basic_machine=$basic_machine-unknown
	;;
	c54x)
	basic_machine=tic54x-unknown
	;;
	c55x)
	basic_machine=tic55x-unknown
	;;
	c6x)
	basic_machine=tic6x-unknown
	;;
	leon\|leon[3-9])
	basic_machine=sparc-$basic_machine
	;;
	m6811 \| m68hc11 \| m6812 \| m68hc12 \| m68hcs12x \| nvptx \| picochip)
	basic_machine=$basic_machine-unknown
	os=-none
	;;
	m88110 \| m680[12346]0 \| m683?2 \| m68360 \| m5200 \| v70 \| w65 \| z8k)
	;;
	ms1)
	basic_machine=mt-unknown
	;;

	strongarm \| thumb \| xscale)
	basic_machine=arm-unknown
	;;
	xgate)
	basic_machine=$basic_machine-unknown
	os=-none
	;;
	xscaleeb)
	basic_machine=armeb-unknown
	;;

	xscaleel)
	basic_machine=armel-unknown
	;;

	# We use `pc' rather than `unknown'
	# because (1) that's what they normally are, and
	# (2) the word "unknown" tends to confuse beginning users.
	i*86 \| x86_64)
	basic_machine=$basic_machine-pc
	;;
	# Object if more than one company name word.
	--*)
	echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
	exit 1
	;;
	# Recognize the basic CPU types with company name.
	580-* \
	\| a29k-* \
	\| aarch64-* \| aarch64_be-* \
	\| alpha-* \| alphaev[4-8]-* \| alphaev56-* \| alphaev6[78]-* \
	\| alpha64-* \| alpha64ev[4-8]-* \| alpha64ev56-* \| alpha64ev6[78]-* \
	\| alphapca5[67]-* \| alpha64pca5[67]-* \| arc-* \| arceb-* \
	\| arm-* \| armbe-* \| armle-* \| armeb-* \| armv- \
	\| avr-* \| avr32-* \
	\| ba-* \
	\| be32-* \| be64-* \
	\| bfin-* \| bs2000-* \
	\| c[123]* \| c30-* \| [cjt]90-* \| c4x-* \
	\| c8051-* \| clipper-* \| craynv-* \| cydra-* \
	\| d10v-* \| d30v-* \| dlx-* \
	\| e2k-* \| elxsi-* \
	\| f30[01]-* \| f700-* \| fido-* \| fr30-* \| frv-* \| fx80-* \
	\| h8300-* \| h8500-* \
	\| hppa-* \| hppa1.[01]-* \| hppa2.0-* \| hppa2.0[nw]-* \| hppa64-* \
	\| hexagon-* \
	\| i86- \| i860-* \| i960-* \| ia64-* \
	\| ip2k-* \| iq2000-* \
	\| k1om-* \
	\| le32-* \| le64-* \
	\| lm32-* \
	\| m32c-* \| m32r-* \| m32rle-* \
	\| m68000-* \| m680[012346]0-* \| m68360-* \| m683?2-* \| m68k-* \
	\| m88110-* \| m88k-* \| maxq-* \| mcore-* \| metag-* \
	\| microblaze-* \| microblazeel-* \
	\| mips-* \| mipsbe-* \| mipseb-* \| mipsel-* \| mipsle-* \
	\| mips16-* \
	\| mips64-* \| mips64el-* \
	\| mips64octeon-* \| mips64octeonel-* \
	\| mips64orion-* \| mips64orionel-* \
	\| mips64r5900-* \| mips64r5900el-* \
	\| mips64vr-* \| mips64vrel-* \
	\| mips64vr4100-* \| mips64vr4100el-* \
	\| mips64vr4300-* \| mips64vr4300el-* \
	\| mips64vr5000-* \| mips64vr5000el-* \
	\| mips64vr5900-* \| mips64vr5900el-* \
	\| mipsisa32-* \| mipsisa32el-* \
	\| mipsisa32r2-* \| mipsisa32r2el-* \
	\| mipsisa32r6-* \| mipsisa32r6el-* \
	\| mipsisa64-* \| mipsisa64el-* \
	\| mipsisa64r2-* \| mipsisa64r2el-* \
	\| mipsisa64r6-* \| mipsisa64r6el-* \
	\| mipsisa64sb1-* \| mipsisa64sb1el-* \
	\| mipsisa64sr71k-* \| mipsisa64sr71kel-* \
	\| mipsr5900-* \| mipsr5900el-* \
	\| mipstx39-* \| mipstx39el-* \
	\| mmix-* \
	\| mt-* \
	\| msp430-* \
	\| nds32-* \| nds32le-* \| nds32be-* \
	\| nios-* \| nios2-* \| nios2eb-* \| nios2el-* \
	\| none-* \| np1-* \| ns16k-* \| ns32k-* \
	\| open8-* \
	\| or1k- \
	\| orion-* \
	\| pdp10-* \| pdp11-* \| pj-* \| pjl-* \| pn-* \| power-* \
	\| powerpc-* \| powerpc64-* \| powerpc64le-* \| powerpcle-* \
	\| pyramid-* \
	\| riscv32-* \| riscv64-* \
	\| rl78-* \| romp-* \| rs6000-* \| rx-* \
	\| sh-* \| sh[1234]-* \| sh[24]a-* \| sh[24]aeb-* \| sh[23]e-* \| sh[34]eb-* \| sheb-* \| shbe-* \
	\| shle-* \| sh[1234]le-* \| sh3ele-* \| sh64-* \| sh64le-* \
	\| sparc-* \| sparc64-* \| sparc64b-* \| sparc64v-* \| sparc86x-* \| sparclet-* \
	\| sparclite-* \
	\| sparcv8-* \| sparcv9-* \| sparcv9b-* \| sparcv9v-* \| sv1-* \| sx- \
	\| tahoe-* \
	\| tic30-* \| tic4x-* \| tic54x-* \| tic55x-* \| tic6x-* \| tic80-* \
	\| tile- \
	\| tron-* \
	\| ubicom32-* \
	\| v850-* \| v850e-* \| v850e1-* \| v850es-* \| v850e2-* \| v850e2v3-* \
	\| vax-* \
	\| visium-* \
	\| we32k-* \
	\| x86-* \| x86_64-* \| xc16x-* \| xps100-* \
	\| xstormy16-* \| xtensa- \
	\| ymp-* \
	\| z8k-* \| z80-*)
	;;
	# Recognize the basic CPU types without company name, with glob match.
	xtensa*)
	basic_machine=$basic_machine-unknown
	;;
	# Recognize the various machine names and aliases which stand
	# for a CPU type and a company and sometimes even an OS.
	386bsd)
	basic_machine=i386-unknown
	os=-bsd
	;;
	3b1 \| 7300 \| 7300-att \| att-7300 \| pc7300 \| safari \| unixpc)
	basic_machine=m68000-att
	;;
	3b*)
	basic_machine=we32k-att
	;;
	a29khif)
	basic_machine=a29k-amd
	os=-udi
	;;
	abacus)
	basic_machine=abacus-unknown
	;;
	adobe68k)
	basic_machine=m68010-adobe
	os=-scout
	;;
	alliant \| fx80)
	basic_machine=fx80-alliant
	;;
	altos \| altos3068)
	basic_machine=m68k-altos
	;;
	am29k)
	basic_machine=a29k-none
	os=-bsd
	;;
	amd64)
	basic_machine=x86_64-pc
	;;
	amd64-*)
	basic_machine=x86_64-`echo $basic_machine \| sed 's/^[^-]*-//'`
	;;
	amdahl)
	basic_machine=580-amdahl
	os=-sysv
	;;
	amiga \| amiga-*)
	basic_machine=m68k-unknown
	;;
	amigaos \| amigados)
	basic_machine=m68k-unknown
	os=-amigaos
	;;
	amigaunix \| amix)
	basic_machine=m68k-unknown
	os=-sysv4
	;;
	apollo68)
	basic_machine=m68k-apollo
	os=-sysv
	;;
	apollo68bsd)
	basic_machine=m68k-apollo
	os=-bsd
	;;
	aros)
	basic_machine=i386-pc
	os=-aros
	;;
	asmjs)
	basic_machine=asmjs-unknown
	;;
	aux)
	basic_machine=m68k-apple
	os=-aux
	;;
	balance)
	basic_machine=ns32k-sequent
	os=-dynix
	;;
	blackfin)
	basic_machine=bfin-unknown
	os=-linux
	;;
	blackfin-*)
	basic_machine=bfin-`echo $basic_machine \| sed 's/^[^-]*-//'`
	os=-linux
	;;
	bluegene*)
	basic_machine=powerpc-ibm
	os=-cnk
	;;
	c54x-*)
	basic_machine=tic54x-`echo $basic_machine \| sed 's/^[^-]*-//'`
	;;
	c55x-*)
	basic_machine=tic55x-`echo $basic_machine \| sed 's/^[^-]*-//'`
	;;
	c6x-*)
	basic_machine=tic6x-`echo $basic_machine \| sed 's/^[^-]*-//'`
	;;
	c90)
	basic_machine=c90-cray
	os=-unicos
	;;
	cegcc)
	basic_machine=arm-unknown
	os=-cegcc
	;;
	convex-c1)
	basic_machine=c1-convex
	os=-bsd
	;;
	convex-c2)
	basic_machine=c2-convex
	os=-bsd
	;;
	convex-c32)
	basic_machine=c32-convex
	os=-bsd
	;;
	convex-c34)
	basic_machine=c34-convex
	os=-bsd
	;;
	convex-c38)
	basic_machine=c38-convex
	os=-bsd
	;;
	cray \| j90)
	basic_machine=j90-cray
	os=-unicos
	;;
	craynv)
	basic_machine=craynv-cray
	os=-unicosmp
	;;
	cr16 \| cr16-*)
	basic_machine=cr16-unknown
	os=-elf
	;;
	crds \| unos)
	basic_machine=m68k-crds
	;;
	crisv32 \| crisv32-* \| etraxfs*)
	basic_machine=crisv32-axis
	;;
	cris \| cris-* \| etrax*)
	basic_machine=cris-axis
	;;
	crx)
	basic_machine=crx-unknown
	os=-elf
	;;
	da30 \| da30-*)
	basic_machine=m68k-da30
	;;
	decstation \| decstation-3100 \| pmax \| pmax-* \| pmin \| dec3100 \| decstatn)
	basic_machine=mips-dec
	;;
	decsystem10* \| dec10*)
	basic_machine=pdp10-dec
	os=-tops10
	;;
	decsystem20* \| dec20*)
	basic_machine=pdp10-dec
	os=-tops20
	;;
	delta \| 3300 \| motorola-3300 \| motorola-delta \
	\| 3300-motorola \| delta-motorola)
	basic_machine=m68k-motorola
	;;
	delta88)
	basic_machine=m88k-motorola
	os=-sysv3
	;;
	dicos)
	basic_machine=i686-pc
	os=-dicos
	;;
	djgpp)
	basic_machine=i586-pc
	os=-msdosdjgpp
	;;
	dpx20 \| dpx20-*)
	basic_machine=rs6000-bull
	os=-bosx
	;;
	dpx2* \| dpx2*-bull)
	basic_machine=m68k-bull
	os=-sysv3
	;;
	e500v[12])
	basic_machine=powerpc-unknown
	os=$os"spe"
	;;
	e500v[12]-*)
	basic_machine=powerpc-`echo $basic_machine \| sed 's/^[^-]*-//'`
	os=$os"spe"
	;;
	ebmon29k)
	basic_machine=a29k-amd
	os=-ebmon
	;;
	elxsi)
	basic_machine=elxsi-elxsi
	os=-bsd
	;;
	encore \| umax \| mmax)
	basic_machine=ns32k-encore
	;;
	es1800 \| OSE68k \| ose68k \| ose \| OSE)
	basic_machine=m68k-ericsson
	os=-ose
	;;
	fx2800)
	basic_machine=i860-alliant
	;;
	genix)
	basic_machine=ns32k-ns
	;;
	gmicro)
	basic_machine=tron-gmicro
	os=-sysv
	;;
	go32)
	basic_machine=i386-pc
	os=-go32
	;;
	h3050r* \| hiux*)
	basic_machine=hppa1.1-hitachi
	os=-hiuxwe2
	;;
	h8300hms)
	basic_machine=h8300-hitachi
	os=-hms
	;;
	h8300xray)
	basic_machine=h8300-hitachi
	os=-xray
	;;
	h8500hms)
	basic_machine=h8500-hitachi
	os=-hms
	;;
	harris)
	basic_machine=m88k-harris
	os=-sysv3
	;;
	hp300-*)
	basic_machine=m68k-hp
	;;
	hp300bsd)
	basic_machine=m68k-hp
	os=-bsd
	;;
	hp300hpux)
	basic_machine=m68k-hp
	os=-hpux
	;;
	hp3k9[0-9][0-9] \| hp9[0-9][0-9])
	basic_machine=hppa1.0-hp
	;;
	hp9k2[0-9][0-9] \| hp9k31[0-9])
	basic_machine=m68000-hp
	;;
	hp9k3[2-9][0-9])
	basic_machine=m68k-hp
	;;
	hp9k6[0-9][0-9] \| hp6[0-9][0-9])
	basic_machine=hppa1.0-hp
	;;
	hp9k7[0-79][0-9] \| hp7[0-79][0-9])
	basic_machine=hppa1.1-hp
	;;
	hp9k78[0-9] \| hp78[0-9])
	# FIXME: really hppa2.0-hp
	basic_machine=hppa1.1-hp
	;;
	hp9k8[67]1 \| hp8[67]1 \| hp9k80[24] \| hp80[24] \| hp9k8[78]9 \| hp8[78]9 \| hp9k893 \| hp893)
	# FIXME: really hppa2.0-hp
	basic_machine=hppa1.1-hp
	;;
	hp9k8[0-9][13679] \| hp8[0-9][13679])
	basic_machine=hppa1.1-hp
	;;
	hp9k8[0-9][0-9] \| hp8[0-9][0-9])
	basic_machine=hppa1.0-hp
	;;
	hppa-next)
	os=-nextstep3
	;;
	hppaosf)
	basic_machine=hppa1.1-hp
	os=-osf
	;;
	hppro)
	basic_machine=hppa1.1-hp
	os=-proelf
	;;
	i370-ibm* \| ibm*)
	basic_machine=i370-ibm
	;;
	i*86v32)
	basic_machine=`echo $1 \| sed -e 's/86.*/86-pc/'`
	os=-sysv32
	;;
	i86v4)
	basic_machine=`echo $1 \| sed -e 's/86.*/86-pc/'`
	os=-sysv4
	;;
	i*86v)
	basic_machine=`echo $1 \| sed -e 's/86.*/86-pc/'`
	os=-sysv
	;;
	i*86sol2)
	basic_machine=`echo $1 \| sed -e 's/86.*/86-pc/'`
	os=-solaris2
	;;
	i386mach)
	basic_machine=i386-mach
	os=-mach
	;;
	i386-vsta \| vsta)
	basic_machine=i386-unknown
	os=-vsta
	;;
	iris \| iris4d)
	basic_machine=mips-sgi
	case $os in
	-irix*)
	;;
	*)
	os=-irix4
	;;
	esac
	;;
	isi68 \| isi)
	basic_machine=m68k-isi
	os=-sysv
	;;
	leon-\|leon[3-9]-)
	basic_machine=sparc-`echo $basic_machine \| sed 's/-.*//'`
	;;
	m68knommu)
	basic_machine=m68k-unknown
	os=-linux
	;;
	m68knommu-*)
	basic_machine=m68k-`echo $basic_machine \| sed 's/^[^-]*-//'`
	os=-linux
	;;
	m88k-omron*)
	basic_machine=m88k-omron
	;;
	magnum \| m3230)
	basic_machine=mips-mips
	os=-sysv
	;;
	merlin)
	basic_machine=ns32k-utek
	os=-sysv
	;;
	microblaze*)
	basic_machine=microblaze-xilinx
	;;
	mingw64)
	basic_machine=x86_64-pc
	os=-mingw64
	;;
	mingw32)
	basic_machine=i686-pc
	os=-mingw32
	;;
	mingw32ce)
	basic_machine=arm-unknown
	os=-mingw32ce
	;;
	miniframe)
	basic_machine=m68000-convergent
	;;
	mint \| -mint[0-9] \| MiNT \| MiNT[0-9]*)
	basic_machine=m68k-atari
	os=-mint
	;;
	mips3-)
	basic_machine=`echo $basic_machine \| sed -e 's/mips3/mips64/'`
	;;
	mips3*)
	basic_machine=`echo $basic_machine \| sed -e 's/mips3/mips64/'`-unknown
	;;
	monitor)
	basic_machine=m68k-rom68k
	os=-coff
	;;
	morphos)
	basic_machine=powerpc-unknown
	os=-morphos
	;;
	moxiebox)
	basic_machine=moxie-unknown
	os=-moxiebox
	;;
	msdos)
	basic_machine=i386-pc
	os=-msdos
	;;
	ms1-*)
	basic_machine=`echo $basic_machine \| sed -e 's/ms1-/mt-/'`
	;;
	msys)
	basic_machine=i686-pc
	os=-msys
	;;
	mvs)
	basic_machine=i370-ibm
	os=-mvs
	;;
	nacl)
	basic_machine=le32-unknown
	os=-nacl
	;;
	ncr3000)
	basic_machine=i486-ncr
	os=-sysv4
	;;
	netbsd386)
	basic_machine=i386-unknown
	os=-netbsd
	;;
	netwinder)
	basic_machine=armv4l-rebel
	os=-linux
	;;
	news \| news700 \| news800 \| news900)
	basic_machine=m68k-sony
	os=-newsos
	;;
	news1000)
	basic_machine=m68030-sony
	os=-newsos
	;;
	news-3600 \| risc-news)
	basic_machine=mips-sony
	os=-newsos
	;;
	necv70)
	basic_machine=v70-nec
	os=-sysv
	;;
	next \| m*-next )
	basic_machine=m68k-next
	case $os in
	-nextstep* )
	;;
	-ns2*)
	os=-nextstep2
	;;
	*)
	os=-nextstep3
	;;
	esac
	;;
	nh3000)
	basic_machine=m68k-harris
	os=-cxux
	;;
	nh[45]000)
	basic_machine=m88k-harris
	os=-cxux
	;;
	nindy960)
	basic_machine=i960-intel
	os=-nindy
	;;
	mon960)
	basic_machine=i960-intel
	os=-mon960
	;;
	nonstopux)
	basic_machine=mips-compaq
	os=-nonstopux
	;;
	np1)
	basic_machine=np1-gould
	;;
	neo-tandem)
	basic_machine=neo-tandem
	;;
	nse-tandem)
	basic_machine=nse-tandem
	;;
	nsr-tandem)
	basic_machine=nsr-tandem
	;;
	op50n-* \| op60c-*)
	basic_machine=hppa1.1-oki
	os=-proelf
	;;
	openrisc \| openrisc-*)
	basic_machine=or32-unknown
	;;
	os400)
	basic_machine=powerpc-ibm
	os=-os400
	;;
	OSE68000 \| ose68000)
	basic_machine=m68000-ericsson
	os=-ose
	;;
	os68k)
	basic_machine=m68k-none
	os=-os68k
	;;
	pa-hitachi)
	basic_machine=hppa1.1-hitachi
	os=-hiuxwe2
	;;
	paragon)
	basic_machine=i860-intel
	os=-osf
	;;
	parisc)
	basic_machine=hppa-unknown
	os=-linux
	;;
	parisc-*)
	basic_machine=hppa-`echo $basic_machine \| sed 's/^[^-]*-//'`
	os=-linux
	;;
	pbd)
	basic_machine=sparc-tti
	;;
	pbb)
	basic_machine=m68k-tti
	;;
	pc532 \| pc532-*)
	basic_machine=ns32k-pc532
	;;
	pc98)
	basic_machine=i386-pc
	;;
	pc98-*)
	basic_machine=i386-`echo $basic_machine \| sed 's/^[^-]*-//'`
	;;
	pentium \| p5 \| k5 \| k6 \| nexgen \| viac3)
	basic_machine=i586-pc
	;;
	pentiumpro \| p6 \| 6x86 \| athlon \| athlon_*)
	basic_machine=i686-pc
	;;
	pentiumii \| pentium2 \| pentiumiii \| pentium3)
	basic_machine=i686-pc
	;;
	pentium4)
	basic_machine=i786-pc
	;;
	pentium-* \| p5-* \| k5-* \| k6-* \| nexgen-* \| viac3-*)
	basic_machine=i586-`echo $basic_machine \| sed 's/^[^-]*-//'`
	;;
	pentiumpro-* \| p6-* \| 6x86-* \| athlon-*)
	basic_machine=i686-`echo $basic_machine \| sed 's/^[^-]*-//'`
	;;
	pentiumii-* \| pentium2-* \| pentiumiii-* \| pentium3-*)
	basic_machine=i686-`echo $basic_machine \| sed 's/^[^-]*-//'`
	;;
	pentium4-*)
	basic_machine=i786-`echo $basic_machine \| sed 's/^[^-]*-//'`
	;;
	pn)
	basic_machine=pn-gould
	;;
	power) basic_machine=power-ibm
	;;
	ppc \| ppcbe) basic_machine=powerpc-unknown
	;;
	ppc-* \| ppcbe-*)
	basic_machine=powerpc-`echo $basic_machine \| sed 's/^[^-]*-//'`
	;;
	ppcle \| powerpclittle)
	basic_machine=powerpcle-unknown
	;;
	ppcle-* \| powerpclittle-*)
	basic_machine=powerpcle-`echo $basic_machine \| sed 's/^[^-]*-//'`
	;;
	ppc64) basic_machine=powerpc64-unknown
	;;
	ppc64-) basic_machine=powerpc64-`echo $basic_machine \| sed 's/^[^-]-//'`
	;;
	ppc64le \| powerpc64little)
	basic_machine=powerpc64le-unknown
	;;
	ppc64le-* \| powerpc64little-*)
	basic_machine=powerpc64le-`echo $basic_machine \| sed 's/^[^-]*-//'`
	;;
	ps2)
	basic_machine=i386-ibm
	;;
	pw32)
	basic_machine=i586-unknown
	os=-pw32
	;;
	rdos \| rdos64)
	basic_machine=x86_64-pc
	os=-rdos
	;;
	rdos32)
	basic_machine=i386-pc
	os=-rdos
	;;
	rom68k)
	basic_machine=m68k-rom68k
	os=-coff
	;;
	rm[46]00)
	basic_machine=mips-siemens
	;;
	rtpc \| rtpc-*)
	basic_machine=romp-ibm
	;;
	s390 \| s390-*)
	basic_machine=s390-ibm
	;;
	s390x \| s390x-*)
	basic_machine=s390x-ibm
	;;
	sa29200)
	basic_machine=a29k-amd
	os=-udi
	;;
	sb1)
	basic_machine=mipsisa64sb1-unknown
	;;
	sb1el)
	basic_machine=mipsisa64sb1el-unknown
	;;
	sde)
	basic_machine=mipsisa32-sde
	os=-elf
	;;
	sei)
	basic_machine=mips-sei
	os=-seiux
	;;
	sequent)
	basic_machine=i386-sequent
	;;
	sh)
	basic_machine=sh-hitachi
	os=-hms
	;;
	sh5el)
	basic_machine=sh5le-unknown
	;;
	sh64)
	basic_machine=sh64-unknown
	;;
	sparclite-wrs \| simso-wrs)
	basic_machine=sparclite-wrs
	os=-vxworks
	;;
	sps7)
	basic_machine=m68k-bull
	os=-sysv2
	;;
	spur)
	basic_machine=spur-unknown
	;;
	st2000)
	basic_machine=m68k-tandem
	;;
	stratus)
	basic_machine=i860-stratus
	os=-sysv4
	;;
	strongarm-* \| thumb-*)
	basic_machine=arm-`echo $basic_machine \| sed 's/^[^-]*-//'`
	;;
	sun2)
	basic_machine=m68000-sun
	;;
	sun2os3)
	basic_machine=m68000-sun
	os=-sunos3
	;;
	sun2os4)
	basic_machine=m68000-sun
	os=-sunos4
	;;
	sun3os3)
	basic_machine=m68k-sun
	os=-sunos3
	;;
	sun3os4)
	basic_machine=m68k-sun
	os=-sunos4
	;;
	sun4os3)
	basic_machine=sparc-sun
	os=-sunos3
	;;
	sun4os4)
	basic_machine=sparc-sun
	os=-sunos4
	;;
	sun4sol2)
	basic_machine=sparc-sun
	os=-solaris2
	;;
	sun3 \| sun3-*)
	basic_machine=m68k-sun
	;;
	sun4)
	basic_machine=sparc-sun
	;;
	sun386 \| sun386i \| roadrunner)
	basic_machine=i386-sun
	;;
	sv1)
	basic_machine=sv1-cray
	os=-unicos
	;;
	symmetry)
	basic_machine=i386-sequent
	os=-dynix
	;;
	t3e)
	basic_machine=alphaev5-cray
	os=-unicos
	;;
	t90)
	basic_machine=t90-cray
	os=-unicos
	;;
	tile*)
	basic_machine=$basic_machine-unknown
	os=-linux-gnu
	;;
	tx39)
	basic_machine=mipstx39-unknown
	;;
	tx39el)
	basic_machine=mipstx39el-unknown
	;;
	toad1)
	basic_machine=pdp10-xkl
	os=-tops20
	;;
	tower \| tower-32)
	basic_machine=m68k-ncr
	;;
	tpf)
	basic_machine=s390x-ibm
	os=-tpf
	;;
	udi29k)
	basic_machine=a29k-amd
	os=-udi
	;;
	ultra3)
	basic_machine=a29k-nyu
	os=-sym1
	;;
	v810 \| necv810)
	basic_machine=v810-nec
	os=-none
	;;
	vaxv)
	basic_machine=vax-dec
	os=-sysv
	;;
	vms)
	basic_machine=vax-dec
	os=-vms
	;;
	vpp\|vx\|vx-)
	basic_machine=f301-fujitsu
	;;
	vxworks960)
	basic_machine=i960-wrs
	os=-vxworks
	;;
	vxworks68)
	basic_machine=m68k-wrs
	os=-vxworks
	;;
	vxworks29k)
	basic_machine=a29k-wrs
	os=-vxworks
	;;
	w65*)
	basic_machine=w65-wdc
	os=-none
	;;
	w89k-*)
	basic_machine=hppa1.1-winbond
	os=-proelf
	;;
	xbox)
	basic_machine=i686-pc
	os=-mingw32
	;;
	xps \| xps100)
	basic_machine=xps100-honeywell
	;;
	xscale-* \| xscalee[bl]-*)
	basic_machine=`echo $basic_machine \| sed 's/^xscale/arm/'`
	;;
	ymp)
	basic_machine=ymp-cray
	os=-unicos
	;;
	z8k-*-coff)
	basic_machine=z8k-unknown
	os=-sim
	;;
	z80-*-coff)
	basic_machine=z80-unknown
	os=-sim
	;;
	none)
	basic_machine=none-none
	os=-none
	;;

	# Here we handle the default manufacturer of certain CPU types. It is in
	# some cases the only manufacturer, in others, it is the most popular.
	w89k)
	basic_machine=hppa1.1-winbond
	;;
	op50n)
	basic_machine=hppa1.1-oki
	;;
	op60c)
	basic_machine=hppa1.1-oki
	;;
	romp)
	basic_machine=romp-ibm
	;;
	mmix)
	basic_machine=mmix-knuth
	;;
	rs6000)
	basic_machine=rs6000-ibm
	;;
	vax)
	basic_machine=vax-dec
	;;
	pdp10)
	# there are many clones, so DEC is not a safe bet
	basic_machine=pdp10-unknown
	;;
	pdp11)
	basic_machine=pdp11-dec
	;;
	we32k)
	basic_machine=we32k-att
	;;
	sh[1234] \| sh[24]a \| sh[24]aeb \| sh[34]eb \| sh[1234]le \| sh[23]ele)
	basic_machine=sh-unknown
	;;
	sparc \| sparcv8 \| sparcv9 \| sparcv9b \| sparcv9v)
	basic_machine=sparc-sun
	;;
	cydra)
	basic_machine=cydra-cydrome
	;;
	orion)
	basic_machine=orion-highlevel
	;;
	orion105)
	basic_machine=clipper-highlevel
	;;
	mac \| mpw \| mac-mpw)
	basic_machine=m68k-apple
	;;
	pmac \| pmac-mpw)
	basic_machine=powerpc-apple
	;;
	*-unknown)
	# Make sure to match an already-canonicalized machine name.
	;;
	*)
	echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
	exit 1
	;;
	esac

	# Here we canonicalize certain aliases for manufacturers.
	case $basic_machine in
	-digital)
	basic_machine=`echo $basic_machine \| sed 's/digital.*/dec/'`
	;;
	-commodore)
	basic_machine=`echo $basic_machine \| sed 's/commodore.*/cbm/'`
	;;
	*)
	;;
	esac

	# Decode manufacturer-specific aliases for certain operating systems.

	if [ x"$os" != x"" ]
	then
	case $os in
	# First match some system type aliases
	# that might get confused with valid system types.
	# -solaris* is a basic system type, with this one exception.
	-auroraux)
	os=-auroraux
	;;
	-solaris1 \| -solaris1.*)
	os=`echo $os \| sed -e 's\|solaris1\|sunos4\|'`
	;;
	-solaris)
	os=-solaris2
	;;
	-svr4*)
	os=-sysv4
	;;
	-unixware*)
	os=-sysv4.2uw
	;;
	-gnu/linux*)
	os=`echo $os \| sed -e 's\|gnu/linux\|linux-gnu\|'`
	;;
	# First accept the basic system types.
	# The portable systems comes first.
	# Each alternative MUST END IN A *, to match a version number.
	# -sysv* is not here because it comes later, after sysvr4.
	-gnu* \| -bsd* \| -mach* \| -minix* \| -genix* \| -ultrix* \| -irix* \
	\| -vms \| -sco* \| -esix* \| -isc* \| -aix* \| -cnk* \| -sunos \| -sunos[34]*\
	\| -hpux* \| -unos* \| -osf* \| -luna* \| -dgux* \| -auroraux* \| -solaris* \
	\| -sym* \| -kopensolaris* \| -plan9* \
	\| -amigaos* \| -amigados* \| -msdos* \| -newsos* \| -unicos* \| -aof* \
	\| -aos* \| -aros* \| -cloudabi* \| -sortix* \
	\| -nindy* \| -vxsim* \| -vxworks* \| -ebmon* \| -hms* \| -mvs* \
	\| -clix* \| -riscos* \| -uniplus* \| -iris* \| -rtu* \| -xenix* \
	\| -hiux* \| -386bsd* \| -knetbsd* \| -mirbsd* \| -netbsd* \
	\| -bitrig* \| -openbsd* \| -solidbsd* \| -libertybsd* \
	\| -ekkobsd* \| -kfreebsd* \| -freebsd* \| -riscix* \| -lynxos* \
	\| -bosx* \| -nextstep* \| -cxux* \| -aout* \| -elf* \| -oabi* \
	\| -ptx* \| -coff* \| -ecoff* \| -winnt* \| -domain* \| -vsta* \
	\| -udi* \| -eabi* \| -lites* \| -ieee* \| -go32* \| -aux* \
	\| -chorusos* \| -chorusrdb* \| -cegcc* \
	\| -cygwin* \| -msys* \| -pe* \| -psos* \| -moss* \| -proelf* \| -rtems* \
	\| -midipix* \| -mingw32* \| -mingw64* \| -linux-gnu* \| -linux-android* \
	\| -linux-newlib* \| -linux-musl* \| -linux-uclibc* \
	\| -uxpv* \| -beos* \| -mpeix* \| -udk* \| -moxiebox* \
	\| -interix* \| -uwin* \| -mks* \| -rhapsody* \| -darwin* \| -opened* \
	\| -openstep* \| -oskit* \| -conix* \| -pw32* \| -nonstopux* \
	\| -storm-chaos* \| -tops10* \| -tenex* \| -tops20* \| -its* \
	\| -os2* \| -vos* \| -palmos* \| -uclinux* \| -nucleus* \
	\| -morphos* \| -superux* \| -rtmk* \| -rtmk-nova* \| -windiss* \
	\| -powermax* \| -dnix* \| -nx6 \| -nx7 \| -sei* \| -dragonfly* \
	\| -skyos* \| -haiku* \| -rdos* \| -toppers* \| -drops* \| -es* \
	\| -onefs* \| -tirtos* \| -phoenix*)
	# Remember, each alternative MUST END IN *, to match a version number.
	;;
	-qnx*)
	case $basic_machine in
	x86-* \| i86-)
	;;
	*)
	os=-nto$os
	;;
	esac
	;;
	-nto-qnx*)
	;;
	-nto*)
	os=`echo $os \| sed -e 's\|nto\|nto-qnx\|'`
	;;
	-sim \| -es1800* \| -hms* \| -xray \| -os68k* \| -none* \| -v88r* \
	\| -windows* \| -osx \| -abug \| -netware* \| -os9* \| -beos* \| -haiku* \
	\| -macos* \| -mpw* \| -magic* \| -mmixware* \| -mon960* \| -lnews*)
	;;
	-mac*)
	os=`echo $os \| sed -e 's\|mac\|macos\|'`
	;;
	-linux-dietlibc)
	os=-linux-dietlibc
	;;
	-linux*)
	os=`echo $os \| sed -e 's\|linux\|linux-gnu\|'`
	;;
	-sunos5*)
	os=`echo $os \| sed -e 's\|sunos5\|solaris2\|'`
	;;
	-sunos6*)
	os=`echo $os \| sed -e 's\|sunos6\|solaris3\|'`
	;;
	-opened*)
	os=-openedition
	;;
	-os400*)
	os=-os400
	;;
	-wince*)
	os=-wince
	;;
	-osfrose*)
	os=-osfrose
	;;
	-osf*)
	os=-osf
	;;
	-utek*)
	os=-bsd
	;;
	-dynix*)
	os=-bsd
	;;
	-acis*)
	os=-aos
	;;
	-atheos*)
	os=-atheos
	;;
	-syllable*)
	os=-syllable
	;;
	-386bsd)
	os=-bsd
	;;
	-ctix* \| -uts*)
	os=-sysv
	;;
	-nova*)
	os=-rtmk-nova
	;;
	-ns2 )
	os=-nextstep2
	;;
	-nsk*)
	os=-nsk
	;;
	# Preserve the version number of sinix5.
	-sinix5.*)
	os=`echo $os \| sed -e 's\|sinix\|sysv\|'`
	;;
	-sinix*)
	os=-sysv4
	;;
	-tpf*)
	os=-tpf
	;;
	-triton*)
	os=-sysv3
	;;
	-oss*)
	os=-sysv3
	;;
	-svr4)
	os=-sysv4
	;;
	-svr3)
	os=-sysv3
	;;
	-sysvr4)
	os=-sysv4
	;;
	# This must come after -sysvr4.
	-sysv*)
	;;
	-ose*)
	os=-ose
	;;
	-es1800*)
	os=-ose
	;;
	-xenix)
	os=-xenix
	;;
	-mint \| -mint[0-9] \| -MiNT \| -MiNT[0-9])
	os=-mint
	;;
	-aros*)
	os=-aros
	;;
	-zvmoe)
	os=-zvmoe
	;;
	-dicos*)
	os=-dicos
	;;
	-nacl*)
	;;
	-ios)
	;;
	-none)
	;;
	*)
	# Get rid of the `-' at the beginning of $os.
	os=`echo $os \| sed 's/[^-]*-//'`
	echo Invalid configuration \`$1\': system \`$os\' not recognized 1>&2
	exit 1
	;;
	esac
	else

	# Here we handle the default operating systems that come with various machines.
	# The value should be what the vendor currently ships out the door with their
	# machine or put another way, the most popular os provided with the machine.

	# Note that if you're going to try to match "-MANUFACTURER" here (say,
	# "-sun"), then you have to tell the case statement up towards the top
	# that MANUFACTURER isn't an operating system. Otherwise, code above
	# will signal an error saying that MANUFACTURER isn't an operating
	# system, and we'll never get to this point.

	case $basic_machine in
	score-*)
	os=-elf
	;;
	spu-*)
	os=-elf
	;;
	*-acorn)
	os=-riscix1.2
	;;
	arm*-rebel)
	os=-linux
	;;
	arm*-semi)
	os=-aout
	;;
	c4x-* \| tic4x-*)
	os=-coff
	;;
	c8051-*)
	os=-elf
	;;
	hexagon-*)
	os=-elf
	;;
	tic54x-*)
	os=-coff
	;;
	tic55x-*)
	os=-coff
	;;
	tic6x-*)
	os=-coff
	;;
	# This must come before the *-dec entry.
	pdp10-*)
	os=-tops20
	;;
	pdp11-*)
	os=-none
	;;
	-dec \| vax-)
	os=-ultrix4.2
	;;
	m68*-apollo)
	os=-domain
	;;
	i386-sun)
	os=-sunos4.0.2
	;;
	m68000-sun)
	os=-sunos3
	;;
	m68*-cisco)
	os=-aout
	;;
	mep-*)
	os=-elf
	;;
	mips*-cisco)
	os=-elf
	;;
	mips-)
	os=-elf
	;;
	or32-*)
	os=-coff
	;;
	*-tti) # must be before sparc entry or we get the wrong os.
	os=-sysv3
	;;
	sparc-* \| *-sun)
	os=-sunos4.1.1
	;;
	*-be)
	os=-beos
	;;
	*-haiku)
	os=-haiku
	;;
	*-ibm)
	os=-aix
	;;
	*-knuth)
	os=-mmixware
	;;
	*-wec)
	os=-proelf
	;;
	*-winbond)
	os=-proelf
	;;
	*-oki)
	os=-proelf
	;;
	*-hp)
	os=-hpux
	;;
	*-hitachi)
	os=-hiux
	;;
	i860-* \| -att \| -ncr \| -altos \| -motorola \| *-convergent)
	os=-sysv
	;;
	*-cbm)
	os=-amigaos
	;;
	*-dg)
	os=-dgux
	;;
	*-dolphin)
	os=-sysv3
	;;
	m68k-ccur)
	os=-rtu
	;;
	m88k-omron*)
	os=-luna
	;;
	*-next )
	os=-nextstep
	;;
	*-sequent)
	os=-ptx
	;;
	*-crds)
	os=-unos
	;;
	*-ns)
	os=-genix
	;;
	i370-*)
	os=-mvs
	;;
	*-next)
	os=-nextstep3
	;;
	*-gould)
	os=-sysv
	;;
	*-highlevel)
	os=-bsd
	;;
	*-encore)
	os=-bsd
	;;
	*-sgi)
	os=-irix
	;;
	*-siemens)
	os=-sysv4
	;;
	*-masscomp)
	os=-rtu
	;;
	f30[01]-fujitsu \| f700-fujitsu)
	os=-uxpv
	;;
	*-rom68k)
	os=-coff
	;;
	-bug)
	os=-coff
	;;
	*-apple)
	os=-macos
	;;
	-atari)
	os=-mint
	;;
	*)
	os=-none
	;;
	esac
	fi

	# Here we handle the case where we know the os, and the CPU type, but not the
	# manufacturer. We pick the logical manufacturer.
	vendor=unknown
	case $basic_machine in
	*-unknown)
	case $os in
	-riscix*)
	vendor=acorn
	;;
	-sunos*)
	vendor=sun
	;;
	-cnk\|-aix)
	vendor=ibm
	;;
	-beos*)
	vendor=be
	;;
	-hpux*)
	vendor=hp
	;;
	-mpeix*)
	vendor=hp
	;;
	-hiux*)
	vendor=hitachi
	;;
	-unos*)
	vendor=crds
	;;
	-dgux*)
	vendor=dg
	;;
	-luna*)
	vendor=omron
	;;
	-genix*)
	vendor=ns
	;;
	-mvs* \| -opened*)
	vendor=ibm
	;;
	-os400*)
	vendor=ibm
	;;
	-ptx*)
	vendor=sequent
	;;
	-tpf*)
	vendor=ibm
	;;
	-vxsim* \| -vxworks* \| -windiss*)
	vendor=wrs
	;;
	-aux*)
	vendor=apple
	;;
	-hms*)
	vendor=hitachi
	;;
	-mpw* \| -macos*)
	vendor=apple
	;;
	-mint \| -mint[0-9] \| -MiNT \| -MiNT[0-9])
	vendor=atari
	;;
	-vos*)
	vendor=stratus
	;;
	esac
	basic_machine=`echo $basic_machine \| sed "s/unknown/$vendor/"`
	;;
	esac

	echo $basic_machine$os
	exit

	# Local variables:
	# eval: (add-hook 'write-file-hooks 'time-stamp)
	# time-stamp-start: "timestamp='"
	# time-stamp-format: "%:y-%02m-%02d"
	# time-stamp-end: "'"
	# End:
	Index: head/contrib/unbound/configure
	===================================================================
	--- head/contrib/unbound/configure (revision 349719)
	+++ head/contrib/unbound/configure (revision 349720)
	@@ -1,23297 +1,23356 @@
	#! /bin/sh
	# Guess values for system-dependent variables and create Makefiles.
	-# Generated by GNU Autoconf 2.69 for unbound 1.8.1.
	+# Generated by GNU Autoconf 2.69 for unbound 1.9.2.
	#
	# Report bugs to <unbound-bugs@nlnetlabs.nl>.
	#
	#
	# Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
	#
	#
	# This configure script is free software; the Free Software Foundation
	# gives unlimited permission to copy, distribute and modify it.
	## -------------------- ##
	## M4sh Initialization. ##
	## -------------------- ##

	# Be more Bourne compatible
	DUALCASE=1; export DUALCASE # for MKS sh
	if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then :
	emulate sh
	NULLCMD=:
	# Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which
	# is contrary to our usage. Disable this feature.
	alias -g '${1+"$@"}'='"$@"'
	setopt NO_GLOB_SUBST
	else
	case `(set -o) 2>/dev/null` in #(
	posix) :
	set -o posix ;; #(
	*) :
	;;
	esac
	fi


	as_nl='
	'
	export as_nl
	# Printing a long string crashes Solaris 7 /usr/bin/printf.
	as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
	as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo
	as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo
	# Prefer a ksh shell builtin over an external printf program on Solaris,
	# but without wasting forks for bash or zsh.
	if test -z "$BASH_VERSION$ZSH_VERSION" \
	&& (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then
	as_echo='print -r --'
	as_echo_n='print -rn --'
	elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then
	as_echo='printf %s\n'
	as_echo_n='printf %s'
	else
	if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then
	as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"'
	as_echo_n='/usr/ucb/echo -n'
	else
	as_echo_body='eval expr "X$1" : "X\$.*\$"'
	as_echo_n_body='eval
	arg=$1;
	case $arg in #(
	"$as_nl")
	expr "X$arg" : "X\$.*\$$as_nl";
	arg=`expr "X$arg" : ".$as_nl\$.\$"`;;
	esac;
	expr "X$arg" : "X\$.*\$" \| tr -d "$as_nl"
	'
	export as_echo_n_body
	as_echo_n='sh -c $as_echo_n_body as_echo'
	fi
	export as_echo_body
	as_echo='sh -c $as_echo_body as_echo'
	fi

	# The user is always right.
	if test "${PATH_SEPARATOR+set}" != set; then
	PATH_SEPARATOR=:
	(PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && {
	(PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 \|\|
	PATH_SEPARATOR=';'
	}
	fi


	# IFS
	# We need space, tab and new line, in precisely that order. Quoting is
	# there to prevent editors from complaining about space-tab.
	# (If _AS_PATH_WALK were called with IFS unset, it would disable word
	# splitting by setting IFS to empty value.)
	IFS=" "" $as_nl"

	# Find who we are. Look in the path if we contain no directory separator.
	as_myself=
	case $0 in #((
	[\\/] ) as_myself=$0 ;;
	*) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
	done
	IFS=$as_save_IFS

	;;
	esac
	# We did not find ourselves, most probably we were run as `sh COMMAND'
	# in which case we are not to be found in the path.
	if test "x$as_myself" = x; then
	as_myself=$0
	fi
	if test ! -f "$as_myself"; then
	$as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
	exit 1
	fi

	# Unset variables that we do not need and which cause bugs (e.g. in
	# pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "\|\| exit 1"
	# suppresses any "Segmentation fault" message there. '((' could
	# trigger a bug in pdksh 5.2.14.
	for as_var in BASH_ENV ENV MAIL MAILPATH
	do eval test x\${$as_var+set} = xset \
	&& ( (unset $as_var) \|\| exit 1) >/dev/null 2>&1 && unset $as_var \|\| :
	done
	PS1='$ '
	PS2='> '
	PS4='+ '

	# NLS nuisances.
	LC_ALL=C
	export LC_ALL
	LANGUAGE=C
	export LANGUAGE

	# CDPATH.
	(unset CDPATH) >/dev/null 2>&1 && unset CDPATH

	# Use a proper internal environment variable to ensure we don't fall
	# into an infinite loop, continuously re-executing ourselves.
	if test x"${_as_can_reexec}" != xno && test "x$CONFIG_SHELL" != x; then
	_as_can_reexec=no; export _as_can_reexec;
	# We cannot yet assume a decent shell, so we have to provide a
	# neutralization value for shells without unset; and this also
	# works around shells that cannot unset nonexistent variables.
	# Preserve -v and -x to the replacement shell.
	BASH_ENV=/dev/null
	ENV=/dev/null
	(unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV
	case $- in # ((((
	vx* \| xv* ) as_opts=-vx ;;
	v ) as_opts=-v ;;
	x ) as_opts=-x ;;
	* ) as_opts= ;;
	esac
	exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"}
	# Admittedly, this is quite paranoid, since all the known shells bail
	# out after a failed `exec'.
	$as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2
	as_fn_exit 255
	fi
	# We don't want this to propagate to other subprocesses.
	{ _as_can_reexec=; unset _as_can_reexec;}
	if test "x$CONFIG_SHELL" = x; then
	as_bourne_compatible="if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then :
	emulate sh
	NULLCMD=:
	# Pre-4.2 versions of Zsh do word splitting on \${1+\"\$@\"}, which
	# is contrary to our usage. Disable this feature.
	alias -g '\${1+\"\$@\"}'='\"\$@\"'
	setopt NO_GLOB_SUBST
	else
	case \`(set -o) 2>/dev/null\` in #(
	posix) :
	set -o posix ;; #(
	*) :
	;;
	esac
	fi
	"
	as_required="as_fn_return () { (exit \$1); }
	as_fn_success () { as_fn_return 0; }
	as_fn_failure () { as_fn_return 1; }
	as_fn_ret_success () { return 0; }
	as_fn_ret_failure () { return 1; }

	exitcode=0
	as_fn_success \|\| { exitcode=1; echo as_fn_success failed.; }
	as_fn_failure && { exitcode=1; echo as_fn_failure succeeded.; }
	as_fn_ret_success \|\| { exitcode=1; echo as_fn_ret_success failed.; }
	as_fn_ret_failure && { exitcode=1; echo as_fn_ret_failure succeeded.; }
	if ( set x; as_fn_ret_success y && test x = \"\$1\" ); then :

	else
	exitcode=1; echo positional parameters were not saved.
	fi
	test x\$exitcode = x0 \|\| exit 1
	test -x / \|\| exit 1"
	as_suggested=" as_lineno_1=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_1a=\$LINENO
	as_lineno_2=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_2a=\$LINENO
	eval 'test \"x\$as_lineno_1'\$as_run'\" != \"x\$as_lineno_2'\$as_run'\" &&
	test \"x\`expr \$as_lineno_1'\$as_run' + 1\`\" = \"x\$as_lineno_2'\$as_run'\"' \|\| exit 1
	test \$(( 1 + 1 )) = 2 \|\| exit 1

	test -n \"\${ZSH_VERSION+set}\${BASH_VERSION+set}\" \|\| (
	ECHO='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
	ECHO=\$ECHO\$ECHO\$ECHO\$ECHO\$ECHO
	ECHO=\$ECHO\$ECHO\$ECHO\$ECHO\$ECHO\$ECHO
	PATH=/empty FPATH=/empty; export PATH FPATH
	test \"X\`printf %s \$ECHO\`\" = \"X\$ECHO\" \\
	\|\| test \"X\`print -r -- \$ECHO\`\" = \"X\$ECHO\" ) \|\| exit 1"
	if (eval "$as_required") 2>/dev/null; then :
	as_have_required=yes
	else
	as_have_required=no
	fi
	if test x$as_have_required = xyes && (eval "$as_suggested") 2>/dev/null; then :

	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	as_found=false
	for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	as_found=:
	case $as_dir in #(
	/*)
	for as_base in sh bash ksh sh5; do
	# Try only shells that exist, to save several forks.
	as_shell=$as_dir/$as_base
	if { test -f "$as_shell" \|\| test -f "$as_shell.exe"; } &&
	{ $as_echo "$as_bourne_compatible""$as_required" \| as_run=a "$as_shell"; } 2>/dev/null; then :
	CONFIG_SHELL=$as_shell as_have_required=yes
	if { $as_echo "$as_bourne_compatible""$as_suggested" \| as_run=a "$as_shell"; } 2>/dev/null; then :
	break 2
	fi
	fi
	done;;
	esac
	as_found=false
	done
	$as_found \|\| { if { test -f "$SHELL" \|\| test -f "$SHELL.exe"; } &&
	{ $as_echo "$as_bourne_compatible""$as_required" \| as_run=a "$SHELL"; } 2>/dev/null; then :
	CONFIG_SHELL=$SHELL as_have_required=yes
	fi; }
	IFS=$as_save_IFS


	if test "x$CONFIG_SHELL" != x; then :
	export CONFIG_SHELL
	# We cannot yet assume a decent shell, so we have to provide a
	# neutralization value for shells without unset; and this also
	# works around shells that cannot unset nonexistent variables.
	# Preserve -v and -x to the replacement shell.
	BASH_ENV=/dev/null
	ENV=/dev/null
	(unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV
	case $- in # ((((
	vx* \| xv* ) as_opts=-vx ;;
	v ) as_opts=-v ;;
	x ) as_opts=-x ;;
	* ) as_opts= ;;
	esac
	exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"}
	# Admittedly, this is quite paranoid, since all the known shells bail
	# out after a failed `exec'.
	$as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2
	exit 255
	fi

	if test x$as_have_required = xno; then :
	$as_echo "$0: This script requires a shell more modern than all"
	$as_echo "$0: the shells that I found on your system."
	if test x${ZSH_VERSION+set} = xset ; then
	$as_echo "$0: In particular, zsh $ZSH_VERSION has bugs and should"
	$as_echo "$0: be upgraded to zsh 4.3.4 or later."
	else
	$as_echo "$0: Please tell bug-autoconf@gnu.org and
	$0: unbound-bugs@nlnetlabs.nl about your system, including
	$0: any error possibly output before this message. Then
	$0: install a modern shell, or manually run the script
	$0: under such a shell if you do have one."
	fi
	exit 1
	fi
	fi
	fi
	SHELL=${CONFIG_SHELL-/bin/sh}
	export SHELL
	# Unset more variables known to interfere with behavior of common tools.
	CLICOLOR_FORCE= GREP_OPTIONS=
	unset CLICOLOR_FORCE GREP_OPTIONS

	## --------------------- ##
	## M4sh Shell Functions. ##
	## --------------------- ##
	# as_fn_unset VAR
	# ---------------
	# Portably unset VAR.
	as_fn_unset ()
	{
	{ eval $1=; unset $1;}
	}
	as_unset=as_fn_unset

	# as_fn_set_status STATUS
	# -----------------------
	# Set $? to STATUS, without forking.
	as_fn_set_status ()
	{
	return $1
	} # as_fn_set_status

	# as_fn_exit STATUS
	# -----------------
	# Exit the shell with STATUS, even in a "trap 0" or "set -e" context.
	as_fn_exit ()
	{
	set +e
	as_fn_set_status $1
	exit $1
	} # as_fn_exit

	# as_fn_mkdir_p
	# -------------
	# Create "$as_dir" as a directory, including parents if necessary.
	as_fn_mkdir_p ()
	{

	case $as_dir in #(
	-*) as_dir=./$as_dir;;
	esac
	test -d "$as_dir" \|\| eval $as_mkdir_p \|\| {
	as_dirs=
	while :; do
	case $as_dir in #(
	\') as_qdir=`$as_echo "$as_dir" \| sed "s/'/'\\\\\\\\''/g"`;; #'(
	*) as_qdir=$as_dir;;
	esac
	as_dirs="'$as_qdir' $as_dirs"
	as_dir=`$as_dirname -- "$as_dir" \|\|
	$as_expr X"$as_dir" : 'X$.[^/]$//[^/][^/]/$' \\| \
	X"$as_dir" : 'X$//$[^/]' \\| \
	X"$as_dir" : 'X$//$$' \\| \
	X"$as_dir" : 'X$/$' \\| . 2>/dev/null \|\|
	$as_echo X"$as_dir" \|
	sed '/^X$.[^/]$\/\/[^/][^/]\/$/{
	s//\1/
	q
	}
	/^X$\/\/$[^/].*/{
	s//\1/
	q
	}
	/^X$\/\/$$/{
	s//\1/
	q
	}
	/^X$\/$.*/{
	s//\1/
	q
	}
	s/.*/./; q'`
	test -d "$as_dir" && break
	done
	test -z "$as_dirs" \|\| eval "mkdir $as_dirs"
	} \|\| test -d "$as_dir" \|\| as_fn_error $? "cannot create directory $as_dir"


	} # as_fn_mkdir_p

	# as_fn_executable_p FILE
	# -----------------------
	# Test if FILE is an executable regular file.
	as_fn_executable_p ()
	{
	test -f "$1" && test -x "$1"
	} # as_fn_executable_p
	# as_fn_append VAR VALUE
	# ----------------------
	# Append the text in VALUE to the end of the definition contained in VAR. Take
	# advantage of any shell optimizations that allow amortized linear growth over
	# repeated appends, instead of the typical quadratic growth present in naive
	# implementations.
	if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then :
	eval 'as_fn_append ()
	{
	eval $1+=\$2
	}'
	else
	as_fn_append ()
	{
	eval $1=\$$1\$2
	}
	fi # as_fn_append

	# as_fn_arith ARG...
	# ------------------
	# Perform arithmetic evaluation on the ARGs, and store the result in the
	# global $as_val. Take advantage of shells that can avoid forks. The arguments
	# must be portable across $(()) and expr.
	if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then :
	eval 'as_fn_arith ()
	{
	as_val=$(( $* ))
	}'
	else
	as_fn_arith ()
	{
	as_val=`expr "$@" \|\| test $? -eq 1`
	}
	fi # as_fn_arith


	# as_fn_error STATUS ERROR [LINENO LOG_FD]
	# ----------------------------------------
	# Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are
	# provided, also output the error to LOG_FD, referencing LINENO. Then exit the
	# script with STATUS, using 1 if that was 0.
	as_fn_error ()
	{
	as_status=$1; test $as_status -eq 0 && as_status=1
	if test "$4"; then
	as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
	$as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
	fi
	$as_echo "$as_me: error: $2" >&2
	as_fn_exit $as_status
	} # as_fn_error

	if expr a : '$a$' >/dev/null 2>&1 &&
	test "X`expr 00001 : '.*$...$'`" = X001; then
	as_expr=expr
	else
	as_expr=false
	fi

	if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then
	as_basename=basename
	else
	as_basename=false
	fi

	if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then
	as_dirname=dirname
	else
	as_dirname=false
	fi

	as_me=`$as_basename -- "$0" \|\|
	$as_expr X/"$0" : './$[^/][^/]$/*$' \\| \
	X"$0" : 'X$//$$' \\| \
	X"$0" : 'X$/$' \\| . 2>/dev/null \|\|
	$as_echo X/"$0" \|
	sed '/^.\/$[^/][^/]$\/*$/{
	s//\1/
	q
	}
	/^X\/$\/\/$$/{
	s//\1/
	q
	}
	/^X\/$\/$.*/{
	s//\1/
	q
	}
	s/.*/./; q'`

	# Avoid depending upon Character Ranges.
	as_cr_letters='abcdefghijklmnopqrstuvwxyz'
	as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
	as_cr_Letters=$as_cr_letters$as_cr_LETTERS
	as_cr_digits='0123456789'
	as_cr_alnum=$as_cr_Letters$as_cr_digits


	as_lineno_1=$LINENO as_lineno_1a=$LINENO
	as_lineno_2=$LINENO as_lineno_2a=$LINENO
	eval 'test "x$as_lineno_1'$as_run'" != "x$as_lineno_2'$as_run'" &&
	test "x`expr $as_lineno_1'$as_run' + 1`" = "x$as_lineno_2'$as_run'"' \|\| {
	# Blame Lee E. McMahon (1931-1989) for sed's syntax. :-)
	sed -n '
	p
	/[$]LINENO/=
	' <$as_myself \|
	sed '
	s/[$]LINENO.*/&-/
	t lineno
	b
	:lineno
	N
	:loop
	s/[$]LINENO$[^'$as_cr_alnum'_].\n$$.$/\2\1\2/
	t loop
	s/-\n.*//
	' >$as_me.lineno &&
	chmod +x "$as_me.lineno" \|\|
	{ $as_echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2; as_fn_exit 1; }

	# If we had to re-execute with $CONFIG_SHELL, we're ensured to have
	# already done that, so ensure we don't try to do so again and fall
	# in an infinite loop. This has already happened in practice.
	_as_can_reexec=no; export _as_can_reexec
	# Don't try to exec as it changes $[0], causing all sort of problems
	# (the dirname of $[0] is not the place where we might find the
	# original and so on. Autoconf is especially sensitive to this).
	. "./$as_me.lineno"
	# Exit status is that of the last command.
	exit
	}

	ECHO_C= ECHO_N= ECHO_T=
	case `echo -n x` in #(((((
	-n*)
	case `echo 'xy\c'` in
	c) ECHO_T=' ';; # ECHO_T is single tab character.
	xy) ECHO_C='\c';;
	*) echo `echo ksh88 bug on AIX 6.1` > /dev/null
	ECHO_T=' ';;
	esac;;
	*)
	ECHO_N='-n';;
	esac

	rm -f conf$$ conf$$.exe conf$$.file
	if test -d conf$$.dir; then
	rm -f conf$$.dir/conf$$.file
	else
	rm -f conf$$.dir
	mkdir conf$$.dir 2>/dev/null
	fi
	if (echo >conf$$.file) 2>/dev/null; then
	if ln -s conf$$.file conf$$ 2>/dev/null; then
	as_ln_s='ln -s'
	# ... but there are two gotchas:
	# 1) On MSYS, both `ln -s file dir' and `ln file dir' fail.
	# 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable.
	# In both cases, we have to default to `cp -pR'.
	ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe \|\|
	as_ln_s='cp -pR'
	elif ln conf$$.file conf$$ 2>/dev/null; then
	as_ln_s=ln
	else
	as_ln_s='cp -pR'
	fi
	else
	as_ln_s='cp -pR'
	fi
	rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file
	rmdir conf$$.dir 2>/dev/null

	if mkdir -p . 2>/dev/null; then
	as_mkdir_p='mkdir -p "$as_dir"'
	else
	test -d ./-p && rmdir ./-p
	as_mkdir_p=false
	fi

	as_test_x='test -x'
	as_executable_p=as_fn_executable_p

	# Sed expression to map a string onto a valid CPP name.
	as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'"

	# Sed expression to map a string onto a valid variable name.
	as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'"

	SHELL=${CONFIG_SHELL-/bin/sh}


	test -n "$DJDIR" \|\| exec 7<&0 </dev/null
	exec 6>&1

	# Name of the host.
	# hostname on some systems (SVR3.2, old GNU/Linux) returns a bogus exit status,
	# so uname gets run too.
	ac_hostname=`(hostname \|\| uname -n) 2>/dev/null \| sed 1q`

	#
	# Initializations.
	#
	ac_default_prefix=/usr/local
	ac_clean_files=
	ac_config_libobj_dir=.
	LIBOBJS=
	cross_compiling=no
	subdirs=
	MFLAGS=
	MAKEFLAGS=

	# Identity of this package.
	PACKAGE_NAME='unbound'
	PACKAGE_TARNAME='unbound'
	-PACKAGE_VERSION='1.8.1'
	-PACKAGE_STRING='unbound 1.8.1'
	+PACKAGE_VERSION='1.9.2'
	+PACKAGE_STRING='unbound 1.9.2'
	PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'
	PACKAGE_URL=''

	# Factoring default headers for most tests.
	ac_includes_default="\
	#include <stdio.h>
	#ifdef HAVE_SYS_TYPES_H
	# include <sys/types.h>
	#endif
	#ifdef HAVE_SYS_STAT_H
	# include <sys/stat.h>
	#endif
	#ifdef STDC_HEADERS
	# include <stdlib.h>
	# include <stddef.h>
	#else
	# ifdef HAVE_STDLIB_H
	# include <stdlib.h>
	# endif
	#endif
	#ifdef HAVE_STRING_H
	# if !defined STDC_HEADERS && defined HAVE_MEMORY_H
	# include <memory.h>
	# endif
	# include <string.h>
	#endif
	#ifdef HAVE_STRINGS_H
	# include <strings.h>
	#endif
	#ifdef HAVE_INTTYPES_H
	# include <inttypes.h>
	#endif
	#ifdef HAVE_STDINT_H
	# include <stdint.h>
	#endif
	#ifdef HAVE_UNISTD_H
	# include <unistd.h>
	#endif"

	ac_subst_vars='LTLIBOBJS
	date
	version
	INSTALLTARGET
	ALLTARGET
	SOURCEFILE
	SOURCEDETERMINE
	IPSECMOD_HEADER
	IPSECMOD_OBJ
	DNSCRYPT_OBJ
	DNSCRYPT_SRC
	ENABLE_DNSCRYPT
	ENABLE_DNSCRYPT_XCHACHA20
	DNSTAP_OBJ
	DNSTAP_SRC
	opt_dnstap_socket_path
	ENABLE_DNSTAP
	PROTOC_C
	UBSYMS
	EXTRALINK
	COMMON_OBJ_ALL_SYMBOLS
	LIBOBJ_WITHOUT_CTIME
	LIBOBJ_WITHOUT_CTIMEARC4
	WIN_CHECKCONF_OBJ_LINK
	WIN_CONTROL_OBJ_LINK
	WIN_UBANCHOR_OBJ_LINK
	WIN_HOST_OBJ_LINK
	WIN_DAEMON_OBJ_LINK
	WIN_DAEMON_OBJ
	WIN_DAEMON_SRC
	WINAPPS
	WINDRES
	CHECKLOCK_OBJ
	USE_SYSTEMD_FALSE
	USE_SYSTEMD_TRUE
	SYSTEMD_DAEMON_LIBS
	SYSTEMD_DAEMON_CFLAGS
	SYSTEMD_LIBS
	SYSTEMD_CFLAGS
	staticexe
	PC_LIBEVENT_DEPENDENCY
	UNBOUND_EVENT_UNINSTALL
	UNBOUND_EVENT_INSTALL
	SUBNET_HEADER
	SUBNET_OBJ
	SSLLIB
	HAVE_SSL
	CONFIG_DATE
	NETBSD_LINTFLAGS
	PYUNBOUND_UNINSTALL
	PYUNBOUND_INSTALL
	PYUNBOUND_TARGET
	PYUNBOUND_OBJ
	WITH_PYUNBOUND
	PYTHONMOD_UNINSTALL
	PYTHONMOD_INSTALL
	PYTHONMOD_HEADER
	PYTHONMOD_OBJ
	WITH_PYTHONMODULE
	swig
	SWIG_LIB
	SWIG
	PC_PY_DEPENDENCY
	-PKG_CONFIG_LIBDIR
	-PKG_CONFIG_PATH
	-PKG_CONFIG
	PY_MAJOR_VERSION
	PYTHON_SITE_PKG
	PYTHON_LDFLAGS
	PYTHON_CPPFLAGS
	PYTHON
	PYTHON_VERSION
	PTHREAD_CFLAGS_ONLY
	PTHREAD_CFLAGS
	PTHREAD_LIBS
	PTHREAD_CC
	ax_pthread_config
	RUNTIME_PATH
	LIBOBJS
	+PKG_CONFIG_LIBDIR
	+PKG_CONFIG_PATH
	+PKG_CONFIG
	LT_SYS_LIBRARY_PATH
	OTOOL64
	OTOOL
	LIPO
	NMEDIT
	DSYMUTIL
	MANIFEST_TOOL
	AWK
	RANLIB
	ac_ct_AR
	DLLTOOL
	OBJDUMP
	LN_S
	NM
	ac_ct_DUMPBIN
	DUMPBIN
	LD
	FGREP
	SED
	LIBTOOL
	AR
	host_os
	host_vendor
	host_cpu
	host
	build_os
	build_vendor
	build_cpu
	build
	libtool
	STRIP
	doxygen
	YFLAGS
	YACC
	LEXLIB
	LEX_OUTPUT_ROOT
	LEX
	debug_enabled
	DEPFLAG
	UNBOUND_USERNAME
	UNBOUND_ROOTCERT_FILE
	UNBOUND_ROOTKEY_FILE
	UNBOUND_PIDFILE
	UNBOUND_SHARE_DIR
	UNBOUND_CHROOT_DIR
	UNBOUND_RUN_DIR
	ub_conf_dir
	ub_conf_file
	UNBOUND_LOCALSTATE_DIR
	UNBOUND_SYSCONF_DIR
	UNBOUND_SBIN_DIR
	EGREP
	GREP
	CPP
	OBJEXT
	EXEEXT
	ac_ct_CC
	CPPFLAGS
	LDFLAGS
	CFLAGS
	CC
	LIBUNBOUND_AGE
	LIBUNBOUND_REVISION
	LIBUNBOUND_CURRENT
	UNBOUND_VERSION_MICRO
	UNBOUND_VERSION_MINOR
	UNBOUND_VERSION_MAJOR
	target_alias
	host_alias
	build_alias
	LIBS
	ECHO_T
	ECHO_N
	ECHO_C
	DEFS
	mandir
	localedir
	libdir
	psdir
	pdfdir
	dvidir
	htmldir
	infodir
	docdir
	oldincludedir
	includedir
	localstatedir
	sharedstatedir
	sysconfdir
	datadir
	datarootdir
	libexecdir
	sbindir
	bindir
	program_transform_name
	prefix
	exec_prefix
	PACKAGE_URL
	PACKAGE_BUGREPORT
	PACKAGE_STRING
	PACKAGE_VERSION
	PACKAGE_TARNAME
	PACKAGE_NAME
	PATH_SEPARATOR
	SHELL'
	ac_subst_files=''
	ac_user_opts='
	enable_option_checking
	with_conf_file
	with_run_dir
	with_chroot_dir
	with_share_dir
	with_pidfile
	with_rootkey_file
	with_rootcert_file
	with_username
	enable_checking
	enable_debug
	enable_flto
	enable_pie
	enable_relro_now
	enable_shared
	enable_static
	with_pic
	enable_fast_install
	with_aix_soname
	with_gnu_ld
	with_sysroot
	enable_libtool_lock
	enable_rpath
	enable_largefile
	enable_alloc_checks
	enable_alloc_lite
	enable_alloc_nonregional
	with_pthreads
	with_solaris_threads
	with_pyunbound
	with_pythonmodule
	enable_swig_version_check
	with_nss
	with_nettle
	with_ssl
	enable_sha1
	enable_sha2
	enable_subnet
	enable_gost
	enable_ecdsa
	enable_dsa
	enable_ed25519
	enable_ed448
	enable_event_api
	enable_tfo_client
	enable_tfo_server
	with_libevent
	with_libexpat
	with_libhiredis
	enable_static_exe
	enable_systemd
	enable_lock_checks
	enable_allsymbols
	enable_dnstap
	with_dnstap_socket_path
	with_protobuf_c
	with_libfstrm
	enable_dnscrypt
	with_libsodium
	enable_cachedb
	enable_ipsecmod
	with_libunbound_only
	'
	ac_precious_vars='build_alias
	host_alias
	target_alias
	CC
	CFLAGS
	LDFLAGS
	LIBS
	CPPFLAGS
	CPP
	YACC
	YFLAGS
	LT_SYS_LIBRARY_PATH
	-PYTHON_VERSION
	PKG_CONFIG
	PKG_CONFIG_PATH
	PKG_CONFIG_LIBDIR
	+PYTHON_VERSION
	SYSTEMD_CFLAGS
	SYSTEMD_LIBS
	SYSTEMD_DAEMON_CFLAGS
	SYSTEMD_DAEMON_LIBS'


	# Initialize some variables set by options.
	ac_init_help=
	ac_init_version=false
	ac_unrecognized_opts=
	ac_unrecognized_sep=
	# The variables have the same names as the options, with
	# dashes changed to underlines.
	cache_file=/dev/null
	exec_prefix=NONE
	no_create=
	no_recursion=
	prefix=NONE
	program_prefix=NONE
	program_suffix=NONE
	program_transform_name=s,x,x,
	silent=
	site=
	srcdir=
	verbose=
	x_includes=NONE
	x_libraries=NONE

	# Installation directory options.
	# These are left unexpanded so users can "make install exec_prefix=/foo"
	# and all the variables that are supposed to be based on exec_prefix
	# by default will actually change.
	# Use braces instead of parens because sh, perl, etc. also accept them.
	# (The list follows the same order as the GNU Coding Standards.)
	bindir='${exec_prefix}/bin'
	sbindir='${exec_prefix}/sbin'
	libexecdir='${exec_prefix}/libexec'
	datarootdir='${prefix}/share'
	datadir='${datarootdir}'
	sysconfdir='${prefix}/etc'
	sharedstatedir='${prefix}/com'
	localstatedir='${prefix}/var'
	includedir='${prefix}/include'
	oldincludedir='/usr/include'
	docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
	infodir='${datarootdir}/info'
	htmldir='${docdir}'
	dvidir='${docdir}'
	pdfdir='${docdir}'
	psdir='${docdir}'
	libdir='${exec_prefix}/lib'
	localedir='${datarootdir}/locale'
	mandir='${datarootdir}/man'

	ac_prev=
	ac_dashdash=
	for ac_option
	do
	# If the previous option needs an argument, assign it.
	if test -n "$ac_prev"; then
	eval $ac_prev=\$ac_option
	ac_prev=
	continue
	fi

	case $ac_option in
	=?) ac_optarg=`expr "X$ac_option" : '[^=]=$.$'` ;;
	*=) ac_optarg= ;;
	*) ac_optarg=yes ;;
	esac

	# Accept the important Cygnus configure options, so we can diagnose typos.

	case $ac_dashdash$ac_option in
	--)
	ac_dashdash=yes ;;

	-bindir \| --bindir \| --bindi \| --bind \| --bin \| --bi)
	ac_prev=bindir ;;
	-bindir=* \| --bindir=* \| --bindi=* \| --bind=* \| --bin=* \| --bi=*)
	bindir=$ac_optarg ;;

	-build \| --build \| --buil \| --bui \| --bu)
	ac_prev=build_alias ;;
	-build=* \| --build=* \| --buil=* \| --bui=* \| --bu=*)
	build_alias=$ac_optarg ;;

	-cache-file \| --cache-file \| --cache-fil \| --cache-fi \
	\| --cache-f \| --cache- \| --cache \| --cach \| --cac \| --ca \| --c)
	ac_prev=cache_file ;;
	-cache-file=* \| --cache-file=* \| --cache-fil=* \| --cache-fi=* \
	\| --cache-f=* \| --cache-=* \| --cache=* \| --cach=* \| --cac=* \| --ca=* \| --c=*)
	cache_file=$ac_optarg ;;

	--config-cache \| -C)
	cache_file=config.cache ;;

	-datadir \| --datadir \| --datadi \| --datad)
	ac_prev=datadir ;;
	-datadir=* \| --datadir=* \| --datadi=* \| --datad=*)
	datadir=$ac_optarg ;;

	-datarootdir \| --datarootdir \| --datarootdi \| --datarootd \| --dataroot \
	\| --dataroo \| --dataro \| --datar)
	ac_prev=datarootdir ;;
	-datarootdir=* \| --datarootdir=* \| --datarootdi=* \| --datarootd=* \
	\| --dataroot=* \| --dataroo=* \| --dataro=* \| --datar=*)
	datarootdir=$ac_optarg ;;

	-disable-* \| --disable-*)
	ac_useropt=`expr "x$ac_option" : 'x-disable-$.$'`
	# Reject names that are not valid shell variable names.
	expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
	as_fn_error $? "invalid feature name: $ac_useropt"
	ac_useropt_orig=$ac_useropt
	ac_useropt=`$as_echo "$ac_useropt" \| sed 's/[-+.]/_/g'`
	case $ac_user_opts in
	*"
	"enable_$ac_useropt"
	"*) ;;
	*) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--disable-$ac_useropt_orig"
	ac_unrecognized_sep=', ';;
	esac
	eval enable_$ac_useropt=no ;;

	-docdir \| --docdir \| --docdi \| --doc \| --do)
	ac_prev=docdir ;;
	-docdir=* \| --docdir=* \| --docdi=* \| --doc=* \| --do=*)
	docdir=$ac_optarg ;;

	-dvidir \| --dvidir \| --dvidi \| --dvid \| --dvi \| --dv)
	ac_prev=dvidir ;;
	-dvidir=* \| --dvidir=* \| --dvidi=* \| --dvid=* \| --dvi=* \| --dv=*)
	dvidir=$ac_optarg ;;

	-enable-* \| --enable-*)
	ac_useropt=`expr "x$ac_option" : 'x-enable-$[^=]$'`
	# Reject names that are not valid shell variable names.
	expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
	as_fn_error $? "invalid feature name: $ac_useropt"
	ac_useropt_orig=$ac_useropt
	ac_useropt=`$as_echo "$ac_useropt" \| sed 's/[-+.]/_/g'`
	case $ac_user_opts in
	*"
	"enable_$ac_useropt"
	"*) ;;
	*) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--enable-$ac_useropt_orig"
	ac_unrecognized_sep=', ';;
	esac
	eval enable_$ac_useropt=\$ac_optarg ;;

	-exec-prefix \| --exec_prefix \| --exec-prefix \| --exec-prefi \
	\| --exec-pref \| --exec-pre \| --exec-pr \| --exec-p \| --exec- \
	\| --exec \| --exe \| --ex)
	ac_prev=exec_prefix ;;
	-exec-prefix=* \| --exec_prefix=* \| --exec-prefix=* \| --exec-prefi=* \
	\| --exec-pref=* \| --exec-pre=* \| --exec-pr=* \| --exec-p=* \| --exec-=* \
	\| --exec=* \| --exe=* \| --ex=*)
	exec_prefix=$ac_optarg ;;

	-gas \| --gas \| --ga \| --g)
	# Obsolete; use --with-gas.
	with_gas=yes ;;

	-help \| --help \| --hel \| --he \| -h)
	ac_init_help=long ;;
	-help=r* \| --help=r* \| --hel=r* \| --he=r* \| -hr*)
	ac_init_help=recursive ;;
	-help=s* \| --help=s* \| --hel=s* \| --he=s* \| -hs*)
	ac_init_help=short ;;

	-host \| --host \| --hos \| --ho)
	ac_prev=host_alias ;;
	-host=* \| --host=* \| --hos=* \| --ho=*)
	host_alias=$ac_optarg ;;

	-htmldir \| --htmldir \| --htmldi \| --htmld \| --html \| --htm \| --ht)
	ac_prev=htmldir ;;
	-htmldir=* \| --htmldir=* \| --htmldi=* \| --htmld=* \| --html=* \| --htm=* \
	\| --ht=*)
	htmldir=$ac_optarg ;;

	-includedir \| --includedir \| --includedi \| --included \| --include \
	\| --includ \| --inclu \| --incl \| --inc)
	ac_prev=includedir ;;
	-includedir=* \| --includedir=* \| --includedi=* \| --included=* \| --include=* \
	\| --includ=* \| --inclu=* \| --incl=* \| --inc=*)
	includedir=$ac_optarg ;;

	-infodir \| --infodir \| --infodi \| --infod \| --info \| --inf)
	ac_prev=infodir ;;
	-infodir=* \| --infodir=* \| --infodi=* \| --infod=* \| --info=* \| --inf=*)
	infodir=$ac_optarg ;;

	-libdir \| --libdir \| --libdi \| --libd)
	ac_prev=libdir ;;
	-libdir=* \| --libdir=* \| --libdi=* \| --libd=*)
	libdir=$ac_optarg ;;

	-libexecdir \| --libexecdir \| --libexecdi \| --libexecd \| --libexec \
	\| --libexe \| --libex \| --libe)
	ac_prev=libexecdir ;;
	-libexecdir=* \| --libexecdir=* \| --libexecdi=* \| --libexecd=* \| --libexec=* \
	\| --libexe=* \| --libex=* \| --libe=*)
	libexecdir=$ac_optarg ;;

	-localedir \| --localedir \| --localedi \| --localed \| --locale)
	ac_prev=localedir ;;
	-localedir=* \| --localedir=* \| --localedi=* \| --localed=* \| --locale=*)
	localedir=$ac_optarg ;;

	-localstatedir \| --localstatedir \| --localstatedi \| --localstated \
	\| --localstate \| --localstat \| --localsta \| --localst \| --locals)
	ac_prev=localstatedir ;;
	-localstatedir=* \| --localstatedir=* \| --localstatedi=* \| --localstated=* \
	\| --localstate=* \| --localstat=* \| --localsta=* \| --localst=* \| --locals=*)
	localstatedir=$ac_optarg ;;

	-mandir \| --mandir \| --mandi \| --mand \| --man \| --ma \| --m)
	ac_prev=mandir ;;
	-mandir=* \| --mandir=* \| --mandi=* \| --mand=* \| --man=* \| --ma=* \| --m=*)
	mandir=$ac_optarg ;;

	-nfp \| --nfp \| --nf)
	# Obsolete; use --without-fp.
	with_fp=no ;;

	-no-create \| --no-create \| --no-creat \| --no-crea \| --no-cre \
	\| --no-cr \| --no-c \| -n)
	no_create=yes ;;

	-no-recursion \| --no-recursion \| --no-recursio \| --no-recursi \
	\| --no-recurs \| --no-recur \| --no-recu \| --no-rec \| --no-re \| --no-r)
	no_recursion=yes ;;

	-oldincludedir \| --oldincludedir \| --oldincludedi \| --oldincluded \
	\| --oldinclude \| --oldinclud \| --oldinclu \| --oldincl \| --oldinc \
	\| --oldin \| --oldi \| --old \| --ol \| --o)
	ac_prev=oldincludedir ;;
	-oldincludedir=* \| --oldincludedir=* \| --oldincludedi=* \| --oldincluded=* \
	\| --oldinclude=* \| --oldinclud=* \| --oldinclu=* \| --oldincl=* \| --oldinc=* \
	\| --oldin=* \| --oldi=* \| --old=* \| --ol=* \| --o=*)
	oldincludedir=$ac_optarg ;;

	-prefix \| --prefix \| --prefi \| --pref \| --pre \| --pr \| --p)
	ac_prev=prefix ;;
	-prefix=* \| --prefix=* \| --prefi=* \| --pref=* \| --pre=* \| --pr=* \| --p=*)
	prefix=$ac_optarg ;;

	-program-prefix \| --program-prefix \| --program-prefi \| --program-pref \
	\| --program-pre \| --program-pr \| --program-p)
	ac_prev=program_prefix ;;
	-program-prefix=* \| --program-prefix=* \| --program-prefi=* \
	\| --program-pref=* \| --program-pre=* \| --program-pr=* \| --program-p=*)
	program_prefix=$ac_optarg ;;

	-program-suffix \| --program-suffix \| --program-suffi \| --program-suff \
	\| --program-suf \| --program-su \| --program-s)
	ac_prev=program_suffix ;;
	-program-suffix=* \| --program-suffix=* \| --program-suffi=* \
	\| --program-suff=* \| --program-suf=* \| --program-su=* \| --program-s=*)
	program_suffix=$ac_optarg ;;

	-program-transform-name \| --program-transform-name \
	\| --program-transform-nam \| --program-transform-na \
	\| --program-transform-n \| --program-transform- \
	\| --program-transform \| --program-transfor \
	\| --program-transfo \| --program-transf \
	\| --program-trans \| --program-tran \
	\| --progr-tra \| --program-tr \| --program-t)
	ac_prev=program_transform_name ;;
	-program-transform-name=* \| --program-transform-name=* \
	\| --program-transform-nam=* \| --program-transform-na=* \
	\| --program-transform-n=* \| --program-transform-=* \
	\| --program-transform=* \| --program-transfor=* \
	\| --program-transfo=* \| --program-transf=* \
	\| --program-trans=* \| --program-tran=* \
	\| --progr-tra=* \| --program-tr=* \| --program-t=*)
	program_transform_name=$ac_optarg ;;

	-pdfdir \| --pdfdir \| --pdfdi \| --pdfd \| --pdf \| --pd)
	ac_prev=pdfdir ;;
	-pdfdir=* \| --pdfdir=* \| --pdfdi=* \| --pdfd=* \| --pdf=* \| --pd=*)
	pdfdir=$ac_optarg ;;

	-psdir \| --psdir \| --psdi \| --psd \| --ps)
	ac_prev=psdir ;;
	-psdir=* \| --psdir=* \| --psdi=* \| --psd=* \| --ps=*)
	psdir=$ac_optarg ;;

	-q \| -quiet \| --quiet \| --quie \| --qui \| --qu \| --q \
	\| -silent \| --silent \| --silen \| --sile \| --sil)
	silent=yes ;;

	-sbindir \| --sbindir \| --sbindi \| --sbind \| --sbin \| --sbi \| --sb)
	ac_prev=sbindir ;;
	-sbindir=* \| --sbindir=* \| --sbindi=* \| --sbind=* \| --sbin=* \
	\| --sbi=* \| --sb=*)
	sbindir=$ac_optarg ;;

	-sharedstatedir \| --sharedstatedir \| --sharedstatedi \
	\| --sharedstated \| --sharedstate \| --sharedstat \| --sharedsta \
	\| --sharedst \| --shareds \| --shared \| --share \| --shar \
	\| --sha \| --sh)
	ac_prev=sharedstatedir ;;
	-sharedstatedir=* \| --sharedstatedir=* \| --sharedstatedi=* \
	\| --sharedstated=* \| --sharedstate=* \| --sharedstat=* \| --sharedsta=* \
	\| --sharedst=* \| --shareds=* \| --shared=* \| --share=* \| --shar=* \
	\| --sha=* \| --sh=*)
	sharedstatedir=$ac_optarg ;;

	-site \| --site \| --sit)
	ac_prev=site ;;
	-site=* \| --site=* \| --sit=*)
	site=$ac_optarg ;;

	-srcdir \| --srcdir \| --srcdi \| --srcd \| --src \| --sr)
	ac_prev=srcdir ;;
	-srcdir=* \| --srcdir=* \| --srcdi=* \| --srcd=* \| --src=* \| --sr=*)
	srcdir=$ac_optarg ;;

	-sysconfdir \| --sysconfdir \| --sysconfdi \| --sysconfd \| --sysconf \
	\| --syscon \| --sysco \| --sysc \| --sys \| --sy)
	ac_prev=sysconfdir ;;
	-sysconfdir=* \| --sysconfdir=* \| --sysconfdi=* \| --sysconfd=* \| --sysconf=* \
	\| --syscon=* \| --sysco=* \| --sysc=* \| --sys=* \| --sy=*)
	sysconfdir=$ac_optarg ;;

	-target \| --target \| --targe \| --targ \| --tar \| --ta \| --t)
	ac_prev=target_alias ;;
	-target=* \| --target=* \| --targe=* \| --targ=* \| --tar=* \| --ta=* \| --t=*)
	target_alias=$ac_optarg ;;

	-v \| -verbose \| --verbose \| --verbos \| --verbo \| --verb)
	verbose=yes ;;

	-version \| --version \| --versio \| --versi \| --vers \| -V)
	ac_init_version=: ;;

	-with-* \| --with-*)
	ac_useropt=`expr "x$ac_option" : 'x-with-$[^=]$'`
	# Reject names that are not valid shell variable names.
	expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
	as_fn_error $? "invalid package name: $ac_useropt"
	ac_useropt_orig=$ac_useropt
	ac_useropt=`$as_echo "$ac_useropt" \| sed 's/[-+.]/_/g'`
	case $ac_user_opts in
	*"
	"with_$ac_useropt"
	"*) ;;
	*) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--with-$ac_useropt_orig"
	ac_unrecognized_sep=', ';;
	esac
	eval with_$ac_useropt=\$ac_optarg ;;

	-without-* \| --without-*)
	ac_useropt=`expr "x$ac_option" : 'x-without-$.$'`
	# Reject names that are not valid shell variable names.
	expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
	as_fn_error $? "invalid package name: $ac_useropt"
	ac_useropt_orig=$ac_useropt
	ac_useropt=`$as_echo "$ac_useropt" \| sed 's/[-+.]/_/g'`
	case $ac_user_opts in
	*"
	"with_$ac_useropt"
	"*) ;;
	*) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--without-$ac_useropt_orig"
	ac_unrecognized_sep=', ';;
	esac
	eval with_$ac_useropt=no ;;

	--x)
	# Obsolete; use --with-x.
	with_x=yes ;;

	-x-includes \| --x-includes \| --x-include \| --x-includ \| --x-inclu \
	\| --x-incl \| --x-inc \| --x-in \| --x-i)
	ac_prev=x_includes ;;
	-x-includes=* \| --x-includes=* \| --x-include=* \| --x-includ=* \| --x-inclu=* \
	\| --x-incl=* \| --x-inc=* \| --x-in=* \| --x-i=*)
	x_includes=$ac_optarg ;;

	-x-libraries \| --x-libraries \| --x-librarie \| --x-librari \
	\| --x-librar \| --x-libra \| --x-libr \| --x-lib \| --x-li \| --x-l)
	ac_prev=x_libraries ;;
	-x-libraries=* \| --x-libraries=* \| --x-librarie=* \| --x-librari=* \
	\| --x-librar=* \| --x-libra=* \| --x-libr=* \| --x-lib=* \| --x-li=* \| --x-l=*)
	x_libraries=$ac_optarg ;;

	-*) as_fn_error $? "unrecognized option: \`$ac_option'
	Try \`$0 --help' for more information"
	;;

	=)
	ac_envvar=`expr "x$ac_option" : 'x$[^=]*$='`
	# Reject names that are not valid shell variable names.
	case $ac_envvar in #(
	'' \| [0-9]* \| [!_$as_cr_alnum] )
	as_fn_error $? "invalid variable name: \`$ac_envvar'" ;;
	esac
	eval $ac_envvar=\$ac_optarg
	export $ac_envvar ;;

	*)
	# FIXME: should be removed in autoconf 3.0.
	$as_echo "$as_me: WARNING: you should use --build, --host, --target" >&2
	expr "x$ac_option" : ".*[^-._$as_cr_alnum]" >/dev/null &&
	$as_echo "$as_me: WARNING: invalid host type: $ac_option" >&2
	: "${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option}"
	;;

	esac
	done

	if test -n "$ac_prev"; then
	ac_option=--`echo $ac_prev \| sed 's/_/-/g'`
	as_fn_error $? "missing argument to $ac_option"
	fi

	if test -n "$ac_unrecognized_opts"; then
	case $enable_option_checking in
	no) ;;
	fatal) as_fn_error $? "unrecognized options: $ac_unrecognized_opts" ;;
	*) $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2 ;;
	esac
	fi

	# Check all directory arguments for consistency.
	for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \
	datadir sysconfdir sharedstatedir localstatedir includedir \
	oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
	libdir localedir mandir
	do
	eval ac_val=\$$ac_var
	# Remove trailing slashes.
	case $ac_val in
	*/ )
	ac_val=`expr "X$ac_val" : 'X$.[^/]$' \\| "X$ac_val" : 'X$.$'`
	eval $ac_var=\$ac_val;;
	esac
	# Be sure to have absolute directory names.
	case $ac_val in
	[\\/$]* \| ?:[\\/]* ) continue;;
	NONE \| '' ) case $ac_var in *prefix ) continue;; esac;;
	esac
	as_fn_error $? "expected an absolute directory name for --$ac_var: $ac_val"
	done

	# There might be people who depend on the old broken behavior: `$host'
	# used to hold the argument of --host etc.
	# FIXME: To remove some day.
	build=$build_alias
	host=$host_alias
	target=$target_alias

	# FIXME: To remove some day.
	if test "x$host_alias" != x; then
	if test "x$build_alias" = x; then
	cross_compiling=maybe
	elif test "x$build_alias" != "x$host_alias"; then
	cross_compiling=yes
	fi
	fi

	ac_tool_prefix=
	test -n "$host_alias" && ac_tool_prefix=$host_alias-

	test "$silent" = yes && exec 6>/dev/null


	ac_pwd=`pwd` && test -n "$ac_pwd" &&
	ac_ls_di=`ls -di .` &&
	ac_pwd_ls_di=`cd "$ac_pwd" && ls -di .` \|\|
	as_fn_error $? "working directory cannot be determined"
	test "X$ac_ls_di" = "X$ac_pwd_ls_di" \|\|
	as_fn_error $? "pwd does not report name of working directory"


	# Find the source files, if location was not specified.
	if test -z "$srcdir"; then
	ac_srcdir_defaulted=yes
	# Try the directory containing this script, then the parent directory.
	ac_confdir=`$as_dirname -- "$as_myself" \|\|
	$as_expr X"$as_myself" : 'X$.[^/]$//[^/][^/]/$' \\| \
	X"$as_myself" : 'X$//$[^/]' \\| \
	X"$as_myself" : 'X$//$$' \\| \
	X"$as_myself" : 'X$/$' \\| . 2>/dev/null \|\|
	$as_echo X"$as_myself" \|
	sed '/^X$.[^/]$\/\/[^/][^/]\/$/{
	s//\1/
	q
	}
	/^X$\/\/$[^/].*/{
	s//\1/
	q
	}
	/^X$\/\/$$/{
	s//\1/
	q
	}
	/^X$\/$.*/{
	s//\1/
	q
	}
	s/.*/./; q'`
	srcdir=$ac_confdir
	if test ! -r "$srcdir/$ac_unique_file"; then
	srcdir=..
	fi
	else
	ac_srcdir_defaulted=no
	fi
	if test ! -r "$srcdir/$ac_unique_file"; then
	test "$ac_srcdir_defaulted" = yes && srcdir="$ac_confdir or .."
	as_fn_error $? "cannot find sources ($ac_unique_file) in $srcdir"
	fi
	ac_msg="sources are in $srcdir, but \`cd $srcdir' does not work"
	ac_abs_confdir=`(
	cd "$srcdir" && test -r "./$ac_unique_file" \|\| as_fn_error $? "$ac_msg"
	pwd)`
	# When building in place, set srcdir=.
	if test "$ac_abs_confdir" = "$ac_pwd"; then
	srcdir=.
	fi
	# Remove unnecessary trailing slashes from srcdir.
	# Double slashes in file names in object file debugging info
	# mess up M-x gdb in Emacs.
	case $srcdir in
	/) srcdir=`expr "X$srcdir" : 'X$.[^/]$' \\| "X$srcdir" : 'X$.*$'`;;
	esac
	for ac_var in $ac_precious_vars; do
	eval ac_env_${ac_var}_set=\${${ac_var}+set}
	eval ac_env_${ac_var}_value=\$${ac_var}
	eval ac_cv_env_${ac_var}_set=\${${ac_var}+set}
	eval ac_cv_env_${ac_var}_value=\$${ac_var}
	done

	#
	# Report the --help message.
	#
	if test "$ac_init_help" = "long"; then
	# Omit some internal or obsolete options to make the list less imposing.
	# This message is too long to be a string in the A/UX 3.1 sh.
	cat <<_ACEOF
	-\`configure' configures unbound 1.8.1 to adapt to many kinds of systems.
	+\`configure' configures unbound 1.9.2 to adapt to many kinds of systems.

	Usage: $0 [OPTION]... [VAR=VALUE]...

	To assign environment variables (e.g., CC, CFLAGS...), specify them as
	VAR=VALUE. See below for descriptions of some of the useful variables.

	Defaults for the options are specified in brackets.

	Configuration:
	-h, --help display this help and exit
	--help=short display options specific to this package
	--help=recursive display the short help of all the included packages
	-V, --version display version information and exit
	-q, --quiet, --silent do not print \`checking ...' messages
	--cache-file=FILE cache test results in FILE [disabled]
	-C, --config-cache alias for \`--cache-file=config.cache'
	-n, --no-create do not create output files
	--srcdir=DIR find the sources in DIR [configure dir or \`..']

	Installation directories:
	--prefix=PREFIX install architecture-independent files in PREFIX
	[$ac_default_prefix]
	--exec-prefix=EPREFIX install architecture-dependent files in EPREFIX
	[PREFIX]

	By default, \`make install' will install all the files in
	\`$ac_default_prefix/bin', \`$ac_default_prefix/lib' etc. You can specify
	an installation prefix other than \`$ac_default_prefix' using \`--prefix',
	for instance \`--prefix=\$HOME'.

	For better control, use the options below.

	Fine tuning of the installation directories:
	--bindir=DIR user executables [EPREFIX/bin]
	--sbindir=DIR system admin executables [EPREFIX/sbin]
	--libexecdir=DIR program executables [EPREFIX/libexec]
	--sysconfdir=DIR read-only single-machine data [PREFIX/etc]
	--sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com]
	--localstatedir=DIR modifiable single-machine data [PREFIX/var]
	--libdir=DIR object code libraries [EPREFIX/lib]
	--includedir=DIR C header files [PREFIX/include]
	--oldincludedir=DIR C header files for non-gcc [/usr/include]
	--datarootdir=DIR read-only arch.-independent data root [PREFIX/share]
	--datadir=DIR read-only architecture-independent data [DATAROOTDIR]
	--infodir=DIR info documentation [DATAROOTDIR/info]
	--localedir=DIR locale-dependent data [DATAROOTDIR/locale]
	--mandir=DIR man documentation [DATAROOTDIR/man]
	--docdir=DIR documentation root [DATAROOTDIR/doc/unbound]
	--htmldir=DIR html documentation [DOCDIR]
	--dvidir=DIR dvi documentation [DOCDIR]
	--pdfdir=DIR pdf documentation [DOCDIR]
	--psdir=DIR ps documentation [DOCDIR]
	_ACEOF

	cat <<\_ACEOF

	System types:
	--build=BUILD configure for building on BUILD [guessed]
	--host=HOST cross-compile to build programs to run on HOST [BUILD]
	_ACEOF
	fi

	if test -n "$ac_init_help"; then
	case $ac_init_help in
	- short \| recursive ) echo "Configuration of unbound 1.8.1:";;
	+ short \| recursive ) echo "Configuration of unbound 1.9.2:";;
	esac
	cat <<\_ACEOF

	Optional Features:
	--disable-option-checking ignore unrecognized --enable/--with options
	--disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no)
	--enable-FEATURE[=ARG] include FEATURE [ARG=yes]
	--enable-checking Enable warnings, asserts, makefile-dependencies
	--enable-debug same as enable-checking
	--disable-flto Disable link-time optimization (gcc specific option)
	--enable-pie Enable Position-Independent Executable (eg. to fully
	benefit from ASLR, small performance penalty)
	--enable-relro-now Enable full relocation binding at load-time (RELRO
	NOW, to protect GOT and .dtor areas)
	--enable-shared[=PKGS] build shared libraries [default=yes]
	--enable-static[=PKGS] build static libraries [default=yes]
	--enable-fast-install[=PKGS]
	optimize for fast installation [default=yes]
	--disable-libtool-lock avoid locking (might break parallel builds)
	--disable-rpath disable hardcoded rpath (default=enabled)
	--disable-largefile omit support for large files
	--enable-alloc-checks enable to memory allocation statistics, for debug
	purposes
	--enable-alloc-lite enable for lightweight alloc assertions, for debug
	purposes
	--enable-alloc-nonregional
	enable nonregional allocs, slow but exposes regional
	allocations to other memory purifiers, for debug
	purposes
	--disable-swig-version-check
	Disable swig version check to build python modules
	with older swig even though that is unreliable
	--disable-sha1 Disable SHA1 RRSIG support, does not disable nsec3
	support
	--disable-sha2 Disable SHA256 and SHA512 RRSIG support
	--enable-subnet Enable client subnet
	--disable-gost Disable GOST support
	--disable-ecdsa Disable ECDSA support
	--disable-dsa Disable DSA support
	--disable-ed25519 Disable ED25519 support
	--disable-ed448 Disable ED448 support
	--enable-event-api Enable (experimental) pluggable event base
	libunbound API installed to unbound-event.h
	--enable-tfo-client Enable TCP Fast Open for client mode
	--enable-tfo-server Enable TCP Fast Open for server mode
	--enable-static-exe enable to compile executables statically against
	(event) libs, for debug purposes
	--enable-systemd compile with systemd support
	--enable-lock-checks enable to check lock and unlock calls, for debug
	purposes
	--enable-allsymbols export all symbols from libunbound and link binaries
	to it, smaller install size but libunbound export
	table is polluted by internal symbols
	--enable-dnstap Enable dnstap support (requires fstrm, protobuf-c)
	--enable-dnscrypt Enable dnscrypt support (requires libsodium)
	--enable-cachedb enable cachedb module that can use external cache
	storage
	--enable-ipsecmod Enable ipsecmod module that facilitates
	opportunistic IPsec

	Optional Packages:
	--with-PACKAGE[=ARG] use PACKAGE [ARG=yes]
	--without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no)
	--with-conf-file=path Pathname to the Unbound configuration file
	--with-run-dir=path set default directory to chdir to (by default dir
	part of cfg file)
	--with-chroot-dir=path set default directory to chroot to (by default same
	as run-dir)
	--with-share-dir=path set default directory with shared data (by default
	same as share/unbound)
	--with-pidfile=filename set default pathname to unbound pidfile (default
	run-dir/unbound.pid)
	--with-rootkey-file=filename
	set default pathname to root key file (default
	run-dir/root.key). This file is read and written.
	--with-rootcert-file=filename
	set default pathname to root update certificate file
	(default run-dir/icannbundle.pem). This file need
	not exist if you are content with the builtin.
	--with-username=user set default user that unbound changes to (default
	user is unbound)
	--with-pic[=PKGS] try to use only PIC/non-PIC objects [default=use
	both]
	--with-aix-soname=aix\|svr4\|both
	shared library versioning (aka "SONAME") variant to
	provide on AIX, [default=aix].
	--with-gnu-ld assume the C compiler uses GNU ld [default=no]
	--with-sysroot[=DIR] Search for dependent libraries within DIR (or the
	compiler's sysroot if not specified).
	--with-pthreads use pthreads library, or --without-pthreads to
	disable threading support.
	--with-solaris-threads use solaris native thread library.
	--with-pyunbound build PyUnbound, or --without-pyunbound to skip it.
	(default=no)
	--with-pythonmodule build Python module, or --without-pythonmodule to
	disable script engine. (default=no)
	--with-nss=path use libnss instead of openssl, installed at path.
	--with-nettle=path use libnettle as crypto library, installed at path.
	--with-ssl=pathname enable SSL (will check /usr/local/ssl /usr/lib/ssl
	/usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw
	/usr)
	--with-libevent=pathname
	use libevent (will check /usr/local /opt/local
	/usr/lib /usr/pkg /usr/sfw /usr or you can specify
	an explicit path). Slower, but allows use of large
	outgoing port ranges.
	--with-libexpat=path specify explicit path for libexpat.
	--with-libhiredis=path specify explicit path for libhiredis.
	--with-dnstap-socket-path=pathname
	set default dnstap socket path
	--with-protobuf-c=path Path where protobuf-c is installed, for dnstap
	--with-libfstrm=path Path where libfstrm is installed, for dnstap
	--with-libsodium=path Path where libsodium is installed, for dnscrypt
	--with-libunbound-only do not build daemon and tool programs

	Some influential environment variables:
	CC C compiler command
	CFLAGS C compiler flags
	LDFLAGS linker flags, e.g. -L<lib dir> if you have libraries in a
	nonstandard directory <lib dir>
	LIBS libraries to pass to the linker, e.g. -l<library>
	CPPFLAGS (Objective) C/C++ preprocessor flags, e.g. -I<include dir> if
	you have headers in a nonstandard directory <include dir>
	CPP C preprocessor
	YACC The `Yet Another Compiler Compiler' implementation to use.
	Defaults to the first program found out of: `bison -y', `byacc',
	`yacc'.
	YFLAGS The list of arguments that will be passed by default to $YACC.
	This script will default YFLAGS to the empty string to avoid a
	default value of `-d' given by some make applications.
	LT_SYS_LIBRARY_PATH
	User-defined run-time library search path.
	- PYTHON_VERSION
	- The installed Python version to use, for example '2.3'. This
	- string will be appended to the Python interpreter canonical
	- name.
	PKG_CONFIG path to pkg-config utility
	PKG_CONFIG_PATH
	directories to add to pkg-config's search path
	PKG_CONFIG_LIBDIR
	path overriding pkg-config's built-in search path
	+ PYTHON_VERSION
	+ The installed Python version to use, for example '2.3'. This
	+ string will be appended to the Python interpreter canonical
	+ name.
	SYSTEMD_CFLAGS
	C compiler flags for SYSTEMD, overriding pkg-config
	SYSTEMD_LIBS
	linker flags for SYSTEMD, overriding pkg-config
	SYSTEMD_DAEMON_CFLAGS
	C compiler flags for SYSTEMD_DAEMON, overriding pkg-config
	SYSTEMD_DAEMON_LIBS
	linker flags for SYSTEMD_DAEMON, overriding pkg-config

	Use these variables to override the choices made by `configure' or to help
	it to find libraries and programs with nonstandard names/locations.

	Report bugs to <unbound-bugs@nlnetlabs.nl>.
	_ACEOF
	ac_status=$?
	fi

	if test "$ac_init_help" = "recursive"; then
	# If there are subdirs, report their specific --help.
	for ac_dir in : $ac_subdirs_all; do test "x$ac_dir" = x: && continue
	test -d "$ac_dir" \|\|
	{ cd "$srcdir" && ac_pwd=`pwd` && srcdir=. && test -d "$ac_dir"; } \|\|
	continue
	ac_builddir=.

	case "$ac_dir" in
	.) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;;
	*)
	ac_dir_suffix=/`$as_echo "$ac_dir" \| sed 's\|^\.[\\/]\|\|'`
	# A ".." for each directory in $ac_dir_suffix.
	ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" \| sed 's\|/[^\\/]*\|/..\|g;s\|/\|\|'`
	case $ac_top_builddir_sub in
	"") ac_top_builddir_sub=. ac_top_build_prefix= ;;
	*) ac_top_build_prefix=$ac_top_builddir_sub/ ;;
	esac ;;
	esac
	ac_abs_top_builddir=$ac_pwd
	ac_abs_builddir=$ac_pwd$ac_dir_suffix
	# for backward compatibility:
	ac_top_builddir=$ac_top_build_prefix

	case $srcdir in
	.) # We are building in place.
	ac_srcdir=.
	ac_top_srcdir=$ac_top_builddir_sub
	ac_abs_top_srcdir=$ac_pwd ;;
	[\\/]* \| ?:[\\/]* ) # Absolute name.
	ac_srcdir=$srcdir$ac_dir_suffix;
	ac_top_srcdir=$srcdir
	ac_abs_top_srcdir=$srcdir ;;
	*) # Relative name.
	ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix
	ac_top_srcdir=$ac_top_build_prefix$srcdir
	ac_abs_top_srcdir=$ac_pwd/$srcdir ;;
	esac
	ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix

	cd "$ac_dir" \|\| { ac_status=$?; continue; }
	# Check for guested configure.
	if test -f "$ac_srcdir/configure.gnu"; then
	echo &&
	$SHELL "$ac_srcdir/configure.gnu" --help=recursive
	elif test -f "$ac_srcdir/configure"; then
	echo &&
	$SHELL "$ac_srcdir/configure" --help=recursive
	else
	$as_echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2
	fi \|\| ac_status=$?
	cd "$ac_pwd" \|\| { ac_status=$?; break; }
	done
	fi

	test -n "$ac_init_help" && exit $ac_status
	if $ac_init_version; then
	cat <<\_ACEOF
	-unbound configure 1.8.1
	+unbound configure 1.9.2
	generated by GNU Autoconf 2.69

	Copyright (C) 2012 Free Software Foundation, Inc.
	This configure script is free software; the Free Software Foundation
	gives unlimited permission to copy, distribute and modify it.
	_ACEOF
	exit
	fi

	## ------------------------ ##
	## Autoconf initialization. ##
	## ------------------------ ##

	# ac_fn_c_try_compile LINENO
	# --------------------------
	# Try to compile conftest.$ac_ext, and return whether this succeeded.
	ac_fn_c_try_compile ()
	{
	as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
	rm -f conftest.$ac_objext
	if { { ac_try="$ac_compile"
	case "(($ac_try" in
	\" \| \` \| \\) ac_try_echo=\$ac_try;;
	*) ac_try_echo=$ac_try;;
	esac
	eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
	$as_echo "$ac_try_echo"; } >&5
	(eval "$ac_compile") 2>conftest.err
	ac_status=$?
	if test -s conftest.err; then
	grep -v '^ *+' conftest.err >conftest.er1
	cat conftest.er1 >&5
	mv -f conftest.er1 conftest.err
	fi
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; } && {
	test -z "$ac_c_werror_flag" \|\|
	test ! -s conftest.err
	} && test -s conftest.$ac_objext; then :
	ac_retval=0
	else
	$as_echo "$as_me: failed program was:" >&5
	sed 's/^/\| /' conftest.$ac_ext >&5

	ac_retval=1
	fi
	eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
	as_fn_set_status $ac_retval

	} # ac_fn_c_try_compile

	# ac_fn_c_try_cpp LINENO
	# ----------------------
	# Try to preprocess conftest.$ac_ext, and return whether this succeeded.
	ac_fn_c_try_cpp ()
	{
	as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
	if { { ac_try="$ac_cpp conftest.$ac_ext"
	case "(($ac_try" in
	\" \| \` \| \\) ac_try_echo=\$ac_try;;
	*) ac_try_echo=$ac_try;;
	esac
	eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
	$as_echo "$ac_try_echo"; } >&5
	(eval "$ac_cpp conftest.$ac_ext") 2>conftest.err
	ac_status=$?
	if test -s conftest.err; then
	grep -v '^ *+' conftest.err >conftest.er1
	cat conftest.er1 >&5
	mv -f conftest.er1 conftest.err
	fi
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; } > conftest.i && {
	test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" \|\|
	test ! -s conftest.err
	}; then :
	ac_retval=0
	else
	$as_echo "$as_me: failed program was:" >&5
	sed 's/^/\| /' conftest.$ac_ext >&5

	ac_retval=1
	fi
	eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
	as_fn_set_status $ac_retval

	} # ac_fn_c_try_cpp

	# ac_fn_c_check_header_mongrel LINENO HEADER VAR INCLUDES
	# -------------------------------------------------------
	# Tests whether HEADER exists, giving a warning if it cannot be compiled using
	# the include files in INCLUDES and setting the cache variable VAR
	# accordingly.
	ac_fn_c_check_header_mongrel ()
	{
	as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
	if eval \${$3+:} false; then :
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
	$as_echo_n "checking for $2... " >&6; }
	if eval \${$3+:} false; then :
	$as_echo_n "(cached) " >&6
	fi
	eval ac_res=\$$3
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
	$as_echo "$ac_res" >&6; }
	else
	# Is the header compilable?
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 usability" >&5
	$as_echo_n "checking $2 usability... " >&6; }
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$4
	#include <$2>
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_header_compiler=yes
	else
	ac_header_compiler=no
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_compiler" >&5
	$as_echo "$ac_header_compiler" >&6; }

	# Is the header present?
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 presence" >&5
	$as_echo_n "checking $2 presence... " >&6; }
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <$2>
	_ACEOF
	if ac_fn_c_try_cpp "$LINENO"; then :
	ac_header_preproc=yes
	else
	ac_header_preproc=no
	fi
	rm -f conftest.err conftest.i conftest.$ac_ext
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_preproc" >&5
	$as_echo "$ac_header_preproc" >&6; }

	# So? What about this header?
	case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in #((
	yes:no: )
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&5
	$as_echo "$as_me: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&2;}
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5
	$as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;}
	;;
	no:yes:* )
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: present but cannot be compiled" >&5
	$as_echo "$as_me: WARNING: $2: present but cannot be compiled" >&2;}
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: check for missing prerequisite headers?" >&5
	$as_echo "$as_me: WARNING: $2: check for missing prerequisite headers?" >&2;}
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: see the Autoconf documentation" >&5
	$as_echo "$as_me: WARNING: $2: see the Autoconf documentation" >&2;}
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&5
	$as_echo "$as_me: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&2;}
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5
	$as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;}
	( $as_echo "## ---------------------------------------- ##
	## Report this to unbound-bugs@nlnetlabs.nl ##
	## ---------------------------------------- ##"
	) \| sed "s/^/$as_me: WARNING: /" >&2
	;;
	esac
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
	$as_echo_n "checking for $2... " >&6; }
	if eval \${$3+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	eval "$3=\$ac_header_compiler"
	fi
	eval ac_res=\$$3
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
	$as_echo "$ac_res" >&6; }
	fi
	eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno

	} # ac_fn_c_check_header_mongrel

	# ac_fn_c_try_run LINENO
	# ----------------------
	# Try to link conftest.$ac_ext, and return whether this succeeded. Assumes
	# that executables can be run.
	ac_fn_c_try_run ()
	{
	as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
	if { { ac_try="$ac_link"
	case "(($ac_try" in
	\" \| \` \| \\) ac_try_echo=\$ac_try;;
	*) ac_try_echo=$ac_try;;
	esac
	eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
	$as_echo "$ac_try_echo"; } >&5
	(eval "$ac_link") 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; } && { ac_try='./conftest$ac_exeext'
	{ { case "(($ac_try" in
	\" \| \` \| \\) ac_try_echo=\$ac_try;;
	*) ac_try_echo=$ac_try;;
	esac
	eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
	$as_echo "$ac_try_echo"; } >&5
	(eval "$ac_try") 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }; }; then :
	ac_retval=0
	else
	$as_echo "$as_me: program exited with status $ac_status" >&5
	$as_echo "$as_me: failed program was:" >&5
	sed 's/^/\| /' conftest.$ac_ext >&5

	ac_retval=$ac_status
	fi
	rm -rf conftest.dSYM conftest_ipa8_conftest.oo
	eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
	as_fn_set_status $ac_retval

	} # ac_fn_c_try_run

	# ac_fn_c_check_header_compile LINENO HEADER VAR INCLUDES
	# -------------------------------------------------------
	# Tests whether HEADER exists and can be compiled using the include files in
	# INCLUDES, setting the cache variable VAR accordingly.
	ac_fn_c_check_header_compile ()
	{
	as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
	$as_echo_n "checking for $2... " >&6; }
	if eval \${$3+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$4
	#include <$2>
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	eval "$3=yes"
	else
	eval "$3=no"
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	fi
	eval ac_res=\$$3
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
	$as_echo "$ac_res" >&6; }
	eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno

	} # ac_fn_c_check_header_compile

	# ac_fn_c_try_link LINENO
	# -----------------------
	# Try to link conftest.$ac_ext, and return whether this succeeded.
	ac_fn_c_try_link ()
	{
	as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
	rm -f conftest.$ac_objext conftest$ac_exeext
	if { { ac_try="$ac_link"
	case "(($ac_try" in
	\" \| \` \| \\) ac_try_echo=\$ac_try;;
	*) ac_try_echo=$ac_try;;
	esac
	eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
	$as_echo "$ac_try_echo"; } >&5
	(eval "$ac_link") 2>conftest.err
	ac_status=$?
	if test -s conftest.err; then
	grep -v '^ *+' conftest.err >conftest.er1
	cat conftest.er1 >&5
	mv -f conftest.er1 conftest.err
	fi
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; } && {
	test -z "$ac_c_werror_flag" \|\|
	test ! -s conftest.err
	} && test -s conftest$ac_exeext && {
	test "$cross_compiling" = yes \|\|
	test -x conftest$ac_exeext
	}; then :
	ac_retval=0
	else
	$as_echo "$as_me: failed program was:" >&5
	sed 's/^/\| /' conftest.$ac_ext >&5

	ac_retval=1
	fi
	# Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information
	# created by the PGI compiler (conftest_ipa8_conftest.oo), as it would
	# interfere with the next link command; also delete a directory that is
	# left behind by Apple's compiler. We do this before executing the actions.
	rm -rf conftest.dSYM conftest_ipa8_conftest.oo
	eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
	as_fn_set_status $ac_retval

	} # ac_fn_c_try_link

	# ac_fn_c_check_func LINENO FUNC VAR
	# ----------------------------------
	# Tests whether FUNC exists, setting the cache variable VAR accordingly
	ac_fn_c_check_func ()
	{
	as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
	$as_echo_n "checking for $2... " >&6; }
	if eval \${$3+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	/* Define $2 to an innocuous variant, in case <limits.h> declares $2.
	For example, HP-UX 11i <limits.h> declares gettimeofday. */
	#define $2 innocuous_$2

	/* System header to define __stub macros and hopefully few prototypes,
	which can conflict with char $2 (); below.
	Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
	<limits.h> exists even on freestanding compilers. */

	#ifdef __STDC__
	# include <limits.h>
	#else
	# include <assert.h>
	#endif

	#undef $2

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char $2 ();
	/* The GNU C library defines this for functions which it implements
	to always fail with ENOSYS. Some functions are actually named
	something starting with __ and the normal name is an alias. */
	#if defined __stub_$2 \|\| defined __stub___$2
	choke me
	#endif

	int
	main ()
	{
	return $2 ();
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	eval "$3=yes"
	else
	eval "$3=no"
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	fi
	eval ac_res=\$$3
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
	$as_echo "$ac_res" >&6; }
	eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno

	} # ac_fn_c_check_func

	# ac_fn_c_check_type LINENO TYPE VAR INCLUDES
	# -------------------------------------------
	# Tests whether TYPE exists after having included INCLUDES, setting cache
	# variable VAR accordingly.
	ac_fn_c_check_type ()
	{
	as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
	$as_echo_n "checking for $2... " >&6; }
	if eval \${$3+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	eval "$3=no"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$4
	int
	main ()
	{
	if (sizeof ($2))
	return 0;
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$4
	int
	main ()
	{
	if (sizeof (($2)))
	return 0;
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :

	else
	eval "$3=yes"
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	fi
	eval ac_res=\$$3
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
	$as_echo "$ac_res" >&6; }
	eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno

	} # ac_fn_c_check_type

	# ac_fn_c_compute_int LINENO EXPR VAR INCLUDES
	# --------------------------------------------
	# Tries to find the compile-time value of EXPR in a program that includes
	# INCLUDES, setting VAR accordingly. Returns whether the value could be
	# computed
	ac_fn_c_compute_int ()
	{
	as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
	if test "$cross_compiling" = yes; then
	# Depending upon the size, compute the lo and hi bounds.
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$4
	int
	main ()
	{
	static int test_array [1 - 2 * !(($2) >= 0)];
	test_array [0] = 0;
	return test_array [0];

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_lo=0 ac_mid=0
	while :; do
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$4
	int
	main ()
	{
	static int test_array [1 - 2 * !(($2) <= $ac_mid)];
	test_array [0] = 0;
	return test_array [0];

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_hi=$ac_mid; break
	else
	as_fn_arith $ac_mid + 1 && ac_lo=$as_val
	if test $ac_lo -le $ac_mid; then
	ac_lo= ac_hi=
	break
	fi
	as_fn_arith 2 '*' $ac_mid + 1 && ac_mid=$as_val
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	done
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$4
	int
	main ()
	{
	static int test_array [1 - 2 * !(($2) < 0)];
	test_array [0] = 0;
	return test_array [0];

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_hi=-1 ac_mid=-1
	while :; do
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$4
	int
	main ()
	{
	static int test_array [1 - 2 * !(($2) >= $ac_mid)];
	test_array [0] = 0;
	return test_array [0];

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_lo=$ac_mid; break
	else
	as_fn_arith '(' $ac_mid ')' - 1 && ac_hi=$as_val
	if test $ac_mid -le $ac_hi; then
	ac_lo= ac_hi=
	break
	fi
	as_fn_arith 2 '*' $ac_mid && ac_mid=$as_val
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	done
	else
	ac_lo= ac_hi=
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	# Binary search between lo and hi bounds.
	while test "x$ac_lo" != "x$ac_hi"; do
	as_fn_arith '(' $ac_hi - $ac_lo ')' / 2 + $ac_lo && ac_mid=$as_val
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$4
	int
	main ()
	{
	static int test_array [1 - 2 * !(($2) <= $ac_mid)];
	test_array [0] = 0;
	return test_array [0];

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_hi=$ac_mid
	else
	as_fn_arith '(' $ac_mid ')' + 1 && ac_lo=$as_val
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	done
	case $ac_lo in #((
	?*) eval "$3=\$ac_lo"; ac_retval=0 ;;
	'') ac_retval=1 ;;
	esac
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$4
	static long int longval () { return $2; }
	static unsigned long int ulongval () { return $2; }
	#include <stdio.h>
	#include <stdlib.h>
	int
	main ()
	{

	FILE *f = fopen ("conftest.val", "w");
	if (! f)
	return 1;
	if (($2) < 0)
	{
	long int i = longval ();
	if (i != ($2))
	return 1;
	fprintf (f, "%ld", i);
	}
	else
	{
	unsigned long int i = ulongval ();
	if (i != ($2))
	return 1;
	fprintf (f, "%lu", i);
	}
	/* Do not output a trailing newline, as this causes \r\n confusion
	on some platforms. */
	return ferror (f) \|\| fclose (f) != 0;

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_run "$LINENO"; then :
	echo >>conftest.val; read $3 <conftest.val; ac_retval=0
	else
	ac_retval=1
	fi
	rm -f core .core core.conftest. gmon.out bb.out conftest$ac_exeext \
	conftest.$ac_objext conftest.beam conftest.$ac_ext
	rm -f conftest.val

	fi
	eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
	as_fn_set_status $ac_retval

	} # ac_fn_c_compute_int

	# ac_fn_c_check_decl LINENO SYMBOL VAR INCLUDES
	# ---------------------------------------------
	# Tests whether SYMBOL is declared in INCLUDES, setting cache variable VAR
	# accordingly.
	ac_fn_c_check_decl ()
	{
	as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
	as_decl_name=`echo $2\|sed 's/ (.//'`
	as_decl_use=`echo $2\|sed -e 's/(/((/' -e 's/)/) 0&/' -e 's/,/) 0& (/g'`
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $as_decl_name is declared" >&5
	$as_echo_n "checking whether $as_decl_name is declared... " >&6; }
	if eval \${$3+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$4
	int
	main ()
	{
	#ifndef $as_decl_name
	#ifdef __cplusplus
	(void) $as_decl_use;
	#else
	(void) $as_decl_name;
	#endif
	#endif

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	eval "$3=yes"
	else
	eval "$3=no"
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	fi
	eval ac_res=\$$3
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
	$as_echo "$ac_res" >&6; }
	eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno

	} # ac_fn_c_check_decl

	# ac_fn_c_check_member LINENO AGGR MEMBER VAR INCLUDES
	# ----------------------------------------------------
	# Tries to find if the field MEMBER exists in type AGGR, after including
	# INCLUDES, setting cache variable VAR accordingly.
	ac_fn_c_check_member ()
	{
	as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2.$3" >&5
	$as_echo_n "checking for $2.$3... " >&6; }
	if eval \${$4+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$5
	int
	main ()
	{
	static $2 ac_aggr;
	if (ac_aggr.$3)
	return 0;
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	eval "$4=yes"
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$5
	int
	main ()
	{
	static $2 ac_aggr;
	if (sizeof ac_aggr.$3)
	return 0;
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	eval "$4=yes"
	else
	eval "$4=no"
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	fi
	eval ac_res=\$$4
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
	$as_echo "$ac_res" >&6; }
	eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno

	} # ac_fn_c_check_member
	cat >config.log <<_ACEOF
	This file contains any messages produced by compilers while
	running configure, to aid debugging if configure makes a mistake.

	-It was created by unbound $as_me 1.8.1, which was
	+It was created by unbound $as_me 1.9.2, which was
	generated by GNU Autoconf 2.69. Invocation command line was

	$ $0 $@

	_ACEOF
	exec 5>>config.log
	{
	cat <<_ASUNAME
	## --------- ##
	## Platform. ##
	## --------- ##

	hostname = `(hostname \|\| uname -n) 2>/dev/null \| sed 1q`
	uname -m = `(uname -m) 2>/dev/null \|\| echo unknown`
	uname -r = `(uname -r) 2>/dev/null \|\| echo unknown`
	uname -s = `(uname -s) 2>/dev/null \|\| echo unknown`
	uname -v = `(uname -v) 2>/dev/null \|\| echo unknown`

	/usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null \|\| echo unknown`
	/bin/uname -X = `(/bin/uname -X) 2>/dev/null \|\| echo unknown`

	/bin/arch = `(/bin/arch) 2>/dev/null \|\| echo unknown`
	/usr/bin/arch -k = `(/usr/bin/arch -k) 2>/dev/null \|\| echo unknown`
	/usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null \|\| echo unknown`
	/usr/bin/hostinfo = `(/usr/bin/hostinfo) 2>/dev/null \|\| echo unknown`
	/bin/machine = `(/bin/machine) 2>/dev/null \|\| echo unknown`
	/usr/bin/oslevel = `(/usr/bin/oslevel) 2>/dev/null \|\| echo unknown`
	/bin/universe = `(/bin/universe) 2>/dev/null \|\| echo unknown`

	_ASUNAME

	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	$as_echo "PATH: $as_dir"
	done
	IFS=$as_save_IFS

	} >&5

	cat >&5 <<_ACEOF


	## ----------- ##
	## Core tests. ##
	## ----------- ##

	_ACEOF


	# Keep a trace of the command line.
	# Strip out --no-create and --no-recursion so they do not pile up.
	# Strip out --silent because we don't want to record it for future runs.
	# Also quote any args containing shell meta-characters.
	# Make two passes to allow for proper duplicate-argument suppression.
	ac_configure_args=
	ac_configure_args0=
	ac_configure_args1=
	ac_must_keep_next=false
	for ac_pass in 1 2
	do
	for ac_arg
	do
	case $ac_arg in
	-no-create \| --no-c* \| -n \| -no-recursion \| --no-r*) continue ;;
	-q \| -quiet \| --quiet \| --quie \| --qui \| --qu \| --q \
	\| -silent \| --silent \| --silen \| --sile \| --sil)
	continue ;;
	\')
	ac_arg=`$as_echo "$ac_arg" \| sed "s/'/'\\\\\\\\''/g"` ;;
	esac
	case $ac_pass in
	1) as_fn_append ac_configure_args0 " '$ac_arg'" ;;
	2)
	as_fn_append ac_configure_args1 " '$ac_arg'"
	if test $ac_must_keep_next = true; then
	ac_must_keep_next=false # Got value, back to normal.
	else
	case $ac_arg in
	= \| --config-cache \| -C \| -disable-* \| --disable-* \
	\| -enable-* \| --enable-* \| -gas \| --g* \| -nfp \| --nf* \
	\| -q \| -quiet \| --q* \| -silent \| --sil* \| -v \| -verb* \
	\| -with-* \| --with-* \| -without-* \| --without-* \| --x)
	case "$ac_configure_args0 " in
	"$ac_configure_args1"" '$ac_arg' " ) continue ;;
	esac
	;;
	-* ) ac_must_keep_next=true ;;
	esac
	fi
	as_fn_append ac_configure_args " '$ac_arg'"
	;;
	esac
	done
	done
	{ ac_configure_args0=; unset ac_configure_args0;}
	{ ac_configure_args1=; unset ac_configure_args1;}

	# When interrupted or exit'd, cleanup temporary files, and complete
	# config.log. We remove comments because anyway the quotes in there
	# would cause problems or look ugly.
	# WARNING: Use '\'' to represent an apostrophe within the trap.
	# WARNING: Do not start the trap code with a newline, due to a FreeBSD 4.0 bug.
	trap 'exit_status=$?
	# Save into config.log some information that might help in debugging.
	{
	echo

	$as_echo "## ---------------- ##
	## Cache variables. ##
	## ---------------- ##"
	echo
	# The following way of writing the cache mishandles newlines in values,
	(
	for ac_var in `(set) 2>&1 \| sed -n '\''s/^$[a-zA-Z_][a-zA-Z0-9_]$=./\1/p'\''`; do
	eval ac_val=\$$ac_var
	case $ac_val in #(
	${as_nl})
	case $ac_var in #(
	_cv_) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5
	$as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
	esac
	case $ac_var in #(
	_ \| IFS \| as_nl) ;; #(
	BASH_ARGV \| BASH_SOURCE) eval $ac_var= ;; #(
	*) { eval $ac_var=; unset $ac_var;} ;;
	esac ;;
	esac
	done
	(set) 2>&1 \|
	case $as_nl`(ac_space='\'' '\''; set) 2>&1` in #(
	${as_nl}ac_space=\ )
	sed -n \
	"s/'\''/'\''\\\\'\'''\''/g;
	s/^\$[_$as_cr_alnum]_cv_[_$as_cr_alnum]\$=\$.*\$/\\1='\''\\2'\''/p"
	;; #(
	*)
	sed -n "/^[_$as_cr_alnum]_cv_[_$as_cr_alnum]=/p"
	;;
	esac \|
	sort
	)
	echo

	$as_echo "## ----------------- ##
	## Output variables. ##
	## ----------------- ##"
	echo
	for ac_var in $ac_subst_vars
	do
	eval ac_val=\$$ac_var
	case $ac_val in
	\'\'') ac_val=`$as_echo "$ac_val" \| sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
	esac
	$as_echo "$ac_var='\''$ac_val'\''"
	done \| sort
	echo

	if test -n "$ac_subst_files"; then
	$as_echo "## ------------------- ##
	## File substitutions. ##
	## ------------------- ##"
	echo
	for ac_var in $ac_subst_files
	do
	eval ac_val=\$$ac_var
	case $ac_val in
	\'\'') ac_val=`$as_echo "$ac_val" \| sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
	esac
	$as_echo "$ac_var='\''$ac_val'\''"
	done \| sort
	echo
	fi

	if test -s confdefs.h; then
	$as_echo "## ----------- ##
	## confdefs.h. ##
	## ----------- ##"
	echo
	cat confdefs.h
	echo
	fi
	test "$ac_signal" != 0 &&
	$as_echo "$as_me: caught signal $ac_signal"
	$as_echo "$as_me: exit $exit_status"
	} >&5
	rm -f core .core core.conftest. &&
	rm -f -r conftest* confdefs* conf$$* $ac_clean_files &&
	exit $exit_status
	' 0
	for ac_signal in 1 2 13 15; do
	trap 'ac_signal='$ac_signal'; as_fn_exit 1' $ac_signal
	done
	ac_signal=0

	# confdefs.h avoids OS command line length limits that DEFS can exceed.
	rm -f -r conftest* confdefs.h

	$as_echo "/* confdefs.h */" > confdefs.h

	# Predefined preprocessor variables.

	cat >>confdefs.h <<_ACEOF
	#define PACKAGE_NAME "$PACKAGE_NAME"
	_ACEOF

	cat >>confdefs.h <<_ACEOF
	#define PACKAGE_TARNAME "$PACKAGE_TARNAME"
	_ACEOF

	cat >>confdefs.h <<_ACEOF
	#define PACKAGE_VERSION "$PACKAGE_VERSION"
	_ACEOF

	cat >>confdefs.h <<_ACEOF
	#define PACKAGE_STRING "$PACKAGE_STRING"
	_ACEOF

	cat >>confdefs.h <<_ACEOF
	#define PACKAGE_BUGREPORT "$PACKAGE_BUGREPORT"
	_ACEOF

	cat >>confdefs.h <<_ACEOF
	#define PACKAGE_URL "$PACKAGE_URL"
	_ACEOF


	# Let the site file select an alternate cache file if it wants to.
	# Prefer an explicitly selected file to automatically selected ones.
	ac_site_file1=NONE
	ac_site_file2=NONE
	if test -n "$CONFIG_SITE"; then
	# We do not want a PATH search for config.site.
	case $CONFIG_SITE in #((
	-*) ac_site_file1=./$CONFIG_SITE;;
	/) ac_site_file1=$CONFIG_SITE;;
	*) ac_site_file1=./$CONFIG_SITE;;
	esac
	elif test "x$prefix" != xNONE; then
	ac_site_file1=$prefix/share/config.site
	ac_site_file2=$prefix/etc/config.site
	else
	ac_site_file1=$ac_default_prefix/share/config.site
	ac_site_file2=$ac_default_prefix/etc/config.site
	fi
	for ac_site_file in "$ac_site_file1" "$ac_site_file2"
	do
	test "x$ac_site_file" = xNONE && continue
	if test /dev/null != "$ac_site_file" && test -r "$ac_site_file"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: loading site script $ac_site_file" >&5
	$as_echo "$as_me: loading site script $ac_site_file" >&6;}
	sed 's/^/\| /' "$ac_site_file" >&5
	. "$ac_site_file" \
	\|\| { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
	$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
	as_fn_error $? "failed to load site script $ac_site_file
	See \`config.log' for more details" "$LINENO" 5; }
	fi
	done

	if test -r "$cache_file"; then
	# Some versions of bash will fail to source /dev/null (special files
	# actually), so we avoid doing that. DJGPP emulates it as a regular file.
	if test /dev/null != "$cache_file" && test -f "$cache_file"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: loading cache $cache_file" >&5
	$as_echo "$as_me: loading cache $cache_file" >&6;}
	case $cache_file in
	[\\/]* \| ?:[\\/]* ) . "$cache_file";;
	*) . "./$cache_file";;
	esac
	fi
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: creating cache $cache_file" >&5
	$as_echo "$as_me: creating cache $cache_file" >&6;}
	>$cache_file
	fi

	# Check that the precious variables saved in the cache have kept the same
	# value.
	ac_cache_corrupted=false
	for ac_var in $ac_precious_vars; do
	eval ac_old_set=\$ac_cv_env_${ac_var}_set
	eval ac_new_set=\$ac_env_${ac_var}_set
	eval ac_old_val=\$ac_cv_env_${ac_var}_value
	eval ac_new_val=\$ac_env_${ac_var}_value
	case $ac_old_set,$ac_new_set in
	set,)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5
	$as_echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;}
	ac_cache_corrupted=: ;;
	,set)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was not set in the previous run" >&5
	$as_echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;}
	ac_cache_corrupted=: ;;
	,);;
	*)
	if test "x$ac_old_val" != "x$ac_new_val"; then
	# differences in whitespace do not lead to failure.
	ac_old_val_w=`echo x $ac_old_val`
	ac_new_val_w=`echo x $ac_new_val`
	if test "$ac_old_val_w" != "$ac_new_val_w"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' has changed since the previous run:" >&5
	$as_echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;}
	ac_cache_corrupted=:
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&5
	$as_echo "$as_me: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&2;}
	eval $ac_var=\$ac_old_val
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: former value: \`$ac_old_val'" >&5
	$as_echo "$as_me: former value: \`$ac_old_val'" >&2;}
	{ $as_echo "$as_me:${as_lineno-$LINENO}: current value: \`$ac_new_val'" >&5
	$as_echo "$as_me: current value: \`$ac_new_val'" >&2;}
	fi;;
	esac
	# Pass precious variables to config.status.
	if test "$ac_new_set" = set; then
	case $ac_new_val in
	\') ac_arg=$ac_var=`$as_echo "$ac_new_val" \| sed "s/'/'\\\\\\\\''/g"` ;;
	*) ac_arg=$ac_var=$ac_new_val ;;
	esac
	case " $ac_configure_args " in
	" '$ac_arg' ") ;; # Avoid dups. Use of quotes ensures accuracy.
	*) as_fn_append ac_configure_args " '$ac_arg'" ;;
	esac
	fi
	done
	if $ac_cache_corrupted; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
	$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
	{ $as_echo "$as_me:${as_lineno-$LINENO}: error: changes in the environment can compromise the build" >&5
	$as_echo "$as_me: error: changes in the environment can compromise the build" >&2;}
	as_fn_error $? "run \`make distclean' and/or \`rm $cache_file' and start over" "$LINENO" 5
	fi
	## -------------------- ##
	## Main body of script. ##
	## -------------------- ##

	ac_ext=c
	ac_cpp='$CPP $CPPFLAGS'
	ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
	ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
	ac_compiler_gnu=$ac_cv_c_compiler_gnu


	UNBOUND_VERSION_MAJOR=1

	-UNBOUND_VERSION_MINOR=8
	+UNBOUND_VERSION_MINOR=9

	-UNBOUND_VERSION_MICRO=1
	+UNBOUND_VERSION_MICRO=2


	-LIBUNBOUND_CURRENT=8
	-LIBUNBOUND_REVISION=1
	-LIBUNBOUND_AGE=0
	+LIBUNBOUND_CURRENT=9
	+LIBUNBOUND_REVISION=2
	+LIBUNBOUND_AGE=1
	# 1.0.0 had 0:12:0
	# 1.0.1 had 0:13:0
	# 1.0.2 had 0:14:0
	# 1.1.0 had 0:15:0
	# 1.1.1 had 0:16:0
	# 1.2.0 had 0:17:0
	# 1.2.1 had 0:18:0
	# 1.3.0 had 1:0:0 # ub_cancel and -export-symbols.
	# 1.3.1 had 1:1:0
	# 1.3.2 had 1:2:0
	# 1.3.3 had 1:3:0
	# 1.3.4 had 1:4:0
	# 1.4.0-snapshots had 1:5:0
	# 1.4.0 had 1:5:0 (not 2:0:0) # ub_result.why_bogus
	# 1.4.1 had 2:1:0
	# 1.4.2 had 2:2:0
	# 1.4.3 had 2:3:0
	# 1.4.4 had 2:4:0
	# 1.4.5 had 2:5:0
	# 1.4.6 had 2:6:0
	# 1.4.7 had 2:7:0
	# 1.4.8 had 2:8:0
	# 1.4.9 had 2:9:0
	# 1.4.10 had 2:10:0
	# 1.4.11 had 2:11:0
	# 1.4.12 had 2:12:0
	# 1.4.13 had 2:13:0
	# and 1.4.13p1 and 1.4.13.p2
	# 1.4.14 had 2:14:0
	# 1.4.15 had 3:0:1 # adds ub_version()
	# 1.4.16 had 3:1:1
	# 1.4.17 had 3:2:1
	# 1.4.18 had 3:3:1
	# 1.4.19 had 3:4:1
	# 1.4.20 had 4:0:2 # adds libunbound.ttl # but shipped 3:5:1
	# 1.4.21 had 4:1:2
	# 1.4.22 had 4:1:2
	# 1.5.0 had 5:3:3 # adds ub_ctx_add_ta_autr
	# 1.5.1 had 5:3:3
	# 1.5.2 had 5:5:3
	# 1.5.3 had 5:6:3
	# 1.5.4 had 5:7:3
	# 1.5.5 had 5:8:3
	# 1.5.6 had 5:9:3
	# 1.5.7 had 5:10:3
	# 1.5.8 had 6:0:4 # adds ub_ctx_set_stub
	# 1.5.9 had 6:1:4
	# 1.5.10 had 6:2:4
	# 1.6.0 had 6:3:4
	# 1.6.1 had 7:0:5 # ub_callback_t typedef renamed to ub_callback_type
	# 1.6.2 had 7:1:5
	# 1.6.3 had 7:2:5
	# 1.6.4 had 7:3:5
	# 1.6.5 had 7:4:5
	# 1.6.6 had 7:5:5
	# 1.6.7 had 7:6:5
	# 1.6.8 had 7:7:5
	# 1.7.0 had 7:8:5
	# 1.7.1 had 7:9:5
	# 1.7.2 had 7:10:5
	# 1.7.3 had 7:11:5
	# 1.8.0 had 8:0:0 # changes the event callback function signature
	# 1.8.1 had 8:1:0
	+# 1.8.2 had 8:2:0
	+# 1.8.3 had 8:3:0
	+# 1.9.0 had 9:0:1 # add ub_ctx_set_tls
	+# 1.9.1 had 9:1:1
	+# 1.9.2 had 9:2:1

	# Current -- the number of the binary API that we're implementing
	# Revision -- which iteration of the implementation of the binary
	# API are we supplying?
	# Age -- How many previous binary API versions do we also
	# support?
	#
	# If we release a new version that does not change the binary API,
	# increment Revision.
	#
	# If we release a new version that changes the binary API, but does
	# not break programs compiled against the old binary API, increment
	# Current and Age. Set Revision to 0, since this is the first
	# implementation of the new API.
	#
	# Otherwise, we're changing the binary API and breaking backward
	# compatibility with old binaries. Increment Current. Set Age to 0,
	# since we're backward compatible with no previous APIs. Set Revision
	# to 0 too.




	CFLAGS="$CFLAGS"
	ac_ext=c
	ac_cpp='$CPP $CPPFLAGS'
	ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
	ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
	ac_compiler_gnu=$ac_cv_c_compiler_gnu
	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}gcc", so it can be a program name with args.
	set dummy ${ac_tool_prefix}gcc; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_CC+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$CC"; then
	ac_cv_prog_CC="$CC" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_CC="${ac_tool_prefix}gcc"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	CC=$ac_cv_prog_CC
	if test -n "$CC"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
	$as_echo "$CC" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$ac_cv_prog_CC"; then
	ac_ct_CC=$CC
	# Extract the first word of "gcc", so it can be a program name with args.
	set dummy gcc; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_CC+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_CC"; then
	ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_CC="gcc"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_CC=$ac_cv_prog_ac_ct_CC
	if test -n "$ac_ct_CC"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
	$as_echo "$ac_ct_CC" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi

	if test "x$ac_ct_CC" = x; then
	CC=""
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	CC=$ac_ct_CC
	fi
	else
	CC="$ac_cv_prog_CC"
	fi

	if test -z "$CC"; then
	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}cc", so it can be a program name with args.
	set dummy ${ac_tool_prefix}cc; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_CC+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$CC"; then
	ac_cv_prog_CC="$CC" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_CC="${ac_tool_prefix}cc"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	CC=$ac_cv_prog_CC
	if test -n "$CC"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
	$as_echo "$CC" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	fi
	if test -z "$CC"; then
	# Extract the first word of "cc", so it can be a program name with args.
	set dummy cc; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_CC+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$CC"; then
	ac_cv_prog_CC="$CC" # Let the user override the test.
	else
	ac_prog_rejected=no
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	if test "$as_dir/$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then
	ac_prog_rejected=yes
	continue
	fi
	ac_cv_prog_CC="cc"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	if test $ac_prog_rejected = yes; then
	# We found a bogon in the path, so make sure we never use it.
	set dummy $ac_cv_prog_CC
	shift
	if test $# != 0; then
	# We chose a different compiler from the bogus one.
	# However, it has the same basename, so the bogon will be chosen
	# first if we set CC to just the basename; use the full file name.
	shift
	ac_cv_prog_CC="$as_dir/$ac_word${1+' '}$@"
	fi
	fi
	fi
	fi
	CC=$ac_cv_prog_CC
	if test -n "$CC"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
	$as_echo "$CC" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$CC"; then
	if test -n "$ac_tool_prefix"; then
	for ac_prog in cl.exe
	do
	# Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args.
	set dummy $ac_tool_prefix$ac_prog; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_CC+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$CC"; then
	ac_cv_prog_CC="$CC" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_CC="$ac_tool_prefix$ac_prog"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	CC=$ac_cv_prog_CC
	if test -n "$CC"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
	$as_echo "$CC" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	test -n "$CC" && break
	done
	fi
	if test -z "$CC"; then
	ac_ct_CC=$CC
	for ac_prog in cl.exe
	do
	# Extract the first word of "$ac_prog", so it can be a program name with args.
	set dummy $ac_prog; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_CC+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_CC"; then
	ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_CC="$ac_prog"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_CC=$ac_cv_prog_ac_ct_CC
	if test -n "$ac_ct_CC"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
	$as_echo "$ac_ct_CC" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	test -n "$ac_ct_CC" && break
	done

	if test "x$ac_ct_CC" = x; then
	CC=""
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	CC=$ac_ct_CC
	fi
	fi

	fi


	test -z "$CC" && { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
	$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
	as_fn_error $? "no acceptable C compiler found in \$PATH
	See \`config.log' for more details" "$LINENO" 5; }

	# Provide some information about the compiler.
	$as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5
	set X $ac_compile
	ac_compiler=$2
	for ac_option in --version -v -V -qversion; do
	{ { ac_try="$ac_compiler $ac_option >&5"
	case "(($ac_try" in
	\" \| \` \| \\) ac_try_echo=\$ac_try;;
	*) ac_try_echo=$ac_try;;
	esac
	eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
	$as_echo "$ac_try_echo"; } >&5
	(eval "$ac_compiler $ac_option >&5") 2>conftest.err
	ac_status=$?
	if test -s conftest.err; then
	sed '10a\
	... rest of stderr output deleted ...
	10q' conftest.err >conftest.er1
	cat conftest.er1 >&5
	fi
	rm -f conftest.er1 conftest.err
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }
	done

	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	ac_clean_files_save=$ac_clean_files
	ac_clean_files="$ac_clean_files a.out a.out.dSYM a.exe b.out"
	# Try to create an executable without -o first, disregard a.out.
	# It will help us diagnose broken compilers, and finding out an intuition
	# of exeext.
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler works" >&5
	$as_echo_n "checking whether the C compiler works... " >&6; }
	ac_link_default=`$as_echo "$ac_link" \| sed 's/ -o conftest[^ ]//'`

	# The possible output files:
	ac_files="a.out conftest.exe conftest a.exe a_out.exe b.out conftest.*"

	ac_rmfiles=
	for ac_file in $ac_files
	do
	case $ac_file in
	.$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) ;;
	* ) ac_rmfiles="$ac_rmfiles $ac_file";;
	esac
	done
	rm -f $ac_rmfiles

	if { { ac_try="$ac_link_default"
	case "(($ac_try" in
	\" \| \` \| \\) ac_try_echo=\$ac_try;;
	*) ac_try_echo=$ac_try;;
	esac
	eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
	$as_echo "$ac_try_echo"; } >&5
	(eval "$ac_link_default") 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }; then :
	# Autoconf-2.13 could set the ac_cv_exeext variable to `no'.
	# So ignore a value of `no', otherwise this would lead to `EXEEXT = no'
	# in a Makefile. We should not override ac_cv_exeext if it was cached,
	# so that the user can short-circuit this test for compilers unknown to
	# Autoconf.
	for ac_file in $ac_files ''
	do
	test -f "$ac_file" \|\| continue
	case $ac_file in
	.$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj )
	;;
	[ab].out )
	# We found the default executable, but exeext='' is most
	# certainly right.
	break;;
	. )
	if test "${ac_cv_exeext+set}" = set && test "$ac_cv_exeext" != no;
	then :; else
	ac_cv_exeext=`expr "$ac_file" : '[^.]$\..$'`
	fi
	# We set ac_cv_exeext here because the later test for it is not
	# safe: cross compilers may not add the suffix if given an `-o'
	# argument, so we may need to know it at that point already.
	# Even if this section looks crufty: it has the advantage of
	# actually working.
	break;;
	* )
	break;;
	esac
	done
	test "$ac_cv_exeext" = no && ac_cv_exeext=

	else
	ac_file=''
	fi
	if test -z "$ac_file"; then :
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	$as_echo "$as_me: failed program was:" >&5
	sed 's/^/\| /' conftest.$ac_ext >&5

	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
	$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
	as_fn_error 77 "C compiler cannot create executables
	See \`config.log' for more details" "$LINENO" 5; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler default output file name" >&5
	$as_echo_n "checking for C compiler default output file name... " >&6; }
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_file" >&5
	$as_echo "$ac_file" >&6; }
	ac_exeext=$ac_cv_exeext

	rm -f -r a.out a.out.dSYM a.exe conftest$ac_cv_exeext b.out
	ac_clean_files=$ac_clean_files_save
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of executables" >&5
	$as_echo_n "checking for suffix of executables... " >&6; }
	if { { ac_try="$ac_link"
	case "(($ac_try" in
	\" \| \` \| \\) ac_try_echo=\$ac_try;;
	*) ac_try_echo=$ac_try;;
	esac
	eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
	$as_echo "$ac_try_echo"; } >&5
	(eval "$ac_link") 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }; then :
	# If both `conftest.exe' and `conftest' are `present' (well, observable)
	# catch `conftest.exe'. For instance with Cygwin, `ls conftest' will
	# work properly (i.e., refer to `conftest.exe'), while it won't with
	# `rm'.
	for ac_file in conftest.exe conftest conftest.*; do
	test -f "$ac_file" \|\| continue
	case $ac_file in
	.$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) ;;
	. ) ac_cv_exeext=`expr "$ac_file" : '[^.]$\..$'`
	break;;
	* ) break;;
	esac
	done
	else
	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
	$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
	as_fn_error $? "cannot compute suffix of executables: cannot compile and link
	See \`config.log' for more details" "$LINENO" 5; }
	fi
	rm -f conftest conftest$ac_cv_exeext
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_exeext" >&5
	$as_echo "$ac_cv_exeext" >&6; }

	rm -f conftest.$ac_ext
	EXEEXT=$ac_cv_exeext
	ac_exeext=$EXEEXT
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <stdio.h>
	int
	main ()
	{
	FILE *f = fopen ("conftest.out", "w");
	return ferror (f) \|\| fclose (f) != 0;

	;
	return 0;
	}
	_ACEOF
	ac_clean_files="$ac_clean_files conftest.out"
	# Check that the compiler produces executables we can run. If not, either
	# the compiler is broken, or we cross compile.
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are cross compiling" >&5
	$as_echo_n "checking whether we are cross compiling... " >&6; }
	if test "$cross_compiling" != yes; then
	{ { ac_try="$ac_link"
	case "(($ac_try" in
	\" \| \` \| \\) ac_try_echo=\$ac_try;;
	*) ac_try_echo=$ac_try;;
	esac
	eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
	$as_echo "$ac_try_echo"; } >&5
	(eval "$ac_link") 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }
	if { ac_try='./conftest$ac_cv_exeext'
	{ { case "(($ac_try" in
	\" \| \` \| \\) ac_try_echo=\$ac_try;;
	*) ac_try_echo=$ac_try;;
	esac
	eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
	$as_echo "$ac_try_echo"; } >&5
	(eval "$ac_try") 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }; }; then
	cross_compiling=no
	else
	if test "$cross_compiling" = maybe; then
	cross_compiling=yes
	else
	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
	$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
	as_fn_error $? "cannot run C compiled programs.
	If you meant to cross compile, use \`--host'.
	See \`config.log' for more details" "$LINENO" 5; }
	fi
	fi
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $cross_compiling" >&5
	$as_echo "$cross_compiling" >&6; }

	rm -f conftest.$ac_ext conftest$ac_cv_exeext conftest.out
	ac_clean_files=$ac_clean_files_save
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of object files" >&5
	$as_echo_n "checking for suffix of object files... " >&6; }
	if ${ac_cv_objext+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	rm -f conftest.o conftest.obj
	if { { ac_try="$ac_compile"
	case "(($ac_try" in
	\" \| \` \| \\) ac_try_echo=\$ac_try;;
	*) ac_try_echo=$ac_try;;
	esac
	eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
	$as_echo "$ac_try_echo"; } >&5
	(eval "$ac_compile") 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }; then :
	for ac_file in conftest.o conftest.obj conftest.*; do
	test -f "$ac_file" \|\| continue;
	case $ac_file in
	.$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| *.dSYM ) ;;
	) ac_cv_objext=`expr "$ac_file" : '.\.$.*$'`
	break;;
	esac
	done
	else
	$as_echo "$as_me: failed program was:" >&5
	sed 's/^/\| /' conftest.$ac_ext >&5

	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
	$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
	as_fn_error $? "cannot compute suffix of object files: cannot compile
	See \`config.log' for more details" "$LINENO" 5; }
	fi
	rm -f conftest.$ac_cv_objext conftest.$ac_ext
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_objext" >&5
	$as_echo "$ac_cv_objext" >&6; }
	OBJEXT=$ac_cv_objext
	ac_objext=$OBJEXT
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using the GNU C compiler" >&5
	$as_echo_n "checking whether we are using the GNU C compiler... " >&6; }
	if ${ac_cv_c_compiler_gnu+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{
	#ifndef __GNUC__
	choke me
	#endif

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_compiler_gnu=yes
	else
	ac_compiler_gnu=no
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	ac_cv_c_compiler_gnu=$ac_compiler_gnu

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5
	$as_echo "$ac_cv_c_compiler_gnu" >&6; }
	if test $ac_compiler_gnu = yes; then
	GCC=yes
	else
	GCC=
	fi
	ac_test_CFLAGS=${CFLAGS+set}
	ac_save_CFLAGS=$CFLAGS
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5
	$as_echo_n "checking whether $CC accepts -g... " >&6; }
	if ${ac_cv_prog_cc_g+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_save_c_werror_flag=$ac_c_werror_flag
	ac_c_werror_flag=yes
	ac_cv_prog_cc_g=no
	CFLAGS="-g"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_prog_cc_g=yes
	else
	CFLAGS=""
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :

	else
	ac_c_werror_flag=$ac_save_c_werror_flag
	CFLAGS="-g"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_prog_cc_g=yes
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	ac_c_werror_flag=$ac_save_c_werror_flag
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5
	$as_echo "$ac_cv_prog_cc_g" >&6; }
	if test "$ac_test_CFLAGS" = set; then
	CFLAGS=$ac_save_CFLAGS
	elif test $ac_cv_prog_cc_g = yes; then
	if test "$GCC" = yes; then
	CFLAGS="-g -O2"
	else
	CFLAGS="-g"
	fi
	else
	if test "$GCC" = yes; then
	CFLAGS="-O2"
	else
	CFLAGS=
	fi
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C89" >&5
	$as_echo_n "checking for $CC option to accept ISO C89... " >&6; }
	if ${ac_cv_prog_cc_c89+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_cv_prog_cc_c89=no
	ac_save_CC=$CC
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <stdarg.h>
	#include <stdio.h>
	struct stat;
	/* Most of the following tests are stolen from RCS 5.7's src/conf.sh. */
	struct buf { int x; };
	FILE * (rcsopen) (struct buf , struct stat *, int);
	static char *e (p, i)
	char **p;
	int i;
	{
	return p[i];
	}
	static char f (char (g) (char , int), char *p, ...)
	{
	char *s;
	va_list v;
	va_start (v,p);
	s = g (p, va_arg (v,int));
	va_end (v);
	return s;
	}

	/* OSF 4.0 Compaq cc is some sort of almost-ANSI by default. It has
	function prototypes and stuff, but not '\xHH' hex character constants.
	These don't provoke an error unfortunately, instead are silently treated
	as 'x'. The following induces an error, until -std is added to get
	proper ANSI mode. Curiously '\x00'!='x' always comes out true, for an
	array size at least. It's necessary to write '\x00'==0 to get something
	that's true only with -std. */
	int osf4_cc_array ['\x00' == 0 ? 1 : -1];

	/* IBM C 6 for AIX is almost-ANSI by default, but it replaces macro parameters
	inside strings and character constants. */
	#define FOO(x) 'x'
	int xlc6_cc_array[FOO(a) == 'x' ? 1 : -1];

	int test (int i, double x);
	struct s1 {int (*f) (int a);};
	struct s2 {int (*f) (double a);};
	int pairnames (int, char *, FILE ()(struct buf , struct stat *, int), int, int);
	int argc;
	char **argv;
	int
	main ()
	{
	return f (e, argv, 0) != argv[0] \|\| f (e, argv, 1) != argv[1];
	;
	return 0;
	}
	_ACEOF
	for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std \
	-Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__"
	do
	CC="$ac_save_CC $ac_arg"
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_prog_cc_c89=$ac_arg
	fi
	rm -f core conftest.err conftest.$ac_objext
	test "x$ac_cv_prog_cc_c89" != "xno" && break
	done
	rm -f conftest.$ac_ext
	CC=$ac_save_CC

	fi
	# AC_CACHE_VAL
	case "x$ac_cv_prog_cc_c89" in
	x)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
	$as_echo "none needed" >&6; } ;;
	xno)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
	$as_echo "unsupported" >&6; } ;;
	*)
	CC="$CC $ac_cv_prog_cc_c89"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5
	$as_echo "$ac_cv_prog_cc_c89" >&6; } ;;
	esac
	if test "x$ac_cv_prog_cc_c89" != xno; then :

	fi

	ac_ext=c
	ac_cpp='$CPP $CPPFLAGS'
	ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
	ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
	ac_compiler_gnu=$ac_cv_c_compiler_gnu


	ac_ext=c
	ac_cpp='$CPP $CPPFLAGS'
	ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
	ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
	ac_compiler_gnu=$ac_cv_c_compiler_gnu
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5
	$as_echo_n "checking how to run the C preprocessor... " >&6; }
	# On Suns, sometimes $CPP names a directory.
	if test -n "$CPP" && test -d "$CPP"; then
	CPP=
	fi
	if test -z "$CPP"; then
	if ${ac_cv_prog_CPP+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	# Double quotes because CPP needs to be expanded
	for CPP in "$CC -E" "$CC -E -traditional-cpp" "/lib/cpp"
	do
	ac_preproc_ok=false
	for ac_c_preproc_warn_flag in '' yes
	do
	# Use a header file that comes with gcc, so configuring glibc
	# with a fresh cross-compiler works.
	# Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
	# <limits.h> exists even on freestanding compilers.
	# On the NeXT, cc -E runs the code through the compiler's parser,
	# not just through cpp. "Syntax error" is here to catch this case.
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#ifdef __STDC__
	# include <limits.h>
	#else
	# include <assert.h>
	#endif
	Syntax error
	_ACEOF
	if ac_fn_c_try_cpp "$LINENO"; then :

	else
	# Broken: fails on valid input.
	continue
	fi
	rm -f conftest.err conftest.i conftest.$ac_ext

	# OK, works on sane cases. Now check whether nonexistent headers
	# can be detected and how.
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <ac_nonexistent.h>
	_ACEOF
	if ac_fn_c_try_cpp "$LINENO"; then :
	# Broken: success on invalid input.
	continue
	else
	# Passes both tests.
	ac_preproc_ok=:
	break
	fi
	rm -f conftest.err conftest.i conftest.$ac_ext

	done
	# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
	rm -f conftest.i conftest.err conftest.$ac_ext
	if $ac_preproc_ok; then :
	break
	fi

	done
	ac_cv_prog_CPP=$CPP

	fi
	CPP=$ac_cv_prog_CPP
	else
	ac_cv_prog_CPP=$CPP
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5
	$as_echo "$CPP" >&6; }
	ac_preproc_ok=false
	for ac_c_preproc_warn_flag in '' yes
	do
	# Use a header file that comes with gcc, so configuring glibc
	# with a fresh cross-compiler works.
	# Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
	# <limits.h> exists even on freestanding compilers.
	# On the NeXT, cc -E runs the code through the compiler's parser,
	# not just through cpp. "Syntax error" is here to catch this case.
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#ifdef __STDC__
	# include <limits.h>
	#else
	# include <assert.h>
	#endif
	Syntax error
	_ACEOF
	if ac_fn_c_try_cpp "$LINENO"; then :

	else
	# Broken: fails on valid input.
	continue
	fi
	rm -f conftest.err conftest.i conftest.$ac_ext

	# OK, works on sane cases. Now check whether nonexistent headers
	# can be detected and how.
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <ac_nonexistent.h>
	_ACEOF
	if ac_fn_c_try_cpp "$LINENO"; then :
	# Broken: success on invalid input.
	continue
	else
	# Passes both tests.
	ac_preproc_ok=:
	break
	fi
	rm -f conftest.err conftest.i conftest.$ac_ext

	done
	# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
	rm -f conftest.i conftest.err conftest.$ac_ext
	if $ac_preproc_ok; then :

	else
	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
	$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
	as_fn_error $? "C preprocessor \"$CPP\" fails sanity check
	See \`config.log' for more details" "$LINENO" 5; }
	fi

	ac_ext=c
	ac_cpp='$CPP $CPPFLAGS'
	ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
	ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
	ac_compiler_gnu=$ac_cv_c_compiler_gnu


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for grep that handles long lines and -e" >&5
	$as_echo_n "checking for grep that handles long lines and -e... " >&6; }
	if ${ac_cv_path_GREP+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -z "$GREP"; then
	ac_path_GREP_found=false
	# Loop through the user's path and test for each of PROGNAME-LIST
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_prog in grep ggrep; do
	for ac_exec_ext in '' $ac_executable_extensions; do
	ac_path_GREP="$as_dir/$ac_prog$ac_exec_ext"
	as_fn_executable_p "$ac_path_GREP" \|\| continue
	# Check for GNU ac_path_GREP and select it if it is found.
	# Check for GNU $ac_path_GREP
	case `"$ac_path_GREP" --version 2>&1` in
	GNU)
	ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_found=:;;
	*)
	ac_count=0
	$as_echo_n 0123456789 >"conftest.in"
	while :
	do
	cat "conftest.in" "conftest.in" >"conftest.tmp"
	mv "conftest.tmp" "conftest.in"
	cp "conftest.in" "conftest.nl"
	$as_echo 'GREP' >> "conftest.nl"
	"$ac_path_GREP" -e 'GREP$' -e '-(cannot match)-' < "conftest.nl" >"conftest.out" 2>/dev/null \|\| break
	diff "conftest.out" "conftest.nl" >/dev/null 2>&1 \|\| break
	as_fn_arith $ac_count + 1 && ac_count=$as_val
	if test $ac_count -gt ${ac_path_GREP_max-0}; then
	# Best one so far, save it but keep looking for a better one
	ac_cv_path_GREP="$ac_path_GREP"
	ac_path_GREP_max=$ac_count
	fi
	# 10*(2^10) chars as input seems more than enough
	test $ac_count -gt 10 && break
	done
	rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
	esac

	$ac_path_GREP_found && break 3
	done
	done
	done
	IFS=$as_save_IFS
	if test -z "$ac_cv_path_GREP"; then
	as_fn_error $? "no acceptable grep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5
	fi
	else
	ac_cv_path_GREP=$GREP
	fi

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_GREP" >&5
	$as_echo "$ac_cv_path_GREP" >&6; }
	GREP="$ac_cv_path_GREP"


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5
	$as_echo_n "checking for egrep... " >&6; }
	if ${ac_cv_path_EGREP+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if echo a \| $GREP -E '(a\|b)' >/dev/null 2>&1
	then ac_cv_path_EGREP="$GREP -E"
	else
	if test -z "$EGREP"; then
	ac_path_EGREP_found=false
	# Loop through the user's path and test for each of PROGNAME-LIST
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_prog in egrep; do
	for ac_exec_ext in '' $ac_executable_extensions; do
	ac_path_EGREP="$as_dir/$ac_prog$ac_exec_ext"
	as_fn_executable_p "$ac_path_EGREP" \|\| continue
	# Check for GNU ac_path_EGREP and select it if it is found.
	# Check for GNU $ac_path_EGREP
	case `"$ac_path_EGREP" --version 2>&1` in
	GNU)
	ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;;
	*)
	ac_count=0
	$as_echo_n 0123456789 >"conftest.in"
	while :
	do
	cat "conftest.in" "conftest.in" >"conftest.tmp"
	mv "conftest.tmp" "conftest.in"
	cp "conftest.in" "conftest.nl"
	$as_echo 'EGREP' >> "conftest.nl"
	"$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null \|\| break
	diff "conftest.out" "conftest.nl" >/dev/null 2>&1 \|\| break
	as_fn_arith $ac_count + 1 && ac_count=$as_val
	if test $ac_count -gt ${ac_path_EGREP_max-0}; then
	# Best one so far, save it but keep looking for a better one
	ac_cv_path_EGREP="$ac_path_EGREP"
	ac_path_EGREP_max=$ac_count
	fi
	# 10*(2^10) chars as input seems more than enough
	test $ac_count -gt 10 && break
	done
	rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
	esac

	$ac_path_EGREP_found && break 3
	done
	done
	done
	IFS=$as_save_IFS
	if test -z "$ac_cv_path_EGREP"; then
	as_fn_error $? "no acceptable egrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5
	fi
	else
	ac_cv_path_EGREP=$EGREP
	fi

	fi
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5
	$as_echo "$ac_cv_path_EGREP" >&6; }
	EGREP="$ac_cv_path_EGREP"


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ANSI C header files" >&5
	$as_echo_n "checking for ANSI C header files... " >&6; }
	if ${ac_cv_header_stdc+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <stdlib.h>
	#include <stdarg.h>
	#include <string.h>
	#include <float.h>

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_header_stdc=yes
	else
	ac_cv_header_stdc=no
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext

	if test $ac_cv_header_stdc = yes; then
	# SunOS 4.x string.h does not declare mem*, contrary to ANSI.
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <string.h>

	_ACEOF
	if (eval "$ac_cpp conftest.$ac_ext") 2>&5 \|
	$EGREP "memchr" >/dev/null 2>&1; then :

	else
	ac_cv_header_stdc=no
	fi
	rm -f conftest*

	fi

	if test $ac_cv_header_stdc = yes; then
	# ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI.
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <stdlib.h>

	_ACEOF
	if (eval "$ac_cpp conftest.$ac_ext") 2>&5 \|
	$EGREP "free" >/dev/null 2>&1; then :

	else
	ac_cv_header_stdc=no
	fi
	rm -f conftest*

	fi

	if test $ac_cv_header_stdc = yes; then
	# /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi.
	if test "$cross_compiling" = yes; then :
	:
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <ctype.h>
	#include <stdlib.h>
	#if ((' ' & 0x0FF) == 0x020)
	# define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
	# define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c))
	#else
	# define ISLOWER(c) \
	(('a' <= (c) && (c) <= 'i') \
	\|\| ('j' <= (c) && (c) <= 'r') \
	\|\| ('s' <= (c) && (c) <= 'z'))
	# define TOUPPER(c) (ISLOWER(c) ? ((c) \| 0x40) : (c))
	#endif

	#define XOR(e, f) (((e) && !(f)) \|\| (!(e) && (f)))
	int
	main ()
	{
	int i;
	for (i = 0; i < 256; i++)
	if (XOR (islower (i), ISLOWER (i))
	\|\| toupper (i) != TOUPPER (i))
	return 2;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_run "$LINENO"; then :

	else
	ac_cv_header_stdc=no
	fi
	rm -f core .core core.conftest. gmon.out bb.out conftest$ac_exeext \
	conftest.$ac_objext conftest.beam conftest.$ac_ext
	fi

	fi
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdc" >&5
	$as_echo "$ac_cv_header_stdc" >&6; }
	if test $ac_cv_header_stdc = yes; then

	$as_echo "#define STDC_HEADERS 1" >>confdefs.h

	fi

	# On IRIX 5.3, sys/types and inttypes.h are conflicting.
	for ac_header in sys/types.h sys/stat.h stdlib.h string.h memory.h strings.h \
	inttypes.h stdint.h unistd.h
	do :
	as_ac_Header=`$as_echo "ac_cv_header_$ac_header" \| $as_tr_sh`
	ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
	"
	if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
	cat >>confdefs.h <<_ACEOF
	#define `$as_echo "HAVE_$ac_header" \| $as_tr_cpp` 1
	_ACEOF

	fi

	done



	ac_fn_c_check_header_mongrel "$LINENO" "minix/config.h" "ac_cv_header_minix_config_h" "$ac_includes_default"
	if test "x$ac_cv_header_minix_config_h" = xyes; then :
	MINIX=yes
	else
	MINIX=
	fi


	if test "$MINIX" = yes; then

	$as_echo "#define _POSIX_SOURCE 1" >>confdefs.h


	$as_echo "#define _POSIX_1_SOURCE 2" >>confdefs.h


	$as_echo "#define _MINIX 1" >>confdefs.h

	fi


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether it is safe to define __EXTENSIONS__" >&5
	$as_echo_n "checking whether it is safe to define __EXTENSIONS__... " >&6; }
	if ${ac_cv_safe_to_define___extensions__+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	# define __EXTENSIONS__ 1
	$ac_includes_default
	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_safe_to_define___extensions__=yes
	else
	ac_cv_safe_to_define___extensions__=no
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_safe_to_define___extensions__" >&5
	$as_echo "$ac_cv_safe_to_define___extensions__" >&6; }
	test $ac_cv_safe_to_define___extensions__ = yes &&
	$as_echo "#define __EXTENSIONS__ 1" >>confdefs.h

	$as_echo "#define _ALL_SOURCE 1" >>confdefs.h

	$as_echo "#define _GNU_SOURCE 1" >>confdefs.h

	$as_echo "#define _POSIX_PTHREAD_SEMANTICS 1" >>confdefs.h

	$as_echo "#define _TANDEM_SOURCE 1" >>confdefs.h



	if test "$ac_cv_header_minix_config_h" = "yes"; then

	$as_echo "#define _NETBSD_SOURCE 1" >>confdefs.h

	fi

	case "$prefix" in
	NONE)
	prefix="/usr/local"
	;;
	esac
	case "$exec_prefix" in
	NONE)
	exec_prefix="$prefix"
	;;
	esac

	# are we on MinGW?
	if uname -s 2>&1 \| grep MINGW32 >/dev/null; then on_mingw="yes"
	else
	if echo $host $target \| grep mingw32 >/dev/null; then on_mingw="yes"
	else on_mingw="no"; fi
	fi

	#
	# Determine configuration file
	# the eval is to evaluate shell expansion twice
	UNBOUND_SBIN_DIR=`eval echo "${sbindir}"`

	UNBOUND_SYSCONF_DIR=`eval echo "${sysconfdir}"`

	UNBOUND_LOCALSTATE_DIR=`eval echo "${localstatedir}"`

	if test $on_mingw = "no"; then
	ub_conf_file=`eval echo "${sysconfdir}/unbound/unbound.conf"`
	else
	ub_conf_file="C:\\Program Files\\Unbound\\service.conf"
	fi

	# Check whether --with-conf_file was given.
	if test "${with_conf_file+set}" = set; then :
	withval=$with_conf_file; ub_conf_file="$withval"
	fi


	hdr_config="`echo $ub_conf_file \| sed -e 's/\\\\/\\\\\\\\/g'`"


	cat >>confdefs.h <<_ACEOF
	#define CONFIGFILE "$hdr_config"
	_ACEOF

	ub_conf_dir=`$as_dirname -- "$ub_conf_file" \|\|
	$as_expr X"$ub_conf_file" : 'X$.[^/]$//[^/][^/]/$' \\| \
	X"$ub_conf_file" : 'X$//$[^/]' \\| \
	X"$ub_conf_file" : 'X$//$$' \\| \
	X"$ub_conf_file" : 'X$/$' \\| . 2>/dev/null \|\|
	$as_echo X"$ub_conf_file" \|
	sed '/^X$.[^/]$\/\/[^/][^/]\/$/{
	s//\1/
	q
	}
	/^X$\/\/$[^/].*/{
	s//\1/
	q
	}
	/^X$\/\/$$/{
	s//\1/
	q
	}
	/^X$\/$.*/{
	s//\1/
	q
	}
	s/.*/./; q'`


	# Determine run, chroot directory and pidfile locations

	# Check whether --with-run-dir was given.
	if test "${with_run_dir+set}" = set; then :
	withval=$with_run_dir; UNBOUND_RUN_DIR="$withval"
	else
	if test $on_mingw = no; then
	UNBOUND_RUN_DIR=`dirname "$ub_conf_file"`
	else
	UNBOUND_RUN_DIR=""
	fi

	fi


	hdr_run="`echo $UNBOUND_RUN_DIR \| sed -e 's/\\\\/\\\\\\\\/g'`"


	cat >>confdefs.h <<_ACEOF
	#define RUN_DIR "$hdr_run"
	_ACEOF



	# Check whether --with-chroot-dir was given.
	if test "${with_chroot_dir+set}" = set; then :
	withval=$with_chroot_dir; UNBOUND_CHROOT_DIR="$withval"
	else
	if test $on_mingw = no; then
	UNBOUND_CHROOT_DIR="$UNBOUND_RUN_DIR"
	else
	UNBOUND_CHROOT_DIR=""
	fi

	fi


	hdr_chroot="`echo $UNBOUND_CHROOT_DIR \| sed -e 's/\\\\/\\\\\\\\/g'`"


	cat >>confdefs.h <<_ACEOF
	#define CHROOT_DIR "$hdr_chroot"
	_ACEOF



	# Check whether --with-share-dir was given.
	if test "${with_share_dir+set}" = set; then :
	withval=$with_share_dir; UNBOUND_SHARE_DIR="$withval"
	else
	UNBOUND_SHARE_DIR="$UNBOUND_RUN_DIR"
	fi



	cat >>confdefs.h <<_ACEOF
	#define SHARE_DIR "$UNBOUND_SHARE_DIR"
	_ACEOF



	# Check whether --with-pidfile was given.
	if test "${with_pidfile+set}" = set; then :
	withval=$with_pidfile; UNBOUND_PIDFILE="$withval"
	else
	if test $on_mingw = no; then
	UNBOUND_PIDFILE="$UNBOUND_RUN_DIR/unbound.pid"
	else
	UNBOUND_PIDFILE=""
	fi

	fi


	hdr_pid="`echo $UNBOUND_PIDFILE \| sed -e 's/\\\\/\\\\\\\\/g'`"


	cat >>confdefs.h <<_ACEOF
	#define PIDFILE "$hdr_pid"
	_ACEOF



	# Check whether --with-rootkey-file was given.
	if test "${with_rootkey_file+set}" = set; then :
	withval=$with_rootkey_file; UNBOUND_ROOTKEY_FILE="$withval"
	else
	if test $on_mingw = no; then
	UNBOUND_ROOTKEY_FILE="$UNBOUND_RUN_DIR/root.key"
	else
	UNBOUND_ROOTKEY_FILE="C:\\Program Files\\Unbound\\root.key"
	fi

	fi


	hdr_rkey="`echo $UNBOUND_ROOTKEY_FILE \| sed -e 's/\\\\/\\\\\\\\/g'`"


	cat >>confdefs.h <<_ACEOF
	#define ROOT_ANCHOR_FILE "$hdr_rkey"
	_ACEOF



	# Check whether --with-rootcert-file was given.
	if test "${with_rootcert_file+set}" = set; then :
	withval=$with_rootcert_file; UNBOUND_ROOTCERT_FILE="$withval"
	else
	if test $on_mingw = no; then
	UNBOUND_ROOTCERT_FILE="$UNBOUND_RUN_DIR/icannbundle.pem"
	else
	UNBOUND_ROOTCERT_FILE="C:\\Program Files\\Unbound\\icannbundle.pem"
	fi

	fi


	hdr_rpem="`echo $UNBOUND_ROOTCERT_FILE \| sed -e 's/\\\\/\\\\\\\\/g'`"


	cat >>confdefs.h <<_ACEOF
	#define ROOT_CERT_FILE "$hdr_rpem"
	_ACEOF



	# Check whether --with-username was given.
	if test "${with_username+set}" = set; then :
	withval=$with_username; UNBOUND_USERNAME="$withval"
	else
	UNBOUND_USERNAME="unbound"
	fi



	cat >>confdefs.h <<_ACEOF
	#define UB_USERNAME "$UNBOUND_USERNAME"
	_ACEOF



	$as_echo "#define WINVER 0x0502" >>confdefs.h

	wnvs=`echo $PACKAGE_VERSION \| sed -e 's/^[^0-9]$[0-9][0-9]$[^0-9][^0-9]$[0-9][0-9]$[^0-9][^0-9]$[0-9][0-9]$[^0-9][^0-9]$[0-9][0-9]$.$/\1,\2,\3,\4/' -e 's/^[^0-9]$[0-9][0-9]$[^0-9][^0-9]$[0-9][0-9]$[^0-9][^0-9]$[0-9][0-9]$[^0-9]$/\1,\2,\3,0/' `


	cat >>confdefs.h <<_ACEOF
	#define RSRC_PACKAGE_VERSION $wnvs
	_ACEOF


	# Checks for typedefs, structures, and compiler characteristics.
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for an ANSI C-conforming const" >&5
	$as_echo_n "checking for an ANSI C-conforming const... " >&6; }
	if ${ac_cv_c_const+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	#ifndef __cplusplus
	/* Ultrix mips cc rejects this sort of thing. */
	typedef int charset[2];
	const charset cs = { 0, 0 };
	/* SunOS 4.1.1 cc rejects this. */
	char const const pcpcc;
	char **ppc;
	/* NEC SVR4.0.2 mips cc rejects this. */
	struct point {int x, y;};
	static struct point const zero = {0,0};
	/* AIX XL C 1.02.0.0 rejects this.
	It does not let you subtract one const X* pointer from another in
	an arm of an if-expression whose if-part is not a constant
	expression */
	const char *g = "string";
	pcpcc = &g + (g ? g-g : 0);
	/* HPUX 7.0 cc rejects these. */
	++pcpcc;
	ppc = (char**) pcpcc;
	pcpcc = (char const const ) ppc;
	{ /* SCO 3.2v4 cc rejects this sort of thing. */
	char tx;
	char *t = &tx;
	char const s = 0 ? (char ) 0 : (char const *) 0;

	*t++ = 0;
	if (s) return 0;
	}
	{ /* Someone thinks the Sun supposedly-ANSI compiler will reject this. */
	int x[] = {25, 17};
	const int *foo = &x[0];
	++foo;
	}
	{ /* Sun SC1.0 ANSI compiler rejects this -- but not the above. */
	typedef const int *iptr;
	iptr p = 0;
	++p;
	}
	{ /* AIX XL C 1.02.0.0 rejects this sort of thing, saying
	"k.c", line 2.27: 1506-025 (S) Operand must be a modifiable lvalue. */
	struct s { int j; const int *ap[3]; } bx;
	struct s *b = &bx; b->j = 5;
	}
	{ /* ULTRIX-32 V3.1 (Rev 9) vcc rejects this */
	const int foo = 10;
	if (!foo) return 0;
	}
	return !cs[0] && !zero.x;
	#endif

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_c_const=yes
	else
	ac_cv_c_const=no
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_const" >&5
	$as_echo "$ac_cv_c_const" >&6; }
	if test $ac_cv_c_const = no; then

	$as_echo "#define const /**/" >>confdefs.h

	fi

	ac_ext=c
	ac_cpp='$CPP $CPPFLAGS'
	ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
	ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
	ac_compiler_gnu=$ac_cv_c_compiler_gnu

	# allow user to override the -g -O2 flags.
	default_cflags=no
	if test "x$CFLAGS" = "x" ; then


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -g" >&5
	$as_echo_n "checking whether $CC supports -g... " >&6; }
	cache=`echo g \| sed 'y%.=/+-%___p_%'`
	if eval \${cv_prog_cc_flag_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo 'void f(void){}' >conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS -g -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_$cache=yes"
	else
	eval "cv_prog_cc_flag_$cache=no"
	fi
	rm -f conftest conftest.o conftest.c

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	CFLAGS="$CFLAGS -g"
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	:

	fi



	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -O2" >&5
	$as_echo_n "checking whether $CC supports -O2... " >&6; }
	cache=`echo O2 \| sed 'y%.=/+-%___p_%'`
	if eval \${cv_prog_cc_flag_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo 'void f(void){}' >conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS -O2 -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_$cache=yes"
	else
	eval "cv_prog_cc_flag_$cache=no"
	fi
	rm -f conftest conftest.o conftest.c

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	CFLAGS="$CFLAGS -O2"
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	:

	fi

	default_cflags=yes
	fi
	ac_ext=c
	ac_cpp='$CPP $CPPFLAGS'
	ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
	ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
	ac_compiler_gnu=$ac_cv_c_compiler_gnu
	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}gcc", so it can be a program name with args.
	set dummy ${ac_tool_prefix}gcc; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_CC+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$CC"; then
	ac_cv_prog_CC="$CC" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_CC="${ac_tool_prefix}gcc"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	CC=$ac_cv_prog_CC
	if test -n "$CC"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
	$as_echo "$CC" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$ac_cv_prog_CC"; then
	ac_ct_CC=$CC
	# Extract the first word of "gcc", so it can be a program name with args.
	set dummy gcc; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_CC+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_CC"; then
	ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_CC="gcc"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_CC=$ac_cv_prog_ac_ct_CC
	if test -n "$ac_ct_CC"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
	$as_echo "$ac_ct_CC" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi

	if test "x$ac_ct_CC" = x; then
	CC=""
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	CC=$ac_ct_CC
	fi
	else
	CC="$ac_cv_prog_CC"
	fi

	if test -z "$CC"; then
	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}cc", so it can be a program name with args.
	set dummy ${ac_tool_prefix}cc; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_CC+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$CC"; then
	ac_cv_prog_CC="$CC" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_CC="${ac_tool_prefix}cc"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	CC=$ac_cv_prog_CC
	if test -n "$CC"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
	$as_echo "$CC" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	fi
	if test -z "$CC"; then
	# Extract the first word of "cc", so it can be a program name with args.
	set dummy cc; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_CC+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$CC"; then
	ac_cv_prog_CC="$CC" # Let the user override the test.
	else
	ac_prog_rejected=no
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	if test "$as_dir/$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then
	ac_prog_rejected=yes
	continue
	fi
	ac_cv_prog_CC="cc"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	if test $ac_prog_rejected = yes; then
	# We found a bogon in the path, so make sure we never use it.
	set dummy $ac_cv_prog_CC
	shift
	if test $# != 0; then
	# We chose a different compiler from the bogus one.
	# However, it has the same basename, so the bogon will be chosen
	# first if we set CC to just the basename; use the full file name.
	shift
	ac_cv_prog_CC="$as_dir/$ac_word${1+' '}$@"
	fi
	fi
	fi
	fi
	CC=$ac_cv_prog_CC
	if test -n "$CC"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
	$as_echo "$CC" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$CC"; then
	if test -n "$ac_tool_prefix"; then
	for ac_prog in cl.exe
	do
	# Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args.
	set dummy $ac_tool_prefix$ac_prog; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_CC+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$CC"; then
	ac_cv_prog_CC="$CC" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_CC="$ac_tool_prefix$ac_prog"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	CC=$ac_cv_prog_CC
	if test -n "$CC"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
	$as_echo "$CC" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	test -n "$CC" && break
	done
	fi
	if test -z "$CC"; then
	ac_ct_CC=$CC
	for ac_prog in cl.exe
	do
	# Extract the first word of "$ac_prog", so it can be a program name with args.
	set dummy $ac_prog; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_CC+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_CC"; then
	ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_CC="$ac_prog"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_CC=$ac_cv_prog_ac_ct_CC
	if test -n "$ac_ct_CC"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
	$as_echo "$ac_ct_CC" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	test -n "$ac_ct_CC" && break
	done

	if test "x$ac_ct_CC" = x; then
	CC=""
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	CC=$ac_ct_CC
	fi
	fi

	fi


	test -z "$CC" && { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
	$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
	as_fn_error $? "no acceptable C compiler found in \$PATH
	See \`config.log' for more details" "$LINENO" 5; }

	# Provide some information about the compiler.
	$as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5
	set X $ac_compile
	ac_compiler=$2
	for ac_option in --version -v -V -qversion; do
	{ { ac_try="$ac_compiler $ac_option >&5"
	case "(($ac_try" in
	\" \| \` \| \\) ac_try_echo=\$ac_try;;
	*) ac_try_echo=$ac_try;;
	esac
	eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
	$as_echo "$ac_try_echo"; } >&5
	(eval "$ac_compiler $ac_option >&5") 2>conftest.err
	ac_status=$?
	if test -s conftest.err; then
	sed '10a\
	... rest of stderr output deleted ...
	10q' conftest.err >conftest.er1
	cat conftest.er1 >&5
	fi
	rm -f conftest.er1 conftest.err
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }
	done

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using the GNU C compiler" >&5
	$as_echo_n "checking whether we are using the GNU C compiler... " >&6; }
	if ${ac_cv_c_compiler_gnu+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{
	#ifndef __GNUC__
	choke me
	#endif

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_compiler_gnu=yes
	else
	ac_compiler_gnu=no
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	ac_cv_c_compiler_gnu=$ac_compiler_gnu

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5
	$as_echo "$ac_cv_c_compiler_gnu" >&6; }
	if test $ac_compiler_gnu = yes; then
	GCC=yes
	else
	GCC=
	fi
	ac_test_CFLAGS=${CFLAGS+set}
	ac_save_CFLAGS=$CFLAGS
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5
	$as_echo_n "checking whether $CC accepts -g... " >&6; }
	if ${ac_cv_prog_cc_g+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_save_c_werror_flag=$ac_c_werror_flag
	ac_c_werror_flag=yes
	ac_cv_prog_cc_g=no
	CFLAGS="-g"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_prog_cc_g=yes
	else
	CFLAGS=""
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :

	else
	ac_c_werror_flag=$ac_save_c_werror_flag
	CFLAGS="-g"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_prog_cc_g=yes
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	ac_c_werror_flag=$ac_save_c_werror_flag
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5
	$as_echo "$ac_cv_prog_cc_g" >&6; }
	if test "$ac_test_CFLAGS" = set; then
	CFLAGS=$ac_save_CFLAGS
	elif test $ac_cv_prog_cc_g = yes; then
	if test "$GCC" = yes; then
	CFLAGS="-g -O2"
	else
	CFLAGS="-g"
	fi
	else
	if test "$GCC" = yes; then
	CFLAGS="-O2"
	else
	CFLAGS=
	fi
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C89" >&5
	$as_echo_n "checking for $CC option to accept ISO C89... " >&6; }
	if ${ac_cv_prog_cc_c89+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_cv_prog_cc_c89=no
	ac_save_CC=$CC
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <stdarg.h>
	#include <stdio.h>
	struct stat;
	/* Most of the following tests are stolen from RCS 5.7's src/conf.sh. */
	struct buf { int x; };
	FILE * (rcsopen) (struct buf , struct stat *, int);
	static char *e (p, i)
	char **p;
	int i;
	{
	return p[i];
	}
	static char f (char (g) (char , int), char *p, ...)
	{
	char *s;
	va_list v;
	va_start (v,p);
	s = g (p, va_arg (v,int));
	va_end (v);
	return s;
	}

	/* OSF 4.0 Compaq cc is some sort of almost-ANSI by default. It has
	function prototypes and stuff, but not '\xHH' hex character constants.
	These don't provoke an error unfortunately, instead are silently treated
	as 'x'. The following induces an error, until -std is added to get
	proper ANSI mode. Curiously '\x00'!='x' always comes out true, for an
	array size at least. It's necessary to write '\x00'==0 to get something
	that's true only with -std. */
	int osf4_cc_array ['\x00' == 0 ? 1 : -1];

	/* IBM C 6 for AIX is almost-ANSI by default, but it replaces macro parameters
	inside strings and character constants. */
	#define FOO(x) 'x'
	int xlc6_cc_array[FOO(a) == 'x' ? 1 : -1];

	int test (int i, double x);
	struct s1 {int (*f) (int a);};
	struct s2 {int (*f) (double a);};
	int pairnames (int, char *, FILE ()(struct buf , struct stat *, int), int, int);
	int argc;
	char **argv;
	int
	main ()
	{
	return f (e, argv, 0) != argv[0] \|\| f (e, argv, 1) != argv[1];
	;
	return 0;
	}
	_ACEOF
	for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std \
	-Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__"
	do
	CC="$ac_save_CC $ac_arg"
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_prog_cc_c89=$ac_arg
	fi
	rm -f core conftest.err conftest.$ac_objext
	test "x$ac_cv_prog_cc_c89" != "xno" && break
	done
	rm -f conftest.$ac_ext
	CC=$ac_save_CC

	fi
	# AC_CACHE_VAL
	case "x$ac_cv_prog_cc_c89" in
	x)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
	$as_echo "none needed" >&6; } ;;
	xno)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
	$as_echo "unsupported" >&6; } ;;
	*)
	CC="$CC $ac_cv_prog_cc_c89"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5
	$as_echo "$ac_cv_prog_cc_c89" >&6; } ;;
	esac
	if test "x$ac_cv_prog_cc_c89" != xno; then :

	fi

	ac_ext=c
	ac_cpp='$CPP $CPPFLAGS'
	ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
	ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
	ac_compiler_gnu=$ac_cv_c_compiler_gnu


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $CC dependency flag" >&5
	$as_echo_n "checking $CC dependency flag... " >&6; }
	echo 'void f(){}' >conftest.c
	if test "`$CC -MM conftest.c 2>&1`" = "conftest.o: conftest.c"; then
	DEPFLAG="-MM"
	else
	if test "`$CC -xM1 conftest.c 2>&1`" = "conftest.o: conftest.c"; then
	DEPFLAG="-xM1"
	else
	DEPFLAG="-MM" # dunno do something
	fi
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $DEPFLAG" >&5
	$as_echo "$DEPFLAG" >&6; }
	rm -f conftest.c





	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Werror" >&5
	$as_echo_n "checking whether $CC supports -Werror... " >&6; }
	cache=`echo Werror \| sed 'y%.=/+-%___p_%'`
	if eval \${cv_prog_cc_flag_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo 'void f(void){}' >conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS -Werror -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_$cache=yes"
	else
	eval "cv_prog_cc_flag_$cache=no"
	fi
	rm -f conftest conftest.o conftest.c

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	ERRFLAG="-Werror"
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	:
	ERRFLAG="-errwarn"
	fi



	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wall" >&5
	$as_echo_n "checking whether $CC supports -Wall... " >&6; }
	cache=`echo Wall \| sed 'y%.=/+-%___p_%'`
	if eval \${cv_prog_cc_flag_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo 'void f(void){}' >conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS -Wall -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_$cache=yes"
	else
	eval "cv_prog_cc_flag_$cache=no"
	fi
	rm -f conftest conftest.o conftest.c

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	ERRFLAG="$ERRFLAG -Wall"
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	:
	ERRFLAG="$ERRFLAG -errfmt"
	fi





	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -std=c99" >&5
	$as_echo_n "checking whether $CC supports -std=c99... " >&6; }
	cache=`echo std=c99 \| sed 'y%.=/+-%___p_%'`
	if eval \${cv_prog_cc_flag_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo 'void f(void){}' >conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS -std=c99 -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_$cache=yes"
	else
	eval "cv_prog_cc_flag_$cache=no"
	fi
	rm -f conftest conftest.o conftest.c

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	C99FLAG="-std=c99"
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	:

	fi



	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -xc99" >&5
	$as_echo_n "checking whether $CC supports -xc99... " >&6; }
	cache=`echo xc99 \| sed 'y%.=/+-%___p_%'`
	if eval \${cv_prog_cc_flag_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo 'void f(void){}' >conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS -xc99 -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_$cache=yes"
	else
	eval "cv_prog_cc_flag_$cache=no"
	fi
	rm -f conftest conftest.o conftest.c

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	C99FLAG="-xc99"
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	:

	fi


	for ac_header in getopt.h time.h
	do :
	as_ac_Header=`$as_echo "ac_cv_header_$ac_header" \| $as_tr_sh`
	ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
	"
	if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
	cat >>confdefs.h <<_ACEOF
	#define `$as_echo "HAVE_$ac_header" \| $as_tr_cpp` 1
	_ACEOF

	fi

	done





	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE as a flag for $CC" >&5
	$as_echo_n "checking whether we need $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE as a flag for $CC... " >&6; }
	cache=`$as_echo "$C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE" \| $as_tr_sh`
	if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo '
	#include "confdefs.h"
	#include <stdlib.h>
	#include <ctype.h>
	#include <sys/time.h>
	#ifdef HAVE_TIME_H
	#include <time.h>
	#endif
	#include <unistd.h>
	#include <netdb.h>
	#ifdef HAVE_GETOPT_H
	#include <getopt.h>
	#endif

	int test() {
	int a;
	char **opts = NULL;
	struct timeval tv;
	char *t;
	time_t time = 0;
	char *buf = NULL;
	const char* str = NULL;
	struct msghdr msg;
	msg.msg_control = 0;
	t = ctime_r(&time, buf);
	tv.tv_usec = 10;
	srandom(32);
	a = getopt(2, opts, "a");
	a = isascii(32);
	str = gai_strerror(0);
	if(str && t && tv.tv_usec && msg.msg_control)
	a = 0;
	return a;
	}
	' > conftest.c
	echo 'void f(){}' >>conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=no"
	else

	if test -z "`$CC $CPPFLAGS $CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=yes"
	else
	eval "cv_prog_cc_flag_needed_$cache=fail"
	#echo 'Test with flag fails too!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	fi

	fi
	rm -f conftest conftest.c conftest.o

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE"
	else
	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	#echo 'Test with flag is no!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	:

	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
	$as_echo "failed" >&6; }
	:

	fi
	fi





	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE as a flag for $CC" >&5
	$as_echo_n "checking whether we need $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE as a flag for $CC... " >&6; }
	cache=`$as_echo "$C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE" \| $as_tr_sh`
	if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo '
	#include "confdefs.h"
	#include <stdlib.h>
	#include <ctype.h>
	#include <sys/time.h>
	#ifdef HAVE_TIME_H
	#include <time.h>
	#endif
	#include <unistd.h>
	#include <netdb.h>
	#ifdef HAVE_GETOPT_H
	#include <getopt.h>
	#endif

	int test() {
	int a;
	char **opts = NULL;
	struct timeval tv;
	char *t;
	time_t time = 0;
	char *buf = NULL;
	const char* str = NULL;
	struct msghdr msg;
	msg.msg_control = 0;
	t = ctime_r(&time, buf);
	tv.tv_usec = 10;
	srandom(32);
	a = getopt(2, opts, "a");
	a = isascii(32);
	str = gai_strerror(0);
	if(str && t && tv.tv_usec && msg.msg_control)
	a = 0;
	return a;
	}
	' > conftest.c
	echo 'void f(){}' >>conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=no"
	else

	if test -z "`$CC $CPPFLAGS $CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=yes"
	else
	eval "cv_prog_cc_flag_needed_$cache=fail"
	#echo 'Test with flag fails too!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	fi

	fi
	rm -f conftest conftest.c conftest.o

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE"
	else
	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	#echo 'Test with flag is no!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	:

	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
	$as_echo "failed" >&6; }
	:

	fi
	fi





	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need $C99FLAG as a flag for $CC" >&5
	$as_echo_n "checking whether we need $C99FLAG as a flag for $CC... " >&6; }
	cache=`$as_echo "$C99FLAG" \| $as_tr_sh`
	if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo '
	#include <stdbool.h>
	#include <ctype.h>
	int test() {
	int a = 0;
	return a;
	}
	' > conftest.c
	echo 'void f(){}' >>conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=no"
	else

	if test -z "`$CC $CPPFLAGS $CFLAGS $C99FLAG $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=yes"
	else
	eval "cv_prog_cc_flag_needed_$cache=fail"
	#echo 'Test with flag fails too!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS $C99FLAG $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS $C99FLAG $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	fi

	fi
	rm -f conftest conftest.c conftest.o

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	CFLAGS="$CFLAGS $C99FLAG"
	else
	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	#echo 'Test with flag is no!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS $C99FLAG $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS $C99FLAG $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	:

	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
	$as_echo "failed" >&6; }
	:

	fi
	fi





	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need -D_BSD_SOURCE -D_DEFAULT_SOURCE as a flag for $CC" >&5
	$as_echo_n "checking whether we need -D_BSD_SOURCE -D_DEFAULT_SOURCE as a flag for $CC... " >&6; }
	cache=_D_BSD_SOURCE__D_DEFAULT_SOURCE
	if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo '
	#include <ctype.h>

	int test() {
	int a;
	a = isascii(32);
	return a;
	}
	' > conftest.c
	echo 'void f(){}' >>conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=no"
	else

	if test -z "`$CC $CPPFLAGS $CFLAGS -D_BSD_SOURCE -D_DEFAULT_SOURCE $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=yes"
	else
	eval "cv_prog_cc_flag_needed_$cache=fail"
	#echo 'Test with flag fails too!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS -D_BSD_SOURCE -D_DEFAULT_SOURCE $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS -D_BSD_SOURCE -D_DEFAULT_SOURCE $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	fi

	fi
	rm -f conftest conftest.c conftest.o

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	CFLAGS="$CFLAGS -D_BSD_SOURCE -D_DEFAULT_SOURCE"
	else
	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	#echo 'Test with flag is no!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS -D_BSD_SOURCE -D_DEFAULT_SOURCE $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS -D_BSD_SOURCE -D_DEFAULT_SOURCE $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	:

	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
	$as_echo "failed" >&6; }
	:

	fi
	fi





	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need -D_GNU_SOURCE as a flag for $CC" >&5
	$as_echo_n "checking whether we need -D_GNU_SOURCE as a flag for $CC... " >&6; }
	cache=_D_GNU_SOURCE
	if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo '
	#include <netinet/in.h>

	int test() {
	struct in6_pktinfo inf;
	int a = (int)sizeof(inf);
	return a;
	}
	' > conftest.c
	echo 'void f(){}' >>conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=no"
	else

	if test -z "`$CC $CPPFLAGS $CFLAGS -D_GNU_SOURCE $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=yes"
	else
	eval "cv_prog_cc_flag_needed_$cache=fail"
	#echo 'Test with flag fails too!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS -D_GNU_SOURCE $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS -D_GNU_SOURCE $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	fi

	fi
	rm -f conftest conftest.c conftest.o

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	CFLAGS="$CFLAGS -D_GNU_SOURCE"
	else
	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	#echo 'Test with flag is no!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS -D_GNU_SOURCE $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS -D_GNU_SOURCE $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	:

	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
	$as_echo "failed" >&6; }
	:

	fi
	fi


	# check again for GNU_SOURCE for setresgid. May fail if setresgid
	# is not available at all. -D_FRSRESGID is to make this check unique.
	# otherwise we would get the previous cached result.



	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need -D_GNU_SOURCE -D_FRSRESGID as a flag for $CC" >&5
	$as_echo_n "checking whether we need -D_GNU_SOURCE -D_FRSRESGID as a flag for $CC... " >&6; }
	cache=_D_GNU_SOURCE__D_FRSRESGID
	if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo '
	#include <unistd.h>

	int test() {
	int a = setresgid(0,0,0);
	a = setresuid(0,0,0);
	return a;
	}
	' > conftest.c
	echo 'void f(){}' >>conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=no"
	else

	if test -z "`$CC $CPPFLAGS $CFLAGS -D_GNU_SOURCE -D_FRSRESGID $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=yes"
	else
	eval "cv_prog_cc_flag_needed_$cache=fail"
	#echo 'Test with flag fails too!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS -D_GNU_SOURCE -D_FRSRESGID $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS -D_GNU_SOURCE -D_FRSRESGID $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	fi

	fi
	rm -f conftest conftest.c conftest.o

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	CFLAGS="$CFLAGS -D_GNU_SOURCE"
	else
	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	#echo 'Test with flag is no!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS -D_GNU_SOURCE -D_FRSRESGID $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS -D_GNU_SOURCE -D_FRSRESGID $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	:

	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
	$as_echo "failed" >&6; }
	:

	fi
	fi





	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need -D_POSIX_C_SOURCE=200112 as a flag for $CC" >&5
	$as_echo_n "checking whether we need -D_POSIX_C_SOURCE=200112 as a flag for $CC... " >&6; }
	cache=_D_POSIX_C_SOURCE_200112
	if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo '
	#include "confdefs.h"
	#ifdef HAVE_TIME_H
	#include <time.h>
	#endif
	#include <netdb.h>

	int test() {
	int a = 0;
	char *t;
	time_t time = 0;
	char *buf = NULL;
	const char* str = NULL;
	t = ctime_r(&time, buf);
	str = gai_strerror(0);
	if(t && str)
	a = 0;
	return a;
	}
	' > conftest.c
	echo 'void f(){}' >>conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=no"
	else

	if test -z "`$CC $CPPFLAGS $CFLAGS -D_POSIX_C_SOURCE=200112 $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=yes"
	else
	eval "cv_prog_cc_flag_needed_$cache=fail"
	#echo 'Test with flag fails too!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS -D_POSIX_C_SOURCE=200112 $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS -D_POSIX_C_SOURCE=200112 $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	fi

	fi
	rm -f conftest conftest.c conftest.o

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	CFLAGS="$CFLAGS -D_POSIX_C_SOURCE=200112"
	else
	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	#echo 'Test with flag is no!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS -D_POSIX_C_SOURCE=200112 $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS -D_POSIX_C_SOURCE=200112 $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	:

	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
	$as_echo "failed" >&6; }
	:

	fi
	fi





	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need -D__EXTENSIONS__ as a flag for $CC" >&5
	$as_echo_n "checking whether we need -D__EXTENSIONS__ as a flag for $CC... " >&6; }
	cache=_D__EXTENSIONS__
	if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo '
	#include "confdefs.h"
	#include <stdlib.h>
	#include <ctype.h>
	#include <sys/time.h>
	#ifdef HAVE_TIME_H
	#include <time.h>
	#endif
	#include <unistd.h>
	#ifdef HAVE_GETOPT_H
	#include <getopt.h>
	#endif

	int test() {
	int a;
	char **opts = NULL;
	struct timeval tv;
	tv.tv_usec = 10;
	srandom(32);
	a = getopt(2, opts, "a");
	a = isascii(32);
	if(tv.tv_usec)
	a = 0;
	return a;
	}
	' > conftest.c
	echo 'void f(){}' >>conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=no"
	else

	if test -z "`$CC $CPPFLAGS $CFLAGS -D__EXTENSIONS__ $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=yes"
	else
	eval "cv_prog_cc_flag_needed_$cache=fail"
	#echo 'Test with flag fails too!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS -D__EXTENSIONS__ $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS -D__EXTENSIONS__ $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	fi

	fi
	rm -f conftest conftest.c conftest.o

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	CFLAGS="$CFLAGS -D__EXTENSIONS__"
	else
	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	#echo 'Test with flag is no!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS -D__EXTENSIONS__ $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS -D__EXTENSIONS__ $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	:

	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
	$as_echo "failed" >&6; }
	:

	fi
	fi




	# debug mode flags warnings
	# Check whether --enable-checking was given.
	if test "${enable_checking+set}" = set; then :
	enableval=$enable_checking;
	fi

	# Check whether --enable-debug was given.
	if test "${enable_debug+set}" = set; then :
	enableval=$enable_debug;
	fi

	if test "$enable_debug" = "yes"; then debug_enabled="$enable_debug";
	else debug_enabled="$enable_checking"; fi

	case "$debug_enabled" in
	yes)


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -W" >&5
	$as_echo_n "checking whether $CC supports -W... " >&6; }
	cache=`echo W \| sed 'y%.=/+-%___p_%'`
	if eval \${cv_prog_cc_flag_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo 'void f(void){}' >conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS -W -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_$cache=yes"
	else
	eval "cv_prog_cc_flag_$cache=no"
	fi
	rm -f conftest conftest.o conftest.c

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	CFLAGS="$CFLAGS -W"
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	:

	fi



	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wall" >&5
	$as_echo_n "checking whether $CC supports -Wall... " >&6; }
	cache=`echo Wall \| sed 'y%.=/+-%___p_%'`
	if eval \${cv_prog_cc_flag_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo 'void f(void){}' >conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS -Wall -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_$cache=yes"
	else
	eval "cv_prog_cc_flag_$cache=no"
	fi
	rm -f conftest conftest.o conftest.c

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	CFLAGS="$CFLAGS -Wall"
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	:

	fi



	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wextra" >&5
	$as_echo_n "checking whether $CC supports -Wextra... " >&6; }
	cache=`echo Wextra \| sed 'y%.=/+-%___p_%'`
	if eval \${cv_prog_cc_flag_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo 'void f(void){}' >conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS -Wextra -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_$cache=yes"
	else
	eval "cv_prog_cc_flag_$cache=no"
	fi
	rm -f conftest conftest.o conftest.c

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	CFLAGS="$CFLAGS -Wextra"
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	:

	fi



	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wdeclaration-after-statement" >&5
	$as_echo_n "checking whether $CC supports -Wdeclaration-after-statement... " >&6; }
	cache=`echo Wdeclaration-after-statement \| sed 'y%.=/+-%___p_%'`
	if eval \${cv_prog_cc_flag_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo 'void f(void){}' >conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS -Wdeclaration-after-statement -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_$cache=yes"
	else
	eval "cv_prog_cc_flag_$cache=no"
	fi
	rm -f conftest conftest.o conftest.c

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	CFLAGS="$CFLAGS -Wdeclaration-after-statement"
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	:

	fi


	$as_echo "#define UNBOUND_DEBUG /**/" >>confdefs.h

	;;
	no\|*)
	# nothing to do.
	;;
	esac
	if test "$default_cflags" = "yes"; then
	# only when CFLAGS was "" at the start, if the users wants to
	# override we shouldn't add default cflags, because they wouldn't
	# be able to turn off these options and set the CFLAGS wanted.

	# Check whether --enable-flto was given.
	if test "${enable_flto+set}" = set; then :
	enableval=$enable_flto;
	fi

	if test "x$enable_flto" != "xno"; then :

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports -flto" >&5
	$as_echo_n "checking if $CC supports -flto... " >&6; }
	BAKCFLAGS="$CFLAGS"
	CFLAGS="$CFLAGS -flto"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :

	if $CC $CFLAGS -o conftest conftest.c 2>&1 \| $GREP -e "warning: no debug symbols in executable" -e "warning: object" >/dev/null; then
	CFLAGS="$BAKCFLAGS"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	fi
	rm -f conftest conftest.c conftest.o

	else
	CFLAGS="$BAKCFLAGS" ; { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext

	fi


	# Check whether --enable-pie was given.
	if test "${enable_pie+set}" = set; then :
	enableval=$enable_pie;
	fi

	if test "x$enable_pie" = "xyes"; then :

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports PIE" >&5
	$as_echo_n "checking if $CC supports PIE... " >&6; }
	BAKLDFLAGS="$LDFLAGS"
	BAKCFLAGS="$CFLAGS"
	LDFLAGS="$LDFLAGS -pie"
	CFLAGS="$CFLAGS -fPIE"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :

	if $CC $CFLAGS $LDFLAGS -o conftest conftest.c 2>&1 \| grep "warning: no debug symbols in executable" >/dev/null; then
	LDFLAGS="$BAKLDFLAGS"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	fi
	rm -f conftest conftest.c conftest.o

	else
	LDFLAGS="$BAKLDFLAGS" ; CFLAGS="$BAKCFLAGS" ; { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext

	fi


	# Check whether --enable-relro_now was given.
	if test "${enable_relro_now+set}" = set; then :
	enableval=$enable_relro_now;
	fi

	if test "x$enable_relro_now" = "xyes"; then :

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports -Wl,-z,relro,-z,now" >&5
	$as_echo_n "checking if $CC supports -Wl,-z,relro,-z,now... " >&6; }
	BAKLDFLAGS="$LDFLAGS"
	LDFLAGS="$LDFLAGS -Wl,-z,relro,-z,now"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :

	if $CC $CFLAGS $LDFLAGS -o conftest conftest.c 2>&1 \| grep "warning: no debug symbols in executable" >/dev/null; then
	LDFLAGS="$BAKLDFLAGS"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	fi
	rm -f conftest conftest.c conftest.o

	else
	LDFLAGS="$BAKLDFLAGS" ; { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext

	fi

	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for inline" >&5
	$as_echo_n "checking for inline... " >&6; }
	if ${ac_cv_c_inline+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_cv_c_inline=no
	for ac_kw in inline __inline__ __inline; do
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#ifndef __cplusplus
	typedef int foo_t;
	static $ac_kw foo_t static_foo () {return 0; }
	$ac_kw foo_t foo () {return 0; }
	#endif

	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_c_inline=$ac_kw
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	test "$ac_cv_c_inline" != no && break
	done

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_inline" >&5
	$as_echo "$ac_cv_c_inline" >&6; }

	case $ac_cv_c_inline in
	inline \| yes) ;;
	*)
	case $ac_cv_c_inline in
	no) ac_val=;;
	*) ac_val=$ac_cv_c_inline;;
	esac
	cat >>confdefs.h <<_ACEOF
	#ifndef __cplusplus
	#define inline $ac_val
	#endif
	_ACEOF
	;;
	esac


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler (${CC-cc}) accepts the \"format\" attribute" >&5
	$as_echo_n "checking whether the C compiler (${CC-cc}) accepts the \"format\" attribute... " >&6; }
	if ${ac_cv_c_format_attribute+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_cv_c_format_attribute=no
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <stdio.h>
	void f (char *format, ...) __attribute__ ((format (printf, 1, 2)));
	void (pf) (char format, ...) __attribute__ ((format (printf, 1, 2)));

	int
	main ()
	{

	f ("%s", "str");

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_c_format_attribute="yes"
	else
	ac_cv_c_format_attribute="no"
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext

	fi


	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_format_attribute" >&5
	$as_echo "$ac_cv_c_format_attribute" >&6; }
	if test $ac_cv_c_format_attribute = yes; then

	$as_echo "#define HAVE_ATTR_FORMAT 1" >>confdefs.h

	fi


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler (${CC-cc}) accepts the \"unused\" attribute" >&5
	$as_echo_n "checking whether the C compiler (${CC-cc}) accepts the \"unused\" attribute... " >&6; }
	if ${ac_cv_c_unused_attribute+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_cv_c_unused_attribute=no
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <stdio.h>
	void f (char *u __attribute__((unused)));

	int
	main ()
	{

	f ("x");

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_c_unused_attribute="yes"
	else
	ac_cv_c_unused_attribute="no"
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext

	fi




	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_unused_attribute" >&5
	$as_echo "$ac_cv_c_unused_attribute" >&6; }
	if test $ac_cv_c_unused_attribute = yes; then

	$as_echo "#define HAVE_ATTR_UNUSED 1" >>confdefs.h

	fi




	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler (${CC-cc}) accepts the \"weak\" attribute" >&5
	$as_echo_n "checking whether the C compiler (${CC-cc}) accepts the \"weak\" attribute... " >&6; }
	if ${ac_cv_c_weak_attribute+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_cv_c_weak_attribute=no
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <stdio.h>
	__attribute__((weak)) void f(int x) { printf("%d", x); }

	int
	main ()
	{

	f(1);

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_c_weak_attribute="yes"
	else
	ac_cv_c_weak_attribute="no"
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext

	fi


	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_weak_attribute" >&5
	$as_echo "$ac_cv_c_weak_attribute" >&6; }
	if test $ac_cv_c_weak_attribute = yes; then

	$as_echo "#define HAVE_ATTR_WEAK 1" >>confdefs.h


	$as_echo "#define ATTR_WEAK __attribute__((weak))" >>confdefs.h

	fi




	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler (${CC-cc}) accepts the \"noreturn\" attribute" >&5
	$as_echo_n "checking whether the C compiler (${CC-cc}) accepts the \"noreturn\" attribute... " >&6; }
	if ${ac_cv_c_noreturn_attribute+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_cv_c_noreturn_attribute=no
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <stdio.h>
	__attribute__((noreturn)) void f(int x) { printf("%d", x); }

	int
	main ()
	{

	f(1);

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_c_noreturn_attribute="yes"
	else
	ac_cv_c_noreturn_attribute="no"
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext

	fi


	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_noreturn_attribute" >&5
	$as_echo "$ac_cv_c_noreturn_attribute" >&6; }
	if test $ac_cv_c_noreturn_attribute = yes; then

	$as_echo "#define HAVE_ATTR_NORETURN 1" >>confdefs.h


	$as_echo "#define ATTR_NORETURN __attribute__((__noreturn__))" >>confdefs.h

	fi


	if test "$srcdir" != "."; then
	CPPFLAGS="$CPPFLAGS -I$srcdir"
	fi





	for ac_prog in flex lex
	do
	# Extract the first word of "$ac_prog", so it can be a program name with args.
	set dummy $ac_prog; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_LEX+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$LEX"; then
	ac_cv_prog_LEX="$LEX" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_LEX="$ac_prog"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	LEX=$ac_cv_prog_LEX
	if test -n "$LEX"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $LEX" >&5
	$as_echo "$LEX" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	test -n "$LEX" && break
	done
	test -n "$LEX" \|\| LEX=":"

	if test "x$LEX" != "x:"; then
	cat >conftest.l <<_ACEOF
	%%
	a { ECHO; }
	b { REJECT; }
	c { yymore (); }
	d { yyless (1); }
	e { /* IRIX 6.5 flex 2.5.4 underquotes its yyless argument. */
	yyless ((input () != 0)); }
	f { unput (yytext[0]); }
	. { BEGIN INITIAL; }
	%%
	#ifdef YYTEXT_POINTER
	extern char *yytext;
	#endif
	int
	main (void)
	{
	return ! yylex () + ! yywrap ();
	}
	_ACEOF
	{ { ac_try="$LEX conftest.l"
	case "(($ac_try" in
	\" \| \` \| \\) ac_try_echo=\$ac_try;;
	*) ac_try_echo=$ac_try;;
	esac
	eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
	$as_echo "$ac_try_echo"; } >&5
	(eval "$LEX conftest.l") 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking lex output file root" >&5
	$as_echo_n "checking lex output file root... " >&6; }
	if ${ac_cv_prog_lex_root+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	if test -f lex.yy.c; then
	ac_cv_prog_lex_root=lex.yy
	elif test -f lexyy.c; then
	ac_cv_prog_lex_root=lexyy
	else
	as_fn_error $? "cannot find output from $LEX; giving up" "$LINENO" 5
	fi
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_lex_root" >&5
	$as_echo "$ac_cv_prog_lex_root" >&6; }
	LEX_OUTPUT_ROOT=$ac_cv_prog_lex_root

	if test -z "${LEXLIB+set}"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking lex library" >&5
	$as_echo_n "checking lex library... " >&6; }
	if ${ac_cv_lib_lex+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	ac_save_LIBS=$LIBS
	ac_cv_lib_lex='none needed'
	for ac_lib in '' -lfl -ll; do
	LIBS="$ac_lib $ac_save_LIBS"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	`cat $LEX_OUTPUT_ROOT.c`
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_lib_lex=$ac_lib
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	test "$ac_cv_lib_lex" != 'none needed' && break
	done
	LIBS=$ac_save_LIBS

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_lex" >&5
	$as_echo "$ac_cv_lib_lex" >&6; }
	test "$ac_cv_lib_lex" != 'none needed' && LEXLIB=$ac_cv_lib_lex
	fi


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether yytext is a pointer" >&5
	$as_echo_n "checking whether yytext is a pointer... " >&6; }
	if ${ac_cv_prog_lex_yytext_pointer+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	# POSIX says lex can declare yytext either as a pointer or an array; the
	# default is implementation-dependent. Figure out which it is, since
	# not all implementations provide the %pointer and %array declarations.
	ac_cv_prog_lex_yytext_pointer=no
	ac_save_LIBS=$LIBS
	LIBS="$LEXLIB $ac_save_LIBS"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	#define YYTEXT_POINTER 1
	`cat $LEX_OUTPUT_ROOT.c`
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_prog_lex_yytext_pointer=yes
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	LIBS=$ac_save_LIBS

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_lex_yytext_pointer" >&5
	$as_echo "$ac_cv_prog_lex_yytext_pointer" >&6; }
	if test $ac_cv_prog_lex_yytext_pointer = yes; then

	$as_echo "#define YYTEXT_POINTER 1" >>confdefs.h

	fi
	rm -f conftest.l $LEX_OUTPUT_ROOT.c

	fi
	if test "$LEX" != "" -a "$LEX" != ":"; then

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for yylex_destroy" >&5
	$as_echo_n "checking for yylex_destroy... " >&6; }
	if echo %% \| $LEX -t 2>&1 \| grep yylex_destroy >/dev/null 2>&1; then

	$as_echo "#define LEX_HAS_YYLEX_DESTROY 1" >>confdefs.h

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; };
	LEX=":"
	fi

	fi
	if test "$LEX" != "" -a "$LEX" != ":"; then

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for lex %option" >&5
	$as_echo_n "checking for lex %option... " >&6; }
	if cat <<EOF \| $LEX -t 2>&1 \| grep yy_delete_buffer >/dev/null 2>&1; then
	%option nounput
	%%
	EOF
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; };
	LEX=":"
	fi

	fi
	for ac_prog in 'bison -y' byacc
	do
	# Extract the first word of "$ac_prog", so it can be a program name with args.
	set dummy $ac_prog; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_YACC+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$YACC"; then
	ac_cv_prog_YACC="$YACC" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_YACC="$ac_prog"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	YACC=$ac_cv_prog_YACC
	if test -n "$YACC"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $YACC" >&5
	$as_echo "$YACC" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	test -n "$YACC" && break
	done
	test -n "$YACC" \|\| YACC="yacc"

	# Extract the first word of "doxygen", so it can be a program name with args.
	set dummy doxygen; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_doxygen+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$doxygen"; then
	ac_cv_prog_doxygen="$doxygen" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_doxygen="doxygen"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	doxygen=$ac_cv_prog_doxygen
	if test -n "$doxygen"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $doxygen" >&5
	$as_echo "$doxygen" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}strip", so it can be a program name with args.
	set dummy ${ac_tool_prefix}strip; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_STRIP+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$STRIP"; then
	ac_cv_prog_STRIP="$STRIP" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_STRIP="${ac_tool_prefix}strip"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	STRIP=$ac_cv_prog_STRIP
	if test -n "$STRIP"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $STRIP" >&5
	$as_echo "$STRIP" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$ac_cv_prog_STRIP"; then
	ac_ct_STRIP=$STRIP
	# Extract the first word of "strip", so it can be a program name with args.
	set dummy strip; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_STRIP+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_STRIP"; then
	ac_cv_prog_ac_ct_STRIP="$ac_ct_STRIP" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_STRIP="strip"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_STRIP=$ac_cv_prog_ac_ct_STRIP
	if test -n "$ac_ct_STRIP"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_STRIP" >&5
	$as_echo "$ac_ct_STRIP" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi

	if test "x$ac_ct_STRIP" = x; then
	STRIP=""
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	STRIP=$ac_ct_STRIP
	fi
	else
	STRIP="$ac_cv_prog_STRIP"
	fi

	ac_aux_dir=
	for ac_dir in "$srcdir" "$srcdir/.." "$srcdir/../.."; do
	if test -f "$ac_dir/install-sh"; then
	ac_aux_dir=$ac_dir
	ac_install_sh="$ac_aux_dir/install-sh -c"
	break
	elif test -f "$ac_dir/install.sh"; then
	ac_aux_dir=$ac_dir
	ac_install_sh="$ac_aux_dir/install.sh -c"
	break
	elif test -f "$ac_dir/shtool"; then
	ac_aux_dir=$ac_dir
	ac_install_sh="$ac_aux_dir/shtool install -c"
	break
	fi
	done
	if test -z "$ac_aux_dir"; then
	as_fn_error $? "cannot find install-sh, install.sh, or shtool in \"$srcdir\" \"$srcdir/..\" \"$srcdir/../..\"" "$LINENO" 5
	fi

	# These three variables are undocumented and unsupported,
	# and are intended to be withdrawn in a future Autoconf release.
	# They can cause serious problems if a builder's source tree is in a directory
	# whose full name contains unusual characters.
	ac_config_guess="$SHELL $ac_aux_dir/config.guess" # Please don't use this var.
	ac_config_sub="$SHELL $ac_aux_dir/config.sub" # Please don't use this var.
	ac_configure="$SHELL $ac_aux_dir/configure" # Please don't use this var.


	# Make sure we can run config.sub.
	$SHELL "$ac_aux_dir/config.sub" sun4 >/dev/null 2>&1 \|\|
	as_fn_error $? "cannot run $SHELL $ac_aux_dir/config.sub" "$LINENO" 5

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking build system type" >&5
	$as_echo_n "checking build system type... " >&6; }
	if ${ac_cv_build+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_build_alias=$build_alias
	test "x$ac_build_alias" = x &&
	ac_build_alias=`$SHELL "$ac_aux_dir/config.guess"`
	test "x$ac_build_alias" = x &&
	as_fn_error $? "cannot guess build type; you must specify one" "$LINENO" 5
	ac_cv_build=`$SHELL "$ac_aux_dir/config.sub" $ac_build_alias` \|\|
	as_fn_error $? "$SHELL $ac_aux_dir/config.sub $ac_build_alias failed" "$LINENO" 5

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_build" >&5
	$as_echo "$ac_cv_build" >&6; }
	case $ac_cv_build in
	--*) ;;
	*) as_fn_error $? "invalid value of canonical build" "$LINENO" 5;;
	esac
	build=$ac_cv_build
	ac_save_IFS=$IFS; IFS='-'
	set x $ac_cv_build
	shift
	build_cpu=$1
	build_vendor=$2
	shift; shift
	# Remember, the first character of IFS is used to create $*,
	# except with old shells:
	build_os=$*
	IFS=$ac_save_IFS
	case $build_os in \ ) build_os=`echo "$build_os" \| sed 's/ /-/g'`;; esac


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking host system type" >&5
	$as_echo_n "checking host system type... " >&6; }
	if ${ac_cv_host+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test "x$host_alias" = x; then
	ac_cv_host=$ac_cv_build
	else
	ac_cv_host=`$SHELL "$ac_aux_dir/config.sub" $host_alias` \|\|
	as_fn_error $? "$SHELL $ac_aux_dir/config.sub $host_alias failed" "$LINENO" 5
	fi

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_host" >&5
	$as_echo "$ac_cv_host" >&6; }
	case $ac_cv_host in
	--*) ;;
	*) as_fn_error $? "invalid value of canonical host" "$LINENO" 5;;
	esac
	host=$ac_cv_host
	ac_save_IFS=$IFS; IFS='-'
	set x $ac_cv_host
	shift
	host_cpu=$1
	host_vendor=$2
	shift; shift
	# Remember, the first character of IFS is used to create $*,
	# except with old shells:
	host_os=$*
	IFS=$ac_save_IFS
	case $host_os in \ ) host_os=`echo "$host_os" \| sed 's/ /-/g'`;; esac



	# skip these tests, we do not need them.








	# always use ./libtool unless override from commandline (libtool=mylibtool)
	if test -z "$libtool"; then
	libtool="./libtool"
	fi

	# avoid libtool max commandline length test on systems that fork slowly.

	if echo "$host_os" \| grep "sunos4" >/dev/null; then
	lt_cv_sys_max_cmd_len=32750;
	fi
	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}ar", so it can be a program name with args.
	set dummy ${ac_tool_prefix}ar; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_path_AR+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	case $AR in
	[\\/]* \| ?:[\\/]*)
	ac_cv_path_AR="$AR" # Let the user override the test with a path.
	;;
	*)
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_path_AR="$as_dir/$ac_word$ac_exec_ext"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	;;
	esac
	fi
	AR=$ac_cv_path_AR
	if test -n "$AR"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $AR" >&5
	$as_echo "$AR" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$ac_cv_path_AR"; then
	ac_pt_AR=$AR
	# Extract the first word of "ar", so it can be a program name with args.
	set dummy ar; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_path_ac_pt_AR+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	case $ac_pt_AR in
	[\\/]* \| ?:[\\/]*)
	ac_cv_path_ac_pt_AR="$ac_pt_AR" # Let the user override the test with a path.
	;;
	*)
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_path_ac_pt_AR="$as_dir/$ac_word$ac_exec_ext"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	;;
	esac
	fi
	ac_pt_AR=$ac_cv_path_ac_pt_AR
	if test -n "$ac_pt_AR"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_pt_AR" >&5
	$as_echo "$ac_pt_AR" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi

	if test "x$ac_pt_AR" = x; then
	AR="false"
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	AR=$ac_pt_AR
	fi
	else
	AR="$ac_cv_path_AR"
	fi

	if test $AR = false; then
	as_fn_error $? "Cannot find 'ar', please extend PATH to include it" "$LINENO" 5
	fi

	case `pwd` in
	\ \| \ )
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Libtool does not cope well with whitespace in \`pwd\`" >&5
	$as_echo "$as_me: WARNING: Libtool does not cope well with whitespace in \`pwd\`" >&2;} ;;
	esac



	macro_version='2.4.6'
	macro_revision='2.4.6'













	ltmain=$ac_aux_dir/ltmain.sh

	# Backslashify metacharacters that are still active within
	# double-quoted strings.
	sed_quote_subst='s/$["`$\\]$/\\\1/g'

	# Same as above, but do not quote variable references.
	double_quote_subst='s/$["`\\]$/\\\1/g'

	# Sed substitution to delay expansion of an escaped shell variable in a
	# double_quote_subst'ed string.
	delay_variable_subst='s/\\\\\\\\\\\$/\\\\\\$/g'

	# Sed substitution to delay expansion of an escaped single quote.
	delay_single_quote_subst='s/'\''/'\'\\\\\\\'\''/g'

	# Sed substitution to avoid accidental globbing in evaled expressions
	no_glob_subst='s/\/\\\/g'

	ECHO='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
	ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO
	ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO$ECHO

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to print strings" >&5
	$as_echo_n "checking how to print strings... " >&6; }
	# Test print first, because it will be a builtin if present.
	if test "X`( print -r -- -n ) 2>/dev/null`" = X-n && \
	test "X`print -r -- $ECHO 2>/dev/null`" = "X$ECHO"; then
	ECHO='print -r --'
	elif test "X`printf %s $ECHO 2>/dev/null`" = "X$ECHO"; then
	ECHO='printf %s\n'
	else
	# Use this function as a fallback that always works.
	func_fallback_echo ()
	{
	eval 'cat <<_LTECHO_EOF
	$1
	_LTECHO_EOF'
	}
	ECHO='func_fallback_echo'
	fi

	# func_echo_all arg...
	# Invoke $ECHO with all args, space-separated.
	func_echo_all ()
	{
	$ECHO ""
	}

	case $ECHO in
	printf*) { $as_echo "$as_me:${as_lineno-$LINENO}: result: printf" >&5
	$as_echo "printf" >&6; } ;;
	print*) { $as_echo "$as_me:${as_lineno-$LINENO}: result: print -r" >&5
	$as_echo "print -r" >&6; } ;;
	*) { $as_echo "$as_me:${as_lineno-$LINENO}: result: cat" >&5
	$as_echo "cat" >&6; } ;;
	esac














	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for a sed that does not truncate output" >&5
	$as_echo_n "checking for a sed that does not truncate output... " >&6; }
	if ${ac_cv_path_SED+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_script=s/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/
	for ac_i in 1 2 3 4 5 6 7; do
	ac_script="$ac_script$as_nl$ac_script"
	done
	echo "$ac_script" 2>/dev/null \| sed 99q >conftest.sed
	{ ac_script=; unset ac_script;}
	if test -z "$SED"; then
	ac_path_SED_found=false
	# Loop through the user's path and test for each of PROGNAME-LIST
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_prog in sed gsed; do
	for ac_exec_ext in '' $ac_executable_extensions; do
	ac_path_SED="$as_dir/$ac_prog$ac_exec_ext"
	as_fn_executable_p "$ac_path_SED" \|\| continue
	# Check for GNU ac_path_SED and select it if it is found.
	# Check for GNU $ac_path_SED
	case `"$ac_path_SED" --version 2>&1` in
	GNU)
	ac_cv_path_SED="$ac_path_SED" ac_path_SED_found=:;;
	*)
	ac_count=0
	$as_echo_n 0123456789 >"conftest.in"
	while :
	do
	cat "conftest.in" "conftest.in" >"conftest.tmp"
	mv "conftest.tmp" "conftest.in"
	cp "conftest.in" "conftest.nl"
	$as_echo '' >> "conftest.nl"
	"$ac_path_SED" -f conftest.sed < "conftest.nl" >"conftest.out" 2>/dev/null \|\| break
	diff "conftest.out" "conftest.nl" >/dev/null 2>&1 \|\| break
	as_fn_arith $ac_count + 1 && ac_count=$as_val
	if test $ac_count -gt ${ac_path_SED_max-0}; then
	# Best one so far, save it but keep looking for a better one
	ac_cv_path_SED="$ac_path_SED"
	ac_path_SED_max=$ac_count
	fi
	# 10*(2^10) chars as input seems more than enough
	test $ac_count -gt 10 && break
	done
	rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
	esac

	$ac_path_SED_found && break 3
	done
	done
	done
	IFS=$as_save_IFS
	if test -z "$ac_cv_path_SED"; then
	as_fn_error $? "no acceptable sed could be found in \$PATH" "$LINENO" 5
	fi
	else
	ac_cv_path_SED=$SED
	fi

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_SED" >&5
	$as_echo "$ac_cv_path_SED" >&6; }
	SED="$ac_cv_path_SED"
	rm -f conftest.sed

	test -z "$SED" && SED=sed
	Xsed="$SED -e 1s/^X//"











	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for fgrep" >&5
	$as_echo_n "checking for fgrep... " >&6; }
	if ${ac_cv_path_FGREP+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if echo 'abc' \| $GREP -F 'abc' >/dev/null 2>&1
	then ac_cv_path_FGREP="$GREP -F"
	else
	if test -z "$FGREP"; then
	ac_path_FGREP_found=false
	# Loop through the user's path and test for each of PROGNAME-LIST
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_prog in fgrep; do
	for ac_exec_ext in '' $ac_executable_extensions; do
	ac_path_FGREP="$as_dir/$ac_prog$ac_exec_ext"
	as_fn_executable_p "$ac_path_FGREP" \|\| continue
	# Check for GNU ac_path_FGREP and select it if it is found.
	# Check for GNU $ac_path_FGREP
	case `"$ac_path_FGREP" --version 2>&1` in
	GNU)
	ac_cv_path_FGREP="$ac_path_FGREP" ac_path_FGREP_found=:;;
	*)
	ac_count=0
	$as_echo_n 0123456789 >"conftest.in"
	while :
	do
	cat "conftest.in" "conftest.in" >"conftest.tmp"
	mv "conftest.tmp" "conftest.in"
	cp "conftest.in" "conftest.nl"
	$as_echo 'FGREP' >> "conftest.nl"
	"$ac_path_FGREP" FGREP < "conftest.nl" >"conftest.out" 2>/dev/null \|\| break
	diff "conftest.out" "conftest.nl" >/dev/null 2>&1 \|\| break
	as_fn_arith $ac_count + 1 && ac_count=$as_val
	if test $ac_count -gt ${ac_path_FGREP_max-0}; then
	# Best one so far, save it but keep looking for a better one
	ac_cv_path_FGREP="$ac_path_FGREP"
	ac_path_FGREP_max=$ac_count
	fi
	# 10*(2^10) chars as input seems more than enough
	test $ac_count -gt 10 && break
	done
	rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
	esac

	$ac_path_FGREP_found && break 3
	done
	done
	done
	IFS=$as_save_IFS
	if test -z "$ac_cv_path_FGREP"; then
	as_fn_error $? "no acceptable fgrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5
	fi
	else
	ac_cv_path_FGREP=$FGREP
	fi

	fi
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_FGREP" >&5
	$as_echo "$ac_cv_path_FGREP" >&6; }
	FGREP="$ac_cv_path_FGREP"


	test -z "$GREP" && GREP=grep



















	# Check whether --with-gnu-ld was given.
	if test "${with_gnu_ld+set}" = set; then :
	withval=$with_gnu_ld; test no = "$withval" \|\| with_gnu_ld=yes
	else
	with_gnu_ld=no
	fi

	ac_prog=ld
	if test yes = "$GCC"; then
	# Check if gcc -print-prog-name=ld gives a path.
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ld used by $CC" >&5
	$as_echo_n "checking for ld used by $CC... " >&6; }
	case $host in
	--mingw*)
	# gcc leaves a trailing carriage return, which upsets mingw
	ac_prog=`($CC -print-prog-name=ld) 2>&5 \| tr -d '\015'` ;;
	*)
	ac_prog=`($CC -print-prog-name=ld) 2>&5` ;;
	esac
	case $ac_prog in
	# Accept absolute paths.
	[\\/]* \| ?:[\\/]*)
	re_direlt='/[^/][^/]*/\.\./'
	# Canonicalize the pathname of ld
	ac_prog=`$ECHO "$ac_prog"\| $SED 's%\\\\%/%g'`
	while $ECHO "$ac_prog" \| $GREP "$re_direlt" > /dev/null 2>&1; do
	ac_prog=`$ECHO $ac_prog\| $SED "s%$re_direlt%/%"`
	done
	test -z "$LD" && LD=$ac_prog
	;;
	"")
	# If it fails, then pretend we aren't using GCC.
	ac_prog=ld
	;;
	*)
	# If it is relative, then search for the first ld in PATH.
	with_gnu_ld=unknown
	;;
	esac
	elif test yes = "$with_gnu_ld"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for GNU ld" >&5
	$as_echo_n "checking for GNU ld... " >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for non-GNU ld" >&5
	$as_echo_n "checking for non-GNU ld... " >&6; }
	fi
	if ${lt_cv_path_LD+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -z "$LD"; then
	lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR
	for ac_dir in $PATH; do
	IFS=$lt_save_ifs
	test -z "$ac_dir" && ac_dir=.
	if test -f "$ac_dir/$ac_prog" \|\| test -f "$ac_dir/$ac_prog$ac_exeext"; then
	lt_cv_path_LD=$ac_dir/$ac_prog
	# Check to see if the program is GNU ld. I'd rather use --version,
	# but apparently some variants of GNU ld only accept -v.
	# Break only if it was the GNU/non-GNU ld that we prefer.
	case `"$lt_cv_path_LD" -v 2>&1 </dev/null` in
	GNU \| 'with BFD')
	test no != "$with_gnu_ld" && break
	;;
	*)
	test yes != "$with_gnu_ld" && break
	;;
	esac
	fi
	done
	IFS=$lt_save_ifs
	else
	lt_cv_path_LD=$LD # Let the user override the test with a path.
	fi
	fi

	LD=$lt_cv_path_LD
	if test -n "$LD"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $LD" >&5
	$as_echo "$LD" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi
	test -z "$LD" && as_fn_error $? "no acceptable ld found in \$PATH" "$LINENO" 5
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if the linker ($LD) is GNU ld" >&5
	$as_echo_n "checking if the linker ($LD) is GNU ld... " >&6; }
	if ${lt_cv_prog_gnu_ld+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	# I'd rather use --version here, but apparently some GNU lds only accept -v.
	case `$LD -v 2>&1 </dev/null` in
	GNU \| 'with BFD')
	lt_cv_prog_gnu_ld=yes
	;;
	*)
	lt_cv_prog_gnu_ld=no
	;;
	esac
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_gnu_ld" >&5
	$as_echo "$lt_cv_prog_gnu_ld" >&6; }
	with_gnu_ld=$lt_cv_prog_gnu_ld









	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for BSD- or MS-compatible name lister (nm)" >&5
	$as_echo_n "checking for BSD- or MS-compatible name lister (nm)... " >&6; }
	if ${lt_cv_path_NM+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$NM"; then
	# Let the user override the test.
	lt_cv_path_NM=$NM
	else
	lt_nm_to_check=${ac_tool_prefix}nm
	if test -n "$ac_tool_prefix" && test "$build" = "$host"; then
	lt_nm_to_check="$lt_nm_to_check nm"
	fi
	for lt_tmp_nm in $lt_nm_to_check; do
	lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR
	for ac_dir in $PATH /usr/ccs/bin/elf /usr/ccs/bin /usr/ucb /bin; do
	IFS=$lt_save_ifs
	test -z "$ac_dir" && ac_dir=.
	tmp_nm=$ac_dir/$lt_tmp_nm
	if test -f "$tmp_nm" \|\| test -f "$tmp_nm$ac_exeext"; then
	# Check to see if the nm accepts a BSD-compat flag.
	# Adding the 'sed 1q' prevents false positives on HP-UX, which says:
	# nm: unknown option "B" ignored
	# Tru64's nm complains that /dev/null is an invalid object file
	# MSYS converts /dev/null to NUL, MinGW nm treats NUL as empty
	case $build_os in
	mingw*) lt_bad_file=conftest.nm/nofile ;;
	*) lt_bad_file=/dev/null ;;
	esac
	case `"$tmp_nm" -B $lt_bad_file 2>&1 \| sed '1q'` in
	$lt_bad_file \| 'Invalid file or object type')
	lt_cv_path_NM="$tmp_nm -B"
	break 2
	;;
	*)
	case `"$tmp_nm" -p /dev/null 2>&1 \| sed '1q'` in
	/dev/null)
	lt_cv_path_NM="$tmp_nm -p"
	break 2
	;;
	*)
	lt_cv_path_NM=${lt_cv_path_NM="$tmp_nm"} # keep the first match, but
	continue # so that we can try to find one that supports BSD flags
	;;
	esac
	;;
	esac
	fi
	done
	IFS=$lt_save_ifs
	done
	: ${lt_cv_path_NM=no}
	fi
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_path_NM" >&5
	$as_echo "$lt_cv_path_NM" >&6; }
	if test no != "$lt_cv_path_NM"; then
	NM=$lt_cv_path_NM
	else
	# Didn't find any BSD compatible name lister, look for dumpbin.
	if test -n "$DUMPBIN"; then :
	# Let the user override the test.
	else
	if test -n "$ac_tool_prefix"; then
	for ac_prog in dumpbin "link -dump"
	do
	# Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args.
	set dummy $ac_tool_prefix$ac_prog; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_DUMPBIN+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$DUMPBIN"; then
	ac_cv_prog_DUMPBIN="$DUMPBIN" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_DUMPBIN="$ac_tool_prefix$ac_prog"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	DUMPBIN=$ac_cv_prog_DUMPBIN
	if test -n "$DUMPBIN"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $DUMPBIN" >&5
	$as_echo "$DUMPBIN" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	test -n "$DUMPBIN" && break
	done
	fi
	if test -z "$DUMPBIN"; then
	ac_ct_DUMPBIN=$DUMPBIN
	for ac_prog in dumpbin "link -dump"
	do
	# Extract the first word of "$ac_prog", so it can be a program name with args.
	set dummy $ac_prog; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_DUMPBIN+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_DUMPBIN"; then
	ac_cv_prog_ac_ct_DUMPBIN="$ac_ct_DUMPBIN" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_DUMPBIN="$ac_prog"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_DUMPBIN=$ac_cv_prog_ac_ct_DUMPBIN
	if test -n "$ac_ct_DUMPBIN"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DUMPBIN" >&5
	$as_echo "$ac_ct_DUMPBIN" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	test -n "$ac_ct_DUMPBIN" && break
	done

	if test "x$ac_ct_DUMPBIN" = x; then
	DUMPBIN=":"
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	DUMPBIN=$ac_ct_DUMPBIN
	fi
	fi

	case `$DUMPBIN -symbols -headers /dev/null 2>&1 \| sed '1q'` in
	COFF)
	DUMPBIN="$DUMPBIN -symbols -headers"
	;;
	*)
	DUMPBIN=:
	;;
	esac
	fi

	if test : != "$DUMPBIN"; then
	NM=$DUMPBIN
	fi
	fi
	test -z "$NM" && NM=nm






	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking the name lister ($NM) interface" >&5
	$as_echo_n "checking the name lister ($NM) interface... " >&6; }
	if ${lt_cv_nm_interface+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_nm_interface="BSD nm"
	echo "int some_variable = 0;" > conftest.$ac_ext
	(eval echo "\"\$as_me:$LINENO: $ac_compile\"" >&5)
	(eval "$ac_compile" 2>conftest.err)
	cat conftest.err >&5
	(eval echo "\"\$as_me:$LINENO: $NM \\\"conftest.$ac_objext\\\"\"" >&5)
	(eval "$NM \"conftest.$ac_objext\"" 2>conftest.err > conftest.out)
	cat conftest.err >&5
	(eval echo "\"\$as_me:$LINENO: output\"" >&5)
	cat conftest.out >&5
	if $GREP 'External.*some_variable' conftest.out > /dev/null; then
	lt_cv_nm_interface="MS dumpbin"
	fi
	rm -f conftest*
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_nm_interface" >&5
	$as_echo "$lt_cv_nm_interface" >&6; }

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ln -s works" >&5
	$as_echo_n "checking whether ln -s works... " >&6; }
	LN_S=$as_ln_s
	if test "$LN_S" = "ln -s"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no, using $LN_S" >&5
	$as_echo "no, using $LN_S" >&6; }
	fi

	# find the maximum length of command line arguments
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking the maximum length of command line arguments" >&5
	$as_echo_n "checking the maximum length of command line arguments... " >&6; }
	if ${lt_cv_sys_max_cmd_len+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	i=0
	teststring=ABCD

	case $build_os in
	msdosdjgpp*)
	# On DJGPP, this test can blow up pretty badly due to problems in libc
	# (any single argument exceeding 2000 bytes causes a buffer overrun
	# during glob expansion). Even if it were fixed, the result of this
	# check would be larger than it should be.
	lt_cv_sys_max_cmd_len=12288; # 12K is about right
	;;

	gnu*)
	# Under GNU Hurd, this test is not required because there is
	# no limit to the length of command line arguments.
	# Libtool will interpret -1 as no limit whatsoever
	lt_cv_sys_max_cmd_len=-1;
	;;

	cygwin* \| mingw* \| cegcc*)
	# On Win9x/ME, this test blows up -- it succeeds, but takes
	# about 5 minutes as the teststring grows exponentially.
	# Worse, since 9x/ME are not pre-emptively multitasking,
	# you end up with a "frozen" computer, even though with patience
	# the test eventually succeeds (with a max line length of 256k).
	# Instead, let's just punt: use the minimum linelength reported by
	# all of the supported platforms: 8192 (on NT/2K/XP).
	lt_cv_sys_max_cmd_len=8192;
	;;

	mint*)
	# On MiNT this can take a long time and run out of memory.
	lt_cv_sys_max_cmd_len=8192;
	;;

	amigaos*)
	# On AmigaOS with pdksh, this test takes hours, literally.
	# So we just punt and use a minimum line length of 8192.
	lt_cv_sys_max_cmd_len=8192;
	;;

	bitrig* \| darwin* \| dragonfly* \| freebsd* \| netbsd* \| openbsd*)
	# This has been around since 386BSD, at least. Likely further.
	if test -x /sbin/sysctl; then
	lt_cv_sys_max_cmd_len=`/sbin/sysctl -n kern.argmax`
	elif test -x /usr/sbin/sysctl; then
	lt_cv_sys_max_cmd_len=`/usr/sbin/sysctl -n kern.argmax`
	else
	lt_cv_sys_max_cmd_len=65536 # usable default for all BSDs
	fi
	# And add a safety zone
	lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 4`
	lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \* 3`
	;;

	interix*)
	# We know the value 262144 and hardcode it with a safety zone (like BSD)
	lt_cv_sys_max_cmd_len=196608
	;;

	os2*)
	# The test takes a long time on OS/2.
	lt_cv_sys_max_cmd_len=8192
	;;

	osf*)
	# Dr. Hans Ekkehard Plesser reports seeing a kernel panic running configure
	# due to this test when exec_disable_arg_limit is 1 on Tru64. It is not
	# nice to cause kernel panics so lets avoid the loop below.
	# First set a reasonable default.
	lt_cv_sys_max_cmd_len=16384
	#
	if test -x /sbin/sysconfig; then
	case `/sbin/sysconfig -q proc exec_disable_arg_limit` in
	1) lt_cv_sys_max_cmd_len=-1 ;;
	esac
	fi
	;;
	sco3.2v5*)
	lt_cv_sys_max_cmd_len=102400
	;;
	sysv5* \| sco5v6* \| sysv4.2uw2*)
	kargmax=`grep ARG_MAX /etc/conf/cf.d/stune 2>/dev/null`
	if test -n "$kargmax"; then
	lt_cv_sys_max_cmd_len=`echo $kargmax \| sed 's/.*[ ]//'`
	else
	lt_cv_sys_max_cmd_len=32768
	fi
	;;
	*)
	lt_cv_sys_max_cmd_len=`(getconf ARG_MAX) 2> /dev/null`
	if test -n "$lt_cv_sys_max_cmd_len" && \
	test undefined != "$lt_cv_sys_max_cmd_len"; then
	lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 4`
	lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \* 3`
	else
	# Make teststring a little bigger before we do anything with it.
	# a 1K string should be a reasonable start.
	for i in 1 2 3 4 5 6 7 8; do
	teststring=$teststring$teststring
	done
	SHELL=${SHELL-${CONFIG_SHELL-/bin/sh}}
	# If test is not a shell built-in, we'll probably end up computing a
	# maximum length that is only half of the actual maximum length, but
	# we can't tell.
	while { test X`env echo "$teststring$teststring" 2>/dev/null` \
	= "X$teststring$teststring"; } >/dev/null 2>&1 &&
	test 17 != "$i" # 1/2 MB should be enough
	do
	i=`expr $i + 1`
	teststring=$teststring$teststring
	done
	# Only check the string length outside the loop.
	lt_cv_sys_max_cmd_len=`expr "X$teststring" : ".*" 2>&1`
	teststring=
	# Add a significant safety factor because C++ compilers can tack on
	# massive amounts of additional arguments before passing them to the
	# linker. It appears as though 1/2 is a usable value.
	lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 2`
	fi
	;;
	esac

	fi

	if test -n "$lt_cv_sys_max_cmd_len"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_sys_max_cmd_len" >&5
	$as_echo "$lt_cv_sys_max_cmd_len" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: none" >&5
	$as_echo "none" >&6; }
	fi
	max_cmd_len=$lt_cv_sys_max_cmd_len






	: ${CP="cp -f"}
	: ${MV="mv -f"}
	: ${RM="rm -f"}

	if ( (MAIL=60; unset MAIL) \|\| exit) >/dev/null 2>&1; then
	lt_unset=unset
	else
	lt_unset=false
	fi





	# test EBCDIC or ASCII
	case `echo X\|tr X '\101'` in
	A) # ASCII based system
	# \n is not interpreted correctly by Solaris 8 /usr/ucb/tr
	lt_SP2NL='tr \040 \012'
	lt_NL2SP='tr \015\012 \040\040'
	;;
	*) # EBCDIC based system
	lt_SP2NL='tr \100 \n'
	lt_NL2SP='tr \r\n \100\100'
	;;
	esac









	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to convert $build file names to $host format" >&5
	$as_echo_n "checking how to convert $build file names to $host format... " >&6; }
	if ${lt_cv_to_host_file_cmd+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	case $host in
	--mingw* )
	case $build in
	--mingw* ) # actually msys
	lt_cv_to_host_file_cmd=func_convert_file_msys_to_w32
	;;
	--cygwin* )
	lt_cv_to_host_file_cmd=func_convert_file_cygwin_to_w32
	;;
	* ) # otherwise, assume *nix
	lt_cv_to_host_file_cmd=func_convert_file_nix_to_w32
	;;
	esac
	;;
	--cygwin* )
	case $build in
	--mingw* ) # actually msys
	lt_cv_to_host_file_cmd=func_convert_file_msys_to_cygwin
	;;
	--cygwin* )
	lt_cv_to_host_file_cmd=func_convert_file_noop
	;;
	* ) # otherwise, assume *nix
	lt_cv_to_host_file_cmd=func_convert_file_nix_to_cygwin
	;;
	esac
	;;
	* ) # unhandled hosts (and "normal" native builds)
	lt_cv_to_host_file_cmd=func_convert_file_noop
	;;
	esac

	fi

	to_host_file_cmd=$lt_cv_to_host_file_cmd
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_to_host_file_cmd" >&5
	$as_echo "$lt_cv_to_host_file_cmd" >&6; }





	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to convert $build file names to toolchain format" >&5
	$as_echo_n "checking how to convert $build file names to toolchain format... " >&6; }
	if ${lt_cv_to_tool_file_cmd+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	#assume ordinary cross tools, or native build.
	lt_cv_to_tool_file_cmd=func_convert_file_noop
	case $host in
	--mingw* )
	case $build in
	--mingw* ) # actually msys
	lt_cv_to_tool_file_cmd=func_convert_file_msys_to_w32
	;;
	esac
	;;
	esac

	fi

	to_tool_file_cmd=$lt_cv_to_tool_file_cmd
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_to_tool_file_cmd" >&5
	$as_echo "$lt_cv_to_tool_file_cmd" >&6; }





	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $LD option to reload object files" >&5
	$as_echo_n "checking for $LD option to reload object files... " >&6; }
	if ${lt_cv_ld_reload_flag+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_ld_reload_flag='-r'
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_reload_flag" >&5
	$as_echo "$lt_cv_ld_reload_flag" >&6; }
	reload_flag=$lt_cv_ld_reload_flag
	case $reload_flag in
	"" \| " "*) ;;
	*) reload_flag=" $reload_flag" ;;
	esac
	reload_cmds='$LD$reload_flag -o $output$reload_objs'
	case $host_os in
	cygwin* \| mingw* \| pw32* \| cegcc*)
	if test yes != "$GCC"; then
	reload_cmds=false
	fi
	;;
	darwin*)
	if test yes = "$GCC"; then
	reload_cmds='$LTCC $LTCFLAGS -nostdlib $wl-r -o $output$reload_objs'
	else
	reload_cmds='$LD$reload_flag -o $output$reload_objs'
	fi
	;;
	esac









	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}objdump", so it can be a program name with args.
	set dummy ${ac_tool_prefix}objdump; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_OBJDUMP+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$OBJDUMP"; then
	ac_cv_prog_OBJDUMP="$OBJDUMP" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_OBJDUMP="${ac_tool_prefix}objdump"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	OBJDUMP=$ac_cv_prog_OBJDUMP
	if test -n "$OBJDUMP"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $OBJDUMP" >&5
	$as_echo "$OBJDUMP" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$ac_cv_prog_OBJDUMP"; then
	ac_ct_OBJDUMP=$OBJDUMP
	# Extract the first word of "objdump", so it can be a program name with args.
	set dummy objdump; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_OBJDUMP+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_OBJDUMP"; then
	ac_cv_prog_ac_ct_OBJDUMP="$ac_ct_OBJDUMP" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_OBJDUMP="objdump"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_OBJDUMP=$ac_cv_prog_ac_ct_OBJDUMP
	if test -n "$ac_ct_OBJDUMP"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OBJDUMP" >&5
	$as_echo "$ac_ct_OBJDUMP" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi

	if test "x$ac_ct_OBJDUMP" = x; then
	OBJDUMP="false"
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	OBJDUMP=$ac_ct_OBJDUMP
	fi
	else
	OBJDUMP="$ac_cv_prog_OBJDUMP"
	fi

	test -z "$OBJDUMP" && OBJDUMP=objdump









	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to recognize dependent libraries" >&5
	$as_echo_n "checking how to recognize dependent libraries... " >&6; }
	if ${lt_cv_deplibs_check_method+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_file_magic_cmd='$MAGIC_CMD'
	lt_cv_file_magic_test_file=
	lt_cv_deplibs_check_method='unknown'
	# Need to set the preceding variable on all platforms that support
	# interlibrary dependencies.
	# 'none' -- dependencies not supported.
	# 'unknown' -- same as none, but documents that we really don't know.
	# 'pass_all' -- all dependencies passed with no checks.
	# 'test_compile' -- check by making test program.
	# 'file_magic [[regex]]' -- check by looking for files in library path
	# that responds to the $file_magic_cmd with a given extended regex.
	# If you have 'file' or equivalent on your system and you're not sure
	# whether 'pass_all' will always work, you probably want this one.

	case $host_os in
	aix[4-9]*)
	lt_cv_deplibs_check_method=pass_all
	;;

	beos*)
	lt_cv_deplibs_check_method=pass_all
	;;

	bsdi[45]*)
	lt_cv_deplibs_check_method='file_magic ELF [0-9][0-9]*-bit [ML]SB (shared object\|dynamic lib)'
	lt_cv_file_magic_cmd='/usr/bin/file -L'
	lt_cv_file_magic_test_file=/shlib/libc.so
	;;

	cygwin*)
	# func_win32_libid is a shell function defined in ltmain.sh
	lt_cv_deplibs_check_method='file_magic ^x86 archive import\|^x86 DLL'
	lt_cv_file_magic_cmd='func_win32_libid'
	;;

	mingw* \| pw32*)
	# Base MSYS/MinGW do not provide the 'file' command needed by
	# func_win32_libid shell function, so use a weaker test based on 'objdump',
	# unless we find 'file', for example because we are cross-compiling.
	if ( file / ) >/dev/null 2>&1; then
	lt_cv_deplibs_check_method='file_magic ^x86 archive import\|^x86 DLL'
	lt_cv_file_magic_cmd='func_win32_libid'
	else
	# Keep this pattern in sync with the one in func_win32_libid.
	lt_cv_deplibs_check_method='file_magic file format (pei-i386(.architecture: i386)?\|pe-arm-wince\|pe-x86-64)'
	lt_cv_file_magic_cmd='$OBJDUMP -f'
	fi
	;;

	cegcc*)
	# use the weaker test based on 'objdump'. See mingw*.
	lt_cv_deplibs_check_method='file_magic file format pe-arm-.little(.architecture: arm)?'
	lt_cv_file_magic_cmd='$OBJDUMP -f'
	;;

	darwin* \| rhapsody*)
	lt_cv_deplibs_check_method=pass_all
	;;

	freebsd* \| dragonfly*)
	if echo __ELF__ \| $CC -E - \| $GREP __ELF__ > /dev/null; then
	case $host_cpu in
	i*86 )
	# Not sure whether the presence of OpenBSD here was a mistake.
	# Let's accept both of them until this is cleared up.
	lt_cv_deplibs_check_method='file_magic (FreeBSD\|OpenBSD\|DragonFly)/i[3-9]86 (compact )?demand paged shared library'
	lt_cv_file_magic_cmd=/usr/bin/file
	lt_cv_file_magic_test_file=`echo /usr/lib/libc.so.*`
	;;
	esac
	else
	lt_cv_deplibs_check_method=pass_all
	fi
	;;

	haiku*)
	lt_cv_deplibs_check_method=pass_all
	;;

	hpux10.20* \| hpux11*)
	lt_cv_file_magic_cmd=/usr/bin/file
	case $host_cpu in
	ia64*)
	lt_cv_deplibs_check_method='file_magic (s[0-9][0-9][0-9]\|ELF-[0-9][0-9]) shared object file - IA64'
	lt_cv_file_magic_test_file=/usr/lib/hpux32/libc.so
	;;
	hppa64)
	lt_cv_deplibs_check_method='file_magic (s[0-9][0-9][0-9]\|ELF[ -][0-9][0-9])(-bit)?( [LM]SB)? shared object( file)?[, -]* PA-RISC [0-9]\.[0-9]'
	lt_cv_file_magic_test_file=/usr/lib/pa20_64/libc.sl
	;;
	*)
	lt_cv_deplibs_check_method='file_magic (s[0-9][0-9][0-9]\|PA-RISC[0-9]\.[0-9]) shared library'
	lt_cv_file_magic_test_file=/usr/lib/libc.sl
	;;
	esac
	;;

	interix[3-9]*)
	# PIC code is broken on Interix 3.x, that's why \|\.a not \|_pic\.a here
	lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so\|\.a)$'
	;;

	irix5* \| irix6* \| nonstopux*)
	case $LD in
	-32\|"-32 ") libmagic=32-bit;;
	-n32\|"-n32 ") libmagic=N32;;
	-64\|"-64 ") libmagic=64-bit;;
	*) libmagic=never-match;;
	esac
	lt_cv_deplibs_check_method=pass_all
	;;

	# This must be glibc/ELF.
	linux* \| kbsd-gnu \| kopensolaris-gnu \| gnu)
	lt_cv_deplibs_check_method=pass_all
	;;

	netbsd*)
	if echo __ELF__ \| $CC -E - \| $GREP __ELF__ > /dev/null; then
	lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so\.[0-9]+\.[0-9]+\|_pic\.a)$'
	else
	lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so\|_pic\.a)$'
	fi
	;;

	newos6*)
	lt_cv_deplibs_check_method='file_magic ELF [0-9][0-9]*-bit [ML]SB (executable\|dynamic lib)'
	lt_cv_file_magic_cmd=/usr/bin/file
	lt_cv_file_magic_test_file=/usr/lib/libnls.so
	;;

	nto \| qnx)
	lt_cv_deplibs_check_method=pass_all
	;;

	openbsd* \| bitrig*)
	if test -z "`echo __ELF__ \| $CC -E - \| $GREP __ELF__`"; then
	lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so\.[0-9]+\.[0-9]+\|\.so\|_pic\.a)$'
	else
	lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so\.[0-9]+\.[0-9]+\|_pic\.a)$'
	fi
	;;

	osf3* \| osf4* \| osf5*)
	lt_cv_deplibs_check_method=pass_all
	;;

	rdos*)
	lt_cv_deplibs_check_method=pass_all
	;;

	solaris*)
	lt_cv_deplibs_check_method=pass_all
	;;

	sysv5* \| sco3.2v5* \| sco5v6* \| unixware* \| OpenUNIX* \| sysv4uw2)
	lt_cv_deplibs_check_method=pass_all
	;;

	sysv4 \| sysv4.3*)
	case $host_vendor in
	motorola)
	lt_cv_deplibs_check_method='file_magic ELF [0-9][0-9]-bit [ML]SB (shared object\|dynamic lib) M[0-9][0-9] Version [0-9]'
	lt_cv_file_magic_test_file=`echo /usr/lib/libc.so*`
	;;
	ncr)
	lt_cv_deplibs_check_method=pass_all
	;;
	sequent)
	lt_cv_file_magic_cmd='/bin/file'
	lt_cv_deplibs_check_method='file_magic ELF [0-9][0-9]*-bit [LM]SB (shared object\|dynamic lib )'
	;;
	sni)
	lt_cv_file_magic_cmd='/bin/file'
	lt_cv_deplibs_check_method="file_magic ELF [0-9][0-9]*-bit [LM]SB dynamic lib"
	lt_cv_file_magic_test_file=/lib/libc.so
	;;
	siemens)
	lt_cv_deplibs_check_method=pass_all
	;;
	pc)
	lt_cv_deplibs_check_method=pass_all
	;;
	esac
	;;

	tpf*)
	lt_cv_deplibs_check_method=pass_all
	;;
	os2*)
	lt_cv_deplibs_check_method=pass_all
	;;
	esac

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_deplibs_check_method" >&5
	$as_echo "$lt_cv_deplibs_check_method" >&6; }

	file_magic_glob=
	want_nocaseglob=no
	if test "$build" = "$host"; then
	case $host_os in
	mingw* \| pw32*)
	if ( shopt \| grep nocaseglob ) >/dev/null 2>&1; then
	want_nocaseglob=yes
	else
	file_magic_glob=`echo aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ \| $SED -e "s/$..$/s\/[\1]\/[\1]\/g;/g"`
	fi
	;;
	esac
	fi

	file_magic_cmd=$lt_cv_file_magic_cmd
	deplibs_check_method=$lt_cv_deplibs_check_method
	test -z "$deplibs_check_method" && deplibs_check_method=unknown






















	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}dlltool", so it can be a program name with args.
	set dummy ${ac_tool_prefix}dlltool; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_DLLTOOL+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$DLLTOOL"; then
	ac_cv_prog_DLLTOOL="$DLLTOOL" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_DLLTOOL="${ac_tool_prefix}dlltool"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	DLLTOOL=$ac_cv_prog_DLLTOOL
	if test -n "$DLLTOOL"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $DLLTOOL" >&5
	$as_echo "$DLLTOOL" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$ac_cv_prog_DLLTOOL"; then
	ac_ct_DLLTOOL=$DLLTOOL
	# Extract the first word of "dlltool", so it can be a program name with args.
	set dummy dlltool; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_DLLTOOL+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_DLLTOOL"; then
	ac_cv_prog_ac_ct_DLLTOOL="$ac_ct_DLLTOOL" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_DLLTOOL="dlltool"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_DLLTOOL=$ac_cv_prog_ac_ct_DLLTOOL
	if test -n "$ac_ct_DLLTOOL"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DLLTOOL" >&5
	$as_echo "$ac_ct_DLLTOOL" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi

	if test "x$ac_ct_DLLTOOL" = x; then
	DLLTOOL="false"
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	DLLTOOL=$ac_ct_DLLTOOL
	fi
	else
	DLLTOOL="$ac_cv_prog_DLLTOOL"
	fi

	test -z "$DLLTOOL" && DLLTOOL=dlltool










	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to associate runtime and link libraries" >&5
	$as_echo_n "checking how to associate runtime and link libraries... " >&6; }
	if ${lt_cv_sharedlib_from_linklib_cmd+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_sharedlib_from_linklib_cmd='unknown'

	case $host_os in
	cygwin* \| mingw* \| pw32* \| cegcc*)
	# two different shell functions defined in ltmain.sh;
	# decide which one to use based on capabilities of $DLLTOOL
	case `$DLLTOOL --help 2>&1` in
	--identify-strict)
	lt_cv_sharedlib_from_linklib_cmd=func_cygming_dll_for_implib
	;;
	*)
	lt_cv_sharedlib_from_linklib_cmd=func_cygming_dll_for_implib_fallback
	;;
	esac
	;;
	*)
	# fallback: assume linklib IS sharedlib
	lt_cv_sharedlib_from_linklib_cmd=$ECHO
	;;
	esac

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_sharedlib_from_linklib_cmd" >&5
	$as_echo "$lt_cv_sharedlib_from_linklib_cmd" >&6; }
	sharedlib_from_linklib_cmd=$lt_cv_sharedlib_from_linklib_cmd
	test -z "$sharedlib_from_linklib_cmd" && sharedlib_from_linklib_cmd=$ECHO







	if test -n "$ac_tool_prefix"; then
	for ac_prog in ar
	do
	# Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args.
	set dummy $ac_tool_prefix$ac_prog; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_AR+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$AR"; then
	ac_cv_prog_AR="$AR" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_AR="$ac_tool_prefix$ac_prog"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	AR=$ac_cv_prog_AR
	if test -n "$AR"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $AR" >&5
	$as_echo "$AR" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	test -n "$AR" && break
	done
	fi
	if test -z "$AR"; then
	ac_ct_AR=$AR
	for ac_prog in ar
	do
	# Extract the first word of "$ac_prog", so it can be a program name with args.
	set dummy $ac_prog; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_AR+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_AR"; then
	ac_cv_prog_ac_ct_AR="$ac_ct_AR" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_AR="$ac_prog"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_AR=$ac_cv_prog_ac_ct_AR
	if test -n "$ac_ct_AR"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_AR" >&5
	$as_echo "$ac_ct_AR" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	test -n "$ac_ct_AR" && break
	done

	if test "x$ac_ct_AR" = x; then
	AR="false"
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	AR=$ac_ct_AR
	fi
	fi

	: ${AR=ar}
	: ${AR_FLAGS=cru}











	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for archiver @FILE support" >&5
	$as_echo_n "checking for archiver @FILE support... " >&6; }
	if ${lt_cv_ar_at_file+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_ar_at_file=no
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	echo conftest.$ac_objext > conftest.lst
	lt_ar_try='$AR $AR_FLAGS libconftest.a @conftest.lst >&5'
	{ { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$lt_ar_try\""; } >&5
	(eval $lt_ar_try) 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }
	if test 0 -eq "$ac_status"; then
	# Ensure the archiver fails upon bogus file names.
	rm -f conftest.$ac_objext libconftest.a
	{ { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$lt_ar_try\""; } >&5
	(eval $lt_ar_try) 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }
	if test 0 -ne "$ac_status"; then
	lt_cv_ar_at_file=@
	fi
	fi
	rm -f conftest.* libconftest.a

	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ar_at_file" >&5
	$as_echo "$lt_cv_ar_at_file" >&6; }

	if test no = "$lt_cv_ar_at_file"; then
	archiver_list_spec=
	else
	archiver_list_spec=$lt_cv_ar_at_file
	fi







	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}strip", so it can be a program name with args.
	set dummy ${ac_tool_prefix}strip; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_STRIP+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$STRIP"; then
	ac_cv_prog_STRIP="$STRIP" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_STRIP="${ac_tool_prefix}strip"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	STRIP=$ac_cv_prog_STRIP
	if test -n "$STRIP"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $STRIP" >&5
	$as_echo "$STRIP" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$ac_cv_prog_STRIP"; then
	ac_ct_STRIP=$STRIP
	# Extract the first word of "strip", so it can be a program name with args.
	set dummy strip; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_STRIP+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_STRIP"; then
	ac_cv_prog_ac_ct_STRIP="$ac_ct_STRIP" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_STRIP="strip"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_STRIP=$ac_cv_prog_ac_ct_STRIP
	if test -n "$ac_ct_STRIP"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_STRIP" >&5
	$as_echo "$ac_ct_STRIP" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi

	if test "x$ac_ct_STRIP" = x; then
	STRIP=":"
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	STRIP=$ac_ct_STRIP
	fi
	else
	STRIP="$ac_cv_prog_STRIP"
	fi

	test -z "$STRIP" && STRIP=:






	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}ranlib", so it can be a program name with args.
	set dummy ${ac_tool_prefix}ranlib; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_RANLIB+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$RANLIB"; then
	ac_cv_prog_RANLIB="$RANLIB" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_RANLIB="${ac_tool_prefix}ranlib"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	RANLIB=$ac_cv_prog_RANLIB
	if test -n "$RANLIB"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $RANLIB" >&5
	$as_echo "$RANLIB" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$ac_cv_prog_RANLIB"; then
	ac_ct_RANLIB=$RANLIB
	# Extract the first word of "ranlib", so it can be a program name with args.
	set dummy ranlib; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_RANLIB+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_RANLIB"; then
	ac_cv_prog_ac_ct_RANLIB="$ac_ct_RANLIB" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_RANLIB="ranlib"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_RANLIB=$ac_cv_prog_ac_ct_RANLIB
	if test -n "$ac_ct_RANLIB"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_RANLIB" >&5
	$as_echo "$ac_ct_RANLIB" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi

	if test "x$ac_ct_RANLIB" = x; then
	RANLIB=":"
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	RANLIB=$ac_ct_RANLIB
	fi
	else
	RANLIB="$ac_cv_prog_RANLIB"
	fi

	test -z "$RANLIB" && RANLIB=:






	# Determine commands to create old-style static archives.
	old_archive_cmds='$AR $AR_FLAGS $oldlib$oldobjs'
	old_postinstall_cmds='chmod 644 $oldlib'
	old_postuninstall_cmds=

	if test -n "$RANLIB"; then
	case $host_os in
	bitrig* \| openbsd*)
	old_postinstall_cmds="$old_postinstall_cmds~\$RANLIB -t \$tool_oldlib"
	;;
	*)
	old_postinstall_cmds="$old_postinstall_cmds~\$RANLIB \$tool_oldlib"
	;;
	esac
	old_archive_cmds="$old_archive_cmds~\$RANLIB \$tool_oldlib"
	fi

	case $host_os in
	darwin*)
	lock_old_archive_extraction=yes ;;
	*)
	lock_old_archive_extraction=no ;;
	esac





















	for ac_prog in gawk mawk nawk awk
	do
	# Extract the first word of "$ac_prog", so it can be a program name with args.
	set dummy $ac_prog; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_AWK+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$AWK"; then
	ac_cv_prog_AWK="$AWK" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_AWK="$ac_prog"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	AWK=$ac_cv_prog_AWK
	if test -n "$AWK"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $AWK" >&5
	$as_echo "$AWK" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	test -n "$AWK" && break
	done



















	# If no C compiler was specified, use CC.
	LTCC=${LTCC-"$CC"}

	# If no C compiler flags were specified, use CFLAGS.
	LTCFLAGS=${LTCFLAGS-"$CFLAGS"}

	# Allow CC to be a program name with arguments.
	compiler=$CC


	# Check for command to grab the raw symbol name followed by C symbol from nm.
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking command to parse $NM output from $compiler object" >&5
	$as_echo_n "checking command to parse $NM output from $compiler object... " >&6; }
	if ${lt_cv_sys_global_symbol_pipe+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	# These are sane defaults that work on at least a few old systems.
	# [They come from Ultrix. What could be older than Ultrix?!! ;)]

	# Character class describing NM global symbol codes.
	symcode='[BCDEGRST]'

	# Regexp to match symbols that can be accessed directly from C.
	sympat='$[_A-Za-z][_A-Za-z0-9]*$'

	# Define system-specific variables.
	case $host_os in
	aix*)
	symcode='[BCDT]'
	;;
	cygwin* \| mingw* \| pw32* \| cegcc*)
	symcode='[ABCDGISTW]'
	;;
	hpux*)
	if test ia64 = "$host_cpu"; then
	symcode='[ABCDEGRST]'
	fi
	;;
	irix* \| nonstopux*)
	symcode='[BCDEGRST]'
	;;
	osf*)
	symcode='[BCDEGQRST]'
	;;
	solaris*)
	symcode='[BDRT]'
	;;
	sco3.2v5*)
	symcode='[DT]'
	;;
	sysv4.2uw2*)
	symcode='[DT]'
	;;
	sysv5* \| sco5v6* \| unixware* \| OpenUNIX*)
	symcode='[ABDT]'
	;;
	sysv4)
	symcode='[DFNSTU]'
	;;
	esac

	# If we're using GNU nm, then use its standard symbol codes.
	case `$NM -V 2>&1` in
	GNU \| 'with BFD')
	symcode='[ABCDGIRSTW]' ;;
	esac

	if test "$lt_cv_nm_interface" = "MS dumpbin"; then
	# Gets list of data symbols to import.
	lt_cv_sys_global_symbol_to_import="sed -n -e 's/^I .* $.*$$/\1/p'"
	# Adjust the below global symbol transforms to fixup imported variables.
	lt_cdecl_hook=" -e 's/^I .* $.*$$/extern __declspec(dllimport) char \1;/p'"
	lt_c_name_hook=" -e 's/^I .* $.$$/ {\"\1\", (void ) 0},/p'"
	lt_c_name_lib_hook="\
	-e 's/^I .* $lib.$$/ {\"\1\", (void ) 0},/p'\
	-e 's/^I .* $.$$/ {\"lib\1\", (void ) 0},/p'"
	else
	# Disable hooks by default.
	lt_cv_sys_global_symbol_to_import=
	lt_cdecl_hook=
	lt_c_name_hook=
	lt_c_name_lib_hook=
	fi

	# Transform an extracted symbol line into a proper C declaration.
	# Some systems (esp. on ia64) link data and code symbols differently,
	# so use this general approach.
	lt_cv_sys_global_symbol_to_cdecl="sed -n"\
	$lt_cdecl_hook\
	" -e 's/^T .* $.*$$/extern int \1();/p'"\
	" -e 's/^$symcode$symcode* .* $.*$$/extern char \1;/p'"

	# Transform an extracted symbol line into symbol name and symbol address
	lt_cv_sys_global_symbol_to_c_name_address="sed -n"\
	$lt_c_name_hook\
	" -e 's/^: $.$ .$/ {\"\1\", (void *) 0},/p'"\
	" -e 's/^$symcode$symcode* .* $.$$/ {\"\1\", (void ) \&\1},/p'"

	# Transform an extracted symbol line into symbol name with lib prefix and
	# symbol address.
	lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="sed -n"\
	$lt_c_name_lib_hook\
	" -e 's/^: $.$ .$/ {\"\1\", (void *) 0},/p'"\
	" -e 's/^$symcode$symcode* .* $lib.$$/ {\"\1\", (void ) \&\1},/p'"\
	" -e 's/^$symcode$symcode* .* $.$$/ {\"lib\1\", (void ) \&\1},/p'"

	# Handle CRLF in mingw tool chain
	opt_cr=
	case $build_os in
	mingw*)
	opt_cr=`$ECHO 'x\{0,1\}' \| tr x '\015'` # option cr in regexp
	;;
	esac

	# Try without a prefix underscore, then with it.
	for ac_symprfx in "" "_"; do

	# Transform symcode, sympat, and symprfx into a raw symbol and a C symbol.
	symxfrm="\\1 $ac_symprfx\\2 \\2"

	# Write the raw and C identifiers.
	if test "$lt_cv_nm_interface" = "MS dumpbin"; then
	# Fake it for dumpbin and say T for any non-static function,
	# D for any global variable and I for any imported variable.
	# Also find C++ and __fastcall symbols from MSVC++,
	# which start with @ or ?.
	lt_cv_sys_global_symbol_pipe="$AWK '"\
	" {last_section=section; section=\$ 3};"\
	" /^COFF SYMBOL TABLE/{for(i in hide) delete hide[i]};"\
	" /Section length .#relocs.(pick any)/{hide[last_section]=1};"\
	" /^ Symbol name : /{split(\$ 0,sn,\":\"); si=substr(sn[2],2)};"\
	" /^ Type : code/{print \"T\",si,substr(si,length(prfx))};"\
	" /^ Type : data/{print \"I\",si,substr(si,length(prfx))};"\
	" \$ 0!~/External *\\|/{next};"\
	" / 0+ UNDEF /{next}; / UNDEF $[^\|]$*()/{next};"\
	" {if(hide[section]) next};"\
	" {f=\"D\"}; \$ 0~/.*\\|/{f=\"T\"};"\
	" {split(\$ 0,a,/\\|\|\r/); split(a[2],s)};"\
	" s[1]~/^[@?]/{print f,s[1],s[1]; next};"\
	" s[1]~prfx {split(s[1],t,\"@\"); print f,t[1],substr(t[1],length(prfx))}"\
	" ' prfx=^$ac_symprfx"
	else
	lt_cv_sys_global_symbol_pipe="sed -n -e 's/^.[ ]$$symcode$symcode$[ ][ ]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'"
	fi
	lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe \| sed '/ __gnu_lto/d'"

	# Check to see that the pipe works correctly.
	pipe_works=no

	rm -f conftest*
	cat > conftest.$ac_ext <<_LT_EOF
	#ifdef __cplusplus
	extern "C" {
	#endif
	char nm_test_var;
	void nm_test_func(void);
	void nm_test_func(void){}
	#ifdef __cplusplus
	}
	#endif
	int main(){nm_test_var='a';nm_test_func();return(0);}
	_LT_EOF

	if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
	(eval $ac_compile) 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }; then
	# Now try to grab the symbols.
	nlist=conftest.nm
	if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$NM conftest.$ac_objext \\| "$lt_cv_sys_global_symbol_pipe" \> $nlist\""; } >&5
	(eval $NM conftest.$ac_objext \\| "$lt_cv_sys_global_symbol_pipe" \> $nlist) 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; } && test -s "$nlist"; then
	# Try sorting and uniquifying the output.
	if sort "$nlist" \| uniq > "$nlist"T; then
	mv -f "$nlist"T "$nlist"
	else
	rm -f "$nlist"T
	fi

	# Make sure that we snagged all the symbols we need.
	if $GREP ' nm_test_var$' "$nlist" >/dev/null; then
	if $GREP ' nm_test_func$' "$nlist" >/dev/null; then
	cat <<_LT_EOF > conftest.$ac_ext
	/* Keep this code in sync between libtool.m4, ltmain, lt_system.h, and tests. */
	#if defined _WIN32 \|\| defined __CYGWIN__ \|\| defined _WIN32_WCE
	/* DATA imports from DLLs on WIN32 can't be const, because runtime
	relocations are performed -- see ld's documentation on pseudo-relocs. */
	# define LT_DLSYM_CONST
	#elif defined __osf__
	/* This system does not cope well with relocations in const data. */
	# define LT_DLSYM_CONST
	#else
	# define LT_DLSYM_CONST const
	#endif

	#ifdef __cplusplus
	extern "C" {
	#endif

	_LT_EOF
	# Now generate the symbol file.
	eval "$lt_cv_sys_global_symbol_to_cdecl"' < "$nlist" \| $GREP -v main >> conftest.$ac_ext'

	cat <<_LT_EOF >> conftest.$ac_ext

	/* The mapping between symbol names and symbols. */
	LT_DLSYM_CONST struct {
	const char *name;
	void *address;
	}
	lt__PROGRAM__LTX_preloaded_symbols[] =
	{
	{ "@PROGRAM@", (void *) 0 },
	_LT_EOF
	$SED "s/^$symcode$symcode* .* $.$$/ {\"\1\", (void ) \&\1},/" < "$nlist" \| $GREP -v main >> conftest.$ac_ext
	cat <<\_LT_EOF >> conftest.$ac_ext
	{0, (void *) 0}
	};

	/* This works around a problem in FreeBSD linker */
	#ifdef FREEBSD_WORKAROUND
	static const void *lt_preloaded_setup() {
	return lt__PROGRAM__LTX_preloaded_symbols;
	}
	#endif

	#ifdef __cplusplus
	}
	#endif
	_LT_EOF
	# Now try linking the two files.
	mv conftest.$ac_objext conftstm.$ac_objext
	lt_globsym_save_LIBS=$LIBS
	lt_globsym_save_CFLAGS=$CFLAGS
	LIBS=conftstm.$ac_objext
	CFLAGS="$CFLAGS$lt_prog_compiler_no_builtin_flag"
	if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_link\""; } >&5
	(eval $ac_link) 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; } && test -s conftest$ac_exeext; then
	pipe_works=yes
	fi
	LIBS=$lt_globsym_save_LIBS
	CFLAGS=$lt_globsym_save_CFLAGS
	else
	echo "cannot find nm_test_func in $nlist" >&5
	fi
	else
	echo "cannot find nm_test_var in $nlist" >&5
	fi
	else
	echo "cannot run $lt_cv_sys_global_symbol_pipe" >&5
	fi
	else
	echo "$progname: failed program was:" >&5
	cat conftest.$ac_ext >&5
	fi
	rm -rf conftest* conftst*

	# Do not use the global_symbol_pipe unless it works.
	if test yes = "$pipe_works"; then
	break
	else
	lt_cv_sys_global_symbol_pipe=
	fi
	done

	fi

	if test -z "$lt_cv_sys_global_symbol_pipe"; then
	lt_cv_sys_global_symbol_to_cdecl=
	fi
	if test -z "$lt_cv_sys_global_symbol_pipe$lt_cv_sys_global_symbol_to_cdecl"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
	$as_echo "failed" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: ok" >&5
	$as_echo "ok" >&6; }
	fi

	# Response file support.
	if test "$lt_cv_nm_interface" = "MS dumpbin"; then
	nm_file_list_spec='@'
	elif $NM --help 2>/dev/null \| grep '[@]FILE' >/dev/null; then
	nm_file_list_spec='@'
	fi





































	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for sysroot" >&5
	$as_echo_n "checking for sysroot... " >&6; }

	# Check whether --with-sysroot was given.
	if test "${with_sysroot+set}" = set; then :
	withval=$with_sysroot;
	else
	with_sysroot=no
	fi


	lt_sysroot=
	case $with_sysroot in #(
	yes)
	if test yes = "$GCC"; then
	lt_sysroot=`$CC --print-sysroot 2>/dev/null`
	fi
	;; #(
	/*)
	lt_sysroot=`echo "$with_sysroot" \| sed -e "$sed_quote_subst"`
	;; #(
	no\|'')
	;; #(
	*)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $with_sysroot" >&5
	$as_echo "$with_sysroot" >&6; }
	as_fn_error $? "The sysroot must be an absolute path." "$LINENO" 5
	;;
	esac

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: ${lt_sysroot:-no}" >&5
	$as_echo "${lt_sysroot:-no}" >&6; }





	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for a working dd" >&5
	$as_echo_n "checking for a working dd... " >&6; }
	if ${ac_cv_path_lt_DD+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	printf 0123456789abcdef0123456789abcdef >conftest.i
	cat conftest.i conftest.i >conftest2.i
	: ${lt_DD:=$DD}
	if test -z "$lt_DD"; then
	ac_path_lt_DD_found=false
	# Loop through the user's path and test for each of PROGNAME-LIST
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_prog in dd; do
	for ac_exec_ext in '' $ac_executable_extensions; do
	ac_path_lt_DD="$as_dir/$ac_prog$ac_exec_ext"
	as_fn_executable_p "$ac_path_lt_DD" \|\| continue
	if "$ac_path_lt_DD" bs=32 count=1 <conftest2.i >conftest.out 2>/dev/null; then
	cmp -s conftest.i conftest.out \
	&& ac_cv_path_lt_DD="$ac_path_lt_DD" ac_path_lt_DD_found=:
	fi
	$ac_path_lt_DD_found && break 3
	done
	done
	done
	IFS=$as_save_IFS
	if test -z "$ac_cv_path_lt_DD"; then
	:
	fi
	else
	ac_cv_path_lt_DD=$lt_DD
	fi

	rm -f conftest.i conftest2.i conftest.out
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_lt_DD" >&5
	$as_echo "$ac_cv_path_lt_DD" >&6; }


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to truncate binary pipes" >&5
	$as_echo_n "checking how to truncate binary pipes... " >&6; }
	if ${lt_cv_truncate_bin+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	printf 0123456789abcdef0123456789abcdef >conftest.i
	cat conftest.i conftest.i >conftest2.i
	lt_cv_truncate_bin=
	if "$ac_cv_path_lt_DD" bs=32 count=1 <conftest2.i >conftest.out 2>/dev/null; then
	cmp -s conftest.i conftest.out \
	&& lt_cv_truncate_bin="$ac_cv_path_lt_DD bs=4096 count=1"
	fi
	rm -f conftest.i conftest2.i conftest.out
	test -z "$lt_cv_truncate_bin" && lt_cv_truncate_bin="$SED -e 4q"
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_truncate_bin" >&5
	$as_echo "$lt_cv_truncate_bin" >&6; }







	# Calculate cc_basename. Skip known compiler wrappers and cross-prefix.
	func_cc_basename ()
	{
	for cc_temp in $*""; do
	case $cc_temp in
	compile \| [\\/]compile \| ccache \| [\\/]ccache ) ;;
	distcc \| [\\/]distcc \| purify \| [\\/]purify ) ;;
	\-*) ;;
	*) break;;
	esac
	done
	func_cc_basename_result=`$ECHO "$cc_temp" \| $SED "s%.*/%%; s%^$host_alias-%%"`
	}

	# Check whether --enable-libtool-lock was given.
	if test "${enable_libtool_lock+set}" = set; then :
	enableval=$enable_libtool_lock;
	fi

	test no = "$enable_libtool_lock" \|\| enable_libtool_lock=yes

	# Some flags need to be propagated to the compiler or linker for good
	# libtool support.
	case $host in
	ia64--hpux)
	# Find out what ABI is being produced by ac_compile, and set mode
	# options accordingly.
	echo 'int i;' > conftest.$ac_ext
	if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
	(eval $ac_compile) 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }; then
	case `/usr/bin/file conftest.$ac_objext` in
	ELF-32)
	HPUX_IA64_MODE=32
	;;
	ELF-64)
	HPUX_IA64_MODE=64
	;;
	esac
	fi
	rm -rf conftest*
	;;
	--irix6*)
	# Find out what ABI is being produced by ac_compile, and set linker
	# options accordingly.
	echo '#line '$LINENO' "configure"' > conftest.$ac_ext
	if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
	(eval $ac_compile) 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }; then
	if test yes = "$lt_cv_prog_gnu_ld"; then
	case `/usr/bin/file conftest.$ac_objext` in
	32-bit)
	LD="${LD-ld} -melf32bsmip"
	;;
	N32)
	LD="${LD-ld} -melf32bmipn32"
	;;
	64-bit)
	LD="${LD-ld} -melf64bmip"
	;;
	esac
	else
	case `/usr/bin/file conftest.$ac_objext` in
	32-bit)
	LD="${LD-ld} -32"
	;;
	N32)
	LD="${LD-ld} -n32"
	;;
	64-bit)
	LD="${LD-ld} -64"
	;;
	esac
	fi
	fi
	rm -rf conftest*
	;;

	mips64-linux*)
	# Find out what ABI is being produced by ac_compile, and set linker
	# options accordingly.
	echo '#line '$LINENO' "configure"' > conftest.$ac_ext
	if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
	(eval $ac_compile) 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }; then
	emul=elf
	case `/usr/bin/file conftest.$ac_objext` in
	32-bit)
	emul="${emul}32"
	;;
	64-bit)
	emul="${emul}64"
	;;
	esac
	case `/usr/bin/file conftest.$ac_objext` in
	MSB)
	emul="${emul}btsmip"
	;;
	LSB)
	emul="${emul}ltsmip"
	;;
	esac
	case `/usr/bin/file conftest.$ac_objext` in
	N32)
	emul="${emul}n32"
	;;
	esac
	LD="${LD-ld} -m $emul"
	fi
	rm -rf conftest*
	;;

	x86_64-kfreebsd-gnu\|x86_64-linux\|powerpc-linux*\| \
	s390-linux\|s390-tpf\|sparc-linux*)
	# Find out what ABI is being produced by ac_compile, and set linker
	# options accordingly. Note that the listed cases only cover the
	# situations where additional linker options are needed (such as when
	# doing 32-bit compilation for a host where ld defaults to 64-bit, or
	# vice versa); the common cases where no linker options are needed do
	# not appear in the list.
	echo 'int i;' > conftest.$ac_ext
	if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
	(eval $ac_compile) 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }; then
	case `/usr/bin/file conftest.o` in
	32-bit)
	case $host in
	x86_64-kfreebsd-gnu)
	LD="${LD-ld} -m elf_i386_fbsd"
	;;
	x86_64-linux)
	case `/usr/bin/file conftest.o` in
	x86-64)
	LD="${LD-ld} -m elf32_x86_64"
	;;
	*)
	LD="${LD-ld} -m elf_i386"
	;;
	esac
	;;
	powerpc64le-linux)
	LD="${LD-ld} -m elf32lppclinux"
	;;
	powerpc64-linux)
	LD="${LD-ld} -m elf32ppclinux"
	;;
	s390x-linux)
	LD="${LD-ld} -m elf_s390"
	;;
	sparc64-linux)
	LD="${LD-ld} -m elf32_sparc"
	;;
	esac
	;;
	64-bit)
	case $host in
	x86_64-kfreebsd-gnu)
	LD="${LD-ld} -m elf_x86_64_fbsd"
	;;
	x86_64-linux)
	LD="${LD-ld} -m elf_x86_64"
	;;
	powerpcle-linux)
	LD="${LD-ld} -m elf64lppc"
	;;
	powerpc-linux)
	LD="${LD-ld} -m elf64ppc"
	;;
	s390-linux\|s390-tpf)
	LD="${LD-ld} -m elf64_s390"
	;;
	sparc-linux*)
	LD="${LD-ld} -m elf64_sparc"
	;;
	esac
	;;
	esac
	fi
	rm -rf conftest*
	;;

	--sco3.2v5*)
	# On SCO OpenServer 5, we need -belf to get full-featured binaries.
	SAVE_CFLAGS=$CFLAGS
	CFLAGS="$CFLAGS -belf"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler needs -belf" >&5
	$as_echo_n "checking whether the C compiler needs -belf... " >&6; }
	if ${lt_cv_cc_needs_belf+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_ext=c
	ac_cpp='$CPP $CPPFLAGS'
	ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
	ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
	ac_compiler_gnu=$ac_cv_c_compiler_gnu

	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	lt_cv_cc_needs_belf=yes
	else
	lt_cv_cc_needs_belf=no
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	ac_ext=c
	ac_cpp='$CPP $CPPFLAGS'
	ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
	ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
	ac_compiler_gnu=$ac_cv_c_compiler_gnu

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_cc_needs_belf" >&5
	$as_echo "$lt_cv_cc_needs_belf" >&6; }
	if test yes != "$lt_cv_cc_needs_belf"; then
	# this is probably gcc 2.8.0, egcs 1.0 or newer; no need for -belf
	CFLAGS=$SAVE_CFLAGS
	fi
	;;
	-solaris*)
	# Find out what ABI is being produced by ac_compile, and set linker
	# options accordingly.
	echo 'int i;' > conftest.$ac_ext
	if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
	(eval $ac_compile) 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }; then
	case `/usr/bin/file conftest.o` in
	64-bit)
	case $lt_cv_prog_gnu_ld in
	yes*)
	case $host in
	i?86--solaris\|x86_64--solaris)
	LD="${LD-ld} -m elf_x86_64"
	;;
	sparc--solaris*)
	LD="${LD-ld} -m elf64_sparc"
	;;
	esac
	# GNU ld 2.21 introduced _sol2 emulations. Use them if available.
	if ${LD-ld} -V \| grep _sol2 >/dev/null 2>&1; then
	LD=${LD-ld}_sol2
	fi
	;;
	*)
	if ${LD-ld} -64 -r -o conftest2.o conftest.o >/dev/null 2>&1; then
	LD="${LD-ld} -64"
	fi
	;;
	esac
	;;
	esac
	fi
	rm -rf conftest*
	;;
	esac

	need_locks=$enable_libtool_lock

	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}mt", so it can be a program name with args.
	set dummy ${ac_tool_prefix}mt; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_MANIFEST_TOOL+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$MANIFEST_TOOL"; then
	ac_cv_prog_MANIFEST_TOOL="$MANIFEST_TOOL" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_MANIFEST_TOOL="${ac_tool_prefix}mt"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	MANIFEST_TOOL=$ac_cv_prog_MANIFEST_TOOL
	if test -n "$MANIFEST_TOOL"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $MANIFEST_TOOL" >&5
	$as_echo "$MANIFEST_TOOL" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$ac_cv_prog_MANIFEST_TOOL"; then
	ac_ct_MANIFEST_TOOL=$MANIFEST_TOOL
	# Extract the first word of "mt", so it can be a program name with args.
	set dummy mt; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_MANIFEST_TOOL+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_MANIFEST_TOOL"; then
	ac_cv_prog_ac_ct_MANIFEST_TOOL="$ac_ct_MANIFEST_TOOL" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_MANIFEST_TOOL="mt"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_MANIFEST_TOOL=$ac_cv_prog_ac_ct_MANIFEST_TOOL
	if test -n "$ac_ct_MANIFEST_TOOL"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_MANIFEST_TOOL" >&5
	$as_echo "$ac_ct_MANIFEST_TOOL" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi

	if test "x$ac_ct_MANIFEST_TOOL" = x; then
	MANIFEST_TOOL=":"
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	MANIFEST_TOOL=$ac_ct_MANIFEST_TOOL
	fi
	else
	MANIFEST_TOOL="$ac_cv_prog_MANIFEST_TOOL"
	fi

	test -z "$MANIFEST_TOOL" && MANIFEST_TOOL=mt
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if $MANIFEST_TOOL is a manifest tool" >&5
	$as_echo_n "checking if $MANIFEST_TOOL is a manifest tool... " >&6; }
	if ${lt_cv_path_mainfest_tool+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_path_mainfest_tool=no
	echo "$as_me:$LINENO: $MANIFEST_TOOL '-?'" >&5
	$MANIFEST_TOOL '-?' 2>conftest.err > conftest.out
	cat conftest.err >&5
	if $GREP 'Manifest Tool' conftest.out > /dev/null; then
	lt_cv_path_mainfest_tool=yes
	fi
	rm -f conftest*
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_path_mainfest_tool" >&5
	$as_echo "$lt_cv_path_mainfest_tool" >&6; }
	if test yes != "$lt_cv_path_mainfest_tool"; then
	MANIFEST_TOOL=:
	fi






	case $host_os in
	rhapsody* \| darwin*)
	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}dsymutil", so it can be a program name with args.
	set dummy ${ac_tool_prefix}dsymutil; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_DSYMUTIL+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$DSYMUTIL"; then
	ac_cv_prog_DSYMUTIL="$DSYMUTIL" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_DSYMUTIL="${ac_tool_prefix}dsymutil"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	DSYMUTIL=$ac_cv_prog_DSYMUTIL
	if test -n "$DSYMUTIL"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $DSYMUTIL" >&5
	$as_echo "$DSYMUTIL" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$ac_cv_prog_DSYMUTIL"; then
	ac_ct_DSYMUTIL=$DSYMUTIL
	# Extract the first word of "dsymutil", so it can be a program name with args.
	set dummy dsymutil; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_DSYMUTIL+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_DSYMUTIL"; then
	ac_cv_prog_ac_ct_DSYMUTIL="$ac_ct_DSYMUTIL" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_DSYMUTIL="dsymutil"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_DSYMUTIL=$ac_cv_prog_ac_ct_DSYMUTIL
	if test -n "$ac_ct_DSYMUTIL"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DSYMUTIL" >&5
	$as_echo "$ac_ct_DSYMUTIL" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi

	if test "x$ac_ct_DSYMUTIL" = x; then
	DSYMUTIL=":"
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	DSYMUTIL=$ac_ct_DSYMUTIL
	fi
	else
	DSYMUTIL="$ac_cv_prog_DSYMUTIL"
	fi

	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}nmedit", so it can be a program name with args.
	set dummy ${ac_tool_prefix}nmedit; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_NMEDIT+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$NMEDIT"; then
	ac_cv_prog_NMEDIT="$NMEDIT" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_NMEDIT="${ac_tool_prefix}nmedit"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	NMEDIT=$ac_cv_prog_NMEDIT
	if test -n "$NMEDIT"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $NMEDIT" >&5
	$as_echo "$NMEDIT" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$ac_cv_prog_NMEDIT"; then
	ac_ct_NMEDIT=$NMEDIT
	# Extract the first word of "nmedit", so it can be a program name with args.
	set dummy nmedit; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_NMEDIT+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_NMEDIT"; then
	ac_cv_prog_ac_ct_NMEDIT="$ac_ct_NMEDIT" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_NMEDIT="nmedit"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_NMEDIT=$ac_cv_prog_ac_ct_NMEDIT
	if test -n "$ac_ct_NMEDIT"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_NMEDIT" >&5
	$as_echo "$ac_ct_NMEDIT" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi

	if test "x$ac_ct_NMEDIT" = x; then
	NMEDIT=":"
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	NMEDIT=$ac_ct_NMEDIT
	fi
	else
	NMEDIT="$ac_cv_prog_NMEDIT"
	fi

	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}lipo", so it can be a program name with args.
	set dummy ${ac_tool_prefix}lipo; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_LIPO+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$LIPO"; then
	ac_cv_prog_LIPO="$LIPO" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_LIPO="${ac_tool_prefix}lipo"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	LIPO=$ac_cv_prog_LIPO
	if test -n "$LIPO"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $LIPO" >&5
	$as_echo "$LIPO" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$ac_cv_prog_LIPO"; then
	ac_ct_LIPO=$LIPO
	# Extract the first word of "lipo", so it can be a program name with args.
	set dummy lipo; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_LIPO+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_LIPO"; then
	ac_cv_prog_ac_ct_LIPO="$ac_ct_LIPO" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_LIPO="lipo"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_LIPO=$ac_cv_prog_ac_ct_LIPO
	if test -n "$ac_ct_LIPO"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_LIPO" >&5
	$as_echo "$ac_ct_LIPO" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi

	if test "x$ac_ct_LIPO" = x; then
	LIPO=":"
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	LIPO=$ac_ct_LIPO
	fi
	else
	LIPO="$ac_cv_prog_LIPO"
	fi

	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}otool", so it can be a program name with args.
	set dummy ${ac_tool_prefix}otool; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_OTOOL+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$OTOOL"; then
	ac_cv_prog_OTOOL="$OTOOL" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_OTOOL="${ac_tool_prefix}otool"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	OTOOL=$ac_cv_prog_OTOOL
	if test -n "$OTOOL"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $OTOOL" >&5
	$as_echo "$OTOOL" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$ac_cv_prog_OTOOL"; then
	ac_ct_OTOOL=$OTOOL
	# Extract the first word of "otool", so it can be a program name with args.
	set dummy otool; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_OTOOL+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_OTOOL"; then
	ac_cv_prog_ac_ct_OTOOL="$ac_ct_OTOOL" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_OTOOL="otool"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_OTOOL=$ac_cv_prog_ac_ct_OTOOL
	if test -n "$ac_ct_OTOOL"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OTOOL" >&5
	$as_echo "$ac_ct_OTOOL" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi

	if test "x$ac_ct_OTOOL" = x; then
	OTOOL=":"
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	OTOOL=$ac_ct_OTOOL
	fi
	else
	OTOOL="$ac_cv_prog_OTOOL"
	fi

	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}otool64", so it can be a program name with args.
	set dummy ${ac_tool_prefix}otool64; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_OTOOL64+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$OTOOL64"; then
	ac_cv_prog_OTOOL64="$OTOOL64" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_OTOOL64="${ac_tool_prefix}otool64"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	OTOOL64=$ac_cv_prog_OTOOL64
	if test -n "$OTOOL64"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $OTOOL64" >&5
	$as_echo "$OTOOL64" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$ac_cv_prog_OTOOL64"; then
	ac_ct_OTOOL64=$OTOOL64
	# Extract the first word of "otool64", so it can be a program name with args.
	set dummy otool64; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_OTOOL64+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_OTOOL64"; then
	ac_cv_prog_ac_ct_OTOOL64="$ac_ct_OTOOL64" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_OTOOL64="otool64"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_OTOOL64=$ac_cv_prog_ac_ct_OTOOL64
	if test -n "$ac_ct_OTOOL64"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OTOOL64" >&5
	$as_echo "$ac_ct_OTOOL64" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi

	if test "x$ac_ct_OTOOL64" = x; then
	OTOOL64=":"
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	OTOOL64=$ac_ct_OTOOL64
	fi
	else
	OTOOL64="$ac_cv_prog_OTOOL64"
	fi



























	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for -single_module linker flag" >&5
	$as_echo_n "checking for -single_module linker flag... " >&6; }
	if ${lt_cv_apple_cc_single_mod+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_apple_cc_single_mod=no
	if test -z "$LT_MULTI_MODULE"; then
	# By default we will add the -single_module flag. You can override
	# by either setting the environment variable LT_MULTI_MODULE
	# non-empty at configure time, or by adding -multi_module to the
	# link flags.
	rm -rf libconftest.dylib*
	echo "int foo(void){return 1;}" > conftest.c
	echo "$LTCC $LTCFLAGS $LDFLAGS -o libconftest.dylib \
	-dynamiclib -Wl,-single_module conftest.c" >&5
	$LTCC $LTCFLAGS $LDFLAGS -o libconftest.dylib \
	-dynamiclib -Wl,-single_module conftest.c 2>conftest.err
	_lt_result=$?
	# If there is a non-empty error log, and "single_module"
	# appears in it, assume the flag caused a linker warning
	if test -s conftest.err && $GREP single_module conftest.err; then
	cat conftest.err >&5
	# Otherwise, if the output was created with a 0 exit code from
	# the compiler, it worked.
	elif test -f libconftest.dylib && test 0 = "$_lt_result"; then
	lt_cv_apple_cc_single_mod=yes
	else
	cat conftest.err >&5
	fi
	rm -rf libconftest.dylib*
	rm -f conftest.*
	fi
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_apple_cc_single_mod" >&5
	$as_echo "$lt_cv_apple_cc_single_mod" >&6; }

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for -exported_symbols_list linker flag" >&5
	$as_echo_n "checking for -exported_symbols_list linker flag... " >&6; }
	if ${lt_cv_ld_exported_symbols_list+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_ld_exported_symbols_list=no
	save_LDFLAGS=$LDFLAGS
	echo "_main" > conftest.sym
	LDFLAGS="$LDFLAGS -Wl,-exported_symbols_list,conftest.sym"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	lt_cv_ld_exported_symbols_list=yes
	else
	lt_cv_ld_exported_symbols_list=no
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	LDFLAGS=$save_LDFLAGS

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_exported_symbols_list" >&5
	$as_echo "$lt_cv_ld_exported_symbols_list" >&6; }

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for -force_load linker flag" >&5
	$as_echo_n "checking for -force_load linker flag... " >&6; }
	if ${lt_cv_ld_force_load+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_ld_force_load=no
	cat > conftest.c << _LT_EOF
	int forced_loaded() { return 2;}
	_LT_EOF
	echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&5
	$LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&5
	echo "$AR cru libconftest.a conftest.o" >&5
	$AR cru libconftest.a conftest.o 2>&5
	echo "$RANLIB libconftest.a" >&5
	$RANLIB libconftest.a 2>&5
	cat > conftest.c << _LT_EOF
	int main() { return 0;}
	_LT_EOF
	echo "$LTCC $LTCFLAGS $LDFLAGS -o conftest conftest.c -Wl,-force_load,./libconftest.a" >&5
	$LTCC $LTCFLAGS $LDFLAGS -o conftest conftest.c -Wl,-force_load,./libconftest.a 2>conftest.err
	_lt_result=$?
	if test -s conftest.err && $GREP force_load conftest.err; then
	cat conftest.err >&5
	elif test -f conftest && test 0 = "$_lt_result" && $GREP forced_load conftest >/dev/null 2>&1; then
	lt_cv_ld_force_load=yes
	else
	cat conftest.err >&5
	fi
	rm -f conftest.err libconftest.a conftest conftest.c
	rm -rf conftest.dSYM

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_force_load" >&5
	$as_echo "$lt_cv_ld_force_load" >&6; }
	case $host_os in
	rhapsody* \| darwin1.[012])
	_lt_dar_allow_undefined='$wl-undefined ${wl}suppress' ;;
	darwin1.*)
	_lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
	darwin*) # darwin 5.x on
	# if running on 10.5 or later, the deployment target defaults
	# to the OS version, if on x86, and 10.4, the deployment
	# target defaults to 10.4. Don't you love it?
	case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in
	10.0,86-darwin8\|10.0,-darwin[91]*)
	_lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
	10.[012][,.]*)
	_lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
	10.*)
	_lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
	esac
	;;
	esac
	if test yes = "$lt_cv_apple_cc_single_mod"; then
	_lt_dar_single_mod='$single_module'
	fi
	if test yes = "$lt_cv_ld_exported_symbols_list"; then
	_lt_dar_export_syms=' $wl-exported_symbols_list,$output_objdir/$libname-symbols.expsym'
	else
	_lt_dar_export_syms='~$NMEDIT -s $output_objdir/$libname-symbols.expsym $lib'
	fi
	if test : != "$DSYMUTIL" && test no = "$lt_cv_ld_force_load"; then
	_lt_dsymutil='~$DSYMUTIL $lib \|\| :'
	else
	_lt_dsymutil=
	fi
	;;
	esac

	# func_munge_path_list VARIABLE PATH
	# -----------------------------------
	# VARIABLE is name of variable containing _space_ separated list of
	# directories to be munged by the contents of PATH, which is string
	# having a format:
	# "DIR[:DIR]:"
	# string "DIR[ DIR]" will be prepended to VARIABLE
	# ":DIR[:DIR]"
	# string "DIR[ DIR]" will be appended to VARIABLE
	# "DIRP[:DIRP]::[DIRA:]DIRA"
	# string "DIRP[ DIRP]" will be prepended to VARIABLE and string
	# "DIRA[ DIRA]" will be appended to VARIABLE
	# "DIR[:DIR]"
	# VARIABLE will be replaced by "DIR[ DIR]"
	func_munge_path_list ()
	{
	case x$2 in
	x)
	;;
	*:)
	eval $1=\"`$ECHO $2 \| $SED 's/:/ /g'` \$$1\"
	;;
	x:*)
	eval $1=\"\$$1 `$ECHO $2 \| $SED 's/:/ /g'`\"
	;;
	::)
	eval $1=\"\$$1\ `$ECHO $2 \| $SED -e 's/.*:://' -e 's/:/ /g'`\"
	eval $1=\"`$ECHO $2 \| $SED -e 's/::.*//' -e 's/:/ /g'`\ \$$1\"
	;;
	*)
	eval $1=\"`$ECHO $2 \| $SED 's/:/ /g'`\"
	;;
	esac
	}

	for ac_header in dlfcn.h
	do :
	ac_fn_c_check_header_compile "$LINENO" "dlfcn.h" "ac_cv_header_dlfcn_h" "$ac_includes_default
	"
	if test "x$ac_cv_header_dlfcn_h" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_DLFCN_H 1
	_ACEOF

	fi

	done







	# Set options



	enable_dlopen=no


	enable_win32_dll=no


	# Check whether --enable-shared was given.
	if test "${enable_shared+set}" = set; then :
	enableval=$enable_shared; p=${PACKAGE-default}
	case $enableval in
	yes) enable_shared=yes ;;
	no) enable_shared=no ;;
	*)
	enable_shared=no
	# Look at the argument we got. We use all the common list separators.
	lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR,
	for pkg in $enableval; do
	IFS=$lt_save_ifs
	if test "X$pkg" = "X$p"; then
	enable_shared=yes
	fi
	done
	IFS=$lt_save_ifs
	;;
	esac
	else
	enable_shared=yes
	fi









	# Check whether --enable-static was given.
	if test "${enable_static+set}" = set; then :
	enableval=$enable_static; p=${PACKAGE-default}
	case $enableval in
	yes) enable_static=yes ;;
	no) enable_static=no ;;
	*)
	enable_static=no
	# Look at the argument we got. We use all the common list separators.
	lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR,
	for pkg in $enableval; do
	IFS=$lt_save_ifs
	if test "X$pkg" = "X$p"; then
	enable_static=yes
	fi
	done
	IFS=$lt_save_ifs
	;;
	esac
	else
	enable_static=yes
	fi










	# Check whether --with-pic was given.
	if test "${with_pic+set}" = set; then :
	withval=$with_pic; lt_p=${PACKAGE-default}
	case $withval in
	yes\|no) pic_mode=$withval ;;
	*)
	pic_mode=default
	# Look at the argument we got. We use all the common list separators.
	lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR,
	for lt_pkg in $withval; do
	IFS=$lt_save_ifs
	if test "X$lt_pkg" = "X$lt_p"; then
	pic_mode=yes
	fi
	done
	IFS=$lt_save_ifs
	;;
	esac
	else
	pic_mode=default
	fi








	# Check whether --enable-fast-install was given.
	if test "${enable_fast_install+set}" = set; then :
	enableval=$enable_fast_install; p=${PACKAGE-default}
	case $enableval in
	yes) enable_fast_install=yes ;;
	no) enable_fast_install=no ;;
	*)
	enable_fast_install=no
	# Look at the argument we got. We use all the common list separators.
	lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR,
	for pkg in $enableval; do
	IFS=$lt_save_ifs
	if test "X$pkg" = "X$p"; then
	enable_fast_install=yes
	fi
	done
	IFS=$lt_save_ifs
	;;
	esac
	else
	enable_fast_install=yes
	fi








	shared_archive_member_spec=
	case $host,$enable_shared in
	power--aix[5-9]*,yes)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking which variant of shared library versioning to provide" >&5
	$as_echo_n "checking which variant of shared library versioning to provide... " >&6; }

	# Check whether --with-aix-soname was given.
	if test "${with_aix_soname+set}" = set; then :
	withval=$with_aix_soname; case $withval in
	aix\|svr4\|both)
	;;
	*)
	as_fn_error $? "Unknown argument to --with-aix-soname" "$LINENO" 5
	;;
	esac
	lt_cv_with_aix_soname=$with_aix_soname
	else
	if ${lt_cv_with_aix_soname+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_with_aix_soname=aix
	fi

	with_aix_soname=$lt_cv_with_aix_soname
	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $with_aix_soname" >&5
	$as_echo "$with_aix_soname" >&6; }
	if test aix != "$with_aix_soname"; then
	# For the AIX way of multilib, we name the shared archive member
	# based on the bitwidth used, traditionally 'shr.o' or 'shr_64.o',
	# and 'shr.imp' or 'shr_64.imp', respectively, for the Import File.
	# Even when GNU compilers ignore OBJECT_MODE but need '-maix64' flag,
	# the AIX toolchain works better with OBJECT_MODE set (default 32).
	if test 64 = "${OBJECT_MODE-32}"; then
	shared_archive_member_spec=shr_64
	else
	shared_archive_member_spec=shr
	fi
	fi
	;;
	*)
	with_aix_soname=aix
	;;
	esac










	# This can be used to rebuild libtool when needed
	LIBTOOL_DEPS=$ltmain

	# Always use our own libtool.
	LIBTOOL='$(SHELL) $(top_builddir)/libtool'






























	test -z "$LN_S" && LN_S="ln -s"














	if test -n "${ZSH_VERSION+set}"; then
	setopt NO_GLOB_SUBST
	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for objdir" >&5
	$as_echo_n "checking for objdir... " >&6; }
	if ${lt_cv_objdir+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	rm -f .libs 2>/dev/null
	mkdir .libs 2>/dev/null
	if test -d .libs; then
	lt_cv_objdir=.libs
	else
	# MS-DOS does not allow filenames that begin with a dot.
	lt_cv_objdir=_libs
	fi
	rmdir .libs 2>/dev/null
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_objdir" >&5
	$as_echo "$lt_cv_objdir" >&6; }
	objdir=$lt_cv_objdir





	cat >>confdefs.h <<_ACEOF
	#define LT_OBJDIR "$lt_cv_objdir/"
	_ACEOF




	case $host_os in
	aix3*)
	# AIX sometimes has problems with the GCC collect2 program. For some
	# reason, if we set the COLLECT_NAMES environment variable, the problems
	# vanish in a puff of smoke.
	if test set != "${COLLECT_NAMES+set}"; then
	COLLECT_NAMES=
	export COLLECT_NAMES
	fi
	;;
	esac

	# Global variables:
	ofile=libtool
	can_build_shared=yes

	# All known linkers require a '.a' archive for static linking (except MSVC,
	# which needs '.lib').
	libext=a

	with_gnu_ld=$lt_cv_prog_gnu_ld

	old_CC=$CC
	old_CFLAGS=$CFLAGS

	# Set sane defaults for various variables
	test -z "$CC" && CC=cc
	test -z "$LTCC" && LTCC=$CC
	test -z "$LTCFLAGS" && LTCFLAGS=$CFLAGS
	test -z "$LD" && LD=ld
	test -z "$ac_objext" && ac_objext=o

	func_cc_basename $compiler
	cc_basename=$func_cc_basename_result


	# Only perform the check for file, if the check method requires it
	test -z "$MAGIC_CMD" && MAGIC_CMD=file
	case $deplibs_check_method in
	file_magic*)
	if test "$file_magic_cmd" = '$MAGIC_CMD'; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ${ac_tool_prefix}file" >&5
	$as_echo_n "checking for ${ac_tool_prefix}file... " >&6; }
	if ${lt_cv_path_MAGIC_CMD+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	case $MAGIC_CMD in
	[\\/] \| ?:[\\/])
	lt_cv_path_MAGIC_CMD=$MAGIC_CMD # Let the user override the test with a path.
	;;
	*)
	lt_save_MAGIC_CMD=$MAGIC_CMD
	lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR
	ac_dummy="/usr/bin$PATH_SEPARATOR$PATH"
	for ac_dir in $ac_dummy; do
	IFS=$lt_save_ifs
	test -z "$ac_dir" && ac_dir=.
	if test -f "$ac_dir/${ac_tool_prefix}file"; then
	lt_cv_path_MAGIC_CMD=$ac_dir/"${ac_tool_prefix}file"
	if test -n "$file_magic_test_file"; then
	case $deplibs_check_method in
	"file_magic "*)
	file_magic_regex=`expr "$deplibs_check_method" : "file_magic $.*$"`
	MAGIC_CMD=$lt_cv_path_MAGIC_CMD
	if eval $file_magic_cmd \$file_magic_test_file 2> /dev/null \|
	$EGREP "$file_magic_regex" > /dev/null; then
	:
	else
	cat <<_LT_EOF 1>&2

	*** Warning: the command libtool uses to detect shared libraries,
	*** $file_magic_cmd, produces output that libtool cannot recognize.
	*** The result is that libtool may fail to recognize shared libraries
	*** as such. This will affect the creation of libtool libraries that
	*** depend on shared libraries, but programs linked with such libtool
	*** libraries will work regardless of this problem. Nevertheless, you
	*** may want to report the problem to your system manager and/or to
	*** bug-libtool@gnu.org

	_LT_EOF
	fi ;;
	esac
	fi
	break
	fi
	done
	IFS=$lt_save_ifs
	MAGIC_CMD=$lt_save_MAGIC_CMD
	;;
	esac
	fi

	MAGIC_CMD=$lt_cv_path_MAGIC_CMD
	if test -n "$MAGIC_CMD"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $MAGIC_CMD" >&5
	$as_echo "$MAGIC_CMD" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi





	if test -z "$lt_cv_path_MAGIC_CMD"; then
	if test -n "$ac_tool_prefix"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for file" >&5
	$as_echo_n "checking for file... " >&6; }
	if ${lt_cv_path_MAGIC_CMD+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	case $MAGIC_CMD in
	[\\/] \| ?:[\\/])
	lt_cv_path_MAGIC_CMD=$MAGIC_CMD # Let the user override the test with a path.
	;;
	*)
	lt_save_MAGIC_CMD=$MAGIC_CMD
	lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR
	ac_dummy="/usr/bin$PATH_SEPARATOR$PATH"
	for ac_dir in $ac_dummy; do
	IFS=$lt_save_ifs
	test -z "$ac_dir" && ac_dir=.
	if test -f "$ac_dir/file"; then
	lt_cv_path_MAGIC_CMD=$ac_dir/"file"
	if test -n "$file_magic_test_file"; then
	case $deplibs_check_method in
	"file_magic "*)
	file_magic_regex=`expr "$deplibs_check_method" : "file_magic $.*$"`
	MAGIC_CMD=$lt_cv_path_MAGIC_CMD
	if eval $file_magic_cmd \$file_magic_test_file 2> /dev/null \|
	$EGREP "$file_magic_regex" > /dev/null; then
	:
	else
	cat <<_LT_EOF 1>&2

	*** Warning: the command libtool uses to detect shared libraries,
	*** $file_magic_cmd, produces output that libtool cannot recognize.
	*** The result is that libtool may fail to recognize shared libraries
	*** as such. This will affect the creation of libtool libraries that
	*** depend on shared libraries, but programs linked with such libtool
	*** libraries will work regardless of this problem. Nevertheless, you
	*** may want to report the problem to your system manager and/or to
	*** bug-libtool@gnu.org

	_LT_EOF
	fi ;;
	esac
	fi
	break
	fi
	done
	IFS=$lt_save_ifs
	MAGIC_CMD=$lt_save_MAGIC_CMD
	;;
	esac
	fi

	MAGIC_CMD=$lt_cv_path_MAGIC_CMD
	if test -n "$MAGIC_CMD"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $MAGIC_CMD" >&5
	$as_echo "$MAGIC_CMD" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	else
	MAGIC_CMD=:
	fi
	fi

	fi
	;;
	esac

	# Use C for the default configuration in the libtool script

	lt_save_CC=$CC
	ac_ext=c
	ac_cpp='$CPP $CPPFLAGS'
	ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
	ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
	ac_compiler_gnu=$ac_cv_c_compiler_gnu


	# Source file extension for C test sources.
	ac_ext=c

	# Object file extension for compiled C test sources.
	objext=o
	objext=$objext

	# Code to be used in simple compile tests
	lt_simple_compile_test_code="int some_variable = 0;"

	# Code to be used in simple link tests
	lt_simple_link_test_code='int main(){return(0);}'







	# If no C compiler was specified, use CC.
	LTCC=${LTCC-"$CC"}

	# If no C compiler flags were specified, use CFLAGS.
	LTCFLAGS=${LTCFLAGS-"$CFLAGS"}

	# Allow CC to be a program name with arguments.
	compiler=$CC

	# Save the default compiler, since it gets overwritten when the other
	# tags are being tested, and _LT_TAGVAR(compiler, []) is a NOP.
	compiler_DEFAULT=$CC

	# save warnings/boilerplate of simple test code
	ac_outfile=conftest.$ac_objext
	echo "$lt_simple_compile_test_code" >conftest.$ac_ext
	eval "$ac_compile" 2>&1 >/dev/null \| $SED '/^$/d; /^ *+/d' >conftest.err
	_lt_compiler_boilerplate=`cat conftest.err`
	$RM conftest*

	ac_outfile=conftest.$ac_objext
	echo "$lt_simple_link_test_code" >conftest.$ac_ext
	eval "$ac_link" 2>&1 >/dev/null \| $SED '/^$/d; /^ *+/d' >conftest.err
	_lt_linker_boilerplate=`cat conftest.err`
	$RM -r conftest*


	if test -n "$compiler"; then

	lt_prog_compiler_no_builtin_flag=

	if test yes = "$GCC"; then
	case $cc_basename in
	nvcc*)
	lt_prog_compiler_no_builtin_flag=' -Xcompiler -fno-builtin' ;;
	*)
	lt_prog_compiler_no_builtin_flag=' -fno-builtin' ;;
	esac

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -fno-rtti -fno-exceptions" >&5
	$as_echo_n "checking if $compiler supports -fno-rtti -fno-exceptions... " >&6; }
	if ${lt_cv_prog_compiler_rtti_exceptions+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_prog_compiler_rtti_exceptions=no
	ac_outfile=conftest.$ac_objext
	echo "$lt_simple_compile_test_code" > conftest.$ac_ext
	lt_compiler_flag="-fno-rtti -fno-exceptions" ## exclude from sc_useless_quotes_in_assignment
	# Insert the option either (1) after the last *FLAGS variable, or
	# (2) before a word containing "conftest.", or (3) at the end.
	# Note that $ac_compile itself does not contain backslashes and begins
	# with a dollar sign (not a hyphen), so the echo should work correctly.
	# The option is referenced via a variable to avoid confusing sed.
	lt_compile=`echo "$ac_compile" \| $SED \
	-e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
	-e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
	-e 's:$: $lt_compiler_flag:'`
	(eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&5)
	(eval "$lt_compile" 2>conftest.err)
	ac_status=$?
	cat conftest.err >&5
	echo "$as_me:$LINENO: \$? = $ac_status" >&5
	if (exit $ac_status) && test -s "$ac_outfile"; then
	# The compiler can only warn and ignore the option if not recognized
	# So say no if there are warnings other than the usual output.
	$ECHO "$_lt_compiler_boilerplate" \| $SED '/^$/d' >conftest.exp
	$SED '/^$/d; /^ *+/d' conftest.err >conftest.er2
	if test ! -s conftest.er2 \|\| diff conftest.exp conftest.er2 >/dev/null; then
	lt_cv_prog_compiler_rtti_exceptions=yes
	fi
	fi
	$RM conftest*

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_rtti_exceptions" >&5
	$as_echo "$lt_cv_prog_compiler_rtti_exceptions" >&6; }

	if test yes = "$lt_cv_prog_compiler_rtti_exceptions"; then
	lt_prog_compiler_no_builtin_flag="$lt_prog_compiler_no_builtin_flag -fno-rtti -fno-exceptions"
	else
	:
	fi

	fi






	lt_prog_compiler_wl=
	lt_prog_compiler_pic=
	lt_prog_compiler_static=


	if test yes = "$GCC"; then
	lt_prog_compiler_wl='-Wl,'
	lt_prog_compiler_static='-static'

	case $host_os in
	aix*)
	# All AIX code is PIC.
	if test ia64 = "$host_cpu"; then
	# AIX 5 now supports IA64 processor
	lt_prog_compiler_static='-Bstatic'
	fi
	lt_prog_compiler_pic='-fPIC'
	;;

	amigaos*)
	case $host_cpu in
	powerpc)
	# see comment about AmigaOS4 .so support
	lt_prog_compiler_pic='-fPIC'
	;;
	m68k)
	# FIXME: we need at least 68020 code to build shared libraries, but
	# adding the '-m68020' flag to GCC prevents building anything better,
	# like '-m68040'.
	lt_prog_compiler_pic='-m68020 -resident32 -malways-restore-a4'
	;;
	esac
	;;

	beos* \| irix5* \| irix6* \| nonstopux* \| osf3* \| osf4* \| osf5*)
	# PIC is the default for these OSes.
	;;

	mingw* \| cygwin* \| pw32* \| os2* \| cegcc*)
	# This hack is so that the source file can tell whether it is being
	# built for inclusion in a dll (and should export symbols for example).
	# Although the cygwin gcc ignores -fPIC, still need this for old-style
	# (--disable-auto-import) libraries
	lt_prog_compiler_pic='-DDLL_EXPORT'
	case $host_os in
	os2*)
	lt_prog_compiler_static='$wl-static'
	;;
	esac
	;;

	darwin* \| rhapsody*)
	# PIC is the default on this platform
	# Common symbols not allowed in MH_DYLIB files
	lt_prog_compiler_pic='-fno-common'
	;;

	haiku*)
	# PIC is the default for Haiku.
	# The "-static" flag exists, but is broken.
	lt_prog_compiler_static=
	;;

	hpux*)
	# PIC is the default for 64-bit PA HP-UX, but not for 32-bit
	# PA HP-UX. On IA64 HP-UX, PIC is the default but the pic flag
	# sets the default TLS model and affects inlining.
	case $host_cpu in
	hppa64)
	# +Z the default
	;;
	*)
	lt_prog_compiler_pic='-fPIC'
	;;
	esac
	;;

	interix[3-9]*)
	# Interix 3.x gcc -fpic/-fPIC options generate broken code.
	# Instead, we relocate shared libraries at runtime.
	;;

	msdosdjgpp*)
	# Just because we use GCC doesn't mean we suddenly get shared libraries
	# on systems that don't support them.
	lt_prog_compiler_can_build_shared=no
	enable_shared=no
	;;

	nto \| qnx)
	# QNX uses GNU C++, but need to define -shared option too, otherwise
	# it will coredump.
	lt_prog_compiler_pic='-fPIC -shared'
	;;

	sysv4MP)
	if test -d /usr/nec; then
	lt_prog_compiler_pic=-Kconform_pic
	fi
	;;

	*)
	lt_prog_compiler_pic='-fPIC'
	;;
	esac

	case $cc_basename in
	nvcc*) # Cuda Compiler Driver 2.2
	lt_prog_compiler_wl='-Xlinker '
	if test -n "$lt_prog_compiler_pic"; then
	lt_prog_compiler_pic="-Xcompiler $lt_prog_compiler_pic"
	fi
	;;
	esac
	else
	# PORTME Check for flag to pass linker flags through the system compiler.
	case $host_os in
	aix*)
	lt_prog_compiler_wl='-Wl,'
	if test ia64 = "$host_cpu"; then
	# AIX 5 now supports IA64 processor
	lt_prog_compiler_static='-Bstatic'
	else
	lt_prog_compiler_static='-bnso -bI:/lib/syscalls.exp'
	fi
	;;

	darwin* \| rhapsody*)
	# PIC is the default on this platform
	# Common symbols not allowed in MH_DYLIB files
	lt_prog_compiler_pic='-fno-common'
	case $cc_basename in
	nagfor*)
	# NAG Fortran compiler
	lt_prog_compiler_wl='-Wl,-Wl,,'
	lt_prog_compiler_pic='-PIC'
	lt_prog_compiler_static='-Bstatic'
	;;
	esac
	;;

	mingw* \| cygwin* \| pw32* \| os2* \| cegcc*)
	# This hack is so that the source file can tell whether it is being
	# built for inclusion in a dll (and should export symbols for example).
	lt_prog_compiler_pic='-DDLL_EXPORT'
	case $host_os in
	os2*)
	lt_prog_compiler_static='$wl-static'
	;;
	esac
	;;

	hpux9* \| hpux10* \| hpux11*)
	lt_prog_compiler_wl='-Wl,'
	# PIC is the default for IA64 HP-UX and 64-bit HP-UX, but
	# not for PA HP-UX.
	case $host_cpu in
	hppa64\|ia64*)
	# +Z the default
	;;
	*)
	lt_prog_compiler_pic='+Z'
	;;
	esac
	# Is there a better lt_prog_compiler_static that works with the bundled CC?
	lt_prog_compiler_static='$wl-a ${wl}archive'
	;;

	irix5* \| irix6* \| nonstopux*)
	lt_prog_compiler_wl='-Wl,'
	# PIC (with -KPIC) is the default.
	lt_prog_compiler_static='-non_shared'
	;;

	linux* \| kbsd-gnu \| kopensolaris-gnu \| gnu)
	case $cc_basename in
	# old Intel for x86_64, which still supported -KPIC.
	ecc*)
	lt_prog_compiler_wl='-Wl,'
	lt_prog_compiler_pic='-KPIC'
	lt_prog_compiler_static='-static'
	;;
	# icc used to be incompatible with GCC.
	# ICC 10 doesn't accept -KPIC any more.
	icc* \| ifort*)
	lt_prog_compiler_wl='-Wl,'
	lt_prog_compiler_pic='-fPIC'
	lt_prog_compiler_static='-static'
	;;
	# Lahey Fortran 8.1.
	lf95*)
	lt_prog_compiler_wl='-Wl,'
	lt_prog_compiler_pic='--shared'
	lt_prog_compiler_static='--static'
	;;
	nagfor*)
	# NAG Fortran compiler
	lt_prog_compiler_wl='-Wl,-Wl,,'
	lt_prog_compiler_pic='-PIC'
	lt_prog_compiler_static='-Bstatic'
	;;
	tcc*)
	# Fabrice Bellard et al's Tiny C Compiler
	lt_prog_compiler_wl='-Wl,'
	lt_prog_compiler_pic='-fPIC'
	lt_prog_compiler_static='-static'
	;;
	pgcc* \| pgf77* \| pgf90* \| pgf95* \| pgfortran*)
	# Portland Group compilers (not the Pentium gcc compiler,
	# which looks to be a dead project)
	lt_prog_compiler_wl='-Wl,'
	lt_prog_compiler_pic='-fpic'
	lt_prog_compiler_static='-Bstatic'
	;;
	ccc*)
	lt_prog_compiler_wl='-Wl,'
	# All Alpha code is PIC.
	lt_prog_compiler_static='-non_shared'
	;;
	xl* \| bgxl* \| bgf* \| mpixl*)
	# IBM XL C 8.0/Fortran 10.1, 11.1 on PPC and BlueGene
	lt_prog_compiler_wl='-Wl,'
	lt_prog_compiler_pic='-qpic'
	lt_prog_compiler_static='-qstaticlink'
	;;
	*)
	case `$CC -V 2>&1 \| sed 5q` in
	Sun\ Ceres\ Fortran \| SunFortran\ [1-7]. \| SunFortran\ 8.[0-3])
	# Sun Fortran 8.3 passes all unrecognized flags to the linker
	lt_prog_compiler_pic='-KPIC'
	lt_prog_compiler_static='-Bstatic'
	lt_prog_compiler_wl=''
	;;
	Sun\ F \| SunFortran*)
	lt_prog_compiler_pic='-KPIC'
	lt_prog_compiler_static='-Bstatic'
	lt_prog_compiler_wl='-Qoption ld '
	;;
	Sun\ C)
	# Sun C 5.9
	lt_prog_compiler_pic='-KPIC'
	lt_prog_compiler_static='-Bstatic'
	lt_prog_compiler_wl='-Wl,'
	;;
	Intel\ [CF]Compiler)
	lt_prog_compiler_wl='-Wl,'
	lt_prog_compiler_pic='-fPIC'
	lt_prog_compiler_static='-static'
	;;
	Portland\ Group)
	lt_prog_compiler_wl='-Wl,'
	lt_prog_compiler_pic='-fpic'
	lt_prog_compiler_static='-Bstatic'
	;;
	esac
	;;
	esac
	;;

	newsos6)
	lt_prog_compiler_pic='-KPIC'
	lt_prog_compiler_static='-Bstatic'
	;;

	nto \| qnx)
	# QNX uses GNU C++, but need to define -shared option too, otherwise
	# it will coredump.
	lt_prog_compiler_pic='-fPIC -shared'
	;;

	osf3* \| osf4* \| osf5*)
	lt_prog_compiler_wl='-Wl,'
	# All OSF/1 code is PIC.
	lt_prog_compiler_static='-non_shared'
	;;

	rdos*)
	lt_prog_compiler_static='-non_shared'
	;;

	solaris*)
	lt_prog_compiler_pic='-KPIC'
	lt_prog_compiler_static='-Bstatic'
	case $cc_basename in
	f77* \| f90* \| f95* \| sunf77* \| sunf90* \| sunf95*)
	lt_prog_compiler_wl='-Qoption ld ';;
	*)
	lt_prog_compiler_wl='-Wl,';;
	esac
	;;

	sunos4*)
	lt_prog_compiler_wl='-Qoption ld '
	lt_prog_compiler_pic='-PIC'
	lt_prog_compiler_static='-Bstatic'
	;;

	sysv4 \| sysv4.2uw2* \| sysv4.3*)
	lt_prog_compiler_wl='-Wl,'
	lt_prog_compiler_pic='-KPIC'
	lt_prog_compiler_static='-Bstatic'
	;;

	sysv4MP)
	if test -d /usr/nec; then
	lt_prog_compiler_pic='-Kconform_pic'
	lt_prog_compiler_static='-Bstatic'
	fi
	;;

	sysv5* \| unixware* \| sco3.2v5* \| sco5v6* \| OpenUNIX*)
	lt_prog_compiler_wl='-Wl,'
	lt_prog_compiler_pic='-KPIC'
	lt_prog_compiler_static='-Bstatic'
	;;

	unicos*)
	lt_prog_compiler_wl='-Wl,'
	lt_prog_compiler_can_build_shared=no
	;;

	uts4*)
	lt_prog_compiler_pic='-pic'
	lt_prog_compiler_static='-Bstatic'
	;;

	*)
	lt_prog_compiler_can_build_shared=no
	;;
	esac
	fi

	case $host_os in
	# For platforms that do not support PIC, -DPIC is meaningless:
	djgpp)
	lt_prog_compiler_pic=
	;;
	*)
	lt_prog_compiler_pic="$lt_prog_compiler_pic -DPIC"
	;;
	esac

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $compiler option to produce PIC" >&5
	$as_echo_n "checking for $compiler option to produce PIC... " >&6; }
	if ${lt_cv_prog_compiler_pic+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_prog_compiler_pic=$lt_prog_compiler_pic
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_pic" >&5
	$as_echo "$lt_cv_prog_compiler_pic" >&6; }
	lt_prog_compiler_pic=$lt_cv_prog_compiler_pic

	#
	# Check to make sure the PIC flag actually works.
	#
	if test -n "$lt_prog_compiler_pic"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler PIC flag $lt_prog_compiler_pic works" >&5
	$as_echo_n "checking if $compiler PIC flag $lt_prog_compiler_pic works... " >&6; }
	if ${lt_cv_prog_compiler_pic_works+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_prog_compiler_pic_works=no
	ac_outfile=conftest.$ac_objext
	echo "$lt_simple_compile_test_code" > conftest.$ac_ext
	lt_compiler_flag="$lt_prog_compiler_pic -DPIC" ## exclude from sc_useless_quotes_in_assignment
	# Insert the option either (1) after the last *FLAGS variable, or
	# (2) before a word containing "conftest.", or (3) at the end.
	# Note that $ac_compile itself does not contain backslashes and begins
	# with a dollar sign (not a hyphen), so the echo should work correctly.
	# The option is referenced via a variable to avoid confusing sed.
	lt_compile=`echo "$ac_compile" \| $SED \
	-e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
	-e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
	-e 's:$: $lt_compiler_flag:'`
	(eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&5)
	(eval "$lt_compile" 2>conftest.err)
	ac_status=$?
	cat conftest.err >&5
	echo "$as_me:$LINENO: \$? = $ac_status" >&5
	if (exit $ac_status) && test -s "$ac_outfile"; then
	# The compiler can only warn and ignore the option if not recognized
	# So say no if there are warnings other than the usual output.
	$ECHO "$_lt_compiler_boilerplate" \| $SED '/^$/d' >conftest.exp
	$SED '/^$/d; /^ *+/d' conftest.err >conftest.er2
	if test ! -s conftest.er2 \|\| diff conftest.exp conftest.er2 >/dev/null; then
	lt_cv_prog_compiler_pic_works=yes
	fi
	fi
	$RM conftest*

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_pic_works" >&5
	$as_echo "$lt_cv_prog_compiler_pic_works" >&6; }

	if test yes = "$lt_cv_prog_compiler_pic_works"; then
	case $lt_prog_compiler_pic in
	"" \| " "*) ;;
	*) lt_prog_compiler_pic=" $lt_prog_compiler_pic" ;;
	esac
	else
	lt_prog_compiler_pic=
	lt_prog_compiler_can_build_shared=no
	fi

	fi











	#
	# Check to make sure the static flag actually works.
	#
	wl=$lt_prog_compiler_wl eval lt_tmp_static_flag=\"$lt_prog_compiler_static\"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler static flag $lt_tmp_static_flag works" >&5
	$as_echo_n "checking if $compiler static flag $lt_tmp_static_flag works... " >&6; }
	if ${lt_cv_prog_compiler_static_works+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_prog_compiler_static_works=no
	save_LDFLAGS=$LDFLAGS
	LDFLAGS="$LDFLAGS $lt_tmp_static_flag"
	echo "$lt_simple_link_test_code" > conftest.$ac_ext
	if (eval $ac_link 2>conftest.err) && test -s conftest$ac_exeext; then
	# The linker can only warn and ignore the option if not recognized
	# So say no if there are warnings
	if test -s conftest.err; then
	# Append any errors to the config.log.
	cat conftest.err 1>&5
	$ECHO "$_lt_linker_boilerplate" \| $SED '/^$/d' > conftest.exp
	$SED '/^$/d; /^ *+/d' conftest.err >conftest.er2
	if diff conftest.exp conftest.er2 >/dev/null; then
	lt_cv_prog_compiler_static_works=yes
	fi
	else
	lt_cv_prog_compiler_static_works=yes
	fi
	fi
	$RM -r conftest*
	LDFLAGS=$save_LDFLAGS

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_static_works" >&5
	$as_echo "$lt_cv_prog_compiler_static_works" >&6; }

	if test yes = "$lt_cv_prog_compiler_static_works"; then
	:
	else
	lt_prog_compiler_static=
	fi







	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -c -o file.$ac_objext" >&5
	$as_echo_n "checking if $compiler supports -c -o file.$ac_objext... " >&6; }
	if ${lt_cv_prog_compiler_c_o+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_prog_compiler_c_o=no
	$RM -r conftest 2>/dev/null
	mkdir conftest
	cd conftest
	mkdir out
	echo "$lt_simple_compile_test_code" > conftest.$ac_ext

	lt_compiler_flag="-o out/conftest2.$ac_objext"
	# Insert the option either (1) after the last *FLAGS variable, or
	# (2) before a word containing "conftest.", or (3) at the end.
	# Note that $ac_compile itself does not contain backslashes and begins
	# with a dollar sign (not a hyphen), so the echo should work correctly.
	lt_compile=`echo "$ac_compile" \| $SED \
	-e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
	-e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
	-e 's:$: $lt_compiler_flag:'`
	(eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&5)
	(eval "$lt_compile" 2>out/conftest.err)
	ac_status=$?
	cat out/conftest.err >&5
	echo "$as_me:$LINENO: \$? = $ac_status" >&5
	if (exit $ac_status) && test -s out/conftest2.$ac_objext
	then
	# The compiler can only warn and ignore the option if not recognized
	# So say no if there are warnings
	$ECHO "$_lt_compiler_boilerplate" \| $SED '/^$/d' > out/conftest.exp
	$SED '/^$/d; /^ *+/d' out/conftest.err >out/conftest.er2
	if test ! -s out/conftest.er2 \|\| diff out/conftest.exp out/conftest.er2 >/dev/null; then
	lt_cv_prog_compiler_c_o=yes
	fi
	fi
	chmod u+w . 2>&5
	$RM conftest*
	# SGI C++ compiler will create directory out/ii_files/ for
	# template instantiation
	test -d out/ii_files && $RM out/ii_files/* && rmdir out/ii_files
	$RM out/* && rmdir out
	cd ..
	$RM -r conftest
	$RM conftest*

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_c_o" >&5
	$as_echo "$lt_cv_prog_compiler_c_o" >&6; }






	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -c -o file.$ac_objext" >&5
	$as_echo_n "checking if $compiler supports -c -o file.$ac_objext... " >&6; }
	if ${lt_cv_prog_compiler_c_o+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_prog_compiler_c_o=no
	$RM -r conftest 2>/dev/null
	mkdir conftest
	cd conftest
	mkdir out
	echo "$lt_simple_compile_test_code" > conftest.$ac_ext

	lt_compiler_flag="-o out/conftest2.$ac_objext"
	# Insert the option either (1) after the last *FLAGS variable, or
	# (2) before a word containing "conftest.", or (3) at the end.
	# Note that $ac_compile itself does not contain backslashes and begins
	# with a dollar sign (not a hyphen), so the echo should work correctly.
	lt_compile=`echo "$ac_compile" \| $SED \
	-e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
	-e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
	-e 's:$: $lt_compiler_flag:'`
	(eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&5)
	(eval "$lt_compile" 2>out/conftest.err)
	ac_status=$?
	cat out/conftest.err >&5
	echo "$as_me:$LINENO: \$? = $ac_status" >&5
	if (exit $ac_status) && test -s out/conftest2.$ac_objext
	then
	# The compiler can only warn and ignore the option if not recognized
	# So say no if there are warnings
	$ECHO "$_lt_compiler_boilerplate" \| $SED '/^$/d' > out/conftest.exp
	$SED '/^$/d; /^ *+/d' out/conftest.err >out/conftest.er2
	if test ! -s out/conftest.er2 \|\| diff out/conftest.exp out/conftest.er2 >/dev/null; then
	lt_cv_prog_compiler_c_o=yes
	fi
	fi
	chmod u+w . 2>&5
	$RM conftest*
	# SGI C++ compiler will create directory out/ii_files/ for
	# template instantiation
	test -d out/ii_files && $RM out/ii_files/* && rmdir out/ii_files
	$RM out/* && rmdir out
	cd ..
	$RM -r conftest
	$RM conftest*

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_c_o" >&5
	$as_echo "$lt_cv_prog_compiler_c_o" >&6; }




	hard_links=nottested
	if test no = "$lt_cv_prog_compiler_c_o" && test no != "$need_locks"; then
	# do not overwrite the value of need_locks provided by the user
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if we can lock with hard links" >&5
	$as_echo_n "checking if we can lock with hard links... " >&6; }
	hard_links=yes
	$RM conftest*
	ln conftest.a conftest.b 2>/dev/null && hard_links=no
	touch conftest.a
	ln conftest.a conftest.b 2>&5 \|\| hard_links=no
	ln conftest.a conftest.b 2>/dev/null && hard_links=no
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $hard_links" >&5
	$as_echo "$hard_links" >&6; }
	if test no = "$hard_links"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: '$CC' does not support '-c -o', so 'make -j' may be unsafe" >&5
	$as_echo "$as_me: WARNING: '$CC' does not support '-c -o', so 'make -j' may be unsafe" >&2;}
	need_locks=warn
	fi
	else
	need_locks=no
	fi






	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the $compiler linker ($LD) supports shared libraries" >&5
	$as_echo_n "checking whether the $compiler linker ($LD) supports shared libraries... " >&6; }

	runpath_var=
	allow_undefined_flag=
	always_export_symbols=no
	archive_cmds=
	archive_expsym_cmds=
	compiler_needs_object=no
	enable_shared_with_static_runtimes=no
	export_dynamic_flag_spec=
	export_symbols_cmds='$NM $libobjs $convenience \| $global_symbol_pipe \| $SED '\''s/.* //'\'' \| sort \| uniq > $export_symbols'
	hardcode_automatic=no
	hardcode_direct=no
	hardcode_direct_absolute=no
	hardcode_libdir_flag_spec=
	hardcode_libdir_separator=
	hardcode_minus_L=no
	hardcode_shlibpath_var=unsupported
	inherit_rpath=no
	link_all_deplibs=unknown
	module_cmds=
	module_expsym_cmds=
	old_archive_from_new_cmds=
	old_archive_from_expsyms_cmds=
	thread_safe_flag_spec=
	whole_archive_flag_spec=
	# include_expsyms should be a list of space-separated symbols to be always
	# included in the symbol list
	include_expsyms=
	# exclude_expsyms can be an extended regexp of symbols to exclude
	# it will be wrapped by ' (' and ')$', so one must not match beginning or
	# end of line. Example: 'a\|bc\|.d.' will exclude the symbols 'a' and 'bc',
	# as well as any symbol that contains 'd'.
	exclude_expsyms='_GLOBAL_OFFSET_TABLE_\|_GLOBAL__F[ID]_.*'
	# Although _GLOBAL_OFFSET_TABLE_ is a valid symbol C name, most a.out
	# platforms (ab)use it in PIC code, but their linkers get confused if
	# the symbol is explicitly referenced. Since portable code cannot
	# rely on this symbol name, it's probably fine to never include it in
	# preloaded symbol tables.
	# Exclude shared library initialization/finalization symbols.
	extract_expsyms_cmds=

	case $host_os in
	cygwin* \| mingw* \| pw32* \| cegcc*)
	# FIXME: the MSVC++ port hasn't been tested in a loooong time
	# When not using gcc, we currently assume that we are using
	# Microsoft Visual C++.
	if test yes != "$GCC"; then
	with_gnu_ld=no
	fi
	;;
	interix*)
	# we just hope/assume this is gcc and not c89 (= MSVC++)
	with_gnu_ld=yes
	;;
	openbsd* \| bitrig*)
	with_gnu_ld=no
	;;
	esac

	ld_shlibs=yes

	# On some targets, GNU ld is compatible enough with the native linker
	# that we're better off using the native interface for both.
	lt_use_gnu_ld_interface=no
	if test yes = "$with_gnu_ld"; then
	case $host_os in
	aix*)
	# The AIX port of GNU ld has always aspired to compatibility
	# with the native linker. However, as the warning in the GNU ld
	# block says, versions before 2.19.5* couldn't really create working
	# shared libraries, regardless of the interface used.
	case `$LD -v 2>&1` in
	\ $GNU\ Binutils$\ 2.19.5) ;;
	\ $GNU\ Binutils$\ 2.[2-9]) ;;
	\ $GNU\ Binutils$\ [3-9]) ;;
	*)
	lt_use_gnu_ld_interface=yes
	;;
	esac
	;;
	*)
	lt_use_gnu_ld_interface=yes
	;;
	esac
	fi

	if test yes = "$lt_use_gnu_ld_interface"; then
	# If archive_cmds runs LD, not CC, wlarc should be empty
	wlarc='$wl'

	# Set some defaults for GNU ld with shared library support. These
	# are reset later if shared libraries are not supported. Putting them
	# here allows them to be overridden if necessary.
	runpath_var=LD_RUN_PATH
	hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
	export_dynamic_flag_spec='$wl--export-dynamic'
	# ancient GNU ld didn't support --whole-archive et. al.
	if $LD --help 2>&1 \| $GREP 'no-whole-archive' > /dev/null; then
	whole_archive_flag_spec=$wlarc'--whole-archive$convenience '$wlarc'--no-whole-archive'
	else
	whole_archive_flag_spec=
	fi
	supports_anon_versioning=no
	case `$LD -v \| $SED -e 's/(^)\+)\s\+//' 2>&1` in
	GNU\ gold) supports_anon_versioning=yes ;;
	\ [01]. \| \ 2.[0-9]. \| \ 2.10.) ;; # catch versions < 2.11
	\ 2.11.93.0.2\ ) supports_anon_versioning=yes ;; # RH7.3 ...
	\ 2.11.92.0.12\ ) supports_anon_versioning=yes ;; # Mandrake 8.2 ...
	\ 2.11.) ;; # other 2.11 versions
	*) supports_anon_versioning=yes ;;
	esac

	# See if GNU ld supports shared libraries.
	case $host_os in
	aix[3-9]*)
	# On AIX/PPC, the GNU linker is very broken
	if test ia64 != "$host_cpu"; then
	ld_shlibs=no
	cat <<_LT_EOF 1>&2

	*** Warning: the GNU linker, at least up to release 2.19, is reported
	*** to be unable to reliably create shared libraries on AIX.
	*** Therefore, libtool is disabling shared libraries support. If you
	*** really care for shared libraries, you may want to install binutils
	*** 2.20 or above, or modify your PATH so that a non-GNU linker is found.
	*** You will then need to restart the configuration process.

	_LT_EOF
	fi
	;;

	amigaos*)
	case $host_cpu in
	powerpc)
	# see comment about AmigaOS4 .so support
	archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	archive_expsym_cmds=''
	;;
	m68k)
	archive_cmds='$RM $output_objdir/a2ixlibrary.data~$ECHO "#define NAME $libname" > $output_objdir/a2ixlibrary.data~$ECHO "#define LIBRARY_ID 1" >> $output_objdir/a2ixlibrary.data~$ECHO "#define VERSION $major" >> $output_objdir/a2ixlibrary.data~$ECHO "#define REVISION $revision" >> $output_objdir/a2ixlibrary.data~$AR $AR_FLAGS $lib $libobjs~$RANLIB $lib~(cd $output_objdir && a2ixlibrary -32)'
	hardcode_libdir_flag_spec='-L$libdir'
	hardcode_minus_L=yes
	;;
	esac
	;;

	beos*)
	if $LD --help 2>&1 \| $GREP ': supported targets:.* elf' > /dev/null; then
	allow_undefined_flag=unsupported
	# Joseph Beckenbach <jrb3@best.com> says some releases of gcc
	# support --undefined. This deserves some investigation. FIXME
	archive_cmds='$CC -nostart $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	else
	ld_shlibs=no
	fi
	;;

	cygwin* \| mingw* \| pw32* \| cegcc*)
	# _LT_TAGVAR(hardcode_libdir_flag_spec, ) is actually meaningless,
	# as there is no search path for DLLs.
	hardcode_libdir_flag_spec='-L$libdir'
	export_dynamic_flag_spec='$wl--export-all-symbols'
	allow_undefined_flag=unsupported
	always_export_symbols=no
	enable_shared_with_static_runtimes=yes
	export_symbols_cmds='$NM $libobjs $convenience \| $global_symbol_pipe \| $SED -e '\''/^[BCDGRS][ ]/s/.[ ]$[^ ]$/\1 DATA/;s/^.[ ]__nm__$[^ ]$[ ][^ ]/\1 DATA/;/^I[ ]/d;/^[AITW][ ]/s/. //'\'' \| sort \| uniq > $export_symbols'
	exclude_expsyms='[_]+GLOBAL_OFFSET_TABLE_\|[_]+GLOBAL__[FID]_.*\|[_]+head_[A-Za-z0-9_]+_dll\|[A-Za-z0-9_]+_dll_iname'

	if $LD --help 2>&1 \| $GREP 'auto-import' > /dev/null; then
	archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib'
	# If the export-symbols file already is a .def file, use it as
	# is; otherwise, prepend EXPORTS...
	archive_expsym_cmds='if test DEF = "`$SED -n -e '\''s/^[ ]//'\'' -e '\''/^$;.$$/d'\'' -e '\''s/^$EXPORTS\\|LIBRARY$$[ ].$*$/DEF/p'\'' -e q $export_symbols`" ; then
	cp $export_symbols $output_objdir/$soname.def;
	else
	echo EXPORTS > $output_objdir/$soname.def;
	cat $export_symbols >> $output_objdir/$soname.def;
	fi~
	$CC -shared $output_objdir/$soname.def $libobjs $deplibs $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib'
	else
	ld_shlibs=no
	fi
	;;

	haiku*)
	archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	link_all_deplibs=yes
	;;

	os2*)
	hardcode_libdir_flag_spec='-L$libdir'
	hardcode_minus_L=yes
	allow_undefined_flag=unsupported
	shrext_cmds=.dll
	archive_cmds='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~
	$ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~
	$ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~
	$ECHO EXPORTS >> $output_objdir/$libname.def~
	emxexp $libobjs \| $SED /"_DLL_InitTerm"/d >> $output_objdir/$libname.def~
	$CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~
	emximp -o $lib $output_objdir/$libname.def'
	archive_expsym_cmds='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~
	$ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~
	$ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~
	$ECHO EXPORTS >> $output_objdir/$libname.def~
	prefix_cmds="$SED"~
	if test EXPORTS = "`$SED 1q $export_symbols`"; then
	prefix_cmds="$prefix_cmds -e 1d";
	fi~
	prefix_cmds="$prefix_cmds -e \"s/^$.*$$/_\1/g\""~
	cat $export_symbols \| $prefix_cmds >> $output_objdir/$libname.def~
	$CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~
	emximp -o $lib $output_objdir/$libname.def'
	old_archive_From_new_cmds='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
	enable_shared_with_static_runtimes=yes
	;;

	interix[3-9]*)
	hardcode_direct=no
	hardcode_shlibpath_var=no
	hardcode_libdir_flag_spec='$wl-rpath,$libdir'
	export_dynamic_flag_spec='$wl-E'
	# Hack: On Interix 3.x, we cannot compile PIC because of a broken gcc.
	# Instead, shared libraries are loaded at an image base (0x10000000 by
	# default) and relocated if they conflict, which is a slow very memory
	# consuming and fragmenting process. To avoid this, we pick a random,
	# 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link
	# time. Moving up from 0x10000000 also allows more sbrk(2) space.
	archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
	archive_expsym_cmds='sed "s\|^\|_\|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
	;;

	gnu* \| linux* \| tpf* \| kbsd-gnu \| kopensolaris*-gnu)
	tmp_diet=no
	if test linux-dietlibc = "$host_os"; then
	case $cc_basename in
	diet\ *) tmp_diet=yes;; # linux-dietlibc with static linking (!diet-dyn)
	esac
	fi
	if $LD --help 2>&1 \| $EGREP ': supported targets:.* elf' > /dev/null \
	&& test no = "$tmp_diet"
	then
	tmp_addflag=' $pic_flag'
	tmp_sharedflag='-shared'
	case $cc_basename,$host_cpu in
	pgcc*) # Portland Group C compiler
	whole_archive_flag_spec='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive'
	tmp_addflag=' $pic_flag'
	;;
	pgf77* \| pgf90* \| pgf95* \| pgfortran*)
	# Portland Group f77 and f90 compilers
	whole_archive_flag_spec='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive'
	tmp_addflag=' $pic_flag -Mnomain' ;;
	ecc,ia64 \| icc,ia64) # Intel C compiler on ia64
	tmp_addflag=' -i_dynamic' ;;
	efc,ia64 \| ifort,ia64) # Intel Fortran compiler on ia64
	tmp_addflag=' -i_dynamic -nofor_main' ;;
	ifc* \| ifort*) # Intel Fortran compiler
	tmp_addflag=' -nofor_main' ;;
	lf95*) # Lahey Fortran 8.1
	whole_archive_flag_spec=
	tmp_sharedflag='--shared' ;;
	nagfor*) # NAGFOR 5.3
	tmp_sharedflag='-Wl,-shared' ;;
	xl[cC]* \| bgxl[cC]* \| mpixl[cC]*) # IBM XL C 8.0 on PPC (deal with xlf below)
	tmp_sharedflag='-qmkshrobj'
	tmp_addflag= ;;
	nvcc*) # Cuda Compiler Driver 2.2
	whole_archive_flag_spec='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive'
	compiler_needs_object=yes
	;;
	esac
	case `$CC -V 2>&1 \| sed 5q` in
	Sun\ C) # Sun C 5.9
	whole_archive_flag_spec='$wl--whole-archive`new_convenience=; for conv in $convenience\"\"; do test -z \"$conv\" \|\| new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive'
	compiler_needs_object=yes
	tmp_sharedflag='-G' ;;
	Sun\ F) # Sun Fortran 8.3
	tmp_sharedflag='-G' ;;
	esac
	archive_cmds='$CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'

	if test yes = "$supports_anon_versioning"; then
	archive_expsym_cmds='echo "{ global:" > $output_objdir/$libname.ver~
	cat $export_symbols \| sed -e "s/$.*$/\1;/" >> $output_objdir/$libname.ver~
	echo "local: *; };" >> $output_objdir/$libname.ver~
	$CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib'
	fi

	case $cc_basename in
	tcc*)
	export_dynamic_flag_spec='-rdynamic'
	;;
	xlf* \| bgf* \| bgxlf* \| mpixlf*)
	# IBM XL Fortran 10.1 on PPC cannot create shared libs itself
	whole_archive_flag_spec='--whole-archive$convenience --no-whole-archive'
	hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
	archive_cmds='$LD -shared $libobjs $deplibs $linker_flags -soname $soname -o $lib'
	if test yes = "$supports_anon_versioning"; then
	archive_expsym_cmds='echo "{ global:" > $output_objdir/$libname.ver~
	cat $export_symbols \| sed -e "s/$.*$/\1;/" >> $output_objdir/$libname.ver~
	echo "local: *; };" >> $output_objdir/$libname.ver~
	$LD -shared $libobjs $deplibs $linker_flags -soname $soname -version-script $output_objdir/$libname.ver -o $lib'
	fi
	;;
	esac
	else
	ld_shlibs=no
	fi
	;;

	netbsd*)
	if echo __ELF__ \| $CC -E - \| $GREP __ELF__ >/dev/null; then
	archive_cmds='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib'
	wlarc=
	else
	archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib'
	fi
	;;

	solaris*)
	if $LD -v 2>&1 \| $GREP 'BFD 2\.8' > /dev/null; then
	ld_shlibs=no
	cat <<_LT_EOF 1>&2

	*** Warning: The releases 2.8.* of the GNU linker cannot reliably
	*** create shared libraries on Solaris systems. Therefore, libtool
	*** is disabling shared libraries support. We urge you to upgrade GNU
	*** binutils to release 2.9.1 or newer. Another option is to modify
	*** your PATH or compiler configuration so that the native linker is
	*** used, and then restart.

	_LT_EOF
	elif $LD --help 2>&1 \| $GREP ': supported targets:.* elf' > /dev/null; then
	archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib'
	else
	ld_shlibs=no
	fi
	;;

	sysv5* \| sco3.2v5* \| sco5v6* \| unixware* \| OpenUNIX*)
	case `$LD -v 2>&1` in
	\ [01]. \| \ 2.[0-9]. \| \ 2.1[0-5].)
	ld_shlibs=no
	cat <<_LT_EOF 1>&2

	*** Warning: Releases of the GNU linker prior to 2.16.91.0.3 cannot
	*** reliably create shared libraries on SCO systems. Therefore, libtool
	*** is disabling shared libraries support. We urge you to upgrade GNU
	*** binutils to release 2.16.91.0.3 or newer. Another option is to modify
	*** your PATH or compiler configuration so that the native linker is
	*** used, and then restart.

	_LT_EOF
	;;
	*)
	# For security reasons, it is highly recommended that you always
	# use absolute paths for naming shared libraries, and exclude the
	# DT_RUNPATH tag from executables and libraries. But doing so
	# requires that you compile everything twice, which is a pain.
	if $LD --help 2>&1 \| $GREP ': supported targets:.* elf' > /dev/null; then
	hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
	archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	archive_expsym_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib'
	else
	ld_shlibs=no
	fi
	;;
	esac
	;;

	sunos4*)
	archive_cmds='$LD -assert pure-text -Bshareable -o $lib $libobjs $deplibs $linker_flags'
	wlarc=
	hardcode_direct=yes
	hardcode_shlibpath_var=no
	;;

	*)
	if $LD --help 2>&1 \| $GREP ': supported targets:.* elf' > /dev/null; then
	archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib'
	else
	ld_shlibs=no
	fi
	;;
	esac

	if test no = "$ld_shlibs"; then
	runpath_var=
	hardcode_libdir_flag_spec=
	export_dynamic_flag_spec=
	whole_archive_flag_spec=
	fi
	else
	# PORTME fill in a description of your system's linker (not GNU ld)
	case $host_os in
	aix3*)
	allow_undefined_flag=unsupported
	always_export_symbols=yes
	archive_expsym_cmds='$LD -o $output_objdir/$soname $libobjs $deplibs $linker_flags -bE:$export_symbols -T512 -H512 -bM:SRE~$AR $AR_FLAGS $lib $output_objdir/$soname'
	# Note: this linker hardcodes the directories in LIBPATH if there
	# are no directories specified by -L.
	hardcode_minus_L=yes
	if test yes = "$GCC" && test -z "$lt_prog_compiler_static"; then
	# Neither direct hardcoding nor static linking is supported with a
	# broken collect2.
	hardcode_direct=unsupported
	fi
	;;

	aix[4-9]*)
	if test ia64 = "$host_cpu"; then
	# On IA64, the linker does run time linking by default, so we don't
	# have to do anything special.
	aix_use_runtimelinking=no
	exp_sym_flag='-Bexport'
	no_entry_flag=
	else
	# If we're using GNU nm, then we don't want the "-C" option.
	# -C means demangle to GNU nm, but means don't demangle to AIX nm.
	# Without the "-l" option, or with the "-B" option, AIX nm treats
	# weak defined symbols like other global defined symbols, whereas
	# GNU nm marks them as "W".
	# While the 'weak' keyword is ignored in the Export File, we need
	# it in the Import File for the 'aix-soname' feature, so we have
	# to replace the "-B" option with "-P" for AIX nm.
	if $NM -V 2>&1 \| $GREP 'GNU' > /dev/null; then
	export_symbols_cmds='$NM -Bpg $libobjs $convenience \| awk '\''{ if (((\$ 2 == "T") \|\| (\$ 2 == "D") \|\| (\$ 2 == "B") \|\| (\$ 2 == "W")) && (substr(\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' \| sort -u > $export_symbols'
	else
	export_symbols_cmds='`func_echo_all $NM \| $SED -e '\''s/B$[^B]*$$/P\1/'\''` -PCpgl $libobjs $convenience \| awk '\''{ if (((\$ 2 == "T") \|\| (\$ 2 == "D") \|\| (\$ 2 == "B") \|\| (\$ 2 == "W") \|\| (\$ 2 == "V") \|\| (\$ 2 == "Z")) && (substr(\$ 1,1,1) != ".")) { if ((\$ 2 == "W") \|\| (\$ 2 == "V") \|\| (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' \| sort -u > $export_symbols'
	fi
	aix_use_runtimelinking=no

	# Test if we are trying to use run time linking or normal
	# AIX style linking. If -brtl is somewhere in LDFLAGS, we
	# have runtime linking enabled, and use it for executables.
	# For shared libraries, we enable/disable runtime linking
	# depending on the kind of the shared library created -
	# when "with_aix_soname,aix_use_runtimelinking" is:
	# "aix,no" lib.a(lib.so.V) shared, rtl:no, for executables
	# "aix,yes" lib.so shared, rtl:yes, for executables
	# lib.a static archive
	# "both,no" lib.so.V(shr.o) shared, rtl:yes
	# lib.a(lib.so.V) shared, rtl:no, for executables
	# "both,yes" lib.so.V(shr.o) shared, rtl:yes, for executables
	# lib.a(lib.so.V) shared, rtl:no
	# "svr4,*" lib.so.V(shr.o) shared, rtl:yes, for executables
	# lib.a static archive
	case $host_os in aix4.[23]\|aix4.[23].\|aix[5-9])
	for ld_flag in $LDFLAGS; do
	if (test x-brtl = "x$ld_flag" \|\| test x-Wl,-brtl = "x$ld_flag"); then
	aix_use_runtimelinking=yes
	break
	fi
	done
	if test svr4,no = "$with_aix_soname,$aix_use_runtimelinking"; then
	# With aix-soname=svr4, we create the lib.so.V shared archives only,
	# so we don't have lib.a shared libs to link our executables.
	# We have to force runtime linking in this case.
	aix_use_runtimelinking=yes
	LDFLAGS="$LDFLAGS -Wl,-brtl"
	fi
	;;
	esac

	exp_sym_flag='-bexport'
	no_entry_flag='-bnoentry'
	fi

	# When large executables or shared objects are built, AIX ld can
	# have problems creating the table of contents. If linking a library
	# or program results in "error TOC overflow" add -mminimal-toc to
	# CXXFLAGS/CFLAGS for g++/gcc. In the cases where that is not
	# enough to fix the problem, add -Wl,-bbigtoc to LDFLAGS.

	archive_cmds=''
	hardcode_direct=yes
	hardcode_direct_absolute=yes
	hardcode_libdir_separator=':'
	link_all_deplibs=yes
	file_list_spec='$wl-f,'
	case $with_aix_soname,$aix_use_runtimelinking in
	aix,*) ;; # traditional, no import file
	svr4,* \| *,yes) # use import file
	# The Import File defines what to hardcode.
	hardcode_direct=no
	hardcode_direct_absolute=no
	;;
	esac

	if test yes = "$GCC"; then
	case $host_os in aix4.[012]\|aix4.[012].*)
	# We only want to do this on AIX 4.2 and lower, the check
	# below for broken collect2 doesn't work under 4.3+
	collect2name=`$CC -print-prog-name=collect2`
	if test -f "$collect2name" &&
	strings "$collect2name" \| $GREP resolve_lib_name >/dev/null
	then
	# We have reworked collect2
	:
	else
	# We have old collect2
	hardcode_direct=unsupported
	# It fails to find uninstalled libraries when the uninstalled
	# path is not listed in the libpath. Setting hardcode_minus_L
	# to unsupported forces relinking
	hardcode_minus_L=yes
	hardcode_libdir_flag_spec='-L$libdir'
	hardcode_libdir_separator=
	fi
	;;
	esac
	shared_flag='-shared'
	if test yes = "$aix_use_runtimelinking"; then
	shared_flag="$shared_flag "'$wl-G'
	fi
	# Need to ensure runtime linking is disabled for the traditional
	# shared library, or the linker may eventually find shared libraries
	# /with/ Import File - we do not want to mix them.
	shared_flag_aix='-shared'
	shared_flag_svr4='-shared $wl-G'
	else
	# not using gcc
	if test ia64 = "$host_cpu"; then
	# VisualAge C++, Version 5.5 for AIX 5L for IA-64, Beta 3 Release
	# chokes on -Wl,-G. The following line is correct:
	shared_flag='-G'
	else
	if test yes = "$aix_use_runtimelinking"; then
	shared_flag='$wl-G'
	else
	shared_flag='$wl-bM:SRE'
	fi
	shared_flag_aix='$wl-bM:SRE'
	shared_flag_svr4='$wl-G'
	fi
	fi

	export_dynamic_flag_spec='$wl-bexpall'
	# It seems that -bexpall does not export symbols beginning with
	# underscore (_), so it is better to generate a list of symbols to export.
	always_export_symbols=yes
	if test aix,yes = "$with_aix_soname,$aix_use_runtimelinking"; then
	# Warning - without using the other runtime loading flags (-brtl),
	# -berok will link without error, but may produce a broken library.
	allow_undefined_flag='-berok'
	# Determine the default libpath from the value encoded in an
	# empty executable.
	if test set = "${lt_cv_aix_libpath+set}"; then
	aix_libpath=$lt_cv_aix_libpath
	else
	if ${lt_cv_aix_libpath_+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :

	lt_aix_libpath_sed='
	/Import File Strings/,/^$/ {
	/^0/ {
	s/^0 $[^ ]$ *$/\1/
	p
	}
	}'
	lt_cv_aix_libpath_=`dump -H conftest$ac_exeext 2>/dev/null \| $SED -n -e "$lt_aix_libpath_sed"`
	# Check for a 64-bit object if we didn't find anything.
	if test -z "$lt_cv_aix_libpath_"; then
	lt_cv_aix_libpath_=`dump -HX64 conftest$ac_exeext 2>/dev/null \| $SED -n -e "$lt_aix_libpath_sed"`
	fi
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	if test -z "$lt_cv_aix_libpath_"; then
	lt_cv_aix_libpath_=/usr/lib:/lib
	fi

	fi

	aix_libpath=$lt_cv_aix_libpath_
	fi

	hardcode_libdir_flag_spec='$wl-blibpath:$libdir:'"$aix_libpath"
	archive_expsym_cmds='$CC -o $output_objdir/$soname $libobjs $deplibs $wl'$no_entry_flag' $compiler_flags `if test -n "$allow_undefined_flag"; then func_echo_all "$wl$allow_undefined_flag"; else :; fi` $wl'$exp_sym_flag:\$export_symbols' '$shared_flag
	else
	if test ia64 = "$host_cpu"; then
	hardcode_libdir_flag_spec='$wl-R $libdir:/usr/lib:/lib'
	allow_undefined_flag="-z nodefs"
	archive_expsym_cmds="\$CC $shared_flag"' -o $output_objdir/$soname $libobjs $deplibs '"\$wl$no_entry_flag"' $compiler_flags $wl$allow_undefined_flag '"\$wl$exp_sym_flag:\$export_symbols"
	else
	# Determine the default libpath from the value encoded in an
	# empty executable.
	if test set = "${lt_cv_aix_libpath+set}"; then
	aix_libpath=$lt_cv_aix_libpath
	else
	if ${lt_cv_aix_libpath_+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :

	lt_aix_libpath_sed='
	/Import File Strings/,/^$/ {
	/^0/ {
	s/^0 $[^ ]$ *$/\1/
	p
	}
	}'
	lt_cv_aix_libpath_=`dump -H conftest$ac_exeext 2>/dev/null \| $SED -n -e "$lt_aix_libpath_sed"`
	# Check for a 64-bit object if we didn't find anything.
	if test -z "$lt_cv_aix_libpath_"; then
	lt_cv_aix_libpath_=`dump -HX64 conftest$ac_exeext 2>/dev/null \| $SED -n -e "$lt_aix_libpath_sed"`
	fi
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	if test -z "$lt_cv_aix_libpath_"; then
	lt_cv_aix_libpath_=/usr/lib:/lib
	fi

	fi

	aix_libpath=$lt_cv_aix_libpath_
	fi

	hardcode_libdir_flag_spec='$wl-blibpath:$libdir:'"$aix_libpath"
	# Warning - without using the other run time loading flags,
	# -berok will link without error, but may produce a broken library.
	no_undefined_flag=' $wl-bernotok'
	allow_undefined_flag=' $wl-berok'
	if test yes = "$with_gnu_ld"; then
	# We only use this code for GNU lds that support --whole-archive.
	whole_archive_flag_spec='$wl--whole-archive$convenience $wl--no-whole-archive'
	else
	# Exported symbols can be pulled into shared objects from archives
	whole_archive_flag_spec='$convenience'
	fi
	archive_cmds_need_lc=yes
	archive_expsym_cmds='$RM -r $output_objdir/$realname.d~$MKDIR $output_objdir/$realname.d'
	# -brtl affects multiple linker settings, -berok does not and is overridden later
	compiler_flags_filtered='`func_echo_all "$compiler_flags " \| $SED -e "s%-brtl\$[, ]\$%-berok\\1%g"`'
	if test svr4 != "$with_aix_soname"; then
	# This is similar to how AIX traditionally builds its shared libraries.
	archive_expsym_cmds="$archive_expsym_cmds"'~$CC '$shared_flag_aix' -o $output_objdir/$realname.d/$soname $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$AR $AR_FLAGS $output_objdir/$libname$release.a $output_objdir/$realname.d/$soname'
	fi
	if test aix != "$with_aix_soname"; then
	archive_expsym_cmds="$archive_expsym_cmds"'~$CC '$shared_flag_svr4' -o $output_objdir/$realname.d/$shared_archive_member_spec.o $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$STRIP -e $output_objdir/$realname.d/$shared_archive_member_spec.o~( func_echo_all "#! $soname($shared_archive_member_spec.o)"; if test shr_64 = "$shared_archive_member_spec"; then func_echo_all "# 64"; else func_echo_all "# 32"; fi; cat $export_symbols ) > $output_objdir/$realname.d/$shared_archive_member_spec.imp~$AR $AR_FLAGS $output_objdir/$soname $output_objdir/$realname.d/$shared_archive_member_spec.o $output_objdir/$realname.d/$shared_archive_member_spec.imp'
	else
	# used by -dlpreopen to get the symbols
	archive_expsym_cmds="$archive_expsym_cmds"'~$MV $output_objdir/$realname.d/$soname $output_objdir'
	fi
	archive_expsym_cmds="$archive_expsym_cmds"'~$RM -r $output_objdir/$realname.d'
	fi
	fi
	;;

	amigaos*)
	case $host_cpu in
	powerpc)
	# see comment about AmigaOS4 .so support
	archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
	archive_expsym_cmds=''
	;;
	m68k)
	archive_cmds='$RM $output_objdir/a2ixlibrary.data~$ECHO "#define NAME $libname" > $output_objdir/a2ixlibrary.data~$ECHO "#define LIBRARY_ID 1" >> $output_objdir/a2ixlibrary.data~$ECHO "#define VERSION $major" >> $output_objdir/a2ixlibrary.data~$ECHO "#define REVISION $revision" >> $output_objdir/a2ixlibrary.data~$AR $AR_FLAGS $lib $libobjs~$RANLIB $lib~(cd $output_objdir && a2ixlibrary -32)'
	hardcode_libdir_flag_spec='-L$libdir'
	hardcode_minus_L=yes
	;;
	esac
	;;

	bsdi[45]*)
	export_dynamic_flag_spec=-rdynamic
	;;

	cygwin* \| mingw* \| pw32* \| cegcc*)
	# When not using gcc, we currently assume that we are using
	# Microsoft Visual C++.
	# hardcode_libdir_flag_spec is actually meaningless, as there is
	# no search path for DLLs.
	case $cc_basename in
	cl*)
	# Native MSVC
	hardcode_libdir_flag_spec=' '
	allow_undefined_flag=unsupported
	always_export_symbols=yes
	file_list_spec='@'
	# Tell ltmain to make .lib files, not .a files.
	libext=lib
	# Tell ltmain to make .dll files, not .so files.
	shrext_cmds=.dll
	# FIXME: Setting linknames here is a bad hack.
	archive_cmds='$CC -o $output_objdir/$soname $libobjs $compiler_flags $deplibs -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~linknames='
	archive_expsym_cmds='if test DEF = "`$SED -n -e '\''s/^[ ]//'\'' -e '\''/^$;.$$/d'\'' -e '\''s/^$EXPORTS\\|LIBRARY$$[ ].$*$/DEF/p'\'' -e q $export_symbols`" ; then
	cp "$export_symbols" "$output_objdir/$soname.def";
	echo "$tool_output_objdir$soname.def" > "$output_objdir/$soname.exp";
	else
	$SED -e '\''s/^/-link -EXPORT:/'\'' < $export_symbols > $output_objdir/$soname.exp;
	fi~
	$CC -o $tool_output_objdir$soname $libobjs $compiler_flags $deplibs "@$tool_output_objdir$soname.exp" -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~
	linknames='
	# The linker will not automatically build a static lib if we build a DLL.
	# _LT_TAGVAR(old_archive_from_new_cmds, )='true'
	enable_shared_with_static_runtimes=yes
	exclude_expsyms='_NULL_IMPORT_DESCRIPTOR\|_IMPORT_DESCRIPTOR_.*'
	export_symbols_cmds='$NM $libobjs $convenience \| $global_symbol_pipe \| $SED -e '\''/^[BCDGRS][ ]/s/.[ ]$[^ ]$/\1,DATA/'\'' \| $SED -e '\''/^[AITW][ ]/s/.*[ ]//'\'' \| sort \| uniq > $export_symbols'
	# Don't use ranlib
	old_postinstall_cmds='chmod 644 $oldlib'
	postlink_cmds='lt_outputfile="@OUTPUT@"~
	lt_tool_outputfile="@TOOL_OUTPUT@"~
	case $lt_outputfile in
	.exe\|.EXE) ;;
	*)
	lt_outputfile=$lt_outputfile.exe
	lt_tool_outputfile=$lt_tool_outputfile.exe
	;;
	esac~
	if test : != "$MANIFEST_TOOL" && test -f "$lt_outputfile.manifest"; then
	$MANIFEST_TOOL -manifest "$lt_tool_outputfile.manifest" -outputresource:"$lt_tool_outputfile" \|\| exit 1;
	$RM "$lt_outputfile.manifest";
	fi'
	;;
	*)
	# Assume MSVC wrapper
	hardcode_libdir_flag_spec=' '
	allow_undefined_flag=unsupported
	# Tell ltmain to make .lib files, not .a files.
	libext=lib
	# Tell ltmain to make .dll files, not .so files.
	shrext_cmds=.dll
	# FIXME: Setting linknames here is a bad hack.
	archive_cmds='$CC -o $lib $libobjs $compiler_flags `func_echo_all "$deplibs" \| $SED '\''s/ -lc$//'\''` -link -dll~linknames='
	# The linker will automatically build a .lib file if we build a DLL.
	old_archive_from_new_cmds='true'
	# FIXME: Should let the user specify the lib program.
	old_archive_cmds='lib -OUT:$oldlib$oldobjs$old_deplibs'
	enable_shared_with_static_runtimes=yes
	;;
	esac
	;;

	darwin* \| rhapsody*)


	archive_cmds_need_lc=no
	hardcode_direct=no
	hardcode_automatic=yes
	hardcode_shlibpath_var=unsupported
	if test yes = "$lt_cv_ld_force_load"; then
	whole_archive_flag_spec='`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience $wl-force_load,$conv\"; done; func_echo_all \"$new_convenience\"`'

	else
	whole_archive_flag_spec=''
	fi
	link_all_deplibs=yes
	allow_undefined_flag=$_lt_dar_allow_undefined
	case $cc_basename in
	ifort\|nagfor) _lt_dar_can_shared=yes ;;
	*) _lt_dar_can_shared=$GCC ;;
	esac
	if test yes = "$_lt_dar_can_shared"; then
	output_verbose_link_cmd=func_echo_all
	archive_cmds="\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dsymutil"
	module_cmds="\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dsymutil"
	archive_expsym_cmds="sed 's\|^\|_\|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
	module_expsym_cmds="sed -e 's\|^\|_\|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"

	else
	ld_shlibs=no
	fi

	;;

	dgux*)
	archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
	hardcode_libdir_flag_spec='-L$libdir'
	hardcode_shlibpath_var=no
	;;

	# FreeBSD 2.2.[012] allows us to include c++rt0.o to get C++ constructor
	# support. Future versions do this automatically, but an explicit c++rt0.o
	# does not break anything, and helps significantly (at the cost of a little
	# extra space).
	freebsd2.2*)
	archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags /usr/lib/c++rt0.o'
	hardcode_libdir_flag_spec='-R$libdir'
	hardcode_direct=yes
	hardcode_shlibpath_var=no
	;;

	# Unfortunately, older versions of FreeBSD 2 do not have this feature.
	freebsd2.*)
	archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags'
	hardcode_direct=yes
	hardcode_minus_L=yes
	hardcode_shlibpath_var=no
	;;

	# FreeBSD 3 and greater uses gcc -shared to do shared libraries.
	freebsd* \| dragonfly*)
	archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
	hardcode_libdir_flag_spec='-R$libdir'
	hardcode_direct=yes
	hardcode_shlibpath_var=no
	;;

	hpux9*)
	if test yes = "$GCC"; then
	archive_cmds='$RM $output_objdir/$soname~$CC -shared $pic_flag $wl+b $wl$install_libdir -o $output_objdir/$soname $libobjs $deplibs $compiler_flags~test "x$output_objdir/$soname" = "x$lib" \|\| mv $output_objdir/$soname $lib'
	else
	archive_cmds='$RM $output_objdir/$soname~$LD -b +b $install_libdir -o $output_objdir/$soname $libobjs $deplibs $linker_flags~test "x$output_objdir/$soname" = "x$lib" \|\| mv $output_objdir/$soname $lib'
	fi
	hardcode_libdir_flag_spec='$wl+b $wl$libdir'
	hardcode_libdir_separator=:
	hardcode_direct=yes

	# hardcode_minus_L: Not really in the search PATH,
	# but as the default location of the library.
	hardcode_minus_L=yes
	export_dynamic_flag_spec='$wl-E'
	;;

	hpux10*)
	if test yes,no = "$GCC,$with_gnu_ld"; then
	archive_cmds='$CC -shared $pic_flag $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags'
	else
	archive_cmds='$LD -b +h $soname +b $install_libdir -o $lib $libobjs $deplibs $linker_flags'
	fi
	if test no = "$with_gnu_ld"; then
	hardcode_libdir_flag_spec='$wl+b $wl$libdir'
	hardcode_libdir_separator=:
	hardcode_direct=yes
	hardcode_direct_absolute=yes
	export_dynamic_flag_spec='$wl-E'
	# hardcode_minus_L: Not really in the search PATH,
	# but as the default location of the library.
	hardcode_minus_L=yes
	fi
	;;

	hpux11*)
	if test yes,no = "$GCC,$with_gnu_ld"; then
	case $host_cpu in
	hppa64)
	archive_cmds='$CC -shared $wl+h $wl$soname -o $lib $libobjs $deplibs $compiler_flags'
	;;
	ia64*)
	archive_cmds='$CC -shared $pic_flag $wl+h $wl$soname $wl+nodefaultrpath -o $lib $libobjs $deplibs $compiler_flags'
	;;
	*)
	archive_cmds='$CC -shared $pic_flag $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags'
	;;
	esac
	else
	case $host_cpu in
	hppa64)
	archive_cmds='$CC -b $wl+h $wl$soname -o $lib $libobjs $deplibs $compiler_flags'
	;;
	ia64*)
	archive_cmds='$CC -b $wl+h $wl$soname $wl+nodefaultrpath -o $lib $libobjs $deplibs $compiler_flags'
	;;
	*)

	# Older versions of the 11.00 compiler do not understand -b yet
	# (HP92453-01 A.11.01.20 doesn't, HP92453-01 B.11.X.35175-35176.GP does)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC understands -b" >&5
	$as_echo_n "checking if $CC understands -b... " >&6; }
	if ${lt_cv_prog_compiler__b+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_prog_compiler__b=no
	save_LDFLAGS=$LDFLAGS
	LDFLAGS="$LDFLAGS -b"
	echo "$lt_simple_link_test_code" > conftest.$ac_ext
	if (eval $ac_link 2>conftest.err) && test -s conftest$ac_exeext; then
	# The linker can only warn and ignore the option if not recognized
	# So say no if there are warnings
	if test -s conftest.err; then
	# Append any errors to the config.log.
	cat conftest.err 1>&5
	$ECHO "$_lt_linker_boilerplate" \| $SED '/^$/d' > conftest.exp
	$SED '/^$/d; /^ *+/d' conftest.err >conftest.er2
	if diff conftest.exp conftest.er2 >/dev/null; then
	lt_cv_prog_compiler__b=yes
	fi
	else
	lt_cv_prog_compiler__b=yes
	fi
	fi
	$RM -r conftest*
	LDFLAGS=$save_LDFLAGS

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler__b" >&5
	$as_echo "$lt_cv_prog_compiler__b" >&6; }

	if test yes = "$lt_cv_prog_compiler__b"; then
	archive_cmds='$CC -b $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags'
	else
	archive_cmds='$LD -b +h $soname +b $install_libdir -o $lib $libobjs $deplibs $linker_flags'
	fi

	;;
	esac
	fi
	if test no = "$with_gnu_ld"; then
	hardcode_libdir_flag_spec='$wl+b $wl$libdir'
	hardcode_libdir_separator=:

	case $host_cpu in
	hppa64\|ia64*)
	hardcode_direct=no
	hardcode_shlibpath_var=no
	;;
	*)
	hardcode_direct=yes
	hardcode_direct_absolute=yes
	export_dynamic_flag_spec='$wl-E'

	# hardcode_minus_L: Not really in the search PATH,
	# but as the default location of the library.
	hardcode_minus_L=yes
	;;
	esac
	fi
	;;

	irix5* \| irix6* \| nonstopux*)
	if test yes = "$GCC"; then
	archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib'
	# Try to use the -exported_symbol ld option, if it does not
	# work, assume that -exports_file does not work either and
	# implicitly export all symbols.
	# This should be the same for all languages, so no per-tag cache variable.
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the $host_os linker accepts -exported_symbol" >&5
	$as_echo_n "checking whether the $host_os linker accepts -exported_symbol... " >&6; }
	if ${lt_cv_irix_exported_symbol+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	save_LDFLAGS=$LDFLAGS
	LDFLAGS="$LDFLAGS -shared $wl-exported_symbol ${wl}foo $wl-update_registry $wl/dev/null"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	int foo (void) { return 0; }
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	lt_cv_irix_exported_symbol=yes
	else
	lt_cv_irix_exported_symbol=no
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	LDFLAGS=$save_LDFLAGS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_irix_exported_symbol" >&5
	$as_echo "$lt_cv_irix_exported_symbol" >&6; }
	if test yes = "$lt_cv_irix_exported_symbol"; then
	archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib'
	fi
	else
	archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
	archive_expsym_cmds='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -exports_file $export_symbols -o $lib'
	fi
	archive_cmds_need_lc='no'
	hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
	hardcode_libdir_separator=:
	inherit_rpath=yes
	link_all_deplibs=yes
	;;

	linux*)
	case $cc_basename in
	tcc*)
	# Fabrice Bellard et al's Tiny C Compiler
	ld_shlibs=yes
	archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
	;;
	esac
	;;

	netbsd*)
	if echo __ELF__ \| $CC -E - \| $GREP __ELF__ >/dev/null; then
	archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags' # a.out
	else
	archive_cmds='$LD -shared -o $lib $libobjs $deplibs $linker_flags' # ELF
	fi
	hardcode_libdir_flag_spec='-R$libdir'
	hardcode_direct=yes
	hardcode_shlibpath_var=no
	;;

	newsos6)
	archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
	hardcode_direct=yes
	hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
	hardcode_libdir_separator=:
	hardcode_shlibpath_var=no
	;;

	nto \| qnx)
	;;

	openbsd* \| bitrig*)
	if test -f /usr/libexec/ld.so; then
	hardcode_direct=yes
	hardcode_shlibpath_var=no
	hardcode_direct_absolute=yes
	if test -z "`echo __ELF__ \| $CC -E - \| $GREP __ELF__`"; then
	archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
	archive_expsym_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags $wl-retain-symbols-file,$export_symbols'
	hardcode_libdir_flag_spec='$wl-rpath,$libdir'
	export_dynamic_flag_spec='$wl-E'
	else
	archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
	hardcode_libdir_flag_spec='$wl-rpath,$libdir'
	fi
	else
	ld_shlibs=no
	fi
	;;

	os2*)
	hardcode_libdir_flag_spec='-L$libdir'
	hardcode_minus_L=yes
	allow_undefined_flag=unsupported
	shrext_cmds=.dll
	archive_cmds='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~
	$ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~
	$ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~
	$ECHO EXPORTS >> $output_objdir/$libname.def~
	emxexp $libobjs \| $SED /"_DLL_InitTerm"/d >> $output_objdir/$libname.def~
	$CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~
	emximp -o $lib $output_objdir/$libname.def'
	archive_expsym_cmds='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~
	$ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~
	$ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~
	$ECHO EXPORTS >> $output_objdir/$libname.def~
	prefix_cmds="$SED"~
	if test EXPORTS = "`$SED 1q $export_symbols`"; then
	prefix_cmds="$prefix_cmds -e 1d";
	fi~
	prefix_cmds="$prefix_cmds -e \"s/^$.*$$/_\1/g\""~
	cat $export_symbols \| $prefix_cmds >> $output_objdir/$libname.def~
	$CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~
	emximp -o $lib $output_objdir/$libname.def'
	old_archive_From_new_cmds='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
	enable_shared_with_static_runtimes=yes
	;;

	osf3*)
	if test yes = "$GCC"; then
	allow_undefined_flag=' $wl-expect_unresolved $wl\*'
	archive_cmds='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib'
	else
	allow_undefined_flag=' -expect_unresolved \*'
	archive_cmds='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
	fi
	archive_cmds_need_lc='no'
	hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
	hardcode_libdir_separator=:
	;;

	osf4* \| osf5) # as osf3 with the addition of -msym flag
	if test yes = "$GCC"; then
	allow_undefined_flag=' $wl-expect_unresolved $wl\*'
	archive_cmds='$CC -shared$allow_undefined_flag $pic_flag $libobjs $deplibs $compiler_flags $wl-msym $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib'
	hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
	else
	allow_undefined_flag=' -expect_unresolved \*'
	archive_cmds='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags -msym -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
	archive_expsym_cmds='for i in `cat $export_symbols`; do printf "%s %s\\n" -exported_symbol "\$i" >> $lib.exp; done; printf "%s\\n" "-hidden">> $lib.exp~
	$CC -shared$allow_undefined_flag $wl-input $wl$lib.exp $compiler_flags $libobjs $deplibs -soname $soname `test -n "$verstring" && $ECHO "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib~$RM $lib.exp'

	# Both c and cxx compiler support -rpath directly
	hardcode_libdir_flag_spec='-rpath $libdir'
	fi
	archive_cmds_need_lc='no'
	hardcode_libdir_separator=:
	;;

	solaris*)
	no_undefined_flag=' -z defs'
	if test yes = "$GCC"; then
	wlarc='$wl'
	archive_cmds='$CC -shared $pic_flag $wl-z ${wl}text $wl-h $wl$soname -o $lib $libobjs $deplibs $compiler_flags'
	archive_expsym_cmds='echo "{ global:" > $lib.exp~cat $export_symbols \| $SED -e "s/$.$/\1;/" >> $lib.exp~echo "local: ; };" >> $lib.exp~
	$CC -shared $pic_flag $wl-z ${wl}text $wl-M $wl$lib.exp $wl-h $wl$soname -o $lib $libobjs $deplibs $compiler_flags~$RM $lib.exp'
	else
	case `$CC -V 2>&1` in
	"Compilers 5.0")
	wlarc=''
	archive_cmds='$LD -G$allow_undefined_flag -h $soname -o $lib $libobjs $deplibs $linker_flags'
	archive_expsym_cmds='echo "{ global:" > $lib.exp~cat $export_symbols \| $SED -e "s/$.$/\1;/" >> $lib.exp~echo "local: ; };" >> $lib.exp~
	$LD -G$allow_undefined_flag -M $lib.exp -h $soname -o $lib $libobjs $deplibs $linker_flags~$RM $lib.exp'
	;;
	*)
	wlarc='$wl'
	archive_cmds='$CC -G$allow_undefined_flag -h $soname -o $lib $libobjs $deplibs $compiler_flags'
	archive_expsym_cmds='echo "{ global:" > $lib.exp~cat $export_symbols \| $SED -e "s/$.$/\1;/" >> $lib.exp~echo "local: ; };" >> $lib.exp~
	$CC -G$allow_undefined_flag -M $lib.exp -h $soname -o $lib $libobjs $deplibs $compiler_flags~$RM $lib.exp'
	;;
	esac
	fi
	hardcode_libdir_flag_spec='-R$libdir'
	hardcode_shlibpath_var=no
	case $host_os in
	solaris2.[0-5] \| solaris2.[0-5].*) ;;
	*)
	# The compiler driver will combine and reorder linker options,
	# but understands '-z linker_flag'. GCC discards it without '$wl',
	# but is careful enough not to reorder.
	# Supported since Solaris 2.6 (maybe 2.5.1?)
	if test yes = "$GCC"; then
	whole_archive_flag_spec='$wl-z ${wl}allextract$convenience $wl-z ${wl}defaultextract'
	else
	whole_archive_flag_spec='-z allextract$convenience -z defaultextract'
	fi
	;;
	esac
	link_all_deplibs=yes
	;;

	sunos4*)
	if test sequent = "$host_vendor"; then
	# Use $CC to link under sequent, because it throws in some extra .o
	# files that make .init and .fini sections work.
	archive_cmds='$CC -G $wl-h $soname -o $lib $libobjs $deplibs $compiler_flags'
	else
	archive_cmds='$LD -assert pure-text -Bstatic -o $lib $libobjs $deplibs $linker_flags'
	fi
	hardcode_libdir_flag_spec='-L$libdir'
	hardcode_direct=yes
	hardcode_minus_L=yes
	hardcode_shlibpath_var=no
	;;

	sysv4)
	case $host_vendor in
	sni)
	archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
	hardcode_direct=yes # is this really true???
	;;
	siemens)
	## LD is ld it makes a PLAMLIB
	## CC just makes a GrossModule.
	archive_cmds='$LD -G -o $lib $libobjs $deplibs $linker_flags'
	reload_cmds='$CC -r -o $output$reload_objs'
	hardcode_direct=no
	;;
	motorola)
	archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
	hardcode_direct=no #Motorola manual says yes, but my tests say they lie
	;;
	esac
	runpath_var='LD_RUN_PATH'
	hardcode_shlibpath_var=no
	;;

	sysv4.3*)
	archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
	hardcode_shlibpath_var=no
	export_dynamic_flag_spec='-Bexport'
	;;

	sysv4MP)
	if test -d /usr/nec; then
	archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
	hardcode_shlibpath_var=no
	runpath_var=LD_RUN_PATH
	hardcode_runpath_var=yes
	ld_shlibs=yes
	fi
	;;

	sysv4uw2 \| sysv5OpenUNIX* \| sysv5UnixWare7.[01].[10]* \| unixware7* \| sco3.2v5.0.[024]*)
	no_undefined_flag='$wl-z,text'
	archive_cmds_need_lc=no
	hardcode_shlibpath_var=no
	runpath_var='LD_RUN_PATH'

	if test yes = "$GCC"; then
	archive_cmds='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	archive_expsym_cmds='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	else
	archive_cmds='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	archive_expsym_cmds='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	fi
	;;

	sysv5* \| sco3.2v5* \| sco5v6*)
	# Note: We CANNOT use -z defs as we might desire, because we do not
	# link with -lc, and that would cause any symbols used from libc to
	# always be unresolved, which means just about no library would
	# ever link correctly. If we're not using GNU ld we use -z text
	# though, which does catch some bad symbols but isn't as heavy-handed
	# as -z defs.
	no_undefined_flag='$wl-z,text'
	allow_undefined_flag='$wl-z,nodefs'
	archive_cmds_need_lc=no
	hardcode_shlibpath_var=no
	hardcode_libdir_flag_spec='$wl-R,$libdir'
	hardcode_libdir_separator=':'
	link_all_deplibs=yes
	export_dynamic_flag_spec='$wl-Bexport'
	runpath_var='LD_RUN_PATH'

	if test yes = "$GCC"; then
	archive_cmds='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	archive_expsym_cmds='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	else
	archive_cmds='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	archive_expsym_cmds='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags'
	fi
	;;

	uts4*)
	archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
	hardcode_libdir_flag_spec='-L$libdir'
	hardcode_shlibpath_var=no
	;;

	*)
	ld_shlibs=no
	;;
	esac

	if test sni = "$host_vendor"; then
	case $host in
	sysv4 \| sysv4.2uw2* \| sysv4.3* \| sysv5*)
	export_dynamic_flag_spec='$wl-Blargedynsym'
	;;
	esac
	fi
	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ld_shlibs" >&5
	$as_echo "$ld_shlibs" >&6; }
	test no = "$ld_shlibs" && can_build_shared=no

	with_gnu_ld=$with_gnu_ld















	#
	# Do we need to explicitly link libc?
	#
	case "x$archive_cmds_need_lc" in
	x\|xyes)
	# Assume -lc should be added
	archive_cmds_need_lc=yes

	if test yes,yes = "$GCC,$enable_shared"; then
	case $archive_cmds in
	'~')
	# FIXME: we may have to deal with multi-command sequences.
	;;
	'$CC '*)
	# Test whether the compiler implicitly links with -lc since on some
	# systems, -lgcc has to come before -lc. If gcc already passes -lc
	# to ld, don't add -lc before -lgcc.
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether -lc should be explicitly linked in" >&5
	$as_echo_n "checking whether -lc should be explicitly linked in... " >&6; }
	if ${lt_cv_archive_cmds_need_lc+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	$RM conftest*
	echo "$lt_simple_compile_test_code" > conftest.$ac_ext

	if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
	(eval $ac_compile) 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; } 2>conftest.err; then
	soname=conftest
	lib=conftest
	libobjs=conftest.$ac_objext
	deplibs=
	wl=$lt_prog_compiler_wl
	pic_flag=$lt_prog_compiler_pic
	compiler_flags=-v
	linker_flags=-v
	verstring=
	output_objdir=.
	libname=conftest
	lt_save_allow_undefined_flag=$allow_undefined_flag
	allow_undefined_flag=
	if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$archive_cmds 2\>\&1 \\| $GREP \" -lc \" \>/dev/null 2\>\&1\""; } >&5
	(eval $archive_cmds 2\>\&1 \\| $GREP \" -lc \" \>/dev/null 2\>\&1) 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }
	then
	lt_cv_archive_cmds_need_lc=no
	else
	lt_cv_archive_cmds_need_lc=yes
	fi
	allow_undefined_flag=$lt_save_allow_undefined_flag
	else
	cat conftest.err 1>&5
	fi
	$RM conftest*

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_archive_cmds_need_lc" >&5
	$as_echo "$lt_cv_archive_cmds_need_lc" >&6; }
	archive_cmds_need_lc=$lt_cv_archive_cmds_need_lc
	;;
	esac
	fi
	;;
	esac
























































































































































	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking dynamic linker characteristics" >&5
	$as_echo_n "checking dynamic linker characteristics... " >&6; }

	if test yes = "$GCC"; then
	case $host_os in
	darwin*) lt_awk_arg='/^libraries:/,/LR/' ;;
	*) lt_awk_arg='/^libraries:/' ;;
	esac
	case $host_os in
	mingw* \| cegcc*) lt_sed_strip_eq='s\|=$[A-Za-z]:$\|\1\|g' ;;
	*) lt_sed_strip_eq='s\|=/\|/\|g' ;;
	esac
	lt_search_path_spec=`$CC -print-search-dirs \| awk $lt_awk_arg \| $SED -e "s/^libraries://" -e $lt_sed_strip_eq`
	case $lt_search_path_spec in
	\;)
	# if the path contains ";" then we assume it to be the separator
	# otherwise default to the standard path separator (i.e. ":") - it is
	# assumed that no part of a normal pathname contains ";" but that should
	# okay in the real world where ";" in dirpaths is itself problematic.
	lt_search_path_spec=`$ECHO "$lt_search_path_spec" \| $SED 's/;/ /g'`
	;;
	*)
	lt_search_path_spec=`$ECHO "$lt_search_path_spec" \| $SED "s/$PATH_SEPARATOR/ /g"`
	;;
	esac
	# Ok, now we have the path, separated by spaces, we can step through it
	# and add multilib dir if necessary...
	lt_tmp_lt_search_path_spec=
	lt_multi_os_dir=/`$CC $CPPFLAGS $CFLAGS $LDFLAGS -print-multi-os-directory 2>/dev/null`
	# ...but if some path component already ends with the multilib dir we assume
	# that all is fine and trust -print-search-dirs as is (GCC 4.2? or newer).
	case "$lt_multi_os_dir; $lt_search_path_spec " in
	"/; "* \| "/.; "* \| "/./; "* \| "$lt_multi_os_dir " \| "$lt_multi_os_dir/ ")
	lt_multi_os_dir=
	;;
	esac
	for lt_sys_path in $lt_search_path_spec; do
	if test -d "$lt_sys_path$lt_multi_os_dir"; then
	lt_tmp_lt_search_path_spec="$lt_tmp_lt_search_path_spec $lt_sys_path$lt_multi_os_dir"
	elif test -n "$lt_multi_os_dir"; then
	test -d "$lt_sys_path" && \
	lt_tmp_lt_search_path_spec="$lt_tmp_lt_search_path_spec $lt_sys_path"
	fi
	done
	lt_search_path_spec=`$ECHO "$lt_tmp_lt_search_path_spec" \| awk '
	BEGIN {RS = " "; FS = "/\|\n";} {
	lt_foo = "";
	lt_count = 0;
	for (lt_i = NF; lt_i > 0; lt_i--) {
	if ($lt_i != "" && $lt_i != ".") {
	if ($lt_i == "..") {
	lt_count++;
	} else {
	if (lt_count == 0) {
	lt_foo = "/" $lt_i lt_foo;
	} else {
	lt_count--;
	}
	}
	}
	}
	if (lt_foo != "") { lt_freq[lt_foo]++; }
	if (lt_freq[lt_foo] == 1) { print lt_foo; }
	}'`
	# AWK program above erroneously prepends '/' to C:/dos/paths
	# for these hosts.
	case $host_os in
	mingw* \| cegcc*) lt_search_path_spec=`$ECHO "$lt_search_path_spec" \|\
	$SED 's\|/$[A-Za-z]:$\|\1\|g'` ;;
	esac
	sys_lib_search_path_spec=`$ECHO "$lt_search_path_spec" \| $lt_NL2SP`
	else
	sys_lib_search_path_spec="/lib /usr/lib /usr/local/lib"
	fi
	library_names_spec=
	libname_spec='lib$name'
	soname_spec=
	shrext_cmds=.so
	postinstall_cmds=
	postuninstall_cmds=
	finish_cmds=
	finish_eval=
	shlibpath_var=
	shlibpath_overrides_runpath=unknown
	version_type=none
	dynamic_linker="$host_os ld.so"
	sys_lib_dlsearch_path_spec="/lib /usr/lib"
	need_lib_prefix=unknown
	hardcode_into_libs=no

	# when you set need_version to no, make sure it does not cause -set_version
	# flags to be left without arguments
	need_version=unknown



	case $host_os in
	aix3*)
	version_type=linux # correct to gnu/linux during the next big refactor
	library_names_spec='$libname$release$shared_ext$versuffix $libname.a'
	shlibpath_var=LIBPATH

	# AIX 3 has no versioning support, so we append a major version to the name.
	soname_spec='$libname$release$shared_ext$major'
	;;

	aix[4-9]*)
	version_type=linux # correct to gnu/linux during the next big refactor
	need_lib_prefix=no
	need_version=no
	hardcode_into_libs=yes
	if test ia64 = "$host_cpu"; then
	# AIX 5 supports IA64
	library_names_spec='$libname$release$shared_ext$major $libname$release$shared_ext$versuffix $libname$shared_ext'
	shlibpath_var=LD_LIBRARY_PATH
	else
	# With GCC up to 2.95.x, collect2 would create an import file
	# for dependence libraries. The import file would start with
	# the line '#! .'. This would cause the generated library to
	# depend on '.', always an invalid library. This was fixed in
	# development snapshots of GCC prior to 3.0.
	case $host_os in
	aix4 \| aix4.[01] \| aix4.[01].*)
	if { echo '#if __GNUC__ > 2 \|\| (__GNUC__ == 2 && __GNUC_MINOR__ >= 97)'
	echo ' yes '
	echo '#endif'; } \| $CC -E - \| $GREP yes > /dev/null; then
	:
	else
	can_build_shared=no
	fi
	;;
	esac
	# Using Import Files as archive members, it is possible to support
	# filename-based versioning of shared library archives on AIX. While
	# this would work for both with and without runtime linking, it will
	# prevent static linking of such archives. So we do filename-based
	# shared library versioning with .so extension only, which is used
	# when both runtime linking and shared linking is enabled.
	# Unfortunately, runtime linking may impact performance, so we do
	# not want this to be the default eventually. Also, we use the
	# versioned .so libs for executables only if there is the -brtl
	# linker flag in LDFLAGS as well, or --with-aix-soname=svr4 only.
	# To allow for filename-based versioning support, we need to create
	# libNAME.so.V as an archive file, containing:
	# *) an Import File, referring to the versioned filename of the
	# archive as well as the shared archive member, telling the
	# bitwidth (32 or 64) of that shared object, and providing the
	# list of exported symbols of that shared object, eventually
	# decorated with the 'weak' keyword
	# *) the shared object with the F_LOADONLY flag set, to really avoid
	# it being seen by the linker.
	# At run time we better use the real file rather than another symlink,
	# but for link time we create the symlink libNAME.so -> libNAME.so.V

	case $with_aix_soname,$aix_use_runtimelinking in
	# AIX (on Power*) has no versioning support, so currently we cannot hardcode correct
	# soname into executable. Probably we can add versioning support to
	# collect2, so additional links can be useful in future.
	aix,yes) # traditional libtool
	dynamic_linker='AIX unversionable lib.so'
	# If using run time linking (on AIX 4.2 or later) use lib<name>.so
	# instead of lib<name>.a to let people know that these are not
	# typical AIX shared libraries.
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	;;
	aix,no) # traditional AIX only
	dynamic_linker='AIX lib.a(lib.so.V)'
	# We preserve .a as extension for shared libraries through AIX4.2
	# and later when we are not doing run time linking.
	library_names_spec='$libname$release.a $libname.a'
	soname_spec='$libname$release$shared_ext$major'
	;;
	svr4,*) # full svr4 only
	dynamic_linker="AIX lib.so.V($shared_archive_member_spec.o)"
	library_names_spec='$libname$release$shared_ext$major $libname$shared_ext'
	# We do not specify a path in Import Files, so LIBPATH fires.
	shlibpath_overrides_runpath=yes
	;;
	*,yes) # both, prefer svr4
	dynamic_linker="AIX lib.so.V($shared_archive_member_spec.o), lib.a(lib.so.V)"
	library_names_spec='$libname$release$shared_ext$major $libname$shared_ext'
	# unpreferred sharedlib libNAME.a needs extra handling
	postinstall_cmds='test -n "$linkname" \|\| linkname="$realname"~func_stripname "" ".so" "$linkname"~$install_shared_prog "$dir/$func_stripname_result.$libext" "$destdir/$func_stripname_result.$libext"~test -z "$tstripme" \|\| test -z "$striplib" \|\| $striplib "$destdir/$func_stripname_result.$libext"'
	postuninstall_cmds='for n in $library_names $old_library; do :; done~func_stripname "" ".so" "$n"~test "$func_stripname_result" = "$n" \|\| func_append rmfiles " $odir/$func_stripname_result.$libext"'
	# We do not specify a path in Import Files, so LIBPATH fires.
	shlibpath_overrides_runpath=yes
	;;
	*,no) # both, prefer aix
	dynamic_linker="AIX lib.a(lib.so.V), lib.so.V($shared_archive_member_spec.o)"
	library_names_spec='$libname$release.a $libname.a'
	soname_spec='$libname$release$shared_ext$major'
	# unpreferred sharedlib libNAME.so.V and symlink libNAME.so need extra handling
	postinstall_cmds='test -z "$dlname" \|\| $install_shared_prog $dir/$dlname $destdir/$dlname~test -z "$tstripme" \|\| test -z "$striplib" \|\| $striplib $destdir/$dlname~test -n "$linkname" \|\| linkname=$realname~func_stripname "" ".a" "$linkname"~(cd "$destdir" && $LN_S -f $dlname $func_stripname_result.so)'
	postuninstall_cmds='test -z "$dlname" \|\| func_append rmfiles " $odir/$dlname"~for n in $old_library $library_names; do :; done~func_stripname "" ".a" "$n"~func_append rmfiles " $odir/$func_stripname_result.so"'
	;;
	esac
	shlibpath_var=LIBPATH
	fi
	;;

	amigaos*)
	case $host_cpu in
	powerpc)
	# Since July 2007 AmigaOS4 officially supports .so libraries.
	# When compiling the executable, add -use-dynld -Lsobjs: to the compileline.
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	;;
	m68k)
	library_names_spec='$libname.ixlibrary $libname.a'
	# Create ${libname}_ixlibrary.a entries in /sys/libs.
	finish_eval='for lib in `ls $libdir/.ixlibrary 2>/dev/null`; do libname=`func_echo_all "$lib" \| $SED '\''s%^./$[^/]*$\.ixlibrary$%\1%'\''`; $RM /sys/libs/${libname}_ixlibrary.a; $show "cd /sys/libs && $LN_S $lib ${libname}_ixlibrary.a"; cd /sys/libs && $LN_S $lib ${libname}_ixlibrary.a \|\| exit 1; done'
	;;
	esac
	;;

	beos*)
	library_names_spec='$libname$shared_ext'
	dynamic_linker="$host_os ld.so"
	shlibpath_var=LIBRARY_PATH
	;;

	bsdi[45]*)
	version_type=linux # correct to gnu/linux during the next big refactor
	need_version=no
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	finish_cmds='PATH="\$PATH:/sbin" ldconfig $libdir'
	shlibpath_var=LD_LIBRARY_PATH
	sys_lib_search_path_spec="/shlib /usr/lib /usr/X11/lib /usr/contrib/lib /lib /usr/local/lib"
	sys_lib_dlsearch_path_spec="/shlib /usr/lib /usr/local/lib"
	# the default ld.so.conf also contains /usr/contrib/lib and
	# /usr/X11R6/lib (/usr/X11 is a link to /usr/X11R6), but let us allow
	# libtool to hard-code these into programs
	;;

	cygwin* \| mingw* \| pw32* \| cegcc*)
	version_type=windows
	shrext_cmds=.dll
	need_version=no
	need_lib_prefix=no

	case $GCC,$cc_basename in
	yes,*)
	# gcc
	library_names_spec='$libname.dll.a'
	# DLL is installed to $(libdir)/../bin by postinstall_cmds
	postinstall_cmds='base_file=`basename \$file`~
	dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; echo \$dlname'\''`~
	dldir=$destdir/`dirname \$dlpath`~
	test -d \$dldir \|\| mkdir -p \$dldir~
	$install_prog $dir/$dlname \$dldir/$dlname~
	chmod a+x \$dldir/$dlname~
	if test -n '\''$stripme'\'' && test -n '\''$striplib'\''; then
	eval '\''$striplib \$dldir/$dlname'\'' \|\| exit \$?;
	fi'
	postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; echo \$dlname'\''`~
	dlpath=$dir/\$dldll~
	$RM \$dlpath'
	shlibpath_overrides_runpath=yes

	case $host_os in
	cygwin*)
	# Cygwin DLLs use 'cyg' prefix rather than 'lib'
	soname_spec='`echo $libname \| sed -e 's/^lib/cyg/'``echo $release \| $SED -e 's/[.]/-/g'`$versuffix$shared_ext'

	sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/lib/w32api"
	;;
	mingw* \| cegcc*)
	# MinGW DLLs use traditional 'lib' prefix
	soname_spec='$libname`echo $release \| $SED -e 's/[.]/-/g'`$versuffix$shared_ext'
	;;
	pw32*)
	# pw32 DLLs use 'pw' prefix rather than 'lib'
	library_names_spec='`echo $libname \| sed -e 's/^lib/pw/'``echo $release \| $SED -e 's/[.]/-/g'`$versuffix$shared_ext'
	;;
	esac
	dynamic_linker='Win32 ld.exe'
	;;

	,cl)
	# Native MSVC
	libname_spec='$name'
	soname_spec='$libname`echo $release \| $SED -e 's/[.]/-/g'`$versuffix$shared_ext'
	library_names_spec='$libname.dll.lib'

	case $build_os in
	mingw*)
	sys_lib_search_path_spec=
	lt_save_ifs=$IFS
	IFS=';'
	for lt_path in $LIB
	do
	IFS=$lt_save_ifs
	# Let DOS variable expansion print the short 8.3 style file name.
	lt_path=`cd "$lt_path" 2>/dev/null && cmd //C "for %i in (".") do @echo %~si"`
	sys_lib_search_path_spec="$sys_lib_search_path_spec $lt_path"
	done
	IFS=$lt_save_ifs
	# Convert to MSYS style.
	sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" \| sed -e 's\|\\\\\|/\|g' -e 's\| \$[a-zA-Z]\$:\| /\\1\|g' -e 's\|^ \|\|'`
	;;
	cygwin*)
	# Convert to unix form, then to dos form, then back to unix form
	# but this time dos style (no spaces!) so that the unix form looks
	# like /cygdrive/c/PROGRA~1:/cygdr...
	sys_lib_search_path_spec=`cygpath --path --unix "$LIB"`
	sys_lib_search_path_spec=`cygpath --path --dos "$sys_lib_search_path_spec" 2>/dev/null`
	sys_lib_search_path_spec=`cygpath --path --unix "$sys_lib_search_path_spec" \| $SED -e "s/$PATH_SEPARATOR/ /g"`
	;;
	*)
	sys_lib_search_path_spec=$LIB
	if $ECHO "$sys_lib_search_path_spec" \| $GREP ';[c-zC-Z]:/' >/dev/null; then
	# It is most probably a Windows format PATH.
	sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" \| $SED -e 's/;/ /g'`
	else
	sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" \| $SED -e "s/$PATH_SEPARATOR/ /g"`
	fi
	# FIXME: find the short name or the path components, as spaces are
	# common. (e.g. "Program Files" -> "PROGRA~1")
	;;
	esac

	# DLL is installed to $(libdir)/../bin by postinstall_cmds
	postinstall_cmds='base_file=`basename \$file`~
	dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; echo \$dlname'\''`~
	dldir=$destdir/`dirname \$dlpath`~
	test -d \$dldir \|\| mkdir -p \$dldir~
	$install_prog $dir/$dlname \$dldir/$dlname'
	postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; echo \$dlname'\''`~
	dlpath=$dir/\$dldll~
	$RM \$dlpath'
	shlibpath_overrides_runpath=yes
	dynamic_linker='Win32 link.exe'
	;;

	*)
	# Assume MSVC wrapper
	library_names_spec='$libname`echo $release \| $SED -e 's/[.]/-/g'`$versuffix$shared_ext $libname.lib'
	dynamic_linker='Win32 ld.exe'
	;;
	esac
	# FIXME: first we should search . and the directory the executable is in
	shlibpath_var=PATH
	;;

	darwin* \| rhapsody*)
	dynamic_linker="$host_os dyld"
	version_type=darwin
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$major$shared_ext $libname$shared_ext'
	soname_spec='$libname$release$major$shared_ext'
	shlibpath_overrides_runpath=yes
	shlibpath_var=DYLD_LIBRARY_PATH
	shrext_cmds='`test .$module = .yes && echo .so \|\| echo .dylib`'

	sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/local/lib"
	sys_lib_dlsearch_path_spec='/usr/local/lib /lib /usr/lib'
	;;

	dgux*)
	version_type=linux # correct to gnu/linux during the next big refactor
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	shlibpath_var=LD_LIBRARY_PATH
	;;

	freebsd* \| dragonfly*)
	# DragonFly does not have aout. When/if they implement a new
	# versioning mechanism, adjust this.
	if test -x /usr/bin/objformat; then
	objformat=`/usr/bin/objformat`
	else
	case $host_os in
	freebsd[23].*) objformat=aout ;;
	*) objformat=elf ;;
	esac
	fi
	version_type=freebsd-$objformat
	case $version_type in
	freebsd-elf*)
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	need_version=no
	need_lib_prefix=no
	;;
	freebsd-*)
	library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix'
	need_version=yes
	;;
	esac
	shlibpath_var=LD_LIBRARY_PATH
	case $host_os in
	freebsd2.*)
	shlibpath_overrides_runpath=yes
	;;
	freebsd3.[01]* \| freebsdelf3.[01]*)
	shlibpath_overrides_runpath=yes
	hardcode_into_libs=yes
	;;
	freebsd3.[2-9]* \| freebsdelf3.[2-9]* \| \
	freebsd4.[0-5] \| freebsdelf4.[0-5] \| freebsd4.1.1 \| freebsdelf4.1.1)
	shlibpath_overrides_runpath=no
	hardcode_into_libs=yes
	;;
	*) # from 4.6 on, and DragonFly
	shlibpath_overrides_runpath=yes
	hardcode_into_libs=yes
	;;
	esac
	;;

	haiku*)
	version_type=linux # correct to gnu/linux during the next big refactor
	need_lib_prefix=no
	need_version=no
	dynamic_linker="$host_os runtime_loader"
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	shlibpath_var=LIBRARY_PATH
	shlibpath_overrides_runpath=no
	sys_lib_dlsearch_path_spec='/boot/home/config/lib /boot/common/lib /boot/system/lib'
	hardcode_into_libs=yes
	;;

	hpux9* \| hpux10* \| hpux11*)
	# Give a soname corresponding to the major version so that dld.sl refuses to
	# link against other versions.
	version_type=sunos
	need_lib_prefix=no
	need_version=no
	case $host_cpu in
	ia64*)
	shrext_cmds='.so'
	hardcode_into_libs=yes
	dynamic_linker="$host_os dld.so"
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	if test 32 = "$HPUX_IA64_MODE"; then
	sys_lib_search_path_spec="/usr/lib/hpux32 /usr/local/lib/hpux32 /usr/local/lib"
	sys_lib_dlsearch_path_spec=/usr/lib/hpux32
	else
	sys_lib_search_path_spec="/usr/lib/hpux64 /usr/local/lib/hpux64"
	sys_lib_dlsearch_path_spec=/usr/lib/hpux64
	fi
	;;
	hppa64)
	shrext_cmds='.sl'
	hardcode_into_libs=yes
	dynamic_linker="$host_os dld.sl"
	shlibpath_var=LD_LIBRARY_PATH # How should we handle SHLIB_PATH
	shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	sys_lib_search_path_spec="/usr/lib/pa20_64 /usr/ccs/lib/pa20_64"
	sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec
	;;
	*)
	shrext_cmds='.sl'
	dynamic_linker="$host_os dld.sl"
	shlibpath_var=SHLIB_PATH
	shlibpath_overrides_runpath=no # +s is required to enable SHLIB_PATH
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	;;
	esac
	# HP-UX runs really slowly unless shared libraries are mode 555, ...
	postinstall_cmds='chmod 555 $lib'
	# or fails outright, so override atomically:
	install_override_mode=555
	;;

	interix[3-9]*)
	version_type=linux # correct to gnu/linux during the next big refactor
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	dynamic_linker='Interix 3.x ld.so.1 (PE, like ELF)'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=no
	hardcode_into_libs=yes
	;;

	irix5* \| irix6* \| nonstopux*)
	case $host_os in
	nonstopux*) version_type=nonstopux ;;
	*)
	if test yes = "$lt_cv_prog_gnu_ld"; then
	version_type=linux # correct to gnu/linux during the next big refactor
	else
	version_type=irix
	fi ;;
	esac
	need_lib_prefix=no
	need_version=no
	soname_spec='$libname$release$shared_ext$major'
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$release$shared_ext $libname$shared_ext'
	case $host_os in
	irix5* \| nonstopux*)
	libsuff= shlibsuff=
	;;
	*)
	case $LD in # libtool.m4 will add one of these switches to LD
	-32\|"-32 "\|-melf32bsmip\|"-melf32bsmip ")
	libsuff= shlibsuff= libmagic=32-bit;;
	-n32\|"-n32 "\|-melf32bmipn32\|"-melf32bmipn32 ")
	libsuff=32 shlibsuff=N32 libmagic=N32;;
	-64\|"-64 "\|-melf64bmip\|"-melf64bmip ")
	libsuff=64 shlibsuff=64 libmagic=64-bit;;
	*) libsuff= shlibsuff= libmagic=never-match;;
	esac
	;;
	esac
	shlibpath_var=LD_LIBRARY${shlibsuff}_PATH
	shlibpath_overrides_runpath=no
	sys_lib_search_path_spec="/usr/lib$libsuff /lib$libsuff /usr/local/lib$libsuff"
	sys_lib_dlsearch_path_spec="/usr/lib$libsuff /lib$libsuff"
	hardcode_into_libs=yes
	;;

	# No shared lib support for Linux oldld, aout, or coff.
	linuxoldld \| linuxaout \| linuxcoff)
	dynamic_linker=no
	;;

	linuxandroid)
	version_type=none # Android doesn't support versioned libraries.
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$shared_ext'
	soname_spec='$libname$release$shared_ext'
	finish_cmds=
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=yes

	# This implies no fast_install, which is unacceptable.
	# Some rework will be needed to allow for fast_install
	# before this can be enabled.
	hardcode_into_libs=yes

	dynamic_linker='Android linker'
	# Don't embed -rpath directories since the linker doesn't support them.
	hardcode_libdir_flag_spec='-L$libdir'
	;;

	# This must be glibc/ELF.
	linux* \| kbsd-gnu \| kopensolaris-gnu \| gnu)
	version_type=linux # correct to gnu/linux during the next big refactor
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	finish_cmds='PATH="\$PATH:/sbin" ldconfig -n $libdir'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=no

	# Some binutils ld are patched to set DT_RUNPATH
	if ${lt_cv_shlibpath_overrides_runpath+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	lt_cv_shlibpath_overrides_runpath=no
	save_LDFLAGS=$LDFLAGS
	save_libdir=$libdir
	eval "libdir=/foo; wl=\"$lt_prog_compiler_wl\"; \
	LDFLAGS=\"\$LDFLAGS $hardcode_libdir_flag_spec\""
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	if ($OBJDUMP -p conftest$ac_exeext) 2>/dev/null \| grep "RUNPATH.*$libdir" >/dev/null; then :
	lt_cv_shlibpath_overrides_runpath=yes
	fi
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	LDFLAGS=$save_LDFLAGS
	libdir=$save_libdir

	fi

	shlibpath_overrides_runpath=$lt_cv_shlibpath_overrides_runpath

	# This implies no fast_install, which is unacceptable.
	# Some rework will be needed to allow for fast_install
	# before this can be enabled.
	hardcode_into_libs=yes

	# Add ABI-specific directories to the system library path.
	sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /lib /usr/lib"

	# Ideally, we could use ldconfig to report all directores which are
	# searched for libraries, however this is still not possible. Aside from not
	# being certain /sbin/ldconfig is available, command
	# 'ldconfig -N -X -v \| grep ^/' on 64bit Fedora does not report /usr/lib64,
	# even though it is searched at run-time. Try to do the best guess by
	# appending ld.so.conf contents (and includes) to the search path.
	if test -f /etc/ld.so.conf; then
	lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \$2)); skip = 1; } { if (!skip) print \$0; skip = 0; }' < /etc/ld.so.conf \| $SED -e 's/#.//;/^[ ]hwcap[ ]/d;s/[:, ]/ /g;s/=[^=]$//;s/=[^= ] / /g;s/"//g;/^$/d' \| tr '\n' ' '`
	sys_lib_dlsearch_path_spec="$sys_lib_dlsearch_path_spec $lt_ld_extra"
	fi

	# We used to test for /lib/ld.so.1 and disable shared libraries on
	# powerpc, because MkLinux only supported shared libraries with the
	# GNU dynamic linker. Since this was broken with cross compilers,
	# most powerpc-linux boxes support dynamic linking these days and
	# people can always --disable-shared, the test was removed, and we
	# assume the GNU/Linux dynamic linker is in use.
	dynamic_linker='GNU/Linux ld.so'
	;;

	netbsd*)
	version_type=sunos
	need_lib_prefix=no
	need_version=no
	if echo __ELF__ \| $CC -E - \| $GREP __ELF__ >/dev/null; then
	library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix'
	finish_cmds='PATH="\$PATH:/sbin" ldconfig -m $libdir'
	dynamic_linker='NetBSD (a.out) ld.so'
	else
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	dynamic_linker='NetBSD ld.elf_so'
	fi
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=yes
	hardcode_into_libs=yes
	;;

	newsos6)
	version_type=linux # correct to gnu/linux during the next big refactor
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=yes
	;;

	nto \| qnx)
	version_type=qnx
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=no
	hardcode_into_libs=yes
	dynamic_linker='ldqnx.so'
	;;

	openbsd* \| bitrig*)
	version_type=sunos
	sys_lib_dlsearch_path_spec=/usr/lib
	need_lib_prefix=no
	if test -z "`echo __ELF__ \| $CC -E - \| $GREP __ELF__`"; then
	need_version=no
	else
	need_version=yes
	fi
	library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix'
	finish_cmds='PATH="\$PATH:/sbin" ldconfig -m $libdir'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=yes
	;;

	os2*)
	libname_spec='$name'
	version_type=windows
	shrext_cmds=.dll
	need_version=no
	need_lib_prefix=no
	# OS/2 can only load a DLL with a base name of 8 characters or less.
	soname_spec='`test -n "$os2dllname" && libname="$os2dllname";
	v=$($ECHO $release$versuffix \| tr -d .-);
	n=$($ECHO $libname \| cut -b -$((8 - ${#v})) \| tr . _);
	$ECHO $n$v`$shared_ext'
	library_names_spec='${libname}_dll.$libext'
	dynamic_linker='OS/2 ld.exe'
	shlibpath_var=BEGINLIBPATH
	sys_lib_search_path_spec="/lib /usr/lib /usr/local/lib"
	sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec
	postinstall_cmds='base_file=`basename \$file`~
	dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; $ECHO \$dlname'\''`~
	dldir=$destdir/`dirname \$dlpath`~
	test -d \$dldir \|\| mkdir -p \$dldir~
	$install_prog $dir/$dlname \$dldir/$dlname~
	chmod a+x \$dldir/$dlname~
	if test -n '\''$stripme'\'' && test -n '\''$striplib'\''; then
	eval '\''$striplib \$dldir/$dlname'\'' \|\| exit \$?;
	fi'
	postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; $ECHO \$dlname'\''`~
	dlpath=$dir/\$dldll~
	$RM \$dlpath'
	;;

	osf3* \| osf4* \| osf5*)
	version_type=osf
	need_lib_prefix=no
	need_version=no
	soname_spec='$libname$release$shared_ext$major'
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	shlibpath_var=LD_LIBRARY_PATH
	sys_lib_search_path_spec="/usr/shlib /usr/ccs/lib /usr/lib/cmplrs/cc /usr/lib /usr/local/lib /var/shlib"
	sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec
	;;

	rdos*)
	dynamic_linker=no
	;;

	solaris*)
	version_type=linux # correct to gnu/linux during the next big refactor
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=yes
	hardcode_into_libs=yes
	# ldd complains unless libraries are executable
	postinstall_cmds='chmod +x $lib'
	;;

	sunos4*)
	version_type=sunos
	library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix'
	finish_cmds='PATH="\$PATH:/usr/etc" ldconfig $libdir'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=yes
	if test yes = "$with_gnu_ld"; then
	need_lib_prefix=no
	fi
	need_version=yes
	;;

	sysv4 \| sysv4.3*)
	version_type=linux # correct to gnu/linux during the next big refactor
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	shlibpath_var=LD_LIBRARY_PATH
	case $host_vendor in
	sni)
	shlibpath_overrides_runpath=no
	need_lib_prefix=no
	runpath_var=LD_RUN_PATH
	;;
	siemens)
	need_lib_prefix=no
	;;
	motorola)
	need_lib_prefix=no
	need_version=no
	shlibpath_overrides_runpath=no
	sys_lib_search_path_spec='/lib /usr/lib /usr/ccs/lib'
	;;
	esac
	;;

	sysv4MP)
	if test -d /usr/nec; then
	version_type=linux # correct to gnu/linux during the next big refactor
	library_names_spec='$libname$shared_ext.$versuffix $libname$shared_ext.$major $libname$shared_ext'
	soname_spec='$libname$shared_ext.$major'
	shlibpath_var=LD_LIBRARY_PATH
	fi
	;;

	sysv5* \| sco3.2v5* \| sco5v6* \| unixware* \| OpenUNIX* \| sysv4uw2)
	version_type=sco
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=yes
	hardcode_into_libs=yes
	if test yes = "$with_gnu_ld"; then
	sys_lib_search_path_spec='/usr/local/lib /usr/gnu/lib /usr/ccs/lib /usr/lib /lib'
	else
	sys_lib_search_path_spec='/usr/ccs/lib /usr/lib'
	case $host_os in
	sco3.2v5*)
	sys_lib_search_path_spec="$sys_lib_search_path_spec /lib"
	;;
	esac
	fi
	sys_lib_dlsearch_path_spec='/usr/lib'
	;;

	tpf*)
	# TPF is a cross-target only. Preferred cross-host = GNU/Linux.
	version_type=linux # correct to gnu/linux during the next big refactor
	need_lib_prefix=no
	need_version=no
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	shlibpath_var=LD_LIBRARY_PATH
	shlibpath_overrides_runpath=no
	hardcode_into_libs=yes
	;;

	uts4*)
	version_type=linux # correct to gnu/linux during the next big refactor
	library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
	soname_spec='$libname$release$shared_ext$major'
	shlibpath_var=LD_LIBRARY_PATH
	;;

	*)
	dynamic_linker=no
	;;
	esac
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $dynamic_linker" >&5
	$as_echo "$dynamic_linker" >&6; }
	test no = "$dynamic_linker" && can_build_shared=no

	variables_saved_for_relink="PATH $shlibpath_var $runpath_var"
	if test yes = "$GCC"; then
	variables_saved_for_relink="$variables_saved_for_relink GCC_EXEC_PREFIX COMPILER_PATH LIBRARY_PATH"
	fi

	if test set = "${lt_cv_sys_lib_search_path_spec+set}"; then
	sys_lib_search_path_spec=$lt_cv_sys_lib_search_path_spec
	fi

	if test set = "${lt_cv_sys_lib_dlsearch_path_spec+set}"; then
	sys_lib_dlsearch_path_spec=$lt_cv_sys_lib_dlsearch_path_spec
	fi

	# remember unaugmented sys_lib_dlsearch_path content for libtool script decls...
	configure_time_dlsearch_path=$sys_lib_dlsearch_path_spec

	# ... but it needs LT_SYS_LIBRARY_PATH munging for other configure-time code
	func_munge_path_list sys_lib_dlsearch_path_spec "$LT_SYS_LIBRARY_PATH"

	# to be used as default LT_SYS_LIBRARY_PATH value in generated libtool
	configure_time_lt_sys_library_path=$LT_SYS_LIBRARY_PATH

































































































	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to hardcode library paths into programs" >&5
	$as_echo_n "checking how to hardcode library paths into programs... " >&6; }
	hardcode_action=
	if test -n "$hardcode_libdir_flag_spec" \|\|
	test -n "$runpath_var" \|\|
	test yes = "$hardcode_automatic"; then

	# We can hardcode non-existent directories.
	if test no != "$hardcode_direct" &&
	# If the only mechanism to avoid hardcoding is shlibpath_var, we
	# have to relink, otherwise we might link with an installed library
	# when we should be linking with a yet-to-be-installed one
	## test no != "$_LT_TAGVAR(hardcode_shlibpath_var, )" &&
	test no != "$hardcode_minus_L"; then
	# Linking always hardcodes the temporary library directory.
	hardcode_action=relink
	else
	# We can link without hardcoding, and we can hardcode nonexisting dirs.
	hardcode_action=immediate
	fi
	else
	# We cannot hardcode anything, or else we can only hardcode existing
	# directories.
	hardcode_action=unsupported
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $hardcode_action" >&5
	$as_echo "$hardcode_action" >&6; }

	if test relink = "$hardcode_action" \|\|
	test yes = "$inherit_rpath"; then
	# Fast installation is not supported
	enable_fast_install=no
	elif test yes = "$shlibpath_overrides_runpath" \|\|
	test no = "$enable_shared"; then
	# Fast installation is not necessary
	enable_fast_install=needless
	fi






	if test yes != "$enable_dlopen"; then
	enable_dlopen=unknown
	enable_dlopen_self=unknown
	enable_dlopen_self_static=unknown
	else
	lt_cv_dlopen=no
	lt_cv_dlopen_libs=

	case $host_os in
	beos*)
	lt_cv_dlopen=load_add_on
	lt_cv_dlopen_libs=
	lt_cv_dlopen_self=yes
	;;

	mingw* \| pw32* \| cegcc*)
	lt_cv_dlopen=LoadLibrary
	lt_cv_dlopen_libs=
	;;

	cygwin*)
	lt_cv_dlopen=dlopen
	lt_cv_dlopen_libs=
	;;

	darwin*)
	# if libdl is installed we need to link against it
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5
	$as_echo_n "checking for dlopen in -ldl... " >&6; }
	if ${ac_cv_lib_dl_dlopen+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_check_lib_save_LIBS=$LIBS
	LIBS="-ldl $LIBS"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char dlopen ();
	int
	main ()
	{
	return dlopen ();
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_lib_dl_dlopen=yes
	else
	ac_cv_lib_dl_dlopen=no
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	LIBS=$ac_check_lib_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5
	$as_echo "$ac_cv_lib_dl_dlopen" >&6; }
	if test "x$ac_cv_lib_dl_dlopen" = xyes; then :
	lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-ldl
	else

	lt_cv_dlopen=dyld
	lt_cv_dlopen_libs=
	lt_cv_dlopen_self=yes

	fi

	;;

	tpf*)
	# Don't try to run any link tests for TPF. We know it's impossible
	# because TPF is a cross-compiler, and we know how we open DSOs.
	lt_cv_dlopen=dlopen
	lt_cv_dlopen_libs=
	lt_cv_dlopen_self=no
	;;

	*)
	ac_fn_c_check_func "$LINENO" "shl_load" "ac_cv_func_shl_load"
	if test "x$ac_cv_func_shl_load" = xyes; then :
	lt_cv_dlopen=shl_load
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for shl_load in -ldld" >&5
	$as_echo_n "checking for shl_load in -ldld... " >&6; }
	if ${ac_cv_lib_dld_shl_load+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_check_lib_save_LIBS=$LIBS
	LIBS="-ldld $LIBS"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char shl_load ();
	int
	main ()
	{
	return shl_load ();
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_lib_dld_shl_load=yes
	else
	ac_cv_lib_dld_shl_load=no
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	LIBS=$ac_check_lib_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dld_shl_load" >&5
	$as_echo "$ac_cv_lib_dld_shl_load" >&6; }
	if test "x$ac_cv_lib_dld_shl_load" = xyes; then :
	lt_cv_dlopen=shl_load lt_cv_dlopen_libs=-ldld
	else
	ac_fn_c_check_func "$LINENO" "dlopen" "ac_cv_func_dlopen"
	if test "x$ac_cv_func_dlopen" = xyes; then :
	lt_cv_dlopen=dlopen
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5
	$as_echo_n "checking for dlopen in -ldl... " >&6; }
	if ${ac_cv_lib_dl_dlopen+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_check_lib_save_LIBS=$LIBS
	LIBS="-ldl $LIBS"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char dlopen ();
	int
	main ()
	{
	return dlopen ();
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_lib_dl_dlopen=yes
	else
	ac_cv_lib_dl_dlopen=no
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	LIBS=$ac_check_lib_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5
	$as_echo "$ac_cv_lib_dl_dlopen" >&6; }
	if test "x$ac_cv_lib_dl_dlopen" = xyes; then :
	lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-ldl
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -lsvld" >&5
	$as_echo_n "checking for dlopen in -lsvld... " >&6; }
	if ${ac_cv_lib_svld_dlopen+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_check_lib_save_LIBS=$LIBS
	LIBS="-lsvld $LIBS"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char dlopen ();
	int
	main ()
	{
	return dlopen ();
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_lib_svld_dlopen=yes
	else
	ac_cv_lib_svld_dlopen=no
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	LIBS=$ac_check_lib_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_svld_dlopen" >&5
	$as_echo "$ac_cv_lib_svld_dlopen" >&6; }
	if test "x$ac_cv_lib_svld_dlopen" = xyes; then :
	lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-lsvld
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for dld_link in -ldld" >&5
	$as_echo_n "checking for dld_link in -ldld... " >&6; }
	if ${ac_cv_lib_dld_dld_link+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_check_lib_save_LIBS=$LIBS
	LIBS="-ldld $LIBS"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char dld_link ();
	int
	main ()
	{
	return dld_link ();
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_lib_dld_dld_link=yes
	else
	ac_cv_lib_dld_dld_link=no
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	LIBS=$ac_check_lib_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dld_dld_link" >&5
	$as_echo "$ac_cv_lib_dld_dld_link" >&6; }
	if test "x$ac_cv_lib_dld_dld_link" = xyes; then :
	lt_cv_dlopen=dld_link lt_cv_dlopen_libs=-ldld
	fi


	fi


	fi


	fi


	fi


	fi

	;;
	esac

	if test no = "$lt_cv_dlopen"; then
	enable_dlopen=no
	else
	enable_dlopen=yes
	fi

	case $lt_cv_dlopen in
	dlopen)
	save_CPPFLAGS=$CPPFLAGS
	test yes = "$ac_cv_header_dlfcn_h" && CPPFLAGS="$CPPFLAGS -DHAVE_DLFCN_H"

	save_LDFLAGS=$LDFLAGS
	wl=$lt_prog_compiler_wl eval LDFLAGS=\"\$LDFLAGS $export_dynamic_flag_spec\"

	save_LIBS=$LIBS
	LIBS="$lt_cv_dlopen_libs $LIBS"

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether a program can dlopen itself" >&5
	$as_echo_n "checking whether a program can dlopen itself... " >&6; }
	if ${lt_cv_dlopen_self+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test yes = "$cross_compiling"; then :
	lt_cv_dlopen_self=cross
	else
	lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
	lt_status=$lt_dlunknown
	cat > conftest.$ac_ext <<_LT_EOF
	#line $LINENO "configure"
	#include "confdefs.h"

	#if HAVE_DLFCN_H
	#include <dlfcn.h>
	#endif

	#include <stdio.h>

	#ifdef RTLD_GLOBAL
	# define LT_DLGLOBAL RTLD_GLOBAL
	#else
	# ifdef DL_GLOBAL
	# define LT_DLGLOBAL DL_GLOBAL
	# else
	# define LT_DLGLOBAL 0
	# endif
	#endif

	/* We may have to define LT_DLLAZY_OR_NOW in the command line if we
	find out it does not work in some platform. */
	#ifndef LT_DLLAZY_OR_NOW
	# ifdef RTLD_LAZY
	# define LT_DLLAZY_OR_NOW RTLD_LAZY
	# else
	# ifdef DL_LAZY
	# define LT_DLLAZY_OR_NOW DL_LAZY
	# else
	# ifdef RTLD_NOW
	# define LT_DLLAZY_OR_NOW RTLD_NOW
	# else
	# ifdef DL_NOW
	# define LT_DLLAZY_OR_NOW DL_NOW
	# else
	# define LT_DLLAZY_OR_NOW 0
	# endif
	# endif
	# endif
	# endif
	#endif

	/* When -fvisibility=hidden is used, assume the code has been annotated
	correspondingly for the symbols needed. */
	#if defined __GNUC__ && (((__GNUC__ == 3) && (__GNUC_MINOR__ >= 3)) \|\| (__GNUC__ > 3))
	int fnord () __attribute__((visibility("default")));
	#endif

	int fnord () { return 42; }
	int main ()
	{
	void *self = dlopen (0, LT_DLGLOBAL\|LT_DLLAZY_OR_NOW);
	int status = $lt_dlunknown;

	if (self)
	{
	if (dlsym (self,"fnord")) status = $lt_dlno_uscore;
	else
	{
	if (dlsym( self,"_fnord")) status = $lt_dlneed_uscore;
	else puts (dlerror ());
	}
	/* dlclose (self); */
	}
	else
	puts (dlerror ());

	return status;
	}
	_LT_EOF
	if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_link\""; } >&5
	(eval $ac_link) 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; } && test -s "conftest$ac_exeext" 2>/dev/null; then
	(./conftest; exit; ) >&5 2>/dev/null
	lt_status=$?
	case x$lt_status in
	x$lt_dlno_uscore) lt_cv_dlopen_self=yes ;;
	x$lt_dlneed_uscore) lt_cv_dlopen_self=yes ;;
	x$lt_dlunknown\|x*) lt_cv_dlopen_self=no ;;
	esac
	else :
	# compilation failed
	lt_cv_dlopen_self=no
	fi
	fi
	rm -fr conftest*


	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_dlopen_self" >&5
	$as_echo "$lt_cv_dlopen_self" >&6; }

	if test yes = "$lt_cv_dlopen_self"; then
	wl=$lt_prog_compiler_wl eval LDFLAGS=\"\$LDFLAGS $lt_prog_compiler_static\"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether a statically linked program can dlopen itself" >&5
	$as_echo_n "checking whether a statically linked program can dlopen itself... " >&6; }
	if ${lt_cv_dlopen_self_static+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test yes = "$cross_compiling"; then :
	lt_cv_dlopen_self_static=cross
	else
	lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
	lt_status=$lt_dlunknown
	cat > conftest.$ac_ext <<_LT_EOF
	#line $LINENO "configure"
	#include "confdefs.h"

	#if HAVE_DLFCN_H
	#include <dlfcn.h>
	#endif

	#include <stdio.h>

	#ifdef RTLD_GLOBAL
	# define LT_DLGLOBAL RTLD_GLOBAL
	#else
	# ifdef DL_GLOBAL
	# define LT_DLGLOBAL DL_GLOBAL
	# else
	# define LT_DLGLOBAL 0
	# endif
	#endif

	/* We may have to define LT_DLLAZY_OR_NOW in the command line if we
	find out it does not work in some platform. */
	#ifndef LT_DLLAZY_OR_NOW
	# ifdef RTLD_LAZY
	# define LT_DLLAZY_OR_NOW RTLD_LAZY
	# else
	# ifdef DL_LAZY
	# define LT_DLLAZY_OR_NOW DL_LAZY
	# else
	# ifdef RTLD_NOW
	# define LT_DLLAZY_OR_NOW RTLD_NOW
	# else
	# ifdef DL_NOW
	# define LT_DLLAZY_OR_NOW DL_NOW
	# else
	# define LT_DLLAZY_OR_NOW 0
	# endif
	# endif
	# endif
	# endif
	#endif

	/* When -fvisibility=hidden is used, assume the code has been annotated
	correspondingly for the symbols needed. */
	#if defined __GNUC__ && (((__GNUC__ == 3) && (__GNUC_MINOR__ >= 3)) \|\| (__GNUC__ > 3))
	int fnord () __attribute__((visibility("default")));
	#endif

	int fnord () { return 42; }
	int main ()
	{
	void *self = dlopen (0, LT_DLGLOBAL\|LT_DLLAZY_OR_NOW);
	int status = $lt_dlunknown;

	if (self)
	{
	if (dlsym (self,"fnord")) status = $lt_dlno_uscore;
	else
	{
	if (dlsym( self,"_fnord")) status = $lt_dlneed_uscore;
	else puts (dlerror ());
	}
	/* dlclose (self); */
	}
	else
	puts (dlerror ());

	return status;
	}
	_LT_EOF
	if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_link\""; } >&5
	(eval $ac_link) 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; } && test -s "conftest$ac_exeext" 2>/dev/null; then
	(./conftest; exit; ) >&5 2>/dev/null
	lt_status=$?
	case x$lt_status in
	x$lt_dlno_uscore) lt_cv_dlopen_self_static=yes ;;
	x$lt_dlneed_uscore) lt_cv_dlopen_self_static=yes ;;
	x$lt_dlunknown\|x*) lt_cv_dlopen_self_static=no ;;
	esac
	else :
	# compilation failed
	lt_cv_dlopen_self_static=no
	fi
	fi
	rm -fr conftest*


	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_dlopen_self_static" >&5
	$as_echo "$lt_cv_dlopen_self_static" >&6; }
	fi

	CPPFLAGS=$save_CPPFLAGS
	LDFLAGS=$save_LDFLAGS
	LIBS=$save_LIBS
	;;
	esac

	case $lt_cv_dlopen_self in
	yes\|no) enable_dlopen_self=$lt_cv_dlopen_self ;;
	*) enable_dlopen_self=unknown ;;
	esac

	case $lt_cv_dlopen_self_static in
	yes\|no) enable_dlopen_self_static=$lt_cv_dlopen_self_static ;;
	*) enable_dlopen_self_static=unknown ;;
	esac
	fi

















	striplib=
	old_striplib=
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether stripping libraries is possible" >&5
	$as_echo_n "checking whether stripping libraries is possible... " >&6; }
	if test -n "$STRIP" && $STRIP -V 2>&1 \| $GREP "GNU strip" >/dev/null; then
	test -z "$old_striplib" && old_striplib="$STRIP --strip-debug"
	test -z "$striplib" && striplib="$STRIP --strip-unneeded"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	else
	# FIXME - insert some real tests, host_os isn't really good enough
	case $host_os in
	darwin*)
	if test -n "$STRIP"; then
	striplib="$STRIP -x"
	old_striplib="$STRIP -S"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi
	;;
	*)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	;;
	esac
	fi












	# Report what library types will actually be built
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if libtool supports shared libraries" >&5
	$as_echo_n "checking if libtool supports shared libraries... " >&6; }
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $can_build_shared" >&5
	$as_echo "$can_build_shared" >&6; }

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to build shared libraries" >&5
	$as_echo_n "checking whether to build shared libraries... " >&6; }
	test no = "$can_build_shared" && enable_shared=no

	# On AIX, shared libraries and static libraries use the same namespace, and
	# are all built from PIC.
	case $host_os in
	aix3*)
	test yes = "$enable_shared" && enable_static=no
	if test -n "$RANLIB"; then
	archive_cmds="$archive_cmds~\$RANLIB \$lib"
	postinstall_cmds='$RANLIB $lib'
	fi
	;;

	aix[4-9]*)
	if test ia64 != "$host_cpu"; then
	case $enable_shared,$with_aix_soname,$aix_use_runtimelinking in
	yes,aix,yes) ;; # shared object as lib.so file only
	yes,svr4,*) ;; # shared object as lib.so archive member only
	yes,*) enable_static=no ;; # shared object in lib.a archive as well
	esac
	fi
	;;
	esac
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $enable_shared" >&5
	$as_echo "$enable_shared" >&6; }

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to build static libraries" >&5
	$as_echo_n "checking whether to build static libraries... " >&6; }
	# Make sure either enable_shared or enable_static is yes.
	test yes = "$enable_shared" \|\| enable_static=yes
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $enable_static" >&5
	$as_echo "$enable_static" >&6; }




	fi
	ac_ext=c
	ac_cpp='$CPP $CPPFLAGS'
	ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
	ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
	ac_compiler_gnu=$ac_cv_c_compiler_gnu

	CC=$lt_save_CC















	ac_config_commands="$ac_config_commands libtool"




	# Only expand once:




	+
	+
	+
	+
	+
	+
	+
	+if test "x$ac_cv_env_PKG_CONFIG_set" != "xset"; then
	+ if test -n "$ac_tool_prefix"; then
	+ # Extract the first word of "${ac_tool_prefix}pkg-config", so it can be a program name with args.
	+set dummy ${ac_tool_prefix}pkg-config; ac_word=$2
	+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	+$as_echo_n "checking for $ac_word... " >&6; }
	+if ${ac_cv_path_PKG_CONFIG+:} false; then :
	+ $as_echo_n "(cached) " >&6
	+else
	+ case $PKG_CONFIG in
	+ [\\/]* \| ?:[\\/]*)
	+ ac_cv_path_PKG_CONFIG="$PKG_CONFIG" # Let the user override the test with a path.
	+ ;;
	+ *)
	+ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	+for as_dir in $PATH
	+do
	+ IFS=$as_save_IFS
	+ test -z "$as_dir" && as_dir=.
	+ for ac_exec_ext in '' $ac_executable_extensions; do
	+ if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	+ ac_cv_path_PKG_CONFIG="$as_dir/$ac_word$ac_exec_ext"
	+ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	+ break 2
	+ fi
	+done
	+ done
	+IFS=$as_save_IFS
	+
	+ ;;
	+esac
	+fi
	+PKG_CONFIG=$ac_cv_path_PKG_CONFIG
	+if test -n "$PKG_CONFIG"; then
	+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PKG_CONFIG" >&5
	+$as_echo "$PKG_CONFIG" >&6; }
	+else
	+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	+$as_echo "no" >&6; }
	+fi
	+
	+
	+fi
	+if test -z "$ac_cv_path_PKG_CONFIG"; then
	+ ac_pt_PKG_CONFIG=$PKG_CONFIG
	+ # Extract the first word of "pkg-config", so it can be a program name with args.
	+set dummy pkg-config; ac_word=$2
	+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	+$as_echo_n "checking for $ac_word... " >&6; }
	+if ${ac_cv_path_ac_pt_PKG_CONFIG+:} false; then :
	+ $as_echo_n "(cached) " >&6
	+else
	+ case $ac_pt_PKG_CONFIG in
	+ [\\/]* \| ?:[\\/]*)
	+ ac_cv_path_ac_pt_PKG_CONFIG="$ac_pt_PKG_CONFIG" # Let the user override the test with a path.
	+ ;;
	+ *)
	+ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	+for as_dir in $PATH
	+do
	+ IFS=$as_save_IFS
	+ test -z "$as_dir" && as_dir=.
	+ for ac_exec_ext in '' $ac_executable_extensions; do
	+ if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	+ ac_cv_path_ac_pt_PKG_CONFIG="$as_dir/$ac_word$ac_exec_ext"
	+ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	+ break 2
	+ fi
	+done
	+ done
	+IFS=$as_save_IFS
	+
	+ ;;
	+esac
	+fi
	+ac_pt_PKG_CONFIG=$ac_cv_path_ac_pt_PKG_CONFIG
	+if test -n "$ac_pt_PKG_CONFIG"; then
	+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_pt_PKG_CONFIG" >&5
	+$as_echo "$ac_pt_PKG_CONFIG" >&6; }
	+else
	+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	+$as_echo "no" >&6; }
	+fi
	+
	+ if test "x$ac_pt_PKG_CONFIG" = x; then
	+ PKG_CONFIG=""
	+ else
	+ case $cross_compiling:$ac_tool_warned in
	+yes:)
	+{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	+$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	+ac_tool_warned=yes ;;
	+esac
	+ PKG_CONFIG=$ac_pt_PKG_CONFIG
	+ fi
	+else
	+ PKG_CONFIG="$ac_cv_path_PKG_CONFIG"
	+fi
	+
	+fi
	+if test -n "$PKG_CONFIG"; then
	+ _pkg_min_version=0.9.0
	+ { $as_echo "$as_me:${as_lineno-$LINENO}: checking pkg-config is at least version $_pkg_min_version" >&5
	+$as_echo_n "checking pkg-config is at least version $_pkg_min_version... " >&6; }
	+ if $PKG_CONFIG --atleast-pkgconfig-version $_pkg_min_version; then
	+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	+$as_echo "yes" >&6; }
	+ else
	+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	+$as_echo "no" >&6; }
	+ PKG_CONFIG=""
	+ fi
	+fi
	+
	# Checks for header files.
	for ac_header in stdarg.h stdbool.h netinet/in.h netinet/tcp.h sys/param.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h sys/endian.h libkern/OSByteOrder.h sys/ipc.h sys/shm.h
	do :
	as_ac_Header=`$as_echo "ac_cv_header_$ac_header" \| $as_tr_sh`
	ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
	"
	if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
	cat >>confdefs.h <<_ACEOF
	#define `$as_echo "HAVE_$ac_header" \| $as_tr_cpp` 1
	_ACEOF

	fi

	done


	# check for types.
	# Using own tests for int64* because autoconf builtin only give 32bit.
	ac_fn_c_check_type "$LINENO" "int8_t" "ac_cv_type_int8_t" "$ac_includes_default"
	if test "x$ac_cv_type_int8_t" = xyes; then :

	else

	cat >>confdefs.h <<_ACEOF
	#define int8_t signed char
	_ACEOF

	fi

	ac_fn_c_check_type "$LINENO" "int16_t" "ac_cv_type_int16_t" "$ac_includes_default"
	if test "x$ac_cv_type_int16_t" = xyes; then :

	else

	cat >>confdefs.h <<_ACEOF
	#define int16_t short
	_ACEOF

	fi

	ac_fn_c_check_type "$LINENO" "int32_t" "ac_cv_type_int32_t" "$ac_includes_default"
	if test "x$ac_cv_type_int32_t" = xyes; then :

	else

	cat >>confdefs.h <<_ACEOF
	#define int32_t int
	_ACEOF

	fi

	ac_fn_c_check_type "$LINENO" "int64_t" "ac_cv_type_int64_t" "$ac_includes_default"
	if test "x$ac_cv_type_int64_t" = xyes; then :

	else

	cat >>confdefs.h <<_ACEOF
	#define int64_t long long
	_ACEOF

	fi

	ac_fn_c_check_type "$LINENO" "uint8_t" "ac_cv_type_uint8_t" "$ac_includes_default"
	if test "x$ac_cv_type_uint8_t" = xyes; then :

	else

	cat >>confdefs.h <<_ACEOF
	#define uint8_t unsigned char
	_ACEOF

	fi

	ac_fn_c_check_type "$LINENO" "uint16_t" "ac_cv_type_uint16_t" "$ac_includes_default"
	if test "x$ac_cv_type_uint16_t" = xyes; then :

	else

	cat >>confdefs.h <<_ACEOF
	#define uint16_t unsigned short
	_ACEOF

	fi

	ac_fn_c_check_type "$LINENO" "uint32_t" "ac_cv_type_uint32_t" "$ac_includes_default"
	if test "x$ac_cv_type_uint32_t" = xyes; then :

	else

	cat >>confdefs.h <<_ACEOF
	#define uint32_t unsigned int
	_ACEOF

	fi

	ac_fn_c_check_type "$LINENO" "uint64_t" "ac_cv_type_uint64_t" "$ac_includes_default"
	if test "x$ac_cv_type_uint64_t" = xyes; then :

	else

	cat >>confdefs.h <<_ACEOF
	#define uint64_t unsigned long long
	_ACEOF

	fi

	ac_fn_c_check_type "$LINENO" "size_t" "ac_cv_type_size_t" "$ac_includes_default"
	if test "x$ac_cv_type_size_t" = xyes; then :

	else

	cat >>confdefs.h <<_ACEOF
	#define size_t unsigned int
	_ACEOF

	fi

	ac_fn_c_check_type "$LINENO" "ssize_t" "ac_cv_type_ssize_t" "$ac_includes_default"
	if test "x$ac_cv_type_ssize_t" = xyes; then :

	else

	cat >>confdefs.h <<_ACEOF
	#define ssize_t int
	_ACEOF

	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for uid_t in sys/types.h" >&5
	$as_echo_n "checking for uid_t in sys/types.h... " >&6; }
	if ${ac_cv_type_uid_t+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <sys/types.h>

	_ACEOF
	if (eval "$ac_cpp conftest.$ac_ext") 2>&5 \|
	$EGREP "uid_t" >/dev/null 2>&1; then :
	ac_cv_type_uid_t=yes
	else
	ac_cv_type_uid_t=no
	fi
	rm -f conftest*

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_uid_t" >&5
	$as_echo "$ac_cv_type_uid_t" >&6; }
	if test $ac_cv_type_uid_t = no; then

	$as_echo "#define uid_t int" >>confdefs.h


	$as_echo "#define gid_t int" >>confdefs.h

	fi

	ac_fn_c_check_type "$LINENO" "pid_t" "ac_cv_type_pid_t" "$ac_includes_default"
	if test "x$ac_cv_type_pid_t" = xyes; then :

	else

	cat >>confdefs.h <<_ACEOF
	#define pid_t int
	_ACEOF

	fi

	ac_fn_c_check_type "$LINENO" "off_t" "ac_cv_type_off_t" "$ac_includes_default"
	if test "x$ac_cv_type_off_t" = xyes; then :

	else

	cat >>confdefs.h <<_ACEOF
	#define off_t long int
	_ACEOF

	fi

	ac_fn_c_check_type "$LINENO" "u_char" "ac_cv_type_u_char" "
	$ac_includes_default
	#ifdef HAVE_WINSOCK2_H
	# include <winsock2.h>
	#endif

	"
	if test "x$ac_cv_type_u_char" = xyes; then :

	else

	$as_echo "#define u_char unsigned char" >>confdefs.h

	fi

	ac_fn_c_check_type "$LINENO" "rlim_t" "ac_cv_type_rlim_t" "
	$ac_includes_default
	#ifdef HAVE_SYS_RESOURCE_H
	# include <sys/resource.h>
	#endif

	"
	if test "x$ac_cv_type_rlim_t" = xyes; then :

	else

	$as_echo "#define rlim_t unsigned long" >>confdefs.h

	fi


	ac_fn_c_check_type "$LINENO" "socklen_t" "ac_cv_type_socklen_t" "
	$ac_includes_default
	#ifdef HAVE_SYS_SOCKET_H
	# include <sys/socket.h>
	#endif
	#ifdef HAVE_WS2TCPIP_H
	# include <ws2tcpip.h>
	#endif

	"
	if test "x$ac_cv_type_socklen_t" = xyes; then :

	else

	$as_echo "#define socklen_t int" >>confdefs.h

	fi

	ac_fn_c_check_type "$LINENO" "in_addr_t" "ac_cv_type_in_addr_t" "
	$ac_includes_default
	#ifdef HAVE_SYS_TYPES_H
	# include <sys/types.h>
	#endif
	#ifdef HAVE_NETINET_IN_H
	# include <netinet/in.h>
	#endif

	"
	if test "x$ac_cv_type_in_addr_t" = xyes; then :

	else

	$as_echo "#define in_addr_t uint32_t" >>confdefs.h

	fi

	ac_fn_c_check_type "$LINENO" "in_port_t" "ac_cv_type_in_port_t" "
	$ac_includes_default
	#ifdef HAVE_SYS_TYPES_H
	# include <sys/types.h>
	#endif
	#ifdef HAVE_NETINET_IN_H
	# include <netinet/in.h>
	#endif

	"
	if test "x$ac_cv_type_in_port_t" = xyes; then :

	else

	$as_echo "#define in_port_t uint16_t" >>confdefs.h

	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if memcmp compares unsigned" >&5
	$as_echo_n "checking if memcmp compares unsigned... " >&6; }
	if test "$cross_compiling" = yes; then :
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: cross-compile no" >&5
	$as_echo "cross-compile no" >&6; }

	$as_echo "#define MEMCMP_IS_BROKEN 1" >>confdefs.h

	case " $LIBOBJS " in
	" memcmp.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS memcmp.$ac_objext"
	;;
	esac


	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	int main(void)
	{
	char a = 255, b = 0;
	if(memcmp(&a, &b, 1) < 0)
	return 1;
	return 0;
	}

	_ACEOF
	if ac_fn_c_try_run "$LINENO"; then :
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }

	$as_echo "#define MEMCMP_IS_BROKEN 1" >>confdefs.h

	case " $LIBOBJS " in
	" memcmp.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS memcmp.$ac_objext"
	;;
	esac


	fi
	rm -f core .core core.conftest. gmon.out bb.out conftest$ac_exeext \
	conftest.$ac_objext conftest.beam conftest.$ac_ext
	fi


	# The cast to long int works around a bug in the HP C Compiler
	# version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
	# declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
	# This bug is HP SR number 8606223364.
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking size of time_t" >&5
	$as_echo_n "checking size of time_t... " >&6; }
	if ${ac_cv_sizeof_time_t+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if ac_fn_c_compute_int "$LINENO" "(long int) (sizeof (time_t))" "ac_cv_sizeof_time_t" "
	$ac_includes_default
	#ifdef TIME_WITH_SYS_TIME
	# include <sys/time.h>
	# include <time.h>
	#else
	# ifdef HAVE_SYS_TIME_H
	# include <sys/time.h>
	# else
	# include <time.h>
	# endif
	#endif

	"; then :

	else
	if test "$ac_cv_type_time_t" = yes; then
	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
	$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
	as_fn_error 77 "cannot compute sizeof (time_t)
	See \`config.log' for more details" "$LINENO" 5; }
	else
	ac_cv_sizeof_time_t=0
	fi
	fi

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sizeof_time_t" >&5
	$as_echo "$ac_cv_sizeof_time_t" >&6; }



	cat >>confdefs.h <<_ACEOF
	#define SIZEOF_TIME_T $ac_cv_sizeof_time_t
	_ACEOF



	# add option to disable the evil rpath

	# Check whether --enable-rpath was given.
	if test "${enable_rpath+set}" = set; then :
	enableval=$enable_rpath; enable_rpath=$enableval
	else
	enable_rpath=yes
	fi

	if test "x$enable_rpath" = xno; then
	ac_config_commands="$ac_config_commands disable-rpath"

	fi



	# check to see if libraries are needed for these functions.
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing inet_pton" >&5
	$as_echo_n "checking for library containing inet_pton... " >&6; }
	if ${ac_cv_search_inet_pton+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_func_search_save_LIBS=$LIBS
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char inet_pton ();
	int
	main ()
	{
	return inet_pton ();
	;
	return 0;
	}
	_ACEOF
	for ac_lib in '' nsl; do
	if test -z "$ac_lib"; then
	ac_res="none required"
	else
	ac_res=-l$ac_lib
	LIBS="-l$ac_lib $ac_func_search_save_LIBS"
	fi
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_search_inet_pton=$ac_res
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext
	if ${ac_cv_search_inet_pton+:} false; then :
	break
	fi
	done
	if ${ac_cv_search_inet_pton+:} false; then :

	else
	ac_cv_search_inet_pton=no
	fi
	rm conftest.$ac_ext
	LIBS=$ac_func_search_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_inet_pton" >&5
	$as_echo "$ac_cv_search_inet_pton" >&6; }
	ac_res=$ac_cv_search_inet_pton
	if test "$ac_res" != no; then :
	test "$ac_res" = "none required" \|\| LIBS="$ac_res $LIBS"

	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing socket" >&5
	$as_echo_n "checking for library containing socket... " >&6; }
	if ${ac_cv_search_socket+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_func_search_save_LIBS=$LIBS
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char socket ();
	int
	main ()
	{
	return socket ();
	;
	return 0;
	}
	_ACEOF
	for ac_lib in '' socket; do
	if test -z "$ac_lib"; then
	ac_res="none required"
	else
	ac_res=-l$ac_lib
	LIBS="-l$ac_lib $ac_func_search_save_LIBS"
	fi
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_search_socket=$ac_res
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext
	if ${ac_cv_search_socket+:} false; then :
	break
	fi
	done
	if ${ac_cv_search_socket+:} false; then :

	else
	ac_cv_search_socket=no
	fi
	rm conftest.$ac_ext
	LIBS=$ac_func_search_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_socket" >&5
	$as_echo "$ac_cv_search_socket" >&6; }
	ac_res=$ac_cv_search_socket
	if test "$ac_res" != no; then :
	test "$ac_res" = "none required" \|\| LIBS="$ac_res $LIBS"

	fi


	# check wether strptime also works

	# check some functions of the OS before linking libs (while still runnable).
	for ac_header in unistd.h
	do :
	ac_fn_c_check_header_mongrel "$LINENO" "unistd.h" "ac_cv_header_unistd_h" "$ac_includes_default"
	if test "x$ac_cv_header_unistd_h" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_UNISTD_H 1
	_ACEOF

	fi

	done

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for working chown" >&5
	$as_echo_n "checking for working chown... " >&6; }
	if ${ac_cv_func_chown_works+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test "$cross_compiling" = yes; then :
	ac_cv_func_chown_works=no
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$ac_includes_default
	#include <fcntl.h>

	int
	main ()
	{
	char *f = "conftest.chown";
	struct stat before, after;

	if (creat (f, 0600) < 0)
	return 1;
	if (stat (f, &before) < 0)
	return 1;
	if (chown (f, (uid_t) -1, (gid_t) -1) == -1)
	return 1;
	if (stat (f, &after) < 0)
	return 1;
	return ! (before.st_uid == after.st_uid && before.st_gid == after.st_gid);

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_run "$LINENO"; then :
	ac_cv_func_chown_works=yes
	else
	ac_cv_func_chown_works=no
	fi
	rm -f core .core core.conftest. gmon.out bb.out conftest$ac_exeext \
	conftest.$ac_objext conftest.beam conftest.$ac_ext
	fi

	rm -f conftest.chown

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_chown_works" >&5
	$as_echo "$ac_cv_func_chown_works" >&6; }
	if test $ac_cv_func_chown_works = yes; then

	$as_echo "#define HAVE_CHOWN 1" >>confdefs.h

	fi

	for ac_header in vfork.h
	do :
	ac_fn_c_check_header_mongrel "$LINENO" "vfork.h" "ac_cv_header_vfork_h" "$ac_includes_default"
	if test "x$ac_cv_header_vfork_h" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_VFORK_H 1
	_ACEOF

	fi

	done

	for ac_func in fork vfork
	do :
	as_ac_var=`$as_echo "ac_cv_func_$ac_func" \| $as_tr_sh`
	ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
	if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
	cat >>confdefs.h <<_ACEOF
	#define `$as_echo "HAVE_$ac_func" \| $as_tr_cpp` 1
	_ACEOF

	fi
	done

	if test "x$ac_cv_func_fork" = xyes; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for working fork" >&5
	$as_echo_n "checking for working fork... " >&6; }
	if ${ac_cv_func_fork_works+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test "$cross_compiling" = yes; then :
	ac_cv_func_fork_works=cross
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$ac_includes_default
	int
	main ()
	{

	/* By Ruediger Kuhlmann. */
	return fork () < 0;

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_run "$LINENO"; then :
	ac_cv_func_fork_works=yes
	else
	ac_cv_func_fork_works=no
	fi
	rm -f core .core core.conftest. gmon.out bb.out conftest$ac_exeext \
	conftest.$ac_objext conftest.beam conftest.$ac_ext
	fi

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_fork_works" >&5
	$as_echo "$ac_cv_func_fork_works" >&6; }

	else
	ac_cv_func_fork_works=$ac_cv_func_fork
	fi
	if test "x$ac_cv_func_fork_works" = xcross; then
	case $host in
	--amigaos* \| --msdosdjgpp*)
	# Override, as these systems have only a dummy fork() stub
	ac_cv_func_fork_works=no
	;;
	*)
	ac_cv_func_fork_works=yes
	;;
	esac
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: result $ac_cv_func_fork_works guessed because of cross compilation" >&5
	$as_echo "$as_me: WARNING: result $ac_cv_func_fork_works guessed because of cross compilation" >&2;}
	fi
	ac_cv_func_vfork_works=$ac_cv_func_vfork
	if test "x$ac_cv_func_vfork" = xyes; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for working vfork" >&5
	$as_echo_n "checking for working vfork... " >&6; }
	if ${ac_cv_func_vfork_works+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test "$cross_compiling" = yes; then :
	ac_cv_func_vfork_works=cross
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	/* Thanks to Paul Eggert for this test. */
	$ac_includes_default
	#include <sys/wait.h>
	#ifdef HAVE_VFORK_H
	# include <vfork.h>
	#endif
	/* On some sparc systems, changes by the child to local and incoming
	argument registers are propagated back to the parent. The compiler
	is told about this with #include <vfork.h>, but some compilers
	(e.g. gcc -O) don't grok <vfork.h>. Test for this by using a
	static variable whose address is put into a register that is
	clobbered by the vfork. */
	static void
	#ifdef __cplusplus
	sparc_address_test (int arg)
	# else
	sparc_address_test (arg) int arg;
	#endif
	{
	static pid_t child;
	if (!child) {
	child = vfork ();
	if (child < 0) {
	perror ("vfork");
	_exit(2);
	}
	if (!child) {
	arg = getpid();
	write(-1, "", 0);
	_exit (arg);
	}
	}
	}

	int
	main ()
	{
	pid_t parent = getpid ();
	pid_t child;

	sparc_address_test (0);

	child = vfork ();

	if (child == 0) {
	/* Here is another test for sparc vfork register problems. This
	test uses lots of local variables, at least as many local
	variables as main has allocated so far including compiler
	temporaries. 4 locals are enough for gcc 1.40.3 on a Solaris
	4.1.3 sparc, but we use 8 to be safe. A buggy compiler should
	reuse the register of parent for one of the local variables,
	since it will think that parent can't possibly be used any more
	in this routine. Assigning to the local variable will thus
	munge parent in the parent process. */
	pid_t
	p = getpid(), p1 = getpid(), p2 = getpid(), p3 = getpid(),
	p4 = getpid(), p5 = getpid(), p6 = getpid(), p7 = getpid();
	/* Convince the compiler that p..p7 are live; otherwise, it might
	use the same hardware register for all 8 local variables. */
	if (p != p1 \|\| p != p2 \|\| p != p3 \|\| p != p4
	\|\| p != p5 \|\| p != p6 \|\| p != p7)
	_exit(1);

	/* On some systems (e.g. IRIX 3.3), vfork doesn't separate parent
	from child file descriptors. If the child closes a descriptor
	before it execs or exits, this munges the parent's descriptor
	as well. Test for this by closing stdout in the child. */
	_exit(close(fileno(stdout)) != 0);
	} else {
	int status;
	struct stat st;

	while (wait(&status) != child)
	;
	return (
	/* Was there some problem with vforking? */
	child < 0

	/* Did the child fail? (This shouldn't happen.) */
	\|\| status

	/* Did the vfork/compiler bug occur? */
	\|\| parent != getpid()

	/* Did the file descriptor bug occur? */
	\|\| fstat(fileno(stdout), &st) != 0
	);
	}
	}
	_ACEOF
	if ac_fn_c_try_run "$LINENO"; then :
	ac_cv_func_vfork_works=yes
	else
	ac_cv_func_vfork_works=no
	fi
	rm -f core .core core.conftest. gmon.out bb.out conftest$ac_exeext \
	conftest.$ac_objext conftest.beam conftest.$ac_ext
	fi

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_vfork_works" >&5
	$as_echo "$ac_cv_func_vfork_works" >&6; }

	fi;
	if test "x$ac_cv_func_fork_works" = xcross; then
	ac_cv_func_vfork_works=$ac_cv_func_vfork
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: result $ac_cv_func_vfork_works guessed because of cross compilation" >&5
	$as_echo "$as_me: WARNING: result $ac_cv_func_vfork_works guessed because of cross compilation" >&2;}
	fi

	if test "x$ac_cv_func_vfork_works" = xyes; then

	$as_echo "#define HAVE_WORKING_VFORK 1" >>confdefs.h

	else

	$as_echo "#define vfork fork" >>confdefs.h

	fi
	if test "x$ac_cv_func_fork_works" = xyes; then

	$as_echo "#define HAVE_WORKING_FORK 1" >>confdefs.h

	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking return type of signal handlers" >&5
	$as_echo_n "checking return type of signal handlers... " >&6; }
	if ${ac_cv_type_signal+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <sys/types.h>
	#include <signal.h>

	int
	main ()
	{
	return *(signal (0, 0)) (0) == 1;
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_type_signal=int
	else
	ac_cv_type_signal=void
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_signal" >&5
	$as_echo "$ac_cv_type_signal" >&6; }

	cat >>confdefs.h <<_ACEOF
	#define RETSIGTYPE $ac_cv_type_signal
	_ACEOF


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for _LARGEFILE_SOURCE value needed for large files" >&5
	$as_echo_n "checking for _LARGEFILE_SOURCE value needed for large files... " >&6; }
	if ${ac_cv_sys_largefile_source+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	while :; do
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <sys/types.h> /* for off_t */
	#include <stdio.h>
	int
	main ()
	{
	int (fp) (FILE , off_t, int) = fseeko;
	return fseeko (stdin, 0, 0) && fp (stdin, 0, 0);
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_sys_largefile_source=no; break
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#define _LARGEFILE_SOURCE 1
	#include <sys/types.h> /* for off_t */
	#include <stdio.h>
	int
	main ()
	{
	int (fp) (FILE , off_t, int) = fseeko;
	return fseeko (stdin, 0, 0) && fp (stdin, 0, 0);
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_sys_largefile_source=1; break
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	ac_cv_sys_largefile_source=unknown
	break
	done
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_largefile_source" >&5
	$as_echo "$ac_cv_sys_largefile_source" >&6; }
	case $ac_cv_sys_largefile_source in #(
	no \| unknown) ;;
	*)
	cat >>confdefs.h <<_ACEOF
	#define _LARGEFILE_SOURCE $ac_cv_sys_largefile_source
	_ACEOF
	;;
	esac
	rm -rf conftest*

	# We used to try defining _XOPEN_SOURCE=500 too, to work around a bug
	# in glibc 2.1.3, but that breaks too many other things.
	# If you want fseeko and ftello with glibc, upgrade to a fixed glibc.
	if test $ac_cv_sys_largefile_source != unknown; then

	$as_echo "#define HAVE_FSEEKO 1" >>confdefs.h

	fi


	# Check whether --enable-largefile was given.
	if test "${enable_largefile+set}" = set; then :
	enableval=$enable_largefile;
	fi

	if test "$enable_largefile" != no; then

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for special C compiler options needed for large files" >&5
	$as_echo_n "checking for special C compiler options needed for large files... " >&6; }
	if ${ac_cv_sys_largefile_CC+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_cv_sys_largefile_CC=no
	if test "$GCC" != yes; then
	ac_save_CC=$CC
	while :; do
	# IRIX 6.2 and later do not support large files by default,
	# so use the C compiler's -n32 option if that helps.
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <sys/types.h>
	/* Check that off_t can represent 2**63 - 1 correctly.
	We can't simply define LARGE_OFF_T to be 9223372036854775807,
	since some C++ compilers masquerading as C compilers
	incorrectly reject 9223372036854775807. */
	#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
	int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
	&& LARGE_OFF_T % 2147483647 == 1)
	? 1 : -1];
	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	break
	fi
	rm -f core conftest.err conftest.$ac_objext
	CC="$CC -n32"
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_sys_largefile_CC=' -n32'; break
	fi
	rm -f core conftest.err conftest.$ac_objext
	break
	done
	CC=$ac_save_CC
	rm -f conftest.$ac_ext
	fi
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_largefile_CC" >&5
	$as_echo "$ac_cv_sys_largefile_CC" >&6; }
	if test "$ac_cv_sys_largefile_CC" != no; then
	CC=$CC$ac_cv_sys_largefile_CC
	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for _FILE_OFFSET_BITS value needed for large files" >&5
	$as_echo_n "checking for _FILE_OFFSET_BITS value needed for large files... " >&6; }
	if ${ac_cv_sys_file_offset_bits+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	while :; do
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <sys/types.h>
	/* Check that off_t can represent 2**63 - 1 correctly.
	We can't simply define LARGE_OFF_T to be 9223372036854775807,
	since some C++ compilers masquerading as C compilers
	incorrectly reject 9223372036854775807. */
	#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
	int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
	&& LARGE_OFF_T % 2147483647 == 1)
	? 1 : -1];
	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_sys_file_offset_bits=no; break
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#define _FILE_OFFSET_BITS 64
	#include <sys/types.h>
	/* Check that off_t can represent 2**63 - 1 correctly.
	We can't simply define LARGE_OFF_T to be 9223372036854775807,
	since some C++ compilers masquerading as C compilers
	incorrectly reject 9223372036854775807. */
	#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
	int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
	&& LARGE_OFF_T % 2147483647 == 1)
	? 1 : -1];
	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_sys_file_offset_bits=64; break
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	ac_cv_sys_file_offset_bits=unknown
	break
	done
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_file_offset_bits" >&5
	$as_echo "$ac_cv_sys_file_offset_bits" >&6; }
	case $ac_cv_sys_file_offset_bits in #(
	no \| unknown) ;;
	*)
	cat >>confdefs.h <<_ACEOF
	#define _FILE_OFFSET_BITS $ac_cv_sys_file_offset_bits
	_ACEOF
	;;
	esac
	rm -rf conftest*
	if test $ac_cv_sys_file_offset_bits = unknown; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for _LARGE_FILES value needed for large files" >&5
	$as_echo_n "checking for _LARGE_FILES value needed for large files... " >&6; }
	if ${ac_cv_sys_large_files+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	while :; do
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <sys/types.h>
	/* Check that off_t can represent 2**63 - 1 correctly.
	We can't simply define LARGE_OFF_T to be 9223372036854775807,
	since some C++ compilers masquerading as C compilers
	incorrectly reject 9223372036854775807. */
	#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
	int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
	&& LARGE_OFF_T % 2147483647 == 1)
	? 1 : -1];
	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_sys_large_files=no; break
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#define _LARGE_FILES 1
	#include <sys/types.h>
	/* Check that off_t can represent 2**63 - 1 correctly.
	We can't simply define LARGE_OFF_T to be 9223372036854775807,
	since some C++ compilers masquerading as C compilers
	incorrectly reject 9223372036854775807. */
	#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
	int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
	&& LARGE_OFF_T % 2147483647 == 1)
	? 1 : -1];
	int
	main ()
	{

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	ac_cv_sys_large_files=1; break
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	ac_cv_sys_large_files=unknown
	break
	done
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_large_files" >&5
	$as_echo "$ac_cv_sys_large_files" >&6; }
	case $ac_cv_sys_large_files in #(
	no \| unknown) ;;
	*)
	cat >>confdefs.h <<_ACEOF
	#define _LARGE_FILES $ac_cv_sys_large_files
	_ACEOF
	;;
	esac
	rm -rf conftest*
	fi


	fi




	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need -D_LARGEFILE_SOURCE=1 as a flag for $CC" >&5
	$as_echo_n "checking whether we need -D_LARGEFILE_SOURCE=1 as a flag for $CC... " >&6; }
	cache=_D_LARGEFILE_SOURCE_1
	if eval \${cv_prog_cc_flag_needed_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo '
	#include <stdio.h>
	int test() {
	int a = fseeko(stdin, 0, 0);
	return a;
	}
	' > conftest.c
	echo 'void f(){}' >>conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=no"
	else

	if test -z "`$CC $CPPFLAGS $CFLAGS -D_LARGEFILE_SOURCE=1 $ERRFLAG -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_needed_$cache=yes"
	else
	eval "cv_prog_cc_flag_needed_$cache=fail"
	#echo 'Test with flag fails too!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS -D_LARGEFILE_SOURCE=1 $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS -D_LARGEFILE_SOURCE=1 $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	fi

	fi
	rm -f conftest conftest.c conftest.o

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	CFLAGS="$CFLAGS -D_LARGEFILE_SOURCE=1"
	else
	if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	#echo 'Test with flag is no!'
	#cat conftest.c
	#echo "$CC $CPPFLAGS $CFLAGS -D_LARGEFILE_SOURCE=1 $ERRFLAG -c conftest.c 2>&1"
	#echo `$CC $CPPFLAGS $CFLAGS -D_LARGEFILE_SOURCE=1 $ERRFLAG -c conftest.c 2>&1`
	#exit 1
	:

	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
	$as_echo "failed" >&6; }
	:

	fi
	fi



	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if nonblocking sockets work" >&5
	$as_echo_n "checking if nonblocking sockets work... " >&6; }
	if echo $target \| grep mingw32 >/dev/null; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no (windows)" >&5
	$as_echo "no (windows)" >&6; }

	$as_echo "#define NONBLOCKING_IS_BROKEN 1" >>confdefs.h

	else
	if test "$cross_compiling" = yes; then :

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: crosscompile(yes)" >&5
	$as_echo "crosscompile(yes)" >&6; }

	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */


	#include <stdio.h>
	#include <string.h>
	#include <stdlib.h>
	#include <fcntl.h>
	#include <errno.h>
	#ifdef HAVE_SYS_TYPES_H
	#include <sys/types.h>
	#endif
	#ifdef HAVE_SYS_SOCKET_H
	#include <sys/socket.h>
	#endif
	#ifdef HAVE_NETINET_IN_H
	#include <netinet/in.h>
	#endif
	#ifdef HAVE_ARPA_INET_H
	#include <arpa/inet.h>
	#endif
	#ifdef HAVE_UNISTD_H
	#include <unistd.h>
	#endif
	#ifdef HAVE_TIME_H
	#include <time.h>
	#endif

	int main(void)
	{
	int port;
	int sfd, cfd;
	int num = 10;
	int i, p;
	struct sockaddr_in a;
	/* test if select and nonblocking reads work well together */
	/* open port.
	fork child to send 10 messages.
	select to read.
	then try to nonblocking read the 10 messages
	then, nonblocking read must give EAGAIN
	*/

	port = 12345 + (time(0)%32);
	sfd = socket(PF_INET, SOCK_DGRAM, 0);
	if(sfd == -1) {
	perror("socket");
	return 1;
	}
	memset(&a, 0, sizeof(a));
	a.sin_family = AF_INET;
	a.sin_port = htons(port);
	a.sin_addr.s_addr = inet_addr("127.0.0.1");
	if(bind(sfd, (struct sockaddr*)&a, sizeof(a)) < 0) {
	perror("bind");
	return 1;
	}
	if(fcntl(sfd, F_SETFL, O_NONBLOCK) == -1) {
	perror("fcntl");
	return 1;
	}

	cfd = socket(PF_INET, SOCK_DGRAM, 0);
	if(cfd == -1) {
	perror("client socket");
	return 1;
	}
	a.sin_port = 0;
	if(bind(cfd, (struct sockaddr*)&a, sizeof(a)) < 0) {
	perror("client bind");
	return 1;
	}
	a.sin_port = htons(port);

	/* no handler, causes exit in 10 seconds */
	alarm(10);

	/* send and receive on the socket */
	if((p=fork()) == 0) {
	for(i=0; i<num; i++) {
	if(sendto(cfd, &i, sizeof(i), 0,
	(struct sockaddr*)&a, sizeof(a)) < 0) {
	perror("sendto");
	return 1;
	}
	}
	} else {
	/* parent */
	fd_set rset;
	int x;
	if(p == -1) {
	perror("fork");
	return 1;
	}
	FD_ZERO(&rset);
	FD_SET(sfd, &rset);
	if(select(sfd+1, &rset, NULL, NULL, NULL) < 1) {
	perror("select");
	return 1;
	}
	i = 0;
	while(i < num) {
	if(recv(sfd, &x, sizeof(x), 0) != sizeof(x)) {
	if(errno == EAGAIN)
	continue;
	perror("recv");
	return 1;
	}
	i++;
	}
	/* now we want to get EAGAIN: nonblocking goodness */
	errno = 0;
	recv(sfd, &x, sizeof(x), 0);
	if(errno != EAGAIN) {
	perror("trying to recv again");
	return 1;
	}
	/* EAGAIN encountered */
	}

	close(sfd);
	close(cfd);
	return 0;
	}

	_ACEOF
	if ac_fn_c_try_run "$LINENO"; then :

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }

	else

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }

	$as_echo "#define NONBLOCKING_IS_BROKEN 1" >>confdefs.h


	fi
	rm -f core .core core.conftest. gmon.out bb.out conftest$ac_exeext \
	conftest.$ac_objext conftest.beam conftest.$ac_ext
	fi

	fi


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether mkdir has one arg" >&5
	$as_echo_n "checking whether mkdir has one arg... " >&6; }
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	#include <stdio.h>
	#include <unistd.h>
	#ifdef HAVE_WINSOCK2_H
	#include <winsock2.h>
	#endif
	#ifdef HAVE_SYS_STAT_H
	#include <sys/stat.h>
	#endif

	int
	main ()
	{

	(void)mkdir("directory");

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }

	$as_echo "#define MKDIR_HAS_ONE_ARG 1" >>confdefs.h


	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }

	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext

	for ac_func in strptime
	do :
	ac_fn_c_check_func "$LINENO" "strptime" "ac_cv_func_strptime"
	if test "x$ac_cv_func_strptime" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_STRPTIME 1
	_ACEOF

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether strptime works" >&5
	$as_echo_n "checking whether strptime works... " >&6; }
	if test c${cross_compiling} = cno; then
	if test "$cross_compiling" = yes; then :
	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
	$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
	as_fn_error $? "cannot run test program while cross compiling
	See \`config.log' for more details" "$LINENO" 5; }
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	#define _XOPEN_SOURCE 600
	#include <time.h>
	int main(void) { struct tm tm; char *res;
	res = strptime("2010-07-15T00:00:00+00:00", "%t%Y%t-%t%m%t-%t%d%tT%t%H%t:%t%M%t:%t%S%t", &tm);
	if (!res) return 2;
	res = strptime("20070207111842", "%Y%m%d%H%M%S", &tm);
	if (!res) return 1; return 0; }

	_ACEOF
	if ac_fn_c_try_run "$LINENO"; then :
	eval "ac_cv_c_strptime_works=yes"
	else
	eval "ac_cv_c_strptime_works=no"
	fi
	rm -f core .core core.conftest. gmon.out bb.out conftest$ac_exeext \
	conftest.$ac_objext conftest.beam conftest.$ac_ext
	fi

	else
	eval "ac_cv_c_strptime_works=maybe"
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_strptime_works" >&5
	$as_echo "$ac_cv_c_strptime_works" >&6; }
	if test $ac_cv_c_strptime_works = no; then
	case " $LIBOBJS " in
	" strptime.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS strptime.$ac_objext"
	;;
	esac

	else

	cat >>confdefs.h <<_ACEOF
	#define STRPTIME_WORKS 1
	_ACEOF

	fi

	else
	case " $LIBOBJS " in
	" strptime.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS strptime.$ac_objext"
	;;
	esac

	fi
	done


	# check if we can use SO_REUSEPORT
	if echo "$host" \| grep -i -e linux -e dragonfly >/dev/null; then

	$as_echo "#define REUSEPORT_DEFAULT 1" >>confdefs.h

	else

	$as_echo "#define REUSEPORT_DEFAULT 0" >>confdefs.h

	fi

	# set memory allocation checking if requested
	# Check whether --enable-alloc-checks was given.
	if test "${enable_alloc_checks+set}" = set; then :
	enableval=$enable_alloc_checks;
	fi

	# Check whether --enable-alloc-lite was given.
	if test "${enable_alloc_lite+set}" = set; then :
	enableval=$enable_alloc_lite;
	fi

	# Check whether --enable-alloc-nonregional was given.
	if test "${enable_alloc_nonregional+set}" = set; then :
	enableval=$enable_alloc_nonregional;
	fi

	if test x_$enable_alloc_nonregional = x_yes; then

	$as_echo "#define UNBOUND_ALLOC_NONREGIONAL 1" >>confdefs.h

	fi
	if test x_$enable_alloc_checks = x_yes; then

	$as_echo "#define UNBOUND_ALLOC_STATS 1" >>confdefs.h

	else
	if test x_$enable_alloc_lite = x_yes; then

	$as_echo "#define UNBOUND_ALLOC_LITE 1" >>confdefs.h

	else

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for GNU libc compatible malloc" >&5
	$as_echo_n "checking for GNU libc compatible malloc... " >&6; }
	if test "$cross_compiling" = yes; then :
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no (crosscompile)" >&5
	$as_echo "no (crosscompile)" >&6; }
	case " $LIBOBJS " in
	" malloc.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS malloc.$ac_objext"
	;;
	esac


	cat >>confdefs.h <<_ACEOF
	#define malloc rpl_malloc_unbound
	_ACEOF

	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#if defined STDC_HEADERS \|\| defined HAVE_STDLIB_H
	#include <stdlib.h>
	#else
	char *malloc ();
	#endif

	int
	main ()
	{
	if(malloc(0) != 0) return 1;
	;
	return 0;
	}

	_ACEOF
	if ac_fn_c_try_run "$LINENO"; then :
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	case " $LIBOBJS " in
	" malloc.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS malloc.$ac_objext"
	;;
	esac


	cat >>confdefs.h <<_ACEOF
	#define malloc rpl_malloc_unbound
	_ACEOF

	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }

	$as_echo "#define HAVE_MALLOC 1" >>confdefs.h

	fi
	rm -f core .core core.conftest. gmon.out bb.out conftest$ac_exeext \
	conftest.$ac_objext conftest.beam conftest.$ac_ext
	fi


	fi
	fi

	# check windows threads (we use them, not pthreads, on windows).
	if test "$on_mingw" = "yes"; then
	# check windows threads
	for ac_header in windows.h
	do :
	ac_fn_c_check_header_compile "$LINENO" "windows.h" "ac_cv_header_windows_h" "$ac_includes_default
	"
	if test "x$ac_cv_header_windows_h" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_WINDOWS_H 1
	_ACEOF

	fi

	done

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for CreateThread" >&5
	$as_echo_n "checking for CreateThread... " >&6; }
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	#ifdef HAVE_WINDOWS_H
	#include <windows.h>
	#endif

	int
	main ()
	{

	HANDLE t = CreateThread(NULL, 0, NULL, NULL, 0, NULL);

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }

	$as_echo "#define HAVE_WINDOWS_THREADS 1" >>confdefs.h


	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }

	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext

	else
	# not on mingw, check thread libraries.

	# check for thread library.
	# check this first, so that the pthread lib does not get linked in via
	# libssl or libpython, and thus distorts the tests, and we end up using
	# the non-threadsafe C libraries.

	# Check whether --with-pthreads was given.
	if test "${with_pthreads+set}" = set; then :
	withval=$with_pthreads;
	else
	withval="yes"
	fi

	ub_have_pthreads=no
	if test x_$withval != x_no; then


	ac_ext=c
	ac_cpp='$CPP $CPPFLAGS'
	ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
	ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
	ac_compiler_gnu=$ac_cv_c_compiler_gnu

	ax_pthread_ok=no

	# We used to check for pthread.h first, but this fails if pthread.h
	# requires special compiler flags (e.g. on True64 or Sequent).
	# It gets checked for in the link test anyway.

	# First of all, check if the user has set any of the PTHREAD_LIBS,
	# etcetera environment variables, and if threads linking works using
	# them:
	if test x"$PTHREAD_LIBS$PTHREAD_CFLAGS" != x; then
	save_CFLAGS="$CFLAGS"
	CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
	save_LIBS="$LIBS"
	LIBS="$PTHREAD_LIBS $LIBS"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for pthread_join in LIBS=$PTHREAD_LIBS with CFLAGS=$PTHREAD_CFLAGS" >&5
	$as_echo_n "checking for pthread_join in LIBS=$PTHREAD_LIBS with CFLAGS=$PTHREAD_CFLAGS... " >&6; }
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char pthread_join ();
	int
	main ()
	{
	return pthread_join ();
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	ax_pthread_ok=yes
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_pthread_ok" >&5
	$as_echo "$ax_pthread_ok" >&6; }
	if test x"$ax_pthread_ok" = xno; then
	PTHREAD_LIBS=""
	PTHREAD_CFLAGS=""
	fi
	LIBS="$save_LIBS"
	CFLAGS="$save_CFLAGS"
	fi

	# We must check for the threads library under a number of different
	# names; the ordering is very important because some systems
	# (e.g. DEC) have both -lpthread and -lpthreads, where one of the
	# libraries is broken (non-POSIX).

	# Create a list of thread flags to try. Items starting with a "-" are
	# C compiler flags, and other items are library names, except for "none"
	# which indicates that we try without any flags at all, and "pthread-config"
	# which is a program returning the flags for the Pth emulation library.

	ax_pthread_flags="pthreads none -Kthread -kthread lthread -pthread -pthreads -mthreads pthread --thread-safe -mt pthread-config"

	# The ordering is (sometimes) important. Some notes on the
	# individual items follow:

	# pthreads: AIX (must check this before -lpthread)
	# none: in case threads are in libc; should be tried before -Kthread and
	# other compiler flags to prevent continual compiler warnings
	# -Kthread: Sequent (threads in libc, but -Kthread needed for pthread.h)
	# -kthread: FreeBSD kernel threads (preferred to -pthread since SMP-able)
	# lthread: LinuxThreads port on FreeBSD (also preferred to -pthread)
	# -pthread: Linux/gcc (kernel threads), BSD/gcc (userland threads)
	# -pthreads: Solaris/gcc
	# -mthreads: Mingw32/gcc, Lynx/gcc
	# -mt: Sun Workshop C (may only link SunOS threads [-lthread], but it
	# doesn't hurt to check since this sometimes defines pthreads too;
	# also defines -D_REENTRANT)
	# ... -mt is also the pthreads flag for HP/aCC
	# pthread: Linux, etcetera
	# --thread-safe: KAI C++
	# pthread-config: use pthread-config program (for GNU Pth library)

	case ${host_os} in
	solaris*)

	# On Solaris (at least, for some versions), libc contains stubbed
	# (non-functional) versions of the pthreads routines, so link-based
	# tests will erroneously succeed. (We need to link with -pthreads/-mt/
	# -lpthread.) (The stubs are missing pthread_cleanup_push, or rather
	# a function called by this macro, so we could check for that, but
	# who knows whether they'll stub that too in a future libc.) So,
	# we'll just look for -pthreads and -lpthread first:

	ax_pthread_flags="-pthreads pthread -mt -pthread $ax_pthread_flags"
	;;

	darwin*)
	ax_pthread_flags="-pthread $ax_pthread_flags"
	;;
	esac

	# Clang doesn't consider unrecognized options an error unless we specify
	# -Werror. We throw in some extra Clang-specific options to ensure that
	# this doesn't happen for GCC, which also accepts -Werror.

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if compiler needs -Werror to reject unknown flags" >&5
	$as_echo_n "checking if compiler needs -Werror to reject unknown flags... " >&6; }
	save_CFLAGS="$CFLAGS"
	ax_pthread_extra_flags="-Werror"
	CFLAGS="$CFLAGS $ax_pthread_extra_flags -Wunknown-warning-option -Wsizeof-array-argument"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	int foo(void);
	int
	main ()
	{
	foo()
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_compile "$LINENO"; then :
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	else
	ax_pthread_extra_flags=
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi
	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
	CFLAGS="$save_CFLAGS"

	if test x"$ax_pthread_ok" = xno; then
	for flag in $ax_pthread_flags; do

	case $flag in
	none)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether pthreads work without any flags" >&5
	$as_echo_n "checking whether pthreads work without any flags... " >&6; }
	;;

	-*)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether pthreads work with $flag" >&5
	$as_echo_n "checking whether pthreads work with $flag... " >&6; }
	PTHREAD_CFLAGS="$flag"
	;;

	pthread-config)
	# Extract the first word of "pthread-config", so it can be a program name with args.
	set dummy pthread-config; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ax_pthread_config+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ax_pthread_config"; then
	ac_cv_prog_ax_pthread_config="$ax_pthread_config" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ax_pthread_config="yes"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	test -z "$ac_cv_prog_ax_pthread_config" && ac_cv_prog_ax_pthread_config="no"
	fi
	fi
	ax_pthread_config=$ac_cv_prog_ax_pthread_config
	if test -n "$ax_pthread_config"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_pthread_config" >&5
	$as_echo "$ax_pthread_config" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	if test x"$ax_pthread_config" = xno; then continue; fi
	PTHREAD_CFLAGS="`pthread-config --cflags`"
	PTHREAD_LIBS="`pthread-config --ldflags` `pthread-config --libs`"
	;;

	*)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for the pthreads library -l$flag" >&5
	$as_echo_n "checking for the pthreads library -l$flag... " >&6; }
	PTHREAD_LIBS="-l$flag"
	;;
	esac

	save_LIBS="$LIBS"
	save_CFLAGS="$CFLAGS"
	LIBS="$PTHREAD_LIBS $LIBS"
	CFLAGS="$CFLAGS $PTHREAD_CFLAGS $ax_pthread_extra_flags"

	# Check for various functions. We must include pthread.h,
	# since some functions may be macros. (On the Sequent, we
	# need a special flag -Kthread to make this header compile.)
	# We check for pthread_join because it is in -lpthread on IRIX
	# while pthread_create is in libc. We check for pthread_attr_init
	# due to DEC craziness with -lpthreads. We check for
	# pthread_cleanup_push because it is one of the few pthread
	# functions on Solaris that doesn't have a non-functional libc stub.
	# We try pthread_create on general principles.
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <pthread.h>
	static void routine(void a) { ((int*)a) = 0; }
	static void start_routine(void a) { return a; }
	int
	main ()
	{
	pthread_t th; pthread_attr_t attr;
	pthread_create(&th, 0, start_routine, 0);
	pthread_join(th, 0);
	pthread_attr_init(&attr);
	pthread_cleanup_push(routine, 0);
	pthread_cleanup_pop(0) /* ; */
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	ax_pthread_ok=yes
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext

	LIBS="$save_LIBS"
	CFLAGS="$save_CFLAGS"

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_pthread_ok" >&5
	$as_echo "$ax_pthread_ok" >&6; }
	if test "x$ax_pthread_ok" = xyes; then
	break;
	fi

	PTHREAD_LIBS=""
	PTHREAD_CFLAGS=""
	done
	fi

	# Various other checks:
	if test "x$ax_pthread_ok" = xyes; then
	save_LIBS="$LIBS"
	LIBS="$PTHREAD_LIBS $LIBS"
	save_CFLAGS="$CFLAGS"
	CFLAGS="$CFLAGS $PTHREAD_CFLAGS"

	# Detect AIX lossage: JOINABLE attribute is called UNDETACHED.
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for joinable pthread attribute" >&5
	$as_echo_n "checking for joinable pthread attribute... " >&6; }
	attr_name=unknown
	for attr in PTHREAD_CREATE_JOINABLE PTHREAD_CREATE_UNDETACHED; do
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <pthread.h>
	int
	main ()
	{
	int attr = $attr; return attr /* ; */
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	attr_name=$attr; break
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	done
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $attr_name" >&5
	$as_echo "$attr_name" >&6; }
	if test "$attr_name" != PTHREAD_CREATE_JOINABLE; then

	cat >>confdefs.h <<_ACEOF
	#define PTHREAD_CREATE_JOINABLE $attr_name
	_ACEOF

	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if more special flags are required for pthreads" >&5
	$as_echo_n "checking if more special flags are required for pthreads... " >&6; }
	flag=no
	case ${host_os} in
	aix* \| freebsd* \| darwin*) flag="-D_THREAD_SAFE";;
	osf* \| hpux*) flag="-D_REENTRANT";;
	solaris*)
	if test "$GCC" = "yes"; then
	flag="-D_REENTRANT"
	else
	# TODO: What about Clang on Solaris?
	flag="-mt -D_REENTRANT"
	fi
	;;
	esac
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $flag" >&5
	$as_echo "$flag" >&6; }
	if test "x$flag" != xno; then
	PTHREAD_CFLAGS="$flag $PTHREAD_CFLAGS"
	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for PTHREAD_PRIO_INHERIT" >&5
	$as_echo_n "checking for PTHREAD_PRIO_INHERIT... " >&6; }
	if ${ax_cv_PTHREAD_PRIO_INHERIT+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	#include <pthread.h>
	int
	main ()
	{
	int i = PTHREAD_PRIO_INHERIT;
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	ax_cv_PTHREAD_PRIO_INHERIT=yes
	else
	ax_cv_PTHREAD_PRIO_INHERIT=no
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext

	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_PRIO_INHERIT" >&5
	$as_echo "$ax_cv_PTHREAD_PRIO_INHERIT" >&6; }
	if test "x$ax_cv_PTHREAD_PRIO_INHERIT" = "xyes"; then :

	$as_echo "#define HAVE_PTHREAD_PRIO_INHERIT 1" >>confdefs.h

	fi

	LIBS="$save_LIBS"
	CFLAGS="$save_CFLAGS"

	# More AIX lossage: compile with *_r variant
	if test "x$GCC" != xyes; then
	case $host_os in
	aix*)
	case "x/$CC" in #(
	x/c89\|x/c89_128\|x/c99\|x/c99_128\|x/cc\|x/cc128\|x/xlc\|x/xlc_v6\|x/xlc128\|x/xlc128_v6) :
	#handle absolute path differently from PATH based program lookup
	case "x$CC" in #(
	x/*) :
	if as_fn_executable_p ${CC}_r; then :
	PTHREAD_CC="${CC}_r"
	fi ;; #(
	*) :
	for ac_prog in ${CC}_r
	do
	# Extract the first word of "$ac_prog", so it can be a program name with args.
	set dummy $ac_prog; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_PTHREAD_CC+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$PTHREAD_CC"; then
	ac_cv_prog_PTHREAD_CC="$PTHREAD_CC" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_PTHREAD_CC="$ac_prog"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	PTHREAD_CC=$ac_cv_prog_PTHREAD_CC
	if test -n "$PTHREAD_CC"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $PTHREAD_CC" >&5
	$as_echo "$PTHREAD_CC" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	test -n "$PTHREAD_CC" && break
	done
	test -n "$PTHREAD_CC" \|\| PTHREAD_CC="$CC"
	;;
	esac ;; #(
	*) :
	;;
	esac
	;;
	esac
	fi
	fi

	test -n "$PTHREAD_CC" \|\| PTHREAD_CC="$CC"





	# Finally, execute ACTION-IF-FOUND/ACTION-IF-NOT-FOUND:
	if test x"$ax_pthread_ok" = xyes; then


	$as_echo "#define HAVE_PTHREAD 1" >>confdefs.h

	if test -n "$PTHREAD_LIBS"; then
	LIBS="$PTHREAD_LIBS $LIBS"
	fi
	CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
	CC="$PTHREAD_CC"
	ub_have_pthreads=yes
	ac_fn_c_check_type "$LINENO" "pthread_spinlock_t" "ac_cv_type_pthread_spinlock_t" "#include <pthread.h>
	"
	if test "x$ac_cv_type_pthread_spinlock_t" = xyes; then :

	cat >>confdefs.h <<_ACEOF
	#define HAVE_PTHREAD_SPINLOCK_T 1
	_ACEOF


	fi
	ac_fn_c_check_type "$LINENO" "pthread_rwlock_t" "ac_cv_type_pthread_rwlock_t" "#include <pthread.h>
	"
	if test "x$ac_cv_type_pthread_rwlock_t" = xyes; then :

	cat >>confdefs.h <<_ACEOF
	#define HAVE_PTHREAD_RWLOCK_T 1
	_ACEOF


	fi


	if echo "$CFLAGS" \| $GREP -e "-pthread" >/dev/null; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if -pthread unused during linking" >&5
	$as_echo_n "checking if -pthread unused during linking... " >&6; }
	# catch clang warning 'argument unused during compilation'
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$ac_includes_default

	int main(void) {return 0;}

	_ACEOF
	pthread_unused="yes"
	# first compile
	echo "$CC $CFLAGS -c conftest.c -o conftest.o" >&5
	$CC $CFLAGS -c conftest.c -o conftest.o 2>&5 >&5
	if test $? = 0; then
	# then link
	echo "$CC $CFLAGS -Werror $LDFLAGS $LIBS -o conftest contest.o" >&5
	$CC $CFLAGS -Werror $LDFLAGS $LIBS -o conftest conftest.o 2>&5 >&5
	if test $? -ne 0; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	CFLAGS=`echo "$CFLAGS" \| sed -e 's/-pthread//'`
	PTHREAD_CFLAGS_ONLY="-pthread"

	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi # endif cc successful
	rm -f conftest conftest.c conftest.o
	fi # endif -pthread in CFLAGS


	:
	else
	ax_pthread_ok=no

	fi
	ac_ext=c
	ac_cpp='$CPP $CPPFLAGS'
	ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
	ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
	ac_compiler_gnu=$ac_cv_c_compiler_gnu


	fi

	# check solaris thread library

	# Check whether --with-solaris-threads was given.
	if test "${with_solaris_threads+set}" = set; then :
	withval=$with_solaris_threads;
	else
	withval="no"
	fi

	ub_have_sol_threads=no
	if test x_$withval != x_no; then
	if test x_$ub_have_pthreads != x_no; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Have pthreads already, ignoring --with-solaris-threads" >&5
	$as_echo "$as_me: WARNING: Have pthreads already, ignoring --with-solaris-threads" >&2;}
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing thr_create" >&5
	$as_echo_n "checking for library containing thr_create... " >&6; }
	if ${ac_cv_search_thr_create+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_func_search_save_LIBS=$LIBS
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char thr_create ();
	int
	main ()
	{
	return thr_create ();
	;
	return 0;
	}
	_ACEOF
	for ac_lib in '' thread; do
	if test -z "$ac_lib"; then
	ac_res="none required"
	else
	ac_res=-l$ac_lib
	LIBS="-l$ac_lib $ac_func_search_save_LIBS"
	fi
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_search_thr_create=$ac_res
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext
	if ${ac_cv_search_thr_create+:} false; then :
	break
	fi
	done
	if ${ac_cv_search_thr_create+:} false; then :

	else
	ac_cv_search_thr_create=no
	fi
	rm conftest.$ac_ext
	LIBS=$ac_func_search_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_thr_create" >&5
	$as_echo "$ac_cv_search_thr_create" >&6; }
	ac_res=$ac_cv_search_thr_create
	if test "$ac_res" != no; then :
	test "$ac_res" = "none required" \|\| LIBS="$ac_res $LIBS"


	$as_echo "#define HAVE_SOLARIS_THREADS 1" >>confdefs.h




	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -mt" >&5
	$as_echo_n "checking whether $CC supports -mt... " >&6; }
	cache=`echo mt \| sed 'y%.=/+-%___p_%'`
	if eval \${cv_prog_cc_flag_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo 'void f(void){}' >conftest.c
	if test -z "`$CC $CPPFLAGS $CFLAGS -mt -c conftest.c 2>&1`"; then
	eval "cv_prog_cc_flag_$cache=yes"
	else
	eval "cv_prog_cc_flag_$cache=no"
	fi
	rm -f conftest conftest.o conftest.c

	fi

	if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	:
	CFLAGS="$CFLAGS -mt"
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	:
	CFLAGS="$CFLAGS -D_REENTRANT"
	fi

	ub_have_sol_threads=yes

	else

	as_fn_error $? "no solaris threads found." "$LINENO" 5

	fi

	fi
	fi

	fi # end of non-mingw check of thread libraries

	# Check for PyUnbound

	# Check whether --with-pyunbound was given.
	if test "${with_pyunbound+set}" = set; then :
	withval=$with_pyunbound;
	else
	withval="no"
	fi


	ub_test_python=no
	ub_with_pyunbound=no
	if test x_$withval != x_no; then
	ub_with_pyunbound=yes
	ub_test_python=yes
	fi

	# Check for Python module

	# Check whether --with-pythonmodule was given.
	if test "${with_pythonmodule+set}" = set; then :
	withval=$with_pythonmodule;
	else
	withval="no"
	fi


	ub_with_pythonmod=no
	if test x_$withval != x_no; then
	ub_with_pythonmod=yes
	ub_test_python=yes
	fi

	# Check for Python & SWIG only on PyUnbound or PyModule
	if test x_$ub_test_python != x_no; then

	# Check for Python
	ub_have_python=no
	ac_save_LIBS="$LIBS"
	#
	# Allow the use of a (user set) custom python version
	#


	# Extract the first word of "python[$PYTHON_VERSION]", so it can be a program name with args.
	set dummy python$PYTHON_VERSION; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_path_PYTHON+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	case $PYTHON in
	[\\/]* \| ?:[\\/]*)
	ac_cv_path_PYTHON="$PYTHON" # Let the user override the test with a path.
	;;
	*)
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_path_PYTHON="$as_dir/$ac_word$ac_exec_ext"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	;;
	esac
	fi
	PYTHON=$ac_cv_path_PYTHON
	if test -n "$PYTHON"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $PYTHON" >&5
	$as_echo "$PYTHON" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	if test -z "$PYTHON"; then
	as_fn_error $? "Cannot find python$PYTHON_VERSION in your system path" "$LINENO" 5
	PYTHON_VERSION=""
	fi

	if test -z "$PYTHON_VERSION"; then
	PYTHON_VERSION=`$PYTHON -c "import sys; \
	print(sys.version.split()[0])"`
	fi

	#
	# Check if you have distutils, else fail
	#
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for the distutils Python package" >&5
	$as_echo_n "checking for the distutils Python package... " >&6; }
	if ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	as_fn_error $? "cannot import Python module \"distutils\".
	Please check your Python installation. The error was:
	$ac_distutils_result" "$LINENO" 5
	PYTHON_VERSION=""
	fi

	#
	# Check for Python include path
	#
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Python include path" >&5
	$as_echo_n "checking for Python include path... " >&6; }
	if test -z "$PYTHON_CPPFLAGS"; then
	python_path=`$PYTHON -c "import distutils.sysconfig; \
	print(distutils.sysconfig.get_python_inc());"`
	if test -n "${python_path}"; then
	python_path="-I$python_path"
	fi
	PYTHON_CPPFLAGS=$python_path
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $PYTHON_CPPFLAGS" >&5
	$as_echo "$PYTHON_CPPFLAGS" >&6; }


	#
	# Check for Python library path
	#
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Python library path" >&5
	$as_echo_n "checking for Python library path... " >&6; }
	if test -z "$PYTHON_LDFLAGS"; then
	PYTHON_LDFLAGS=`$PYTHON -c "from distutils.sysconfig import *; \
	print('-L'+get_config_var('LIBDIR')+' -L'+get_config_var('LIBDEST')+' '+get_config_var('BLDLIBRARY'));"`
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $PYTHON_LDFLAGS" >&5
	$as_echo "$PYTHON_LDFLAGS" >&6; }


	#
	# Check for site packages
	#
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Python site-packages path" >&5
	$as_echo_n "checking for Python site-packages path... " >&6; }
	if test -z "$PYTHON_SITE_PKG"; then
	PYTHON_SITE_PKG=`$PYTHON -c "import distutils.sysconfig; \
	print(distutils.sysconfig.get_python_lib(1,0));"`
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $PYTHON_SITE_PKG" >&5
	$as_echo "$PYTHON_SITE_PKG" >&6; }


	#
	# final check to see if everything compiles alright
	#
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking consistency of all components of python development environment" >&5
	$as_echo_n "checking consistency of all components of python development environment... " >&6; }
	ac_ext=c
	ac_cpp='$CPP $CPPFLAGS'
	ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
	ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
	ac_compiler_gnu=$ac_cv_c_compiler_gnu

	# save current global flags
	ac_save_LIBS="$LIBS"
	ac_save_CPPFLAGS="$CPPFLAGS"

	LIBS="$LIBS $PYTHON_LDFLAGS"
	CPPFLAGS="$CPPFLAGS $PYTHON_CPPFLAGS"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	#include <Python.h>

	int
	main ()
	{

	Py_Initialize();

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	pythonexists=yes
	else
	pythonexists=no
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $pythonexists" >&5
	$as_echo "$pythonexists" >&6; }

	if test ! "$pythonexists" = "yes"; then
	as_fn_error $? "
	Could not link test program to Python. Maybe the main Python library has been
	installed in some non-standard library path. If so, pass it to configure,
	via the LDFLAGS environment variable.
	Example: ./configure LDFLAGS=\"-L/usr/non-standard-path/python/lib\"
	============================================================================
	ERROR!
	You probably have to install the development version of the Python package
	for your distribution. The exact name of this package varies among them.
	============================================================================
	" "$LINENO" 5
	PYTHON_VERSION=""
	fi
	ac_ext=c
	ac_cpp='$CPP $CPPFLAGS'
	ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
	ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
	ac_compiler_gnu=$ac_cv_c_compiler_gnu

	# turn back to default flags
	CPPFLAGS="$ac_save_CPPFLAGS"
	LIBS="$ac_save_LIBS"

	#
	# all done!
	#

	if test ! -z "$PYTHON_VERSION"; then
	if test `$PYTHON -c "print('$PYTHON_VERSION' >= '2.4.0')"` = "False"; then
	as_fn_error $? "Python version >= 2.4.0 is required" "$LINENO" 5
	fi

	PY_MAJOR_VERSION="`$PYTHON -c \"import sys; print(sys.version_info[0])\"`"

	# Have Python

	$as_echo "#define HAVE_PYTHON 1" >>confdefs.h

	if test -n "$LIBS"; then
	LIBS="$PYTHON_LDFLAGS $LIBS"
	else
	LIBS="$PYTHON_LDFLAGS"
	fi
	if test -n "$CPPFLAGS"; then
	CPPFLAGS="$CPPFLAGS $PYTHON_CPPFLAGS"
	else
	CPPFLAGS="$PYTHON_CPPFLAGS"
	fi
	ub_have_python=yes
	-
	-
	-
	-
	-
	-
	-
	-if test "x$ac_cv_env_PKG_CONFIG_set" != "xset"; then
	- if test -n "$ac_tool_prefix"; then
	- # Extract the first word of "${ac_tool_prefix}pkg-config", so it can be a program name with args.
	-set dummy ${ac_tool_prefix}pkg-config; ac_word=$2
	-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	-$as_echo_n "checking for $ac_word... " >&6; }
	-if ${ac_cv_path_PKG_CONFIG+:} false; then :
	- $as_echo_n "(cached) " >&6
	-else
	- case $PKG_CONFIG in
	- [\\/]* \| ?:[\\/]*)
	- ac_cv_path_PKG_CONFIG="$PKG_CONFIG" # Let the user override the test with a path.
	- ;;
	- *)
	- as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	-for as_dir in $PATH
	-do
	- IFS=$as_save_IFS
	- test -z "$as_dir" && as_dir=.
	- for ac_exec_ext in '' $ac_executable_extensions; do
	- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	- ac_cv_path_PKG_CONFIG="$as_dir/$ac_word$ac_exec_ext"
	- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	- break 2
	- fi
	-done
	- done
	-IFS=$as_save_IFS
	-
	- ;;
	-esac
	-fi
	-PKG_CONFIG=$ac_cv_path_PKG_CONFIG
	-if test -n "$PKG_CONFIG"; then
	- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PKG_CONFIG" >&5
	-$as_echo "$PKG_CONFIG" >&6; }
	-else
	- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	-$as_echo "no" >&6; }
	-fi
	-
	-
	-fi
	-if test -z "$ac_cv_path_PKG_CONFIG"; then
	- ac_pt_PKG_CONFIG=$PKG_CONFIG
	- # Extract the first word of "pkg-config", so it can be a program name with args.
	-set dummy pkg-config; ac_word=$2
	-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	-$as_echo_n "checking for $ac_word... " >&6; }
	-if ${ac_cv_path_ac_pt_PKG_CONFIG+:} false; then :
	- $as_echo_n "(cached) " >&6
	-else
	- case $ac_pt_PKG_CONFIG in
	- [\\/]* \| ?:[\\/]*)
	- ac_cv_path_ac_pt_PKG_CONFIG="$ac_pt_PKG_CONFIG" # Let the user override the test with a path.
	- ;;
	- *)
	- as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	-for as_dir in $PATH
	-do
	- IFS=$as_save_IFS
	- test -z "$as_dir" && as_dir=.
	- for ac_exec_ext in '' $ac_executable_extensions; do
	- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	- ac_cv_path_ac_pt_PKG_CONFIG="$as_dir/$ac_word$ac_exec_ext"
	- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	- break 2
	- fi
	-done
	- done
	-IFS=$as_save_IFS
	-
	- ;;
	-esac
	-fi
	-ac_pt_PKG_CONFIG=$ac_cv_path_ac_pt_PKG_CONFIG
	-if test -n "$ac_pt_PKG_CONFIG"; then
	- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_pt_PKG_CONFIG" >&5
	-$as_echo "$ac_pt_PKG_CONFIG" >&6; }
	-else
	- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	-$as_echo "no" >&6; }
	-fi
	-
	- if test "x$ac_pt_PKG_CONFIG" = x; then
	- PKG_CONFIG=""
	- else
	- case $cross_compiling:$ac_tool_warned in
	-yes:)
	-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	-ac_tool_warned=yes ;;
	-esac
	- PKG_CONFIG=$ac_pt_PKG_CONFIG
	- fi
	-else
	- PKG_CONFIG="$ac_cv_path_PKG_CONFIG"
	-fi
	-
	-fi
	-if test -n "$PKG_CONFIG"; then
	- _pkg_min_version=0.9.0
	- { $as_echo "$as_me:${as_lineno-$LINENO}: checking pkg-config is at least version $_pkg_min_version" >&5
	-$as_echo_n "checking pkg-config is at least version $_pkg_min_version... " >&6; }
	- if $PKG_CONFIG --atleast-pkgconfig-version $_pkg_min_version; then
	- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	-$as_echo "yes" >&6; }
	- else
	- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	-$as_echo "no" >&6; }
	- PKG_CONFIG=""
	- fi
	-fi
	if test -n "$PKG_CONFIG" && \
	{ { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"\"python\${PY_MAJOR_VERSION}\"\""; } >&5
	($PKG_CONFIG --exists --print-errors ""python${PY_MAJOR_VERSION}"") 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }; then
	PC_PY_DEPENDENCY="python${PY_MAJOR_VERSION}"
	else
	PC_PY_DEPENDENCY="python"
	fi


	# Check for SWIG
	ub_have_swig=no
	# Check whether --enable-swig-version-check was given.
	if test "${enable_swig_version_check+set}" = set; then :
	enableval=$enable_swig_version_check;
	fi

	if test "$enable_swig_version_check" = "yes"; then

	# Extract the first word of "swig", so it can be a program name with args.
	set dummy swig; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_path_SWIG+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	case $SWIG in
	[\\/]* \| ?:[\\/]*)
	ac_cv_path_SWIG="$SWIG" # Let the user override the test with a path.
	;;
	*)
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_path_SWIG="$as_dir/$ac_word$ac_exec_ext"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	;;
	esac
	fi
	SWIG=$ac_cv_path_SWIG
	if test -n "$SWIG"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $SWIG" >&5
	$as_echo "$SWIG" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	if test -z "$SWIG" ; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cannot find 'swig' program. You should look at http://www.swig.org" >&5
	$as_echo "$as_me: WARNING: cannot find 'swig' program. You should look at http://www.swig.org" >&2;}
	SWIG='echo "Error: SWIG is not installed. You should look at http://www.swig.org" ; false'
	elif test -n "2.0.1" ; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SWIG version" >&5
	$as_echo_n "checking for SWIG version... " >&6; }
	swig_version=`$SWIG -version 2>&1 \| grep 'SWIG Version' \| sed 's/.$[0-9][0-9]\.[0-9][0-9]\.[0-9][0-9]$.*/\1/g'`
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $swig_version" >&5
	$as_echo "$swig_version" >&6; }
	if test -n "$swig_version" ; then
	# Calculate the required version number components
	required=2.0.1
	required_major=`echo $required \| sed 's/[^0-9].*//'`
	if test -z "$required_major" ; then
	required_major=0
	fi
	required=`echo $required \| sed 's/[0-9]*[^0-9]//'`
	required_minor=`echo $required \| sed 's/[^0-9].*//'`
	if test -z "$required_minor" ; then
	required_minor=0
	fi
	required=`echo $required \| sed 's/[0-9]*[^0-9]//'`
	required_patch=`echo $required \| sed 's/[^0-9].*//'`
	if test -z "$required_patch" ; then
	required_patch=0
	fi
	# Calculate the available version number components
	available=$swig_version
	available_major=`echo $available \| sed 's/[^0-9].*//'`
	if test -z "$available_major" ; then
	available_major=0
	fi
	available=`echo $available \| sed 's/[0-9]*[^0-9]//'`
	available_minor=`echo $available \| sed 's/[^0-9].*//'`
	if test -z "$available_minor" ; then
	available_minor=0
	fi
	available=`echo $available \| sed 's/[0-9]*[^0-9]//'`
	available_patch=`echo $available \| sed 's/[^0-9].*//'`
	if test -z "$available_patch" ; then
	available_patch=0
	fi
	badversion=0
	if test $available_major -lt $required_major ; then
	badversion=1
	fi
	if test $available_major -eq $required_major \
	-a $available_minor -lt $required_minor ; then
	badversion=1
	fi
	if test $available_major -eq $required_major \
	-a $available_minor -eq $required_minor \
	-a $available_patch -lt $required_patch ; then
	badversion=1
	fi
	if test $badversion -eq 1 ; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: SWIG version >= 2.0.1 is required. You have $swig_version. You should look at http://www.swig.org" >&5
	$as_echo "$as_me: WARNING: SWIG version >= 2.0.1 is required. You have $swig_version. You should look at http://www.swig.org" >&2;}
	SWIG='echo "Error: SWIG version >= 2.0.1 is required. You have '"$swig_version"'. You should look at http://www.swig.org" ; false'
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: SWIG executable is '$SWIG'" >&5
	$as_echo "$as_me: SWIG executable is '$SWIG'" >&6;}
	SWIG_LIB=`$SWIG -swiglib`
	{ $as_echo "$as_me:${as_lineno-$LINENO}: SWIG library directory is '$SWIG_LIB'" >&5
	$as_echo "$as_me: SWIG library directory is '$SWIG_LIB'" >&6;}
	fi
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cannot determine SWIG version" >&5
	$as_echo "$as_me: WARNING: cannot determine SWIG version" >&2;}
	SWIG='echo "Error: Cannot determine SWIG version. You should look at http://www.swig.org" ; false'
	fi
	fi


	else

	# Extract the first word of "swig", so it can be a program name with args.
	set dummy swig; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_path_SWIG+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	case $SWIG in
	[\\/]* \| ?:[\\/]*)
	ac_cv_path_SWIG="$SWIG" # Let the user override the test with a path.
	;;
	*)
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_path_SWIG="$as_dir/$ac_word$ac_exec_ext"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	;;
	esac
	fi
	SWIG=$ac_cv_path_SWIG
	if test -n "$SWIG"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $SWIG" >&5
	$as_echo "$SWIG" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	if test -z "$SWIG" ; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cannot find 'swig' program. You should look at http://www.swig.org" >&5
	$as_echo "$as_me: WARNING: cannot find 'swig' program. You should look at http://www.swig.org" >&2;}
	SWIG='echo "Error: SWIG is not installed. You should look at http://www.swig.org" ; false'
	elif test -n "" ; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SWIG version" >&5
	$as_echo_n "checking for SWIG version... " >&6; }
	swig_version=`$SWIG -version 2>&1 \| grep 'SWIG Version' \| sed 's/.$[0-9][0-9]\.[0-9][0-9]\.[0-9][0-9]$.*/\1/g'`
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $swig_version" >&5
	$as_echo "$swig_version" >&6; }
	if test -n "$swig_version" ; then
	# Calculate the required version number components
	required=
	required_major=`echo $required \| sed 's/[^0-9].*//'`
	if test -z "$required_major" ; then
	required_major=0
	fi
	required=`echo $required \| sed 's/[0-9]*[^0-9]//'`
	required_minor=`echo $required \| sed 's/[^0-9].*//'`
	if test -z "$required_minor" ; then
	required_minor=0
	fi
	required=`echo $required \| sed 's/[0-9]*[^0-9]//'`
	required_patch=`echo $required \| sed 's/[^0-9].*//'`
	if test -z "$required_patch" ; then
	required_patch=0
	fi
	# Calculate the available version number components
	available=$swig_version
	available_major=`echo $available \| sed 's/[^0-9].*//'`
	if test -z "$available_major" ; then
	available_major=0
	fi
	available=`echo $available \| sed 's/[0-9]*[^0-9]//'`
	available_minor=`echo $available \| sed 's/[^0-9].*//'`
	if test -z "$available_minor" ; then
	available_minor=0
	fi
	available=`echo $available \| sed 's/[0-9]*[^0-9]//'`
	available_patch=`echo $available \| sed 's/[^0-9].*//'`
	if test -z "$available_patch" ; then
	available_patch=0
	fi
	badversion=0
	if test $available_major -lt $required_major ; then
	badversion=1
	fi
	if test $available_major -eq $required_major \
	-a $available_minor -lt $required_minor ; then
	badversion=1
	fi
	if test $available_major -eq $required_major \
	-a $available_minor -eq $required_minor \
	-a $available_patch -lt $required_patch ; then
	badversion=1
	fi
	if test $badversion -eq 1 ; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: SWIG version >= is required. You have $swig_version. You should look at http://www.swig.org" >&5
	$as_echo "$as_me: WARNING: SWIG version >= is required. You have $swig_version. You should look at http://www.swig.org" >&2;}
	SWIG='echo "Error: SWIG version >= is required. You have '"$swig_version"'. You should look at http://www.swig.org" ; false'
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: SWIG executable is '$SWIG'" >&5
	$as_echo "$as_me: SWIG executable is '$SWIG'" >&6;}
	SWIG_LIB=`$SWIG -swiglib`
	{ $as_echo "$as_me:${as_lineno-$LINENO}: SWIG library directory is '$SWIG_LIB'" >&5
	$as_echo "$as_me: SWIG library directory is '$SWIG_LIB'" >&6;}
	fi
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cannot determine SWIG version" >&5
	$as_echo "$as_me: WARNING: cannot determine SWIG version" >&2;}
	SWIG='echo "Error: Cannot determine SWIG version. You should look at http://www.swig.org" ; false'
	fi
	fi


	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking SWIG" >&5
	$as_echo_n "checking SWIG... " >&6; }
	if test ! -x "$SWIG"; then
	as_fn_error $? "failed to find swig tool, install it, or do not build Python module and PyUnbound" "$LINENO" 5
	else

	$as_echo "#define HAVE_SWIG 1" >>confdefs.h

	swig="$SWIG"

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: present" >&5
	$as_echo "present" >&6; }

	# If have Python & SWIG
	# Declare PythonMod
	if test x_$ub_with_pythonmod != x_no; then

	$as_echo "#define WITH_PYTHONMODULE 1" >>confdefs.h

	WITH_PYTHONMODULE=yes

	PYTHONMOD_OBJ="pythonmod.lo pythonmod_utils.lo"

	PYTHONMOD_HEADER='$(srcdir)/pythonmod/pythonmod.h'

	PYTHONMOD_INSTALL=pythonmod-install

	PYTHONMOD_UNINSTALL=pythonmod-uninstall

	fi

	# Declare PyUnbound
	if test x_$ub_with_pyunbound != x_no; then

	$as_echo "#define WITH_PYUNBOUND 1" >>confdefs.h

	WITH_PYUNBOUND=yes

	PYUNBOUND_OBJ="libunbound_wrap.lo"

	PYUNBOUND_TARGET="_unbound.la"

	PYUNBOUND_INSTALL=pyunbound-install

	PYUNBOUND_UNINSTALL=pyunbound-uninstall

	fi
	fi
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: * Python libraries not found, won't build PythonMod or PyUnbound *" >&5
	$as_echo "* Python libraries not found, won't build PythonMod or PyUnbound *" >&6; }
	ub_with_pyunbound=no
	ub_with_pythonmod=no
	fi
	fi

	if test "`uname`" = "NetBSD"; then
	NETBSD_LINTFLAGS='"-D__RENAME(x)=" -D_NETINET_IN_H_'

	fi
	CONFIG_DATE=`date +%Y%m%d`


	# Checks for libraries.

	# libnss
	USE_NSS="no"

	# Check whether --with-nss was given.
	if test "${with_nss+set}" = set; then :
	withval=$with_nss;
	USE_NSS="yes"

	$as_echo "#define HAVE_NSS 1" >>confdefs.h

	if test "$withval" != "" -a "$withval" != "yes"; then
	CPPFLAGS="$CPPFLAGS -I$withval/include/nss3"
	LDFLAGS="$LDFLAGS -L$withval/lib"

	if test "x$enable_rpath" = xyes; then
	if echo "$withval/lib" \| grep "^/" >/dev/null; then
	RUNTIME_PATH="$RUNTIME_PATH -R$withval/lib"
	fi
	fi

	CPPFLAGS="-I$withval/include/nspr4 $CPPFLAGS"
	else
	CPPFLAGS="$CPPFLAGS -I/usr/include/nss3"
	CPPFLAGS="-I/usr/include/nspr4 $CPPFLAGS"
	fi
	LIBS="$LIBS -lnss3 -lnspr4"
	SSLLIB=""


	fi


	# libnettle
	USE_NETTLE="no"

	# Check whether --with-nettle was given.
	if test "${with_nettle+set}" = set; then :
	withval=$with_nettle;
	USE_NETTLE="yes"

	$as_echo "#define HAVE_NETTLE 1" >>confdefs.h

	for ac_header in nettle/dsa-compat.h
	do :
	ac_fn_c_check_header_compile "$LINENO" "nettle/dsa-compat.h" "ac_cv_header_nettle_dsa_compat_h" "$ac_includes_default
	"
	if test "x$ac_cv_header_nettle_dsa_compat_h" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_NETTLE_DSA_COMPAT_H 1
	_ACEOF

	fi

	done

	if test "$withval" != "" -a "$withval" != "yes"; then
	CPPFLAGS="$CPPFLAGS -I$withval/include/nettle"
	LDFLAGS="$LDFLAGS -L$withval/lib"

	if test "x$enable_rpath" = xyes; then
	if echo "$withval/lib" \| grep "^/" >/dev/null; then
	RUNTIME_PATH="$RUNTIME_PATH -R$withval/lib"
	fi
	fi

	else
	CPPFLAGS="$CPPFLAGS -I/usr/include/nettle"
	fi
	LIBS="$LIBS -lhogweed -lnettle -lgmp"
	SSLLIB=""


	fi


	# openssl
	if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then


	# Check whether --with-ssl was given.
	if test "${with_ssl+set}" = set; then :
	withval=$with_ssl;

	else

	withval="yes"

	fi

	if test x_$withval = x_no; then
	as_fn_error $? "Need SSL library to do digital signature cryptography" "$LINENO" 5
	fi

	withval=$withval
	if test x_$withval != x_no; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SSL" >&5
	$as_echo_n "checking for SSL... " >&6; }
	if test x_$withval = x_ -o x_$withval = x_yes; then
	withval="/usr/local/ssl /usr/lib/ssl /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw /usr"
	fi
	for dir in $withval; do
	ssldir="$dir"
	if test -f "$dir/include/openssl/ssl.h"; then
	found_ssl="yes"

	cat >>confdefs.h <<_ACEOF
	#define HAVE_SSL /**/
	_ACEOF

	if test "$ssldir" != "/usr"; then
	CPPFLAGS="$CPPFLAGS -I$ssldir/include"
	LIBSSL_CPPFLAGS="$LIBSSL_CPPFLAGS -I$ssldir/include"
	fi
	break;
	fi
	done
	if test x_$found_ssl != x_yes; then
	as_fn_error $? "Cannot find the SSL libraries in $withval" "$LINENO" 5
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found in $ssldir" >&5
	$as_echo "found in $ssldir" >&6; }
	HAVE_SSL=yes
	if test "$ssldir" != "/usr" -a "$ssldir" != ""; then
	LDFLAGS="$LDFLAGS -L$ssldir/lib"
	LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib"

	if test "x$enable_rpath" = xyes; then
	if echo "$ssldir/lib" \| grep "^/" >/dev/null; then
	RUNTIME_PATH="$RUNTIME_PATH -R$ssldir/lib"
	fi
	fi

	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for HMAC_Update in -lcrypto" >&5
	$as_echo_n "checking for HMAC_Update in -lcrypto... " >&6; }
	LIBS="$LIBS -lcrypto"
	LIBSSL_LIBS="$LIBSSL_LIBS -lcrypto"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	int HMAC_Update(void);
	(void)HMAC_Update();

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }

	$as_echo "#define HAVE_HMAC_UPDATE 1" >>confdefs.h


	else

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	# check if -lwsock32 or -lgdi32 are needed.
	BAKLIBS="$LIBS"
	BAKSSLLIBS="$LIBSSL_LIBS"
	LIBS="$LIBS -lgdi32 -lws2_32"
	LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32 -lws2_32"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if -lcrypto needs -lgdi32" >&5
	$as_echo_n "checking if -lcrypto needs -lgdi32... " >&6; }
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	int HMAC_Update(void);
	(void)HMAC_Update();

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :


	$as_echo "#define HAVE_HMAC_UPDATE 1" >>confdefs.h

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }

	else

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	LIBS="$BAKLIBS"
	LIBSSL_LIBS="$BAKSSLLIBS"
	LIBS="$LIBS -ldl"
	LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if -lcrypto needs -ldl" >&5
	$as_echo_n "checking if -lcrypto needs -ldl... " >&6; }
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	int HMAC_Update(void);
	(void)HMAC_Update();

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :


	$as_echo "#define HAVE_HMAC_UPDATE 1" >>confdefs.h

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }

	else

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	LIBS="$BAKLIBS"
	LIBSSL_LIBS="$BAKSSLLIBS"
	LIBS="$LIBS -ldl -pthread"
	LIBSSL_LIBS="$LIBSSL_LIBS -ldl -pthread"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if -lcrypto needs -ldl -pthread" >&5
	$as_echo_n "checking if -lcrypto needs -ldl -pthread... " >&6; }
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	int
	main ()
	{

	int HMAC_Update(void);
	(void)HMAC_Update();

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :


	$as_echo "#define HAVE_HMAC_UPDATE 1" >>confdefs.h

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }

	else

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	as_fn_error $? "OpenSSL found in $ssldir, but version 0.9.7 or higher is required" "$LINENO" 5

	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext

	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext

	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext

	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	fi


	fi
	for ac_header in openssl/ssl.h
	do :
	ac_fn_c_check_header_compile "$LINENO" "openssl/ssl.h" "ac_cv_header_openssl_ssl_h" "$ac_includes_default
	"
	if test "x$ac_cv_header_openssl_ssl_h" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_OPENSSL_SSL_H 1
	_ACEOF

	fi

	done

	for ac_header in openssl/err.h
	do :
	ac_fn_c_check_header_compile "$LINENO" "openssl/err.h" "ac_cv_header_openssl_err_h" "$ac_includes_default
	"
	if test "x$ac_cv_header_openssl_err_h" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_OPENSSL_ERR_H 1
	_ACEOF

	fi

	done

	for ac_header in openssl/rand.h
	do :
	ac_fn_c_check_header_compile "$LINENO" "openssl/rand.h" "ac_cv_header_openssl_rand_h" "$ac_includes_default
	"
	if test "x$ac_cv_header_openssl_rand_h" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_OPENSSL_RAND_H 1
	_ACEOF

	fi

	done




	# check if libssl needs libdl
	BAKLIBS="$LIBS"
	LIBS="-lssl $LIBS"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if libssl needs libdl" >&5
	$as_echo_n "checking if libssl needs libdl... " >&6; }
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char SSL_CTX_new ();
	int
	main ()
	{
	return SSL_CTX_new ();
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	LIBS="$BAKLIBS"

	else

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	LIBS="$BAKLIBS"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing dlopen" >&5
	$as_echo_n "checking for library containing dlopen... " >&6; }
	if ${ac_cv_search_dlopen+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_func_search_save_LIBS=$LIBS
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char dlopen ();
	int
	main ()
	{
	return dlopen ();
	;
	return 0;
	}
	_ACEOF
	for ac_lib in '' dl; do
	if test -z "$ac_lib"; then
	ac_res="none required"
	else
	ac_res=-l$ac_lib
	LIBS="-l$ac_lib $ac_func_search_save_LIBS"
	fi
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_search_dlopen=$ac_res
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext
	if ${ac_cv_search_dlopen+:} false; then :
	break
	fi
	done
	if ${ac_cv_search_dlopen+:} false; then :

	else
	ac_cv_search_dlopen=no
	fi
	rm conftest.$ac_ext
	LIBS=$ac_func_search_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_dlopen" >&5
	$as_echo "$ac_cv_search_dlopen" >&6; }
	ac_res=$ac_cv_search_dlopen
	if test "$ac_res" != no; then :
	test "$ac_res" = "none required" \|\| LIBS="$ac_res $LIBS"

	fi


	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext
	SSLLIB="-lssl"

	# check if -lcrypt32 is needed because CAPIENG needs that. (on windows)
	BAKLIBS="$LIBS"
	LIBS="-lssl $LIBS"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if libssl needs -lcrypt32" >&5
	$as_echo_n "checking if libssl needs -lcrypt32... " >&6; }
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char HMAC_Update ();
	int
	main ()
	{
	return HMAC_Update ();
	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	LIBS="$BAKLIBS"

	else

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	LIBS="$BAKLIBS"
	LIBS="$LIBS -lcrypt32"

	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for LibreSSL" >&5
	$as_echo_n "checking for LibreSSL... " >&6; }
	if grep VERSION_TEXT $ssldir/include/openssl/opensslv.h \| grep "LibreSSL" >/dev/null; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }

	$as_echo "#define HAVE_LIBRESSL 1" >>confdefs.h

	# libressl provides these compat functions, but they may also be
	# declared by the OS in libc. See if they have been declared.
	ac_fn_c_check_decl "$LINENO" "strlcpy" "ac_cv_have_decl_strlcpy" "$ac_includes_default"
	if test "x$ac_cv_have_decl_strlcpy" = xyes; then :
	ac_have_decl=1
	else
	ac_have_decl=0
	fi

	cat >>confdefs.h <<_ACEOF
	#define HAVE_DECL_STRLCPY $ac_have_decl
	_ACEOF
	ac_fn_c_check_decl "$LINENO" "strlcat" "ac_cv_have_decl_strlcat" "$ac_includes_default"
	if test "x$ac_cv_have_decl_strlcat" = xyes; then :
	ac_have_decl=1
	else
	ac_have_decl=0
	fi

	cat >>confdefs.h <<_ACEOF
	#define HAVE_DECL_STRLCAT $ac_have_decl
	_ACEOF
	ac_fn_c_check_decl "$LINENO" "arc4random" "ac_cv_have_decl_arc4random" "$ac_includes_default"
	if test "x$ac_cv_have_decl_arc4random" = xyes; then :
	ac_have_decl=1
	else
	ac_have_decl=0
	fi

	cat >>confdefs.h <<_ACEOF
	#define HAVE_DECL_ARC4RANDOM $ac_have_decl
	_ACEOF
	ac_fn_c_check_decl "$LINENO" "arc4random_uniform" "ac_cv_have_decl_arc4random_uniform" "$ac_includes_default"
	if test "x$ac_cv_have_decl_arc4random_uniform" = xyes; then :
	ac_have_decl=1
	else
	ac_have_decl=0
	fi

	cat >>confdefs.h <<_ACEOF
	#define HAVE_DECL_ARC4RANDOM_UNIFORM $ac_have_decl
	_ACEOF
	ac_fn_c_check_decl "$LINENO" "reallocarray" "ac_cv_have_decl_reallocarray" "$ac_includes_default"
	if test "x$ac_cv_have_decl_reallocarray" = xyes; then :
	ac_have_decl=1
	else
	ac_have_decl=0
	fi

	cat >>confdefs.h <<_ACEOF
	#define HAVE_DECL_REALLOCARRAY $ac_have_decl
	_ACEOF

	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi
	for ac_header in openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h
	do :
	as_ac_Header=`$as_echo "ac_cv_header_$ac_header" \| $as_tr_sh`
	ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
	"
	if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
	cat >>confdefs.h <<_ACEOF
	#define `$as_echo "HAVE_$ac_header" \| $as_tr_cpp` 1
	_ACEOF

	fi

	done

	-for ac_func in OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify
	+for ac_func in OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify SSL_CTX_set_tlsext_ticket_key_cb EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback
	do :
	as_ac_var=`$as_echo "ac_cv_func_$ac_func" \| $as_tr_sh`
	ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
	if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
	cat >>confdefs.h <<_ACEOF
	#define `$as_echo "HAVE_$ac_func" \| $as_tr_cpp` 1
	_ACEOF

	fi
	done


	# these check_funcs need -lssl
	BAKLIBS="$LIBS"
	LIBS="-lssl $LIBS"
	-for ac_func in OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername
	+for ac_func in OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername X509_VERIFY_PARAM_set1_host SSL_CTX_set_ciphersuites
	do :
	as_ac_var=`$as_echo "ac_cv_func_$ac_func" \| $as_tr_sh`
	ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
	if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
	cat >>confdefs.h <<_ACEOF
	#define `$as_echo "HAVE_$ac_func" \| $as_tr_cpp` 1
	_ACEOF

	fi
	done

	LIBS="$BAKLIBS"

	ac_fn_c_check_decl "$LINENO" "SSL_COMP_get_compression_methods" "ac_cv_have_decl_SSL_COMP_get_compression_methods" "
	$ac_includes_default
	#ifdef HAVE_OPENSSL_ERR_H
	#include <openssl/err.h>
	#endif

	#ifdef HAVE_OPENSSL_RAND_H
	#include <openssl/rand.h>
	#endif

	#ifdef HAVE_OPENSSL_CONF_H
	#include <openssl/conf.h>
	#endif

	#ifdef HAVE_OPENSSL_ENGINE_H
	#include <openssl/engine.h>
	#endif
	#include <openssl/ssl.h>
	#include <openssl/evp.h>

	"
	if test "x$ac_cv_have_decl_SSL_COMP_get_compression_methods" = xyes; then :
	ac_have_decl=1
	else
	ac_have_decl=0
	fi

	cat >>confdefs.h <<_ACEOF
	#define HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS $ac_have_decl
	_ACEOF
	ac_fn_c_check_decl "$LINENO" "sk_SSL_COMP_pop_free" "ac_cv_have_decl_sk_SSL_COMP_pop_free" "
	$ac_includes_default
	#ifdef HAVE_OPENSSL_ERR_H
	#include <openssl/err.h>
	#endif

	#ifdef HAVE_OPENSSL_RAND_H
	#include <openssl/rand.h>
	#endif

	#ifdef HAVE_OPENSSL_CONF_H
	#include <openssl/conf.h>
	#endif

	#ifdef HAVE_OPENSSL_ENGINE_H
	#include <openssl/engine.h>
	#endif
	#include <openssl/ssl.h>
	#include <openssl/evp.h>

	"
	if test "x$ac_cv_have_decl_sk_SSL_COMP_pop_free" = xyes; then :
	ac_have_decl=1
	else
	ac_have_decl=0
	fi

	cat >>confdefs.h <<_ACEOF
	#define HAVE_DECL_SK_SSL_COMP_POP_FREE $ac_have_decl
	_ACEOF
	ac_fn_c_check_decl "$LINENO" "SSL_CTX_set_ecdh_auto" "ac_cv_have_decl_SSL_CTX_set_ecdh_auto" "
	$ac_includes_default
	#ifdef HAVE_OPENSSL_ERR_H
	#include <openssl/err.h>
	#endif

	#ifdef HAVE_OPENSSL_RAND_H
	#include <openssl/rand.h>
	#endif

	#ifdef HAVE_OPENSSL_CONF_H
	#include <openssl/conf.h>
	#endif

	#ifdef HAVE_OPENSSL_ENGINE_H
	#include <openssl/engine.h>
	#endif
	#include <openssl/ssl.h>
	#include <openssl/evp.h>

	"
	if test "x$ac_cv_have_decl_SSL_CTX_set_ecdh_auto" = xyes; then :
	ac_have_decl=1
	else
	ac_have_decl=0
	fi

	cat >>confdefs.h <<_ACEOF
	#define HAVE_DECL_SSL_CTX_SET_ECDH_AUTO $ac_have_decl
	_ACEOF

	fi



	# Check whether --enable-sha1 was given.
	if test "${enable_sha1+set}" = set; then :
	enableval=$enable_sha1;
	fi

	case "$enable_sha1" in
	no)
	;;
	yes\|*)

	$as_echo "#define USE_SHA1 1" >>confdefs.h

	;;
	esac


	# Check whether --enable-sha2 was given.
	if test "${enable_sha2+set}" = set; then :
	enableval=$enable_sha2;
	fi

	case "$enable_sha2" in
	no)
	;;
	yes\|*)

	$as_echo "#define USE_SHA2 1" >>confdefs.h

	;;
	esac

	# Check whether --enable-subnet was given.
	if test "${enable_subnet+set}" = set; then :
	enableval=$enable_subnet;
	fi

	case "$enable_subnet" in
	yes)

	$as_echo "#define CLIENT_SUBNET 1" >>confdefs.h

	SUBNET_OBJ="edns-subnet.lo subnetmod.lo addrtree.lo subnet-whitelist.lo"

	SUBNET_HEADER='$(srcdir)/edns-subnet/subnetmod.h $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/edns-subnet/subnet-whitelist.h $(srcdir)/edns-subnet/addrtree.h'

	;;
	no\|*)
	;;
	esac

	# check wether gost also works

	# Check whether --enable-gost was given.
	if test "${enable_gost+set}" = set; then :
	enableval=$enable_gost;
	fi

	use_gost="no"
	if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
	case "$enable_gost" in
	no)
	;;
	*)
	ac_fn_c_check_func "$LINENO" "EVP_PKEY_set_type_str" "ac_cv_func_EVP_PKEY_set_type_str"
	if test "x$ac_cv_func_EVP_PKEY_set_type_str" = xyes; then :
	:
	else
	as_fn_error $? "OpenSSL 1.0.0 is needed for GOST support" "$LINENO" 5
	fi

	ac_fn_c_check_func "$LINENO" "EC_KEY_new" "ac_cv_func_EC_KEY_new"
	if test "x$ac_cv_func_EC_KEY_new" = xyes; then :

	else
	as_fn_error $? "OpenSSL does not support ECC, needed for GOST support" "$LINENO" 5
	fi


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if GOST works" >&5
	$as_echo_n "checking if GOST works... " >&6; }
	if test c${cross_compiling} = cno; then
	BAKCFLAGS="$CFLAGS"
	if test -n "$ssldir"; then
	CFLAGS="$CFLAGS -Wl,-rpath,$ssldir/lib"
	fi
	if test "$cross_compiling" = yes; then :
	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
	$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
	as_fn_error $? "cannot run test program while cross compiling
	See \`config.log' for more details" "$LINENO" 5; }
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	#include <string.h>
	#include <openssl/ssl.h>
	#include <openssl/evp.h>
	#include <openssl/engine.h>
	#include <openssl/conf.h>
	/* routine to load gost (from sldns) */
	int load_gost_id(void)
	{
	static int gost_id = 0;
	const EVP_PKEY_ASN1_METHOD* meth;
	ENGINE* e;

	if(gost_id) return gost_id;

	/* see if configuration loaded gost implementation from other engine*/
	meth = EVP_PKEY_asn1_find_str(NULL, "gost2001", -1);
	if(meth) {
	EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
	return gost_id;
	}

	/* see if engine can be loaded already */
	e = ENGINE_by_id("gost");
	if(!e) {
	/* load it ourself, in case statically linked */
	ENGINE_load_builtin_engines();
	ENGINE_load_dynamic();
	e = ENGINE_by_id("gost");
	}
	if(!e) {
	/* no gost engine in openssl */
	return 0;
	}
	if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
	ENGINE_finish(e);
	ENGINE_free(e);
	return 0;
	}

	meth = EVP_PKEY_asn1_find_str(&e, "gost2001", -1);
	if(!meth) {
	/* algo not found */
	ENGINE_finish(e);
	ENGINE_free(e);
	return 0;
	}
	EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
	return gost_id;
	}
	int main(void) {
	EVP_MD_CTX* ctx;
	const EVP_MD* md;
	unsigned char digest[64]; /* its a 256-bit digest, so uses 32 bytes */
	const char* str = "Hello world";
	const unsigned char check[] = {
	0x40 , 0xed , 0xf8 , 0x56 , 0x5a , 0xc5 , 0x36 , 0xe1 ,
	0x33 , 0x7c , 0x7e , 0x87 , 0x62 , 0x1c , 0x42 , 0xe0 ,
	0x17 , 0x1b , 0x5e , 0xce , 0xa8 , 0x46 , 0x65 , 0x4d ,
	0x8d , 0x3e , 0x22 , 0x9b , 0xe1 , 0x30 , 0x19 , 0x9d
	};
	OPENSSL_config(NULL);
	(void)load_gost_id();
	md = EVP_get_digestbyname("md_gost94");
	if(!md) return 1;
	memset(digest, 0, sizeof(digest));
	ctx = EVP_MD_CTX_create();
	if(!ctx) return 2;
	if(!EVP_DigestInit_ex(ctx, md, NULL)) return 3;
	if(!EVP_DigestUpdate(ctx, str, 10)) return 4;
	if(!EVP_DigestFinal_ex(ctx, digest, NULL)) return 5;
	/* uncomment to see the hash calculated.
	{int i;
	for(i=0; i<32; i++)
	printf(" %2.2x", (int)digest[i]);
	printf("\n");}
	*/
	if(memcmp(digest, check, sizeof(check)) != 0)
	return 6;
	return 0;
	}

	_ACEOF
	if ac_fn_c_try_run "$LINENO"; then :
	eval "ac_cv_c_gost_works=yes"
	else
	eval "ac_cv_c_gost_works=no"
	fi
	rm -f core .core core.conftest. gmon.out bb.out conftest$ac_exeext \
	conftest.$ac_objext conftest.beam conftest.$ac_ext
	fi

	CFLAGS="$BAKCFLAGS"
	else
	eval "ac_cv_c_gost_works=maybe"
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_gost_works" >&5
	$as_echo "$ac_cv_c_gost_works" >&6; }

	if test "$ac_cv_c_gost_works" != no; then
	use_gost="yes"

	$as_echo "#define USE_GOST 1" >>confdefs.h

	fi
	;;
	esac
	fi
	# Check whether --enable-ecdsa was given.
	if test "${enable_ecdsa+set}" = set; then :
	enableval=$enable_ecdsa;
	fi

	use_ecdsa="no"
	case "$enable_ecdsa" in
	no)
	;;
	*)
	if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
	ac_fn_c_check_func "$LINENO" "ECDSA_sign" "ac_cv_func_ECDSA_sign"
	if test "x$ac_cv_func_ECDSA_sign" = xyes; then :

	else
	as_fn_error $? "OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa" "$LINENO" 5
	fi

	ac_fn_c_check_func "$LINENO" "SHA384_Init" "ac_cv_func_SHA384_Init"
	if test "x$ac_cv_func_SHA384_Init" = xyes; then :

	else
	as_fn_error $? "OpenSSL does not support SHA384: please upgrade or rerun with --disable-ecdsa" "$LINENO" 5
	fi

	ac_fn_c_check_decl "$LINENO" "NID_X9_62_prime256v1" "ac_cv_have_decl_NID_X9_62_prime256v1" "$ac_includes_default
	#include <openssl/evp.h>

	"
	if test "x$ac_cv_have_decl_NID_X9_62_prime256v1" = xyes; then :
	ac_have_decl=1
	else
	ac_have_decl=0
	fi

	cat >>confdefs.h <<_ACEOF
	#define HAVE_DECL_NID_X9_62_PRIME256V1 $ac_have_decl
	_ACEOF
	if test $ac_have_decl = 1; then :

	else
	as_fn_error $? "OpenSSL does not support the ECDSA curves: please upgrade or rerun with --disable-ecdsa" "$LINENO" 5
	fi
	ac_fn_c_check_decl "$LINENO" "NID_secp384r1" "ac_cv_have_decl_NID_secp384r1" "$ac_includes_default
	#include <openssl/evp.h>

	"
	if test "x$ac_cv_have_decl_NID_secp384r1" = xyes; then :
	ac_have_decl=1
	else
	ac_have_decl=0
	fi

	cat >>confdefs.h <<_ACEOF
	#define HAVE_DECL_NID_SECP384R1 $ac_have_decl
	_ACEOF
	if test $ac_have_decl = 1; then :

	else
	as_fn_error $? "OpenSSL does not support the ECDSA curves: please upgrade or rerun with --disable-ecdsa" "$LINENO" 5
	fi

	# see if OPENSSL 1.0.0 or later (has EVP MD and Verify independency)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if openssl supports SHA2 and ECDSA with EVP" >&5
	$as_echo_n "checking if openssl supports SHA2 and ECDSA with EVP... " >&6; }
	if grep OPENSSL_VERSION_TEXT $ssldir/include/openssl/opensslv.h \| grep "OpenSSL" >/dev/null; then
	if grep OPENSSL_VERSION_NUMBER $ssldir/include/openssl/opensslv.h \| grep 0x0 >/dev/null; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }

	cat >>confdefs.h <<_ACEOF
	#define USE_ECDSA_EVP_WORKAROUND 1
	_ACEOF

	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	fi
	else
	# not OpenSSL, thus likely LibreSSL, which supports it
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	fi
	fi
	# we now know we have ECDSA and the required curves.

	cat >>confdefs.h <<_ACEOF
	#define USE_ECDSA 1
	_ACEOF

	use_ecdsa="yes"
	;;
	esac

	# Check whether --enable-dsa was given.
	if test "${enable_dsa+set}" = set; then :
	enableval=$enable_dsa;
	fi

	use_dsa="no"
	case "$enable_dsa" in
	no)
	;;
	*)
	# detect if DSA is supported, and turn it off if not.
	if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
	ac_fn_c_check_func "$LINENO" "DSA_SIG_new" "ac_cv_func_DSA_SIG_new"
	if test "x$ac_cv_func_DSA_SIG_new" = xyes; then :

	as_ac_Type=`$as_echo "ac_cv_type_DSA_SIG*" \| $as_tr_sh`
	ac_fn_c_check_type "$LINENO" "DSA_SIG*" "$as_ac_Type" "
	$ac_includes_default
	#ifdef HAVE_OPENSSL_ERR_H
	#include <openssl/err.h>
	#endif

	#ifdef HAVE_OPENSSL_RAND_H
	#include <openssl/rand.h>
	#endif

	#ifdef HAVE_OPENSSL_CONF_H
	#include <openssl/conf.h>
	#endif

	#ifdef HAVE_OPENSSL_ENGINE_H
	#include <openssl/engine.h>
	#endif

	"
	if eval test \"x\$"$as_ac_Type"\" = x"yes"; then :


	cat >>confdefs.h <<_ACEOF
	#define USE_DSA 1
	_ACEOF


	else
	if test "x$enable_dsa" = "xyes"; then as_fn_error $? "OpenSSL does not support DSA and you used --enable-dsa." "$LINENO" 5
	fi
	fi


	else
	if test "x$enable_dsa" = "xyes"; then as_fn_error $? "OpenSSL does not support DSA and you used --enable-dsa." "$LINENO" 5
	fi
	fi

	else

	cat >>confdefs.h <<_ACEOF
	#define USE_DSA 1
	_ACEOF

	fi
	;;
	esac

	# Check whether --enable-ed25519 was given.
	if test "${enable_ed25519+set}" = set; then :
	enableval=$enable_ed25519;
	fi

	use_ed25519="no"
	case "$enable_ed25519" in
	no)
	;;
	*)
	if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
	ac_fn_c_check_decl "$LINENO" "NID_ED25519" "ac_cv_have_decl_NID_ED25519" "$ac_includes_default
	#include <openssl/evp.h>

	"
	if test "x$ac_cv_have_decl_NID_ED25519" = xyes; then :
	ac_have_decl=1
	else
	ac_have_decl=0
	fi

	cat >>confdefs.h <<_ACEOF
	#define HAVE_DECL_NID_ED25519 $ac_have_decl
	_ACEOF
	if test $ac_have_decl = 1; then :

	use_ed25519="yes"

	else
	if test "x$enable_ed25519" = "xyes"; then as_fn_error $? "OpenSSL does not support ED25519 and you used --enable-ed25519." "$LINENO" 5
	fi
	fi

	fi
	if test $USE_NETTLE = "yes"; then
	for ac_header in nettle/eddsa.h
	do :
	ac_fn_c_check_header_compile "$LINENO" "nettle/eddsa.h" "ac_cv_header_nettle_eddsa_h" "$ac_includes_default
	"
	if test "x$ac_cv_header_nettle_eddsa_h" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_NETTLE_EDDSA_H 1
	_ACEOF
	use_ed25519="yes"
	fi

	done

	fi
	if test $use_ed25519 = "yes"; then

	cat >>confdefs.h <<_ACEOF
	#define USE_ED25519 1
	_ACEOF

	fi
	;;
	esac

	# Check whether --enable-ed448 was given.
	if test "${enable_ed448+set}" = set; then :
	enableval=$enable_ed448;
	fi

	use_ed448="no"
	case "$enable_ed448" in
	no)
	;;
	*)
	if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
	ac_fn_c_check_decl "$LINENO" "NID_ED448" "ac_cv_have_decl_NID_ED448" "$ac_includes_default
	#include <openssl/evp.h>

	"
	if test "x$ac_cv_have_decl_NID_ED448" = xyes; then :
	ac_have_decl=1
	else
	ac_have_decl=0
	fi

	cat >>confdefs.h <<_ACEOF
	#define HAVE_DECL_NID_ED448 $ac_have_decl
	_ACEOF
	if test $ac_have_decl = 1; then :

	use_ed448="yes"

	else
	if test "x$enable_ed448" = "xyes"; then as_fn_error $? "OpenSSL does not support ED448 and you used --enable-ed448." "$LINENO" 5
	fi
	fi

	fi
	if test $use_ed448 = "yes"; then

	cat >>confdefs.h <<_ACEOF
	#define USE_ED448 1
	_ACEOF

	fi
	;;
	esac

	# Check whether --enable-event-api was given.
	if test "${enable_event_api+set}" = set; then :
	enableval=$enable_event_api;
	fi

	case "$enable_event_api" in
	yes)
	UNBOUND_EVENT_INSTALL=unbound-event-install

	UNBOUND_EVENT_UNINSTALL=unbound-event-uninstall

	;;
	*)
	;;
	esac

	# Check whether --enable-tfo-client was given.
	if test "${enable_tfo_client+set}" = set; then :
	enableval=$enable_tfo_client;
	fi

	case "$enable_tfo_client" in
	yes)
	case `uname` in
	Linux) ac_fn_c_check_decl "$LINENO" "MSG_FASTOPEN" "ac_cv_have_decl_MSG_FASTOPEN" "$ac_includes_default
	#include <netinet/tcp.h>

	"
	if test "x$ac_cv_have_decl_MSG_FASTOPEN" = xyes; then :
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Check the platform specific TFO kernel parameters are correctly configured to support client mode TFO" >&5
	$as_echo "$as_me: WARNING: Check the platform specific TFO kernel parameters are correctly configured to support client mode TFO" >&2;}
	else
	as_fn_error $? "TCP Fast Open is not available for client mode: please rerun without --enable-tfo-client" "$LINENO" 5
	fi


	cat >>confdefs.h <<_ACEOF
	#define USE_MSG_FASTOPEN 1
	_ACEOF

	;;
	Darwin) ac_fn_c_check_decl "$LINENO" "CONNECT_RESUME_ON_READ_WRITE" "ac_cv_have_decl_CONNECT_RESUME_ON_READ_WRITE" "$ac_includes_default
	#include <sys/socket.h>

	"
	if test "x$ac_cv_have_decl_CONNECT_RESUME_ON_READ_WRITE" = xyes; then :
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Check the platform specific TFO kernel parameters are correctly configured to support client mode TFO" >&5
	$as_echo "$as_me: WARNING: Check the platform specific TFO kernel parameters are correctly configured to support client mode TFO" >&2;}
	else
	as_fn_error $? "TCP Fast Open is not available for client mode: please rerun without --enable-tfo-client" "$LINENO" 5
	fi


	cat >>confdefs.h <<_ACEOF
	#define USE_OSX_MSG_FASTOPEN 1
	_ACEOF

	;;
	esac
	;;
	no\|*)
	;;
	esac

	# Check whether --enable-tfo-server was given.
	if test "${enable_tfo_server+set}" = set; then :
	enableval=$enable_tfo_server;
	fi

	case "$enable_tfo_server" in
	yes)
	ac_fn_c_check_decl "$LINENO" "TCP_FASTOPEN" "ac_cv_have_decl_TCP_FASTOPEN" "$ac_includes_default
	#include <netinet/tcp.h>

	"
	if test "x$ac_cv_have_decl_TCP_FASTOPEN" = xyes; then :
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Check the platform specific TFO kernel parameters are correctly configured to support server mode TFO" >&5
	$as_echo "$as_me: WARNING: Check the platform specific TFO kernel parameters are correctly configured to support server mode TFO" >&2;}
	else
	as_fn_error $? "TCP Fast Open is not available for server mode: please rerun without --enable-tfo-server" "$LINENO" 5
	fi


	cat >>confdefs.h <<_ACEOF
	#define USE_TCP_FASTOPEN 1
	_ACEOF

	;;
	no\|*)
	;;
	esac

	# check for libevent

	# Check whether --with-libevent was given.
	if test "${with_libevent+set}" = set; then :
	withval=$with_libevent;
	else
	withval="no"
	fi

	if test x_$withval = x_yes -o x_$withval != x_no; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for libevent" >&5
	$as_echo_n "checking for libevent... " >&6; }
	if test x_$withval = x_ -o x_$withval = x_yes; then
	withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
	fi
	for dir in $withval; do
	thedir="$dir"
	if test -f "$dir/include/event.h" -o -f "$dir/include/event2/event.h"; then
	found_libevent="yes"
	if test "$thedir" != "/usr"; then
	CPPFLAGS="$CPPFLAGS -I$thedir/include"
	fi
	break;
	fi
	done
	if test x_$found_libevent != x_yes; then
	if test -f "$dir/event.h" -a $ -f "$dir/libevent.la" -o -f "$dir/libev.la" $ ; then
	# libevent source directory
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found in $thedir" >&5
	$as_echo "found in $thedir" >&6; }
	CPPFLAGS="$CPPFLAGS -I$thedir -I$thedir/include"
	BAK_LDFLAGS_SET="1"
	BAK_LDFLAGS="$LDFLAGS"
	# remove evdns from linking
	mkdir build >/dev/null 2>&1
	mkdir build/libevent >/dev/null 2>&1
	mkdir build/libevent/.libs >/dev/null 2>&1
	ev_files_o=`ls $thedir/*.o \| grep -v evdns\.o \| grep -v bufferevent_openssl\.o`
	ev_files_lo=`ls $thedir/*.lo \| grep -v evdns\.lo \| grep -v bufferevent_openssl\.lo`
	ev_files_libso=`ls $thedir/.libs/*.o \| grep -v evdns\.o \| grep -v bufferevent_openssl\.o`
	cp $ev_files_o build/libevent
	cp $ev_files_lo build/libevent
	cp $ev_files_libso build/libevent/.libs
	LATE_LDFLAGS="build/libevent/*.lo -lm"
	LDFLAGS="build/libevent/*.o $LDFLAGS -lm"
	else
	as_fn_error $? "Cannot find the libevent library in $withval
	You can restart ./configure --with-libevent=no to use a builtin alternative.
	Please note that this alternative is not as capable as libevent when using
	large outgoing port ranges. " "$LINENO" 5
	fi
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found in $thedir" >&5
	$as_echo "found in $thedir" >&6; }
	if test ! -f $thedir/lib/libevent.a -a ! -f $thedir/lib/libevent.so -a -d "$thedir/lib/event2"; then
	LDFLAGS="$LDFLAGS -L$thedir/lib/event2"

	if test "x$enable_rpath" = xyes; then
	if echo "$thedir/lib/event2" \| grep "^/" >/dev/null; then
	RUNTIME_PATH="$RUNTIME_PATH -R$thedir/lib/event2"
	fi
	fi

	else
	if test "$thedir" != "/usr" -a "$thedir" != ""; then
	LDFLAGS="$LDFLAGS -L$thedir/lib"

	if test "x$enable_rpath" = xyes; then
	if echo "$thedir/lib" \| grep "^/" >/dev/null; then
	RUNTIME_PATH="$RUNTIME_PATH -R$thedir/lib"
	fi
	fi

	fi
	fi
	fi
	# check for library used by libevent after 1.3c
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing clock_gettime" >&5
	$as_echo_n "checking for library containing clock_gettime... " >&6; }
	if ${ac_cv_search_clock_gettime+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_func_search_save_LIBS=$LIBS
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char clock_gettime ();
	int
	main ()
	{
	return clock_gettime ();
	;
	return 0;
	}
	_ACEOF
	for ac_lib in '' rt; do
	if test -z "$ac_lib"; then
	ac_res="none required"
	else
	ac_res=-l$ac_lib
	LIBS="-l$ac_lib $ac_func_search_save_LIBS"
	fi
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_search_clock_gettime=$ac_res
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext
	if ${ac_cv_search_clock_gettime+:} false; then :
	break
	fi
	done
	if ${ac_cv_search_clock_gettime+:} false; then :

	else
	ac_cv_search_clock_gettime=no
	fi
	rm conftest.$ac_ext
	LIBS=$ac_func_search_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_clock_gettime" >&5
	$as_echo "$ac_cv_search_clock_gettime" >&6; }
	ac_res=$ac_cv_search_clock_gettime
	if test "$ac_res" != no; then :
	test "$ac_res" = "none required" \|\| LIBS="$ac_res $LIBS"

	fi


	# is the event.h header libev or libevent?
	for ac_header in event.h
	do :
	ac_fn_c_check_header_compile "$LINENO" "event.h" "ac_cv_header_event_h" "$ac_includes_default
	"
	if test "x$ac_cv_header_event_h" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_EVENT_H 1
	_ACEOF

	fi

	done

	ac_fn_c_check_decl "$LINENO" "EV_VERSION_MAJOR" "ac_cv_have_decl_EV_VERSION_MAJOR" "$ac_includes_default
	#include <event.h>

	"
	if test "x$ac_cv_have_decl_EV_VERSION_MAJOR" = xyes; then :

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing event_set" >&5
	$as_echo_n "checking for library containing event_set... " >&6; }
	if ${ac_cv_search_event_set+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_func_search_save_LIBS=$LIBS
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char event_set ();
	int
	main ()
	{
	return event_set ();
	;
	return 0;
	}
	_ACEOF
	for ac_lib in '' ev; do
	if test -z "$ac_lib"; then
	ac_res="none required"
	else
	ac_res=-l$ac_lib
	LIBS="-l$ac_lib $ac_func_search_save_LIBS"
	fi
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_search_event_set=$ac_res
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext
	if ${ac_cv_search_event_set+:} false; then :
	break
	fi
	done
	if ${ac_cv_search_event_set+:} false; then :

	else
	ac_cv_search_event_set=no
	fi
	rm conftest.$ac_ext
	LIBS=$ac_func_search_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_event_set" >&5
	$as_echo "$ac_cv_search_event_set" >&6; }
	ac_res=$ac_cv_search_event_set
	if test "$ac_res" != no; then :
	test "$ac_res" = "none required" \|\| LIBS="$ac_res $LIBS"

	fi


	else

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing event_set" >&5
	$as_echo_n "checking for library containing event_set... " >&6; }
	if ${ac_cv_search_event_set+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_func_search_save_LIBS=$LIBS
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char event_set ();
	int
	main ()
	{
	return event_set ();
	;
	return 0;
	}
	_ACEOF
	for ac_lib in '' event; do
	if test -z "$ac_lib"; then
	ac_res="none required"
	else
	ac_res=-l$ac_lib
	LIBS="-l$ac_lib $ac_func_search_save_LIBS"
	fi
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_search_event_set=$ac_res
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext
	if ${ac_cv_search_event_set+:} false; then :
	break
	fi
	done
	if ${ac_cv_search_event_set+:} false; then :

	else
	ac_cv_search_event_set=no
	fi
	rm conftest.$ac_ext
	LIBS=$ac_func_search_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_event_set" >&5
	$as_echo "$ac_cv_search_event_set" >&6; }
	ac_res=$ac_cv_search_event_set
	if test "$ac_res" != no; then :
	test "$ac_res" = "none required" \|\| LIBS="$ac_res $LIBS"

	fi


	fi

	for ac_func in event_base_free
	do :
	ac_fn_c_check_func "$LINENO" "event_base_free" "ac_cv_func_event_base_free"
	if test "x$ac_cv_func_event_base_free" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_EVENT_BASE_FREE 1
	_ACEOF

	fi
	done
	# only in libevent 1.2 and later
	for ac_func in event_base_once
	do :
	ac_fn_c_check_func "$LINENO" "event_base_once" "ac_cv_func_event_base_once"
	if test "x$ac_cv_func_event_base_once" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_EVENT_BASE_ONCE 1
	_ACEOF

	fi
	done
	# only in libevent 1.4.1 and later
	for ac_func in event_base_new
	do :
	ac_fn_c_check_func "$LINENO" "event_base_new" "ac_cv_func_event_base_new"
	if test "x$ac_cv_func_event_base_new" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_EVENT_BASE_NEW 1
	_ACEOF

	fi
	done
	# only in libevent 1.4.1 and later
	for ac_func in event_base_get_method
	do :
	ac_fn_c_check_func "$LINENO" "event_base_get_method" "ac_cv_func_event_base_get_method"
	if test "x$ac_cv_func_event_base_get_method" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_EVENT_BASE_GET_METHOD 1
	_ACEOF

	fi
	done
	# only in libevent 1.4.3 and later
	for ac_func in ev_loop
	do :
	ac_fn_c_check_func "$LINENO" "ev_loop" "ac_cv_func_ev_loop"
	if test "x$ac_cv_func_ev_loop" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_EV_LOOP 1
	_ACEOF

	fi
	done
	# only in libev. (tested on 3.51)
	for ac_func in ev_default_loop
	do :
	ac_fn_c_check_func "$LINENO" "ev_default_loop" "ac_cv_func_ev_default_loop"
	if test "x$ac_cv_func_ev_default_loop" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_EV_DEFAULT_LOOP 1
	_ACEOF

	fi
	done
	# only in libev. (tested on 4.00)
	+ for ac_func in event_assign
	+do :
	+ ac_fn_c_check_func "$LINENO" "event_assign" "ac_cv_func_event_assign"
	+if test "x$ac_cv_func_event_assign" = xyes; then :
	+ cat >>confdefs.h <<_ACEOF
	+#define HAVE_EVENT_ASSIGN 1
	+_ACEOF
	+
	+fi
	+done
	+ # in libevent, for thread-safety
	+ ac_fn_c_check_decl "$LINENO" "evsignal_assign" "ac_cv_have_decl_evsignal_assign" "$ac_includes_default
	+#ifdef HAVE_EVENT_H
	+# include <event.h>
	+#else
	+# include \"event2/event.h\"
	+#endif
	+
	+"
	+if test "x$ac_cv_have_decl_evsignal_assign" = xyes; then :
	+ ac_have_decl=1
	+else
	+ ac_have_decl=0
	+fi
	+
	+cat >>confdefs.h <<_ACEOF
	+#define HAVE_DECL_EVSIGNAL_ASSIGN $ac_have_decl
	+_ACEOF
	+
	PC_LIBEVENT_DEPENDENCY="libevent"

	if test -n "$BAK_LDFLAGS_SET"; then
	LDFLAGS="$BAK_LDFLAGS"
	fi
	else

	$as_echo "#define USE_MINI_EVENT 1" >>confdefs.h

	fi

	# check for libexpat

	# Check whether --with-libexpat was given.
	if test "${with_libexpat+set}" = set; then :
	withval=$with_libexpat;
	else
	withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for libexpat" >&5
	$as_echo_n "checking for libexpat... " >&6; }
	found_libexpat="no"
	for dir in $withval ; do
	if test -f "$dir/include/expat.h"; then
	found_libexpat="yes"
	if test "$dir" != "/usr"; then
	CPPFLAGS="$CPPFLAGS -I$dir/include"
	LDFLAGS="$LDFLAGS -L$dir/lib"
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found in $dir" >&5
	$as_echo "found in $dir" >&6; }
	break;
	fi
	done
	if test x_$found_libexpat != x_yes; then
	as_fn_error $? "Could not find libexpat, expat.h" "$LINENO" 5
	fi
	for ac_header in expat.h
	do :
	ac_fn_c_check_header_compile "$LINENO" "expat.h" "ac_cv_header_expat_h" "$ac_includes_default
	"
	if test "x$ac_cv_header_expat_h" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_EXPAT_H 1
	_ACEOF

	fi

	done

	ac_fn_c_check_decl "$LINENO" "XML_StopParser" "ac_cv_have_decl_XML_StopParser" "$ac_includes_default
	#include <expat.h>

	"
	if test "x$ac_cv_have_decl_XML_StopParser" = xyes; then :
	ac_have_decl=1
	else
	ac_have_decl=0
	fi

	cat >>confdefs.h <<_ACEOF
	#define HAVE_DECL_XML_STOPPARSER $ac_have_decl
	_ACEOF


	# hiredis (redis C client for cachedb)

	# Check whether --with-libhiredis was given.
	if test "${with_libhiredis+set}" = set; then :
	withval=$with_libhiredis;
	else
	withval="no"
	fi

	found_libhiredis="no"
	if test x_$withval = x_yes -o x_$withval != x_no; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for libhiredis" >&5
	$as_echo_n "checking for libhiredis... " >&6; }
	if test x_$withval = x_ -o x_$withval = x_yes; then
	withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
	fi
	for dir in $withval ; do
	if test -f "$dir/include/hiredis/hiredis.h"; then
	found_libhiredis="yes"
	if test "$dir" != "/usr"; then
	CPPFLAGS="$CPPFLAGS -I$dir/include"
	LDFLAGS="$LDFLAGS -L$dir/lib"
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found in $dir" >&5
	$as_echo "found in $dir" >&6; }

	$as_echo "#define USE_REDIS 1" >>confdefs.h

	LIBS="$LIBS -lhiredis"
	break;
	fi
	done
	if test x_$found_libhiredis != x_yes; then
	as_fn_error $? "Could not find libhiredis, hiredis.h" "$LINENO" 5
	fi
	for ac_header in hiredis/hiredis.h
	do :
	ac_fn_c_check_header_compile "$LINENO" "hiredis/hiredis.h" "ac_cv_header_hiredis_hiredis_h" "$ac_includes_default
	"
	if test "x$ac_cv_header_hiredis_hiredis_h" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_HIREDIS_HIREDIS_H 1
	_ACEOF

	fi

	done

	ac_fn_c_check_decl "$LINENO" "redisConnect" "ac_cv_have_decl_redisConnect" "$ac_includes_default
	#include <hiredis/hiredis.h>

	"
	if test "x$ac_cv_have_decl_redisConnect" = xyes; then :
	ac_have_decl=1
	else
	ac_have_decl=0
	fi

	cat >>confdefs.h <<_ACEOF
	#define HAVE_DECL_REDISCONNECT $ac_have_decl
	_ACEOF

	fi

	# set static linking if requested

	staticexe=""
	# Check whether --enable-static-exe was given.
	if test "${enable_static_exe+set}" = set; then :
	enableval=$enable_static_exe;
	fi

	if test x_$enable_static_exe = x_yes; then
	staticexe="-static"
	if test "$on_mingw" = yes; then
	staticexe="-all-static"
	# for static compile, include gdi32 and zlib here.
	if echo $LIBS \| grep 'lgdi32' >/dev/null; then
	:
	else
	LIBS="$LIBS -lgdi32"
	fi
	LIBS="$LIBS -lz"
	fi
	fi

	# Include systemd.m4 - begin
	# macros for configuring systemd
	# Copyright 2015, Sami Kerola, CloudFlare.
	# BSD licensed.
	# Check whether --enable-systemd was given.
	if test "${enable_systemd+set}" = set; then :
	enableval=$enable_systemd;
	else
	enable_systemd=no
	fi

	have_systemd=no
	if test "x$enable_systemd" != xno; then :



	pkg_failed=no
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SYSTEMD" >&5
	$as_echo_n "checking for SYSTEMD... " >&6; }

	if test -n "$SYSTEMD_CFLAGS"; then
	pkg_cv_SYSTEMD_CFLAGS="$SYSTEMD_CFLAGS"
	elif test -n "$PKG_CONFIG"; then
	if test -n "$PKG_CONFIG" && \
	{ { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libsystemd\""; } >&5
	($PKG_CONFIG --exists --print-errors "libsystemd") 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }; then
	pkg_cv_SYSTEMD_CFLAGS=`$PKG_CONFIG --cflags "libsystemd" 2>/dev/null`
	test "x$?" != "x0" && pkg_failed=yes
	else
	pkg_failed=yes
	fi
	else
	pkg_failed=untried
	fi
	if test -n "$SYSTEMD_LIBS"; then
	pkg_cv_SYSTEMD_LIBS="$SYSTEMD_LIBS"
	elif test -n "$PKG_CONFIG"; then
	if test -n "$PKG_CONFIG" && \
	{ { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libsystemd\""; } >&5
	($PKG_CONFIG --exists --print-errors "libsystemd") 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }; then
	pkg_cv_SYSTEMD_LIBS=`$PKG_CONFIG --libs "libsystemd" 2>/dev/null`
	test "x$?" != "x0" && pkg_failed=yes
	else
	pkg_failed=yes
	fi
	else
	pkg_failed=untried
	fi



	if test $pkg_failed = yes; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }

	if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
	_pkg_short_errors_supported=yes
	else
	_pkg_short_errors_supported=no
	fi
	if test $_pkg_short_errors_supported = yes; then
	SYSTEMD_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libsystemd" 2>&1`
	else
	SYSTEMD_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libsystemd" 2>&1`
	fi
	# Put the nasty error message in config.log where it belongs
	echo "$SYSTEMD_PKG_ERRORS" >&5

	have_systemd=no
	elif test $pkg_failed = untried; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	have_systemd=no
	else
	SYSTEMD_CFLAGS=$pkg_cv_SYSTEMD_CFLAGS
	SYSTEMD_LIBS=$pkg_cv_SYSTEMD_LIBS
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	have_systemd=yes
	fi
	if test "x$have_systemd" != "xyes"; then :


	pkg_failed=no
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SYSTEMD_DAEMON" >&5
	$as_echo_n "checking for SYSTEMD_DAEMON... " >&6; }

	if test -n "$SYSTEMD_DAEMON_CFLAGS"; then
	pkg_cv_SYSTEMD_DAEMON_CFLAGS="$SYSTEMD_DAEMON_CFLAGS"
	elif test -n "$PKG_CONFIG"; then
	if test -n "$PKG_CONFIG" && \
	{ { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libsystemd-daemon\""; } >&5
	($PKG_CONFIG --exists --print-errors "libsystemd-daemon") 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }; then
	pkg_cv_SYSTEMD_DAEMON_CFLAGS=`$PKG_CONFIG --cflags "libsystemd-daemon" 2>/dev/null`
	test "x$?" != "x0" && pkg_failed=yes
	else
	pkg_failed=yes
	fi
	else
	pkg_failed=untried
	fi
	if test -n "$SYSTEMD_DAEMON_LIBS"; then
	pkg_cv_SYSTEMD_DAEMON_LIBS="$SYSTEMD_DAEMON_LIBS"
	elif test -n "$PKG_CONFIG"; then
	if test -n "$PKG_CONFIG" && \
	{ { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libsystemd-daemon\""; } >&5
	($PKG_CONFIG --exists --print-errors "libsystemd-daemon") 2>&5
	ac_status=$?
	$as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
	test $ac_status = 0; }; then
	pkg_cv_SYSTEMD_DAEMON_LIBS=`$PKG_CONFIG --libs "libsystemd-daemon" 2>/dev/null`
	test "x$?" != "x0" && pkg_failed=yes
	else
	pkg_failed=yes
	fi
	else
	pkg_failed=untried
	fi



	if test $pkg_failed = yes; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }

	if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
	_pkg_short_errors_supported=yes
	else
	_pkg_short_errors_supported=no
	fi
	if test $_pkg_short_errors_supported = yes; then
	SYSTEMD_DAEMON_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libsystemd-daemon" 2>&1`
	else
	SYSTEMD_DAEMON_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libsystemd-daemon" 2>&1`
	fi
	# Put the nasty error message in config.log where it belongs
	echo "$SYSTEMD_DAEMON_PKG_ERRORS" >&5

	have_systemd_daemon=no
	elif test $pkg_failed = untried; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	have_systemd_daemon=no
	else
	SYSTEMD_DAEMON_CFLAGS=$pkg_cv_SYSTEMD_DAEMON_CFLAGS
	SYSTEMD_DAEMON_LIBS=$pkg_cv_SYSTEMD_DAEMON_LIBS
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	have_systemd_daemon=yes
	fi
	if test "x$have_systemd_daemon" = "xyes"; then :
	have_systemd=yes
	fi

	fi
	case $enable_systemd:$have_systemd in #(
	yes:no) :
	as_fn_error $? "systemd enabled but libsystemd not found" "$LINENO" 5 ;; #(
	*:yes) :

	$as_echo "#define HAVE_SYSTEMD 1" >>confdefs.h

	LIBS="$LIBS $SYSTEMD_LIBS"

	;; #(
	*) :
	;;
	esac


	fi
	if test "x$have_systemd" = xyes; then
	USE_SYSTEMD_TRUE=
	USE_SYSTEMD_FALSE='#'
	else
	USE_SYSTEMD_TRUE='#'
	USE_SYSTEMD_FALSE=
	fi


	# Include systemd.m4 - end

	# set lock checking if requested
	# Check whether --enable-lock_checks was given.
	if test "${enable_lock_checks+set}" = set; then :
	enableval=$enable_lock_checks;
	fi

	if test x_$enable_lock_checks = x_yes; then

	$as_echo "#define ENABLE_LOCK_CHECKS 1" >>confdefs.h

	CHECKLOCK_OBJ="checklocks.lo"

	fi


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for getaddrinfo" >&5
	$as_echo_n "checking for getaddrinfo... " >&6; }
	ac_cv_func_getaddrinfo=no
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	#ifdef __cplusplus
	extern "C"
	{
	#endif
	char* getaddrinfo();
	char* (*f) () = getaddrinfo;
	#ifdef __cplusplus
	}
	#endif
	int main() {
	;
	return 0;
	}

	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_func_getaddrinfo="yes"
	if test "$ac_cv_header_windows_h" = "yes"; then

	$as_echo "#define USE_WINSOCK 1" >>confdefs.h

	USE_WINSOCK="1"
	if echo $LIBS \| grep 'lws2_32' >/dev/null; then
	:
	else
	LIBS="$LIBS -lws2_32"
	fi
	fi

	else
	ORIGLIBS="$LIBS"
	LIBS="$LIBS -lws2_32"
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	#ifdef HAVE_WS2TCPIP_H
	#include <ws2tcpip.h>
	#endif

	int
	main ()
	{

	(void)getaddrinfo(NULL, NULL, NULL, NULL);


	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :

	ac_cv_func_getaddrinfo="yes"

	$as_echo "#define USE_WINSOCK 1" >>confdefs.h

	USE_WINSOCK="1"

	else

	ac_cv_func_getaddrinfo="no"
	LIBS="$ORIGLIBS"

	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext

	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_getaddrinfo" >&5
	$as_echo "$ac_cv_func_getaddrinfo" >&6; }
	if test $ac_cv_func_getaddrinfo = yes; then

	$as_echo "#define HAVE_GETADDRINFO 1" >>confdefs.h

	fi

	if test "$USE_WINSOCK" = 1; then

	$as_echo "#define UB_ON_WINDOWS 1" >>confdefs.h

	for ac_header in iphlpapi.h
	do :
	ac_fn_c_check_header_compile "$LINENO" "iphlpapi.h" "ac_cv_header_iphlpapi_h" "$ac_includes_default
	#include <windows.h>

	"
	if test "x$ac_cv_header_iphlpapi_h" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_IPHLPAPI_H 1
	_ACEOF

	fi

	done

	if test -n "$ac_tool_prefix"; then
	# Extract the first word of "${ac_tool_prefix}windres", so it can be a program name with args.
	set dummy ${ac_tool_prefix}windres; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_WINDRES+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$WINDRES"; then
	ac_cv_prog_WINDRES="$WINDRES" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_WINDRES="${ac_tool_prefix}windres"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	WINDRES=$ac_cv_prog_WINDRES
	if test -n "$WINDRES"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $WINDRES" >&5
	$as_echo "$WINDRES" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	fi
	if test -z "$ac_cv_prog_WINDRES"; then
	ac_ct_WINDRES=$WINDRES
	# Extract the first word of "windres", so it can be a program name with args.
	set dummy windres; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_prog_ac_ct_WINDRES+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	if test -n "$ac_ct_WINDRES"; then
	ac_cv_prog_ac_ct_WINDRES="$ac_ct_WINDRES" # Let the user override the test.
	else
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_prog_ac_ct_WINDRES="windres"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	fi
	fi
	ac_ct_WINDRES=$ac_cv_prog_ac_ct_WINDRES
	if test -n "$ac_ct_WINDRES"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_WINDRES" >&5
	$as_echo "$ac_ct_WINDRES" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi

	if test "x$ac_ct_WINDRES" = x; then
	WINDRES=""
	else
	case $cross_compiling:$ac_tool_warned in
	yes:)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
	$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
	ac_tool_warned=yes ;;
	esac
	WINDRES=$ac_ct_WINDRES
	fi
	else
	WINDRES="$ac_cv_prog_WINDRES"
	fi

	LIBS="$LIBS -liphlpapi -lcrypt32"
	WINAPPS="unbound-service-install.exe unbound-service-remove.exe anchor-update.exe"

	WIN_DAEMON_SRC="winrc/win_svc.c winrc/w_inst.c"

	WIN_DAEMON_OBJ="win_svc.lo w_inst.lo"

	WIN_DAEMON_OBJ_LINK="rsrc_unbound.o"

	WIN_HOST_OBJ_LINK="rsrc_unbound_host.o"

	WIN_UBANCHOR_OBJ_LINK="rsrc_unbound_anchor.o log.lo locks.lo"

	WIN_CONTROL_OBJ_LINK="rsrc_unbound_control.o"

	WIN_CHECKCONF_OBJ_LINK="rsrc_unbound_checkconf.o"

	fi
	if test $ac_cv_func_getaddrinfo = no; then
	case " $LIBOBJS " in
	" fake-rfc2553.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS fake-rfc2553.$ac_objext"
	;;
	esac

	fi
	# check after getaddrinfo for its libraries

	# check ioctlsocket
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ioctlsocket" >&5
	$as_echo_n "checking for ioctlsocket... " >&6; }
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	#ifdef HAVE_WINSOCK2_H
	#include <winsock2.h>
	#endif

	int
	main ()
	{

	(void)ioctlsocket(0, 0, NULL);

	;
	return 0;
	}
	_ACEOF
	if ac_fn_c_try_link "$LINENO"; then :

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }

	$as_echo "#define HAVE_IOCTLSOCKET 1" >>confdefs.h


	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext conftest.$ac_ext


	# see if daemon(3) exists, and if it is deprecated.
	for ac_func in daemon
	do :
	ac_fn_c_check_func "$LINENO" "daemon" "ac_cv_func_daemon"
	if test "x$ac_cv_func_daemon" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_DAEMON 1
	_ACEOF

	fi
	done

	if test $ac_cv_func_daemon = yes; then


	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if daemon is deprecated" >&5
	$as_echo_n "checking if daemon is deprecated... " >&6; }
	cache=`echo daemon \| sed 'y%.=/+-%___p_%'`
	if eval \${cv_cc_deprecated_$cache+:} false; then :
	$as_echo_n "(cached) " >&6
	else

	echo '
	#include <stdlib.h>
	' >conftest.c
	echo 'void f(){ (void)daemon(0, 0); }' >>conftest.c
	if test -z "`$CC -c conftest.c 2>&1 \| grep deprecated`"; then
	eval "cv_cc_deprecated_$cache=no"
	else
	eval "cv_cc_deprecated_$cache=yes"
	fi
	rm -f conftest conftest.o conftest.c

	fi

	if eval "test \"`echo '$cv_cc_deprecated_'$cache`\" = yes"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }

	cat >>confdefs.h <<_ACEOF
	#define DEPRECATED_DAEMON 1
	_ACEOF

	:

	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	:

	fi

	fi

	ac_fn_c_check_member "$LINENO" "struct sockaddr_un" "sun_len" "ac_cv_member_struct_sockaddr_un_sun_len" "
	$ac_includes_default
	#ifdef HAVE_SYS_UN_H
	#include <sys/un.h>
	#endif

	"
	if test "x$ac_cv_member_struct_sockaddr_un_sun_len" = xyes; then :

	cat >>confdefs.h <<_ACEOF
	#define HAVE_STRUCT_SOCKADDR_UN_SUN_LEN 1
	_ACEOF


	fi

	ac_fn_c_check_member "$LINENO" "struct in_pktinfo" "ipi_spec_dst" "ac_cv_member_struct_in_pktinfo_ipi_spec_dst" "
	$ac_includes_default
	#if HAVE_SYS_PARAM_H
	#include <sys/param.h>
	#endif

	#ifdef HAVE_SYS_SOCKET_H
	#include <sys/socket.h>
	#endif

	#ifdef HAVE_SYS_UIO_H
	#include <sys/uio.h>
	#endif

	#ifdef HAVE_NETINET_IN_H
	#include <netinet/in.h>
	#endif

	#ifdef HAVE_NETINET_TCP_H
	#include <netinet/tcp.h>
	#endif

	#ifdef HAVE_ARPA_INET_H
	#include <arpa/inet.h>
	#endif

	#ifdef HAVE_WINSOCK2_H
	#include <winsock2.h>
	#endif

	#ifdef HAVE_WS2TCPIP_H
	#include <ws2tcpip.h>
	#endif

	"
	if test "x$ac_cv_member_struct_in_pktinfo_ipi_spec_dst" = xyes; then :

	cat >>confdefs.h <<_ACEOF
	#define HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST 1
	_ACEOF


	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing setusercontext" >&5
	$as_echo_n "checking for library containing setusercontext... " >&6; }
	if ${ac_cv_search_setusercontext+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_func_search_save_LIBS=$LIBS
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char setusercontext ();
	int
	main ()
	{
	return setusercontext ();
	;
	return 0;
	}
	_ACEOF
	for ac_lib in '' util; do
	if test -z "$ac_lib"; then
	ac_res="none required"
	else
	ac_res=-l$ac_lib
	LIBS="-l$ac_lib $ac_func_search_save_LIBS"
	fi
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_search_setusercontext=$ac_res
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext
	if ${ac_cv_search_setusercontext+:} false; then :
	break
	fi
	done
	if ${ac_cv_search_setusercontext+:} false; then :

	else
	ac_cv_search_setusercontext=no
	fi
	rm conftest.$ac_ext
	LIBS=$ac_func_search_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_setusercontext" >&5
	$as_echo "$ac_cv_search_setusercontext" >&6; }
	ac_res=$ac_cv_search_setusercontext
	if test "$ac_res" != no; then :
	test "$ac_res" = "none required" \|\| LIBS="$ac_res $LIBS"

	fi

	for ac_func in tzset sigprocmask fcntl getpwnam endpwent getrlimit setrlimit setsid chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync shmget accept4
	do :
	as_ac_var=`$as_echo "ac_cv_func_$ac_func" \| $as_tr_sh`
	ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
	if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
	cat >>confdefs.h <<_ACEOF
	#define `$as_echo "HAVE_$ac_func" \| $as_tr_cpp` 1
	_ACEOF

	fi
	done

	for ac_func in setresuid
	do :
	ac_fn_c_check_func "$LINENO" "setresuid" "ac_cv_func_setresuid"
	if test "x$ac_cv_func_setresuid" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_SETRESUID 1
	_ACEOF

	else
	for ac_func in setreuid
	do :
	ac_fn_c_check_func "$LINENO" "setreuid" "ac_cv_func_setreuid"
	if test "x$ac_cv_func_setreuid" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_SETREUID 1
	_ACEOF

	fi
	done

	fi
	done

	for ac_func in setresgid
	do :
	ac_fn_c_check_func "$LINENO" "setresgid" "ac_cv_func_setresgid"
	if test "x$ac_cv_func_setresgid" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_SETRESGID 1
	_ACEOF

	else
	for ac_func in setregid
	do :
	ac_fn_c_check_func "$LINENO" "setregid" "ac_cv_func_setregid"
	if test "x$ac_cv_func_setregid" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_SETREGID 1
	_ACEOF

	fi
	done

	fi
	done


	# check if setreuid en setregid fail, on MacOSX10.4(darwin8).
	if echo $target_os \| grep darwin8 > /dev/null; then

	$as_echo "#define DARWIN_BROKEN_SETREUID 1" >>confdefs.h

	fi
	ac_fn_c_check_decl "$LINENO" "inet_pton" "ac_cv_have_decl_inet_pton" "
	$ac_includes_default
	#ifdef HAVE_NETINET_IN_H
	#include <netinet/in.h>
	#endif

	#ifdef HAVE_NETINET_TCP_H
	#include <netinet/tcp.h>
	#endif

	#ifdef HAVE_ARPA_INET_H
	#include <arpa/inet.h>
	#endif

	#ifdef HAVE_WINSOCK2_H
	#include <winsock2.h>
	#endif

	#ifdef HAVE_WS2TCPIP_H
	#include <ws2tcpip.h>
	#endif

	"
	if test "x$ac_cv_have_decl_inet_pton" = xyes; then :
	ac_have_decl=1
	else
	ac_have_decl=0
	fi

	cat >>confdefs.h <<_ACEOF
	#define HAVE_DECL_INET_PTON $ac_have_decl
	_ACEOF
	ac_fn_c_check_decl "$LINENO" "inet_ntop" "ac_cv_have_decl_inet_ntop" "
	$ac_includes_default
	#ifdef HAVE_NETINET_IN_H
	#include <netinet/in.h>
	#endif

	#ifdef HAVE_NETINET_TCP_H
	#include <netinet/tcp.h>
	#endif

	#ifdef HAVE_ARPA_INET_H
	#include <arpa/inet.h>
	#endif

	#ifdef HAVE_WINSOCK2_H
	#include <winsock2.h>
	#endif

	#ifdef HAVE_WS2TCPIP_H
	#include <ws2tcpip.h>
	#endif

	"
	if test "x$ac_cv_have_decl_inet_ntop" = xyes; then :
	ac_have_decl=1
	else
	ac_have_decl=0
	fi

	cat >>confdefs.h <<_ACEOF
	#define HAVE_DECL_INET_NTOP $ac_have_decl
	_ACEOF

	ac_fn_c_check_func "$LINENO" "inet_aton" "ac_cv_func_inet_aton"
	if test "x$ac_cv_func_inet_aton" = xyes; then :
	$as_echo "#define HAVE_INET_ATON 1" >>confdefs.h

	else
	case " $LIBOBJS " in
	" inet_aton.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS inet_aton.$ac_objext"
	;;
	esac

	fi


	ac_fn_c_check_func "$LINENO" "inet_pton" "ac_cv_func_inet_pton"
	if test "x$ac_cv_func_inet_pton" = xyes; then :
	$as_echo "#define HAVE_INET_PTON 1" >>confdefs.h

	else
	case " $LIBOBJS " in
	" inet_pton.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS inet_pton.$ac_objext"
	;;
	esac

	fi


	ac_fn_c_check_func "$LINENO" "inet_ntop" "ac_cv_func_inet_ntop"
	if test "x$ac_cv_func_inet_ntop" = xyes; then :
	$as_echo "#define HAVE_INET_NTOP 1" >>confdefs.h

	else
	case " $LIBOBJS " in
	" inet_ntop.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS inet_ntop.$ac_objext"
	;;
	esac

	fi


	ac_fn_c_check_func "$LINENO" "snprintf" "ac_cv_func_snprintf"
	if test "x$ac_cv_func_snprintf" = xyes; then :
	$as_echo "#define HAVE_SNPRINTF 1" >>confdefs.h

	else
	case " $LIBOBJS " in
	" snprintf.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS snprintf.$ac_objext"
	;;
	esac

	fi


	# test if snprintf return the proper length
	if test "x$ac_cv_func_snprintf" = xyes; then
	if test c${cross_compiling} = cno; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for correct snprintf return value" >&5
	$as_echo_n "checking for correct snprintf return value... " >&6; }
	if test "$cross_compiling" = yes; then :
	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
	$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
	as_fn_error $? "cannot run test program while cross compiling
	See \`config.log' for more details" "$LINENO" 5; }
	else
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */
	$ac_includes_default

	int main(void) { return !(snprintf(NULL, 0, "test") == 4); }

	_ACEOF
	if ac_fn_c_try_run "$LINENO"; then :
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	else

	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }

	$as_echo "#define SNPRINTF_RET_BROKEN /**/" >>confdefs.h

	case " $LIBOBJS " in
	" snprintf.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS snprintf.$ac_objext"
	;;
	esac


	fi
	rm -f core .core core.conftest. gmon.out bb.out conftest$ac_exeext \
	conftest.$ac_objext conftest.beam conftest.$ac_ext
	fi

	fi
	fi
	ac_fn_c_check_func "$LINENO" "strlcat" "ac_cv_func_strlcat"
	if test "x$ac_cv_func_strlcat" = xyes; then :
	$as_echo "#define HAVE_STRLCAT 1" >>confdefs.h

	else
	case " $LIBOBJS " in
	" strlcat.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS strlcat.$ac_objext"
	;;
	esac

	fi


	ac_fn_c_check_func "$LINENO" "strlcpy" "ac_cv_func_strlcpy"
	if test "x$ac_cv_func_strlcpy" = xyes; then :
	$as_echo "#define HAVE_STRLCPY 1" >>confdefs.h

	else
	case " $LIBOBJS " in
	" strlcpy.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS strlcpy.$ac_objext"
	;;
	esac

	fi


	ac_fn_c_check_func "$LINENO" "memmove" "ac_cv_func_memmove"
	if test "x$ac_cv_func_memmove" = xyes; then :
	$as_echo "#define HAVE_MEMMOVE 1" >>confdefs.h

	else
	case " $LIBOBJS " in
	" memmove.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS memmove.$ac_objext"
	;;
	esac

	fi


	ac_fn_c_check_func "$LINENO" "gmtime_r" "ac_cv_func_gmtime_r"
	if test "x$ac_cv_func_gmtime_r" = xyes; then :
	$as_echo "#define HAVE_GMTIME_R 1" >>confdefs.h

	else
	case " $LIBOBJS " in
	" gmtime_r.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS gmtime_r.$ac_objext"
	;;
	esac

	fi


	ac_fn_c_check_func "$LINENO" "isblank" "ac_cv_func_isblank"
	if test "x$ac_cv_func_isblank" = xyes; then :
	$as_echo "#define HAVE_ISBLANK 1" >>confdefs.h

	else
	case " $LIBOBJS " in
	" isblank.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS isblank.$ac_objext"
	;;
	esac

	fi


	ac_fn_c_check_func "$LINENO" "explicit_bzero" "ac_cv_func_explicit_bzero"
	if test "x$ac_cv_func_explicit_bzero" = xyes; then :
	$as_echo "#define HAVE_EXPLICIT_BZERO 1" >>confdefs.h

	else
	case " $LIBOBJS " in
	" explicit_bzero.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS explicit_bzero.$ac_objext"
	;;
	esac

	fi


	LIBOBJ_WITHOUT_CTIMEARC4="$LIBOBJS"

	-ac_fn_c_check_func "$LINENO" "reallocarray" "ac_cv_func_reallocarray"
	-if test "x$ac_cv_func_reallocarray" = xyes; then :
	- $as_echo "#define HAVE_REALLOCARRAY 1" >>confdefs.h
	+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for reallocarray" >&5
	+$as_echo_n "checking for reallocarray... " >&6; }
	+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	+/* end confdefs.h. */
	+$ac_includes_default

	+#ifndef _OPENBSD_SOURCE
	+#define _OPENBSD_SOURCE 1
	+#endif
	+#include <stdlib.h>
	+int main(void) {
	+ void* p = reallocarray(NULL, 10, 100);
	+ free(p);
	+ return 0;
	+}
	+
	+_ACEOF
	+if ac_fn_c_try_link "$LINENO"; then :
	+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	+$as_echo "yes" >&6; }
	+
	+$as_echo "#define HAVE_REALLOCARRAY 1" >>confdefs.h
	+
	+
	else
	- case " $LIBOBJS " in
	+
	+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	+$as_echo "no" >&6; }
	+ case " $LIBOBJS " in
	" reallocarray.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS reallocarray.$ac_objext"
	;;
	esac

	-fi

	-
	+fi
	+rm -f core conftest.err conftest.$ac_objext \
	+ conftest$ac_exeext conftest.$ac_ext
	if test "$USE_NSS" = "no"; then
	ac_fn_c_check_func "$LINENO" "arc4random" "ac_cv_func_arc4random"
	if test "x$ac_cv_func_arc4random" = xyes; then :
	$as_echo "#define HAVE_ARC4RANDOM 1" >>confdefs.h

	else
	case " $LIBOBJS " in
	" arc4random.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS arc4random.$ac_objext"
	;;
	esac

	fi


	ac_fn_c_check_func "$LINENO" "arc4random_uniform" "ac_cv_func_arc4random_uniform"
	if test "x$ac_cv_func_arc4random_uniform" = xyes; then :
	$as_echo "#define HAVE_ARC4RANDOM_UNIFORM 1" >>confdefs.h

	else
	case " $LIBOBJS " in
	" arc4random_uniform.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS arc4random_uniform.$ac_objext"
	;;
	esac

	fi


	if test "$ac_cv_func_arc4random" = "no"; then
	case " $LIBOBJS " in
	" arc4_lock.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS arc4_lock.$ac_objext"
	;;
	esac

	for ac_func in getentropy
	do :
	ac_fn_c_check_func "$LINENO" "getentropy" "ac_cv_func_getentropy"
	if test "x$ac_cv_func_getentropy" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_GETENTROPY 1
	_ACEOF

	else

	if test "$USE_WINSOCK" = 1; then
	case " $LIBOBJS " in
	" getentropy_win.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS getentropy_win.$ac_objext"
	;;
	esac

	else
	case "$host" in
	Darwin\|darwin)
	case " $LIBOBJS " in
	" getentropy_osx.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS getentropy_osx.$ac_objext"
	;;
	esac

	;;
	solaris\|sunos\|SunOS)
	case " $LIBOBJS " in
	" getentropy_solaris.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS getentropy_solaris.$ac_objext"
	;;
	esac

	for ac_header in sys/sha2.h
	do :
	ac_fn_c_check_header_compile "$LINENO" "sys/sha2.h" "ac_cv_header_sys_sha2_h" "$ac_includes_default
	"
	if test "x$ac_cv_header_sys_sha2_h" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_SYS_SHA2_H 1
	_ACEOF

	else

	for ac_func in SHA512_Update
	do :
	ac_fn_c_check_func "$LINENO" "SHA512_Update" "ac_cv_func_SHA512_Update"
	if test "x$ac_cv_func_SHA512_Update" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_SHA512_UPDATE 1
	_ACEOF

	else

	case " $LIBOBJS " in
	" sha512.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS sha512.$ac_objext"
	;;
	esac


	fi
	done


	fi

	done

	if test "$ac_cv_header_sys_sha2_h" = "yes"; then
	# this lib needed for sha2 on solaris
	LIBS="$LIBS -lmd"
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing clock_gettime" >&5
	$as_echo_n "checking for library containing clock_gettime... " >&6; }
	if ${ac_cv_search_clock_gettime+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_func_search_save_LIBS=$LIBS
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char clock_gettime ();
	int
	main ()
	{
	return clock_gettime ();
	;
	return 0;
	}
	_ACEOF
	for ac_lib in '' rt; do
	if test -z "$ac_lib"; then
	ac_res="none required"
	else
	ac_res=-l$ac_lib
	LIBS="-l$ac_lib $ac_func_search_save_LIBS"
	fi
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_search_clock_gettime=$ac_res
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext
	if ${ac_cv_search_clock_gettime+:} false; then :
	break
	fi
	done
	if ${ac_cv_search_clock_gettime+:} false; then :

	else
	ac_cv_search_clock_gettime=no
	fi
	rm conftest.$ac_ext
	LIBS=$ac_func_search_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_clock_gettime" >&5
	$as_echo "$ac_cv_search_clock_gettime" >&6; }
	ac_res=$ac_cv_search_clock_gettime
	if test "$ac_res" != no; then :
	test "$ac_res" = "none required" \|\| LIBS="$ac_res $LIBS"

	fi

	;;
	linux\|Linux\|*)
	case " $LIBOBJS " in
	" getentropy_linux.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS getentropy_linux.$ac_objext"
	;;
	esac

	for ac_func in SHA512_Update
	do :
	ac_fn_c_check_func "$LINENO" "SHA512_Update" "ac_cv_func_SHA512_Update"
	if test "x$ac_cv_func_SHA512_Update" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_SHA512_UPDATE 1
	_ACEOF

	else


	$as_echo "#define COMPAT_SHA512 1" >>confdefs.h

	case " $LIBOBJS " in
	" sha512.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS sha512.$ac_objext"
	;;
	esac


	fi
	done

	for ac_header in sys/sysctl.h
	do :
	ac_fn_c_check_header_compile "$LINENO" "sys/sysctl.h" "ac_cv_header_sys_sysctl_h" "$ac_includes_default
	"
	if test "x$ac_cv_header_sys_sysctl_h" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_SYS_SYSCTL_H 1
	_ACEOF

	fi

	done

	for ac_func in getauxval
	do :
	ac_fn_c_check_func "$LINENO" "getauxval" "ac_cv_func_getauxval"
	if test "x$ac_cv_func_getauxval" = xyes; then :
	cat >>confdefs.h <<_ACEOF
	#define HAVE_GETAUXVAL 1
	_ACEOF

	fi
	done

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing clock_gettime" >&5
	$as_echo_n "checking for library containing clock_gettime... " >&6; }
	if ${ac_cv_search_clock_gettime+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_func_search_save_LIBS=$LIBS
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char clock_gettime ();
	int
	main ()
	{
	return clock_gettime ();
	;
	return 0;
	}
	_ACEOF
	for ac_lib in '' rt; do
	if test -z "$ac_lib"; then
	ac_res="none required"
	else
	ac_res=-l$ac_lib
	LIBS="-l$ac_lib $ac_func_search_save_LIBS"
	fi
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_search_clock_gettime=$ac_res
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext
	if ${ac_cv_search_clock_gettime+:} false; then :
	break
	fi
	done
	if ${ac_cv_search_clock_gettime+:} false; then :

	else
	ac_cv_search_clock_gettime=no
	fi
	rm conftest.$ac_ext
	LIBS=$ac_func_search_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_clock_gettime" >&5
	$as_echo "$ac_cv_search_clock_gettime" >&6; }
	ac_res=$ac_cv_search_clock_gettime
	if test "$ac_res" != no; then :
	test "$ac_res" = "none required" \|\| LIBS="$ac_res $LIBS"

	fi

	;;
	esac
	fi

	fi
	done

	fi
	fi
	LIBOBJ_WITHOUT_CTIME="$LIBOBJS"

	ac_fn_c_check_func "$LINENO" "ctime_r" "ac_cv_func_ctime_r"
	if test "x$ac_cv_func_ctime_r" = xyes; then :
	$as_echo "#define HAVE_CTIME_R 1" >>confdefs.h

	else
	case " $LIBOBJS " in
	" ctime_r.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS ctime_r.$ac_objext"
	;;
	esac

	fi


	ac_fn_c_check_func "$LINENO" "strsep" "ac_cv_func_strsep"
	if test "x$ac_cv_func_strsep" = xyes; then :
	$as_echo "#define HAVE_STRSEP 1" >>confdefs.h

	else
	case " $LIBOBJS " in
	" strsep.$ac_objext " ) ;;
	*) LIBOBJS="$LIBOBJS strsep.$ac_objext"
	;;
	esac

	fi



	# Check whether --enable-allsymbols was given.
	if test "${enable_allsymbols+set}" = set; then :
	enableval=$enable_allsymbols;
	fi

	case "$enable_allsymbols" in
	yes)
	COMMON_OBJ_ALL_SYMBOLS=""
	UBSYMS=""
	EXTRALINK="-L. -L.libs -lunbound"

	$as_echo "#define EXPORT_ALL_SYMBOLS 1" >>confdefs.h

	;;
	no\|*)
	COMMON_OBJ_ALL_SYMBOLS='$(COMMON_OBJ)'
	UBSYMS='-export-symbols $(srcdir)/libunbound/ubsyms.def'
	EXTRALINK=""
	;;
	esac



	if test x_$enable_lock_checks = x_yes; then
	UBSYMS="-export-symbols clubsyms.def"
	cp ${srcdir}/libunbound/ubsyms.def clubsyms.def
	echo lock_protect >> clubsyms.def
	echo lock_unprotect >> clubsyms.def
	echo lock_get_mem >> clubsyms.def
	echo checklock_start >> clubsyms.def
	echo checklock_stop >> clubsyms.def
	echo checklock_lock >> clubsyms.def
	echo checklock_unlock >> clubsyms.def
	echo checklock_init >> clubsyms.def
	echo checklock_thrcreate >> clubsyms.def
	echo checklock_thrjoin >> clubsyms.def
	fi

	# check for dnstap if requested

	# Check whether --enable-dnstap was given.
	if test "${enable_dnstap+set}" = set; then :
	enableval=$enable_dnstap; opt_dnstap=$enableval
	else
	opt_dnstap=no
	fi



	# Check whether --with-dnstap-socket-path was given.
	if test "${with_dnstap_socket_path+set}" = set; then :
	withval=$with_dnstap_socket_path; opt_dnstap_socket_path=$withval
	else
	opt_dnstap_socket_path="$UNBOUND_RUN_DIR/dnstap.sock"
	fi


	if test "x$opt_dnstap" != "xno"; then
	# Extract the first word of "protoc-c", so it can be a program name with args.
	set dummy protoc-c; ac_word=$2
	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
	$as_echo_n "checking for $ac_word... " >&6; }
	if ${ac_cv_path_PROTOC_C+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	case $PROTOC_C in
	[\\/]* \| ?:[\\/]*)
	ac_cv_path_PROTOC_C="$PROTOC_C" # Let the user override the test with a path.
	;;
	*)
	as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
	ac_cv_path_PROTOC_C="$as_dir/$ac_word$ac_exec_ext"
	$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
	break 2
	fi
	done
	done
	IFS=$as_save_IFS

	;;
	esac
	fi
	PROTOC_C=$ac_cv_path_PROTOC_C
	if test -n "$PROTOC_C"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $PROTOC_C" >&5
	$as_echo "$PROTOC_C" >&6; }
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	fi


	if test -z "$PROTOC_C"; then
	as_fn_error $? "The protoc-c program was not found. Please install protobuf-c!" "$LINENO" 5
	fi

	# Check whether --with-protobuf-c was given.
	if test "${with_protobuf_c+set}" = set; then :
	withval=$with_protobuf_c;
	# workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
	if test -f $withval/include/google/protobuf-c/protobuf-c.h; then
	CFLAGS="$CFLAGS -I$withval/include/google"
	else
	CFLAGS="$CFLAGS -I$withval/include"
	fi
	LDFLAGS="$LDFLAGS -L$withval/lib"

	else

	# workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
	if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
	CFLAGS="$CFLAGS -I/usr/include/google"
	else
	if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
	CFLAGS="$CFLAGS -I/usr/local/include/google"
	LDFLAGS="$LDFLAGS -L/usr/local/lib"
	fi
	fi

	fi


	# Check whether --with-libfstrm was given.
	if test "${with_libfstrm+set}" = set; then :
	withval=$with_libfstrm;
	CFLAGS="$CFLAGS -I$withval/include"
	LDFLAGS="$LDFLAGS -L$withval/lib"

	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing fstrm_iothr_init" >&5
	$as_echo_n "checking for library containing fstrm_iothr_init... " >&6; }
	if ${ac_cv_search_fstrm_iothr_init+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_func_search_save_LIBS=$LIBS
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char fstrm_iothr_init ();
	int
	main ()
	{
	return fstrm_iothr_init ();
	;
	return 0;
	}
	_ACEOF
	for ac_lib in '' fstrm; do
	if test -z "$ac_lib"; then
	ac_res="none required"
	else
	ac_res=-l$ac_lib
	LIBS="-l$ac_lib $ac_func_search_save_LIBS"
	fi
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_search_fstrm_iothr_init=$ac_res
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext
	if ${ac_cv_search_fstrm_iothr_init+:} false; then :
	break
	fi
	done
	if ${ac_cv_search_fstrm_iothr_init+:} false; then :

	else
	ac_cv_search_fstrm_iothr_init=no
	fi
	rm conftest.$ac_ext
	LIBS=$ac_func_search_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_fstrm_iothr_init" >&5
	$as_echo "$ac_cv_search_fstrm_iothr_init" >&6; }
	ac_res=$ac_cv_search_fstrm_iothr_init
	if test "$ac_res" != no; then :
	test "$ac_res" = "none required" \|\| LIBS="$ac_res $LIBS"

	else
	as_fn_error $? "The fstrm library was not found. Please install fstrm!" "$LINENO" 5
	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing protobuf_c_message_pack" >&5
	$as_echo_n "checking for library containing protobuf_c_message_pack... " >&6; }
	if ${ac_cv_search_protobuf_c_message_pack+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_func_search_save_LIBS=$LIBS
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char protobuf_c_message_pack ();
	int
	main ()
	{
	return protobuf_c_message_pack ();
	;
	return 0;
	}
	_ACEOF
	for ac_lib in '' protobuf-c; do
	if test -z "$ac_lib"; then
	ac_res="none required"
	else
	ac_res=-l$ac_lib
	LIBS="-l$ac_lib $ac_func_search_save_LIBS"
	fi
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_search_protobuf_c_message_pack=$ac_res
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext
	if ${ac_cv_search_protobuf_c_message_pack+:} false; then :
	break
	fi
	done
	if ${ac_cv_search_protobuf_c_message_pack+:} false; then :

	else
	ac_cv_search_protobuf_c_message_pack=no
	fi
	rm conftest.$ac_ext
	LIBS=$ac_func_search_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_protobuf_c_message_pack" >&5
	$as_echo "$ac_cv_search_protobuf_c_message_pack" >&6; }
	ac_res=$ac_cv_search_protobuf_c_message_pack
	if test "$ac_res" != no; then :
	test "$ac_res" = "none required" \|\| LIBS="$ac_res $LIBS"

	else
	as_fn_error $? "The protobuf-c library was not found. Please install protobuf-c!" "$LINENO" 5
	fi



	$as_echo "#define USE_DNSTAP 1" >>confdefs.h

	ENABLE_DNSTAP=1



	hdr_dnstap_socket_path="`echo $opt_dnstap_socket_path \| sed -e 's/\\\\/\\\\\\\\/g'`"


	cat >>confdefs.h <<_ACEOF
	#define DNSTAP_SOCKET_PATH "$hdr_dnstap_socket_path"
	_ACEOF


	DNSTAP_SRC="dnstap/dnstap.c dnstap/dnstap.pb-c.c"

	DNSTAP_OBJ="dnstap.lo dnstap.pb-c.lo"


	else

	ENABLE_DNSTAP=0



	fi


	# check for dnscrypt if requested

	# Check whether --enable-dnscrypt was given.
	if test "${enable_dnscrypt+set}" = set; then :
	enableval=$enable_dnscrypt; opt_dnscrypt=$enableval
	else
	opt_dnscrypt=no
	fi


	if test "x$opt_dnscrypt" != "xno"; then

	# Check whether --with-libsodium was given.
	if test "${with_libsodium+set}" = set; then :
	withval=$with_libsodium;
	CFLAGS="$CFLAGS -I$withval/include"
	LDFLAGS="$LDFLAGS -L$withval/lib"

	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing sodium_init" >&5
	$as_echo_n "checking for library containing sodium_init... " >&6; }
	if ${ac_cv_search_sodium_init+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_func_search_save_LIBS=$LIBS
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char sodium_init ();
	int
	main ()
	{
	return sodium_init ();
	;
	return 0;
	}
	_ACEOF
	for ac_lib in '' sodium; do
	if test -z "$ac_lib"; then
	ac_res="none required"
	else
	ac_res=-l$ac_lib
	LIBS="-l$ac_lib $ac_func_search_save_LIBS"
	fi
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_search_sodium_init=$ac_res
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext
	if ${ac_cv_search_sodium_init+:} false; then :
	break
	fi
	done
	if ${ac_cv_search_sodium_init+:} false; then :

	else
	ac_cv_search_sodium_init=no
	fi
	rm conftest.$ac_ext
	LIBS=$ac_func_search_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_sodium_init" >&5
	$as_echo "$ac_cv_search_sodium_init" >&6; }
	ac_res=$ac_cv_search_sodium_init
	if test "$ac_res" != no; then :
	test "$ac_res" = "none required" \|\| LIBS="$ac_res $LIBS"

	else
	as_fn_error $? "The sodium library was not found. Please install sodium!" "$LINENO" 5
	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing crypto_box_curve25519xchacha20poly1305_beforenm" >&5
	$as_echo_n "checking for library containing crypto_box_curve25519xchacha20poly1305_beforenm... " >&6; }
	if ${ac_cv_search_crypto_box_curve25519xchacha20poly1305_beforenm+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_func_search_save_LIBS=$LIBS
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char crypto_box_curve25519xchacha20poly1305_beforenm ();
	int
	main ()
	{
	return crypto_box_curve25519xchacha20poly1305_beforenm ();
	;
	return 0;
	}
	_ACEOF
	for ac_lib in '' sodium; do
	if test -z "$ac_lib"; then
	ac_res="none required"
	else
	ac_res=-l$ac_lib
	LIBS="-l$ac_lib $ac_func_search_save_LIBS"
	fi
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_search_crypto_box_curve25519xchacha20poly1305_beforenm=$ac_res
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext
	if ${ac_cv_search_crypto_box_curve25519xchacha20poly1305_beforenm+:} false; then :
	break
	fi
	done
	if ${ac_cv_search_crypto_box_curve25519xchacha20poly1305_beforenm+:} false; then :

	else
	ac_cv_search_crypto_box_curve25519xchacha20poly1305_beforenm=no
	fi
	rm conftest.$ac_ext
	LIBS=$ac_func_search_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_crypto_box_curve25519xchacha20poly1305_beforenm" >&5
	$as_echo "$ac_cv_search_crypto_box_curve25519xchacha20poly1305_beforenm" >&6; }
	ac_res=$ac_cv_search_crypto_box_curve25519xchacha20poly1305_beforenm
	if test "$ac_res" != no; then :
	test "$ac_res" = "none required" \|\| LIBS="$ac_res $LIBS"

	ENABLE_DNSCRYPT_XCHACHA20=1


	$as_echo "#define USE_DNSCRYPT_XCHACHA20 1" >>confdefs.h


	else

	ENABLE_DNSCRYPT_XCHACHA20=0


	fi

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing sodium_set_misuse_handler" >&5
	$as_echo_n "checking for library containing sodium_set_misuse_handler... " >&6; }
	if ${ac_cv_search_sodium_set_misuse_handler+:} false; then :
	$as_echo_n "(cached) " >&6
	else
	ac_func_search_save_LIBS=$LIBS
	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
	/* end confdefs.h. */

	/* Override any GCC internal prototype to avoid an error.
	Use char because int might match the return type of a GCC
	builtin and then its argument prototype would still apply. */
	#ifdef __cplusplus
	extern "C"
	#endif
	char sodium_set_misuse_handler ();
	int
	main ()
	{
	return sodium_set_misuse_handler ();
	;
	return 0;
	}
	_ACEOF
	for ac_lib in '' sodium; do
	if test -z "$ac_lib"; then
	ac_res="none required"
	else
	ac_res=-l$ac_lib
	LIBS="-l$ac_lib $ac_func_search_save_LIBS"
	fi
	if ac_fn_c_try_link "$LINENO"; then :
	ac_cv_search_sodium_set_misuse_handler=$ac_res
	fi
	rm -f core conftest.err conftest.$ac_objext \
	conftest$ac_exeext
	if ${ac_cv_search_sodium_set_misuse_handler+:} false; then :
	break
	fi
	done
	if ${ac_cv_search_sodium_set_misuse_handler+:} false; then :

	else
	ac_cv_search_sodium_set_misuse_handler=no
	fi
	rm conftest.$ac_ext
	LIBS=$ac_func_search_save_LIBS
	fi
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_sodium_set_misuse_handler" >&5
	$as_echo "$ac_cv_search_sodium_set_misuse_handler" >&6; }
	ac_res=$ac_cv_search_sodium_set_misuse_handler
	if test "$ac_res" != no; then :
	test "$ac_res" = "none required" \|\| LIBS="$ac_res $LIBS"


	$as_echo "#define SODIUM_MISUSE_HANDLER 1" >>confdefs.h


	fi



	$as_echo "#define USE_DNSCRYPT 1" >>confdefs.h

	ENABLE_DNSCRYPT=1


	DNSCRYPT_SRC="dnscrypt/dnscrypt.c"

	DNSCRYPT_OBJ="dnscrypt.lo"


	else
	ENABLE_DNSCRYPT_XCHACHA20=0


	ENABLE_DNSCRYPT=0



	fi


	# check for cachedb if requested
	# Check whether --enable-cachedb was given.
	if test "${enable_cachedb+set}" = set; then :
	enableval=$enable_cachedb;
	fi

	# turn on cachedb when hiredis support is enabled.
	if test "$found_libhiredis" = "yes"; then enable_cachedb="yes"; fi
	case "$enable_cachedb" in
	yes)

	$as_echo "#define USE_CACHEDB 1" >>confdefs.h

	;;
	no\|*)
	# nothing
	;;
	esac

	# check for ipsecmod if requested
	# Check whether --enable-ipsecmod was given.
	if test "${enable_ipsecmod+set}" = set; then :
	enableval=$enable_ipsecmod;
	fi

	case "$enable_ipsecmod" in
	yes)

	$as_echo "#define USE_IPSECMOD 1" >>confdefs.h

	IPSECMOD_OBJ="ipsecmod.lo ipsecmod-whitelist.lo"

	IPSECMOD_HEADER='$(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/ipsecmod/ipsecmod-whitelist.h'

	;;
	no\|*)
	# nothing
	;;
	esac

	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if ${MAKE:-make} supports $< with implicit rule in scope" >&5
	$as_echo_n "checking if ${MAKE:-make} supports $< with implicit rule in scope... " >&6; }
	# on openBSD, the implicit rule make $< work.
	# on Solaris, it does not work ($? is changed sources, $^ lists dependencies).
	# gmake works.
	cat >conftest.make <<EOF
	all: conftest.lo

	conftest.lo foo.lo bla.lo:
	if test -f "\$<"; then touch \$@; fi

	.SUFFIXES: .lo
	.c.lo:
	if test -f "\$<"; then touch \$@; fi

	conftest.lo: conftest.dir/conftest.c
	EOF
	mkdir conftest.dir
	touch conftest.dir/conftest.c
	rm -f conftest.lo conftest.c
	${MAKE:-make} -f conftest.make >/dev/null
	rm -f conftest.make conftest.c conftest.dir/conftest.c
	rm -rf conftest.dir
	if test ! -f conftest.lo; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
	$as_echo "no" >&6; }
	SOURCEDETERMINE='echo "$^" \| awk "-F " "{print \$$1;}" > .source'
	SOURCEFILE='`cat .source`'
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
	$as_echo "yes" >&6; }
	SOURCEDETERMINE=':'
	SOURCEFILE='$<'
	fi
	rm -f conftest.lo



	# see if we want to build the library or everything
	ALLTARGET="alltargets"
	INSTALLTARGET="install-all"

	# Check whether --with-libunbound-only was given.
	if test "${with_libunbound_only+set}" = set; then :
	withval=$with_libunbound_only;
	if test "$withval" = "yes"; then
	ALLTARGET="lib"
	INSTALLTARGET="install-lib"
	fi

	fi

	if test $ALLTARGET = "alltargets"; then
	if test $USE_NSS = "yes"; then
	as_fn_error $? "--with-nss can only be used in combination with --with-libunbound-only." "$LINENO" 5
	fi
	if test $USE_NETTLE = "yes"; then
	as_fn_error $? "--with-nettle can only be used in combination with --with-libunbound-only." "$LINENO" 5
	fi
	fi





	{ $as_echo "$as_me:${as_lineno-$LINENO}: Stripping extension flags..." >&5
	$as_echo "$as_me: Stripping extension flags..." >&6;}

	if echo $CFLAGS \| grep " -D_GNU_SOURCE" >/dev/null 2>&1; then
	CFLAGS="`echo $CFLAGS \| sed -e 's/ -D_GNU_SOURCE//g'`"

	$as_echo "#define OMITTED__D_GNU_SOURCE 1" >>confdefs.h

	fi


	if echo $CFLAGS \| grep " -D_BSD_SOURCE" >/dev/null 2>&1; then
	CFLAGS="`echo $CFLAGS \| sed -e 's/ -D_BSD_SOURCE//g'`"

	$as_echo "#define OMITTED__D_BSD_SOURCE 1" >>confdefs.h

	fi


	if echo $CFLAGS \| grep " -D_DEFAULT_SOURCE" >/dev/null 2>&1; then
	CFLAGS="`echo $CFLAGS \| sed -e 's/ -D_DEFAULT_SOURCE//g'`"

	$as_echo "#define OMITTED__D_DEFAULT_SOURCE 1" >>confdefs.h

	fi


	if echo $CFLAGS \| grep " -D__EXTENSIONS__" >/dev/null 2>&1; then
	CFLAGS="`echo $CFLAGS \| sed -e 's/ -D__EXTENSIONS__//g'`"

	$as_echo "#define OMITTED__D__EXTENSIONS__ 1" >>confdefs.h

	fi


	if echo $CFLAGS \| grep " -D_POSIX_C_SOURCE=200112" >/dev/null 2>&1; then
	CFLAGS="`echo $CFLAGS \| sed -e 's/ -D_POSIX_C_SOURCE=200112//g'`"

	$as_echo "#define OMITTED__D_POSIX_C_SOURCE_200112 1" >>confdefs.h

	fi


	if echo $CFLAGS \| grep " -D_XOPEN_SOURCE=600" >/dev/null 2>&1; then
	CFLAGS="`echo $CFLAGS \| sed -e 's/ -D_XOPEN_SOURCE=600//g'`"

	$as_echo "#define OMITTED__D_XOPEN_SOURCE_600 1" >>confdefs.h

	fi


	if echo $CFLAGS \| grep " -D_XOPEN_SOURCE_EXTENDED=1" >/dev/null 2>&1; then
	CFLAGS="`echo $CFLAGS \| sed -e 's/ -D_XOPEN_SOURCE_EXTENDED=1//g'`"

	$as_echo "#define OMITTED__D_XOPEN_SOURCE_EXTENDED_1 1" >>confdefs.h

	fi


	if echo $CFLAGS \| grep " -D_ALL_SOURCE" >/dev/null 2>&1; then
	CFLAGS="`echo $CFLAGS \| sed -e 's/ -D_ALL_SOURCE//g'`"

	$as_echo "#define OMITTED__D_ALL_SOURCE 1" >>confdefs.h

	fi


	if echo $CFLAGS \| grep " -D_LARGEFILE_SOURCE=1" >/dev/null 2>&1; then
	CFLAGS="`echo $CFLAGS \| sed -e 's/ -D_LARGEFILE_SOURCE=1//g'`"

	$as_echo "#define OMITTED__D_LARGEFILE_SOURCE_1 1" >>confdefs.h

	fi


	if test -n "$LATE_LDFLAGS"; then
	LDFLAGS="$LATE_LDFLAGS $LDFLAGS"
	fi
	# remove start spaces
	LDFLAGS=`echo "$LDFLAGS"\|sed -e 's/^ *//'`
	LIBS=`echo "$LIBS"\|sed -e 's/^ *//'`


	cat >>confdefs.h <<_ACEOF
	#define MAXSYSLOGMSGLEN 10240
	_ACEOF




	-version=1.8.1
	+version=1.9.2

	date=`date +'%b %e, %Y'`


	ac_config_files="$ac_config_files Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service"

	ac_config_headers="$ac_config_headers config.h"

	cat >confcache <<\_ACEOF
	# This file is a shell script that caches the results of configure
	# tests run on this system so they can be shared between configure
	# scripts and configure runs, see configure's option --config-cache.
	# It is not useful on other systems. If it contains results you don't
	# want to keep, you may remove or edit it.
	#
	# config.status only pays attention to the cache file if you give it
	# the --recheck option to rerun configure.
	#
	# `ac_cv_env_foo' variables (set or unset) will be overridden when
	# loading this file, other unset `ac_cv_foo' will be assigned the
	# following values.

	_ACEOF

	# The following way of writing the cache mishandles newlines in values,
	# but we know of no workaround that is simple, portable, and efficient.
	# So, we kill variables containing newlines.
	# Ultrix sh set writes to stderr and can't be redirected directly,
	# and sets the high bit in the cache file unless we assign to the vars.
	(
	for ac_var in `(set) 2>&1 \| sed -n 's/^$[a-zA-Z_][a-zA-Z0-9_]$=./\1/p'`; do
	eval ac_val=\$$ac_var
	case $ac_val in #(
	${as_nl})
	case $ac_var in #(
	_cv_) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5
	$as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
	esac
	case $ac_var in #(
	_ \| IFS \| as_nl) ;; #(
	BASH_ARGV \| BASH_SOURCE) eval $ac_var= ;; #(
	*) { eval $ac_var=; unset $ac_var;} ;;
	esac ;;
	esac
	done

	(set) 2>&1 \|
	case $as_nl`(ac_space=' '; set) 2>&1` in #(
	${as_nl}ac_space=\ )
	# `set' does not quote correctly, so add quotes: double-quote
	# substitution turns \\\\ into \\, and sed turns \\ into \.
	sed -n \
	"s/'/'\\\\''/g;
	s/^\$[_$as_cr_alnum]_cv_[_$as_cr_alnum]\$=\$.*\$/\\1='\\2'/p"
	;; #(
	*)
	# `set' quotes correctly as required by POSIX, so do not add quotes.
	sed -n "/^[_$as_cr_alnum]_cv_[_$as_cr_alnum]=/p"
	;;
	esac \|
	sort
	) \|
	sed '
	/^ac_cv_env_/b end
	t clear
	:clear
	s/^$[^=]$=$.[{}].*$$/test "${\1+set}" = set \|\| &/
	t end
	s/^$[^=]$=$.$$/\1=${\1=\2}/
	:end' >>confcache
	if diff "$cache_file" confcache >/dev/null 2>&1; then :; else
	if test -w "$cache_file"; then
	if test "x$cache_file" != "x/dev/null"; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: updating cache $cache_file" >&5
	$as_echo "$as_me: updating cache $cache_file" >&6;}
	if test ! -f "$cache_file" \|\| test -h "$cache_file"; then
	cat confcache >"$cache_file"
	else
	case $cache_file in #(
	/ \| ?:*)
	mv -f confcache "$cache_file"$$ &&
	mv -f "$cache_file"$$ "$cache_file" ;; #(
	*)
	mv -f confcache "$cache_file" ;;
	esac
	fi
	fi
	else
	{ $as_echo "$as_me:${as_lineno-$LINENO}: not updating unwritable cache $cache_file" >&5
	$as_echo "$as_me: not updating unwritable cache $cache_file" >&6;}
	fi
	fi
	rm -f confcache

	test "x$prefix" = xNONE && prefix=$ac_default_prefix
	# Let make expand exec_prefix.
	test "x$exec_prefix" = xNONE && exec_prefix='${prefix}'

	DEFS=-DHAVE_CONFIG_H

	ac_libobjs=
	ac_ltlibobjs=
	U=
	for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue
	# 1. Remove the extension, and $U if already installed.
	ac_script='s/\$U\././;s/\.o$//;s/\.obj$//'
	ac_i=`$as_echo "$ac_i" \| sed "$ac_script"`
	# 2. Prepend LIBOBJDIR. When used with automake>=1.10 LIBOBJDIR
	# will be set to the directory where LIBOBJS objects are built.
	as_fn_append ac_libobjs " \${LIBOBJDIR}$ac_i\$U.$ac_objext"
	as_fn_append ac_ltlibobjs " \${LIBOBJDIR}$ac_i"'$U.lo'
	done
	LIBOBJS=$ac_libobjs

	LTLIBOBJS=$ac_ltlibobjs


	if test -z "${USE_SYSTEMD_TRUE}" && test -z "${USE_SYSTEMD_FALSE}"; then
	as_fn_error $? "conditional \"USE_SYSTEMD\" was never defined.
	Usually this means the macro was only invoked conditionally." "$LINENO" 5
	fi

	: "${CONFIG_STATUS=./config.status}"
	ac_write_fail=0
	ac_clean_files_save=$ac_clean_files
	ac_clean_files="$ac_clean_files $CONFIG_STATUS"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: creating $CONFIG_STATUS" >&5
	$as_echo "$as_me: creating $CONFIG_STATUS" >&6;}
	as_write_fail=0
	cat >$CONFIG_STATUS <<_ASEOF \|\| as_write_fail=1
	#! $SHELL
	# Generated by $as_me.
	# Run this file to recreate the current configuration.
	# Compiler output produced by configure, useful for debugging
	# configure, is in config.log if it exists.

	debug=false
	ac_cs_recheck=false
	ac_cs_silent=false

	SHELL=\${CONFIG_SHELL-$SHELL}
	export SHELL
	_ASEOF
	cat >>$CONFIG_STATUS <<\_ASEOF \|\| as_write_fail=1
	## -------------------- ##
	## M4sh Initialization. ##
	## -------------------- ##

	# Be more Bourne compatible
	DUALCASE=1; export DUALCASE # for MKS sh
	if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then :
	emulate sh
	NULLCMD=:
	# Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which
	# is contrary to our usage. Disable this feature.
	alias -g '${1+"$@"}'='"$@"'
	setopt NO_GLOB_SUBST
	else
	case `(set -o) 2>/dev/null` in #(
	posix) :
	set -o posix ;; #(
	*) :
	;;
	esac
	fi


	as_nl='
	'
	export as_nl
	# Printing a long string crashes Solaris 7 /usr/bin/printf.
	as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
	as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo
	as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo
	# Prefer a ksh shell builtin over an external printf program on Solaris,
	# but without wasting forks for bash or zsh.
	if test -z "$BASH_VERSION$ZSH_VERSION" \
	&& (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then
	as_echo='print -r --'
	as_echo_n='print -rn --'
	elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then
	as_echo='printf %s\n'
	as_echo_n='printf %s'
	else
	if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then
	as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"'
	as_echo_n='/usr/ucb/echo -n'
	else
	as_echo_body='eval expr "X$1" : "X\$.*\$"'
	as_echo_n_body='eval
	arg=$1;
	case $arg in #(
	"$as_nl")
	expr "X$arg" : "X\$.*\$$as_nl";
	arg=`expr "X$arg" : ".$as_nl\$.\$"`;;
	esac;
	expr "X$arg" : "X\$.*\$" \| tr -d "$as_nl"
	'
	export as_echo_n_body
	as_echo_n='sh -c $as_echo_n_body as_echo'
	fi
	export as_echo_body
	as_echo='sh -c $as_echo_body as_echo'
	fi

	# The user is always right.
	if test "${PATH_SEPARATOR+set}" != set; then
	PATH_SEPARATOR=:
	(PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && {
	(PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 \|\|
	PATH_SEPARATOR=';'
	}
	fi


	# IFS
	# We need space, tab and new line, in precisely that order. Quoting is
	# there to prevent editors from complaining about space-tab.
	# (If _AS_PATH_WALK were called with IFS unset, it would disable word
	# splitting by setting IFS to empty value.)
	IFS=" "" $as_nl"

	# Find who we are. Look in the path if we contain no directory separator.
	as_myself=
	case $0 in #((
	[\\/] ) as_myself=$0 ;;
	*) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
	for as_dir in $PATH
	do
	IFS=$as_save_IFS
	test -z "$as_dir" && as_dir=.
	test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
	done
	IFS=$as_save_IFS

	;;
	esac
	# We did not find ourselves, most probably we were run as `sh COMMAND'
	# in which case we are not to be found in the path.
	if test "x$as_myself" = x; then
	as_myself=$0
	fi
	if test ! -f "$as_myself"; then
	$as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
	exit 1
	fi

	# Unset variables that we do not need and which cause bugs (e.g. in
	# pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "\|\| exit 1"
	# suppresses any "Segmentation fault" message there. '((' could
	# trigger a bug in pdksh 5.2.14.
	for as_var in BASH_ENV ENV MAIL MAILPATH
	do eval test x\${$as_var+set} = xset \
	&& ( (unset $as_var) \|\| exit 1) >/dev/null 2>&1 && unset $as_var \|\| :
	done
	PS1='$ '
	PS2='> '
	PS4='+ '

	# NLS nuisances.
	LC_ALL=C
	export LC_ALL
	LANGUAGE=C
	export LANGUAGE

	# CDPATH.
	(unset CDPATH) >/dev/null 2>&1 && unset CDPATH


	# as_fn_error STATUS ERROR [LINENO LOG_FD]
	# ----------------------------------------
	# Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are
	# provided, also output the error to LOG_FD, referencing LINENO. Then exit the
	# script with STATUS, using 1 if that was 0.
	as_fn_error ()
	{
	as_status=$1; test $as_status -eq 0 && as_status=1
	if test "$4"; then
	as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
	$as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
	fi
	$as_echo "$as_me: error: $2" >&2
	as_fn_exit $as_status
	} # as_fn_error


	# as_fn_set_status STATUS
	# -----------------------
	# Set $? to STATUS, without forking.
	as_fn_set_status ()
	{
	return $1
	} # as_fn_set_status

	# as_fn_exit STATUS
	# -----------------
	# Exit the shell with STATUS, even in a "trap 0" or "set -e" context.
	as_fn_exit ()
	{
	set +e
	as_fn_set_status $1
	exit $1
	} # as_fn_exit

	# as_fn_unset VAR
	# ---------------
	# Portably unset VAR.
	as_fn_unset ()
	{
	{ eval $1=; unset $1;}
	}
	as_unset=as_fn_unset
	# as_fn_append VAR VALUE
	# ----------------------
	# Append the text in VALUE to the end of the definition contained in VAR. Take
	# advantage of any shell optimizations that allow amortized linear growth over
	# repeated appends, instead of the typical quadratic growth present in naive
	# implementations.
	if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then :
	eval 'as_fn_append ()
	{
	eval $1+=\$2
	}'
	else
	as_fn_append ()
	{
	eval $1=\$$1\$2
	}
	fi # as_fn_append

	# as_fn_arith ARG...
	# ------------------
	# Perform arithmetic evaluation on the ARGs, and store the result in the
	# global $as_val. Take advantage of shells that can avoid forks. The arguments
	# must be portable across $(()) and expr.
	if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then :
	eval 'as_fn_arith ()
	{
	as_val=$(( $* ))
	}'
	else
	as_fn_arith ()
	{
	as_val=`expr "$@" \|\| test $? -eq 1`
	}
	fi # as_fn_arith


	if expr a : '$a$' >/dev/null 2>&1 &&
	test "X`expr 00001 : '.*$...$'`" = X001; then
	as_expr=expr
	else
	as_expr=false
	fi

	if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then
	as_basename=basename
	else
	as_basename=false
	fi

	if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then
	as_dirname=dirname
	else
	as_dirname=false
	fi

	as_me=`$as_basename -- "$0" \|\|
	$as_expr X/"$0" : './$[^/][^/]$/*$' \\| \
	X"$0" : 'X$//$$' \\| \
	X"$0" : 'X$/$' \\| . 2>/dev/null \|\|
	$as_echo X/"$0" \|
	sed '/^.\/$[^/][^/]$\/*$/{
	s//\1/
	q
	}
	/^X\/$\/\/$$/{
	s//\1/
	q
	}
	/^X\/$\/$.*/{
	s//\1/
	q
	}
	s/.*/./; q'`

	# Avoid depending upon Character Ranges.
	as_cr_letters='abcdefghijklmnopqrstuvwxyz'
	as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
	as_cr_Letters=$as_cr_letters$as_cr_LETTERS
	as_cr_digits='0123456789'
	as_cr_alnum=$as_cr_Letters$as_cr_digits

	ECHO_C= ECHO_N= ECHO_T=
	case `echo -n x` in #(((((
	-n*)
	case `echo 'xy\c'` in
	c) ECHO_T=' ';; # ECHO_T is single tab character.
	xy) ECHO_C='\c';;
	*) echo `echo ksh88 bug on AIX 6.1` > /dev/null
	ECHO_T=' ';;
	esac;;
	*)
	ECHO_N='-n';;
	esac

	rm -f conf$$ conf$$.exe conf$$.file
	if test -d conf$$.dir; then
	rm -f conf$$.dir/conf$$.file
	else
	rm -f conf$$.dir
	mkdir conf$$.dir 2>/dev/null
	fi
	if (echo >conf$$.file) 2>/dev/null; then
	if ln -s conf$$.file conf$$ 2>/dev/null; then
	as_ln_s='ln -s'
	# ... but there are two gotchas:
	# 1) On MSYS, both `ln -s file dir' and `ln file dir' fail.
	# 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable.
	# In both cases, we have to default to `cp -pR'.
	ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe \|\|
	as_ln_s='cp -pR'
	elif ln conf$$.file conf$$ 2>/dev/null; then
	as_ln_s=ln
	else
	as_ln_s='cp -pR'
	fi
	else
	as_ln_s='cp -pR'
	fi
	rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file
	rmdir conf$$.dir 2>/dev/null


	# as_fn_mkdir_p
	# -------------
	# Create "$as_dir" as a directory, including parents if necessary.
	as_fn_mkdir_p ()
	{

	case $as_dir in #(
	-*) as_dir=./$as_dir;;
	esac
	test -d "$as_dir" \|\| eval $as_mkdir_p \|\| {
	as_dirs=
	while :; do
	case $as_dir in #(
	\') as_qdir=`$as_echo "$as_dir" \| sed "s/'/'\\\\\\\\''/g"`;; #'(
	*) as_qdir=$as_dir;;
	esac
	as_dirs="'$as_qdir' $as_dirs"
	as_dir=`$as_dirname -- "$as_dir" \|\|
	$as_expr X"$as_dir" : 'X$.[^/]$//[^/][^/]/$' \\| \
	X"$as_dir" : 'X$//$[^/]' \\| \
	X"$as_dir" : 'X$//$$' \\| \
	X"$as_dir" : 'X$/$' \\| . 2>/dev/null \|\|
	$as_echo X"$as_dir" \|
	sed '/^X$.[^/]$\/\/[^/][^/]\/$/{
	s//\1/
	q
	}
	/^X$\/\/$[^/].*/{
	s//\1/
	q
	}
	/^X$\/\/$$/{
	s//\1/
	q
	}
	/^X$\/$.*/{
	s//\1/
	q
	}
	s/.*/./; q'`
	test -d "$as_dir" && break
	done
	test -z "$as_dirs" \|\| eval "mkdir $as_dirs"
	} \|\| test -d "$as_dir" \|\| as_fn_error $? "cannot create directory $as_dir"


	} # as_fn_mkdir_p
	if mkdir -p . 2>/dev/null; then
	as_mkdir_p='mkdir -p "$as_dir"'
	else
	test -d ./-p && rmdir ./-p
	as_mkdir_p=false
	fi


	# as_fn_executable_p FILE
	# -----------------------
	# Test if FILE is an executable regular file.
	as_fn_executable_p ()
	{
	test -f "$1" && test -x "$1"
	} # as_fn_executable_p
	as_test_x='test -x'
	as_executable_p=as_fn_executable_p

	# Sed expression to map a string onto a valid CPP name.
	as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'"

	# Sed expression to map a string onto a valid variable name.
	as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'"


	exec 6>&1
	## ----------------------------------- ##
	## Main body of $CONFIG_STATUS script. ##
	## ----------------------------------- ##
	_ASEOF
	test $as_write_fail = 0 && chmod +x $CONFIG_STATUS \|\| ac_write_fail=1

	cat >>$CONFIG_STATUS <<\_ACEOF \|\| ac_write_fail=1
	# Save the log message, to keep $0 and so on meaningful, and to
	# report actual input values of CONFIG_FILES etc. instead of their
	# values after options handling.
	ac_log="
	-This file was extended by unbound $as_me 1.8.1, which was
	+This file was extended by unbound $as_me 1.9.2, which was
	generated by GNU Autoconf 2.69. Invocation command line was

	CONFIG_FILES = $CONFIG_FILES
	CONFIG_HEADERS = $CONFIG_HEADERS
	CONFIG_LINKS = $CONFIG_LINKS
	CONFIG_COMMANDS = $CONFIG_COMMANDS
	$ $0 $@

	on `(hostname \|\| uname -n) 2>/dev/null \| sed 1q`
	"

	_ACEOF

	case $ac_config_files in *"
	") set x $ac_config_files; shift; ac_config_files=$;;
	esac

	case $ac_config_headers in *"
	") set x $ac_config_headers; shift; ac_config_headers=$;;
	esac


	cat >>$CONFIG_STATUS <<_ACEOF \|\| ac_write_fail=1
	# Files that config.status was made for.
	config_files="$ac_config_files"
	config_headers="$ac_config_headers"
	config_commands="$ac_config_commands"

	_ACEOF

	cat >>$CONFIG_STATUS <<\_ACEOF \|\| ac_write_fail=1
	ac_cs_usage="\
	\`$as_me' instantiates files and other configuration actions
	from templates according to the current configuration. Unless the files
	and actions are specified as TAGs, all are instantiated by default.

	Usage: $0 [OPTION]... [TAG]...

	-h, --help print this help, then exit
	-V, --version print version number and configuration settings, then exit
	--config print configuration, then exit
	-q, --quiet, --silent
	do not print progress messages
	-d, --debug don't remove temporary files
	--recheck update $as_me by reconfiguring in the same conditions
	--file=FILE[:TEMPLATE]
	instantiate the configuration file FILE
	--header=FILE[:TEMPLATE]
	instantiate the configuration header FILE

	Configuration files:
	$config_files

	Configuration headers:
	$config_headers

	Configuration commands:
	$config_commands

	Report bugs to <unbound-bugs@nlnetlabs.nl>."

	_ACEOF
	cat >>$CONFIG_STATUS <<_ACEOF \|\| ac_write_fail=1
	ac_cs_config="`$as_echo "$ac_configure_args" \| sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
	ac_cs_version="\\
	-unbound config.status 1.8.1
	+unbound config.status 1.9.2
	configured by $0, generated by GNU Autoconf 2.69,
	with options \\"\$ac_cs_config\\"

	Copyright (C) 2012 Free Software Foundation, Inc.
	This config.status script is free software; the Free Software Foundation
	gives unlimited permission to copy, distribute and modify it."

	ac_pwd='$ac_pwd'
	srcdir='$srcdir'
	AWK='$AWK'
	test -n "\$AWK" \|\| AWK=awk
	_ACEOF

	cat >>$CONFIG_STATUS <<\_ACEOF \|\| ac_write_fail=1
	# The default lists apply if the user does not specify any file.
	ac_need_defaults=:
	while test $# != 0
	do
	case $1 in
	--=?)
	ac_option=`expr "X$1" : 'X$[^=]*$='`
	ac_optarg=`expr "X$1" : 'X[^=]=$.$'`
	ac_shift=:
	;;
	--*=)
	ac_option=`expr "X$1" : 'X$[^=]*$='`
	ac_optarg=
	ac_shift=:
	;;
	*)
	ac_option=$1
	ac_optarg=$2
	ac_shift=shift
	;;
	esac

	case $ac_option in
	# Handling of the options.
	-recheck \| --recheck \| --rechec \| --reche \| --rech \| --rec \| --re \| --r)
	ac_cs_recheck=: ;;
	--version \| --versio \| --versi \| --vers \| --ver \| --ve \| --v \| -V )
	$as_echo "$ac_cs_version"; exit ;;
	--config \| --confi \| --conf \| --con \| --co \| --c )
	$as_echo "$ac_cs_config"; exit ;;
	--debug \| --debu \| --deb \| --de \| --d \| -d )
	debug=: ;;
	--file \| --fil \| --fi \| --f )
	$ac_shift
	case $ac_optarg in
	\') ac_optarg=`$as_echo "$ac_optarg" \| sed "s/'/'\\\\\\\\''/g"` ;;
	'') as_fn_error $? "missing file argument" ;;
	esac
	as_fn_append CONFIG_FILES " '$ac_optarg'"
	ac_need_defaults=false;;
	--header \| --heade \| --head \| --hea )
	$ac_shift
	case $ac_optarg in
	\') ac_optarg=`$as_echo "$ac_optarg" \| sed "s/'/'\\\\\\\\''/g"` ;;
	esac
	as_fn_append CONFIG_HEADERS " '$ac_optarg'"
	ac_need_defaults=false;;
	--he \| --h)
	# Conflict between --help and --header
	as_fn_error $? "ambiguous option: \`$1'
	Try \`$0 --help' for more information.";;
	--help \| --hel \| -h )
	$as_echo "$ac_cs_usage"; exit ;;
	-q \| -quiet \| --quiet \| --quie \| --qui \| --qu \| --q \
	\| -silent \| --silent \| --silen \| --sile \| --sil \| --si \| --s)
	ac_cs_silent=: ;;

	# This is an error.
	-*) as_fn_error $? "unrecognized option: \`$1'
	Try \`$0 --help' for more information." ;;

	*) as_fn_append ac_config_targets " $1"
	ac_need_defaults=false ;;

	esac
	shift
	done

	ac_configure_extra_args=

	if $ac_cs_silent; then
	exec 6>/dev/null
	ac_configure_extra_args="$ac_configure_extra_args --silent"
	fi

	_ACEOF
	cat >>$CONFIG_STATUS <<_ACEOF \|\| ac_write_fail=1
	if \$ac_cs_recheck; then
	set X $SHELL '$0' $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion
	shift
	\$as_echo "running CONFIG_SHELL=$SHELL \$*" >&6
	CONFIG_SHELL='$SHELL'
	export CONFIG_SHELL
	exec "\$@"
	fi

	_ACEOF
	cat >>$CONFIG_STATUS <<\_ACEOF \|\| ac_write_fail=1
	exec 5>>config.log
	{
	echo
	sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX
	## Running $as_me. ##
	_ASBOX
	$as_echo "$ac_log"
	} >&5

	_ACEOF
	cat >>$CONFIG_STATUS <<_ACEOF \|\| ac_write_fail=1
	#
	# INIT-COMMANDS
	#


	# The HP-UX ksh and POSIX shell print the target directory to stdout
	# if CDPATH is set.
	(unset CDPATH) >/dev/null 2>&1 && unset CDPATH

	sed_quote_subst='$sed_quote_subst'
	double_quote_subst='$double_quote_subst'
	delay_variable_subst='$delay_variable_subst'
	macro_version='`$ECHO "$macro_version" \| $SED "$delay_single_quote_subst"`'
	macro_revision='`$ECHO "$macro_revision" \| $SED "$delay_single_quote_subst"`'
	enable_shared='`$ECHO "$enable_shared" \| $SED "$delay_single_quote_subst"`'
	enable_static='`$ECHO "$enable_static" \| $SED "$delay_single_quote_subst"`'
	pic_mode='`$ECHO "$pic_mode" \| $SED "$delay_single_quote_subst"`'
	enable_fast_install='`$ECHO "$enable_fast_install" \| $SED "$delay_single_quote_subst"`'
	shared_archive_member_spec='`$ECHO "$shared_archive_member_spec" \| $SED "$delay_single_quote_subst"`'
	SHELL='`$ECHO "$SHELL" \| $SED "$delay_single_quote_subst"`'
	ECHO='`$ECHO "$ECHO" \| $SED "$delay_single_quote_subst"`'
	PATH_SEPARATOR='`$ECHO "$PATH_SEPARATOR" \| $SED "$delay_single_quote_subst"`'
	host_alias='`$ECHO "$host_alias" \| $SED "$delay_single_quote_subst"`'
	host='`$ECHO "$host" \| $SED "$delay_single_quote_subst"`'
	host_os='`$ECHO "$host_os" \| $SED "$delay_single_quote_subst"`'
	build_alias='`$ECHO "$build_alias" \| $SED "$delay_single_quote_subst"`'
	build='`$ECHO "$build" \| $SED "$delay_single_quote_subst"`'
	build_os='`$ECHO "$build_os" \| $SED "$delay_single_quote_subst"`'
	SED='`$ECHO "$SED" \| $SED "$delay_single_quote_subst"`'
	Xsed='`$ECHO "$Xsed" \| $SED "$delay_single_quote_subst"`'
	GREP='`$ECHO "$GREP" \| $SED "$delay_single_quote_subst"`'
	EGREP='`$ECHO "$EGREP" \| $SED "$delay_single_quote_subst"`'
	FGREP='`$ECHO "$FGREP" \| $SED "$delay_single_quote_subst"`'
	LD='`$ECHO "$LD" \| $SED "$delay_single_quote_subst"`'
	NM='`$ECHO "$NM" \| $SED "$delay_single_quote_subst"`'
	LN_S='`$ECHO "$LN_S" \| $SED "$delay_single_quote_subst"`'
	max_cmd_len='`$ECHO "$max_cmd_len" \| $SED "$delay_single_quote_subst"`'
	ac_objext='`$ECHO "$ac_objext" \| $SED "$delay_single_quote_subst"`'
	exeext='`$ECHO "$exeext" \| $SED "$delay_single_quote_subst"`'
	lt_unset='`$ECHO "$lt_unset" \| $SED "$delay_single_quote_subst"`'
	lt_SP2NL='`$ECHO "$lt_SP2NL" \| $SED "$delay_single_quote_subst"`'
	lt_NL2SP='`$ECHO "$lt_NL2SP" \| $SED "$delay_single_quote_subst"`'
	lt_cv_to_host_file_cmd='`$ECHO "$lt_cv_to_host_file_cmd" \| $SED "$delay_single_quote_subst"`'
	lt_cv_to_tool_file_cmd='`$ECHO "$lt_cv_to_tool_file_cmd" \| $SED "$delay_single_quote_subst"`'
	reload_flag='`$ECHO "$reload_flag" \| $SED "$delay_single_quote_subst"`'
	reload_cmds='`$ECHO "$reload_cmds" \| $SED "$delay_single_quote_subst"`'
	OBJDUMP='`$ECHO "$OBJDUMP" \| $SED "$delay_single_quote_subst"`'
	deplibs_check_method='`$ECHO "$deplibs_check_method" \| $SED "$delay_single_quote_subst"`'
	file_magic_cmd='`$ECHO "$file_magic_cmd" \| $SED "$delay_single_quote_subst"`'
	file_magic_glob='`$ECHO "$file_magic_glob" \| $SED "$delay_single_quote_subst"`'
	want_nocaseglob='`$ECHO "$want_nocaseglob" \| $SED "$delay_single_quote_subst"`'
	DLLTOOL='`$ECHO "$DLLTOOL" \| $SED "$delay_single_quote_subst"`'
	sharedlib_from_linklib_cmd='`$ECHO "$sharedlib_from_linklib_cmd" \| $SED "$delay_single_quote_subst"`'
	AR='`$ECHO "$AR" \| $SED "$delay_single_quote_subst"`'
	AR_FLAGS='`$ECHO "$AR_FLAGS" \| $SED "$delay_single_quote_subst"`'
	archiver_list_spec='`$ECHO "$archiver_list_spec" \| $SED "$delay_single_quote_subst"`'
	STRIP='`$ECHO "$STRIP" \| $SED "$delay_single_quote_subst"`'
	RANLIB='`$ECHO "$RANLIB" \| $SED "$delay_single_quote_subst"`'
	old_postinstall_cmds='`$ECHO "$old_postinstall_cmds" \| $SED "$delay_single_quote_subst"`'
	old_postuninstall_cmds='`$ECHO "$old_postuninstall_cmds" \| $SED "$delay_single_quote_subst"`'
	old_archive_cmds='`$ECHO "$old_archive_cmds" \| $SED "$delay_single_quote_subst"`'
	lock_old_archive_extraction='`$ECHO "$lock_old_archive_extraction" \| $SED "$delay_single_quote_subst"`'
	CC='`$ECHO "$CC" \| $SED "$delay_single_quote_subst"`'
	CFLAGS='`$ECHO "$CFLAGS" \| $SED "$delay_single_quote_subst"`'
	compiler='`$ECHO "$compiler" \| $SED "$delay_single_quote_subst"`'
	GCC='`$ECHO "$GCC" \| $SED "$delay_single_quote_subst"`'
	lt_cv_sys_global_symbol_pipe='`$ECHO "$lt_cv_sys_global_symbol_pipe" \| $SED "$delay_single_quote_subst"`'
	lt_cv_sys_global_symbol_to_cdecl='`$ECHO "$lt_cv_sys_global_symbol_to_cdecl" \| $SED "$delay_single_quote_subst"`'
	lt_cv_sys_global_symbol_to_import='`$ECHO "$lt_cv_sys_global_symbol_to_import" \| $SED "$delay_single_quote_subst"`'
	lt_cv_sys_global_symbol_to_c_name_address='`$ECHO "$lt_cv_sys_global_symbol_to_c_name_address" \| $SED "$delay_single_quote_subst"`'
	lt_cv_sys_global_symbol_to_c_name_address_lib_prefix='`$ECHO "$lt_cv_sys_global_symbol_to_c_name_address_lib_prefix" \| $SED "$delay_single_quote_subst"`'
	lt_cv_nm_interface='`$ECHO "$lt_cv_nm_interface" \| $SED "$delay_single_quote_subst"`'
	nm_file_list_spec='`$ECHO "$nm_file_list_spec" \| $SED "$delay_single_quote_subst"`'
	lt_sysroot='`$ECHO "$lt_sysroot" \| $SED "$delay_single_quote_subst"`'
	lt_cv_truncate_bin='`$ECHO "$lt_cv_truncate_bin" \| $SED "$delay_single_quote_subst"`'
	objdir='`$ECHO "$objdir" \| $SED "$delay_single_quote_subst"`'
	MAGIC_CMD='`$ECHO "$MAGIC_CMD" \| $SED "$delay_single_quote_subst"`'
	lt_prog_compiler_no_builtin_flag='`$ECHO "$lt_prog_compiler_no_builtin_flag" \| $SED "$delay_single_quote_subst"`'
	lt_prog_compiler_pic='`$ECHO "$lt_prog_compiler_pic" \| $SED "$delay_single_quote_subst"`'
	lt_prog_compiler_wl='`$ECHO "$lt_prog_compiler_wl" \| $SED "$delay_single_quote_subst"`'
	lt_prog_compiler_static='`$ECHO "$lt_prog_compiler_static" \| $SED "$delay_single_quote_subst"`'
	lt_cv_prog_compiler_c_o='`$ECHO "$lt_cv_prog_compiler_c_o" \| $SED "$delay_single_quote_subst"`'
	need_locks='`$ECHO "$need_locks" \| $SED "$delay_single_quote_subst"`'
	MANIFEST_TOOL='`$ECHO "$MANIFEST_TOOL" \| $SED "$delay_single_quote_subst"`'
	DSYMUTIL='`$ECHO "$DSYMUTIL" \| $SED "$delay_single_quote_subst"`'
	NMEDIT='`$ECHO "$NMEDIT" \| $SED "$delay_single_quote_subst"`'
	LIPO='`$ECHO "$LIPO" \| $SED "$delay_single_quote_subst"`'
	OTOOL='`$ECHO "$OTOOL" \| $SED "$delay_single_quote_subst"`'
	OTOOL64='`$ECHO "$OTOOL64" \| $SED "$delay_single_quote_subst"`'
	libext='`$ECHO "$libext" \| $SED "$delay_single_quote_subst"`'
	shrext_cmds='`$ECHO "$shrext_cmds" \| $SED "$delay_single_quote_subst"`'
	extract_expsyms_cmds='`$ECHO "$extract_expsyms_cmds" \| $SED "$delay_single_quote_subst"`'
	archive_cmds_need_lc='`$ECHO "$archive_cmds_need_lc" \| $SED "$delay_single_quote_subst"`'
	enable_shared_with_static_runtimes='`$ECHO "$enable_shared_with_static_runtimes" \| $SED "$delay_single_quote_subst"`'
	export_dynamic_flag_spec='`$ECHO "$export_dynamic_flag_spec" \| $SED "$delay_single_quote_subst"`'
	whole_archive_flag_spec='`$ECHO "$whole_archive_flag_spec" \| $SED "$delay_single_quote_subst"`'
	compiler_needs_object='`$ECHO "$compiler_needs_object" \| $SED "$delay_single_quote_subst"`'
	old_archive_from_new_cmds='`$ECHO "$old_archive_from_new_cmds" \| $SED "$delay_single_quote_subst"`'
	old_archive_from_expsyms_cmds='`$ECHO "$old_archive_from_expsyms_cmds" \| $SED "$delay_single_quote_subst"`'
	archive_cmds='`$ECHO "$archive_cmds" \| $SED "$delay_single_quote_subst"`'
	archive_expsym_cmds='`$ECHO "$archive_expsym_cmds" \| $SED "$delay_single_quote_subst"`'
	module_cmds='`$ECHO "$module_cmds" \| $SED "$delay_single_quote_subst"`'
	module_expsym_cmds='`$ECHO "$module_expsym_cmds" \| $SED "$delay_single_quote_subst"`'
	with_gnu_ld='`$ECHO "$with_gnu_ld" \| $SED "$delay_single_quote_subst"`'
	allow_undefined_flag='`$ECHO "$allow_undefined_flag" \| $SED "$delay_single_quote_subst"`'
	no_undefined_flag='`$ECHO "$no_undefined_flag" \| $SED "$delay_single_quote_subst"`'
	hardcode_libdir_flag_spec='`$ECHO "$hardcode_libdir_flag_spec" \| $SED "$delay_single_quote_subst"`'
	hardcode_libdir_separator='`$ECHO "$hardcode_libdir_separator" \| $SED "$delay_single_quote_subst"`'
	hardcode_direct='`$ECHO "$hardcode_direct" \| $SED "$delay_single_quote_subst"`'
	hardcode_direct_absolute='`$ECHO "$hardcode_direct_absolute" \| $SED "$delay_single_quote_subst"`'
	hardcode_minus_L='`$ECHO "$hardcode_minus_L" \| $SED "$delay_single_quote_subst"`'
	hardcode_shlibpath_var='`$ECHO "$hardcode_shlibpath_var" \| $SED "$delay_single_quote_subst"`'
	hardcode_automatic='`$ECHO "$hardcode_automatic" \| $SED "$delay_single_quote_subst"`'
	inherit_rpath='`$ECHO "$inherit_rpath" \| $SED "$delay_single_quote_subst"`'
	link_all_deplibs='`$ECHO "$link_all_deplibs" \| $SED "$delay_single_quote_subst"`'
	always_export_symbols='`$ECHO "$always_export_symbols" \| $SED "$delay_single_quote_subst"`'
	export_symbols_cmds='`$ECHO "$export_symbols_cmds" \| $SED "$delay_single_quote_subst"`'
	exclude_expsyms='`$ECHO "$exclude_expsyms" \| $SED "$delay_single_quote_subst"`'
	include_expsyms='`$ECHO "$include_expsyms" \| $SED "$delay_single_quote_subst"`'
	prelink_cmds='`$ECHO "$prelink_cmds" \| $SED "$delay_single_quote_subst"`'
	postlink_cmds='`$ECHO "$postlink_cmds" \| $SED "$delay_single_quote_subst"`'
	file_list_spec='`$ECHO "$file_list_spec" \| $SED "$delay_single_quote_subst"`'
	variables_saved_for_relink='`$ECHO "$variables_saved_for_relink" \| $SED "$delay_single_quote_subst"`'
	need_lib_prefix='`$ECHO "$need_lib_prefix" \| $SED "$delay_single_quote_subst"`'
	need_version='`$ECHO "$need_version" \| $SED "$delay_single_quote_subst"`'
	version_type='`$ECHO "$version_type" \| $SED "$delay_single_quote_subst"`'
	runpath_var='`$ECHO "$runpath_var" \| $SED "$delay_single_quote_subst"`'
	shlibpath_var='`$ECHO "$shlibpath_var" \| $SED "$delay_single_quote_subst"`'
	shlibpath_overrides_runpath='`$ECHO "$shlibpath_overrides_runpath" \| $SED "$delay_single_quote_subst"`'
	libname_spec='`$ECHO "$libname_spec" \| $SED "$delay_single_quote_subst"`'
	library_names_spec='`$ECHO "$library_names_spec" \| $SED "$delay_single_quote_subst"`'
	soname_spec='`$ECHO "$soname_spec" \| $SED "$delay_single_quote_subst"`'
	install_override_mode='`$ECHO "$install_override_mode" \| $SED "$delay_single_quote_subst"`'
	postinstall_cmds='`$ECHO "$postinstall_cmds" \| $SED "$delay_single_quote_subst"`'
	postuninstall_cmds='`$ECHO "$postuninstall_cmds" \| $SED "$delay_single_quote_subst"`'
	finish_cmds='`$ECHO "$finish_cmds" \| $SED "$delay_single_quote_subst"`'
	finish_eval='`$ECHO "$finish_eval" \| $SED "$delay_single_quote_subst"`'
	hardcode_into_libs='`$ECHO "$hardcode_into_libs" \| $SED "$delay_single_quote_subst"`'
	sys_lib_search_path_spec='`$ECHO "$sys_lib_search_path_spec" \| $SED "$delay_single_quote_subst"`'
	configure_time_dlsearch_path='`$ECHO "$configure_time_dlsearch_path" \| $SED "$delay_single_quote_subst"`'
	configure_time_lt_sys_library_path='`$ECHO "$configure_time_lt_sys_library_path" \| $SED "$delay_single_quote_subst"`'
	hardcode_action='`$ECHO "$hardcode_action" \| $SED "$delay_single_quote_subst"`'
	enable_dlopen='`$ECHO "$enable_dlopen" \| $SED "$delay_single_quote_subst"`'
	enable_dlopen_self='`$ECHO "$enable_dlopen_self" \| $SED "$delay_single_quote_subst"`'
	enable_dlopen_self_static='`$ECHO "$enable_dlopen_self_static" \| $SED "$delay_single_quote_subst"`'
	old_striplib='`$ECHO "$old_striplib" \| $SED "$delay_single_quote_subst"`'
	striplib='`$ECHO "$striplib" \| $SED "$delay_single_quote_subst"`'

	LTCC='$LTCC'
	LTCFLAGS='$LTCFLAGS'
	compiler='$compiler_DEFAULT'

	# A function that is used when there is no print builtin or printf.
	func_fallback_echo ()
	{
	eval 'cat <<_LTECHO_EOF
	\$1
	_LTECHO_EOF'
	}

	# Quote evaled strings.
	for var in SHELL \
	ECHO \
	PATH_SEPARATOR \
	SED \
	GREP \
	EGREP \
	FGREP \
	LD \
	NM \
	LN_S \
	lt_SP2NL \
	lt_NL2SP \
	reload_flag \
	OBJDUMP \
	deplibs_check_method \
	file_magic_cmd \
	file_magic_glob \
	want_nocaseglob \
	DLLTOOL \
	sharedlib_from_linklib_cmd \
	AR \
	AR_FLAGS \
	archiver_list_spec \
	STRIP \
	RANLIB \
	CC \
	CFLAGS \
	compiler \
	lt_cv_sys_global_symbol_pipe \
	lt_cv_sys_global_symbol_to_cdecl \
	lt_cv_sys_global_symbol_to_import \
	lt_cv_sys_global_symbol_to_c_name_address \
	lt_cv_sys_global_symbol_to_c_name_address_lib_prefix \
	lt_cv_nm_interface \
	nm_file_list_spec \
	lt_cv_truncate_bin \
	lt_prog_compiler_no_builtin_flag \
	lt_prog_compiler_pic \
	lt_prog_compiler_wl \
	lt_prog_compiler_static \
	lt_cv_prog_compiler_c_o \
	need_locks \
	MANIFEST_TOOL \
	DSYMUTIL \
	NMEDIT \
	LIPO \
	OTOOL \
	OTOOL64 \
	shrext_cmds \
	export_dynamic_flag_spec \
	whole_archive_flag_spec \
	compiler_needs_object \
	with_gnu_ld \
	allow_undefined_flag \
	no_undefined_flag \
	hardcode_libdir_flag_spec \
	hardcode_libdir_separator \
	exclude_expsyms \
	include_expsyms \
	file_list_spec \
	variables_saved_for_relink \
	libname_spec \
	library_names_spec \
	soname_spec \
	install_override_mode \
	finish_eval \
	old_striplib \
	striplib; do
	case \`eval \\\\\$ECHO \\\\""\\\\\$\$var"\\\\"\` in
	[\\\\\\\`\\"\\\$])
	eval "lt_\$var=\\\\\\"\\\`\\\$ECHO \\"\\\$\$var\\" \| \\\$SED \\"\\\$sed_quote_subst\\"\\\`\\\\\\"" ## exclude from sc_prohibit_nested_quotes
	;;
	*)
	eval "lt_\$var=\\\\\\"\\\$\$var\\\\\\""
	;;
	esac
	done

	# Double-quote double-evaled strings.
	for var in reload_cmds \
	old_postinstall_cmds \
	old_postuninstall_cmds \
	old_archive_cmds \
	extract_expsyms_cmds \
	old_archive_from_new_cmds \
	old_archive_from_expsyms_cmds \
	archive_cmds \
	archive_expsym_cmds \
	module_cmds \
	module_expsym_cmds \
	export_symbols_cmds \
	prelink_cmds \
	postlink_cmds \
	postinstall_cmds \
	postuninstall_cmds \
	finish_cmds \
	sys_lib_search_path_spec \
	configure_time_dlsearch_path \
	configure_time_lt_sys_library_path; do
	case \`eval \\\\\$ECHO \\\\""\\\\\$\$var"\\\\"\` in
	[\\\\\\\`\\"\\\$])
	eval "lt_\$var=\\\\\\"\\\`\\\$ECHO \\"\\\$\$var\\" \| \\\$SED -e \\"\\\$double_quote_subst\\" -e \\"\\\$sed_quote_subst\\" -e \\"\\\$delay_variable_subst\\"\\\`\\\\\\"" ## exclude from sc_prohibit_nested_quotes
	;;
	*)
	eval "lt_\$var=\\\\\\"\\\$\$var\\\\\\""
	;;
	esac
	done

	ac_aux_dir='$ac_aux_dir'

	# See if we are running on zsh, and set the options that allow our
	# commands through without removal of \ escapes INIT.
	if test -n "\${ZSH_VERSION+set}"; then
	setopt NO_GLOB_SUBST
	fi


	PACKAGE='$PACKAGE'
	VERSION='$VERSION'
	RM='$RM'
	ofile='$ofile'




	_ACEOF

	cat >>$CONFIG_STATUS <<\_ACEOF \|\| ac_write_fail=1

	# Handling of arguments.
	for ac_config_target in $ac_config_targets
	do
	case $ac_config_target in
	"libtool") CONFIG_COMMANDS="$CONFIG_COMMANDS libtool" ;;
	"disable-rpath") CONFIG_COMMANDS="$CONFIG_COMMANDS disable-rpath" ;;
	"Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;;
	"doc/example.conf") CONFIG_FILES="$CONFIG_FILES doc/example.conf" ;;
	"doc/libunbound.3") CONFIG_FILES="$CONFIG_FILES doc/libunbound.3" ;;
	"doc/unbound.8") CONFIG_FILES="$CONFIG_FILES doc/unbound.8" ;;
	"doc/unbound-anchor.8") CONFIG_FILES="$CONFIG_FILES doc/unbound-anchor.8" ;;
	"doc/unbound-checkconf.8") CONFIG_FILES="$CONFIG_FILES doc/unbound-checkconf.8" ;;
	"doc/unbound.conf.5") CONFIG_FILES="$CONFIG_FILES doc/unbound.conf.5" ;;
	"doc/unbound-control.8") CONFIG_FILES="$CONFIG_FILES doc/unbound-control.8" ;;
	"doc/unbound-host.1") CONFIG_FILES="$CONFIG_FILES doc/unbound-host.1" ;;
	"smallapp/unbound-control-setup.sh") CONFIG_FILES="$CONFIG_FILES smallapp/unbound-control-setup.sh" ;;
	"dnstap/dnstap_config.h") CONFIG_FILES="$CONFIG_FILES dnstap/dnstap_config.h" ;;
	"dnscrypt/dnscrypt_config.h") CONFIG_FILES="$CONFIG_FILES dnscrypt/dnscrypt_config.h" ;;
	"contrib/libunbound.pc") CONFIG_FILES="$CONFIG_FILES contrib/libunbound.pc" ;;
	"contrib/unbound.socket") CONFIG_FILES="$CONFIG_FILES contrib/unbound.socket" ;;
	"contrib/unbound.service") CONFIG_FILES="$CONFIG_FILES contrib/unbound.service" ;;
	"config.h") CONFIG_HEADERS="$CONFIG_HEADERS config.h" ;;

	*) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;;
	esac
	done


	# If the user did not use the arguments to specify the items to instantiate,
	# then the envvar interface is used. Set only those that are not.
	# We use the long form for the default assignment because of an extremely
	# bizarre bug on SunOS 4.1.3.
	if $ac_need_defaults; then
	test "${CONFIG_FILES+set}" = set \|\| CONFIG_FILES=$config_files
	test "${CONFIG_HEADERS+set}" = set \|\| CONFIG_HEADERS=$config_headers
	test "${CONFIG_COMMANDS+set}" = set \|\| CONFIG_COMMANDS=$config_commands
	fi

	# Have a temporary directory for convenience. Make it in the build tree
	# simply because there is no reason against having it here, and in addition,
	# creating and moving files from /tmp can sometimes cause problems.
	# Hook for its removal unless debugging.
	# Note that there is a small window in which the directory will not be cleaned:
	# after its creation but before its name has been assigned to `$tmp'.
	$debug \|\|
	{
	tmp= ac_tmp=
	trap 'exit_status=$?
	: "${ac_tmp:=$tmp}"
	{ test ! -d "$ac_tmp" \|\| rm -fr "$ac_tmp"; } && exit $exit_status
	' 0
	trap 'as_fn_exit 1' 1 2 13 15
	}
	# Create a (secure) tmp directory for tmp files.

	{
	tmp=`(umask 077 && mktemp -d "./confXXXXXX") 2>/dev/null` &&
	test -d "$tmp"
	} \|\|
	{
	tmp=./conf$$-$RANDOM
	(umask 077 && mkdir "$tmp")
	} \|\| as_fn_error $? "cannot create a temporary directory in ." "$LINENO" 5
	ac_tmp=$tmp

	# Set up the scripts for CONFIG_FILES section.
	# No need to generate them if there are no CONFIG_FILES.
	# This happens for instance with `./config.status config.h'.
	if test -n "$CONFIG_FILES"; then


	ac_cr=`echo X \| tr X '\015'`
	# On cygwin, bash can eat \r inside `` if the user requested igncr.
	# But we know of no other shell where ac_cr would be empty at this
	# point, so we can use a bashism as a fallback.
	if test "x$ac_cr" = x; then
	eval ac_cr=\$\'\\r\'
	fi
	ac_cs_awk_cr=`$AWK 'BEGIN { print "a\rb" }' </dev/null 2>/dev/null`
	if test "$ac_cs_awk_cr" = "a${ac_cr}b"; then
	ac_cs_awk_cr='\\r'
	else
	ac_cs_awk_cr=$ac_cr
	fi

	echo 'BEGIN {' >"$ac_tmp/subs1.awk" &&
	_ACEOF


	{
	echo "cat >conf$$subs.awk <<_ACEOF" &&
	echo "$ac_subst_vars" \| sed 's/.*/&!$&$ac_delim/' &&
	echo "_ACEOF"
	} >conf$$subs.sh \|\|
	as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5
	ac_delim_num=`echo "$ac_subst_vars" \| grep -c '^'`
	ac_delim='%!_!# '
	for ac_last_try in false false false false false :; do
	. ./conf$$subs.sh \|\|
	as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5

	ac_delim_n=`sed -n "s/.*$ac_delim\$/X/p" conf$$subs.awk \| grep -c X`
	if test $ac_delim_n = $ac_delim_num; then
	break
	elif $ac_last_try; then
	as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5
	else
	ac_delim="$ac_delim!$ac_delim _$ac_delim!! "
	fi
	done
	rm -f conf$$subs.sh

	cat >>$CONFIG_STATUS <<_ACEOF \|\| ac_write_fail=1
	cat >>"\$ac_tmp/subs1.awk" <<\\_ACAWK &&
	_ACEOF
	sed -n '
	h
	s/^/S["/; s/!.*/"]=/
	p
	g
	s/^[^!]*!//
	:repl
	t repl
	s/'"$ac_delim"'$//
	t delim
	:nl
	h
	s/$.\{148\}$..*/\1/
	t more1
	s/["\\]/\\&/g; s/^/"/; s/$/\\n"\\/
	p
	n
	b repl
	:more1
	s/["\\]/\\&/g; s/^/"/; s/$/"\\/
	p
	g
	s/.\{148\}//
	t nl
	:delim
	h
	s/$.\{148\}$..*/\1/
	t more2
	s/["\\]/\\&/g; s/^/"/; s/$/"/
	p
	b
	:more2
	s/["\\]/\\&/g; s/^/"/; s/$/"\\/
	p
	g
	s/.\{148\}//
	t delim
	' <conf$$subs.awk \| sed '
	/^[^""]/{
	N
	s/\n//
	}
	' >>$CONFIG_STATUS \|\| ac_write_fail=1
	rm -f conf$$subs.awk
	cat >>$CONFIG_STATUS <<_ACEOF \|\| ac_write_fail=1
	_ACAWK
	cat >>"\$ac_tmp/subs1.awk" <<_ACAWK &&
	for (key in S) S_is_set[key] = 1
	FS = ""

	}
	{
	line = $ 0
	nfields = split(line, field, "@")
	substed = 0
	len = length(field[1])
	for (i = 2; i < nfields; i++) {
	key = field[i]
	keylen = length(key)
	if (S_is_set[key]) {
	value = S[key]
	line = substr(line, 1, len) "" value "" substr(line, len + keylen + 3)
	len += length(value) + length(field[++i])
	substed = 1
	} else
	len += 1 + keylen
	}

	print line
	}

	_ACAWK
	_ACEOF
	cat >>$CONFIG_STATUS <<\_ACEOF \|\| ac_write_fail=1
	if sed "s/$ac_cr//" < /dev/null > /dev/null 2>&1; then
	sed "s/$ac_cr\$//; s/$ac_cr/$ac_cs_awk_cr/g"
	else
	cat
	fi < "$ac_tmp/subs1.awk" > "$ac_tmp/subs.awk" \
	\|\| as_fn_error $? "could not setup config files machinery" "$LINENO" 5
	_ACEOF

	# VPATH may cause trouble with some makes, so we remove sole $(srcdir),
	# ${srcdir} and @srcdir@ entries from VPATH if srcdir is ".", strip leading and
	# trailing colons and then remove the whole line if VPATH becomes empty
	# (actually we leave an empty line to preserve line numbers).
	if test "x$srcdir" = x.; then
	ac_vpsub='/^[ ]VPATH[ ]=[ ]*/{
	h
	s///
	s/^/:/
	s/[ ]*$/:/
	s/:\$(srcdir):/:/g
	s/:\${srcdir}:/:/g
	s/:@srcdir@:/:/g
	s/^:*//
	s/:*$//
	x
	s/$=[ ]$./\1/
	G
	s/\n//
	s/^[^=]=[ ]$//
	}'
	fi

	cat >>$CONFIG_STATUS <<\_ACEOF \|\| ac_write_fail=1
	fi # test -n "$CONFIG_FILES"

	# Set up the scripts for CONFIG_HEADERS section.
	# No need to generate them if there are no CONFIG_HEADERS.
	# This happens for instance with `./config.status Makefile'.
	if test -n "$CONFIG_HEADERS"; then
	cat >"$ac_tmp/defines.awk" <<\_ACAWK \|\|
	BEGIN {
	_ACEOF

	# Transform confdefs.h into an awk script `defines.awk', embedded as
	# here-document in config.status, that substitutes the proper values into
	# config.h.in to produce config.h.

	# Create a delimiter string that does not exist in confdefs.h, to ease
	# handling of long lines.
	ac_delim='%!_!# '
	for ac_last_try in false false :; do
	ac_tt=`sed -n "/$ac_delim/p" confdefs.h`
	if test -z "$ac_tt"; then
	break
	elif $ac_last_try; then
	as_fn_error $? "could not make $CONFIG_HEADERS" "$LINENO" 5
	else
	ac_delim="$ac_delim!$ac_delim _$ac_delim!! "
	fi
	done

	# For the awk script, D is an array of macro values keyed by name,
	# likewise P contains macro parameters if any. Preserve backslash
	# newline sequences.

	ac_word_re=[_$as_cr_Letters][_$as_cr_alnum]*
	sed -n '
	s/.\{148\}/&'"$ac_delim"'/g
	t rset
	:rset
	s/^[ ]#[ ]define[ ][ ]*/ /
	t def
	d
	:def
	s/\\$//
	t bsnl
	s/["\\]/\\&/g
	s/^ $'"$ac_word_re"'$$([^()])$[ ]$.*$/P["\1"]="\2"\
	D["\1"]=" \3"/p
	s/^ $'"$ac_word_re"'$[ ]$.$/D["\1"]=" \2"/p
	d
	:bsnl
	s/["\\]/\\&/g
	s/^ $'"$ac_word_re"'$$([^()])$[ ]$.*$/P["\1"]="\2"\
	D["\1"]=" \3\\\\\\n"\\/p
	t cont
	s/^ $'"$ac_word_re"'$[ ]$.$/D["\1"]=" \2\\\\\\n"\\/p
	t cont
	d
	:cont
	n
	s/.\{148\}/&'"$ac_delim"'/g
	t clear
	:clear
	s/\\$//
	t bsnlc
	s/["\\]/\\&/g; s/^/"/; s/$/"/p
	d
	:bsnlc
	s/["\\]/\\&/g; s/^/"/; s/$/\\\\\\n"\\/p
	b cont
	' <confdefs.h \| sed '
	s/'"$ac_delim"'/"\\\
	"/g' >>$CONFIG_STATUS \|\| ac_write_fail=1

	cat >>$CONFIG_STATUS <<_ACEOF \|\| ac_write_fail=1
	for (key in D) D_is_set[key] = 1
	FS = ""
	}
	/^[\t ]#[\t ](define\|undef)[\t ]+$ac_word_re([\t (]\|\$)/ {
	line = \$ 0
	split(line, arg, " ")
	if (arg[1] == "#") {
	defundef = arg[2]
	mac1 = arg[3]
	} else {
	defundef = substr(arg[1], 2)
	mac1 = arg[2]
	}
	split(mac1, mac2, "(") #)
	macro = mac2[1]
	prefix = substr(line, 1, index(line, defundef) - 1)
	if (D_is_set[macro]) {
	# Preserve the white space surrounding the "#".
	print prefix "define", macro P[macro] D[macro]
	next
	} else {
	# Replace #undef with comments. This is necessary, for example,
	# in the case of _POSIX_SOURCE, which is predefined and required
	# on some systems where configure will not decide to define it.
	if (defundef == "undef") {
	print "/", prefix defundef, macro, "/"
	next
	}
	}
	}
	{ print }
	_ACAWK
	_ACEOF
	cat >>$CONFIG_STATUS <<\_ACEOF \|\| ac_write_fail=1
	as_fn_error $? "could not setup config headers machinery" "$LINENO" 5
	fi # test -n "$CONFIG_HEADERS"


	eval set X " :F $CONFIG_FILES :H $CONFIG_HEADERS :C $CONFIG_COMMANDS"
	shift
	for ac_tag
	do
	case $ac_tag in
	:[FHLC]) ac_mode=$ac_tag; continue;;
	esac
	case $ac_mode$ac_tag in
	:[FHL]:);;
	:L* \| :C:) as_fn_error $? "invalid tag \`$ac_tag'" "$LINENO" 5;;
	:[FH]-) ac_tag=-:-;;
	:[FH]*) ac_tag=$ac_tag:$ac_tag.in;;
	esac
	ac_save_IFS=$IFS
	IFS=:
	set x $ac_tag
	IFS=$ac_save_IFS
	shift
	ac_file=$1
	shift

	case $ac_mode in
	:L) ac_source=$1;;
	:[FH])
	ac_file_inputs=
	for ac_f
	do
	case $ac_f in
	-) ac_f="$ac_tmp/stdin";;
	*) # Look for the file first in the build tree, then in the source tree
	# (if the path is not absolute). The absolute path cannot be DOS-style,
	# because $ac_f cannot contain `:'.
	test -f "$ac_f" \|\|
	case $ac_f in
	[\\/$]*) false;;
	*) test -f "$srcdir/$ac_f" && ac_f="$srcdir/$ac_f";;
	esac \|\|
	as_fn_error 1 "cannot find input file: \`$ac_f'" "$LINENO" 5;;
	esac
	case $ac_f in \') ac_f=`$as_echo "$ac_f" \| sed "s/'/'\\\\\\\\''/g"`;; esac
	as_fn_append ac_file_inputs " '$ac_f'"
	done

	# Let's still pretend it is `configure' which instantiates (i.e., don't
	# use $as_me), people would be surprised to read:
	# /* config.h. Generated by config.status. */
	configure_input='Generated from '`
	$as_echo "$" \| sed 's\|^[^:]/\|\|;s\|:[^:]*/\|, \|g'
	`' by configure.'
	if test x"$ac_file" != x-; then
	configure_input="$ac_file. $configure_input"
	{ $as_echo "$as_me:${as_lineno-$LINENO}: creating $ac_file" >&5
	$as_echo "$as_me: creating $ac_file" >&6;}
	fi
	# Neutralize special characters interpreted by sed in replacement strings.
	case $configure_input in #(
	\& \| \\| \| \\ )
	ac_sed_conf_input=`$as_echo "$configure_input" \|
	sed 's/[\\\\&\|]/\\\\&/g'`;; #(
	*) ac_sed_conf_input=$configure_input;;
	esac

	case $ac_tag in
	:-: \| *:-) cat >"$ac_tmp/stdin" \
	\|\| as_fn_error $? "could not create $ac_file" "$LINENO" 5 ;;
	esac
	;;
	esac

	ac_dir=`$as_dirname -- "$ac_file" \|\|
	$as_expr X"$ac_file" : 'X$.[^/]$//[^/][^/]/$' \\| \
	X"$ac_file" : 'X$//$[^/]' \\| \
	X"$ac_file" : 'X$//$$' \\| \
	X"$ac_file" : 'X$/$' \\| . 2>/dev/null \|\|
	$as_echo X"$ac_file" \|
	sed '/^X$.[^/]$\/\/[^/][^/]\/$/{
	s//\1/
	q
	}
	/^X$\/\/$[^/].*/{
	s//\1/
	q
	}
	/^X$\/\/$$/{
	s//\1/
	q
	}
	/^X$\/$.*/{
	s//\1/
	q
	}
	s/.*/./; q'`
	as_dir="$ac_dir"; as_fn_mkdir_p
	ac_builddir=.

	case "$ac_dir" in
	.) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;;
	*)
	ac_dir_suffix=/`$as_echo "$ac_dir" \| sed 's\|^\.[\\/]\|\|'`
	# A ".." for each directory in $ac_dir_suffix.
	ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" \| sed 's\|/[^\\/]*\|/..\|g;s\|/\|\|'`
	case $ac_top_builddir_sub in
	"") ac_top_builddir_sub=. ac_top_build_prefix= ;;
	*) ac_top_build_prefix=$ac_top_builddir_sub/ ;;
	esac ;;
	esac
	ac_abs_top_builddir=$ac_pwd
	ac_abs_builddir=$ac_pwd$ac_dir_suffix
	# for backward compatibility:
	ac_top_builddir=$ac_top_build_prefix

	case $srcdir in
	.) # We are building in place.
	ac_srcdir=.
	ac_top_srcdir=$ac_top_builddir_sub
	ac_abs_top_srcdir=$ac_pwd ;;
	[\\/]* \| ?:[\\/]* ) # Absolute name.
	ac_srcdir=$srcdir$ac_dir_suffix;
	ac_top_srcdir=$srcdir
	ac_abs_top_srcdir=$srcdir ;;
	*) # Relative name.
	ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix
	ac_top_srcdir=$ac_top_build_prefix$srcdir
	ac_abs_top_srcdir=$ac_pwd/$srcdir ;;
	esac
	ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix


	case $ac_mode in
	:F)
	#
	# CONFIG_FILE
	#

	_ACEOF

	cat >>$CONFIG_STATUS <<\_ACEOF \|\| ac_write_fail=1
	# If the template does not know about datarootdir, expand it.
	# FIXME: This hack should be removed a few years after 2.60.
	ac_datarootdir_hack=; ac_datarootdir_seen=
	ac_sed_dataroot='
	/datarootdir/ {
	p
	q
	}
	/@datadir@/p
	/@docdir@/p
	/@infodir@/p
	/@localedir@/p
	/@mandir@/p'
	case `eval "sed -n \"\$ac_sed_dataroot\" $ac_file_inputs"` in
	datarootdir) ac_datarootdir_seen=yes;;
	@datadir@\|@docdir@\|@infodir@\|@localedir@\|@mandir@)
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5
	$as_echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;}
	_ACEOF
	cat >>$CONFIG_STATUS <<_ACEOF \|\| ac_write_fail=1
	ac_datarootdir_hack='
	s&@datadir@&$datadir&g
	s&@docdir@&$docdir&g
	s&@infodir@&$infodir&g
	s&@localedir@&$localedir&g
	s&@mandir@&$mandir&g
	s&\\\${datarootdir}&$datarootdir&g' ;;
	esac
	_ACEOF

	# Neutralize VPATH when `$srcdir' = `.'.
	# Shell code in configure.ac might set extrasub.
	# FIXME: do we really want to maintain this feature?
	cat >>$CONFIG_STATUS <<_ACEOF \|\| ac_write_fail=1
	ac_sed_extra="$ac_vpsub
	$extrasub
	_ACEOF
	cat >>$CONFIG_STATUS <<\_ACEOF \|\| ac_write_fail=1
	:t
	/@[a-zA-Z_][a-zA-Z_0-9]*@/!b
	s\|@configure_input@\|$ac_sed_conf_input\|;t t
	s&@top_builddir@&$ac_top_builddir_sub&;t t
	s&@top_build_prefix@&$ac_top_build_prefix&;t t
	s&@srcdir@&$ac_srcdir&;t t
	s&@abs_srcdir@&$ac_abs_srcdir&;t t
	s&@top_srcdir@&$ac_top_srcdir&;t t
	s&@abs_top_srcdir@&$ac_abs_top_srcdir&;t t
	s&@builddir@&$ac_builddir&;t t
	s&@abs_builddir@&$ac_abs_builddir&;t t
	s&@abs_top_builddir@&$ac_abs_top_builddir&;t t
	$ac_datarootdir_hack
	"
	eval sed \"\$ac_sed_extra\" "$ac_file_inputs" \| $AWK -f "$ac_tmp/subs.awk" \
	>$ac_tmp/out \|\| as_fn_error $? "could not create $ac_file" "$LINENO" 5

	test -z "$ac_datarootdir_hack$ac_datarootdir_seen" &&
	{ ac_out=`sed -n '/\${datarootdir}/p' "$ac_tmp/out"`; test -n "$ac_out"; } &&
	{ ac_out=`sed -n '/^[ ]datarootdir[ ]:*=/p' \
	"$ac_tmp/out"`; test -z "$ac_out"; } &&
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file contains a reference to the variable \`datarootdir'
	which seems to be undefined. Please make sure it is defined" >&5
	$as_echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir'
	which seems to be undefined. Please make sure it is defined" >&2;}

	rm -f "$ac_tmp/stdin"
	case $ac_file in
	-) cat "$ac_tmp/out" && rm -f "$ac_tmp/out";;
	*) rm -f "$ac_file" && mv "$ac_tmp/out" "$ac_file";;
	esac \
	\|\| as_fn_error $? "could not create $ac_file" "$LINENO" 5
	;;
	:H)
	#
	# CONFIG_HEADER
	#
	if test x"$ac_file" != x-; then
	{
	$as_echo "/* $configure_input */" \
	&& eval '$AWK -f "$ac_tmp/defines.awk"' "$ac_file_inputs"
	} >"$ac_tmp/config.h" \
	\|\| as_fn_error $? "could not create $ac_file" "$LINENO" 5
	if diff "$ac_file" "$ac_tmp/config.h" >/dev/null 2>&1; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: $ac_file is unchanged" >&5
	$as_echo "$as_me: $ac_file is unchanged" >&6;}
	else
	rm -f "$ac_file"
	mv "$ac_tmp/config.h" "$ac_file" \
	\|\| as_fn_error $? "could not create $ac_file" "$LINENO" 5
	fi
	else
	$as_echo "/* $configure_input */" \
	&& eval '$AWK -f "$ac_tmp/defines.awk"' "$ac_file_inputs" \
	\|\| as_fn_error $? "could not create -" "$LINENO" 5
	fi
	;;

	:C) { $as_echo "$as_me:${as_lineno-$LINENO}: executing $ac_file commands" >&5
	$as_echo "$as_me: executing $ac_file commands" >&6;}
	;;
	esac


	case $ac_file$ac_mode in
	"libtool":C)

	# See if we are running on zsh, and set the options that allow our
	# commands through without removal of \ escapes.
	if test -n "${ZSH_VERSION+set}"; then
	setopt NO_GLOB_SUBST
	fi

	cfgfile=${ofile}T
	trap "$RM \"$cfgfile\"; exit 1" 1 2 15
	$RM "$cfgfile"

	cat <<_LT_EOF >> "$cfgfile"
	#! $SHELL
	# Generated automatically by $as_me ($PACKAGE) $VERSION
	# Libtool was configured on host `(hostname \|\| uname -n) 2>/dev/null \| sed 1q`:
	# NOTE: Changes made to this file will be lost: look at ltmain.sh.

	# Provide generalized library-building support services.
	# Written by Gordon Matzigkeit, 1996

	# Copyright (C) 2014 Free Software Foundation, Inc.
	# This is free software; see the source for copying conditions. There is NO
	# warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

	# GNU Libtool is free software; you can redistribute it and/or modify
	# it under the terms of the GNU General Public License as published by
	# the Free Software Foundation; either version 2 of of the License, or
	# (at your option) any later version.
	#
	# As a special exception to the GNU General Public License, if you
	# distribute this file as part of a program or library that is built
	# using GNU Libtool, you may include this file under the same
	# distribution terms that you use for the rest of that program.
	#
	# GNU Libtool is distributed in the hope that it will be useful, but
	# WITHOUT ANY WARRANTY; without even the implied warranty of
	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	# GNU General Public License for more details.
	#
	# You should have received a copy of the GNU General Public License
	# along with this program. If not, see <http://www.gnu.org/licenses/>.


	# The names of the tagged configurations supported by this script.
	available_tags=''

	# Configured defaults for sys_lib_dlsearch_path munging.
	: \${LT_SYS_LIBRARY_PATH="$configure_time_lt_sys_library_path"}

	# ### BEGIN LIBTOOL CONFIG

	# Which release of libtool.m4 was used?
	macro_version=$macro_version
	macro_revision=$macro_revision

	# Whether or not to build shared libraries.
	build_libtool_libs=$enable_shared

	# Whether or not to build static libraries.
	build_old_libs=$enable_static

	# What type of objects to build.
	pic_mode=$pic_mode

	# Whether or not to optimize for fast installation.
	fast_install=$enable_fast_install

	# Shared archive member basename,for filename based shared library versioning on AIX.
	shared_archive_member_spec=$shared_archive_member_spec

	# Shell to use when invoking shell scripts.
	SHELL=$lt_SHELL

	# An echo program that protects backslashes.
	ECHO=$lt_ECHO

	# The PATH separator for the build system.
	PATH_SEPARATOR=$lt_PATH_SEPARATOR

	# The host system.
	host_alias=$host_alias
	host=$host
	host_os=$host_os

	# The build system.
	build_alias=$build_alias
	build=$build
	build_os=$build_os

	# A sed program that does not truncate output.
	SED=$lt_SED

	# Sed that helps us avoid accidentally triggering echo(1) options like -n.
	Xsed="\$SED -e 1s/^X//"

	# A grep program that handles long lines.
	GREP=$lt_GREP

	# An ERE matcher.
	EGREP=$lt_EGREP

	# A literal string matcher.
	FGREP=$lt_FGREP

	# A BSD- or MS-compatible name lister.
	NM=$lt_NM

	# Whether we need soft or hard links.
	LN_S=$lt_LN_S

	# What is the maximum length of a command?
	max_cmd_len=$max_cmd_len

	# Object file suffix (normally "o").
	objext=$ac_objext

	# Executable file suffix (normally "").
	exeext=$exeext

	# whether the shell understands "unset".
	lt_unset=$lt_unset

	# turn spaces into newlines.
	SP2NL=$lt_lt_SP2NL

	# turn newlines into spaces.
	NL2SP=$lt_lt_NL2SP

	# convert \$build file names to \$host format.
	to_host_file_cmd=$lt_cv_to_host_file_cmd

	# convert \$build files to toolchain format.
	to_tool_file_cmd=$lt_cv_to_tool_file_cmd

	# An object symbol dumper.
	OBJDUMP=$lt_OBJDUMP

	# Method to check whether dependent libraries are shared objects.
	deplibs_check_method=$lt_deplibs_check_method

	# Command to use when deplibs_check_method = "file_magic".
	file_magic_cmd=$lt_file_magic_cmd

	# How to find potential files when deplibs_check_method = "file_magic".
	file_magic_glob=$lt_file_magic_glob

	# Find potential files using nocaseglob when deplibs_check_method = "file_magic".
	want_nocaseglob=$lt_want_nocaseglob

	# DLL creation program.
	DLLTOOL=$lt_DLLTOOL

	# Command to associate shared and link libraries.
	sharedlib_from_linklib_cmd=$lt_sharedlib_from_linklib_cmd

	# The archiver.
	AR=$lt_AR

	# Flags to create an archive.
	AR_FLAGS=$lt_AR_FLAGS

	# How to feed a file listing to the archiver.
	archiver_list_spec=$lt_archiver_list_spec

	# A symbol stripping program.
	STRIP=$lt_STRIP

	# Commands used to install an old-style archive.
	RANLIB=$lt_RANLIB
	old_postinstall_cmds=$lt_old_postinstall_cmds
	old_postuninstall_cmds=$lt_old_postuninstall_cmds

	# Whether to use a lock for old archive extraction.
	lock_old_archive_extraction=$lock_old_archive_extraction

	# A C compiler.
	LTCC=$lt_CC

	# LTCC compiler flags.
	LTCFLAGS=$lt_CFLAGS

	# Take the output of nm and produce a listing of raw symbols and C names.
	global_symbol_pipe=$lt_lt_cv_sys_global_symbol_pipe

	# Transform the output of nm in a proper C declaration.
	global_symbol_to_cdecl=$lt_lt_cv_sys_global_symbol_to_cdecl

	# Transform the output of nm into a list of symbols to manually relocate.
	global_symbol_to_import=$lt_lt_cv_sys_global_symbol_to_import

	# Transform the output of nm in a C name address pair.
	global_symbol_to_c_name_address=$lt_lt_cv_sys_global_symbol_to_c_name_address

	# Transform the output of nm in a C name address pair when lib prefix is needed.
	global_symbol_to_c_name_address_lib_prefix=$lt_lt_cv_sys_global_symbol_to_c_name_address_lib_prefix

	# The name lister interface.
	nm_interface=$lt_lt_cv_nm_interface

	# Specify filename containing input files for \$NM.
	nm_file_list_spec=$lt_nm_file_list_spec

	# The root where to search for dependent libraries,and where our libraries should be installed.
	lt_sysroot=$lt_sysroot

	# Command to truncate a binary pipe.
	lt_truncate_bin=$lt_lt_cv_truncate_bin

	# The name of the directory that contains temporary libtool files.
	objdir=$objdir

	# Used to examine libraries when file_magic_cmd begins with "file".
	MAGIC_CMD=$MAGIC_CMD

	# Must we lock files when doing compilation?
	need_locks=$lt_need_locks

	# Manifest tool.
	MANIFEST_TOOL=$lt_MANIFEST_TOOL

	# Tool to manipulate archived DWARF debug symbol files on Mac OS X.
	DSYMUTIL=$lt_DSYMUTIL

	# Tool to change global to local symbols on Mac OS X.
	NMEDIT=$lt_NMEDIT

	# Tool to manipulate fat objects and archives on Mac OS X.
	LIPO=$lt_LIPO

	# ldd/readelf like tool for Mach-O binaries on Mac OS X.
	OTOOL=$lt_OTOOL

	# ldd/readelf like tool for 64 bit Mach-O binaries on Mac OS X 10.4.
	OTOOL64=$lt_OTOOL64

	# Old archive suffix (normally "a").
	libext=$libext

	# Shared library suffix (normally ".so").
	shrext_cmds=$lt_shrext_cmds

	# The commands to extract the exported symbol list from a shared archive.
	extract_expsyms_cmds=$lt_extract_expsyms_cmds

	# Variables whose values should be saved in libtool wrapper scripts and
	# restored at link time.
	variables_saved_for_relink=$lt_variables_saved_for_relink

	# Do we need the "lib" prefix for modules?
	need_lib_prefix=$need_lib_prefix

	# Do we need a version for libraries?
	need_version=$need_version

	# Library versioning type.
	version_type=$version_type

	# Shared library runtime path variable.
	runpath_var=$runpath_var

	# Shared library path variable.
	shlibpath_var=$shlibpath_var

	# Is shlibpath searched before the hard-coded library search path?
	shlibpath_overrides_runpath=$shlibpath_overrides_runpath

	# Format of library name prefix.
	libname_spec=$lt_libname_spec

	# List of archive names. First name is the real one, the rest are links.
	# The last name is the one that the linker finds with -lNAME
	library_names_spec=$lt_library_names_spec

	# The coded name of the library, if different from the real name.
	soname_spec=$lt_soname_spec

	# Permission mode override for installation of shared libraries.
	install_override_mode=$lt_install_override_mode

	# Command to use after installation of a shared archive.
	postinstall_cmds=$lt_postinstall_cmds

	# Command to use after uninstallation of a shared archive.
	postuninstall_cmds=$lt_postuninstall_cmds

	# Commands used to finish a libtool library installation in a directory.
	finish_cmds=$lt_finish_cmds

	# As "finish_cmds", except a single script fragment to be evaled but
	# not shown.
	finish_eval=$lt_finish_eval

	# Whether we should hardcode library paths into libraries.
	hardcode_into_libs=$hardcode_into_libs

	# Compile-time system search path for libraries.
	sys_lib_search_path_spec=$lt_sys_lib_search_path_spec

	# Detected run-time system search path for libraries.
	sys_lib_dlsearch_path_spec=$lt_configure_time_dlsearch_path

	# Explicit LT_SYS_LIBRARY_PATH set during ./configure time.
	configure_time_lt_sys_library_path=$lt_configure_time_lt_sys_library_path

	# Whether dlopen is supported.
	dlopen_support=$enable_dlopen

	# Whether dlopen of programs is supported.
	dlopen_self=$enable_dlopen_self

	# Whether dlopen of statically linked programs is supported.
	dlopen_self_static=$enable_dlopen_self_static

	# Commands to strip libraries.
	old_striplib=$lt_old_striplib
	striplib=$lt_striplib


	# The linker used to build libraries.
	LD=$lt_LD

	# How to create reloadable object files.
	reload_flag=$lt_reload_flag
	reload_cmds=$lt_reload_cmds

	# Commands used to build an old-style archive.
	old_archive_cmds=$lt_old_archive_cmds

	# A language specific compiler.
	CC=$lt_compiler

	# Is the compiler the GNU compiler?
	with_gcc=$GCC

	# Compiler flag to turn off builtin functions.
	no_builtin_flag=$lt_lt_prog_compiler_no_builtin_flag

	# Additional compiler flags for building library objects.
	pic_flag=$lt_lt_prog_compiler_pic

	# How to pass a linker flag through the compiler.
	wl=$lt_lt_prog_compiler_wl

	# Compiler flag to prevent dynamic linking.
	link_static_flag=$lt_lt_prog_compiler_static

	# Does compiler simultaneously support -c and -o options?
	compiler_c_o=$lt_lt_cv_prog_compiler_c_o

	# Whether or not to add -lc for building shared libraries.
	build_libtool_need_lc=$archive_cmds_need_lc

	# Whether or not to disallow shared libs when runtime libs are static.
	allow_libtool_libs_with_static_runtimes=$enable_shared_with_static_runtimes

	# Compiler flag to allow reflexive dlopens.
	export_dynamic_flag_spec=$lt_export_dynamic_flag_spec

	# Compiler flag to generate shared objects directly from archives.
	whole_archive_flag_spec=$lt_whole_archive_flag_spec

	# Whether the compiler copes with passing no objects directly.
	compiler_needs_object=$lt_compiler_needs_object

	# Create an old-style archive from a shared archive.
	old_archive_from_new_cmds=$lt_old_archive_from_new_cmds

	# Create a temporary old-style archive to link instead of a shared archive.
	old_archive_from_expsyms_cmds=$lt_old_archive_from_expsyms_cmds

	# Commands used to build a shared archive.
	archive_cmds=$lt_archive_cmds
	archive_expsym_cmds=$lt_archive_expsym_cmds

	# Commands used to build a loadable module if different from building
	# a shared archive.
	module_cmds=$lt_module_cmds
	module_expsym_cmds=$lt_module_expsym_cmds

	# Whether we are building with GNU ld or not.
	with_gnu_ld=$lt_with_gnu_ld

	# Flag that allows shared libraries with undefined symbols to be built.
	allow_undefined_flag=$lt_allow_undefined_flag

	# Flag that enforces no undefined symbols.
	no_undefined_flag=$lt_no_undefined_flag

	# Flag to hardcode \$libdir into a binary during linking.
	# This must work even if \$libdir does not exist
	hardcode_libdir_flag_spec=$lt_hardcode_libdir_flag_spec

	# Whether we need a single "-rpath" flag with a separated argument.
	hardcode_libdir_separator=$lt_hardcode_libdir_separator

	# Set to "yes" if using DIR/libNAME\$shared_ext during linking hardcodes
	# DIR into the resulting binary.
	hardcode_direct=$hardcode_direct

	# Set to "yes" if using DIR/libNAME\$shared_ext during linking hardcodes
	# DIR into the resulting binary and the resulting library dependency is
	# "absolute",i.e impossible to change by setting \$shlibpath_var if the
	# library is relocated.
	hardcode_direct_absolute=$hardcode_direct_absolute

	# Set to "yes" if using the -LDIR flag during linking hardcodes DIR
	# into the resulting binary.
	hardcode_minus_L=$hardcode_minus_L

	# Set to "yes" if using SHLIBPATH_VAR=DIR during linking hardcodes DIR
	# into the resulting binary.
	hardcode_shlibpath_var=$hardcode_shlibpath_var

	# Set to "yes" if building a shared library automatically hardcodes DIR
	# into the library and all subsequent libraries and executables linked
	# against it.
	hardcode_automatic=$hardcode_automatic

	# Set to yes if linker adds runtime paths of dependent libraries
	# to runtime path list.
	inherit_rpath=$inherit_rpath

	# Whether libtool must link a program against all its dependency libraries.
	link_all_deplibs=$link_all_deplibs

	# Set to "yes" if exported symbols are required.
	always_export_symbols=$always_export_symbols

	# The commands to list exported symbols.
	export_symbols_cmds=$lt_export_symbols_cmds

	# Symbols that should not be listed in the preloaded symbols.
	exclude_expsyms=$lt_exclude_expsyms

	# Symbols that must always be exported.
	include_expsyms=$lt_include_expsyms

	# Commands necessary for linking programs (against libraries) with templates.
	prelink_cmds=$lt_prelink_cmds

	# Commands necessary for finishing linking programs.
	postlink_cmds=$lt_postlink_cmds

	# Specify filename containing input files.
	file_list_spec=$lt_file_list_spec

	# How to hardcode a shared library path into an executable.
	hardcode_action=$hardcode_action

	# ### END LIBTOOL CONFIG

	_LT_EOF

	cat <<'_LT_EOF' >> "$cfgfile"

	# ### BEGIN FUNCTIONS SHARED WITH CONFIGURE

	# func_munge_path_list VARIABLE PATH
	# -----------------------------------
	# VARIABLE is name of variable containing _space_ separated list of
	# directories to be munged by the contents of PATH, which is string
	# having a format:
	# "DIR[:DIR]:"
	# string "DIR[ DIR]" will be prepended to VARIABLE
	# ":DIR[:DIR]"
	# string "DIR[ DIR]" will be appended to VARIABLE
	# "DIRP[:DIRP]::[DIRA:]DIRA"
	# string "DIRP[ DIRP]" will be prepended to VARIABLE and string
	# "DIRA[ DIRA]" will be appended to VARIABLE
	# "DIR[:DIR]"
	# VARIABLE will be replaced by "DIR[ DIR]"
	func_munge_path_list ()
	{
	case x$2 in
	x)
	;;
	*:)
	eval $1=\"`$ECHO $2 \| $SED 's/:/ /g'` \$$1\"
	;;
	x:*)
	eval $1=\"\$$1 `$ECHO $2 \| $SED 's/:/ /g'`\"
	;;
	::)
	eval $1=\"\$$1\ `$ECHO $2 \| $SED -e 's/.*:://' -e 's/:/ /g'`\"
	eval $1=\"`$ECHO $2 \| $SED -e 's/::.*//' -e 's/:/ /g'`\ \$$1\"
	;;
	*)
	eval $1=\"`$ECHO $2 \| $SED 's/:/ /g'`\"
	;;
	esac
	}


	# Calculate cc_basename. Skip known compiler wrappers and cross-prefix.
	func_cc_basename ()
	{
	for cc_temp in $*""; do
	case $cc_temp in
	compile \| [\\/]compile \| ccache \| [\\/]ccache ) ;;
	distcc \| [\\/]distcc \| purify \| [\\/]purify ) ;;
	\-*) ;;
	*) break;;
	esac
	done
	func_cc_basename_result=`$ECHO "$cc_temp" \| $SED "s%.*/%%; s%^$host_alias-%%"`
	}


	# ### END FUNCTIONS SHARED WITH CONFIGURE

	_LT_EOF

	case $host_os in
	aix3*)
	cat <<\_LT_EOF >> "$cfgfile"
	# AIX sometimes has problems with the GCC collect2 program. For some
	# reason, if we set the COLLECT_NAMES environment variable, the problems
	# vanish in a puff of smoke.
	if test set != "${COLLECT_NAMES+set}"; then
	COLLECT_NAMES=
	export COLLECT_NAMES
	fi
	_LT_EOF
	;;
	esac


	ltmain=$ac_aux_dir/ltmain.sh


	# We use sed instead of cat because bash on DJGPP gets confused if
	# if finds mixed CR/LF and LF-only lines. Since sed operates in
	# text mode, it properly converts lines to CR/LF. This bash problem
	# is reportedly fixed, but why not run on old versions too?
	sed '$q' "$ltmain" >> "$cfgfile" \
	\|\| (rm -f "$cfgfile"; exit 1)

	mv -f "$cfgfile" "$ofile" \|\|
	(rm -f "$ofile" && cp "$cfgfile" "$ofile" && rm -f "$cfgfile")
	chmod +x "$ofile"

	;;
	"disable-rpath":C)
	sed < libtool > libtool-2 \
	's/^hardcode_libdir_flag_spec.*$'/'hardcode_libdir_flag_spec=" -D__LIBTOOL_RPATH_SED__ "/'
	mv libtool-2 libtool
	chmod 755 libtool
	libtool="./libtool"
	;;

	esac
	done # for ac_tag


	as_fn_exit 0
	_ACEOF
	ac_clean_files=$ac_clean_files_save

	test $ac_write_fail = 0 \|\|
	as_fn_error $? "write failure creating $CONFIG_STATUS" "$LINENO" 5


	# configure is writing to config.log, and then calls config.status.
	# config.status does its own redirection, appending to config.log.
	# Unfortunately, on DOS this fails, as config.log is still kept open
	# by configure, so config.status won't be able to write to it; its
	# output is simply discarded. So we exec the FD to /dev/null,
	# effectively closing config.log, so it can be properly (re)opened and
	# appended to by config.status. When coming back to configure, we
	# need to make the FD available again.
	if test "$no_create" != yes; then
	ac_cs_success=:
	ac_config_status_args=
	test "$silent" = yes &&
	ac_config_status_args="$ac_config_status_args --quiet"
	exec 5>/dev/null
	$SHELL $CONFIG_STATUS $ac_config_status_args \|\| ac_cs_success=false
	exec 5>>config.log
	# Use \|\|, not &&, to avoid exiting from the if with $? = 1, which
	# would make configure fail if this is the last instruction.
	$ac_cs_success \|\| as_fn_exit 1
	fi
	if test -n "$ac_unrecognized_opts" && test "$enable_option_checking" != no; then
	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5
	$as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;}
	fi

	Index: head/contrib/unbound/configure.ac
	===================================================================
	--- head/contrib/unbound/configure.ac (revision 349719)
	+++ head/contrib/unbound/configure.ac (revision 349720)
	@@ -1,1890 +1,1927 @@
	# -- Autoconf --
	# Process this file with autoconf to produce a configure script.
	AC_PREREQ(2.56)
	sinclude(acx_nlnetlabs.m4)
	sinclude(ax_pthread.m4)
	sinclude(acx_python.m4)
	sinclude(ac_pkg_swig.m4)
	sinclude(dnstap/dnstap.m4)
	sinclude(dnscrypt/dnscrypt.m4)

	# must be numbers. ac_defun because of later processing
	m4_define([VERSION_MAJOR],[1])
	-m4_define([VERSION_MINOR],[8])
	-m4_define([VERSION_MICRO],[1])
	+m4_define([VERSION_MINOR],[9])
	+m4_define([VERSION_MICRO],[2])
	AC_INIT(unbound, m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]), unbound-bugs@nlnetlabs.nl, unbound)
	AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
	AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
	AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])

	-LIBUNBOUND_CURRENT=8
	-LIBUNBOUND_REVISION=1
	-LIBUNBOUND_AGE=0
	+LIBUNBOUND_CURRENT=9
	+LIBUNBOUND_REVISION=2
	+LIBUNBOUND_AGE=1
	# 1.0.0 had 0:12:0
	# 1.0.1 had 0:13:0
	# 1.0.2 had 0:14:0
	# 1.1.0 had 0:15:0
	# 1.1.1 had 0:16:0
	# 1.2.0 had 0:17:0
	# 1.2.1 had 0:18:0
	# 1.3.0 had 1:0:0 # ub_cancel and -export-symbols.
	# 1.3.1 had 1:1:0
	# 1.3.2 had 1:2:0
	# 1.3.3 had 1:3:0
	# 1.3.4 had 1:4:0
	# 1.4.0-snapshots had 1:5:0
	# 1.4.0 had 1:5:0 (not 2:0:0) # ub_result.why_bogus
	# 1.4.1 had 2:1:0
	# 1.4.2 had 2:2:0
	# 1.4.3 had 2:3:0
	# 1.4.4 had 2:4:0
	# 1.4.5 had 2:5:0
	# 1.4.6 had 2:6:0
	# 1.4.7 had 2:7:0
	# 1.4.8 had 2:8:0
	# 1.4.9 had 2:9:0
	# 1.4.10 had 2:10:0
	# 1.4.11 had 2:11:0
	# 1.4.12 had 2:12:0
	# 1.4.13 had 2:13:0
	# and 1.4.13p1 and 1.4.13.p2
	# 1.4.14 had 2:14:0
	# 1.4.15 had 3:0:1 # adds ub_version()
	# 1.4.16 had 3:1:1
	# 1.4.17 had 3:2:1
	# 1.4.18 had 3:3:1
	# 1.4.19 had 3:4:1
	# 1.4.20 had 4:0:2 # adds libunbound.ttl # but shipped 3:5:1
	# 1.4.21 had 4:1:2
	# 1.4.22 had 4:1:2
	# 1.5.0 had 5:3:3 # adds ub_ctx_add_ta_autr
	# 1.5.1 had 5:3:3
	# 1.5.2 had 5:5:3
	# 1.5.3 had 5:6:3
	# 1.5.4 had 5:7:3
	# 1.5.5 had 5:8:3
	# 1.5.6 had 5:9:3
	# 1.5.7 had 5:10:3
	# 1.5.8 had 6:0:4 # adds ub_ctx_set_stub
	# 1.5.9 had 6:1:4
	# 1.5.10 had 6:2:4
	# 1.6.0 had 6:3:4
	# 1.6.1 had 7:0:5 # ub_callback_t typedef renamed to ub_callback_type
	# 1.6.2 had 7:1:5
	# 1.6.3 had 7:2:5
	# 1.6.4 had 7:3:5
	# 1.6.5 had 7:4:5
	# 1.6.6 had 7:5:5
	# 1.6.7 had 7:6:5
	# 1.6.8 had 7:7:5
	# 1.7.0 had 7:8:5
	# 1.7.1 had 7:9:5
	# 1.7.2 had 7:10:5
	# 1.7.3 had 7:11:5
	# 1.8.0 had 8:0:0 # changes the event callback function signature
	# 1.8.1 had 8:1:0
	+# 1.8.2 had 8:2:0
	+# 1.8.3 had 8:3:0
	+# 1.9.0 had 9:0:1 # add ub_ctx_set_tls
	+# 1.9.1 had 9:1:1
	+# 1.9.2 had 9:2:1

	# Current -- the number of the binary API that we're implementing
	# Revision -- which iteration of the implementation of the binary
	# API are we supplying?
	# Age -- How many previous binary API versions do we also
	# support?
	#
	# If we release a new version that does not change the binary API,
	# increment Revision.
	#
	# If we release a new version that changes the binary API, but does
	# not break programs compiled against the old binary API, increment
	# Current and Age. Set Revision to 0, since this is the first
	# implementation of the new API.
	#
	# Otherwise, we're changing the binary API and breaking backward
	# compatibility with old binaries. Increment Current. Set Age to 0,
	# since we're backward compatible with no previous APIs. Set Revision
	# to 0 too.
	AC_SUBST(LIBUNBOUND_CURRENT)
	AC_SUBST(LIBUNBOUND_REVISION)
	AC_SUBST(LIBUNBOUND_AGE)

	CFLAGS="$CFLAGS"
	AC_AIX
	if test "$ac_cv_header_minix_config_h" = "yes"; then
	AC_DEFINE(_NETBSD_SOURCE,1, [Enable for compile on Minix])
	fi

	dnl
	dnl By default set prefix to /usr/local
	dnl
	case "$prefix" in
	NONE)
	prefix="/usr/local"
	;;
	esac
	case "$exec_prefix" in
	NONE)
	exec_prefix="$prefix"
	;;
	esac

	# are we on MinGW?
	if uname -s 2>&1 \| grep MINGW32 >/dev/null; then on_mingw="yes"
	else
	if echo $host $target \| grep mingw32 >/dev/null; then on_mingw="yes"
	else on_mingw="no"; fi
	fi

	#
	# Determine configuration file
	# the eval is to evaluate shell expansion twice
	UNBOUND_SBIN_DIR=`eval echo "${sbindir}"`
	AC_SUBST(UNBOUND_SBIN_DIR)
	UNBOUND_SYSCONF_DIR=`eval echo "${sysconfdir}"`
	AC_SUBST(UNBOUND_SYSCONF_DIR)
	UNBOUND_LOCALSTATE_DIR=`eval echo "${localstatedir}"`
	AC_SUBST(UNBOUND_LOCALSTATE_DIR)
	if test $on_mingw = "no"; then
	ub_conf_file=`eval echo "${sysconfdir}/unbound/unbound.conf"`
	else
	ub_conf_file="C:\\Program Files\\Unbound\\service.conf"
	fi
	AC_ARG_WITH([conf_file],
	AC_HELP_STRING([--with-conf-file=path],
	[Pathname to the Unbound configuration file]),
	[ub_conf_file="$withval"])
	AC_SUBST(ub_conf_file)
	ACX_ESCAPE_BACKSLASH($ub_conf_file, hdr_config)
	AC_DEFINE_UNQUOTED(CONFIGFILE, ["$hdr_config"], [Pathname to the Unbound configuration file])
	ub_conf_dir=`AS_DIRNAME(["$ub_conf_file"])`
	AC_SUBST(ub_conf_dir)

	# Determine run, chroot directory and pidfile locations
	AC_ARG_WITH(run-dir,
	AC_HELP_STRING([--with-run-dir=path],
	[set default directory to chdir to (by default dir part of cfg file)]),
	UNBOUND_RUN_DIR="$withval",
	if test $on_mingw = no; then
	UNBOUND_RUN_DIR=`dirname "$ub_conf_file"`
	else
	UNBOUND_RUN_DIR=""
	fi
	)
	AC_SUBST(UNBOUND_RUN_DIR)
	ACX_ESCAPE_BACKSLASH($UNBOUND_RUN_DIR, hdr_run)
	AC_DEFINE_UNQUOTED(RUN_DIR, ["$hdr_run"], [Directory to chdir to])

	AC_ARG_WITH(chroot-dir,
	AC_HELP_STRING([--with-chroot-dir=path],
	[set default directory to chroot to (by default same as run-dir)]),
	UNBOUND_CHROOT_DIR="$withval",
	if test $on_mingw = no; then
	UNBOUND_CHROOT_DIR="$UNBOUND_RUN_DIR"
	else
	UNBOUND_CHROOT_DIR=""
	fi
	)
	AC_SUBST(UNBOUND_CHROOT_DIR)
	ACX_ESCAPE_BACKSLASH($UNBOUND_CHROOT_DIR, hdr_chroot)
	AC_DEFINE_UNQUOTED(CHROOT_DIR, ["$hdr_chroot"], [Directory to chroot to])

	AC_ARG_WITH(share-dir,
	AC_HELP_STRING([--with-share-dir=path],
	[set default directory with shared data (by default same as share/unbound)]),
	UNBOUND_SHARE_DIR="$withval",
	UNBOUND_SHARE_DIR="$UNBOUND_RUN_DIR")
	AC_SUBST(UNBOUND_SHARE_DIR)
	AC_DEFINE_UNQUOTED(SHARE_DIR, ["$UNBOUND_SHARE_DIR"], [Shared data])

	AC_ARG_WITH(pidfile,
	AC_HELP_STRING([--with-pidfile=filename],
	[set default pathname to unbound pidfile (default run-dir/unbound.pid)]),
	UNBOUND_PIDFILE="$withval",
	if test $on_mingw = no; then
	UNBOUND_PIDFILE="$UNBOUND_RUN_DIR/unbound.pid"
	else
	UNBOUND_PIDFILE=""
	fi
	)
	AC_SUBST(UNBOUND_PIDFILE)
	ACX_ESCAPE_BACKSLASH($UNBOUND_PIDFILE, hdr_pid)
	AC_DEFINE_UNQUOTED(PIDFILE, ["$hdr_pid"], [default pidfile location])

	AC_ARG_WITH(rootkey-file,
	AC_HELP_STRING([--with-rootkey-file=filename],
	[set default pathname to root key file (default run-dir/root.key). This file is read and written.]),
	UNBOUND_ROOTKEY_FILE="$withval",
	if test $on_mingw = no; then
	UNBOUND_ROOTKEY_FILE="$UNBOUND_RUN_DIR/root.key"
	else
	UNBOUND_ROOTKEY_FILE="C:\\Program Files\\Unbound\\root.key"
	fi
	)
	AC_SUBST(UNBOUND_ROOTKEY_FILE)
	ACX_ESCAPE_BACKSLASH($UNBOUND_ROOTKEY_FILE, hdr_rkey)
	AC_DEFINE_UNQUOTED(ROOT_ANCHOR_FILE, ["$hdr_rkey"], [default rootkey location])

	AC_ARG_WITH(rootcert-file,
	AC_HELP_STRING([--with-rootcert-file=filename],
	[set default pathname to root update certificate file (default run-dir/icannbundle.pem). This file need not exist if you are content with the builtin.]),
	UNBOUND_ROOTCERT_FILE="$withval",
	if test $on_mingw = no; then
	UNBOUND_ROOTCERT_FILE="$UNBOUND_RUN_DIR/icannbundle.pem"
	else
	UNBOUND_ROOTCERT_FILE="C:\\Program Files\\Unbound\\icannbundle.pem"
	fi
	)
	AC_SUBST(UNBOUND_ROOTCERT_FILE)
	ACX_ESCAPE_BACKSLASH($UNBOUND_ROOTCERT_FILE, hdr_rpem)
	AC_DEFINE_UNQUOTED(ROOT_CERT_FILE, ["$hdr_rpem"], [default rootcert location])

	AC_ARG_WITH(username,
	AC_HELP_STRING([--with-username=user],
	[set default user that unbound changes to (default user is unbound)]),
	UNBOUND_USERNAME="$withval",
	UNBOUND_USERNAME="unbound")
	AC_SUBST(UNBOUND_USERNAME)
	AC_DEFINE_UNQUOTED(UB_USERNAME, ["$UNBOUND_USERNAME"], [default username])

	AC_DEFINE(WINVER, 0x0502, [the version of the windows API enabled])
	ACX_RSRC_VERSION(wnvs)
	AC_DEFINE_UNQUOTED(RSRC_PACKAGE_VERSION, [$wnvs], [version number for resource files])

	# Checks for typedefs, structures, and compiler characteristics.
	AC_C_CONST
	AC_LANG_C
	# allow user to override the -g -O2 flags.
	default_cflags=no
	if test "x$CFLAGS" = "x" ; then
	ACX_CHECK_COMPILER_FLAG(g, [CFLAGS="$CFLAGS -g"])
	ACX_CHECK_COMPILER_FLAG(O2, [CFLAGS="$CFLAGS -O2"])
	default_cflags=yes
	fi
	AC_PROG_CC
	ACX_DEPFLAG
	ACX_DETERMINE_EXT_FLAGS_UNBOUND

	# debug mode flags warnings
	AC_ARG_ENABLE(checking, AC_HELP_STRING([--enable-checking], [Enable warnings, asserts, makefile-dependencies]))
	AC_ARG_ENABLE(debug, AC_HELP_STRING([--enable-debug], [same as enable-checking]))
	if test "$enable_debug" = "yes"; then debug_enabled="$enable_debug";
	else debug_enabled="$enable_checking"; fi
	AC_SUBST(debug_enabled)
	case "$debug_enabled" in
	yes)
	ACX_CHECK_COMPILER_FLAG(W, [CFLAGS="$CFLAGS -W"])
	ACX_CHECK_COMPILER_FLAG(Wall, [CFLAGS="$CFLAGS -Wall"])
	ACX_CHECK_COMPILER_FLAG(Wextra, [CFLAGS="$CFLAGS -Wextra"])
	ACX_CHECK_COMPILER_FLAG(Wdeclaration-after-statement, [CFLAGS="$CFLAGS -Wdeclaration-after-statement"])
	AC_DEFINE([UNBOUND_DEBUG], [], [define this to enable debug checks.])
	;;
	no\|*)
	# nothing to do.
	;;
	esac
	if test "$default_cflags" = "yes"; then
	# only when CFLAGS was "" at the start, if the users wants to
	# override we shouldn't add default cflags, because they wouldn't
	# be able to turn off these options and set the CFLAGS wanted.
	ACX_CHECK_FLTO
	ACX_CHECK_PIE
	ACX_CHECK_RELRO_NOW
	fi

	AC_C_INLINE
	ACX_CHECK_FORMAT_ATTRIBUTE
	ACX_CHECK_UNUSED_ATTRIBUTE

	AC_DEFUN([CHECK_WEAK_ATTRIBUTE],
	[AC_REQUIRE([AC_PROG_CC])
	AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "weak" attribute)
	AC_CACHE_VAL(ac_cv_c_weak_attribute,
	[ac_cv_c_weak_attribute=no
	AC_TRY_COMPILE(
	[ #include <stdio.h>
	__attribute__((weak)) void f(int x) { printf("%d", x); }
	], [
	f(1);
	],
	[ac_cv_c_weak_attribute="yes"],
	[ac_cv_c_weak_attribute="no"])
	])

	AC_MSG_RESULT($ac_cv_c_weak_attribute)
	if test $ac_cv_c_weak_attribute = yes; then
	AC_DEFINE(HAVE_ATTR_WEAK, 1, [Whether the C compiler accepts the "weak" attribute])
	AC_DEFINE(ATTR_WEAK, [__attribute__((weak))], [apply the weak attribute to a symbol])
	fi
	])dnl End of CHECK_WEAK_ATTRIBUTE

	CHECK_WEAK_ATTRIBUTE

	AC_DEFUN([CHECK_NORETURN_ATTRIBUTE],
	[AC_REQUIRE([AC_PROG_CC])
	AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "noreturn" attribute)
	AC_CACHE_VAL(ac_cv_c_noreturn_attribute,
	[ac_cv_c_noreturn_attribute=no
	AC_TRY_COMPILE(
	[ #include <stdio.h>
	__attribute__((noreturn)) void f(int x) { printf("%d", x); }
	], [
	f(1);
	],
	[ac_cv_c_noreturn_attribute="yes"],
	[ac_cv_c_noreturn_attribute="no"])
	])

	AC_MSG_RESULT($ac_cv_c_noreturn_attribute)
	if test $ac_cv_c_noreturn_attribute = yes; then
	AC_DEFINE(HAVE_ATTR_NORETURN, 1, [Whether the C compiler accepts the "noreturn" attribute])
	AC_DEFINE(ATTR_NORETURN, [__attribute__((__noreturn__))], [apply the noreturn attribute to a function that exits the program])
	fi
	])dnl End of CHECK_NORETURN_ATTRIBUTE

	CHECK_NORETURN_ATTRIBUTE

	if test "$srcdir" != "."; then
	CPPFLAGS="$CPPFLAGS -I$srcdir"
	fi

	AC_DEFUN([ACX_YYLEX_DESTROY], [
	AC_MSG_CHECKING([for yylex_destroy])
	if echo %% \| $LEX -t 2>&1 \| grep yylex_destroy >/dev/null 2>&1; then
	AC_DEFINE(LEX_HAS_YYLEX_DESTROY, 1, [if lex has yylex_destroy])
	AC_MSG_RESULT(yes)
	else AC_MSG_RESULT(no);
	LEX=":"
	fi
	])

	AC_DEFUN([ACX_YYLEX_OPTION], [
	AC_MSG_CHECKING([for lex %option])
	if cat <<EOF \| $LEX -t 2>&1 \| grep yy_delete_buffer >/dev/null 2>&1; then
	%option nounput
	%%
	EOF
	AC_MSG_RESULT(yes)
	else AC_MSG_RESULT(no);
	LEX=":"
	fi
	])

	AC_PROG_LEX
	if test "$LEX" != "" -a "$LEX" != ":"; then
	ACX_YYLEX_DESTROY
	fi
	if test "$LEX" != "" -a "$LEX" != ":"; then
	ACX_YYLEX_OPTION
	fi
	AC_PROG_YACC
	AC_CHECK_PROG(doxygen, doxygen, doxygen)
	AC_CHECK_TOOL(STRIP, strip)
	ACX_LIBTOOL_C_ONLY

	+PKG_PROG_PKG_CONFIG
	+
	# Checks for header files.
	AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h netinet/tcp.h sys/param.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h sys/endian.h libkern/OSByteOrder.h sys/ipc.h sys/shm.h],,, [AC_INCLUDES_DEFAULT])

	# check for types.
	# Using own tests for int64* because autoconf builtin only give 32bit.
	AC_CHECK_TYPE(int8_t, signed char)
	AC_CHECK_TYPE(int16_t, short)
	AC_CHECK_TYPE(int32_t, int)
	AC_CHECK_TYPE(int64_t, long long)
	AC_CHECK_TYPE(uint8_t, unsigned char)
	AC_CHECK_TYPE(uint16_t, unsigned short)
	AC_CHECK_TYPE(uint32_t, unsigned int)
	AC_CHECK_TYPE(uint64_t, unsigned long long)
	AC_TYPE_SIZE_T
	AC_CHECK_TYPE(ssize_t, int)
	AC_TYPE_UID_T
	AC_TYPE_PID_T
	AC_TYPE_OFF_T
	ACX_TYPE_U_CHAR
	ACX_TYPE_RLIM_T
	ACX_TYPE_SOCKLEN_T
	ACX_TYPE_IN_ADDR_T
	ACX_TYPE_IN_PORT_T
	ACX_CHECK_MEMCMP_SIGNED

	AC_CHECK_SIZEOF(time_t,,[
	AC_INCLUDES_DEFAULT
	#ifdef TIME_WITH_SYS_TIME
	# include <sys/time.h>
	# include <time.h>
	#else
	# ifdef HAVE_SYS_TIME_H
	# include <sys/time.h>
	# else
	# include <time.h>
	# endif
	#endif
	])

	# add option to disable the evil rpath
	ACX_ARG_RPATH
	AC_SUBST(RUNTIME_PATH)

	# check to see if libraries are needed for these functions.
	AC_SEARCH_LIBS([inet_pton], [nsl])
	AC_SEARCH_LIBS([socket], [socket])

	# check wether strptime also works
	AC_DEFUN([AC_CHECK_STRPTIME_WORKS],
	[AC_REQUIRE([AC_PROG_CC])
	AC_MSG_CHECKING(whether strptime works)
	if test c${cross_compiling} = cno; then
	AC_RUN_IFELSE([AC_LANG_SOURCE([[
	#define _XOPEN_SOURCE 600
	#include <time.h>
	int main(void) { struct tm tm; char *res;
	res = strptime("2010-07-15T00:00:00+00:00", "%t%Y%t-%t%m%t-%t%d%tT%t%H%t:%t%M%t:%t%S%t", &tm);
	if (!res) return 2;
	res = strptime("20070207111842", "%Y%m%d%H%M%S", &tm);
	if (!res) return 1; return 0; }
	]])] , [eval "ac_cv_c_strptime_works=yes"], [eval "ac_cv_c_strptime_works=no"])
	else
	eval "ac_cv_c_strptime_works=maybe"
	fi
	AC_MSG_RESULT($ac_cv_c_strptime_works)
	if test $ac_cv_c_strptime_works = no; then
	AC_LIBOBJ(strptime)
	else
	AC_DEFINE_UNQUOTED([STRPTIME_WORKS], 1, [use default strptime.])
	fi
	])dnl

	# check some functions of the OS before linking libs (while still runnable).
	AC_FUNC_CHOWN
	AC_FUNC_FORK
	AC_TYPE_SIGNAL
	AC_FUNC_FSEEKO
	ACX_SYS_LARGEFILE
	ACX_CHECK_NONBLOCKING_BROKEN
	ACX_MKDIR_ONE_ARG
	AC_CHECK_FUNCS([strptime],[AC_CHECK_STRPTIME_WORKS],[AC_LIBOBJ([strptime])])

	# check if we can use SO_REUSEPORT
	if echo "$host" \| grep -i -e linux -e dragonfly >/dev/null; then
	AC_DEFINE(REUSEPORT_DEFAULT, 1, [if REUSEPORT is enabled by default])
	else
	AC_DEFINE(REUSEPORT_DEFAULT, 0, [if REUSEPORT is enabled by default])
	fi

	# set memory allocation checking if requested
	AC_ARG_ENABLE(alloc-checks, AC_HELP_STRING([--enable-alloc-checks],
	[ enable to memory allocation statistics, for debug purposes ]),
	, )
	AC_ARG_ENABLE(alloc-lite, AC_HELP_STRING([--enable-alloc-lite],
	[ enable for lightweight alloc assertions, for debug purposes ]),
	, )
	AC_ARG_ENABLE(alloc-nonregional, AC_HELP_STRING([--enable-alloc-nonregional],
	[ enable nonregional allocs, slow but exposes regional allocations to other memory purifiers, for debug purposes ]),
	, )
	if test x_$enable_alloc_nonregional = x_yes; then
	AC_DEFINE(UNBOUND_ALLOC_NONREGIONAL, 1, [use malloc not regions, for debug use])
	fi
	if test x_$enable_alloc_checks = x_yes; then
	AC_DEFINE(UNBOUND_ALLOC_STATS, 1, [use statistics for allocs and frees, for debug use])
	else
	if test x_$enable_alloc_lite = x_yes; then
	AC_DEFINE(UNBOUND_ALLOC_LITE, 1, [use to enable lightweight alloc assertions, for debug use])
	else
	ACX_FUNC_MALLOC([unbound])
	fi
	fi

	# check windows threads (we use them, not pthreads, on windows).
	if test "$on_mingw" = "yes"; then
	# check windows threads
	AC_CHECK_HEADERS([windows.h],,, [AC_INCLUDES_DEFAULT])
	AC_MSG_CHECKING([for CreateThread])
	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([
	#ifdef HAVE_WINDOWS_H
	#include <windows.h>
	#endif
	], [
	HANDLE t = CreateThread(NULL, 0, NULL, NULL, 0, NULL);
	])],
	AC_MSG_RESULT(yes)
	AC_DEFINE(HAVE_WINDOWS_THREADS, 1, [Using Windows threads])
	,
	AC_MSG_RESULT(no)
	)

	else
	# not on mingw, check thread libraries.

	# check for thread library.
	# check this first, so that the pthread lib does not get linked in via
	# libssl or libpython, and thus distorts the tests, and we end up using
	# the non-threadsafe C libraries.
	AC_ARG_WITH(pthreads, AC_HELP_STRING([--with-pthreads],
	[use pthreads library, or --without-pthreads to disable threading support.]),
	[ ],[ withval="yes" ])
	ub_have_pthreads=no
	if test x_$withval != x_no; then
	AX_PTHREAD([
	AC_DEFINE(HAVE_PTHREAD,1,[Define if you have POSIX threads libraries and header files.])
	if test -n "$PTHREAD_LIBS"; then
	LIBS="$PTHREAD_LIBS $LIBS"
	fi
	CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
	CC="$PTHREAD_CC"
	ub_have_pthreads=yes
	AC_CHECK_TYPES([pthread_spinlock_t, pthread_rwlock_t],,,[#include <pthread.h>])

	if echo "$CFLAGS" \| $GREP -e "-pthread" >/dev/null; then
	AC_MSG_CHECKING([if -pthread unused during linking])
	# catch clang warning 'argument unused during compilation'
	AC_LANG_CONFTEST([AC_LANG_SOURCE(AC_INCLUDES_DEFAULT
	[[
	int main(void) {return 0;}
	]])])
	pthread_unused="yes"
	# first compile
	echo "$CC $CFLAGS -c conftest.c -o conftest.o" >&AS_MESSAGE_LOG_FD
	$CC $CFLAGS -c conftest.c -o conftest.o 2>&AS_MESSAGE_LOG_FD >&AS_MESSAGE_LOG_FD
	if test $? = 0; then
	# then link
	echo "$CC $CFLAGS -Werror $LDFLAGS $LIBS -o conftest contest.o" >&AS_MESSAGE_LOG_FD
	$CC $CFLAGS -Werror $LDFLAGS $LIBS -o conftest conftest.o 2>&AS_MESSAGE_LOG_FD >&AS_MESSAGE_LOG_FD
	if test $? -ne 0; then
	AC_MSG_RESULT(yes)
	CFLAGS=`echo "$CFLAGS" \| sed -e 's/-pthread//'`
	PTHREAD_CFLAGS_ONLY="-pthread"
	AC_SUBST(PTHREAD_CFLAGS_ONLY)
	else
	AC_MSG_RESULT(no)
	fi
	else
	AC_MSG_RESULT(no)
	fi # endif cc successful
	rm -f conftest conftest.c conftest.o
	fi # endif -pthread in CFLAGS

	])
	fi

	# check solaris thread library
	AC_ARG_WITH(solaris-threads, AC_HELP_STRING([--with-solaris-threads],
	[use solaris native thread library.]), [ ],[ withval="no" ])
	ub_have_sol_threads=no
	if test x_$withval != x_no; then
	if test x_$ub_have_pthreads != x_no; then
	AC_WARN([Have pthreads already, ignoring --with-solaris-threads])
	else
	AC_SEARCH_LIBS(thr_create, [thread],
	[
	AC_DEFINE(HAVE_SOLARIS_THREADS, 1, [Using Solaris threads])

	ACX_CHECK_COMPILER_FLAG(mt, [CFLAGS="$CFLAGS -mt"],
	[CFLAGS="$CFLAGS -D_REENTRANT"])
	ub_have_sol_threads=yes
	] , [
	AC_ERROR([no solaris threads found.])
	])
	fi
	fi

	fi # end of non-mingw check of thread libraries

	# Check for PyUnbound
	AC_ARG_WITH(pyunbound,
	AC_HELP_STRING([--with-pyunbound],
	[build PyUnbound, or --without-pyunbound to skip it. (default=no)]),
	[], [ withval="no" ])

	ub_test_python=no
	ub_with_pyunbound=no
	if test x_$withval != x_no; then
	ub_with_pyunbound=yes
	ub_test_python=yes
	fi

	# Check for Python module
	AC_ARG_WITH(pythonmodule,
	AC_HELP_STRING([--with-pythonmodule],
	[build Python module, or --without-pythonmodule to disable script engine. (default=no)]),
	[], [ withval="no" ])

	ub_with_pythonmod=no
	if test x_$withval != x_no; then
	ub_with_pythonmod=yes
	ub_test_python=yes
	fi

	# Check for Python & SWIG only on PyUnbound or PyModule
	if test x_$ub_test_python != x_no; then

	# Check for Python
	ub_have_python=no
	ac_save_LIBS="$LIBS" dnl otherwise AC_PYTHON_DEVEL thrashes $LIBS
	AC_PYTHON_DEVEL
	if test ! -z "$PYTHON_VERSION"; then
	if test `$PYTHON -c "print('$PYTHON_VERSION' >= '2.4.0')"` = "False"; then
	AC_ERROR([Python version >= 2.4.0 is required])
	fi

	[PY_MAJOR_VERSION="`$PYTHON -c \"import sys; print(sys.version_info[0])\"`"]
	AC_SUBST(PY_MAJOR_VERSION)
	# Have Python
	AC_DEFINE(HAVE_PYTHON,1,[Define if you have Python libraries and header files.])
	if test -n "$LIBS"; then
	LIBS="$PYTHON_LDFLAGS $LIBS"
	else
	LIBS="$PYTHON_LDFLAGS"
	fi
	if test -n "$CPPFLAGS"; then
	CPPFLAGS="$CPPFLAGS $PYTHON_CPPFLAGS"
	else
	CPPFLAGS="$PYTHON_CPPFLAGS"
	fi
	ub_have_python=yes
	- PKG_PROG_PKG_CONFIG
	PKG_CHECK_EXISTS(["python${PY_MAJOR_VERSION}"],
	[PC_PY_DEPENDENCY="python${PY_MAJOR_VERSION}"],
	[PC_PY_DEPENDENCY="python"])
	AC_SUBST(PC_PY_DEPENDENCY)

	# Check for SWIG
	ub_have_swig=no
	AC_ARG_ENABLE(swig-version-check, AC_HELP_STRING([--disable-swig-version-check], [Disable swig version check to build python modules with older swig even though that is unreliable]))
	if test "$enable_swig_version_check" = "yes"; then
	AC_PROG_SWIG(2.0.1)
	else
	AC_PROG_SWIG
	fi
	AC_MSG_CHECKING(SWIG)
	if test ! -x "$SWIG"; then
	AC_ERROR([failed to find swig tool, install it, or do not build Python module and PyUnbound])
	else
	AC_DEFINE(HAVE_SWIG, 1, [Define if you have Swig libraries and header files.])
	AC_SUBST(swig, "$SWIG")
	AC_MSG_RESULT(present)

	# If have Python & SWIG
	# Declare PythonMod
	if test x_$ub_with_pythonmod != x_no; then
	AC_DEFINE(WITH_PYTHONMODULE, 1, [Define if you want Python module.])
	WITH_PYTHONMODULE=yes
	AC_SUBST(WITH_PYTHONMODULE)
	PYTHONMOD_OBJ="pythonmod.lo pythonmod_utils.lo"
	AC_SUBST(PYTHONMOD_OBJ)
	PYTHONMOD_HEADER='$(srcdir)/pythonmod/pythonmod.h'
	AC_SUBST(PYTHONMOD_HEADER)
	PYTHONMOD_INSTALL=pythonmod-install
	AC_SUBST(PYTHONMOD_INSTALL)
	PYTHONMOD_UNINSTALL=pythonmod-uninstall
	AC_SUBST(PYTHONMOD_UNINSTALL)
	fi

	# Declare PyUnbound
	if test x_$ub_with_pyunbound != x_no; then
	AC_DEFINE(WITH_PYUNBOUND, 1, [Define if you want PyUnbound.])
	WITH_PYUNBOUND=yes
	AC_SUBST(WITH_PYUNBOUND)
	PYUNBOUND_OBJ="libunbound_wrap.lo"
	AC_SUBST(PYUNBOUND_OBJ)
	PYUNBOUND_TARGET="_unbound.la"
	AC_SUBST(PYUNBOUND_TARGET)
	PYUNBOUND_INSTALL=pyunbound-install
	AC_SUBST(PYUNBOUND_INSTALL)
	PYUNBOUND_UNINSTALL=pyunbound-uninstall
	AC_SUBST(PYUNBOUND_UNINSTALL)
	fi
	fi
	else
	AC_MSG_RESULT([* Python libraries not found, won't build PythonMod or PyUnbound *])
	ub_with_pyunbound=no
	ub_with_pythonmod=no
	fi
	fi

	if test "`uname`" = "NetBSD"; then
	NETBSD_LINTFLAGS='"-D__RENAME(x)=" -D_NETINET_IN_H_'
	AC_SUBST(NETBSD_LINTFLAGS)
	fi
	CONFIG_DATE=`date +%Y%m%d`
	AC_SUBST(CONFIG_DATE)

	# Checks for libraries.

	# libnss
	USE_NSS="no"
	AC_ARG_WITH([nss], AC_HELP_STRING([--with-nss=path],
	[use libnss instead of openssl, installed at path.]),
	[
	USE_NSS="yes"
	AC_DEFINE(HAVE_NSS, 1, [Use libnss for crypto])
	if test "$withval" != "" -a "$withval" != "yes"; then
	CPPFLAGS="$CPPFLAGS -I$withval/include/nss3"
	LDFLAGS="$LDFLAGS -L$withval/lib"
	ACX_RUNTIME_PATH_ADD([$withval/lib])
	CPPFLAGS="-I$withval/include/nspr4 $CPPFLAGS"
	else
	CPPFLAGS="$CPPFLAGS -I/usr/include/nss3"
	CPPFLAGS="-I/usr/include/nspr4 $CPPFLAGS"
	fi
	LIBS="$LIBS -lnss3 -lnspr4"
	SSLLIB=""
	]
	)

	# libnettle
	USE_NETTLE="no"
	AC_ARG_WITH([nettle], AC_HELP_STRING([--with-nettle=path],
	[use libnettle as crypto library, installed at path.]),
	[
	USE_NETTLE="yes"
	AC_DEFINE(HAVE_NETTLE, 1, [Use libnettle for crypto])
	AC_CHECK_HEADERS([nettle/dsa-compat.h],,, [AC_INCLUDES_DEFAULT])
	if test "$withval" != "" -a "$withval" != "yes"; then
	CPPFLAGS="$CPPFLAGS -I$withval/include/nettle"
	LDFLAGS="$LDFLAGS -L$withval/lib"
	ACX_RUNTIME_PATH_ADD([$withval/lib])
	else
	CPPFLAGS="$CPPFLAGS -I/usr/include/nettle"
	fi
	LIBS="$LIBS -lhogweed -lnettle -lgmp"
	SSLLIB=""
	]
	)

	# openssl
	if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
	ACX_WITH_SSL
	ACX_LIB_SSL
	SSLLIB="-lssl"

	# check if -lcrypt32 is needed because CAPIENG needs that. (on windows)
	BAKLIBS="$LIBS"
	LIBS="-lssl $LIBS"
	AC_MSG_CHECKING([if libssl needs -lcrypt32])
	AC_TRY_LINK_FUNC([HMAC_Update], [
	AC_MSG_RESULT([no])
	LIBS="$BAKLIBS"
	], [
	AC_MSG_RESULT([yes])
	LIBS="$BAKLIBS"
	LIBS="$LIBS -lcrypt32"
	])

	AC_MSG_CHECKING([for LibreSSL])
	if grep VERSION_TEXT $ssldir/include/openssl/opensslv.h \| grep "LibreSSL" >/dev/null; then
	AC_MSG_RESULT([yes])
	AC_DEFINE([HAVE_LIBRESSL], [1], [Define if we have LibreSSL])
	# libressl provides these compat functions, but they may also be
	# declared by the OS in libc. See if they have been declared.
	AC_CHECK_DECLS([strlcpy,strlcat,arc4random,arc4random_uniform,reallocarray])
	else
	AC_MSG_RESULT([no])
	fi
	AC_CHECK_HEADERS([openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h],,, [AC_INCLUDES_DEFAULT])
	-AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify])
	+AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify SSL_CTX_set_tlsext_ticket_key_cb EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback])

	# these check_funcs need -lssl
	BAKLIBS="$LIBS"
	LIBS="-lssl $LIBS"
	-AC_CHECK_FUNCS([OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername])
	+AC_CHECK_FUNCS([OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername X509_VERIFY_PARAM_set1_host SSL_CTX_set_ciphersuites])
	LIBS="$BAKLIBS"

	AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free,SSL_CTX_set_ecdh_auto], [], [], [
	AC_INCLUDES_DEFAULT
	#ifdef HAVE_OPENSSL_ERR_H
	#include <openssl/err.h>
	#endif

	#ifdef HAVE_OPENSSL_RAND_H
	#include <openssl/rand.h>
	#endif

	#ifdef HAVE_OPENSSL_CONF_H
	#include <openssl/conf.h>
	#endif

	#ifdef HAVE_OPENSSL_ENGINE_H
	#include <openssl/engine.h>
	#endif
	#include <openssl/ssl.h>
	#include <openssl/evp.h>
	])
	fi
	AC_SUBST(SSLLIB)


	AC_ARG_ENABLE(sha1, AC_HELP_STRING([--disable-sha1], [Disable SHA1 RRSIG support, does not disable nsec3 support]))
	case "$enable_sha1" in
	no)
	;;
	yes\|*)
	AC_DEFINE([USE_SHA1], [1], [Define this to enable SHA1 support.])
	;;
	esac


	AC_ARG_ENABLE(sha2, AC_HELP_STRING([--disable-sha2], [Disable SHA256 and SHA512 RRSIG support]))
	case "$enable_sha2" in
	no)
	;;
	yes\|*)
	AC_DEFINE([USE_SHA2], [1], [Define this to enable SHA256 and SHA512 support.])
	;;
	esac

	AC_ARG_ENABLE(subnet, AC_HELP_STRING([--enable-subnet], [Enable client subnet]))
	case "$enable_subnet" in
	yes)
	AC_DEFINE([CLIENT_SUBNET], [1], [Define this to enable client subnet option.])
	SUBNET_OBJ="edns-subnet.lo subnetmod.lo addrtree.lo subnet-whitelist.lo"
	AC_SUBST(SUBNET_OBJ)
	SUBNET_HEADER='$(srcdir)/edns-subnet/subnetmod.h $(srcdir)/edns-subnet/edns-subnet.h $(srcdir)/edns-subnet/subnet-whitelist.h $(srcdir)/edns-subnet/addrtree.h'
	AC_SUBST(SUBNET_HEADER)
	;;
	no\|*)
	;;
	esac

	# check wether gost also works
	AC_DEFUN([AC_CHECK_GOST_WORKS],
	[AC_REQUIRE([AC_PROG_CC])
	AC_MSG_CHECKING([if GOST works])
	if test c${cross_compiling} = cno; then
	BAKCFLAGS="$CFLAGS"
	if test -n "$ssldir"; then
	CFLAGS="$CFLAGS -Wl,-rpath,$ssldir/lib"
	fi
	AC_RUN_IFELSE([AC_LANG_SOURCE([[
	#include <string.h>
	#include <openssl/ssl.h>
	#include <openssl/evp.h>
	#include <openssl/engine.h>
	#include <openssl/conf.h>
	/* routine to load gost (from sldns) */
	int load_gost_id(void)
	{
	static int gost_id = 0;
	const EVP_PKEY_ASN1_METHOD* meth;
	ENGINE* e;

	if(gost_id) return gost_id;

	/* see if configuration loaded gost implementation from other engine*/
	meth = EVP_PKEY_asn1_find_str(NULL, "gost2001", -1);
	if(meth) {
	EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
	return gost_id;
	}

	/* see if engine can be loaded already */
	e = ENGINE_by_id("gost");
	if(!e) {
	/* load it ourself, in case statically linked */
	ENGINE_load_builtin_engines();
	ENGINE_load_dynamic();
	e = ENGINE_by_id("gost");
	}
	if(!e) {
	/* no gost engine in openssl */
	return 0;
	}
	if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
	ENGINE_finish(e);
	ENGINE_free(e);
	return 0;
	}

	meth = EVP_PKEY_asn1_find_str(&e, "gost2001", -1);
	if(!meth) {
	/* algo not found */
	ENGINE_finish(e);
	ENGINE_free(e);
	return 0;
	}
	EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
	return gost_id;
	}
	int main(void) {
	EVP_MD_CTX* ctx;
	const EVP_MD* md;
	unsigned char digest[64]; /* its a 256-bit digest, so uses 32 bytes */
	const char* str = "Hello world";
	const unsigned char check[] = {
	0x40 , 0xed , 0xf8 , 0x56 , 0x5a , 0xc5 , 0x36 , 0xe1 ,
	0x33 , 0x7c , 0x7e , 0x87 , 0x62 , 0x1c , 0x42 , 0xe0 ,
	0x17 , 0x1b , 0x5e , 0xce , 0xa8 , 0x46 , 0x65 , 0x4d ,
	0x8d , 0x3e , 0x22 , 0x9b , 0xe1 , 0x30 , 0x19 , 0x9d
	};
	OPENSSL_config(NULL);
	(void)load_gost_id();
	md = EVP_get_digestbyname("md_gost94");
	if(!md) return 1;
	memset(digest, 0, sizeof(digest));
	ctx = EVP_MD_CTX_create();
	if(!ctx) return 2;
	if(!EVP_DigestInit_ex(ctx, md, NULL)) return 3;
	if(!EVP_DigestUpdate(ctx, str, 10)) return 4;
	if(!EVP_DigestFinal_ex(ctx, digest, NULL)) return 5;
	/* uncomment to see the hash calculated.
	{int i;
	for(i=0; i<32; i++)
	printf(" %2.2x", (int)digest[i]);
	printf("\n");}
	*/
	if(memcmp(digest, check, sizeof(check)) != 0)
	return 6;
	return 0;
	}
	]])] , [eval "ac_cv_c_gost_works=yes"], [eval "ac_cv_c_gost_works=no"])
	CFLAGS="$BAKCFLAGS"
	else
	eval "ac_cv_c_gost_works=maybe"
	fi
	AC_MSG_RESULT($ac_cv_c_gost_works)
	])dnl

	AC_ARG_ENABLE(gost, AC_HELP_STRING([--disable-gost], [Disable GOST support]))
	use_gost="no"
	if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
	case "$enable_gost" in
	no)
	;;
	*)
	AC_CHECK_FUNC(EVP_PKEY_set_type_str, [:],[AC_MSG_ERROR([OpenSSL 1.0.0 is needed for GOST support])])
	AC_CHECK_FUNC(EC_KEY_new, [], [AC_MSG_ERROR([OpenSSL does not support ECC, needed for GOST support])])
	AC_CHECK_GOST_WORKS
	if test "$ac_cv_c_gost_works" != no; then
	use_gost="yes"
	AC_DEFINE([USE_GOST], [1], [Define this to enable GOST support.])
	fi
	;;
	esac
	fi dnl !USE_NSS && !USE_NETTLE

	AC_ARG_ENABLE(ecdsa, AC_HELP_STRING([--disable-ecdsa], [Disable ECDSA support]))
	use_ecdsa="no"
	case "$enable_ecdsa" in
	no)
	;;
	*)
	if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
	AC_CHECK_FUNC(ECDSA_sign, [], [AC_MSG_ERROR([OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa])])
	AC_CHECK_FUNC(SHA384_Init, [], [AC_MSG_ERROR([OpenSSL does not support SHA384: please upgrade or rerun with --disable-ecdsa])])
	AC_CHECK_DECLS([NID_X9_62_prime256v1, NID_secp384r1], [], [AC_MSG_ERROR([OpenSSL does not support the ECDSA curves: please upgrade or rerun with --disable-ecdsa])], [AC_INCLUDES_DEFAULT
	#include <openssl/evp.h>
	])
	# see if OPENSSL 1.0.0 or later (has EVP MD and Verify independency)
	AC_MSG_CHECKING([if openssl supports SHA2 and ECDSA with EVP])
	if grep OPENSSL_VERSION_TEXT $ssldir/include/openssl/opensslv.h \| grep "OpenSSL" >/dev/null; then
	if grep OPENSSL_VERSION_NUMBER $ssldir/include/openssl/opensslv.h \| grep 0x0 >/dev/null; then
	AC_MSG_RESULT([no])
	AC_DEFINE_UNQUOTED([USE_ECDSA_EVP_WORKAROUND], [1], [Define this to enable an EVP workaround for older openssl])
	else
	AC_MSG_RESULT([yes])
	fi
	else
	# not OpenSSL, thus likely LibreSSL, which supports it
	AC_MSG_RESULT([yes])
	fi
	fi
	# we now know we have ECDSA and the required curves.
	AC_DEFINE_UNQUOTED([USE_ECDSA], [1], [Define this to enable ECDSA support.])
	use_ecdsa="yes"
	;;
	esac

	AC_ARG_ENABLE(dsa, AC_HELP_STRING([--disable-dsa], [Disable DSA support]))
	use_dsa="no"
	case "$enable_dsa" in
	no)
	;;
	*)
	# detect if DSA is supported, and turn it off if not.
	if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
	AC_CHECK_FUNC(DSA_SIG_new, [
	AC_CHECK_TYPE(DSA_SIG*, [
	AC_DEFINE_UNQUOTED([USE_DSA], [1], [Define this to enable DSA support.])
	], [if test "x$enable_dsa" = "xyes"; then AC_MSG_ERROR([OpenSSL does not support DSA and you used --enable-dsa.])
	fi ], [
	AC_INCLUDES_DEFAULT
	#ifdef HAVE_OPENSSL_ERR_H
	#include <openssl/err.h>
	#endif

	#ifdef HAVE_OPENSSL_RAND_H
	#include <openssl/rand.h>
	#endif

	#ifdef HAVE_OPENSSL_CONF_H
	#include <openssl/conf.h>
	#endif

	#ifdef HAVE_OPENSSL_ENGINE_H
	#include <openssl/engine.h>
	#endif
	])
	], [if test "x$enable_dsa" = "xyes"; then AC_MSG_ERROR([OpenSSL does not support DSA and you used --enable-dsa.])
	fi ])
	else
	AC_DEFINE_UNQUOTED([USE_DSA], [1], [Define this to enable DSA support.])
	fi
	;;
	esac

	AC_ARG_ENABLE(ed25519, AC_HELP_STRING([--disable-ed25519], [Disable ED25519 support]))
	use_ed25519="no"
	case "$enable_ed25519" in
	no)
	;;
	*)
	if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
	AC_CHECK_DECLS([NID_ED25519], [
	use_ed25519="yes"
	], [ if test "x$enable_ed25519" = "xyes"; then AC_MSG_ERROR([OpenSSL does not support ED25519 and you used --enable-ed25519.])
	fi ], [AC_INCLUDES_DEFAULT
	#include <openssl/evp.h>
	])
	fi
	if test $USE_NETTLE = "yes"; then
	AC_CHECK_HEADERS([nettle/eddsa.h], use_ed25519="yes",, [AC_INCLUDES_DEFAULT])
	fi
	if test $use_ed25519 = "yes"; then
	AC_DEFINE_UNQUOTED([USE_ED25519], [1], [Define this to enable ED25519 support.])
	fi
	;;
	esac

	AC_ARG_ENABLE(ed448, AC_HELP_STRING([--disable-ed448], [Disable ED448 support]))
	use_ed448="no"
	case "$enable_ed448" in
	no)
	;;
	*)
	if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
	AC_CHECK_DECLS([NID_ED448], [
	use_ed448="yes"
	], [ if test "x$enable_ed448" = "xyes"; then AC_MSG_ERROR([OpenSSL does not support ED448 and you used --enable-ed448.])
	fi ], [AC_INCLUDES_DEFAULT
	#include <openssl/evp.h>
	])
	fi
	if test $use_ed448 = "yes"; then
	AC_DEFINE_UNQUOTED([USE_ED448], [1], [Define this to enable ED448 support.])
	fi
	;;
	esac

	AC_ARG_ENABLE(event-api, AC_HELP_STRING([--enable-event-api], [Enable (experimental) pluggable event base libunbound API installed to unbound-event.h]))
	case "$enable_event_api" in
	yes)
	AC_SUBST(UNBOUND_EVENT_INSTALL, [unbound-event-install])
	AC_SUBST(UNBOUND_EVENT_UNINSTALL, [unbound-event-uninstall])
	;;
	*)
	;;
	esac

	AC_ARG_ENABLE(tfo-client, AC_HELP_STRING([--enable-tfo-client], [Enable TCP Fast Open for client mode]))
	case "$enable_tfo_client" in
	yes)
	case `uname` in
	Linux) AC_CHECK_DECL([MSG_FASTOPEN], [AC_MSG_WARN([Check the platform specific TFO kernel parameters are correctly configured to support client mode TFO])],
	[AC_MSG_ERROR([TCP Fast Open is not available for client mode: please rerun without --enable-tfo-client])],
	[AC_INCLUDES_DEFAULT
	#include <netinet/tcp.h>
	])
	AC_DEFINE_UNQUOTED([USE_MSG_FASTOPEN], [1], [Define this to enable client TCP Fast Open.])
	;;
	Darwin) AC_CHECK_DECL([CONNECT_RESUME_ON_READ_WRITE], [AC_MSG_WARN([Check the platform specific TFO kernel parameters are correctly configured to support client mode TFO])],
	[AC_MSG_ERROR([TCP Fast Open is not available for client mode: please rerun without --enable-tfo-client])],
	[AC_INCLUDES_DEFAULT
	#include <sys/socket.h>
	])
	AC_DEFINE_UNQUOTED([USE_OSX_MSG_FASTOPEN], [1], [Define this to enable client TCP Fast Open.])
	;;
	esac
	;;
	no\|*)
	;;
	esac

	AC_ARG_ENABLE(tfo-server, AC_HELP_STRING([--enable-tfo-server], [Enable TCP Fast Open for server mode]))
	case "$enable_tfo_server" in
	yes)
	AC_CHECK_DECL([TCP_FASTOPEN], [AC_MSG_WARN([Check the platform specific TFO kernel parameters are correctly configured to support server mode TFO])], [AC_MSG_ERROR([TCP Fast Open is not available for server mode: please rerun without --enable-tfo-server])], [AC_INCLUDES_DEFAULT
	#include <netinet/tcp.h>
	])
	AC_DEFINE_UNQUOTED([USE_TCP_FASTOPEN], [1], [Define this to enable server TCP Fast Open.])
	;;
	no\|*)
	;;
	esac

	# check for libevent
	AC_ARG_WITH(libevent, AC_HELP_STRING([--with-libevent=pathname],
	[use libevent (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr or you can specify an explicit path). Slower, but allows use of large outgoing port ranges.]),
	[ ],[ withval="no" ])
	if test x_$withval = x_yes -o x_$withval != x_no; then
	AC_MSG_CHECKING(for libevent)
	if test x_$withval = x_ -o x_$withval = x_yes; then
	withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
	fi
	for dir in $withval; do
	thedir="$dir"
	if test -f "$dir/include/event.h" -o -f "$dir/include/event2/event.h"; then
	found_libevent="yes"
	dnl assume /usr is in default path.
	if test "$thedir" != "/usr"; then
	CPPFLAGS="$CPPFLAGS -I$thedir/include"
	fi
	break;
	fi
	done
	if test x_$found_libevent != x_yes; then
	if test -f "$dir/event.h" -a $ -f "$dir/libevent.la" -o -f "$dir/libev.la" $ ; then
	# libevent source directory
	AC_MSG_RESULT(found in $thedir)
	CPPFLAGS="$CPPFLAGS -I$thedir -I$thedir/include"
	BAK_LDFLAGS_SET="1"
	BAK_LDFLAGS="$LDFLAGS"
	# remove evdns from linking
	mkdir build >/dev/null 2>&1
	mkdir build/libevent >/dev/null 2>&1
	mkdir build/libevent/.libs >/dev/null 2>&1
	ev_files_o=`ls $thedir/*.o \| grep -v evdns\.o \| grep -v bufferevent_openssl\.o`
	ev_files_lo=`ls $thedir/*.lo \| grep -v evdns\.lo \| grep -v bufferevent_openssl\.lo`
	ev_files_libso=`ls $thedir/.libs/*.o \| grep -v evdns\.o \| grep -v bufferevent_openssl\.o`
	cp $ev_files_o build/libevent
	cp $ev_files_lo build/libevent
	cp $ev_files_libso build/libevent/.libs
	LATE_LDFLAGS="build/libevent/*.lo -lm"
	LDFLAGS="build/libevent/*.o $LDFLAGS -lm"
	else
	AC_MSG_ERROR([Cannot find the libevent library in $withval
	You can restart ./configure --with-libevent=no to use a builtin alternative.
	Please note that this alternative is not as capable as libevent when using
	large outgoing port ranges. ])
	fi
	else
	AC_MSG_RESULT(found in $thedir)
	dnl if event2 exists and no event lib in dir itself, use subdir
	if test ! -f $thedir/lib/libevent.a -a ! -f $thedir/lib/libevent.so -a -d "$thedir/lib/event2"; then
	LDFLAGS="$LDFLAGS -L$thedir/lib/event2"
	ACX_RUNTIME_PATH_ADD([$thedir/lib/event2])
	else
	dnl assume /usr is in default path, do not add "".
	if test "$thedir" != "/usr" -a "$thedir" != ""; then
	LDFLAGS="$LDFLAGS -L$thedir/lib"
	ACX_RUNTIME_PATH_ADD([$thedir/lib])
	fi
	fi
	fi
	# check for library used by libevent after 1.3c
	AC_SEARCH_LIBS([clock_gettime], [rt])

	# is the event.h header libev or libevent?
	AC_CHECK_HEADERS([event.h],,, [AC_INCLUDES_DEFAULT])
	AC_CHECK_DECL(EV_VERSION_MAJOR, [
	AC_SEARCH_LIBS(event_set, [ev])
	],[
	AC_SEARCH_LIBS(event_set, [event])
	],[AC_INCLUDES_DEFAULT
	#include <event.h>
	])
	AC_CHECK_FUNCS([event_base_free]) # only in libevent 1.2 and later
	AC_CHECK_FUNCS([event_base_once]) # only in libevent 1.4.1 and later
	AC_CHECK_FUNCS([event_base_new]) # only in libevent 1.4.1 and later
	AC_CHECK_FUNCS([event_base_get_method]) # only in libevent 1.4.3 and later
	AC_CHECK_FUNCS([ev_loop]) # only in libev. (tested on 3.51)
	AC_CHECK_FUNCS([ev_default_loop]) # only in libev. (tested on 4.00)
	+ AC_CHECK_FUNCS([event_assign]) # in libevent, for thread-safety
	+ AC_CHECK_DECLS([evsignal_assign], [], [], [AC_INCLUDES_DEFAULT
	+#ifdef HAVE_EVENT_H
	+# include <event.h>
	+#else
	+# include "event2/event.h"
	+#endif
	+ ])
	PC_LIBEVENT_DEPENDENCY="libevent"
	AC_SUBST(PC_LIBEVENT_DEPENDENCY)
	if test -n "$BAK_LDFLAGS_SET"; then
	LDFLAGS="$BAK_LDFLAGS"
	fi
	else
	AC_DEFINE(USE_MINI_EVENT, 1, [Define if you want to use internal select based events])
	fi

	# check for libexpat
	AC_ARG_WITH(libexpat, AC_HELP_STRING([--with-libexpat=path],
	[specify explicit path for libexpat.]),
	[ ],[ withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr" ])
	AC_MSG_CHECKING(for libexpat)
	found_libexpat="no"
	for dir in $withval ; do
	if test -f "$dir/include/expat.h"; then
	found_libexpat="yes"
	dnl assume /usr is in default path.
	if test "$dir" != "/usr"; then
	CPPFLAGS="$CPPFLAGS -I$dir/include"
	LDFLAGS="$LDFLAGS -L$dir/lib"
	fi
	AC_MSG_RESULT(found in $dir)
	break;
	fi
	done
	if test x_$found_libexpat != x_yes; then
	AC_ERROR([Could not find libexpat, expat.h])
	fi
	AC_CHECK_HEADERS([expat.h],,, [AC_INCLUDES_DEFAULT])
	AC_CHECK_DECLS([XML_StopParser], [], [], [AC_INCLUDES_DEFAULT
	#include <expat.h>
	])

	# hiredis (redis C client for cachedb)
	AC_ARG_WITH(libhiredis, AC_HELP_STRING([--with-libhiredis=path],
	[specify explicit path for libhiredis.]),
	[ ],[ withval="no" ])
	found_libhiredis="no"
	if test x_$withval = x_yes -o x_$withval != x_no; then
	AC_MSG_CHECKING(for libhiredis)
	if test x_$withval = x_ -o x_$withval = x_yes; then
	withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
	fi
	for dir in $withval ; do
	if test -f "$dir/include/hiredis/hiredis.h"; then
	found_libhiredis="yes"
	dnl assume /usr is in default path.
	if test "$dir" != "/usr"; then
	CPPFLAGS="$CPPFLAGS -I$dir/include"
	LDFLAGS="$LDFLAGS -L$dir/lib"
	fi
	AC_MSG_RESULT(found in $dir)
	AC_DEFINE([USE_REDIS], [1], [Define this to use hiredis client.])
	LIBS="$LIBS -lhiredis"
	break;
	fi
	done
	if test x_$found_libhiredis != x_yes; then
	AC_ERROR([Could not find libhiredis, hiredis.h])
	fi
	AC_CHECK_HEADERS([hiredis/hiredis.h],,, [AC_INCLUDES_DEFAULT])
	AC_CHECK_DECLS([redisConnect], [], [], [AC_INCLUDES_DEFAULT
	#include <hiredis/hiredis.h>
	])
	fi

	# set static linking if requested
	AC_SUBST(staticexe)
	staticexe=""
	AC_ARG_ENABLE(static-exe, AC_HELP_STRING([--enable-static-exe],
	[ enable to compile executables statically against (event) libs, for debug purposes ]),
	, )
	if test x_$enable_static_exe = x_yes; then
	staticexe="-static"
	if test "$on_mingw" = yes; then
	staticexe="-all-static"
	# for static compile, include gdi32 and zlib here.
	if echo $LIBS \| grep 'lgdi32' >/dev/null; then
	:
	else
	LIBS="$LIBS -lgdi32"
	fi
	LIBS="$LIBS -lz"
	fi
	fi

	# Include systemd.m4 - begin
	sinclude(systemd.m4)
	# Include systemd.m4 - end

	# set lock checking if requested
	AC_ARG_ENABLE(lock_checks, AC_HELP_STRING([--enable-lock-checks],
	[ enable to check lock and unlock calls, for debug purposes ]),
	, )
	if test x_$enable_lock_checks = x_yes; then
	AC_DEFINE(ENABLE_LOCK_CHECKS, 1, [Define if you want to use debug lock checking (slow).])
	CHECKLOCK_OBJ="checklocks.lo"
	AC_SUBST(CHECKLOCK_OBJ)
	fi

	ACX_CHECK_GETADDRINFO_WITH_INCLUDES
	if test "$USE_WINSOCK" = 1; then
	AC_DEFINE(UB_ON_WINDOWS, 1, [Use win32 resources and API])
	AC_CHECK_HEADERS([iphlpapi.h],,, [AC_INCLUDES_DEFAULT
	#include <windows.h>
	])
	AC_CHECK_TOOL(WINDRES, windres)
	LIBS="$LIBS -liphlpapi -lcrypt32"
	WINAPPS="unbound-service-install.exe unbound-service-remove.exe anchor-update.exe"
	AC_SUBST(WINAPPS)
	WIN_DAEMON_SRC="winrc/win_svc.c winrc/w_inst.c"
	AC_SUBST(WIN_DAEMON_SRC)
	WIN_DAEMON_OBJ="win_svc.lo w_inst.lo"
	AC_SUBST(WIN_DAEMON_OBJ)
	WIN_DAEMON_OBJ_LINK="rsrc_unbound.o"
	AC_SUBST(WIN_DAEMON_OBJ_LINK)
	WIN_HOST_OBJ_LINK="rsrc_unbound_host.o"
	AC_SUBST(WIN_HOST_OBJ_LINK)
	WIN_UBANCHOR_OBJ_LINK="rsrc_unbound_anchor.o log.lo locks.lo"
	AC_SUBST(WIN_UBANCHOR_OBJ_LINK)
	WIN_CONTROL_OBJ_LINK="rsrc_unbound_control.o"
	AC_SUBST(WIN_CONTROL_OBJ_LINK)
	WIN_CHECKCONF_OBJ_LINK="rsrc_unbound_checkconf.o"
	AC_SUBST(WIN_CHECKCONF_OBJ_LINK)
	fi
	if test $ac_cv_func_getaddrinfo = no; then
	AC_LIBOBJ([fake-rfc2553])
	fi
	# check after getaddrinfo for its libraries
	ACX_FUNC_IOCTLSOCKET

	# see if daemon(3) exists, and if it is deprecated.
	AC_CHECK_FUNCS([daemon])
	if test $ac_cv_func_daemon = yes; then
	ACX_FUNC_DEPRECATED([daemon], [(void)daemon(0, 0);], [
	#include <stdlib.h>
	])
	fi

	AC_CHECK_MEMBERS([struct sockaddr_un.sun_len],,,[
	AC_INCLUDES_DEFAULT
	#ifdef HAVE_SYS_UN_H
	#include <sys/un.h>
	#endif
	])
	AC_CHECK_MEMBERS([struct in_pktinfo.ipi_spec_dst],,,[
	AC_INCLUDES_DEFAULT
	#if HAVE_SYS_PARAM_H
	#include <sys/param.h>
	#endif

	#ifdef HAVE_SYS_SOCKET_H
	#include <sys/socket.h>
	#endif

	#ifdef HAVE_SYS_UIO_H
	#include <sys/uio.h>
	#endif

	#ifdef HAVE_NETINET_IN_H
	#include <netinet/in.h>
	#endif

	#ifdef HAVE_NETINET_TCP_H
	#include <netinet/tcp.h>
	#endif

	#ifdef HAVE_ARPA_INET_H
	#include <arpa/inet.h>
	#endif

	#ifdef HAVE_WINSOCK2_H
	#include <winsock2.h>
	#endif

	#ifdef HAVE_WS2TCPIP_H
	#include <ws2tcpip.h>
	#endif
	])
	AC_SEARCH_LIBS([setusercontext], [util])
	AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam endpwent getrlimit setrlimit setsid chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync shmget accept4])
	AC_CHECK_FUNCS([setresuid],,[AC_CHECK_FUNCS([setreuid])])
	AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])

	# check if setreuid en setregid fail, on MacOSX10.4(darwin8).
	if echo $target_os \| grep darwin8 > /dev/null; then
	AC_DEFINE(DARWIN_BROKEN_SETREUID, 1, [Define this if on macOSX10.4-darwin8 and setreuid and setregid do not work])
	fi
	AC_CHECK_DECLS([inet_pton,inet_ntop], [], [], [
	AC_INCLUDES_DEFAULT
	#ifdef HAVE_NETINET_IN_H
	#include <netinet/in.h>
	#endif

	#ifdef HAVE_NETINET_TCP_H
	#include <netinet/tcp.h>
	#endif

	#ifdef HAVE_ARPA_INET_H
	#include <arpa/inet.h>
	#endif

	#ifdef HAVE_WINSOCK2_H
	#include <winsock2.h>
	#endif

	#ifdef HAVE_WS2TCPIP_H
	#include <ws2tcpip.h>
	#endif
	])
	AC_REPLACE_FUNCS(inet_aton)
	AC_REPLACE_FUNCS(inet_pton)
	AC_REPLACE_FUNCS(inet_ntop)
	AC_REPLACE_FUNCS(snprintf)
	# test if snprintf return the proper length
	if test "x$ac_cv_func_snprintf" = xyes; then
	if test c${cross_compiling} = cno; then
	AC_MSG_CHECKING([for correct snprintf return value])
	AC_RUN_IFELSE([AC_LANG_SOURCE(AC_INCLUDES_DEFAULT
	[[
	int main(void) { return !(snprintf(NULL, 0, "test") == 4); }
	]])], [AC_MSG_RESULT(yes)], [
	AC_MSG_RESULT(no)
	AC_DEFINE([SNPRINTF_RET_BROKEN], [], [define if (v)snprintf does not return length needed, (but length used)])
	AC_LIBOBJ(snprintf)
	])
	fi
	fi
	AC_REPLACE_FUNCS(strlcat)
	AC_REPLACE_FUNCS(strlcpy)
	AC_REPLACE_FUNCS(memmove)
	AC_REPLACE_FUNCS(gmtime_r)
	AC_REPLACE_FUNCS(isblank)
	AC_REPLACE_FUNCS(explicit_bzero)
	dnl without CTIME, ARC4-functions and without reallocarray.
	LIBOBJ_WITHOUT_CTIMEARC4="$LIBOBJS"
	AC_SUBST(LIBOBJ_WITHOUT_CTIMEARC4)
	-AC_REPLACE_FUNCS(reallocarray)
	+AC_MSG_CHECKING([for reallocarray])
	+AC_LINK_IFELSE([AC_LANG_SOURCE(AC_INCLUDES_DEFAULT
	+[[
	+#ifndef _OPENBSD_SOURCE
	+#define _OPENBSD_SOURCE 1
	+#endif
	+#include <stdlib.h>
	+int main(void) {
	+ void* p = reallocarray(NULL, 10, 100);
	+ free(p);
	+ return 0;
	+}
	+]])], [AC_MSG_RESULT(yes)
	+ AC_DEFINE(HAVE_REALLOCARRAY, 1, [If we have reallocarray(3)])
	+], [
	+ AC_MSG_RESULT(no)
	+ AC_LIBOBJ(reallocarray)
	+])
	if test "$USE_NSS" = "no"; then
	AC_REPLACE_FUNCS(arc4random)
	AC_REPLACE_FUNCS(arc4random_uniform)
	if test "$ac_cv_func_arc4random" = "no"; then
	AC_LIBOBJ(arc4_lock)
	AC_CHECK_FUNCS([getentropy],,[
	if test "$USE_WINSOCK" = 1; then
	AC_LIBOBJ(getentropy_win)
	else
	case "$host" in
	Darwin\|darwin)
	AC_LIBOBJ(getentropy_osx)
	;;
	solaris\|sunos\|SunOS)
	AC_LIBOBJ(getentropy_solaris)
	AC_CHECK_HEADERS([sys/sha2.h],, [
	AC_CHECK_FUNCS([SHA512_Update],,[
	AC_LIBOBJ(sha512)
	])
	], [AC_INCLUDES_DEFAULT])
	if test "$ac_cv_header_sys_sha2_h" = "yes"; then
	# this lib needed for sha2 on solaris
	LIBS="$LIBS -lmd"
	fi
	AC_SEARCH_LIBS([clock_gettime], [rt])
	;;
	linux\|Linux\|*)
	AC_LIBOBJ(getentropy_linux)
	AC_CHECK_FUNCS([SHA512_Update],,[
	AC_DEFINE([COMPAT_SHA512], [1], [Do sha512 definitions in config.h])
	AC_LIBOBJ(sha512)
	])
	AC_CHECK_HEADERS([sys/sysctl.h],,, [AC_INCLUDES_DEFAULT])
	AC_CHECK_FUNCS([getauxval])
	AC_SEARCH_LIBS([clock_gettime], [rt])
	;;
	esac
	fi
	])
	fi
	fi
	LIBOBJ_WITHOUT_CTIME="$LIBOBJS"
	AC_SUBST(LIBOBJ_WITHOUT_CTIME)
	AC_REPLACE_FUNCS(ctime_r)
	AC_REPLACE_FUNCS(strsep)

	AC_ARG_ENABLE(allsymbols, AC_HELP_STRING([--enable-allsymbols], [export all symbols from libunbound and link binaries to it, smaller install size but libunbound export table is polluted by internal symbols]))
	case "$enable_allsymbols" in
	yes)
	COMMON_OBJ_ALL_SYMBOLS=""
	UBSYMS=""
	EXTRALINK="-L. -L.libs -lunbound"
	AC_DEFINE(EXPORT_ALL_SYMBOLS, 1, [Define this if you enabled-allsymbols from libunbound to link binaries to it for smaller install size, but the libunbound export table is polluted by internal symbols])
	;;
	no\|*)
	COMMON_OBJ_ALL_SYMBOLS='$(COMMON_OBJ)'
	UBSYMS='-export-symbols $(srcdir)/libunbound/ubsyms.def'
	EXTRALINK=""
	;;
	esac
	AC_SUBST(COMMON_OBJ_ALL_SYMBOLS)
	AC_SUBST(EXTRALINK)
	AC_SUBST(UBSYMS)
	if test x_$enable_lock_checks = x_yes; then
	UBSYMS="-export-symbols clubsyms.def"
	cp ${srcdir}/libunbound/ubsyms.def clubsyms.def
	echo lock_protect >> clubsyms.def
	echo lock_unprotect >> clubsyms.def
	echo lock_get_mem >> clubsyms.def
	echo checklock_start >> clubsyms.def
	echo checklock_stop >> clubsyms.def
	echo checklock_lock >> clubsyms.def
	echo checklock_unlock >> clubsyms.def
	echo checklock_init >> clubsyms.def
	echo checklock_thrcreate >> clubsyms.def
	echo checklock_thrjoin >> clubsyms.def
	fi

	# check for dnstap if requested
	dt_DNSTAP([$UNBOUND_RUN_DIR/dnstap.sock],
	[
	AC_DEFINE([USE_DNSTAP], [1], [Define to 1 to enable dnstap support])
	AC_SUBST([ENABLE_DNSTAP], [1])

	AC_SUBST([opt_dnstap_socket_path])
	ACX_ESCAPE_BACKSLASH($opt_dnstap_socket_path, hdr_dnstap_socket_path)
	AC_DEFINE_UNQUOTED(DNSTAP_SOCKET_PATH,
	["$hdr_dnstap_socket_path"], [default dnstap socket path])

	AC_SUBST([DNSTAP_SRC], ["dnstap/dnstap.c dnstap/dnstap.pb-c.c"])
	AC_SUBST([DNSTAP_OBJ], ["dnstap.lo dnstap.pb-c.lo"])
	],
	[
	AC_SUBST([ENABLE_DNSTAP], [0])
	]
	)

	# check for dnscrypt if requested
	dnsc_DNSCRYPT([
	AC_DEFINE([USE_DNSCRYPT], [1], [Define to 1 to enable dnscrypt support])
	AC_SUBST([ENABLE_DNSCRYPT], [1])

	AC_SUBST([DNSCRYPT_SRC], ["dnscrypt/dnscrypt.c"])
	AC_SUBST([DNSCRYPT_OBJ], ["dnscrypt.lo"])
	],
	[
	AC_SUBST([ENABLE_DNSCRYPT], [0])
	]
	)

	# check for cachedb if requested
	AC_ARG_ENABLE(cachedb, AC_HELP_STRING([--enable-cachedb], [enable cachedb module that can use external cache storage]))
	# turn on cachedb when hiredis support is enabled.
	if test "$found_libhiredis" = "yes"; then enable_cachedb="yes"; fi
	case "$enable_cachedb" in
	yes)
	AC_DEFINE([USE_CACHEDB], [1], [Define to 1 to use cachedb support])
	;;
	no\|*)
	# nothing
	;;
	esac

	# check for ipsecmod if requested
	AC_ARG_ENABLE(ipsecmod, AC_HELP_STRING([--enable-ipsecmod], [Enable ipsecmod module that facilitates opportunistic IPsec]))
	case "$enable_ipsecmod" in
	yes)
	AC_DEFINE([USE_IPSECMOD], [1], [Define to 1 to use ipsecmod support.])
	IPSECMOD_OBJ="ipsecmod.lo ipsecmod-whitelist.lo"
	AC_SUBST(IPSECMOD_OBJ)
	IPSECMOD_HEADER='$(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/ipsecmod/ipsecmod-whitelist.h'
	AC_SUBST(IPSECMOD_HEADER)
	;;
	no\|*)
	# nothing
	;;
	esac

	AC_MSG_CHECKING([if ${MAKE:-make} supports $< with implicit rule in scope])
	# on openBSD, the implicit rule make $< work.
	# on Solaris, it does not work ($? is changed sources, $^ lists dependencies).
	# gmake works.
	cat >conftest.make <<EOF
	all: conftest.lo

	conftest.lo foo.lo bla.lo:
	if test -f "\$<"; then touch \$@; fi

	.SUFFIXES: .lo
	.c.lo:
	if test -f "\$<"; then touch \$@; fi

	conftest.lo: conftest.dir/conftest.c
	EOF
	mkdir conftest.dir
	touch conftest.dir/conftest.c
	rm -f conftest.lo conftest.c
	${MAKE:-make} -f conftest.make >/dev/null
	rm -f conftest.make conftest.c conftest.dir/conftest.c
	rm -rf conftest.dir
	if test ! -f conftest.lo; then
	AC_MSG_RESULT(no)
	SOURCEDETERMINE='echo "$^" \| awk "-F " "{print \$$1;}" > .source'
	SOURCEFILE='`cat .source`'
	else
	AC_MSG_RESULT(yes)
	SOURCEDETERMINE=':'
	SOURCEFILE='$<'
	fi
	rm -f conftest.lo
	AC_SUBST(SOURCEDETERMINE)
	AC_SUBST(SOURCEFILE)

	# see if we want to build the library or everything
	ALLTARGET="alltargets"
	INSTALLTARGET="install-all"
	AC_ARG_WITH(libunbound-only, AC_HELP_STRING([--with-libunbound-only],
	[do not build daemon and tool programs]),
	[
	if test "$withval" = "yes"; then
	ALLTARGET="lib"
	INSTALLTARGET="install-lib"
	fi
	])
	if test $ALLTARGET = "alltargets"; then
	if test $USE_NSS = "yes"; then
	AC_ERROR([--with-nss can only be used in combination with --with-libunbound-only.])
	fi
	if test $USE_NETTLE = "yes"; then
	AC_ERROR([--with-nettle can only be used in combination with --with-libunbound-only.])
	fi
	fi

	AC_SUBST(ALLTARGET)
	AC_SUBST(INSTALLTARGET)

	ACX_STRIP_EXT_FLAGS
	if test -n "$LATE_LDFLAGS"; then
	LDFLAGS="$LATE_LDFLAGS $LDFLAGS"
	fi
	# remove start spaces
	LDFLAGS=`echo "$LDFLAGS"\|sed -e 's/^ *//'`
	LIBS=`echo "$LIBS"\|sed -e 's/^ *//'`

	AC_DEFINE_UNQUOTED([MAXSYSLOGMSGLEN], [10240], [Define to the maximum message length to pass to syslog.])

	AH_BOTTOM(
	dnl this must be first AH_CONFIG, to define the flags before any includes.
	AHX_CONFIG_EXT_FLAGS

	dnl includes
	[
	+#ifndef _OPENBSD_SOURCE
	+#define _OPENBSD_SOURCE 1
	+#endif
	+
	#ifndef UNBOUND_DEBUG
	+# ifndef NDEBUG
	# define NDEBUG
	+# endif
	#endif

	/** Use small-ldns codebase */
	#define USE_SLDNS 1
	#ifdef HAVE_SSL
	# define LDNS_BUILD_CONFIG_HAVE_SSL 1
	#endif

	#include <stdio.h>
	#include <string.h>
	#include <unistd.h>
	#include <assert.h>

	#if STDC_HEADERS
	#include <stdlib.h>
	#include <stddef.h>
	#endif

	#ifdef HAVE_STDARG_H
	#include <stdarg.h>
	#endif

	#ifdef HAVE_STDINT_H
	#include <stdint.h>
	#endif

	#include <errno.h>

	#if HAVE_SYS_PARAM_H
	#include <sys/param.h>
	#endif

	#ifdef HAVE_SYS_SOCKET_H
	#include <sys/socket.h>
	#endif

	#ifdef HAVE_SYS_UIO_H
	#include <sys/uio.h>
	#endif

	#ifdef HAVE_NETINET_IN_H
	#include <netinet/in.h>
	#endif

	#ifdef HAVE_NETINET_TCP_H
	#include <netinet/tcp.h>
	#endif

	#ifdef HAVE_ARPA_INET_H
	#include <arpa/inet.h>
	#endif

	#ifdef HAVE_WINSOCK2_H
	#include <winsock2.h>
	#endif

	#ifdef HAVE_WS2TCPIP_H
	#include <ws2tcpip.h>
	#endif

	#ifndef USE_WINSOCK
	#define ARG_LL "%ll"
	#else
	#define ARG_LL "%I64"
	#endif

	#ifndef AF_LOCAL
	#define AF_LOCAL AF_UNIX
	#endif
	]

	AHX_CONFIG_FORMAT_ATTRIBUTE
	AHX_CONFIG_UNUSED_ATTRIBUTE
	AHX_CONFIG_FSEEKO
	AHX_CONFIG_MAXHOSTNAMELEN
	#if !defined(HAVE_SNPRINTF) \|\| defined(SNPRINTF_RET_BROKEN)
	#define snprintf snprintf_unbound
	#define vsnprintf vsnprintf_unbound
	#include <stdarg.h>
	int snprintf (char str, size_t count, const char fmt, ...);
	int vsnprintf (char str, size_t count, const char fmt, va_list arg);
	#endif /* HAVE_SNPRINTF or SNPRINTF_RET_BROKEN */
	AHX_CONFIG_INET_PTON(unbound)
	AHX_CONFIG_INET_NTOP(unbound)
	AHX_CONFIG_INET_ATON(unbound)
	AHX_CONFIG_MEMMOVE(unbound)
	AHX_CONFIG_STRLCAT(unbound)
	AHX_CONFIG_STRLCPY(unbound)
	AHX_CONFIG_GMTIME_R(unbound)
	AHX_CONFIG_REALLOCARRAY(unbound)
	AHX_CONFIG_W32_SLEEP
	AHX_CONFIG_W32_USLEEP
	AHX_CONFIG_W32_RANDOM
	AHX_CONFIG_W32_SRANDOM
	AHX_CONFIG_W32_FD_SET_T
	AHX_CONFIG_IPV6_MIN_MTU
	AHX_MEMCMP_BROKEN(unbound)

	[
	#ifndef HAVE_CTIME_R
	#define ctime_r unbound_ctime_r
	char ctime_r(const time_t timep, char *buf);
	#endif

	#ifndef HAVE_STRSEP
	#define strsep unbound_strsep
	char strsep(char stringp, const char delim);
	#endif

	#ifndef HAVE_ISBLANK
	#define isblank unbound_isblank
	int isblank(int c);
	#endif

	#ifndef HAVE_EXPLICIT_BZERO
	#define explicit_bzero unbound_explicit_bzero
	void explicit_bzero(void* buf, size_t len);
	#endif

	#if defined(HAVE_INET_NTOP) && !HAVE_DECL_INET_NTOP
	const char inet_ntop(int af, const void src, char *dst, size_t size);
	#endif

	#if defined(HAVE_INET_PTON) && !HAVE_DECL_INET_PTON
	int inet_pton(int af, const char* src, void* dst);
	#endif

	#if !defined(HAVE_STRPTIME) \|\| !defined(STRPTIME_WORKS)
	#define strptime unbound_strptime
	struct tm;
	char strptime(const char s, const char format, struct tm tm);
	#endif

	#ifdef HAVE_LIBRESSL
	# if !HAVE_DECL_STRLCPY
	size_t strlcpy(char dst, const char src, size_t siz);
	# endif
	# if !HAVE_DECL_STRLCAT
	size_t strlcat(char dst, const char src, size_t siz);
	# endif
	# if !HAVE_DECL_ARC4RANDOM && defined(HAVE_ARC4RANDOM)
	uint32_t arc4random(void);
	# endif
	# if !HAVE_DECL_ARC4RANDOM_UNIFORM && defined(HAVE_ARC4RANDOM_UNIFORM)
	uint32_t arc4random_uniform(uint32_t upper_bound);
	# endif
	# if !HAVE_DECL_REALLOCARRAY
	void reallocarray(void ptr, size_t nmemb, size_t size);
	# endif
	#endif /* HAVE_LIBRESSL */
	#ifndef HAVE_ARC4RANDOM
	int getentropy(void* buf, size_t len);
	uint32_t arc4random(void);
	void arc4random_buf(void* buf, size_t n);
	void _ARC4_LOCK(void);
	void _ARC4_UNLOCK(void);
	void _ARC4_LOCK_DESTROY(void);
	#endif
	#ifndef HAVE_ARC4RANDOM_UNIFORM
	uint32_t arc4random_uniform(uint32_t upper_bound);
	#endif
	#ifdef COMPAT_SHA512
	#ifndef SHA512_DIGEST_LENGTH
	#define SHA512_BLOCK_LENGTH 128
	#define SHA512_DIGEST_LENGTH 64
	#define SHA512_DIGEST_STRING_LENGTH (SHA512_DIGEST_LENGTH * 2 + 1)
	typedef struct _SHA512_CTX {
	uint64_t state[8];
	uint64_t bitcount[2];
	uint8_t buffer[SHA512_BLOCK_LENGTH];
	} SHA512_CTX;
	#endif /* SHA512_DIGEST_LENGTH */
	void SHA512_Init(SHA512_CTX*);
	void SHA512_Update(SHA512_CTX, void, size_t);
	void SHA512_Final(uint8_t[SHA512_DIGEST_LENGTH], SHA512_CTX*);
	unsigned char SHA512(void data, unsigned int data_len, unsigned char *digest);
	#endif /* COMPAT_SHA512 */



	#if defined(HAVE_EVENT_H) && !defined(HAVE_EVENT_BASE_ONCE) && !(defined(HAVE_EV_LOOP) \|\| defined(HAVE_EV_DEFAULT_LOOP)) && (defined(HAVE_PTHREAD) \|\| defined(HAVE_SOLARIS_THREADS))
	/* using version of libevent that is not threadsafe. */
	# define LIBEVENT_SIGNAL_PROBLEM 1
	#endif

	#ifndef CHECKED_INET6
	# define CHECKED_INET6
	# ifdef AF_INET6
	# define INET6
	# else
	# define AF_INET6 28
	# endif
	#endif /* CHECKED_INET6 */

	#ifndef HAVE_GETADDRINFO
	struct sockaddr_storage;
	#include "compat/fake-rfc2553.h"
	#endif

	#ifdef UNBOUND_ALLOC_STATS
	# define malloc(s) unbound_stat_malloc_log(s, __FILE__, __LINE__, __func__)
	# define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
	# define free(p) unbound_stat_free_log(p, __FILE__, __LINE__, __func__)
	# define realloc(p,s) unbound_stat_realloc_log(p, s, __FILE__, __LINE__, __func__)
	void *unbound_stat_malloc(size_t size);
	void *unbound_stat_calloc(size_t nmemb, size_t size);
	void unbound_stat_free(void *ptr);
	void unbound_stat_realloc(void ptr, size_t size);
	void unbound_stat_malloc_log(size_t size, const char file, int line,
	const char* func);
	void unbound_stat_calloc_log(size_t nmemb, size_t size, const char file,
	int line, const char* func);
	void unbound_stat_free_log(void ptr, const char file, int line,
	const char* func);
	void unbound_stat_realloc_log(void ptr, size_t size, const char* file,
	int line, const char* func);
	#elif defined(UNBOUND_ALLOC_LITE)
	# include "util/alloc.h"
	#endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */

	/** default port for DNS traffic. */
	#define UNBOUND_DNS_PORT 53
	/** default port for DNS over TLS traffic. */
	#define UNBOUND_DNS_OVER_TLS_PORT 853
	/** default port for unbound control traffic, registered port with IANA,
	ub-dns-control 8953/tcp unbound dns nameserver control */
	#define UNBOUND_CONTROL_PORT 8953
	/** the version of unbound-control that this software implements */
	#define UNBOUND_CONTROL_VERSION 1

	])

	dnl if we build from source tree, the man pages need @date@ and @version@
	dnl if this is a distro tarball, that was already done by makedist.sh
	AC_SUBST(version, [VERSION_MAJOR.VERSION_MINOR.VERSION_MICRO])
	AC_SUBST(date, [`date +'%b %e, %Y'`])

	AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service])
	AC_CONFIG_HEADER([config.h])
	AC_OUTPUT
	Index: head/contrib/unbound/contrib/README
	===================================================================
	--- head/contrib/unbound/contrib/README (revision 349719)
	+++ head/contrib/unbound/contrib/README (revision 349720)
	@@ -1,40 +1,42 @@
	These files are contributed to unbound, and are not part of the official
	distribution but may be helpful.

	* rc_d_unbound: FreeBSD compatible /etc/rc.d script.
	* parseunbound.pl: perl script to run from cron that parses statistics from
	the log file and stores them.
	* unbound.spec and unbound.init: RPM specfile and Linux rc.d initfile.
	* update-anchor.sh: shell script that uses unbound-host to update a set
	of trust anchor files. Run from cron twice a month.
	* unbound_munin_ : plugin for munin statistics report
	* unbound_cacti.tar.gz : setup files for cacti statistics report
	* selinux: the .fc and .te files for SElinux protection of the unbound daemon
	* unbound.plist: launchd configuration file for MacOSX.
	* build-unbound-localzone-from-hosts.pl: perl script to turn /etc/hosts into
	a local-zone and local-data include file for unbound.conf.
	* unbound-host.nagios.patch: makes unbound-host return status that fits right
	in with the nagios monitoring framework. Contributed by Migiel de Vos.
	* patch_rsamd5_enable.diff: this patch enables RSAMD5 validation (otherwise
	it is treated as insecure). The RSAMD5 algorithm is deprecated (RFC6725).
	* create_unbound_ad_servers.sh: shell script to enter anti-ad server lists.
	* create_unbound_ad_servers.cmd: windows script to enter anti-ad server lists.
	* unbound_cache.sh: shell script to save and load the cache.
	* unbound_cache.cmd: windows script to save and load the cache.
	* warmup.sh: shell script to warm up DNS cache by your own MRU domains.
	* warmup.cmd: windows script to warm up DNS cache by your own MRU domains.
	* aaaa-filter-iterator.patch: adds config option aaaa-filter: yes that
	works like the BIND feature (removes AAAA records unless AAAA-only domain).
	Useful for certain 'broken IPv6 default route' scenarios.
	Patch from Stephane Lapie for ASAHI Net.
	* unbound_smf22.tar.gz: Solaris SMF installation/removal scripts.
	Contributed by Yuri Voinov.
	* unbound.socket and unbound.service: systemd files for unbound, install them
	in /usr/lib/systemd/system. Contributed by Sami Kerola and Pavel Odintsov.
	* redirect-bogus.patch: Return configured address for bogus A and AAAA answers,
	instead of SERVFAIL. Contributed by SIDN.
	* fastrpz.patch: fastrpz support from Farsight Security.
	* libunbound.so.conf: ltrace.conf file, see ltrace.conf(5), for libunbound.
	* unbound-querycachedb.py: utility to show data stored in cachedb backend
	for a particular query name and type. It requires dnspython and (for
	redis backend) redis Python modules.
	+* unbound-fuzzme.patch: adds unbound-fuzzme program that parses a packet from
	+ stdin. Used with fuzzers, patch from Jacob Hoffman-Andrews.
	Index: head/contrib/unbound/contrib/fastrpz.patch
	===================================================================
	--- head/contrib/unbound/contrib/fastrpz.patch (revision 349719)
	+++ head/contrib/unbound/contrib/fastrpz.patch (revision 349720)
	@@ -1,3501 +1,3504 @@
	Description: based on the included patch contrib/fastrpz.patch
	Author: fastrpz@farsightsecurity.com
	---
	-Index: unboundfastrpz/Makefile.in
	-===================================================================
	---- unboundfastrpz/Makefile.in (revision 4923)
	-+++ unboundfastrpz/Makefile.in (working copy)
	-@@ -23,6 +23,8 @@
	+diff --git a/Makefile.in b/Makefile.in
	+index 03a6347..6758bea 100644
	+--- a/Makefile.in
	++++ b/Makefile.in
	+@@ -23,6 +23,8 @@ CHECKLOCK_SRC=testcode/checklocks.c
	CHECKLOCK_OBJ=@CHECKLOCK_OBJ@
	DNSTAP_SRC=@DNSTAP_SRC@
	DNSTAP_OBJ=@DNSTAP_OBJ@
	+FASTRPZ_SRC=@FASTRPZ_SRC@
	+FASTRPZ_OBJ=@FASTRPZ_OBJ@
	DNSCRYPT_SRC=@DNSCRYPT_SRC@
	DNSCRYPT_OBJ=@DNSCRYPT_OBJ@
	WITH_PYTHONMODULE=@WITH_PYTHONMODULE@
	-@@ -126,7 +128,7 @@
	+@@ -126,7 +128,7 @@ validator/val_sigcrypt.c validator/val_utils.c dns64/dns64.c \
	edns-subnet/edns-subnet.c edns-subnet/subnetmod.c \
	edns-subnet/addrtree.c edns-subnet/subnet-whitelist.c \
	cachedb/cachedb.c cachedb/redis.c respip/respip.c $(CHECKLOCK_SRC) \
	-$(DNSTAP_SRC) $(DNSCRYPT_SRC) $(IPSECMOD_SRC)
	+$(DNSTAP_SRC) $(FASTRPZ_SRC) $(DNSCRYPT_SRC) $(IPSECMOD_SRC)
	COMMON_OBJ_WITHOUT_NETCALL=dns.lo infra.lo rrset.lo dname.lo msgencode.lo \
	as112.lo msgparse.lo msgreply.lo packed_rrset.lo iterator.lo iter_delegpt.lo \
	iter_donotq.lo iter_fwd.lo iter_hints.lo iter_priv.lo iter_resptype.lo \
	-@@ -139,7 +141,7 @@
	+@@ -139,7 +141,7 @@ autotrust.lo val_anchor.lo \
	validator.lo val_kcache.lo val_kentry.lo val_neg.lo val_nsec3.lo val_nsec.lo \
	val_secalgo.lo val_sigcrypt.lo val_utils.lo dns64.lo cachedb.lo redis.lo authzone.lo \
	$(SUBNET_OBJ) $(PYTHONMOD_OBJ) $(CHECKLOCK_OBJ) $(DNSTAP_OBJ) $(DNSCRYPT_OBJ) \
	-$(IPSECMOD_OBJ) respip.lo
	+$(FASTRPZ_OBJ) $(IPSECMOD_OBJ) respip.lo
	COMMON_OBJ_WITHOUT_UB_EVENT=$(COMMON_OBJ_WITHOUT_NETCALL) netevent.lo listen_dnsport.lo \
	outside_network.lo
	COMMON_OBJ=$(COMMON_OBJ_WITHOUT_UB_EVENT) ub_event.lo
	-@@ -405,6 +407,11 @@
	+@@ -405,6 +407,11 @@ dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h \
	$(srcdir)/util/config_file.h $(srcdir)/util/log.h \
	$(srcdir)/util/netevent.h

	+# fastrpz
	+rpz.lo rpz.o: $(srcdir)/fastrpz/rpz.c config.h fastrpz/rpz.h fastrpz/librpz.h \
	+ $(srcdir)/util/config_file.h $(srcdir)/daemon/daemon.h \
	+ $(srcdir)/util/log.h
	+
	# Python Module
	pythonmod.lo pythonmod.o: $(srcdir)/pythonmod/pythonmod.c config.h \
	pythonmod/interface.h \
	-Index: unboundfastrpz/config.h.in
	-===================================================================
	---- unboundfastrpz/config.h.in (revision 4923)
	-+++ unboundfastrpz/config.h.in (working copy)
	-@@ -1272,4 +1272,11 @@
	+diff --git a/config.h.in b/config.h.in
	+index 74c14d1..a18f4ff 100644
	+--- a/config.h.in
	++++ b/config.h.in
	+@@ -1305,4 +1305,11 @@ void unbound_stat_realloc_log(void ptr, size_t size, const char* file,
	/** the version of unbound-control that this software implements */
	#define UNBOUND_CONTROL_VERSION 1

	-
	+/* have __attribute__s used in librpz.h */
	+#undef LIBRPZ_HAVE_ATTR
	+/** fastrpz librpz.so */
	+#undef FASTRPZ_LIBRPZ_PATH
	+/** 0=no fastrpz 1=static link 2=dlopen() */
	+#undef FASTRPZ_LIB_OPEN
	+/** turn on fastrpz response policy zones */
	+#undef ENABLE_FASTRPZ
	-Index: unboundfastrpz/configure.ac
	-===================================================================
	---- unboundfastrpz/configure.ac (revision 4923)
	-+++ unboundfastrpz/configure.ac (working copy)
	-@@ -6,6 +6,7 @@
	+diff --git a/configure.ac b/configure.ac
	+index abbecf0..6454274 100644
	+--- a/configure.ac
	++++ b/configure.ac
	+@@ -6,6 +6,7 @@ sinclude(ax_pthread.m4)
	sinclude(acx_python.m4)
	sinclude(ac_pkg_swig.m4)
	sinclude(dnstap/dnstap.m4)
	+sinclude(fastrpz/rpz.m4)
	sinclude(dnscrypt/dnscrypt.m4)

	# must be numbers. ac_defun because of later processing
	-@@ -1565,6 +1566,9 @@
	+@@ -1586,6 +1587,9 @@ case "$enable_ipsecmod" in
	;;
	esac

	+# check for Fastrpz with fastrpz/rpz.m4
	+ck_FASTRPZ
	+
	AC_MSG_CHECKING([if ${MAKE:-make} supports $< with implicit rule in scope])
	# on openBSD, the implicit rule make $< work.
	# on Solaris, it does not work ($? is changed sources, $^ lists dependencies).
	-Index: unboundfastrpz/daemon/daemon.c
	-===================================================================
	---- unboundfastrpz/daemon/daemon.c (revision 4923)
	-+++ unboundfastrpz/daemon/daemon.c (working copy)
	+diff --git a/daemon/daemon.c b/daemon/daemon.c
	+index 7461a26..706f8f6 100644
	+--- a/daemon/daemon.c
	++++ b/daemon/daemon.c
	@@ -91,6 +91,9 @@
	#include "sldns/keyraw.h"
	#include "respip/respip.h"
	#include <signal.h>
	+#ifdef ENABLE_FASTRPZ
	+#include "fastrpz/rpz.h"
	+#endif

	#ifdef HAVE_SYSTEMD
	#include <systemd/sd-daemon.h>
	-@@ -462,6 +465,14 @@
	+@@ -460,6 +463,14 @@ daemon_create_workers(struct daemon* daemon)
	+ dt_apply_cfg(daemon->dtenv, daemon->cfg);
	+ #else
	fatal_exit("dnstap enabled in config but not built with dnstap support");
	- #endif
	- }
	++#endif
	++ }
	+ if(daemon->cfg->rpz_enable) {
	+#ifdef ENABLE_FASTRPZ
	+ rpz_init(&daemon->rpz_clist, &daemon->rpz_client, daemon->cfg);
	+#else
	+ fatal_exit("fastrpz enabled in config"
	+ " but not built with fastrpz");
	-+#endif
	-+ }
	+ #endif
	+ }
	for(i=0; i<daemon->num; i++) {
	- if(!(daemon->workers[i] = worker_create(daemon, i,
	- shufport+numport*i/daemon->num,
	-@@ -719,6 +730,9 @@
	+@@ -718,6 +729,9 @@ daemon_cleanup(struct daemon* daemon)
	+ #ifdef USE_DNSCRYPT
	dnsc_delete(daemon->dnscenv);
	daemon->dnscenv = NULL;
	- #endif
	++#endif
	+#ifdef ENABLE_FASTRPZ
	+ rpz_delete(&daemon->rpz_clist, &daemon->rpz_client);
	-+#endif
	+ #endif
	daemon->cfg = NULL;
	}
	-
	-Index: unboundfastrpz/daemon/daemon.h
	-===================================================================
	---- unboundfastrpz/daemon/daemon.h (revision 4923)
	-+++ unboundfastrpz/daemon/daemon.h (working copy)
	-@@ -136,6 +136,11 @@
	+diff --git a/daemon/daemon.h b/daemon/daemon.h
	+index 5749dbe..64ce230 100644
	+--- a/daemon/daemon.h
	++++ b/daemon/daemon.h
	+@@ -136,6 +136,11 @@ struct daemon {
	/** the dnscrypt environment */
	struct dnsc_env* dnscenv;
	#endif
	+#ifdef ENABLE_FASTRPZ
	+ /** global opaque rpz handles */
	+ struct librpz_clist *rpz_clist;
	+ struct librpz_client *rpz_client;
	+#endif
	};

	/**
	-Index: unboundfastrpz/daemon/worker.c
	-===================================================================
	---- unboundfastrpz/daemon/worker.c (revision 4923)
	-+++ unboundfastrpz/daemon/worker.c (working copy)
	+diff --git a/daemon/worker.c b/daemon/worker.c
	+index fc93817..e435226 100644
	+--- a/daemon/worker.c
	++++ b/daemon/worker.c
	@@ -75,6 +75,9 @@
	#include "libunbound/context.h"
	#include "libunbound/libworker.h"
	#include "sldns/sbuffer.h"
	+#ifdef ENABLE_FASTRPZ
	+#include "fastrpz/rpz.h"
	+#endif
	#include "sldns/wire2str.h"
	#include "util/shm_side/shm_main.h"
	#include "dnscrypt/dnscrypt.h"
	-@@ -533,8 +536,27 @@
	+@@ -533,8 +536,27 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
	/* not secure */
	secure = 0;
	break;
	+#ifdef ENABLE_FASTRPZ
	+ case sec_status_rpz_rewritten:
	+ case sec_status_rpz_drop:
	+ fatal_exit("impossible cached RPZ sec_status");
	+ break;
	+#endif
	}
	}
	+#ifdef ENABLE_FASTRPZ
	+ if(repinfo->rpz) {
	+ /* Scan the cached answer for RPZ hits.
	+ * ret=1 use cache entry
	+ * ret=-1 rewritten response already sent or dropped
	+ * ret=0 deny a cached entry exists
	+ */
	+ int ret = rpz_worker_cache(worker, msg->rep, qinfo,
	+ id, flags, edns, repinfo);
	+ if(ret != 1)
	+ return ret;
	+ }
	+#endif
	/* return this delegation from the cache */
	edns_bak = *edns;
	edns->edns_version = EDNS_ADVERTISED_VERSION;
	-@@ -702,6 +724,23 @@
	+@@ -699,6 +721,23 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
	secure = 0;
	}
	} else secure = 0;
	+#ifdef ENABLE_FASTRPZ
	+ if(repinfo->rpz) {
	+ /* Scan the cached answer for RPZ hits.
	+ * ret=1 use cache entry
	+ * ret=-1 rewritten response already sent or dropped
	+ * ret=0 deny a cached entry exists
	+ */
	+ int ret = rpz_worker_cache(worker, rep, qinfo, id, flags, edns,
	+ repinfo);
	+ if(ret != 1) {
	+ rrset_array_unlock_touch(worker->env.rrset_cache,
	+ worker->scratchpad, rep->ref,
	+ rep->rrset_count);
	+ return ret;
	+ }
	+ }
	+#endif

	edns_bak = *edns;
	edns->edns_version = EDNS_ADVERTISED_VERSION;
	-@@ -1407,6 +1446,15 @@
	+@@ -1409,6 +1448,15 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
	log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
	&repinfo->addr, repinfo->addrlen);
	goto send_reply;
	+#ifdef ENABLE_FASTRPZ
	+ } else {
	+ /* Start to rewrite for response policy zones.
	+ * This can hit a qname trigger and be done. */
	+ if(rpz_start(worker, &qinfo, repinfo, &edns)) {
	+ regional_free_all(worker->scratchpad);
	+ return 0;
	+ }
	+#endif
	}

	/* If we've found a local alias, replace the qname with the alias
	-@@ -1455,12 +1503,21 @@
	+@@ -1457,12 +1505,21 @@ lookup_cache:
	h = query_info_hash(lookup_qinfo, sldns_buffer_read_u16_at(c->buffer, 2));
	if((e=slabhash_lookup(worker->env.msg_cache, h, lookup_qinfo, 0))) {
	/* answer from cache - we have acquired a readlock on it */
	- if(answer_from_cache(worker, &qinfo,
	+ ret = answer_from_cache(worker, &qinfo,
	cinfo, &need_drop, &alias_rrset, &partial_rep,
	(struct reply_info*)e->data,
	(uint16_t)(void *)sldns_buffer_begin(c->buffer),
	sldns_buffer_read_u16_at(c->buffer, 2), repinfo,
	- &edns)) {
	+ &edns);
	+#ifdef ENABLE_FASTRPZ
	+ if(ret < 0) {
	+ /* RPZ already dropped or sent a response. */
	+ lock_rw_unlock(&e->lock);
	+ regional_free_all(worker->scratchpad);
	+ return 0;
	+ }
	+#endif
	+ if(ret) {
	/* prefetch it if the prefetch TTL expired.
	* Note that if there is more than one pass
	* its qname must be that used for cache
	-@@ -1514,11 +1571,19 @@
	+@@ -1516,11 +1573,19 @@ lookup_cache:
	lock_rw_unlock(&e->lock);
	}
	if(!LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) {
	- if(answer_norec_from_cache(worker, &qinfo,
	+ ret = answer_norec_from_cache(worker, &qinfo,
	(uint16_t)(void *)sldns_buffer_begin(c->buffer),
	sldns_buffer_read_u16_at(c->buffer, 2), repinfo,
	- &edns)) {
	+ &edns);
	+ if(ret) {
	regional_free_all(worker->scratchpad);
	+#ifdef ENABLE_FASTRPZ
	+ if(ret < 0) {
	+ /* RPZ already dropped
	+ * or sent a response. */
	+ return 0;
	+ }
	+#endif
	goto send_reply;
	}
	verbose(VERB_ALGO, "answer norec from cache -- "
	-Index: unboundfastrpz/doc/unbound.conf.5.in
	-===================================================================
	---- unboundfastrpz/doc/unbound.conf.5.in (revision 4923)
	-+++ unboundfastrpz/doc/unbound.conf.5.in (working copy)
	-@@ -1728,6 +1728,81 @@
	+diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
	+index c14ee27..0b71eaf 100644
	+--- a/doc/unbound.conf.5.in
	++++ b/doc/unbound.conf.5.in
	+@@ -1795,6 +1795,81 @@ List domain for which the AAAA records are ignored and the A record is
	used by dns64 processing instead. Can be entered multiple times, list a
	new domain for which it applies, one per line. Applies also to names
	underneath the name given.
	+.SS "Response Policy Zone Rewriting"
	+.LP
	+Response policy zone rewriting is controlled with the
	+.B rpz
	+clause.
	+It must contain a
	+.B rpz\-enable:
	+option, and one or more
	+.B rpz\-zone:
	+options.
	+It will usually also contain
	+.B rpz\-option:
	+clauses with general rewriting options or specifying dnsrpzd parameters.
	+Beneath the surface, the text in
	+.B rpz\-zone: \fI<"domain">\fR
	+is converted to \fI"zone domain\\n"\fR and added to the configuration string
	+given to
	+\fIlibrpz\fR(3).
	+The text in
	+.B rpz-option \fI<"text">\fR
	+is also added to that configuration string.
	+.LP
	+If using chroot, then the chroot directory must contain the \fIdnsrpzd\fR(3)
	+command and the shared libraries that it uses.
	+Those can be found with the \fIldd\fR(1) command.
	+.LP
	+Resolver zone and rewriting options and response policy zone triggers and
	+actions are described in \fIlibrpz\fR(3).
	+The separate control file that specifies the policy zones maintained by
	+the dnsrpzd daemon is described in \fIdnsrpzd\fR(8).
	+.LP
	+Many installations need a local whitelist that exempts local
	+domains from rewriting.
	+Whitelist records can be in zones transferred by dnsrpzd from
	+authorities or in a local zone file.
	+.TP
	+.B rpz-enable: \fI<yes or no>
	+enables Fastrpz.
	+If not enabled, the other options in the
	+.B rpz:
	+clause are ignored.
	+.TP
	+.B rpz-zone: \fI<"zone and options">
	+specifies a policy zone and optional per-zone rewriting parameters.
	+.TP
	+.B rpz-option: \fI<"option">
	+specifies general Fastrpz options.
	+.LP
	+Fastrpz is available only on POSIX compliant UNIX-like systems with the
	+\fImmap\fR(2) system call.
	+.LP
	+Fastrpz in Unbound differs from rpz and fastrpz in BIND by
	+.RS 3
	+.HP 4
	+RPZ-CLIENT-IP triggers can only be used in the first policy zone
	+specified with
	+.B rpz-zone:
	+.HP
	+Policy zone rewriting is disabled by the DO bit in DNS requests
	+even when no DNSSEC signatures are supplied by authorities.
	+.HP
	+Unbound local zones are not subject to rpz rewriting.
	+.HP
	+Like Fastrpz with BIND but unlike classic BIND rpz,
	+the ADDITIONAL sections of rewritten responses contain the SOA record from
	+the policy zone used to rewrite the response.
	+.RE
	+.P
	+.nf
	+# example Fastrpz settings for use with chroot on Freebsd
	+rpz:
	+ rpz-zone: "rpz.example.org"
	+ rpz-zone: "other.rpz.example.org ip-as-ns yes"
	+ rpz-option: "dnsrpzd ./dnsrpzd"
	+.fi
	.SS "DNSCrypt Options"
	.LP
	The
	-Index: unboundfastrpz/fastrpz/librpz.h
	-===================================================================
	---- unboundfastrpz/fastrpz/librpz.h (nonexistent)
	-+++ unboundfastrpz/fastrpz/librpz.h (working copy)
	+diff --git a/fastrpz/librpz.h b/fastrpz/librpz.h
	+new file mode 100644
	+index 0000000..645279d
	+--- /dev/null
	++++ b/fastrpz/librpz.h
	@@ -0,0 +1,957 @@
	+/*
	+ * Define the interface from a DNS resolver to the Response Policy Zone
	+ * library, librpz.
	+ *
	+ * This file should be included only the interface functions between the
	+ * resolver and librpz to avoid name space pollution.
	+ *
	+ * Copyright (c) 2016-2017 Farsight Security, Inc.
	+ *
	+ * Licensed under the Apache License, Version 2.0 (the "License");
	+ * you may not use this file except in compliance with the License.
	+ * You may obtain a copy of the License at
	+ * http://www.apache.org/licenses/LICENSE-2.0
	+ *
	+ * Unless required by applicable law or agreed to in writing, software
	+ * distributed under the License is distributed on an "AS IS" BASIS,
	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	+ * See the License for the specific language governing permissions and
	+ * limitations under the License.
	+ *
	+ * Fastrpz version 1.2.10
	+ */
	+
	+#ifndef LIBRPZ_H
	+#define LIBRPZ_H
	+
	+#include <arpa/nameser.h>
	+#include <netinet/in.h>
	+#include <stdarg.h>
	+#include <stdbool.h>
	+#include <stdio.h>
	+#include <sys/types.h>
	+
	+
	+/*
	+ * Allow either ordinary or dlopen() linking.
	+ */
	+#ifdef LIBRPZ_INTERNAL
	+#define LIBDEF(t,s) extern t s;
	+#define LIBDEF_F(f) LIBDEF(librpz_##f##_t, librpz_##f)
	+#else
	+#define LIBDEF(t,s)
	+#define LIBDEF_F(f)
	+#endif
	+
	+/*
	+ * Response Policy Zone triggers.
	+ * Comparisons of trigger precedences require
	+ * LIBRPZ_TRIG_CLIENT_IP < LIBRPZ_TRIG_QNAME < LIBRPZ_TRIG_IP
	+ * < LIBRPZ_TRIG_NSDNAME < LIBRPZ_TRIG_NSIP}
	+ */
	+typedef enum {
	+ LIBRPZ_TRIG_BAD =0,
	+ LIBRPZ_TRIG_CLIENT_IP =1,
	+ LIBRPZ_TRIG_QNAME =2,
	+ LIBRPZ_TRIG_IP =3,
	+ LIBRPZ_TRIG_NSDNAME =4,
	+ LIBRPZ_TRIG_NSIP =5
	+} librpz_trig_t;
	+#define LIBRPZ_TRIG_SIZE 3 /* sizeof librpz_trig_t in bits */
	+typedef uint8_t librpz_tbit_t; /* one bit for each of the TRIGS_NUM
	+ * trigger types */
	+
	+
	+/*
	+ * Response Policy Zone Actions or policies
	+ */
	+typedef enum {
	+ LIBRPZ_POLICY_UNDEFINED =0, /* an empty entry or no decision yet */
	+ LIBRPZ_POLICY_DELETED =1, /* placeholder for a deleted policy */
	+
	+ LIBRPZ_POLICY_PASSTHRU =2, /* 'passthru': do not rewrite */
	+ LIBRPZ_POLICY_DROP =3, /* 'drop': do not respond */
	+ LIBRPZ_POLICY_TCP_ONLY =4, /* 'tcp-only': answer UDP with TC=1 */
	+ LIBRPZ_POLICY_NXDOMAIN =5, /* 'nxdomain': answer with NXDOMAIN */
	+ LIBRPZ_POLICY_NODATA =6, /* 'nodata': answer with ANCOUNT=0 */
	+ LIBRPZ_POLICY_RECORD =7, /* rewrite with the policy's RR */
	+
	+ /* only in client configurations to override the zone */
	+ LIBRPZ_POLICY_GIVEN, /* 'given': what policy record says */
	+ LIBRPZ_POLICY_DISABLED, /* at most log */
	+ LIBRPZ_POLICY_CNAME, /* answer with 'cname x' */
	+} librpz_policy_t;
	+#define LIBRPZ_POLICY_BITS 4
	+
	+/*
	+ * Special policies that appear as targets of CNAMEs
	+ * NXDOMAIN is signaled by a CNAME with a "." target.
	+ * NODATA is signaled by a CNAME with a "*." target.
	+ */
	+#define LIBRPZ_RPZ_PREFIX "rpz-"
	+#define LIBRPZ_RPZ_PASSTHRU LIBRPZ_RPZ_PREFIX"passthru"
	+#define LIBRPZ_RPZ_DROP LIBRPZ_RPZ_PREFIX"drop"
	+#define LIBRPZ_RPZ_TCP_ONLY LIBRPZ_RPZ_PREFIX"tcp-only"
	+
	+
	+typedef uint16_t librpz_dznum_t; /* dnsrpzd zone # in [0,DZNUM_MAX] */
	+typedef uint8_t librpz_cznum_t; /* client zone # in [0,CZNUM_MAX] */
	+
	+
	+/*
	+ * CIDR block
	+ */
	+typedef struct librpz_prefix {
	+ union {
	+ struct in_addr in;
	+ struct in6_addr in6;
	+ } addr;
	+ uint8_t family;
	+ uint8_t len;
	+} librpz_prefix_t;
	+
	+/*
	+ * A domain
	+ */
	+typedef uint8_t librpz_dsize_t;
	+typedef struct librpz_domain {
	+ librpz_dsize_t size; /* of only .d */
	+ uint8_t d[0]; /* variable length wire format */
	+} librpz_domain_t;
	+
	+/*
	+ * A maximal domain buffer
	+ */
	+typedef struct librpz_domain_buf {
	+ librpz_dsize_t size;
	+ uint8_t d[NS_MAXCDNAME];
	+} librpz_domain_buf_t;
	+
	+/*
	+ * A resource record without the owner name.
	+ * C compilers say that sizeof(librpz_rr_t)=12 instead of 10.
	+ */
	+typedef struct {
	+ uint16_t type; /* network byte order */
	+ uint16_t class; /* network byte order */
	+ uint32_t ttl; /* network byte order */
	+ uint16_t rdlength; /* network byte order */
	+ uint8_t rdata[0]; /* variable length */
	+} librpz_rr_t;
	+
	+/*
	+ * The database file might be mapped with different starting addresses
	+ * by concurrent clients (resolvers), and so all pointers are offsets.
	+ */
	+typedef uint32_t librpz_idx_t;
	+#define LIBRPZ_IDX_NULL 0
	+#define LIBRPZ_IDX_MIN 1
	+#define LIBRPZ_IDX_BAD ((librpz_idx_t)-1)
	+/**
	+ * Partial decoded results of a set of RPZ queries for a single DNS response
	+ * or interation through the mapped file.
	+ */
	+typedef int16_t librpz_result_id_t;
	+typedef struct librpz_result {
	+ librpz_idx_t next_rr;
	+ librpz_result_id_t hit_id; /* trigger ID from resolver */
	+ librpz_policy_t zpolicy; /* policy from zone */
	+ librpz_policy_t policy; /* adjusted by client configuration */
	+ librpz_dznum_t dznum; /* dnsrpzd zone number */
	+ librpz_cznum_t cznum; /* librpz client zone number */
	+ librpz_trig_t trig:LIBRPZ_TRIG_SIZE;
	+ bool log:1; /* log rewrite given librpz_log_level */
	+} librpz_result_t;
	+
	+
	+/**
	+ * librpz trace or log levels.
	+ */
	+typedef enum {
	+ LIBRPZ_LOG_FATAL =0, /* always print fatal errors */
	+ LIBRPZ_LOG_ERROR =1, /* errors have this level */
	+ LIBRPZ_LOG_TRACE1 =2, /* big events such as dnsrpzd starts */
	+ LIBRPZ_LOG_TRACE2 =3, /* smaller dnsrpzd zone transfers */
	+ LIBRPZ_LOG_TRACE3 =4, /* librpz hits */
	+ LIBRPZ_LOG_TRACE4 =5, /* librpz lookups */
	+ LIBRPZ_LOG_INVALID =999,
	+} librpz_log_level_t;
	+typedef librpz_log_level_t (librpz_log_level_val_t)(librpz_log_level_t level);
	+LIBDEF_F(log_level_val)
	+
	+/**
	+ * Logging function that can be supplied by the resolver.
	+ * @param level is one of librpz_log_level_t
	+ * @param ctx is for use by the resolver's logging system.
	+ * NULL mean a context-free message.
	+ */
	+typedef void(librpz_log_fnc_t)(librpz_log_level_t level, void *ctx,
	+ const char *buf);
	+
	+/**
	+ * Point librpz logging functions to the resolver's choice.
	+ */
	+typedef void (librpz_set_log_t)(librpz_log_fnc_t new_log, const char prog_nm);
	+LIBDEF_F(set_log)
	+
	+
	+/**
	+ * librpz error messages are put in these buffers.
	+ * Use a structure intead of naked char* to let the compiler check the length.
	+ * A function defined with "foo(char buf[120])" can be called with
	+ * "char sbuf[2]; foo(sbuf)" and suffer a buffer overrun.
	+ */
	+typedef struct {
	+ char c[120];
	+} librpz_emsg_t;
	+
	+
	+#ifdef LIBRPZ_HAVE_ATTR
	+#define LIBRPZ_UNUSED __attribute__((unused))
	+#define LIBRPZ_PF(f,l) __attribute__((format(printf,f,l)))
	+#define LIBRPZ_NORET __attribute__((__noreturn__))
	+#else
	+#define LIBRPZ_UNUSED
	+#define LIBRPZ_PF(f,l)
	+#define LIBRPZ_NORET
	+#endif
	+
	+#ifdef HAVE_BUILTIN_EXPECT
	+#define LIBRPZ_LIKELY(c) __builtin_expect(!!(c), 1)
	+#define LIBRPZ_UNLIKELY(c) __builtin_expect(!!(c), 0)
	+#else
	+#define LIBRPZ_LIKELY(c) (c)
	+#define LIBRPZ_UNLIKELY(c) (c)
	+#endif
	+
	+typedef bool (librpz_parse_log_opt_t)(librpz_emsg_t emsg, const char arg);
	+LIBDEF_F(parse_log_opt)
	+
	+typedef void (librpz_vpemsg_t)(librpz_emsg_t *emsg,
	+ const char *p, va_list args);
	+LIBDEF_F(vpemsg)
	+typedef void (librpz_pemsg_t)(librpz_emsg_t *emsg,
	+ const char *p, ...) LIBRPZ_PF(2,3);
	+LIBDEF_F(pemsg)
	+
	+typedef void (librpz_vlog_t)(librpz_log_level_t level, void *ctx,
	+ const char *p, va_list args);
	+LIBDEF_F(vlog)
	+typedef void (librpz_log_t)(librpz_log_level_t level, void *ctx,
	+ const char *p, ...) LIBRPZ_PF(3,4);
	+LIBDEF_F(log)
	+
	+typedef void (librpz_fatal_t)(int ex_code,
	+ const char *p, ...) LIBRPZ_PF(2,3);
	+extern void librpz_fatal(int ex_code,
	+ const char *p, ...) LIBRPZ_PF(2,3) LIBRPZ_NORET;
	+
	+typedef void (librpz_rpz_assert_t)(const char *file, unsigned line,
	+ const char *p, ...) LIBRPZ_PF(3,4);
	+extern void librpz_rpz_assert(const char *file, unsigned line,
	+ const char *p, ...) LIBRPZ_PF(3,4) LIBRPZ_NORET;
	+
	+typedef void (librpz_rpz_vassert_t)(const char *file, uint line,
	+ const char *p, va_list args);
	+extern void librpz_rpz_vassert(const char *file, uint line,
	+ const char *p, va_list args) LIBRPZ_NORET;
	+
	+
	+/*
	+ * As far as clients are concerned, all relative pointers or indexes in a
	+ * version of the mapped file except trie node parent pointers remain valid
	+ * forever. A client must release a version so that it can be garbage
	+ * collected by the file system. When dnsrpzd needs to expand the file,
	+ * it copies the old file to a new, larger file. Clients can continue
	+ * using the old file.
	+ *
	+ * Versions can also appear in a single file. Old nodes and trie values
	+ * within the file are not destroyed until all clients using the version
	+ * that contained the old values release the version.
	+ *
	+ * A client is marked as using version by connecting to the deamon. It is
	+ * marked as using all subsequent versions. A client releases all versions
	+ * by closing the connection or a range of versions by updating is slot
	+ * in the shared memory version table.
	+ *
	+ * As far as clients are concerned, there are the following possible librpz
	+ * failures:
	+ * - malloc() or other fatal internal librpz problems indicated by
	+ * a failing return from a librpz function
	+ * All operations will fail until client handle is destroyed and
	+ * recreated with librpz_client_detach() and librpz_client_create().
	+ * - corrupt database detected by librpz code, corrupt database detected
	+ * by dnsrpzd, or disconnection from the daemon.
	+ * Current operations will fail.
	+ *
	+ * Clients assume that the file has already been unlinked before
	+ * the corrupt flag is set so that they do not race with the server
	+ * over the corruption of a single file. A client that finds the
	+ * corrupt set knows that dnsrpzd has already crashed with
	+ * abort() and is restarting. The client can re-connect to dnsrpzd
	+ * and retransmit its configuration, backing off as usual if anything
	+ * goes wrong.
	+ *
	+ * Searchs of the database by a client do not need locks against dnsrpzd or
	+ * other clients, but a lock is used to protect changes to the connection
	+ * by competing threads in the client. The client provides fuctions
	+ * to serialize the conncurrent use of any single client handle.
	+ * Functions that do nothing are appropriate for applications that are
	+ * not "threaded" or that do not share client handles among threads.
	+ * Otherwise, functions must be provided to librpz_clientcreate().
	+ * Something like the following works with pthreads:
	+ *
	+ * static void
	+ * lock(void *mutex) { assert(pthread_mutex_lock(mutex) == 0); }
	+ *
	+ * static void
	+ * unlock(void *mutex) { assert(pthread_mutex_unlock(mutex) == 0); }
	+ *
	+ * static void
	+ * mutex_destroy(void *mutex) { assert(pthread_mutex_destroy(mutex) == 0); }
	+ *
	+ *
	+ *
	+ * At every instant, all of the data and pointers in the mapped file are valid.
	+ * Changes to trie node or other data are always made so that it and
	+ * all pointers in and to it remain valid for a time. Old versions are
	+ * eventually discarded.
	+ *
	+ * Dnsrpzd periodically defines a new version by setting asside all changes
	+ * made since the previous version was defined. Subsequent changes
	+ * made (only!) by dnsrpzd will be part of the next version.
	+ *
	+ * To discard an old version, dnsrpzd must know that all clients have stopped
	+ * using that version. Clients do that by using part of the mapped file
	+ * to tell dnsrpzd the oldest version that each client is using.
	+ * Dnsrpzd assigns each connecting client an entry in the cversions array
	+ * in the mapped file. The client puts version numbers into that entry
	+ * to signal to dnsrpzd which versions that can be discarded.
	+ * Dnsrpzd is free, as far as that client is concerned, to discard all
	+ * numerically smaller versions. A client can disclaim all versions with
	+ * the version number VERSIONS_ALL or 0.
	+ *
	+ * The race between a client changing its entry and dnsrpzd discarding a
	+ * version is resolved by allowing dnsrpzd to discard all versions
	+ * smaller or equal to the client's version number. If dnsrpzd is in
	+ * the midst of discarding or about to discard version N when the
	+ * client asserts N, no harm is done. The client depends only on
	+ * the consistency of version N+1.
	+ *
	+ * This version mechanism depends in part on not being exercised too frequently
	+ * Version numbers are 32 bits long and dnsrpzd creates new versions
	+ * at most once every 30 seconds.
	+ */
	+
	+
	+/*
	+ * Lock functions for concurrent use of a single librpz_client_t client handle.
	+ */
	+typedef void(librpz_mutex_t)(void *mutex);
	+
	+/*
	+ * List of connections to dnsrpzd daemons.
	+ */
	+typedef struct librpz_clist librpz_clist_t;
	+
	+/*
	+ * Client's handle on dnsrpzd.
	+ */
	+typedef struct librpz_client librpz_client_t;
	+
	+/**
	+ * Create the list of connections to the dnsrpzd daemon.
	+ * @param[out] emsg: error message
	+ * @param lock: start exclusive access to the client handle
	+ * @param unlock: end exclusive access to the client handle
	+ * @param mutex_destroy: release the lock
	+ * @param mutex: pointer to the lock for the client handle
	+ * @param log_ctx: NULL or resolver's context log messages
	+ */
	+typedef librpz_clist_t (librpz_clist_create_t)(librpz_emsg_t emsg,
	+ librpz_mutex_t *lock,
	+ librpz_mutex_t *unlock,
	+ librpz_mutex_t *mutex_destroy,
	+ void mutex, void log_ctx);
	+LIBDEF_F(clist_create)
	+
	+
	+/**
	+ * Release the list of dnsrpzd connections.
	+ */
	+typedef void (librpz_clist_detach_t)(librpz_clist_t **clistp);
	+LIBDEF_F(clist_detach)
	+
	+/**
	+ * Create a librpz client handle.
	+ * @param[out] emsg: error message
	+ * @param: list of dnsrpzd connections
	+ * @param cstr: string of configuration settings separated by ';' or '\n'
	+ * @param use_expired: true to not ignore expired zones
	+ * @return client handle or NULL if the handle could not be created
	+ */
	+typedef librpz_client_t (librpz_client_create_t)(librpz_emsg_t emsg,
	+ librpz_clist_t *clist,
	+ const char *cstr,
	+ bool use_expired);
	+LIBDEF_F(client_create)
	+
	+/**
	+ * Start (if necessary) dnsrpzd and connect to it.
	+ * @param[out] emsg: error message
	+ * @param client handle
	+ * @param optional: true if it is ok if starting the daemon is not allowed
	+ */
	+typedef bool (librpz_connect_t)(librpz_emsg_t emsg, librpz_client_t client,
	+ bool optional);
	+LIBDEF_F(connect)
	+
	+/**
	+ * Start to destroy a librpz client handle.
	+ * It will not be destroyed until the last set of RPZ queries represented
	+ * by a librpz_rsp_t ends.
	+ * @param client handle to be released
	+ * @return false on error
	+ */
	+typedef void (librpz_client_detach_t)(librpz_client_t **clientp);
	+LIBDEF_F(client_detach)
	+
	+/**
	+ * State for a set of RPZ queries for a single DNS response
	+ * or for listing the database.
	+ */
	+typedef struct librpz_rsp librpz_rsp_t;
	+
	+/**
	+ * Start a set of RPZ queries for a single DNS response.
	+ * @param[out] emsg: error message for false return or *rspp=NULL
	+ * @param[out] rspp created context or NULL
	+ * @param[out] min_ns_dotsp: NULL or pointer to configured MIN-NS-DOTS value
	+ * @param client state
	+ * @param have_rd: RD=1 in the DNS request
	+ * @param have_do: DO=1 in the DNS request
	+ * @return false on error
	+ */
	+typedef bool (librpz_rsp_create_t)(librpz_emsg_t emsg, librpz_rsp_t *rspp,
	+ int min_ns_dotsp, librpz_client_t client,
	+ bool have_rd, bool have_do);
	+LIBDEF_F(rsp_create)
	+
	+/**
	+ * Finish RPZ work for a DNS response.
	+ */
	+typedef void (librpz_rsp_detach_t)(librpz_rsp_t **rspp);
	+LIBDEF_F(rsp_detach)
	+
	+/**
	+ * Get the final, accumulated result of a set of RPZ queries.
	+ * Yield LIBRPZ_POLICY_UNDEFINED if
	+ * - there were no hits,
	+ * - there was a dispositive hit, be we have not recursed and are required
	+ * to recurse so that evil DNS authories will not know we are using RPZ
	+ * - we have a hit and have recursed, but later data such as NSIP could
	+ * override
	+ * @param[out] emsg
	+ * @param[out] result describes the hit
	+ * or result->policy=LIBRPZ_POLICY_UNDEFINED without a hit
	+ * @param[out] result: current policy rewrite values
	+ * @param recursed: recursion has now been done even if it was not done
	+ * when the hit was found
	+ * @param[in,out] rsp state from librpz_itr_start()
	+ * @return false on error
	+ */
	+typedef bool (librpz_rsp_result_t)(librpz_emsg_t emsg, librpz_result_t result,
	+ bool recursed, const librpz_rsp_t *rsp);
	+LIBDEF_F(rsp_result)
	+
	+/**
	+ * Might looking for a trigger be worthwhile?
	+ * @param trig: look for this type of trigger
	+ * @param ipv6: true if trig is LIBRPZ_TRIG_CLIENT_IP, LIBRPZ_TRIG_IP,
	+ * or LIBRPZ_TRIG_NSIP and the IP address is IPv6
	+ * @return: true if looking could be worthwhile
	+ */
	+typedef bool (librpz_have_trig_t)(librpz_trig_t trig, bool ipv6,
	+ const librpz_rsp_t *rsp);
	+LIBDEF_F(have_trig)
	+
	+/**
	+ * Might looking for NSDNAME and NSIP triggers be worthwhile?
	+ * @return: true if looking could be worthwhile
	+ */
	+typedef bool (librpz_have_ns_trig_t)(const librpz_rsp_t *rsp);
	+LIBDEF_F(have_ns_trig)
	+
	+/**
	+ * Convert the found client IP trie key to a CIDR block
	+ * @param[out] emsg
	+ * @param[out] prefix trigger
	+ * @param[in,out] rsp state from librpz_itr_start()
	+ * @return false on error
	+ */
	+typedef bool (librpz_rsp_clientip_prefix_t)(librpz_emsg_t *emsg,
	+ librpz_prefix_t *prefix,
	+ librpz_rsp_t *rsp);
	+LIBDEF_F(rsp_clientip_prefix)
	+
	+/**
	+ * Compute the owner name of the found or result trie key, usually to log it.
	+ * An IP address key might be returned as 8.0.0.0.127.rpz-client-ip.
	+ * example.com. might be a qname trigger. example.com.rpz-nsdname. could
	+ * be an NSDNAME trigger.
	+ * @param[out] emsg
	+ * @param[out] owner domain
	+ * @param[in,out] rsp state from librpz_itr_start()
	+ * @return false on error
	+ */
	+typedef bool (librpz_rsp_domain_t)(librpz_emsg_t *emsg,
	+ librpz_domain_buf_t *owner,
	+ librpz_rsp_t *rsp);
	+LIBDEF_F(rsp_domain)
	+
	+/**
	+ * Get the next RR of the LIBRPZ_POLICY_RECORD result after an initial use of
	+ * librpz_rsp_result() or librpz_itr_node() or after a previous use of
	+ * librpz_rsp_rr(). The RR is in uncompressed wire format including type,
	+ * class, ttl and length in network byte order.
	+ * @param[out] emsg
	+ * @param[out] typep: optional host byte order record type or ns_t_invalid (0)
	+ * @param[out] classp: class such as ns_c_in
	+ * @param[out] ttlp: TTL
	+ * @param[out] rrp: optionall malloc() buffer containting the next RR or
	+ * NULL after the last RR
	+ * @param[out] result: current policy rewrite values
	+ * @param qname: used construct a wildcard CNAME
	+ * @param qname_size
	+ * @param[in,out] rsp state from librpz_itr_start()
	+ * @return false on error
	+ */
	+typedef bool (librpz_rsp_rr_t)(librpz_emsg_t emsg, uint16_t typep,
	+ uint16_t classp, uint32_t ttlp,
	+ librpz_rr_t *rrp, librpz_result_t result,
	+ const uint8_t *qname, size_t qname_size,
	+ librpz_rsp_t *rsp);
	+LIBDEF_F(rsp_rr)
	+
	+/**
	+ * Get the next RR of the LIBRPZ_POLICY_RECORD result.
	+ * @param[out] emsg
	+ * @param[out] ttlp: TTL
	+ * @param[out] rrp: malloc() buffer with SOA RR without owner name
	+ * @param[out] result: current policy rewrite values
	+ * @param[out] origin: SOA owner name
	+ * @param[out] origin_size
	+ * @param[in,out] rsp state from librpz_itr_start()
	+ * @return false on error
	+ */
	+typedef bool (librpz_rsp_soa_t)(librpz_emsg_t emsg, uint32_t ttlp,
	+ librpz_rr_t *rrp, librpz_domain_buf_t origin,
	+ librpz_result_t result, librpz_rsp_t rsp);
	+LIBDEF_F(rsp_soa)
	+
	+/**
	+ * Get the SOA serial number for a policy zone to compare with a known value
	+ * to check whether a zone tranfer is complete.
	+ */
	+typedef bool (librpz_soa_serial_t)(librpz_emsg_t emsg, uint32_t serialp,
	+ const char domain_nm, librpz_rsp_t rsp);
	+LIBDEF_F(soa_serial)
	+
	+/**
	+ * Save the current policy checking state.
	+ * @param[out] emsg
	+ * @param[in,out] rsp state from librpz_itr_start()
	+ * @return false on error
	+ */
	+typedef bool (librpz_rsp_push_t)(librpz_emsg_t emsg, librpz_rsp_t rsp);
	+LIBDEF_F(rsp_push)
	+#define LIBRPZ_RSP_STACK_DEPTH 3
	+
	+/**
	+ * Restore the previous policy checking state.
	+ * @param[out] emsg
	+ * @param[out] result: NULL or restored policy rewrite values
	+ * @param[in,out] rsp state from librpz_itr_start()
	+ * @return false on error
	+ */
	+typedef bool (librpz_rsp_pop_t)(librpz_emsg_t emsg, librpz_result_t result,
	+ librpz_rsp_t *rsp);
	+LIBDEF_F(rsp_pop)
	+
	+/**
	+ * Discard the most recently save policy checking state.
	+ * @param[out] emsg
	+ * @param[out] result: NULL or restored policy rewrite values
	+ * @return false on error
	+ */
	+typedef bool (librpz_rsp_pop_discard_t)(librpz_emsg_t emsg, librpz_rsp_t rsp);
	+LIBDEF_F(rsp_pop_discard)
	+
	+/**
	+ * Disable a zone.
	+ * @param[out] emsg
	+ * @param znum
	+ * @param[in,out] rsp state from librpz_itr_start()
	+ * @return false on error
	+ */
	+typedef bool (librpz_rsp_forget_zone_t)(librpz_emsg_t *emsg,
	+ librpz_cznum_t znum, librpz_rsp_t *rsp);
	+LIBDEF_F(rsp_forget_zone)
	+
	+/**
	+ * Apply RPZ to an IP address.
	+ * @param[out] emsg
	+ * @param addr: address to check
	+ * @param ipv6: true for 16 byte IPv6 instead of 4 byte IPv4
	+ * @param trig LIBRPZ_TRIG_CLIENT_IP, LIBRPZ_TRIG_IP, or LIBRPZ_TRIG_NSIP
	+ * @param hit_id: caller chosen
	+ * @param recursed: recursion has been done
	+ * @param[in,out] rsp state from librpz_itr_start()
	+ * @return false on error
	+ */
	+typedef bool (librpz_ck_ip_t)(librpz_emsg_t *emsg,
	+ const void *addr, uint family,
	+ librpz_trig_t trig, librpz_result_id_t hit_id,
	+ bool recursed, librpz_rsp_t *rsp);
	+LIBDEF_F(ck_ip)
	+
	+/**
	+ * Apply RPZ to a wire-format domain.
	+ * @param[out] emsg
	+ * @param domain in wire format
	+ * @param domain_size
	+ * @param trig LIBRPZ_TRIG_QNAME or LIBRPZ_TRIG_NSDNAME
	+ * @param hit_id: caller chosen
	+ * @param recursed: recursion has been done
	+ * @param[in,out] rsp state from librpz_itr_start()
	+ * @return false on error
	+ */
	+typedef bool (librpz_ck_domain_t)(librpz_emsg_t *emsg,
	+ const uint8_t *domain, size_t domain_size,
	+ librpz_trig_t trig, librpz_result_id_t hit_id,
	+ bool recursed, librpz_rsp_t *rsp);
	+LIBDEF_F(ck_domain)
	+
	+/**
	+ * Ask dnsrpzd to refresh a zone.
	+ * @param[out] emsg error message
	+ * @param librpz_domain_t domain to refresh
	+ * @param client context
	+ * @return false after error
	+ */
	+typedef bool (librpz_zone_refresh_t)(librpz_emsg_t emsg, const char domain,
	+ librpz_rsp_t *rsp);
	+LIBDEF_F(zone_refresh)
	+
	+/**
	+ * Get a string describing the the databasse
	+ * @param license: include the license
	+ * @param cfiles: include the configuration file names
	+ * @param listens: include the local notify IP addresses
	+ * @param[out] emsg error message if the result is null
	+ * @param client context
	+ * @return malloc'ed string or NULL after error
	+ */
	+typedef char (librpz_db_info_t)(librpz_emsg_t emsg,
	+ bool license, bool cfiles, bool listens,
	+ librpz_rsp_t *rsp);
	+LIBDEF_F(db_info)
	+
	+/**
	+ * Start a context for listing the nodes and/or zones in the mapped file
	+ * @param[out] emsg: error message for false return or *rspp=NULL
	+ * @param[out[ rspp created context or NULL
	+ * @param client context
	+ * @return false after error
	+ */
	+typedef bool (librpz_itr_start_t)(librpz_emsg_t emsg, librpz_rsp_t *rspp,
	+ librpz_client_t *client);
	+LIBDEF_F(itr_start)
	+
	+/**
	+ * Get mapped file memory allocation statistics.
	+ * @param[out] emsg: error message
	+ * @param rsp state from librpz_itr_start()
	+ * @return malloc'ed string or NULL after error
	+ */
	+typedef char (librpz_mf_stats_t)(librpz_emsg_t emsg, librpz_rsp_t *rsp);
	+LIBDEF_F(mf_stats)
	+
	+/**
	+ * Get versions currently used by clients.
	+ * @param[out] emsg: error message
	+ * @param[in,out] rsp: state from librpz_itr_start()
	+ * @return malloc'ed string or NULL after error
	+ */
	+typedef char (librpz_vers_stats_t)(librpz_emsg_t emsg, librpz_rsp_t *rsp);
	+LIBDEF_F(vers_stats)
	+
	+/**
	+ * Allocate a string describing the next zone or "" after the last zone.
	+ * @param[out] emsg
	+ * @param all_zones to list all instead of only requested zones
	+ * @param[in,out] rsp state from librpz_rsp_start()
	+ * @return malloc'ed string or NULL after error
	+ */
	+typedef char (librpz_itr_zone_t)(librpz_emsg_t emsg, bool all_zones,
	+ librpz_rsp_t *rsp);
	+LIBDEF_F(itr_zone)
	+
	+/**
	+ * Describe the next trie node while dumping the database.
	+ * @param[out] emsg
	+ * @param[out] result describes node
	+ * or result->policy=LIBRPZ_POLICY_UNDEFINED after the last node.
	+ * @param all_zones to list all instead of only requested zones
	+ * @param[in,out] rsp state from librpz_itr_start()
	+ * @return: false on error
	+ */
	+typedef bool (librpz_itr_node_t)(librpz_emsg_t emsg, librpz_result_t result,
	+ bool all_zones, librpz_rsp_t *rsp);
	+LIBDEF_F(itr_node)
	+
	+/**
	+ * RPZ policy to string with a backup buffer of POLICY2STR_SIZE size
	+ */
	+typedef const char *(librpz_policy2str_t)(librpz_policy_t policy,
	+ char *buf, size_t buf_size);
	+#define POLICY2STR_SIZE sizeof("policy xxxxxx")
	+LIBDEF_F(policy2str)
	+
	+/**
	+ * Trigger type to string.
	+ */
	+typedef const char *(librpz_trig2str_t)(librpz_trig_t trig);
	+LIBDEF_F(trig2str)
	+
	+/**
	+ * Convert a number of seconds to a zone file duration string
	+ */
	+typedef const char *(librpz_secs2str_t)(time_t secs,
	+ char *buf, size_t buf_size);
	+#define SECS2STR_SIZE sizeof("1234567w7d24h59m59s")
	+LIBDEF_F(secs2str)
	+
	+/**
	+ * Parse a duration with 's', 'm', 'h', 'd', and 'w' units.
	+ */
	+typedef bool (librpz_str2secs_t)(librpz_emsg_t emsg, time_t val,
	+ const char *str0);
	+LIBDEF_F(str2secs)
	+
	+/**
	+ * Translate selected rtypes to strings
	+ */
	+typedef const char (librpz_rtype2str_t)(uint type, char buf, size_t buf_size);
	+#define RTYPE2STR_SIZE sizeof("type xxxxx")
	+LIBDEF_F(rtype2str)
	+
	+/**
	+ * Local version of ns_name_ntop() for portability.
	+ */
	+typedef int (librpz_domain_ntop_t)(const u_char src, char dst, size_t dstsiz);
	+LIBDEF_F(domain_ntop)
	+
	+/**
	+ * Local version of ns_name_pton().
	+ */
	+typedef int (librpz_domain_pton2_t)(const char src, u_char dst, size_t dstsiz,
	+ size_t *dstlen, bool lower);
	+LIBDEF_F(domain_pton2)
	+
	+typedef union socku socku_t;
	+typedef socku_t (librpz_mk_inet_su_t)(socku_t su, const struct in_addr *addrp,
	+ in_port_t port);
	+LIBDEF_F(mk_inet_su)
	+
	+typedef socku_t (librpz_mk_inet6_su_t)(socku_t su, const
	+ struct in6_addr *addrp,
	+ uint32_t scope_id, in_port_t port);
	+LIBDEF_F(mk_inet6_su)
	+
	+typedef bool (librpz_str2su_t)(socku_t sup, const char str);
	+LIBDEF_F(str2su)
	+
	+typedef char (librpz_su2str_t)(char str, size_t str_len, const socku_t *su);
	+LIBDEF_F(su2str)
	+#define SU2STR_SIZE (INET6_ADDRSTRLEN+1+6+1)
	+
	+
	+/**
	+ * default path to dnsrpzd
	+ */
	+const char *librpz_dnsrpzd_path;
	+
	+
	+#undef LIBDEF
	+
	+/*
	+ * This is the dlopen() interface to librpz.
	+ */
	+typedef const struct {
	+ const char *dnsrpzd_path;
	+ const char *version;
	+ librpz_parse_log_opt_t *parse_log_opt;
	+ librpz_log_level_val_t *log_level_val;
	+ librpz_set_log_t *set_log;
	+ librpz_vpemsg_t *vpemsg;
	+ librpz_pemsg_t *pemsg;
	+ librpz_vlog_t *vlog;
	+ librpz_log_t *log;
	+ librpz_fatal_t *fatal LIBRPZ_NORET;
	+ librpz_rpz_assert_t *rpz_assert LIBRPZ_NORET;
	+ librpz_rpz_vassert_t *rpz_vassert LIBRPZ_NORET;
	+ librpz_clist_create_t *clist_create;
	+ librpz_clist_detach_t *clist_detach;
	+ librpz_client_create_t *client_create;
	+ librpz_connect_t *connect;
	+ librpz_client_detach_t *client_detach;
	+ librpz_rsp_create_t *rsp_create;
	+ librpz_rsp_detach_t *rsp_detach;
	+ librpz_rsp_result_t *rsp_result;
	+ librpz_have_trig_t *have_trig;
	+ librpz_have_ns_trig_t *have_ns_trig;
	+ librpz_rsp_clientip_prefix_t *rsp_clientip_prefix;
	+ librpz_rsp_domain_t *rsp_domain;
	+ librpz_rsp_rr_t *rsp_rr;
	+ librpz_rsp_soa_t *rsp_soa;
	+ librpz_soa_serial_t *soa_serial;
	+ librpz_rsp_push_t *rsp_push;
	+ librpz_rsp_pop_t *rsp_pop;
	+ librpz_rsp_pop_discard_t *rsp_pop_discard;
	+ librpz_rsp_forget_zone_t *rsp_forget_zone;
	+ librpz_ck_ip_t *ck_ip;
	+ librpz_ck_domain_t *ck_domain;
	+ librpz_zone_refresh_t *zone_refresh;
	+ librpz_db_info_t *db_info;
	+ librpz_itr_start_t *itr_start;
	+ librpz_mf_stats_t *mf_stats;
	+ librpz_vers_stats_t *vers_stats;
	+ librpz_itr_zone_t *itr_zone;
	+ librpz_itr_node_t *itr_node;
	+ librpz_policy2str_t *policy2str;
	+ librpz_trig2str_t *trig2str;
	+ librpz_secs2str_t *secs2str;
	+ librpz_str2secs_t *str2secs;
	+ librpz_rtype2str_t *rtype2str;
	+ librpz_domain_ntop_t *domain_ntop;
	+ librpz_domain_pton2_t *domain_pton2;
	+ librpz_mk_inet_su_t *mk_inet_su;
	+ librpz_mk_inet6_su_t *mk_inet6_su;
	+ librpz_str2su_t *str2su;
	+ librpz_su2str_t *su2str;
	+} librpz_0_t;
	+extern librpz_0_t librpz_def_0;
	+
	+/*
	+ * Future versions can be upward compatible by defining LIBRPZ_DEF as
	+ * librpz_X_t.
	+ */
	+#define LIBRPZ_DEF librpz_def_0
	+#define LIBRPZ_DEF_STR "librpz_def_0"
	+
	+typedef librpz_0_t librpz_t;
	+extern librpz_t *librpz;
	+
	+
	+#if LIBRPZ_LIB_OPEN == 2
	+#include <dlfcn.h>
	+
	+/**
	+ * link-load librpz
	+ * @param[out] emsg: error message
	+ * @param[in,out] dl_handle: NULL or pointer to new dlopen handle
	+ * @param[in] path: librpz.so path
	+ * @return address of interface structure or NULL on failure
	+ */
	+static inline librpz_t *
	+librpz_lib_open(librpz_emsg_t emsg, void dl_handle, const char path)
	+{
	+ void *handle;
	+ librpz_t *new_librpz;
	+
	+ emsg->c[0] = '\0';
	+
	+ /*
	+ * Close a previously opened handle on librpz.so.
	+ */
	+ if (dl_handle != NULL && *dl_handle != NULL) {
	+ if (dlclose(*dl_handle) != 0) {
	+ snprintf(emsg->c, sizeof(librpz_emsg_t),
	+ "dlopen(NULL): %s", dlerror());
	+ return (NULL);
	+ }
	+ *dl_handle = NULL;
	+ }
	+
	+ /*
	+ * First try the main executable of the process in case it was
	+ * linked to librpz.
	+ * Do not worry if we cannot search the main executable of the process.
	+ */
	+ handle = dlopen(NULL, RTLD_NOW \| RTLD_LOCAL);
	+ if (handle != NULL) {
	+ new_librpz = dlsym(handle, LIBRPZ_DEF_STR);
	+ if (new_librpz != NULL) {
	+ if (dl_handle != NULL)
	+ *dl_handle = handle;
	+ return (new_librpz);
	+ }
	+ if (dlclose(handle) != 0) {
	+ snprintf(emsg->c, sizeof(librpz_emsg_t),
	+ "dlsym(NULL, "LIBRPZ_DEF_STR"): %s",
	+ dlerror());
	+ return (NULL);
	+ }
	+ }
	+
	+ if (path == NULL \|\| path[0] == '\0') {
	+ snprintf(emsg->c, sizeof(librpz_emsg_t),
	+ "librpz not linked and no dlopen() path provided");
	+ return (NULL);
	+ }
	+
	+ handle = dlopen(path, RTLD_NOW \| RTLD_LOCAL);
	+ if (handle == NULL) {
	+ snprintf(emsg->c, sizeof(librpz_emsg_t), "dlopen(%s): %s",
	+ path, dlerror());
	+ return (NULL);
	+ }
	+ new_librpz = dlsym(handle, LIBRPZ_DEF_STR);
	+ if (new_librpz != NULL) {
	+ if (dl_handle != NULL)
	+ *dl_handle = handle;
	+ return (new_librpz);
	+ }
	+ snprintf(emsg->c, sizeof(librpz_emsg_t),
	+ "dlsym(%s, "LIBRPZ_DEF_STR"): %s",
	+ path, dlerror());
	+ dlclose(handle);
	+ return (NULL);
	+}
	+
	+#elif defined(LIBRPZ_LIB_OPEN)
	+
	+/*
	+ * Statically link to the librpz.so DSO on systems without dlopen()
	+ */
	+static inline librpz_t *
	+librpz_lib_open(librpz_emsg_t emsg, void dl_handle, const char path)
	+{
	+ (void)(path);
	+
	+ if (dl_handle != NULL)
	+ *dl_handle = NULL;
	+
	+#if LIBRPZ_LIB_OPEN == 1
	+ emsg->c[0] = '\0';
	+ return (&LIBRPZ_DEF);
	+#else
	+ snprintf(emsg->c, sizeof(librpz_emsg_t),
	+ "librpz not available via ./configure");
	+ return (NULL);
	+#endif /* LIBRPZ_LIB_OPEN */
	+}
	+#endif /* LIBRPZ_LIB_OPEN */
	+
	+#endif /* LIBRPZ_H */
	-Index: unboundfastrpz/fastrpz/rpz.c
	-===================================================================
	---- unboundfastrpz/fastrpz/rpz.c (nonexistent)
	-+++ unboundfastrpz/fastrpz/rpz.c (working copy)
	+diff --git a/fastrpz/rpz.c b/fastrpz/rpz.c
	+new file mode 100644
	+index 0000000..c5ab780
	+--- /dev/null
	++++ b/fastrpz/rpz.c
	@@ -0,0 +1,1352 @@
	+/*
	+ * fastrpz/rpz.c - interface to the fastrpz response policy zone library
	+ *
	+ * Optimize no-rewrite cases for speed but optimize rewriting for
	+ * simplicity and size.
	+ */
	+
	+#include "config.h"
	+
	+#ifdef ENABLE_FASTRPZ
	+#include "daemon/daemon.h"
	+#define LIBRPZ_LIB_OPEN FASTRPZ_LIB_OPEN
	+#include "fastrpz/rpz.h"
	+#include "daemon/worker.h"
	+#include "iterator/iter_delegpt.h"
	+#include "iterator/iter_utils.h"
	+#include "iterator/iterator.h"
	+#include "util/data/dname.h"
	+#include "util/data/msgencode.h"
	+#include "util/data/msgparse.h"
	+#include "util/data/msgreply.h"
	+#include "util/log.h"
	+#include "util/netevent.h"
	+#include "util/net_help.h"
	+#include "util/regional.h"
	+#include "util/storage/slabhash.h"
	+#include "services/cache/dns.h"
	+#include "services/cache/rrset.h"
	+#include "services/mesh.h"
	+#include "sldns/sbuffer.h"
	+#include "sldns/rrdef.h"
	+
	+
	+typedef enum state {
	+ /* No more rewriting */
	+ st_off = 1,
	+ /* Send SERVFAIL */
	+ st_servfail,
	+ /* No dispositive hit yet */
	+ st_unknown,
	+ /* Let the iterator resolve a CNAME or get a delegation point. */
	+ st_iterate,
	+ /* Let the iterator resolve NS to check NSIP or NSDNAME triggers. */
	+ st_ck_ns,
	+ /* We have an answer */
	+ st_rewritten,
	+} st_t;
	+
	+
	+/* RPZ state pointed to by struct comm_reply */
	+typedef struct commreply_rpz {
	+ /* librpz state */
	+ librpz_rsp_t* rsp;
	+ /* ID for log messages */
	+ int log_id;
	+
	+ /* from configuration */
	+ int min_ns_dots;
	+
	+ /* Running in the iterator */
	+ bool iterating;
	+
	+ /* current and previous state and librpz result */
	+ st_t st;
	+ st_t saved_st[LIBRPZ_RSP_STACK_DEPTH-1];
	+ librpz_result_t result;
	+
	+ /* Stop adding CNAMEs to the prepend list before this owner name. */
	+ librpz_domain_buf_t cname_hit;
	+ /* It is not the first CNAME */
	+ bool cname_hit_2nd;
	+ librpz_result_id_t hit_id;
	+} commreply_rpz_t;
	+
	+
	+/* Generate an ID for log messages. */
	+static int log_id;
	+
	+librpz_t *librpz;
	+
	+
	+static void LIBRPZ_NORET
	+rpz_assert(const char *s)
	+{
	+ fatal_exit("%s", s);
	+ exit(1);
	+}
	+#define RPZ_ASSERT(c) ((c) ? (void)0 : rpz_assert(#c), (void)0)
	+
	+/*
	+ * librpz client handle locking
	+ */
	+static void
	+lock_destroy(void* mutex)
	+{
	+ lock_basic_destroy(mutex);
	+ free(mutex);
	+}
	+
	+static void
	+lock(void* mutex)
	+{
	+ lock_basic_lock(mutex);
	+}
	+
	+static void
	+unlock(void* mutex)
	+{
	+ lock_basic_unlock(mutex);
	+}
	+
	+
	+static void
	+log_fnc(librpz_log_level_t level, void* ATTR_UNUSED(ctx), const char* buf)
	+{
	+ /* Setting librpz_log_level overrides the unbound "verbose" level. */
	+ if(level > LIBRPZ_LOG_TRACE1 &&
	+ level <= librpz->log_level_val(LIBRPZ_LOG_INVALID))
	+ level = LIBRPZ_LOG_TRACE1;
	+
	+ switch(level) {
	+ case LIBRPZ_LOG_FATAL:
	+ case LIBRPZ_LOG_ERROR: /* errors */
	+ default:
	+ log_err("rpz: %s", buf);
	+ break;
	+
	+ case LIBRPZ_LOG_TRACE1: /* big events such as dnsrpzd starts */
	+ verbose(VERB_OPS, "rpz: %s", buf);
	+ break;
	+
	+ case LIBRPZ_LOG_TRACE2: /* smaller dnsrpzd zone transfers */
	+ verbose(VERB_DETAIL, "rpz: %s", buf);
	+ break;
	+
	+ case LIBRPZ_LOG_TRACE3: /* librpz hits */
	+ verbose(VERB_QUERY, "rpz: %s", buf);
	+ break;
	+
	+ case LIBRPZ_LOG_TRACE4: /* librpz lookups */
	+ verbose(VERB_CLIENT, "rpz: %s", buf);
	+ break;
	+ }
	+}
	+
	+
	+/* Release the librpz version. */
	+static void
	+rpz_off(commreply_rpz_t* rpz, st_t st)
	+{
	+ if(!rpz)
	+ return;
	+ rpz->st = st;
	+ librpz->rsp_detach(&rpz->rsp);
	+}
	+
	+
	+static void LIBRPZ_PF(2,3)
	+log_fail(commreply_rpz_t* rpz, const char* p, ...)
	+{
	+ va_list args;
	+
	+ if(rpz->st == st_servfail)
	+ return;
	+
	+ va_start(args, p);
	+ librpz->vlog(LIBRPZ_LOG_ERROR, rpz, p, args);
	+ va_end(args);
	+ if(!rpz)
	+ return;
	+ rpz_off(rpz, st_servfail);
	+}
	+
	+
	+/* Announce a rewrite. */
	+static void
	+log_rewrite(uint8_t* qname, librpz_policy_t policy, const char* msg,
	+ commreply_rpz_t* rpz)
	+{
	+ char policy_buf[POLICY2STR_SIZE];
	+ char qname_nm[LDNS_MAX_DOMAINLEN+1];
	+ librpz_domain_buf_t tdomain;
	+ char tdomain_nm[LDNS_MAX_DOMAINLEN+1];
	+ librpz_emsg_t emsg;
	+
	+ if(rpz->st == st_servfail \|\| !rpz->result.log)
	+ return;
	+ if(librpz->log_level_val(LIBRPZ_LOG_INVALID) < LIBRPZ_LOG_TRACE1)
	+ return;
	+
	+ dname_str(qname, qname_nm);
	+
	+ if(!librpz->rsp_domain(&emsg, &tdomain, rpz->rsp)) {
	+ librpz->log(LIBRPZ_LOG_ERROR, rpz, "%s", emsg.c);
	+ return;
	+ }
	+ dname_str(tdomain.d, tdomain_nm);
	+
	+ librpz->log(LIBRPZ_LOG_TRACE3, rpz, "%srewriting %s via %s %s to %s",
	+ msg, qname_nm, tdomain_nm,
	+ librpz->trig2str(rpz->result.trig),
	+ librpz->policy2str(policy, policy_buf,
	+ sizeof(policy_buf)));
	+}
	+
	+
	+/* Connect to and start dnsrpzd if necessary for the unbound daemon.
	+ * Require "rpz-conf: path" to specify the rpz configuration file.
	+ * The unbound server directory name is the default rpz working
	+ * directory. If unbound uses chroot, then the dnsrpzd working
	+ * directory must be in the chroot tree.
	+ * The database and socket are closed and re-opened.
	+ */
	+void
	+rpz_init(librpz_clist_t pclist, librpz_client_t pclient,
	+ const struct config_file* cfg)
	+{
	+ lock_basic_type* mutex;
	+ librpz_emsg_t emsg;
	+
	+ if(!librpz) {
	+ librpz = librpz_lib_open(&emsg, NULL, FASTRPZ_LIBRPZ_PATH);
	+ if(!librpz)
	+ fatal_exit("rpz: %s", emsg.c);
	+ }
	+
	+ librpz->set_log(&log_fnc, NULL);
	+
	+ if(!cfg->rpz_cstr)
	+ fatal_exit("rpz: rpz-zone: not set");
	+
	+ librpz->client_detach(pclient);
	+ librpz->clist_detach(pclist);
	+
	+ mutex = malloc(sizeof(*mutex));
	+ if(!mutex)
	+ fatal_exit("rpz: no memory for lock");
	+ lock_basic_init(mutex);
	+
	+ *pclist = librpz->clist_create(&emsg, &lock, &unlock, &lock_destroy,
	+ mutex, NULL);
	+ if(!pclist)
	+ fatal_exit("rpz: %s", emsg.c);
	+
	+ pclient = librpz->client_create(&emsg, pclist, cfg->rpz_cstr, false);
	+ if(!*pclient)
	+ fatal_exit("rpz: %s", emsg.c);
	+
	+ if(!librpz->connect(&emsg, *pclient, true))
	+ fatal_exit("rpz: %s", emsg.c);
	+
	+ verbose(VERB_OPS, "rpz: librpz version %s", librpz->version);
	+}
	+
	+
	+/* Stop using librpz on behalf of a worker thread. */
	+void
	+rpz_delete(librpz_clist_t pclist, librpz_client_t pclient)
	+{
	+ if(librpz) {
	+ librpz->client_detach(pclient);
	+ librpz->clist_detach(pclist);
	+ }
	+}
	+
	+
	+/* Release the librpz resources held for a DNS client request. */
	+void
	+rpz_end(struct comm_reply* commreply)
	+{
	+ if(!commreply->rpz)
	+ return;
	+ rpz_off(commreply->rpz, commreply->rpz->st);
	+ free(commreply->rpz);
	+ commreply->rpz = NULL;
	+}
	+
	+
	+static bool
	+push_st(commreply_rpz_t* rpz)
	+{
	+ librpz_emsg_t emsg;
	+
	+ if(rpz->st == st_off \|\| rpz->st == st_servfail) {
	+ librpz->log(LIBRPZ_LOG_ERROR, rpz,
	+ "state %d in push_st()", rpz->st);
	+ return false;
	+ }
	+ if(!librpz->rsp_push(&emsg, rpz->rsp))
	+ log_fail(rpz, "%s", emsg.c);
	+ memmove(&rpz->saved_st[1], &rpz->saved_st[0],
	+ sizeof(rpz->saved_st) - sizeof(rpz->saved_st[0]));
	+ rpz->saved_st[0] = rpz->st;
	+ return rpz->st != st_servfail;
	+}
	+
	+
	+static bool
	+pop_st(commreply_rpz_t* rpz)
	+{
	+ librpz_emsg_t emsg;
	+
	+ if(rpz->rsp && !librpz->rsp_pop(&emsg, &rpz->result, rpz->rsp))
	+ log_fail(rpz, "%s", emsg.c);
	+ if(rpz->st != st_servfail)
	+ rpz->st = rpz->saved_st[0];
	+ memmove(&rpz->saved_st[0], &rpz->saved_st[1],
	+ sizeof(rpz->saved_st) - sizeof(rpz->saved_st[0]));
	+ return rpz->st != st_servfail;
	+}
	+
	+static bool
	+pop_discard_st(commreply_rpz_t* rpz)
	+{
	+ librpz_emsg_t emsg;
	+
	+ if(rpz->rsp && !librpz->rsp_pop_discard(&emsg, rpz->rsp))
	+ log_fail(rpz, "%s", emsg.c);
	+ memmove(&rpz->saved_st[0], &rpz->saved_st[1],
	+ sizeof(rpz->saved_st) - sizeof(rpz->saved_st[0]));
	+ return rpz->st != st_servfail;
	+}
	+
	+/* Check a rewrite attempt for errors and a disabled zone. */
	+static bool /* true=repeat the check */
	+ck_after(uint8_t* qname, bool recursed, librpz_trig_t trig,
	+ commreply_rpz_t* rpz)
	+{
	+ librpz_emsg_t emsg;
	+
	+ if(rpz->st == st_servfail)
	+ return false;
	+
	+ if(!librpz->rsp_result(&emsg, &rpz->result, recursed, rpz->rsp)) {
	+ log_fail(rpz, "%s", emsg.c);
	+ return false;
	+ }
	+
	+ if(rpz->result.policy == LIBRPZ_POLICY_DISABLED) {
	+ /* Log the hit on the disabled zone, do not try the zone again,
	+ * and restore the state from before the check to forget the hit
	+ * before trying again. */
	+ log_rewrite(qname, rpz->result.zpolicy, "disabled ", rpz);
	+ if(!librpz->rsp_forget_zone(&emsg, rpz->result.cznum, rpz->rsp))
	+ log_fail(rpz, "%s", emsg.c);
	+ return pop_st(rpz);
	+ }
	+
	+ /* Complain about and forget client-IP address hit that is not
	+ * dispositive. Client-IP triggers have the highest priority
	+ * within a policy zone, but can be overridden by any hit in a policy
	+ * earlier in the client's (resolver's) list of zones, including
	+ * policies that cannot be hit until after recursion. If we allowed
	+ * client-IP triggers in secondary zones, then than two DNS requests
	+ * that differ only in DNS client-IP addresses could properly
	+ * have differing results. The Unbound iterator treats identical
	+ * DNS requests the same regardless of DNS client-IP address.
	+ * struct query_info would need to be modified to have an optional
	+ * librpz_prefix_t containing the prefix of the client-IP address hit
	+ * from librpz->rsp_clientip_prefix(). Adding to struct query_info
	+ * would require finding and changing the many and obscure places
	+ * including the Unbound tests to memset(0) the struct query_info
	+ * that they create. */
	+ if(trig == LIBRPZ_TRIG_CLIENT_IP) {
	+ if(rpz->result.cznum != 0) {
	+ log_rewrite(qname, rpz->result.policy,
	+ "ignore secondary ", rpz);
	+ if(!pop_st(rpz))
	+ log_fail(rpz, "%s", emsg.c);
	+ return (false);
	+ }
	+ }
	+
	+ /* Forget the state from before the check and keep the new state
	+ * if we do not have a hit on a disabled policy zone. */
	+ pop_discard_st(rpz);
	+ return false;
	+}
	+
	+
	+/* Get the next RR from the policy record. */
	+static bool
	+next_rr(librpz_rr_t** rrp, const uint8_t* qname, size_t qname_len,
	+ commreply_rpz_t* rpz)
	+{
	+ librpz_emsg_t emsg;
	+
	+ if(!librpz->rsp_rr(&emsg, NULL, NULL, NULL, rrp, &rpz->result,
	+ qname, qname_len, rpz->rsp)) {
	+ log_fail(rpz, "%s", emsg.c);
	+ *rrp = NULL;
	+ return false;
	+ }
	+ return true;
	+}
	+
	+
	+static bool /* false=fatal error to be logged */
	+add_rr(struct sldns_buffer* pkt, const uint8_t* owner, size_t owner_len,
	+ librpz_rr_t* rr, commreply_rpz_t* rpz)
	+{
	+ size_t rdlength;
	+
	+ rdlength = ntohs(rr->rdlength);
	+
	+ if(!sldns_buffer_available(pkt, owner_len + 10 + rdlength)) {
	+ log_fail(rpz, "comm_reply buffer exhausted");
	+ free(rr);
	+ return false;
	+ }
	+ sldns_buffer_write(pkt, owner, owner_len);
	+ /* sizeof(librpz_rr_t)=12 instead of 10 */
	+ sldns_buffer_write(pkt, rr, 10 + rdlength);
	+ return true;
	+}
	+
	+
	+/* Convert a fake incoming DNS message to an Unbound struct dns_msg */
	+static void
	+pkt2dns_msg(struct dns_msg** dnsmsg, struct sldns_buffer* pkt,
	+ commreply_rpz_t* rpz, struct regional* region)
	+{
	+ struct msg_parse* msgparse;
	+
	+ msgparse = regional_alloc(region, sizeof(*msgparse));
	+ if(!msgparse) {
	+ log_fail(rpz, "out of memory for msgparse");
	+ *dnsmsg = NULL;
	+ return;
	+ }
	+ memset(msgparse, 0, sizeof(*msgparse));
	+ if(parse_packet(pkt, msgparse, region) != LDNS_RCODE_NOERROR) {
	+ log_fail(rpz, "packet parse error");
	+ *dnsmsg = NULL;
	+ return;
	+ }
	+ *dnsmsg = dns_alloc_msg(pkt, msgparse, region);
	+ if(!*dnsmsg) {
	+ log_fail(rpz, "dns_alloc_msg() failed");
	+ *dnsmsg = NULL;
	+ return;
	+ }
	+ (*dnsmsg)->rep->security = sec_status_rpz_rewritten;
	+}
	+
	+
	+static bool /* false=SERVFAIL */
	+ck_ip_rrset(const void* vdata, int family, librpz_trig_t trig,
	+ uint8_t* qname, commreply_rpz_t* rpz)
	+{
	+ const struct packed_rrset_data* data;
	+ uint rr_n;
	+ size_t len;
	+ librpz_emsg_t emsg;
	+
	+ data = vdata;
	+
	+ /* Loop to ignore disabled zones. */
	+ do {
	+ if(!push_st(rpz))
	+ return false;
	+ for(rr_n = 0; rr_n < data->count; ++rr_n) {
	+ len = data->rr_len[rr_n];
	+ /* Skip bogus including negative placeholding rdata. */
	+ if((family == AF_INET &&
	+ len != sizeof(struct in_addr)+2) \|\|
	+ (family == AF_INET6 &&
	+ len != sizeof(struct in6_addr)+2))
	+ continue;
	+ if(!librpz->ck_ip(&emsg, data->rr_data[rr_n]+2,
	+ family, trig, rpz->hit_id, true,
	+ rpz->rsp)) {
	+ log_fail(rpz, "%s", emsg.c);
	+ return false;
	+ }
	+ }
	+ } while(ck_after(qname, true, trig, rpz));
	+ return rpz->st != st_servfail;
	+}
	+
	+
	+static bool /* false=SERVFAIL */
	+ck_dname(uint8_t* dname, size_t dname_size, librpz_trig_t trig,
	+ uint8_t* qname, bool recursed, commreply_rpz_t* rpz)
	+{
	+ librpz_emsg_t emsg;
	+
	+ /* Refuse to check the root. */
	+ if(dname_is_root(dname))
	+ return rpz->st != st_servfail;
	+
	+ /* Loop to ignore disabled zones. */
	+ do {
	+ if(!push_st(rpz))
	+ return false;
	+ if(!librpz->ck_domain(&emsg, dname, dname_size, trig,
	+ rpz->hit_id, recursed, rpz->rsp)) {
	+ log_fail(rpz, "%s", emsg.c);
	+ return false;
	+ }
	+ } while(ck_after(qname, recursed, trig, rpz));
	+
	+ return rpz->st != st_servfail;
	+}
	+
	+
	+/* Check the IPv4 or IPv6 addresses for one NS name. */
	+static bool /* false=st_servfail */
	+ck_1nsip(uint8_t* nsname, size_t nsname_size, int family, int qtype,
	+ bool* have_ns, commreply_rpz_t* rpz, struct module_env* env)
	+{
	+ struct ub_packed_rrset_key* akey;
	+
	+ akey = rrset_cache_lookup(env->rrset_cache, nsname, nsname_size,
	+ qtype, LDNS_RR_CLASS_IN, 0, 0, 0);
	+ if(akey) {
	+ *have_ns = true;
	+
	+ if(!ck_ip_rrset(akey->entry.data, family, LIBRPZ_TRIG_NSIP,
	+ nsname, rpz)) {
	+ lock_rw_unlock(&akey->entry.lock);
	+ return false;
	+ }
	+ lock_rw_unlock(&akey->entry.lock);
	+ }
	+ return true;
	+}
	+
	+
	+static bool /* false=st_servfail */
	+ck_qname(uint8_t* qname, size_t qname_len,
	+ bool recursed, /* recursion done */
	+ bool wait_ns, /* willing to iterate for NS data */
	+ commreply_rpz_t* rpz, struct module_env* env)
	+{
	+ uint8_t* dname;
	+ size_t dname_size;
	+ int cur_lab;
	+ struct ub_packed_rrset_key* nskey;
	+ const struct packed_rrset_data* nsdata;
	+ uint8_t* nsname;
	+ size_t nsname_size;
	+ uint rr_n;
	+ bool have_ns, tried_ns;
	+
	+ if(!ck_dname(qname, qname_len, LIBRPZ_TRIG_QNAME, qname, false, rpz))
	+ return false;
	+
	+ /* Do not waste time looking for NSDNAME and NSIP hits when there
	+ * are no currently relevant triggers. */
	+ if(!librpz->have_ns_trig(rpz->rsp))
	+ return true;
	+
	+ have_ns = false;
	+ tried_ns = false;
	+ dname = qname;
	+ dname_size = qname_len;
	+ for(cur_lab = dname_count_labels(dname) - 2;
	+ cur_lab > rpz->min_ns_dots;
	+ --cur_lab) {
	+ tried_ns = true;
	+ dname_remove_label(&dname, &dname_size);
	+ nskey = rrset_cache_lookup(env->rrset_cache, dname, dname_size,
	+ LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN,
	+ 0, 0, 0);
	+ if(!nskey)
	+ continue;
	+
	+ nsdata = (const struct packed_rrset_data*)nskey->entry.data;
	+ for(rr_n = 0;
	+ rr_n < nsdata->count && rpz->st == st_unknown;
	+ ++rr_n) {
	+ nsname = nsdata->rr_data[rr_n]+2;
	+ nsname_size = nsdata->rr_len[rr_n];
	+ if(nsname_size <= 2)
	+ continue;
	+ nsname_size -= 2;
	+ if(!ck_dname(nsname, nsname_size, LIBRPZ_TRIG_NSDNAME,
	+ qname, recursed, rpz))
	+ return false;
	+ if(!ck_1nsip(nsname, nsname_size, AF_INET,
	+ LDNS_RR_TYPE_A, &have_ns, rpz, env))
	+ return false;
	+ if(!ck_1nsip(nsname, nsname_size, AF_INET6,
	+ LDNS_RR_TYPE_AAAA, &have_ns, rpz, env))
	+ return false;
	+ }
	+ lock_rw_unlock(&nskey->entry.lock);
	+ }
	+
	+ /* If we failed to find NS records, then stop building the response
	+ * before a CNAME with this owner name. */
	+ if(!have_ns && tried_ns && (!recursed \|\| wait_ns)) {
	+ rpz->cname_hit.size = qname_len;
	+ RPZ_ASSERT(rpz->cname_hit.size <= sizeof(rpz->cname_hit.d));
	+ memcpy(rpz->cname_hit.d, qname, qname_len);
	+ rpz->result.hit_id = rpz->hit_id;
	+ rpz->st = st_ck_ns;
	+ }
	+ return true;
	+}
	+
	+
	+/*
	+ * Are we ready to rewrite the response?
	+ */
	+static bool /* true=send rewritten response */
	+ck_result(uint8_t* qname, bool recursed,
	+ commreply_rpz_t* rpz, const struct comm_point* commpoint)
	+{
	+ librpz_emsg_t emsg;
	+
	+ switch(rpz->st) {
	+ case st_off:
	+ case st_servfail:
	+ case st_rewritten:
	+ return false;
	+ case st_unknown:
	+ break;
	+ case st_iterate:
	+ return false;
	+ case st_ck_ns:
	+ /* An NSDNAME or NSIP check failed for lack of cached data. */
	+ return false;
	+ default:
	+ fatal_exit("impossible RPZ state %d in rpz_worker_cache()",
	+ rpz->st);
	+ }
	+
	+ /* Wait for a trigger. */
	+ if(rpz->result.policy == LIBRPZ_POLICY_UNDEFINED) {
	+ if(recursed &&
	+ rpz->result.zpolicy != LIBRPZ_POLICY_UNDEFINED &&
	+ !librpz->rsp_result(&emsg, &rpz->result, true, rpz->rsp)) {
	+ log_fail(rpz, "%s", emsg.c);
	+ return false;
	+ }
	+ if(rpz->result.policy == LIBRPZ_POLICY_UNDEFINED)
	+ return false;
	+ }
	+
	+ if(rpz->result.policy == LIBRPZ_POLICY_PASSTHRU) {
	+ log_rewrite(qname, rpz->result.policy, "", rpz);
	+ rpz_off(rpz, st_off);
	+ return false;
	+ }
	+
	+ /* The TCP-only policy answers UDP requests with truncated responses. */
	+ if(rpz->result.policy == LIBRPZ_POLICY_TCP_ONLY &&
	+ commpoint->type == comm_tcp) {
	+ rpz_off(rpz, st_off);
	+ return false;
	+ }
	+
	+ return true;
	+}
	+
	+
	+/*
	+ * Convert an RPZ hit to a struct dns_msg
	+ */
	+static void
	+get_result_msg(struct dns_msg** dnsmsg, struct query_info* qinfo,
	+ uint16_t id, uint16_t flags, bool recursed, commreply_rpz_t* rpz,
	+ struct comm_point* commpoint, struct regional* region)
	+{
	+ librpz_rr_t* rr;
	+ librpz_domain_buf_t origin;
	+ struct sldns_buffer* pkt;
	+ uint16_t num_rrs;
	+ librpz_emsg_t emsg;
	+
	+ *dnsmsg = NULL;
	+ if(!ck_result(qinfo->qname, recursed, rpz, commpoint))
	+ return;
	+
	+ rpz->st = st_rewritten;
	+
	+ if(rpz->result.policy == LIBRPZ_POLICY_DROP) {
	+ log_rewrite(qinfo->qname, rpz->result.policy, "", rpz);
	+ /* Make a fake cached message to carry
	+ * sec_status_rpz_drop and be dropped. */
	+ error_encode(commpoint->buffer, LDNS_RCODE_NOERROR,
	+ qinfo, id, flags, NULL);
	+ pkt2dns_msg(dnsmsg, commpoint->buffer, rpz, region);
	+ (*dnsmsg)->rep->security = sec_status_rpz_drop;
	+ return;
	+ }
	+
	+ /* Create a DNS message of the RPZ data.
	+ * In many cases that message could be sent directly to the DNS client,
	+ * but sometimes iteration must be used to resolve a CNAME.
	+ * This need not be fast, because rewriting responses should be rare.
	+ * Therefore, use the simpler but slower tactic of generating a
	+ * parsed version of the message. */
	+
	+ flags &= ~BIT_AA;
	+ flags \|= BIT_QR \| BIT_RA;
	+ rr = NULL;
	+
	+ /* The TCP-only policy answers UDP requests with truncated responses. */
	+ if(rpz->result.policy == LIBRPZ_POLICY_TCP_ONLY) {
	+ flags \|= BIT_TC;
	+
	+ } else if(rpz->result.policy == LIBRPZ_POLICY_NXDOMAIN) {
	+ flags \|= LDNS_RCODE_NXDOMAIN;
	+
	+ } else if(rpz->result.policy == LIBRPZ_POLICY_CNAME) {
	+ if(!rpz->iterating &&
	+ qinfo->qtype != LDNS_RR_TYPE_CNAME) {
	+ /* The new DNS message would be a CNAME and
	+ * the external request was not for a CNAME.
	+ * The worker must punt to the iterator so that
	+ * the iterator can resolve the CNAME. */
	+ rpz->st = st_iterate;
	+ return;
	+ }
	+ next_rr(&rr, qinfo->qname, qinfo->qname_len, rpz);
	+
	+ } else if(rpz->result.policy == LIBRPZ_POLICY_RECORD \|\|
	+ rpz->result.policy == LIBRPZ_POLICY_NODATA) {
	+ next_rr(&rr, qinfo->qname, qinfo->qname_len, rpz);
	+ /* Punt to the iterator if the new DNS message would
	+ * be a CNAME that must be resolved. */
	+ if(!rpz->iterating &&
	+ qinfo->qtype != LDNS_RR_TYPE_CNAME &&
	+ rr && rr->type == ntohs(LDNS_RR_TYPE_CNAME)) {
	+ free(rr);
	+ rpz->st = st_iterate;
	+ return;
	+ }
	+ }
	+ log_rewrite(qinfo->qname, rpz->result.policy, "", rpz);
	+
	+ /* Make a buffer containing a DNS message with the RPZ data. */
	+ pkt = commpoint->buffer;
	+ sldns_buffer_clear(pkt);
	+ if(sldns_buffer_remaining(pkt) < LDNS_HEADER_SIZE) {
	+ log_fail(rpz, "comm_reply buffer too small for header");
	+ if(rr)
	+ free(rr);
	+ return;
	+ }
	+
	+ /* Install ID, flags, QDCOUNT=1, ANCOUNT=# of RPZ RRs, NSCOUNT=0,
	+ * and ARCOUNT=1 for the RPZ SOA. */
	+ sldns_buffer_write_u16(pkt, id);
	+ sldns_buffer_write_u16(pkt, flags);
	+ sldns_buffer_write_u16(pkt, 1); /* QDCOUNT */
	+ sldns_buffer_write_u16(pkt, 0); /* ANCOUNT will be set later */
	+ sldns_buffer_write_u16(pkt, 0); /* NSCOUNT */
	+ sldns_buffer_write_u16(pkt, 1); /* ARCOUNT */
	+
	+ /* Install the question with the LDNS_RR_CLASS_RPZ bit to
	+ * to distinguish this supposed cache entry from the real deal. */
	+ sldns_buffer_write(pkt, qinfo->qname, qinfo->qname_len);
	+ sldns_buffer_write_u16(pkt, qinfo->qtype);
	+ sldns_buffer_write_u16(pkt, LDNS_RR_CLASS_IN);
	+
	+ /* Install the RPZ RRs in the answer section */
	+ num_rrs = 0;
	+ while(rr) {
	+ /* Include only the requested RRs. */
	+ if(qinfo->qtype == LDNS_RR_TYPE_ANY \|\|
	+ rr->type == htons(qinfo->qtype) \|\|
	+ rr->type == htons(LDNS_RR_TYPE_CNAME)) {
	+ if(!add_rr(pkt, qinfo->qname, qinfo->qname_len,
	+ rr, rpz))
	+ return;
	+
	+ ++num_rrs;
	+ }
	+ free(rr);
	+
	+ next_rr(&rr, qinfo->qname, qinfo->qname_len, rpz);
	+ }
	+ /* Finish ANCOUNT. */
	+ if(num_rrs != 0)
	+ sldns_buffer_write_u16_at(pkt, 6, num_rrs);
	+
	+ /* All rewritten responses have an identifying SOA record in the
	+ * additional section. */
	+ if(!librpz->rsp_soa(&emsg, NULL, &rr, &origin,
	+ &rpz->result, rpz->rsp)) {
	+ log_fail(rpz, "no soa");
	+ return;
	+ }
	+ if(!add_rr(pkt, origin.d, origin.size, rr, rpz))
	+ return;
	+ free(rr);
	+
	+ /* Create a dns_msg representation of the fake incoming message. */
	+ sldns_buffer_flip(pkt);
	+ pkt2dns_msg(dnsmsg, pkt, rpz, region);
	+}
	+
	+
	+/* Check the RRs in the ANSWER section of a reply_info. */
	+static void
	+ck_reply(struct reply_info* reply, uint8_t* qname, bool wait_ns,
	+ commreply_rpz_t* rpz, struct module_env* env)
	+{
	+ struct ub_packed_rrset_key* rrset;
	+ enum sldns_enum_rr_type type;
	+ uint rrset_n;
	+
	+ /* Check the RRs in the ANSWER section. */
	+ rpz->cname_hit.size = 0;
	+ rpz->cname_hit_2nd = false;
	+ for(rrset_n = 0; rrset_n < reply->an_numrrsets; ++rrset_n) {
	+ /* Check all of the RRs before deciding. */
	+ if(rpz->st != st_unknown)
	+ return;
	+
	+ rrset = reply->rrsets[rrset_n];
	+ if(ntohs(rrset->rk.rrset_class) != LDNS_RR_CLASS_IN)
	+ continue;
	+ type = ntohs(rrset->rk.type);
	+
	+ if(type == LDNS_RR_TYPE_A) {
	+ if(!ck_ip_rrset(rrset->entry.data, AF_INET,
	+ LIBRPZ_TRIG_IP, qname, rpz))
	+ break;
	+
	+ } else if(type == LDNS_RR_TYPE_AAAA) {
	+ if(!ck_ip_rrset(rrset->entry.data, AF_INET6,
	+ LIBRPZ_TRIG_IP, qname, rpz))
	+ break;
	+
	+ } else if(type == LDNS_RR_TYPE_CNAME) {
	+ /* Check CNAME owners unless we already have a hit. */
	+ ++rpz->hit_id;
	+ if(!ck_qname(rrset->rk.dname, rrset->rk.dname_len,
	+ true, wait_ns, rpz, env))
	+ break;
	+
	+ /* Do not worry about the CNAME if it did not hit,
	+ * but note the miss so that it can be prepended
	+ * if we do hit. */
	+ if(rpz->result.hit_id != rpz->hit_id) {
	+ rpz->cname_hit_2nd = true;
	+ continue;
	+ }
	+
	+ /* Stop after hitting a CNAME.
	+ * The iterator must be used to include CNAMEs before
	+ * the CNAME that hit in the rewritten response. */
	+ rpz->cname_hit.size = rrset->rk.dname_len;
	+ RPZ_ASSERT(rpz->cname_hit.size <= sizeof(rpz->cname_hit.d));
	+ memcpy(rpz->cname_hit.d, rrset->rk.dname,
	+ rpz->cname_hit.size);
	+ break;
	+ }
	+ }
	+}
	+
	+
	+static void
	+worker_servfail(struct worker* worker, struct query_info* qinfo,
	+ uint16_t id, uint16_t flags, struct comm_reply* commreply)
	+{
	+ error_encode(commreply->c->buffer, LDNS_RCODE_SERVFAIL,
	+ qinfo, id, flags, NULL);
	+ regional_free_all(worker->scratchpad);
	+ comm_point_send_reply(commreply);
	+}
	+
	+
	+/* Send an RPZ answer before the iterator has started.
	+ * @return: 1=continue normal unbound processing
	+ * 0=punt to the iterator
	+ * -1=rewritten response already sent or dropped. */
	+static int
	+worker_send(struct dns_msg* dnsmsg, struct worker* worker,
	+ struct query_info* qinfo, uint16_t id, uint16_t flags,
	+ struct edns_data* edns, struct comm_reply* commreply)
	+{
	+ switch (commreply->rpz->st) {
	+ case st_off:
	+ return 1;
	+ case st_servfail:
	+ worker_servfail(worker, qinfo, id, flags, commreply);
	+ return -1;
	+ case st_unknown:
	+ return 1;
	+ case st_iterate:
	+ case st_ck_ns:
	+ return 0; /* punt to the iterator */
	+ case st_rewritten:
	+ break;
	+ default:
	+ fatal_exit("impossible RPZ state %d in worker_send()",
	+ commreply->rpz->st);
	+ }
	+
	+ if(dnsmsg->rep->security == sec_status_rpz_drop) {
	+ regional_free_all(worker->scratchpad);
	+ comm_point_drop_reply(commreply);
	+ return -1;
	+ }
	+
	+ edns->edns_version = EDNS_ADVERTISED_VERSION;
	+ edns->udp_size = EDNS_ADVERTISED_SIZE;
	+ edns->ext_rcode = 0;
	+ edns->bits = 0; /* rewritten response cannot verify. */
	+ if(!reply_info_answer_encode(qinfo, dnsmsg->rep,
	+ id, flags \| BIT_QR,
	+ commreply->c->buffer, 0, 1,
	+ worker->scratchpad,
	+ edns->udp_size, edns, 0, 0)) {
	+ worker_servfail(worker, qinfo, id, flags, commreply);
	+ } else {
	+ regional_free_all(worker->scratchpad);
	+ comm_point_send_reply(commreply);
	+ }
	+ return -1;
	+}
	+
	+
	+/* Set commreply to an RPZ context if the response might be rewritten.
	+ * Try to answer now with a hit allowed before recursion (iteration). */
	+bool /* true=response sent or dropped */
	+rpz_start(struct worker* worker, struct query_info* qinfo,
	+ struct comm_reply* commreply, struct edns_data* edns)
	+{
	+ commreply_rpz_t* rpz;
	+ uint16_t id, flags;
	+ struct dns_msg* dnsmsg;
	+ int family;
	+ const void* addr;
	+ librpz_emsg_t emsg;
	+
	+ /* Quit if rpz not configured. */
	+ if(!worker->daemon->rpz_client)
	+ return false;
	+
	+ /* Rewrite only the Internet class */
	+ if(qinfo->qclass != LDNS_RR_CLASS_IN)
	+ return false;
	+
	+ rpz = commreply->rpz;
	+ RPZ_ASSERT(!rpz);
	+
	+ dnsmsg = NULL;
	+ id = htons(sldns_buffer_read_u16_at(commreply->c->buffer, 0));
	+ flags = sldns_buffer_read_u16_at(commreply->c->buffer, 2);
	+
	+ rpz = malloc(sizeof(*rpz));
	+ if(!rpz) {
	+ librpz->log(LIBRPZ_LOG_ERROR, NULL, "no memory for rpz");
	+ return 0 > worker_send(dnsmsg, worker, qinfo,
	+ id, flags, edns, commreply);
	+ }
	+ memset(rpz, 0, sizeof(*rpz));
	+ rpz->st = st_unknown;
	+ commreply->rpz = rpz;
	+
	+ /* Make a new ID for log messages */
	+ rpz->log_id = __sync_add_and_fetch(&log_id, 1);
	+
	+ /* Get access to the librpz data. */
	+ if(!librpz->rsp_create(&emsg, &rpz->rsp, &rpz->min_ns_dots,
	+ worker->daemon->rpz_client,
	+ (flags & BIT_RD) != 0,
	+ (edns->bits & EDNS_DO) != 0)) {
	+ log_fail(rpz, "%s", emsg.c);
	+ return false;
	+ }
	+ /* Quit if benign reasons prevent rewriting. */
	+ if(!rpz->rsp) {
	+ rpz->st = st_off;
	+ librpz->log(LIBRPZ_LOG_TRACE1, rpz, "%s", emsg.c);
	+ return false;
	+ }
	+
	+ /* Check the client IP address.
	+ * Do not use commreply->srctype because it is often 0. */
	+ family = ((struct sockaddr*)&commreply->addr)->sa_family;
	+ switch(family) {
	+ case AF_INET:
	+ addr = &((struct sockaddr_in*)&commreply->addr)->sin_addr;
	+ break;
	+ case AF_INET6:
	+ addr = &((struct sockaddr_in6*)&commreply->addr)->sin6_addr;
	+ break;
	+ default:
	+ /* Maybe the client is on a UNIX domain socket. */
	+ librpz->log(LIBRPZ_LOG_TRACE2, rpz,
	+ "unknown client address family %d", family);
	+ addr = NULL;
	+ break;
	+ }
	+ /* Loop to ignore disabled zones. */
	+ while(addr) {
	+ if(!push_st(rpz))
	+ break;
	+ if(!librpz->ck_ip(&emsg, addr, family, LIBRPZ_TRIG_CLIENT_IP,
	+ rpz->hit_id, true, rpz->rsp)) {
	+ log_fail(rpz, "%s", emsg.c);
	+ break;
	+ }
	+ if(!ck_after(qinfo->qname, false, LIBRPZ_TRIG_CLIENT_IP, rpz))
	+ break;
	+ }
	+ if(rpz->st == st_servfail)
	+ return 0 > worker_send(dnsmsg, worker, qinfo,
	+ id, flags, edns, commreply);
	+
	+ /* Check the QNAME and possibly replace a client-IP hit. */
	+ ck_qname(qinfo->qname, qinfo->qname_len, false, true,
	+ rpz, &worker->env);
	+
	+ get_result_msg(&dnsmsg, qinfo, id, flags, false,
	+ rpz, commreply->c, worker->scratchpad);
	+ return 0 > worker_send(dnsmsg, worker, qinfo,
	+ id, flags, edns, commreply);
	+}
	+
	+
	+/* Check a cached reply before iteration.
	+ * @return: 1=use cache entry
	+ * 0=deny a cached entry exists in order to punt to the iterator
	+ * -1=rewritten response already sent or dropped */
	+int
	+rpz_worker_cache(struct worker* worker, struct reply_info* reply,
	+ struct query_info* qinfo, uint16_t id, uint16_t flags,
	+ struct edns_data* edns, struct comm_reply* commreply)
	+{
	+ commreply_rpz_t* rpz;
	+ struct dns_msg* dnsmsg;
	+ st_t new_st;
	+ librpz_rr_t* rr;
	+
	+ dnsmsg = NULL;
	+
	+ rpz = commreply->rpz;
	+ switch(rpz->st) {
	+ case st_off:
	+ return 1; /* Send the cache entry. */
	+ case st_servfail:
	+ return worker_send(dnsmsg, worker, qinfo, id, flags,
	+ edns, commreply);
	+ case st_unknown:
	+ break;
	+ case st_iterate:
	+ case st_ck_ns:
	+ return 0; /* Punt to the iterator. */
	+ case st_rewritten:
	+ default:
	+ fatal_exit("impossible RPZ state %d in rpz_worker_cache()",
	+ rpz->st);
	+ }
	+
	+ /* Check the RRs in the ANSWER section. */
	+ if(!push_st(rpz))
	+ return worker_send(dnsmsg, worker, qinfo, id, flags, edns,
	+ commreply);
	+
	+ ck_reply(reply, qinfo->qname, true, rpz, &worker->env);
	+ if(!ck_result(qinfo->qname, true, rpz, commreply->c))
	+ return worker_send(dnsmsg, worker, qinfo, id, flags, edns,
	+ commreply);
	+
	+ if(rpz->cname_hit.size != 0) {
	+ /* Punt to the iterator if leading CNAMEs must be
	+ * included in the rewritten response. */
	+ rpz->cname_hit.size = 0;
	+ new_st = st_iterate;
	+
	+ } else if(rpz->result.policy == LIBRPZ_POLICY_CNAME) {
	+ /* Punt if the rewritten response is to a CNAME. */
	+ new_st = st_iterate;
	+
	+ } else {
	+ if(rpz->result.policy == LIBRPZ_POLICY_RECORD) {
	+ next_rr(&rr, qinfo->qname, qinfo->qname_len, rpz);
	+ if(rr) {
	+ /* Punt we are rewriting to a CNAME. */
	+ if(rr->type == ntohs(LDNS_RR_TYPE_CNAME)) {
	+ free(rr);
	+ rpz->st = st_iterate;
	+ } else {
	+ free(rr);
	+ }
	+ }
	+ }
	+ get_result_msg(&dnsmsg, qinfo, id, flags, true,
	+ rpz, commreply->c, worker->scratchpad);
	+ new_st = rpz->st;
	+ }
	+
	+ switch(new_st) {
	+ case st_off:
	+ case st_servfail:
	+ break;
	+ case st_unknown:
	+ pop_discard_st(rpz);
	+ break;
	+ case st_iterate:
	+ case st_ck_ns:
	+ if(pop_st(rpz))
	+ rpz->st = new_st;
	+ break;
	+ case st_rewritten:
	+ pop_discard_st(rpz);
	+ break;
	+ default:
	+ fatal_exit("impossible RPZ state %d in rpz_worker_cache()",
	+ rpz->st);
	+ }
	+
	+ return worker_send(dnsmsg, worker, qinfo, id, flags, edns, commreply);
	+}
	+
	+
	+/* Check a cache hit or miss for the iterator.
	+ * A cache miss can already have a QNAME hit that was ignored before checking
	+ * the iterator because of "QNAME-WAIT-RECURSE yes".
	+ * Cache hits are treated like responses from authorities. */
	+bool /* false=SERVFAIL */
	+rpz_iter_cache(struct dns_msg** msg, enum response_type* type,
	+ struct module_qstate* qstate, struct iter_qstate* iq)
	+{
	+ struct comm_reply* commreply;
	+ commreply_rpz_t* rpz;
	+ struct dns_msg* dnsmsg;
	+
	+ commreply = &qstate->mesh_info->reply_list->query_reply;
	+ rpz = commreply->rpz;
	+
	+ rpz->iterating = true;
	+
	+ switch(rpz->st) {
	+ case st_off:
	+ iq->rpz_rewritten = 1; /* RPZ has nothing to say. */
	+ return true;
	+ case st_servfail:
	+ return false;
	+ case st_unknown:
	+ break;
	+ case st_iterate:
	+ case st_ck_ns:
	+ rpz->st = st_unknown;
	+ if(!ck_qname(iq->qchase.qname, iq->qchase.qname_len,
	+ *msg != NULL, true, rpz, qstate->env))
	+ return false;
	+ /* If we must recurse regardless and if NSIP/NSDNAME
	+ * checking failed, then delay in the hope that
	+ * recursion will also get NS data. */
	+ if(rpz->st == st_ck_ns)
	+ return true;
	+ break;
	+ case st_rewritten:
	+ default:
	+ fatal_exit("impossible RPZ state %d in rpz_iter_cache()",
	+ rpz->st);
	+ }
	+
	+ push_st(rpz);
	+
	+ /* Check the cache hit. */
	+ if(*msg)
	+ ck_reply((*msg)->rep, iq->qchase.qname, true, rpz, qstate->env);
	+
	+ /* The DNS ID does not matter, because the generated dns_msg
	+ * is nominally from an authority and not to the DNS client. */
	+ get_result_msg(&dnsmsg, &iq->qchase, 1, qstate->query_flags, true,
	+ rpz, commreply->c, qstate->region);
	+
	+ switch(rpz->st) {
	+ case st_off:
	+ iq->rpz_rewritten = 1; /* RPZ has nothing to say. */
	+ return true;
	+ case st_servfail:
	+ return false;
	+ case st_unknown:
	+ /* RPZ has nothing to say yet. Maybe there will be a hit
	+ * later in the CNAME chain. */
	+ return pop_discard_st(rpz);
	+ case st_ck_ns:
	+ /* Try to get NS data for a CNAME found by ck_reply() */
	+ *type = RESPONSE_TYPE_CNAME;
	+ return pop_discard_st(rpz);
	+ case st_iterate:
	+ default:
	+ fatal_exit("impossible RPZ state %d in rpz_iter_cache()",
	+ rpz->st);
	+ case st_rewritten:
	+ break;
	+ }
	+
	+ if(*msg && rpz->cname_hit.size != 0 && rpz->cname_hit_2nd) {
	+ /* We hit a CNAME owner in the cached msg after not hitting one
	+ * or more CNAME owners. We need to add those leading CNAMEs
	+ * to the prepend list. Tell the iterator to treat the cached
	+ * message as a RESPONSE_TYPE_CNAME even if it contains answers.
	+ * handle_cname_response() will stop prepending CNAMEs before
	+ * the triggering CNAME. handle_cname_response() will cause
	+ * a restart to resolve the target of the preceding CNAME,
	+ * which is the same as the hit CNAME owner. */
	+ rpz->st = st_unknown;
	+ *type = RESPONSE_TYPE_CNAME;
	+ return pop_discard_st(rpz);
	+ }
	+
	+ *msg = dnsmsg;
	+ iq->rpz_security = dnsmsg->rep->security;
	+
	+ if(dnsmsg && dnsmsg->rep->an_numrrsets != 0 &&
	+ dnsmsg->rep->rrsets[0]->rk.type == htons(LDNS_RR_TYPE_CNAME)) {
	+ /* The cached msg triggered a rule that rewrites to a
	+ * CNAME that must be resolved.
	+ * We have a replacement dns_msg with that CNAME and also
	+ * an SOA RR in the ADDITIONAL section that the iterator
	+ * will lose as it adds the CNAME to the prepend list.
	+ * Save the SOA RR in iq->rpz_soa. */
	+ iq->rpz_soa = dnsmsg->rep->rrsets[1];
	+ iq->rpz_rewritten = 1;
	+ *type = RESPONSE_TYPE_CNAME;
	+ return true;
	+ }
	+
	+ /* Otherwise we have rewritten to zero or more non-CNAME RRs.
	+ * (DNAMEs are not supported.)
	+ * Tell the iterator to send the rewritten message. */
	+ *type = RESPONSE_TYPE_ANSWER;
	+ iq->rpz_rewritten = 1;
	+ return true;
	+}
	+
	+
	+/* Check a RESPONSE_TYPE_ANSWER response from an authority in the iterator. */
	+rpz_iter_resp_t
	+rpz_iter_resp(struct module_qstate* qstate, struct iter_qstate* iq,
	+ struct dns_msg** resp, bool* is_cname)
	+{
	+ struct comm_reply* commreply;
	+ commreply_rpz_t* rpz;
	+ struct reply_info* rep;
	+
	+ *is_cname = false;
	+
	+ commreply = &qstate->mesh_info->reply_list->query_reply;
	+ rpz = commreply->rpz;
	+ switch(rpz->st) {
	+ case st_off:
	+ case st_servfail:
	+ case st_iterate:
	+ case st_rewritten:
	+ default:
	+ fatal_exit("impossible RPZ state %d in rpz_iter_resp()",
	+ rpz->st);
	+ case st_ck_ns:
	+ case st_unknown:
	+ break;
	+ }
	+
	+ /* We know !iq->rpz_rewritten and so the response was after a simple
	+ * cache miss when the original QNAME did not trigger a response
	+ * or after a CNAME whose owner name did hit but was then forgotten
	+ * with pop_st().
	+ * In either case, it is necessary to check the QNAME here.
	+ * Checking the QNAME will not lose a better hit. */
	+ rpz->st = st_unknown;
	+ ck_qname(iq->qchase.qname, iq->qchase.qname_len, true, false,
	+ rpz, qstate->env);
	+
	+ /* Check the RRs in the ANSWER section. */
	+ if(!push_st(rpz))
	+ return rpz_iter_resp_fail;
	+ ck_reply(iq->response->rep, iq->qchase.qname, false, rpz, qstate->env);
	+ get_result_msg(resp, &qstate->qinfo, 1, qstate->query_flags, true,
	+ rpz, commreply->c, qstate->region);
	+ switch(rpz->st) {
	+ case st_off:
	+ iq->rpz_rewritten = 1; /* Do not come back. */
	+ return rpz_iter_resp_done;
	+ case st_servfail: /* Send SERVFAIL */
	+ return rpz_iter_resp_fail;
	+ case st_unknown:
	+ case st_ck_ns:
	+ return rpz_iter_resp_done; /* continue without change */
	+ case st_iterate:
	+ default:
	+ fatal_exit("impossible RPZ state %d in rpz_iter_resp()",
	+ rpz->st);
	+ case st_rewritten:
	+ /* Tell the iterator to use handle_cname_response() to
	+ * prepend any preceding CNAMEs.
	+ * We have a replacement dns_msg that also has an SOA RR in the
	+ * ADDITIONAL section that the iterator will lose if it is a
	+ * CNAME. Save that SOA in that case. */
	+ rep = (*resp)->rep;
	+ if(rep->an_numrrsets != 0 &&
	+ rep->rrsets[0]->rk.type == ntohs(LDNS_RR_TYPE_CNAME)) {
	+ *is_cname = true;
	+ iq->rpz_soa = rep->rrsets[1];
	+ }
	+ return rpz_iter_resp_rewrite;
	+ }
	+}
	+
	+
	+/* Tell handle_cname_response() to stop adding to the answer prepend list
	+ * after adding CNAME with a target that hits a QNAME trigger.
	+ * Do not change any RPZ state, but expect the call of handle_cname_response()
	+ * to try to resolve the CNAME and hit the same QNAME trigger and rewrite
	+ * the response. */
	+rpz_cname_t
	+rpz_cname(struct module_qstate* qstate,
	+ uint8_t* oname, size_t oname_size)
	+{
	+ struct mesh_reply* reply_list;
	+ struct comm_reply* commreply;
	+ commreply_rpz_t* rpz;
	+ rpz_cname_t ret;
	+
	+ /* Quit if RPZ is off */
	+ reply_list = qstate->mesh_info->reply_list;
	+ if(!reply_list)
	+ return rpz_cname_prepend;
	+ commreply = &reply_list->query_reply;
	+ rpz = commreply->rpz;
	+
	+ if(!rpz \|\| rpz->st == st_off)
	+ return rpz_cname_prepend;
	+
	+ /* Stop on a 2nd or later CNAME for rpz_iter_resp(). */
	+ if(rpz->cname_hit.size != 0) {
	+ if(!query_dname_compare(rpz->cname_hit.d, oname))
	+ return rpz_cname_stop;
	+ return rpz_cname_prepend;
	+ }
	+
	+ if(rpz->st != st_unknown)
	+ fatal_exit("impossible RPZ state %d in rpz_cname()", rpz->st);
	+
	+ ret = rpz_cname_prepend;
	+ if(!push_st(rpz))
	+ return rpz_cname_fail;
	+ /* Stop before prepending a CNAME that would preempt a
	+ * rewritten response or before a possible NSDNAME or NSIP trigger. */
	+ ++rpz->hit_id;
	+ ck_qname(oname, oname_size, true, true, rpz, qstate->env);
	+ if(rpz->st != st_unknown)
	+ ret = rpz_cname_stop;
	+ if(!pop_st(rpz))
	+ return rpz_cname_fail;
	+ return ret;
	+}
	+
	+#endif /* ENABLE_FASTRPZ */
	-Index: unboundfastrpz/fastrpz/rpz.h
	-===================================================================
	---- unboundfastrpz/fastrpz/rpz.h (nonexistent)
	-+++ unboundfastrpz/fastrpz/rpz.h (working copy)
	+diff --git a/fastrpz/rpz.h b/fastrpz/rpz.h
	+new file mode 100644
	+index 0000000..5d7e31c
	+--- /dev/null
	++++ b/fastrpz/rpz.h
	@@ -0,0 +1,138 @@
	+/*
	+ * fastrpz/rpz.h - interface to the fastrpz response policy zone library
	+ *
	+ * Copyright (c) 2016 Farsight Security, Inc.
	+ *
	+ * Licensed under the Apache License, Version 2.0 (the "License");
	+ * you may not use this file except in compliance with the License.
	+ * You may obtain a copy of the License at
	+ * http://www.apache.org/licenses/LICENSE-2.0
	+ *
	+ * Unless required by applicable law or agreed to in writing, software
	+ * distributed under the License is distributed on an "AS IS" BASIS,
	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	+ * See the License for the specific language governing permissions and
	+ * limitations under the License.
	+ */
	+
	+#ifndef UNBOUND_FASTRPZ_RPZ_H
	+#define UNBOUND_FASTRPZ_RPZ_H
	+
	+#ifndef PACKAGE_VERSION
	+/* Ensure that config.h has been included to correctly set ENABLE_FASTRPZ */
	+#include "config.h"
	+#endif
	+
	+#ifdef ENABLE_FASTRPZ
	+
	+#include "librpz.h"
	+
	+#include "daemon/daemon.h"
	+#include "util/config_file.h"
	+
	+struct comm_point; /* forward references */
	+struct comm_reply;
	+struct dns_msg;
	+struct edns_data;
	+struct iter_qstate;
	+struct query_info;
	+struct reply_info;
	+enum response_type; /* iterator/iter_utils.h */
	+
	+
	+struct commreply_rpz;
	+
	+/**
	+ * Connect to the librpz database.
	+ * @param pclist: future pointer to opaque librpz client data
	+ * @param pclient: future pointer to opaque librpz client data
	+ * @param cfg: parsed unbound configuration
	+ */
	+void rpz_init(librpz_clist_t pclist, librpz_client_t pclient,
	+ const struct config_file* cfg);
	+
	+/**
	+ * Disconnect from the librpz database
	+ * @param client: opaque librpz client data
	+ */
	+void rpz_delete(librpz_clist_t pclist, librpz_client_t pclient);
	+
	+/**
	+ * Start working on a DNS request and check for client IP address triggers.
	+ * @param worker: the DNS request context
	+ * @param qinfo: the DNS question
	+ * @param[in,out] commreply: the answer
	+ * @param c: where to send the response
	+ * @param[in,out] edns for the DO flag
	+ * @return true if response already sent or dropped
	+ */
	+bool rpz_start(struct worker* worker, struct query_info* qinfo,
	+ struct comm_reply* commreply, struct edns_data* edns);
	+
	+/**
	+ * Release resources held for a DNS request
	+ * @param rspp: pointer to pointer to rpz client context.
	+ */
	+void rpz_end(struct comm_reply* comm_rep);
	+
	+/**
	+ * Check a cached reply for RPZ hits before iteration
	+ * @param worker: the DNS request context
	+ * @param casheresp: cache reply
	+ * @param qinfo: the DNS question
	+ * @param id from the DNS request
	+ * @param flags from the DNS request
	+ * @param[in,out] edns for the DO flag
	+ * @param[in,out] commreply: RPZ state
	+ * @return 1=use cache entry, -1=rewritten response already sent or dropped,
	+ * 0=deny a cached entry exists
	+ */
	+int rpz_worker_cache(struct worker* worker, struct reply_info* cacheresp,
	+ struct query_info* qinfo, uint16_t id, uint16_t flags,
	+ struct edns_data* edns, struct comm_reply* commreply);
	+
	+/**
	+ * Check for an existing RPZ CNAME rewrite with "QNAME-WAIT-RECURSE no"
	+ * that needs to be resolved before resolving the external request.
	+ * @param[out] msg: rewritten CNAME response.
	+ * @param qstate: query state.
	+ * @param iq: iterator query state.
	+ * @return false=send SERVFAIL
	+ */
	+bool rpz_iter_cache(struct dns_msg** msg, enum response_type* type,
	+ struct module_qstate* qstate, struct iter_qstate* iq);
	+
	+/**
	+ * Check a response from an authority in the iterator.
	+ * @param[out] type: of the final response
	+ * @param qstate: query state.
	+ * @param iq: iterator query state.
	+ * @param is_cname: true if the rewritten response is a CNAME
	+ * @return one of rpz_resp_t
	+ */
	+typedef enum {
	+ rpz_iter_resp_fail, /* Send SERVFAIL. */
	+ rpz_iter_resp_rewrite, /* We rewrote the response. */
	+ rpz_iter_resp_done, /* Restart to refetch glue. */
	+} rpz_iter_resp_t;
	+rpz_iter_resp_t rpz_iter_resp(struct module_qstate* qstate,
	+ struct iter_qstate* iq, struct dns_msg** resp,
	+ bool* is_cname);
	+
	+/**
	+ * Check a CNAME RR
	+ * @param qstate: query state.
	+ * @param oname: cname owner name
	+ * @param oname_size: length of oname
	+ * @return: one of rpz_cname_t
	+ */
	+typedef enum {
	+ rpz_cname_fail, /* send SERVFAIL */
	+ rpz_cname_prepend, /* prepend CNAME as usual */
	+ rpz_cname_stop, /* stop before prepending this CNAME */
	+} rpz_cname_t;
	+rpz_cname_t rpz_cname(struct module_qstate* qstate,
	+ uint8_t* oname, size_t oname_size);
	+
	+#endif /* ENABLE_FASTRPZ */
	+#endif /* UNBOUND_FASTRPZ_RPZ_H */
	-Index: unboundfastrpz/fastrpz/rpz.m4
	-===================================================================
	---- unboundfastrpz/fastrpz/rpz.m4 (nonexistent)
	-+++ unboundfastrpz/fastrpz/rpz.m4 (working copy)
	+diff --git a/fastrpz/rpz.m4 b/fastrpz/rpz.m4
	+new file mode 100644
	+index 0000000..2123535
	+--- /dev/null
	++++ b/fastrpz/rpz.m4
	@@ -0,0 +1,64 @@
	+# fastrpz/rpz.m4
	+
	+# ck_FASTRPZ
	+# --------------------------------------------------------------------------
	+# check for Fastrpz
	+# --enable-fastrpz enable Fastrpz response policy zones
	+# --enable-fastrpz-dl Fastrpz delayed link [default=have dlopen]
	+# --with-fastrpz-dir directory containing librpz.so
	+#
	+# Fastrpz can be compiled into Unbound everywhere with a reasonably
	+# modern C compiler. It is enabled on systems with dlopen() and librpz.so.
	+
	+AC_DEFUN([ck_FASTRPZ],
	+[
	+ fastrpz_avail=yes
	+ AC_MSG_CHECKING([for librpz __attribute__s])
	+ AC_TRY_COMPILE(,[
	+ extern void f(char *p __attribute__((unused)), ...)
	+ __attribute__((format(printf,1,2))) __attribute__((__noreturn__));],
	+ librpz_have_attr=yes
	+ AC_DEFINE([LIBRPZ_HAVE_ATTR], 1, [have __attribute__s used in librpz.h])
	+ AC_MSG_RESULT([yes]),
	+ librpz_have_attr=no
	+ AC_MSG_RESULT([no]))
	+
	+ AC_SEARCH_LIBS(dlopen, dl)
	+ librpz_dl=yes
	+ AC_CHECK_FUNCS(dlopen dlclose dlsym,,librpz_dl=no)
	+ AC_ARG_ENABLE([fastrpz-dl],
	+ [ --enable-fastrpz-dl Fastrpz delayed link [[default=$librpz_dl]]],
	+ [enable_librpz_dl="$enableval"],
	+ [enable_librpz_dl="$librpz_dl"])
	+ AC_ARG_WITH([fastrpz-dir],
	+ [ --with-fastrpz-dir directory containing librpz.so],
	+ [librpz_path="$withval/librpz.so"], [librpz_path="librpz.so"])
	+ AC_DEFINE_UNQUOTED([FASTRPZ_LIBRPZ_PATH], ["$librpz_path"],
	+ [fastrpz librpz.so])
	+ if test "x$enable_librpz_dl" = "xyes"; then
	+ fastrpz_lib_open=2
	+ else
	+ fastrpz_lib_open=1
	+ # Add librpz.so to linked libraries if we are not using dlopen()
	+ AC_SEARCH_LIBS([librpz_client_create], [rpz], [],
	+ [fastrpz_lib_open=0
	+ fastrpz_avail=no])
	+ fi
	+ AC_DEFINE_UNQUOTED([FASTRPZ_LIB_OPEN], [$fastrpz_lib_open],
	+ [0=no fastrpz 1=static link 2=dlopen()])
	+
	+ AC_ARG_ENABLE([fastrpz],
	+ AS_HELP_STRING([--enable-fastrpz],[enable Fastrpz response policy zones]),
	+ [enable_fastrpz=$enableval],[enable_fastrpz=$fastrpz_avail])
	+ if test "x$enable_fastrpz" = xyes; then
	+ AC_DEFINE([ENABLE_FASTRPZ], [1], [Enable fastrpz])
	+ if test "x$fastrpz_lib_open" = "x0"; then
	+ AC_MSG_ERROR([[dlopen and librpz.so needed for fastrpz]])
	+ fi
	+ # used in Makefile.in
	+ AC_SUBST([FASTRPZ_SRC], [fastrpz/rpz.c])
	+ AC_SUBST([FASTRPZ_OBJ], [rpz.lo])
	+ elif test "x$fastrpz_avail" = "x0"; then
	+ AC_MSG_WARN([[dlopen and librpz.so needed for fastrpz]])
	+ fi
	+])
	-Index: unboundfastrpz/iterator/iterator.c
	-===================================================================
	---- unboundfastrpz/iterator/iterator.c (revision 4923)
	-+++ unboundfastrpz/iterator/iterator.c (working copy)
	+diff --git a/iterator/iterator.c b/iterator/iterator.c
	+index c906c27..55bf218 100644
	+--- a/iterator/iterator.c
	++++ b/iterator/iterator.c
	@@ -68,6 +68,9 @@
	#include "sldns/str2wire.h"
	#include "sldns/parseutil.h"
	#include "sldns/sbuffer.h"
	+#ifdef ENABLE_FASTRPZ
	+#include "fastrpz/rpz.h"
	+#endif

	- int
	- iter_init(struct module_env* env, int id)
	-@@ -525,6 +528,23 @@
	+ /* in msec */
	+ int UNKNOWN_SERVER_NICENESS = 376;
	+@@ -551,6 +554,23 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,
	if(ntohs(r->rk.type) == LDNS_RR_TYPE_CNAME &&
	query_dname_compare(*mname, r->rk.dname) == 0 &&
	!iter_find_rrset_in_prepend_answer(iq, r)) {
	+#ifdef ENABLE_FASTRPZ
	+ /* Stop adding CNAME rrsets to the prepend list
	+ * before defining an RPZ hit. */
	+ if(!iq->rpz_rewritten) {
	+ switch (rpz_cname(qstate, mname, mname_len)) {
	+ case rpz_cname_fail:
	+ /* send SERVFAIL */
	+ return 0;
	+ case rpz_cname_prepend:
	+ /* save the CNAME. */
	+ break;
	+ case rpz_cname_stop:
	+ /* Pause before adding the CNAME. */
	+ goto stop_short;
	+ }
	+ }
	+#endif
	/* Add this relevant CNAME rrset to the prepend list.*/
	if(!iter_add_prepend_answer(qstate, iq, r))
	return 0;
	-@@ -533,6 +553,9 @@
	+@@ -559,6 +579,9 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,

	/* Other rrsets in the section are ignored. */
	}
	+#ifdef ENABLE_FASTRPZ
	+stop_short: ;
	+#endif
	/* add authority rrsets to authority prepend, for wildcarded CNAMEs */
	for(i=msg->rep->an_numrrsets; i<msg->rep->an_numrrsets +
	msg->rep->ns_numrrsets; i++) {
	-@@ -1216,6 +1239,7 @@
	+@@ -1195,6 +1218,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
	uint8_t* delname;
	size_t delnamelen;
	struct dns_msg* msg = NULL;
	+ enum response_type type;

	log_query_info(VERB_DETAIL, "resolving", &qstate->qinfo);
	/* check effort */
	-@@ -1302,8 +1326,7 @@
	+@@ -1281,8 +1305,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
	}
	if(msg) {
	/* handle positive cache response */
	- enum response_type type = response_type_from_cache(msg,
	- &iq->qchase);
	+ type = response_type_from_cache(msg, &iq->qchase);
	if(verbosity >= VERB_ALGO) {
	log_dns_msg("msg from cache lookup", &msg->qinfo,
	msg->rep);
	-@@ -1311,7 +1334,22 @@
	+@@ -1290,7 +1313,22 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
	(int)msg->rep->ttl,
	(int)msg->rep->prefetch_ttl);
	}
	+#ifdef ENABLE_FASTRPZ
	+ }
	+ /* Check for an RPZ hit in the cached DNS message or an existing
	+ * RPZ CNAME rewrite that can be resolved now after a hit on the QNAME
	+ * or client IP address. This can involve a creating a fake cache
	+ * hit. It can also involve overriding an RESPONSE_TYPE_ANSWER
	+ * result from response_type_from_cache(). Or it can ignore
	+ * the cached result to refetch glue. */
	+ if(!iq->rpz_rewritten &&
	+ qstate->mesh_info->reply_list &&
	+ qstate->mesh_info->reply_list->query_reply.rpz &&
	+ !rpz_iter_cache(&msg, &type, qstate, iq))
	+ return error_response(qstate, id, LDNS_RCODE_SERVFAIL);

	+ if(msg) {
	+#endif
	if(type == RESPONSE_TYPE_CNAME) {
	uint8_t* sname = 0;
	size_t slen = 0;
	-@@ -2716,6 +2754,62 @@
	+@@ -2714,6 +2752,62 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
	sock_list_insert(&qstate->reply_origin,
	&qstate->reply->addr, qstate->reply->addrlen,
	qstate->region);
	+#ifdef ENABLE_FASTRPZ
	+ /* Check the response for an RPZ hit. The response has already
	+ * been saved in the cache. This should have the same effect
	+ * as finding that response in the cache.
	+ * We have already used rpz_iter_cache() at least once. */
	+ if(!iq->rpz_rewritten &&
	+ qstate->mesh_info->reply_list &&
	+ qstate->mesh_info->reply_list->query_reply.rpz) {
	+ struct dns_msg* resp;
	+ bool is_cname;
	+ uint8_t* sname;
	+ size_t slen;
	+
	+ switch (rpz_iter_resp(qstate, iq, &resp, &is_cname)) {
	+ case rpz_iter_resp_fail:
	+ return error_response(qstate, id,
	+ LDNS_RCODE_SERVFAIL);
	+ case rpz_iter_resp_rewrite:
	+ /* Prepend any initial CNAMEs from the original
	+ * response up to a hit. */
	+ if(!handle_cname_response(qstate, iq,
	+ iq->response,
	+ &sname, &slen))
	+ return error_response(qstate, id,
	+ LDNS_RCODE_SERVFAIL);
	+ if (resp) {
	+ iq->response = resp;
	+ iq->rpz_security = resp->rep->security;
	+ iq->rpz_rewritten = 1;
	+
	+ /* Send the rewritten record if it
	+ * is not a CNAME. */
	+ if(!is_cname)
	+ break;
	+
	+ /* Prepend the new CNAME
	+ * and restart to resolve it. */
	+ if(!handle_cname_response(qstate, iq,
	+ resp, &sname, &slen))
	+ return error_response(qstate, id,
	+ LDNS_RCODE_SERVFAIL);
	+ }
	+ iq->qchase.qname = sname;
	+ iq->qchase.qname_len = slen;
	+ iq->dp = NULL;
	+ iq->refetch_glue = 0;
	+ iq->query_restart_count++;
	+ iq->sent_count = 0;
	+ iq->state = INIT_REQUEST_STATE;
	+ return 1;
	+
	+ case rpz_iter_resp_done:
	+ break;
	+ }
	+ }
	+#endif
	if(iq->minimisation_state != DONOT_MINIMISE_STATE
	&& !(iq->chase_flags & BIT_RD)) {
	if(FLAGS_GET_RCODE(iq->response->rep->flags) !=
	-@@ -3462,6 +3556,10 @@
	+@@ -3467,12 +3561,44 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
	* but only if we did recursion. The nonrecursion referral
	* from cache does not need to be stored in the msg cache. */
	if(!qstate->no_cache_store && qstate->query_flags&BIT_RD) {
	+#ifdef ENABLE_FASTRPZ
	+ /* Do not save RPZ rewritten messages. */
	+ if(!iq->rpz_rewritten)
	+#endif
	iter_dns_store(qstate->env, &qstate->qinfo,
	iq->response->rep, 0, qstate->prefetch_leeway,
	iq->dp&&iq->dp->has_parent_side_NS,
	-@@ -3468,6 +3566,34 @@
	qstate->region, qstate->query_flags);
	}
	}
	+#ifdef ENABLE_FASTRPZ
	+ if(iq->rpz_rewritten) {
	+ /* Restore RPZ marks on a rewritten response. The marks
	+ * are lost if the rewrite is to a CNAME. */
	+ iq->response->rep->security = iq->rpz_security;
	+
	+ /* Append the RPZ SOA to rewritten CNAME chains. */
	+ if(iq->rpz_soa) {
	+ struct ub_packed_rrset_key** sets;
	+ uint n;
	+
	+ n = iq->response->rep->rrset_count;
	+ sets = regional_alloc(qstate->region,
	+ (1+n) * sizeof(*sets));
	+ if(!sets) {
	+ log_err("append RPZ SOA: out of memory");
	+ return error_response(qstate, id,
	+ LDNS_RCODE_SERVFAIL);
	+ }
	+ memcpy(sets, iq->response->rep->rrsets,
	+ n * sizeof(struct ub_packed_rrset_key*));
	+ sets[n] = iq->rpz_soa;
	+ iq->response->rep->rrsets = sets;
	+ ++iq->response->rep->rrset_count;
	+ ++iq->response->rep->ar_numrrsets;
	+ }
	+ }
	+#endif
	qstate->return_rcode = LDNS_RCODE_NOERROR;
	qstate->return_msg = iq->response;
	return 0;
	-Index: unboundfastrpz/iterator/iterator.h
	-===================================================================
	---- unboundfastrpz/iterator/iterator.h (revision 4923)
	-+++ unboundfastrpz/iterator/iterator.h (working copy)
	-@@ -386,6 +386,16 @@
	+diff --git a/iterator/iterator.h b/iterator/iterator.h
	+index a2f1b57..e1e4a73 100644
	+--- a/iterator/iterator.h
	++++ b/iterator/iterator.h
	+@@ -386,6 +386,16 @@ struct iter_qstate {
	*/
	int minimise_count;

	+
	+#ifdef ENABLE_FASTRPZ
	+ /** The response has been rewritten by RPZ. */
	+ int rpz_rewritten;
	+ /** RPZ SOA RR for the ADDITIONAL section */
	+ struct ub_packed_rrset_key* rpz_soa;
	+ /** sec_status_rpz_rewritten or sec_status_rpz_drop if rewritten. */
	+ enum sec_status rpz_security;
	+#endif
	+
	/**
	* Count number of time-outs. Used to prevent resolving failures when
	* the QNAME minimisation QTYPE is blocked. */
	-Index: unboundfastrpz/services/cache/dns.c
	-===================================================================
	---- unboundfastrpz/services/cache/dns.c (revision 4923)
	-+++ unboundfastrpz/services/cache/dns.c (working copy)
	-@@ -928,6 +928,14 @@
	+diff --git a/services/cache/dns.c b/services/cache/dns.c
	+index aa4efec..5dd3412 100644
	+--- a/services/cache/dns.c
	++++ b/services/cache/dns.c
	+@@ -945,6 +945,14 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
	struct regional* region, uint32_t flags)
	{
	struct reply_info* rep = NULL;
	+
	+#ifdef ENABLE_FASTRPZ
	+ /* Never save RPZ rewritten data. */
	+ if (msgrep->security == sec_status_rpz_drop \|\|
	+ msgrep->security == sec_status_rpz_rewritten)
	+ return 1;
	+#endif
	+
	/* alloc, malloc properly (not in region, like msg is) */
	rep = reply_info_copy(msgrep, env->alloc, NULL);
	if(!rep)
	-Index: unboundfastrpz/services/mesh.c
	-===================================================================
	---- unboundfastrpz/services/mesh.c (revision 4923)
	-+++ unboundfastrpz/services/mesh.c (working copy)
	+diff --git a/services/mesh.c b/services/mesh.c
	+index d96289e..2e9f267 100644
	+--- a/services/mesh.c
	++++ b/services/mesh.c
	@@ -60,6 +60,9 @@
	#include "sldns/wire2str.h"
	#include "services/localzone.h"
	#include "util/data/dname.h"
	+#ifdef ENABLE_FASTRPZ
	+#include "fastrpz/rpz.h"
	+#endif
	#include "respip/respip.h"
	+ #include "services/listen_dnsport.h"

	- /** subtract timers and the values do not overflow or become negative */
	-@@ -1057,6 +1060,13 @@
	+@@ -1072,6 +1075,13 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
	else secure = 0;
	if(!rep && rcode == LDNS_RCODE_NOERROR)
	rcode = LDNS_RCODE_SERVFAIL;
	+#ifdef ENABLE_FASTRPZ
	+ /* Drop the response here for LIBRPZ_POLICY_DROP after iteration. */
	+ if(rep && rep->security == sec_status_rpz_drop) {
	+ log_query_info(VERB_QUERY, "rpz drop", &m->s.qinfo);
	+ secure = 0;
	+ } else
	+#endif
	/* send the reply */
	/* We don't reuse the encoded answer if either the previous or current
	* response has a local alias. We could compare the alias records
	-@@ -1230,6 +1240,7 @@
	+@@ -1247,6 +1257,7 @@ struct mesh_state* mesh_area_find(struct mesh_area* mesh,
	key.s.is_valrec = valrec;
	key.s.qinfo = *qinfo;
	key.s.query_flags = qflags;
	+ key.reply_list = NULL;
	/* We are searching for a similar mesh state when we DO want to
	* aggregate the state. Thus unique is set to NULL. (default when we
	* desire aggregation).*/
	-@@ -1276,6 +1287,10 @@
	+@@ -1293,6 +1304,10 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
	if(!r)
	return 0;
	r->query_reply = *rep;
	+#ifdef ENABLE_FASTRPZ
	+ /* The new reply structure owns the RPZ state. */
	+ rep->rpz = NULL;
	+#endif
	r->edns = *edns;
	if(edns->opt_list) {
	r->edns.opt_list = edns_opt_copy_region(edns->opt_list,
	-Index: unboundfastrpz/util/config_file.c
	-===================================================================
	---- unboundfastrpz/util/config_file.c (revision 4923)
	-+++ unboundfastrpz/util/config_file.c (working copy)
	-@@ -1386,6 +1386,8 @@
	+diff --git a/util/config_file.c b/util/config_file.c
	+index 9b60254..d791f8f 100644
	+--- a/util/config_file.c
	++++ b/util/config_file.c
	+@@ -1418,6 +1418,8 @@ config_delete(struct config_file* cfg)
	free(cfg->dnstap_socket_path);
	free(cfg->dnstap_identity);
	free(cfg->dnstap_version);
	+ if (cfg->rpz_cstr)
	+ free(cfg->rpz_cstr);
	config_deldblstrlist(cfg->ratelimit_for_domain);
	config_deldblstrlist(cfg->ratelimit_below_domain);
	#ifdef USE_IPSECMOD
	-Index: unboundfastrpz/util/config_file.h
	-===================================================================
	---- unboundfastrpz/util/config_file.h (revision 4923)
	-+++ unboundfastrpz/util/config_file.h (working copy)
	-@@ -468,6 +468,11 @@
	+diff --git a/util/config_file.h b/util/config_file.h
	+index 3cffdbf..e0fa1c8 100644
	+--- a/util/config_file.h
	++++ b/util/config_file.h
	+@@ -490,6 +490,11 @@ struct config_file {
	/** true to disable DNSSEC lameness check in iterator */
	int disable_dnssec_lame_check;

	+ /** true to enable RPZ */
	+ int rpz_enable;
	+ /** RPZ configuration */
	+ char* rpz_cstr;
	+
	/** ratelimit for ip addresses. 0 is off, otherwise qps (unless overridden) */
	int ip_ratelimit;
	/** number of slabs for ip_ratelimit cache */
	-Index: unboundfastrpz/util/configlexer.lex
	-===================================================================
	---- unboundfastrpz/util/configlexer.lex (revision 4923)
	-+++ unboundfastrpz/util/configlexer.lex (working copy)
	-@@ -429,6 +429,10 @@
	+diff --git a/util/configlexer.lex b/util/configlexer.lex
	+index 16b5bc5..038045d 100644
	+--- a/util/configlexer.lex
	++++ b/util/configlexer.lex
	+@@ -439,6 +439,10 @@ dnstap-log-forwarder-query-messages{COLON} {
	YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
	dnstap-log-forwarder-response-messages{COLON} {
	YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
	+rpz{COLON} { YDVAR(0, VAR_RPZ) }
	+rpz-enable{COLON} { YDVAR(1, VAR_RPZ_ENABLE) }
	+rpz-zone{COLON} { YDVAR(1, VAR_RPZ_ZONE) }
	+rpz-option{COLON} { YDVAR(1, VAR_RPZ_OPTION) }
	disable-dnssec-lame-check{COLON} { YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) }
	ip-ratelimit{COLON} { YDVAR(1, VAR_IP_RATELIMIT) }
	ratelimit{COLON} { YDVAR(1, VAR_RATELIMIT) }
	-Index: unboundfastrpz/util/configparser.y
	-===================================================================
	---- unboundfastrpz/util/configparser.y (revision 4923)
	-+++ unboundfastrpz/util/configparser.y (working copy)
	-@@ -125,6 +125,7 @@
	+diff --git a/util/configparser.y b/util/configparser.y
	+index c7b9169..bef15b5 100644
	+--- a/util/configparser.y
	++++ b/util/configparser.y
	+@@ -125,6 +125,7 @@ extern struct config_parser_state* cfg_parser;
	%token VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES
	%token VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES
	%token VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES
	+%token VAR_RPZ VAR_RPZ_ENABLE VAR_RPZ_ZONE VAR_RPZ_OPTION
	%token VAR_RESPONSE_IP_TAG VAR_RESPONSE_IP VAR_RESPONSE_IP_DATA
	%token VAR_HARDEN_ALGO_DOWNGRADE VAR_IP_TRANSPARENT
	%token VAR_DISABLE_DNSSEC_LAME_CHECK
	-@@ -164,7 +165,7 @@
	+@@ -170,7 +171,7 @@ extern struct config_parser_state* cfg_parser;

	%%
	toplevelvars: /* empty */ \| toplevelvars toplevelvar ;
	-toplevelvar: serverstart contents_server \| stubstart contents_stub \|
	+toplevelvar: serverstart contents_server \| stubstart contents_stub \| rpzstart contents_rpz \|
	forwardstart contents_forward \| pythonstart contents_py \|
	rcstart contents_rc \| dtstart contents_dt \| viewstart contents_view \|
	dnscstart contents_dnsc \| cachedbstart contents_cachedb \|
	-@@ -2546,6 +2547,50 @@
	- (strcmp($2, "yes")==0);
	+@@ -2710,6 +2711,50 @@ dt_dnstap_log_forwarder_response_messages: VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MES
	+ free($2);
	}
	;
	+rpzstart: VAR_RPZ
	+ {
	+ OUTYY(("\nP(rpz:)\n"));
	+ }
	+ ;
	+contents_rpz: contents_rpz content_rpz
	+ \| ;
	+content_rpz: rpz_enable \| rpz_zone \| rpz_option
	+ ;
	+rpz_enable: VAR_RPZ_ENABLE STRING_ARG
	+ {
	+ OUTYY(("P(rpz_enable:%s)\n", $2));
	+ if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	+ yyerror("expected yes or no.");
	+ else cfg_parser->cfg->rpz_enable = (strcmp($2, "yes")==0);
	+ free($2);
	+ }
	+ ;
	+rpz_zone: VAR_RPZ_ZONE STRING_ARG
	+ {
	+ char new_cstr, old_cstr;
	+
	+ OUTYY(("P(rpz_zone:%s)\n", $2));
	+ old_cstr = cfg_parser->cfg->rpz_cstr;
	+ (void)asprintf(&new_cstr, "%s\nzone %s", old_cstr?old_cstr:"", $2);
	+ if(!new_cstr)
	+ yyerror("out of memory");
	+ free(old_cstr);
	+ cfg_parser->cfg->rpz_cstr = new_cstr;
	+ }
	+ ;
	+rpz_option: VAR_RPZ_OPTION STRING_ARG
	+ {
	+ char new_cstr, old_cstr;
	+
	+ OUTYY(("P(rpz_option:%s)\n", $2));
	+ old_cstr = cfg_parser->cfg->rpz_cstr;
	+ (void)asprintf(&new_cstr, "%s\n%s", old_cstr ? old_cstr : "", $2);
	+ if(!new_cstr)
	+ yyerror("out of memory");
	+ free(old_cstr);
	+ cfg_parser->cfg->rpz_cstr = new_cstr;
	+ }
	+ ;
	pythonstart: VAR_PYTHON
	{
	OUTYY(("\nP(python:)\n"));
	-Index: unboundfastrpz/util/data/msgencode.c
	-===================================================================
	---- unboundfastrpz/util/data/msgencode.c (revision 4923)
	-+++ unboundfastrpz/util/data/msgencode.c (working copy)
	-@@ -585,6 +585,35 @@
	+diff --git a/util/data/msgencode.c b/util/data/msgencode.c
	+index 4c0a555..e51e9b8 100644
	+--- a/util/data/msgencode.c
	++++ b/util/data/msgencode.c
	+@@ -590,6 +590,35 @@ insert_section(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs,
	return RETVAL_OK;
	}

	+#ifdef ENABLE_FASTRPZ
	+/* Insert the RPZ SOA even with MINIMAL_RESPONSES */
	+static int
	+insert_rpz_soa(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs,
	+ sldns_buffer* pkt, size_t rrsets_before, time_t timenow,
	+ struct regional* region, struct compress_tree_node** tree,
	+ size_t rr_offset)
	+{
	+ int r;
	+ size_t i, setstart;
	+
	+ *num_rrs = 0;
	+ for(i=0; i<num_rrsets; i++) {
	+ if (rep->rrsets[rrsets_before+i]->rk.type != LDNS_RR_TYPE_SOA)
	+ continue;
	+ setstart = sldns_buffer_position(pkt);
	+ if((r=packed_rrset_encode(rep->rrsets[rrsets_before+i],
	+ pkt, num_rrs, timenow, region,
	+ 1, 0, tree, LDNS_SECTION_ADDITIONAL,
	+ LDNS_RR_TYPE_ANY, 0, rr_offset))
	+ != RETVAL_OK) {
	+ sldns_buffer_set_position(pkt, setstart);
	+ return r;
	+ }
	+ }
	+ return RETVAL_OK;
	+}
	+
	+#endif
	/** store query section in wireformat buffer, return RETVAL */
	static int
	insert_query(struct query_info* qinfo, struct compress_tree_node** tree,
	-@@ -748,6 +777,19 @@
	+@@ -753,6 +782,19 @@ reply_info_encode(struct query_info* qinfo, struct reply_info* rep,
	return 0;
	}
	sldns_buffer_write_u16_at(buffer, 10, arcount);
	+#ifdef ENABLE_FASTRPZ
	+ } else if(rep->security == sec_status_rpz_rewritten) {
	+ /* Insert the RPZ SOA for rpz even with MINIMAL_RESPONSES */
	+ r = insert_rpz_soa(rep, rep->ar_numrrsets, &arcount, buffer,
	+ rep->an_numrrsets + rep->ns_numrrsets,
	+ timenow, region, &tree, rr_offset);
	+ if(r!= RETVAL_OK) {
	+ if(r != RETVAL_TRUNC)
	+ return 0;
	+ /* no need to set TC bit, this is the additional */
	+ sldns_buffer_write_u16_at(buffer, 10, arcount);
	+ }
	+#endif
	}
	sldns_buffer_flip(buffer);
	return 1;
	-Index: unboundfastrpz/util/data/packed_rrset.c
	-===================================================================
	---- unboundfastrpz/util/data/packed_rrset.c (revision 4923)
	-+++ unboundfastrpz/util/data/packed_rrset.c (working copy)
	-@@ -255,6 +255,10 @@
	+diff --git a/util/data/packed_rrset.c b/util/data/packed_rrset.c
	+index 7b9d549..e44b2ce 100644
	+--- a/util/data/packed_rrset.c
	++++ b/util/data/packed_rrset.c
	+@@ -255,6 +255,10 @@ sec_status_to_string(enum sec_status s)
	case sec_status_insecure: return "sec_status_insecure";
	case sec_status_secure_sentinel_fail: return "sec_status_secure_sentinel_fail";
	case sec_status_secure: return "sec_status_secure";
	+#ifdef ENABLE_FASTRPZ
	+ case sec_status_rpz_rewritten: return "sec_status_rpz_rewritten";
	+ case sec_status_rpz_drop: return "sec_status_rpz_drop";
	+#endif
	}
	return "unknown_sec_status_value";
	}
	-Index: unboundfastrpz/util/data/packed_rrset.h
	-===================================================================
	---- unboundfastrpz/util/data/packed_rrset.h (revision 4923)
	-+++ unboundfastrpz/util/data/packed_rrset.h (working copy)
	-@@ -193,7 +193,15 @@
	+diff --git a/util/data/packed_rrset.h b/util/data/packed_rrset.h
	+index 3a5335d..2011321 100644
	+--- a/util/data/packed_rrset.h
	++++ b/util/data/packed_rrset.h
	+@@ -193,7 +193,15 @@ enum sec_status {
	sec_status_secure_sentinel_fail,
	/** SECURE means that the object (RRset or message) validated
	* according to local policy. */
	- sec_status_secure
	+ sec_status_secure,
	+#ifdef ENABLE_FASTRPZ
	+ /** RPZ_REWRITTEN means that the response has been rewritten by
	+ * rpz and so cannot be verified. */
	+ sec_status_rpz_rewritten,
	+ /** RPZ_DROP means that the response has been rewritten by rpz
	+ * as silence. */
	+ sec_status_rpz_drop
	+#endif
	};

	/**
	-Index: unboundfastrpz/util/netevent.c
	-===================================================================
	---- unboundfastrpz/util/netevent.c (revision 4923)
	-+++ unboundfastrpz/util/netevent.c (working copy)
	-@@ -56,6 +56,9 @@
	+diff --git a/util/netevent.c b/util/netevent.c
	+index b8b2a09..5ccc29a 100644
	+--- a/util/netevent.c
	++++ b/util/netevent.c
	+@@ -57,6 +57,9 @@
	#ifdef HAVE_OPENSSL_ERR_H
	#include <openssl/err.h>
	#endif
	+#ifdef ENABLE_FASTRPZ
	+#include "fastrpz/rpz.h"
	+#endif

	/* -------- Start of local definitions -------- */
	/** if CMSG_ALIGN is not defined on this platform, a workaround */
	-@@ -588,6 +591,9 @@
	+@@ -590,6 +593,9 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
	struct cmsghdr* cmsg;
	#endif /* S_SPLINT_S */

	+#ifdef ENABLE_FASTRPZ
	+ rep.rpz = NULL;
	+#endif
	rep.c = (struct comm_point*)arg;
	log_assert(rep.c->type == comm_udp);

	-@@ -677,6 +683,9 @@
	+@@ -679,6 +685,9 @@ comm_point_udp_callback(int fd, short event, void* arg)
	int i;
	struct sldns_buffer *buffer;

	+#ifdef ENABLE_FASTRPZ
	+ rep.rpz = NULL;
	+#endif
	rep.c = (struct comm_point*)arg;
	log_assert(rep.c->type == comm_udp);

	-@@ -720,6 +729,9 @@
	+@@ -722,6 +731,9 @@ comm_point_udp_callback(int fd, short event, void* arg)
	(void)comm_point_send_udp_msg(rep.c, buffer,
	(struct sockaddr*)&rep.addr, rep.addrlen);
	}
	+#ifdef ENABLE_FASTRPZ
	+ rpz_end(&rep);
	+#endif
	if(!rep.c \|\| rep.c->fd != fd) /* commpoint closed to -1 or reused for
	another UDP port. Note rep.c cannot be reused with TCP fd. */
	break;
	-@@ -3035,6 +3047,9 @@
	- comm_point_start_listening(repinfo->c, -1,
	- repinfo->c->tcp_timeout_msec);
	+@@ -3142,6 +3154,9 @@ comm_point_send_reply(struct comm_reply *repinfo)
	+ repinfo->c->tcp_timeout_msec);
	+ }
	}
	+#ifdef ENABLE_FASTRPZ
	+ rpz_end(repinfo);
	+#endif
	}

	void
	-@@ -3044,6 +3059,9 @@
	+@@ -3151,6 +3166,9 @@ comm_point_drop_reply(struct comm_reply* repinfo)
	return;
	log_assert(repinfo && repinfo->c);
	log_assert(repinfo->c->type != comm_tcp_accept);
	+#ifdef ENABLE_FASTRPZ
	+ rpz_end(repinfo);
	+#endif
	if(repinfo->c->type == comm_udp)
	return;
	- reclaim_tcp_handler(repinfo->c);
	-@@ -3063,6 +3081,9 @@
	+ if(repinfo->c->tcp_req_info)
	+@@ -3172,6 +3190,9 @@ comm_point_start_listening(struct comm_point* c, int newfd, int msec)
	{
	- verbose(VERB_ALGO, "comm point start listening %d",
	- c->fd==-1?newfd:c->fd);
	+ verbose(VERB_ALGO, "comm point start listening %d (%d msec)",
	+ c->fd==-1?newfd:c->fd, msec);
	+#ifdef ENABLE_FASTRPZ
	+ rpz_end(&c->repinfo);
	+#endif
	if(c->type == comm_tcp_accept && !c->tcp_free) {
	/* no use to start listening no free slots. */
	return;
	-Index: unboundfastrpz/util/netevent.h
	-===================================================================
	---- unboundfastrpz/util/netevent.h (revision 4923)
	-+++ unboundfastrpz/util/netevent.h (working copy)
	-@@ -120,6 +120,10 @@
	+diff --git a/util/netevent.h b/util/netevent.h
	+index d80c72b..0233292 100644
	+--- a/util/netevent.h
	++++ b/util/netevent.h
	+@@ -120,6 +120,10 @@ struct comm_reply {
	/** return type 0 (none), 4(IP4), 6(IP6) */
	int srctype;
	/* DnsCrypt context */
	+#ifdef ENABLE_FASTRPZ
	+ /** per-request RPZ state */
	+ struct commreply_rpz* rpz;
	+#endif
	#ifdef USE_DNSCRYPT
	uint8_t client_nonce[crypto_box_HALF_NONCEBYTES];
	uint8_t nmkey[crypto_box_BEFORENMBYTES];
	-Index: unboundfastrpz/validator/validator.c
	-===================================================================
	---- unboundfastrpz/validator/validator.c (revision 4923)
	-+++ unboundfastrpz/validator/validator.c (working copy)
	-@@ -2755,6 +2755,12 @@
	+diff --git a/validator/validator.c b/validator/validator.c
	+index fa8d541..5628ef0 100644
	+--- a/validator/validator.c
	++++ b/validator/validator.c
	+@@ -2755,6 +2755,12 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
	default:
	/* NSEC proof did not work, try next */
	break;
	+#ifdef ENABLE_FASTRPZ
	+ case sec_status_rpz_rewritten:
	+ case sec_status_rpz_drop:
	+ fatal_exit("impossible RPZ sec_status");
	+ break;
	+#endif
	}

	sec = nsec3_prove_nods(qstate->env, ve,
	-@@ -2788,6 +2794,12 @@
	+@@ -2788,6 +2794,12 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
	default:
	/* NSEC3 proof did not work */
	break;
	+#ifdef ENABLE_FASTRPZ
	+ case sec_status_rpz_rewritten:
	+ case sec_status_rpz_drop:
	+ fatal_exit("impossible RPZ sec_status");
	+ break;
	+#endif
	}

	/* Apparently, no available NSEC/NSEC3 proved NODATA, so
	Index: head/contrib/unbound/contrib/libunbound.so.conf
	===================================================================
	--- head/contrib/unbound/contrib/libunbound.so.conf (revision 349719)
	+++ head/contrib/unbound/contrib/libunbound.so.conf (revision 349720)
	@@ -1,41 +1,42 @@
	# See ltrace.conf(5) for description of syntax of this file.
	typedef ub_type = enum(TYPE_A=1,TYPE_NS=2,TYPE_SOA=6,TYPE_MX=15,TYPE_TXT=16,TYPE_AAAA=28,TYPE_DS=43,TYPE_DNSKEY=48,TYPE_TLSA=52,TYPE_ANY=255);
	typedef ub_class = enum(CLASS_IN=1,CLASS_CH=3,CLASS_NONE=254,CLASS_ANY=255);
	typedef ub_rcode = enum(RCODE_NOERROR,RCODE_FORMERR,RCODE_SERVFAIL,RCODE_NXDOMAIN,RCODE_NOTIMPL,RCODE_REFUSED,RCODE_YXDOMAIN,RCODE_YXRRSET,RCODE_NXRRSET,RCODE_NOTAUTH,RCODE_NOTZONE);
	typedef ub_havedata = enum(no_data, have_data);
	typedef ub_nxdomain = enum(name_exists, nxdomain);
	typedef ub_secure = enum(not_secure, secure);
	typedef ub_bogus = enum(not_bogus, bogus);
	typedef ub_result = struct(string, ub_type, ub_class, array(void,zero), array(int,zero), string, ub_rcode, void, int, ub_havedata, ub_nxdomain, ub_secure, ub_bogus, string, int);
	typedef ub_ctx = void;
	ub_ctx* ub_ctx_create(void);
	void ub_ctx_delete(ub_ctx*);
	int ub_ctx_set_option(ub_ctx*, string, string);
	int ub_ctx_get_option(ub_ctx, string, +string);
	int ub_ctx_config(ub_ctx*, string);
	int ub_ctx_set_fwd(ub_ctx*, string);
	+int ub_ctx_set_tls(ub_ctx*, bool(int));
	int ub_ctx_set_stub(ub_ctx*, string, string, bool(int));
	int ub_ctx_resolvconf(ub_ctx*, string);
	int ub_ctx_hosts(ub_ctx*, string);
	int ub_ctx_add_ta(ub_ctx*, string);
	int ub_ctx_add_ta_file(ub_ctx*, string);
	int ub_ctx_add_ta_autr(ub_ctx*, string);
	int ub_ctx_trustedkeys(ub_ctx*, string);
	int ub_ctx_debugout(ub_ctx, void);
	int ub_ctx_debuglevel(ub_ctx*, int);
	int ub_ctx_async(ub_ctx*, bool(int));
	int ub_poll(ub_ctx*);
	int ub_wait(ub_ctx*);
	int ub_fd(ub_ctx*);
	int ub_process(ub_ctx*);
	int ub_resolve(ub_ctx, string, ub_type, ub_class, +ub_result*);
	int ub_resolve_async(ub_ctx, string, ub_type, ub_class, void, void, +int);
	int ub_cancel(ub_ctx*, int);
	void ub_resolve_free(ub_result*);
	string ub_strerror(int);
	int ub_ctx_print_local_zones(ub_ctx*);
	int ub_ctx_zone_add(ub_ctx*, string, string);
	int ub_ctx_zone_remove(ub_ctx*, string);
	int ub_ctx_data_add(ub_ctx*, string);
	int ub_ctx_data_remove(ub_ctx*, string);
	string ub_version(void);
	Index: head/contrib/unbound/contrib/unbound-fuzzme.patch
	===================================================================
	--- head/contrib/unbound/contrib/unbound-fuzzme.patch (nonexistent)
	+++ head/contrib/unbound/contrib/unbound-fuzzme.patch (revision 349720)
	@@ -0,0 +1,148 @@
	+>From cc9b927f8f29d989ddb8415fe6508a538546abca Mon Sep 17 00:00:00 2001
	+From: Jacob Hoffman-Andrews <github@hoffman-andrews.com>
	+Date: Wed, 2 Jan 2019 22:52:51 -0800
	+Subject: [PATCH] Add unbound-fuzzme.
	+
	+This is a small program that simply parses a packet provided on stdout,
	+for the purposes of fuzzing.
	+---
	+ .gitignore \| 1 +
	+ Makefile.in \| 22 ++++++++++++++++++++--
	+ smallapp/unbound-fuzzme.c \| 38 ++++++++++++++++++++++++++++++++++++++
	+ 3 files changed, 59 insertions(+), 2 deletions(-)
	+ create mode 100644 smallapp/unbound-fuzzme.c
	+
	+diff --git a/.gitignore b/.gitignore
	+index f4527fd8..6163f905 100644
	+--- a/.gitignore
	++++ b/.gitignore
	+@@ -24,6 +24,7 @@
	+ /unbound-checkconf
	+ /unbound-control
	+ /unbound-control-setup
	++/unbound-fuzzme
	+ /unbound-host
	+ /unbound.h
	+ /asynclook
	+diff --git a/Makefile.in b/Makefile.in
	+index af5b10f6..dacf1ab5 100644
	+--- a/Makefile.in
	++++ b/Makefile.in
	+@@ -177,6 +177,10 @@ shm_main.lo remote.lo stats.lo unbound.lo \
	+ worker.lo @WIN_DAEMON_OBJ@
	+ DAEMON_OBJ_LINK=$(DAEMON_OBJ) $(COMMON_OBJ_ALL_SYMBOLS) $(SLDNS_OBJ) \
	+ $(COMPAT_OBJ) @WIN_DAEMON_OBJ_LINK@
	++FUZZME_SRC=smallapp/unbound-fuzzme.c
	++FUZZME_OBJ=unbound-fuzzme.lo
	++FUZZME_OBJ_LINK=$(FUZZME_OBJ) worker_cb.lo $(COMMON_OBJ_ALL_SYMBOLS) $(SLDNS_OBJ) \
	++$(COMPAT_OBJ)
	+ CHECKCONF_SRC=smallapp/unbound-checkconf.c smallapp/worker_cb.c
	+ CHECKCONF_OBJ=unbound-checkconf.lo worker_cb.lo
	+ CHECKCONF_OBJ_LINK=$(CHECKCONF_OBJ) $(COMMON_OBJ_ALL_SYMBOLS) $(SLDNS_OBJ) \
	+@@ -252,6 +256,7 @@ RSRC_OBJ=rsrc_svcinst.o rsrc_svcuninst.o rsrc_anchorupd.o rsrc_unbound.o \
	+ rsrc_unbound_checkconf.o
	+
	+ ALL_SRC=$(COMMON_SRC) $(UNITTEST_SRC) $(DAEMON_SRC) \
	++ $(FUZZME_SRC) \
	+ $(TESTBOUND_SRC) $(LOCKVERIFY_SRC) $(PKTVIEW_SRC) \
	+ $(MEMSTATS_SRC) $(CHECKCONF_SRC) $(LIBUNBOUND_SRC) $(HOST_SRC) \
	+ $(ASYNCLOOK_SRC) $(STREAMTCP_SRC) $(PERF_SRC) $(DELAYER_SRC) \
	+@@ -259,6 +264,7 @@ ALL_SRC=$(COMMON_SRC) $(UNITTEST_SRC) $(DAEMON_SRC) \
	+ $(PYTHONMOD_SRC) $(PYUNBOUND_SRC) $(WIN_DAEMON_THE_SRC)\
	+ $(SVCINST_SRC) $(SVCUNINST_SRC) $(ANCHORUPD_SRC) $(SLDNS_SRC)
	+ ALL_OBJ=$(COMMON_OBJ) $(UNITTEST_OBJ) $(DAEMON_OBJ) \
	++ $(FUZZME_OBJ) \
	+ $(TESTBOUND_OBJ) $(LOCKVERIFY_OBJ) $(PKTVIEW_OBJ) \
	+ $(MEMSTATS_OBJ) $(CHECKCONF_OBJ) $(LIBUNBOUND_OBJ) $(HOST_OBJ) \
	+ $(ASYNCLOOK_OBJ) $(STREAMTCP_OBJ) $(PERF_OBJ) $(DELAYER_OBJ) \
	+@@ -274,7 +280,7 @@ LINK_LIB=$(LIBTOOL) --tag=CC --mode=link $(CC) $(RUNTIME_PATH) $(CPPFLAGS) $(CFL
	+
	+ all: $(COMMON_OBJ) $(ALLTARGET)
	+
	+-alltargets: unbound$(EXEEXT) unbound-checkconf$(EXEEXT) lib unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup $(WINAPPS) $(PYUNBOUND_TARGET)
	++alltargets: unbound$(EXEEXT) unbound-checkconf$(EXEEXT) lib unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup unbound-fuzzme$(EXEEXT) $(WINAPPS) $(PYUNBOUND_TARGET)
	+
	+ # compat with BSD make, register suffix, and an implicit rule to actualise it.
	+ .SUFFIXES: .lo
	+@@ -325,6 +331,9 @@ libunbound.la: $(LIBUNBOUND_OBJ_LINK)
	+ unbound$(EXEEXT): $(DAEMON_OBJ_LINK) libunbound.la
	+ $(LINK) -o $@ $(DAEMON_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
	+
	++unbound-fuzzme$(EXEEXT): $(FUZZME_OBJ_LINK) libunbound.la
	++ $(LINK) -o $@ $(FUZZME_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
	++
	+ unbound-checkconf$(EXEEXT): $(CHECKCONF_OBJ_LINK) libunbound.la
	+ $(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
	+
	+@@ -447,7 +456,7 @@ util/configparser.c util/configparser.h: $(srcdir)/util/configparser.y
	+
	+ clean:
	+ rm -f .o .d .lo ~ tags
	+- rm -f unbound$(EXEEXT) unbound-checkconf$(EXEEXT) unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup libunbound.la unbound.h
	++ rm -f unbound$(EXEEXT) unbound-checkconf$(EXEEXT) unbound-fuzzme$(EXEEXT) unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup libunbound.la unbound.h
	+ rm -f $(ALL_SRC:.c=.lint)
	+ rm -f _unbound.la libunbound/python/libunbound_wrap.c libunbound/python/unbound.py pythonmod/interface.h pythonmod/unboundmodule.py
	+ rm -rf autom4te.cache .libs build doc/html doc/xml
	+@@ -1183,6 +1192,15 @@ stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(s
	+ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
	+ $(srcdir)/util/rtt.h $(srcdir)/services/authzone.h $(srcdir)/validator/val_kcache.h \
	+ $(srcdir)/validator/val_neg.h
	++unbound-fuzzme.lo unbound-fuzzme.o: $(srcdir)/smallapp/unbound-fuzzme.c \
	++ $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
	++ $(srcdir)/daemon/remote.h $(srcdir)/util/config_file.h \
	++ $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/services/listen_dnsport.h \
	++ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/services/cache/rrset.h \
	++ $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \
	++ $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h \
	++ $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \
	++ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
	+ unbound.lo unbound.o: $(srcdir)/daemon/unbound.c config.h $(srcdir)/util/log.h $(srcdir)/daemon/daemon.h \
	+ $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \
	+ $(srcdir)/daemon/remote.h \
	+diff --git a/smallapp/unbound-fuzzme.c b/smallapp/unbound-fuzzme.c
	+new file mode 100644
	+index 00000000..74ae5204
	+--- /dev/null
	++++ b/smallapp/unbound-fuzzme.c
	+@@ -0,0 +1,38 @@
	++/*
	++ * unbound-fuzzme.c - parse a packet provided on stdin (for fuzzing).
	++ *
	++ */
	++#include "config.h"
	++#include "util/regional.h"
	++#include "util/fptr_wlist.h"
	++#include "sldns/sbuffer.h"
	++
	++#define SZ 10000
	++
	++int main() {
	++ char buffer[SZ];
	++ size_t n_read = fread(buffer, 1, SZ, stdin);
	++ if (n_read == SZ) {
	++ printf("input too big\n");
	++ return 1;
	++ }
	++ sldns_buffer *pkt = sldns_buffer_new(n_read);
	++ sldns_buffer_init_frm_data(pkt, buffer, n_read);
	++
	++ struct regional *region = regional_create();
	++
	++ struct msg_parse* prs;
	++ struct edns_data edns;
	++ prs = (struct msg_parse*)malloc(sizeof(struct msg_parse));
	++ if(!prs) {
	++ printf("out of memory on incoming message\n");
	++ return 1;
	++ }
	++ memset(prs, 0, sizeof(*prs));
	++ memset(&edns, 0, sizeof(edns));
	++ sldns_buffer_set_position(pkt, 0);
	++ if(parse_packet(pkt, prs, region) != LDNS_RCODE_NOERROR) {
	++ printf("parse error\n");
	++ return 1;
	++ }
	++}
	+--
	+2.17.1
	+
	Index: head/contrib/unbound/contrib/unbound.init
	===================================================================
	--- head/contrib/unbound/contrib/unbound.init (revision 349719)
	+++ head/contrib/unbound/contrib/unbound.init (revision 349720)
	@@ -1,139 +1,139 @@
	#!/bin/sh
	#
	# unbound This shell script takes care of starting and stopping
	# unbound (DNS server).
	#
	# chkconfig: - 14 86
	# description: unbound is a Domain Name Server (DNS) \
	# that is used to resolve host names to IP addresses.

	### BEGIN INIT INFO
	# Provides: $named unbound
	# Required-Start: $network $local_fs
	# Required-Stop: $network $local_fs
	# Should-Start: $syslog
	# Should-Stop: $syslog
	# Short-Description: unbound recursive Domain Name Server.
	# Description: unbound is a Domain Name Server (DNS)
	# that is used to resolve host names to IP addresses.
	### END INIT INFO

	# Source function library.
	. /etc/rc.d/init.d/functions

	exec="/usr/sbin/unbound"
	prog="unbound"
	config="/var/unbound/unbound.conf"
	pidfile="/var/unbound/unbound.pid"
	rootdir="/var/unbound"

	[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog

	lockfile=/var/lock/subsys/$prog

	start() {
	[ -x $exec ] \|\| exit 5
	[ -f $config ] \|\| exit 6
	echo -n $"Starting $prog: "

	# setup root jail
	if [ -s /etc/localtime ]; then
	[ -d ${rootdir}/etc ] \|\| mkdir -p ${rootdir}/etc ;
	- if [ ! -e ${rootdir}/etc/localtime ] \|\| /usr/bin/cmp -s /etc/localtime ${rootdir}/etc/localtime; then
	+ if [ ! -e ${rootdir}/etc/localtime ] \|\| ! /usr/bin/cmp -s /etc/localtime ${rootdir}/etc/localtime; then
	cp -fp /etc/localtime ${rootdir}/etc/localtime
	fi;
	fi;
	if [ -s /etc/resolv.conf ]; then
	[ -d ${rootdir}/etc ] \|\| mkdir -p ${rootdir}/etc ;
	- if [ ! -e ${rootdir}/etc/resolv.conf ] \|\| /usr/bin/cmp -s /etc/resolv.conf ${rootdir}/etc/resolv.conf; then
	+ if [ ! -e ${rootdir}/etc/resolv.conf ] \|\| ! /usr/bin/cmp -s /etc/resolv.conf ${rootdir}/etc/resolv.conf; then
	cp -fp /etc/resolv.conf ${rootdir}/etc/resolv.conf
	fi;
	fi;
	if ! egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/log' /proc/mounts; then
	[ -d ${rootdir}/dev ] \|\| mkdir -p ${rootdir}/dev ;
	[ -e ${rootdir}/dev/log ] \|\| touch ${rootdir}/dev/log
	mount --bind -n /dev/log ${rootdir}/dev/log >/dev/null 2>&1;
	fi;
	if ! egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/random' /proc/mounts; then
	[ -d ${rootdir}/dev ] \|\| mkdir -p ${rootdir}/dev ;
	[ -e ${rootdir}/dev/random ] \|\| touch ${rootdir}/dev/random
	mount --bind -n /dev/random ${rootdir}/dev/random >/dev/null 2>&1;
	fi;

	# if not running, start it up here
	daemon $exec
	retval=$?
	echo
	[ $retval -eq 0 ] && touch $lockfile
	return $retval
	}

	stop() {
	echo -n $"Stopping $prog: "
	# stop it here, often "killproc $prog"
	killproc -p $pidfile $prog
	retval=$?
	echo
	[ $retval -eq 0 ] && rm -f $lockfile
	if egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/log' /proc/mounts; then
	umount ${rootdir}/dev/log >/dev/null 2>&1
	fi;
	if egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/random' /proc/mounts; then
	umount ${rootdir}/dev/random >/dev/null 2>&1
	fi;
	return $retval
	}

	restart() {
	stop
	start
	}

	reload() {
	kill -HUP `cat $pidfile`
	}

	force_reload() {
	restart
	}

	rh_status() {
	# run checks to determine if the service is running or use generic status
	status -p $pidfile $prog
	}

	rh_status_q() {
	rh_status -p $pidfile >/dev/null 2>&1
	}

	case "$1" in
	start)
	rh_status_q && exit 0
	$1
	;;
	stop)
	rh_status_q \|\| exit 0
	$1
	;;
	restart)
	$1
	;;
	reload)
	rh_status_q \|\| exit 7
	$1
	;;
	force-reload)
	force_reload
	;;
	status)
	rh_status
	;;
	condrestart\|try-restart)
	rh_status_q \|\| exit 0
	restart
	;;
	*)
	echo $"Usage: $0 {start\|stop\|status\|restart\|condrestart\|try-restart\|reload\|force-reload}"
	exit 2
	esac
	exit $?
	Index: head/contrib/unbound/daemon/daemon.c
	===================================================================
	--- head/contrib/unbound/daemon/daemon.c (revision 349719)
	+++ head/contrib/unbound/daemon/daemon.c (revision 349720)
	@@ -1,825 +1,826 @@
	/*
	* daemon/daemon.c - collection of workers that handles requests.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* The daemon consists of global settings and a number of workers.
	*/

	#include "config.h"
	#ifdef HAVE_OPENSSL_ERR_H
	#include <openssl/err.h>
	#endif

	#ifdef HAVE_OPENSSL_RAND_H
	#include <openssl/rand.h>
	#endif

	#ifdef HAVE_OPENSSL_CONF_H
	#include <openssl/conf.h>
	#endif

	#ifdef HAVE_OPENSSL_ENGINE_H
	#include <openssl/engine.h>
	#endif

	#ifdef HAVE_TIME_H
	#include <time.h>
	#endif
	#include <sys/time.h>

	#ifdef HAVE_NSS
	/* nss3 */
	#include "nss.h"
	#endif

	#include "daemon/daemon.h"
	#include "daemon/worker.h"
	#include "daemon/remote.h"
	#include "daemon/acl_list.h"
	#include "util/log.h"
	#include "util/config_file.h"
	#include "util/data/msgreply.h"
	#include "util/shm_side/shm_main.h"
	#include "util/storage/lookup3.h"
	#include "util/storage/slabhash.h"
	#include "util/tcp_conn_limit.h"
	#include "services/listen_dnsport.h"
	#include "services/cache/rrset.h"
	#include "services/cache/infra.h"
	#include "services/localzone.h"
	#include "services/view.h"
	#include "services/modstack.h"
	#include "services/authzone.h"
	#include "util/module.h"
	#include "util/random.h"
	#include "util/tube.h"
	#include "util/net_help.h"
	#include "sldns/keyraw.h"
	#include "respip/respip.h"
	#include <signal.h>

	#ifdef HAVE_SYSTEMD
	#include <systemd/sd-daemon.h>
	#endif

	/** How many quit requests happened. */
	static int sig_record_quit = 0;
	/** How many reload requests happened. */
	static int sig_record_reload = 0;

	#if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
	/** cleaner ssl memory freeup */
	static void* comp_meth = NULL;
	#endif
	/** remove buffers for parsing and init */
	int ub_c_lex_destroy(void);

	/** used when no other sighandling happens, so we don't die
	* when multiple signals in quick succession are sent to us.
	* @param sig: signal number.
	* @return signal handler return type (void or int).
	*/
	static RETSIGTYPE record_sigh(int sig)
	{
	#ifdef LIBEVENT_SIGNAL_PROBLEM
	/* cannot log, verbose here because locks may be held */
	/* quit on signal, no cleanup and statistics,
	because installed libevent version is not threadsafe */
	exit(0);
	#endif
	switch(sig)
	{
	case SIGTERM:
	#ifdef SIGQUIT
	case SIGQUIT:
	#endif
	#ifdef SIGBREAK
	case SIGBREAK:
	#endif
	case SIGINT:
	sig_record_quit++;
	break;
	#ifdef SIGHUP
	case SIGHUP:
	sig_record_reload++;
	break;
	#endif
	#ifdef SIGPIPE
	case SIGPIPE:
	break;
	#endif
	default:
	/* ignoring signal */
	break;
	}
	}

	/**
	* Signal handling during the time when netevent is disabled.
	* Stores signals to replay later.
	*/
	static void
	signal_handling_record(void)
	{
	if( signal(SIGTERM, record_sigh) == SIG_ERR \|\|
	#ifdef SIGQUIT
	signal(SIGQUIT, record_sigh) == SIG_ERR \|\|
	#endif
	#ifdef SIGBREAK
	signal(SIGBREAK, record_sigh) == SIG_ERR \|\|
	#endif
	#ifdef SIGHUP
	signal(SIGHUP, record_sigh) == SIG_ERR \|\|
	#endif
	#ifdef SIGPIPE
	signal(SIGPIPE, SIG_IGN) == SIG_ERR \|\|
	#endif
	signal(SIGINT, record_sigh) == SIG_ERR
	)
	log_err("install sighandler: %s", strerror(errno));
	}

	/**
	* Replay old signals.
	* @param wrk: worker that handles signals.
	*/
	static void
	signal_handling_playback(struct worker* wrk)
	{
	#ifdef SIGHUP
	if(sig_record_reload)
	worker_sighandler(SIGHUP, wrk);
	#endif
	if(sig_record_quit)
	worker_sighandler(SIGTERM, wrk);
	sig_record_quit = 0;
	sig_record_reload = 0;
	}

	struct daemon*
	daemon_init(void)
	{
	struct daemon* daemon = (struct daemon*)calloc(1,
	sizeof(struct daemon));
	#ifdef USE_WINSOCK
	int r;
	WSADATA wsa_data;
	#endif
	if(!daemon)
	return NULL;
	#ifdef USE_WINSOCK
	r = WSAStartup(MAKEWORD(2,2), &wsa_data);
	if(r != 0) {
	fatal_exit("could not init winsock. WSAStartup: %s",
	wsa_strerror(r));
	}
	#endif /* USE_WINSOCK */
	signal_handling_record();
	checklock_start();
	#ifdef HAVE_SSL
	# ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
	ERR_load_crypto_strings();
	# endif
	#if OPENSSL_VERSION_NUMBER < 0x10100000 \|\| !defined(HAVE_OPENSSL_INIT_SSL)
	ERR_load_SSL_strings();
	#endif
	# ifdef USE_GOST
	(void)sldns_key_EVP_load_gost_id();
	# endif
	# if OPENSSL_VERSION_NUMBER < 0x10100000 \|\| !defined(HAVE_OPENSSL_INIT_CRYPTO)
	OpenSSL_add_all_algorithms();
	# else
	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
	\| OPENSSL_INIT_ADD_ALL_DIGESTS
	\| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
	# endif
	# if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
	/* grab the COMP method ptr because openssl leaks it */
	comp_meth = (void*)SSL_COMP_get_compression_methods();
	# endif
	# if OPENSSL_VERSION_NUMBER < 0x10100000 \|\| !defined(HAVE_OPENSSL_INIT_SSL)
	(void)SSL_library_init();
	# else
	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
	# endif
	# if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
	if(!ub_openssl_lock_init())
	fatal_exit("could not init openssl locks");
	# endif
	#elif defined(HAVE_NSS)
	if(NSS_NoDB_Init(NULL) != SECSuccess)
	fatal_exit("could not init NSS");
	#endif /* HAVE_SSL or HAVE_NSS */
	#ifdef HAVE_TZSET
	/* init timezone info while we are not chrooted yet */
	tzset();
	#endif
	/* open /dev/random if needed */
	ub_systemseed((unsigned)time(NULL)^(unsigned)getpid()^0xe67);
	daemon->need_to_exit = 0;
	modstack_init(&daemon->mods);
	if(!(daemon->env = (struct module_env*)calloc(1,
	sizeof(*daemon->env)))) {
	free(daemon);
	return NULL;
	}
	/* init edns_known_options */
	if(!edns_known_options_init(daemon->env)) {
	free(daemon->env);
	free(daemon);
	return NULL;
	}
	alloc_init(&daemon->superalloc, NULL, 0);
	daemon->acl = acl_list_create();
	if(!daemon->acl) {
	edns_known_options_delete(daemon->env);
	free(daemon->env);
	free(daemon);
	return NULL;
	}
	daemon->tcl = tcl_list_create();
	if(!daemon->tcl) {
	acl_list_delete(daemon->acl);
	edns_known_options_delete(daemon->env);
	free(daemon->env);
	free(daemon);
	return NULL;
	}
	if(gettimeofday(&daemon->time_boot, NULL) < 0)
	log_err("gettimeofday: %s", strerror(errno));
	daemon->time_last_stat = daemon->time_boot;
	if((daemon->env->auth_zones = auth_zones_create()) == 0) {
	acl_list_delete(daemon->acl);
	tcl_list_delete(daemon->tcl);
	edns_known_options_delete(daemon->env);
	free(daemon->env);
	free(daemon);
	return NULL;
	}
	return daemon;
	}

	int
	daemon_open_shared_ports(struct daemon* daemon)
	{
	log_assert(daemon);
	if(daemon->cfg->port != daemon->listening_port) {
	size_t i;
	struct listen_port* p0;
	daemon->reuseport = 0;
	/* free and close old ports */
	if(daemon->ports != NULL) {
	for(i=0; i<daemon->num_ports; i++)
	listening_ports_free(daemon->ports[i]);
	free(daemon->ports);
	daemon->ports = NULL;
	}
	/* see if we want to reuseport */
	#ifdef SO_REUSEPORT
	if(daemon->cfg->so_reuseport && daemon->cfg->num_threads > 0)
	daemon->reuseport = 1;
	#endif
	/* try to use reuseport */
	p0 = listening_ports_open(daemon->cfg, &daemon->reuseport);
	if(!p0) {
	listening_ports_free(p0);
	return 0;
	}
	if(daemon->reuseport) {
	/* reuseport was successful, allocate for it */
	daemon->num_ports = (size_t)daemon->cfg->num_threads;
	} else {
	/* do the normal, singleportslist thing,
	* reuseport not enabled or did not work */
	daemon->num_ports = 1;
	}
	if(!(daemon->ports = (struct listen_port**)calloc(
	daemon->num_ports, sizeof(*daemon->ports)))) {
	listening_ports_free(p0);
	return 0;
	}
	daemon->ports[0] = p0;
	if(daemon->reuseport) {
	/* continue to use reuseport */
	for(i=1; i<daemon->num_ports; i++) {
	if(!(daemon->ports[i]=
	listening_ports_open(daemon->cfg,
	&daemon->reuseport))
	\|\| !daemon->reuseport ) {
	for(i=0; i<daemon->num_ports; i++)
	listening_ports_free(daemon->ports[i]);
	free(daemon->ports);
	daemon->ports = NULL;
	return 0;
	}
	}
	}
	daemon->listening_port = daemon->cfg->port;
	}
	if(!daemon->cfg->remote_control_enable && daemon->rc_port) {
	listening_ports_free(daemon->rc_ports);
	daemon->rc_ports = NULL;
	daemon->rc_port = 0;
	}
	if(daemon->cfg->remote_control_enable &&
	daemon->cfg->control_port != daemon->rc_port) {
	listening_ports_free(daemon->rc_ports);
	if(!(daemon->rc_ports=daemon_remote_open_ports(daemon->cfg)))
	return 0;
	daemon->rc_port = daemon->cfg->control_port;
	}
	return 1;
	}

	/**
	* Setup modules. setup module stack.
	* @param daemon: the daemon
	*/
	static void daemon_setup_modules(struct daemon* daemon)
	{
	daemon->env->cfg = daemon->cfg;
	daemon->env->alloc = &daemon->superalloc;
	daemon->env->worker = NULL;
	daemon->env->need_to_validate = 0; /* set by module init below */
	if(!modstack_setup(&daemon->mods, daemon->cfg->module_conf,
	daemon->env)) {
	fatal_exit("failed to setup modules");
	}
	log_edns_known_options(VERB_ALGO, daemon->env);
	}

	/**
	* Obtain allowed port numbers, concatenate the list, and shuffle them
	* (ready to be handed out to threads).
	* @param daemon: the daemon. Uses rand and cfg.
	* @param shufport: the portlist output.
	* @return number of ports available.
	*/
	static int daemon_get_shufport(struct daemon* daemon, int* shufport)
	{
	int i, n, k, temp;
	int avail = 0;
	for(i=0; i<65536; i++) {
	if(daemon->cfg->outgoing_avail_ports[i]) {
	shufport[avail++] = daemon->cfg->
	outgoing_avail_ports[i];
	}
	}
	if(avail == 0)
	fatal_exit("no ports are permitted for UDP, add "
	"with outgoing-port-permit");
	/* Knuth shuffle */
	n = avail;
	while(--n > 0) {
	k = ub_random_max(daemon->rand, n+1); /* 0<= k<= n */
	temp = shufport[k];
	shufport[k] = shufport[n];
	shufport[n] = temp;
	}
	return avail;
	}

	/**
	* Allocate empty worker structures. With backptr and thread-number,
	* from 0..numthread initialised. Used as user arguments to new threads.
	* Creates the daemon random generator if it does not exist yet.
	* The random generator stays existing between reloads with a unique state.
	* @param daemon: the daemon with (new) config settings.
	*/
	static void
	daemon_create_workers(struct daemon* daemon)
	{
	int i, numport;
	int* shufport;
	log_assert(daemon && daemon->cfg);
	if(!daemon->rand) {
	unsigned int seed = (unsigned int)time(NULL) ^
	(unsigned int)getpid() ^ 0x438;
	daemon->rand = ub_initstate(seed, NULL);
	if(!daemon->rand)
	fatal_exit("could not init random generator");
	hash_set_raninit((uint32_t)ub_random(daemon->rand));
	}
	shufport = (int*)calloc(65536, sizeof(int));
	if(!shufport)
	fatal_exit("out of memory during daemon init");
	numport = daemon_get_shufport(daemon, shufport);
	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);

	daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1);
	if(daemon->reuseport && (int)daemon->num < (int)daemon->num_ports) {
	log_warn("cannot reduce num-threads to %d because so-reuseport "
	"so continuing with %d threads.", (int)daemon->num,
	(int)daemon->num_ports);
	daemon->num = (int)daemon->num_ports;
	}
	daemon->workers = (struct worker**)calloc((size_t)daemon->num,
	sizeof(struct worker*));
	if(!daemon->workers)
	fatal_exit("out of memory during daemon init");
	if(daemon->cfg->dnstap) {
	#ifdef USE_DNSTAP
	daemon->dtenv = dt_create(daemon->cfg->dnstap_socket_path,
	(unsigned int)daemon->num);
	if (!daemon->dtenv)
	fatal_exit("dt_create failed");
	dt_apply_cfg(daemon->dtenv, daemon->cfg);
	#else
	fatal_exit("dnstap enabled in config but not built with dnstap support");
	#endif
	}
	for(i=0; i<daemon->num; i++) {
	if(!(daemon->workers[i] = worker_create(daemon, i,
	shufport+numport*i/daemon->num,
	numport(i+1)/daemon->num - numporti/daemon->num)))
	/* the above is not ports/numthr, due to rounding */
	fatal_exit("could not create worker");
	}
	free(shufport);
	}

	#ifdef THREADS_DISABLED
	/**
	* Close all pipes except for the numbered thread.
	* @param daemon: daemon to close pipes in.
	* @param thr: thread number 0..num-1 of thread to skip.
	*/
	static void close_other_pipes(struct daemon* daemon, int thr)
	{
	int i;
	for(i=0; i<daemon->num; i++)
	if(i!=thr) {
	if(i==0) {
	/* only close read part, need to write stats */
	tube_close_read(daemon->workers[i]->cmd);
	} else {
	/* complete close channel to others */
	tube_delete(daemon->workers[i]->cmd);
	daemon->workers[i]->cmd = NULL;
	}
	}
	}
	#endif /* THREADS_DISABLED */

	/**
	* Function to start one thread.
	* @param arg: user argument.
	* @return: void* user return value could be used for thread_join results.
	*/
	static void*
	thread_start(void* arg)
	{
	struct worker* worker = (struct worker*)arg;
	int port_num = 0;
	log_thread_set(&worker->thread_num);
	ub_thread_blocksigs();
	#ifdef THREADS_DISABLED
	/* close pipe ends used by main */
	tube_close_write(worker->cmd);
	close_other_pipes(worker->daemon, worker->thread_num);
	#endif
	#ifdef SO_REUSEPORT
	if(worker->daemon->cfg->so_reuseport)
	port_num = worker->thread_num % worker->daemon->num_ports;
	else
	port_num = 0;
	#endif
	if(!worker_init(worker, worker->daemon->cfg,
	worker->daemon->ports[port_num], 0))
	fatal_exit("Could not initialize thread");

	worker_work(worker);
	return NULL;
	}

	/**
	* Fork and init the other threads. Main thread returns for special handling.
	* @param daemon: the daemon with other threads to fork.
	*/
	static void
	daemon_start_others(struct daemon* daemon)
	{
	int i;
	log_assert(daemon);
	verbose(VERB_ALGO, "start threads");
	/* skip i=0, is this thread */
	for(i=1; i<daemon->num; i++) {
	ub_thread_create(&daemon->workers[i]->thr_id,
	thread_start, daemon->workers[i]);
	#ifdef THREADS_DISABLED
	/* close pipe end of child */
	tube_close_read(daemon->workers[i]->cmd);
	#endif /* no threads */
	}
	}

	/**
	* Stop the other threads.
	* @param daemon: the daemon with other threads.
	*/
	static void
	daemon_stop_others(struct daemon* daemon)
	{
	int i;
	log_assert(daemon);
	verbose(VERB_ALGO, "stop threads");
	/* skip i=0, is this thread */
	/* use i=0 buffer for sending cmds; because we are #0 */
	for(i=1; i<daemon->num; i++) {
	worker_send_cmd(daemon->workers[i], worker_cmd_quit);
	}
	/* wait for them to quit */
	for(i=1; i<daemon->num; i++) {
	/* join it to make sure its dead */
	verbose(VERB_ALGO, "join %d", i);
	ub_thread_join(daemon->workers[i]->thr_id);
	verbose(VERB_ALGO, "join success %d", i);
	}
	}

	void
	daemon_fork(struct daemon* daemon)
	{
	int have_view_respip_cfg = 0;

	log_assert(daemon);
	if(!(daemon->views = views_create()))
	fatal_exit("Could not create views: out of memory");
	/* create individual views and their localzone/data trees */
	if(!views_apply_cfg(daemon->views, daemon->cfg))
	fatal_exit("Could not set up views");

	if(!acl_list_apply_cfg(daemon->acl, daemon->cfg, daemon->views))
	fatal_exit("Could not setup access control list");
	if(!tcl_list_apply_cfg(daemon->tcl, daemon->cfg))
	fatal_exit("Could not setup TCP connection limits");
	if(daemon->cfg->dnscrypt) {
	#ifdef USE_DNSCRYPT
	daemon->dnscenv = dnsc_create();
	if (!daemon->dnscenv)
	fatal_exit("dnsc_create failed");
	dnsc_apply_cfg(daemon->dnscenv, daemon->cfg);
	#else
	fatal_exit("dnscrypt enabled in config but unbound was not built with "
	"dnscrypt support");
	#endif
	}
	/* create global local_zones */
	if(!(daemon->local_zones = local_zones_create()))
	fatal_exit("Could not create local zones: out of memory");
	if(!local_zones_apply_cfg(daemon->local_zones, daemon->cfg))
	fatal_exit("Could not set up local zones");

	/* process raw response-ip configuration data */
	if(!(daemon->respip_set = respip_set_create()))
	fatal_exit("Could not create response IP set");
	if(!respip_global_apply_cfg(daemon->respip_set, daemon->cfg))
	fatal_exit("Could not set up response IP set");
	if(!respip_views_apply_cfg(daemon->views, daemon->cfg,
	&have_view_respip_cfg))
	fatal_exit("Could not set up per-view response IP sets");
	daemon->use_response_ip = !respip_set_is_empty(daemon->respip_set) \|\|
	have_view_respip_cfg;

	/* read auth zonefiles */
	if(!auth_zones_apply_cfg(daemon->env->auth_zones, daemon->cfg, 1))
	fatal_exit("auth_zones could not be setup");

	/* setup modules */
	daemon_setup_modules(daemon);

	/* response-ip-xxx options don't work as expected without the respip
	* module. To avoid run-time operational surprise we reject such
	* configuration. */
	if(daemon->use_response_ip &&
	modstack_find(&daemon->mods, "respip") < 0)
	fatal_exit("response-ip options require respip module");

	/* first create all the worker structures, so we can pass
	* them to the newly created threads.
	*/
	daemon_create_workers(daemon);

	#if defined(HAVE_EV_LOOP) \|\| defined(HAVE_EV_DEFAULT_LOOP)
	/* in libev the first inited base gets signals */
	if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports[0], 1))
	fatal_exit("Could not initialize main thread");
	#endif

	/* Now create the threads and init the workers.
	* By the way, this is thread #0 (the main thread).
	*/
	daemon_start_others(daemon);

	/* Special handling for the main thread. This is the thread
	* that handles signals and remote control.
	*/
	#if !(defined(HAVE_EV_LOOP) \|\| defined(HAVE_EV_DEFAULT_LOOP))
	/* libevent has the last inited base get signals (or any base) */
	if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports[0], 1))
	fatal_exit("Could not initialize main thread");
	#endif
	signal_handling_playback(daemon->workers[0]);

	if (!shm_main_init(daemon))
	log_warn("SHM has failed");

	/* Start resolver service on main thread. */
	#ifdef HAVE_SYSTEMD
	sd_notify(0, "READY=1");
	#endif
	log_info("start of service (%s).", PACKAGE_STRING);
	worker_work(daemon->workers[0]);
	#ifdef HAVE_SYSTEMD
	if (daemon->workers[0]->need_to_exit)
	sd_notify(0, "STOPPING=1");
	else
	sd_notify(0, "RELOADING=1");
	#endif
	log_info("service stopped (%s).", PACKAGE_STRING);

	/* we exited! a signal happened! Stop other threads */
	daemon_stop_others(daemon);

	/* Shutdown SHM */
	shm_main_shutdown(daemon);

	daemon->need_to_exit = daemon->workers[0]->need_to_exit;
	}

	void
	daemon_cleanup(struct daemon* daemon)
	{
	int i;
	log_assert(daemon);
	/* before stopping main worker, handle signals ourselves, so we
	don't die on multiple reload signals for example. */
	signal_handling_record();
	log_thread_set(NULL);
	/* clean up caches because
	* a) RRset IDs will be recycled after a reload, causing collisions
	* b) validation config can change, thus rrset, msg, keycache clear */
	slabhash_clear(&daemon->env->rrset_cache->table);
	slabhash_clear(daemon->env->msg_cache);
	local_zones_delete(daemon->local_zones);
	daemon->local_zones = NULL;
	respip_set_delete(daemon->respip_set);
	daemon->respip_set = NULL;
	views_delete(daemon->views);
	daemon->views = NULL;
	if(daemon->env->auth_zones)
	auth_zones_cleanup(daemon->env->auth_zones);
	/* key cache is cleared by module desetup during next daemon_fork() */
	daemon_remote_clear(daemon->rc);
	for(i=0; i<daemon->num; i++)
	worker_delete(daemon->workers[i]);
	free(daemon->workers);
	daemon->workers = NULL;
	daemon->num = 0;
	alloc_clear_special(&daemon->superalloc);
	#ifdef USE_DNSTAP
	dt_delete(daemon->dtenv);
	daemon->dtenv = NULL;
	#endif
	#ifdef USE_DNSCRYPT
	dnsc_delete(daemon->dnscenv);
	daemon->dnscenv = NULL;
	#endif
	daemon->cfg = NULL;
	}

	void
	daemon_delete(struct daemon* daemon)
	{
	size_t i;
	if(!daemon)
	return;
	modstack_desetup(&daemon->mods, daemon->env);
	daemon_remote_delete(daemon->rc);
	for(i = 0; i < daemon->num_ports; i++)
	listening_ports_free(daemon->ports[i]);
	free(daemon->ports);
	listening_ports_free(daemon->rc_ports);
	if(daemon->env) {
	slabhash_delete(daemon->env->msg_cache);
	rrset_cache_delete(daemon->env->rrset_cache);
	infra_delete(daemon->env->infra_cache);
	edns_known_options_delete(daemon->env);
	auth_zones_delete(daemon->env->auth_zones);
	}
	ub_randfree(daemon->rand);
	alloc_clear(&daemon->superalloc);
	acl_list_delete(daemon->acl);
	tcl_list_delete(daemon->tcl);
	free(daemon->chroot);
	free(daemon->pidfile);
	free(daemon->env);
	#ifdef HAVE_SSL
	+ listen_sslctx_delete_ticket_keys();
	SSL_CTX_free((SSL_CTX*)daemon->listen_sslctx);
	SSL_CTX_free((SSL_CTX*)daemon->connect_sslctx);
	#endif
	free(daemon);
	/* lex cleanup */
	ub_c_lex_destroy();
	/* libcrypto cleanup */
	#ifdef HAVE_SSL
	# if defined(USE_GOST) && defined(HAVE_LDNS_KEY_EVP_UNLOAD_GOST)
	sldns_key_EVP_unload_gost();
	# endif
	# if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS && HAVE_DECL_SK_SSL_COMP_POP_FREE
	# ifndef S_SPLINT_S
	# if OPENSSL_VERSION_NUMBER < 0x10100000
	sk_SSL_COMP_pop_free(comp_meth, (void(*)())CRYPTO_free);
	# endif
	# endif
	# endif
	# ifdef HAVE_OPENSSL_CONFIG
	EVP_cleanup();
	-# if OPENSSL_VERSION_NUMBER < 0x10100000
	+# if (OPENSSL_VERSION_NUMBER < 0x10100000) && !defined(OPENSSL_NO_ENGINE)
	ENGINE_cleanup();
	# endif
	CONF_modules_free();
	# endif
	# ifdef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
	CRYPTO_cleanup_all_ex_data(); /* safe, no more threads right now */
	# endif
	# ifdef HAVE_ERR_FREE_STRINGS
	ERR_free_strings();
	# endif
	# if OPENSSL_VERSION_NUMBER < 0x10100000
	RAND_cleanup();
	# endif
	# if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
	ub_openssl_lock_delete();
	# endif
	#ifndef HAVE_ARC4RANDOM
	_ARC4_LOCK_DESTROY();
	#endif
	#elif defined(HAVE_NSS)
	NSS_Shutdown();
	#endif /* HAVE_SSL or HAVE_NSS */
	checklock_stop();
	#ifdef USE_WINSOCK
	if(WSACleanup() != 0) {
	log_err("Could not WSACleanup: %s",
	wsa_strerror(WSAGetLastError()));
	}
	#endif
	}

	void daemon_apply_cfg(struct daemon* daemon, struct config_file* cfg)
	{
	daemon->cfg = cfg;
	config_apply(cfg);
	if(!slabhash_is_size(daemon->env->msg_cache, cfg->msg_cache_size,
	cfg->msg_cache_slabs)) {
	slabhash_delete(daemon->env->msg_cache);
	daemon->env->msg_cache = slabhash_create(cfg->msg_cache_slabs,
	HASH_DEFAULT_STARTARRAY, cfg->msg_cache_size,
	msgreply_sizefunc, query_info_compare,
	query_entry_delete, reply_info_delete, NULL);
	if(!daemon->env->msg_cache) {
	fatal_exit("malloc failure updating config settings");
	}
	}
	if((daemon->env->rrset_cache = rrset_cache_adjust(
	daemon->env->rrset_cache, cfg, &daemon->superalloc)) == 0)
	fatal_exit("malloc failure updating config settings");
	if((daemon->env->infra_cache = infra_adjust(daemon->env->infra_cache,
	cfg))==0)
	fatal_exit("malloc failure updating config settings");
	}
	Index: head/contrib/unbound/daemon/remote.c
	===================================================================
	--- head/contrib/unbound/daemon/remote.c (revision 349719)
	+++ head/contrib/unbound/daemon/remote.c (revision 349720)
	@@ -1,3158 +1,3188 @@
	/*
	* daemon/remote.c - remote control for the unbound daemon.
	*
	* Copyright (c) 2008, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains the remote control functionality for the daemon.
	* The remote control can be performed using either the commandline
	* unbound-control tool, or a TLS capable web browser.
	* The channel is secured using TLSv1, and certificates.
	* Both the server and the client(control tool) have their own keys.
	*/
	#include "config.h"
	#ifdef HAVE_OPENSSL_ERR_H
	#include <openssl/err.h>
	#endif
	#ifdef HAVE_OPENSSL_DH_H
	#include <openssl/dh.h>
	#endif
	#ifdef HAVE_OPENSSL_BN_H
	#include <openssl/bn.h>
	#endif

	#include <ctype.h>
	#include "daemon/remote.h"
	#include "daemon/worker.h"
	#include "daemon/daemon.h"
	#include "daemon/stats.h"
	#include "daemon/cachedump.h"
	#include "util/log.h"
	#include "util/config_file.h"
	#include "util/net_help.h"
	#include "util/module.h"
	#include "services/listen_dnsport.h"
	#include "services/cache/rrset.h"
	#include "services/cache/infra.h"
	#include "services/mesh.h"
	#include "services/localzone.h"
	#include "services/authzone.h"
	#include "util/storage/slabhash.h"
	#include "util/fptr_wlist.h"
	#include "util/data/dname.h"
	#include "validator/validator.h"
	#include "validator/val_kcache.h"
	#include "validator/val_kentry.h"
	#include "validator/val_anchor.h"
	#include "iterator/iterator.h"
	#include "iterator/iter_fwd.h"
	#include "iterator/iter_hints.h"
	#include "iterator/iter_delegpt.h"
	#include "services/outbound_list.h"
	#include "services/outside_network.h"
	#include "sldns/str2wire.h"
	#include "sldns/parseutil.h"
	#include "sldns/wire2str.h"
	#include "sldns/sbuffer.h"

	#ifdef HAVE_SYS_TYPES_H
	# include <sys/types.h>
	#endif
	#ifdef HAVE_SYS_STAT_H
	#include <sys/stat.h>
	#endif
	#ifdef HAVE_NETDB_H
	#include <netdb.h>
	#endif

	/* just for portability */
	#ifdef SQ
	#undef SQ
	#endif

	/** what to put on statistics lines between var and value, ": " or "=" */
	#define SQ "="
	/** if true, inhibits a lot of =0 lines from the stats output */
	static const int inhibit_zero = 1;

	/** subtract timers and the values do not overflow or become negative */
	static void
	timeval_subtract(struct timeval* d, const struct timeval* end,
	const struct timeval* start)
	{
	#ifndef S_SPLINT_S
	time_t end_usec = end->tv_usec;
	d->tv_sec = end->tv_sec - start->tv_sec;
	if(end_usec < start->tv_usec) {
	end_usec += 1000000;
	d->tv_sec--;
	}
	d->tv_usec = end_usec - start->tv_usec;
	#endif
	}

	/** divide sum of timers to get average */
	static void
	timeval_divide(struct timeval* avg, const struct timeval* sum, long long d)
	{
	#ifndef S_SPLINT_S
	size_t leftover;
	if(d == 0) {
	avg->tv_sec = 0;
	avg->tv_usec = 0;
	return;
	}
	avg->tv_sec = sum->tv_sec / d;
	avg->tv_usec = sum->tv_usec / d;
	/* handle fraction from seconds divide */
	leftover = sum->tv_sec - avg->tv_sec*d;
	avg->tv_usec += (leftover*1000000)/d;
	#endif
	}

	static int
	remote_setup_ctx(struct daemon_remote* rc, struct config_file* cfg)
	{
	char* s_cert;
	char* s_key;
	rc->ctx = SSL_CTX_new(SSLv23_server_method());
	if(!rc->ctx) {
	log_crypto_err("could not SSL_CTX_new");
	return 0;
	}
	if(!listen_sslctx_setup(rc->ctx)) {
	return 0;
	}

	s_cert = fname_after_chroot(cfg->server_cert_file, cfg, 1);
	s_key = fname_after_chroot(cfg->server_key_file, cfg, 1);
	if(!s_cert \|\| !s_key) {
	log_err("out of memory in remote control fname");
	goto setup_error;
	}
	verbose(VERB_ALGO, "setup SSL certificates");
	if (!SSL_CTX_use_certificate_chain_file(rc->ctx,s_cert)) {
	log_err("Error for server-cert-file: %s", s_cert);
	log_crypto_err("Error in SSL_CTX use_certificate_chain_file");
	goto setup_error;
	}
	if(!SSL_CTX_use_PrivateKey_file(rc->ctx,s_key,SSL_FILETYPE_PEM)) {
	log_err("Error for server-key-file: %s", s_key);
	log_crypto_err("Error in SSL_CTX use_PrivateKey_file");
	goto setup_error;
	}
	if(!SSL_CTX_check_private_key(rc->ctx)) {
	log_err("Error for server-key-file: %s", s_key);
	log_crypto_err("Error in SSL_CTX check_private_key");
	goto setup_error;
	}
	listen_sslctx_setup_2(rc->ctx);
	if(!SSL_CTX_load_verify_locations(rc->ctx, s_cert, NULL)) {
	log_crypto_err("Error setting up SSL_CTX verify locations");
	setup_error:
	free(s_cert);
	free(s_key);
	return 0;
	}
	SSL_CTX_set_client_CA_list(rc->ctx, SSL_load_client_CA_file(s_cert));
	SSL_CTX_set_verify(rc->ctx, SSL_VERIFY_PEER, NULL);
	free(s_cert);
	free(s_key);
	return 1;
	}

	struct daemon_remote*
	daemon_remote_create(struct config_file* cfg)
	{
	struct daemon_remote* rc = (struct daemon_remote*)calloc(1,
	sizeof(*rc));
	if(!rc) {
	log_err("out of memory in daemon_remote_create");
	return NULL;
	}
	rc->max_active = 10;

	if(!cfg->remote_control_enable) {
	rc->ctx = NULL;
	return rc;
	}
	if(options_remote_is_address(cfg) && cfg->control_use_cert) {
	if(!remote_setup_ctx(rc, cfg)) {
	daemon_remote_delete(rc);
	return NULL;
	}
	rc->use_cert = 1;
	} else {
	struct config_strlist* p;
	rc->ctx = NULL;
	rc->use_cert = 0;
	if(!options_remote_is_address(cfg))
	for(p = cfg->control_ifs.first; p; p = p->next) {
	if(p->str && p->str[0] != '/')
	log_warn("control-interface %s is not using TLS, but plain transfer, because first control-interface in config file is a local socket (starts with a /).", p->str);
	}
	}
	return rc;
	}

	void daemon_remote_clear(struct daemon_remote* rc)
	{
	struct rc_state* p, *np;
	if(!rc) return;
	/* but do not close the ports */
	listen_list_delete(rc->accept_list);
	rc->accept_list = NULL;
	/* do close these sockets */
	p = rc->busy_list;
	while(p) {
	np = p->next;
	if(p->ssl)
	SSL_free(p->ssl);
	comm_point_delete(p->c);
	free(p);
	p = np;
	}
	rc->busy_list = NULL;
	rc->active = 0;
	rc->worker = NULL;
	}

	void daemon_remote_delete(struct daemon_remote* rc)
	{
	if(!rc) return;
	daemon_remote_clear(rc);
	if(rc->ctx) {
	SSL_CTX_free(rc->ctx);
	}
	free(rc);
	}

	/**
	* Add and open a new control port
	* @param ip: ip str
	* @param nr: port nr
	* @param list: list head
	* @param noproto_is_err: if lack of protocol support is an error.
	* @param cfg: config with username for chown of unix-sockets.
	* @return false on failure.
	*/
	static int
	add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
	struct config_file* cfg)
	{
	struct addrinfo hints;
	struct addrinfo* res;
	struct listen_port* n;
	int noproto = 0;
	int fd, r;
	char port[15];
	snprintf(port, sizeof(port), "%d", nr);
	port[sizeof(port)-1]=0;
	memset(&hints, 0, sizeof(hints));
	log_assert(ip);

	if(ip[0] == '/') {
	/* This looks like a local socket */
	fd = create_local_accept_sock(ip, &noproto, cfg->use_systemd);
	/*
	* Change socket ownership and permissions so users other
	* than root can access it provided they are in the same
	* group as the user we run as.
	*/
	if(fd != -1) {
	#ifdef HAVE_CHOWN
	if (cfg->username && cfg->username[0] &&
	cfg_uid != (uid_t)-1) {
	if(chown(ip, cfg_uid, cfg_gid) == -1)
	verbose(VERB_QUERY, "cannot chown %u.%u %s: %s",
	(unsigned)cfg_uid, (unsigned)cfg_gid,
	ip, strerror(errno));
	}
	chmod(ip, (mode_t)(S_IRUSR \| S_IWUSR \| S_IRGRP \| S_IWGRP));
	#else
	(void)cfg;
	#endif
	}
	} else {
	hints.ai_socktype = SOCK_STREAM;
	hints.ai_flags = AI_PASSIVE \| AI_NUMERICHOST;
	if((r = getaddrinfo(ip, port, &hints, &res)) != 0 \|\| !res) {
	#ifdef USE_WINSOCK
	if(!noproto_is_err && r == EAI_NONAME) {
	/* tried to lookup the address as name */
	return 1; /* return success, but do nothing */
	}
	#endif /* USE_WINSOCK */
	log_err("control interface %s:%s getaddrinfo: %s %s",
	ip?ip:"default", port, gai_strerror(r),
	#ifdef EAI_SYSTEM
	r==EAI_SYSTEM?(char*)strerror(errno):""
	#else
	""
	#endif
	);
	return 0;
	}

	/* open fd */
	fd = create_tcp_accept_sock(res, 1, &noproto, 0,
	cfg->ip_transparent, 0, cfg->ip_freebind, cfg->use_systemd);
	freeaddrinfo(res);
	}

	if(fd == -1 && noproto) {
	if(!noproto_is_err)
	return 1; /* return success, but do nothing */
	log_err("cannot open control interface %s %d : "
	"protocol not supported", ip, nr);
	return 0;
	}
	if(fd == -1) {
	log_err("cannot open control interface %s %d", ip, nr);
	return 0;
	}

	/* alloc */
	n = (struct listen_port)calloc(1, sizeof(n));
	if(!n) {
	#ifndef USE_WINSOCK
	close(fd);
	#else
	closesocket(fd);
	#endif
	log_err("out of memory");
	return 0;
	}
	n->next = *list;
	*list = n;
	n->fd = fd;
	return 1;
	}

	struct listen_port* daemon_remote_open_ports(struct config_file* cfg)
	{
	struct listen_port* l = NULL;
	log_assert(cfg->remote_control_enable && cfg->control_port);
	if(cfg->control_ifs.first) {
	struct config_strlist* p;
	for(p = cfg->control_ifs.first; p; p = p->next) {
	if(!add_open(p->str, cfg->control_port, &l, 1, cfg)) {
	listening_ports_free(l);
	return NULL;
	}
	}
	} else {
	/* defaults */
	if(cfg->do_ip6 &&
	!add_open("::1", cfg->control_port, &l, 0, cfg)) {
	listening_ports_free(l);
	return NULL;
	}
	if(cfg->do_ip4 &&
	!add_open("127.0.0.1", cfg->control_port, &l, 1, cfg)) {
	listening_ports_free(l);
	return NULL;
	}
	}
	return l;
	}

	/** open accept commpoint */
	static int
	accept_open(struct daemon_remote* rc, int fd)
	{
	struct listen_list* n = (struct listen_list)malloc(sizeof(n));
	if(!n) {
	log_err("out of memory");
	return 0;
	}
	n->next = rc->accept_list;
	rc->accept_list = n;
	/* open commpt */
	n->com = comm_point_create_raw(rc->worker->base, fd, 0,
	&remote_accept_callback, rc);
	if(!n->com)
	return 0;
	/* keep this port open, its fd is kept in the rc portlist */
	n->com->do_not_close = 1;
	return 1;
	}

	int daemon_remote_open_accept(struct daemon_remote* rc,
	struct listen_port* ports, struct worker* worker)
	{
	struct listen_port* p;
	rc->worker = worker;
	for(p = ports; p; p = p->next) {
	if(!accept_open(rc, p->fd)) {
	log_err("could not create accept comm point");
	return 0;
	}
	}
	return 1;
	}

	void daemon_remote_stop_accept(struct daemon_remote* rc)
	{
	struct listen_list* p;
	for(p=rc->accept_list; p; p=p->next) {
	comm_point_stop_listening(p->com);
	}
	}

	void daemon_remote_start_accept(struct daemon_remote* rc)
	{
	struct listen_list* p;
	for(p=rc->accept_list; p; p=p->next) {
	comm_point_start_listening(p->com, -1, -1);
	}
	}

	int remote_accept_callback(struct comm_point* c, void* arg, int err,
	struct comm_reply* ATTR_UNUSED(rep))
	{
	struct daemon_remote* rc = (struct daemon_remote*)arg;
	struct sockaddr_storage addr;
	socklen_t addrlen;
	int newfd;
	struct rc_state* n;
	if(err != NETEVENT_NOERROR) {
	log_err("error %d on remote_accept_callback", err);
	return 0;
	}
	/* perform the accept */
	newfd = comm_point_perform_accept(c, &addr, &addrlen);
	if(newfd == -1)
	return 0;
	/* create new commpoint unless we are servicing already */
	if(rc->active >= rc->max_active) {
	log_warn("drop incoming remote control: too many connections");
	close_exit:
	#ifndef USE_WINSOCK
	close(newfd);
	#else
	closesocket(newfd);
	#endif
	return 0;
	}

	/* setup commpoint to service the remote control command */
	n = (struct rc_state)calloc(1, sizeof(n));
	if(!n) {
	log_err("out of memory");
	goto close_exit;
	}
	n->fd = newfd;
	/* start in reading state */
	n->c = comm_point_create_raw(rc->worker->base, newfd, 0,
	&remote_control_callback, n);
	if(!n->c) {
	log_err("out of memory");
	free(n);
	goto close_exit;
	}
	log_addr(VERB_QUERY, "new control connection from", &addr, addrlen);
	n->c->do_not_close = 0;
	comm_point_stop_listening(n->c);
	comm_point_start_listening(n->c, -1, REMOTE_CONTROL_TCP_TIMEOUT);
	memcpy(&n->c->repinfo.addr, &addr, addrlen);
	n->c->repinfo.addrlen = addrlen;
	if(rc->use_cert) {
	n->shake_state = rc_hs_read;
	n->ssl = SSL_new(rc->ctx);
	if(!n->ssl) {
	log_crypto_err("could not SSL_new");
	comm_point_delete(n->c);
	free(n);
	goto close_exit;
	}
	SSL_set_accept_state(n->ssl);
	(void)SSL_set_mode(n->ssl, SSL_MODE_AUTO_RETRY);
	if(!SSL_set_fd(n->ssl, newfd)) {
	log_crypto_err("could not SSL_set_fd");
	SSL_free(n->ssl);
	comm_point_delete(n->c);
	free(n);
	goto close_exit;
	}
	} else {
	n->ssl = NULL;
	}

	n->rc = rc;
	n->next = rc->busy_list;
	rc->busy_list = n;
	rc->active ++;

	/* perform the first nonblocking read already, for windows,
	* so it can return wouldblock. could be faster too. */
	(void)remote_control_callback(n->c, n, NETEVENT_NOERROR, NULL);
	return 0;
	}

	/** delete from list */
	static void
	state_list_remove_elem(struct rc_state** list, struct comm_point* c)
	{
	while(*list) {
	if( (*list)->c == c) {
	list = (list)->next;
	return;
	}
	list = &(*list)->next;
	}
	}

	/** decrease active count and remove commpoint from busy list */
	static void
	clean_point(struct daemon_remote* rc, struct rc_state* s)
	{
	state_list_remove_elem(&rc->busy_list, s->c);
	rc->active --;
	if(s->ssl) {
	SSL_shutdown(s->ssl);
	SSL_free(s->ssl);
	}
	comm_point_delete(s->c);
	free(s);
	}

	int
	ssl_print_text(RES* res, const char* text)
	{
	int r;
	if(!res)
	return 0;
	if(res->ssl) {
	ERR_clear_error();
	if((r=SSL_write(res->ssl, text, (int)strlen(text))) <= 0) {
	if(SSL_get_error(res->ssl, r) == SSL_ERROR_ZERO_RETURN) {
	verbose(VERB_QUERY, "warning, in SSL_write, peer "
	"closed connection");
	return 0;
	}
	log_crypto_err("could not SSL_write");
	return 0;
	}
	} else {
	size_t at = 0;
	while(at < strlen(text)) {
	ssize_t r = send(res->fd, text+at, strlen(text)-at, 0);
	if(r == -1) {
	if(errno == EAGAIN \|\| errno == EINTR)
	continue;
	#ifndef USE_WINSOCK
	log_err("could not send: %s", strerror(errno));
	#else
	log_err("could not send: %s", wsa_strerror(WSAGetLastError()));
	#endif
	return 0;
	}
	at += r;
	}
	}
	return 1;
	}

	/** print text over the ssl connection */
	static int
	ssl_print_vmsg(RES* ssl, const char* format, va_list args)
	{
	char msg[1024];
	vsnprintf(msg, sizeof(msg), format, args);
	return ssl_print_text(ssl, msg);
	}

	/** printf style printing to the ssl connection */
	int ssl_printf(RES* ssl, const char* format, ...)
	{
	va_list args;
	int ret;
	va_start(args, format);
	ret = ssl_print_vmsg(ssl, format, args);
	va_end(args);
	return ret;
	}

	int
	ssl_read_line(RES* res, char* buf, size_t max)
	{
	int r;
	size_t len = 0;
	if(!res)
	return 0;
	while(len < max) {
	if(res->ssl) {
	ERR_clear_error();
	if((r=SSL_read(res->ssl, buf+len, 1)) <= 0) {
	if(SSL_get_error(res->ssl, r) == SSL_ERROR_ZERO_RETURN) {
	buf[len] = 0;
	return 1;
	}
	log_crypto_err("could not SSL_read");
	return 0;
	}
	} else {
	while(1) {
	ssize_t rr = recv(res->fd, buf+len, 1, 0);
	if(rr <= 0) {
	if(rr == 0) {
	buf[len] = 0;
	return 1;
	}
	if(errno == EINTR \|\| errno == EAGAIN)
	continue;
	#ifndef USE_WINSOCK
	log_err("could not recv: %s", strerror(errno));
	#else
	log_err("could not recv: %s", wsa_strerror(WSAGetLastError()));
	#endif
	return 0;
	}
	break;
	}
	}
	if(buf[len] == '\n') {
	/* return string without \n */
	buf[len] = 0;
	return 1;
	}
	len++;
	}
	buf[max-1] = 0;
	log_err("control line too long (%d): %s", (int)max, buf);
	return 0;
	}

	/** skip whitespace, return new pointer into string */
	static char*
	skipwhite(char* str)
	{
	/* EOS \0 is not a space */
	while( isspace((unsigned char)*str) )
	str++;
	return str;
	}

	/** send the OK to the control client */
	static void send_ok(RES* ssl)
	{
	(void)ssl_printf(ssl, "ok\n");
	}

	/** do the stop command */
	static void
	do_stop(RES* ssl, struct daemon_remote* rc)
	{
	rc->worker->need_to_exit = 1;
	comm_base_exit(rc->worker->base);
	send_ok(ssl);
	}

	/** do the reload command */
	static void
	do_reload(RES* ssl, struct daemon_remote* rc)
	{
	rc->worker->need_to_exit = 0;
	comm_base_exit(rc->worker->base);
	send_ok(ssl);
	}

	/** do the verbosity command */
	static void
	do_verbosity(RES* ssl, char* str)
	{
	int val = atoi(str);
	if(val == 0 && strcmp(str, "0") != 0) {
	ssl_printf(ssl, "error in verbosity number syntax: %s\n", str);
	return;
	}
	verbosity = val;
	send_ok(ssl);
	}

	/** print stats from statinfo */
	static int
	print_stats(RES* ssl, const char* nm, struct ub_stats_info* s)
	{
	struct timeval sumwait, avg;
	if(!ssl_printf(ssl, "%s.num.queries"SQ"%lu\n", nm,
	(unsigned long)s->svr.num_queries)) return 0;
	if(!ssl_printf(ssl, "%s.num.queries_ip_ratelimited"SQ"%lu\n", nm,
	(unsigned long)s->svr.num_queries_ip_ratelimited)) return 0;
	if(!ssl_printf(ssl, "%s.num.cachehits"SQ"%lu\n", nm,
	(unsigned long)(s->svr.num_queries
	- s->svr.num_queries_missed_cache))) return 0;
	if(!ssl_printf(ssl, "%s.num.cachemiss"SQ"%lu\n", nm,
	(unsigned long)s->svr.num_queries_missed_cache)) return 0;
	if(!ssl_printf(ssl, "%s.num.prefetch"SQ"%lu\n", nm,
	(unsigned long)s->svr.num_queries_prefetch)) return 0;
	if(!ssl_printf(ssl, "%s.num.zero_ttl"SQ"%lu\n", nm,
	(unsigned long)s->svr.zero_ttl_responses)) return 0;
	if(!ssl_printf(ssl, "%s.num.recursivereplies"SQ"%lu\n", nm,
	(unsigned long)s->mesh_replies_sent)) return 0;
	#ifdef USE_DNSCRYPT
	if(!ssl_printf(ssl, "%s.num.dnscrypt.crypted"SQ"%lu\n", nm,
	(unsigned long)s->svr.num_query_dnscrypt_crypted)) return 0;
	if(!ssl_printf(ssl, "%s.num.dnscrypt.cert"SQ"%lu\n", nm,
	(unsigned long)s->svr.num_query_dnscrypt_cert)) return 0;
	if(!ssl_printf(ssl, "%s.num.dnscrypt.cleartext"SQ"%lu\n", nm,
	(unsigned long)s->svr.num_query_dnscrypt_cleartext)) return 0;
	if(!ssl_printf(ssl, "%s.num.dnscrypt.malformed"SQ"%lu\n", nm,
	(unsigned long)s->svr.num_query_dnscrypt_crypted_malformed)) return 0;
	#endif
	if(!ssl_printf(ssl, "%s.requestlist.avg"SQ"%g\n", nm,
	(s->svr.num_queries_missed_cache+s->svr.num_queries_prefetch)?
	(double)s->svr.sum_query_list_size/
	(double)(s->svr.num_queries_missed_cache+
	s->svr.num_queries_prefetch) : 0.0)) return 0;
	if(!ssl_printf(ssl, "%s.requestlist.max"SQ"%lu\n", nm,
	(unsigned long)s->svr.max_query_list_size)) return 0;
	if(!ssl_printf(ssl, "%s.requestlist.overwritten"SQ"%lu\n", nm,
	(unsigned long)s->mesh_jostled)) return 0;
	if(!ssl_printf(ssl, "%s.requestlist.exceeded"SQ"%lu\n", nm,
	(unsigned long)s->mesh_dropped)) return 0;
	if(!ssl_printf(ssl, "%s.requestlist.current.all"SQ"%lu\n", nm,
	(unsigned long)s->mesh_num_states)) return 0;
	if(!ssl_printf(ssl, "%s.requestlist.current.user"SQ"%lu\n", nm,
	(unsigned long)s->mesh_num_reply_states)) return 0;
	#ifndef S_SPLINT_S
	sumwait.tv_sec = s->mesh_replies_sum_wait_sec;
	sumwait.tv_usec = s->mesh_replies_sum_wait_usec;
	#endif
	timeval_divide(&avg, &sumwait, s->mesh_replies_sent);
	if(!ssl_printf(ssl, "%s.recursion.time.avg"SQ ARG_LL "d.%6.6d\n", nm,
	(long long)avg.tv_sec, (int)avg.tv_usec)) return 0;
	if(!ssl_printf(ssl, "%s.recursion.time.median"SQ"%g\n", nm,
	s->mesh_time_median)) return 0;
	if(!ssl_printf(ssl, "%s.tcpusage"SQ"%lu\n", nm,
	(unsigned long)s->svr.tcp_accept_usage)) return 0;
	return 1;
	}

	/** print stats for one thread */
	static int
	print_thread_stats(RES* ssl, int i, struct ub_stats_info* s)
	{
	char nm[32];
	snprintf(nm, sizeof(nm), "thread%d", i);
	nm[sizeof(nm)-1]=0;
	return print_stats(ssl, nm, s);
	}

	/** print long number */
	static int
	print_longnum(RES* ssl, const char* desc, size_t x)
	{
	if(x > 102410241024) {
	/* more than a Gb */
	size_t front = x / (size_t)1000000;
	size_t back = x % (size_t)1000000;
	return ssl_printf(ssl, "%s%u%6.6u\n", desc,
	(unsigned)front, (unsigned)back);
	} else {
	return ssl_printf(ssl, "%s%lu\n", desc, (unsigned long)x);
	}
	}

	/** print mem stats */
	static int
	-print_mem(RES* ssl, struct worker* worker, struct daemon* daemon)
	+print_mem(RES* ssl, struct worker* worker, struct daemon* daemon,
	+ struct ub_stats_info* s)
	{
	size_t msg, rrset, val, iter, respip;
	#ifdef CLIENT_SUBNET
	size_t subnet = 0;
	#endif /* CLIENT_SUBNET */
	#ifdef USE_IPSECMOD
	size_t ipsecmod = 0;
	#endif /* USE_IPSECMOD */
	#ifdef USE_DNSCRYPT
	size_t dnscrypt_shared_secret = 0;
	size_t dnscrypt_nonce = 0;
	#endif /* USE_DNSCRYPT */
	msg = slabhash_get_mem(daemon->env->msg_cache);
	rrset = slabhash_get_mem(&daemon->env->rrset_cache->table);
	val = mod_get_mem(&worker->env, "validator");
	iter = mod_get_mem(&worker->env, "iterator");
	respip = mod_get_mem(&worker->env, "respip");
	#ifdef CLIENT_SUBNET
	subnet = mod_get_mem(&worker->env, "subnet");
	#endif /* CLIENT_SUBNET */
	#ifdef USE_IPSECMOD
	ipsecmod = mod_get_mem(&worker->env, "ipsecmod");
	#endif /* USE_IPSECMOD */
	#ifdef USE_DNSCRYPT
	if(daemon->dnscenv) {
	dnscrypt_shared_secret = slabhash_get_mem(
	daemon->dnscenv->shared_secrets_cache);
	dnscrypt_nonce = slabhash_get_mem(daemon->dnscenv->nonces_cache);
	}
	#endif /* USE_DNSCRYPT */

	if(!print_longnum(ssl, "mem.cache.rrset"SQ, rrset))
	return 0;
	if(!print_longnum(ssl, "mem.cache.message"SQ, msg))
	return 0;
	if(!print_longnum(ssl, "mem.mod.iterator"SQ, iter))
	return 0;
	if(!print_longnum(ssl, "mem.mod.validator"SQ, val))
	return 0;
	if(!print_longnum(ssl, "mem.mod.respip"SQ, respip))
	return 0;
	#ifdef CLIENT_SUBNET
	if(!print_longnum(ssl, "mem.mod.subnet"SQ, subnet))
	return 0;
	#endif /* CLIENT_SUBNET */
	#ifdef USE_IPSECMOD
	if(!print_longnum(ssl, "mem.mod.ipsecmod"SQ, ipsecmod))
	return 0;
	#endif /* USE_IPSECMOD */
	#ifdef USE_DNSCRYPT
	if(!print_longnum(ssl, "mem.cache.dnscrypt_shared_secret"SQ,
	dnscrypt_shared_secret))
	return 0;
	if(!print_longnum(ssl, "mem.cache.dnscrypt_nonce"SQ,
	dnscrypt_nonce))
	return 0;
	#endif /* USE_DNSCRYPT */
	+ if(!print_longnum(ssl, "mem.streamwait"SQ,
	+ (size_t)s->svr.mem_stream_wait))
	+ return 0;
	return 1;
	}

	/** print uptime stats */
	static int
	print_uptime(RES* ssl, struct worker* worker, int reset)
	{
	struct timeval now = *worker->env.now_tv;
	struct timeval up, dt;
	timeval_subtract(&up, &now, &worker->daemon->time_boot);
	timeval_subtract(&dt, &now, &worker->daemon->time_last_stat);
	if(reset)
	worker->daemon->time_last_stat = now;
	if(!ssl_printf(ssl, "time.now"SQ ARG_LL "d.%6.6d\n",
	(long long)now.tv_sec, (unsigned)now.tv_usec)) return 0;
	if(!ssl_printf(ssl, "time.up"SQ ARG_LL "d.%6.6d\n",
	(long long)up.tv_sec, (unsigned)up.tv_usec)) return 0;
	if(!ssl_printf(ssl, "time.elapsed"SQ ARG_LL "d.%6.6d\n",
	(long long)dt.tv_sec, (unsigned)dt.tv_usec)) return 0;
	return 1;
	}

	/** print extended histogram */
	static int
	print_hist(RES* ssl, struct ub_stats_info* s)
	{
	struct timehist* hist;
	size_t i;
	hist = timehist_setup();
	if(!hist) {
	log_err("out of memory");
	return 0;
	}
	timehist_import(hist, s->svr.hist, NUM_BUCKETS_HIST);
	for(i=0; i<hist->num; i++) {
	if(!ssl_printf(ssl,
	"histogram.%6.6d.%6.6d.to.%6.6d.%6.6d=%lu\n",
	(int)hist->buckets[i].lower.tv_sec,
	(int)hist->buckets[i].lower.tv_usec,
	(int)hist->buckets[i].upper.tv_sec,
	(int)hist->buckets[i].upper.tv_usec,
	(unsigned long)hist->buckets[i].count)) {
	timehist_delete(hist);
	return 0;
	}
	}
	timehist_delete(hist);
	return 1;
	}

	/** print extended stats */
	static int
	print_ext(RES* ssl, struct ub_stats_info* s)
	{
	int i;
	char nm[16];
	const sldns_rr_descriptor* desc;
	const sldns_lookup_table* lt;
	/* TYPE */
	for(i=0; i<UB_STATS_QTYPE_NUM; i++) {
	if(inhibit_zero && s->svr.qtype[i] == 0)
	continue;
	desc = sldns_rr_descript((uint16_t)i);
	if(desc && desc->_name) {
	snprintf(nm, sizeof(nm), "%s", desc->_name);
	} else if (i == LDNS_RR_TYPE_IXFR) {
	snprintf(nm, sizeof(nm), "IXFR");
	} else if (i == LDNS_RR_TYPE_AXFR) {
	snprintf(nm, sizeof(nm), "AXFR");
	} else if (i == LDNS_RR_TYPE_MAILA) {
	snprintf(nm, sizeof(nm), "MAILA");
	} else if (i == LDNS_RR_TYPE_MAILB) {
	snprintf(nm, sizeof(nm), "MAILB");
	} else if (i == LDNS_RR_TYPE_ANY) {
	snprintf(nm, sizeof(nm), "ANY");
	} else {
	snprintf(nm, sizeof(nm), "TYPE%d", i);
	}
	if(!ssl_printf(ssl, "num.query.type.%s"SQ"%lu\n",
	nm, (unsigned long)s->svr.qtype[i])) return 0;
	}
	if(!inhibit_zero \|\| s->svr.qtype_big) {
	if(!ssl_printf(ssl, "num.query.type.other"SQ"%lu\n",
	(unsigned long)s->svr.qtype_big)) return 0;
	}
	/* CLASS */
	for(i=0; i<UB_STATS_QCLASS_NUM; i++) {
	if(inhibit_zero && s->svr.qclass[i] == 0)
	continue;
	lt = sldns_lookup_by_id(sldns_rr_classes, i);
	if(lt && lt->name) {
	snprintf(nm, sizeof(nm), "%s", lt->name);
	} else {
	snprintf(nm, sizeof(nm), "CLASS%d", i);
	}
	if(!ssl_printf(ssl, "num.query.class.%s"SQ"%lu\n",
	nm, (unsigned long)s->svr.qclass[i])) return 0;
	}
	if(!inhibit_zero \|\| s->svr.qclass_big) {
	if(!ssl_printf(ssl, "num.query.class.other"SQ"%lu\n",
	(unsigned long)s->svr.qclass_big)) return 0;
	}
	/* OPCODE */
	for(i=0; i<UB_STATS_OPCODE_NUM; i++) {
	if(inhibit_zero && s->svr.qopcode[i] == 0)
	continue;
	lt = sldns_lookup_by_id(sldns_opcodes, i);
	if(lt && lt->name) {
	snprintf(nm, sizeof(nm), "%s", lt->name);
	} else {
	snprintf(nm, sizeof(nm), "OPCODE%d", i);
	}
	if(!ssl_printf(ssl, "num.query.opcode.%s"SQ"%lu\n",
	nm, (unsigned long)s->svr.qopcode[i])) return 0;
	}
	/* transport */
	if(!ssl_printf(ssl, "num.query.tcp"SQ"%lu\n",
	(unsigned long)s->svr.qtcp)) return 0;
	if(!ssl_printf(ssl, "num.query.tcpout"SQ"%lu\n",
	(unsigned long)s->svr.qtcp_outgoing)) return 0;
	if(!ssl_printf(ssl, "num.query.tls"SQ"%lu\n",
	(unsigned long)s->svr.qtls)) return 0;
	+ if(!ssl_printf(ssl, "num.query.tls.resume"SQ"%lu\n",
	+ (unsigned long)s->svr.qtls_resume)) return 0;
	if(!ssl_printf(ssl, "num.query.ipv6"SQ"%lu\n",
	(unsigned long)s->svr.qipv6)) return 0;
	/* flags */
	if(!ssl_printf(ssl, "num.query.flags.QR"SQ"%lu\n",
	(unsigned long)s->svr.qbit_QR)) return 0;
	if(!ssl_printf(ssl, "num.query.flags.AA"SQ"%lu\n",
	(unsigned long)s->svr.qbit_AA)) return 0;
	if(!ssl_printf(ssl, "num.query.flags.TC"SQ"%lu\n",
	(unsigned long)s->svr.qbit_TC)) return 0;
	if(!ssl_printf(ssl, "num.query.flags.RD"SQ"%lu\n",
	(unsigned long)s->svr.qbit_RD)) return 0;
	if(!ssl_printf(ssl, "num.query.flags.RA"SQ"%lu\n",
	(unsigned long)s->svr.qbit_RA)) return 0;
	if(!ssl_printf(ssl, "num.query.flags.Z"SQ"%lu\n",
	(unsigned long)s->svr.qbit_Z)) return 0;
	if(!ssl_printf(ssl, "num.query.flags.AD"SQ"%lu\n",
	(unsigned long)s->svr.qbit_AD)) return 0;
	if(!ssl_printf(ssl, "num.query.flags.CD"SQ"%lu\n",
	(unsigned long)s->svr.qbit_CD)) return 0;
	if(!ssl_printf(ssl, "num.query.edns.present"SQ"%lu\n",
	(unsigned long)s->svr.qEDNS)) return 0;
	if(!ssl_printf(ssl, "num.query.edns.DO"SQ"%lu\n",
	(unsigned long)s->svr.qEDNS_DO)) return 0;

	/* RCODE */
	for(i=0; i<UB_STATS_RCODE_NUM; i++) {
	/* Always include RCODEs 0-5 */
	if(inhibit_zero && i > LDNS_RCODE_REFUSED && s->svr.ans_rcode[i] == 0)
	continue;
	lt = sldns_lookup_by_id(sldns_rcodes, i);
	if(lt && lt->name) {
	snprintf(nm, sizeof(nm), "%s", lt->name);
	} else {
	snprintf(nm, sizeof(nm), "RCODE%d", i);
	}
	if(!ssl_printf(ssl, "num.answer.rcode.%s"SQ"%lu\n",
	nm, (unsigned long)s->svr.ans_rcode[i])) return 0;
	}
	if(!inhibit_zero \|\| s->svr.ans_rcode_nodata) {
	if(!ssl_printf(ssl, "num.answer.rcode.nodata"SQ"%lu\n",
	(unsigned long)s->svr.ans_rcode_nodata)) return 0;
	}
	/* iteration */
	if(!ssl_printf(ssl, "num.query.ratelimited"SQ"%lu\n",
	(unsigned long)s->svr.queries_ratelimited)) return 0;
	/* validation */
	if(!ssl_printf(ssl, "num.answer.secure"SQ"%lu\n",
	(unsigned long)s->svr.ans_secure)) return 0;
	if(!ssl_printf(ssl, "num.answer.bogus"SQ"%lu\n",
	(unsigned long)s->svr.ans_bogus)) return 0;
	if(!ssl_printf(ssl, "num.rrset.bogus"SQ"%lu\n",
	(unsigned long)s->svr.rrset_bogus)) return 0;
	if(!ssl_printf(ssl, "num.query.aggressive.NOERROR"SQ"%lu\n",
	(unsigned long)s->svr.num_neg_cache_noerror)) return 0;
	if(!ssl_printf(ssl, "num.query.aggressive.NXDOMAIN"SQ"%lu\n",
	(unsigned long)s->svr.num_neg_cache_nxdomain)) return 0;
	/* threat detection */
	if(!ssl_printf(ssl, "unwanted.queries"SQ"%lu\n",
	(unsigned long)s->svr.unwanted_queries)) return 0;
	if(!ssl_printf(ssl, "unwanted.replies"SQ"%lu\n",
	(unsigned long)s->svr.unwanted_replies)) return 0;
	/* cache counts */
	if(!ssl_printf(ssl, "msg.cache.count"SQ"%u\n",
	(unsigned)s->svr.msg_cache_count)) return 0;
	if(!ssl_printf(ssl, "rrset.cache.count"SQ"%u\n",
	(unsigned)s->svr.rrset_cache_count)) return 0;
	if(!ssl_printf(ssl, "infra.cache.count"SQ"%u\n",
	(unsigned)s->svr.infra_cache_count)) return 0;
	if(!ssl_printf(ssl, "key.cache.count"SQ"%u\n",
	(unsigned)s->svr.key_cache_count)) return 0;
	#ifdef USE_DNSCRYPT
	if(!ssl_printf(ssl, "dnscrypt_shared_secret.cache.count"SQ"%u\n",
	(unsigned)s->svr.shared_secret_cache_count)) return 0;
	if(!ssl_printf(ssl, "dnscrypt_nonce.cache.count"SQ"%u\n",
	(unsigned)s->svr.nonce_cache_count)) return 0;
	if(!ssl_printf(ssl, "num.query.dnscrypt.shared_secret.cachemiss"SQ"%lu\n",
	(unsigned long)s->svr.num_query_dnscrypt_secret_missed_cache)) return 0;
	if(!ssl_printf(ssl, "num.query.dnscrypt.replay"SQ"%lu\n",
	(unsigned long)s->svr.num_query_dnscrypt_replay)) return 0;
	#endif /* USE_DNSCRYPT */
	if(!ssl_printf(ssl, "num.query.authzone.up"SQ"%lu\n",
	(unsigned long)s->svr.num_query_authzone_up)) return 0;
	if(!ssl_printf(ssl, "num.query.authzone.down"SQ"%lu\n",
	(unsigned long)s->svr.num_query_authzone_down)) return 0;
	#ifdef CLIENT_SUBNET
	if(!ssl_printf(ssl, "num.query.subnet"SQ"%lu\n",
	(unsigned long)s->svr.num_query_subnet)) return 0;
	if(!ssl_printf(ssl, "num.query.subnet_cache"SQ"%lu\n",
	(unsigned long)s->svr.num_query_subnet_cache)) return 0;
	#endif /* CLIENT_SUBNET */
	return 1;
	}

	/** do the stats command */
	static void
	do_stats(RES* ssl, struct daemon_remote* rc, int reset)
	{
	struct daemon* daemon = rc->worker->daemon;
	struct ub_stats_info total;
	struct ub_stats_info s;
	int i;
	memset(&total, 0, sizeof(total));
	log_assert(daemon->num > 0);
	/* gather all thread statistics in one place */
	for(i=0; i<daemon->num; i++) {
	server_stats_obtain(rc->worker, daemon->workers[i], &s, reset);
	if(!print_thread_stats(ssl, i, &s))
	return;
	if(i == 0)
	total = s;
	else server_stats_add(&total, &s);
	}
	/* print the thread statistics */
	total.mesh_time_median /= (double)daemon->num;
	if(!print_stats(ssl, "total", &total))
	return;
	if(!print_uptime(ssl, rc->worker, reset))
	return;
	if(daemon->cfg->stat_extended) {
	- if(!print_mem(ssl, rc->worker, daemon))
	+ if(!print_mem(ssl, rc->worker, daemon, &total))
	return;
	if(!print_hist(ssl, &total))
	return;
	if(!print_ext(ssl, &total))
	return;
	}
	}

	/** parse commandline argument domain name */
	static int
	parse_arg_name(RES* ssl, char* str, uint8_t** res, size_t* len, int* labs)
	{
	uint8_t nm[LDNS_MAX_DOMAINLEN+1];
	size_t nmlen = sizeof(nm);
	int status;
	*res = NULL;
	*len = 0;
	*labs = 0;
	status = sldns_str2wire_dname_buf(str, nm, &nmlen);
	if(status != 0) {
	ssl_printf(ssl, "error cannot parse name %s at %d: %s\n", str,
	LDNS_WIREPARSE_OFFSET(status),
	sldns_get_errorstr_parse(status));
	return 0;
	}
	*res = memdup(nm, nmlen);
	if(!*res) {
	ssl_printf(ssl, "error out of memory\n");
	return 0;
	}
	labs = dname_count_size_labels(res, len);
	return 1;
	}

	/** find second argument, modifies string */
	static int
	find_arg2(RES* ssl, char* arg, char** arg2)
	{
	char* as = strchr(arg, ' ');
	char* at = strchr(arg, '\t');
	if(as && at) {
	if(at < as)
	as = at;
	as[0]=0;
	*arg2 = skipwhite(as+1);
	} else if(as) {
	as[0]=0;
	*arg2 = skipwhite(as+1);
	} else if(at) {
	at[0]=0;
	*arg2 = skipwhite(at+1);
	} else {
	ssl_printf(ssl, "error could not find next argument "
	"after %s\n", arg);
	return 0;
	}
	return 1;
	}

	/** Add a new zone */
	static int
	perform_zone_add(RES* ssl, struct local_zones* zones, char* arg)
	{
	uint8_t* nm;
	int nmlabs;
	size_t nmlen;
	char* arg2;
	enum localzone_type t;
	struct local_zone* z;
	if(!find_arg2(ssl, arg, &arg2))
	return 0;
	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
	return 0;
	if(!local_zone_str2type(arg2, &t)) {
	ssl_printf(ssl, "error not a zone type. %s\n", arg2);
	free(nm);
	return 0;
	}
	lock_rw_wrlock(&zones->lock);
	if((z=local_zones_find(zones, nm, nmlen,
	nmlabs, LDNS_RR_CLASS_IN))) {
	/* already present in tree */
	lock_rw_wrlock(&z->lock);
	z->type = t; /* update type anyway */
	lock_rw_unlock(&z->lock);
	free(nm);
	lock_rw_unlock(&zones->lock);
	return 1;
	}
	if(!local_zones_add_zone(zones, nm, nmlen,
	nmlabs, LDNS_RR_CLASS_IN, t)) {
	lock_rw_unlock(&zones->lock);
	ssl_printf(ssl, "error out of memory\n");
	return 0;
	}
	lock_rw_unlock(&zones->lock);
	return 1;
	}

	/** Do the local_zone command */
	static void
	do_zone_add(RES* ssl, struct local_zones* zones, char* arg)
	{
	if(!perform_zone_add(ssl, zones, arg))
	return;
	send_ok(ssl);
	}

	/** Do the local_zones command */
	static void
	do_zones_add(RES* ssl, struct local_zones* zones)
	{
	char buf[2048];
	int num = 0;
	while(ssl_read_line(ssl, buf, sizeof(buf))) {
	if(buf[0] == 0x04 && buf[1] == 0)
	break; /* end of transmission */
	if(!perform_zone_add(ssl, zones, buf)) {
	if(!ssl_printf(ssl, "error for input line: %s\n", buf))
	return;
	}
	else
	num++;
	}
	(void)ssl_printf(ssl, "added %d zones\n", num);
	}

	/** Remove a zone */
	static int
	perform_zone_remove(RES* ssl, struct local_zones* zones, char* arg)
	{
	uint8_t* nm;
	int nmlabs;
	size_t nmlen;
	struct local_zone* z;
	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
	return 0;
	lock_rw_wrlock(&zones->lock);
	if((z=local_zones_find(zones, nm, nmlen,
	nmlabs, LDNS_RR_CLASS_IN))) {
	/* present in tree */
	local_zones_del_zone(zones, z);
	}
	lock_rw_unlock(&zones->lock);
	free(nm);
	return 1;
	}

	/** Do the local_zone_remove command */
	static void
	do_zone_remove(RES* ssl, struct local_zones* zones, char* arg)
	{
	if(!perform_zone_remove(ssl, zones, arg))
	return;
	send_ok(ssl);
	}

	/** Do the local_zones_remove command */
	static void
	do_zones_remove(RES* ssl, struct local_zones* zones)
	{
	char buf[2048];
	int num = 0;
	while(ssl_read_line(ssl, buf, sizeof(buf))) {
	if(buf[0] == 0x04 && buf[1] == 0)
	break; /* end of transmission */
	if(!perform_zone_remove(ssl, zones, buf)) {
	if(!ssl_printf(ssl, "error for input line: %s\n", buf))
	return;
	}
	else
	num++;
	}
	(void)ssl_printf(ssl, "removed %d zones\n", num);
	}

	/** Add new RR data */
	static int
	perform_data_add(RES* ssl, struct local_zones* zones, char* arg)
	{
	if(!local_zones_add_RR(zones, arg)) {
	ssl_printf(ssl,"error in syntax or out of memory, %s\n", arg);
	return 0;
	}
	return 1;
	}

	/** Do the local_data command */
	static void
	do_data_add(RES* ssl, struct local_zones* zones, char* arg)
	{
	if(!perform_data_add(ssl, zones, arg))
	return;
	send_ok(ssl);
	}

	/** Do the local_datas command */
	static void
	do_datas_add(RES* ssl, struct local_zones* zones)
	{
	char buf[2048];
	int num = 0;
	while(ssl_read_line(ssl, buf, sizeof(buf))) {
	if(buf[0] == 0x04 && buf[1] == 0)
	break; /* end of transmission */
	if(!perform_data_add(ssl, zones, buf)) {
	if(!ssl_printf(ssl, "error for input line: %s\n", buf))
	return;
	}
	else
	num++;
	}
	(void)ssl_printf(ssl, "added %d datas\n", num);
	}

	/** Remove RR data */
	static int
	perform_data_remove(RES* ssl, struct local_zones* zones, char* arg)
	{
	uint8_t* nm;
	int nmlabs;
	size_t nmlen;
	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
	return 0;
	local_zones_del_data(zones, nm,
	nmlen, nmlabs, LDNS_RR_CLASS_IN);
	free(nm);
	return 1;
	}

	/** Do the local_data_remove command */
	static void
	do_data_remove(RES* ssl, struct local_zones* zones, char* arg)
	{
	if(!perform_data_remove(ssl, zones, arg))
	return;
	send_ok(ssl);
	}

	/** Do the local_datas_remove command */
	static void
	do_datas_remove(RES* ssl, struct local_zones* zones)
	{
	char buf[2048];
	int num = 0;
	while(ssl_read_line(ssl, buf, sizeof(buf))) {
	if(buf[0] == 0x04 && buf[1] == 0)
	break; /* end of transmission */
	if(!perform_data_remove(ssl, zones, buf)) {
	if(!ssl_printf(ssl, "error for input line: %s\n", buf))
	return;
	}
	else
	num++;
	}
	(void)ssl_printf(ssl, "removed %d datas\n", num);
	}

	/** Add a new zone to view */
	static void
	do_view_zone_add(RES* ssl, struct worker* worker, char* arg)
	{
	char* arg2;
	struct view* v;
	if(!find_arg2(ssl, arg, &arg2))
	return;
	v = views_find_view(worker->daemon->views,
	arg, 1 /* get write lock*/);
	if(!v) {
	ssl_printf(ssl,"no view with name: %s\n", arg);
	return;
	}
	if(!v->local_zones) {
	if(!(v->local_zones = local_zones_create())){
	lock_rw_unlock(&v->lock);
	ssl_printf(ssl,"error out of memory\n");
	return;
	}
	if(!v->isfirst) {
	/* Global local-zone is not used for this view,
	* therefore add defaults to this view-specic
	* local-zone. */
	struct config_file lz_cfg;
	memset(&lz_cfg, 0, sizeof(lz_cfg));
	local_zone_enter_defaults(v->local_zones, &lz_cfg);
	}
	}
	do_zone_add(ssl, v->local_zones, arg2);
	lock_rw_unlock(&v->lock);
	}

	/** Remove a zone from view */
	static void
	do_view_zone_remove(RES* ssl, struct worker* worker, char* arg)
	{
	char* arg2;
	struct view* v;
	if(!find_arg2(ssl, arg, &arg2))
	return;
	v = views_find_view(worker->daemon->views,
	arg, 1 /* get write lock*/);
	if(!v) {
	ssl_printf(ssl,"no view with name: %s\n", arg);
	return;
	}
	if(!v->local_zones) {
	lock_rw_unlock(&v->lock);
	send_ok(ssl);
	return;
	}
	do_zone_remove(ssl, v->local_zones, arg2);
	lock_rw_unlock(&v->lock);
	}

	/** Add new RR data to view */
	static void
	do_view_data_add(RES* ssl, struct worker* worker, char* arg)
	{
	char* arg2;
	struct view* v;
	if(!find_arg2(ssl, arg, &arg2))
	return;
	v = views_find_view(worker->daemon->views,
	arg, 1 /* get write lock*/);
	if(!v) {
	ssl_printf(ssl,"no view with name: %s\n", arg);
	return;
	}
	if(!v->local_zones) {
	if(!(v->local_zones = local_zones_create())){
	lock_rw_unlock(&v->lock);
	ssl_printf(ssl,"error out of memory\n");
	return;
	}
	}
	do_data_add(ssl, v->local_zones, arg2);
	lock_rw_unlock(&v->lock);
	}

	+/** Add new RR data from stdin to view */
	+static void
	+do_view_datas_add(RES* ssl, struct worker* worker, char* arg)
	+{
	+ struct view* v;
	+ v = views_find_view(worker->daemon->views,
	+ arg, 1 /* get write lock*/);
	+ if(!v) {
	+ ssl_printf(ssl,"no view with name: %s\n", arg);
	+ return;
	+ }
	+ if(!v->local_zones) {
	+ if(!(v->local_zones = local_zones_create())){
	+ lock_rw_unlock(&v->lock);
	+ ssl_printf(ssl,"error out of memory\n");
	+ return;
	+ }
	+ }
	+ do_datas_add(ssl, v->local_zones);
	+ lock_rw_unlock(&v->lock);
	+}
	+
	/** Remove RR data from view */
	static void
	do_view_data_remove(RES* ssl, struct worker* worker, char* arg)
	{
	char* arg2;
	struct view* v;
	if(!find_arg2(ssl, arg, &arg2))
	return;
	v = views_find_view(worker->daemon->views,
	arg, 1 /* get write lock*/);
	if(!v) {
	ssl_printf(ssl,"no view with name: %s\n", arg);
	return;
	}
	if(!v->local_zones) {
	lock_rw_unlock(&v->lock);
	send_ok(ssl);
	return;
	}
	do_data_remove(ssl, v->local_zones, arg2);
	lock_rw_unlock(&v->lock);
	}

	/** cache lookup of nameservers */
	static void
	do_lookup(RES* ssl, struct worker* worker, char* arg)
	{
	uint8_t* nm;
	int nmlabs;
	size_t nmlen;
	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
	return;
	(void)print_deleg_lookup(ssl, worker, nm, nmlen, nmlabs);
	free(nm);
	}

	/** flush something from rrset and msg caches */
	static void
	do_cache_remove(struct worker* worker, uint8_t* nm, size_t nmlen,
	uint16_t t, uint16_t c)
	{
	hashvalue_type h;
	struct query_info k;
	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, t, c, 0);
	if(t == LDNS_RR_TYPE_SOA)
	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, t, c,
	PACKED_RRSET_SOA_NEG);
	k.qname = nm;
	k.qname_len = nmlen;
	k.qtype = t;
	k.qclass = c;
	k.local_alias = NULL;
	h = query_info_hash(&k, 0);
	slabhash_remove(worker->env.msg_cache, h, &k);
	if(t == LDNS_RR_TYPE_AAAA) {
	/* for AAAA also flush dns64 bit_cd packet */
	h = query_info_hash(&k, BIT_CD);
	slabhash_remove(worker->env.msg_cache, h, &k);
	}
	}

	/** flush a type */
	static void
	do_flush_type(RES* ssl, struct worker* worker, char* arg)
	{
	uint8_t* nm;
	int nmlabs;
	size_t nmlen;
	char* arg2;
	uint16_t t;
	if(!find_arg2(ssl, arg, &arg2))
	return;
	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
	return;
	t = sldns_get_rr_type_by_name(arg2);
	do_cache_remove(worker, nm, nmlen, t, LDNS_RR_CLASS_IN);

	free(nm);
	send_ok(ssl);
	}

	/** flush statistics */
	static void
	do_flush_stats(RES* ssl, struct worker* worker)
	{
	worker_stats_clear(worker);
	send_ok(ssl);
	}

	/**
	* Local info for deletion functions
	*/
	struct del_info {
	/** worker */
	struct worker* worker;
	/** name to delete */
	uint8_t* name;
	/** length */
	size_t len;
	/** labels */
	int labs;
	/** time to invalidate to */
	time_t expired;
	/** number of rrsets removed */
	size_t num_rrsets;
	/** number of msgs removed */
	size_t num_msgs;
	/** number of key entries removed */
	size_t num_keys;
	/** length of addr */
	socklen_t addrlen;
	/** socket address for host deletion */
	struct sockaddr_storage addr;
	};

	/** callback to delete hosts in infra cache */
	static void
	infra_del_host(struct lruhash_entry* e, void* arg)
	{
	/* entry is locked */
	struct del_info* inf = (struct del_info*)arg;
	struct infra_key* k = (struct infra_key*)e->key;
	if(sockaddr_cmp(&inf->addr, inf->addrlen, &k->addr, k->addrlen) == 0) {
	struct infra_data* d = (struct infra_data*)e->data;
	d->probedelay = 0;
	d->timeout_A = 0;
	d->timeout_AAAA = 0;
	d->timeout_other = 0;
	rtt_init(&d->rtt);
	if(d->ttl > inf->expired) {
	d->ttl = inf->expired;
	inf->num_keys++;
	}
	}
	}

	/** flush infra cache */
	static void
	do_flush_infra(RES* ssl, struct worker* worker, char* arg)
	{
	struct sockaddr_storage addr;
	socklen_t len;
	struct del_info inf;
	if(strcmp(arg, "all") == 0) {
	slabhash_clear(worker->env.infra_cache->hosts);
	send_ok(ssl);
	return;
	}
	if(!ipstrtoaddr(arg, UNBOUND_DNS_PORT, &addr, &len)) {
	(void)ssl_printf(ssl, "error parsing ip addr: '%s'\n", arg);
	return;
	}
	/* delete all entries from cache */
	/* what we do is to set them all expired */
	inf.worker = worker;
	inf.name = 0;
	inf.len = 0;
	inf.labs = 0;
	inf.expired = *worker->env.now;
	inf.expired -= 3; /* handle 3 seconds skew between threads */
	inf.num_rrsets = 0;
	inf.num_msgs = 0;
	inf.num_keys = 0;
	inf.addrlen = len;
	memmove(&inf.addr, &addr, len);
	slabhash_traverse(worker->env.infra_cache->hosts, 1, &infra_del_host,
	&inf);
	send_ok(ssl);
	}

	/** flush requestlist */
	static void
	do_flush_requestlist(RES* ssl, struct worker* worker)
	{
	mesh_delete_all(worker->env.mesh);
	send_ok(ssl);
	}

	/** callback to delete rrsets in a zone */
	static void
	zone_del_rrset(struct lruhash_entry* e, void* arg)
	{
	/* entry is locked */
	struct del_info* inf = (struct del_info*)arg;
	struct ub_packed_rrset_key* k = (struct ub_packed_rrset_key*)e->key;
	if(dname_subdomain_c(k->rk.dname, inf->name)) {
	struct packed_rrset_data* d =
	(struct packed_rrset_data*)e->data;
	if(d->ttl > inf->expired) {
	d->ttl = inf->expired;
	inf->num_rrsets++;
	}
	}
	}

	/** callback to delete messages in a zone */
	static void
	zone_del_msg(struct lruhash_entry* e, void* arg)
	{
	/* entry is locked */
	struct del_info* inf = (struct del_info*)arg;
	struct msgreply_entry* k = (struct msgreply_entry*)e->key;
	if(dname_subdomain_c(k->key.qname, inf->name)) {
	struct reply_info* d = (struct reply_info*)e->data;
	if(d->ttl > inf->expired) {
	d->ttl = inf->expired;
	d->prefetch_ttl = inf->expired;
	d->serve_expired_ttl = inf->expired;
	inf->num_msgs++;
	}
	}
	}

	/** callback to delete keys in zone */
	static void
	zone_del_kcache(struct lruhash_entry* e, void* arg)
	{
	/* entry is locked */
	struct del_info* inf = (struct del_info*)arg;
	struct key_entry_key* k = (struct key_entry_key*)e->key;
	if(dname_subdomain_c(k->name, inf->name)) {
	struct key_entry_data* d = (struct key_entry_data*)e->data;
	if(d->ttl > inf->expired) {
	d->ttl = inf->expired;
	inf->num_keys++;
	}
	}
	}

	/** remove all rrsets and keys from zone from cache */
	static void
	do_flush_zone(RES* ssl, struct worker* worker, char* arg)
	{
	uint8_t* nm;
	int nmlabs;
	size_t nmlen;
	struct del_info inf;
	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
	return;
	/* delete all RRs and key entries from zone */
	/* what we do is to set them all expired */
	inf.worker = worker;
	inf.name = nm;
	inf.len = nmlen;
	inf.labs = nmlabs;
	inf.expired = *worker->env.now;
	inf.expired -= 3; /* handle 3 seconds skew between threads */
	inf.num_rrsets = 0;
	inf.num_msgs = 0;
	inf.num_keys = 0;
	slabhash_traverse(&worker->env.rrset_cache->table, 1,
	&zone_del_rrset, &inf);

	slabhash_traverse(worker->env.msg_cache, 1, &zone_del_msg, &inf);

	/* and validator cache */
	if(worker->env.key_cache) {
	slabhash_traverse(worker->env.key_cache->slab, 1,
	&zone_del_kcache, &inf);
	}

	free(nm);

	(void)ssl_printf(ssl, "ok removed %lu rrsets, %lu messages "
	"and %lu key entries\n", (unsigned long)inf.num_rrsets,
	(unsigned long)inf.num_msgs, (unsigned long)inf.num_keys);
	}

	/** callback to delete bogus rrsets */
	static void
	bogus_del_rrset(struct lruhash_entry* e, void* arg)
	{
	/* entry is locked */
	struct del_info* inf = (struct del_info*)arg;
	struct packed_rrset_data* d = (struct packed_rrset_data*)e->data;
	if(d->security == sec_status_bogus) {
	d->ttl = inf->expired;
	inf->num_rrsets++;
	}
	}

	/** callback to delete bogus messages */
	static void
	bogus_del_msg(struct lruhash_entry* e, void* arg)
	{
	/* entry is locked */
	struct del_info* inf = (struct del_info*)arg;
	struct reply_info* d = (struct reply_info*)e->data;
	if(d->security == sec_status_bogus) {
	d->ttl = inf->expired;
	inf->num_msgs++;
	}
	}

	/** callback to delete bogus keys */
	static void
	bogus_del_kcache(struct lruhash_entry* e, void* arg)
	{
	/* entry is locked */
	struct del_info* inf = (struct del_info*)arg;
	struct key_entry_data* d = (struct key_entry_data*)e->data;
	if(d->isbad) {
	d->ttl = inf->expired;
	inf->num_keys++;
	}
	}

	/** remove all bogus rrsets, msgs and keys from cache */
	static void
	do_flush_bogus(RES* ssl, struct worker* worker)
	{
	struct del_info inf;
	/* what we do is to set them all expired */
	inf.worker = worker;
	inf.expired = *worker->env.now;
	inf.expired -= 3; /* handle 3 seconds skew between threads */
	inf.num_rrsets = 0;
	inf.num_msgs = 0;
	inf.num_keys = 0;
	slabhash_traverse(&worker->env.rrset_cache->table, 1,
	&bogus_del_rrset, &inf);

	slabhash_traverse(worker->env.msg_cache, 1, &bogus_del_msg, &inf);

	/* and validator cache */
	if(worker->env.key_cache) {
	slabhash_traverse(worker->env.key_cache->slab, 1,
	&bogus_del_kcache, &inf);
	}

	(void)ssl_printf(ssl, "ok removed %lu rrsets, %lu messages "
	"and %lu key entries\n", (unsigned long)inf.num_rrsets,
	(unsigned long)inf.num_msgs, (unsigned long)inf.num_keys);
	}

	/** callback to delete negative and servfail rrsets */
	static void
	negative_del_rrset(struct lruhash_entry* e, void* arg)
	{
	/* entry is locked */
	struct del_info* inf = (struct del_info*)arg;
	struct ub_packed_rrset_key* k = (struct ub_packed_rrset_key*)e->key;
	struct packed_rrset_data* d = (struct packed_rrset_data*)e->data;
	/* delete the parentside negative cache rrsets,
	* these are nameserver rrsets that failed lookup, rdata empty */
	if((k->rk.flags & PACKED_RRSET_PARENT_SIDE) && d->count == 1 &&
	d->rrsig_count == 0 && d->rr_len[0] == 0) {
	d->ttl = inf->expired;
	inf->num_rrsets++;
	}
	}

	/** callback to delete negative and servfail messages */
	static void
	negative_del_msg(struct lruhash_entry* e, void* arg)
	{
	/* entry is locked */
	struct del_info* inf = (struct del_info*)arg;
	struct reply_info* d = (struct reply_info*)e->data;
	/* rcode not NOERROR: NXDOMAIN, SERVFAIL, ..: an nxdomain or error
	* or NOERROR rcode with ANCOUNT==0: a NODATA answer */
	if(FLAGS_GET_RCODE(d->flags) != 0 \|\| d->an_numrrsets == 0) {
	d->ttl = inf->expired;
	inf->num_msgs++;
	}
	}

	/** callback to delete negative key entries */
	static void
	negative_del_kcache(struct lruhash_entry* e, void* arg)
	{
	/* entry is locked */
	struct del_info* inf = (struct del_info*)arg;
	struct key_entry_data* d = (struct key_entry_data*)e->data;
	/* could be bad because of lookup failure on the DS, DNSKEY, which
	* was nxdomain or servfail, and thus a result of negative lookups */
	if(d->isbad) {
	d->ttl = inf->expired;
	inf->num_keys++;
	}
	}

	/** remove all negative(NODATA,NXDOMAIN), and servfail messages from cache */
	static void
	do_flush_negative(RES* ssl, struct worker* worker)
	{
	struct del_info inf;
	/* what we do is to set them all expired */
	inf.worker = worker;
	inf.expired = *worker->env.now;
	inf.expired -= 3; /* handle 3 seconds skew between threads */
	inf.num_rrsets = 0;
	inf.num_msgs = 0;
	inf.num_keys = 0;
	slabhash_traverse(&worker->env.rrset_cache->table, 1,
	&negative_del_rrset, &inf);

	slabhash_traverse(worker->env.msg_cache, 1, &negative_del_msg, &inf);

	/* and validator cache */
	if(worker->env.key_cache) {
	slabhash_traverse(worker->env.key_cache->slab, 1,
	&negative_del_kcache, &inf);
	}

	(void)ssl_printf(ssl, "ok removed %lu rrsets, %lu messages "
	"and %lu key entries\n", (unsigned long)inf.num_rrsets,
	(unsigned long)inf.num_msgs, (unsigned long)inf.num_keys);
	}

	/** remove name rrset from cache */
	static void
	do_flush_name(RES* ssl, struct worker* w, char* arg)
	{
	uint8_t* nm;
	int nmlabs;
	size_t nmlen;
	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
	return;
	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_A, LDNS_RR_CLASS_IN);
	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_AAAA, LDNS_RR_CLASS_IN);
	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SOA, LDNS_RR_CLASS_IN);
	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_CNAME, LDNS_RR_CLASS_IN);
	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_DNAME, LDNS_RR_CLASS_IN);
	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_MX, LDNS_RR_CLASS_IN);
	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_PTR, LDNS_RR_CLASS_IN);
	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SRV, LDNS_RR_CLASS_IN);
	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_NAPTR, LDNS_RR_CLASS_IN);

	free(nm);
	send_ok(ssl);
	}

	/** printout a delegation point info */
	static int
	ssl_print_name_dp(RES* ssl, const char* str, uint8_t* nm, uint16_t dclass,
	struct delegpt* dp)
	{
	char buf[257];
	struct delegpt_ns* ns;
	struct delegpt_addr* a;
	int f = 0;
	if(str) { /* print header for forward, stub */
	char* c = sldns_wire2str_class(dclass);
	dname_str(nm, buf);
	if(!ssl_printf(ssl, "%s %s %s ", buf, (c?c:"CLASS??"), str)) {
	free(c);
	return 0;
	}
	free(c);
	}
	for(ns = dp->nslist; ns; ns = ns->next) {
	dname_str(ns->name, buf);
	if(!ssl_printf(ssl, "%s%s", (f?" ":""), buf))
	return 0;
	f = 1;
	}
	for(a = dp->target_list; a; a = a->next_target) {
	addr_to_str(&a->addr, a->addrlen, buf, sizeof(buf));
	if(!ssl_printf(ssl, "%s%s", (f?" ":""), buf))
	return 0;
	f = 1;
	}
	return ssl_printf(ssl, "\n");
	}


	/** print root forwards */
	static int
	print_root_fwds(RES* ssl, struct iter_forwards* fwds, uint8_t* root)
	{
	struct delegpt* dp;
	dp = forwards_lookup(fwds, root, LDNS_RR_CLASS_IN);
	if(!dp)
	return ssl_printf(ssl, "off (using root hints)\n");
	/* if dp is returned it must be the root */
	log_assert(query_dname_compare(dp->name, root)==0);
	return ssl_print_name_dp(ssl, NULL, root, LDNS_RR_CLASS_IN, dp);
	}

	/** parse args into delegpt */
	static struct delegpt*
	parse_delegpt(RES* ssl, char* args, uint8_t* nm, int allow_names)
	{
	/* parse args and add in */
	char* p = args;
	char* todo;
	struct delegpt* dp = delegpt_create_mlc(nm);
	struct sockaddr_storage addr;
	socklen_t addrlen;
	char* auth_name;
	if(!dp) {
	(void)ssl_printf(ssl, "error out of memory\n");
	return NULL;
	}
	while(p) {
	todo = p;
	p = strchr(p, ' '); /* find next spot, if any */
	if(p) {
	p++ = 0; / end this spot */
	p = skipwhite(p); /* position at next spot */
	}
	/* parse address */
	if(!authextstrtoaddr(todo, &addr, &addrlen, &auth_name)) {
	if(allow_names) {
	uint8_t* n = NULL;
	size_t ln;
	int lb;
	if(!parse_arg_name(ssl, todo, &n, &ln, &lb)) {
	(void)ssl_printf(ssl, "error cannot "
	"parse IP address or name "
	"'%s'\n", todo);
	delegpt_free_mlc(dp);
	return NULL;
	}
	if(!delegpt_add_ns_mlc(dp, n, 0)) {
	(void)ssl_printf(ssl, "error out of memory\n");
	free(n);
	delegpt_free_mlc(dp);
	return NULL;
	}
	free(n);

	} else {
	(void)ssl_printf(ssl, "error cannot parse"
	" IP address '%s'\n", todo);
	delegpt_free_mlc(dp);
	return NULL;
	}
	} else {
	-#ifndef HAVE_SSL_SET1_HOST
	+#if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
	if(auth_name)
	log_err("no name verification functionality in "
	"ssl library, ignored name for %s", todo);
	#endif
	/* add address */
	if(!delegpt_add_addr_mlc(dp, &addr, addrlen, 0, 0,
	auth_name)) {
	(void)ssl_printf(ssl, "error out of memory\n");
	delegpt_free_mlc(dp);
	return NULL;
	}
	}
	}
	dp->has_parent_side_NS = 1;
	return dp;
	}

	/** do the status command */
	static void
	do_forward(RES* ssl, struct worker* worker, char* args)
	{
	struct iter_forwards* fwd = worker->env.fwds;
	uint8_t* root = (uint8_t*)"\000";
	if(!fwd) {
	(void)ssl_printf(ssl, "error: structure not allocated\n");
	return;
	}
	if(args == NULL \|\| args[0] == 0) {
	(void)print_root_fwds(ssl, fwd, root);
	return;
	}
	/* set root forwards for this thread. since we are in remote control
	* the actual mesh is not running, so we can freely edit it. */
	/* delete all the existing queries first */
	mesh_delete_all(worker->env.mesh);
	if(strcmp(args, "off") == 0) {
	forwards_delete_zone(fwd, LDNS_RR_CLASS_IN, root);
	} else {
	struct delegpt* dp;
	if(!(dp = parse_delegpt(ssl, args, root, 0)))
	return;
	if(!forwards_add_zone(fwd, LDNS_RR_CLASS_IN, dp)) {
	(void)ssl_printf(ssl, "error out of memory\n");
	return;
	}
	}
	send_ok(ssl);
	}

	static int
	parse_fs_args(RES* ssl, char* args, uint8_t nm, struct delegpt dp,
	int* insecure, int* prime)
	{
	char* zonename;
	char* rest;
	size_t nmlen;
	int nmlabs;
	/* parse all -x args */
	while(args[0] == '+') {
	if(!find_arg2(ssl, args, &rest))
	return 0;
	while(*(++args) != 0) {
	if(*args == 'i' && insecure)
	*insecure = 1;
	else if(*args == 'p' && prime)
	*prime = 1;
	else {
	(void)ssl_printf(ssl, "error: unknown option %s\n", args);
	return 0;
	}
	}
	args = rest;
	}
	/* parse name */
	if(dp) {
	if(!find_arg2(ssl, args, &rest))
	return 0;
	zonename = args;
	args = rest;
	} else zonename = args;
	if(!parse_arg_name(ssl, zonename, nm, &nmlen, &nmlabs))
	return 0;

	/* parse dp */
	if(dp) {
	if(!(dp = parse_delegpt(ssl, args, nm, 1))) {
	free(*nm);
	return 0;
	}
	}
	return 1;
	}

	/** do the forward_add command */
	static void
	do_forward_add(RES* ssl, struct worker* worker, char* args)
	{
	struct iter_forwards* fwd = worker->env.fwds;
	int insecure = 0;
	uint8_t* nm = NULL;
	struct delegpt* dp = NULL;
	if(!parse_fs_args(ssl, args, &nm, &dp, &insecure, NULL))
	return;
	if(insecure && worker->env.anchors) {
	if(!anchors_add_insecure(worker->env.anchors, LDNS_RR_CLASS_IN,
	nm)) {
	(void)ssl_printf(ssl, "error out of memory\n");
	delegpt_free_mlc(dp);
	free(nm);
	return;
	}
	}
	if(!forwards_add_zone(fwd, LDNS_RR_CLASS_IN, dp)) {
	(void)ssl_printf(ssl, "error out of memory\n");
	free(nm);
	return;
	}
	free(nm);
	send_ok(ssl);
	}

	/** do the forward_remove command */
	static void
	do_forward_remove(RES* ssl, struct worker* worker, char* args)
	{
	struct iter_forwards* fwd = worker->env.fwds;
	int insecure = 0;
	uint8_t* nm = NULL;
	if(!parse_fs_args(ssl, args, &nm, NULL, &insecure, NULL))
	return;
	if(insecure && worker->env.anchors)
	anchors_delete_insecure(worker->env.anchors, LDNS_RR_CLASS_IN,
	nm);
	forwards_delete_zone(fwd, LDNS_RR_CLASS_IN, nm);
	free(nm);
	send_ok(ssl);
	}

	/** do the stub_add command */
	static void
	do_stub_add(RES* ssl, struct worker* worker, char* args)
	{
	struct iter_forwards* fwd = worker->env.fwds;
	int insecure = 0, prime = 0;
	uint8_t* nm = NULL;
	struct delegpt* dp = NULL;
	if(!parse_fs_args(ssl, args, &nm, &dp, &insecure, &prime))
	return;
	if(insecure && worker->env.anchors) {
	if(!anchors_add_insecure(worker->env.anchors, LDNS_RR_CLASS_IN,
	nm)) {
	(void)ssl_printf(ssl, "error out of memory\n");
	delegpt_free_mlc(dp);
	free(nm);
	return;
	}
	}
	if(!forwards_add_stub_hole(fwd, LDNS_RR_CLASS_IN, nm)) {
	if(insecure && worker->env.anchors)
	anchors_delete_insecure(worker->env.anchors,
	LDNS_RR_CLASS_IN, nm);
	(void)ssl_printf(ssl, "error out of memory\n");
	delegpt_free_mlc(dp);
	free(nm);
	return;
	}
	if(!hints_add_stub(worker->env.hints, LDNS_RR_CLASS_IN, dp, !prime)) {
	(void)ssl_printf(ssl, "error out of memory\n");
	forwards_delete_stub_hole(fwd, LDNS_RR_CLASS_IN, nm);
	if(insecure && worker->env.anchors)
	anchors_delete_insecure(worker->env.anchors,
	LDNS_RR_CLASS_IN, nm);
	free(nm);
	return;
	}
	free(nm);
	send_ok(ssl);
	}

	/** do the stub_remove command */
	static void
	do_stub_remove(RES* ssl, struct worker* worker, char* args)
	{
	struct iter_forwards* fwd = worker->env.fwds;
	int insecure = 0;
	uint8_t* nm = NULL;
	if(!parse_fs_args(ssl, args, &nm, NULL, &insecure, NULL))
	return;
	if(insecure && worker->env.anchors)
	anchors_delete_insecure(worker->env.anchors, LDNS_RR_CLASS_IN,
	nm);
	forwards_delete_stub_hole(fwd, LDNS_RR_CLASS_IN, nm);
	hints_delete_stub(worker->env.hints, LDNS_RR_CLASS_IN, nm);
	free(nm);
	send_ok(ssl);
	}

	/** do the insecure_add command */
	static void
	do_insecure_add(RES* ssl, struct worker* worker, char* arg)
	{
	size_t nmlen;
	int nmlabs;
	uint8_t* nm = NULL;
	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
	return;
	if(worker->env.anchors) {
	if(!anchors_add_insecure(worker->env.anchors,
	LDNS_RR_CLASS_IN, nm)) {
	(void)ssl_printf(ssl, "error out of memory\n");
	free(nm);
	return;
	}
	}
	free(nm);
	send_ok(ssl);
	}

	/** do the insecure_remove command */
	static void
	do_insecure_remove(RES* ssl, struct worker* worker, char* arg)
	{
	size_t nmlen;
	int nmlabs;
	uint8_t* nm = NULL;
	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
	return;
	if(worker->env.anchors)
	anchors_delete_insecure(worker->env.anchors,
	LDNS_RR_CLASS_IN, nm);
	free(nm);
	send_ok(ssl);
	}

	static void
	do_insecure_list(RES* ssl, struct worker* worker)
	{
	char buf[257];
	struct trust_anchor* a;
	if(worker->env.anchors) {
	RBTREE_FOR(a, struct trust_anchor*, worker->env.anchors->tree) {
	if(a->numDS == 0 && a->numDNSKEY == 0) {
	dname_str(a->name, buf);
	ssl_printf(ssl, "%s\n", buf);
	}
	}
	}
	}

	/** do the status command */
	static void
	do_status(RES* ssl, struct worker* worker)
	{
	int i;
	time_t uptime;
	if(!ssl_printf(ssl, "version: %s\n", PACKAGE_VERSION))
	return;
	if(!ssl_printf(ssl, "verbosity: %d\n", verbosity))
	return;
	if(!ssl_printf(ssl, "threads: %d\n", worker->daemon->num))
	return;
	if(!ssl_printf(ssl, "modules: %d [", worker->daemon->mods.num))
	return;
	for(i=0; i<worker->daemon->mods.num; i++) {
	if(!ssl_printf(ssl, " %s", worker->daemon->mods.mod[i]->name))
	return;
	}
	if(!ssl_printf(ssl, " ]\n"))
	return;
	uptime = (time_t)time(NULL) - (time_t)worker->daemon->time_boot.tv_sec;
	if(!ssl_printf(ssl, "uptime: " ARG_LL "d seconds\n", (long long)uptime))
	return;
	if(!ssl_printf(ssl, "options:%s%s%s%s\n" ,
	(worker->daemon->reuseport?" reuseport":""),
	(worker->daemon->rc->accept_list?" control":""),
	(worker->daemon->rc->accept_list && worker->daemon->rc->use_cert?"(ssl)":""),
	(worker->daemon->rc->accept_list && worker->daemon->cfg->control_ifs.first && worker->daemon->cfg->control_ifs.first->str && worker->daemon->cfg->control_ifs.first->str[0] == '/'?"(namedpipe)":"")
	))
	return;
	if(!ssl_printf(ssl, "unbound (pid %d) is running...\n",
	(int)getpid()))
	return;
	}

	/** get age for the mesh state */
	static void
	get_mesh_age(struct mesh_state* m, char* buf, size_t len,
	struct module_env* env)
	{
	if(m->reply_list) {
	struct timeval d;
	struct mesh_reply* r = m->reply_list;
	/* last reply is the oldest */
	while(r && r->next)
	r = r->next;
	timeval_subtract(&d, env->now_tv, &r->start_time);
	snprintf(buf, len, ARG_LL "d.%6.6d",
	(long long)d.tv_sec, (int)d.tv_usec);
	} else {
	snprintf(buf, len, "-");
	}
	}

	/** get status of a mesh state */
	static void
	get_mesh_status(struct mesh_area* mesh, struct mesh_state* m,
	char* buf, size_t len)
	{
	enum module_ext_state s = m->s.ext_state[m->s.curmod];
	const char *modname = mesh->mods.mod[m->s.curmod]->name;
	size_t l;
	if(strcmp(modname, "iterator") == 0 && s == module_wait_reply &&
	m->s.minfo[m->s.curmod]) {
	/* break into iterator to find out who its waiting for */
	struct iter_qstate* qstate = (struct iter_qstate*)
	m->s.minfo[m->s.curmod];
	struct outbound_list* ol = &qstate->outlist;
	struct outbound_entry* e;
	snprintf(buf, len, "%s wait for", modname);
	l = strlen(buf);
	buf += l; len -= l;
	if(ol->first == NULL)
	snprintf(buf, len, " (empty_list)");
	for(e = ol->first; e; e = e->next) {
	snprintf(buf, len, " ");
	l = strlen(buf);
	buf += l; len -= l;
	addr_to_str(&e->qsent->addr, e->qsent->addrlen,
	buf, len);
	l = strlen(buf);
	buf += l; len -= l;
	}
	} else if(s == module_wait_subquery) {
	/* look in subs from mesh state to see what */
	char nm[257];
	struct mesh_state_ref* sub;
	snprintf(buf, len, "%s wants", modname);
	l = strlen(buf);
	buf += l; len -= l;
	if(m->sub_set.count == 0)
	snprintf(buf, len, " (empty_list)");
	RBTREE_FOR(sub, struct mesh_state_ref*, &m->sub_set) {
	char* t = sldns_wire2str_type(sub->s->s.qinfo.qtype);
	char* c = sldns_wire2str_class(sub->s->s.qinfo.qclass);
	dname_str(sub->s->s.qinfo.qname, nm);
	snprintf(buf, len, " %s %s %s", (t?t:"TYPE??"),
	(c?c:"CLASS??"), nm);
	l = strlen(buf);
	buf += l; len -= l;
	free(t);
	free(c);
	}
	} else {
	snprintf(buf, len, "%s is %s", modname, strextstate(s));
	}
	}

	/** do the dump_requestlist command */
	static void
	do_dump_requestlist(RES* ssl, struct worker* worker)
	{
	struct mesh_area* mesh;
	struct mesh_state* m;
	int num = 0;
	char buf[257];
	char timebuf[32];
	char statbuf[10240];
	if(!ssl_printf(ssl, "thread #%d\n", worker->thread_num))
	return;
	if(!ssl_printf(ssl, "# type cl name seconds module status\n"))
	return;
	/* show worker mesh contents */
	mesh = worker->env.mesh;
	if(!mesh) return;
	RBTREE_FOR(m, struct mesh_state*, &mesh->all) {
	char* t = sldns_wire2str_type(m->s.qinfo.qtype);
	char* c = sldns_wire2str_class(m->s.qinfo.qclass);
	dname_str(m->s.qinfo.qname, buf);
	get_mesh_age(m, timebuf, sizeof(timebuf), &worker->env);
	get_mesh_status(mesh, m, statbuf, sizeof(statbuf));
	if(!ssl_printf(ssl, "%3d %4s %2s %s %s %s\n",
	num, (t?t:"TYPE??"), (c?c:"CLASS??"), buf, timebuf,
	statbuf)) {
	free(t);
	free(c);
	return;
	}
	num++;
	free(t);
	free(c);
	}
	}

	/** structure for argument data for dump infra host */
	struct infra_arg {
	/** the infra cache */
	struct infra_cache* infra;
	/** the SSL connection */
	RES* ssl;
	/** the time now */
	time_t now;
	/** ssl failure? stop writing and skip the rest. If the tcp
	* connection is broken, and writes fail, we then stop writing. */
	int ssl_failed;
	};

	/** callback for every host element in the infra cache */
	static void
	dump_infra_host(struct lruhash_entry* e, void* arg)
	{
	struct infra_arg* a = (struct infra_arg*)arg;
	struct infra_key* k = (struct infra_key*)e->key;
	struct infra_data* d = (struct infra_data*)e->data;
	char ip_str[1024];
	char name[257];
	int port;
	if(a->ssl_failed)
	return;
	addr_to_str(&k->addr, k->addrlen, ip_str, sizeof(ip_str));
	dname_str(k->zonename, name);
	port = (int)ntohs(((struct sockaddr_in*)&k->addr)->sin_port);
	if(port != UNBOUND_DNS_PORT) {
	snprintf(ip_str+strlen(ip_str), sizeof(ip_str)-strlen(ip_str),
	"@%d", port);
	}
	/* skip expired stuff (only backed off) */
	if(d->ttl < a->now) {
	if(d->rtt.rto >= USEFUL_SERVER_TOP_TIMEOUT) {
	if(!ssl_printf(a->ssl, "%s %s expired rto %d\n", ip_str,
	name, d->rtt.rto)) {
	a->ssl_failed = 1;
	return;
	}
	}
	return;
	}
	if(!ssl_printf(a->ssl, "%s %s ttl %lu ping %d var %d rtt %d rto %d "
	"tA %d tAAAA %d tother %d "
	"ednsknown %d edns %d delay %d lame dnssec %d rec %d A %d "
	"other %d\n", ip_str, name, (unsigned long)(d->ttl - a->now),
	d->rtt.srtt, d->rtt.rttvar, rtt_notimeout(&d->rtt), d->rtt.rto,
	d->timeout_A, d->timeout_AAAA, d->timeout_other,
	(int)d->edns_lame_known, (int)d->edns_version,
	(int)(a->now<d->probedelay?(d->probedelay - a->now):0),
	(int)d->isdnsseclame, (int)d->rec_lame, (int)d->lame_type_A,
	(int)d->lame_other)) {
	a->ssl_failed = 1;
	return;
	}
	}

	/** do the dump_infra command */
	static void
	do_dump_infra(RES* ssl, struct worker* worker)
	{
	struct infra_arg arg;
	arg.infra = worker->env.infra_cache;
	arg.ssl = ssl;
	arg.now = *worker->env.now;
	arg.ssl_failed = 0;
	slabhash_traverse(arg.infra->hosts, 0, &dump_infra_host, (void*)&arg);
	}

	/** do the log_reopen command */
	static void
	do_log_reopen(RES* ssl, struct worker* worker)
	{
	struct config_file* cfg = worker->env.cfg;
	send_ok(ssl);
	log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
	}

	/** do the auth_zone_reload command */
	static void
	do_auth_zone_reload(RES* ssl, struct worker* worker, char* arg)
	{
	size_t nmlen;
	int nmlabs;
	uint8_t* nm = NULL;
	struct auth_zones* az = worker->env.auth_zones;
	struct auth_zone* z = NULL;
	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
	return;
	if(az) {
	lock_rw_rdlock(&az->lock);
	z = auth_zone_find(az, nm, nmlen, LDNS_RR_CLASS_IN);
	if(z) {
	lock_rw_wrlock(&z->lock);
	}
	lock_rw_unlock(&az->lock);
	}
	free(nm);
	if(!z) {
	(void)ssl_printf(ssl, "error no auth-zone %s\n", arg);
	return;
	}
	- if(!auth_zone_read_zonefile(z)) {
	+ if(!auth_zone_read_zonefile(z, worker->env.cfg)) {
	lock_rw_unlock(&z->lock);
	(void)ssl_printf(ssl, "error failed to read %s\n", arg);
	return;
	}
	lock_rw_unlock(&z->lock);
	send_ok(ssl);
	}

	/** do the auth_zone_transfer command */
	static void
	do_auth_zone_transfer(RES* ssl, struct worker* worker, char* arg)
	{
	size_t nmlen;
	int nmlabs;
	uint8_t* nm = NULL;
	struct auth_zones* az = worker->env.auth_zones;
	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
	return;
	if(!az \|\| !auth_zones_startprobesequence(az, &worker->env, nm, nmlen,
	LDNS_RR_CLASS_IN)) {
	(void)ssl_printf(ssl, "error zone xfr task not found %s\n", arg);
	return;
	}
	send_ok(ssl);
	}

	/** do the set_option command */
	static void
	do_set_option(RES* ssl, struct worker* worker, char* arg)
	{
	char* arg2;
	if(!find_arg2(ssl, arg, &arg2))
	return;
	if(!config_set_option(worker->env.cfg, arg, arg2)) {
	(void)ssl_printf(ssl, "error setting option\n");
	return;
	}
	/* effectuate some arguments */
	if(strcmp(arg, "val-override-date:") == 0) {
	int m = modstack_find(&worker->env.mesh->mods, "validator");
	struct val_env* val_env = NULL;
	if(m != -1) val_env = (struct val_env*)worker->env.modinfo[m];
	if(val_env)
	val_env->date_override = worker->env.cfg->val_date_override;
	}
	send_ok(ssl);
	}

	/* routine to printout option values over SSL */
	void remote_get_opt_ssl(char* line, void* arg)
	{
	RES* ssl = (RES*)arg;
	(void)ssl_printf(ssl, "%s\n", line);
	}

	/** do the get_option command */
	static void
	do_get_option(RES* ssl, struct worker* worker, char* arg)
	{
	int r;
	r = config_get_option(worker->env.cfg, arg, remote_get_opt_ssl, ssl);
	if(!r) {
	(void)ssl_printf(ssl, "error unknown option\n");
	return;
	}
	}

	/** do the list_forwards command */
	static void
	do_list_forwards(RES* ssl, struct worker* worker)
	{
	/* since its a per-worker structure no locks needed */
	struct iter_forwards* fwds = worker->env.fwds;
	struct iter_forward_zone* z;
	struct trust_anchor* a;
	int insecure;
	RBTREE_FOR(z, struct iter_forward_zone*, fwds->tree) {
	if(!z->dp) continue; /* skip empty marker for stub */

	/* see if it is insecure */
	insecure = 0;
	if(worker->env.anchors &&
	(a=anchor_find(worker->env.anchors, z->name,
	z->namelabs, z->namelen, z->dclass))) {
	if(!a->keylist && !a->numDS && !a->numDNSKEY)
	insecure = 1;
	lock_basic_unlock(&a->lock);
	}

	if(!ssl_print_name_dp(ssl, (insecure?"forward +i":"forward"),
	z->name, z->dclass, z->dp))
	return;
	}
	}

	/** do the list_stubs command */
	static void
	do_list_stubs(RES* ssl, struct worker* worker)
	{
	struct iter_hints_stub* z;
	struct trust_anchor* a;
	int insecure;
	char str[32];
	RBTREE_FOR(z, struct iter_hints_stub*, &worker->env.hints->tree) {

	/* see if it is insecure */
	insecure = 0;
	if(worker->env.anchors &&
	(a=anchor_find(worker->env.anchors, z->node.name,
	z->node.labs, z->node.len, z->node.dclass))) {
	if(!a->keylist && !a->numDS && !a->numDNSKEY)
	insecure = 1;
	lock_basic_unlock(&a->lock);
	}

	snprintf(str, sizeof(str), "stub %sprime%s",
	(z->noprime?"no":""), (insecure?" +i":""));
	if(!ssl_print_name_dp(ssl, str, z->node.name,
	z->node.dclass, z->dp))
	return;
	}
	}

	/** do the list_auth_zones command */
	static void
	do_list_auth_zones(RES* ssl, struct auth_zones* az)
	{
	struct auth_zone* z;
	char buf[257], buf2[256];
	lock_rw_rdlock(&az->lock);
	RBTREE_FOR(z, struct auth_zone*, &az->ztree) {
	lock_rw_rdlock(&z->lock);
	dname_str(z->name, buf);
	if(z->zone_expired)
	snprintf(buf2, sizeof(buf2), "expired");
	else {
	uint32_t serial = 0;
	if(auth_zone_get_serial(z, &serial))
	snprintf(buf2, sizeof(buf2), "serial %u",
	(unsigned)serial);
	else snprintf(buf2, sizeof(buf2), "no serial");
	}
	if(!ssl_printf(ssl, "%s\t%s\n", buf, buf2)) {
	/* failure to print */
	lock_rw_unlock(&z->lock);
	lock_rw_unlock(&az->lock);
	return;
	}
	lock_rw_unlock(&z->lock);
	}
	lock_rw_unlock(&az->lock);
	}

	/** do the list_local_zones command */
	static void
	do_list_local_zones(RES* ssl, struct local_zones* zones)
	{
	struct local_zone* z;
	char buf[257];
	lock_rw_rdlock(&zones->lock);
	RBTREE_FOR(z, struct local_zone*, &zones->ztree) {
	lock_rw_rdlock(&z->lock);
	dname_str(z->name, buf);
	if(!ssl_printf(ssl, "%s %s\n", buf,
	local_zone_type2str(z->type))) {
	/* failure to print */
	lock_rw_unlock(&z->lock);
	lock_rw_unlock(&zones->lock);
	return;
	}
	lock_rw_unlock(&z->lock);
	}
	lock_rw_unlock(&zones->lock);
	}

	/** do the list_local_data command */
	static void
	do_list_local_data(RES* ssl, struct worker* worker, struct local_zones* zones)
	{
	struct local_zone* z;
	struct local_data* d;
	struct local_rrset* p;
	char* s = (char*)sldns_buffer_begin(worker->env.scratch_buffer);
	size_t slen = sldns_buffer_capacity(worker->env.scratch_buffer);
	lock_rw_rdlock(&zones->lock);
	RBTREE_FOR(z, struct local_zone*, &zones->ztree) {
	lock_rw_rdlock(&z->lock);
	RBTREE_FOR(d, struct local_data*, &z->data) {
	for(p = d->rrsets; p; p = p->next) {
	struct packed_rrset_data* d =
	(struct packed_rrset_data*)p->rrset->entry.data;
	size_t i;
	for(i=0; i<d->count + d->rrsig_count; i++) {
	if(!packed_rr_to_string(p->rrset, i,
	0, s, slen)) {
	if(!ssl_printf(ssl, "BADRR\n")) {
	lock_rw_unlock(&z->lock);
	lock_rw_unlock(&zones->lock);
	return;
	}
	}
	if(!ssl_printf(ssl, "%s\n", s)) {
	lock_rw_unlock(&z->lock);
	lock_rw_unlock(&zones->lock);
	return;
	}
	}
	}
	}
	lock_rw_unlock(&z->lock);
	}
	lock_rw_unlock(&zones->lock);
	}

	/** do the view_list_local_zones command */
	static void
	do_view_list_local_zones(RES* ssl, struct worker* worker, char* arg)
	{
	struct view* v = views_find_view(worker->daemon->views,
	arg, 0 /* get read lock*/);
	if(!v) {
	ssl_printf(ssl,"no view with name: %s\n", arg);
	return;
	}
	if(v->local_zones) {
	do_list_local_zones(ssl, v->local_zones);
	}
	lock_rw_unlock(&v->lock);
	}

	/** do the view_list_local_data command */
	static void
	do_view_list_local_data(RES* ssl, struct worker* worker, char* arg)
	{
	struct view* v = views_find_view(worker->daemon->views,
	arg, 0 /* get read lock*/);
	if(!v) {
	ssl_printf(ssl,"no view with name: %s\n", arg);
	return;
	}
	if(v->local_zones) {
	do_list_local_data(ssl, worker, v->local_zones);
	}
	lock_rw_unlock(&v->lock);
	}

	/** struct for user arg ratelimit list */
	struct ratelimit_list_arg {
	/** the infra cache */
	struct infra_cache* infra;
	/** the SSL to print to */
	RES* ssl;
	/** all or only ratelimited */
	int all;
	/** current time */
	time_t now;
	};

	#define ip_ratelimit_list_arg ratelimit_list_arg

	/** list items in the ratelimit table */
	static void
	rate_list(struct lruhash_entry* e, void* arg)
	{
	struct ratelimit_list_arg* a = (struct ratelimit_list_arg*)arg;
	struct rate_key* k = (struct rate_key*)e->key;
	struct rate_data* d = (struct rate_data*)e->data;
	char buf[257];
	int lim = infra_find_ratelimit(a->infra, k->name, k->namelen);
	int max = infra_rate_max(d, a->now);
	if(a->all == 0) {
	if(max < lim)
	return;
	}
	dname_str(k->name, buf);
	ssl_printf(a->ssl, "%s %d limit %d\n", buf, max, lim);
	}

	/** list items in the ip_ratelimit table */
	static void
	ip_rate_list(struct lruhash_entry* e, void* arg)
	{
	char ip[128];
	struct ip_ratelimit_list_arg* a = (struct ip_ratelimit_list_arg*)arg;
	struct ip_rate_key* k = (struct ip_rate_key*)e->key;
	struct ip_rate_data* d = (struct ip_rate_data*)e->data;
	int lim = infra_ip_ratelimit;
	int max = infra_rate_max(d, a->now);
	if(a->all == 0) {
	if(max < lim)
	return;
	}
	addr_to_str(&k->addr, k->addrlen, ip, sizeof(ip));
	ssl_printf(a->ssl, "%s %d limit %d\n", ip, max, lim);
	}

	/** do the ratelimit_list command */
	static void
	do_ratelimit_list(RES* ssl, struct worker* worker, char* arg)
	{
	struct ratelimit_list_arg a;
	a.all = 0;
	a.infra = worker->env.infra_cache;
	a.now = *worker->env.now;
	a.ssl = ssl;
	arg = skipwhite(arg);
	if(strcmp(arg, "+a") == 0)
	a.all = 1;
	if(a.infra->domain_rates==NULL \|\|
	(a.all == 0 && infra_dp_ratelimit == 0))
	return;
	slabhash_traverse(a.infra->domain_rates, 0, rate_list, &a);
	}

	/** do the ip_ratelimit_list command */
	static void
	do_ip_ratelimit_list(RES* ssl, struct worker* worker, char* arg)
	{
	struct ip_ratelimit_list_arg a;
	a.all = 0;
	a.infra = worker->env.infra_cache;
	a.now = *worker->env.now;
	a.ssl = ssl;
	arg = skipwhite(arg);
	if(strcmp(arg, "+a") == 0)
	a.all = 1;
	if(a.infra->client_ip_rates==NULL \|\|
	(a.all == 0 && infra_ip_ratelimit == 0))
	return;
	slabhash_traverse(a.infra->client_ip_rates, 0, ip_rate_list, &a);
	}

	/** tell other processes to execute the command */
	static void
	distribute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd)
	{
	int i;
	if(!cmd \|\| !ssl)
	return;
	/* skip i=0 which is me */
	for(i=1; i<rc->worker->daemon->num; i++) {
	worker_send_cmd(rc->worker->daemon->workers[i],
	worker_cmd_remote);
	if(!tube_write_msg(rc->worker->daemon->workers[i]->cmd,
	(uint8_t*)cmd, strlen(cmd)+1, 0)) {
	ssl_printf(ssl, "error could not distribute cmd\n");
	return;
	}
	}
	}

	/** check for name with end-of-string, space or tab after it */
	static int
	cmdcmp(char* p, const char* cmd, size_t len)
	{
	return strncmp(p,cmd,len)==0 && (p[len]==0\|\|p[len]==' '\|\|p[len]=='\t');
	}

	/** execute a remote control command */
	static void
	execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd,
	struct worker* worker)
	{
	char* p = skipwhite(cmd);
	/* compare command */
	if(cmdcmp(p, "stop", 4)) {
	do_stop(ssl, rc);
	return;
	} else if(cmdcmp(p, "reload", 6)) {
	do_reload(ssl, rc);
	return;
	} else if(cmdcmp(p, "stats_noreset", 13)) {
	do_stats(ssl, rc, 0);
	return;
	} else if(cmdcmp(p, "stats", 5)) {
	do_stats(ssl, rc, 1);
	return;
	} else if(cmdcmp(p, "status", 6)) {
	do_status(ssl, worker);
	return;
	} else if(cmdcmp(p, "dump_cache", 10)) {
	(void)dump_cache(ssl, worker);
	return;
	} else if(cmdcmp(p, "load_cache", 10)) {
	if(load_cache(ssl, worker)) send_ok(ssl);
	return;
	} else if(cmdcmp(p, "list_forwards", 13)) {
	do_list_forwards(ssl, worker);
	return;
	} else if(cmdcmp(p, "list_stubs", 10)) {
	do_list_stubs(ssl, worker);
	return;
	} else if(cmdcmp(p, "list_insecure", 13)) {
	do_insecure_list(ssl, worker);
	return;
	} else if(cmdcmp(p, "list_local_zones", 16)) {
	do_list_local_zones(ssl, worker->daemon->local_zones);
	return;
	} else if(cmdcmp(p, "list_local_data", 15)) {
	do_list_local_data(ssl, worker, worker->daemon->local_zones);
	return;
	} else if(cmdcmp(p, "view_list_local_zones", 21)) {
	do_view_list_local_zones(ssl, worker, skipwhite(p+21));
	return;
	} else if(cmdcmp(p, "view_list_local_data", 20)) {
	do_view_list_local_data(ssl, worker, skipwhite(p+20));
	return;
	} else if(cmdcmp(p, "ratelimit_list", 14)) {
	do_ratelimit_list(ssl, worker, p+14);
	return;
	} else if(cmdcmp(p, "ip_ratelimit_list", 17)) {
	do_ip_ratelimit_list(ssl, worker, p+17);
	return;
	} else if(cmdcmp(p, "list_auth_zones", 15)) {
	do_list_auth_zones(ssl, worker->env.auth_zones);
	return;
	} else if(cmdcmp(p, "auth_zone_reload", 16)) {
	do_auth_zone_reload(ssl, worker, skipwhite(p+16));
	return;
	} else if(cmdcmp(p, "auth_zone_transfer", 18)) {
	do_auth_zone_transfer(ssl, worker, skipwhite(p+18));
	return;
	} else if(cmdcmp(p, "stub_add", 8)) {
	/* must always distribute this cmd */
	if(rc) distribute_cmd(rc, ssl, cmd);
	do_stub_add(ssl, worker, skipwhite(p+8));
	return;
	} else if(cmdcmp(p, "stub_remove", 11)) {
	/* must always distribute this cmd */
	if(rc) distribute_cmd(rc, ssl, cmd);
	do_stub_remove(ssl, worker, skipwhite(p+11));
	return;
	} else if(cmdcmp(p, "forward_add", 11)) {
	/* must always distribute this cmd */
	if(rc) distribute_cmd(rc, ssl, cmd);
	do_forward_add(ssl, worker, skipwhite(p+11));
	return;
	} else if(cmdcmp(p, "forward_remove", 14)) {
	/* must always distribute this cmd */
	if(rc) distribute_cmd(rc, ssl, cmd);
	do_forward_remove(ssl, worker, skipwhite(p+14));
	return;
	} else if(cmdcmp(p, "insecure_add", 12)) {
	/* must always distribute this cmd */
	if(rc) distribute_cmd(rc, ssl, cmd);
	do_insecure_add(ssl, worker, skipwhite(p+12));
	return;
	} else if(cmdcmp(p, "insecure_remove", 15)) {
	/* must always distribute this cmd */
	if(rc) distribute_cmd(rc, ssl, cmd);
	do_insecure_remove(ssl, worker, skipwhite(p+15));
	return;
	} else if(cmdcmp(p, "forward", 7)) {
	/* must always distribute this cmd */
	if(rc) distribute_cmd(rc, ssl, cmd);
	do_forward(ssl, worker, skipwhite(p+7));
	return;
	} else if(cmdcmp(p, "flush_stats", 11)) {
	/* must always distribute this cmd */
	if(rc) distribute_cmd(rc, ssl, cmd);
	do_flush_stats(ssl, worker);
	return;
	} else if(cmdcmp(p, "flush_requestlist", 17)) {
	/* must always distribute this cmd */
	if(rc) distribute_cmd(rc, ssl, cmd);
	do_flush_requestlist(ssl, worker);
	return;
	} else if(cmdcmp(p, "lookup", 6)) {
	do_lookup(ssl, worker, skipwhite(p+6));
	return;
	}

	#ifdef THREADS_DISABLED
	/* other processes must execute the command as well */
	/* commands that should not be distributed, returned above. */
	if(rc) { /* only if this thread is the master (rc) thread */
	/* done before the code below, which may split the string */
	distribute_cmd(rc, ssl, cmd);
	}
	#endif
	if(cmdcmp(p, "verbosity", 9)) {
	do_verbosity(ssl, skipwhite(p+9));
	} else if(cmdcmp(p, "local_zone_remove", 17)) {
	do_zone_remove(ssl, worker->daemon->local_zones, skipwhite(p+17));
	} else if(cmdcmp(p, "local_zones_remove", 18)) {
	do_zones_remove(ssl, worker->daemon->local_zones);
	} else if(cmdcmp(p, "local_zone", 10)) {
	do_zone_add(ssl, worker->daemon->local_zones, skipwhite(p+10));
	} else if(cmdcmp(p, "local_zones", 11)) {
	do_zones_add(ssl, worker->daemon->local_zones);
	} else if(cmdcmp(p, "local_data_remove", 17)) {
	do_data_remove(ssl, worker->daemon->local_zones, skipwhite(p+17));
	} else if(cmdcmp(p, "local_datas_remove", 18)) {
	do_datas_remove(ssl, worker->daemon->local_zones);
	} else if(cmdcmp(p, "local_data", 10)) {
	do_data_add(ssl, worker->daemon->local_zones, skipwhite(p+10));
	} else if(cmdcmp(p, "local_datas", 11)) {
	do_datas_add(ssl, worker->daemon->local_zones);
	} else if(cmdcmp(p, "view_local_zone_remove", 22)) {
	do_view_zone_remove(ssl, worker, skipwhite(p+22));
	} else if(cmdcmp(p, "view_local_zone", 15)) {
	do_view_zone_add(ssl, worker, skipwhite(p+15));
	} else if(cmdcmp(p, "view_local_data_remove", 22)) {
	do_view_data_remove(ssl, worker, skipwhite(p+22));
	} else if(cmdcmp(p, "view_local_data", 15)) {
	do_view_data_add(ssl, worker, skipwhite(p+15));
	+ } else if(cmdcmp(p, "view_local_datas", 16)) {
	+ do_view_datas_add(ssl, worker, skipwhite(p+16));
	} else if(cmdcmp(p, "flush_zone", 10)) {
	do_flush_zone(ssl, worker, skipwhite(p+10));
	} else if(cmdcmp(p, "flush_type", 10)) {
	do_flush_type(ssl, worker, skipwhite(p+10));
	} else if(cmdcmp(p, "flush_infra", 11)) {
	do_flush_infra(ssl, worker, skipwhite(p+11));
	} else if(cmdcmp(p, "flush", 5)) {
	do_flush_name(ssl, worker, skipwhite(p+5));
	} else if(cmdcmp(p, "dump_requestlist", 16)) {
	do_dump_requestlist(ssl, worker);
	} else if(cmdcmp(p, "dump_infra", 10)) {
	do_dump_infra(ssl, worker);
	} else if(cmdcmp(p, "log_reopen", 10)) {
	do_log_reopen(ssl, worker);
	} else if(cmdcmp(p, "set_option", 10)) {
	do_set_option(ssl, worker, skipwhite(p+10));
	} else if(cmdcmp(p, "get_option", 10)) {
	do_get_option(ssl, worker, skipwhite(p+10));
	} else if(cmdcmp(p, "flush_bogus", 11)) {
	do_flush_bogus(ssl, worker);
	} else if(cmdcmp(p, "flush_negative", 14)) {
	do_flush_negative(ssl, worker);
	} else {
	(void)ssl_printf(ssl, "error unknown command '%s'\n", p);
	}
	}

	void
	daemon_remote_exec(struct worker* worker)
	{
	/* read the cmd string */
	uint8_t* msg = NULL;
	uint32_t len = 0;
	if(!tube_read_msg(worker->cmd, &msg, &len, 0)) {
	log_err("daemon_remote_exec: tube_read_msg failed");
	return;
	}
	verbose(VERB_ALGO, "remote exec distributed: %s", (char*)msg);
	execute_cmd(NULL, NULL, (char*)msg, worker);
	free(msg);
	}

	/** handle remote control request */
	static void
	handle_req(struct daemon_remote* rc, struct rc_state* s, RES* res)
	{
	int r;
	char pre[10];
	char magic[7];
	char buf[1024];
	#ifdef USE_WINSOCK
	/* makes it possible to set the socket blocking again. */
	/* basically removes it from winsock_event ... */
	WSAEventSelect(s->c->fd, NULL, 0);
	#endif
	fd_set_block(s->c->fd);

	/* try to read magic UBCT[version]_space_ string */
	if(res->ssl) {
	ERR_clear_error();
	if((r=SSL_read(res->ssl, magic, (int)sizeof(magic)-1)) <= 0) {
	if(SSL_get_error(res->ssl, r) == SSL_ERROR_ZERO_RETURN)
	return;
	log_crypto_err("could not SSL_read");
	return;
	}
	} else {
	while(1) {
	ssize_t rr = recv(res->fd, magic, sizeof(magic)-1, 0);
	if(rr <= 0) {
	if(rr == 0) return;
	if(errno == EINTR \|\| errno == EAGAIN)
	continue;
	#ifndef USE_WINSOCK
	log_err("could not recv: %s", strerror(errno));
	#else
	log_err("could not recv: %s", wsa_strerror(WSAGetLastError()));
	#endif
	return;
	}
	r = (int)rr;
	break;
	}
	}
	magic[6] = 0;
	if( r != 6 \|\| strncmp(magic, "UBCT", 4) != 0) {
	verbose(VERB_QUERY, "control connection has bad magic string");
	/* probably wrong tool connected, ignore it completely */
	return;
	}

	/* read the command line */
	if(!ssl_read_line(res, buf, sizeof(buf))) {
	return;
	}
	snprintf(pre, sizeof(pre), "UBCT%d ", UNBOUND_CONTROL_VERSION);
	if(strcmp(magic, pre) != 0) {
	verbose(VERB_QUERY, "control connection had bad "
	"version %s, cmd: %s", magic, buf);
	ssl_printf(res, "error version mismatch\n");
	return;
	}
	verbose(VERB_DETAIL, "control cmd: %s", buf);

	/* figure out what to do */
	execute_cmd(rc, res, buf, rc->worker);
	}

	/** handle SSL_do_handshake changes to the file descriptor to wait for later */
	static int
	remote_handshake_later(struct daemon_remote* rc, struct rc_state* s,
	struct comm_point* c, int r, int r2)
	{
	if(r2 == SSL_ERROR_WANT_READ) {
	if(s->shake_state == rc_hs_read) {
	/* try again later */
	return 0;
	}
	s->shake_state = rc_hs_read;
	comm_point_listen_for_rw(c, 1, 0);
	return 0;
	} else if(r2 == SSL_ERROR_WANT_WRITE) {
	if(s->shake_state == rc_hs_write) {
	/* try again later */
	return 0;
	}
	s->shake_state = rc_hs_write;
	comm_point_listen_for_rw(c, 0, 1);
	return 0;
	} else {
	if(r == 0)
	log_err("remote control connection closed prematurely");
	log_addr(1, "failed connection from",
	&s->c->repinfo.addr, s->c->repinfo.addrlen);
	log_crypto_err("remote control failed ssl");
	clean_point(rc, s);
	}
	return 0;
	}

	int remote_control_callback(struct comm_point* c, void* arg, int err,
	struct comm_reply* ATTR_UNUSED(rep))
	{
	RES res;
	struct rc_state* s = (struct rc_state*)arg;
	struct daemon_remote* rc = s->rc;
	int r;
	if(err != NETEVENT_NOERROR) {
	if(err==NETEVENT_TIMEOUT)
	log_err("remote control timed out");
	clean_point(rc, s);
	return 0;
	}
	if(s->ssl) {
	/* (continue to) setup the SSL connection */
	ERR_clear_error();
	r = SSL_do_handshake(s->ssl);
	if(r != 1) {
	int r2 = SSL_get_error(s->ssl, r);
	return remote_handshake_later(rc, s, c, r, r2);
	}
	s->shake_state = rc_none;
	}

	/* once handshake has completed, check authentication */
	if (!rc->use_cert) {
	verbose(VERB_ALGO, "unauthenticated remote control connection");
	} else if(SSL_get_verify_result(s->ssl) == X509_V_OK) {
	X509* x = SSL_get_peer_certificate(s->ssl);
	if(!x) {
	verbose(VERB_DETAIL, "remote control connection "
	"provided no client certificate");
	clean_point(rc, s);
	return 0;
	}
	verbose(VERB_ALGO, "remote control connection authenticated");
	X509_free(x);
	} else {
	verbose(VERB_DETAIL, "remote control connection failed to "
	"authenticate with client certificate");
	clean_point(rc, s);
	return 0;
	}

	/* if OK start to actually handle the request */
	res.ssl = s->ssl;
	res.fd = c->fd;
	handle_req(rc, s, &res);

	verbose(VERB_ALGO, "remote control operation completed");
	clean_point(rc, s);
	return 0;
	}
	Index: head/contrib/unbound/daemon/stats.c
	===================================================================
	--- head/contrib/unbound/daemon/stats.c (revision 349719)
	+++ head/contrib/unbound/daemon/stats.c (revision 349720)
	@@ -1,507 +1,518 @@
	/*
	* daemon/stats.c - collect runtime performance indicators.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file describes the data structure used to collect runtime performance
	* numbers. These 'statistics' may be of interest to the operator.
	*/
	#include "config.h"
	#ifdef HAVE_TIME_H
	#include <time.h>
	#endif
	#include <sys/time.h>
	#include <sys/types.h>
	#include "daemon/stats.h"
	#include "daemon/worker.h"
	#include "daemon/daemon.h"
	#include "services/mesh.h"
	#include "services/outside_network.h"
	#include "services/listen_dnsport.h"
	#include "util/config_file.h"
	#include "util/tube.h"
	#include "util/timehist.h"
	#include "util/net_help.h"
	#include "validator/validator.h"
	#include "iterator/iterator.h"
	#include "sldns/sbuffer.h"
	#include "services/cache/rrset.h"
	#include "services/cache/infra.h"
	#include "services/authzone.h"
	#include "validator/val_kcache.h"
	#include "validator/val_neg.h"
	#ifdef CLIENT_SUBNET
	#include "edns-subnet/subnetmod.h"
	#endif
	+#ifdef HAVE_SSL
	+#include <openssl/ssl.h>
	+#endif

	/** add timers and the values do not overflow or become negative */
	static void
	stats_timeval_add(long long* d_sec, long long* d_usec, long long add_sec, long long add_usec)
	{
	#ifndef S_SPLINT_S
	(*d_sec) += add_sec;
	(*d_usec) += add_usec;
	if((*d_usec) > 1000000) {
	(*d_usec) -= 1000000;
	(*d_sec)++;
	}
	#endif
	}

	void server_stats_init(struct ub_server_stats* stats, struct config_file* cfg)
	{
	memset(stats, 0, sizeof(*stats));
	stats->extended = cfg->stat_extended;
	}

	void server_stats_querymiss(struct ub_server_stats* stats, struct worker* worker)
	{
	stats->num_queries_missed_cache++;
	stats->sum_query_list_size += worker->env.mesh->all.count;
	if((long long)worker->env.mesh->all.count > stats->max_query_list_size)
	stats->max_query_list_size = (long long)worker->env.mesh->all.count;
	}

	void server_stats_prefetch(struct ub_server_stats* stats, struct worker* worker)
	{
	stats->num_queries_prefetch++;
	/* changes the query list size so account that, like a querymiss */
	stats->sum_query_list_size += worker->env.mesh->all.count;
	if((long long)worker->env.mesh->all.count > stats->max_query_list_size)
	stats->max_query_list_size = (long long)worker->env.mesh->all.count;
	}

	void server_stats_log(struct ub_server_stats* stats, struct worker* worker,
	int threadnum)
	{
	log_info("server stats for thread %d: %u queries, "
	"%u answers from cache, %u recursions, %u prefetch, %u rejected by "
	"ip ratelimiting",
	threadnum, (unsigned)stats->num_queries,
	(unsigned)(stats->num_queries -
	stats->num_queries_missed_cache),
	(unsigned)stats->num_queries_missed_cache,
	(unsigned)stats->num_queries_prefetch,
	(unsigned)stats->num_queries_ip_ratelimited);
	log_info("server stats for thread %d: requestlist max %u avg %g "
	"exceeded %u jostled %u", threadnum,
	(unsigned)stats->max_query_list_size,
	(stats->num_queries_missed_cache+stats->num_queries_prefetch)?
	(double)stats->sum_query_list_size/
	(double)(stats->num_queries_missed_cache+
	stats->num_queries_prefetch) : 0.0,
	(unsigned)worker->env.mesh->stats_dropped,
	(unsigned)worker->env.mesh->stats_jostled);
	}


	#ifdef CLIENT_SUBNET
	/** Set the EDNS Subnet stats. */
	static void
	set_subnet_stats(struct worker* worker, struct ub_server_stats* svr,
	int reset)
	{
	int m = modstack_find(&worker->env.mesh->mods, "subnet");
	struct subnet_env* sne;
	if(m == -1)
	return;
	sne = (struct subnet_env*)worker->env.modinfo[m];
	if(reset && !worker->env.cfg->stat_cumulative) {
	lock_rw_wrlock(&sne->biglock);
	} else {
	lock_rw_rdlock(&sne->biglock);
	}
	svr->num_query_subnet = (long long)(sne->num_msg_nocache + sne->num_msg_cache);
	svr->num_query_subnet_cache = (long long)sne->num_msg_cache;
	if(reset && !worker->env.cfg->stat_cumulative) {
	sne->num_msg_cache = 0;
	sne->num_msg_nocache = 0;
	}
	lock_rw_unlock(&sne->biglock);
	}
	#endif /* CLIENT_SUBNET */

	/** Set the neg cache stats. */
	static void
	set_neg_cache_stats(struct worker* worker, struct ub_server_stats* svr,
	int reset)
	{
	int m = modstack_find(&worker->env.mesh->mods, "validator");
	struct val_env* ve;
	struct val_neg_cache* neg;
	if(m == -1)
	return;
	ve = (struct val_env*)worker->env.modinfo[m];
	if(!ve->neg_cache)
	return;
	neg = ve->neg_cache;
	lock_basic_lock(&neg->lock);
	svr->num_neg_cache_noerror = (long long)neg->num_neg_cache_noerror;
	svr->num_neg_cache_nxdomain = (long long)neg->num_neg_cache_nxdomain;
	if(reset && !worker->env.cfg->stat_cumulative) {
	neg->num_neg_cache_noerror = 0;
	neg->num_neg_cache_nxdomain = 0;
	}
	lock_basic_unlock(&neg->lock);
	}

	/** get rrsets bogus number from validator */
	static size_t
	get_rrset_bogus(struct worker* worker, int reset)
	{
	int m = modstack_find(&worker->env.mesh->mods, "validator");
	struct val_env* ve;
	size_t r;
	if(m == -1)
	return 0;
	ve = (struct val_env*)worker->env.modinfo[m];
	lock_basic_lock(&ve->bogus_lock);
	r = ve->num_rrset_bogus;
	if(reset && !worker->env.cfg->stat_cumulative)
	ve->num_rrset_bogus = 0;
	lock_basic_unlock(&ve->bogus_lock);
	return r;
	}

	/** get number of ratelimited queries from iterator */
	static size_t
	get_queries_ratelimit(struct worker* worker, int reset)
	{
	int m = modstack_find(&worker->env.mesh->mods, "iterator");
	struct iter_env* ie;
	size_t r;
	if(m == -1)
	return 0;
	ie = (struct iter_env*)worker->env.modinfo[m];
	lock_basic_lock(&ie->queries_ratelimit_lock);
	r = ie->num_queries_ratelimited;
	if(reset && !worker->env.cfg->stat_cumulative)
	ie->num_queries_ratelimited = 0;
	lock_basic_unlock(&ie->queries_ratelimit_lock);
	return r;
	}

	#ifdef USE_DNSCRYPT
	/** get the number of shared secret cache miss */
	static size_t
	get_dnscrypt_cache_miss(struct worker* worker, int reset)
	{
	size_t r;
	struct dnsc_env* de = worker->daemon->dnscenv;
	if(!de) return 0;

	lock_basic_lock(&de->shared_secrets_cache_lock);
	r = de->num_query_dnscrypt_secret_missed_cache;
	if(reset && !worker->env.cfg->stat_cumulative)
	de->num_query_dnscrypt_secret_missed_cache = 0;
	lock_basic_unlock(&de->shared_secrets_cache_lock);
	return r;
	}

	/** get the number of replayed queries */
	static size_t
	get_dnscrypt_replay(struct worker* worker, int reset)
	{
	size_t r;
	struct dnsc_env* de = worker->daemon->dnscenv;

	lock_basic_lock(&de->nonces_cache_lock);
	r = de->num_query_dnscrypt_replay;
	if(reset && !worker->env.cfg->stat_cumulative)
	de->num_query_dnscrypt_replay = 0;
	lock_basic_unlock(&de->nonces_cache_lock);
	return r;
	}
	#endif /* USE_DNSCRYPT */

	void
	server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
	{
	int i;
	struct listen_list* lp;

	s->svr = worker->stats;
	s->mesh_num_states = (long long)worker->env.mesh->all.count;
	s->mesh_num_reply_states = (long long)worker->env.mesh->num_reply_states;
	s->mesh_jostled = (long long)worker->env.mesh->stats_jostled;
	s->mesh_dropped = (long long)worker->env.mesh->stats_dropped;
	s->mesh_replies_sent = (long long)worker->env.mesh->replies_sent;
	s->mesh_replies_sum_wait_sec = (long long)worker->env.mesh->replies_sum_wait.tv_sec;
	s->mesh_replies_sum_wait_usec = (long long)worker->env.mesh->replies_sum_wait.tv_usec;
	s->mesh_time_median = timehist_quartile(worker->env.mesh->histogram,
	0.50);

	/* add in the values from the mesh */
	s->svr.ans_secure += (long long)worker->env.mesh->ans_secure;
	s->svr.ans_bogus += (long long)worker->env.mesh->ans_bogus;
	s->svr.ans_rcode_nodata += (long long)worker->env.mesh->ans_nodata;
	for(i=0; i<16; i++)
	s->svr.ans_rcode[i] += (long long)worker->env.mesh->ans_rcode[i];
	timehist_export(worker->env.mesh->histogram, s->svr.hist,
	NUM_BUCKETS_HIST);
	/* values from outside network */
	s->svr.unwanted_replies = (long long)worker->back->unwanted_replies;
	s->svr.qtcp_outgoing = (long long)worker->back->num_tcp_outgoing;

	/* get and reset validator rrset bogus number */
	s->svr.rrset_bogus = (long long)get_rrset_bogus(worker, reset);

	/* get and reset iterator query ratelimit number */
	s->svr.queries_ratelimited = (long long)get_queries_ratelimit(worker, reset);

	/* get cache sizes */
	s->svr.msg_cache_count = (long long)count_slabhash_entries(worker->env.msg_cache);
	s->svr.rrset_cache_count = (long long)count_slabhash_entries(&worker->env.rrset_cache->table);
	s->svr.infra_cache_count = (long long)count_slabhash_entries(worker->env.infra_cache->hosts);
	if(worker->env.key_cache)
	s->svr.key_cache_count = (long long)count_slabhash_entries(worker->env.key_cache->slab);
	else s->svr.key_cache_count = 0;

	#ifdef USE_DNSCRYPT
	if(worker->daemon->dnscenv) {
	s->svr.num_query_dnscrypt_secret_missed_cache =
	(long long)get_dnscrypt_cache_miss(worker, reset);
	s->svr.shared_secret_cache_count = (long long)count_slabhash_entries(
	worker->daemon->dnscenv->shared_secrets_cache);
	s->svr.nonce_cache_count = (long long)count_slabhash_entries(
	worker->daemon->dnscenv->nonces_cache);
	s->svr.num_query_dnscrypt_replay =
	(long long)get_dnscrypt_replay(worker, reset);
	} else {
	s->svr.num_query_dnscrypt_secret_missed_cache = 0;
	s->svr.shared_secret_cache_count = 0;
	s->svr.nonce_cache_count = 0;
	s->svr.num_query_dnscrypt_replay = 0;
	}
	#else
	s->svr.num_query_dnscrypt_secret_missed_cache = 0;
	s->svr.shared_secret_cache_count = 0;
	s->svr.nonce_cache_count = 0;
	s->svr.num_query_dnscrypt_replay = 0;
	#endif /* USE_DNSCRYPT */
	if(worker->env.auth_zones) {
	if(reset && !worker->env.cfg->stat_cumulative) {
	lock_rw_wrlock(&worker->env.auth_zones->lock);
	} else {
	lock_rw_rdlock(&worker->env.auth_zones->lock);
	}
	s->svr.num_query_authzone_up = (long long)worker->env.
	auth_zones->num_query_up;
	s->svr.num_query_authzone_down = (long long)worker->env.
	auth_zones->num_query_down;
	if(reset && !worker->env.cfg->stat_cumulative) {
	worker->env.auth_zones->num_query_up = 0;
	worker->env.auth_zones->num_query_down = 0;
	}
	lock_rw_unlock(&worker->env.auth_zones->lock);
	}
	+ s->svr.mem_stream_wait =
	+ (long long)tcp_req_info_get_stream_buffer_size();

	/* Set neg cache usage numbers */
	set_neg_cache_stats(worker, &s->svr, reset);
	#ifdef CLIENT_SUBNET
	/* EDNS Subnet usage numbers */
	set_subnet_stats(worker, &s->svr, reset);
	#else
	s->svr.num_query_subnet = 0;
	s->svr.num_query_subnet_cache = 0;
	#endif

	/* get tcp accept usage */
	s->svr.tcp_accept_usage = 0;
	for(lp = worker->front->cps; lp; lp = lp->next) {
	if(lp->com->type == comm_tcp_accept)
	s->svr.tcp_accept_usage += (long long)lp->com->cur_tcp_count;
	}

	if(reset && !worker->env.cfg->stat_cumulative) {
	worker_stats_clear(worker);
	}
	}

	void server_stats_obtain(struct worker* worker, struct worker* who,
	struct ub_stats_info* s, int reset)
	{
	uint8_t *reply = NULL;
	uint32_t len = 0;
	if(worker == who) {
	/* just fill it in */
	server_stats_compile(worker, s, reset);
	return;
	}
	/* communicate over tube */
	verbose(VERB_ALGO, "write stats cmd");
	if(reset)
	worker_send_cmd(who, worker_cmd_stats);
	else worker_send_cmd(who, worker_cmd_stats_noreset);
	verbose(VERB_ALGO, "wait for stats reply");
	if(!tube_read_msg(worker->cmd, &reply, &len, 0))
	fatal_exit("failed to read stats over cmd channel");
	if(len != (uint32_t)sizeof(*s))
	fatal_exit("stats on cmd channel wrong length %d %d",
	(int)len, (int)sizeof(*s));
	memcpy(s, reply, (size_t)len);
	free(reply);
	}

	void server_stats_reply(struct worker* worker, int reset)
	{
	struct ub_stats_info s;
	server_stats_compile(worker, &s, reset);
	verbose(VERB_ALGO, "write stats replymsg");
	if(!tube_write_msg(worker->daemon->workers[0]->cmd,
	(uint8_t*)&s, sizeof(s), 0))
	fatal_exit("could not write stat values over cmd channel");
	}

	void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
	{
	total->svr.num_queries += a->svr.num_queries;
	total->svr.num_queries_ip_ratelimited += a->svr.num_queries_ip_ratelimited;
	total->svr.num_queries_missed_cache += a->svr.num_queries_missed_cache;
	total->svr.num_queries_prefetch += a->svr.num_queries_prefetch;
	total->svr.sum_query_list_size += a->svr.sum_query_list_size;
	#ifdef USE_DNSCRYPT
	total->svr.num_query_dnscrypt_crypted += a->svr.num_query_dnscrypt_crypted;
	total->svr.num_query_dnscrypt_cert += a->svr.num_query_dnscrypt_cert;
	total->svr.num_query_dnscrypt_cleartext += \
	a->svr.num_query_dnscrypt_cleartext;
	total->svr.num_query_dnscrypt_crypted_malformed += \
	a->svr.num_query_dnscrypt_crypted_malformed;
	#endif /* USE_DNSCRYPT */
	/* the max size reached is upped to higher of both */
	if(a->svr.max_query_list_size > total->svr.max_query_list_size)
	total->svr.max_query_list_size = a->svr.max_query_list_size;

	if(a->svr.extended) {
	int i;
	total->svr.qtype_big += a->svr.qtype_big;
	total->svr.qclass_big += a->svr.qclass_big;
	total->svr.qtcp += a->svr.qtcp;
	total->svr.qtcp_outgoing += a->svr.qtcp_outgoing;
	total->svr.qtls += a->svr.qtls;
	+ total->svr.qtls_resume += a->svr.qtls_resume;
	total->svr.qipv6 += a->svr.qipv6;
	total->svr.qbit_QR += a->svr.qbit_QR;
	total->svr.qbit_AA += a->svr.qbit_AA;
	total->svr.qbit_TC += a->svr.qbit_TC;
	total->svr.qbit_RD += a->svr.qbit_RD;
	total->svr.qbit_RA += a->svr.qbit_RA;
	total->svr.qbit_Z += a->svr.qbit_Z;
	total->svr.qbit_AD += a->svr.qbit_AD;
	total->svr.qbit_CD += a->svr.qbit_CD;
	total->svr.qEDNS += a->svr.qEDNS;
	total->svr.qEDNS_DO += a->svr.qEDNS_DO;
	total->svr.ans_rcode_nodata += a->svr.ans_rcode_nodata;
	total->svr.zero_ttl_responses += a->svr.zero_ttl_responses;
	total->svr.ans_secure += a->svr.ans_secure;
	total->svr.ans_bogus += a->svr.ans_bogus;
	total->svr.unwanted_replies += a->svr.unwanted_replies;
	total->svr.unwanted_queries += a->svr.unwanted_queries;
	total->svr.tcp_accept_usage += a->svr.tcp_accept_usage;
	for(i=0; i<UB_STATS_QTYPE_NUM; i++)
	total->svr.qtype[i] += a->svr.qtype[i];
	for(i=0; i<UB_STATS_QCLASS_NUM; i++)
	total->svr.qclass[i] += a->svr.qclass[i];
	for(i=0; i<UB_STATS_OPCODE_NUM; i++)
	total->svr.qopcode[i] += a->svr.qopcode[i];
	for(i=0; i<UB_STATS_RCODE_NUM; i++)
	total->svr.ans_rcode[i] += a->svr.ans_rcode[i];
	for(i=0; i<NUM_BUCKETS_HIST; i++)
	total->svr.hist[i] += a->svr.hist[i];
	}

	total->mesh_num_states += a->mesh_num_states;
	total->mesh_num_reply_states += a->mesh_num_reply_states;
	total->mesh_jostled += a->mesh_jostled;
	total->mesh_dropped += a->mesh_dropped;
	total->mesh_replies_sent += a->mesh_replies_sent;
	stats_timeval_add(&total->mesh_replies_sum_wait_sec, &total->mesh_replies_sum_wait_usec, a->mesh_replies_sum_wait_sec, a->mesh_replies_sum_wait_usec);
	/* the medians are averaged together, this is not as accurate as
	* taking the median over all of the data, but is good and fast
	* added up here, division later*/
	total->mesh_time_median += a->mesh_time_median;
	}

	void server_stats_insquery(struct ub_server_stats* stats, struct comm_point* c,
	uint16_t qtype, uint16_t qclass, struct edns_data* edns,
	struct comm_reply* repinfo)
	{
	uint16_t flags = sldns_buffer_read_u16_at(c->buffer, 2);
	if(qtype < UB_STATS_QTYPE_NUM)
	stats->qtype[qtype]++;
	else stats->qtype_big++;
	if(qclass < UB_STATS_QCLASS_NUM)
	stats->qclass[qclass]++;
	else stats->qclass_big++;
	stats->qopcode[ LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) ]++;
	if(c->type != comm_udp) {
	stats->qtcp++;
	- if(c->ssl != NULL)
	+ if(c->ssl != NULL) {
	stats->qtls++;
	+#ifdef HAVE_SSL
	+ if(SSL_session_reused(c->ssl))
	+ stats->qtls_resume++;
	+#endif
	+ }
	}
	if(repinfo && addr_is_ip6(&repinfo->addr, repinfo->addrlen))
	stats->qipv6++;
	if( (flags&BIT_QR) )
	stats->qbit_QR++;
	if( (flags&BIT_AA) )
	stats->qbit_AA++;
	if( (flags&BIT_TC) )
	stats->qbit_TC++;
	if( (flags&BIT_RD) )
	stats->qbit_RD++;
	if( (flags&BIT_RA) )
	stats->qbit_RA++;
	if( (flags&BIT_Z) )
	stats->qbit_Z++;
	if( (flags&BIT_AD) )
	stats->qbit_AD++;
	if( (flags&BIT_CD) )
	stats->qbit_CD++;
	if(edns->edns_present) {
	stats->qEDNS++;
	if( (edns->bits & EDNS_DO) )
	stats->qEDNS_DO++;
	}
	}

	void server_stats_insrcode(struct ub_server_stats* stats, sldns_buffer* buf)
	{
	if(stats->extended && sldns_buffer_limit(buf) != 0) {
	int r = (int)LDNS_RCODE_WIRE( sldns_buffer_begin(buf) );
	stats->ans_rcode[r] ++;
	if(r == 0 && LDNS_ANCOUNT( sldns_buffer_begin(buf) ) == 0)
	stats->ans_rcode_nodata ++;
	}
	}
	Index: head/contrib/unbound/daemon/unbound.c
	===================================================================
	--- head/contrib/unbound/daemon/unbound.c (revision 349719)
	+++ head/contrib/unbound/daemon/unbound.c (revision 349720)
	@@ -1,757 +1,776 @@
	/*
	* daemon/unbound.c - main program for unbound DNS resolver daemon.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*
	*/

	/**
	* \file
	*
	* Main program to start the DNS resolver daemon.
	*/

	#include "config.h"
	#ifdef HAVE_GETOPT_H
	#include <getopt.h>
	#endif
	#include <sys/time.h>
	#include "util/log.h"
	#include "daemon/daemon.h"
	#include "daemon/remote.h"
	#include "util/config_file.h"
	#include "util/storage/slabhash.h"
	#include "services/listen_dnsport.h"
	#include "services/cache/rrset.h"
	#include "services/cache/infra.h"
	#include "util/fptr_wlist.h"
	#include "util/data/msgreply.h"
	#include "util/module.h"
	#include "util/net_help.h"
	#include "util/ub_event.h"
	#include <signal.h>
	#include <fcntl.h>
	#include <openssl/crypto.h>
	#ifdef HAVE_PWD_H
	#include <pwd.h>
	#endif
	#ifdef HAVE_GRP_H
	#include <grp.h>
	#endif
	+#include <openssl/ssl.h>

	#ifndef S_SPLINT_S
	/* splint chokes on this system header file */
	#ifdef HAVE_SYS_RESOURCE_H
	#include <sys/resource.h>
	#endif
	#endif /* S_SPLINT_S */
	#ifdef HAVE_LOGIN_CAP_H
	#include <login_cap.h>
	#endif

	#ifdef UB_ON_WINDOWS
	# include "winrc/win_svc.h"
	#endif

	#ifdef HAVE_NSS
	/* nss3 */
	# include "nss.h"
	#endif

	/** print usage. */
	static void usage(void)
	{
	const char** m;
	const char evnm="event", evsys="", *evmethod="";
	time_t t;
	struct timeval now;
	struct ub_event_base* base;
	printf("usage: local-unbound [options]\n");
	printf(" start unbound daemon DNS resolver.\n");
	printf("-h this help\n");
	printf("-c file config file to read instead of %s\n", CONFIGFILE);
	printf(" file format is described in unbound.conf(5).\n");
	printf("-d do not fork into the background.\n");
	printf("-p do not create a pidfile.\n");
	printf("-v verbose (more times to increase verbosity)\n");
	#ifdef UB_ON_WINDOWS
	printf("-w opt windows option: \n");
	printf(" install, remove - manage the services entry\n");
	printf(" service - used to start from services control panel\n");
	#endif
	printf("Version %s\n", PACKAGE_VERSION);
	base = ub_default_event_base(0,&t,&now);
	ub_get_event_sys(base, &evnm, &evsys, &evmethod);
	printf("linked libs: %s %s (it uses %s), %s\n",
	evnm, evsys, evmethod,
	#ifdef HAVE_SSL
	# ifdef SSLEAY_VERSION
	SSLeay_version(SSLEAY_VERSION)
	# else
	OpenSSL_version(OPENSSL_VERSION)
	# endif
	#elif defined(HAVE_NSS)
	NSS_GetVersion()
	#elif defined(HAVE_NETTLE)
	"nettle"
	#endif
	);
	printf("linked modules:");
	for(m = module_list_avail(); *m; m++)
	printf(" %s", *m);
	printf("\n");
	#ifdef USE_DNSCRYPT
	printf("DNSCrypt feature available\n");
	#endif
	printf("BSD licensed, see LICENSE in source package for details.\n");
	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
	ub_event_base_free(base);
	}

	#ifndef unbound_testbound
	int replay_var_compare(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
	{
	log_assert(0);
	return 0;
	}
	#endif

	/** check file descriptor count */
	static void
	checkrlimits(struct config_file* cfg)
	{
	#ifndef S_SPLINT_S
	#ifdef HAVE_GETRLIMIT
	/* list has number of ports to listen to, ifs number addresses */
	int list = ((cfg->do_udp?1:0) + (cfg->do_tcp?1 +
	(int)cfg->incoming_num_tcp:0));
	size_t listen_ifs = (size_t)(cfg->num_ifs==0?
	((cfg->do_ip4 && !cfg->if_automatic?1:0) +
	(cfg->do_ip6?1:0)):cfg->num_ifs);
	size_t listen_num = list*listen_ifs;
	size_t outudpnum = (size_t)cfg->outgoing_num_ports;
	size_t outtcpnum = cfg->outgoing_num_tcp;
	size_t misc = 4; /* logfile, pidfile, stdout... */
	size_t perthread_noudp = listen_num + outtcpnum +
	2/cmdpipe/ + 2/libevent/ + misc;
	size_t perthread = perthread_noudp + outudpnum;

	#if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
	int numthread = 1; /* it forks */
	#else
	int numthread = (cfg->num_threads?cfg->num_threads:1);
	#endif
	size_t total = numthread * perthread + misc;
	size_t avail;
	struct rlimit rlim;

	if(total > 1024 &&
	strncmp(ub_event_get_version(), "mini-event", 10) == 0) {
	log_warn("too many file descriptors requested. The builtin"
	"mini-event cannot handle more than 1024. Config "
	"for less fds or compile with libevent");
	if(numthread*perthread_noudp+15 > 1024)
	fatal_exit("too much tcp. not enough fds.");
	cfg->outgoing_num_ports = (int)((1024
	- numthread*perthread_noudp
	- 10 /* safety margin */) /numthread);
	log_warn("continuing with less udp ports: %u",
	cfg->outgoing_num_ports);
	total = 1024;
	}
	if(perthread > 64 &&
	strncmp(ub_event_get_version(), "winsock-event", 13) == 0) {
	log_err("too many file descriptors requested. The winsock"
	" event handler cannot handle more than 64 per "
	" thread. Config for less fds");
	if(perthread_noudp+2 > 64)
	fatal_exit("too much tcp. not enough fds.");
	cfg->outgoing_num_ports = (int)((64
	- perthread_noudp
	- 2/* safety margin */));
	log_warn("continuing with less udp ports: %u",
	cfg->outgoing_num_ports);
	total = numthread*(perthread_noudp+
	(size_t)cfg->outgoing_num_ports)+misc;
	}
	if(getrlimit(RLIMIT_NOFILE, &rlim) < 0) {
	log_warn("getrlimit: %s", strerror(errno));
	return;
	}
	if(rlim.rlim_cur == (rlim_t)RLIM_INFINITY)
	return;
	if((size_t)rlim.rlim_cur < total) {
	avail = (size_t)rlim.rlim_cur;
	rlim.rlim_cur = (rlim_t)(total + 10);
	rlim.rlim_max = (rlim_t)(total + 10);
	#ifdef HAVE_SETRLIMIT
	if(setrlimit(RLIMIT_NOFILE, &rlim) < 0) {
	log_warn("setrlimit: %s", strerror(errno));
	#endif
	log_warn("cannot increase max open fds from %u to %u",
	(unsigned)avail, (unsigned)total+10);
	/* check that calculation below does not underflow,
	* with 15 as margin */
	if(numthread*perthread_noudp+15 > avail)
	fatal_exit("too much tcp. not enough fds.");
	cfg->outgoing_num_ports = (int)((avail
	- numthread*perthread_noudp
	- 10 /* safety margin */) /numthread);
	log_warn("continuing with less udp ports: %u",
	cfg->outgoing_num_ports);
	log_warn("increase ulimit or decrease threads, "
	"ports in config to remove this warning");
	return;
	#ifdef HAVE_SETRLIMIT
	}
	#endif
	verbose(VERB_ALGO, "increased limit(open files) from %u to %u",
	(unsigned)avail, (unsigned)total+10);
	}
	#else
	(void)cfg;
	#endif /* HAVE_GETRLIMIT */
	#endif /* S_SPLINT_S */
	}

	/ set default logfile identity based on value from argv[0] at startup /
	static void
	log_ident_set_fromdefault(struct config_file* cfg,
	const char *log_default_identity)
	{
	if(cfg->log_identity == NULL \|\| cfg->log_identity[0] == 0)
	log_ident_set(log_default_identity);
	else
	log_ident_set(cfg->log_identity);
	}

	/** set verbosity, check rlimits, cache settings */
	static void
	apply_settings(struct daemon* daemon, struct config_file* cfg,
	int cmdline_verbose, int debug_mode, const char* log_default_identity)
	{
	/* apply if they have changed */
	verbosity = cmdline_verbose + cfg->verbosity;
	if (debug_mode > 1) {
	cfg->use_syslog = 0;
	free(cfg->logfile);
	cfg->logfile = NULL;
	}
	daemon_apply_cfg(daemon, cfg);
	checkrlimits(cfg);

	if (cfg->use_systemd && cfg->do_daemonize) {
	log_warn("use-systemd and do-daemonize should not be enabled at the same time");
	}

	log_ident_set_fromdefault(cfg, log_default_identity);
	}

	#ifdef HAVE_KILL
	/** Read existing pid from pidfile.
	* @param file: file name of pid file.
	* @return: the pid from the file or -1 if none.
	*/
	static pid_t
	readpid (const char* file)
	{
	int fd;
	pid_t pid;
	char pidbuf[32];
	char* t;
	ssize_t l;

	if ((fd = open(file, O_RDONLY)) == -1) {
	if(errno != ENOENT)
	log_err("Could not read pidfile %s: %s",
	file, strerror(errno));
	return -1;
	}

	if (((l = read(fd, pidbuf, sizeof(pidbuf)))) == -1) {
	if(errno != ENOENT)
	log_err("Could not read pidfile %s: %s",
	file, strerror(errno));
	close(fd);
	return -1;
	}

	close(fd);

	/* Empty pidfile means no pidfile... */
	if (l == 0) {
	return -1;
	}

	pidbuf[sizeof(pidbuf)-1] = 0;
	pid = (pid_t)strtol(pidbuf, &t, 10);

	if (t && t != '\n') {
	return -1;
	}
	return pid;
	}

	/** write pid to file.
	* @param pidfile: file name of pid file.
	* @param pid: pid to write to file.
	*/
	static void
	writepid (const char* pidfile, pid_t pid)
	{
	FILE* f;

	if ((f = fopen(pidfile, "w")) == NULL ) {
	log_err("cannot open pidfile %s: %s",
	pidfile, strerror(errno));
	return;
	}
	if(fprintf(f, "%lu\n", (unsigned long)pid) < 0) {
	log_err("cannot write to pidfile %s: %s",
	pidfile, strerror(errno));
	}
	fclose(f);
	}

	/**
	* check old pid file.
	* @param pidfile: the file name of the pid file.
	* @param inchroot: if pidfile is inchroot and we can thus expect to
	* be able to delete it.
	*/
	static void
	checkoldpid(char* pidfile, int inchroot)
	{
	pid_t old;
	if((old = readpid(pidfile)) != -1) {
	/* see if it is still alive */
	if(kill(old, 0) == 0 \|\| errno == EPERM)
	log_warn("unbound is already running as pid %u.",
	(unsigned)old);
	else if(inchroot)
	log_warn("did not exit gracefully last time (%u)",
	(unsigned)old);
	}
	}
	#endif /* HAVE_KILL */

	/** detach from command line */
	static void
	detach(void)
	{
	#if defined(HAVE_DAEMON) && !defined(DEPRECATED_DAEMON)
	/* use POSIX daemon(3) function */
	if(daemon(1, 0) != 0)
	fatal_exit("daemon failed: %s", strerror(errno));
	#else /* no HAVE_DAEMON */
	#ifdef HAVE_FORK
	int fd;
	/* Take off... */
	switch (fork()) {
	case 0:
	break;
	case -1:
	fatal_exit("fork failed: %s", strerror(errno));
	default:
	/* exit interactive session */
	exit(0);
	}
	/* detach */
	#ifdef HAVE_SETSID
	if(setsid() == -1)
	fatal_exit("setsid() failed: %s", strerror(errno));
	#endif
	if ((fd = open("/dev/null", O_RDWR, 0)) != -1) {
	(void)dup2(fd, STDIN_FILENO);
	(void)dup2(fd, STDOUT_FILENO);
	(void)dup2(fd, STDERR_FILENO);
	if (fd > 2)
	(void)close(fd);
	}
	#endif /* HAVE_FORK */
	#endif /* HAVE_DAEMON */
	}

	/** daemonize, drop user privileges and chroot if needed */
	static void
	perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
	const char** cfgfile, int need_pidfile)
	{
	#ifdef HAVE_KILL
	int pidinchroot;
	#endif
	#ifdef HAVE_GETPWNAM
	struct passwd *pwd = NULL;

	if(cfg->username && cfg->username[0]) {
	if((pwd = getpwnam(cfg->username)) == NULL)
	fatal_exit("user '%s' does not exist.", cfg->username);
	/* endpwent below, in case we need pwd for setusercontext */
	}
	#endif
	#ifdef UB_ON_WINDOWS
	w_config_adjust_directory(cfg);
	#endif

	/* read ssl keys while superuser and outside chroot */
	#ifdef HAVE_SSL
	if(!(daemon->rc = daemon_remote_create(cfg)))
	fatal_exit("could not set up remote-control");
	if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
	if(!(daemon->listen_sslctx = listen_sslctx_create(
	cfg->ssl_service_key, cfg->ssl_service_pem, NULL)))
	fatal_exit("could not set up listen SSL_CTX");
	+ if(cfg->tls_ciphers && cfg->tls_ciphers[0]) {
	+ if (!SSL_CTX_set_cipher_list(daemon->listen_sslctx, cfg->tls_ciphers)) {
	+ fatal_exit("failed to set tls-cipher %s", cfg->tls_ciphers);
	+ }
	+ }
	+#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
	+ if(cfg->tls_ciphersuites && cfg->tls_ciphersuites[0]) {
	+ if (!SSL_CTX_set_ciphersuites(daemon->listen_sslctx, cfg->tls_ciphersuites)) {
	+ fatal_exit("failed to set tls-ciphersuites %s", cfg->tls_ciphersuites);
	+ }
	+ }
	+#endif
	+ if(cfg->tls_session_ticket_keys.first &&
	+ cfg->tls_session_ticket_keys.first->str[0] != 0) {
	+ if(!listen_sslctx_setup_ticket_keys(daemon->listen_sslctx, cfg->tls_session_ticket_keys.first)) {
	+ fatal_exit("could not set session ticket SSL_CTX");
	+ }
	+ }
	}
	if(!(daemon->connect_sslctx = connect_sslctx_create(NULL, NULL,
	cfg->tls_cert_bundle, cfg->tls_win_cert)))
	fatal_exit("could not set up connect SSL_CTX");
	#endif

	/* init syslog (as root) if needed, before daemonize, otherwise
	* a fork error could not be printed since daemonize closed stderr.*/
	if(cfg->use_syslog) {
	log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
	}
	/* if using a logfile, we cannot open it because the logfile would
	* be created with the wrong permissions, we cannot chown it because
	* we cannot chown system logfiles, so we do not open at all.
	* So, using a logfile, the user does not see errors unless -d is
	* given to unbound on the commandline. */

	#ifdef HAVE_KILL
	/* true if pidfile is inside chrootdir, or nochroot */
	pidinchroot = need_pidfile && (!(cfg->chrootdir && cfg->chrootdir[0]) \|\|
	(cfg->chrootdir && cfg->chrootdir[0] &&
	strncmp(cfg->pidfile, cfg->chrootdir,
	strlen(cfg->chrootdir))==0));

	/* check old pid file before forking */
	if(cfg->pidfile && cfg->pidfile[0] && need_pidfile) {
	/* calculate position of pidfile */
	if(cfg->pidfile[0] == '/')
	daemon->pidfile = strdup(cfg->pidfile);
	else daemon->pidfile = fname_after_chroot(cfg->pidfile,
	cfg, 1);
	if(!daemon->pidfile)
	fatal_exit("pidfile alloc: out of memory");
	checkoldpid(daemon->pidfile, pidinchroot);
	}
	#endif

	/* daemonize because pid is needed by the writepid func */
	if(!debug_mode && cfg->do_daemonize) {
	detach();
	}

	/* write new pidfile (while still root, so can be outside chroot) */
	#ifdef HAVE_KILL
	if(cfg->pidfile && cfg->pidfile[0] && need_pidfile) {
	writepid(daemon->pidfile, getpid());
	if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1 &&
	pidinchroot) {
	# ifdef HAVE_CHOWN
	if(chown(daemon->pidfile, cfg_uid, cfg_gid) == -1) {
	verbose(VERB_QUERY, "cannot chown %u.%u %s: %s",
	(unsigned)cfg_uid, (unsigned)cfg_gid,
	daemon->pidfile, strerror(errno));
	}
	# endif /* HAVE_CHOWN */
	}
	}
	#else
	(void)daemon;
	(void)need_pidfile;
	#endif /* HAVE_KILL */

	/* Set user context */
	#ifdef HAVE_GETPWNAM
	if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1) {
	#ifdef HAVE_SETUSERCONTEXT
	/* setusercontext does initgroups, setuid, setgid, and
	* also resource limits from login config, but we
	* still call setresuid, setresgid to be sure to set all uid*/
	if(setusercontext(NULL, pwd, cfg_uid, (unsigned)
	LOGIN_SETALL & ~LOGIN_SETUSER & ~LOGIN_SETGROUP) != 0)
	log_warn("unable to setusercontext %s: %s",
	cfg->username, strerror(errno));
	#endif /* HAVE_SETUSERCONTEXT */
	}
	#endif /* HAVE_GETPWNAM */

	/* box into the chroot */
	#ifdef HAVE_CHROOT
	if(cfg->chrootdir && cfg->chrootdir[0]) {
	if(chdir(cfg->chrootdir)) {
	fatal_exit("unable to chdir to chroot %s: %s",
	cfg->chrootdir, strerror(errno));
	}
	verbose(VERB_QUERY, "chdir to %s", cfg->chrootdir);
	if(chroot(cfg->chrootdir))
	fatal_exit("unable to chroot to %s: %s",
	cfg->chrootdir, strerror(errno));
	if(chdir("/"))
	fatal_exit("unable to chdir to / in chroot %s: %s",
	cfg->chrootdir, strerror(errno));
	verbose(VERB_QUERY, "chroot to %s", cfg->chrootdir);
	if(strncmp(*cfgfile, cfg->chrootdir,
	strlen(cfg->chrootdir)) == 0)
	(*cfgfile) += strlen(cfg->chrootdir);

	/* adjust stored pidfile for chroot */
	if(daemon->pidfile && daemon->pidfile[0] &&
	strncmp(daemon->pidfile, cfg->chrootdir,
	strlen(cfg->chrootdir))==0) {
	char* old = daemon->pidfile;
	daemon->pidfile = strdup(old+strlen(cfg->chrootdir));
	free(old);
	if(!daemon->pidfile)
	log_err("out of memory in pidfile adjust");
	}
	daemon->chroot = strdup(cfg->chrootdir);
	if(!daemon->chroot)
	log_err("out of memory in daemon chroot dir storage");
	}
	#else
	(void)cfgfile;
	#endif
	/* change to working directory inside chroot */
	if(cfg->directory && cfg->directory[0]) {
	char* dir = cfg->directory;
	if(cfg->chrootdir && cfg->chrootdir[0] &&
	strncmp(dir, cfg->chrootdir,
	strlen(cfg->chrootdir)) == 0)
	dir += strlen(cfg->chrootdir);
	if(dir[0]) {
	if(chdir(dir)) {
	fatal_exit("Could not chdir to %s: %s",
	dir, strerror(errno));
	}
	verbose(VERB_QUERY, "chdir to %s", dir);
	}
	}

	/* drop permissions after chroot, getpwnam, pidfile, syslog done*/
	#ifdef HAVE_GETPWNAM
	if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1) {
	# ifdef HAVE_INITGROUPS
	if(initgroups(cfg->username, cfg_gid) != 0)
	log_warn("unable to initgroups %s: %s",
	cfg->username, strerror(errno));
	# endif /* HAVE_INITGROUPS */
	# ifdef HAVE_ENDPWENT
	endpwent();
	# endif

	#ifdef HAVE_SETRESGID
	if(setresgid(cfg_gid,cfg_gid,cfg_gid) != 0)
	#elif defined(HAVE_SETREGID) && !defined(DARWIN_BROKEN_SETREUID)
	if(setregid(cfg_gid,cfg_gid) != 0)
	#else /* use setgid */
	if(setgid(cfg_gid) != 0)
	#endif /* HAVE_SETRESGID */
	fatal_exit("unable to set group id of %s: %s",
	cfg->username, strerror(errno));
	#ifdef HAVE_SETRESUID
	if(setresuid(cfg_uid,cfg_uid,cfg_uid) != 0)
	#elif defined(HAVE_SETREUID) && !defined(DARWIN_BROKEN_SETREUID)
	if(setreuid(cfg_uid,cfg_uid) != 0)
	#else /* use setuid */
	if(setuid(cfg_uid) != 0)
	#endif /* HAVE_SETRESUID */
	fatal_exit("unable to set user id of %s: %s",
	cfg->username, strerror(errno));
	verbose(VERB_QUERY, "drop user privileges, run as %s",
	cfg->username);
	}
	#endif /* HAVE_GETPWNAM */
	/* file logging inited after chroot,chdir,setuid is done so that
	* it would succeed on SIGHUP as well */
	if(!cfg->use_syslog)
	log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
	}

	/**
	* Run the daemon.
	* @param cfgfile: the config file name.
	* @param cmdline_verbose: verbosity resulting from commandline -v.
	* These increase verbosity as specified in the config file.
	* @param debug_mode: if set, do not daemonize.
	* @param log_default_identity: Default identity to report in logs
	* @param need_pidfile: if false, no pidfile is checked or created.
	*/
	static void
	run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode, const char* log_default_identity, int need_pidfile)
	{
	struct config_file* cfg = NULL;
	struct daemon* daemon = NULL;
	int done_setup = 0;

	if(!(daemon = daemon_init()))
	fatal_exit("alloc failure");
	while(!daemon->need_to_exit) {
	if(done_setup)
	verbose(VERB_OPS, "Restart of %s.", PACKAGE_STRING);
	else verbose(VERB_OPS, "Start of %s.", PACKAGE_STRING);

	/* config stuff */
	if(!(cfg = config_create()))
	fatal_exit("Could not alloc config defaults");
	if(!config_read(cfg, cfgfile, daemon->chroot)) {
	if(errno != ENOENT)
	fatal_exit("Could not read config file: %s."
	" Maybe try unbound -dd, it stays on "
	"the commandline to see more errors, "
	"or unbound-checkconf", cfgfile);
	log_warn("Continuing with default config settings");
	}
	apply_settings(daemon, cfg, cmdline_verbose, debug_mode, log_default_identity);
	if(!done_setup)
	config_lookup_uid(cfg);

	/* prepare */
	if(!daemon_open_shared_ports(daemon))
	fatal_exit("could not open ports");
	if(!done_setup) {
	perform_setup(daemon, cfg, debug_mode, &cfgfile, need_pidfile);
	done_setup = 1;
	} else {
	/* reopen log after HUP to facilitate log rotation */
	if(!cfg->use_syslog)
	log_init(cfg->logfile, 0, cfg->chrootdir);
	}
	/* work */
	daemon_fork(daemon);

	/* clean up for restart */
	verbose(VERB_ALGO, "cleanup.");
	daemon_cleanup(daemon);
	config_delete(cfg);
	}
	verbose(VERB_ALGO, "Exit cleanup.");
	/* this unlink may not work if the pidfile is located outside
	* of the chroot/workdir or we no longer have permissions */
	if(daemon->pidfile) {
	int fd;
	/* truncate pidfile */
	fd = open(daemon->pidfile, O_WRONLY \| O_TRUNC, 0644);
	if(fd != -1)
	close(fd);
	/* delete pidfile */
	unlink(daemon->pidfile);
	}
	daemon_delete(daemon);
	}

	/** getopt global, in case header files fail to declare it. */
	extern int optind;
	/** getopt global, in case header files fail to declare it. */
	extern char* optarg;

	/**
	* main program. Set options given commandline arguments.
	* @param argc: number of commandline arguments.
	* @param argv: array of commandline arguments.
	* @return: exit status of the program.
	*/
	int
	main(int argc, char* argv[])
	{
	int c;
	const char* cfgfile = CONFIGFILE;
	const char* winopt = NULL;
	const char* log_ident_default;
	int cmdline_verbose = 0;
	int debug_mode = 0;
	int need_pidfile = 1;

	#ifdef UB_ON_WINDOWS
	int cmdline_cfg = 0;
	#endif

	log_init(NULL, 0, NULL);
	log_ident_default = strrchr(argv[0],'/')?strrchr(argv[0],'/')+1:argv[0];
	log_ident_set(log_ident_default);
	/* parse the options */
	while( (c=getopt(argc, argv, "c:dhpvw:")) != -1) {
	switch(c) {
	case 'c':
	cfgfile = optarg;
	#ifdef UB_ON_WINDOWS
	cmdline_cfg = 1;
	#endif
	break;
	case 'v':
	cmdline_verbose++;
	verbosity++;
	break;
	case 'p':
	need_pidfile = 0;
	break;
	case 'd':
	debug_mode++;
	break;
	case 'w':
	winopt = optarg;
	break;
	case '?':
	case 'h':
	default:
	usage();
	return 1;
	}
	}
	argc -= optind;
	/* argv += optind; not using further arguments */

	if(winopt) {
	#ifdef UB_ON_WINDOWS
	wsvc_command_option(winopt, cfgfile, cmdline_verbose,
	cmdline_cfg);
	#else
	fatal_exit("option not supported");
	#endif
	}

	if(argc != 0) {
	usage();
	return 1;
	}

	run_daemon(cfgfile, cmdline_verbose, debug_mode, log_ident_default, need_pidfile);
	log_init(NULL, 0, NULL); /* close logfile */
	#ifndef unbound_testbound
	if(log_get_lock()) {
	lock_quick_destroy((lock_quick_type*)log_get_lock());
	}
	#endif
	return 0;
	}
	Index: head/contrib/unbound/daemon/worker.c
	===================================================================
	--- head/contrib/unbound/daemon/worker.c (revision 349719)
	+++ head/contrib/unbound/daemon/worker.c (revision 349720)
	@@ -1,2054 +1,2068 @@
	/*
	* daemon/worker.c - worker that handles a pending list of requests.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file implements the worker that handles callbacks on events, for
	* pending requests.
	*/
	#include "config.h"
	#include "util/log.h"
	#include "util/net_help.h"
	#include "util/random.h"
	#include "daemon/worker.h"
	#include "daemon/daemon.h"
	#include "daemon/remote.h"
	#include "daemon/acl_list.h"
	#include "util/netevent.h"
	#include "util/config_file.h"
	#include "util/module.h"
	#include "util/regional.h"
	#include "util/storage/slabhash.h"
	#include "services/listen_dnsport.h"
	#include "services/outside_network.h"
	#include "services/outbound_list.h"
	#include "services/cache/rrset.h"
	#include "services/cache/infra.h"
	#include "services/cache/dns.h"
	#include "services/authzone.h"
	#include "services/mesh.h"
	#include "services/localzone.h"
	#include "util/data/msgparse.h"
	#include "util/data/msgencode.h"
	#include "util/data/dname.h"
	#include "util/fptr_wlist.h"
	#include "util/tube.h"
	#include "util/edns.h"
	#include "iterator/iter_fwd.h"
	#include "iterator/iter_hints.h"
	#include "validator/autotrust.h"
	#include "validator/val_anchor.h"
	#include "respip/respip.h"
	#include "libunbound/context.h"
	#include "libunbound/libworker.h"
	#include "sldns/sbuffer.h"
	#include "sldns/wire2str.h"
	#include "util/shm_side/shm_main.h"
	#include "dnscrypt/dnscrypt.h"

	#ifdef HAVE_SYS_TYPES_H
	# include <sys/types.h>
	#endif
	#ifdef HAVE_NETDB_H
	#include <netdb.h>
	#endif
	#include <signal.h>
	#ifdef UB_ON_WINDOWS
	#include "winrc/win_svc.h"
	#endif

	/** Size of an UDP datagram */
	#define NORMAL_UDP_SIZE 512 /* bytes */
	/** ratelimit for error responses */
	#define ERROR_RATELIMIT 100 /* qps */

	/**
	* seconds to add to prefetch leeway. This is a TTL that expires old rrsets
	* earlier than they should in order to put the new update into the cache.
	* This additional value is to make sure that if not all TTLs are equal in
	* the message to be updated(and replaced), that rrsets with up to this much
	* extra TTL are also replaced. This means that the resulting new message
	* will have (most likely) this TTL at least, avoiding very small 'split
	* second' TTLs due to operators choosing relative primes for TTLs (or so).
	* Also has to be at least one to break ties (and overwrite cached entry).
	*/
	#define PREFETCH_EXPIRY_ADD 60

	/** Report on memory usage by this thread and global */
	static void
	worker_mem_report(struct worker* ATTR_UNUSED(worker),
	struct serviced_query* ATTR_UNUSED(cur_serv))
	{
	#ifdef UNBOUND_ALLOC_STATS
	/* measure memory leakage */
	extern size_t unbound_mem_alloc, unbound_mem_freed;
	/* debug func in validator module */
	size_t total, front, back, mesh, msg, rrset, infra, ac, superac;
	size_t me, iter, val, anch;
	int i;
	#ifdef CLIENT_SUBNET
	size_t subnet = 0;
	#endif /* CLIENT_SUBNET */
	if(verbosity < VERB_ALGO)
	return;
	front = listen_get_mem(worker->front);
	back = outnet_get_mem(worker->back);
	msg = slabhash_get_mem(worker->env.msg_cache);
	rrset = slabhash_get_mem(&worker->env.rrset_cache->table);
	infra = infra_get_mem(worker->env.infra_cache);
	mesh = mesh_get_mem(worker->env.mesh);
	ac = alloc_get_mem(&worker->alloc);
	superac = alloc_get_mem(&worker->daemon->superalloc);
	anch = anchors_get_mem(worker->env.anchors);
	iter = 0;
	val = 0;
	for(i=0; i<worker->env.mesh->mods.num; i++) {
	fptr_ok(fptr_whitelist_mod_get_mem(worker->env.mesh->
	mods.mod[i]->get_mem));
	if(strcmp(worker->env.mesh->mods.mod[i]->name, "validator")==0)
	val += (*worker->env.mesh->mods.mod[i]->get_mem)
	(&worker->env, i);
	#ifdef CLIENT_SUBNET
	else if(strcmp(worker->env.mesh->mods.mod[i]->name,
	"subnet")==0)
	subnet += (*worker->env.mesh->mods.mod[i]->get_mem)
	(&worker->env, i);
	#endif /* CLIENT_SUBNET */
	else iter += (*worker->env.mesh->mods.mod[i]->get_mem)
	(&worker->env, i);
	}
	me = sizeof(worker) + sizeof(worker->base) + sizeof(*worker->comsig)
	+ comm_point_get_mem(worker->cmd_com)
	+ sizeof(worker->rndstate)
	+ regional_get_mem(worker->scratchpad)
	+ sizeof(*worker->env.scratch_buffer)
	+ sldns_buffer_capacity(worker->env.scratch_buffer)
	+ forwards_get_mem(worker->env.fwds)
	+ hints_get_mem(worker->env.hints);
	if(worker->thread_num == 0)
	me += acl_list_get_mem(worker->daemon->acl);
	if(cur_serv) {
	me += serviced_get_mem(cur_serv);
	}
	total = front+back+mesh+msg+rrset+infra+iter+val+ac+superac+me;
	#ifdef CLIENT_SUBNET
	total += subnet;
	log_info("Memory conditions: %u front=%u back=%u mesh=%u msg=%u "
	"rrset=%u infra=%u iter=%u val=%u subnet=%u anchors=%u "
	"alloccache=%u globalalloccache=%u me=%u",
	(unsigned)total, (unsigned)front, (unsigned)back,
	(unsigned)mesh, (unsigned)msg, (unsigned)rrset, (unsigned)infra,
	(unsigned)iter, (unsigned)val,
	(unsigned)subnet, (unsigned)anch, (unsigned)ac,
	(unsigned)superac, (unsigned)me);
	#else /* no CLIENT_SUBNET */
	log_info("Memory conditions: %u front=%u back=%u mesh=%u msg=%u "
	"rrset=%u infra=%u iter=%u val=%u anchors=%u "
	"alloccache=%u globalalloccache=%u me=%u",
	(unsigned)total, (unsigned)front, (unsigned)back,
	(unsigned)mesh, (unsigned)msg, (unsigned)rrset,
	(unsigned)infra, (unsigned)iter, (unsigned)val, (unsigned)anch,
	(unsigned)ac, (unsigned)superac, (unsigned)me);
	#endif /* CLIENT_SUBNET */
	log_info("Total heap memory estimate: %u total-alloc: %u "
	"total-free: %u", (unsigned)total,
	(unsigned)unbound_mem_alloc, (unsigned)unbound_mem_freed);
	#else /* no UNBOUND_ALLOC_STATS */
	size_t val = 0;
	#ifdef CLIENT_SUBNET
	size_t subnet = 0;
	#endif /* CLIENT_SUBNET */
	int i;
	if(verbosity < VERB_QUERY)
	return;
	for(i=0; i<worker->env.mesh->mods.num; i++) {
	fptr_ok(fptr_whitelist_mod_get_mem(worker->env.mesh->
	mods.mod[i]->get_mem));
	if(strcmp(worker->env.mesh->mods.mod[i]->name, "validator")==0)
	val += (*worker->env.mesh->mods.mod[i]->get_mem)
	(&worker->env, i);
	#ifdef CLIENT_SUBNET
	else if(strcmp(worker->env.mesh->mods.mod[i]->name,
	"subnet")==0)
	subnet += (*worker->env.mesh->mods.mod[i]->get_mem)
	(&worker->env, i);
	#endif /* CLIENT_SUBNET */
	}
	#ifdef CLIENT_SUBNET
	verbose(VERB_QUERY, "cache memory msg=%u rrset=%u infra=%u val=%u "
	"subnet=%u",
	(unsigned)slabhash_get_mem(worker->env.msg_cache),
	(unsigned)slabhash_get_mem(&worker->env.rrset_cache->table),
	(unsigned)infra_get_mem(worker->env.infra_cache),
	(unsigned)val, (unsigned)subnet);
	#else /* no CLIENT_SUBNET */
	verbose(VERB_QUERY, "cache memory msg=%u rrset=%u infra=%u val=%u",
	(unsigned)slabhash_get_mem(worker->env.msg_cache),
	(unsigned)slabhash_get_mem(&worker->env.rrset_cache->table),
	(unsigned)infra_get_mem(worker->env.infra_cache),
	(unsigned)val);
	#endif /* CLIENT_SUBNET */
	#endif /* UNBOUND_ALLOC_STATS */
	}

	void
	worker_send_cmd(struct worker* worker, enum worker_commands cmd)
	{
	uint32_t c = (uint32_t)htonl(cmd);
	if(!tube_write_msg(worker->cmd, (uint8_t*)&c, sizeof(c), 0)) {
	log_err("worker send cmd %d failed", (int)cmd);
	}
	}

	int
	worker_handle_reply(struct comm_point* c, void* arg, int error,
	struct comm_reply* reply_info)
	{
	struct module_qstate* q = (struct module_qstate*)arg;
	struct worker* worker = q->env->worker;
	struct outbound_entry e;
	e.qstate = q;
	e.qsent = NULL;

	if(error != 0) {
	mesh_report_reply(worker->env.mesh, &e, reply_info, error);
	worker_mem_report(worker, NULL);
	return 0;
	}
	/* sanity check. */
	if(!LDNS_QR_WIRE(sldns_buffer_begin(c->buffer))
	\|\| LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) !=
	LDNS_PACKET_QUERY
	\|\| LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) > 1) {
	/* error becomes timeout for the module as if this reply
	* never arrived. */
	mesh_report_reply(worker->env.mesh, &e, reply_info,
	NETEVENT_TIMEOUT);
	worker_mem_report(worker, NULL);
	return 0;
	}
	mesh_report_reply(worker->env.mesh, &e, reply_info, NETEVENT_NOERROR);
	worker_mem_report(worker, NULL);
	return 0;
	}

	int
	worker_handle_service_reply(struct comm_point* c, void* arg, int error,
	struct comm_reply* reply_info)
	{
	struct outbound_entry* e = (struct outbound_entry*)arg;
	struct worker* worker = e->qstate->env->worker;
	struct serviced_query *sq = e->qsent;

	verbose(VERB_ALGO, "worker svcd callback for qstate %p", e->qstate);
	if(error != 0) {
	mesh_report_reply(worker->env.mesh, e, reply_info, error);
	worker_mem_report(worker, sq);
	return 0;
	}
	/* sanity check. */
	if(!LDNS_QR_WIRE(sldns_buffer_begin(c->buffer))
	\|\| LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) !=
	LDNS_PACKET_QUERY
	\|\| LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) > 1) {
	/* error becomes timeout for the module as if this reply
	* never arrived. */
	verbose(VERB_ALGO, "worker: bad reply handled as timeout");
	mesh_report_reply(worker->env.mesh, e, reply_info,
	NETEVENT_TIMEOUT);
	worker_mem_report(worker, sq);
	return 0;
	}
	mesh_report_reply(worker->env.mesh, e, reply_info, NETEVENT_NOERROR);
	worker_mem_report(worker, sq);
	return 0;
	}

	/** ratelimit error replies
	* @param worker: the worker struct with ratelimit counter
	* @param err: error code that would be wanted.
	* @return value of err if okay, or -1 if it should be discarded instead.
	*/
	static int
	worker_err_ratelimit(struct worker* worker, int err)
	{
	if(worker->err_limit_time == *worker->env.now) {
	/* see if limit is exceeded for this second */
	if(worker->err_limit_count++ > ERROR_RATELIMIT)
	return -1;
	} else {
	/* new second, new limits */
	worker->err_limit_time = *worker->env.now;
	worker->err_limit_count = 1;
	}
	return err;
	}

	/** check request sanity.
	* @param pkt: the wire packet to examine for sanity.
	* @param worker: parameters for checking.
	* @return error code, 0 OK, or -1 discard.
	*/
	static int
	worker_check_request(sldns_buffer* pkt, struct worker* worker)
	{
	if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) {
	verbose(VERB_QUERY, "request too short, discarded");
	return -1;
	}
	if(sldns_buffer_limit(pkt) > NORMAL_UDP_SIZE &&
	worker->daemon->cfg->harden_large_queries) {
	verbose(VERB_QUERY, "request too large, discarded");
	return -1;
	}
	if(LDNS_QR_WIRE(sldns_buffer_begin(pkt))) {
	verbose(VERB_QUERY, "request has QR bit on, discarded");
	return -1;
	}
	if(LDNS_TC_WIRE(sldns_buffer_begin(pkt))) {
	LDNS_TC_CLR(sldns_buffer_begin(pkt));
	verbose(VERB_QUERY, "request bad, has TC bit on");
	return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
	}
	if(LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_QUERY &&
	LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_NOTIFY) {
	verbose(VERB_QUERY, "request unknown opcode %d",
	LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)));
	return worker_err_ratelimit(worker, LDNS_RCODE_NOTIMPL);
	}
	if(LDNS_QDCOUNT(sldns_buffer_begin(pkt)) != 1) {
	verbose(VERB_QUERY, "request wrong nr qd=%d",
	LDNS_QDCOUNT(sldns_buffer_begin(pkt)));
	return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
	}
	if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) != 0 &&
	(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) != 1 \|\|
	LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_NOTIFY)) {
	verbose(VERB_QUERY, "request wrong nr an=%d",
	LDNS_ANCOUNT(sldns_buffer_begin(pkt)));
	return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
	}
	if(LDNS_NSCOUNT(sldns_buffer_begin(pkt)) != 0) {
	verbose(VERB_QUERY, "request wrong nr ns=%d",
	LDNS_NSCOUNT(sldns_buffer_begin(pkt)));
	return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
	}
	if(LDNS_ARCOUNT(sldns_buffer_begin(pkt)) > 1) {
	verbose(VERB_QUERY, "request wrong nr ar=%d",
	LDNS_ARCOUNT(sldns_buffer_begin(pkt)));
	return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
	}
	return 0;
	}

	void
	worker_handle_control_cmd(struct tube* ATTR_UNUSED(tube), uint8_t* msg,
	size_t len, int error, void* arg)
	{
	struct worker* worker = (struct worker*)arg;
	enum worker_commands cmd;
	if(error != NETEVENT_NOERROR) {
	free(msg);
	if(error == NETEVENT_CLOSED)
	comm_base_exit(worker->base);
	else log_info("control event: %d", error);
	return;
	}
	if(len != sizeof(uint32_t)) {
	fatal_exit("bad control msg length %d", (int)len);
	}
	cmd = sldns_read_uint32(msg);
	free(msg);
	switch(cmd) {
	case worker_cmd_quit:
	verbose(VERB_ALGO, "got control cmd quit");
	comm_base_exit(worker->base);
	break;
	case worker_cmd_stats:
	verbose(VERB_ALGO, "got control cmd stats");
	server_stats_reply(worker, 1);
	break;
	case worker_cmd_stats_noreset:
	verbose(VERB_ALGO, "got control cmd stats_noreset");
	server_stats_reply(worker, 0);
	break;
	case worker_cmd_remote:
	verbose(VERB_ALGO, "got control cmd remote");
	daemon_remote_exec(worker);
	break;
	default:
	log_err("bad command %d", (int)cmd);
	break;
	}
	}

	/** check if a delegation is secure */
	static enum sec_status
	check_delegation_secure(struct reply_info *rep)
	{
	/* return smallest security status */
	size_t i;
	enum sec_status sec = sec_status_secure;
	enum sec_status s;
	size_t num = rep->an_numrrsets + rep->ns_numrrsets;
	/* check if answer and authority are OK */
	for(i=0; i<num; i++) {
	s = ((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
	->security;
	if(s < sec)
	sec = s;
	}
	/* in additional, only unchecked triggers revalidation */
	for(i=num; i<rep->rrset_count; i++) {
	s = ((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
	->security;
	if(s == sec_status_unchecked)
	return s;
	}
	return sec;
	}

	/** remove nonsecure from a delegation referral additional section */
	static void
	deleg_remove_nonsecure_additional(struct reply_info* rep)
	{
	/* we can simply edit it, since we are working in the scratch region */
	size_t i;
	enum sec_status s;

	for(i = rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) {
	s = ((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
	->security;
	if(s != sec_status_secure) {
	memmove(rep->rrsets+i, rep->rrsets+i+1,
	sizeof(struct ub_packed_rrset_key)
	(rep->rrset_count - i - 1));
	rep->ar_numrrsets--;
	rep->rrset_count--;
	i--;
	}
	}
	}

	/** answer nonrecursive query from the cache */
	static int
	answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
	uint16_t id, uint16_t flags, struct comm_reply* repinfo,
	struct edns_data* edns)
	{
	/* for a nonrecursive query return either:
	* o an error (servfail; we try to avoid this)
	* o a delegation (closest we have; this routine tries that)
	* o the answer (checked by answer_from_cache)
	*
	* So, grab a delegation from the rrset cache.
	* Then check if it needs validation, if so, this routine fails,
	* so that iterator can prime and validator can verify rrsets.
	*/
	struct edns_data edns_bak;
	uint16_t udpsize = edns->udp_size;
	int secure = 0;
	time_t timenow = *worker->env.now;
	int must_validate = (!(flags&BIT_CD) \|\| worker->env.cfg->ignore_cd)
	&& worker->env.need_to_validate;
	struct dns_msg *msg = NULL;
	struct delegpt *dp;

	dp = dns_cache_find_delegation(&worker->env, qinfo->qname,
	qinfo->qname_len, qinfo->qtype, qinfo->qclass,
	worker->scratchpad, &msg, timenow);
	if(!dp) { /* no delegation, need to reprime */
	return 0;
	}
	/* In case we have a local alias, copy it into the delegation message.
	* Shallow copy should be fine, as we'll be done with msg in this
	* function. */
	msg->qinfo.local_alias = qinfo->local_alias;
	if(must_validate) {
	switch(check_delegation_secure(msg->rep)) {
	case sec_status_unchecked:
	/* some rrsets have not been verified yet, go and
	* let validator do that */
	return 0;
	case sec_status_bogus:
	case sec_status_secure_sentinel_fail:
	/* some rrsets are bogus, reply servfail */
	edns->edns_version = EDNS_ADVERTISED_VERSION;
	edns->udp_size = EDNS_ADVERTISED_SIZE;
	edns->ext_rcode = 0;
	edns->bits &= EDNS_DO;
	if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL,
	msg->rep, LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad))
	return 0;
	error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL,
	&msg->qinfo, id, flags, edns);
	if(worker->stats.extended) {
	worker->stats.ans_bogus++;
	worker->stats.ans_rcode[LDNS_RCODE_SERVFAIL]++;
	}
	return 1;
	case sec_status_secure:
	/* all rrsets are secure */
	/* remove non-secure rrsets from the add. section*/
	if(worker->env.cfg->val_clean_additional)
	deleg_remove_nonsecure_additional(msg->rep);
	secure = 1;
	break;
	case sec_status_indeterminate:
	case sec_status_insecure:
	default:
	/* not secure */
	secure = 0;
	break;
	}
	}
	/* return this delegation from the cache */
	edns_bak = *edns;
	edns->edns_version = EDNS_ADVERTISED_VERSION;
	edns->udp_size = EDNS_ADVERTISED_SIZE;
	edns->ext_rcode = 0;
	edns->bits &= EDNS_DO;
	if(!inplace_cb_reply_cache_call(&worker->env, qinfo, NULL, msg->rep,
	(int)(flags&LDNS_RCODE_MASK), edns, repinfo, worker->scratchpad))
	return 0;
	msg->rep->flags \|= BIT_QR\|BIT_RA;
	if(!apply_edns_options(edns, &edns_bak, worker->env.cfg,
	repinfo->c, worker->scratchpad) \|\|
	!reply_info_answer_encode(&msg->qinfo, msg->rep, id, flags,
	repinfo->c->buffer, 0, 1, worker->scratchpad,
	udpsize, edns, (int)(edns->bits & EDNS_DO), secure)) {
	if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, NULL,
	LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad))
	edns->opt_list = NULL;
	error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL,
	&msg->qinfo, id, flags, edns);
	}
	if(worker->stats.extended) {
	if(secure) worker->stats.ans_secure++;
	server_stats_insrcode(&worker->stats, repinfo->c->buffer);
	}
	return 1;
	}

	/** Apply, if applicable, a response IP action to a cached answer.
	* If the answer is rewritten as a result of an action, '*encode_repp' will
	* point to the reply info containing the modified answer. '*encode_repp' will
	* be intact otherwise.
	* It returns 1 on success, 0 otherwise. */
	static int
	apply_respip_action(struct worker* worker, const struct query_info* qinfo,
	struct respip_client_info* cinfo, struct reply_info* rep,
	struct comm_reply* repinfo, struct ub_packed_rrset_key** alias_rrset,
	struct reply_info** encode_repp)
	{
	struct respip_action_info actinfo = {respip_none, NULL};

	if(qinfo->qtype != LDNS_RR_TYPE_A &&
	qinfo->qtype != LDNS_RR_TYPE_AAAA &&
	qinfo->qtype != LDNS_RR_TYPE_ANY)
	return 1;

	if(!respip_rewrite_reply(qinfo, cinfo, rep, encode_repp, &actinfo,
	alias_rrset, 0, worker->scratchpad))
	return 0;

	/* xxx_deny actions mean dropping the reply, unless the original reply
	* was redirected to response-ip data. */
	if((actinfo.action == respip_deny \|\|
	actinfo.action == respip_inform_deny) &&
	*encode_repp == rep)
	*encode_repp = NULL;

	/* If address info is returned, it means the action should be an
	* 'inform' variant and the information should be logged. */
	if(actinfo.addrinfo) {
	respip_inform_print(actinfo.addrinfo, qinfo->qname,
	qinfo->qtype, qinfo->qclass, qinfo->local_alias,
	repinfo);
	}

	return 1;
	}

	/** answer query from the cache.
	* Normally, the answer message will be built in repinfo->c->buffer; if the
	* answer is supposed to be suppressed or the answer is supposed to be an
	* incomplete CNAME chain, the buffer is explicitly cleared to signal the
	* caller as such. In the latter case *partial_rep will point to the incomplete
	* reply, and this function is (possibly) supposed to be called again with that
	* *partial_rep value to complete the chain. In addition, if the query should
	* be completely dropped, 'need_drop' will be set to 1. /
	static int
	answer_from_cache(struct worker* worker, struct query_info* qinfo,
	struct respip_client_info* cinfo, int* need_drop,
	struct ub_packed_rrset_key** alias_rrset,
	struct reply_info** partial_repp,
	struct reply_info* rep, uint16_t id, uint16_t flags,
	struct comm_reply* repinfo, struct edns_data* edns)
	{
	struct edns_data edns_bak;
	time_t timenow = *worker->env.now;
	uint16_t udpsize = edns->udp_size;
	struct reply_info* encode_rep = rep;
	struct reply_info* partial_rep = *partial_repp;
	int secure;
	int must_validate = (!(flags&BIT_CD) \|\| worker->env.cfg->ignore_cd)
	&& worker->env.need_to_validate;
	partial_repp = NULL; / avoid accidental further pass */
	if(worker->env.cfg->serve_expired) {
	if(worker->env.cfg->serve_expired_ttl &&
	rep->serve_expired_ttl < timenow)
	return 0;
	if(!rrset_array_lock(rep->ref, rep->rrset_count, 0))
	return 0;
	/* below, rrsets with ttl before timenow become TTL 0 in
	* the response */
	/* This response was served with zero TTL */
	if (timenow >= rep->ttl) {
	worker->stats.zero_ttl_responses++;
	}
	} else {
	/* see if it is possible */
	if(rep->ttl < timenow) {
	/* the rrsets may have been updated in the meantime.
	* we will refetch the message format from the
	* authoritative server
	*/
	return 0;
	}
	if(!rrset_array_lock(rep->ref, rep->rrset_count, timenow))
	return 0;
	/* locked and ids and ttls are OK. */
	}
	/* check CNAME chain (if any) */
	if(rep->an_numrrsets > 0 && (rep->rrsets[0]->rk.type ==
	htons(LDNS_RR_TYPE_CNAME) \|\| rep->rrsets[0]->rk.type ==
	htons(LDNS_RR_TYPE_DNAME))) {
	if(!reply_check_cname_chain(qinfo, rep)) {
	/* cname chain invalid, redo iterator steps */
	verbose(VERB_ALGO, "Cache reply: cname chain broken");
	- bail_out:
	- rrset_array_unlock_touch(worker->env.rrset_cache,
	- worker->scratchpad, rep->ref, rep->rrset_count);
	- return 0;
	+ goto bail_out;
	}
	}
	/* check security status of the cached answer */
	if(must_validate && (rep->security == sec_status_bogus \|\|
	rep->security == sec_status_secure_sentinel_fail)) {
	/* BAD cached */
	edns->edns_version = EDNS_ADVERTISED_VERSION;
	edns->udp_size = EDNS_ADVERTISED_SIZE;
	edns->ext_rcode = 0;
	edns->bits &= EDNS_DO;
	if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, rep,
	LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad))
	goto bail_out;
	error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL,
	qinfo, id, flags, edns);
	rrset_array_unlock_touch(worker->env.rrset_cache,
	worker->scratchpad, rep->ref, rep->rrset_count);
	if(worker->stats.extended) {
	worker->stats.ans_bogus ++;
	worker->stats.ans_rcode[LDNS_RCODE_SERVFAIL] ++;
	}
	return 1;
	} else if( rep->security == sec_status_unchecked && must_validate) {
	verbose(VERB_ALGO, "Cache reply: unchecked entry needs "
	"validation");
	goto bail_out; /* need to validate cache entry first */
	} else if(rep->security == sec_status_secure) {
	if(reply_all_rrsets_secure(rep))
	secure = 1;
	else {
	if(must_validate) {
	verbose(VERB_ALGO, "Cache reply: secure entry"
	" changed status");
	goto bail_out; /* rrset changed, re-verify */
	}
	secure = 0;
	}
	} else secure = 0;

	edns_bak = *edns;
	edns->edns_version = EDNS_ADVERTISED_VERSION;
	edns->udp_size = EDNS_ADVERTISED_SIZE;
	edns->ext_rcode = 0;
	edns->bits &= EDNS_DO;
	if(!inplace_cb_reply_cache_call(&worker->env, qinfo, NULL, rep,
	(int)(flags&LDNS_RCODE_MASK), edns, repinfo, worker->scratchpad))
	goto bail_out;
	alias_rrset = NULL; / avoid confusion if caller set it to non-NULL */
	if(worker->daemon->use_response_ip && !partial_rep &&
	!apply_respip_action(worker, qinfo, cinfo, rep, repinfo, alias_rrset,
	&encode_rep)) {
	goto bail_out;
	} else if(partial_rep &&
	!respip_merge_cname(partial_rep, qinfo, rep, cinfo,
	must_validate, &encode_rep, worker->scratchpad)) {
	goto bail_out;
	}
	if(encode_rep != rep)
	secure = 0; /* if rewritten, it can't be considered "secure" */
	if(!encode_rep \|\| *alias_rrset) {
	sldns_buffer_clear(repinfo->c->buffer);
	sldns_buffer_flip(repinfo->c->buffer);
	if(!encode_rep)
	*need_drop = 1;
	else {
	/* If a partial CNAME chain is found, we first need to
	* make a copy of the reply in the scratchpad so we
	* can release the locks and lookup the cache again. */
	*partial_repp = reply_info_copy(encode_rep, NULL,
	worker->scratchpad);
	if(!*partial_repp)
	goto bail_out;
	}
	} else if(!apply_edns_options(edns, &edns_bak, worker->env.cfg,
	repinfo->c, worker->scratchpad) \|\|
	!reply_info_answer_encode(qinfo, encode_rep, id, flags,
	repinfo->c->buffer, timenow, 1, worker->scratchpad,
	udpsize, edns, (int)(edns->bits & EDNS_DO), secure)) {
	if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, NULL,
	LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad))
	edns->opt_list = NULL;
	error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL,
	qinfo, id, flags, edns);
	}
	/* cannot send the reply right now, because blocking network syscall
	* is bad while holding locks. */
	rrset_array_unlock_touch(worker->env.rrset_cache, worker->scratchpad,
	rep->ref, rep->rrset_count);
	if(worker->stats.extended) {
	if(secure) worker->stats.ans_secure++;
	server_stats_insrcode(&worker->stats, repinfo->c->buffer);
	}
	/* go and return this buffer to the client */
	return 1;
	+
	+bail_out:
	+ rrset_array_unlock_touch(worker->env.rrset_cache,
	+ worker->scratchpad, rep->ref, rep->rrset_count);
	+ return 0;
	}

	/** Reply to client and perform prefetch to keep cache up to date.
	* If the buffer for the reply is empty, it indicates that only prefetch is
	* necessary and the reply should be suppressed (because it's dropped or
	* being deferred). */
	static void
	reply_and_prefetch(struct worker* worker, struct query_info* qinfo,
	uint16_t flags, struct comm_reply* repinfo, time_t leeway)
	{
	/* first send answer to client to keep its latency
	* as small as a cachereply */
	- if(sldns_buffer_limit(repinfo->c->buffer) != 0)
	+ if(sldns_buffer_limit(repinfo->c->buffer) != 0) {
	+ if(repinfo->c->tcp_req_info) {
	+ sldns_buffer_copy(
	+ repinfo->c->tcp_req_info->spool_buffer,
	+ repinfo->c->buffer);
	+ }
	comm_point_send_reply(repinfo);
	+ }
	server_stats_prefetch(&worker->stats, worker);

	/* create the prefetch in the mesh as a normal lookup without
	* client addrs waiting, which has the cache blacklisted (to bypass
	* the cache and go to the network for the data). */
	/* this (potentially) runs the mesh for the new query */
	mesh_new_prefetch(worker->env.mesh, qinfo, flags, leeway +
	PREFETCH_EXPIRY_ADD);
	}

	/**
	* Fill CH class answer into buffer. Keeps query.
	* @param pkt: buffer
	* @param str: string to put into text record (<255).
	* array of strings, every string becomes a text record.
	* @param num: number of strings in array.
	* @param edns: edns reply information.
	* @param worker: worker with scratch region.
	* @param repinfo: reply information for a communication point.
	*/
	static void
	chaos_replystr(sldns_buffer* pkt, char** str, int num, struct edns_data* edns,
	struct worker* worker, struct comm_reply* repinfo)
	{
	int i;
	unsigned int rd = LDNS_RD_WIRE(sldns_buffer_begin(pkt));
	unsigned int cd = LDNS_CD_WIRE(sldns_buffer_begin(pkt));
	sldns_buffer_clear(pkt);
	sldns_buffer_skip(pkt, (ssize_t)sizeof(uint16_t)); /* skip id */
	sldns_buffer_write_u16(pkt, (uint16_t)(BIT_QR\|BIT_RA));
	if(rd) LDNS_RD_SET(sldns_buffer_begin(pkt));
	if(cd) LDNS_CD_SET(sldns_buffer_begin(pkt));
	sldns_buffer_write_u16(pkt, 1); /* qdcount */
	sldns_buffer_write_u16(pkt, (uint16_t)num); /* ancount */
	sldns_buffer_write_u16(pkt, 0); /* nscount */
	sldns_buffer_write_u16(pkt, 0); /* arcount */
	(void)query_dname_len(pkt); /* skip qname */
	sldns_buffer_skip(pkt, (ssize_t)sizeof(uint16_t)); /* skip qtype */
	sldns_buffer_skip(pkt, (ssize_t)sizeof(uint16_t)); /* skip qclass */
	for(i=0; i<num; i++) {
	size_t len = strlen(str[i]);
	if(len>255) len=255; /* cap size of TXT record */
	sldns_buffer_write_u16(pkt, 0xc00c); /* compr ptr to query */
	sldns_buffer_write_u16(pkt, LDNS_RR_TYPE_TXT);
	sldns_buffer_write_u16(pkt, LDNS_RR_CLASS_CH);
	sldns_buffer_write_u32(pkt, 0); /* TTL */
	sldns_buffer_write_u16(pkt, sizeof(uint8_t) + len);
	sldns_buffer_write_u8(pkt, len);
	sldns_buffer_write(pkt, str[i], len);
	}
	sldns_buffer_flip(pkt);
	edns->edns_version = EDNS_ADVERTISED_VERSION;
	edns->udp_size = EDNS_ADVERTISED_SIZE;
	edns->bits &= EDNS_DO;
	if(!inplace_cb_reply_local_call(&worker->env, NULL, NULL, NULL,
	LDNS_RCODE_NOERROR, edns, repinfo, worker->scratchpad))
	edns->opt_list = NULL;
	if(sldns_buffer_capacity(pkt) >=
	sldns_buffer_limit(pkt)+calc_edns_field_size(edns))
	attach_edns_record(pkt, edns);
	}

	/** Reply with one string */
	static void
	chaos_replyonestr(sldns_buffer* pkt, const char* str, struct edns_data* edns,
	struct worker* worker, struct comm_reply* repinfo)
	{
	chaos_replystr(pkt, (char**)&str, 1, edns, worker, repinfo);
	}

	/**
	* Create CH class trustanchor answer.
	* @param pkt: buffer
	* @param edns: edns reply information.
	* @param w: worker with scratch region.
	* @param repinfo: reply information for a communication point.
	*/
	static void
	chaos_trustanchor(sldns_buffer* pkt, struct edns_data* edns, struct worker* w,
	struct comm_reply* repinfo)
	{
	#define TA_RESPONSE_MAX_TXT 16 /* max number of TXT records */
	#define TA_RESPONSE_MAX_TAGS 32 /* max number of tags printed per zone */
	char* str_array[TA_RESPONSE_MAX_TXT];
	uint16_t tags[TA_RESPONSE_MAX_TAGS];
	int num = 0;
	struct trust_anchor* ta;

	if(!w->env.need_to_validate) {
	/* no validator module, reply no trustanchors */
	chaos_replystr(pkt, NULL, 0, edns, w, repinfo);
	return;
	}

	/* fill the string with contents */
	lock_basic_lock(&w->env.anchors->lock);
	RBTREE_FOR(ta, struct trust_anchor*, w->env.anchors->tree) {
	char* str;
	size_t i, numtag, str_len = 255;
	if(num == TA_RESPONSE_MAX_TXT) continue;
	str = (char*)regional_alloc(w->scratchpad, str_len);
	if(!str) continue;
	lock_basic_lock(&ta->lock);
	numtag = anchor_list_keytags(ta, tags, TA_RESPONSE_MAX_TAGS);
	if(numtag == 0) {
	/* empty, insecure point */
	lock_basic_unlock(&ta->lock);
	continue;
	}
	str_array[num] = str;
	num++;

	/* spool name of anchor */
	(void)sldns_wire2str_dname_buf(ta->name, ta->namelen, str, str_len);
	str_len -= strlen(str); str += strlen(str);
	/* spool tags */
	for(i=0; i<numtag; i++) {
	snprintf(str, str_len, " %u", (unsigned)tags[i]);
	str_len -= strlen(str); str += strlen(str);
	}
	lock_basic_unlock(&ta->lock);
	}
	lock_basic_unlock(&w->env.anchors->lock);

	chaos_replystr(pkt, str_array, num, edns, w, repinfo);
	regional_free_all(w->scratchpad);
	}

	/**
	* Answer CH class queries.
	* @param w: worker
	* @param qinfo: query info. Pointer into packet buffer.
	* @param edns: edns info from query.
	* @param repinfo: reply information for a communication point.
	* @param pkt: packet buffer.
	* @return: true if a reply is to be sent.
	*/
	static int
	answer_chaos(struct worker* w, struct query_info* qinfo,
	struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* pkt)
	{
	struct config_file* cfg = w->env.cfg;
	if(qinfo->qtype != LDNS_RR_TYPE_ANY && qinfo->qtype != LDNS_RR_TYPE_TXT)
	return 0;
	if(query_dname_compare(qinfo->qname,
	(uint8_t*)"\002id\006server") == 0 \|\|
	query_dname_compare(qinfo->qname,
	(uint8_t*)"\010hostname\004bind") == 0)
	{
	if(cfg->hide_identity)
	return 0;
	if(cfg->identity==NULL \|\| cfg->identity[0]==0) {
	char buf[MAXHOSTNAMELEN+1];
	if (gethostname(buf, MAXHOSTNAMELEN) == 0) {
	buf[MAXHOSTNAMELEN] = 0;
	chaos_replyonestr(pkt, buf, edns, w, repinfo);
	} else {
	log_err("gethostname: %s", strerror(errno));
	chaos_replyonestr(pkt, "no hostname", edns, w, repinfo);
	}
	}
	else chaos_replyonestr(pkt, cfg->identity, edns, w, repinfo);
	return 1;
	}
	if(query_dname_compare(qinfo->qname,
	(uint8_t*)"\007version\006server") == 0 \|\|
	query_dname_compare(qinfo->qname,
	(uint8_t*)"\007version\004bind") == 0)
	{
	if(cfg->hide_version)
	return 0;
	if(cfg->version==NULL \|\| cfg->version[0]==0)
	chaos_replyonestr(pkt, PACKAGE_STRING, edns, w, repinfo);
	else chaos_replyonestr(pkt, cfg->version, edns, w, repinfo);
	return 1;
	}
	if(query_dname_compare(qinfo->qname,
	(uint8_t*)"\013trustanchor\007unbound") == 0)
	{
	if(cfg->hide_trustanchor)
	return 0;
	chaos_trustanchor(pkt, edns, w, repinfo);
	return 1;
	}

	return 0;
	}

	/**
	* Answer notify queries. These are notifies for authoritative zones,
	* the reply is an ack that the notify has been received. We need to check
	* access permission here.
	* @param w: worker
	* @param qinfo: query info. Pointer into packet buffer.
	* @param edns: edns info from query.
	* @param repinfo: reply info with source address.
	* @param pkt: packet buffer.
	*/
	static void
	answer_notify(struct worker* w, struct query_info* qinfo,
	struct edns_data* edns, sldns_buffer* pkt, struct comm_reply* repinfo)
	{
	int refused = 0;
	int rcode = LDNS_RCODE_NOERROR;
	uint32_t serial = 0;
	int has_serial;
	if(!w->env.auth_zones) return;
	has_serial = auth_zone_parse_notify_serial(pkt, &serial);
	if(auth_zones_notify(w->env.auth_zones, &w->env, qinfo->qname,
	qinfo->qname_len, qinfo->qclass, &repinfo->addr,
	repinfo->addrlen, has_serial, serial, &refused)) {
	rcode = LDNS_RCODE_NOERROR;
	} else {
	if(refused)
	rcode = LDNS_RCODE_REFUSED;
	else rcode = LDNS_RCODE_SERVFAIL;
	}

	if(verbosity >= VERB_DETAIL) {
	char buf[380];
	char zname[255+1];
	char sr[25];
	dname_str(qinfo->qname, zname);
	sr[0]=0;
	if(has_serial)
	snprintf(sr, sizeof(sr), "serial %u ",
	(unsigned)serial);
	if(rcode == LDNS_RCODE_REFUSED)
	snprintf(buf, sizeof(buf),
	"refused NOTIFY %sfor %s from", sr, zname);
	else if(rcode == LDNS_RCODE_SERVFAIL)
	snprintf(buf, sizeof(buf),
	"servfail for NOTIFY %sfor %s from", sr, zname);
	else snprintf(buf, sizeof(buf),
	"received NOTIFY %sfor %s from", sr, zname);
	log_addr(VERB_DETAIL, buf, &repinfo->addr, repinfo->addrlen);
	}
	edns->edns_version = EDNS_ADVERTISED_VERSION;
	edns->udp_size = EDNS_ADVERTISED_SIZE;
	edns->ext_rcode = 0;
	edns->bits &= EDNS_DO;
	edns->opt_list = NULL;
	error_encode(pkt, rcode, qinfo,
	(uint16_t)(void *)sldns_buffer_begin(pkt),
	sldns_buffer_read_u16_at(pkt, 2), edns);
	LDNS_OPCODE_SET(sldns_buffer_begin(pkt), LDNS_PACKET_NOTIFY);
	}

	static int
	deny_refuse(struct comm_point* c, enum acl_access acl,
	enum acl_access deny, enum acl_access refuse,
	struct worker* worker, struct comm_reply* repinfo)
	{
	if(acl == deny) {
	comm_point_drop_reply(repinfo);
	if(worker->stats.extended)
	worker->stats.unwanted_queries++;
	return 0;
	} else if(acl == refuse) {
	log_addr(VERB_ALGO, "refused query from",
	&repinfo->addr, repinfo->addrlen);
	log_buf(VERB_ALGO, "refuse", c->buffer);
	if(worker->stats.extended)
	worker->stats.unwanted_queries++;
	if(worker_check_request(c->buffer, worker) == -1) {
	comm_point_drop_reply(repinfo);
	return 0; /* discard this */
	}
	sldns_buffer_set_limit(c->buffer, LDNS_HEADER_SIZE);
	sldns_buffer_write_at(c->buffer, 4,
	(uint8_t*)"\0\0\0\0\0\0\0\0", 8);
	LDNS_QR_SET(sldns_buffer_begin(c->buffer));
	LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
	LDNS_RCODE_REFUSED);
	sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
	sldns_buffer_flip(c->buffer);
	return 1;
	}

	return -1;
	}

	static int
	deny_refuse_all(struct comm_point* c, enum acl_access acl,
	struct worker* worker, struct comm_reply* repinfo)
	{
	return deny_refuse(c, acl, acl_deny, acl_refuse, worker, repinfo);
	}

	static int
	deny_refuse_non_local(struct comm_point* c, enum acl_access acl,
	struct worker* worker, struct comm_reply* repinfo)
	{
	return deny_refuse(c, acl, acl_deny_non_local, acl_refuse_non_local, worker, repinfo);
	}

	int
	worker_handle_request(struct comm_point* c, void* arg, int error,
	struct comm_reply* repinfo)
	{
	struct worker* worker = (struct worker*)arg;
	int ret;
	hashvalue_type h;
	struct lruhash_entry* e;
	struct query_info qinfo;
	struct edns_data edns;
	enum acl_access acl;
	struct acl_addr* acladdr;
	int rc = 0;
	int need_drop = 0;
	/* We might have to chase a CNAME chain internally, in which case
	* we'll have up to two replies and combine them to build a complete
	* answer. These variables control this case. */
	struct ub_packed_rrset_key* alias_rrset = NULL;
	struct reply_info* partial_rep = NULL;
	struct query_info* lookup_qinfo = &qinfo;
	- struct query_info qinfo_tmp; /* placeholdoer for lookup_qinfo */
	+ struct query_info qinfo_tmp; /* placeholder for lookup_qinfo */
	struct respip_client_info* cinfo = NULL, cinfo_tmp;
	memset(&qinfo, 0, sizeof(qinfo));

	if(error != NETEVENT_NOERROR) {
	/* some bad tcp query DNS formats give these error calls */
	verbose(VERB_ALGO, "handle request called with err=%d", error);
	return 0;
	}
	#ifdef USE_DNSCRYPT
	repinfo->max_udp_size = worker->daemon->cfg->max_udp_size;
	if(!dnsc_handle_curved_request(worker->daemon->dnscenv, repinfo)) {
	worker->stats.num_query_dnscrypt_crypted_malformed++;
	return 0;
	}
	if(c->dnscrypt && !repinfo->is_dnscrypted) {
	char buf[LDNS_MAX_DOMAINLEN+1];
	/* Check if this is unencrypted and asking for certs */
	if(worker_check_request(c->buffer, worker) != 0) {
	verbose(VERB_ALGO,
	"dnscrypt: worker check request: bad query.");
	log_addr(VERB_CLIENT,"from",&repinfo->addr,
	repinfo->addrlen);
	comm_point_drop_reply(repinfo);
	return 0;
	}
	if(!query_info_parse(&qinfo, c->buffer)) {
	verbose(VERB_ALGO,
	"dnscrypt: worker parse request: formerror.");
	log_addr(VERB_CLIENT, "from", &repinfo->addr,
	repinfo->addrlen);
	comm_point_drop_reply(repinfo);
	return 0;
	}
	dname_str(qinfo.qname, buf);
	if(!(qinfo.qtype == LDNS_RR_TYPE_TXT &&
	strcasecmp(buf,
	worker->daemon->dnscenv->provider_name) == 0)) {
	verbose(VERB_ALGO,
	"dnscrypt: not TXT \"%s\". Received: %s \"%s\"",
	worker->daemon->dnscenv->provider_name,
	sldns_rr_descript(qinfo.qtype)->_name,
	buf);
	comm_point_drop_reply(repinfo);
	worker->stats.num_query_dnscrypt_cleartext++;
	return 0;
	}
	worker->stats.num_query_dnscrypt_cert++;
	sldns_buffer_rewind(c->buffer);
	} else if(c->dnscrypt && repinfo->is_dnscrypted) {
	worker->stats.num_query_dnscrypt_crypted++;
	}
	#endif
	#ifdef USE_DNSTAP
	if(worker->dtenv.log_client_query_messages)
	dt_msg_send_client_query(&worker->dtenv, &repinfo->addr, c->type,
	c->buffer);
	#endif
	acladdr = acl_addr_lookup(worker->daemon->acl, &repinfo->addr,
	repinfo->addrlen);
	acl = acl_get_control(acladdr);
	if((ret=deny_refuse_all(c, acl, worker, repinfo)) != -1)
	{
	if(ret == 1)
	goto send_reply;
	return ret;
	}
	if((ret=worker_check_request(c->buffer, worker)) != 0) {
	verbose(VERB_ALGO, "worker check request: bad query.");
	log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
	if(ret != -1) {
	LDNS_QR_SET(sldns_buffer_begin(c->buffer));
	LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), ret);
	return 1;
	}
	comm_point_drop_reply(repinfo);
	return 0;
	}

	worker->stats.num_queries++;

	/* check if this query should be dropped based on source ip rate limiting */
	if(!infra_ip_ratelimit_inc(worker->env.infra_cache, repinfo,
	- *worker->env.now)) {
	+ *worker->env.now, c->buffer)) {
	/* See if we are passed through with slip factor */
	if(worker->env.cfg->ip_ratelimit_factor != 0 &&
	ub_random_max(worker->env.rnd,
	- worker->env.cfg->ip_ratelimit_factor) == 1) {
	+ worker->env.cfg->ip_ratelimit_factor) == 0) {

	char addrbuf[128];
	addr_to_str(&repinfo->addr, repinfo->addrlen,
	addrbuf, sizeof(addrbuf));
	verbose(VERB_QUERY, "ip_ratelimit allowed through for ip address %s because of slip in ip_ratelimit_factor",
	addrbuf);
	} else {
	worker->stats.num_queries_ip_ratelimited++;
	comm_point_drop_reply(repinfo);
	return 0;
	}
	}

	/* see if query is in the cache */
	if(!query_info_parse(&qinfo, c->buffer)) {
	verbose(VERB_ALGO, "worker parse request: formerror.");
	log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
	memset(&qinfo, 0, sizeof(qinfo)); /* zero qinfo.qname */
	if(worker_err_ratelimit(worker, LDNS_RCODE_FORMERR) == -1) {
	comm_point_drop_reply(repinfo);
	return 0;
	}
	sldns_buffer_rewind(c->buffer);
	LDNS_QR_SET(sldns_buffer_begin(c->buffer));
	LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
	LDNS_RCODE_FORMERR);
	server_stats_insrcode(&worker->stats, c->buffer);
	goto send_reply;
	}
	if(worker->env.cfg->log_queries) {
	char ip[128];
	addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip));
	- log_nametypeclass(0, ip, qinfo.qname, qinfo.qtype, qinfo.qclass);
	+ log_query_in(ip, qinfo.qname, qinfo.qtype, qinfo.qclass);
	}
	if(qinfo.qtype == LDNS_RR_TYPE_AXFR \|\|
	qinfo.qtype == LDNS_RR_TYPE_IXFR) {
	verbose(VERB_ALGO, "worker request: refused zone transfer.");
	log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
	sldns_buffer_rewind(c->buffer);
	LDNS_QR_SET(sldns_buffer_begin(c->buffer));
	LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
	LDNS_RCODE_REFUSED);
	if(worker->stats.extended) {
	worker->stats.qtype[qinfo.qtype]++;
	server_stats_insrcode(&worker->stats, c->buffer);
	}
	goto send_reply;
	}
	if(qinfo.qtype == LDNS_RR_TYPE_OPT \|\|
	qinfo.qtype == LDNS_RR_TYPE_TSIG \|\|
	qinfo.qtype == LDNS_RR_TYPE_TKEY \|\|
	qinfo.qtype == LDNS_RR_TYPE_MAILA \|\|
	qinfo.qtype == LDNS_RR_TYPE_MAILB \|\|
	(qinfo.qtype >= 128 && qinfo.qtype <= 248)) {
	verbose(VERB_ALGO, "worker request: formerror for meta-type.");
	log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
	if(worker_err_ratelimit(worker, LDNS_RCODE_FORMERR) == -1) {
	comm_point_drop_reply(repinfo);
	return 0;
	}
	sldns_buffer_rewind(c->buffer);
	LDNS_QR_SET(sldns_buffer_begin(c->buffer));
	LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
	LDNS_RCODE_FORMERR);
	if(worker->stats.extended) {
	worker->stats.qtype[qinfo.qtype]++;
	server_stats_insrcode(&worker->stats, c->buffer);
	}
	goto send_reply;
	}
	if((ret=parse_edns_from_pkt(c->buffer, &edns, worker->scratchpad)) != 0) {
	struct edns_data reply_edns;
	verbose(VERB_ALGO, "worker parse edns: formerror.");
	log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
	memset(&reply_edns, 0, sizeof(reply_edns));
	reply_edns.edns_present = 1;
	reply_edns.udp_size = EDNS_ADVERTISED_SIZE;
	LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), ret);
	error_encode(c->buffer, ret, &qinfo,
	(uint16_t)(void *)sldns_buffer_begin(c->buffer),
	sldns_buffer_read_u16_at(c->buffer, 2), &reply_edns);
	regional_free_all(worker->scratchpad);
	server_stats_insrcode(&worker->stats, c->buffer);
	goto send_reply;
	}
	if(edns.edns_present) {
	struct edns_option* edns_opt;
	if(edns.edns_version != 0) {
	edns.ext_rcode = (uint8_t)(EDNS_RCODE_BADVERS>>4);
	edns.edns_version = EDNS_ADVERTISED_VERSION;
	edns.udp_size = EDNS_ADVERTISED_SIZE;
	edns.bits &= EDNS_DO;
	edns.opt_list = NULL;
	verbose(VERB_ALGO, "query with bad edns version.");
	log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
	error_encode(c->buffer, EDNS_RCODE_BADVERS&0xf, &qinfo,
	(uint16_t)(void *)sldns_buffer_begin(c->buffer),
	sldns_buffer_read_u16_at(c->buffer, 2), NULL);
	if(sldns_buffer_capacity(c->buffer) >=
	sldns_buffer_limit(c->buffer)+calc_edns_field_size(&edns))
	attach_edns_record(c->buffer, &edns);
	regional_free_all(worker->scratchpad);
	goto send_reply;
	}
	if(edns.udp_size < NORMAL_UDP_SIZE &&
	worker->daemon->cfg->harden_short_bufsize) {
	verbose(VERB_QUERY, "worker request: EDNS bufsize %d ignored",
	(int)edns.udp_size);
	log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
	edns.udp_size = NORMAL_UDP_SIZE;
	}
	if(c->type != comm_udp) {
	edns_opt = edns_opt_list_find(edns.opt_list, LDNS_EDNS_KEEPALIVE);
	if(edns_opt && edns_opt->opt_len > 0) {
	edns.ext_rcode = 0;
	edns.edns_version = EDNS_ADVERTISED_VERSION;
	edns.udp_size = EDNS_ADVERTISED_SIZE;
	edns.bits &= EDNS_DO;
	edns.opt_list = NULL;
	verbose(VERB_ALGO, "query with bad edns keepalive.");
	log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
	error_encode(c->buffer, LDNS_RCODE_FORMERR, &qinfo,
	(uint16_t)(void *)sldns_buffer_begin(c->buffer),
	sldns_buffer_read_u16_at(c->buffer, 2), NULL);
	if(sldns_buffer_capacity(c->buffer) >=
	sldns_buffer_limit(c->buffer)+calc_edns_field_size(&edns))
	attach_edns_record(c->buffer, &edns);
	regional_free_all(worker->scratchpad);
	goto send_reply;
	}
	}
	}
	if(edns.udp_size > worker->daemon->cfg->max_udp_size &&
	c->type == comm_udp) {
	verbose(VERB_QUERY,
	"worker request: max UDP reply size modified"
	" (%d to max-udp-size)", (int)edns.udp_size);
	log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
	edns.udp_size = worker->daemon->cfg->max_udp_size;
	}
	if(edns.udp_size < LDNS_HEADER_SIZE) {
	verbose(VERB_ALGO, "worker request: edns is too small.");
	log_addr(VERB_CLIENT, "from", &repinfo->addr, repinfo->addrlen);
	LDNS_QR_SET(sldns_buffer_begin(c->buffer));
	LDNS_TC_SET(sldns_buffer_begin(c->buffer));
	LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
	LDNS_RCODE_SERVFAIL);
	sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
	sldns_buffer_write_at(c->buffer, 4,
	(uint8_t*)"\0\0\0\0\0\0\0\0", 8);
	sldns_buffer_flip(c->buffer);
	regional_free_all(worker->scratchpad);
	goto send_reply;
	}
	if(worker->stats.extended)
	server_stats_insquery(&worker->stats, c, qinfo.qtype,
	qinfo.qclass, &edns, repinfo);
	if(c->type != comm_udp)
	edns.udp_size = 65535; /* max size for TCP replies */
	if(qinfo.qclass == LDNS_RR_CLASS_CH && answer_chaos(worker, &qinfo,
	&edns, repinfo, c->buffer)) {
	server_stats_insrcode(&worker->stats, c->buffer);
	regional_free_all(worker->scratchpad);
	goto send_reply;
	}
	if(LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) ==
	LDNS_PACKET_NOTIFY) {
	answer_notify(worker, &qinfo, &edns, c->buffer, repinfo);
	regional_free_all(worker->scratchpad);
	goto send_reply;
	}
	if(local_zones_answer(worker->daemon->local_zones, &worker->env, &qinfo,
	&edns, c->buffer, worker->scratchpad, repinfo, acladdr->taglist,
	acladdr->taglen, acladdr->tag_actions,
	acladdr->tag_actions_size, acladdr->tag_datas,
	acladdr->tag_datas_size, worker->daemon->cfg->tagname,
	worker->daemon->cfg->num_tags, acladdr->view)) {
	regional_free_all(worker->scratchpad);
	if(sldns_buffer_limit(c->buffer) == 0) {
	comm_point_drop_reply(repinfo);
	return 0;
	}
	server_stats_insrcode(&worker->stats, c->buffer);
	goto send_reply;
	}
	if(worker->env.auth_zones &&
	auth_zones_answer(worker->env.auth_zones, &worker->env,
	&qinfo, &edns, repinfo, c->buffer, worker->scratchpad)) {
	regional_free_all(worker->scratchpad);
	if(sldns_buffer_limit(c->buffer) == 0) {
	comm_point_drop_reply(repinfo);
	return 0;
	}
	/* set RA for everyone that can have recursion (based on
	* access control list) */
	if(LDNS_RD_WIRE(sldns_buffer_begin(c->buffer)) &&
	acl != acl_deny_non_local && acl != acl_refuse_non_local)
	LDNS_RA_SET(sldns_buffer_begin(c->buffer));
	server_stats_insrcode(&worker->stats, c->buffer);
	goto send_reply;
	}

	/* We've looked in our local zones. If the answer isn't there, we
	* might need to bail out based on ACLs now. */
	if((ret=deny_refuse_non_local(c, acl, worker, repinfo)) != -1)
	{
	regional_free_all(worker->scratchpad);
	if(ret == 1)
	goto send_reply;
	return ret;
	}

	/* If this request does not have the recursion bit set, verify
	* ACLs allow the recursion bit to be treated as set. */
	if(!(LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) &&
	acl == acl_allow_setrd ) {
	LDNS_RD_SET(sldns_buffer_begin(c->buffer));
	}

	/* If this request does not have the recursion bit set, verify
	* ACLs allow the snooping. */
	if(!(LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) &&
	acl != acl_allow_snoop ) {
	error_encode(c->buffer, LDNS_RCODE_REFUSED, &qinfo,
	(uint16_t)(void *)sldns_buffer_begin(c->buffer),
	sldns_buffer_read_u16_at(c->buffer, 2), NULL);
	regional_free_all(worker->scratchpad);
	server_stats_insrcode(&worker->stats, c->buffer);
	log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
	&repinfo->addr, repinfo->addrlen);
	goto send_reply;
	}

	/* If we've found a local alias, replace the qname with the alias
	* target before resolving it. */
	if(qinfo.local_alias) {
	struct ub_packed_rrset_key* rrset = qinfo.local_alias->rrset;
	struct packed_rrset_data* d = rrset->entry.data;

	/* Sanity check: our current implementation only supports
	* a single CNAME RRset as a local alias. */
	if(qinfo.local_alias->next \|\|
	rrset->rk.type != htons(LDNS_RR_TYPE_CNAME) \|\|
	d->count != 1) {
	log_err("assumption failure: unexpected local alias");
	regional_free_all(worker->scratchpad);
	return 0; /* drop it */
	}
	qinfo.qname = d->rr_data[0] + 2;
	qinfo.qname_len = d->rr_len[0] - 2;
	}

	/* If we may apply IP-based actions to the answer, build the client
	* information. As this can be expensive, skip it if there is
	* absolutely no possibility of it. */
	if(worker->daemon->use_response_ip &&
	(qinfo.qtype == LDNS_RR_TYPE_A \|\|
	qinfo.qtype == LDNS_RR_TYPE_AAAA \|\|
	qinfo.qtype == LDNS_RR_TYPE_ANY)) {
	cinfo_tmp.taglist = acladdr->taglist;
	cinfo_tmp.taglen = acladdr->taglen;
	cinfo_tmp.tag_actions = acladdr->tag_actions;
	cinfo_tmp.tag_actions_size = acladdr->tag_actions_size;
	cinfo_tmp.tag_datas = acladdr->tag_datas;
	cinfo_tmp.tag_datas_size = acladdr->tag_datas_size;
	cinfo_tmp.view = acladdr->view;
	cinfo_tmp.respip_set = worker->daemon->respip_set;
	cinfo = &cinfo_tmp;
	}

	lookup_cache:
	/* Lookup the cache. In case we chase an intermediate CNAME chain
	* this is a two-pass operation, and lookup_qinfo is different for
	* each pass. We should still pass the original qinfo to
	* answer_from_cache(), however, since it's used to build the reply. */
	if(!edns_bypass_cache_stage(edns.opt_list, &worker->env)) {
	h = query_info_hash(lookup_qinfo, sldns_buffer_read_u16_at(c->buffer, 2));
	if((e=slabhash_lookup(worker->env.msg_cache, h, lookup_qinfo, 0))) {
	/* answer from cache - we have acquired a readlock on it */
	if(answer_from_cache(worker, &qinfo,
	cinfo, &need_drop, &alias_rrset, &partial_rep,
	(struct reply_info*)e->data,
	(uint16_t)(void *)sldns_buffer_begin(c->buffer),
	sldns_buffer_read_u16_at(c->buffer, 2), repinfo,
	&edns)) {
	/* prefetch it if the prefetch TTL expired.
	* Note that if there is more than one pass
	* its qname must be that used for cache
	* lookup. */
	if((worker->env.cfg->prefetch \|\| worker->env.cfg->serve_expired)
	&& *worker->env.now >=
	((struct reply_info*)e->data)->prefetch_ttl) {
	time_t leeway = ((struct reply_info*)e->
	data)->ttl - *worker->env.now;
	if(((struct reply_info*)e->data)->ttl
	< *worker->env.now)
	leeway = 0;
	lock_rw_unlock(&e->lock);
	reply_and_prefetch(worker, lookup_qinfo,
	sldns_buffer_read_u16_at(c->buffer, 2),
	repinfo, leeway);
	if(!partial_rep) {
	rc = 0;
	regional_free_all(worker->scratchpad);
	goto send_reply_rc;
	}
	} else if(!partial_rep) {
	lock_rw_unlock(&e->lock);
	regional_free_all(worker->scratchpad);
	goto send_reply;
	} else {
	/* Note that we've already released the
	* lock if we're here after prefetch. */
	lock_rw_unlock(&e->lock);
	}
	/* We've found a partial reply ending with an
	* alias. Replace the lookup qinfo for the
	* alias target and lookup the cache again to
	* (possibly) complete the reply. As we're
	* passing the "base" reply, there will be no
	* more alias chasing. */
	memset(&qinfo_tmp, 0, sizeof(qinfo_tmp));
	get_cname_target(alias_rrset, &qinfo_tmp.qname,
	&qinfo_tmp.qname_len);
	if(!qinfo_tmp.qname) {
	log_err("unexpected: invalid answer alias");
	regional_free_all(worker->scratchpad);
	return 0; /* drop query */
	}
	qinfo_tmp.qtype = qinfo.qtype;
	qinfo_tmp.qclass = qinfo.qclass;
	lookup_qinfo = &qinfo_tmp;
	goto lookup_cache;
	}
	verbose(VERB_ALGO, "answer from the cache failed");
	lock_rw_unlock(&e->lock);
	}
	if(!LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) {
	if(answer_norec_from_cache(worker, &qinfo,
	(uint16_t)(void *)sldns_buffer_begin(c->buffer),
	sldns_buffer_read_u16_at(c->buffer, 2), repinfo,
	&edns)) {
	regional_free_all(worker->scratchpad);
	goto send_reply;
	}
	verbose(VERB_ALGO, "answer norec from cache -- "
	"need to validate or not primed");
	}
	}
	sldns_buffer_rewind(c->buffer);
	server_stats_querymiss(&worker->stats, worker);

	if(verbosity >= VERB_CLIENT) {
	if(c->type == comm_udp)
	log_addr(VERB_CLIENT, "udp request from",
	&repinfo->addr, repinfo->addrlen);
	else log_addr(VERB_CLIENT, "tcp request from",
	&repinfo->addr, repinfo->addrlen);
	}

	/* grab a work request structure for this new request */
	mesh_new_client(worker->env.mesh, &qinfo, cinfo,
	sldns_buffer_read_u16_at(c->buffer, 2),
	&edns, repinfo, (uint16_t)(void *)sldns_buffer_begin(c->buffer));
	regional_free_all(worker->scratchpad);
	worker_mem_report(worker, NULL);
	return 0;

	send_reply:
	rc = 1;
	send_reply_rc:
	if(need_drop) {
	comm_point_drop_reply(repinfo);
	return 0;
	}
	#ifdef USE_DNSTAP
	if(worker->dtenv.log_client_response_messages)
	dt_msg_send_client_response(&worker->dtenv, &repinfo->addr,
	c->type, c->buffer);
	#endif
	if(worker->env.cfg->log_replies)
	{
	struct timeval tv = {0, 0};
	- log_reply_info(0, &qinfo, &repinfo->addr, repinfo->addrlen,
	- tv, 1, c->buffer);
	+ if(qinfo.local_alias && qinfo.local_alias->rrset &&
	+ qinfo.local_alias->rrset->rk.dname) {
	+ /* log original qname, before the local alias was
	+ * used to resolve that CNAME to something else */
	+ qinfo.qname = qinfo.local_alias->rrset->rk.dname;
	+ log_reply_info(0, &qinfo, &repinfo->addr, repinfo->addrlen,
	+ tv, 1, c->buffer);
	+ } else {
	+ log_reply_info(0, &qinfo, &repinfo->addr, repinfo->addrlen,
	+ tv, 1, c->buffer);
	+ }
	}
	#ifdef USE_DNSCRYPT
	if(!dnsc_handle_uncurved_request(repinfo)) {
	return 0;
	}
	#endif
	return rc;
	}

	void
	worker_sighandler(int sig, void* arg)
	{
	/* note that log, print, syscalls here give race conditions.
	* And cause hangups if the log-lock is held by the application. */
	struct worker* worker = (struct worker*)arg;
	switch(sig) {
	#ifdef SIGHUP
	case SIGHUP:
	comm_base_exit(worker->base);
	break;
	#endif
	case SIGINT:
	worker->need_to_exit = 1;
	comm_base_exit(worker->base);
	break;
	#ifdef SIGQUIT
	case SIGQUIT:
	worker->need_to_exit = 1;
	comm_base_exit(worker->base);
	break;
	#endif
	case SIGTERM:
	worker->need_to_exit = 1;
	comm_base_exit(worker->base);
	break;
	default:
	/* unknown signal, ignored */
	break;
	}
	}

	/** restart statistics timer for worker, if enabled */
	static void
	worker_restart_timer(struct worker* worker)
	{
	if(worker->env.cfg->stat_interval > 0) {
	struct timeval tv;
	#ifndef S_SPLINT_S
	tv.tv_sec = worker->env.cfg->stat_interval;
	tv.tv_usec = 0;
	#endif
	comm_timer_set(worker->stat_timer, &tv);
	}
	}

	void worker_stat_timer_cb(void* arg)
	{
	struct worker* worker = (struct worker*)arg;
	server_stats_log(&worker->stats, worker, worker->thread_num);
	mesh_stats(worker->env.mesh, "mesh has");
	worker_mem_report(worker, NULL);
	/* SHM is enabled, process data to SHM */
	if (worker->daemon->cfg->shm_enable) {
	shm_main_run(worker);
	}
	if(!worker->daemon->cfg->stat_cumulative) {
	worker_stats_clear(worker);
	}
	/* start next timer */
	worker_restart_timer(worker);
	}

	void worker_probe_timer_cb(void* arg)
	{
	struct worker* worker = (struct worker*)arg;
	struct timeval tv;
	#ifndef S_SPLINT_S
	tv.tv_sec = (time_t)autr_probe_timer(&worker->env);
	tv.tv_usec = 0;
	#endif
	if(tv.tv_sec != 0)
	comm_timer_set(worker->env.probe_timer, &tv);
	}

	struct worker*
	worker_create(struct daemon* daemon, int id, int* ports, int n)
	{
	unsigned int seed;
	struct worker* worker = (struct worker*)calloc(1,
	sizeof(struct worker));
	if(!worker)
	return NULL;
	worker->numports = n;
	worker->ports = (int)memdup(ports, sizeof(int)n);
	if(!worker->ports) {
	free(worker);
	return NULL;
	}
	worker->daemon = daemon;
	worker->thread_num = id;
	if(!(worker->cmd = tube_create())) {
	free(worker->ports);
	free(worker);
	return NULL;
	}
	/* create random state here to avoid locking trouble in RAND_bytes */
	seed = (unsigned int)time(NULL) ^ (unsigned int)getpid() ^
	(((unsigned int)worker->thread_num)<<17);
	/* shift thread_num so it does not match out pid bits */
	if(!(worker->rndstate = ub_initstate(seed, daemon->rand))) {
	explicit_bzero(&seed, sizeof(seed));
	log_err("could not init random numbers.");
	tube_delete(worker->cmd);
	free(worker->ports);
	free(worker);
	return NULL;
	}
	explicit_bzero(&seed, sizeof(seed));
	#ifdef USE_DNSTAP
	if(daemon->cfg->dnstap) {
	log_assert(daemon->dtenv != NULL);
	memcpy(&worker->dtenv, daemon->dtenv, sizeof(struct dt_env));
	if(!dt_init(&worker->dtenv))
	fatal_exit("dt_init failed");
	}
	#endif
	return worker;
	}

	int
	worker_init(struct worker* worker, struct config_file *cfg,
	struct listen_port* ports, int do_sigs)
	{
	#ifdef USE_DNSTAP
	struct dt_env* dtenv = &worker->dtenv;
	#else
	void* dtenv = NULL;
	#endif
	worker->need_to_exit = 0;
	worker->base = comm_base_create(do_sigs);
	if(!worker->base) {
	log_err("could not create event handling base");
	worker_delete(worker);
	return 0;
	}
	comm_base_set_slow_accept_handlers(worker->base, &worker_stop_accept,
	&worker_start_accept, worker);
	if(do_sigs) {
	#ifdef SIGHUP
	ub_thread_sig_unblock(SIGHUP);
	#endif
	ub_thread_sig_unblock(SIGINT);
	#ifdef SIGQUIT
	ub_thread_sig_unblock(SIGQUIT);
	#endif
	ub_thread_sig_unblock(SIGTERM);
	#ifndef LIBEVENT_SIGNAL_PROBLEM
	worker->comsig = comm_signal_create(worker->base,
	worker_sighandler, worker);
	if(!worker->comsig
	#ifdef SIGHUP
	\|\| !comm_signal_bind(worker->comsig, SIGHUP)
	#endif
	#ifdef SIGQUIT
	\|\| !comm_signal_bind(worker->comsig, SIGQUIT)
	#endif
	\|\| !comm_signal_bind(worker->comsig, SIGTERM)
	\|\| !comm_signal_bind(worker->comsig, SIGINT)) {
	log_err("could not create signal handlers");
	worker_delete(worker);
	return 0;
	}
	#endif /* LIBEVENT_SIGNAL_PROBLEM */
	if(!daemon_remote_open_accept(worker->daemon->rc,
	worker->daemon->rc_ports, worker)) {
	worker_delete(worker);
	return 0;
	}
	#ifdef UB_ON_WINDOWS
	wsvc_setup_worker(worker);
	#endif /* UB_ON_WINDOWS */
	} else { /* !do_sigs */
	worker->comsig = NULL;
	}
	worker->front = listen_create(worker->base, ports,
	cfg->msg_buffer_size, (int)cfg->incoming_num_tcp,
	cfg->do_tcp_keepalive
	? cfg->tcp_keepalive_timeout
	: cfg->tcp_idle_timeout,
	worker->daemon->tcl,
	worker->daemon->listen_sslctx,
	dtenv, worker_handle_request, worker);
	if(!worker->front) {
	log_err("could not create listening sockets");
	worker_delete(worker);
	return 0;
	}
	worker->back = outside_network_create(worker->base,
	cfg->msg_buffer_size, (size_t)cfg->outgoing_num_ports,
	cfg->out_ifs, cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6,
	cfg->do_tcp?cfg->outgoing_num_tcp:0,
	worker->daemon->env->infra_cache, worker->rndstate,
	cfg->use_caps_bits_for_id, worker->ports, worker->numports,
	cfg->unwanted_threshold, cfg->outgoing_tcp_mss,
	&worker_alloc_cleanup, worker,
	cfg->do_udp \|\| cfg->udp_upstream_without_downstream,
	worker->daemon->connect_sslctx, cfg->delay_close,
	dtenv);
	if(!worker->back) {
	log_err("could not create outgoing sockets");
	worker_delete(worker);
	return 0;
	}
	/* start listening to commands */
	if(!tube_setup_bg_listen(worker->cmd, worker->base,
	&worker_handle_control_cmd, worker)) {
	log_err("could not create control compt.");
	worker_delete(worker);
	return 0;
	}
	worker->stat_timer = comm_timer_create(worker->base,
	worker_stat_timer_cb, worker);
	if(!worker->stat_timer) {
	log_err("could not create statistics timer");
	}

	/* we use the msg_buffer_size as a good estimate for what the
	* user wants for memory usage sizes */
	worker->scratchpad = regional_create_custom(cfg->msg_buffer_size);
	if(!worker->scratchpad) {
	log_err("malloc failure");
	worker_delete(worker);
	return 0;
	}

	server_stats_init(&worker->stats, cfg);
	alloc_init(&worker->alloc, &worker->daemon->superalloc,
	worker->thread_num);
	alloc_set_id_cleanup(&worker->alloc, &worker_alloc_cleanup, worker);
	worker->env = *worker->daemon->env;
	comm_base_timept(worker->base, &worker->env.now, &worker->env.now_tv);
	- if(worker->thread_num == 0)
	- log_set_time(worker->env.now);
	worker->env.worker = worker;
	worker->env.worker_base = worker->base;
	worker->env.send_query = &worker_send_query;
	worker->env.alloc = &worker->alloc;
	worker->env.outnet = worker->back;
	worker->env.rnd = worker->rndstate;
	/* If case prefetch is triggered, the corresponding mesh will clear
	* the scratchpad for the module env in the middle of request handling.
	* It would be prone to a use-after-free kind of bug, so we avoid
	* sharing it with worker's own scratchpad at the cost of having
	* one more pad per worker. */
	worker->env.scratch = regional_create_custom(cfg->msg_buffer_size);
	if(!worker->env.scratch) {
	log_err("malloc failure");
	worker_delete(worker);
	return 0;
	}
	worker->env.mesh = mesh_create(&worker->daemon->mods, &worker->env);
	worker->env.detach_subs = &mesh_detach_subs;
	worker->env.attach_sub = &mesh_attach_sub;
	worker->env.add_sub = &mesh_add_sub;
	worker->env.kill_sub = &mesh_state_delete;
	worker->env.detect_cycle = &mesh_detect_cycle;
	worker->env.scratch_buffer = sldns_buffer_new(cfg->msg_buffer_size);
	if(!(worker->env.fwds = forwards_create()) \|\|
	!forwards_apply_cfg(worker->env.fwds, cfg)) {
	log_err("Could not set forward zones");
	worker_delete(worker);
	return 0;
	}
	if(!(worker->env.hints = hints_create()) \|\|
	!hints_apply_cfg(worker->env.hints, cfg)) {
	log_err("Could not set root or stub hints");
	worker_delete(worker);
	return 0;
	}
	/* one probe timer per process -- if we have 5011 anchors */
	if(autr_get_num_anchors(worker->env.anchors) > 0
	#ifndef THREADS_DISABLED
	&& worker->thread_num == 0
	#endif
	) {
	struct timeval tv;
	tv.tv_sec = 0;
	tv.tv_usec = 0;
	worker->env.probe_timer = comm_timer_create(worker->base,
	worker_probe_timer_cb, worker);
	if(!worker->env.probe_timer) {
	log_err("could not create 5011-probe timer");
	} else {
	/* let timer fire, then it can reset itself */
	comm_timer_set(worker->env.probe_timer, &tv);
	}
	}
	/* zone transfer tasks, setup once per process, if any */
	if(worker->env.auth_zones
	#ifndef THREADS_DISABLED
	&& worker->thread_num == 0
	#endif
	) {
	auth_xfer_pickup_initial(worker->env.auth_zones, &worker->env);
	}
	if(!worker->env.mesh \|\| !worker->env.scratch_buffer) {
	worker_delete(worker);
	return 0;
	}
	worker_mem_report(worker, NULL);
	/* if statistics enabled start timer */
	if(worker->env.cfg->stat_interval > 0) {
	verbose(VERB_ALGO, "set statistics interval %d secs",
	worker->env.cfg->stat_interval);
	worker_restart_timer(worker);
	}
	return 1;
	}

	void
	worker_work(struct worker* worker)
	{
	comm_base_dispatch(worker->base);
	}

	void
	worker_delete(struct worker* worker)
	{
	if(!worker)
	return;
	if(worker->env.mesh && verbosity >= VERB_OPS) {
	server_stats_log(&worker->stats, worker, worker->thread_num);
	mesh_stats(worker->env.mesh, "mesh has");
	worker_mem_report(worker, NULL);
	}
	outside_network_quit_prepare(worker->back);
	mesh_delete(worker->env.mesh);
	sldns_buffer_free(worker->env.scratch_buffer);
	forwards_delete(worker->env.fwds);
	hints_delete(worker->env.hints);
	listen_delete(worker->front);
	outside_network_delete(worker->back);
	comm_signal_delete(worker->comsig);
	tube_delete(worker->cmd);
	comm_timer_delete(worker->stat_timer);
	comm_timer_delete(worker->env.probe_timer);
	free(worker->ports);
	if(worker->thread_num == 0) {
	- log_set_time(NULL);
	#ifdef UB_ON_WINDOWS
	wsvc_desetup_worker(worker);
	#endif /* UB_ON_WINDOWS */
	}
	comm_base_delete(worker->base);
	ub_randfree(worker->rndstate);
	alloc_clear(&worker->alloc);
	regional_destroy(worker->env.scratch);
	regional_destroy(worker->scratchpad);
	free(worker);
	}

	struct outbound_entry*
	worker_send_query(struct query_info* qinfo, uint16_t flags, int dnssec,
	int want_dnssec, int nocaps, struct sockaddr_storage* addr,
	socklen_t addrlen, uint8_t* zone, size_t zonelen, int ssl_upstream,
	char* tls_auth_name, struct module_qstate* q)
	{
	struct worker* worker = q->env->worker;
	struct outbound_entry* e = (struct outbound_entry*)regional_alloc(
	q->region, sizeof(*e));
	if(!e)
	return NULL;
	e->qstate = q;
	e->qsent = outnet_serviced_query(worker->back, qinfo, flags, dnssec,
	want_dnssec, nocaps, q->env->cfg->tcp_upstream,
	ssl_upstream, tls_auth_name, addr, addrlen, zone, zonelen, q,
	worker_handle_service_reply, e, worker->back->udp_buff, q->env);
	if(!e->qsent) {
	return NULL;
	}
	return e;
	}

	void
	worker_alloc_cleanup(void* arg)
	{
	struct worker* worker = (struct worker*)arg;
	slabhash_clear(&worker->env.rrset_cache->table);
	slabhash_clear(worker->env.msg_cache);
	}

	void worker_stats_clear(struct worker* worker)
	{
	server_stats_init(&worker->stats, worker->env.cfg);
	mesh_stats_clear(worker->env.mesh);
	worker->back->unwanted_replies = 0;
	worker->back->num_tcp_outgoing = 0;
	}

	void worker_start_accept(void* arg)
	{
	struct worker* worker = (struct worker*)arg;
	listen_start_accept(worker->front);
	if(worker->thread_num == 0)
	daemon_remote_start_accept(worker->daemon->rc);
	}

	void worker_stop_accept(void* arg)
	{
	struct worker* worker = (struct worker*)arg;
	listen_stop_accept(worker->front);
	if(worker->thread_num == 0)
	daemon_remote_stop_accept(worker->daemon->rc);
	}

	/* --- fake callbacks for fptr_wlist to work --- */
	struct outbound_entry* libworker_send_query(
	struct query_info* ATTR_UNUSED(qinfo),
	uint16_t ATTR_UNUSED(flags), int ATTR_UNUSED(dnssec),
	int ATTR_UNUSED(want_dnssec), int ATTR_UNUSED(nocaps),
	struct sockaddr_storage* ATTR_UNUSED(addr), socklen_t ATTR_UNUSED(addrlen),
	uint8_t* ATTR_UNUSED(zone), size_t ATTR_UNUSED(zonelen),
	int ATTR_UNUSED(ssl_upstream), char* ATTR_UNUSED(tls_auth_name),
	struct module_qstate* ATTR_UNUSED(q))
	{
	log_assert(0);
	return 0;
	}

	int libworker_handle_reply(struct comm_point* ATTR_UNUSED(c),
	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
	struct comm_reply* ATTR_UNUSED(reply_info))
	{
	log_assert(0);
	return 0;
	}

	int libworker_handle_service_reply(struct comm_point* ATTR_UNUSED(c),
	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
	struct comm_reply* ATTR_UNUSED(reply_info))
	{
	log_assert(0);
	return 0;
	}

	void libworker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
	uint8_t* ATTR_UNUSED(buffer), size_t ATTR_UNUSED(len),
	int ATTR_UNUSED(error), void* ATTR_UNUSED(arg))
	{
	log_assert(0);
	}

	void libworker_fg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
	sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s),
	char* ATTR_UNUSED(why_bogus), int ATTR_UNUSED(was_ratelimited))
	{
	log_assert(0);
	}

	void libworker_bg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
	sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s),
	char* ATTR_UNUSED(why_bogus), int ATTR_UNUSED(was_ratelimited))
	{
	log_assert(0);
	}

	void libworker_event_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
	sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s),
	char* ATTR_UNUSED(why_bogus), int ATTR_UNUSED(was_ratelimited))
	{
	log_assert(0);
	}

	int context_query_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
	{
	log_assert(0);
	return 0;
	}

	int order_lock_cmp(const void* ATTR_UNUSED(e1), const void* ATTR_UNUSED(e2))
	{
	log_assert(0);
	return 0;
	}

	int codeline_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
	{
	log_assert(0);
	return 0;
	}

	Index: head/contrib/unbound/dns64/dns64.c
	===================================================================
	--- head/contrib/unbound/dns64/dns64.c (revision 349719)
	+++ head/contrib/unbound/dns64/dns64.c (revision 349720)
	@@ -1,970 +1,1008 @@
	/*
	* dns64/dns64.c - DNS64 module
	*
	* Copyright (c) 2009, Viagénie. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of Viagénie nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
	* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
	* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
	* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
	* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
	* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
	* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
	* POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains a module that performs DNS64 query processing.
	*/

	#include "config.h"
	#include "dns64/dns64.h"
	#include "services/cache/dns.h"
	#include "services/cache/rrset.h"
	#include "util/config_file.h"
	#include "util/data/msgreply.h"
	#include "util/fptr_wlist.h"
	#include "util/net_help.h"
	#include "util/regional.h"
	#include "util/storage/dnstree.h"
	#include "util/data/dname.h"
	#include "sldns/str2wire.h"

	/******************************************************************************
	* *
	* STATIC CONSTANTS *
	* *
	******************************************************************************/

	/**
	* This is the default DNS64 prefix that is used whent he dns64 module is listed
	* in module-config but when the dns64-prefix variable is not present.
	*/
	static const char DEFAULT_DNS64_PREFIX[] = "64:ff9b::/96";

	/**
	* Maximum length of a domain name in a PTR query in the .in-addr.arpa tree.
	*/
	#define MAX_PTR_QNAME_IPV4 30

	/**
	- * Per-query module-specific state. This is usually a dynamically-allocated
	- * structure, but in our case we only need to store one variable describing the
	- * state the query is in. So we repurpose the minfo pointer by storing an
	- * integer in there.
	+ * State of DNS64 processing for a query.
	*/
	-enum dns64_qstate {
	+enum dns64_state {
	DNS64_INTERNAL_QUERY, /**< Internally-generated query, no DNS64
	processing. */
	DNS64_NEW_QUERY, /**< Query for which we're the first module in
	line. */
	DNS64_SUBQUERY_FINISHED /**< Query for which we generated a sub-query, and
	for which this sub-query is finished. */
	};

	+/**
	+ * Per-query module-specific state. For the DNS64 module.
	+ */
	+struct dns64_qstate {
	+ /** State of the DNS64 module. */
	+ enum dns64_state state;
	+ /** If the dns64 module started with no_cache bool set in the qstate,
	+ * a message to tell it to not modify the cache contents, then this
	+ * is true. The dns64 module is then free to modify that flag for
	+ * its own purposes.
	+ * Otherwise, it is false, the dns64 module was not told to no_cache */
	+ int started_no_cache_store;
	+};

	/******************************************************************************
	* *
	* STRUCTURES *
	* *
	******************************************************************************/

	/**
	* This structure contains module configuration information. One instance of
	* this structure exists per instance of the module. Normally there is only one
	* instance of the module.
	*/
	struct dns64_env {
	/**
	* DNS64 prefix address. We're using a full sockaddr instead of just an
	* in6_addr because we can reuse Unbound's generic string parsing functions.
	* It will always contain a sockaddr_in6, and only the sin6_addr member will
	* ever be used.
	*/
	struct sockaddr_storage prefix_addr;

	/**
	* This is always sizeof(sockaddr_in6).
	*/
	socklen_t prefix_addrlen;

	/**
	* This is the CIDR length of the prefix. It needs to be between 0 and 96.
	*/
	int prefix_net;

	/**
	* Tree of names for which AAAA is ignored. always synthesize from A.
	*/
	rbtree_type ignore_aaaa;
	};


	/******************************************************************************
	* *
	* UTILITY FUNCTIONS *
	* *
	******************************************************************************/

	/**
	* Generic macro for swapping two variables.
	*
	* \param t Type of the variables. (e.g. int)
	* \param a First variable.
	* \param b Second variable.
	*
	* \warning Do not attempt something foolish such as swap(int,a++,b++)!
	*/
	#define swap(t,a,b) do {t x = a; a = b; b = x;} while(0)

	/**
	* Reverses a string.
	*
	* \param begin Points to the first character of the string.
	* \param end Points one past the last character of the string.
	*/
	static void
	reverse(char* begin, char* end)
	{
	while ( begin < --end ) {
	swap(char, begin, end);
	++begin;
	}
	}

	/**
	* Convert an unsigned integer to a string. The point of this function is that
	* of being faster than sprintf().
	*
	* \param n The number to be converted.
	* \param s The result will be written here. Must be large enough, be careful!
	*
	* \return The number of characters written.
	*/
	static int
	uitoa(unsigned n, char* s)
	{
	char* ss = s;
	do {
	*ss++ = '0' + n % 10;
	} while (n /= 10);
	reverse(s, ss);
	return ss - s;
	}

	/**
	* Extract an IPv4 address embedded in the IPv6 address \a ipv6 at offset \a
	* offset (in bits). Note that bits are not necessarily aligned on bytes so we
	* need to be careful.
	*
	* \param ipv6 IPv6 address represented as a 128-bit array in big-endian
	* order.
	* \param offset Index of the MSB of the IPv4 address embedded in the IPv6
	* address.
	*/
	static uint32_t
	extract_ipv4(const uint8_t ipv6[16], const int offset)
	{
	uint32_t ipv4 = (uint32_t)ipv6[offset/8+0] << (24 + (offset%8))
	\| (uint32_t)ipv6[offset/8+1] << (16 + (offset%8))
	\| (uint32_t)ipv6[offset/8+2] << ( 8 + (offset%8))
	\| (uint32_t)ipv6[offset/8+3] << ( 0 + (offset%8));
	if (offset/8+4 < 16)
	ipv4 \|= (uint32_t)ipv6[offset/8+4] >> (8 - offset%8);
	return ipv4;
	}

	/**
	* Builds the PTR query name corresponding to an IPv4 address. For example,
	* given the number 3,464,175,361, this will build the string
	* "\03206\03123\0231\011\07in-addr\04arpa".
	*
	* \param ipv4 IPv4 address represented as an unsigned 32-bit number.
	* \param ptr The result will be written here. Must be large enough, be
	* careful!
	*
	* \return The number of characters written.
	*/
	static size_t
	ipv4_to_ptr(uint32_t ipv4, char ptr[MAX_PTR_QNAME_IPV4])
	{
	static const char IPV4_PTR_SUFFIX[] = "\07in-addr\04arpa";
	int i;
	char* c = ptr;

	for (i = 0; i < 4; ++i) {
	*c = uitoa((unsigned int)(ipv4 % 256), c + 1);
	c += *c + 1;
	ipv4 /= 256;
	}

	memmove(c, IPV4_PTR_SUFFIX, sizeof(IPV4_PTR_SUFFIX));

	return c + sizeof(IPV4_PTR_SUFFIX) - ptr;
	}

	/**
	* Converts an IPv6-related domain name string from a PTR query into an IPv6
	* address represented as a 128-bit array.
	*
	* \param ptr The domain name. (e.g. "\011[...]\010\012\016\012\03ip6\04arpa")
	* \param ipv6 The result will be written here, in network byte order.
	*
	* \return 1 on success, 0 on failure.
	*/
	static int
	ptr_to_ipv6(const char* ptr, uint8_t ipv6[16])
	{
	int i;

	for (i = 0; i < 64; i++) {
	int x;

	if (ptr[i++] != 1)
	return 0;

	if (ptr[i] >= '0' && ptr[i] <= '9') {
	x = ptr[i] - '0';
	} else if (ptr[i] >= 'a' && ptr[i] <= 'f') {
	x = ptr[i] - 'a' + 10;
	} else if (ptr[i] >= 'A' && ptr[i] <= 'F') {
	x = ptr[i] - 'A' + 10;
	} else {
	return 0;
	}

	ipv6[15-i/4] \|= x << (2 * ((i-1) % 4));
	}

	return 1;
	}

	/**
	* Synthesize an IPv6 address based on an IPv4 address and the DNS64 prefix.
	*
	* \param prefix_addr DNS64 prefix address.
	* \param prefix_net CIDR length of the DNS64 prefix. Must be between 0 and 96.
	* \param a IPv4 address.
	* \param aaaa IPv6 address. The result will be written here.
	*/
	static void
	synthesize_aaaa(const uint8_t prefix_addr[16], int prefix_net,
	const uint8_t a[4], uint8_t aaaa[16])
	{
	memcpy(aaaa, prefix_addr, 16);
	aaaa[prefix_net/8+0] \|= a[0] >> (0+prefix_net%8);
	aaaa[prefix_net/8+1] \|= a[0] << (8-prefix_net%8);
	aaaa[prefix_net/8+1] \|= a[1] >> (0+prefix_net%8);
	aaaa[prefix_net/8+2] \|= a[1] << (8-prefix_net%8);
	aaaa[prefix_net/8+2] \|= a[2] >> (0+prefix_net%8);
	aaaa[prefix_net/8+3] \|= a[2] << (8-prefix_net%8);
	aaaa[prefix_net/8+3] \|= a[3] >> (0+prefix_net%8);
	if (prefix_net/8+4 < 16) /* <-- my beautiful symmetry is destroyed! */
	aaaa[prefix_net/8+4] \|= a[3] << (8-prefix_net%8);
	}


	/******************************************************************************
	* *
	* DNS64 MODULE FUNCTIONS *
	* *
	******************************************************************************/

	/**
	* insert ignore_aaaa element into the tree
	* @param dns64_env: module env.
	* @param str: string with domain name.
	* @return false on failure.
	*/
	static int
	dns64_insert_ignore_aaaa(struct dns64_env* dns64_env, char* str)
	{
	/* parse and insert element */
	struct name_tree_node* node;
	node = (struct name_tree_node)calloc(1, sizeof(node));
	if(!node) {
	log_err("out of memory");
	return 0;
	}
	node->name = sldns_str2wire_dname(str, &node->len);
	if(!node->name) {
	free(node);
	log_err("cannot parse dns64-ignore-aaaa: %s", str);
	return 0;
	}
	node->labs = dname_count_labels(node->name);
	node->dclass = LDNS_RR_CLASS_IN;
	if(!name_tree_insert(&dns64_env->ignore_aaaa, node,
	node->name, node->len, node->labs, node->dclass)) {
	/* ignore duplicate element */
	free(node->name);
	free(node);
	return 1;
	}
	return 1;
	}

	/**
	* This function applies the configuration found in the parsed configuration
	* file \a cfg to this instance of the dns64 module. Currently only the DNS64
	* prefix (a.k.a. Pref64) is configurable.
	*
	* \param dns64_env Module-specific global parameters.
	* \param cfg Parsed configuration file.
	*/
	static int
	dns64_apply_cfg(struct dns64_env* dns64_env, struct config_file* cfg)
	{
	struct config_strlist* s;
	verbose(VERB_ALGO, "dns64-prefix: %s", cfg->dns64_prefix);
	if (!netblockstrtoaddr(cfg->dns64_prefix ? cfg->dns64_prefix :
	DEFAULT_DNS64_PREFIX, 0, &dns64_env->prefix_addr,
	&dns64_env->prefix_addrlen, &dns64_env->prefix_net)) {
	log_err("cannot parse dns64-prefix netblock: %s", cfg->dns64_prefix);
	return 0;
	}
	if (!addr_is_ip6(&dns64_env->prefix_addr, dns64_env->prefix_addrlen)) {
	log_err("dns64_prefix is not IPv6: %s", cfg->dns64_prefix);
	return 0;
	}
	if (dns64_env->prefix_net < 0 \|\| dns64_env->prefix_net > 96) {
	log_err("dns64-prefix length it not between 0 and 96: %s",
	cfg->dns64_prefix);
	return 0;
	}
	for(s = cfg->dns64_ignore_aaaa; s; s = s->next) {
	if(!dns64_insert_ignore_aaaa(dns64_env, s->str))
	return 0;
	}
	name_tree_init_parents(&dns64_env->ignore_aaaa);
	return 1;
	}

	/**
	* Initializes this instance of the dns64 module.
	*
	* \param env Global state of all module instances.
	* \param id This instance's ID number.
	*/
	int
	dns64_init(struct module_env* env, int id)
	{
	struct dns64_env* dns64_env =
	(struct dns64_env*)calloc(1, sizeof(struct dns64_env));
	if (!dns64_env) {
	log_err("malloc failure");
	return 0;
	}
	env->modinfo[id] = (void*)dns64_env;
	name_tree_init(&dns64_env->ignore_aaaa);
	if (!dns64_apply_cfg(dns64_env, env->cfg)) {
	log_err("dns64: could not apply configuration settings.");
	return 0;
	}
	return 1;
	}

	/** free ignore AAAA elements */
	static void
	free_ignore_aaaa_node(rbnode_type* node, void* ATTR_UNUSED(arg))
	{
	struct name_tree_node* n = (struct name_tree_node*)node;
	if(!n) return;
	free(n->name);
	free(n);
	}

	/**
	* Deinitializes this instance of the dns64 module.
	*
	* \param env Global state of all module instances.
	* \param id This instance's ID number.
	*/
	void
	dns64_deinit(struct module_env* env, int id)
	{
	struct dns64_env* dns64_env;
	if (!env)
	return;
	dns64_env = (struct dns64_env*)env->modinfo[id];
	if(dns64_env) {
	traverse_postorder(&dns64_env->ignore_aaaa, free_ignore_aaaa_node,
	NULL);
	}
	free(env->modinfo[id]);
	env->modinfo[id] = NULL;
	}

	/**
	* Handle PTR queries for IPv6 addresses. If the address belongs to the DNS64
	* prefix, we must do a PTR query for the corresponding IPv4 address instead.
	*
	* \param qstate Query state structure.
	* \param id This module instance's ID number.
	*
	* \return The new state of the query.
	*/
	static enum module_ext_state
	handle_ipv6_ptr(struct module_qstate* qstate, int id)
	{
	struct dns64_env* dns64_env = (struct dns64_env*)qstate->env->modinfo[id];
	struct module_qstate* subq = NULL;
	struct query_info qinfo;
	struct sockaddr_in6 sin6;

	/* Convert the PTR query string to an IPv6 address. */
	memset(&sin6, 0, sizeof(sin6));
	sin6.sin6_family = AF_INET6;
	if (!ptr_to_ipv6((char*)qstate->qinfo.qname, sin6.sin6_addr.s6_addr))
	return module_wait_module; /* Let other module handle this. */

	/*
	* If this IPv6 address is not part of our DNS64 prefix, then we don't need
	* to do anything. Let another module handle the query.
	*/
	if (addr_in_common((struct sockaddr_storage*)&sin6, 128,
	&dns64_env->prefix_addr, dns64_env->prefix_net,
	(socklen_t)sizeof(sin6)) != dns64_env->prefix_net)
	return module_wait_module;

	verbose(VERB_ALGO, "dns64: rewrite PTR record");

	/*
	* Create a new PTR query info for the domain name corresponding to the IPv4
	* address corresponding to the IPv6 address corresponding to the original
	* PTR query domain name.
	*/
	qinfo = qstate->qinfo;
	if (!(qinfo.qname = regional_alloc(qstate->region, MAX_PTR_QNAME_IPV4)))
	return module_error;
	qinfo.qname_len = ipv4_to_ptr(extract_ipv4(sin6.sin6_addr.s6_addr,
	dns64_env->prefix_net), (char*)qinfo.qname);

	/* Create the new sub-query. */
	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
	if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0, 0,
	&subq))
	return module_error;
	if (subq) {
	subq->curmod = id;
	subq->ext_state[id] = module_state_initial;
	- subq->minfo[id] = NULL;
	+ subq->minfo[id] = NULL;
	}

	return module_wait_subquery;
	}

	static enum module_ext_state
	generate_type_A_query(struct module_qstate* qstate, int id)
	{
	struct module_qstate* subq = NULL;
	struct query_info qinfo;

	verbose(VERB_ALGO, "dns64: query A record");

	/* Create a new query info. */
	qinfo = qstate->qinfo;
	qinfo.qtype = LDNS_RR_TYPE_A;

	/* Start the sub-query. */
	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
	if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0,
	0, &subq))
	{
	verbose(VERB_ALGO, "dns64: sub-query creation failed");
	return module_error;
	}
	if (subq) {
	subq->curmod = id;
	subq->ext_state[id] = module_state_initial;
	subq->minfo[id] = NULL;
	}

	return module_wait_subquery;
	}

	/**
	* See if query name is in the always synth config.
	* The ignore-aaaa list has names for which the AAAA for the domain is
	* ignored and the A is always used to create the answer.
	* @param qstate: query state.
	* @param id: module id.
	* @return true if the name is covered by ignore-aaaa.
	*/
	static int
	dns64_always_synth_for_qname(struct module_qstate* qstate, int id)
	{
	struct dns64_env* dns64_env = (struct dns64_env*)qstate->env->modinfo[id];
	int labs = dname_count_labels(qstate->qinfo.qname);
	struct name_tree_node* node = name_tree_lookup(&dns64_env->ignore_aaaa,
	qstate->qinfo.qname, qstate->qinfo.qname_len, labs,
	qstate->qinfo.qclass);
	return (node != NULL);
	}

	/**
	* Handles the "pass" event for a query. This event is received when a new query
	* is received by this module. The query may have been generated internally by
	* another module, in which case we don't want to do any special processing
	* (this is an interesting discussion topic), or it may be brand new, e.g.
	* received over a socket, in which case we do want to apply DNS64 processing.
	*
	* \param qstate A structure representing the state of the query that has just
	* received the "pass" event.
	* \param id This module's instance ID.
	*
	* \return The new state of the query.
	*/
	static enum module_ext_state
	handle_event_pass(struct module_qstate* qstate, int id)
	{
	- if ((uintptr_t)qstate->minfo[id] == DNS64_NEW_QUERY
	+ struct dns64_qstate* iq = (struct dns64_qstate*)qstate->minfo[id];
	+ if (iq && iq->state == DNS64_NEW_QUERY
	&& qstate->qinfo.qtype == LDNS_RR_TYPE_PTR
	&& qstate->qinfo.qname_len == 74
	&& !strcmp((char*)&qstate->qinfo.qname[64], "\03ip6\04arpa"))
	/* Handle PTR queries for IPv6 addresses. */
	return handle_ipv6_ptr(qstate, id);

	if (qstate->env->cfg->dns64_synthall &&
	- (uintptr_t)qstate->minfo[id] == DNS64_NEW_QUERY
	+ iq && iq->state == DNS64_NEW_QUERY
	&& qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA)
	return generate_type_A_query(qstate, id);

	if(dns64_always_synth_for_qname(qstate, id) &&
	- (uintptr_t)qstate->minfo[id] == DNS64_NEW_QUERY
	+ iq && iq->state == DNS64_NEW_QUERY
	&& !(qstate->query_flags & BIT_CD)
	&& qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA) {
	verbose(VERB_ALGO, "dns64: ignore-aaaa and synthesize anyway");
	return generate_type_A_query(qstate, id);
	}

	/* We are finished when our sub-query is finished. */
	- if ((uintptr_t)qstate->minfo[id] == DNS64_SUBQUERY_FINISHED)
	+ if (iq && iq->state == DNS64_SUBQUERY_FINISHED)
	return module_finished;

	/* Otherwise, pass request to next module. */
	verbose(VERB_ALGO, "dns64: pass to next module");
	return module_wait_module;
	}

	/**
	* Handles the "done" event for a query. We need to analyze the response and
	* maybe issue a new sub-query for the A record.
	*
	* \param qstate A structure representing the state of the query that has just
	* received the "pass" event.
	* \param id This module's instance ID.
	*
	* \return The new state of the query.
	*/
	static enum module_ext_state
	handle_event_moddone(struct module_qstate* qstate, int id)
	{
	+ struct dns64_qstate* iq = (struct dns64_qstate*)qstate->minfo[id];
	/*
	* In many cases we have nothing special to do. From most to least common:
	*
	* - An internal query.
	* - A query for a record type other than AAAA.
	* - CD FLAG was set on querier
	* - An AAAA query for which an error was returned.(qstate.return_rcode)
	* -> treated as servfail thus synthesize (sec 5.1.3 6147), thus
	* synthesize in (sec 5.1.2 of RFC6147).
	* - A successful AAAA query with an answer.
	*/
	- if((enum dns64_qstate)qstate->minfo[id] != DNS64_INTERNAL_QUERY
	+ if((!iq \|\| iq->state != DNS64_INTERNAL_QUERY)
	&& qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA
	&& !(qstate->query_flags & BIT_CD)
	&& !(qstate->return_msg &&
	qstate->return_msg->rep &&
	reply_find_answer_rrset(&qstate->qinfo,
	qstate->return_msg->rep)))
	/* not internal, type AAAA, not CD, and no answer RRset,
	* So, this is a AAAA noerror/nodata answer */
	return generate_type_A_query(qstate, id);

	- if((enum dns64_qstate)qstate->minfo[id] != DNS64_INTERNAL_QUERY
	+ if((!iq \|\| iq->state != DNS64_INTERNAL_QUERY)
	&& qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA
	&& !(qstate->query_flags & BIT_CD)
	&& dns64_always_synth_for_qname(qstate, id)) {
	/* if it is not internal, AAAA, not CD and listed domain,
	* generate from A record and ignore AAAA */
	verbose(VERB_ALGO, "dns64: ignore-aaaa and synthesize anyway");
	return generate_type_A_query(qstate, id);
	}

	+ /* Store the response in cache. */
	+ if ( (!iq \|\| !iq->started_no_cache_store) &&
	+ qstate->return_msg && qstate->return_msg->rep &&
	+ !dns_cache_store(qstate->env, &qstate->qinfo, qstate->return_msg->rep,
	+ 0, 0, 0, NULL, qstate->query_flags))
	+ log_err("out of memory");
	+
	/* do nothing */
	return module_finished;
	}

	/**
	* This is the module's main() function. It gets called each time a query
	* receives an event which we may need to handle. We respond by updating the
	* state of the query.
	*
	* \param qstate Structure containing the state of the query.
	* \param event Event that has just been received.
	* \param id This module's instance ID.
	* \param outbound State of a DNS query on an authoritative server. We never do
	* our own queries ourselves (other modules do it for us), so
	* this is unused.
	*/
	void
	dns64_operate(struct module_qstate* qstate, enum module_ev event, int id,
	struct outbound_entry* outbound)
	{
	+ struct dns64_qstate* iq;
	(void)outbound;
	verbose(VERB_QUERY, "dns64[module %d] operate: extstate:%s event:%s",
	id, strextstate(qstate->ext_state[id]),
	strmodulevent(event));
	log_query_info(VERB_QUERY, "dns64 operate: query", &qstate->qinfo);

	switch(event) {
	case module_event_new:
	/* Tag this query as being new and fall through. */
	- qstate->minfo[id] = (void*)DNS64_NEW_QUERY;
	+ iq = (struct dns64_qstate*)regional_alloc(
	+ qstate->region, sizeof(*iq));
	+ qstate->minfo[id] = iq;
	+ iq->state = DNS64_NEW_QUERY;
	+ iq->started_no_cache_store = qstate->no_cache_store;
	+ qstate->no_cache_store = 1;
	/* fallthrough */
	case module_event_pass:
	qstate->ext_state[id] = handle_event_pass(qstate, id);
	break;
	case module_event_moddone:
	qstate->ext_state[id] = handle_event_moddone(qstate, id);
	break;
	default:
	qstate->ext_state[id] = module_finished;
	break;
	}
	+ if(qstate->ext_state[id] == module_finished) {
	+ iq = (struct dns64_qstate*)qstate->minfo[id];
	+ if(iq && iq->state != DNS64_INTERNAL_QUERY)
	+ qstate->no_cache_store = iq->started_no_cache_store;
	+ }
	}

	static void
	dns64_synth_aaaa_data(const struct ub_packed_rrset_key* fk,
	const struct packed_rrset_data* fd,
	struct ub_packed_rrset_key *dk,
	struct packed_rrset_data *dd_out, struct regional region,
	struct dns64_env* dns64_env )
	{
	struct packed_rrset_data *dd;
	size_t i;
	/*
	* Create synthesized AAAA RR set data. We need to allocated extra memory
	* for the RRs themselves. Each RR has a length, TTL, pointer to wireformat
	* data, 2 bytes of data length, and 16 bytes of IPv6 address.
	*/
	if(fd->count > RR_COUNT_MAX) {
	*dd_out = NULL;
	return; /* integer overflow protection in alloc */
	}
	if (!(dd = *dd_out = regional_alloc(region,
	sizeof(struct packed_rrset_data)
	+ fd->count * (sizeof(size_t) + sizeof(time_t) +
	sizeof(uint8_t*) + 2 + 16)))) {
	log_err("out of memory");
	return;
	}

	/* Copy attributes from A RR set. */
	dd->ttl = fd->ttl;
	dd->count = fd->count;
	dd->rrsig_count = 0;
	dd->trust = fd->trust;
	dd->security = fd->security;

	/*
	* Synthesize AAAA records. Adjust pointers in structure.
	*/
	dd->rr_len =
	(size_t)((uint8_t)dd + sizeof(struct packed_rrset_data));
	dd->rr_data = (uint8_t**)&dd->rr_len[dd->count];
	dd->rr_ttl = (time_t*)&dd->rr_data[dd->count];
	for(i = 0; i < fd->count; ++i) {
	if (fd->rr_len[i] != 6 \|\| fd->rr_data[i][0] != 0
	\|\| fd->rr_data[i][1] != 4) {
	*dd_out = NULL;
	return;
	}
	dd->rr_len[i] = 18;
	dd->rr_data[i] =
	(uint8_t)&dd->rr_ttl[dd->count] + 18i;
	dd->rr_data[i][0] = 0;
	dd->rr_data[i][1] = 16;
	synthesize_aaaa(
	((struct sockaddr_in6*)&dns64_env->prefix_addr)->sin6_addr.s6_addr,
	dns64_env->prefix_net, &fd->rr_data[i][2],
	&dd->rr_data[i][2] );
	dd->rr_ttl[i] = fd->rr_ttl[i];
	}

	/*
	* Create synthesized AAAA RR set key. This is mostly just bookkeeping,
	* nothing interesting here.
	*/
	if(!dk) {
	log_err("no key");
	*dd_out = NULL;
	return;
	}

	dk->rk.dname = (uint8_t*)regional_alloc_init(region,
	fk->rk.dname, fk->rk.dname_len);

	if(!dk->rk.dname) {
	log_err("out of memory");
	*dd_out = NULL;
	return;
	}

	dk->rk.type = htons(LDNS_RR_TYPE_AAAA);
	memset(&dk->entry, 0, sizeof(dk->entry));
	dk->entry.key = dk;
	dk->entry.hash = rrset_key_hash(&dk->rk);
	dk->entry.data = dd;

	}

	/**
	* Synthesize an AAAA RR set from an A sub-query's answer and add it to the
	* original empty response.
	*
	* \param id This module's instance ID.
	* \param super Original AAAA query.
	* \param qstate A query.
	*/
	static void
	dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate)
	{
	struct dns64_env* dns64_env = (struct dns64_env*)super->env->modinfo[id];
	struct reply_info rep, cp;
	size_t i, s;
	struct packed_rrset_data* fd, *dd;
	struct ub_packed_rrset_key* fk, *dk;

	verbose(VERB_ALGO, "converting A answers to AAAA answers");

	log_assert(super->region);
	log_assert(qstate->return_msg);
	log_assert(qstate->return_msg->rep);

	/* If dns64-synthall is enabled, return_msg is not initialized */
	if(!super->return_msg) {
	super->return_msg = (struct dns_msg*)regional_alloc(
	super->region, sizeof(struct dns_msg));
	if(!super->return_msg)
	return;
	memset(super->return_msg, 0, sizeof(*super->return_msg));
	super->return_msg->qinfo = super->qinfo;
	}

	rep = qstate->return_msg->rep;

	/*
	* Build the actual reply.
	*/
	cp = construct_reply_info_base(super->region, rep->flags, rep->qdcount,
	rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl,
	rep->an_numrrsets, rep->ns_numrrsets, rep->ar_numrrsets,
	rep->rrset_count, rep->security);
	if(!cp)
	return;

	/* allocate ub_key structures special or not */
	if(!reply_info_alloc_rrset_keys(cp, NULL, super->region)) {
	return;
	}

	/* copy everything and replace A by AAAA */
	for(i=0; i<cp->rrset_count; i++) {
	fk = rep->rrsets[i];
	dk = cp->rrsets[i];
	fd = (struct packed_rrset_data*)fk->entry.data;
	dk->rk = fk->rk;
	dk->id = fk->id;

	if(i<rep->an_numrrsets && fk->rk.type == htons(LDNS_RR_TYPE_A)) {
	/* also sets dk->entry.hash */
	dns64_synth_aaaa_data(fk, fd, dk, &dd, super->region, dns64_env);
	if(!dd)
	return;
	/* Delete negative AAAA record from cache stored by
	* the iterator module */
	rrset_cache_remove(super->env->rrset_cache, dk->rk.dname,
	dk->rk.dname_len, LDNS_RR_TYPE_AAAA,
	LDNS_RR_CLASS_IN, 0);
	/* Delete negative AAAA in msg cache for CNAMEs,
	* stored by the iterator module */
	if(i != 0) /* if not the first RR */
	msg_cache_remove(super->env, dk->rk.dname,
	dk->rk.dname_len, LDNS_RR_TYPE_AAAA,
	LDNS_RR_CLASS_IN, 0);
	} else {
	dk->entry.hash = fk->entry.hash;
	dk->rk.dname = (uint8_t*)regional_alloc_init(super->region,
	fk->rk.dname, fk->rk.dname_len);

	if(!dk->rk.dname)
	return;

	s = packed_rrset_sizeof(fd);
	dd = (struct packed_rrset_data*)regional_alloc_init(
	super->region, fd, s);

	if(!dd)
	return;
	}

	packed_rrset_ptr_fixup(dd);
	dk->entry.data = (void*)dd;
	}

	/* Commit changes. */
	super->return_msg->rep = cp;
	}

	/**
	* Generate a response for the original IPv6 PTR query based on an IPv4 PTR
	* sub-query's response.
	*
	* \param qstate IPv4 PTR sub-query.
	* \param super Original IPv6 PTR query.
	*/
	static void
	dns64_adjust_ptr(struct module_qstate* qstate, struct module_qstate* super)
	{
	struct ub_packed_rrset_key* answer;

	verbose(VERB_ALGO, "adjusting PTR reply");

	/* Copy the sub-query's reply to the parent. */
	if (!(super->return_msg = (struct dns_msg*)regional_alloc(super->region,
	sizeof(struct dns_msg))))
	return;
	super->return_msg->qinfo = super->qinfo;
	super->return_msg->rep = reply_info_copy(qstate->return_msg->rep, NULL,
	super->region);

	/*
	* Adjust the domain name of the answer RR set so that it matches the
	* initial query's domain name.
	*/
	answer = reply_find_answer_rrset(&qstate->qinfo, super->return_msg->rep);
	- log_assert(answer);
	- answer->rk.dname = super->qinfo.qname;
	- answer->rk.dname_len = super->qinfo.qname_len;
	+ if(answer) {
	+ answer->rk.dname = super->qinfo.qname;
	+ answer->rk.dname_len = super->qinfo.qname_len;
	+ }
	}

	/**
	* This function is called when a sub-query finishes to inform the parent query.
	*
	* We issue two kinds of sub-queries: PTR and A.
	*
	* \param qstate State of the sub-query.
	* \param id This module's instance ID.
	* \param super State of the super-query.
	*/
	void
	dns64_inform_super(struct module_qstate* qstate, int id,
	struct module_qstate* super)
	{
	+ struct dns64_qstate* super_dq = (struct dns64_qstate*)super->minfo[id];
	log_query_info(VERB_ALGO, "dns64: inform_super, sub is",
	&qstate->qinfo);
	log_query_info(VERB_ALGO, "super is", &super->qinfo);

	/*
	* Signal that the sub-query is finished, no matter whether we are
	* successful or not. This lets the state machine terminate.
	*/
	- super->minfo[id] = (void*)DNS64_SUBQUERY_FINISHED;
	+ if(!super_dq) {
	+ super_dq = (struct dns64_qstate*)regional_alloc(super->region,
	+ sizeof(*super_dq));
	+ super->minfo[id] = super_dq;
	+ memset(super_dq, 0, sizeof(*super_dq));
	+ super_dq->started_no_cache_store = super->no_cache_store;
	+ }
	+ super_dq->state = DNS64_SUBQUERY_FINISHED;

	/* If there is no successful answer, we're done. */
	if (qstate->return_rcode != LDNS_RCODE_NOERROR
	\|\| !qstate->return_msg
	- \|\| !qstate->return_msg->rep
	- \|\| !reply_find_answer_rrset(&qstate->qinfo,
	- qstate->return_msg->rep))
	+ \|\| !qstate->return_msg->rep) {
	return;
	+ }

	/* Use return code from A query in response to client. */
	if (super->return_rcode != LDNS_RCODE_NOERROR)
	super->return_rcode = qstate->return_rcode;

	/* Generate a response suitable for the original query. */
	if (qstate->qinfo.qtype == LDNS_RR_TYPE_A) {
	dns64_adjust_a(id, super, qstate);
	} else {
	log_assert(qstate->qinfo.qtype == LDNS_RR_TYPE_PTR);
	dns64_adjust_ptr(qstate, super);
	}

	/* Store the generated response in cache. */
	- if (!super->no_cache_store &&
	+ if ( (!super_dq \|\| !super_dq->started_no_cache_store) &&
	!dns_cache_store(super->env, &super->qinfo, super->return_msg->rep,
	0, 0, 0, NULL, super->query_flags))
	log_err("out of memory");
	}

	/**
	* Clear module-specific data from query state. Since we do not allocate memory,
	* it's just a matter of setting a pointer to NULL.
	*
	* \param qstate Query state.
	* \param id This module's instance ID.
	*/
	void
	dns64_clear(struct module_qstate* qstate, int id)
	{
	qstate->minfo[id] = NULL;
	}

	/**
	* Returns the amount of global memory that this module uses, not including
	* per-query data.
	*
	* \param env Module environment.
	* \param id This module's instance ID.
	*/
	size_t
	dns64_get_mem(struct module_env* env, int id)
	{
	struct dns64_env* dns64_env = (struct dns64_env*)env->modinfo[id];
	if (!dns64_env)
	return 0;
	return sizeof(*dns64_env);
	}

	/**
	* The dns64 function block.
	*/
	static struct module_func_block dns64_block = {
	"dns64",
	&dns64_init, &dns64_deinit, &dns64_operate, &dns64_inform_super,
	&dns64_clear, &dns64_get_mem
	};

	/**
	* Function for returning the above function block.
	*/
	struct module_func_block *
	dns64_get_funcblock(void)
	{
	return &dns64_block;
	}
	Index: head/contrib/unbound/dnscrypt/dnscrypt.c
	===================================================================
	--- head/contrib/unbound/dnscrypt/dnscrypt.c (revision 349719)
	+++ head/contrib/unbound/dnscrypt/dnscrypt.c (revision 349720)
	@@ -1,1115 +1,1116 @@

	#include "config.h"
	#include <stdlib.h>
	#include <fcntl.h>
	#ifdef HAVE_TIME_H
	#include <time.h>
	#endif
	#include <inttypes.h>
	#include <sys/time.h>
	#include <sys/types.h>
	#include "sldns/sbuffer.h"
	#include "util/config_file.h"
	#include "util/net_help.h"
	#include "util/netevent.h"
	#include "util/log.h"
	#include "util/storage/slabhash.h"
	#include "util/storage/lookup3.h"

	#include "dnscrypt/cert.h"
	#include "dnscrypt/dnscrypt.h"
	#include "dnscrypt/dnscrypt_config.h"

	#include <ctype.h>


	/**
	* \file
	* dnscrypt functions for encrypting DNS packets.
	*/

	#define DNSCRYPT_QUERY_BOX_OFFSET \
	(DNSCRYPT_MAGIC_HEADER_LEN + crypto_box_PUBLICKEYBYTES + \
	crypto_box_HALF_NONCEBYTES)

	// 8 bytes: magic header (CERT_MAGIC_HEADER)
	// 12 bytes: the client's nonce
	// 12 bytes: server nonce extension
	// 16 bytes: Poly1305 MAC (crypto_box_ZEROBYTES - crypto_box_BOXZEROBYTES)

	#define DNSCRYPT_REPLY_BOX_OFFSET \
	(DNSCRYPT_MAGIC_HEADER_LEN + crypto_box_HALF_NONCEBYTES + \
	crypto_box_HALF_NONCEBYTES)


	/**
	* Shared secret cache key length.
	* secret key.
	* 1 byte: ES_VERSION[1]
	* 32 bytes: client crypto_box_PUBLICKEYBYTES
	* 32 bytes: server crypto_box_SECRETKEYBYTES
	*/
	#define DNSCRYPT_SHARED_SECRET_KEY_LENGTH \
	(1 + crypto_box_PUBLICKEYBYTES + crypto_box_SECRETKEYBYTES)


	struct shared_secret_cache_key {
	/** the hash table key */
	uint8_t key[DNSCRYPT_SHARED_SECRET_KEY_LENGTH];
	/** the hash table entry, data is uint8_t pointer of size crypto_box_BEFORENMBYTES which contains the shared secret. */
	struct lruhash_entry entry;
	};


	struct nonce_cache_key {
	/** the nonce used by the client */
	uint8_t nonce[crypto_box_HALF_NONCEBYTES];
	/** the client_magic used by the client, this is associated to 1 cert only */
	uint8_t magic_query[DNSCRYPT_MAGIC_HEADER_LEN];
	/** the client public key */
	uint8_t client_publickey[crypto_box_PUBLICKEYBYTES];
	/** the hash table entry, data is uint8_t */
	struct lruhash_entry entry;
	};

	/**
	* Generate a key suitable to find shared secret in slabhash.
	* \param[in] key: a uint8_t pointer of size DNSCRYPT_SHARED_SECRET_KEY_LENGTH
	* \param[in] esversion: The es version least significant byte.
	* \param[in] pk: The public key of the client. uint8_t pointer of size
	* crypto_box_PUBLICKEYBYTES.
	* \param[in] sk: The secret key of the server matching the magic query number.
	* uint8_t pointer of size crypto_box_SECRETKEYBYTES.
	* \return the hash of the key.
	*/
	static uint32_t
	dnsc_shared_secrets_cache_key(uint8_t* key,
	uint8_t esversion,
	uint8_t* pk,
	uint8_t* sk)
	{
	key[0] = esversion;
	memcpy(key + 1, pk, crypto_box_PUBLICKEYBYTES);
	memcpy(key + 1 + crypto_box_PUBLICKEYBYTES, sk, crypto_box_SECRETKEYBYTES);
	return hashlittle(key, DNSCRYPT_SHARED_SECRET_KEY_LENGTH, 0);
	}

	/**
	* Inserts a shared secret into the shared_secrets_cache slabhash.
	* The shared secret is copied so the caller can use it freely without caring
	* about the cache entry being evicted or not.
	* \param[in] cache: the slabhash in which to look for the key.
	* \param[in] key: a uint8_t pointer of size DNSCRYPT_SHARED_SECRET_KEY_LENGTH
	* which contains the key of the shared secret.
	* \param[in] hash: the hash of the key.
	* \param[in] nmkey: a uint8_t pointer of size crypto_box_BEFORENMBYTES which
	* contains the shared secret.
	*/
	static void
	dnsc_shared_secret_cache_insert(struct slabhash *cache,
	uint8_t key[DNSCRYPT_SHARED_SECRET_KEY_LENGTH],
	uint32_t hash,
	uint8_t nmkey[crypto_box_BEFORENMBYTES])
	{
	struct shared_secret_cache_key* k =
	(struct shared_secret_cache_key)calloc(1, sizeof(k));
	uint8_t* d = malloc(crypto_box_BEFORENMBYTES);
	if(!k \|\| !d) {
	free(k);
	free(d);
	return;
	}
	memcpy(d, nmkey, crypto_box_BEFORENMBYTES);
	lock_rw_init(&k->entry.lock);
	memcpy(k->key, key, DNSCRYPT_SHARED_SECRET_KEY_LENGTH);
	k->entry.hash = hash;
	k->entry.key = k;
	k->entry.data = d;
	slabhash_insert(cache,
	hash, &k->entry,
	d,
	NULL);
	}

	/**
	* Lookup a record in shared_secrets_cache.
	* \param[in] cache: a pointer to shared_secrets_cache slabhash.
	* \param[in] key: a uint8_t pointer of size DNSCRYPT_SHARED_SECRET_KEY_LENGTH
	* containing the key to look for.
	* \param[in] hash: a hash of the key.
	* \return a pointer to the locked cache entry or NULL on failure.
	*/
	static struct lruhash_entry*
	dnsc_shared_secrets_lookup(struct slabhash* cache,
	uint8_t key[DNSCRYPT_SHARED_SECRET_KEY_LENGTH],
	uint32_t hash)
	{
	return slabhash_lookup(cache, hash, key, 0);
	}

	/**
	* Generate a key hash suitable to find a nonce in slabhash.
	* \param[in] nonce: a uint8_t pointer of size crypto_box_HALF_NONCEBYTES
	* \param[in] magic_query: a uint8_t pointer of size DNSCRYPT_MAGIC_HEADER_LEN
	* \param[in] pk: The public key of the client. uint8_t pointer of size
	* crypto_box_PUBLICKEYBYTES.
	* \return the hash of the key.
	*/
	static uint32_t
	dnsc_nonce_cache_key_hash(const uint8_t nonce[crypto_box_HALF_NONCEBYTES],
	const uint8_t magic_query[DNSCRYPT_MAGIC_HEADER_LEN],
	const uint8_t pk[crypto_box_PUBLICKEYBYTES])
	{
	uint32_t h = 0;
	h = hashlittle(nonce, crypto_box_HALF_NONCEBYTES, h);
	h = hashlittle(magic_query, DNSCRYPT_MAGIC_HEADER_LEN, h);
	return hashlittle(pk, crypto_box_PUBLICKEYBYTES, h);
	}

	/**
	* Inserts a nonce, magic_query, pk tuple into the nonces_cache slabhash.
	* \param[in] cache: the slabhash in which to look for the key.
	* \param[in] nonce: a uint8_t pointer of size crypto_box_HALF_NONCEBYTES
	* \param[in] magic_query: a uint8_t pointer of size DNSCRYPT_MAGIC_HEADER_LEN
	* \param[in] pk: The public key of the client. uint8_t pointer of size
	* crypto_box_PUBLICKEYBYTES.
	* \param[in] hash: the hash of the key.
	*/
	static void
	dnsc_nonce_cache_insert(struct slabhash *cache,
	const uint8_t nonce[crypto_box_HALF_NONCEBYTES],
	const uint8_t magic_query[DNSCRYPT_MAGIC_HEADER_LEN],
	const uint8_t pk[crypto_box_PUBLICKEYBYTES],
	uint32_t hash)
	{
	struct nonce_cache_key* k =
	(struct nonce_cache_key)calloc(1, sizeof(k));
	if(!k) {
	free(k);
	return;
	}
	lock_rw_init(&k->entry.lock);
	memcpy(k->nonce, nonce, crypto_box_HALF_NONCEBYTES);
	memcpy(k->magic_query, magic_query, DNSCRYPT_MAGIC_HEADER_LEN);
	memcpy(k->client_publickey, pk, crypto_box_PUBLICKEYBYTES);
	k->entry.hash = hash;
	k->entry.key = k;
	k->entry.data = NULL;
	slabhash_insert(cache,
	hash, &k->entry,
	NULL,
	NULL);
	}

	/**
	* Lookup a record in nonces_cache.
	* \param[in] cache: the slabhash in which to look for the key.
	* \param[in] nonce: a uint8_t pointer of size crypto_box_HALF_NONCEBYTES
	* \param[in] magic_query: a uint8_t pointer of size DNSCRYPT_MAGIC_HEADER_LEN
	* \param[in] pk: The public key of the client. uint8_t pointer of size
	* crypto_box_PUBLICKEYBYTES.
	* \param[in] hash: the hash of the key.
	* \return a pointer to the locked cache entry or NULL on failure.
	*/
	static struct lruhash_entry*
	dnsc_nonces_lookup(struct slabhash* cache,
	const uint8_t nonce[crypto_box_HALF_NONCEBYTES],
	const uint8_t magic_query[DNSCRYPT_MAGIC_HEADER_LEN],
	const uint8_t pk[crypto_box_PUBLICKEYBYTES],
	uint32_t hash)
	{
	struct nonce_cache_key k;
	memset(&k, 0, sizeof(k));
	k.entry.hash = hash;
	memcpy(k.nonce, nonce, crypto_box_HALF_NONCEBYTES);
	memcpy(k.magic_query, magic_query, DNSCRYPT_MAGIC_HEADER_LEN);
	memcpy(k.client_publickey, pk, crypto_box_PUBLICKEYBYTES);

	return slabhash_lookup(cache, hash, &k, 0);
	}

	/**
	* Decrypt a query using the dnsccert that was found using dnsc_find_cert.
	* The client nonce will be extracted from the encrypted query and stored in
	* client_nonce, a shared secret will be computed and stored in nmkey and the
	* buffer will be decrypted inplace.
	* \param[in] env the dnscrypt environment.
	* \param[in] cert the cert that matches this encrypted query.
	* \param[in] client_nonce where the client nonce will be stored.
	* \param[in] nmkey where the shared secret key will be written.
	* \param[in] buffer the encrypted buffer.
	* \return 0 on success.
	*/
	static int
	dnscrypt_server_uncurve(struct dnsc_env* env,
	const dnsccert *cert,
	uint8_t client_nonce[crypto_box_HALF_NONCEBYTES],
	uint8_t nmkey[crypto_box_BEFORENMBYTES],
	struct sldns_buffer* buffer)
	{
	size_t len = sldns_buffer_limit(buffer);
	uint8_t *const buf = sldns_buffer_begin(buffer);
	uint8_t nonce[crypto_box_NONCEBYTES];
	struct dnscrypt_query_header *query_header;
	// shared secret cache
	uint8_t key[DNSCRYPT_SHARED_SECRET_KEY_LENGTH];
	struct lruhash_entry* entry;
	uint32_t hash;

	uint32_t nonce_hash;

	if (len <= DNSCRYPT_QUERY_HEADER_SIZE) {
	return -1;
	}

	query_header = (struct dnscrypt_query_header *)buf;

	/* Detect replay attacks */
	nonce_hash = dnsc_nonce_cache_key_hash(
	query_header->nonce,
	cert->magic_query,
	query_header->publickey);

	lock_basic_lock(&env->nonces_cache_lock);
	entry = dnsc_nonces_lookup(
	env->nonces_cache,
	query_header->nonce,
	cert->magic_query,
	query_header->publickey,
	nonce_hash);

	if(entry) {
	lock_rw_unlock(&entry->lock);
	env->num_query_dnscrypt_replay++;
	lock_basic_unlock(&env->nonces_cache_lock);
	return -1;
	}

	dnsc_nonce_cache_insert(
	env->nonces_cache,
	query_header->nonce,
	cert->magic_query,
	query_header->publickey,
	nonce_hash);
	lock_basic_unlock(&env->nonces_cache_lock);

	/* Find existing shared secret */
	hash = dnsc_shared_secrets_cache_key(key,
	cert->es_version[1],
	query_header->publickey,
	cert->keypair->crypt_secretkey);
	entry = dnsc_shared_secrets_lookup(env->shared_secrets_cache,
	key,
	hash);

	if(!entry) {
	lock_basic_lock(&env->shared_secrets_cache_lock);
	env->num_query_dnscrypt_secret_missed_cache++;
	lock_basic_unlock(&env->shared_secrets_cache_lock);
	if(cert->es_version[1] == 2) {
	#ifdef USE_DNSCRYPT_XCHACHA20
	if (crypto_box_curve25519xchacha20poly1305_beforenm(
	nmkey, query_header->publickey,
	cert->keypair->crypt_secretkey) != 0) {
	return -1;
	}
	#else
	return -1;
	#endif
	} else {
	if (crypto_box_beforenm(nmkey,
	query_header->publickey,
	cert->keypair->crypt_secretkey) != 0) {
	return -1;
	}
	}
	// Cache the shared secret we just computed.
	dnsc_shared_secret_cache_insert(env->shared_secrets_cache,
	key,
	hash,
	nmkey);
	} else {
	/* copy shared secret and unlock entry */
	memcpy(nmkey, entry->data, crypto_box_BEFORENMBYTES);
	lock_rw_unlock(&entry->lock);
	}

	memcpy(nonce, query_header->nonce, crypto_box_HALF_NONCEBYTES);
	memset(nonce + crypto_box_HALF_NONCEBYTES, 0, crypto_box_HALF_NONCEBYTES);

	if(cert->es_version[1] == 2) {
	#ifdef USE_DNSCRYPT_XCHACHA20
	if (crypto_box_curve25519xchacha20poly1305_open_easy_afternm
	(buf,
	buf + DNSCRYPT_QUERY_BOX_OFFSET,
	len - DNSCRYPT_QUERY_BOX_OFFSET, nonce,
	nmkey) != 0) {
	return -1;
	}
	#else
	return -1;
	#endif
	} else {
	if (crypto_box_open_easy_afternm
	(buf,
	buf + DNSCRYPT_QUERY_BOX_OFFSET,
	len - DNSCRYPT_QUERY_BOX_OFFSET, nonce,
	nmkey) != 0) {
	return -1;
	}
	}

	len -= DNSCRYPT_QUERY_HEADER_SIZE;

	while (*sldns_buffer_at(buffer, --len) == 0)
	;

	if (*sldns_buffer_at(buffer, len) != 0x80) {
	return -1;
	}

	memcpy(client_nonce, nonce, crypto_box_HALF_NONCEBYTES);

	sldns_buffer_set_position(buffer, 0);
	sldns_buffer_set_limit(buffer, len);

	return 0;
	}


	/**
	* Add random padding to a buffer, according to a client nonce.
	* The length has to depend on the query in order to avoid reply attacks.
	*
	* @param buf a buffer
	* @param len the initial size of the buffer
	* @param max_len the maximum size
	* @param nonce a nonce, made of the client nonce repeated twice
	* @param secretkey
	* @return the new size, after padding
	*/
	size_t
	dnscrypt_pad(uint8_t *buf, const size_t len, const size_t max_len,
	const uint8_t nonce, const uint8_t secretkey)
	{
	uint8_t *buf_padding_area = buf + len;
	size_t padded_len;
	uint32_t rnd;

	// no padding
	if (max_len < len + DNSCRYPT_MIN_PAD_LEN)
	return len;

	assert(nonce[crypto_box_HALF_NONCEBYTES] == nonce[0]);

	crypto_stream((unsigned char *)&rnd, (unsigned long long)sizeof(rnd), nonce,
	secretkey);
	padded_len =
	len + DNSCRYPT_MIN_PAD_LEN + rnd % (max_len - len -
	DNSCRYPT_MIN_PAD_LEN + 1);
	padded_len += DNSCRYPT_BLOCK_SIZE - padded_len % DNSCRYPT_BLOCK_SIZE;
	if (padded_len > max_len)
	padded_len = max_len;

	memset(buf_padding_area, 0, padded_len - len);
	*buf_padding_area = 0x80;

	return padded_len;
	}

	uint64_t
	dnscrypt_hrtime(void)
	{
	struct timeval tv;
	uint64_t ts = (uint64_t)0U;
	int ret;

	ret = gettimeofday(&tv, NULL);
	if (ret == 0) {
	ts = (uint64_t)tv.tv_sec * 1000000U + (uint64_t)tv.tv_usec;
	} else {
	log_err("gettimeofday: %s", strerror(errno));
	}
	return ts;
	}

	/**
	* Add the server nonce part to once.
	* The nonce is made half of client nonce and the seconf half of the server
	* nonce, both of them of size crypto_box_HALF_NONCEBYTES.
	* \param[in] nonce: a uint8_t* of size crypto_box_NONCEBYTES
	*/
	static void
	add_server_nonce(uint8_t *nonce)
	{
	uint64_t ts;
	uint64_t tsn;
	uint32_t suffix;
	ts = dnscrypt_hrtime();
	// TODO? dnscrypt-wrapper does some logic with context->nonce_ts_last
	// unclear if we really need it, so skipping it for now.
	tsn = (ts << 10) \| (randombytes_random() & 0x3ff);
	#if (BYTE_ORDER == LITTLE_ENDIAN)
	tsn =
	(((uint64_t)htonl((uint32_t)tsn)) << 32) \| htonl((uint32_t)(tsn >> 32));
	#endif
	memcpy(nonce + crypto_box_HALF_NONCEBYTES, &tsn, 8);
	suffix = randombytes_random();
	memcpy(nonce + crypto_box_HALF_NONCEBYTES + 8, &suffix, 4);
	}

	/**
	* Encrypt a reply using the dnsccert that was used with the query.
	* The client nonce will be extracted from the encrypted query and stored in
	* The buffer will be encrypted inplace.
	* \param[in] cert the dnsccert that matches this encrypted query.
	* \param[in] client_nonce client nonce used during the query
	* \param[in] nmkey shared secret key used during the query.
	* \param[in] buffer the buffer where to encrypt the reply.
	* \param[in] udp if whether or not it is a UDP query.
	* \param[in] max_udp_size configured max udp size.
	* \return 0 on success.
	*/
	static int
	dnscrypt_server_curve(const dnsccert *cert,
	uint8_t client_nonce[crypto_box_HALF_NONCEBYTES],
	uint8_t nmkey[crypto_box_BEFORENMBYTES],
	struct sldns_buffer* buffer,
	uint8_t udp,
	size_t max_udp_size)
	{
	size_t dns_reply_len = sldns_buffer_limit(buffer);
	size_t max_len = dns_reply_len + DNSCRYPT_MAX_PADDING \
	+ DNSCRYPT_REPLY_HEADER_SIZE;
	size_t max_reply_size = max_udp_size - 20U - 8U;
	uint8_t nonce[crypto_box_NONCEBYTES];
	uint8_t *boxed;
	uint8_t *const buf = sldns_buffer_begin(buffer);
	size_t len = sldns_buffer_limit(buffer);

	if(udp){
	if (max_len > max_reply_size)
	max_len = max_reply_size;
	}


	memcpy(nonce, client_nonce, crypto_box_HALF_NONCEBYTES);
	memcpy(nonce + crypto_box_HALF_NONCEBYTES, client_nonce,
	crypto_box_HALF_NONCEBYTES);

	boxed = buf + DNSCRYPT_REPLY_BOX_OFFSET;
	memmove(boxed + crypto_box_MACBYTES, buf, len);
	len = dnscrypt_pad(boxed + crypto_box_MACBYTES, len,
	max_len - DNSCRYPT_REPLY_HEADER_SIZE, nonce,
	cert->keypair->crypt_secretkey);
	sldns_buffer_set_at(buffer,
	DNSCRYPT_REPLY_BOX_OFFSET - crypto_box_BOXZEROBYTES,
	0, crypto_box_ZEROBYTES);

	// add server nonce extension
	add_server_nonce(nonce);

	if(cert->es_version[1] == 2) {
	#ifdef USE_DNSCRYPT_XCHACHA20
	if (crypto_box_curve25519xchacha20poly1305_easy_afternm
	(boxed, boxed + crypto_box_MACBYTES, len, nonce, nmkey) != 0) {
	return -1;
	}
	#else
	return -1;
	#endif
	} else {
	if (crypto_box_easy_afternm
	(boxed, boxed + crypto_box_MACBYTES, len, nonce, nmkey) != 0) {
	return -1;
	}
	}

	sldns_buffer_write_at(buffer,
	0,
	DNSCRYPT_MAGIC_RESPONSE,
	DNSCRYPT_MAGIC_HEADER_LEN);
	sldns_buffer_write_at(buffer,
	DNSCRYPT_MAGIC_HEADER_LEN,
	nonce,
	crypto_box_NONCEBYTES);
	sldns_buffer_set_limit(buffer, len + DNSCRYPT_REPLY_HEADER_SIZE);
	return 0;
	}

	/**
	* Read the content of fname into buf.
	* \param[in] fname name of the file to read.
	* \param[in] buf the buffer in which to read the content of the file.
	* \param[in] count number of bytes to read.
	* \return 0 on success.
	*/
	static int
	dnsc_read_from_file(char fname, char buf, size_t count)
	{
	int fd;
	fd = open(fname, O_RDONLY);
	if (fd == -1) {
	return -1;
	}
	if (read(fd, buf, count) != (ssize_t)count) {
	close(fd);
	return -2;
	}
	close(fd);
	return 0;
	}

	/**
	* Given an absolute path on the original root, returns the absolute path
	* within the chroot. If chroot is disabled, the path is not modified.
	* No char * is malloced so there is no need to free this.
	* \param[in] cfg the configuration.
	* \param[in] path the path from the original root.
	* \return the path from inside the chroot.
	*/
	static char *
	dnsc_chroot_path(struct config_file cfg, char path)
	{
	char *nm;
	nm = path;
	if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(nm,
	cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
	nm += strlen(cfg->chrootdir);
	return nm;
	}

	/**
	* Parse certificates files provided by the configuration and load them into
	* dnsc_env.
	* \param[in] env the dnsc_env structure to load the certs into.
	* \param[in] cfg the configuration.
	* \return the number of certificates loaded.
	*/
	static int
	dnsc_parse_certs(struct dnsc_env env, struct config_file cfg)
	{
	struct config_strlist head, head2;
	size_t signed_cert_id;
	size_t rotated_cert_id;
	char *nm;

	env->signed_certs_count = 0U;
	env->rotated_certs_count = 0U;
	for (head = cfg->dnscrypt_provider_cert; head; head = head->next) {
	env->signed_certs_count++;
	}
	for (head = cfg->dnscrypt_provider_cert_rotated; head; head = head->next) {
	env->rotated_certs_count++;
	}
	env->signed_certs = sodium_allocarray(env->signed_certs_count,
	sizeof *env->signed_certs);

	env->rotated_certs = sodium_allocarray(env->rotated_certs_count,
	sizeof env->signed_certs);
	signed_cert_id = 0U;
	rotated_cert_id = 0U;
	for(head = cfg->dnscrypt_provider_cert; head; head = head->next, signed_cert_id++) {
	nm = dnsc_chroot_path(cfg, head->str);
	if(dnsc_read_from_file(
	nm,
	(char *)(env->signed_certs + signed_cert_id),
	sizeof(struct SignedCert)) != 0) {
	fatal_exit("dnsc_parse_certs: failed to load %s: %s", head->str, strerror(errno));
	}
	for(head2 = cfg->dnscrypt_provider_cert_rotated; head2; head2 = head2->next) {
	if(strcmp(head->str, head2->str) == 0) {
	*(env->rotated_certs + rotated_cert_id) = env->signed_certs + signed_cert_id;
	rotated_cert_id++;
	verbose(VERB_OPS, "Cert %s is rotated and will not be distributed via DNS", head->str);
	break;
	}
	}
	verbose(VERB_OPS, "Loaded cert %s", head->str);
	}
	return signed_cert_id;
	}

	/**
	* Helper function to convert a binary key into a printable fingerprint.
	* \param[in] fingerprint the buffer in which to write the printable key.
	* \param[in] key the key to convert.
	*/
	void
	dnsc_key_to_fingerprint(char fingerprint[80U], const uint8_t * const key)
	{
	const size_t fingerprint_size = 80U;
	size_t fingerprint_pos = (size_t) 0U;
	size_t key_pos = (size_t) 0U;

	for (;;) {
	assert(fingerprint_size > fingerprint_pos);
	snprintf(&fingerprint[fingerprint_pos],
	fingerprint_size - fingerprint_pos, "%02X%02X",
	key[key_pos], key[key_pos + 1U]);
	key_pos += 2U;
	if (key_pos >= crypto_box_PUBLICKEYBYTES) {
	break;
	}
	fingerprint[fingerprint_pos + 4U] = ':';
	fingerprint_pos += 5U;
	}
	}

	/**
	* Find the cert matching a DNSCrypt query.
	* \param[in] dnscenv The DNSCrypt environment, which contains the list of certs
	* supported by the server.
	* \param[in] buffer The encrypted DNS query.
	* \return a dnsccert * if we found a cert matching the magic_number of the
	* query, NULL otherwise.
	*/
	static const dnsccert *
	dnsc_find_cert(struct dnsc_env* dnscenv, struct sldns_buffer* buffer)
	{
	const dnsccert *certs = dnscenv->certs;
	struct dnscrypt_query_header *dnscrypt_header;
	size_t i;

	if (sldns_buffer_limit(buffer) < DNSCRYPT_QUERY_HEADER_SIZE) {
	return NULL;
	}
	dnscrypt_header = (struct dnscrypt_query_header *)sldns_buffer_begin(buffer);
	for (i = 0U; i < dnscenv->signed_certs_count; i++) {
	if (memcmp(certs[i].magic_query, dnscrypt_header->magic_query,
	DNSCRYPT_MAGIC_HEADER_LEN) == 0) {
	return &certs[i];
	}
	}
	return NULL;
	}

	/**
	* Insert local-zone and local-data into configuration.
	* In order to be able to serve certs over TXT, we can reuse the local-zone and
	* local-data config option. The zone and qname are infered from the
	* provider_name and the content of the TXT record from the certificate content.
	* returns the number of certificate TXT record that were loaded.
	* < 0 in case of error.
	*/
	static int
	dnsc_load_local_data(struct dnsc_env* dnscenv, struct config_file *cfg)
	{
	size_t i, j;
	// Insert 'local-zone: "2.dnscrypt-cert.example.com" deny'
	if(!cfg_str2list_insert(&cfg->local_zones,
	strdup(dnscenv->provider_name),
	strdup("deny"))) {
	log_err("Could not load dnscrypt local-zone: %s deny",
	dnscenv->provider_name);
	return -1;
	}

	// Add local data entry of type:
	// 2.dnscrypt-cert.example.com 86400 IN TXT "DNSC......"
	for(i=0; i<dnscenv->signed_certs_count; i++) {
	const char *ttl_class_type = " 86400 IN TXT \"";
	int rotated_cert = 0;
	uint32_t serial;
	uint16_t rrlen;
	char* rr;
	struct SignedCert *cert = dnscenv->signed_certs + i;
	// Check if the certificate is being rotated and should not be published
	for(j=0; j<dnscenv->rotated_certs_count; j++){
	if(cert == dnscenv->rotated_certs[j]) {
	rotated_cert = 1;
	break;
	}
	}
	memcpy(&serial, cert->serial, sizeof serial);
	serial = htonl(serial);
	if(rotated_cert) {
	verbose(VERB_OPS,
	"DNSCrypt: not adding cert with serial #%"
	PRIu32
	" to local-data as it is rotated",
	serial
	);
	continue;
	}
	rrlen = strlen(dnscenv->provider_name) +
	strlen(ttl_class_type) +
	4 * sizeof(struct SignedCert) + // worst case scenario
	1 + // trailing double quote
	1;
	rr = malloc(rrlen);
	if(!rr) {
	log_err("Could not allocate memory");
	return -2;
	}
	snprintf(rr, rrlen - 1, "%s 86400 IN TXT \"", dnscenv->provider_name);
	for(j=0; j<sizeof(struct SignedCert); j++) {
	int c = (int)((const uint8_t ) cert + j);
	if (isprint(c) && c != '"' && c != '\\') {
	snprintf(rr + strlen(rr), rrlen - 1 - strlen(rr), "%c", c);
	} else {
	snprintf(rr + strlen(rr), rrlen - 1 - strlen(rr), "\\%03d", c);
	}
	}
	verbose(VERB_OPS,
	"DNSCrypt: adding cert with serial #%"
	PRIu32
	" to local-data to config: %s",
	serial, rr
	);
	snprintf(rr + strlen(rr), rrlen - 1 - strlen(rr), "\"");
	cfg_strlist_insert(&cfg->local_data, strdup(rr));
	free(rr);
	}
	return dnscenv->signed_certs_count;
	}

	static const char *
	key_get_es_version(uint8_t version[2])
	{
	struct es_version {
	uint8_t es_version[2];
	const char *name;
	};

	+ const int num_versions = 2;
	struct es_version es_versions[] = {
	{{0x00, 0x01}, "X25519-XSalsa20Poly1305"},
	{{0x00, 0x02}, "X25519-XChacha20Poly1305"},
	};
	int i;
	- for(i=0; i < (int)sizeof(es_versions); i++){
	+ for(i=0; i < num_versions; i++){
	if(es_versions[i].es_version[0] == version[0] &&
	es_versions[i].es_version[1] == version[1]){
	return es_versions[i].name;
	}
	}
	return NULL;
	}


	/**
	* Parse the secret key files from `dnscrypt-secret-key` config and populates
	* a list of dnsccert with es_version, magic number and secret/public keys
	* supported by dnscrypt listener.
	* \param[in] env The dnsc_env structure which will hold the keypairs.
	* \param[in] cfg The config with the secret key file paths.
	*/
	static int
	dnsc_parse_keys(struct dnsc_env env, struct config_file cfg)
	{
	struct config_strlist *head;
	size_t cert_id, keypair_id;
	size_t c;
	char *nm;

	env->keypairs_count = 0U;
	for (head = cfg->dnscrypt_secret_key; head; head = head->next) {
	env->keypairs_count++;
	}

	env->keypairs = sodium_allocarray(env->keypairs_count,
	sizeof *env->keypairs);
	env->certs = sodium_allocarray(env->signed_certs_count,
	sizeof *env->certs);

	cert_id = 0U;
	keypair_id = 0U;
	for(head = cfg->dnscrypt_secret_key; head; head = head->next, keypair_id++) {
	char fingerprint[80];
	int found_cert = 0;
	KeyPair *current_keypair = &env->keypairs[keypair_id];
	nm = dnsc_chroot_path(cfg, head->str);
	if(dnsc_read_from_file(
	nm,
	(char *)(current_keypair->crypt_secretkey),
	crypto_box_SECRETKEYBYTES) != 0) {
	fatal_exit("dnsc_parse_keys: failed to load %s: %s", head->str, strerror(errno));
	}
	verbose(VERB_OPS, "Loaded key %s", head->str);
	if (crypto_scalarmult_base(current_keypair->crypt_publickey,
	current_keypair->crypt_secretkey) != 0) {
	fatal_exit("dnsc_parse_keys: could not generate public key from %s", head->str);
	}
	dnsc_key_to_fingerprint(fingerprint, current_keypair->crypt_publickey);
	verbose(VERB_OPS, "Crypt public key fingerprint for %s: %s", head->str, fingerprint);
	// find the cert matching this key
	for(c = 0; c < env->signed_certs_count; c++) {
	if(memcmp(current_keypair->crypt_publickey,
	env->signed_certs[c].server_publickey,
	crypto_box_PUBLICKEYBYTES) == 0) {
	dnsccert *current_cert = &env->certs[cert_id++];
	found_cert = 1;
	current_cert->keypair = current_keypair;
	memcpy(current_cert->magic_query,
	env->signed_certs[c].magic_query,
	sizeof env->signed_certs[c].magic_query);
	memcpy(current_cert->es_version,
	env->signed_certs[c].version_major,
	sizeof env->signed_certs[c].version_major
	);
	dnsc_key_to_fingerprint(fingerprint,
	current_cert->keypair->crypt_publickey);
	verbose(VERB_OPS, "Crypt public key fingerprint for %s: %s",
	head->str, fingerprint);
	verbose(VERB_OPS, "Using %s",
	key_get_es_version(current_cert->es_version));
	#ifndef USE_DNSCRYPT_XCHACHA20
	if (current_cert->es_version[1] == 0x02) {
	fatal_exit("Certificate for XChacha20 but libsodium does not support it.");
	}
	#endif

	}
	}
	if (!found_cert) {
	fatal_exit("dnsc_parse_keys: could not match certificate for key "
	"%s. Unable to determine ES version.",
	head->str);
	}
	}
	return cert_id;
	}

	static void
	sodium_misuse_handler(void)
	{
	fatal_exit(
	"dnscrypt: libsodium could not be initialized, this typically"
	" happens when no good source of entropy is found. If you run"
	" unbound in a chroot, make sure /dev/random is available. See"
	" https://www.unbound.net/documentation/unbound.conf.html");
	}


	/**
	* #########################################################
	* ############# Publicly accessible functions #############
	* #########################################################
	*/

	int
	dnsc_handle_curved_request(struct dnsc_env* dnscenv,
	struct comm_reply* repinfo)
	{
	struct comm_point* c = repinfo->c;

	repinfo->is_dnscrypted = 0;
	if( !c->dnscrypt ) {
	return 1;
	}
	// Attempt to decrypt the query. If it is not crypted, we may still need
	// to serve the certificate.
	verbose(VERB_ALGO, "handle request called on DNSCrypt socket");
	if ((repinfo->dnsc_cert = dnsc_find_cert(dnscenv, c->buffer)) != NULL) {
	if(dnscrypt_server_uncurve(dnscenv,
	repinfo->dnsc_cert,
	repinfo->client_nonce,
	repinfo->nmkey,
	c->buffer) != 0){
	verbose(VERB_ALGO, "dnscrypt: Failed to uncurve");
	comm_point_drop_reply(repinfo);
	return 0;
	}
	repinfo->is_dnscrypted = 1;
	sldns_buffer_rewind(c->buffer);
	}
	return 1;
	}

	int
	dnsc_handle_uncurved_request(struct comm_reply *repinfo)
	{
	if(!repinfo->c->dnscrypt) {
	return 1;
	}
	sldns_buffer_copy(repinfo->c->dnscrypt_buffer, repinfo->c->buffer);
	if(!repinfo->is_dnscrypted) {
	return 1;
	}
	if(dnscrypt_server_curve(repinfo->dnsc_cert,
	repinfo->client_nonce,
	repinfo->nmkey,
	repinfo->c->dnscrypt_buffer,
	repinfo->c->type == comm_udp,
	repinfo->max_udp_size) != 0){
	verbose(VERB_ALGO, "dnscrypt: Failed to curve cached missed answer");
	comm_point_drop_reply(repinfo);
	return 0;
	}
	return 1;
	}

	struct dnsc_env *
	dnsc_create(void)
	{
	struct dnsc_env *env;
	#ifdef SODIUM_MISUSE_HANDLER
	sodium_set_misuse_handler(sodium_misuse_handler);
	#endif
	if (sodium_init() == -1) {
	fatal_exit("dnsc_create: could not initialize libsodium.");
	}
	env = (struct dnsc_env *) calloc(1, sizeof(struct dnsc_env));
	lock_basic_init(&env->shared_secrets_cache_lock);
	lock_protect(&env->shared_secrets_cache_lock,
	&env->num_query_dnscrypt_secret_missed_cache,
	sizeof(env->num_query_dnscrypt_secret_missed_cache));
	lock_basic_init(&env->nonces_cache_lock);
	lock_protect(&env->nonces_cache_lock,
	&env->nonces_cache,
	sizeof(env->nonces_cache));
	lock_protect(&env->nonces_cache_lock,
	&env->num_query_dnscrypt_replay,
	sizeof(env->num_query_dnscrypt_replay));

	return env;
	}

	int
	dnsc_apply_cfg(struct dnsc_env env, struct config_file cfg)
	{
	if(dnsc_parse_certs(env, cfg) <= 0) {
	fatal_exit("dnsc_apply_cfg: no cert file loaded");
	}
	if(dnsc_parse_keys(env, cfg) <= 0) {
	fatal_exit("dnsc_apply_cfg: no key file loaded");
	}
	randombytes_buf(env->hash_key, sizeof env->hash_key);
	env->provider_name = cfg->dnscrypt_provider;

	if(dnsc_load_local_data(env, cfg) <= 0) {
	fatal_exit("dnsc_apply_cfg: could not load local data");
	}
	lock_basic_lock(&env->shared_secrets_cache_lock);
	env->shared_secrets_cache = slabhash_create(
	cfg->dnscrypt_shared_secret_cache_slabs,
	HASH_DEFAULT_STARTARRAY,
	cfg->dnscrypt_shared_secret_cache_size,
	dnsc_shared_secrets_sizefunc,
	dnsc_shared_secrets_compfunc,
	dnsc_shared_secrets_delkeyfunc,
	dnsc_shared_secrets_deldatafunc,
	NULL
	);
	lock_basic_unlock(&env->shared_secrets_cache_lock);
	if(!env->shared_secrets_cache){
	fatal_exit("dnsc_apply_cfg: could not create shared secrets cache.");
	}
	lock_basic_lock(&env->nonces_cache_lock);
	env->nonces_cache = slabhash_create(
	cfg->dnscrypt_nonce_cache_slabs,
	HASH_DEFAULT_STARTARRAY,
	cfg->dnscrypt_nonce_cache_size,
	dnsc_nonces_sizefunc,
	dnsc_nonces_compfunc,
	dnsc_nonces_delkeyfunc,
	dnsc_nonces_deldatafunc,
	NULL
	);
	lock_basic_unlock(&env->nonces_cache_lock);
	return 0;
	}

	void
	dnsc_delete(struct dnsc_env *env)
	{
	if(!env) {
	return;
	}
	verbose(VERB_OPS, "DNSCrypt: Freeing environment.");
	sodium_free(env->signed_certs);
	sodium_free(env->rotated_certs);
	sodium_free(env->certs);
	sodium_free(env->keypairs);
	lock_basic_destroy(&env->shared_secrets_cache_lock);
	lock_basic_destroy(&env->nonces_cache_lock);
	slabhash_delete(env->shared_secrets_cache);
	slabhash_delete(env->nonces_cache);
	free(env);
	}

	/**
	* #########################################################
	* ############# Shared secrets cache functions ############
	* #########################################################
	*/

	size_t
	dnsc_shared_secrets_sizefunc(void k, void ATTR_UNUSED(d))
	{
	struct shared_secret_cache_key* ssk = (struct shared_secret_cache_key*)k;
	size_t key_size = sizeof(struct shared_secret_cache_key)
	+ lock_get_mem(&ssk->entry.lock);
	size_t data_size = crypto_box_BEFORENMBYTES;
	(void)ssk; /* otherwise ssk is unused if no threading, or fixed locksize */
	return key_size + data_size;
	}

	int
	dnsc_shared_secrets_compfunc(void m1, void m2)
	{
	return sodium_memcmp(m1, m2, DNSCRYPT_SHARED_SECRET_KEY_LENGTH);
	}

	void
	dnsc_shared_secrets_delkeyfunc(void k, void ATTR_UNUSED(arg))
	{
	struct shared_secret_cache_key* ssk = (struct shared_secret_cache_key*)k;
	lock_rw_destroy(&ssk->entry.lock);
	free(ssk);
	}

	void
	dnsc_shared_secrets_deldatafunc(void* d, void* ATTR_UNUSED(arg))
	{
	uint8_t* data = (uint8_t*)d;
	free(data);
	}

	/**
	* #########################################################
	* ############### Nonces cache functions ##################
	* #########################################################
	*/

	size_t
	dnsc_nonces_sizefunc(void k, void ATTR_UNUSED(d))
	{
	struct nonce_cache_key* nk = (struct nonce_cache_key*)k;
	size_t key_size = sizeof(struct nonce_cache_key)
	+ lock_get_mem(&nk->entry.lock);
	(void)nk; /* otherwise ssk is unused if no threading, or fixed locksize */
	return key_size;
	}

	int
	dnsc_nonces_compfunc(void m1, void m2)
	{
	struct nonce_cache_key k1 = m1, k2 = m2;
	return
	sodium_memcmp(
	k1->nonce,
	k2->nonce,
	crypto_box_HALF_NONCEBYTES) != 0 \|\|
	sodium_memcmp(
	k1->magic_query,
	k2->magic_query,
	DNSCRYPT_MAGIC_HEADER_LEN) != 0 \|\|
	sodium_memcmp(
	k1->client_publickey, k2->client_publickey,
	crypto_box_PUBLICKEYBYTES) != 0;
	}

	void
	dnsc_nonces_delkeyfunc(void k, void ATTR_UNUSED(arg))
	{
	struct nonce_cache_key* nk = (struct nonce_cache_key*)k;
	lock_rw_destroy(&nk->entry.lock);
	free(nk);
	}

	void
	dnsc_nonces_deldatafunc(void* ATTR_UNUSED(d), void* ATTR_UNUSED(arg))
	{
	return;
	}
	Index: head/contrib/unbound/dnstap/dnstap.c
	===================================================================
	--- head/contrib/unbound/dnstap/dnstap.c (revision 349719)
	+++ head/contrib/unbound/dnstap/dnstap.c (revision 349720)
	@@ -1,518 +1,535 @@
	/* dnstap support for Unbound */

	/*
	* Copyright (c) 2013-2014, Farsight Security, Inc.
	* All rights reserved.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* 1. Redistributions of source code must retain the above copyright
	* notice, this list of conditions and the following disclaimer.
	*
	* 2. Redistributions in binary form must reproduce the above copyright
	* notice, this list of conditions and the following disclaimer in the
	* documentation and/or other materials provided with the distribution.
	*
	* 3. Neither the name of the copyright holder nor the names of its
	* contributors may be used to endorse or promote products derived from
	* this software without specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
	* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
	* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
	* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
	* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
	* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	#include "dnstap/dnstap_config.h"

	#ifdef USE_DNSTAP

	#include "config.h"
	#include <string.h>
	#include <sys/time.h>
	+#ifdef HAVE_SYS_STAT_H
	+#include <sys/stat.h>
	+#endif
	+#include <errno.h>
	#include "sldns/sbuffer.h"
	#include "util/config_file.h"
	#include "util/net_help.h"
	#include "util/netevent.h"
	#include "util/log.h"

	#include <fstrm.h>
	#include <protobuf-c/protobuf-c.h>

	#include "dnstap/dnstap.h"
	#include "dnstap/dnstap.pb-c.h"

	#define DNSTAP_CONTENT_TYPE "protobuf:dnstap.Dnstap"
	#define DNSTAP_INITIAL_BUF_SIZE 256

	struct dt_msg {
	void *buf;
	size_t len_buf;
	Dnstap__Dnstap d;
	Dnstap__Message m;
	};

	static int
	dt_pack(const Dnstap__Dnstap d, void buf, size_t sz)
	{
	ProtobufCBufferSimple sbuf;

	memset(&sbuf, 0, sizeof(sbuf));
	sbuf.base.append = protobuf_c_buffer_simple_append;
	sbuf.len = 0;
	sbuf.alloced = DNSTAP_INITIAL_BUF_SIZE;
	sbuf.data = malloc(sbuf.alloced);
	if (sbuf.data == NULL)
	return 0;
	sbuf.must_free_data = 1;

	sz = dnstap__dnstap__pack_to_buffer(d, (ProtobufCBuffer ) &sbuf);
	if (sbuf.data == NULL)
	return 0;
	*buf = sbuf.data;

	return 1;
	}

	static void
	dt_send(const struct dt_env env, void buf, size_t len_buf)
	{
	fstrm_res res;
	if (!buf)
	return;
	res = fstrm_iothr_submit(env->iothr, env->ioq, buf, len_buf,
	fstrm_free_wrapper, NULL);
	if (res != fstrm_res_success)
	free(buf);
	}

	static void
	dt_msg_init(const struct dt_env *env,
	struct dt_msg *dm,
	Dnstap__Message__Type mtype)
	{
	memset(dm, 0, sizeof(*dm));
	dm->d.base.descriptor = &dnstap__dnstap__descriptor;
	dm->m.base.descriptor = &dnstap__message__descriptor;
	dm->d.type = DNSTAP__DNSTAP__TYPE__MESSAGE;
	dm->d.message = &dm->m;
	dm->m.type = mtype;
	if (env->identity != NULL) {
	dm->d.identity.data = (uint8_t *) env->identity;
	dm->d.identity.len = (size_t) env->len_identity;
	dm->d.has_identity = 1;
	}
	if (env->version != NULL) {
	dm->d.version.data = (uint8_t *) env->version;
	dm->d.version.len = (size_t) env->len_version;
	dm->d.has_version = 1;
	}
	}

	+/* check that the socket file can be opened and exists, print error if not */
	+static void
	+check_socket_file(const char* socket_path)
	+{
	+ struct stat statbuf;
	+ memset(&statbuf, 0, sizeof(statbuf));
	+ if(stat(socket_path, &statbuf) < 0) {
	+ log_warn("could not open dnstap-socket-path: %s, %s",
	+ socket_path, strerror(errno));
	+ }
	+}
	+
	struct dt_env *
	dt_create(const char *socket_path, unsigned num_workers)
	{
	#ifdef UNBOUND_DEBUG
	fstrm_res res;
	#endif
	struct dt_env *env;
	struct fstrm_iothr_options *fopt;
	struct fstrm_unix_writer_options *fuwopt;
	struct fstrm_writer *fw;
	struct fstrm_writer_options *fwopt;

	verbose(VERB_OPS, "attempting to connect to dnstap socket %s",
	socket_path);
	log_assert(socket_path != NULL);
	log_assert(num_workers > 0);
	+ check_socket_file(socket_path);

	env = (struct dt_env *) calloc(1, sizeof(struct dt_env));
	if (!env)
	return NULL;

	fwopt = fstrm_writer_options_init();
	#ifdef UNBOUND_DEBUG
	res =
	#else
	(void)
	#endif
	fstrm_writer_options_add_content_type(fwopt,
	DNSTAP_CONTENT_TYPE, sizeof(DNSTAP_CONTENT_TYPE) - 1);
	log_assert(res == fstrm_res_success);

	fuwopt = fstrm_unix_writer_options_init();
	fstrm_unix_writer_options_set_socket_path(fuwopt, socket_path);

	fw = fstrm_unix_writer_init(fuwopt, fwopt);
	log_assert(fw != NULL);

	fopt = fstrm_iothr_options_init();
	fstrm_iothr_options_set_num_input_queues(fopt, num_workers);
	env->iothr = fstrm_iothr_init(fopt, &fw);
	if (env->iothr == NULL) {
	verbose(VERB_DETAIL, "dt_create: fstrm_iothr_init() failed");
	fstrm_writer_destroy(&fw);
	free(env);
	env = NULL;
	}
	fstrm_iothr_options_destroy(&fopt);
	fstrm_unix_writer_options_destroy(&fuwopt);
	fstrm_writer_options_destroy(&fwopt);

	return env;
	}

	static void
	dt_apply_identity(struct dt_env env, struct config_file cfg)
	{
	char buf[MAXHOSTNAMELEN+1];
	if (!cfg->dnstap_send_identity)
	return;
	free(env->identity);
	if (cfg->dnstap_identity == NULL \|\| cfg->dnstap_identity[0] == 0) {
	if (gethostname(buf, MAXHOSTNAMELEN) == 0) {
	buf[MAXHOSTNAMELEN] = 0;
	env->identity = strdup(buf);
	} else {
	fatal_exit("dt_apply_identity: gethostname() failed");
	}
	} else {
	env->identity = strdup(cfg->dnstap_identity);
	}
	if (env->identity == NULL)
	fatal_exit("dt_apply_identity: strdup() failed");
	env->len_identity = (unsigned int)strlen(env->identity);
	verbose(VERB_OPS, "dnstap identity field set to \"%s\"",
	env->identity);
	}

	static void
	dt_apply_version(struct dt_env env, struct config_file cfg)
	{
	if (!cfg->dnstap_send_version)
	return;
	free(env->version);
	if (cfg->dnstap_version == NULL \|\| cfg->dnstap_version[0] == 0)
	env->version = strdup(PACKAGE_STRING);
	else
	env->version = strdup(cfg->dnstap_version);
	if (env->version == NULL)
	fatal_exit("dt_apply_version: strdup() failed");
	env->len_version = (unsigned int)strlen(env->version);
	verbose(VERB_OPS, "dnstap version field set to \"%s\"",
	env->version);
	}

	void
	dt_apply_cfg(struct dt_env env, struct config_file cfg)
	{
	if (!cfg->dnstap)
	return;

	dt_apply_identity(env, cfg);
	dt_apply_version(env, cfg);
	if ((env->log_resolver_query_messages = (unsigned int)
	cfg->dnstap_log_resolver_query_messages))
	{
	verbose(VERB_OPS, "dnstap Message/RESOLVER_QUERY enabled");
	}
	if ((env->log_resolver_response_messages = (unsigned int)
	cfg->dnstap_log_resolver_response_messages))
	{
	verbose(VERB_OPS, "dnstap Message/RESOLVER_RESPONSE enabled");
	}
	if ((env->log_client_query_messages = (unsigned int)
	cfg->dnstap_log_client_query_messages))
	{
	verbose(VERB_OPS, "dnstap Message/CLIENT_QUERY enabled");
	}
	if ((env->log_client_response_messages = (unsigned int)
	cfg->dnstap_log_client_response_messages))
	{
	verbose(VERB_OPS, "dnstap Message/CLIENT_RESPONSE enabled");
	}
	if ((env->log_forwarder_query_messages = (unsigned int)
	cfg->dnstap_log_forwarder_query_messages))
	{
	verbose(VERB_OPS, "dnstap Message/FORWARDER_QUERY enabled");
	}
	if ((env->log_forwarder_response_messages = (unsigned int)
	cfg->dnstap_log_forwarder_response_messages))
	{
	verbose(VERB_OPS, "dnstap Message/FORWARDER_RESPONSE enabled");
	}
	}

	int
	dt_init(struct dt_env *env)
	{
	env->ioq = fstrm_iothr_get_input_queue(env->iothr);
	if (env->ioq == NULL)
	return 0;
	return 1;
	}

	void
	dt_delete(struct dt_env *env)
	{
	if (!env)
	return;
	verbose(VERB_OPS, "closing dnstap socket");
	fstrm_iothr_destroy(&env->iothr);
	free(env->identity);
	free(env->version);
	free(env);
	}

	static void
	dt_fill_timeval(const struct timeval *tv,
	uint64_t time_sec, protobuf_c_boolean has_time_sec,
	uint32_t time_nsec, protobuf_c_boolean has_time_nsec)
	{
	#ifndef S_SPLINT_S
	*time_sec = tv->tv_sec;
	time_nsec = tv->tv_usec 1000;
	#endif
	*has_time_sec = 1;
	*has_time_nsec = 1;
	}

	static void
	dt_fill_buffer(sldns_buffer b, ProtobufCBinaryData p, protobuf_c_boolean *has)
	{
	log_assert(b != NULL);
	p->len = sldns_buffer_limit(b);
	p->data = sldns_buffer_begin(b);
	*has = 1;
	}

	static void
	dt_msg_fill_net(struct dt_msg *dm,
	struct sockaddr_storage *ss,
	enum comm_point_type cptype,
	ProtobufCBinaryData addr, protobuf_c_boolean has_addr,
	uint32_t port, protobuf_c_boolean has_port)
	{
	log_assert(ss->ss_family == AF_INET6 \|\| ss->ss_family == AF_INET);
	if (ss->ss_family == AF_INET6) {
	struct sockaddr_in6 s = (struct sockaddr_in6 ) ss;

	/* socket_family */
	dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET6;
	dm->m.has_socket_family = 1;

	/* addr: query_address or response_address */
	addr->data = s->sin6_addr.s6_addr;
	addr->len = 16; /* IPv6 */
	*has_addr = 1;

	/* port: query_port or response_port */
	*port = ntohs(s->sin6_port);
	*has_port = 1;
	} else if (ss->ss_family == AF_INET) {
	struct sockaddr_in s = (struct sockaddr_in ) ss;

	/* socket_family */
	dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET;
	dm->m.has_socket_family = 1;

	/* addr: query_address or response_address */
	addr->data = (uint8_t *) &s->sin_addr.s_addr;
	addr->len = 4; /* IPv4 */
	*has_addr = 1;

	/* port: query_port or response_port */
	*port = ntohs(s->sin_port);
	*has_port = 1;
	}

	log_assert(cptype == comm_udp \|\| cptype == comm_tcp);
	if (cptype == comm_udp) {
	/* socket_protocol */
	dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__UDP;
	dm->m.has_socket_protocol = 1;
	} else if (cptype == comm_tcp) {
	/* socket_protocol */
	dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__TCP;
	dm->m.has_socket_protocol = 1;
	}
	}

	void
	dt_msg_send_client_query(struct dt_env *env,
	struct sockaddr_storage *qsock,
	enum comm_point_type cptype,
	sldns_buffer *qmsg)
	{
	struct dt_msg dm;
	struct timeval qtime;

	gettimeofday(&qtime, NULL);

	/* type */
	dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_QUERY);

	/* query_time */
	dt_fill_timeval(&qtime,
	&dm.m.query_time_sec, &dm.m.has_query_time_sec,
	&dm.m.query_time_nsec, &dm.m.has_query_time_nsec);

	/* query_message */
	dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message);

	/* socket_family, socket_protocol, query_address, query_port */
	log_assert(cptype == comm_udp \|\| cptype == comm_tcp);
	dt_msg_fill_net(&dm, qsock, cptype,
	&dm.m.query_address, &dm.m.has_query_address,
	&dm.m.query_port, &dm.m.has_query_port);

	if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
	dt_send(env, dm.buf, dm.len_buf);
	}

	void
	dt_msg_send_client_response(struct dt_env *env,
	struct sockaddr_storage *qsock,
	enum comm_point_type cptype,
	sldns_buffer *rmsg)
	{
	struct dt_msg dm;
	struct timeval rtime;

	gettimeofday(&rtime, NULL);

	/* type */
	dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_RESPONSE);

	/* response_time */
	dt_fill_timeval(&rtime,
	&dm.m.response_time_sec, &dm.m.has_response_time_sec,
	&dm.m.response_time_nsec, &dm.m.has_response_time_nsec);

	/* response_message */
	dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message);

	/* socket_family, socket_protocol, query_address, query_port */
	log_assert(cptype == comm_udp \|\| cptype == comm_tcp);
	dt_msg_fill_net(&dm, qsock, cptype,
	&dm.m.query_address, &dm.m.has_query_address,
	&dm.m.query_port, &dm.m.has_query_port);

	if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
	dt_send(env, dm.buf, dm.len_buf);
	}

	void
	dt_msg_send_outside_query(struct dt_env *env,
	struct sockaddr_storage *rsock,
	enum comm_point_type cptype,
	uint8_t *zone, size_t zone_len,
	sldns_buffer *qmsg)
	{
	struct dt_msg dm;
	struct timeval qtime;
	uint16_t qflags;

	gettimeofday(&qtime, NULL);
	qflags = sldns_buffer_read_u16_at(qmsg, 2);

	/* type */
	if (qflags & BIT_RD) {
	if (!env->log_forwarder_query_messages)
	return;
	dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_QUERY);
	} else {
	if (!env->log_resolver_query_messages)
	return;
	dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_QUERY);
	}

	/* query_zone */
	dm.m.query_zone.data = zone;
	dm.m.query_zone.len = zone_len;
	dm.m.has_query_zone = 1;

	/* query_time_sec, query_time_nsec */
	dt_fill_timeval(&qtime,
	&dm.m.query_time_sec, &dm.m.has_query_time_sec,
	&dm.m.query_time_nsec, &dm.m.has_query_time_nsec);

	/* query_message */
	dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message);

	/* socket_family, socket_protocol, response_address, response_port */
	log_assert(cptype == comm_udp \|\| cptype == comm_tcp);
	dt_msg_fill_net(&dm, rsock, cptype,
	&dm.m.response_address, &dm.m.has_response_address,
	&dm.m.response_port, &dm.m.has_response_port);

	if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
	dt_send(env, dm.buf, dm.len_buf);
	}

	void
	dt_msg_send_outside_response(struct dt_env *env,
	struct sockaddr_storage *rsock,
	enum comm_point_type cptype,
	uint8_t *zone, size_t zone_len,
	uint8_t *qbuf, size_t qbuf_len,
	const struct timeval *qtime,
	const struct timeval *rtime,
	sldns_buffer *rmsg)
	{
	struct dt_msg dm;
	uint16_t qflags;

	log_assert(qbuf_len >= sizeof(qflags));
	memcpy(&qflags, qbuf, sizeof(qflags));
	qflags = ntohs(qflags);

	/* type */
	if (qflags & BIT_RD) {
	if (!env->log_forwarder_response_messages)
	return;
	dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_RESPONSE);
	} else {
	if (!env->log_resolver_response_messages)
	return;
	dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_RESPONSE);
	}

	/* query_zone */
	dm.m.query_zone.data = zone;
	dm.m.query_zone.len = zone_len;
	dm.m.has_query_zone = 1;

	/* query_time_sec, query_time_nsec */
	dt_fill_timeval(qtime,
	&dm.m.query_time_sec, &dm.m.has_query_time_sec,
	&dm.m.query_time_nsec, &dm.m.has_query_time_nsec);

	/* response_time_sec, response_time_nsec */
	dt_fill_timeval(rtime,
	&dm.m.response_time_sec, &dm.m.has_response_time_sec,
	&dm.m.response_time_nsec, &dm.m.has_response_time_nsec);

	/* response_message */
	dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message);

	/* socket_family, socket_protocol, response_address, response_port */
	log_assert(cptype == comm_udp \|\| cptype == comm_tcp);
	dt_msg_fill_net(&dm, rsock, cptype,
	&dm.m.response_address, &dm.m.has_response_address,
	&dm.m.response_port, &dm.m.has_response_port);

	if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
	dt_send(env, dm.buf, dm.len_buf);
	}

	#endif /* USE_DNSTAP */
	Index: head/contrib/unbound/doc/Changelog
	===================================================================
	--- head/contrib/unbound/doc/Changelog (revision 349719)
	+++ head/contrib/unbound/doc/Changelog (revision 349720)
	@@ -1,8312 +1,8831 @@
	+12 June 2019: Wouter
	+ - Fix another spoolbuf storage code point, in prefetch.
	+ - 1.9.2rc3 release candidate tag.
	+
	+11 June 2019: Wouter
	+ - Fix that fixes the Fix that spoolbuf is not used to store tcp
	+ pipelined response between mesh send and callback end, this fixes
	+ error cases that did not use the correct spoolbuf.
	+ - 1.9.2rc2 release candidate tag.
	+
	+6 June 2019: Wouter
	+ - 1.9.2rc1 release candidate tag.
	+
	+4 June 2019: Wouter
	+ - iana portlist updated.
	+
	+29 May 2019: Wouter
	+ - Fix to guard _OPENBSD_SOURCE from redefinition.
	+
	+28 May 2019: Wouter
	+ - Fix to define _OPENBSD_SOURCE to get reallocarray on NetBSD.
	+ - gitignore config.h.in~.
	+
	+27 May 2019: Wouter
	+ - Fix double file close in tcp pipelined response code.
	+
	+24 May 2019: Wouter
	+ - Fix that spoolbuf is not used to store tcp pipelined response
	+ between mesh send and callback end.
	+
	+20 May 2019: Wouter
	+ - Note that so-reuseport at extreme load is better turned off,
	+ otherwise queries are not distributed evenly, on Linux 4.4.x.
	+
	+16 May 2019: Wouter
	+ - Fix #31: swig 4.0 and python module.
	+
	+13 May 2019: Wouter
	+ - Squelch log messages from tcp send about connection reset by peer.
	+ They can be enabled with verbosity at higher values for diagnosing
	+ network connectivity issues.
	+ - Attempt to fix malformed tcp response.
	+
	+9 May 2019: Wouter
	+ - Revert fix for oss-fuzz, error is in that build script that
	+ unconditionally includes .o files detected by configure, also
	+ when the machine architecture uses different LIBOBJS files.
	+
	+8 May 2019: Wouter
	+ - Attempt to fix build failure in oss-fuzz because of reallocarray.
	+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14648.
	+ Does not omit compile flags from commandline.
	+
	+7 May 2019: Wouter
	+ - Fix edns-subnet locks, in error cases the lock was not unlocked.
	+ - Fix doxygen output error on readme markdown vignettes.
	+
	+6 May 2019: Wouter
	+ - Fix #29: Solaris 11.3 and missing symbols be64toh, htobe64.
	+ - Fix #30: AddressSanitizer finding in lookup3.c. This sets the
	+ hash function to use a slower but better auditable code that does
	+ not read beyond array boundaries. This makes code better security
	+ checkable, and is better for security. It is fixed to be slower,
	+ but not read outside of the array.
	+
	+2 May 2019: Wouter
	+ - contrib/fastrpz.patch updated for code changes, and with git diff.
	+ - Fix .gitignore, add pythonmod and dnstap generated files.
	+ And unit test generated files, and generated doc files.
	+
	+1 May 2019: Wouter
	+ - Update makedist for git.
	+ - Nicer travis output for clang analysis.
	+ - PR #16: XoT support, AXFR over TLS, turn it on with
	+ master: <ip>#<authname> in unbound.conf. This uses TLS to
	+ download the AXFR (or IXFR).
	+
	+25 April 2019: Wouter
	+ - Fix wrong query name in local zone redirect answers with a CNAME,
	+ the copy of the local alias is in unpacked form.
	+
	+18 April 2019: Ralph
	+ - Scrub RRs from answer section when reusing NXDOMAIN message for
	+ subdomain answers.
	+ - For harden-below-nxdomain: do not consider a name to be non-exitent
	+ when message contains a CNAME record.
	+
	+18 April 2019: Wouter
	+ - travis build file.
	+
	+16 April 2019: Wouter
	+ - Better braces in if statement in TCP fastopen code.
	+ - iana portlist updated.
	+
	+15 April 2019: Wouter
	+ - Fix tls write event for read state change to re-call SSL_write and
	+ not resume the TLS handshake.
	+
	+11 April 2019: George
	+ - Update python documentation for init_standard().
	+ - Typos.
	+
	+11 April 2019: Wouter
	+ - Fix that auth zone uses correct network type for sockets for
	+ SOA serial probes. This fixes that probes fail because earlier
	+ probe addresses are unreachable.
	+ - Fix that auth zone fails over to next master for timeout in tcp.
	+ - Squelch SSL read and write connection reset by peer and broken pipe
	+ messages. Verbosity 2 and higher enables them.
	+
	+8 April 2019: Wouter
	+ - Fix to use event_assign with libevent for thread-safety.
	+ - verbose information about auth zone lookup process, also lookup
	+ start, timeout and fail.
	+ - Fix #17: Add python module example from Jan Janak, that is a
	+ plugin for the Unbound DNS resolver to resolve DNS records in
	+ multicast DNS [RFC 6762] via Avahi. The plugin communicates
	+ with Avahi via DBus. The comment section at the beginning of
	+ the file contains detailed documentation.
	+ - Fix to wipe ssl ticket keys from memory with explicit_bzero,
	+ if available.
	+
	+5 April 2019: Wouter
	+ - Fix to reinit event structure for accepted TCP (and TLS) sockets.
	+
	+4 April 2019: Wouter
	+ - Fix spelling error in log output for event method.
	+
	+3 April 2019: Wouter
	+ - Move goto label in answer_from_cache to the end of the function
	+ where it is more visible.
	+ - Fix auth-zone NSEC3 response for wildcard nodata answers,
	+ include the closest encloser in the answer.
	+
	+2 April 2019: Wouter
	+ - Fix auth-zone NSEC3 response for empty nonterminals with exact
	+ match nsec3 records.
	+ - Fix for out of bounds integers, thanks to OSTIF audit. It is in
	+ allocation debug code.
	+ - Fix for auth zone nsec3 ent fix for wildcard nodata.
	+
	+25 March 2019: Wouter
	+ - Fix that tls-session-ticket-keys: "" on its own in unbound.conf
	+ disables the tls session ticker key calls into the OpenSSL API.
	+ - Fix crash if tls-servic-pem not filled in when necessary.
	+
	+21 March 2019: Wouter
	+ - Fix #4240: Fix whitespace cleanup in example.conf.
	+
	+19 March 2019: Wouter
	+ - add type CAA to libpyunbound (accessing libunbound from python).
	+
	+18 March 2019: Wouter
	+ - Add log message, at verbosity 4, that says the query is encrypted
	+ with TLS, if that is enabled for the query.
	+ - Fix #4239: set NOTIMPL when deny-any is enabled, for RFC8482.
	+
	+7 March 2019: Wouter
	+ - Fix for #4233: guard use of NDEBUG, so that it can be passed in
	+ CFLAGS into configure.
	+
	+5 March 2019: Wouter
	+ - Tag release 1.9.1rc1. Which became 1.9.1 on 12 March 2019. Trunk
	+ has 1.9.2 in development.
	+
	+1 March 2019: Wouter
	+ - output forwarder log in ssl_req_order test.
	+
	+28 February 2019: Wouter
	+ - Remove memory leak on pythonmod python2 script file init.
	+ - Remove swig gcc8 python function cast warnings, they are ignored.
	+ - Print correct module that failed when module-config is wrong.
	+
	+27 February 2019: Wouter
	+ - Fix #4229: Unbound man pages lack information, about access-control
	+ order and local zone tags, and elements in views.
	+ - Fix #14: contrib/unbound.init: Fix wrong comparison judgment
	+ before copying.
	+ - Fix for python module on Windows, fix fopen.
	+
	+25 February 2019: Wouter
	+ - Fix #4227: pair event del and add for libevent for tcp_req_info.
	+
	+21 February 2019: Wouter
	+ - Fix the error for unknown module in module-config is understandable,
	+ and explains it was not compiled in and where to see the list.
	+ - In example.conf explain where to put cachedb module in module-config.
	+ - In man page and example config explain that most modules have to
	+ be listed at the start of module-config.
	+
	+20 February 2019: Wouter
	+ - Fix pythonmod include and sockaddr_un ifdefs for compile on
	+ Windows, and for libunbound.
	+
	+18 February 2019: Wouter
	+ - Print query name with ip_ratelimit exceeded log lines.
	+ - Spaces instead of tabs in that log message.
	+ - Print query name and IP address when domain rate limit exceeded.
	+
	+14 February 2019: Wouter
	+ - Fix capsforid canonical sort qsort callback.
	+
	+11 February 2019: Wouter
	+ - Note default for module-config in man page.
	+ - Fix recursion lame test for qname minimisation asked queries,
	+ that were not present in the set of prepared answers.
	+ - Fix #13: Remove left-over requirements on OpenSSL >= 1.1.0 for
	+ cert name matching, from man page.
	+ - make depend, with newer gcc, nicer layout.
	+
	+7 February 2019: Wouter
	+ - Fix #4206: OpenSSL 1.0.2 hostname verification for FreeBSD 11.2.
	+ - Fix that qname minimisation does not skip a label when missing
	+ nameserver targets need to be fetched.
	+ - Fix #4225: clients seem to erroneously receive no answer with
	+ DNS-over-TLS and qname-minimisation.
	+
	+4 February 2019: Wouter
	+ - Fix that log-replies prints the correct name for local-alias
	+ names, for names that have a CNAME in local-data configuration.
	+ It logs the original query name, not the target of the CNAME.
	+ - Add local-zone type inform_redirect, which logs like type inform,
	+ and redirects like type redirect.
	+ - Perform canonical sort for 0x20 capsforid compare of replies,
	+ this sorts rrsets in the authority and additional section before
	+ comparison, so that out of order rrsets do not cause failure.
	+
	+31 January 2019: Wouter
	+ - Set ub_ctx_set_tls call signature in ltrace config file for
	+ libunbound in contrib/libunbound.so.conf.
	+ - improve documentation for tls-service-key and forward-first.
	+ - #10: fixed pkg-config operations, PKG_PROG_PKG_CONFIG moved out of
	+ conditional section, fixes systemd builds, from Enrico Scholz.
	+ - #9: For openssl 1.0.2 use the CRYPTO_THREADID locking callbacks,
	+ still supports the set_id_callback previous API. And for 1.1.0
	+ no locking callbacks are needed.
	+ - #8: Fix OpenSSL without ENGINE support compilation.
	+ - Wipe TLS session key data from memory on exit.
	+
	+30 January 2019: Ralph
	+ - Fix case in which query timeout can result in marking delegation
	+ as edns_lame_known.
	+
	+29 January 2019: Wouter
	+ - Fix spelling of tls-ciphers in example.conf.in.
	+ - Fix #4224: auth_xfr_notify.rpl test broken due to typo
	+ - Fix locking for libunbound context setup with broken port config.
	+
	+28 January 2019: Wouter
	+ - ub_ctx_set_tls call for libunbound that enables DoT for the machines
	+ set with ub_ctx_set_fwd. Patch from Florian Obser.
	+ - Set build system for added call in the libunbound API.
	+ - List example config for root zone copy locally hosted with auth-zone
	+ as suggested from draft-ietf-dnsop-7706-bis-02. But with updated
	+ B root address.
	+ - set version to 1.9.0 for release. And this was released with the
	+ spelling for tls-ciphers fix as 1.9.0 on Feb 5. Trunk has 1.9.1 in
	+ development.
	+
	+25 January 2019: Wouter
	+ - Fix that tcp for auth zone and outgoing does not remove and
	+ then gets the ssl read again applied to the deleted commpoint.
	+ - updated contrib/fastrpz.patch to cleanly diff.
	+ - no lock when threads disabled in tcp request buffer count.
	+ - remove compile warnings from libnettle compile.
	+ - output of newer lex 2.6.1 and bison 3.0.5.
	+
	+24 January 2019: Wouter
	+ - Newer aclocal and libtoolize used for generating configure scripts,
	+ aclocal 1.16.1 and libtoolize 2.4.6.
	+ - Fix unit test for python 3.7 new keyword 'async'.
	+ - clang analysis fixes, assert arc4random buffer in init,
	+ no check for already checked delegation pointer in iterator,
	+ in testcode check for NULL packet matches, in perf do not copy
	+ from NULL start list when growing capacity. Adjust host and file
	+ only when present in test header read to please checker. In
	+ testcode for unknown macro operand give zero result. Initialise the
	+ passed argv array in test code. In test code add EDNS data
	+ segment copy only when nonempty.
	+ - Patch from Florian Obser fixes some compiler warnings:
	+ include mini_event.h to have a prototype for mini_ev_cmp
	+ include edns.h to have a prototype for apply_edns_options
	+ sldns_wire2str_edns_keepalive_print is only called in the wire2str,
	+ module declare it static to get rid of compiler warning:
	+ no previous prototype for function
	+ infra_find_ip_ratedata() is only called in the infra module,
	+ declare it static to get rid of compiler warning:
	+ no previous prototype for function
	+ do not shadow local variable buf in authzone
	+ auth_chunks_delete and az_nsec3_findnode are only called in the
	+ authzone module, declare them static to get rid of compiler warning:
	+ no previous prototype for function...
	+ copy_rrset() is only called in the respip module, declare it
	+ static to get rid of compiler warning:
	+ no previous prototype for function 'copy_rrset'
	+ no need for another variable "r"; gets rid of compiler warning:
	+ declaration shadows a local variable in libunbound.c
	+ no need for another variable "ns"; gets rid of compiler warning:
	+ declaration shadows a local variable in iterator.c
	+ - Moved includes and make depend.
	+
	+23 January 2019: Wouter
	+ - Patch from Manabu Sonoda with tls-ciphers and tls-ciphersuites
	+ options for unbound.conf.
	+ - Fixes for the patch, and man page entry.
	+ - Fix configure to detect SSL_CTX_set_ciphersuites, for better
	+ library compatibility when compiling.
	+ - Patch for TLS session resumption from Manabu Sonoda,
	+ enable with tls-session-ticket-keys in unbound.conf.
	+ - Fixes for patch (includes, declarations, warnings). Free at end
	+ and keep config options in order read from file to keep the first
	+ one as the first one.
	+ - Fix for IXFR fallback to reset counter when IXFR does not timeout.
	+
	+22 January 2019: Wouter
	+ - Fix space calculation for tcp req buffer size.
	+ - Doc for stream-wait-size and unit test.
	+ - unbound-control stats has mem.streamwait that counts TCP and TLS
	+ waiting result buffers.
	+ - Fix for #4219: secondaries not updated after serial change, unbound
	+ falls back to AXFR after IXFR gives several timeout failures.
	+ - Fix that auth zone after IXFR fallback tries the same master.
	+
	+21 January 2019: Wouter
	+ - Fix tcp idle timeout test, for difference in the tcp reply code.
	+ - Unit test for tcp request reorder and timeouts.
	+ - Unit tests for ssl out of order processing.
	+ - Fix that multiple dns fragments can be carried in one TLS frame.
	+ - Add stream-wait-size: 4m config option to limit the maximum
	+ memory used by waiting tcp and tls stream replies. This avoids
	+ a denial of service where these replies use up all of the memory.
	+
	+17 January 2019: Wouter
	+ - For caps-for-id fallback, use the whitelist to avoid timeout
	+ starting a fallback sequence for it.
	+ - increase mesh max activation count for capsforid long fetches.
	+
	+16 January 2019: Ralph
	+ - Get ready for the DNS flag day: remove EDNS lame procedure, do not
	+ re-query without EDNS after timeout.
	+
	+15 January 2019: Wouter
	+ - In the out of order processing, reset byte count for (potential)
	+ partial read.
	+ - Review fixes in out of order processing.
	+
	+14 January 2019: Wouter
	+ - streamtcp option -a send queries consecutively and prints answers
	+ as they arrive.
	+ - Fix for out of order processing administration quit cleanup.
	+ - unit test for tcp out of order processing.
	+
	+11 January 2019: Wouter
	+ - Initial commit for out-of-order processing for TCP and TLS.
	+
	+9 January 2019: Wouter
	+ - Log query name for looping module errors.
	+
	+8 January 2019: Wouter
	+ - Fix syntax in comment of local alias processing.
	+ - Fix NSEC3 record that is returned in wildcard replies from
	+ auth-zone zones with NSEC3 and wildcards.
	+
	+7 January 2019: Wouter
	+ - On FreeBSD warn if systcl settings do not allow server TCP FASTOPEN,
	+ and server tcp fastopen is enabled at compile time.
	+ - Document interaction between the tls-upstream option in the server
	+ section and forward-tls-upstream option in the forward-zone sections.
	+ - Add contrib/unbound-fuzzme.patch from Jacob Hoffman-Andrews,
	+ the patch adds a program used for fuzzing.
	+
	+12 December 2018: Wouter
	+ - Fix for crash in dns64 module if response is null.
	+
	+10 December 2018: Wouter
	+ - Fix config parser memory leaks.
	+ - ip-ratelimit-factor of 1 allows all traffic through, instead of the
	+ previous blocking everything.
	+ - Fix for FreeBSD port make with dnscrypt and dnstap enabled.
	+ - Fix #4206: support openssl 1.0.2 for TLS hostname verification,
	+ alongside the 1.1.0 and later support that is already there.
	+ - Fixup openssl 1.0.2 compile
	+
	+6 December 2018: Wouter
	+ - Fix dns64 allocation in wrong region for returned internal queries.
	+
	+3 December 2018: Wouter
	+ - Fix icon, no ragged edges and nicer resolutions available, for eg.
	+ Win 7 and Windows 10 display.
	+ - cache-max-ttl also defines upperbound of initial TTL in response.
	+
	+30 November 2018: Wouter
	+ - Patch for typo in unbound.conf man page.
	+ - log-tag-queryreply: yes in unbound.conf tags the log-queries and
	+ log-replies in the log file for easier log filter maintenance.
	+
	+29 November 2018: Wouter
	+ - iana portlist updated.
	+ - Fix chroot auth-zone fix to remove chroot prefix.
	+ - tag for 1.8.2rc1, which became 1.8.2 on 4 dec 2018, with icon
	+ updated. Trunk contains 1.8.3 in development.
	+ Which became 1.8.3 on 11 december with only the dns64 fix of 6 dec.
	+ Trunk then became 1.8.4 in development.
	+ - Fix that unbound-checkconf does not complains if the config file
	+ is not placed inside the chroot.
	+ - Refuse to start with no ports.
	+ - Remove clang analysis warnings.
	+
	+28 November 2018: Wouter
	+ - Fix leak in chroot fix for auth-zone.
	+ - Fix clang analysis for outside directory build test.
	+
	+27 November 2018: Wouter
	+ - Fix DNS64 to not store intermediate results in cache, this avoids
	+ other threads from picking up the wrong data. The module restores
	+ the previous no_cache_store setting when the the module is finished.
	+ - Fix #4208: 'stub-no-cache' and 'forward-no-cache' not work.
	+ - New and better fix for Fix #4193: Fix that prefetch failure does
	+ not overwrite valid cache entry with SERVFAIL.
	+ - auth-zone give SERVFAIL when expired, fallback activates when
	+ expired, and this is documented in the man page.
	+ - stat count SERVFAIL downstream auth-zone queries for expired zones.
	+ - Put new logos into windows installer.
	+ - Fix windows compile for new rrset roundrobin fix.
	+ - Update contrib fastrpz patch for latest release.
	+
	+26 November 2018: Wouter
	+ - Fix to not set GLOB_NOSORT so the unbound.conf include: files are
	+ sorted and in a predictable order.
	+ - Fix #4193: Fix that prefetch failure does not overwrite valid cache
	+ entry with SERVFAIL.
	+ - Add unbound-control view_local_datas command, like local_datas.
	+ - Fix that unbound-control can send file for view_local_datas.
	+
	+22 November 2018: Wouter
	+ - With ./configure --with-pyunbound --with-pythonmodule
	+ PYTHON_VERSION=3.6 or with 2.7 unbound can compile and unit tests
	+ succeed for the python module.
	+ - pythonmod logs the python error and traceback on failure.
	+ - ignore debug python module for test in doxygen output.
	+ - review fixes for python module.
	+ - Fix #4209: Crash in libunbound when called from getdns.
	+ - auth zone zonefiles can be in a chroot, the chroot directory
	+ components are removed before use.
	+ - Fix that empty zonefile means the zonefile is not set and not used.
	+ - make depend.
	+
	+21 November 2018: Wouter
	+ - Scrub NS records from NODATA responses as well.
	+
	+20 November 2018: Wouter
	+ - Scrub NS records from NXDOMAIN responses to stop fragmentation
	+ poisoning of the cache.
	+ - Add patch from Jan Vcelak for pythonmod,
	+ add sockaddr_storage getters, add support for query callbacks,
	+ allow raw address access via comm_reply and update API documentation.
	+ - Removed compile warnings in pythonmod sockaddr routines.
	+
	+19 November 2018: Wouter
	+ - Support SO_REUSEPORT_LB in FreeBSD 12 with the so-reuseport: yes
	+ option in unbound.conf.
	+
	+6 November 2018: Ralph
	+ - Bugfix min-client-subnet-ipv6
	+
	+25 October 2018: Ralph
	+ - Add min-client-subnet-ipv6 and min-client-subnet-ipv4 options.
	+
	+25 October 2018: Wouter
	+ - Fix #4191: NXDOMAIN vs SERVFAIL during dns64 PTR query.
	+ - Fix #4190: Please create a "ANY" deny option, adds the option
	+ deny-any: yes in unbound.conf. This responds with an empty message
	+ to queries of type ANY.
	+ - Fix #4141: More randomness to rrset-roundrobin.
	+ - Fix #4132: Openness/closeness of RANGE intervals in rpl files.
	+ - Fix #4126: RTT_band too low on VSAT links with 600+ms latency,
	+ adds the option unknown-server-time-limit to unbound.conf that
	+ can be increased to avoid the problem.
	+ - remade makefile dependencies.
	+ - Fix #4152: Logs shows wrong time when using log-time-ascii: yes.
	+
	+24 October 2018: Ralph
	+ - Add markdel function to ECS slabhash.
	+ - Limit ECS scope returned to client to the scope used for caching.
	+ - Make lint like previous #4154 fix.
	+
	+22 October 2018: Wouter
	+ - Fix #4192: unbound-control-setup generates keys not readable by
	+ group.
	+ - check that the dnstap socket file can be opened and exists, print
	+ error if not.
	+ - Fix #4154: make ECS_MAX_TREESIZE configurable, with
	+ the max-ecs-tree-size-ipv4 and max-ecs-tree-size-ipv6 options.
	+
	+22 October 2018: Ralph
	+ - Change fast-server-num default to 3.
	+
	+8 October 2018: Ralph
	+ - Add fast-server-permil and fast-server-num options.
	+ - Deprecate low-rtt and low-rtt-permil options.
	+
	8 October 2018: Wouter
	- - fastrpz.patch fix included.
	+ - Squelch log of failed to tcp initiate after TCP Fastopen failure.

	+5 October 2018: Wouter
	+ - Squelch EADDRNOTAVAIL errors when the interface goes away,
	+ this omits 'can't assign requested address' errors unless
	+ verbosity is set to a high value.
	+ - Set default for so-reuseport to no for FreeBSD. It is enabled
	+ by default for Linux and DragonFlyBSD. The setting can
	+ be configured in unbound.conf to override the default.
	+ - iana port update.
	+
	+2 October 2018: Wouter
	+ - updated contrib/fastrpz.patch to apply for this version
	+ - dnscrypt.c removed sizeof to get array bounds.
	+ - Fix testlock code to set noreturn on error routine.
	+ - Remove unused variable from contrib fastrpz/rpz.c and
	+ remove unused diagnostic pragmas that themselves generate warnings
	+ - clang analyze test is used only when assertions are enabled.
	+
	1 October 2018: Wouter
	- - tag for release 1.8.1rc1.
	+ - tag for release 1.8.1rc1. Became release 1.8.1 on 8 oct, with
	+ fastrpz.patch fix included. Trunk has 1.8.2 in development.

	27 September 2018: Wouter
	- Fix #4188: IPv6 forwarders without ipv6 result in SERVFAIL, fixes
	qname minimisation with a forwarder when connectivity has issues
	from rejecting responses.

	25 September 2018: Wouter
	- Perform TLS SNI indication of the host that is being contacted
	for DNS over TLS service. It sets the configured tls auth name.
	This is useful for hosts that apart from the DNS over TLS services
	also provide other (web) services.
	- Fix #4149: Add SSL cleanup for tcp timeout.

	17 September 2018: Wouter
	- Fix compile on Mac for unbound, provide explicit_bzero when libc
	does not have it.
	- Fix unbound for openssl in FIPS mode, it uses the digests with
	the EVP call contexts.
	- Fix that with harden-below-nxdomain and qname minisation enabled
	some iterator states for nonresponsive domains can get into a
	state where they waited for an empty list.
	- Stop UDP to TCP failover after timeouts that causes the ping count
	to be reset by the TCP time measurement (that exists for TLS),
	because that causes the UDP part to not be measured as timeout.
	- Fix #4156: Fix systemd service manager state change notification.

	13 September 2018: Wouter
	- Fix seed for random backup code to use explicit zero when wiped.
	- exit log routine is annotated as noreturn function.
	- free memory leaks in config strlist and str2list insert functions.
	- do not move unused argv variable after getopt.
	- Remove unused if clause in testcode.
	- in testcode, free async ids, initialise array, and check for null
	pointer during test of the test. And use exit for return to note
	irregular program stop.
	- Free memory leak in config strlist append.
	- make sure nsec3 comparison salt is initialized.
	- unit test has clang analysis.
	- remove unused variable assignment from iterator scrub routine.
	- check for null in delegation point during iterator refetch
	in forward zone.
	- neater pointer cast in libunbound context quit routine.
	- initialize statistics totals for printout.
	- in authzone check that node exists before adding rrset.
	- in unbound-anchor, use readwrite memory BIO.
	- assertion in autotrust that packed rrset is formed correctly.
	- Fix memory leak when message parse fails partway through copy.
	- remove unused udpsize assignment in message encode.
	- nicer bio free code in unbound-anchor.
	- annotate exit functions with noreturn in unbound-control.

	11 September 2018: Wouter
	- Fixed unused return value warnings in contrib/fastrpz.patch for
	asprintf.
	- Fix to squelch respip warning in unit test, it is printed at
	higher verbosity settings.
	- Fix spelling errors.
	- Fix initialisation in remote.c

	10 September 2018: Wouter
	- 1.8.1 in svn trunk. (changes from 4,5,.. sep apply).
	- iana port update.

	5 September 2018: Wouter
	- Fix spelling error in header, from getdns commit by Andreas Gelmini.

	4 September 2018: Ralph
	- More explicitly mention the type of ratelimit when applying
	ip-ratelimit.

	4 September 2018: Wouter
	- Tag for 1.8.0rc1 release, became 1.8.0 release on 10 Sep 2018.

	31 August 2018: Wouter
	- Disable minimal-responses in subnet unit tests.

	30 August 2018: Wouter
	- Fix that a local-zone with a local-zone-type that is transparent
	in a view with view-first, makes queries check for answers from the
	local-zones defined outside of views.

	28 August 2018: Ralph
	- Disable minimal-responses in ipsecmod unit tests.
	- Added serve-expired-ttl and serve-expired-ttl-reset options.

	27 August 2018: Wouter
	- Set defaults to yes for a number of options to increase speed and
	resilience of the server. The so-reuseport, harden-below-nxdomain,
	and minimal-responses options are enabled by default. They used
	to be disabled by default, waiting to make sure they worked. They
	are enabled by default now, and can be disabled explicitly by
	setting them to "no" in the unbound.conf config file. The reuseport
	and minimal options increases speed of the server, and should be
	otherwise harmless. The harden-below-nxdomain option works well
	together with the recently default enabled qname minimisation, this
	causes more fetches to use information from the cache.
	- next release is called 1.8.0.
	- Fix lintflags for lint on FreeBSD.

	22 August 2018: George
	- #4140: Expose repinfo (comm_reply) to the inplace_callbacks. This
	gives access to reply information for the client's communication
	point when the callback is called before the mesh state (modules).
	Changes to C and Python's inplace_callback signatures were also
	necessary.

	21 August 2018: Wouter
	- log-local-actions: yes option for unbound.conf that logs all the
	local zone actions, a patch from Saksham Manchanda (Secure64).
	- #4146: num.query.subnet and num.query.subnet_cache counters.
	- Fix only misc failure from log-servfail when val-log-level is not
	enabled.

	17 August 2018: Ralph
	- Fix classification for QTYPE=CNAME queries when QNAME minimisation is
	enabled.

	17 August 2018: Wouter
	- Set libunbound to increase current, because the libunbound change
	to the event callback function signature. That needs programs,
	that use it, to recompile against the new header definition.
	- print servfail info to log as error.
	- added more servfail printout statements, to the iterator.
	- log-servfail: yes prints log lines that say why queries are
	returning SERVFAIL to clients.

	16 August 2018: Wouter
	- Fix warning on compile without threads.
	- Fix contrib/fastrpz.patch.

	15 August 2018: Wouter
	- Fix segfault in auth-zone read and reorder of RRSIGs.

	14 August 2018: Wouter
	- Fix that printout of error for cycle targets is a verbosity 4
	printout and does not wrongly print it is a memory error.
	- Upgraded crosscompile script to include libunbound DLL in the
	zipfile.

	10 August 2018: Wouter
	- Fix #4144: dns64 module caches wrong (negative) information.

	9 August 2018: Wouter
	- unbound-checkconf checks if modules exist and prints if they are
	not compiled in the name of the wrong module.
	- document --enable-subnet in doc/README.
	- Patch for stub-no-cache and forward-no-cache options that disable
	caching for the contents of that stub or forward, for when you
	want immediate changes visible, from Bjoern A. Zeeb.

	7 August 2018: Ralph
	- Make capsforid fallback QNAME minimisation aware.

	7 August 2018: Wouter
	- Fix #4142: unbound.service.in: improvements and fixes.
	Add unit dependency ordering (based on systemd-resolved).
	Add 'CAP_SYS_RESOURCE' to 'CapabilityBoundingSet' (fixes warnings
	about missing privileges during startup). Add 'AF_INET6' to
	'RestrictAddressFamilies' (without it IPV6 can't work). From
	Guido Shanahan.
	- Patch to implement tcp-connection-limit from Jim Hague (Sinodun).
	This limits the number of simultaneous TCP client connections
	from a nominated netblock.
	- make depend, yacc, lex, doc, headers. And log the limit exceeded
	message only on high verbosity, so as to not spam the logs when
	it is busy.

	6 August 2018: Wouter
	- Fix for #4136: Fix to unconditionally call destroy in daemon.c.

	3 August 2018: George
	- Expose if a query (or a subquery) was ratelimited (not src IP
	ratelimiting) to libunbound under 'ub_result.was_ratelimited'.
	This also introduces a change to 'ub_event_callback_type' in
	libunbound/unbound-event.h.
	- Tidy pylib tests.

	3 August 2018: Wouter
	- Revert previous change for #4136: because it introduces build
	problems.
	- New fix for #4136: This one ignores lex without without
	yylex_destroy.

	1 August 2018: Wouter
	- Fix to remove systemd sockaddr function check, that is not
	always present. Make socket activation more lenient. But not
	different when socket activation is not used.
	- iana port list update.

	31 July 2018: Wouter
	- Patches from Jim Hague (Sinodun) for EDNS KeepAlive.
	- Sort out test runs when the build directory isn't the project
	root directory.
	- Add config tcp-idle-timeout (default 30s). This applies to
	client connections only; the timeout on TCP connections upstream
	is unaffected.
	- Error if EDNS Keepalive received over UDP.
	- Add edns-tcp-keepalive and edns-tcp-keepalive timeout options
	and implement option in client responses.
	- Correct and expand manual page entries for keepalive and idle timeout.
	- Implement progressive backoff of TCP idle/keepalive timeout.
	- Fix 'make depend' to work when build dir is not project root.
	- Add delay parameter to streamtcp, -d secs.
	To be used when testing idle timeout.
	- From Wouter: make depend, the dependencies in the patches did not
	apply cleanly. Also remade yacc and lex.
	- Fix mesh.c incompatible pointer pass.
	- Please doxygen so it passes.
	- Fix #4139: Fix unbound-host leaks memory on ANY.

	30 July 2018: Wouter
	- Fix #4136: insufficiency from mismatch of FLEX capability between
	released tarball and build host.

	27 July 2018: Wouter
	- Fix man page, say that chroot is enabled by default.

	26 July 2018: Wouter
	- Fix #4135: 64-bit Windows Installer Creates Entries Under The
	Wrong Registry Key, reported by Brian White.

	23 July 2018: Wouter
	- Fix use-systemd readiness signalling, only when use-systemd is yes
	and not in signal handler.

	20 July 2018: Wouter
	- Fix #4130: print text describing -dd and unbound-checkconf on
	config file read error at startup, the errors may have been moved
	away by the startup process.
	- Fix #4131: for solaris, error YY_CURRENT_BUFFER undeclared.

	19 July 2018: Wouter
	- Fix #4129 unbound-control error message with wrong cert permissions
	is too cryptic.

	17 July 2018: Wouter
	- Fix #4127 unbound -h does not list -p help.
	- Print error if SSL name verification configured but not available
	in the ssl library.
	- Fix that ratelimit and ip-ratelimit are applied after reload of
	changed config file.
	- Resize ratelimit and ip-ratelimit caches if changed on reload.

	16 July 2018: Wouter
	- Fix qname minimisation NXDOMAIN validation lookup failures causing
	error_supers assertion fails.
	- Squelch can't bind socket errors with Permission denied unless
	verbosity is 4 or higher, for UDP outgoing sockets.

	12 July 2018: Wouter
	- Fix to improve systemd socket activation code file descriptor
	assignment.
	- Fix for 4126 that the #define for UNKNOWN_SERVER_NICENESS can be more
	easily changed to adjust default rtt assumptions.

	10 July 2018: Wouter
	- Note in documentation that the cert name match code needs
	OpenSSL 1.1.0 or later to be enabled.

	6 July 2018: Wouter
	- Fix documentation ambiguity for tls-win-cert in tls-upstream and
	forward-tls-upstream docs.
	- iana port update.
	- Note RFC8162 support. SMIMEA record type can be read in by the
	zone record parser.
	- Fix round robin for failed addresses with prefer-ip6: yes

	4 July 2018: Wouter
	- Fix #4112: Fix that unbound-anchor -f /etc/resolv.conf will not pass
	if DNSSEC is not enabled. New option -R allows fallback from
	resolv.conf to direct queries.

	3 July 2018: Wouter
	- Better documentation for unblock-lan-zones and insecure-lan-zones
	config statements.
	- Fix permission denied printed for auth zone probe random port nrs.

	2 July 2018: Wouter
	- Fix checking for libhiredis printout in configure output.
	- Fix typo on man page in ip-address description.
	- Update libunbound/python/examples/dnssec_test.py example code to
	also set the 20326 trust anchor for the root in the example code.

	29 June 2018: Wouter
	- dns64-ignore-aaaa: config option to list domain names for which the
	existing AAAA is ignored and dns64 processing is used on the A
	record.

	28 June 2018: Wouter
	- num.queries.tls counter for queries over TLS.
	- log port number with err_addr logs.

	27 June 2018: Wouter
	- #4109: Fix that package config depends on python unconditionally.
	- Patch, do not export python from pkg-config, from Petr Menšík.

	26 June 2018: Wouter
	- Partial fix for permission denied on IPv6 address on FreeBSD.
	- Fix that auth-zone master reply with current SOA serial does not
	stop scan of masters for an updated zone.
	- Fix that auth-zone does not start the wait timer without checking
	if the wait timer has already been started.

	21 June 2018: Wouter
	- #4108: systemd reload hang fix.
	- Fix usage printout for unbound-host, hostname has to be last
	argument on BSDs and Windows.

	19 June 2018: Wouter
	- Fix for unbound-control on Windows and set TCP socket parameters
	more closely.
	This fix is part of 1.7.3.
	- Windows example service.conf edited with more windows specific
	configuration.
	- Fix windows unbound-control no cert bad file descriptor error.
	This fix is part of 1.7.3.

	18 June 2018: Wouter
	- Fix that control-use-cert: no works for 127.0.0.1 to disable certs.
	This fix is part of 1.7.3rc2.
	- Fix unbound-checkconf for control-use-cert.
	This fix is part of 1.7.3.

	15 June 2018: Wouter
	- tag for 1.7.3rc1.
	- trunk has 1.7.4.
	- unbound-control auth_zone_reload _zone_ option rereads the zonefile.
	- unbound-control auth_zone_transfer _zone_ option starts the probe
	sequence for a master to transfer the zone from and transfers when
	a new zone version is available.

	14 June 2018: Wouter
	- #4103: Fix that auth-zone does not insist on SOA record first in
	file for url downloads.
	- Fix that first control-interface determines if TLS is used. Warn
	when IP address interfaces are used without TLS.
	- Fix nettle compile.

	12 June 2018: Ralph
	- Don't count CNAME response types received during qname minimisation as
	query restart.

	12 June 2018: Wouter
	- #4102 for NSD, but for Unbound. Named unix pipes do not use
	certificate and key files, access can be restricted with file and
	directory permissions. The option control-use-cert is no longer
	used, and ignored if found in unbound.conf.
	- Rename tls-additional-ports to tls-additional-port, because every
	line adds one port.
	- Fix buffer size warning in unit test.
	- remade dependencies in the Makefile.

	6 June 2018: Wouter
	- Patch to fix openwrt for mac os build darwin detection in configure.

	5 June 2018: Wouter
	- Fix crash if ratelimit taken into use with unbound-control
	instead of with unbound.conf.

	4 June 2018: Wouter
	- Fix deadlock caused by incoming notify for auth-zone.
	- tag for 1.7.2rc1, became 1.7.2 release on 11 June 2018,
	trunk is 1.7.3 in development from this point.
	- #4100: Fix stub reprime when it becomes useless.

	1 June 2018: Wouter
	- Rename additional-tls-port to tls-additional-ports.
	The older name is accepted for backwards compatibility.

	30 May 2018: Wouter
	- Patch from Syzdek: Add ability to ignore RD bit and treat all
	requests as if the RD bit is set.

	29 May 2018: Wouter
	- in compat/arc4random call getentropy_urandom when getentropy fails
	with ENOSYS.
	- Fix that fallback for windows port.

	28 May 2018: Wouter
	- Fix windows tcp and tls spin on events.
	- Add routine from getdns to add windows cert store to the SSL_CTX.
	- tls-win-cert option that adds the system certificate store for
	authenticating DNS-over-TLS connections. It can be used instead
	of the tls-cert-bundle option, or with it to add certificates.

	25 May 2018: Wouter
	- For TCP and TLS connections that don't establish, perform address
	update in infra cache, so future selections can exclude them.
	- Fix that tcp sticky events are removed for closed fd on windows.
	- Fix close events for tcp only.

	24 May 2018: Wouter
	- Fix that libunbound can do DNS-over-TLS, when configured.
	- Fix that windows unbound service can use DNS-over-TLS.
	- unbound-host initializes ssl (for potential DNS-over-TLS usage
	inside libunbound), when ssl upstream or a cert-bundle is configured.

	23 May 2018: Wouter
	- Use accept4 to speed up incoming TCP (and TLS) connections,
	available on Linux, FreeBSD and OpenBSD.

	17 May 2018: Ralph
	- Qname minimisation default changed to yes.

	15 May 2018: Wouter
	- Fix low-rtt-pct to low-rtt-permil, as it is parts in one thousand.

	11 May 2018: Wouter
	- Fix contrib/libunbound.pc for libssl libcrypto references,
	from https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=226914

	7 May 2018: Wouter
	- Fix windows to not have sticky TLS events for TCP.
	- Fix read of DNS over TLS length and data in one read call.
	- Fix mesh state assertion failure due to callback removal.

	3 May 2018: Wouter
	- Fix that configure --with-libhiredis also turns on cachedb.
	- Fix gcc 8 buffer warning in testcode.
	- Fix function type cast warning in libunbound context callback type.

	2 May 2018: Wouter
	- Fix fail to reject dead peers in forward-zone, with ssl-upstream.

	1 May 2018: Wouter
	- Fix that unbound-control reload frees the rrset keys and returns
	the memory pages to the system.

	30 April 2018: Wouter
	- Fix spelling error in man page and note defaults as no instead of
	off.

	26 April 2018: Wouter
	- Fix for crash in daemon_cleanup with dnstap during reload,
	from Saksham Manchanda.
	- Also that for dnscrypt.
	- tag for 1.7.1rc1 release. Became 1.7.1 release on 3 May, trunk
	is from here 1.7.2 in development.

	25 April 2018: Ralph
	- Fix memory leak when caching wildcard records for aggressive NSEC use

	24 April 2018: Wouter
	- Fix contrib/fastrpz.patch for this release.
	- Fix auth https for libev.

	24 April 2018: Ralph
	- Added root-key-sentinel support

	23 April 2018: Wouter
	- makedist uses bz2 for expat code, instead of tar.gz.
	- Fix #4092: libunbound: use-caps-for-id lacks colon in
	config_set_option.
	- auth zone http download stores exact copy of downloaded file,
	including comments in the file.
	- Fix sldns parse failure for CDS alternate delete syntax empty hex.
	- Attempt for auth zone fix; add of callback in mesh gets from
	callback does not skip callback of result.
	- Fix cname classification with qname minimisation enabled.
	- list_auth_zones unbound-control command.

	20 April 2018: Wouter
	- man page documentation for dns-over-tls forward-addr '#' notation.
	- removed free from failed parse case.
	- Fix #4091: Fix that reload of auth-zone does not merge the zonefile
	with the previous contents.
	- Delete auth zone when removed from config.

	19 April 2018: Wouter
	- Can set tls authentication with forward-addr: IP#tls.auth.name
	And put the public cert bundle in tls-cert-bundle: "ca-bundle.pem".
	such as forward-addr: 9.9.9.9@853#dns.quad9.net or
	1.1.1.1@853#cloudflare-dns.com
	- Fix #658: unbound using TLS in a forwarding configuration does not
	verify the server's certificate (RFC 8310 support).
	- For addr with #authname and no @port notation, the default is 853.

	18 April 2018: Wouter
	- Fix auth-zone retry timer to be on schedule with retry timeout,
	with backoff. Also time a refresh at the zone expiry.

	17 April 2018: Wouter
	- auth zone notify work.
	- allow-notify: config statement for auth-zones.
	- unit test for allow-notify

	16 April 2018: Wouter
	- Fix auth zone target lookup iterator.
	- auth zone notify with prefix
	- auth zone notify work.

	13 April 2018: Wouter
	- Fix for max include depth for authzones.
	- Fix memory free on fail for $INCLUDE in authzone.
	- Fix that an internal error to look up the wrong rr type for
	auth zone gets stopped, before trying to send there.
	- auth zone notify work.

	10 April 2018: Ralph
	- num.query.aggressive.NOERROR and num.query.aggressive.NXDOMAIN
	statistics counters.

	10 April 2018: Wouter
	- documentation for low-rtt and low-rtt-pct.
	- auth zone notify work.

	9 April 2018: Wouter
	- Fix that flush_zone sets prefetch ttl expired, so that with
	serve-expired enabled it'll start prefetching those entries.
	- num.query.authzone.up and num.query.authzone.down statistics counters.
	- Fix downstream auth zone, only fallback when auth zone fails to
	answer and fallback is enabled.
	- Accept both option names with and without colon for get_option
	and set_option.
	- low-rtt and low-rtt-pct in unbound.conf enable the server selection
	of fast servers for some percentage of the time.

	5 April 2018: Wouter
	- Combine write of tcp length and tcp query for dns over tls.
	- nitpick fixes in example.conf.
	- Fix above stub queries for type NS and useless delegation point.
	- Fix unbound-control over pipe with openssl 1.1.1, the TLSv1.3
	tls_choose_sigalg routine does not allow the ciphers for the pipe,
	so use TLSv1.2.
	- ED448 support.

	3 April 2018: Wouter
	- Fix #4043: make test fails due to v6 presentation issue in macOS.
	- Fix unable to resolve after new WLAN connection, due to auth-zone
	failing with a forwarder set. Now, auth-zone is only used for
	answers (not referrals) when a forwarder is set.

	29 March 2018: Ralph
	- Check "result" in dup_all(), by Florian Obser.

	23 March 2018: Ralph
	- Fix unbound-control get_option aggressive-nsec

	21 March 2018: Ralph
	- Do not use cached NSEC records to generate negative answers for
	domains under DNSSEC Negative Trust Anchors.

	19 March 2018: Wouter
	- iana port update.

	16 March 2018: Wouter
	- corrected a minor typo in the changelog.
	- move htobe64/be64toh portability code to cachedb.c.

	15 March 2018: Wouter
	- Add --with-libhiredis, unbound support for a new cachedb backend
	that uses a Redis server as the storage. This implementation
	depends on the hiredis client library (https://redislabs.com/lp/hiredis/).
	And unbound should be built with both --enable-cachedb and
	--with-libhiredis[=PATH] (where $PATH/include/hiredis/hiredis.h
	should exist). Patch from Jinmei Tatuya (Infoblox).
	- Fix #3817: core dump happens in libunbound delete, when queued
	servfail hits deleted message queue.
	- Create additional tls service interfaces by opening them on other
	portnumbers and listing the portnumbers as additional-tls-port: nr.

	13 March 2018: Wouter
	- Fix typo in documentation.
	- Fix #3736: Fix 0 TTL domains stuck on SERVFAIL unless manually
	flushed with serve-expired on.

	12 March 2018: Wouter
	- Added documentation for aggressive-nsec: yes.
	- tag 1.7.0rc3. That became the 1.7.0 release on 15 Mar, trunk
	now has 1.7.1 in development.
	- Fix #3727: Protocol name is TLS, options have been renamed but
	documentation is not consistent.
	- Check IXFR start serial.

	9 March 2018: Wouter
	- Fix #3598: Fix swig build issue on rhel6 based system.
	configure --disable-swig-version-check stops the swig version check.

	8 March 2018: Wouter
	- tag 1.7.0rc2.

	7 March 2018: Wouter
	- Fixed contrib/fastrpz.patch, even though this already applied
	cleanly for me, now also for others.
	- patch to log creates keytag queries, from A. Schulze.
	- patch suggested by Debian lintian: allow to -> allow one to, from
	A. Schulze.
	- Attempt to remove warning about trailing whitespace.

	6 March 2018: Wouter
	- Reverted fix for #3512, this may not be the best way forward;
	although it could be changed at a later time, to stay similar to
	other implementations.
	- svn trunk contains 1.7.0, this is the number for the next release.
	- Fix for windows compile.
	- tag 1.7.0rc1.

	5 March 2018: Wouter
	- Fix to check define of DSA for when openssl is without deprecated.
	- iana port update.
	- Fix #3582: Squelch address already in use log when reuseaddr option
	causes same port to be used twice for tcp connections.

	27 February 2018: Wouter
	- Fixup contrib/fastrpz.patch so that it applies.
	- Fix compile without threads, and remove unused variable.
	- Fix compile with staticexe and python module.
	- Fix nettle compile.

	22 February 2018: Ralph
	- Save wildcard RRset from answer with original owner for use in
	aggressive NSEC.

	21 February 2018: Wouter
	- Fix #3512: unbound incorrectly reports SERVFAIL for CAA query
	when there is a CNAME loop.
	- Fix validation for CNAME loops. When it detects a cname loop,
	by finding the cname, cname in the existing list, it returns
	the partial result with the validation result up to then.
	- more robust cachedump rrset routine.

	19 February 2018: Wouter
	- Fix #3505: Documentation for default local zones references
	wrong RFC.
	- Fix #3494: local-zone noview can be used to break out of the view
	to the global local zone contents, for queries for that zone.
	- Fix for more maintainable code in localzone.

	16 February 2018: Wouter
	- Fixes for clang static analyzer, the missing ; in
	edns-subnet/addrtree.c after the assert made clang analyzer
	produce a failure to analyze it.

	13 February 2018: Ralph
	- Aggressive NSEC tests

	13 February 2018: Wouter
	- tls-cert-bundle option in unbound.conf enables TLS authentication.
	- iana port update.

	12 February 2018: Wouter
	- Unit test for auth zone https url download.

	12 February 2018: Ralph
	- Added tests with wildcard expanded NSEC records (CVE-2017-15105 test)
	- Processed aggressive NSEC code review remarks Wouter

	8 February 2018: Ralph
	- Aggressive use of NSEC implementation. Use cached NSEC records to
	generate NXDOMAIN, NODATA and positive wildcard answers.

	8 February 2018: Wouter
	- iana port update.
	- auth zone url config.

	5 February 2018: Wouter
	- Fix #3451: dnstap not building when you have a separate build dir.
	And removed protoc warning, set dnstap.proto syntax to proto2.
	- auth-zone provides a way to configure RFC7706 from unbound.conf,
	eg. with auth-zone: name: "." for-downstream: no for-upstream: yes
	fallback-enabled: yes and masters or a zonefile with data.

	2 February 2018: Wouter
	- Fix unfreed locks in log and arc4random at exit of unbound.
	- unit test with valgrind
	- Fix lock race condition in dns cache dname synthesis.
	- lock subnet new item before insertion to please checklocks,
	no modification of critical regions outside of lock region.

	1 February 2018: Wouter
	- fix unaligned structure making a false positive in checklock
	unitialised memory.

	29 January 2018: Ralph
	- Use NSEC with longest ce to prove wildcard absence.
	- Only use *.ce to prove wildcard absence, no longer names.

	25 January 2018: Wouter
	- ltrace.conf file for libunbound in contrib.

	23 January 2018: Wouter
	- Fix that unbound-checkconf -f flag works with auto-trust-anchor-file
	for startup scripts to get the full pathname(s) of anchor file(s).
	- Print fatal errors about remote control setup before log init,
	so that it is printed to console.

	22 January 2018: Wouter
	- Accept tls-upstream in unbound.conf, the ssl-upstream keyword is
	also recognized and means the same. Also for tls-port,
	tls-service-key, tls-service-pem, stub-tls-upstream and
	forward-tls-upstream.
	- Fix #3397: Fix that cachedb could return a partial CNAME chain.
	- Fix #3397: Fix that when the cache contains an unsigned DNAME in
	the middle of a cname chain, a result without the DNAME could
	be returned.

	19 January 2018: Wouter
	- tag 1.6.8 for release with CVE fix.
	- trunk has 1.6.9 with fix and previous commits.
	- patch for CVE-2017-15105: vulnerability in the processing of
	wildcard synthesized NSEC records.
	- iana port update.
	- make depend: code dependencies updated in Makefile.

	4 January 2018: Ralph
	- Copy query and correctly set flags on REFUSED answers when cache
	snooping is not allowed.

	3 January 2018: Ralph
	- Fix queries being leaked above stub when refetching glue.

	2 January 2017: Wouter
	- Fix that DS queries with referral replies are answered straight
	away, without a repeat query picking the DS from cache.
	The correct reply should have been an answer, the reply is fixed
	by the scrubber to have the answer in the answer section.
	- Remove clang optimizer disable,
	Fix that expiration date checks don't fail with clang -O2.

	15 December 2017: Wouter
	- Fix timestamp failure because of clang optimizer failure, by
	disabling -O2 when the compiler --version is clang.
	- iana port update.
	- Also disable -flto for clang, to make incep-expi signature check
	work.

	12 December 2017: Ralph
	- Fix qname-minimisation documentation (A QTYPE, not NS)

	12 December 2017: Wouter
	- authzone work, transfer connect.

	7 December 2017: Ralph
	- Check whether --with-libunbound-only is set when using --with-nettle
	or --with-nss.

	4 December 2017: Wouter
	- Fix link failure on OmniOS.

	1 December 2017: Wouter
	- auth zone work.

	30 November 2017: Wouter
	- Fix #3299 - forward CNAME daisy chain is not working

	14 November 2017: Wouter
	- Fix #2882: Unbound behaviour changes (wrong) when domain-insecure is
	set for stub zone. It no longer searches for DNSSEC information.
	- auth xfer work on probe timer and lookup.

	13 November 2017: Wouter
	- Fix #2801: Install libunbound.pc.
	- Fix qname minimisation to send AAAA queries at zonecut like type A.
	- reverted AAAA change.

	7 November 2017: Wouter
	- Fix #2492: Documentation libunbound.

	3 November 2017: Wouter
	- Fix #2362: TLS1.3/openssl-1.1.1 not working.
	- Fix #2034 - Autoconf and -flto.
	- Fix #2141 - for libsodium detect lack of entropy in chroot, print
	a message and exit.

	2 November 2017: Wouter
	- Fix #1913: ub_ctx_config is under circumstances thread-safe.
	- make ip-transparent option work on OpenBSD.

	31 October 2017: Wouter
	- Document that errno is left informative on libunbound config read
	fail.
	- lexer output.
	- iana port update.

	25 October 2017: Ralph
	- Fixed libunbound manual typo.
	- Fix #1949: [dnscrypt] make provider name mismatch more obvious.
	- Fix #2031: Double included headers

	24 October 2017: Ralph
	- Update B root ipv4 address.

	19 October 2017: Wouter
	- authzone work, probe timer setup.

	18 October 2017: Wouter
	- lint for recent authzone commit.

	17 October 2017: Wouter
	- Fix #1749: With harden-referral-path: performance drops, due to
	circular dependency in NS and DS lookups.
	- [dnscrypt] prevent dnscrypt-secret-key, dnscrypt-provider-cert
	duplicates
	- [dnscrypt] introduce dnscrypt-provider-cert-rotated option,
	from Manu Bretelle.
	This option allows handling multiple cert/key pairs while only
	distributing some of them.
	In order to reliably match a client magic with a given key without
	strong assumption as to how those were generated, we need both key and
	cert. Likewise, in order to know which ES version should be used.
	On the other hand, when rotating a cert, it can be desirable to only
	serve the new cert but still be able to handle clients that are still
	using the old certs's public key.
	The `dnscrypt-provider-cert-rotated` allow to instruct unbound to not
	publish the cert as part of the DNS's provider_name's TXT answer.
	- Better documentation for cache-max-negative-ttl.
	- Work on local root zone code.

	10 October 2017: Wouter
	- tag 1.6.7
	- trunk has version 1.6.8.

	6 October 2017: Wouter
	- Fix spelling in unbound-control man page.

	5 October 2017: Wouter
	- Fix trust-anchor-signaling works in libunbound.
	- Fix some more crpls in testdata for different signaling default.
	- tag 1.6.7rc1

	5 October 2017: Ralph
	- Set trust-anchor-signaling default to yes
	- Use RCODE from A query on DNS64 synthesized answer.

	2 October 2017: Wouter
	- Fix param unused warning for windows exportsymbol compile.

	25 September 2017: Ralph
	- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
	(by Danilo G. Baio).

	21 September 2017: Ralph
	- Log name of looping module

	19 September 2017: Wouter
	- use a cachedb answer even if it's "expired" when serve-expired is yes
	(patch from Jinmei Tatuya).
	- trigger refetching of the answer in that case (this will bypass
	cachedb lookup)
	- allow storing a 0-TTL answer from cachedb in the in-memory message
	cache when serve-expired is yes
	- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.

	18 September 2017: Ralph
	- Fix #1400: allowing use of global cache on ECS-forwarding unless
	always-forward.

	18 September 2017: Wouter
	- tag 1.6.6 (is 1.6.6rc2)
	- Fix that looping modules always stop the query, and don't pass
	control.
	- Fix #1435: Please allow UDP to be disabled separately upstream and
	downstream.
	- Fix #1440: [dnscrypt] client nonce cache.

	15 September 2017: Wouter
	- Fix unbound-host to report error for DNSSEC state of failed lookups.
	- Spelling fixes, from Josh Soref.

	13 September 2017: Wouter
	- tag 1.6.6rc2, became 1.6.6 on 18 sep. trunk 1.6.7 in development.

	12 September 2017: Wouter
	- Add dns64 for client-subnet in unbound-checkconf.

	4 September 2017: Ralph
	- Fix #1412: QNAME minimisation strict mode not honored
	- Fix #1434: Fix windows openssl 1.1.0 linking.

	4 September 2017: Wouter
	- tag 1.6.6rc1
	- makedist fix for windows binaries, with openssl 1.1.0 windres fix,
	and expat 2.2.4 install target fix.

	1 September 2017: Wouter
	- Recommend 1472 buffer size in unbound.conf

	31 August 2017: Wouter
	- Fix #1424: cachedb:testframe is not thread safe.
	- For #1417: escape ; in dnscrypt tests.
	- but reverted that, tests fails with that escape.
	- Fix #1417: [dnscrypt] shared secret cache counters, and works when
	dnscrypt is not enabled. And cache size configuration option.
	- make depend
	- Fix #1418: [ip ratelimit] initialize slabhash using
	ip-ratelimit-slabs.

	30 August 2017: Wouter
	- updated contrib/fastrpz.patch to apply with configparser changes.
	- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.

	29 August 2017: Wouter
	- Fix #1414: fix segfault on parse failure and log_replies.
	- zero qinfo in handle_request, this zeroes local_alias and also the
	qname member.
	- new keys and certs for dnscrypt tests.
	- fixup WKS test on buildhost without servicebyname.

	28 August 2017: Wouter
	- Fix #1415: patch to free dnscrypt environment on reload.
	- iana portlist update
	- Fix #1415: [dnscrypt] shared secret cache, patch from
	Manu Bretelle.
	- Small fixes for the shared secret cache patch.
	- Fix WKS records on kvm autobuild host, with default protobyname
	entries for udp and tcp.

	23 August 2017: Wouter
	- Fix #1407: Add ECS options check to unbound-checkconf.
	- make depend
	- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
	allocation failure.

	22 August 2017: Wouter
	- Fix install of trust anchor when two anchors are present, makes both
	valid. Checks hash of DS but not signature of new key. This fixes
	the root.key file if created when unbound is installed between
	sep11 and oct11 2017.
	- tag 1.6.5 with pointrelease 1.6.5 (1.6.4 plus 5011 fix).
	- trunk version 1.6.6 in development.
	- Fix issue on macOX 10.10 where TCP fast open is detected but not
	implemented causing TCP to fail. The fix allows fallback to regular
	TCP in this case and is also more robust for cases where connectx()
	fails for some reason.
	- Fix #1402: squelch invalid argument error for fd_set_block on windows.

	10 August 2017: Wouter
	- Patch to show DNSCrypt status in help output, from Carsten
	Strotmann.

	8 August 2017: Wouter
	- Fix #1398: make cachedb secret configurable.
	- Remove spaces from Makefile.

	7 August 2017: Wouter
	- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.

	3 August 2017: Ralph
	- Remove unused iter_env member (ip6arpa_dname)
	- Do not reset rrset.bogus stats when called using stats_noreset.
	- Added stats for queries that have been ratelimited by domain
	recursion.
	- Do not add rrset_bogus and query ratelimiting stats per thread, these
	module stats are global.

	3 August 2017: Wouter
	- Fix #1394: mix of serve-expired and response-ip could cause a crash.

	24 July 2017: Wouter
	- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
	config.sub(2016-09-05).
	- annotate case statement fallthrough for gcc 7.1.1.
	- flex output from flex 2.6.1.
	- snprintf of thread number does not warn about truncated string.
	- squelch TCP fast open error on FreeBSD when kernel has it disabled,
	unless verbosity is high.
	- remove warning from windows compile.
	- Fix compile with libnettle
	- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
	- Fix #1365: Add Ed25519 support using libnettle.
	- iana portlist update

	17 July 2017: Wouter
	- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
	- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
	With the -p option unbound does not create a pidfile.

	11 July 2017: Wouter
	- Fix #1344: RFC6761-reserved domains: test. and invalid.
	- Redirect all localhost names to localhost address for RFC6761.

	6 July 2017: Wouter
	- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
	- Fix svn hooks for tdir (selected if testcode/mini_tdir.sh exists)..

	4 July 2017: Wouter
	- Fix 1332: Bump verbosity of failed chown'ing of the control socket.

	3 July 2017: Wouter
	- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
	on.
	- Fix #1331: libunbound segfault in threaded mode when context is
	deleted.
	- Fix pythonmod link line option flag.
	- Fix openssl 1.1.0 load of ssl error strings from ssl init.

	29 June 2017: Wouter
	- Fix python example0 return module wait instead of error for pass.
	- iana portlist update
	- enhancement for hardened-tls for DNS over TLS. Removed duplicated
	security settings.

	27 June 2017: Wouter
	- Tag 1.6.4 is created with the 1.6.4rc2 contents.
	- Trunk contains 1.6.5, with changes from 26, 27 june.
	- Remove signed unsigned warning from authzone.
	- Fix that infra cache host hash does not change after reconfig.

	26 June 2017: Wouter
	- (for 1.6.5)
	Better fixup of dnscrypt_cert_chacha test for different escapes.
	- First fix for zero b64 and hex text zone format in sldns.
	- unbound-control dump_infra prints port number for address if not 53.

	23 June 2017: Wouter
	- (for 1.6.5): fixup of dnscrypt_cert_chacha test (from Manu Bretelle).

	22 June 2017: Wouter
	- Tag 1.6.4rc2

	22 June 2017: Ralph
	- Added fastrpz patch to contrib

	21 June 2017: Wouter
	- Fix #1316: heap read buffer overflow in parse_edns_options.

	20 June 2017: Wouter
	- Fix warning in pythonmod under clang compiler.
	- Tag 1.6.4rc1
	- Fix lintian typo.

	16 June 2017: Ralph
	- Fix #1277: disable domain ratelimit by setting value to 0.

	16 June 2017: Wouter
	- Fix #1301: memory leak in respip and tests.
	- Free callback in edns-subnetmod on exit and restart.
	- Fix memory leak in sldns_buffer_new_frm_data.
	- Fix memory leak in dnscrypt config read.
	- Fix dnscrypt chacha cert support ifdefs.
	- Fix dnscrypt chacha cert unit test escapes in grep.
	- Remove asynclook tests that cause test and purifier problems.
	- Fix to unlock view in view test.

	15 June 2017: Wouter
	- Fix stub zone queries leaking to the internet for
	harden-referral-path ns checks.
	- Fix query for refetch_glue of stub leaking to internet.

	13 June 2017: Wouter
	- Fix #1279: Memory leak on reload when python module is enabled.
	- Fix #1280: Unbound fails assert when response from authoritative
	contains malformed qname. When 0x20 caps-for-id is enabled, when
	assertions are not enabled the malformed qname is handled correctly.
	- 1.6.3 tag created, with only #1280 fix, trunk is 1.6.4 development.
	- More fixes in depth for buffer checks in 0x20 qname checks.

	12 June 2017: Wouter
	- Fix #1278: Incomplete wildcard proof.

	8 June 2017: Ralph
	- Added domain name based ECS whitelist.

	8 June 2017: Wouter
	- Detect chacha for dnscrypt at configure time.
	- dnscrypt unit tests with chacha.

	7 June 2017: Wouter
	- Fix that unbound-control can set val_clean_additional and val_permissive_mode.
	- Add dnscrypt XChaCha20 tests.

	6 June 2017: Wouter
	- Add an explicit type cast for TCP FASTOPEN fix.
	- renumbering B-Root's IPv6 address to 2001:500:200::b.
	- Fix #1275: cached data in cachedb is never used.
	- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.

	1 June 2017: Ralph
	- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
	(from Manu Bretelle).

	1 June 2017: Wouter
	- Fix fastopen EPIPE fallthrough to perform connect.

	31 May 2017: Ralph
	- Also use global local-zones when there is a matching view that does
	not have any local-zone specified.

	31 May 2017: Wouter
	- Fix #1273: cachedb.c doesn't compile with -Wextra.
	- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.

	30 May 2017: Ralph
	- Fix #1269: inconsistent use of built-in local zones with views.
	- Add defaults for new local-zone trees added to views using
	unbound-control.

	30 May 2017: Wouter
	- Support for openssl EVP_DigestVerify.
	- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).

	29 May 2017: Wouter
	- Fix assertion for low buffer size and big edns payload when worker
	overrides udpsize.

	26 May 2017: Ralph
	- Added redirect-bogus.patch to contrib directory.

	26 May 2017: Wouter
	- Fix #1270: unitauth.c doesn't compile with higher warning level
	and optimization
	- exec_prefix is by default equal to prefix.
	- printout localzone for duplicate local-zone warnings.

	24 May 2017: Wouter
	- authzone cname chain, no rrset duplicates, wildcard doesn't change
	rrsets added for cname chain.

	23 May 2017: Wouter
	- first services/authzone check in, it compiles and reads and writes
	zonefiles.
	- iana portlist update

	22 May 2017: Wouter
	- Fix #1268: SIGSEGV after log_reopen.

	18 May 2017: Wouter
	- Fix #1265 to use /bin/kill.
	- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
	and compatibility with BoringSSL.

	17 May 2017: Wouter
	- Fix #1265: contrib/unbound.service contains hardcoded path.

	17 May 2017: George
	- Use qstate's region for IPSECKEY rrset (ipsecmod).

	16 May 2017: George
	- Implemented opportunistic IPsec support module (ipsecmod).
	- Some whitespace fixup.

	16 May 2017: Wouter
	- updated dependencies in the makefile.
	- document trust-anchor-signaling in example config file.
	- updated configure, dependencies and flex output.
	- better module memory lookup, fix of unbound-control shm names for
	module memory printout of statistics.
	- Fix type AVC sldns rrdef.

	12 May 2017: Wouter
	- Adjust servfail by iterator to not store in cache when serve-expired
	is enabled, to avoid overwriting useful information there.
	- Fix queries for nameservers under a stub leaking to the internet.

	9 May 2017: Ralph
	- Add 'c' to getopt() in testbound.
	- iana portlist update

	8 May 2017: Wouter
	- Fix tcp-mss failure printout text.
	- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
	connect limited tcp connections. With the option tcp connections
	can share the same source port (for different destinations).

	2 May 2017: Ralph
	- Added mesh_add_sub to add detached mesh entries.
	- Use mesh_add_sub for key tag signaling query.

	2 May 2017: Wouter
	- Added test for leak of stub information.
	- Fix sldns wire2str printout of RR type CAA tags.
	- Fix sldns int16_data parse.
	- Fix sldns parse and printout of TSIG RRs.
	- sldns SMIMEA and AVC definitions, same as getdns definitions.

	1 May 2017: Wouter
	- Fix #1259: "--disable-ecdsa" argument overwritten
	by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
	- iana portlist update
	- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
	and fix that 64bit getting installed in C:\Program Files (x86).

	26 April 2017: Ralph
	- Implemented trust anchor signaling using key tag query.

	26 April 2017: Wouter
	- Based on #1257: check parse limit before t increment in sldns RR
	string parse routine.

	24 April 2017: Wouter
	- unbound-checkconf -o allows query of dnstap config variables.
	Also unbound-control get_option. Also for dnscrypt.
	- trunk contains 1.6.3 version number (changes from 1.6.2 back from
	when the 1.6.2rc1 tag has been created).

	21 April 2017: Ralph
	- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
	- iana portlist update

	18 April 2017: Ralph
	- Fix #1252: more indentation inconsistencies.
	- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().

	13 April 2017: Ralph
	- Added ECS unit test (from Manu Bretelle).
	- ECS documentation fix (from Manu Bretelle).

	13 April 2017: Wouter
	- Fix #1250: inconsistent indentation in services/listen_dnsport.c.
	- tag for 1.6.2rc1
	- (for 1.6.3:) unbound.h exports the shm stats structures. They use
	type long long and no ifdefs, and ub_ before the typenames.

	12 April 2017: Wouter
	- subnet mem value is available in shm, also when not enabled,
	to make the struct easier to memmap by other applications,
	independent of the configuration of unbound.

	12 April 2017: Ralph
	- Fix #1247: unbound does not shorten source prefix length when
	forwarding ECS.
	- Properly check for allocation failure in local_data_find_tag_datas.
	- Fix #1249: unbound doesn't return FORMERR to bogus ECS.
	- Set SHM ECS memory usage to 0 when module not loaded.

	11 April 2017: Ralph
	- Display ECS module memory usage.

	10 April 2017: Wouter
	- harden-algo-downgrade: no also makes unbound more lenient about
	digest algorithms in DS records.

	10 April 2017: Ralph
	- Remove ECS option after REFUSED answer.
	- Fix small memory leak in edns_opt_copy_alloc.
	- Respip dereference after NULL check.
	- Zero initialize addrtree allocation.
	- Use correct identifier for SHM destroy.

	7 April 2017: George
	- Fix pythonmod for cb changes.
	- Some whitespace fixup.

	7 April 2017: Ralph
	- Unlock view in respip unit test

	6 April 2017: Ralph
	- Generalise inplace callback (de)registration
	- (de)register inplace callbacks for module id
	- No unbound-control set_option for ECS options
	- Deprecated client-subnet-opcode config option
	- Introduced client-subnet-always-forward config option
	- Changed max-client-subnet-ipv6 default to 56 (as in RFC)
	- Removed extern ECS config options
	- module_restart_next now calls clear on all following modules
	- Also create ECS module qstate on module_event_pass event
	- remove malloc from inplace_cb_register

	6 April 2017: Wouter
	- Small fixup for documentation.
	- iana portlist update
	- Fix respip for braces when locks arent used.
	- Fix pythonmod for cb changes.

	4 April 2017: Wouter
	- Fix #1244: document that use of chroot requires trust anchor file to
	be under chroot.
	- iana portlist update

	3 April 2017: Ralph
	- Do not add current time twice to TTL before ECS cache store.
	- Do not touch rrset cache after ECS cache message generation.
	- Use LDNS_EDNS_CLIENT_SUBNET as default ECS opcode.

	3 April 2017: Wouter
	- Fix #1217: Add metrics to unbound-control interface showing
	crypted, cert request, plaintext and malformed queries (from
	Manu Bretelle).
	- iana portlist update

	27 March 2017: Wouter
	- Remove (now unused) event2 include from dnscrypt code.

	24 March 2017: George
	- Fix to prevent non-referal query from being cached as referal when the
	no_cache_store flag was set.

	23 March 2017: Wouter
	- Fix #1239: configure fails to find python distutils if python
	prints warning.

	22 March 2017: Wouter
	- Fix #1238: segmentation fault when adding through the remote
	interface a per-view local zone to a view with no previous
	(configured) local zones.
	- Fix #1229: Systemd service sandboxing, options in wrong sections.

	21 March 2017: Ralph
	- Merge EDNS Client subnet implementation from feature branch into main
	branch, using new EDNS processing framework.

	21 March 2017: Wouter
	- Fix doxygen for dnscrypt files.

	20 March 2017: Wouter
	- #1217. DNSCrypt support, with --enable-dnscrypt, libsodium and then
	enabled in the config file from Manu Bretelle.
	- make depend, autoconf, remove warnings about statement before var.
	- lru_demote and lruhash_insert_or_retrieve functions for getdns.
	- fixup for lruhash (whitespace and header file comment).
	- dnscrypt tests.

	17 March 2017: Wouter
	- Patch for view functionality for local-data-ptr from Björn Ketelaars.
	- Fix #1237 - Wrong resolving in chain, for norec queries that get
	SERVFAIL returned.

	16 March 2017: Wouter
	- Fix that SHM is not inited if not enabled.
	- Add trustanchor.unbound CH TXT that gets a response with a number
	of TXT RRs with a string like "example.com. 2345 1234" with
	the trust anchors and their keytags.
	- Fix that looped DNAMEs do not cause unbound to spend effort.
	- trustanchor tags are sorted. reusable routine to fetch taglist.

	13 March 2017: Wouter
	- testbound understands Deckard MATCH rcode question answer commands.
	- Fix #1235: Fix too long DNAME expansion produces SERVFAIL instead
	of YXDOMAIN + query loop, reported by Petr Spacek.

	10 March 2017: Wouter
	- Fix #1234: shortening DNAME loop produces duplicate DNAME records
	in ANSWER section.

	9 March 2017: Wouter
	- --disable-sha1 disables SHA1 support in RRSIG, so from DNSKEY and
	DS records. NSEC3 is not disabled.
	- fake-sha1 test option; print warning if used. To make unit tests.
	- unbound-control list local zone and data commands listed in the
	help output.

	8 March 2017: Wouter
	- make depend for build dependencies.
	- swig version 2.0.1 required.
	- fix enum conversion warnings

	7 March 2017: Wouter
	- Fix #1230: swig version 2.0.0 is required for pythonmod, with
	1.3.40 it crashes when running repeatly unbound-control reload.
	- Response actions based on IP address from Jinmei Tatuya (Infoblox).

	6 March 2017: Wouter
	- Fix #1229: Systemd service sandboxing in contrib/unbound.service.
	- iana portlist update

	28 February 2017: Ralph
	- Fix testpkts.c, check if DO bit is set, not only if there is an OPT
	record.

	28 February 2017: Wouter
	- For #1227: if we have sha256, set the cipher list to have no
	known vulns.

	27 February 2017: Wouter
	- Fix #1227: Fix that Unbound control allows weak ciphersuits.
	- Fix #1226: provide official 32bit binary for windows.

	24 February 2017: Wouter
	- include sys/time.h for new shm code on NetBSD.

	23 February 2017: Wouter
	- Fix doc/CNAME-basedRedirectionDesignNotes.pdf zone static to
	redirect.
	- Patch from Luiz Fernando Softov for Stats Shared Memory.
	- unbound-control stats_shm command prints stats using shared memory,
	which uses less cpu.
	- make depend, autoconf, doxygen and lint fixed up.

	22 February 2017: Wouter
	- Fix #1224: Fix that defaults should not fall back to "Program Files
	(x86) if Unbound is 64bit by default on windows.

	21 February 2017: Wouter
	- iana portlist update

	16 February 2017: Wouter
	- sldns updated for vfixed and buffer resize indication from getdns.

	15 February 2017: Wouter
	- sldns has ED25519 and ED448 algorithm number and name for display.

	14 February 2017: Wouter
	- tag 1.6.1rc3. -- which became 1.6.1 on 21feb, trunk has 1.6.2

	13 February 2017: Wouter
	- Fix autoconf of systemd check for lack of pkg-config.

	10 February 2017: Wouter
	- Fix pythonmod for typedef changes.
	- Fix dnstap for warning of set but not used.
	- tag 1.6.1rc2.

	9 February 2017: Wouter
	- tag 1.6.1rc1.

	8 February 2017: Wouter
	- Fix for type name change and fix warning on windows compile.

	7 February 2017: Wouter
	- Include root trust anchor id 20326 in unbound-anchor.

	6 February 2017: Wouter
	- Fix compile on solaris of the fix to use $host detect.

	4 February 2017: Wouter
	- fix root_anchor test for updated icannbundle.pem lower certificates.

	26 January 2017: Wouter
	- Fix 1211: Fix can't enable interface-automatic if no IPv6 with
	more helpful error message.

	20 January 2017: Wouter
	- Increase MAX_MODULE to 16.

	19 January 2017: Wouter
	- Fix to Rename ub_callback_t to ub_callback_type, because POSIX
	reserves _t typedefs.
	- Fix to rename internally used types from _t to _type, because _t
	type names are reserved by POSIX.
	- iana portlist update

	12 January 2017: Wouter
	- Fix to also block meta types 128 through to 248 with formerr.
	- Fix #1206: Some view-related commands are missing from 'unbound-control -h'

	9 January 2017: Wouter
	- Fix #1202: Fix code comment that packed_rrset_data is not always
	'packed'.

	6 January 2017: Wouter
	- Fix #1201: Fix missing unlock in answer_from_cache error condition.

	5 January 2017: Wouter
	- Fix to return formerr for queries for meta-types, to avoid
	packet amplification if this meta-type is sent on to upstream.
	- Fix #1184: Log DNS replies. This includes the same logging
	information that DNS queries and response code and response size,
	patch from Larissa Feng.
	- Fix #1187: Source IP rate limiting, patch from Larissa Feng.

	3 January 2017: Wouter
	- configure --enable-systemd and lets unbound use systemd sockets if
	you enable use-systemd: yes in unbound.conf.
	Also there are contrib/unbound.socket and contrib/unbound.service:
	systemd files for unbound, install them in /usr/lib/systemd/system.
	Contributed by Sami Kerola and Pavel Odintsov.
	- Fix reload chdir failure when also chrooted to that directory.

	2 January 2017: Wouter
	- Fix #1194: Cross build fails when $host isn't `uname` for getentropy.

	23 December 2016: Ralph
	- Fix #1190: Do not echo back EDNS options in local-zone error response.
	- iana portlist update

	21 December 2016: Ralph
	- Fix #1188: Unresolved symbol 'fake_dsa' in libunbound.so when built
	with Nettle

	19 December 2016: Ralph
	- Fix #1191: remove comment about view deletion.

	15 December 2016: Wouter
	- iana portlist update
	- 64bit is default for windows builds.
	- Fix inet_ntop and inet_pton warnings in windows compile.

	14 December 2016: Wouter
	- Fix #1178: attempt to fix setup error at end, pop result values
	at end of install.

	13 December 2016: Wouter
	- Fix #1182: Fix Resource leak (socket), at startup.
	- Fix unbound-control and ipv6 only.

	9 December 2016: Wouter
	- Fix #1176: stack size too small for Alpine Linux.

	8 December 2016: Wouter
	- Fix downcast warnings from visual studio in sldns code.
	- tag 1.6.0rc1 which became 1.6.0 on 15 dec, and trunk is 1.6.1.

	7 December 2016: Ralph
	- Add DSA support for OpenSSL 1.1.0
	- Fix remote control without cert for LibreSSL

	6 December 2016: George
	- Added generic EDNS code for registering known EDNS option codes,
	bypassing the cache response stage and uniquifying mesh states. Four EDNS
	option lists were added to module_qstate (module_qstate.edns_opts_*) to
	store EDNS options from/to front/back side.
	- Added two flags to module_qstate (no_cache_lookup, no_cache_store) that
	control the modules' cache interactions.
	- Added code for registering inplace callback functions. The registered
	functions can be called just before replying with local data or Chaos,
	replying from cache, replying with SERVFAIL, replying with a resolved
	query, sending a query to a nameserver. The functions can inspect the
	available data and maybe change response/query related data (i.e. append
	EDNS options).
	- Updated Python module for the above.
	- Updated Python documentation.

	5 December 2016: Ralph
	- Fix #1173: differ local-zone type deny from unset
	tag_actions element.

	5 December 2016: Wouter
	- Fix #1170: document that 'inform' local-zone uses local-data.

	1 December 2016: Ralph
	- hyphen as minus fix, by Andreas Schulze

	30 November 2016: Ralph
	- Added local-zones and local-data bulk addition and removal
	functionality in unbound-control (local_zones, local_zones_remove,
	local_datas and local_datas_remove).
	- iana portlist update

	29 November 2016: Wouter
	- version 1.6.0 is in the development branch.
	- braces in view.c around lock statements.

	28 November 2016: Wouter
	- new install-sh.

	25 November 2016: Wouter
	- Fix that with openssl 1.1 control-use-cert: no uses less cpu, by
	using no encryption over the unix socket.

	22 Novenber 2016: Ralph
	- Make access-control-tag-data RDATA absolute. This makes the RDATA
	origin consistent between local-data and access-control-tag-data.
	- Fix NSEC ENT wildcard check. Matching wildcard does not have to be a
	subdomain of the NSEC owner.
	- QNAME minimisation uses QTYPE=A, therefore always check cache for
	this type in harden-below-nxdomain functionality.
	- Added unit test for QNAME minimisation + harden below nxdomain
	synergy.

	22 November 2016: Wouter
	- iana portlist update.
	- Fix unit tests for DS hash processing for fake-dsa test option.
	- patch from Dag-Erling Smorgrav that removes code that relies
	on sbrk().

	21 November 2016: Wouter
	- Fix #1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing
	Underneath" for the harden-below-nxdomain option.

	10 November 2016: Ralph
	- Fix #1155: test status code of unbound-control in 04-checkconf,
	not the status code from the tee command.

	4 November 2016: Ralph
	- Added stub-ssl-upstream and forward-ssl-upstream options.

	4 November 2016: Wouter
	- configure detects ssl security level API function in the autoconf
	manner. Every function on its own, so that other libraries (eg.
	LibreSSL) can develop their API without hindrance.
	- Fix #1154: segfault when reading config with duplicate zones.
	- Note that for harden-below-nxdomain the nxdomain must be secure,
	this means nsec3 with optout is insufficient.

	3 November 2016: Ralph
	- Set OpenSSL security level to 0 when using aNULL ciphers.

	3 November 2016: Wouter
	- .gitattributes line for githubs code language display.
	- log-identity: config option to set sys log identity, patch from
	"Robin H. Johnson" <robbat2@gentoo.org>

	2 November 2016: Wouter
	- iana portlist update.

	31 October 2016: Wouter
	- Fix failure to build on arm64 with no sbrk.
	- iana portlist update.

	28 October 2016: Wouter
	- Patch for server.num.zero_ttl stats for count of expired replies,
	from Pavel Odintsov.

	26 October 2016: Wouter
	- Fix unit tests for openssl 1.1, with no DSA, by faking DSA, enabled
	with the undocumented switch 'fake-dsa'. It logs a warning.

	25 October 2016: Wouter
	- Fix #1134: unbound-control set_option -- val-override-date: -1 works
	immediately to ignore datetime, or back to 0 to enable it again.
	The -- is to ignore the '-1' as an option flag.

	24 October 2016: Wouter
	- serve-expired config option: serve expired responses with TTL 0.
	- g.root-servers.net has AAAA address.

	21 October 2016: Wouter
	- Ported tests for local_cname unit test to testbound framework.

	20 October 2016: Wouter
	- suppress compile warning in lex files.
	- init lzt variable, for older gcc compiler warnings.
	- fix --enable-dsa to work, instead of copying ecdsa enable.
	- Fix DNSSEC validation of query type ANY with DNAME answers.
	- Fixup query_info local_alias init.

	19 October 2016: Wouter
	- Fix #1130: whitespace in example.conf.in more consistent.

	18 October 2016: Wouter
	- Patch that resolves CNAMEs entered in local-data conf statements that
	point to data on the internet, from Jinmei Tatuya (Infoblox).
	- Removed patch comments from acllist.c and msgencode.c
	- Added documentation doc/CNAME-basedRedirectionDesignNotes.pdf,
	from Jinmei Tatuya (Infoblox).
	- Fix #1125: unbound could reuse an answer packet incorrectly for
	clients with different EDNS parameters, from Jinmei Tatuya.
	- Fix #1118: libunbound.pc sets strange Libs, Libs.private values.
	- Added Requires line to libunbound.pc
	- Please doxygen by modifying mesh.h

	17 October 2016: Wouter
	- Re-fix #839 from view commit overwrite.
	- Fixup const void cast warning.

	12 October 2016: Ralph
	- Free view config elements.

	11 October 2016: Ralph
	- Added qname-minimisation-strict config option.
	- iana portlist update.
	- fix memoryleak logfile when in debug mode.

	5 October 2016: Ralph
	- Added views functionality.
	- Fix #1117: spelling errors, from Robert Edmonds.

	30 September 2016: Wouter
	- Fix Nits for 1.5.10 reported by Dag-Erling Smorgrav.

	29 September 2016: Wouter
	- Fix #838: 1.5.10 cannot be built on Solaris, undefined PATH_MAX.
	- Fix #839: Memory grows unexpectedly with large RPZ files.
	- Fix #840: infinite loop in unbound_munin_ plugin on unowned lockfile.
	- Fix #841: big local-zone's make it consume large amounts of memory.

	27 September 2016: Wouter
	- tag for 1.5.10 release
	- trunk contains 1.5.11 in development.
	- Fix dnstap relaying "random" messages instead of resolver/forwarder
	responses, from Nikolay Edigaryev.
	- Fix #836: unbound could echo back EDNS options in an error response.

	20 September 2016: Wouter
	- iana portlist update.
	- Fix #835: fix --disable-dsa with nettle verify.
	- tag for 1.5.10rc1 release.

	15 September 2016: Wouter
	- Fix 883: error for duplicate local zone entry.
	- Test for openssl init_crypto and init_ssl functions.

	15 September 2016: Ralph
	- fix potential memory leak in daemon/remote.c and nullpointer
	dereference in validator/autotrust.
	- iana portlist update.

	13 September 2016: Wouter
	- Silenced flex-generated sign-unsigned warning print with gcc
	diagnostic pragma.
	- Fix for new splint on FreeBSD. Fix cast for sockaddr_un.sun_len.

	9 September 2016: Wouter
	- Fix #831: workaround for spurious fread_chk warning against petal.c

	5 September 2016: Ralph
	- Take configured minimum TTL into consideration when reducing TTL
	to original TTL from RRSIG.

	5 September 2016: Wouter
	- Fix #829: doc of sldns_wire2str_rdata_buf() return value has an
	off-by-one typo, from Jinmei Tatuya (Infoblox).
	- Fix incomplete prototypes reported by Dag-Erling Smørgrav.
	- Fix #828: missing type in access-control-tag-action redirect results
	in NXDOMAIN.

	2 September 2016: Wouter
	- Fix compile with openssl 1.1.0 with api=1.1.0.

	1 September 2016: Wouter
	- RFC 7958 is now out, updated docs for unbound-anchor.
	- Fix for compile without warnings with openssl 1.1.0.
	- Fix #826: Fix refuse_non_local could result in a broken response.
	- iana portlist update.

	29 August 2016: Wouter
	- Fix #777: OpenSSL 1.1.0 compatibility, patch from Sebastian A.
	Siewior.
	- Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e.

	25 August 2016: Ralph
	- Clarify local-zone-override entry in unbound.conf.5

	25 August 2016: Wouter
	- 64bit build option for makedist windows compile, -w64.

	24 August 2016: Ralph
	- Fix #820: set sldns_str2wire_rr_buf() dual meaning len parameter
	in each iteration in find_tag_datas().
	- unbound.conf.5 entries for define-tag, access-control-tag,
	access-control-tag-action, access-control-tag-data, local-zone-tag,
	and local-zone-override.

	23 August 2016: Wouter
	- Fix #804: unbound stops responding after outage. Fixes queries
	that attempt to wait for an empty list of subqueries.
	- Fix #804: lower num_target_queries for iterator also for failed
	lookups.

	8 August 2016: Wouter
	- Note that OPENPGPKEY type is RFC 7929.

	4 August 2016: Wouter
	- Fix #807: workaround for possible some "unused" function parameters
	in test code, from Jinmei Tatuya.

	3 August 2016: Wouter
	- use sendmsg instead of sendto for TFO.

	28 July 2016: Wouter
	- Fix #806: wrong comment removed.

	26 July 2016: Wouter
	- nicer ratelimit-below-domain explanation.

	22 July 2016: Wouter
	- Fix #801: missing error condition handling in
	daemon_create_workers().
	- Fix #802: workaround for function parameters that are "unused"
	without log_assert.
	- Fix #803: confusing (and incorrect) code comment in daemon_cleanup().

	20 July 2016: Wouter
	- Fix typo in unbound.conf.

	18 July 2016: Wouter
	- Fix #798: Client-side TCP fast open fails (Linux).

	14 July 2016: Wouter
	- TCP Fast open patch from Sara Dickinson.
	- Fixed unbound.doxygen for 1.8.11.

	7 July 2016: Wouter
	- access-control-tag-data implemented. verbose(4) prints tag debug.

	5 July 2016: Wouter
	- Fix dynamic link of anchor-update.exe on windows.
	- Fix detect of mingw for MXE package build.
	- Fixes for 64bit windows compile.
	- Fix #788 for nettle 3.0: Failed to build with Nettle >= 3.0 and
	--with-libunbound-only --with-nettle.

	4 July 2016: Wouter
	- For #787: prefer-ip6 option for unbound.conf prefers to send
	upstream queries to ipv6 servers.
	- Fix #787: outgoing-interface netblock/64 ipv6 option to use linux
	freebind to use 64bits of entropy for every query with random local
	part.

	30 June 2016: Wouter
	- Document always_transparent, always_refuse, always_nxdomain types.

	29 June 2016: Wouter
	- Fix static compile on windows missing gdi32.

	28 June 2016: Wouter
	- Create a pkg-config file for libunbound in contrib.

	27 June 2016: Wouter
	- Fix #784: Build configure assumess that having getpwnam means there
	is endpwent function available.
	- Updated repository with newer flex and bison output.

	24 June 2016: Ralph
	- Possibility to specify local-zone type for an acl/tag pair
	- Possibility to specify (override) local-zone type for a source address
	block
	16 June 2016: Ralph
	- Decrease dp attempts at each QNAME minimisation iteration

	16 June 2016: Wouter
	- Fix tcp timeouts in tv.usec.

	15 June 2016: Wouter
	- TCP_TIMEOUT is specified in milliseconds.
	- If more than half of tcp connections are in use, a shorter timeout
	is used (200 msec, vs 2 minutes) to pressure tcp for new connects.

	14 June 2016: Ralph
	- QNAME minimisation unit test for dropped QTYPE=A queries.

	14 June 2016: Wouter
	- Fix 775: unbound-host and unbound-anchor crash on windows, ignore
	null delete for wsaevent.
	- Fix spelling in freebind option man page text.
	- Fix windows link of ssl with crypt32.
	- Fix 779: Union casting is non-portable.
	- Fix 780: MAP_ANON not defined in HP-UX 11.31.
	- Fix 781: prealloc() is an HP-UX system library call.

	13 June 2016: Ralph
	- Use QTYPE=A for QNAME minimisation.
	- Keep track of number of time-outs when performing QNAME minimisation.
	Stop minimising when number of time-outs for a QNAME/QTYPE pair is
	more than three.

	13 June 2016: Wouter
	- Fix #778: unbound 1.5.9: -h segfault (null deref).
	- Fix directory: fix for unbound-checkconf, it restores cwd.

	10 June 2016: Wouter
	- And delete service.conf.shipped on uninstall.
	- In unbound.conf directory: dir immediately changes to that directory,
	so that include: file below that is relative to that directory.
	With chroot, make the directory an absolute path inside chroot.
	- keep debug symbols in windows build.
	- do not delete service.conf on windows uninstall.
	- document directory immediate fix and allow EXECUTABLE syntax in it
	on windows.

	9 June 2016: Wouter
	- Trunk is called 1.5.10 (with previous fixes already in there to 2
	june).
	- Revert fix for NetworkService account on windows due to breakage
	it causes.
	- Fix that windows install will not overwrite existing service.conf
	file (and ignore gui config choices if it exists).

	7 June 2016: Ralph
	- Lookup localzones by taglist from acl.
	- Possibility to lookup local_zone, regardless the taglist.
	- Added local_zone/taglist/acl unit test.

	7 June 2016: Wouter
	- Fix #773: Non-standard Python location build failure with pyunbound.
	- Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures.

	6 June 2016: Wouter
	- Better help text from -h (from Ray Griffith).
	- access-control-tag config directive.
	- local-zone-override config directive.
	- access-control-tag-action and access-control-tag-data config
	directives.
	- free acl-tags, acltag-action and acltag-data config lists during
	initialisation to free up memory for more entries.

	3 June 2016: Wouter
	- Fix to not ignore return value of chown() in daemon startup.

	2 June 2016: Wouter
	- Fix libubound for edns optlist feature.
	- Fix distinction between free and CRYPTO_free in dsa and ecdsa alloc.
	- Fix #752: retry resource temporarily unavailable on control pipe.
	- un-document localzone tags.
	- tag for release 1.5.9rc1.
	And this also became release 1.5.9.
	- Fix (for 1.5.10): Fix unbound-anchor.exe file location defaults to
	Program Files with (x86) appended.
	- re-documented localzone tags in example.conf.

	31 May 2016: Wouter
	- Fix windows service to be created run with limited rights, as a
	network service account, from Mario Turschmann.
	- compat strsep implementation.
	- generic edns option parse and store code.
	- and also generic edns options for upstream messages (and replies).
	after parse use edns_opt_find(edns.opt_list, LDNS_EDNS_NSID),
	to insert use edns_opt_append(edns, region, code, len, bindata) on
	the opt_list passed to send_query, or in edns_opt_inplace_reply.

	30 May 2016: Wouter
	- Fix time in case answer comes from cache in ub_resolve_event().
	- Attempted fix for #765: _unboundmodule missing for python3.

	27 May 2016: Wouter
	- Fix #770: Small subgroup attack on DH used in unix pipe on localhost
	if unbound control uses a unix local named pipe.
	- Document write permission to directory of trust anchor needed.
	- Fix #768: Unbound Service Sometimes Can Not Shutdown
	Completely, WER Report Shown Up. Close handle before closing WSA.

	26 May 2016: Wouter
	- Updated patch from Charles Walker.

	24 May 2016: Wouter
	- disable-dnssec-lame-check config option from Charles Walker.
	- remove memory leak from lame-check patch.
	- iana portlist update.

	23 May 2016: Wouter
	- Fix #767: Reference to an expired Internet-Draft in
	harden-below-nxdomain documentation.

	20 May 2016: Ralph
	- No QNAME minimisation fall-back for NXDOMAIN answers from DNSSEC
	signed zones.
	- iana portlist update.

	19 May 2016: Wouter
	- Fix #766: dns64 should synthesize results on timeout/errors.

	18 May 2016: Wouter
	- Fix #761: DNSSEC LAME false positive resolving nic.club.

	17 May 2016: Wouter
	- trunk updated with output of flex 2.6.0.

	6 May 2016: Wouter
	- Fix memory leak in out-of-memory conditions of local zone add.

	29 April 2016: Wouter
	- Fix sldns with static checking fixes copied from getdns.

	28 April 2016: Wouter
	- Fix #759: 0x20 capsforid no longer checks type PTR, for
	compatibility with cisco dns guard. This lowers false positives.

	18 April 2016: Wouter
	- Fix some malformed responses to edns queries get fallback to nonedns.

	15 April 2016: Wouter
	- cachedb module event handling design.

	14 April 2016: Wouter
	- cachedb module framework (empty).
	- iana portlist update.

	12 April 2016: Wouter
	- Fix #753: document dump_requestlist is for first thread.

	24 March 2016: Wouter
	- Document permit-small-holddown for 5011 debug.
	- Fix #749: unbound-checkconf gets SIGSEGV when use against a
	malformatted conf file.

	23 March 2016: Wouter
	- OpenSSL 1.1.0 portability, --disable-dsa configure option.

	21 March 2016: Wouter
	- Fix compile of getentropy_linux for SLES11 servicepack 4.
	- Fix dnstap-log-resolver-response-messages, from Nikolay Edigaryev.
	- Fix test for openssl to use HMAC_Update for 1.1.0.
	- acx_nlnetlabs.m4 to v33, with HMAC_Update.
	- acx_nlnetlabs.m4 to v34, with -ldl -pthread test for libcrypto.
	- ERR_remove_state deprecated since openssl 1.0.0.
	- OPENSSL_config is deprecated, removing.

	18 March 2016: Ralph
	- Validate QNAME minimised NXDOMAIN responses.
	- If QNAME minimisation is enabled, do cache lookup for QTYPE NS in
	harden-below-nxdomain.

	17 March 2016: Ralph
	- Limit number of QNAME minimisation iterations.

	17 March 2016: Wouter
	- Fix #746: Fix unbound sets CD bit on all forwards.
	If no trust anchors, it'll not set CD bit when forwarding to another
	server. If a trust anchor, no CD bit on the first attempt to a
	forwarder, but CD bit thereafter on repeated attempts to get DNSSEC.
	- iana portlist update.

	16 March 2016: Wouter
	- Fix ip-transparent for ipv6 on FreeBSD, thanks to Nick Hibma.
	- Fix ip-transparent for tcp on freebsd.

	15 March 2016: Wouter
	- ip_freebind: yesno option in unbound.conf sets IP_FREEBIND for
	binding to an IP address while the interface or address is down.

	14 March 2016: Wouter
	- Fix warnings in ifdef corner case, older or unknown libevent.
	- Fix compile for ub_event code with older libev.

	11 March 2016: Wouter
	- Remove warning about unused parameter in event_pluggable.c.
	- Fix libev usage of dispatch return value.
	- No side effects in tolower() call, in case it is a macro.
	- For test put free in pluggable api in parenthesis.

	10 March 2016: Wouter
	- Fixup backend2str for libev.

	09 March 2016: Willem
	- User defined pluggable event API for libunbound
	- Fixup of compile fix for pluggable event API from P.Y. Adi
	Prasaja.

	09 March 2016: Wouter
	- Updated configure and ltmain.sh.
	- Updated L root IPv6 address.

	07 March 2016: Wouter
	- Fix #747: assert in outnet_serviced_query_stop.
	- iana ports fetched via https.
	- iana portlist update.

	03 March 2016: Wouter
	- configure tests for the weak attribute support by the compiler.

	02 March 2016: Wouter
	- 1.5.8 release tag
	- trunk contains 1.5.9 in development.
	- iana portlist update.
	- Fix #745: unbound.py - idn2dname throws UnicodeError when idnname
	contains trailing dot.

	24 February 2016: Wouter
	- Fix OpenBSD asynclook lock free that gets used later (fix test code).
	- Fix that NSEC3 negative cache is used when there is no salt.

	23 February 2016: Wouter
	- ub_ctx_set_stub() function for libunbound to config stub zones.
	- sorted ubsyms.def file with exported libunbound functions.

	19 February 2016: Wouter
	- Print understandable debug log when unusable DS record is seen.
	- load gost algorithm if digest is seen before key algorithm.
	- iana portlist update.

	17 February 2016: Wouter
	- Fix that "make install" fails due to "text file busy" error.

	16 February 2016: Wouter
	- Set IPPROTO_IP6 for ipv6 sockets otherwise invalid argument error.

	15 February 2016: Wouter
	- ip-transparent option for FreeBSD with IP_BINDANY socket option.
	- wait for sendto to drain socket buffers when they are full.

	9 February 2016: Wouter
	- Test for type OPENPGPKEY.
	- insecure-lan-zones: yesno config option, patch from Dag-Erling
	Smørgrav.

	8 February 2016: Wouter
	- Fix patch typo in prevuous commit for 734 from Adi Prasaja.
	- RR Type CSYNC support RFC 7477, in debug printout and config input.
	- RR Type OPENPGPKEY support (draft-ietf-dane-openpgpkey-07).

	29 January 2016: Wouter
	- Neater cmdline_verbose increment patch from Edgar Pettijohn.

	27 January 2016: Wouter
	- Made netbsd sendmsg test nonfatal, in case of false positives.
	- Fix #741: log message for dnstap socket connection is more clear.

	26 January 2016: Wouter
	- Fix #734: chown the pidfile if it resides inside the chroot.
	- Use arc4random instead of random in tests (because it is
	available, possibly as compat, anyway).
	- Fix cmsg alignment for argument to sendmsg on NetBSD.
	- Fix that unbound complains about unimplemented IP_PKTINFO for
	sendmsg on NetBSD (for interface-automatic).

	25 January 2016: Wouter
	- Fix #738: Swig should not be invoked with CPPFLAGS.

	19 January 2016: Wouter
	- Squelch 'cannot assign requested address' log messages unless
	verbosity is high, it was spammed after network down.

	14 January 2016: Wouter
	- Fix to simplify empty string checking from Michael McConville.
	- iana portlist update.

	12 January 2016: Wouter
	- Fix #734: Do not log an error when the PID file cannot be chown'ed.
	Patch from Simon Deziel.

	11 January 2016: Wouter
	- Fix test if -pthreads unused to use better grep for portability.

	06 January 2016: Wouter
	- Fix mingw crosscompile for recent mingw.
	- Update aclocal, autoconf output with new versions (1.15, 2.4.6).

	05 January 2016: Wouter
	- #731: tcp-mss, outgoing-tcp-mss options for unbound.conf, patch
	from Daisuke Higashi.
	- Support RFC7686: handle ".onion" Special-Use Domain. It is blocked
	by default, and can be unblocked with "nodefault" localzone config.

	04 January 2016: Wouter
	- Define DEFAULT_SOURCE together with BSD_SOURCE when that is defined,
	for Linux glibc 2.20.
	- Fixup contrib/aaaa-filter-iterator.patch for moved contents in the
	source code, so it applies cleanly again. Removed unused variable
	warnings.

	15 December 2015: Ralph
	- Fix #729: omit use of escape sequences in echo since they are not
	portable (unbound-control-setup).

	11 December 2015: Wouter
	- remove NULL-checks before free, patch from Michael McConville.
	- updated ax_pthread.m4 to version 21 with clang support, this
	removes a warning from compilation.
	- OSX portability, detect if sbrk is deprecated.
	- OSX clang, stop -pthread unused during link stage warnings.
	- OSX clang new flto check.

	10 December 2015: Wouter
	- 1.5.7 release
	- trunk has 1.5.8 in development.

	8 December 2015: Wouter
	- Fixup 724 for unbound-control.

	7 December 2015: Ralph
	- Do not minimise forwarded requests.

	4 December 2015: Wouter
	- Removed unneeded whitespace from example.conf.

	3 December 2015: Ralph
	- (after rc1 tag)
	- Committed fix to qname minimisation and unit test case for it.

	3 December 2015: Wouter
	- iana portlist update.
	- 1.5.7rc1 prerelease tag.

	2 December 2015: Wouter
	- Fixup 724: Fix PCA prompt for unbound-service-install.exe.
	re-enable stdout printout.
	- For 724: Add Changelog to windows binary dist.

	1 December 2015: Ralph
	- Qname minimisation review fixes

	1 December 2015: Wouter
	- Fixup 724 fix for fname_after_chroot() calls.
	- Remove stdout printout for unbound-service-install.exe
	- .gitignore for git users.

	30 November 2015: Ralph
	- Implemented qname minimisation

	30 November 2015: Wouter
	- Fix for #724: conf syntax to read files from run dir (on Windows).

	25 November 2015: Wouter
	- Fix for #720, fix unbound-control-setup windows batch file.

	24 November 2015: Wouter
	- Fix #720: add windows scripts to zip bundle.
	- iana portlist update.

	20 November 2015: Wouter
	- Added assert on rrset cache correctness.
	- Fix that malformed EDNS query gets a response without malformed EDNS.

	18 November 2015: Wouter
	- newer acx_nlnetlabs.m4.
	- spelling fixes from Igor Sobrado Delgado.

	17 November 2015: Wouter
	- Fix #594. libunbound: optionally use libnettle for crypto.
	Contributed by Luca Bruno. Added --with-nettle for use with
	--with-libunbound-only.
	- refactor nsec3 hash implementation to be more library-portable.
	- iana portlist update.
	- Fixup DER encoded DSA signatures for libnettle.

	16 November 2015: Wouter
	- Fix for lenient accept of reverse order DNAME and CNAME.

	6 November 2015: Wouter
	- Change example.conf: ftp.internic.net to https://www.internic.net

	5 November 2015: Wouter
	- ACX_SSL_CHECKS no longer adds -ldl needlessly.

	3 November 2015: Wouter
	- Fix #718: Fix unbound-control-setup with support for env
	without HEREDOC bash support.

	29 October 2015: Wouter
	- patch from Doug Hogan for SSL_OP_NO_SSLvx options.
	- Fix #716: nodata proof with empty non-terminals and wildcards.

	28 October 2015: Wouter
	- Fix checklock testcode for linux threads on exit.

	27 October 2015: Wouter
	- isblank() compat implementation.
	- detect libexpat without xml_StopParser function.
	- portability fixes.
	- portability, replace snprintf if return value broken.

	23 October 2015: Wouter
	- Fix #714: Document config to block private-address for IPv4
	mapped IPv6 addresses.

	22 October 2015: Wouter
	- Fix #712: unbound-anchor appears to not fsync root.key.

	20 October 2015: Wouter
	- 1.5.6 release.
	- trunk tracks development of 1.5.7.

	15 October 2015: Wouter
	- Fix segfault in the dns64 module in the formaterror error path.
	- Fix sldns_wire2str_rdata_scan for malformed RRs.
	- tag for 1.5.6rc1 release.

	14 October 2015: Wouter
	- ANY responses include DNAME records if present, as per Evan Hunt's
	remark in dnsop.
	- Fix manpage to suggest using SIGTERM to terminate the server.

	9 October 2015: Wouter
	- Default for ssl-port is port 853, the temporary port assignment
	for secure domain name system traffic.
	If you used to rely on the older default of port 443, you have
	to put a clause in unbound.conf for that. The new value is likely
	going to be the standardised port number for this traffic.
	- iana portlist update.

	6 October 2015: Wouter
	- 1.5.5 release.
	- trunk tracks the development of 1.5.6.

	28 September 2015: Wouter
	- MAX_TARGET_COUNT increased to 64, to fix up sporadic resolution
	failures.
	- tag for 1.5.5rc1 release.
	- makedist.sh: pgp sig echo commands.

	25 September 2015: Wouter
	- Fix unbound-control flush that does not succeed in removing data.

	22 September 2015: Wouter
	- Fix config globbed include chroot treatment, this fixes reload of
	globs (patch from Dag-Erling Smørgrav).
	- iana portlist update.
	- Fix #702: New IPs for for h.root-servers.net.
	- Remove confusion comment from canonical_compare() function.
	- Fix #705: ub_ctx_set_fwd() return value mishandled on windows.
	- testbound selftest also works in non-debug mode.
	- Fix minor error in unbound.conf.5.in
	- Fix unbound.conf(5) access-control description for precedence
	and default.

	31 August 2015: Wouter
	- changed windows setup compression to be more transparent.

	28 August 2015: Wouter
	- Fix #697: Get PY_MAJOR_VERSION failure at configure for python
	2.4 to 2.6.
	- Feature #699: --enable-pie option to that builds PIE binary.
	- Feature #700: --enable-relro-now option that enables full read-only
	relocation.

	24 August 2015: Wouter
	- Fix deadlock for local data add and zone add when unbound-control
	list_local_data printout is interrupted.
	- iana portlist update.
	- Change default of harden-algo-downgrade to off. This is lenient
	for algorithm rollover.

	13 August 2015: Wouter
	- 5011 implementation does not insist on all algorithms, when
	harden-algo-downgrade is turned off.
	- Reap the child process that libunbound spawns.

	11 August 2015: Wouter
	- Fix #694: configure script does not detect LibreSSL 2.2.2

	4 August 2015: Wouter
	- Document that local-zone nodefault matches exactly and transparent
	can be used to release a subzone.

	3 August 2015: Wouter
	- Document in the manual more text about configuring locally served
	zones.
	- Fix 5011 anchor update timer after reload.
	- Fix mktime in unbound-anchor not using UTC.

	30 July 2015: Wouter
	- please afl-gcc (llvm) for uninitialised variable warning.
	- Added permit-small-holddown config to debug fast 5011 rollover.

	24 July 2015: Wouter
	- Fix #690: Reload fails when so-reuseport is yes after changing
	num-threads.
	- iana portlist update.

	21 July 2015: Wouter
	- Fix configure to detect SSL_CTX_set_ecdh_auto.
	- iana portlist update.

	20 July 2015: Wouter
	- Enable ECDHE for servers. Where available, use
	SSL_CTX_set_ecdh_auto() for TLS-wrapped server configurations to
	enable ECDHE. Otherwise, manually offer curve p256.
	Client connections should automatically use ECDHE when available.
	(thanks Daniel Kahn Gillmor)

	18 July 2015: Willem
	- Allow certificate chain files to allow for intermediate certificates.
	(thanks Daniel Kahn Gillmor)

	13 July 2015: Wouter
	- makedist produces sha1 and sha256 files for created binaries too.

	9 July 2015: Wouter
	- 1.5.4 release tag
	- trunk has 1.5.5 in development.
	- Fix #681: Setting forwarders with unbound-control forward
	implicitly turns on forward-first.

	29 June 2015: Wouter
	- iana portlist update.
	- Fix alloc with log for allocation size checks.

	26 June 2015: Wouter
	- Fix #677 Fix DNAME responses from cache that failed internal chain
	test.
	- iana portlist update.

	22 June 2015: Wouter
	- Fix #677 Fix CNAME corresponding to a DNAME was checked incorrectly
	and was therefore always synthesized (thanks to Valentin Dietrich).

	4 June 2015: Wouter
	- RFC 7553 RR type URI support, is now enabled by default.

	2 June 2015: Wouter
	- Fix #674: Do not free pointers given by getenv.

	29 May 2015: Wouter
	- Fix that unparseable error responses are ratelimited.
	- SOA negative TTL is capped at minimumttl in its rdata section.
	- cache-max-negative-ttl config option, default 3600.

	26 May 2015: Wouter
	- Document that ratelimit works with unbound-control set_option.

	21 May 2015: Wouter
	- iana portlist update.
	- documentation proposes ratelimit of 1000 (closer to what upstream
	servers expect from us).

	20 May 2015: Wouter
	- DLV is going to be decommissioned. Advice to stop using it, and
	put text in the example configuration and man page to that effect.

	10 May 2015: Wouter
	- Change syntax of particular validator error to be easier for
	machine parse, swap rrset and ip adres info so it looks like:
	validation failure <www.example.nl. TXT IN>: signature crypto
	failed from 2001:DB8:7:bba4::53 for <*.example.nl. NSEC IN>

	1 May 2015: Wouter
	- caps-whitelist in unbound.conf allows whitelist of loadbalancers
	that cannot work with caps-for-id or its fallback.

	30 April 2015: Wouter
	- Unit test for type ANY synthesis.

	22 April 2015: Wouter
	- Removed contrib/unbound_unixsock.diff, because it has been
	integrated, use control-interface: /path in unbound.conf.
	- iana portlist update.

	17 April 2015: Wouter
	- Synthesize ANY responses from cache. Does not search exhaustively,
	but MX,A,AAAA,SOA,NS also CNAME.
	- Fix leaked dns64prefix configuration string.

	16 April 2015: Wouter
	- Add local-zone type inform_deny, that logs query and drops answer.
	- Ratelimit does not apply to prefetched queries, and ratelimit-factor
	is default 10. Repeated normal queries get resolved and with
	prefetch stay in the cache.
	- Fix bug#664: libunbound python3 related fixes (from Tomas Hozza)
	Use print_function also for Python2.
	libunbound examples: produce sorted output.
	libunbound-Python: libldns is not used anymore.
	Fix issue with Python 3 mapping of FILE* using file_py3.i from ldns.

	10 April 2015: Wouter
	- unbound-control ratelimit_list lists high rate domains.
	- ratelimit feature, ratelimit: 100, or some sensible qps, can be
	used to turn it on. It ratelimits recursion effort per zone.
	For particular names you can configure exceptions in unbound.conf.
	- Fix that get_option for cache-sizes does not print double newline.
	- Fix#663: ssl handshake fails when using unix socket because dh size
	is too small.

	8 April 2015: Wouter
	- Fix crash in dnstap: Do not try to log TCP responses after timeout.

	7 April 2015: Wouter
	- Libunbound skips dos-line-endings from etc/hosts.
	- Unbound exits with a fatal error when the auto-trust-anchor-file
	fails to be writable. This is seconds after startup. You can
	load a readonly auto-trust-anchor-file with trust-anchor-file.
	The file has to be writable to notice the trust anchor change,
	without it, a trust anchor change will be unnoticed and the system
	will then become inoperable.
	- unbound-control list_insecure command shows the negative trust
	anchors currently configured, patch from Jelte Jansen.

	2 April 2015: Wouter
	- Fix #660: Fix interface-automatic broken in the presence of
	asymmetric routing.

	26 March 2015: Wouter
	- remote.c probedelay line is easier to read.
	- rename ldns subdirectory to sldns to avoid name collision.

	25 March 2015: Wouter
	- Fix #657: libunbound(3) recommends deprecated
	CRYPTO_set_id_callback.
	- If unknown trust anchor algorithm, and libressl is used, error
	message encourages upgrade of the libressl package.

	23 March 2015: Wouter
	- Fix segfault on user not found at startup (from Maciej Soltysiak).

	20 March 2015: Wouter
	- Fixed to add integer overflow checks on allocation (defense in depth).

	19 March 2015: Wouter
	- Add ip-transparent config option for bind to non-local addresses.

	17 March 2015: Wouter
	- Use reallocarray for integer overflow protection, patch submitted
	by Loganaden Velvindron.

	16 March 2015: Wouter
	- Fixup compile on cygwin, more portable openssl thread id.

	12 March 2015: Wouter
	- Updated default keylength in unbound-control-setup to 3k.

	10 March 2015: Wouter
	- Fix lintian warning in unbound-checkconf man page (from Andreas
	Schulze).
	- print svnroot when building windows dist.
	- iana portlist update.
	- Fix warning on sign compare in getentropy_linux.

	9 March 2015: Wouter
	- Fix #644: harden-algo-downgrade option, if turned off, fixes the
	reported excessive validation failure when multiple algorithms
	are present. It allows the weakest algorithm to validate the zone.
	- iana portlist update.

	5 March 2015: Wouter
	- contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal
	scripts. Contributed by Yuri Voinov.
	- Document that incoming-num-tcp increase is good for large servers.
	- stats reports tcp usage, of incoming-num-tcp buffers.

	4 March 2015: Wouter
	- Patch from Brad Smith that syncs compat/getentropy_linux with
	OpenBSD's version (2015-03-04).
	- 0x20 fallback improved: servfail responses do not count as missing
	comparisons (except if all responses are errors),
	inability to find nameservers does not fail equality comparisons,
	many nameservers does not try to compare more than max-sent-count,
	parse failures start 0x20 fallback procedure.
	- store caps_response with best response in case downgrade response
	happens to be the last one.
	- Document windows 8 tests.

	3 March 2015: Wouter
	- tag 1.5.3rc1
	[ This became 1.5.3 on 10 March, trunk is 1.5.4 in development ]

	2 March 2015: Wouter
	- iana portlist update.

	20 February 2015: Wouter
	- Use the getrandom syscall introduced in Linux 3.17 (from Heiner
	Kallweit).
	- Fix #645 Portability to Solaris 10, use AF_LOCAL.
	- Fix #646 Portability to Solaris, -lrt for getentropy_solaris.
	- Fix #647 crash in 1.5.2 because pwd.db no longer accessible after
	reload.

	19 February 2015: Wouter
	- 1.5.2 release tag.
	- svn trunk contains 1.5.3 under development.

	13 February 2015: Wouter
	- Fix #643: doc/example.conf.in: unnecessary whitespace.

	12 February 2015: Wouter
	- tag 1.5.2rc1

	11 February 2015: Wouter
	- iana portlist update.

	10 February 2015: Wouter
	- Fix scrubber with harden-glue turned off to reject NS (and other
	not-address) records.

	9 February 2015: Wouter
	- Fix validation failure in case upstream forwarder (ISC BIND) does
	not have the same trust anchors and decides to insert unsigned NS
	record in authority section.

	2 February 2015: Wouter
	- infra-cache-min-rtt patch from Florian Riehm, for expected long
	uplink roundtrip times.

	30 January 2015: Wouter
	- Fix 0x20 capsforid fallback to omit gratuitous NS and additional
	section changes.
	- Portability fix for Solaris ('sun' is not usable for a variable).

	29 January 2015: Wouter
	- Fix pyunbound byte string representation for python3.

	26 January 2015: Wouter
	- Fix unintended use of gcc extension for incomplete enum types,
	compile with pedantic c99 compliance (from Daniel Dickman).

	23 January 2015: Wouter
	- windows port fixes, no AF_LOCAL, no chown, no chmod(grp).

	16 January 2015: Wouter
	- unit test for local unix connection. Documentation and log_addr
	does not inspect port for AF_LOCAL.
	- unbound-checkconf -f prints chroot with pidfile path.

	13 January 2015: Wouter
	- iana portlist update.

	12 January 2015: Wouter
	- Cast sun_len sizeof to socklen_t.
	- Fix pyunbound ord call, portable for python 2 and 3.

	7 January 2015: Wouter
	- Fix warnings in pythonmod changes.

	6 January 2015: Wouter
	- iana portlist update.
	- patch for remote control over local sockets, from Dag-Erling
	Smorgrav, Ilya Bakulin. Use control-interface: /path/sock and
	control-use-cert: no.
	- Fixup that patch and uid lookup (only for daemon).
	- coded the default of control-use-cert, to yes.

	5 January 2015: Wouter
	- getauxval test for ppc64 linux compatibility.
	- make strip works for unbound-host and unbound-anchor.
	- patch from Stephane Lapie that adds to the python API, that
	exposes struct delegpt, and adds the find_delegation function.
	- print query name when max target count is exceeded.
	- patch from Stuart Henderson that fixes DESTDIR in
	unbound-control-setup for installs where config is not in
	the prefix location.
	- Fix #634: fix fail to start on Linux LTS 3.14.X, ignores missing
	IP_MTU_DISCOVER OMIT option (fix from Remi Gacogne).
	- Updated contrib warmup.cmd/sh to support two modes - load
	from pre-defined list of domains or (with filename as argument)
	load from user-specified list of domains, and updated contrib
	unbound_cache.sh/cmd to support loading/save/reload cache to/from
	default path or (with secondary argument) arbitrary path/filename,
	from Yuri Voinov.
	- Patch from Philip Paeps to contrib/unbound_munin_ that uses
	type ABSOLUTE. Allows munin.conf: [idleserver.example.net]
	unbound_munin_hits.graph_period minute

	9 December 2014: Wouter
	- svn trunk has 1.5.2 in development.
	- config.guess and config.sub update from libtoolize.
	- local-zone: example.com inform makes unbound log a message with
	client IP for queries in that zone. Eg. for finding infected hosts.

	8 December 2014: Wouter
	- Fix CVE-2014-8602: denial of service by making resolver chase
	endless series of delegations.

	1 December 2014: Wouter
	- Fix bug#632: unbound fails to build on AArch64, protects
	getentropy compat code from calling sysctl if it is has been removed.

	29 November 2014: Wouter
	- Add include to getentropy_linux.c, hopefully fixing debian build.

	28 November 2014: Wouter
	- Fix makefile for build from noexec source tree.

	26 November 2014: Wouter
	- Fix libunbound undefined symbol errors for main.
	Referencing main does not seem to be possible for libunbound.

	24 November 2014: Wouter
	- Fix log at high verbosity and memory allocation failure.
	- iana portlist update.

	21 November 2014: Wouter
	- Fix crash on multiple thread random usage on systems without
	arc4random.

	20 November 2014: Wouter
	- fix compat/getentropy_win.c check if CryptGenRandom works and no
	immediate exit on windows.

	19 November 2014: Wouter
	- Fix cdflag dns64 processing.

	18 November 2014: Wouter
	- Fix that CD flag disables DNS64 processing, returning the DNSSEC
	signed AAAA denial.
	- iana portlist update.

	17 November 2014: Wouter
	- Fix #627: SSL_CTX_load_verify_locations return code not properly
	checked.

	14 November 2014: Wouter
	- parser with bison 2.7

	13 November 2014: Wouter
	- Patch from Stephane Lapie for ASAHI Net that implements aaaa-filter,
	added to contrib/aaaa-filter-iterator.patch.

	12 November 2014: Wouter
	- trunk has 1.5.1 in development.
	- Patch from Robert Edmonds to build pyunbound python module
	differently. No versioninfo, with -shared and without $(LIBS).
	- Patch from Robert Edmonds fixes hyphens in unbound-anchor man page.
	- Removed 'increased limit open files' log message that is written
	to console. It is only written on verbosity 4 and higher.
	This keeps system bootup console cleaner.
	- Patch from James Raftery, always print stats for rcodes 0..5.

	11 November 2014: Wouter
	- iana portlist update.
	- Fix bug where forward or stub addresses with same address but
	different port number were not tried.
	- version number in svn trunk is 1.5.0
	- tag 1.5.0rc1
	- review fix from Ralph.

	7 November 2014: Wouter
	- dnstap fixes by Robert Edmonds:
	dnstap/dnstap.m4: cosmetic fixes
	dnstap/: Remove compiled protoc-c output files
	dnstap/dnstap.m4: Error out if required libraries are not found
	dnstap: Fix ProtobufCBufferSimple usage that is incorrect as of
	protobuf-c 1.0.0
	dnstap/: Adapt to API changes in latest libfstrm (>= 0.2.0)

	4 November 2014: Wouter
	- Add ub_ctx_add_ta_autr function to add a RFC5011 automatically
	tracked trust anchor to libunbound.
	- Redefine internal minievent symbols to unique symbols that helps
	linking on platforms where the linker leaks names across modules.

	27 October 2014: Wouter
	- Disabled use of SSLv3 in remote-control and ssl-upstream.
	- iana portlist update.

	16 October 2014: Wouter
	- Documented dns64 configuration in unbound.conf man page.

	13 October 2014: Wouter
	- Fix #617: in ldns in unbound, lowercase WKS services.
	- Fix ctype invocation casts.

	10 October 2014: Wouter
	- Fix unbound-checkconf check for module config with dns64 module.
	- Fix unbound capsforid fallback, it ignores TTLs in comparison.

	6 October 2014: Wouter
	- Fix #614: man page variable substitution bug.
	6 October 2014: Willem
	- Whitespaces after $ORIGIN are not part of the origin dname (ldns).
	- $TTL's value starts at position 5 (ldns).

	1 October 2014: Wouter
	- fix #613: Allow tab ws in var length last rdfs (in ldns str2wire).

	29 September 2014: Wouter
	- Fix #612: create service with service.conf in present directory and
	auto load it.
	- Fix for mingw compile openssl ranlib.

	25 September 2014: Wouter
	- updated configure and aclocal with newer autoconf 1.13.

	22 September 2014: Wouter
	- Fix swig and python examples for Python 3.x.
	- Fix for mingw compile with openssl-1.0.1i.

	19 September 2014: Wouter
	- improve python configuration detection to build on Fedora 22.

	18 September 2014: Wouter
	- patches to also build with Python 3.x (from Pavel Simerda).

	16 September 2014: Wouter
	- Fix tcp timer waiting list removal code.
	- iana portlist update.
	- Updated the TCP_BACLOG from 5 to 256, so that the tcp accept queue
	is longer and more tcp connections can be handled.

	15 September 2014: Wouter
	- Fix unit test for CDS typecode.

	5 September 2014: Wouter
	- type CDS and CDNSKEY types in sldns.

	25 August 2014: Wouter
	- Fixup checklock code for log lock and its mutual initialization
	dependency.
	- iana portlist update.
	- Removed necessity for pkg-config from the dnstap.m4, new are
	the --with-libfstrm and --with-protobuf-c configure options.

	19 August 2014: Wouter
	- Update unbound manpage with more explanation (from Florian Obser).

	18 August 2014: Wouter
	- Fix #603: unbound-checkconf -o <option> should skip verification
	checks.
	- iana portlist update.
	- Fixup doc/unbound.doxygen to remove obsolete 1.8.7 settings.

	5 August 2014: Wouter
	- dnstap support, with a patch from Farsight Security, written by
	Robert Edmonds. The --enable-dnstap needs libfstrm and protobuf-c.
	It is BSD licensed (see dnstap/dnstap.c).
	Building with --enable-dnstap needs pkg-config with this patch.
	- Noted dnstap in doc/README and doc/CREDITS.
	- Changes to the dnstap patch.
	- lint fixes.
	- dnstap/dnstap_config.h should not have been added to the repo,
	because is it generated.

	1 August 2014: Wouter
	- Patch add msg, rrset, infra and key cache sizes to stats command
	from Maciej Soltysiak.
	- iana portlist update.

	31 July 2014: Wouter
	- DNS64 from Viagenie (BSD Licensed), written by Simon Perrault.
	Initial commit of the patch from the FreeBSD base (with its fixes).
	This adds a module (for module-config in unbound.conf) dns64 that
	performs DNS64 processing, see README.DNS64.
	- Changes from DNS64:
	strcpy changed to memmove.
	arraybound check fixed from prefix_net/8/4 to prefix_net/8+4.
	allocation of result consistently in the correct region.
	time_t is now used for ttl in unbound (since the patch's version).
	- testdata/dns64_lookup.rpl for unit test for dns64 functionality.

	29 July 2014: Wouter
	- Patch from Dag-Erling Smorgrav that implements feature, unbound -dd
	does not fork in the background and also logs to stderr.

	21 July 2014: Wouter
	- Fix endian.h include for OpenBSD.

	16 July 2014: Wouter
	- And Fix#596: Bail out of unbound-control dump_infra when ssl
	write fails.

	15 July 2014: Wouter
	- Fix #596: Bail out of unbound-control list_local_zones when ssl
	write fails.
	- iana portlist update.

	13 July 2014: Wouter
	- Configure tests if main can be linked to from getentropy compat.

	12 July 2014: Wouter
	- Fix getentropy compat code, function refs were not portable.
	- Fix to check openssl version number only for OpenSSL.
	- LibreSSL provides compat items, check for that in configure.
	- Fix bug in fix for log locks that caused deadlock in signal handler.
	- update compat/getentropy and arc4random to the most recent ones from OpenBSD.

	11 July 2014: Matthijs
	- fake-rfc2553 patch (thanks Benjamin Baier).

	11 July 2014: Wouter
	- arc4random in compat/ and getentropy, explicit_bzero, chacha for
	dependencies, from OpenBSD. arc4_lock and sha512 in compat.
	This makes arc4random available on all platforms, except when
	compiled with LIBNSS (it uses libNSS crypto random).
	- fix strptime implicit declaration error on OpenBSD.
	- arc4random, getentropy and explicit_bzero compat for Windows.

	4 July 2014: Wouter
	- Fix #593: segfault or crash upon rotating logfile.

	3 July 2014: Wouter
	- DLV tests added.
	- signit tool fixup for compile with libldns library.
	- iana portlist updated.

	27 June 2014: Wouter
	- so-reuseport is available on BSDs(such as FreeBSD 10) and OS/X.

	26 June 2014: Wouter
	- unbound-control status reports if so-reuseport was successful.
	- iana portlist updated.

	24 June 2014: Wouter
	- Fix caps-for-id fallback, and added fallback attempt when servers
	drop 0x20 perturbed queries.
	- Fixup testsetup for VM tests (run testcode/run_vm.sh).

	17 June 2014: Wouter
	- iana portlist updated.

	3 June 2014: Wouter
	- Add AAAA for B root server to default root hints.

	2 June 2014: Wouter
	- Remove unused define from iterator.h

	30 May 2014: Wouter
	- Fixup sldns_enum_edns_option typedef definition.

	28 May 2014: Wouter
	- Code cleanup patch from Dag-Erling Smorgrav, with compiler issue
	fixes from FreeBSD's copy of Unbound, he notes:
	Generate unbound-control-setup.sh at build time so it respects
	prefix and sysconfdir from the configure script. Also fix the
	umask to match the comment, and the comment to match the umask.
	Add const and static where needed. Use unions instead of
	playing pointer poker. Move declarations that are needed in
	multiple source files into a shared header. Move sldns_bgetc()
	from parse.c to buffer.c where it belongs. Introduce a new
	header file, worker.h, which declares the callbacks that
	all workers must define. Remove those declarations from
	libworker.h. Include the correct headers in the correct places.
	Fix a few dummy callbacks that don't match their prototype.
	Fix some casts. Hide the sbrk madness behind #ifdef HAVE_SBRK.
	Remove a useless printf which breaks reproducible builds.
	Get rid of CONFIGURE_{TARGET,DATE,BUILD_WITH} now that they're
	no longer used. Add unbound-control-setup.sh to the list of
	generated files. The prototype for libworker_event_done_cb()
	needs to be moved from libunbound/libworker.h to
	libunbound/worker.h.
	- Fixup out-of-directory compile with unbound-control-setup.sh.in.
	- make depend.

	23 May 2014: Wouter
	- unbound-host -D enabled dnssec and reads root trust anchor from
	the default root key file that was compiled in.

	20 May 2014: Wouter
	- Feature, unblock-lan-zones: yesno that you can use to make unbound
	perform 10.0.0.0/8 and other reverse lookups normally, for use if
	unbound is running service for localhost on localhost.

	16 May 2014: Wouter
	- Updated create_unbound_ad_servers and unbound_cache scripts from
	Yuri Voinov in the source/contrib directory. Added
	warmup.cmd (and .sh): warm up the DNS cache with your MRU domains.

	9 May 2014: Wouter
	- Implement draft-ietf-dnsop-rfc6598-rfc6303-01.
	- iana portlist updated.

	8 May 2014: Wouter
	- Contrib windows scripts from Yuri Voinov added to src/contrib:
	create_unbound_ad_servers.cmd: enters anti-ad server lists.
	unbound_cache.cmd: saves and loads the cache.
	- Added unbound-control-setup.cmd from Yuri Voinov to the windows
	unbound distribution set. It requires openssl installed in %PATH%.

	6 May 2014: Wouter
	- Change MAX_SENT_COUNT from 16 to 32 to resolve some cases easier.

	5 May 2014: Wouter
	- More #567: remove : from output of stub and forward lists, this is
	easier to parse.

	29 April 2014: Wouter
	- iana portlist updated.
	- Add unbound-control flush_negative that flushed nxdomains, nodata,
	and errors from the cache. For dnssec-trigger and NetworkManager,
	fixes cases where network changes have localdata that was already
	negatively cached from the previous network.

	23 April 2014: Wouter
	- Patch from Jeremie Courreges-Anglas to use arc4random_uniform
	if available on the OS, it gets entropy from the OS.

	15 April 2014: Wouter
	- Fix compile with libevent2 on FreeBSD.

	11 April 2014: Wouter
	- Fix #502: explain that do-ip6 disable does not stop AAAA lookups,
	but it stops the use of the ipv6 transport layer for DNS traffic.
	- iana portlist updated.

	10 April 2014: Wouter
	- iana portlist updated.
	- Patch from Hannes Frederic Sowa for Linux 3.15 fragmentation
	option for DNS fragmentation defense.
	- Document that dump_requestlist only prints queries from thread 0.
	- unbound-control stats prints num.query.tcpout with number of TCP
	outgoing queries made in the previous statistics interval.
	- Fix #567: unbound lists if forward zone is secure or insecure with
	+i annotation in output of list_forwards, also for list_stubs
	(for NetworkManager integration.)
	- Fix #554: use unsigned long to print 64bit statistics counters on
	64bit systems.
	- Fix #558: failed prefetch lookup does not remove cached response
	but delays next prefetch (in lieu of caching a SERVFAIL).
	- Fix #545: improved logging, the ip address of the error is printed
	on the same log-line as the error.

	8 April 2014: Wouter
	- Fix #574: make test fails on Ubuntu 14.04. Disabled remote-control
	in testbound scripts.
	- iana portlist updated.

	7 April 2014: Wouter
	- C.ROOT-SERVERS.NET has an IPv6 address, and we updated the root
	hints (patch from Anand Buddhdev).
	- Fix #572: Fix unit test failure for systems with different
	/etc/services.

	28 March 2014: Wouter
	- Fix #569: do_tcp is do-tcp in unbound.conf man page.

	25 March 2014: Wouter
	- Patch from Stuart Henderson to build unbound-host man from .1.in.

	24 March 2014: Wouter
	- Fix print filename of encompassing config file on read failure.

	12 March 2014: Wouter
	- tag 1.4.22
	- trunk has 1.4.23 in development.

	10 March 2014: Wouter
	- Fix bug#561: contrib/cacti plugin did not report SERVFAIL rcodes
	because of spelling. Patch from Chris Coates.

	27 February 2014: Wouter
	- tag 1.4.22rc1

	21 February 2014: Wouter
	- iana portlist updated.

	20 February 2014: Matthijs
	- Be lenient when a NSEC NameError response with RCODE=NXDOMAIN is
	received. This is okay according 4035, but not after revising
	existence in 4592. NSEC empty non-terminals exist and thus the
	RCODE should have been NOERROR. If this occurs, and the RRsets
	are secure, we set the RCODE to NOERROR and the security status
	of the response is also considered secure.

	14 February 2014: Wouter
	- Works on Minix (3.2.1).

	11 February 2014: Wouter
	- Fix parse of #553(NSD) string in sldns, quotes without spaces.

	7 February 2014: Wouter
	- iana portlist updated.
	- add body to ifstatement if locks disabled.
	- add TXT string"string" test case to unit test.
	- Fix #551: License change "Regents" to "Copyright holder", matching
	the BSD license on opensource.org.

	6 February 2014: Wouter
	- sldns has type HIP.
	- code documentation on the module interface.

	5 February 2014: Wouter
	- Fix sldns parse tests on osx.

	3 February 2014: Wouter
	- Detect libevent2 install automatically by configure.
	- Fixup link with lib/event2 subdir.
	- Fix parse in sldns of quoted parenthesized text strings.

	31 January 2014: Wouter
	- unit test for ldns wire to str and back with zones, root, nlnetlabs
	and types.sidnlabs.
	- Fix for hex to string in unknown, atma and nsap.
	- fixup nss compile (no ldns in it).
	- fixup warning in unitldns
	- fixup WKS and rdata type service to print unsigned because strings
	are not portable; they cannot be read (for sure) on other computers.
	- fixup type EUI48 and EUI64, type APL and type IPSECKEY in string
	parse sldns.

	30 January 2014: Wouter
	- delay-close does not act if there are udp-wait queries, so that
	it does not make a socketdrain DoS easier.

	28 January 2014: Wouter
	- iana portlist updated.
	- iana portlist test updated so it does not touch the source
	if there are no changes.
	- delay-close: msec option that delays closing ports for which
	the UDP reply has timed out. Keeps the port open, only accepts
	the correct reply. This correct reply is not used, but the port
	is open so that no port-denied ICMPs are generated.

	27 January 2014: Wouter
	- reuseport is attempted, then fallback to without on failure.

	24 January 2014: Wouter
	- Change unbound-event.h to use void* buffer, length idiom.
	- iana portlist updated.
	- unbound-event.h is installed if you configure --enable-event-api.
	- speed up unbound (reports say it could be up to 10%), by reducing
	lock contention on localzones.lock. It is changed to an rwlock.
	- so-reuseport: yesno option to distribute queries evenly over
	threads on Linux (Thanks Robert Edmonds).
	- made lint clean.

	21 January 2014: Wouter
	- Fix #547: no trustanchor written if filesystem full, fclose checked.

	17 January 2014: Wouter
	- Fix isprint() portability in sldns, uses unsigned int.
	- iana portlist updated.

	16 January 2014: Wouter
	- fix #544: Fixed +i causes segfault when running with module conf
	"iterator".
	- Windows port, adjust %lld to %I64d, and warning in win_event.c.

	14 January 2014: Wouter
	- iana portlist updated.

	5 Dec 2013: Wouter
	- Fix bug in cachedump that uses sldns.
	- update pythonmod for ldns_ to sldns_ name change.

	3 Dec 2013: Wouter
	- Fix sldns to use sldns_ prefix for all ldns_ variables.
	- Fix windows compile to compile with sldns.

	30 Nov 2013: Wouter
	- Fix sldns to make globals use sldns_ prefix. This fixes
	linking with libldns that uses global variables ldns_ .

	13 Nov 2013: Wouter
	- Fix bug#537: compile python plugin without ldns library.

	12 Nov 2013: Wouter
	- Fix bug#536: acl_deny_non_local and refuse_non_local added.

	5 Nov 2013: Wouter
	- Patch from Neel Goyal to fix async id assignment if callback
	is called by libunbound in the mesh attach.
	- Accept ip-address: as an alternative for interface: for
	consistency with nsd.conf syntax.

	4 Nov 2013: Wouter
	- Patch from Neel Goyal to fix callback in libunbound.

	3 Nov 2013: Wouter
	- if configured --with-libunbound-only fix make install.

	31 Oct 2013: Wouter
	- Fix #531: Set SO_REUSEADDR so that the wildcard interface and a
	more specific interface port 53 can be used at the same time, and
	one of the daemons is unbound.
	- iana portlist update.
	- separate ldns into core ldns inside ldns/ subdirectory. No more
	--with-ldns is needed and unbound does not rely on libldns.
	- portability fixes for new USE_SLDNS ldns subdir codebase.

	22 Oct 2013: Wouter
	- Patch from Neel Goyal: Add an API call to set an event base on an
	existing ub_ctx. This basically just destroys the current worker and
	sets the event base to the current. And fix a deadlock in
	ub_resolve_event – the cfglock is held when libworker_create is
	called. This ends up trying to acquire the lock again in
	context_obtain_alloc in the call chain.
	- Fix #528: if very high logging (4 or more) segfault on allow_snoop.

	26 Sep 2013: Wouter
	- unbound-event.h is installed if configured --with-libevent. It
	contains low-level library calls, that use libevent's event_base
	and an ldns_buffer for the wire return packet to perform async
	resolution in the client's eventloop.

	19 Sep 2013: Wouter
	- 1.4.21 tag created.
	- trunk has 1.4.22 number inside it.
	- iana portlist updated.
	- acx_nlnetlabs.m4 to 26; improve FLTO help text.

	16 Sep 2013: Wouter
	- Fix#524: max-udp-size not effective to non-EDNS0 queries, from
	Daisuke HIGASHI.

	10 Sep 2013: Wouter
	- MIN_TTL and MAX_TTL also in time_t.
	- tag 1.4.21rc1 made again.

	26 Aug 2013: Wouter
	- More fixes for bug#519: for the threaded case test if the bg
	thread has been killed, on ub_ctx_delete, to avoid hangs.

	22 Aug 2013: Wouter
	- more fixes that I overlooked.
	- review fixes from Willem.

	21 Aug 2013: Wouter
	- Fix#520: Errors found by static analysis from Tomas Hozza(redhat).

	20 Aug 2013: Wouter
	- Fix for 2038, with time_t instead of uint32_t.

	19 Aug 2013: Wouter
	- Fix#519 ub_ctx_delete may hang in some scenarios (libunbound).

	14 Aug 2013: Wouter
	- Fix uninit variable in fix#516.

	8 Aug 2013: Wouter
	- Fix#516 dnssec lameness detection for answers that are improper.

	30 Jun 2013: Wouter
	- tag 1.4.21rc1

	29 Jun 2013: Wouter
	- Fix#512 memleak in testcode for testbound (if it fails).
	- Fix#512 NSS returned arrays out of setup function to be statics.

	26 Jun 2013: Wouter
	- max include of 100.000 files (depth and globbed at one time).
	This is to preserve system memory in bug cases, or endless cases.
	- iana portlist updated.

	19 Jun 2013: Wouter
	- streamtcp man page, contributed by Tomas Hozza.
	- iana portlist updated.
	- libunbound documentation on how to avoid openssl race conditions.

	25 Jun 2013: Wouter
	- Squelch sendto-permission denied errors when the network is
	not connected, to avoid spamming syslog.
	- configure --disable-flto option (from Robert Edmonds).

	18 Jun 2013: Wouter
	- Fix for const string literals in C++ for libunbound, from Karel
	Slany.
	- iana portlist updated.

	17 Jun 2013: Wouter
	- Fixup manpage syntax.

	14 Jun 2013: Wouter
	- get_option and set_option support for log-time-ascii, python-script
	val-sig-skew-min and val-sig-skew-max. log-time-ascii takes effect
	immediately. The others are mostly useful for libunbound users.

	13 Jun 2013: Wouter
	- get_option, set_option, unbound-checkconf -o and libunbound
	getoption and setoption support cache-min-ttl and cache-max-ttl.

	10 Jun 2013: Wouter
	- Fix#501: forward-first does not recurse, when forward name is ".".
	- iana portlist update.
	- Max include depth is unlimited.

	27 May 2013: Wouter
	- Update acx_pthreads.m4 to ax_pthreads.4 (2013-03-29), and apply
	patch to it to not fail when -Werror is also specified, from the
	autoconf-archives.
	- iana portlist update.

	21 May 2013: Wouter
	- Explain bogus and secure flags in libunbound more.

	16 May 2013: Wouter
	- Fix#499 use-after-free in out-of-memory handling code (thanks Jake
	Montgomery).
	- Fix#500 use on non-initialised values on socket bind failures.

	15 May 2013: Wouter
	- Fix round-robin doesn't work with some Windows clients (from Ilya
	Bakulin).

	3 May 2013: Wouter
	- update acx_nlnetlabs.m4 to v23, sleep w32 fix.

	26 April 2013: Wouter
	- add unbound-control insecure_add and insecure_remove for the
	administration of negative trust anchors.

	25 April 2013: Wouter
	- Implement max-udp-size config option, default 4096 (thanks
	Daisuke Higashi).
	- Robust checks on dname validity from rdata for dname compare.
	- updated iana portlist.

	19 April 2013: Wouter
	- Fixup snprintf return value usage, fixed libunbound_get_option.

	18 April 2013: Wouter
	- fix bug #491: pick program name (0th argument) as syslog identity.
	- own implementation of compat/snprintf.c.

	15 April 2013: Wouter
	- Fix so that for a configuration line of include: "*.conf" it is not
	an error if there are no files matching the glob pattern.
	- unbound-anchor review: BIO_write can return 0 successfully if it
	has successfully appended a zero length string.

	11 April 2013: Wouter
	- Fix queries leaking up for stubs and forwards, if the configured
	nameservers all fail to answer.

	10 April 2013: Wouter
	- code improve for minimal responses, small speed increase.

	9 April 2013: Wouter
	- updated iana portlist.
	- Fix crash in previous private address fixup of 22 March.

	28 March 2013: Wouter
	- Make reverse zones easier by documenting the nodefault statements
	commented-out in the example config file.

	26 March 2013: Wouter
	- more fixes to lookup3.c endianness detection.

	25 March 2013: Wouter
	- #492: Fix endianness detection, revert to older lookup3.c detection
	and put new detect lines after previous tests, to avoid regressions
	but allow new detections to succeed.
	And add detection for machine/endian.h to it.

	22 March 2013: Wouter
	- Fix resolve of names that use a mix of public and private addresses.
	- iana portlist update.
	- Fix makedist for new svn for -d option.
	- unbound.h header file has UNBOUND_VERSION_MAJOR define.
	- Fix windows RSRC version for long version numbers.

	21 March 2013: Wouter
	- release 1.4.20
	- trunk has 1.4.21
	- committed libunbound version 4:1:2 for binary API updated in 1.4.20
	- install copy of unbound-control.8 man page for unbound-control-setup

	14 March 2013: Wouter
	- iana portlist update.
	- tag 1.4.20rc1

	12 March 2013: Wouter
	- Fixup makedist.sh for windows compile.

	11 March 2013: Wouter
	- iana portlist update.
	- testcode/ldns-testpkts.c check for makedist is informational.

	15 February 2013: Wouter
	- fix defines in lookup3 for bigendian bsd alpha

	11 February 2013: Wouter
	- Fixup openssl_thread init code to only run if compiled with SSL.

	7 February 2013: Wouter
	- detect endianness in lookup3 on BSD.
	- add libunbound.ttl at end of result structure, version bump for
	libunbound and binary backwards compatible, but 1.4.19 is not
	forward compatible with 1.4.20.
	- update iana port list.

	30 January 2013: Wouter
	- includes and have_ssl fixes for nss.

	29 January 2013: Wouter
	- printout name of zone with duplicate fwd and hint errors.

	28 January 2013: Wouter
	- updated fwd_zero for newer nc. Updated common.sh for newer netstat.

	17 January 2013: Wouter
	- unbound-anchors checks the emailAddress of the signer of the
	root.xml file, default is dnssec@iana.org. It also checks that
	the signer has the correct key usage for a digital signature.
	- update iana port list.

	3 January 2013: Wouter
	- Test that unbound-control checks client credentials.
	- Test that unbound can handle a CNAME at an intermediate node in
	the chain of trust (where it seeks a DS record).
	- Check the commonName of the signer of the root.xml file in
	unbound-anchor, default is dnssec@iana.org.

	2 January 2013: Wouter
	- Fix openssl lock free on exit (reported by Robert Fleischman).
	- iana portlist updated.
	- Tested that unbound implements the RFC5155 Technical Errata id 3441.
	Unbound already implements insecure classification of an empty
	nonterminal in NSEC3 optout zone.

	20 December 2012: Wouter
	- Fix unbound-anchor xml parse of entity declarations for safety.

	19 December 2012: Wouter
	- iana portlist updated.

	18 December 2012: Wouter
	- iana portlist updated.

	14 December 2012: Wouter
	- Change of D.ROOT-SERVERS.NET A address in default root hints.

	12 December 2012: Wouter
	- 1.4.19 release.
	- trunk has 1.4.20 under development.

	5 December 2012: Wouter
	- note support for AAAA RR type RFC.

	4 December 2012: Wouter
	- 1.4.19rc1 tag.

	30 November 2012: Wouter
	- bug 481: fix python example0.
	- iana portlist updated.

	27 November 2012: Wouter
	- iana portlist updated.

	9 November 2012: Wouter
	- Fix unbound-control forward disables configured stubs below it.

	7 November 2012: Wouter
	- Fixup ldns-testpkts, identical to ldns/examples.
	- iana portlist updated.

	30 October 2012: Wouter
	- Fix bug #477: unbound-anchor segfaults if EDNS is blocked.

	29 October 2012: Matthijs
	- Fix validation for responses with both CNAME and wildcard
	expanded CNAME records in answer section.

	8 October 2012: Wouter
	- update ldns-testpkts.c to ldns 1.6.14 version.
	- fix build of pythonmod in objdir, for unbound.py.
	- make clean and makerealclean remove generated python and docs.

	5 October 2012: Wouter
	- fix build of pythonmod in objdir (thanks Jakob Schlyter).

	3 October 2012: Wouter
	- fix text in unbound-anchor man page.

	1 October 2012: Wouter
	- ignore trusted-keys globs that have no files (from Paul Wouters).

	27 September 2012: Wouter
	- include: directive in config file accepts wildcards. Patch from
	Paul Wouters. Suggested use: include: "/etc/unbound.d/conf.d/*"
	- unbound-control -q option is quiet, patch from Mariano Absatz.
	- iana portlist updated.
	- updated contrib/unbound.spec, patch from Valentin Bud.

	21 September 2012: Wouter
	- chdir to / after chroot call (suggested by Camiel Dobbelaar).

	17 September 2012: Wouter
	- patch_rsamd5_enable.diff: this patch enables RSAMD5 validation
	otherwise it is treated as insecure. The RSAMD5 algorithm is
	deprecated (RFC6725). The MD5 hash is considered weak for some
	purposes, if you want to sign your zone, then RSASHA256 is an
	uncontested hash.

	30 August 2012: Wouter
	- RFC6725 deprecates RSAMD5: this DNSKEY algorithm is disabled.
	- iana portlist updated.

	29 August 2012: Wouter
	- Nicer comments outgoing-port-avoid, thanks Stu (bug #465).

	22 August 2012: Wouter
	- Fallback to 1472 and 1232, one fragment size without headers.

	21 August 2012: Wouter
	- Fix timeouts so that when a server has been offline for a while
	and is probed to see it works, it becomes fully available for
	server selection again.

	17 August 2012: Wouter
	- Add documentation to libunbound for default nonuse of resolv.conf.

	2 August 2012: Wouter
	- trunk has 1.4.19 under development (fixes from 1 aug and 31 july
	are for 1.4.19).
	- iana portlist updated.

	1 August 2012: Wouter
	- Fix openssl race condition, initializes openssl locks, reported
	by Einar Lonn and Patrik Wallstrom.

	31 July 2012: Wouter
	- Improved forward-first and stub-first documentation.
	- Fix that enables modules to register twice for the same
	serviced_query, without race conditions or administration issues.
	This should not happen with the current codebase, but it is robust.
	- Fix forward-first option where it sets the RD flag wrongly.
	- added manpage links for libunbound calls (Thanks Paul Wouters).

	30 July 2012: Wouter
	- tag 1.4.18rc2 (became 1.4.18 release at 2 august 2012).

	27 July 2012: Wouter
	- unbound-host works with libNSS
	- fix bogus nodata cname chain not reported as bogus by validator,
	(Thanks Peter van Dijk).

	26 July 2012: Wouter
	- iana portlist updated.
	- tag 1.4.18rc1.

	25 July 2012: Wouter
	- review fix for libnss, check hash prefix allocation size.

	23 July 2012: Wouter
	- fix missing break for GOST DS hash function.
	- implemented forward_first for the root.

	20 July 2012: Wouter
	- Fix bug#452 and another assertion failure in mesh.c, makes
	assertions in mesh.c resist duplicates. Fixes DS NS search to
	not generate duplicate sub queries.

	19 July 2012: Willem
	- Fix bug#454: Remove ACX_CHECK_COMPILER_FLAG from configure.ac,
	if CFLAGS is specified at configure time then '-g -O2' is not
	appended to CFLAGS, so that the user can override them.

	18 July 2012: Willem
	- Fix libunbound report of errors when in background mode.

	11 July 2012: Willem
	- updated iana ports list.

	9 July 2012: Willem
	- Add flush_bogus option for unbound-control

	6 July 2012: Wouter
	- Fix validation of qtype DS queries that result in no data for
	non-optout NSEC3 zones.

	4 July 2012: Wouter
	- compile libunbound with libnss on Suse, passes regression tests.

	3 July 2012: Wouter
	- FIPS_mode openssl does not use arc4random but RAND_pseudo_bytes.

	2 July 2012: Wouter
	- updated iana ports list.

	29 June 2012: Wouter
	- patch for unbound_munin_ script to handle arbitrary thread count by
	Sven Ulland.

	28 June 2012: Wouter
	- detect if openssl has FIPS_mode.
	- code review: return value of cache_store can be ignored for better
	performance in out of memory conditions.
	- fix edns-buffer-size and msg-buffer-size manpage documentation.
	- updated iana ports list.

	25 June 2012: Wouter
	- disable RSAMD5 if in FIPS mode (for openssl and for libnss).

	22 June 2012: Wouter
	- implement DS records, NSEC3 and ECDSA for compile with libnss.

	21 June 2012: Wouter
	- fix error handling of alloc failure during rrsig verification.
	- nss check for verification failure.
	- nss crypto works for RSA and DSA.

	20 June 2012: Wouter
	- work on --with-nss build option (for now, --with-libunbound-only).

	19 June 2012: Wouter
	- --with-libunbound-only build option, only builds the library and
	not the daemon and other tools.

	18 June 2012: Wouter
	- code review.

	15 June 2012: Wouter
	- implement log-time-ascii on windows.
	- The key-cache bad key ttl is now 60 seconds.
	- updated iana ports list.
	- code review.

	11 June 2012: Wouter
	- bug #452: fix crash on assert in mesh_state_attachment.

	30 May 2012: Wouter
	- silence warning from swig-generated code (md set but not used in
	swig initmodule, due to ifdefs in swig-generated code).

	27 May 2012: Wouter
	- Fix debian-bugs-658021: Please enable hardened build flags.

	25 May 2012: Wouter
	- updated iana ports list.

	24 May 2012: Wouter
	- tag for 1.4.17 release.
	- trunk is 1.4.18 in development.

	18 May 2012: Wouter
	- Review comments, removed duplicate memset to zero in delegpt.

	16 May 2012: Wouter
	- Updated doc/FEATURES with RFCs that are implemented but not listed.
	- Protect if statements in val_anchor for compile without locks.
	- tag for 1.4.17rc1.

	15 May 2012: Wouter
	- fix configure ECDSA support in ldns detection for windows compile.
	- fix possible uninitialised variable in windows pipe implementation.

	9 May 2012: Wouter
	- Fix alignment problem in util/random on sparc64/freebsd.

	8 May 2012: Wouter
	- Fix for accept spinning reported by OpenBSD.
	- iana portlist updated.

	2 May 2012: Wouter
	- Fix validation of nodata for DS query in NSEC zones, reported by
	Ondrej Mikle.

	13 April 2012: Wouter
	- ECDSA support (RFC 6605) by default. Use --disable-ecdsa for older
	openssl.

	10 April 2012: Wouter
	- Applied patch from Daisuke HIGASHI for rrset-roundrobin and
	minimal-responses features.
	- iana portlist updated.

	5 April 2012: Wouter
	- fix bug #443: --with-chroot-dir not honoured by configure.
	- fix bug #444: setusercontext was called too late (thanks Bjorn
	Ketelaars).

	27 March 2012: Wouter
	- fix bug #442: Fix that Makefile depends on pythonmod headers
	even using --without-pythonmodule.

	22 March 2012: Wouter
	- contrib/validation-reporter follows rotated log file (patch from
	Augie Schwer).

	21 March 2012: Wouter
	- new approach to NS fetches for DS lookup that works with
	cornercases, and is more robust and considers forwarders.

	19 March 2012: Wouter
	- iana portlist updated.
	- fix to locate nameservers for DS lookup with NS fetches.

	16 March 2012: Wouter
	- Patch for access to full DNS packet data in unbound python module
	from Ondrej Mikle.

	9 March 2012: Wouter
	- Applied line-buffer patch from Augie Schwer to validation.reporter.sh.

	2 March 2012: Wouter
	- flush_infra cleans timeouted servers from the cache too.
	- removed warning from --enable-ecdsa.

	1 March 2012: Wouter
	- forward-first option. Tries without forward if a query fails.
	Also stub-first option that is similar.

	28 February 2012: Wouter
	- Fix from code review, if EINPROGRESS not defined chain if statement
	differently.

	27 February 2012: Wouter
	- Fix bug#434: on windows check registry for config file location
	for unbound-control.exe, and unbound-checkconf.exe.

	23 February 2012: Wouter
	- Fix to squelch 'network unreachable' errors from tcp connect in
	logs, high verbosity will show them.

	16 February 2012: Wouter
	- iter_hints is now thread-owned in module env, and thus threadsafe.
	- Fix prefetch and sticky NS, now the prefetch works. It picks
	nameservers that 'would be valid in the future', and if this makes
	the NS timeout, it updates that NS by asking delegation from the
	parent again. If child NS has longer TTL, that TTL does not get
	refreshed from the lookup to the child nameserver.

	15 February 2012: Wouter
	- Fix forward-zone memory, uses malloc and frees original root dp.
	- iter hints (stubs) uses malloc inside for more dynamicity.
	- unbound-control forward_add, forward_remove, stub_add, stub_remove
	can modify stubs and forwards for running unbound (on mobile computer)
	they can also add and remove domain-insecure for the zone.

	14 February 2012: Wouter
	- Fix sticky NS (ghost domain problem) if prefetch is yes.
	- iter forwards uses malloc inside for more dynamicity.

	13 February 2012: Wouter
	- RT#2955. Fix for cygwin compilation.
	- iana portlist updated.

	10 February 2012: Wouter
	- Slightly smaller critical region in one case in infra cache.
	- Fix timeouts to keep track of query type, A, AAAA and other, if
	another has caused timeout blacklist, different type can still probe.
	- unit test fix for nomem_cnametopos.rpl race condition.

	9 February 2012: Wouter
	- Fix AHX_BROKEN_MEMCMP for autoheader mess up of #undef in config.h.

	8 February 2012: Wouter
	- implement draft-ietf-dnsext-ecdsa-04; which is in IETF LC; This
	implementation is experimental at this time and not recommended
	for use on the public internet (the protocol numbers have not
	been assigned). Needs recent ldns with --enable-ecdsa.
	- fix memory leak in errorcase for DSA signatures.
	- iana portlist updated.
	- workaround for openssl 0.9.8 ecdsa sha2 and evp problem.

	3 February 2012: Wouter
	- fix for windows, rename() is not posix compliant on windows.

	2 February 2012: Wouter
	- 1.4.16 release tag.
	- svn trunk is 1.4.17 in development.
	- iana portlist updated.

	1 February 2012: Wouter
	- Fix validation failures (like: validation failure xx: no NSEC3
	closest encloser from yy for DS zz. while building chain of trust,
	because of a bug in the TTL-fix in 1.4.15, it picked the wrong rdata
	for an NSEC3. Now it does not change rdata, and fixes TTL.

	30 January 2012: Wouter
	- Fix version-number in libtool to be version-info so it produces
	libunbound.so.2 like it should.

	26 January 2012: Wouter
	- Tag 1.4.15 (same as 1.4.15rc1), for 1.4.15 release.
	- trunk 1.4.16; includes changes memset testcode, #424 openindiana,
	and keyfile write fixup.
	- applied patch to support outgoing-interface with ub_ctx_set_option.

	23 January 2012: Wouter
	- Fix memset in test code.

	20 January 2012: Wouter
	- Fix bug #424: compile on OpenIndiana OS with gcc 4.6.2.

	19 January 2012: Wouter
	- Fix to write key files completely to a temporary file, and if that
	succeeds, replace the real key file. So failures leave a useful file.

	18 January 2012: Wouter
	- tag 1.4.15rc1 created
	- updated libunbound/ubsyms.def and remade tag 1.4.15rc1.

	17 January 2012: Wouter
	- Fix bug where canonical_compare of RRSIG did not downcase the
	signer-name. This is mostly harmless because RRSIGs do not have
	to be sorted in canonical order, usually.

	12 January 2012: Wouter
	- bug#428: add ub_version() call to libunbound. API version increase,
	with (binary) backwards compatibility for the previous version.

	10 January 2012: Wouter
	- Fix bug #425: unbound reports wrong TTL in reply, it reports a TTL
	that would be permissible by the RFCs but it is not the TTL in the
	cache.
	- iana portlist updated.
	- uninitialised variable in reprobe for rtt blocked domains fixed.
	- lintfix and new flex output.

	2 January 2012: Wouter
	- Fix to randomize hash function, based on 28c3 congress, reported
	by Peter van Dijk.

	24 December 2011: Wouter
	- Fix for memory leak (about 20 bytes when a tcp or udp send operation
	towards authority servers failed, takes about 50.000 such failures to
	leak one Mb, such failures are also usually logged), reported by
	Robert Fleischmann.
	- iana portlist updated.

	19 December 2011: Wouter
	- Fix for VU#209659 CVE-2011-4528: Unbound denial of service
	vulnerabilities from nonstandard redirection and denial of existence
	http://www.unbound.net/downloads/CVE-2011-4528.txt
	- robust checks for next-closer NSEC3s.
	- tag 1.4.14 created.
	- trunk has 1.4.15 in development.

	15 December 2011: Wouter
	- remove uninit warning from cachedump code.
	- Fix parse error on negative SOA RRSIGs if badly ordered in the packet.

	13 December 2011: Wouter
	- iana portlist updated.
	- svn tag 1.4.14rc1
	- fix infra cache comparison.
	- Fix to constrain signer_name to be a parent of the lookupname.

	5 December 2011: Wouter
	- Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc.
	- Fix warnings with gcc 4.6 in compat/inet_ntop.c.
	- Fix warning unused in compat/strptime.c.
	- Fix malloc detection and double definition.

	2 December 2011: Wouter
	- configure generated with autoconf 2.68.

	30 November 2011: Wouter
	- Fix for tcp-upstream and ssl-upstream for if a laptop sleeps, causes
	SERVFAILs. Also fixed for UDP (but less likely).

	28 November 2011: Wouter
	- Fix quartile time estimate, it was too low, (thanks Jan Komissar).
	- iana ports updated.

	11 November 2011: Wouter
	- Makefile compat with SunOS make, BSD make and GNU make.
	- iana ports updated.

	10 November 2011: Wouter
	- Makefile changed for BSD make compatibility.

	9 November 2011: Wouter
	- added unit test for SSL service and SSL-upstream.

	8 November 2011: Wouter
	- can configure ssl service to one port number, and not on others.
	- fixup windows compile with ssl support.
	- Fix double free in unbound-host, reported by Steve Grubb.
	- iana portlist updated.

	1 November 2011: Wouter
	- dns over ssl support as a client, ssl-upstream yes turns it on.
	It performs an SSL transaction for every DNS query (250 msec).
	- documentation for new options: ssl-upstream, ssl-service-key and
	ssl-service.pem.
	- iana portlist updated.
	- fix -flto detection on Lion for llvm-gcc.

	31 October 2011: Wouter
	- dns over ssl support, ssl-service-pem and ssl-service-key files
	can be given and then TCP queries are serviced wrapped in SSL.

	27 October 2011: Wouter
	- lame-ttl and lame-size options no longer exist, it is integrated
	with the host info. They are ignored (with verbose warning) if
	encountered to keep the config file backwards compatible.
	- fix iana-update for changing gzip compression of results.
	- fix export-all-symbols on OSX.

	26 October 2011: Wouter
	- iana portlist updated.
	- Infra cache stores information about ping and lameness per IP, zone.
	This fixes bug #416.
	- fix iana_update target for gzipped file on iana site.

	24 October 2011: Wouter
	- Fix resolve of partners.extranet.microsoft.com with a fix for the
	server selection for choosing out of a (particular) list of bad
	choices. (bug#415)
	- Fix make_new_space function so that the incoming query is not
	overwritten if a jostled out query causes a waiting query to be
	resumed that then fails and sends an error message. (Thanks to
	Matthew Lee).

	21 October 2011: Wouter
	- fix --enable-allsymbols, fptr wlist is disabled on windows with this
	option enabled because of memory layout exe vs dll.

	19 October 2011: Wouter
	- fix unbound-anchor for broken strptime on OSX lion, detected
	in configure.
	- Detect if GOST really works, openssl1.0 on OSX fails.
	- Implement ipv6%interface notation for scope_id usage.

	17 October 2011: Wouter
	- better documentation for inform_super (Thanks Yang Zhe).

	14 October 2011: Wouter
	- Fix for out-of-memory condition in libunbound (thanks
	Robert Fleischman).

	13 October 2011: Wouter
	- Fix --enable-allsymbols, it depended on link specifics of the
	target platform, or fptr_wlist assertion failures could occur.

	12 October 2011: Wouter
	- updated contrib/unbound_munin_ to family=auto so that it works with
	munin-node-configure automatically (if installed as
	/usr/local/share/munin/plugins/unbound_munin_ ).

	27 September 2011: Wouter
	- unbound.exe -w windows option for start and stop service.

	23 September 2011: Wouter
	- TCP-upstream calculates tcp-ping so server selection works if there
	are alternatives.

	20 September 2011: Wouter
	- Fix classification of NS set in answer section, where there is a
	parent-child server, and the answer has the AA flag for dir.slb.com.
	Thanks to Amanda Constant from Secure64.

	16 September 2011: Wouter
	- fix bug #408: accept patch from Steve Snyder that comments out
	unused functions in lookup3.c.
	- iana portlist updated.
	- fix EDNS1480 change memleak and TCP fallback.
	- fix various compiler warnings (reported by Paul Wouters).
	- max sent count. EDNS1480 only for rtt < 5000. No promiscuous
	fetch if sentcount > 3, stop query if sentcount > 16. Count is
	reset when referral or CNAME happens. This makes unbound better
	at managing large NS sets, they are explored when there is continued
	interest (in the form of queries).

	15 September 2011: Wouter
	- release 1.4.13.
	- trunk contains 1.4.14 in development.
	- Unbound probes at EDNS1480 if there an EDNS0 timeout.

	12 September 2011: Wouter
	- Reverted dns EDNS backoff fix, it did not help and needs
	fragmentation fixes instead.
	- tag 1.4.13rc2

	7 September 2011: Wouter
	- Fix operation in ipv6 only (do-ip4: no) mode.

	6 September 2011: Wouter
	- fedora specfile updated.

	5 September 2011: Wouter
	- tag 1.4.13rc1

	2 September 2011: Wouter
	- iana portlist updated.

	26 August 2011: Wouter
	- Fix num-threads 0 does not segfault, reported by Simon Deziel.
	- Fix validation failures due to EDNS backoff retries, the retry
	for fetch of data has want_dnssec because the iter_indicate_dnssec
	function returns true when validation failure retry happens, and
	then the serviced query code does not fallback to noEDNS, even if
	the cache says it has this. This helps for DLV deployment when
	the DNSSEC status is not known for sure before the lookup concludes.

	24 August 2011: Wouter
	- Applied patch from Karel Slany that fixes a memory leak in the
	unbound python module, in string conversions.

	22 August 2011: Wouter
	- Fix validation of qtype ANY responses with CNAMEs (thanks Cathy
	Zhang and Luo Ce). Unbound responds with the RR types that are
	available at the name for qtype ANY and validates those RR types.
	It does not test for completeness (i.e. with NSEC or NSEC3 query),
	and it does not follow the CNAME or DNAME to another name (with
	even more data for the already large response).
	- Fix that internally, CNAMEs with NXDOMAIN have that as rcode.
	- Documented the options that work with control set_option command.
	- tcp-upstream yes/no option (works with set_option) for tunnels.

	18 August 2011: Wouter
	- fix autoconf call in makedist crosscompile to RC or snapshot.

	17 August 2011: Wouter
	- Fix validation of . DS query.
	- new xml format at IANA, new awk for iana_update.
	- iana portlist updated.

	10 August 2011: Wouter
	- Fix python site-packages path to /usr/lib64.
	- updated patch from Tom.
	- fix memory and fd leak after out-of-memory condition.

	9 August 2011: Wouter
	- patch from Tom Hendrikx fixes load of python modules.

	8 August 2011: Wouter
	- make clean had ldns-src reference, removed.

	1 August 2011: Wouter
	- Fix autoconf 2.68 warnings

	14 July 2011: Wouter
	- Unbound implements RFC6303 (since version 1.4.7).
	- tag 1.4.12rc1 is released as 1.4.12 (without the other fixes in the
	meantime, those are for 1.4.13).
	- iana portlist updated.

	13 July 2011: Wouter
	- Quick fix for contrib/unbound.spec example, no ldns-builtin any more.

	11 July 2011: Wouter
	- Fix wildcard expansion no-data reply under an optout NSEC3 zone is
	validated as insecure, reported by Jia Li (lijia@cnnic.cn).

	4 July 2011: Wouter
	- 1.4.12rc1 tag created.

	1 July 2011: Wouter
	- version number in example config file.
	- fix that --enable-static-exe does not complain about it unknown.

	30 June 2011: Wouter
	- tag relase 1.4.11, trunk is 1.4.12 development.
	- iana portlist updated.
	- fix bug#395: id bits of other query may leak out under conditions
	- fix replyaddr count wrong after jostled queries, which leads to
	eventual starvation where the daemon has no replyaddrs left to use.
	- fix comment about rndc port, that referred to the old port number.
	- fix that the listening socket is not closed when too many remote
	control connections are made at the same time.
	- removed ldns-src tarball inside the unbound tarball.

	23 June 2011: Wouter
	- Changed -flto check to support clang compiler.
	- tag 1.4.11rc3 created.

	17 June 2011: Wouter
	- tag 1.4.11rc1 created.
	- remove warning about signed/unsigned from flex (other flex version).
	- updated aclocal.m4 and libtool to match.
	- tag 1.4.11rc2 created.

	16 June 2011: Wouter
	- log-queries: yesno option, default is no, prints querylog.
	- version is 1.4.11.

	14 June 2011: Wouter
	- Use -flto compiler flag for link time optimization, if supported.
	- iana portlist updated.

	12 June 2011: Wouter
	- IPv6 service address for d.root-servers.net (2001:500:2D::D).

	10 June 2011: Wouter
	- unbound-control has version number in the header,
	UBCT[version]_space_ is the header sent by the client now.
	- Unbound control port number is registered with IANA:
	ub-dns-control 8953/tcp unbound dns nameserver control
	This is the new default for the control-port config setting.
	- statistics-interval prints the number of jostled queries to log.

	30 May 2011: Wouter
	- Fix Makefile for U in environment, since wrong U is more common than
	deansification necessity.
	- iana portlist updated.
	- updated ldns tarball to 1.6.10rc2 snapshot of today.

	25 May 2011: Wouter
	- Fix assertion failure when unbound generates an empty error reply
	in response to a query, CVE-2011-1922 VU#531342.
	- This fix is in tag 1.4.10.
	- defense in depth against the above bug, an error is printed to log
	instead of an assertion failure.

	10 May 2011: Wouter
	- bug#386: --enable-allsymbols option links all binaries to libunbound
	and reduces install size significantly.
	- feature, ignore-cd-flag: yesno to provide dnssec to legacy servers.
	- iana portlist updated.
	- Fix TTL of SOA so negative TTL is separately cached from normal TTL.

	14 April 2011: Wouter
	- configure created with newer autoconf 2.66.

	12 April 2011: Wouter
	- bug#378: Fix that configure checks for ldns_get_random presence.

	8 April 2011: Wouter
	- iana portlist updated.
	- queries with CD flag set cause DNSSEC validation, but the answer is
	not withheld if it is bogus. Thus, unbound will retry if it is bad
	and curb the TTL if it is bad, thus protecting the cache for use by
	downstream validators.
	- val-override-date: -1 ignores dates entirely, for NTP usage.

	29 March 2011: Wouter
	- harden-below-nxdomain: changed so that it activates when the
	cached nxdomain is dnssec secure. This avoids backwards
	incompatibility because those old servers do not have dnssec.

	24 March 2011: Wouter
	- iana portlist updated.
	- release 1.4.9.
	- trunk is 1.5.0

	17 March 2011: Wouter
	- bug#370: new unbound.spec for CentOS 5.x from Harold Jones.
	Applied but did not do the --disable-gost.

	10 March 2011: Wouter
	- tag 1.4.9 release candidate 1 created.

	3 March 2011: Wouter
	- updated ldns to today.

	1 March 2011: Wouter
	- Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout.
	- give config parse error for multiple names on a stub or forward zone.
	- updated ldns tarball to 1.6.9(todays snapshot).

	24 February 2011: Wouter
	- bug #361: Fix, time.elapsed variable not reset with stats_noreset.

	23 February 2011: Wouter
	- iana portlist updated.
	- common.sh to version 3.

	18 February 2011: Wouter
	- common.sh in testdata updated to version 2.

	15 February 2011: Wouter
	- Added explicit note on unbound-anchor usage:
	Please note usage of unbound-anchor root anchor is at your own risk
	and under the terms of our LICENSE (see that file in the source).

	11 February 2011: Wouter
	- iana portlist updated.
	- tpkg updated with common.sh for common functionality.

	7 February 2011: Wouter
	- Added regression test for addition of a .net DS to the root, and
	cache effects with different TTL for glue and DNSKEY.
	- iana portlist updated.

	28 January 2011: Wouter
	- Fix remove private address does not throw away entire response.

	24 January 2011: Wouter
	- release 1.4.8

	19 January 2011: Wouter
	- fix bug#349: no -L/usr for ldns.

	18 January 2011: Wouter
	- ldns 1.6.8 tarball included.
	- release 1.4.8rc1.

	17 January 2011: Wouter
	- add get and set option for harden-below-nxdomain feature.
	- iana portlist updated.

	14 January 2011: Wouter
	- Fix so a changed NS RRset does not get moved name stuck on old
	server, for type NS the TTL is not increased.

	13 January 2011: Wouter
	- Fix prefetch so it does not get stuck on old server for moved names.

	12 January 2011: Wouter
	- iana portlist updated.

	11 January 2011: Wouter
	- Fix insecure CNAME sequence marked as secure, reported by Bert
	Hubert.

	10 January 2011: Wouter
	- faster lruhash get_mem routine.

	4 January 2011: Wouter
	- bug#346: remove ITAR scripts from contrib, the service is discontinued, use the root.
	- iana portlist updated.

	23 December 2010: Wouter
	- Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept.

	21 December 2010: Wouter
	- algorithm compromise protection using the algorithms signalled in
	the DS record. Also, trust anchors, DLV, and RFC5011 receive this,
	and thus, if you have multiple algorithms in your trust-anchor-file
	then it will now behave different than before. Also, 5011 rollover
	for algorithms needs to be double-signature until the old algorithm
	is revoked.
	It is not an option, because I see no use to turn the security off.
	- iana portlist updated.

	17 December 2010: Wouter
	- squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them).
	- fix validation in this case: CNAME to nodata for co-hosted opt-in
	NSEC3 insecure delegation, was bogus, fixed to be insecure.

	16 December 2010: Wouter
	- Fix our 'BDS' license (typo reported by Xavier Belanger).

	10 December 2010: Wouter
	- iana portlist updated.
	- review changes for unbound-anchor.

	2 December 2010: Wouter
	- feature typetransparent localzone, does not block other RR types.

	1 December 2010: Wouter
	- Fix bug#338: print address when socket creation fails.

	30 November 2010: Wouter
	- Fix storage of EDNS failures in the infra cache.
	- iana portlist updated.

	18 November 2010: Wouter
	- harden-below-nxdomain option, default off (because very old
	software may be incompatible). We could enable it by default in
	the future.

	17 November 2010: Wouter
	- implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN.
	- make test output nicer.

	15 November 2010: Wouter
	- silence 'tcp connect: broken pipe' and 'net down' at low verbosity.
	- iana portlist updated.
	- so-sndbuf option for very busy servers, a bit like so-rcvbuf.

	9 November 2010: Wouter
	- unbound-anchor compiles with openssl 0.9.7.

	8 November 2010: Wouter
	- release tag 1.4.7.
	- trunk is version 1.4.8.
	- Be lenient and accept imgw.pl malformed packet (like BIND).

	5 November 2010: Wouter
	- do not synthesize a CNAME message from cache for qtype DS.

	4 November 2010: Wouter
	- Use central entropy to seed threads.

	3 November 2010: Wouter
	- Change the rtt used to probe EDNS-timeout hosts to 1000 msec.

	2 November 2010: Wouter
	- tag 1.4.7rc1.
	- code review.

	1 November 2010: Wouter
	- GOST code enabled by default (RFC 5933).

	27 October 2010: Wouter
	- Fix uninit value in dump_infra print.
	- Fix validation failure for parent and child on same server with an
	insecure childzone and a CNAME from parent to child.
	- Configure detects libev-4.00.

	26 October 2010: Wouter
	- dump_infra and flush_infra commands for unbound-control.
	- no timeout backoff if meanwhile a query succeeded.
	- Change of timeout code. No more lost and backoff in blockage.
	At 12sec timeout (and at least 2x lost before) one probe per IP
	is allowed only. At 120sec, the IP is blocked. After 15min, a
	120sec entry has a single retry packet.

	25 October 2010: Wouter
	- Configure errors if ldns is not found.

	22 October 2010: Wouter
	- Windows 7 fix for the installer.

	21 October 2010: Wouter
	- Fix bug where fallback_tcp causes wrong roundtrip and edns
	observation to be noted in cache. Fix bug where EDNSprobe halted
	exponential backoff if EDNS status unknown.
	- new unresponsive host method, exponentially increasing block backoff.
	- iana portlist updated.

	20 October 2010: Wouter
	- interface automatic works for some people with ip6 disabled.
	Therefore the error check is removed, so they can use the option.

	19 October 2010: Wouter
	- Fix for request list growth, if a server has long timeout but the
	lost counter is low, then its effective rtt is the one without
	exponential backoff applied. Because the backoff is not working.
	The lost counter can then increase and the server is blacklisted,
	or the lost counter does not increase and the server is working
	for some queries.

	18 October 2010: Wouter
	- iana portlist updated.

	13 October 2010: Wouter
	- Fix TCP so it uses a random outgoing-interface.
	- unbound-anchor handles ADDPEND keystate.

	11 October 2010: Wouter
	- Fix bug when DLV below a trust-anchor that uses NSEC3 optout where
	the zone has a secure delegation hosted on the same server did not
	verify as secure (it was insecure by mistake).
	- iana portlist updated.
	- ldns tarball updated (for reading cachedumps with bad RR data).

	1 October 2010: Wouter
	- test for unbound-anchor. fix for reading certs.
	- Fix alloc_reg_release for longer uptime in out of memory conditions.

	28 September 2010: Wouter
	- unbound-anchor working, it creates or updates a root.key file.
	Use it before you start the validator (e.g. at system boot time).

	27 September 2010: Wouter
	- iana portlist updated.

	24 September 2010: Wouter
	- bug#329: in example.conf show correct ipv4 link-local 169.254/16.

	23 September 2010: Wouter
	- unbound-anchor app, unbound requires libexpat (xml parser library).

	22 September 2010: Wouter
	- compliance with draft-ietf-dnsop-default-local-zones-14, removed
	reverse ipv6 orchid prefix from builtin list.
	- iana portlist updated.

	17 September 2010: Wouter
	- DLV has downgrade protection again, because the RFC says so.
	- iana portlist updated.

	16 September 2010: Wouter
	- Algorithm rollover operational reality intrudes, for trust-anchor,
	5011-store, and DLV-anchor if one key matches it's good enough.
	- iana portlist updated.
	- Fix reported validation error in out of memory condition.

	15 September 2010: Wouter
	- Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout.

	14 September 2010: Wouter
	- increased mesh-max-activation from 1000 to 3000 for crazy domains
	like _tcp.slb.com with 262 servers.
	- iana portlist updated.

	13 September 2010: Wouter
	- bug#327: Fix for cannot access stub zones until the root is primed.

	9 September 2010: Wouter
	- unresponsive servers are not completely blacklisted (because of
	firewalls), but also not probed all the time (because of the request
	list size it generates). The probe rate is 1%.
	- iana portlist updated.

	20 August 2010: Wouter
	- openbsd-lint fixes: acl_list_get_mem used if debug-alloc enabled.
	iterator get_mem includes priv_get_mem. delegpt nodup removed.
	listen_pushback, query_info_allocqname, write_socket, send_packet,
	comm_point_set_cb_arg and listen_resume removed.

	19 August 2010: Wouter
	- Fix bug#321: resolution of rs.ripe.net artifacts with 0x20.
	Delegpt structures checked for duplicates always.
	No more nameserver lookups generated when depth is full anyway.
	- example.conf notes how to do DNSSEC validation and track the root.
	- iana portlist updated.

	18 August 2010: Wouter
	- Fix bug#322: configure does not respect CFLAGS on Solaris.
	Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line
	if use sun-cc, but some systems need different flags.

	16 August 2010: Wouter
	- Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP
	changes, uses m4_bpatsubst now.
	- make test (or make check) should be more portable and run the unit
	test and testbound scripts. (make longtest has special requirements).

	13 August 2010: Wouter
	- More pleasant remote control command parsing.
	- documentation added for return values reported by doxygen 1.7.1.
	- iana portlist updated.

	9 August 2010: Wouter
	- Fix name of rrset printed that failed validation.

	5 August 2010: Wouter
	- Return NXDOMAIN after chain of CNAMEs ends at name-not-found.

	4 August 2010: Wouter
	- Fix validation in case a trust anchor enters into a zone with
	unsupported algorithms.

	3 August 2010: Wouter
	- updated ldns tarball with bugfixes.
	- release tag 1.4.6.
	- trunk becomes 1.4.7 develop.
	- iana portlist updated.

	22 July 2010: Wouter
	- more error details on failed remote control connection.

	15 July 2010: Wouter
	- rlimit adjustments for select and ulimit can happen at the same time.

	14 July 2010: Wouter
	- Donation text added to README.
	- Fix integer underflow in prefetch ttl creation from cache. This
	fixes a potential negative prefetch ttl.

	12 July 2010: Wouter
	- Changed the defaults for num-queries-per-thread/outgoing-range.
	For builtin-select: 512/960, for libevent 1024/4096 and for
	windows 24/48 (because of win api). This makes the ratio this way
	to improve resilience under heavy load. For high performance, use
	libevent and possibly higher numbers.

	10 July 2010: Wouter
	- GOST enabled if SSL is recent and ldns has GOST enabled too.
	- ldns tarball updated.

	9 July 2010: Wouter
	- iana portlist updated.
	- Fix validation of qtype DNSKEY when a key-cache entry exists but
	no rr-cache entry is used (it expired or prefetch), it then goes
	back up to the DS or trust-anchor to validate the DNSKEY.

	7 July 2010: Wouter
	- Neat function prototypes, unshadowed local declarations.

	6 July 2010: Wouter
	- failure to chown the pidfile is not fatal any more.
	- testbound uses UTC timezone.
	- ldns tarball updated (ports and works on Minix 3.1.7). On Minix, add
	/usr/gnu/bin to PATH, use ./configure AR=/usr/gnu/bin/gar and gmake.

	5 July 2010: Wouter
	- log if a server is skipped because it is on the donotquery list,
	at verbosity 4, to enable diagnosis why no queries to 127.0.0.1.
	- added feature to print configure date, target and options with -h.
	- added feature to print event backend system details with -h.
	- wdiff is not actually required by make test, updated requirements.

	1 July 2010: Wouter
	- Fix RFC4035 compliance with 2.2 statement that the DNSKEY at apex
	must be signed with all algorithms from the DS rrset at the parent.
	This is now checked and becomes bogus if not.

	28 June 2010: Wouter
	- Fix jostle list bug found by Vince (luoce@cnnic), it caused the qps
	in overload situations to be about 5 qps for the class of shortly
	serviced queries.
	The capacity of the resolver is then about (numqueriesperthread / 2)
	/ (average time for such long queries) qps for long queries.
	And about (numqueriesperthread / 2)/(jostletimeout in whole seconds)
	qps for short queries, per thread.
	- Fix the max number of reply-address count to be applied for duplicate
	queries, and not for new query list entries. This raises the memory
	usage to a max of (16+1)*numqueriesperthread reply addresses.

	25 June 2010: Wouter
	- Fix handling of corner case reply from lame server, follows rfc2308.
	It could lead to a nodata reply getting into the cache if the search
	for a non-lame server turned up other misconfigured servers.
	- unbound.h has extern "C" statement for easier include in c++.

	23 June 2010: Wouter
	- iana portlist updated.
	- makedist upgraded cross compile openssl option, like this:
	./makedist.sh -s -wssl openssl-1.0.0a.tar.gz -w --enable-gost

	22 June 2010: Wouter
	- Unbound reports libev or libevent correctly in logs in verbose mode.
	- Fix to unload gost dynamic library module for leak testing.

	18 June 2010: Wouter
	- iana portlist updated.

	17 June 2010: Wouter
	- Add AAAA to root hints for I.ROOT-SERVERS.NET.

	16 June 2010: Wouter
	- Fix assertion failure reported by Kai Storbeck from XS4ALL, the
	assertion was wrong.
	- updated ldns tarball.

	15 June 2010: Wouter
	- tag 1.4.5 created.
	- trunk contains 1.4.6 in development.
	- Fix TCPreply on systems with no writev, if just 1 byte could be sent.
	- Fix to use one pointer less for iterator query state store_parent_NS.
	- makedist crosscompile to windows uses builtin ldns not host ldns.
	- Max referral count from 30 to 130, because 128 one character domains
	is valid DNS.
	- added documentation for the histogram printout to syslog.

	11 June 2010: Wouter
	- When retry to parent the retrycount is not wiped, so failed
	nameservers are not tried again.
	- iana portlist updated.

	10 June 2010: Wouter
	- Fix bug where a long loop could be entered, now cycle detection
	has a loop-counter and maximum search amount.

	4 June 2010: Wouter
	- iana portlist updated.
	- 1.4.5rc1 tag created.

	3 June 2010: Wouter
	- ldns tarball updated, 1.6.5.
	- review comments, split dependency cycle tracking for parentside
	last resort lookups for A and AAAA so there are more lookup options.

	2 June 2010: Wouter
	- Fix compile warning if compiled without threads.
	- updated ldns-tarball with current ldns svn (pre 1.6.5).
	- GOST disabled-by-default, the algorithm number is allocated but the
	RFC is still has to pass AUTH48 at the IETF.

	1 June 2010: Wouter
	- Ignore Z flag in incoming messages too.
	- Fix storage of negative parent glue if that last resort fails.
	- libtoolize 2.2.6b, autoconf 2.65 applied to configure.
	- new splint flags for newer splint install.

	31 May 2010: Wouter
	- Fix AD flag handling, it could in some cases mistakenly copy the AD
	flag from upstream servers.
	- alloc_special_obtain out of memory is not a fatal error any more,
	enabling unbound to continue longer in out of memory conditions.
	- parentside names are dispreferred but not said to be dnssec-lame.
	- parentside check for cached newname glue.
	- fix parentside and querytargets modulestate, for dump_requestlist.
	- unbound-control-setup makes keys -rw-r--- so not all users permitted.
	- fix parentside from cache to be marked dispreferred for bad names.

	28 May 2010: Wouter
	- iana portlist updated.
	- parent-child disagreement approach altered. Older fixes are
	removed in place of a more exhaustive search for misconfigured data
	available via the parent of a delegation.
	This is designed to be throttled by cache entries, with TTL from the
	parent if possible. Additionally the loop-counter is used.
	It also tests for NS RRset differences between parent and child.
	The fetch of misconfigured data should be more reliable and thorough.
	It should work reliably even with no or only partial data in cache.
	Data received from the child (as always) is deemed more
	authoritative than information received from the delegation parent.
	The search for misconfigured data is not performed normally.

	26 May 2010: Wouter
	- Contribution from Migiel de Vos (Surfnet): nagios patch for
	unbound-host, in contrib/ (in the source tarball). Makes
	unbound-host suitable for monitoring dnssec(-chain) status.

	21 May 2010: Wouter
	- EDNS timeout code will not fire if EDNS status already known.
	- EDNS failure not stored if EDNS status known to work.

	19 May 2010: Wouter
	- Fix resolution for domains like safesvc.com.cn. If the iterator
	can not recurse further and it finds the delegation in a state
	where it would otherwise have rejected it outhand if so received
	from a cache lookup, then it can try to ask higherup (with loop
	protection).
	- Fix comments in iter_utils:dp_is_useless.

	18 May 2010: Wouter
	- Fix various compiler warnings from the clang llvm compiler.
	- iana portlist updated.

	6 May 2010: Wouter
	- Fix bug#308: spelling error in variable name in parser and lexer.

	4 May 2010: Wouter
	- Fix dnssec-missing detection that was turned off by server selection.
	- Conforms to draft-ietf-dnsop-default-local-zones-13. Added default
	reverse lookup blocks for IPv4 test nets 100.51.198.in-addr.arpa,
	113.0.203.in-addr.arpa and Orchid prefix 0.1.1.0.0.2.ip6.arpa.

	29 April 2010: Wouter
	- Fix for dnssec lameness detection to use the key cache.
	- infra cache entries that are expired are wiped clean. Previously
	it was possible to not expire host data (if accessed often).

	28 April 2010: Wouter
	- ldns tarball updated and GOST support is detected and then enabled.
	- iana portlist updated.
	- Fix detection of gost support in ldns (reported by Chris Smith).

	27 April 2010: Wouter
	- unbound-control get_option domain-insecure shows config file items.
	- fix retry sequence if prime hints are recursion-lame.
	- autotrust anchor file can be initialized with a ZSK key as well.
	- harden-referral-path does not result in failures due to max-depth.
	You can increase the max-depth by adding numbers (' 0') after the
	target-fetch-policy, this increases the depth to which is checked.

	26 April 2010: Wouter
	- Compile fix using Sun Studio 12 compiler on Solaris 5.9, use
	CPPFLAGS during configure process.
	- if libev is installed on the base system (not libevent), detect
	it from the event.h header file and link with -lev.
	- configlexer.lex gets config.h, and configyyrename.h added by make,
	no more double include.
	- More strict scrubber (Thanks to George Barwood for the idea):
	NS set must be pertinent to the query (qname subdomain nsname).
	- Fix bug#307: In 0x20 backoff fix fallback so the number of
	outstanding queries does not become -1 and block the request.
	Fixed handling of recursion-lame in combination with 0x20 fallback.
	Fix so RRsets are compared canonicalized and sorted if the immediate
	comparison fails, this makes it work around round-robin sites.

	23 April 2010: Wouter
	- Squelch log message: sendto failed permission denied for
	255.255.255.255, it is visible in VERB_DETAIL (verbosity 2).
	- Fix to fetch data as last resort more tenaciously. When cycle
	targets cause the server selection to believe there are more options
	when they really are not there, the server selection is reinitiated.
	- Fix fetch from blacklisted dnssec lame servers as last resort. The
	server's IP address is then given in validator errors as well.
	- Fix local-zone type redirect that did not use the query name for
	the answer rrset.

	22 April 2010: Wouter
	- tag 1.4.4.
	- trunk contains 1.4.5 in development.
	- Fix validation failure for qtype ANY caused by a RRSIG parse failure.
	The validator error message was 'no signatures from ...'.

	16 April 2010: Wouter
	- more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN.
	- tag 1.4.4rc1.

	15 April 2010: Wouter
	- ECC-GOST algorithm number 12 that is assigned by IANA. New test
	example key and signatures for GOST. GOST requires openssl-1.0.0.
	GOST is still disabled by default.

	9 April 2010: Wouter
	- Fix bug#305: pkt_dname_tolower could read beyond end of buffer or
	get into an endless loop, if 0x20 was enabled, and buffers are small
	or particular broken packets are received.
	- Fix chain of trust with CNAME at an intermediate step, for the DS
	processing proof.

	8 April 2010: Wouter
	- Fix validation of queries with wildcard names (*.example).

	6 April 2010: Wouter
	- Fix EDNS probe for .de DNSSEC testbed failure, where the infra
	cache timeout coincided with a server update, the current EDNS
	backoff is less sensitive, and does not cache the backoff unless
	the backoff actually works and the domain is not expecting DNSSEC.
	- GOST support with correct algorithm numbers.

	1 April 2010: Wouter
	- iana portlist updated.

	24 March 2010: Wouter
	- unbound control flushed items are not counted when flushed again.

	23 March 2010: Wouter
	- iana portlist updated.

	22 March 2010: Wouter
	- unbound-host disables use-syslog from config file so that the
	config file for the main server can be used more easily.
	- fix bug#301: unbound-checkconf could not parse interface
	'0.0.0.0@5353', even though unbound itself worked fine.

	19 March 2010: Wouter
	- fix fwd_ancil test to pass if the socket options are not supported.

	18 March 2010: Wouter
	- Fixed random numbers for port, interface and server selection.
	Removed very small bias.
	- Refer to the listing in unbound-control man page in the extended
	statistics entry in the unbound.conf man page.

	16 March 2010: Wouter
	- Fix interface-automatic for OpenBSD: msg.controllen was too small,
	also assertions on ancillary data buffer.
	- check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO.
	- for NSEC3 check if signatures are cached.

	15 March 2010: Wouter
	- unit test for util/regional.c.

	12 March 2010: Wouter
	- Reordered configure checks so fork and -lnsl -lsocket checks are
	earlier, and thus later checks benefit from and do not hinder them.
	- iana portlist updated.
	- ldns tarball updated.
	- Fix python use when multithreaded.
	- Fix solaris python compile.
	- Include less in config.h and include per code file for ldns, ssl.

	11 March 2010: Wouter
	- another memory allocation option: --enable-alloc-nonregional.
	exposes the regional allocations to other memory purifiers.
	- fix for memory alignment in struct sock_list allocation.
	- Fix for MacPorts ldns without ssl default, unbound checks if ldns
	has dnssec functionality and uses the builtin if not.
	- Fix daemonize on Solaris 10, it did not detach from terminal.
	- tag 1.4.3 created.
	- trunk is 1.4.4 in development.
	- spelling fix in validation error involving cnames.

	10 March 2010: Wouter
	- --enable-alloc-lite works with test set.
	- portability in the testset: printf format conversions, prototypes.

	9 March 2010: Wouter
	- tag 1.4.2 created.
	- trunk is 1.4.3 in development.
	- --enable-alloc-lite debug option.

	8 March 2010: Wouter
	- iana portlist updated.

	4 March 2010: Wouter
	- Fix crash in control channel code.

	3 March 2010: Wouter
	- better casts in pipe code, brackets placed wrongly.
	- iana portlist updated.

	1 March 2010: Wouter
	- make install depends on make all.
	- Fix 5011 auto-trust-anchor-file initial read to skip RRSIGs.
	- --enable-checking: enables assertions but does not look nonproduction.
	- nicer VERB_DETAIL (verbosity 2, unbound-host -d) output, with
	nxdomain and nodata distinguished.
	- ldns tarball updated.
	- --disable-rpath fixed for libtool not found errors.
	- new fedora specfile from Fedora13 in contrib from Paul Wouters.

	26 February 2010: Wouter
	- Fixup prototype for lexer cleanup in daemon code.
	- unbound-control list_stubs, list_forwards, list_local_zones and
	list_local_data.

	24 February 2010: Wouter
	- Fix scrubber bug that potentially let NS records through. Reported
	by Amanda Constant.
	- Also delete potential poison references from additional.
	- Fix: no classification of a forwarder as lame, throw away instead.

	23 February 2010: Wouter
	- libunbound ub_ctx_get_option() added.
	- unbound-control set_option and get_option commands.
	- iana portlist updated.

	18 February 2010: Wouter
	- A little more strict DS scrubbing.
	- No more blacklisting of unresponsive servers, a 2 minute timeout
	is backed off to.
	- RD flag not enabled for dnssec-blacklisted tries, unless necessary.
	- pickup ldns compile fix, libdl for libcrypto.
	- log 'tcp connect: connection timed out' only in high verbosity.
	- unbound-control log_reopen command.
	- moved get_option code from unbound-checkconf to util/config_file.c

	17 February 2010: Wouter
	- Disregard DNSKEY from authority section for chain of trust.
	DS records that are irrelevant to a referral scrubbed. Anti-poison.
	- iana portlist updated.

	16 February 2010: Wouter
	- Check for 'no space left on device' (or other errors) when
	writing updated autotrust anchors and print errno to log.

	15 February 2010: Wouter
	- Fixed the requery protection, the TTL was 0, it is now 900 seconds,
	hardcoded. We made the choice to send out more conservatively,
	protecting against an aggregate effect more than protecting a
	single user (from their own folly, perhaps in case of misconfig).

	12 February 2010: Wouter
	- Re-query pattern changed on validation failure. To protect troubled
	authority servers, unbound caches a failure for the DNSKEY or DS
	records for the entire zone, and only retries that 900 seconds later.
	This implies that only a handful of packets are sent extra to the
	authority if the zone fails.

	11 February 2010: Wouter
	- ldns tarball update for long label length syntax error fix.
	- iana portlist updated.

	9 February 2010: Wouter
	- Fixup in compat snprintf routine, %f 1.02 and %g support.
	- include math.h for testbound test compile portability.

	2 February 2010: Wouter
	- Updated url of IANA itar, interim trust anchor repository, in script.

	1 February 2010: Wouter
	- iana portlist updated.
	- configure test for memcmp portability.

	27 January 2010: Wouter
	- removed warning on format string in validator error log statement.
	- iana portlist updated.

	22 January 2010: Wouter
	- libtool finish the install of unbound python dynamic library.

	21 January 2010: Wouter
	- acx_nlnetlabs.m4 synchronised with nsd's version.

	20 January 2010: Wouter
	- Fixup lookup trouble for parent-child domains on the first query.

	14 January 2010: Wouter
	- Fixup ldns detection to also check for header files.

	13 January 2010: Wouter
	- prefetch-key option that performs DNSKEY queries earlier in the
	validation process, and that could halve the latency on DNSSEC
	queries. It takes some extra processing (CPU, a cache is needed).

	12 January 2010: Wouter
	- Fix unbound-checkconf for auto-trust-anchor-file present checks.

	8 January 2010: Wouter
	- Fix for parent-child disagreement code which could have trouble
	when (a) ipv6 was disabled and (b) the TTL for parent and child
	were different. There were two bugs, the parent-side information
	is fixed to no longer block lookup of child side information and
	the iterator is fixed to no longer attempt to get ipv6 when it is
	not enabled and then give up in failure.
	- test and fixes to make prefetch actually store the answer in the
	cache. Considers some rrsets 'already expired' but does not allow
	overwriting of rrsets considered more secure.

	7 January 2010: Wouter
	- Fixup python documentation (thanks Leo Vandewoestijne).
	- Work on cache prefetch feature.
	- Stats for prefetch, in log print stats, unbound-control stats
	and in unbound_munin plugin.

	6 January 2010: Wouter
	- iana portlist updated.
	- bug#291: DNS wireformat max is 255. dname_valid allowed 256 length.
	- verbose output includes parent-side-address notion for lameness.
	- documented val-log-level: 2 setting in example.conf and man page.
	- change unbound-control-setup from 1024(sha1) to 1536(sha256).

	1 January 2010: Wouter
	- iana portlist updated.

	22 December 2009: Wouter
	- configure with newer libtool 2.2.6b.

	17 December 2009: Wouter
	- review comments.
	- tag 1.4.1.
	- trunk to version 1.4.2.

	15 December 2009: Wouter
	- Answer to qclass=ANY queries, with class IN contents.
	Test that validation also works.
	- updated ldns snapshot tarball with latest fixes (parsing records).

	11 December 2009: Wouter
	- on IPv4 UDP turn off DF flag.

	10 December 2009: Wouter
	- requirements.txt updated with design choice explanations.
	- Reading fixes: fix to set unlame when child confirms parent glue,
	and fix to avoid duplicate addresses in delegation point.
	- verify_rrsig routine checks expiration last.

	9 December 2009: Wouter
	- Fix Bug#287(reopened): update of ldns tarball with fix for parse
	errors generated for domain names like '.example.com'.
	- Fix SOA excluded from negative DS responses. Reported by Hauke
	Lampe. The negative cache did not include proper SOA records for
	negative qtype DS responses which makes BIND barf on it, such
	responses are now only used internally.
	- Fix negative cache lookup of closestencloser check of DS type bit.

	8 December 2009: Wouter
	- Fix for lookup of parent-child disagreement domains, where the
	parent-side glue works but it does not provide proper NS, A or AAAA
	for itself, fixing domains such as motorcaravanners.eu.
	- Feature: you can specify a port number in the interface: line, so
	you can bind the same interface multiple times at different ports.

	7 December 2009: Wouter
	- Bug#287: Fix segfault when unbound-control remove nonexistent local
	data. Added check to tests.

	1 December 2009: Wouter
	- Fix crash with module-config "iterator".
	- Added unit test that has "iterator" module-config.

	30 November 2009: Wouter
	- bug#284: fix parse of # without end-of-line at end-of-file.

	26 November 2009: Wouter
	- updated ldns with release candidate for version 1.6.3.
	- tag for 1.4.0 release.
	- 1.4.1 version in trunk.
	- Fixup major libtool version to 2 because of why_bogus change.
	It was 1:5:0 but should have been 2:0:0.

	23 November 2009: Wouter
	- Patch from David Hubbard for libunbound manual page.
	- Fixup endless spinning in unbound-control stats reported by
	Attila Nagy. Probably caused by clock reversal.

	20 November 2009: Wouter
	- contrib/split-itar.sh contributed by Tom Hendrikx.

	19 November 2009: Wouter
	- better argument help for unbound-control.
	- iana portlist updated.

	17 November 2009: Wouter
	- noted multiple entries for multiple domain names in example.conf.
	- iana portlist updated.

	16 November 2009: Wouter
	- Fixed signer detection of CNAME responses without signatures.
	- Fix#282 libunbound memleak on error condition by Eric Sesterhenn.
	- Tests for CNAMEs to deeper trust anchors, secure and bogus.
	- svn tag 1.4.0rc1 made.

	13 November 2009: Wouter
	- Fixed validation failure for CNAME to optout NSEC3 nodata answer.
	- unbound-host does not fail on type ANY.
	- Fixed wireparse failure to put RRSIGs together with data in some
	long ANY mix cases, which fixes validation failures.

	12 November 2009: Wouter
	- iana portlist updated.
	- fix manpage errors reported by debian lintian.
	- review comments.
	- fixup very long vallog2 level error strings.

	11 November 2009: Wouter
	- ldns tarball updated (to 1.6.2).
	- review comments.

	10 November 2009: Wouter
	- Thanks to Surfnet found bug in new dnssec-retry code that failed
	to combine well when combined with DLV and a particular failure.
	- Fixed unbound-control -h output about argument optionality.
	- review comments.

	5 November 2009: Wouter
	- lint fixes and portability tests.
	- better error text for multiple domain keys in one autotrust file.

	2 November 2009: Wouter
	- Fix bug where autotrust does not work when started with a DS.
	- Updated GOST unit tests for unofficial algorithm number 249
	and DNSKEY-format changes in draft version -01.

	29 October 2009: Wouter
	- iana portlist updated.
	- edns-buffer-size option, default 4096.
	- fixed do-udp: no.

	28 October 2009: Wouter
	- removed abort on prealloc failure, error still printed but softfail.
	- iana portlist updated.
	- RFC 5702: RSASHA256 and RSASHA512 support enabled by default.
	- ldns tarball updated (which also enables rsasha256 support).

	27 October 2009: Wouter
	- iana portlist updated.

	8 October 2009: Wouter
	- please doxygen
	- add val-log-level print to corner case (nameserver.epost.bg).
	- more detail to errors from insecure delegation checks.
	- Fix double time subtraction in negative cache reported by
	Amanda Constant and Hugh Mahon.
	- Made new validator error string available from libunbound for
	applications. It is in result->why_bogus, a zero-terminated string.
	unbound-host prints it by default if a result is bogus.
	Also the errinf is public in module_qstate (for other modules).

	7 October 2009: Wouter
	- retry for validation failure in DS and prime results. Less mem use.
	unit test. Provisioning in other tests for requeries.
	- retry for validation failure in DNSKEY in middle of chain of trust.
	unit test.
	- retry for empty non terminals in chain of trust and unit test.
	- Fixed security bug where the signatures for NSEC3 records were not
	checked when checking for absence of DS records. This could have
	enabled the substitution of an insecure delegation.
	- moved version number to 1.4.0 because of 1.3.4 release with only
	the NSEC3 patch from the entry above.
	- val-log-level: 2 shows extended error information for validation
	failures, but still one (longish) line per failure. For example:
	validation failure <example.com. DNSKEY IN>: signature expired from
	192.0.2.4 for trust anchor example.com. while building chain of trust
	validation failure <www.example.com. A IN>: no signatures from
	192.0.2.6 for key example.com. while building chain of trust

	6 October 2009: Wouter
	- Test set updated to provide additional ns lookup result.
	The retry would attempt to fetch the data from other nameservers
	for bogus data, and this needed to be provisioned in the tests.

	5 October 2009: Wouter
	- first validation failure retry code. Retries for data failures.
	And unit test.

	2 October 2009: Wouter
	- improve 5011 modularization.
	- fix unbound-host so -d can be given before -C.
	- iana portlist updated.

	28 September 2009: Wouter
	- autotrust-anchor-file can read multiline input and $ORIGIN.
	- prevent integer overflow in holddown calculation. review fixes.
	- fixed race condition in trust point revocation. review fix.
	- review fixes to comments, removed unused code.

	25 September 2009: Wouter
	- so-rcvbuf: 4m option added. Set this on large busy servers to not
	drop the occasional packet in spikes due to full socket buffers.
	netstat -su keeps a counter of UDP dropped due to full buffers.
	- review of validator/autotrust.c, small fixes and comments.

	23 September 2009: Wouter
	- 5011 query failed counts verification failures, not lookup failures.
	- 5011 probe failure handling fixup.
	- test unbound reading of original autotrust data.
	The metadata per-key, such as key state (PENDING, MISSING, VALID) is
	picked up, otherwise performs initial probe like usual.

	22 September 2009: Wouter
	- autotrust test with algorithm rollover, new ordering of checks
	assists in orderly rollover.
	- autotrust test with algorithm rollover to unknown algorithm.
	checks if new keys are supported before adding them.
	- autotrust test with trust point revocation, becomes unsigned.
	- fix DNSSEC-missing-signature detection for minimal responses
	for qtype DNSKEY (assumes DNSKEY occurs at zone apex).

	18 September 2009: Wouter
	- autotrust tests, fix trustpoint timer deletion code.
	fix count of valid anchors during missing remove.
	- autotrust: pick up REVOKE even if not signed with known other keys.

	17 September 2009: Wouter
	- fix compile of unbound-host when --enable-alloc-checks.
	- Fix lookup problem reported by Koh-ichi Ito and Jaap Akkerhuis.
	- Manual page fixes reported by Tony Finch.

	16 September 2009: Wouter
	- Fix memory leak reported by Tao Ma.
	- Fix memstats test tool for log-time-ascii log format.

	15 September 2009: Wouter
	- iana portlist updated.

	10 September 2009: Wouter
	- increased MAXSYSLOGLEN so .bg key can be printed in debug output.
	- use linebuffering for log-file: output, this can be significantly
	faster than the previous fflush method and enable some class of
	resolvers to use high verbosity (for short periods).
	Not on windows, because line buffering does not work there.

	9 September 2009: Wouter
	- Fix bug where DNSSEC-bogus messages were marked with too high TTL.
	The RRsets would still expire at the normal time, but this would
	keep messages bogus in the cache for too long.
	- regression test for that bug.
	- documented that load_cache is meant for debugging.

	8 September 2009: Wouter
	- fixup printing errors when load_cache, they were printed to the
	SSL connection which broke, now to the log.
	- new ldns - with fixed parse of large SOA values.

	7 September 2009: Wouter
	- autotrust testbound scenarios.
	- autotrust fix that failure count is written to file.
	- autotrust fix that keys may become valid after add holddown time
	alone, before the probe returns.

	4 September 2009: Wouter
	- Changes to make unbound work with libevent-2.0.3 alpha. (in
	configure detection due to new ssl dependency in libevent)
	- do not call sphinx for documentation when python is disabled.
	- remove EV_PERSIST from libevent timeout code to make the code
	compatible with the libevent-2.0. Works with older libevent too.
	- fix memory leak in python code.

	3 September 2009: Wouter
	- Got a patch from Luca Bruno for libunbound support on windows to
	pick up the system resolvconf nameservers and hosts there.
	- included ldns updated (enum warning fixed).
	- makefile fix for parallel makes.
	- Patch from Zdenek Vasicek and Attila Nagy for using the source IP
	from python scripts. See pythonmod/examples/resip.py.
	- doxygen comment fixes.

	2 September 2009: Wouter
	- TRAFFIC keyword for testbound. Simplifies test generation.
	${range lower val upper} to check probe timeout values.
	- test with 5011-prepublish rollover and revocation.
	- fix revocation of RR for autotrust, stray exclamation mark.

	1 September 2009: Wouter
	- testbound variable arithmetic.
	- autotrust probe time is randomised.
	- autotrust: the probe is active and does not fetch from cache.

	31 August 2009: Wouter
	- testbound variable processing.

	28 August 2009: Wouter
	- fixup unbound-control lookup to print forward and stub servers.

	27 August 2009: Wouter
	- autotrust: mesh answer callback is empty.

	26 August 2009: Wouter
	- autotrust probing.
	- iana portlist updated.

	25 August 2009: Wouter
	- fixup memleak in trust anchor unsupported algorithm check.
	- iana portlist updated.
	- autotrust options: add-holddown, del-holddown, keep-missing.
	- autotrust store revoked status of trust points.
	- ctime_r compat definition.
	- detect yylex_destroy() in configure.
	- detect SSL_get_compression_methods declaration in configure.
	- fixup DS lookup at anchor point with unsigned parent.
	- fixup DLV lookup for DS queries to unsigned domains.

	24 August 2009: Wouter
	- cleaner memory allocation on exit. autotrust test routines.
	- free all memory on program exit, fix for ssl and flex.

	21 August 2009: Wouter
	- autotrust: debug routines. Read,write and conversions work.

	20 August 2009: Wouter
	- autotrust: save and read trustpoint variables.

	19 August 2009: Wouter
	- autotrust: state table updates.
	- iana portlist updated.

	17 August 2009: Wouter
	- autotrust: process events.

	17 August 2009: Wouter
	- Fix so that servers are only blacklisted if they fail to reply
	to 16 queries in a row and the timeout gets above 2 minutes.
	- autotrust work, split up DS verification of DNSKEYs.

	14 August 2009: Wouter
	- unbound-control lookup prints out infra cache information, like RTT.
	- Fix bug in DLV lookup reported by Amanda from Secure64.
	It could sometimes wrongly classify a domain as unsigned, which
	does not give the AD bit on replies.

	13 August 2009: Wouter
	- autotrust read anchor files. locked trust anchors.

	12 August 2009: Wouter
	- autotrust import work.

	11 August 2009: Wouter
	- Check for openssl compatible with gost if enabled.
	- updated unit test for GOST=211 code.
	Nicer naming of test files.
	- iana portlist updated.

	7 August 2009: Wouter
	- call OPENSSL_config() in unbound and unit test so that the
	operator can use openssl.cnf for configuration options.
	- removed small memory leak from config file reader.

	6 August 2009: Wouter
	- configure --enable-gost for GOST support, experimental
	implementation of draft-dolmatov-dnsext-dnssec-gost-01.
	- iana portlist updated.
	- ldns tarball updated (with GOST support).

	5 August 2009: Wouter
	- trunk moved to 1.3.4.

	4 August 2009: Wouter
	- Added test that the examples from draft rsasha256-14 verify.
	- iana portlist updated.
	- tagged 1.3.3

	3 August 2009: Wouter
	- nicer warning when algorithm not supported, tells you to upgrade.
	- iana portlist updated.

	27 July 2009: Wouter
	- Updated unbound-cacti contribution from Dmitriy Demidov, with
	the queue statistics displayed in its own graph.
	- iana portlist updated.

	22 July 2009: Wouter
	- Fix bug found by Michael Tokarev where unbound would try to
	prime the root servers even though forwarders are configured for
	the root.
	- tagged 1.3.3rc1

	21 July 2009: Wouter
	- Fix server selection, so that it waits for open target queries when
	faced with lameness.

	20 July 2009: Wouter
	- Ignore transient sendto errors, no route to host, and host, net down.
	- contrib/update-anchor.sh has -r option for root-hints.
	- feature val-log-level: 1 prints validation failures so you can
	keep track of them during dnssec deployment.

	16 July 2009: Wouter
	- fix replacement malloc code. Used in crosscompile.
	- makedist -w creates crosscompiled setup.exe on fedora11.

	15 July 2009: Wouter
	- dependencies for compat items, for crosscompile.
	- mingw32 crosscompile changes, dependencies and zipfile creation.
	and with System.dll from the windows NSIS you can make setup.exe.
	- package libgcc_s_sjlj exception handler for NSISdl.dll.

	14 July 2009: Wouter
	- updated ldns tarball for solaris x64 compile assistance.
	- no need to define RAND_MAX from config.h.
	- iana portlist updated.
	- configure changes and ldns update for mingw32 crosscompile.

	13 July 2009: Wouter
	- Fix for crash at start on windows.
	- tag for release 1.3.2.
	- trunk has version 1.3.3.
	- Fix for ID bits on windows to use all 16. RAND_MAX was not
	defined like you'd expect on mingw. Reported by Mees de Roo.

	9 July 2009: Wouter
	- tag for release 1.3.1.
	- trunk has version 1.3.2.

	7 July 2009: Wouter
	- iana portlist updated.

	6 July 2009: Wouter
	- prettier error handling in SSL setup.
	- makedist.sh uname fix (same as ldns).
	- updated fedora spec file.

	3 July 2009: Wouter
	- fixup linking when ldnsdir is "".

	30 June 2009: Wouter
	- more lenient truncation checks.

	29 June 2009: Wouter
	- ldns trunk r2959 imported as tarball, because of solaris cc compile
	support for c99. r2960 for better configure.
	- better wrongly_truncated check.
	- On Linux, fragment IPv6 datagrams to the IPv6 minimum MTU, to
	avoid dropped packets at routers.

	26 June 2009: Wouter
	- Fix EDNS fallback when EDNS works for short answers but long answers
	are dropped.

	22 June 2009: Wouter
	- fixup iter priv strict aliasing while preserving size of sockaddr.
	- iana portlist updated. (one less port allocated, one more fraction
	of a bit for security!)
	- updated fedora specfile in contrib from Paul Wouters.

	19 June 2009: Wouter
	- Fixup strict aliasing warning in iter priv code.
	and config_file code.
	- iana portlist updated.
	- harden-referral-path: handle cases where NS is in answer section.

	18 June 2009: Wouter
	- Fix of message parse bug where (specifically) an NSEC and RRSIG
	in the wrong order would be parsed, but put wrongly into internal
	structures so that later validation would fail.
	- Extreme lenience for wrongly truncated replies where a positive
	reply has an NS in the authority but no signatures. They are
	turned into minimal responses with only the (secure) answer.
	- autoconf 2.63 for configure.
	- python warnings suppress. Keep python API away from header files.

	17 June 2009: Wouter
	- CREDITS entry for cz.nic, sponsoring a 'summer of code' that was
	used for the python code in unbound. (http://www.nic.cz/vip/ in cz).

	16 June 2009: Wouter
	- Fixup opportunistic target query generation to it does not
	generate queries that are known to fail.
	- Touchup on munin total memory report.
	- messages picked out of the cache by the iterator are checked
	if their cname chain is still correct and if validation status
	has to be reexamined.

	15 June 2009: Wouter
	- iana portlist updated.

	14 June 2009: Wouter
	- Fixed bug where cached responses would lose their security
	status on second validation, which especially impacted dlv
	lookups. Reported by Hauke Lampe.

	13 June 2009: Wouter
	- bug #254. removed random whitespace from example.conf.

	12 June 2009: Wouter
	- Fixup potential wrong NSEC picked out of the cache.
	- If unfulfilled callbacks are deleted they are called with an error.
	- fptr wlist checks for mesh callbacks.
	- fwd above stub in configuration works.

	11 June 2009: Wouter
	- Fix queries for type DS when forward or stub zones are there.
	They are performed to higherup domains, and thus treated as if
	going to higher zones when looking up the right forward or stub
	server. This makes a stub pointing to a local server that has
	a local view of example.com signed with the same keys as are
	publicly used work. Reported by Johan Ihren.
	- Added build-unbound-localzone-from-hosts.pl to contrib, from
	Dennis DeDonatis. It converts /etc/hosts into config statements.
	- same thing fixed for forward-zone and DS, chain of trust from
	public internet into the forward-zone works now. Added unit test.

	9 June 2009: Wouter
	- openssl key files are opened apache-style, when user is root and
	before chrooting. This makes permissions on remote-control key
	files easier to set up. Fixes bug #251.
	- flush_type and flush_name remove msg cache entries.
	- codereview - dp copy bogus setting fix.

	8 June 2009: Wouter
	- Removed RFC5011 REVOKE flag support. Partial 5011 support may cause
	inadvertant behaviour.
	- 1.3.0 tarball for release created.
	- 1.3.1 development in svn trunk.
	- iana portlist updated.
	- fix lint from complaining on ldns/sha.h.
	- help compiler figure out aliasing in priv_rrset_bad() routine.
	- fail to configure with python if swig is not found.
	- unbound_munin_ in contrib uses ps to show rss if sbrk does not work.

	3 June 2009: Wouter
	- fixup bad free() when wrongly encoded DSA signature is seen.
	Reported by Paul Wouters.
	- review comments from Matthijs.

	2 June 2009: Wouter
	- --enable-sha2 option. The draft rsasha256 changed its algorithm
	numbers too often. Therefore it is more prudent to disable the
	RSASHA256 and RSASHA512 support by default.
	- ldns trunk included as new tarball.
	- recreated the 1.3.0 tag in svn. rc1 tarball generated at this point.

	29 May 2009: Wouter
	- fixup doc bug in README reported by Matthew Dempsky.

	28 May 2009: Wouter
	- update iana port list
	- update ldns lib tarball

	27 May 2009: Wouter
	- detect lack of IPv6 support on XP (with a different error code).
	- Fixup a crash-on-exit which was triggered by a very long queue.
	Unbound would try to re-use ports that came free, but this is
	of course not really possible because everything is deleted.
	Most easily triggered on XP (not Vista), maybe because of the
	network stack encouraging large messages backlogs.
	- change in debug statements.
	- Fixed bug that could cause a crash if root prime failed when there
	were message backlogs.

	26 May 2009: Wouter
	- Thanks again to Brett Carr, found an assertion that was not true.
	Assertion checked if recursion parent query still existed.

	29 April 2009: Wouter
	- Thanks to Brett Carr, caught windows resource leak, use
	closesocket() and not close() on sockets or else the network stack
	starts to leak handles.
	- Removed usage of windows Mutex because windows cannot handle enough
	mutexes open. Provide own mutex implementation using primitives.

	28 April 2009: Wouter
	- created svn tag for 1.3.0.

	27 April 2009: Wouter
	- optimised cname from cache.
	- ifdef windows functions in testbound.

	23 April 2009: Wouter
	- fix for threadsafety in solaris thr_key_create() in tests.
	- iana portlist updated.
	- fix pylib test for Darwin.
	- fix pymod test for Darwin and a python threading bug in pymod init.
	- check python >= 2.4 in configure.
	- -ldl check for libcrypto 1.0.0beta.

	21 April 2009: Wouter
	- fix for build outside sourcedir.
	- fix for configure script swig detection.

	17 April 2009: Wouter
	- Fix reentrant in minievent handler for unix. Could have resulted
	in spurious event callbacks.
	- timers do not take up a fd slot for winsock handler.
	- faster fix for winsock reentrant check.
	- fix rsasha512 unit test for new (interim) algorithm number.
	- fix test:ldns doesn't like DOS line endings in keyfiles on unix.
	- fix compile warning on ubuntu (configlexer fwrite return value).
	- move python include directives into CPPFLAGS instead of CFLAGS.

	16 April 2009: Wouter
	- winsock event handler exit very quickly on signal, even if
	under heavy load.
	- iana portlist updated.
	- fixup windows winsock handler reentrant problem.

	14 April 2009: Wouter
	- bug #245: fix munin plugin, perform cleanup of stale lockfiles.
	- makedist.sh; better help text.
	- cache-min-ttl option and tests.
	- mingw detect error condition on TCP sockets (NOTCONN).

	9 April 2009: Wouter
	- Fix for removal of RSASHA256_NSEC3 protonumber from ldns.
	- ldns tarball updated.
	- iana portlist update.
	- detect GOST support in openssl-1.0.0-beta1, and fix compile problem
	because that openssl defines the name STRING for itself.

	6 April 2009: Wouter
	- windows compile fix.
	- Detect FreeBSD jail without ipv6 addresses assigned.
	- python libunbound wrapper unit test.
	- installs the following files. Default is to not build them.
	from configure --with-pythonmodule:
	/usr/lib/python2.x/site-packages/unboundmodule.py
	from configure --with-pyunbound:
	/usr/lib/python2.x/site-packages/unbound.py
	/usr/lib/python2.x/site-packages/_unbound.so*
	The example python scripts (pythonmod/examples and
	libunbound/python/examples) are not installed.
	- python invalidate routine respects packed rrset ids and locks.
	- clock skew checks in unbound, config statements.
	- nxdomain ttl considerations in requirements.txt

	3 April 2009: Wouter
	- Fixed a bug that caused messages to be stored in the cache too
	long. Hard to trigger, but NXDOMAINs for nameservers or CNAME
	targets have been more vulnerable to the TTL miscalculation bug.
	- documentation test fixed for python addition.

	2 April 2009: Wouter
	- pyunbound (libunbound python plugin) compiles using libtool.
	- documentation for pythonmod and pyunbound is generated in doc/html.
	- iana portlist updated.
	- fixed bug in unbound-control flush_zone where it would not flush
	every message in the target domain. This especially impacted
	NXDOMAIN messages which could remain in the cache regardless.
	- python module test package.

	1 April 2009: Wouter
	- suppress errors when trying to contact authority servers that gave
	ipv6 AAAA records for their nameservers with ipv4 mapped contents.
	Still tries to do so, could work when deployed in intranet.
	Higher verbosity shows the error.
	- new libunbound calls documented.
	- pyunbound in libunbound/python. Removed compile warnings.
	Makefile to make it.

	30 March 2009: Wouter
	- Fixup LDFLAGS from libevent sourcedir compile configure restore.
	- Fixup so no non-absolute rpaths are added.
	- Fixup validation of RRSIG queries, they are let through.
	- read /dev/random before chroot
	- checkconf fix no python checks when no python module enabled.
	- fix configure, pthread first, so other libs do not change outcome.

	27 March 2009: Wouter
	- nicer -h output. report linked libraries and modules.
	- prints modules in intuitive order (config file friendly).
	- python compiles easily on BSD.

	26 March 2009: Wouter
	- ignore swig varargs warnings with gcc.
	- remove duplicate example.conf text from python example configs.
	- outofdir compile fix for python.
	- pyunbound works.
	- print modules compiled in on -h. manpage.

	25 March 2009: Wouter
	- initial import of the python contribution from Zdenek Vasicek and
	Marek Vavrusa.
	- pythonmod in Makefile; changes to remove warnings/errors for 1.3.0.

	24 March 2009: Wouter
	- more neat configure.ac. Removed duplicate config.h includes.
	- neater config.h.in.
	- iana portlist updated.
	- fix util/configlexer.c and solaris -std=c99 flag.
	- fix postcommit aclocal errors.
	- spaces stripped. Makefile cleaner, /usr omitted from -I, -L, -R.
	- swap order of host detect and libtool generation.

	23 March 2009: Wouter
	- added launchd plist example file for MacOSX to contrib.
	- deprecation test for daemon(3).
	- moved common configure actions to m4 include, prettier Makefile.

	20 March 2009: Wouter
	- bug #239: module-config entries order is important. Documented.
	- build fix for test asynclook.

	19 March 2009: Wouter
	- winrc/README.txt dos-format text file.
	- iana portlist updated.
	- use _beginthreadex() when available (performs stack alignment).
	- defaults for windows baked into configure.ac (used if on mingw).

	18 March 2009: Wouter
	- Added tests, unknown algorithms become insecure. fallback works.
	- Fix for and test for unknown algorithms in a trust anchor
	definition. Trust anchors with no supported algos are ignored.
	This means a (higher)DS or DLV entry for them could succeed, and
	otherwise they are treated as insecure.
	- domain-insecure: "example.com" statement added. Sets domain
	insecure regardless of chain of trust DSs or DLVs. The inverse
	of a trust-anchor.

	17 March 2009: Wouter
	- unit test for unsupported algorithm in anchor warning.
	- fixed so queries do not fail on opportunistic target queries.

	16 March 2009: Wouter
	- fixup diff error printout in contrib/update-itar.sh.
	- added contrib/unbound_cacti for statistics support in cacti,
	contributed by Dmitriy Demidov.

	13 March 2009: Wouter
	- doxygen and lex/yacc on linux.
	- strip update-anchor on makedist -w.
	- fix testbound on windows.
	- default log to syslog for windows.
	- uninstaller can stop unbound - changed text on it to reflect that.
	- remove debugging from windows 'cron' actions.

	12 March 2009: Wouter
	- log to App.logs on windows prints executable identity.
	- fixup tests.
	- munin plugin fix benign locking error printout.
	- anchor-update for windows, called every 24 hours; unbound reloads.

	11 March 2009: Wouter
	- winsock event handler resets WSAevents after signalled.
	- winsock event handler tests if signals are really signalled.
	- install and service with log to file works on XP and Vista on
	default install location.
	- on windows logging to the Application logbook works (as a service).
	- fix RUN_DIR on windows compile setting in makedist.
	- windows registry has Software\Unbound\ConfigFile element.
	If does not exist, the default is used. The -c switch overrides it.
	- fix makedist version cleanup function.

	10 March 2009: Wouter
	- makedist -w strips out old rc.. and snapshot info from version.
	- setup.exe starts and stops unbound after install, before uninstall.
	- unbound-checkconf recognizes absolute pathnames on windows (C:...).

	9 March 2009: Wouter
	- Nullsoft NSIS installer creation script.

	5 March 2009: Wouter
	- fixup memory leak introduced on 18feb in mesh reentrant fix.

	3 March 2009: Wouter
	- combined icon with 16x16(4) 32x32(4) 48x48(8) 64x64(8).
	- service works on xp/vista, no config necessary (using defaults).
	- windows registry settings.

	2 March 2009: Wouter
	- fixup --export-symbols to be -export-symbls for libtool.
	This should fix extraneous symbols exported from libunbound.
	Thanks to Ondrej Sury and Robert Edmonds for finding it.
	- iana portlist updated.
	- document FAQ entry on stub/forward zones and default blocking.
	- fix asynclook test app for libunbound not exporting symbols.
	- service install and remove utils that work with vista UAC.

	27 February 2009: Wouter
	- Fixup lexer, to not give warnings about fwrite. Appeared in
	new lexer features.
	- makedistro functionality for mingw. Has RC support.
	- support spaces and backslashes in configured defaults paths.
	- register, deregister in service control manager.

	25 February 2009: Wouter
	- windres usage for application resources.

	24 February 2009: Wouter
	- isc moved their dlv key download location.
	- fixup warning on vista/mingw.
	- makedist -w for window zip distribution first version.

	20 February 2009: Wouter
	- Fixup contrib/update-itar.sh, the exit codes 1 and 0 were swapped.
	Nicer script layout. Added url to site in -h output.

	19 February 2009: Wouter
	- unbound-checkconf and unbound print warnings when trust anchors
	have unsupported algorithms.
	- added contrib/update-itar.sh This script is similar to
	update-anchor.sh, and updates from the IANA ITAR repository.
	You can provide your own PGP key and trust repo, or can use the
	builtin. The program uses wget and gpg to work.
	- iana portlist updated.
	- update-itar.sh: using ftp:// urls because https godaddy certificate
	is not available everywhere and then gives fatal errors. The
	security is provided by pgp signature.

	18 February 2009: Wouter
	- more cycle detection. Also for target queries.
	- fixup bug where during deletion of the mesh queries the callbacks
	that were reentrant caused assertion failures. Keep the mesh in
	a reentrant safe state. Affects libunbound, reload of server,
	on quit and flush_requestlist.
	- iana portlist updated.

	13 February 2009: Wouter
	- forwarder information now per-thread duplicated.
	This keeps it read only for speed, with no locking necessary.
	- forward command for unbound control to change forwarders to use
	on the fly.
	- document that unbound-host reads no config file by default.
	- updated iana portlist.

	12 February 2009: Wouter
	- call setusercontext if available (on BSD).
	- small refactor of stats clearing.
	- #227: flush_stats feature for unbound-control.
	- stats_noreset feature for unbound-control.
	- flush_requestlist feature for unbound-control.
	- libunbound version upped API (was changed 5 feb).
	- unbound-control status shows if root forwarding is in use.
	- slightly nicer memory management in iter-fwd code.

	10 February 2009: Wouter
	- keys with rfc5011 REVOKE flag are skipped and not considered when
	validating data.
	- iana portlist updated
	- #226: dump_requestlist feature for unbound-control.

	6 February 2009: Wouter
	- contrib contains specfile for fedora 1.2.1 (from Paul Wouters).
	- iana portlist updated.
	- fixup EOL in include directive (reported by Paul Wouters).
	You can no longer specify newlines in the names of included files.
	- config parser changed. Gives some syntax errors closer to where they
	occurred. Does not enforce a space after keyword anymore.
	Does not allow literal newlines inside quoted strings anymore.
	- verbosity level 5 logs customer IP for new requestlist entries.
	- test fix, lexer and cancel test.
	- new option log-time-ascii: yes if you enable it prints timestamps
	in the log file as Feb 06 13:45:26 (like syslog does).
	- detect event_base_new in libevent-1.4.1 and later and use it.
	- #231 unbound-checkconf -o option prints that value from config file.
	Useful for scripting in management scripts and the like.

	5 February 2009: Wouter
	- ldns 1.5.0 rc as tarball included.
	- 1.3.0 development continues:
	change in libunbound API: ub_cancel can return an error, that
	the async_id did not exist, or that it was already delivered.
	The result could have been delivered just before the cancel
	routine managed to acquire the lock, so a caller may get the
	result at the same time they call cancel. For this case,
	ub_cancel tries to return an error code.
	Fixes race condition in ub_cancel() libunbound function.
	- MacOSX Leopard cleaner text output from configure.
	- initgroups(3) is called to drop secondary group permissions, if
	applicable.
	- configure option --with-ldns-builtin forces the use of the
	inluded ldns package with the unbound source. The -I include
	is put before the others, so it avoids bad include files from
	an older ldns install.
	- daemon(3) posix call is used when available.
	- testbound test for older fix added.

	4 February 2009: Wouter
	- tag for release 1.2.1.
	- trunk setup for 1.3.0 development.

	3 February 2009: Wouter
	- noted feature requests in doc/TODO.
	- printout more detailed errors on ssl certificate loading failures.
	- updated IANA portlist.

	16 January 2009: Wouter
	- more quiet about ipv6 network failures, i.e. when ipv6 is not
	available (network unreachable). Debug still printed on high
	verbosity.
	- unbound-host -4 and -6 options. Stops annoying ipv6 errors when
	debugging with unbound-host -4 -d ...
	- more cycle detection for NS-check, addr-check, root-prime and
	stub-prime queries in the iterator. Avoids possible deadlock
	when priming fails.

	15 January 2009: Wouter
	- bug #229: fixup configure checks for compilation with Solaris
	Sun cc compiler, ./configure CC=/opt/SUNWspro/bin/cc
	- fixup suncc warnings.
	- fix bug where unbound could crash using libevent 1.3 and older.
	- update testset for recent retry change.

	14 January 2009: Wouter
	- 1.2.1 feature: negative caching for failed queries.
	Queries that failed are cached for 5 seconds (NORR_TTL).
	If the failure is local, like out of memory, it is not cached.
	- the TTL comparison for the cache used different comparisons,
	causing many cache responses that used the iterator and validator
	state machines unnecessarily.
	- retry from 4 to 5 so that EDNS drop retry is part of the first
	query resolve attempt, and cached error does not stop EDNS fallback.
	- remove debug prints that protect against bad referrals.
	- honor QUIET=no on make commandline (or QUIET=yes ).

	13 January 2009: Wouter
	- fixed bug in lameness marking, removed printouts.
	- find NS rrset more cleanly for qtype NS.
	- Moved changes to 1.2.0 for release. Thanks to Mark Zealey for
	reporting and logs.
	- 1.2.1 feature: stops resolving AAAAs promiscuously when they
	are in the negative cache.

	12 January 2009: Wouter
	- fixed bug in infrastructure lameness cache, did not lowercase
	name of zone to hash when setting lame.
	- lameness debugging printouts.

	9 January 2009: Wouter
	- created svn tag for 1.2.0 release.
	- svn trunk contains 1.2.1 version number.
	- iana portlist updated for todays list.
	- removed debug print.

	8 January 2009: Wouter
	- new version of ldns-trunk (today) included as tarball, fixed
	bug #224, building with -j race condition.
	- remove possible race condition in the test for race conditions.

	7 January 2009: Wouter
	- version 1.2.0 in preparation.
	- feature to allow wildcards (*, ?, [], {}. ~) in trusted-keys-file
	statements. (Adapted from patch by Paul Wouters).
	- typo fix and iana portlist updated.
	- porting testsuite; unused var warning, and type fixup.

	6 January 2009: Wouter
	- fixup packet-of-death when compiled with --enable-debug.
	A malformed packet could cause an internal assertion failure.
	- added test for HINFO canonicalisation behaviour.
	- fixup reported problem with transparent local-zone data where
	queries with different type could get nxdomain. Now queries
	with a different name get resolved normally, with different type
	get a correct NOERROR/NODATA answer.
	- HINFO no longer downcased for validation, making unbound compatible
	with bind and ldns.
	- fix reading included config files when chrooted.
	Give full path names for include files.
	Relative path names work if the start dir equals the working dir.
	- fix libunbound message transport when no packet buffer is available.

	5 January 2009: Wouter
	- fixup getaddrinfo failure handling for remote control port.
	- added L.ROOT-SERVERS.NET. AAAA 2001:500:3::42 to builtin root hints.
	- fixup so it works with libev-3.51 from http://dist.schmorp.de/libev/
	- comm_timer_set performs base_set operation after event_add.

	18 December 2008: Wouter
	- fixed bug reported by Duane Wessels: error in DLV lookup, would make
	some zones that had correct DLV keys as insecure.
	- follows -rc makedist from ldns changes (no _rc).
	- ldns tarball updated with 1.4.1rc for DLV unit test.
	- verbose prints about recursion lame detection and server selection.
	- fixup BSD port for infra host storage. It hashed wrongly.
	- fixup makedist snapshot name generation.
	- do not reopen syslog to avoid dev/log dependency.

	17 December 2008: Wouter
	- follows ldns makedist.sh. -rc option. autom4te dir removed.
	- unbound-control status command.
	- extended statistics has a number of ipv6 queries counter.
	contrib/unbound_munin_ was updated to draw ipv6 in the hits graph.

	16 December 2008: Wouter
	- follow makedist improvements from ldns, for maintainers prereleases.
	- snapshot version uses _ not - to help rpm distinguish the
	version number.

	11 December 2008: Wouter
	- better fix for bug #219: use LOG_NDELAY with openlog() call.
	Thanks to Tamas Tevesz.

	9 December 2008: Wouter
	- bug #221 fixed: unbound checkconf checks if key files exist if
	remote control is enabled. Also fixed NULL printf when not chrooted.
	- iana portlist updated.

	3 December 2008: Wouter
	- Fix problem reported by Jaco Engelbrecht where unbound-control stats
	freezes up unbound if this was compiled without threading, and
	was using multiple processes.
	- iana portlist updated.
	- test for remote control with interprocess communication.
	- created command distribution mechanism so that remote control
	commands other than 'stats' work on all processes in a nonthreaded
	compiled version. dump/load cache work, on the first process.
	- fixup remote control local_data addition memory corruption bug.

	1 December 2008: Wouter
	- SElinux policy files in contrib/selinux for the unbound daemon,
	by Paul Wouters and Adam Tkac.

	25 November 2008: Wouter
	- configure complains when --without-ssl is given (bug #220).
	- skip unsupported feature tests on vista/mingw.
	- fixup testcode/streamtcp to work on vista/mingw.
	- root-hints test checks version of dig required.
	- blacklisted servers are polled at a low rate (1%) to see if they
	come back up. But not if there is some other working server.

	24 November 2008: Wouter
	- document that the user of the server daemon needs read privileges
	on the keys and certificates generated by unbound-control-setup.
	This is different per system or distribution, usually, running the
	script under the same username as the server uses suffices.
	i.e. sudo -u unbound unbound-control-setup
	- testset port to vista/mingw.
	- tcp_sigpipe to freebsd port.

	21 November 2008: Wouter
	- fixed tcp accept, errors were printed when they should not.
	- unbound-control-setup.sh removes read/write permissions other
	from the keys it creates (as suggested by Dmitriy Demidov).

	20 November 2008: Wouter
	- fixup fatal error due to faulty error checking after tcp accept.
	- add check in rlimit to avoid integer underflow.
	- rlimit check with new formula; better estimate for number interfaces
	- nicer comments in rlimit check.
	- tag 1.1.1 created in svn.
	- trunk label is 1.1.2

	19 November 2008: Wouter
	- bug #219: fixed so that syslog which delays opening until the first
	log line is written, gets a log line while not chroot'ed yet.

	18 November 2008: Wouter
	- iana portlist updated.
	- removed cast in unit test debug print that was not 64bit safe.
	- trunk back to 1.1.0; copied to tags 1.1.0 release.
	- trunk to has version number 1.1.1 again.
	- in 1.1.1; make clean nicer. grammar in manpage.

	17 November 2008: Wouter
	- theoretical fix for problems reported on mailing list.
	If a delegation point has no A but only AAAA and do-ip6 is no,
	resolution would fail. Fixed to ask for the A and AAAA records.
	It has to ask for both always, so that it can fail quietly, from
	TLD perspective, when a zone is only reachable on one transport.
	- test for above, only AAAA and doip6 is no. Fix causes A record
	for nameserver to be fetched.
	- fixup address duplication on cache fillup for delegation points.
	- testset updated for new query answer requirements.

	14 November 2008: Wouter
	- created 1.1.0 release tag in svn.
	- trunk moved to 1.1.1
	- fixup unittest-neg for locking.

	13 November 2008: Wouter
	- added fedora init and specfile to contrib (by Paul Wouters).
	- added configure check for ldns 1.4.0 (using its compat funcs).
	- neater comments in worker.h.
	- removed doc/plan and updated doc/TODO.
	- silenced EHOSTDOWN (verbosity 2 or higher to see it).
	- review comments from Jelte, Matthijs. Neater code.

	12 November 2008: Wouter
	- add unbound-control manpage to makedist replace list.

	11 November 2008: Wouter
	- unit test for negative cache, stress tests the refcounting.
	- fix for refcounting error that could cause fptr_wlist fatal exit
	in the negative cache rbtree (upcoming 1.1 feature). (Thanks to
	Attila Nagy for testing).
	- nicer comments in cachedump about failed RR to string conversion.
	- fix 32bit wrap around when printing large (4G and more) mem usage
	for extended statistics.

	10 November 2008: Wouter
	- fixup the getaddrinfo compat code rename.

	8 November 2008: Wouter
	- added configure check for eee build warning.

	7 November 2008: Wouter
	- fix bug 217: fixed, setreuid and setregid do not work on MacOSX10.4.
	- detect nonblocking problems in network stack in configure script.

	6 November 2008: Wouter
	- dname_priv must decompress the name before comparison.
	- iana portlist updated.

	5 November 2008: Wouter
	- fixed possible memory leak in key_entry_key deletion.
	Would leak a couple bytes when trust anchors were replaced.
	- if query and reply qname overlap, the bytes are skipped not copied.
	- fixed file descriptor leak when messages were jostled out that
	had outstanding (TCP) replies.
	- DNAMEs used from cache have their synthesized CNAMEs initialized
	properly.
	- fixed file descriptor leak for localzone type deny (for TCP).
	- fixed memleak at exit for nsec3 negative cached zones.
	- fixed memleak for the keyword 'nodefault' when reading config.
	- made verbosity of 'edns incapable peer' warning higher, so you
	do not get spammed by it.
	- caught elusive Bad file descriptor error bug, that would print the
	error while unnecessarily try to listen to a closed fd. Fixed.

	4 November 2008: Wouter
	- fixed -Wwrite-strings warnings that result in better code.

	3 November 2008: Wouter
	- fixup build process for Mac OSX linker, use ldns b32 compat funcs.
	- generated configure with autoconf-2.61.
	- iana portlist updated.
	- detect if libssl needs libdl. For static linking with libssl.
	- changed to use new algorithm identifiers for sha256/sha512
	from ldns 1.4.0 (need very latest version).
	- updated the included ldns tarball.
	- proper detection of SHA256 and SHA512 functions (not just sizes).

	23 October 2008: Wouter
	- a little more debug info for failure on signer names. prints names.

	22 October 2008: Wouter
	- CFLAGS are picked up by configure from the environment.
	- iana portlist updated.
	- updated ldns to use 1.4.0-pre20081022 so it picks up CFLAGS too.
	- new stub-prime: yesno option. Default is off, so it does not prime.
	can be turned on to get same behaviour as previous unbound release.
	- made automated test that checks if builtin root hints are uptodate.
	- finished draft-wijngaards-dnsext-resolver-side-mitigation
	implementation. The unwanted-reply-threshold can be set.
	- fixup so fptr_whitelist test in alloc.c works.

	21 October 2008: Wouter
	- fix update-anchors.sh, so it does not report different RR order
	as an update. Sorts the keys in the file. Updated copyright.
	- fixup testbound on windows, the command control pipe doesn't exist.
	- skip 08hostlib test on windows, no fork() available.
	- made unbound-remote work on windows.

	20 October 2008: Wouter
	- quench a log message that is debug only.
	- iana portlist updated.
	- do not query bogus nameservers. It is like nameservers that have
	the NS or A or AAAA record bogus are listed as donotquery.
	- if server selection is faced with only bad choices, it will
	attempt to get more options to be fetched.
	- changed bogus-ttl default value from 900 to 60 seconds.
	In anticipation that operator caused failures are more likely than
	actual attacks at this time. And thus repeated validation helps
	the operators get the problem fixed sooner. It makes validation
	failures go away sooner (60 seconds after the zone is fixed).
	Also it is likely to try different nameserver targets every minute,
	so that if a zone is bad on one server but not another, it is
	likely to pick up the 'correct' one after a couple minutes,
	and if the TTL is big enough that solves validation for the zone.
	- fixup unbound-control compilation on windows.

	17 October 2008: Wouter
	- port Leopard/G5: fixup type conversion size_t/uint32.
	please ranlib, stop file without symbols warning.
	- harden referral path now also validates the root after priming.
	It looks up the root NS authoritatively as well as the root servers
	and attemps to validate the entries.

	16 October 2008: Wouter
	- Fixup negative TTL values appearing (reported by Attila Nagy).

	15 October 2008: Wouter
	- better documentation for 0x20; remove fallback TODO, it is done.
	- harden-referral-path feature includes A, AAAA queries for glue,
	as well as very careful NS caching (only when doing NS query).
	A, AAAA use the delegation from the NS-query.

	14 October 2008: Wouter
	- fwd_three.tpkg test was flaky. If the three requests hit the
	wrong threads by chance (or bad OS) then the test would fail.
	Made less flaky by increasing number of retries.
	- stub_udp.tpkg changed to work, give root hints. fixed ldns_dname_abs.
	- ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081014).
	Which includes the ldns_dname_absolute fix.
	- fwd_three test remains flaky now that unbound does not stop
	listening when full. Thus, removed timeout problem.
	It may be serviced by three threads, or maybe by one.
	Mostly only useful for lock-check testing now.

	13 October 2008: Wouter
	- fixed recursion servers deployed as authoritative detection, so
	that as a last resort, a +RD query is sent there to get the
	correct answer.
	- iana port list update.
	- ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081013).

	10 October 2008: Wouter
	- fixup tests - the negative cache contained the correct NSEC3s for
	two tests that are supposed to fail to validate.

	9 October 2008: Wouter
	- negative cache caps max iterations of NSEC3 done.
	- NSEC3 negative cache for qtype DS works.

	8 October 2008: Wouter
	- NSEC negative cache for DS.

	6 October 2008: Wouter
	- jostle-timeout option, so you can config for slow links.
	- 0x20 fallback code. Tries 3xnumber of nameserver addresses
	queries that must all be the same. Sent to random nameservers.
	- documented choices for DoS, EDNS, 0x20.

	2 October 2008: Wouter
	- fixup unlink of pidfile.
	- fixup SHA256 algorithm collation code.
	- contrib/update-anchor.sh does not overwrite anchors if not needed.
	exits 0 when a restart is needed, other values if not.
	so, update-anchor.sh -d mydir && /etc/rc.d/unbound restart
	can restart unbound exactly when needed.

	30 September 2008: Wouter
	- fixup SHA256 DS downgrade, no longer possible to downgrade to SHA1.
	- tests for sha256 support and downgrade resistance.
	- RSASHA256 and RSASHA512 support (using the draft in dnsext),
	using the drafted protocol numbers.
	- when using stub on localhost (127.0.0.1@10053) unbound works.
	Like when running NSD to host a local zone, on the same machine.
	The noprime feature. manpages more explanation. Added a test for it.
	- shorthand for reverse PTR, local-data-ptr: "1.2.3.4 www.ex.com"

	29 September 2008: Wouter
	- EDNS lameness detection, if EDNS packets are dropped this is
	detected, eventually.
	- multiple query timeout rtt backoff does not backoff too much.

	26 September 2008: Wouter
	- tests for remote-control.
	- small memory leak in exception during remote control fixed.
	- fixup for lock checking but not unchecking in remote control.
	- iana portlist updated.

	23 September 2008: Wouter
	- Msg cache is loaded. A cache load enables cache responses.
	- unbound-control flush [name], flush_type and flush_zone.

	22 September 2008: Wouter
	- dump_cache and load_cache statements in unbound-control.
	RRsets are dumped and loaded correctly.
	Msg cache is dumped.

	19 September 2008: Wouter
	- locking on the localdata structure.
	- add and remove local zone and data with unbound-control.
	- ldns trunk snapshot updated, make tests work again.

	18 September 2008: Wouter
	- fixup error in time calculation.
	- munin plugin improvements.
	- nicer abbreviations for high query types values (ixfr, axfr, any...)
	- documented the statistics output in unbound-control man page.
	- extended statistics prints out histogram, over unbound-control.

	17 September 2008: Wouter
	- locking for threadsafe bogus rrset counter.
	- ldns trunk no longer exports b32 functions, provide compat.
	- ldns tarball updated.
	- testcode/ldns-testpkts.c const fixups.
	- fixed rcode stat printout.
	- munin plugin in contrib.
	- stats always printout uptime, because stats plugins need it.

	16 September 2008: Wouter
	- extended-statistics: yesno config option.
	- unwanted replies spoof nearmiss detector.
	- iana portlist updated.

	15 September 2008: Wouter
	- working start, stop, reload commands for unbound-control.
	- test for unbound-control working; better exit value for control.
	- verbosity control via unbound-control.
	- unbound-control stats.

	12 September 2008: Wouter
	- removed browser control mentions. Proto speccy.

	11 September 2008: Wouter
	- set nonblocking on new TCP streams, because linux does not inherit
	the socket options to the accepted socket.
	- fix TCP timeouts.
	- SSL protected connection between server and unbound-control.

	10 September 2008: Wouter
	- remove memleak in privacy addresses on reloads and quits.
	- remote control work.

	9 September 2008: Wouter
	- smallapp/unbound-control-setup.sh script to set up certificates.

	4 September 2008: Wouter
	- scrubber scrubs away private addresses.
	- test for private addresses. man page entry.
	- code refactored for name and address tree lookups.

	3 September 2008: Wouter
	- options for 'DNS Rebinding' protection: private-address and
	private-domain.
	- dnstree for reuse of routines that help with domain, addr lookups.
	- private-address and private-domain config option read, stored.

	2 September 2008: Wouter
	- DoS protection features. Queries are jostled out to make room.
	- testbound can pass time, increasing the internal timer.
	- do not mark unsigned additionals bogus, leave unchecked, which
	is removed too.

	1 September 2008: Wouter
	- disallow nonrecursive queries for cache snooping by default.
	You can allow is using access-control: <subnet> allow_snoop.
	The defaults do allow access no authoritative data without RD bit.
	- two tests for it and fixups of tests for nonrec refused.

	29 August 2008: Wouter
	- version 1.1 number in trunk.
	- harden-referral-path option for query for NS records.
	Default turns off expensive, experimental option.

	28 August 2008: Wouter
	- fixup logfile handling; it is created with correct permissions
	again. (from bugfix#199).
	Some errors are not written to logfile (pidfile writing, forking),
	and these are only visible by using the -d commandline flag.

	27 August 2008: Wouter
	- daemon(3) is causing problems for people. Reverting the patch.
	bug#200, and 199 and 203 contain sideline discussion on it.
	- bug#199 fixed: pidfile can be outside chroot. openlog is done before
	chroot and drop permissions.
	- config option to set size of aggressive negative cache,
	neg-cache-size.
	- bug#203 fixed: dlv has been implemented.

	26 August 2008: Wouter
	- test for insecure zone when DLV is in use, also does negative cache.
	- test for trustanchor when DLV is in use (the anchor works).
	- test for DLV used for a zone below a trustanchor.
	- added scrub filter for overreaching NSEC records and unit test.
	- iana portlist update
	- use of setresuid or setreuid when available.
	- use daemon(3) if available.

	25 August 2008: Wouter
	- realclean patch from Robert Edmonds.

	22 August 2008: Wouter
	- nicer debuglogging of DLV.
	- test with secure delegation inside the DLV repository.

	21 August 2008: Wouter
	- negative cache code linked into validator, for DLV use.
	negative cache works for DLV.
	- iana portlist update.
	- dlv-anchor option for unit tests.
	- fixup NSEC_AT_APEX classification for short typemaps.
	- ldns-testns has subdomain checks, for unit tests.

	20 August 2008: Wouter
	- negative cache code, reviewed.

	18 August 2008: Wouter
	- changes info: in logfile to notice: info: or debug: depending on
	the verbosity of the statements. Better logfile message
	classification.
	- bug #208: extra rc.d unbound flexibility for freebsd/nanobsd.

	15 August 2008: Wouter
	- DLV nsec code fixed for better detection of closest existing
	enclosers from NSEC responses.
	- DLV works, straight to the dlv repository, so not for production.
	- Iana port update.

	14 August 2008: Wouter
	- synthesize DLV messages from the rrset cache, like done for DS.

	13 August 2008: Wouter
	- bug #203: nicer do-auto log message when user sets incompatible
	options.
	- bug #204: variable name ameliorated in log.c.
	- bug #206: in iana_update, no egrep, but awk use.
	- ldns snapshot r2699 taken (includes DLV type).
	- DLV work, config file element, trust anchor read in.

	12 August 2008: Wouter
	- finished adjusting testset to provide qtype NS answers.

	11 August 2008: Wouter
	- Fixup rrset security updates overwriting 2181 trust status.
	This makes validated to be insecure data just as worthless as
	nonvalidated data, and 2181 rules prevent cache overwrites to them.
	- Fix assertion fail on bogus key handling.
	- dnssec lameness detection works on first query at trust apex.
	- NS queries get proper cache and dnssec lameness treatment.
	- fixup compilation without pthreads on linux.

	8 August 2008: Wouter
	- NS queries are done after every referral.
	validator is used on those NS records (if anchors enabled).

	7 August 2008: Wouter
	- Scrubber more strict. CNAME chains, DNAMEs from cache, other
	irrelevant rrsets removed.
	- 1.0.2 released from 1.0 support branch.
	- fixup update-anchor.sh to work both in BSD shell and bash.

	5 August 2008: Wouter
	- fixup DS test so apex nodata works again.

	4 August 2008: Wouter
	- iana port update.
	- TODO update.
	- fix bug 201: null ptr deref on cleanup while udp pkts wait for port.
	- added explanatory text for outgoing-port-permit in manpage.

	30 July 2008: Wouter
	- fixup bug qtype DS for unsigned zone and signed parent validation.

	25 July 2008: Wouter
	- added original copyright statement of OpenBSD arc4random code.
	- created tube signaling solution on windows, as a pipe replacement.
	this makes background asynchronous resolution work on windows.
	- removed very insecure socketpair compat code. It also did not
	work with event_waiting. Solved by pipe replacement.
	- unbound -h prints openssl version number as well.

	22 July 2008: Wouter
	- moved pipe actions to util/tube.c. easier porting and shared code.
	- check _raw() commpoint callbacks with fptr_wlist.
	- iana port update.

	21 July 2008: Wouter
	- #198: nicer entropy warning message. manpage OS hints.

	19 July 2008: Wouter
	- #198: fixup man page to suggest chroot entropy fix.

	18 July 2008: Wouter
	- branch for 1.0 support.
	- trunk work on tube.c.

	17 July 2008: Wouter
	- fix bug #196, compile outside source tree.
	- fix bug #195, add --with-username=user configure option.
	- print error and exit if started with config that requires more
	fds than the builtin minievent can handle.

	16 July 2008: Wouter
	- made svn tag 1.0.1, trunk now 1.0.2
	- sha256 checksums enabled in makedist.sh

	15 July 2008: Wouter
	- Follow draft-ietf-dnsop-default-local-zones-06 added reverse
	IPv6 example prefix to AS112 default blocklist.
	- fixup lookup of DS records by client with trustanchor for same.
	- libunbound ub_resolve, fix handling of error condition during setup.
	- lowered log_hex blocksize to fit through BSD syslog linesize.
	- no useless initialisation if getpwnam not available.
	- iana, ldns snapshot updated.

	3 July 2008: Wouter
	- Matthijs fixed memory leaks in root hints file reading.

	26 June 2008: Wouter
	- fixup streamtcp bounds setting for udp mode, in the test framework.
	- contrib item for updating trust anchors.

	25 June 2008: Wouter
	- fixup fwd_ancil test typos.
	- Fix for newegg lameness : ok for qtype=A, but lame for others.
	- fixup unit test for infra cache, test lame merging.
	- porting to mingw, bind, listen, getsockopt and setsockopt error
	handling.

	24 June 2008: Wouter
	- removed testcode/checklocks from production code compilation path.
	- streamtcp can use UDP mode (connected UDP socket), for testing IPv6
	on windows.
	- fwd_ancil test fails if platform support is lacking.

	23 June 2008: Wouter
	- fixup minitpkg to cleanup on windows with its file locking troubles.
	- minitpkg shows skipped tests in report.
	- skip ipv6 tests on ipv4 only hosts (requires only ipv6 localhost not
	ipv6 connectivity).
	- winsock event handler keeps track of sticky TCP events, that have
	not been fully handled yet. when interest in the event(s) resumes,
	they are sent again. When WOULDBLOCK is returned events are cleared.
	- skip tests that need signals when testing on mingw.

	18 June 2008: Wouter
	- open testbound replay files in binary mode, because fseek/ftell
	do not work in ascii-mode on windows. The b does nothing on unix.
	unittest and testbound tests work on windows (xp too).
	- ioctlsocket prints nicer error message.
	- fixed up some TCP porting for winsock.
	- lack of IPv6 gives a warning, no fatal error.
	- use WSAGetLastError() on windows instead of errno for some errors.

	17 June 2008: Wouter
	- outgoing num fds 32 by default on windows ; it supports less
	fds for waiting on than unixes.
	- winsock_event minievent handler for windows. (you could also
	attempt to link with libevent/libev ports for windows).
	- neater crypto check and gdi32 detection.
	- unbound.exe works to resolve and validate www.nlnetlabs.nl on vista.

	16 June 2008: Wouter
	- on windows, use windows threads, mutex and thread-local-storage(Tls).
	- detect if openssl needs gdi32.
	- if no threading, THREADS_DISABLED is defined for use in the code.
	- sets USE_WINSOCK if using ws2_32 on windows.
	- wsa_strerror() function for more readable errors.
	- WSA Startup and Cleanup called in unbound.exe.

	13 June 2008: Wouter
	- port mingw32, more signal ifdefs, detect sleep, usleep,
	random, srandom (used inside the tests).
	- signed or unsigned FD_SET is cast.

	10 June 2008: Wouter
	- fixup warnings compiling on eeepc xandros linux.

	9 June 2008: Wouter
	- in iteration response type code
	* first check for SOA record (negative answer) before NS record
	and lameness.
	* check if no AA bit for non-forwarder, and thus lame zone.
	In response to error report by Richard Doty for mail.opusnet.com.
	- fixup unput warning from lexer on freeBSD.
	- bug#183. pidfile, rundir, and chroot configure options. Also the
	example.conf and manual pages get the configured defaults.
	You can use: (or accept the defaults to /usr/local/etc/unbound/)
	--with-conf-file=filename
	--with-pidfile=filename
	--with-run-dir=path
	--with-chroot-dir=path

	8 June 2008: Wouter
	- if multiple CNAMEs, use the first one. Fixup akamai CNAME bug.
	Reported by Robert Edmonds.
	- iana port updated.

	4 June 2008: Wouter
	- updated libtool files with newer version.
	- iana portlist updated.

	3 June 2008: Wouter
	- fixup local-zone: "30.172.in-addr.arpa." nodefault, so that the
	trailing dot is not used during comparison.

	2 June 2008: Wouter
	- Jelte fixed bugs in my absence
	- bug 178: fixed unportable shell usage in configure (relied on
	bash shell).
	- bug 180: fixed buffer overflow in unbound-checkconf use of strncat.
	- bug 181: fixed buffer overflow in ldns (called by unbound to parse
	config file parts).
	- fixes by Wouter
	- bug 177: fixed compilation failure on opensuse, the
	--disable-static configure flag caused problems. (Patch from
	Klaus Singvogel)
	- bug 179: same fix as 177.
	- bug 185: --disable-shared not passed along to ldns included with
	unbound. Fixed so that configure parameters are passed to the
	subdir configure script.
	fixed that ./libtool is used always, you can still override
	manually with ./configure libtool=mylibtool or set $libtool in
	the environment.
	- update of the ldns tarball to current ldns svn version (fix 181).
	- bug 184: -r option for unbound-host, read resolv.conf for
	forwarder. (Note that forwarder must support DNSSEC for validation
	to succeed).

	23 May 2008: Wouter
	- mingw32 porting.
	- test for sys/wait.h
	- WSAEWOULDBLOCK test after nonblocking TCP connect.
	- write_iov_buffer removed: unused and no struct iov on windows.
	- signed/unsigned warning fixup mini_event.
	- use ioctlsocket to set nonblocking I/O if fnctl is unavailable.
	- skip signals that are not defined
	- detect pwd.h.
	- detect getpwnam, getrlimit, setsid, sbrk, chroot.
	- default config has no chroot if chroot() unavailable.
	- if no kill() then no pidfile is read or written.
	- gmtime_r is replaced by nonthreadsafe alternative if unavail.
	used in rrsig time validation errors.

	22 May 2008: Wouter
	- contrib unbound.spec from Patrick Vande Walle.
	- fixup bug#175: call tzset before chroot to have correct timestamps
	in system log.
	- do not generate lex input and lex unput functions.
	- mingw port. replacement functions labelled _unbound.
	- fix bug 174 - check for tcp_sigpipe that ldns-testns is installed.

	19 May 2008: Wouter
	- fedora 9, check in6_pktinfo define in configure.
	- CREDITS fixup of history.
	- ignore ldns-1.2.2 if installed, use builtin 1.3.0-pre alternative.

	16 May 2008: Wouter
	- fixup for MacOSX hosts file reading (reported by John Dickinson).
	- created 1.0.0 svn tag.
	- trunk version 1.0.1.

	14 May 2008: Wouter
	- accepted patch from Ondrej Sury for library version libtool option.
	- configure --disable-rpath fixes up libtool for rpath trouble.
	Adapted from debian package patch file.

	13 May 2008: Wouter
	- Added root ipv6 addresses to builtin root hints.
	- TODO modified for post 1.0 plans.
	- trunk version set to 1.0.0.
	- no unnecessary linking with librt (only when libevent/libev used).

	7 May 2008: Wouter
	- fixup no-ip4 problem with error callback in outside network.

	25 April 2008: Wouter
	- DESTDIR is honored by the Makefile for rpms.
	- contrib files unbound.spec and unbound.init, builds working RPM
	on FC7 Linux, a chrooted caching resolver, and libunbound.
	- iana ports update.

	24 April 2008: Wouter
	- chroot checks improved. working directory relative to chroot.
	checks if config file path is inside chroot. Documentation on it.
	- nicer example.conf text.
	- created 0.11 tag.

	23 April 2008: Wouter
	- parseunbound.pl contrib update from Kai Storbeck for threads.
	- iana ports update

	22 April 2008: Wouter
	- ignore SIGPIPE.
	- unit test for SIGPIPE ignore.

	21 April 2008: Wouter
	- FEATURES document.
	- fixup reread of config file if it was given as a full path
	and chroot was used.

	16 April 2008: Wouter
	- requirements doc, updated clean query returns.
	- parseunbound.pl update from Kai Storbeck.
	- sunos4 porting changes.

	15 April 2008: Wouter
	- fixup default rc.d pidfile location to /usr/local/etc.
	- iana ports updated.
	- copyright updated in ldns-testpkts to keep same as in ldns.
	- fixup checkconf chroot tests a bit more, chdir must be inside
	chroot dir.
	- documented 'gcc: unrecognized -KPIC option' errors on Solaris.
	- example.conf values changed to /usr/local/etc/unbound
	- DSA test work.
	- DSA signatures: unbound is compatible with both encodings found.
	It will detect and convert when necessary.

	14 April 2008: Wouter
	- got update for parseunbound.pl statistics script from Kai Storbeck.
	- tpkg tests for udp wait list.
	- documented 0x20 status.
	- fixup chroot and checkconf, it is much smarter now.
	- fixup DSA EVP signature decoding. Solution that Jelte found copied.
	- and check first sig byte for the encoding type.

	11 April 2008: Wouter
	- random port selection out of the configged ports.
	- fixup threadsafety for libevent-1.4.3+ (event_base_get_method).
	- removed base_port.
	- created 256-port ephemeral space for the OS, 59802 available.
	- fixup consistency of port_if out array during heavy use.

	10 April 2008: Wouter
	- --with-libevent works with latest libevent 1.4.99-trunk.
	- added log file statistics perl script to contrib.
	- automatic iana ports update from makefile. 60058 available.

	9 April 2008: Wouter
	- configure can detect libev(from its build directory) when passed
	--with-libevent=/home/wouter/libev-3.2
	libev-3.2 is a little faster than libevent-1.4.3-stable (about 5%).
	- unused commpoints not listed in epoll list.
	- statistics-cumulative option so that the values are not reset.
	- config creates array of available ports, 61841 available,
	it excludes <1024 and iana assigned numbers.
	config statements to modify the available port numbers.

	8 April 2008: Wouter
	- unbound tries to set the ulimit fds when started as server.
	if that does not work, it will scale back its requirements.

	27 March 2008: Wouter
	- documented /dev/random symlink from chrootdir as FAQ entry.

	26 March 2008: Wouter
	- implemented AD bit signaling. If a query sets AD bit (but not DO)
	then the AD bit is set in the reply if the answer validated.
	Without including DNSSEC signatures. Useful if you have a trusted
	path from the client to the resolver. Follows dnssec-updates draft.

	25 March 2008: Wouter
	- implemented check that for NXDOMAIN and NOERROR answers a query
	section must be present in the reply (by the scrubber). And it must
	be equal to the question sent, at least lowercase folded.
	Previously this feature happened because the cache code refused
	to store such messages. However blocking by the scrubber makes
	sure nothing gets into the RRset cache. Also, this looks like a
	timeout (instead of an allocation failure) and this retries are
	done (which is useful in a spoofing situation).
	- RTT banding. Band size 400 msec, this makes band around zero (fast)
	include unknown servers. This makes unbound explore unknown servers.

	7 March 2008: Wouter
	- -C config feature for harvest program.
	- harvest handles CNAMEs too.

	5 March 2008: Wouter
	- patch from Hugo Koji Kobayashi for iterator logs spelling.

	4 March 2008: Wouter
	- From report by Jinmei Tatuya, rfc2181 trust value for remainder
	of a cname trust chain is lower; not full answer_AA.
	- test for this fix.
	- default config file location is /usr/local/etc/unbound.
	Thus prefix is used to determine the location. This is also the
	chroot and pidfile default location.

	3 March 2008: Wouter
	- Create 0.10 svn tag.
	- 0.11 version in trunk.
	- indentation nicer.

	29 February 2008: Wouter
	- documentation update.
	- fixup port to Solaris of perf test tool.
	- updated ldns-tarball with decl-after-statement fixes.

	28 February 2008: Wouter
	- fixed memory leaks in libunbound (during cancellation and wait).
	- libunbound returns the answer packet in full.
	- snprintf compat update.
	- harvest performs lookup.
	- ldns-tarball update with fix for ldns_dname_label.
	- installs to sbin by default.
	- install all manual pages (unbound-host and libunbound too).

	27 February 2008: Wouter
	- option to use caps for id randomness.
	- config file option use-caps-for-id: yes
	- harvest debug tool

	26 February 2008: Wouter
	- delay utility delays TCP as well. If the server that is forwarded
	to has a TCP error, the delay utility closes the connection.
	- delay does REUSE_ADDR, and can handle a server that closes its end.
	- answers use casing from query.

	25 February 2008: Wouter
	- delay utility works. Gets decent thoughput too (>20000).

	22 February 2008: Wouter
	- +2% for recursions, if identical queries (except for destination
	and query ID) in the reply list, avoid re-encoding the answer.
	- removed TODO items for optimizations that do not show up in
	profile reports.
	- default is now minievent - not libevent. As its faster and
	not needed for regular installs, only for very large port ranges.
	- loop check different speedup pkt-dname-reading, 1% faster for
	nocache-recursion check.
	- less hashing during msg parse, 4% for recursion.
	- small speed fix for dname_count_size_labels, +1 or +2% recursion.
	- some speed results noted:
	optimization resulted in +40% for recursion (cache miss) and
	+70 to +80 for cache hits, and +96% for version.bind.
	zone nsec3 example, 100 NXDOMAIN queries, NSD 35182.8 Ub 36048.4
	www.nlnetlabs.nl from cache: BIND 8987.99 Ub 31218.3
	www with DO bit set : BIND 8269.31 Ub 28735.6 qps.
	So, unbound can be about equal qps to NSD in cache hits.
	And about 3.4x faster than BIND in cache performance.
	- delay utility for testing.

	21 February 2008: Wouter
	- speedup of root-delegation message encoding by 15%.
	- minor speedup of compress tree_lookup, maybe 1%.
	- speedup of dname_lab_cmp and memlowercmp - the top functions in
	profiler output, maybe a couple percent when it matters.

	20 February 2008: Wouter
	- setup speec_cache for need-ldns-testns in dotests.
	- check number of queued replies on incoming queries to avoid overload
	on that account.
	- fptr whitelist checks are not disabled in optimize mode.
	- do-daemonize config file option.
	- minievent time share initializes time at start.
	- updated testdata for nsec3 new algorithm numbers (6, 7).
	- small performance test of packet encoding (root delegation).

	19 February 2008: Wouter
	- applied patch to unbound-host man page from Jan-Piet Mens.
	- fix donotquery-localhost: yes default (it erroneously was switched
	to default 'no').
	- time is only gotten once and the value is shared across unbound.
	- unittest cleans up crypto, so that it has no memory leaks.
	- mini_event shares the time value with unbound this results in
	+3% speed for cache responses and +9% for recursions.
	- ldns tarball update with new NSEC3 sign code numbers.
	- perform several reads per UDP operation. This improves performance
	in DoS conditions, and costs very little in normal conditions.
	improves cache response +50%, and recursions +10%.
	- modified asynclook test. because the callback from async is not
	in any sort of lock (and thus can use all library functions freely),
	this causes a tiny race condition window when the last lock is
	released for a callback and a new cancel() for that callback.
	The only way to remove this is by putting callbacks into some
	lock window. I'd rather have the small possibility of a callback
	for a cancelled function then no use of library functions in
	callbacks. Could be possible to only outlaw process(), wait(),
	cancel() from callbacks, by adding another lock, but I'd rather not.

	18 February 2008: Wouter
	- patch to unbound-host from Jan-Piet Mens.
	- unbound host prints errors if fails to configure context.
	- fixup perf to resend faster, so that long waiting requests do
	not hold up the queue, they become lost packets or SERVFAILs,
	or can be sent a little while later (i.e. processing time may
	take long, but throughput has to be high).
	- fixup iterator operating in no cache conditions (RD flag unset
	after a CNAME).
	- streamlined code for RD flag setting.
	- profiled code and changed dname compares to be faster.
	The speedup is about +3% to +8% (depending on the test).
	- minievent tests for eintr and eagain.

	15 February 2008: Wouter
	- added FreeBSD rc.d script to contrib.
	- --prefix option for configure also changes directory: pidfile:
	and chroot: defaults in config file.
	- added cache speed test, for cache size OK and cache too small.

	14 February 2008: Wouter
	- start without a config file (will complain, but start with
	defaults).
	- perf test program works.

	13 February 2008: Wouter
	- 0.9 released.
	- 1.0 development. Printout ldns version on unbound -h.
	- start of perf tool.
	- bugfix to read empty lines from /etc/hosts.

	12 February 2008: Wouter
	- fixup problem with configure calling itself if ldns-src tarball
	is not present.

	11 February 2008: Wouter
	- changed library to use ub_ instead of ub_val_ as prefix.
	- statistics output text nice.
	- etc/hosts handling.
	- library function to put logging to a stream.
	- set any option interface.

	8 February 2008: Wouter
	- test program for multiple queries over a TCP channel.
	- tpkg test for stream tcp queries.
	- unbound replies to multiple TCP queries on a TCP channel.
	- fixup misclassification of root referral with NS in answer
	when validating a nonrec query.
	- tag 0.9
	- layout of manpages, spelling fix in header, manpages process by
	makedist, list asynclook and tcpstream tests as ldns-testns
	required.

	7 February 2008: Wouter
	- moved up all current level 2 to be level 3. And 3 to 4.
	to make room for new debug level 2 for detailed information
	for operators.
	- verbosity level 2. Describes recursion and validation.
	- cleaner configure script and fixes for libevent solaris.
	- signedness for log output memory sizes in high verbosity.

	6 February 2008: Wouter
	- clearer explanation of threading configure options.
	- fixup asynclook test for nothreading (it creates only one process
	to do the extended test).
	- changed name of ub_val_result_free to ub_val_resolve_free.
	- removes warning message during library linking, renamed
	libunbound/unbound.c -> libunbound.c and worker to libworker.
	- fallback without EDNS if result is NOTIMPL as well as on FORMERR.

	5 February 2008: Wouter
	- statistics-interval: seconds option added.
	- test for statistics option
	- ignore errors making directories, these can occur in parallel builds
	- fixup Makefile strip command and libunbound docs typo.

	31 January 2008: Wouter
	- bg thread/process reads and writes the pipe nonblocking all the time
	so that even if the pipe is buffered or so, the bg thread does not
	block, and services both pipes and queries.

	30 January 2008: Wouter
	- check trailing / on chrootdir in checkconf.
	- check if root hints and anchor files are in chrootdir.
	- no route to host tcp error is verbosity level 2.
	- removed unused send_reply_iov. and its configure check.
	- added prints of 'remote address is 1.2.3.4 port 53' to errors
	from netevent; the basic socket errors.

	28 January 2008: Wouter
	- fixup uninit use of buffer by libunbound (query id, flags) for
	local_zone answers.
	- fixup uninit warning from random.c; also seems to fix sporadic
	sigFPE coming out of openssl.
	- made openssl entropy warning more silent for library use. Needs
	verbosity 1 now.
	- fixup forgotten locks for rbtree_searches on ctx->query tree.
	- random generator cleanup - RND_STATE_SIZE removed, and instead
	a super-rnd can be passed at init to chain init random states.
	- test also does lock checks if available.
	- protect config access in libworker_setup().
	- libevent doesn't like comm_base_exit outside of runloop.
	- close fds after removing commpoints only (for epoll, kqueue).

	25 January 2008: Wouter
	- added tpkg for asynclook and library use.
	- allows localhost to be queried when as a library.
	- fixup race condition between cancel and answer (in case of
	really fast answers that beat the cancel).
	- please doxygen, put doxygen comment in one place.
	- asynclook -b blocking mode and test.
	- refactor asynclook, nicer code.
	- fixup race problems from opensll in rand init from library, with
	a mutex around the rand init.
	- fix pass async_id=NULL to _async resolve().
	- rewrote _wait() routine, so that it is threadsafe.
	- cancelation is threadsafe.
	- asynclook extended test in tpkg.
	- fixed two races where forked bg process waits for (somehow shared?)
	locks, so does not service the query pipe on the bg side.
	Now those locks are only held for fg_threads and for bg_as_a_thread.

	24 January 2008: Wouter
	- tested the cancel() function.
	- asynclook -c (cancel) feature.
	- fix fail to allocate context actions.
	- make pipe nonblocking at start.
	- update plane for retry mode with caution to limit bandwidth.
	- fix Makefile for concurrent make of unbound-host.
	- renamed ub_val_ctx_wait/poll/process/fd to ub_val*.
	- new calls to set forwarding added to header and docs.

	23 January 2008: Wouter
	- removed debug prints from if-auto, verb-algo enables some.
	- libunbound QUIT setup, remove memory leaks, when using threads
	will share memory for passing results instead of writing it over
	the pipe, only writes ID number over the pipe (towards the handler
	thread that does process() ).

	22 January 2008: Wouter
	- library code for async in libunbound/unbound.c.
	- fix link testbound.
	- fixup exit bug in mini_event.
	- background worker query enter and result functions.
	- bg query test application asynclook, it looks up multiple
	hostaddresses (A records) at the same time.

	21 January 2008: Wouter
	- libworker work, netevent raw commpoints, write_msg, serialize.

	18 January 2008: Wouter
	- touch up of manpage for libunbound.
	- support for IP_RECVDSTADDR (for *BSD ip4).
	- fix for BSD, do not use ip4to6 mapping, make two sockets, once
	ip6 and once ip4, uses socket options.
	- goodbye ip4to6 mapping.
	- update ldns-testpkts with latest version from ldns-trunk.
	- updated makedist for relative ldns pathnames.
	- library API with more information inside the result structure.
	- work on background resolves.

	17 January 2008: Wouter
	- fixup configure in case -lldns is installed.
	- fixup a couple of doxygen warnings, about enum variables.
	- interface-automatic now copies the interface address from the
	PKT_INFO structure as well.
	- manual page with library API, all on one page 'man libunbound'.
	- rewrite of PKTINFO structure, it also captures IP4 PKTINFO.

	16 January 2008: Wouter
	- incoming queries to the server with TC bit on are replied FORMERR.
	- interface-automatic replied the wrong source address on localhost
	queries. Seems to be due to ifnum=0 in recvmsg PKTINFO. Trying
	to use ifnum=-1 to mean 'no interface, use kernel route'.

	15 January 2008: Wouter
	- interface-automatic feature. experimental. Nice for anycast.
	- tpkg test for ip6 ancillary data.
	- removed debug prints.
	- porting experience, define for Solaris, test refined for BSD
	compatibility. The feature probably will not work on OpenBSD.
	- makedist fixup for ldns-src in build-dir.

	14 January 2008: Wouter
	- in no debug sets NDEBUG to remove asserts.
	- configure --enable-debug is needed for dependency generation
	for assertions and for compiler warnings.
	- ldns.tgz updated with ldns-trunk (where buffer.h is updated).
	- fix lint, unit test in optimize mode.
	- default access control allows ::ffff:127.0.0.1 v6mapped localhost.

	11 January 2008: Wouter
	- man page, warning removed.
	- added text describing the use of stub zones for private zones.
	- checkconf tests for bad hostnames (IP address), and for doubled
	interface lines.
	- memory sizes can be given with 'k', 'Kb', or M or G appended.

	10 January 2008: Wouter
	- typo in example.conf.
	- made using ldns-src that is included the package more portable
	by linking with .lo instead of .o files in the ldns package.
	- nicer do-ip6: yes/no documentation.
	- nicer linking of libevent .o files.
	- man pages render correctly on solaris.

	9 January 2008: Wouter
	- fixup openssl RAND problem, when the system is not configured to
	give entropy, and the rng needs to be seeded.

	8 January 2008: Wouter
	- print median and quartiles with extensive logging.

	4 January 2008: Wouter
	- document misconfiguration in private network.

	2 January 2008: Wouter
	- fixup typo in requirements.
	- document that 'refused' is a better choice than 'drop' for
	the access control list, as refused will stop retries.

	7 December 2007: Wouter
	- unbound-host has a -d option to show what happens. This can help
	with debugging (why do I get this answer).
	- fixup CNAME handling, on nodata, sets and display canonname.
	- dot removed from CNAME display.
	- respect -v for NXDOMAINs.
	- updated ldns-src.tar.gz with ldns-trunk today (1.2.2 fixes).
	- size_t to int for portability of the header file.
	- fixup bogus handling.
	- dependencies and lint for unbound-host.

	6 December 2007: Wouter
	- library resolution works in foreground mode, unbound-host app
	receives data.
	- unbound-host prints rdata using ldns.
	- unbound-host accepts trust anchors, and prints validation
	information when you give -v.

	5 December 2007: Wouter
	- locking in context_new() inside the function.
	- setup of libworker.

	4 December 2007: Wouter
	- minor Makefile fixup.
	- moved module-stack code out of daemon/daemon into services/modstack,
	preparing for code-reuse.
	- move context into own header file.
	- context query structure.
	- removed unused variable pwd from checkconf.
	- removed unused assignment from outside netw.
	- check timeval length of string.
	- fixup error in val_utils getsigner.
	- fixup same (*var) error in netblocktostr.
	- fixup memleak on parse error in localzone.
	- fixup memleak on packet parse error.
	- put ; after union in parser.y.
	- small hardening in iter_operate against iq==NULL.
	- hardening, if error reply with rcode=0 (noerror) send servfail.
	- fixup same (*var) error in find_rrset in msgparse, was harmless.
	- check return value of evtimer_add().
	- fixup lockorder in lruhash_reclaim(), building up a list of locked
	entries one at a time. Instead they are removed and unlocked.
	- fptr_wlist for markdelfunc.
	- removed is_locked param from lruhash delkeyfunc.
	- moved bin_unlock during bin_split purely to please.

	3 December 2007: Wouter
	- changed checkconf/ to smallapp/ to make room for more support tools.
	(such as unbound-host).
	- install dirs created with -m 755 because they need to be accessible.
	- library extensive featurelist added to TODO.
	- please doxygen, lint.
	- library test application, with basic functionality.
	- fix for building in a subdirectory.
	- link lib fix for Leopard.

	30 November 2007: Wouter
	- makefile that creates libunbound.la, basic file or libunbound.a
	when creating static executables (no libtool).
	- more API setup.

	29 November 2007: Wouter
	- 0.9 public API start.

	28 November 2007: Wouter
	- Changeup plan for 0.8 - no complication needed, a simple solution
	has been chosen for authoritative features.
	- you can use single quotes in the config file, so it is possible
	to specify TXT records in local data.
	- fixup small memory problem in implicit transparent zone creation.
	- test for implicit zone creation and multiple RR RRsets local data.
	- local-zone nodefault test.
	- show testbound testlist on commit.
	- iterator normalizer changes CNAME chains ending in NXDOMAIN where
	the packet got rcode NXDOMAIN into rcode NOERROR. (since the initial
	domain exists).
	- nicer verbosity: 0 and 1 levels.
	- lower nonRDquery chance of eliciting wrongly typed validation
	requiring message from the cache.
	- fix for nonRDquery validation typing; nodata is detected when
	SOA record in auth section (all validation-requiring nodata messages
	have a SOA record in authority, so this is OK for the validator),
	and NS record is needed to be a referral.
	- duplicate checking when adding NSECs for a CNAME, and test.
	- created svn tag 0.8, after completing testbed tests.

	27 November 2007: Wouter
	- per suggestion in rfc2308, replaced default max-ttl value with 1 day.
	- set size of msgparse lookup table to 32, from 1024, so that its size
	is below the 2048 regional large size threshold, and does not cause
	a call to malloc when a message is parsed.
	- update of memstats tool to print number of allocation calls.
	This is what is taking time (not space) and indicates the avg size
	of the allocations as well. region_alloc stat is removed.

	22 November 2007: Wouter
	- noted EDNS in-the-middle dropping trouble as a TODO.
	At this point theoretical, no user trouble has been reported.
	- added all default AS112 zones.
	- answers from local zone content.
	* positive answer, the rrset in question
	* nodata answer (exist, but not that type).
	* nxdomain answer (domain does not exist).
	* empty-nonterminal answer.
	* But not: wildcard, nsec, referral, rrsig, cname/dname,
	or additional section processing, NS put in auth.
	- test for correct working of static and transparent and couple
	of important defaults (localhost, as112, reverses).
	Also checks deny and refuse settings.
	- fixup implicit zone generation and AA bit for NXDOMAIN on localdata.

	21 November 2007: Wouter
	- local zone internal data setup.

	20 November 2007: Wouter
	- 0.8 - str2list config support for double string config options.
	- local-zone and local-data options, config storage and documentation.

	19 November 2007: Wouter
	- do not downcase NSEC and RRSIG for verification. Follows
	draft-ietf-dnsext-dnssec-bis-updates-06.txt.
	- fixup leaking unbound daemons at end of tests.
	- README file updated.
	- nice libevent not found error.
	- README talks about gnu make.
	- 0.8: unit test for addr_mask and fixups for it.
	and unit test for addr_in_common().
	- 0.8: access-control config file element.
	and unit test rpl replay file.
	- 0.8: fixup address reporting from netevent.

	16 November 2007: Wouter
	- privilege separation is not needed in unbound at this time.
	TODO item marked as such.
	- created beta-0.7 branch for support.
	- tagged 0.7 for beta release.
	- moved trunk to 0.8 for 0.8(auth features) development.
	- 0.8: access control list setup.

	15 November 2007: Wouter
	- review fixups from Jelte.

	14 November 2007: Wouter
	- testbed script does not recreate configure, since its in svn now.
	- fixup checkconf test so that it does not test
	/etc/unbound/unbound.conf.
	- tag 0.6.

	13 November 2007: Wouter
	- remove debug print.
	- fixup testbound exit when LIBEVENT_SIGNAL_PROBLEM exists.

	12 November 2007: Wouter
	- fixup signal handling where SIGTERM could be ignored if a SIGHUP
	arrives later on.
	- bugreports to unbound-bugs@nlnetlabs.nl
	- fixup testbound so it exits cleanly.
	- cleanup the caches on a reload, so that rrsetID numbers won't clash.

	9 November 2007: Wouter
	- took ldns snapshot in repo.
	- default config file is /etc/unbound/unbound.conf.
	If it doesn't exist, it is installed with the doc/example.conf file.
	The file is not deleted on uninstall.
	- default listening is not all, but localhost interfaces.

	8 November 2007: Wouter
	- Fixup chroot and drop user privileges.
	- new L root ip address in default hints.

	1 November 2007: Wouter
	- Fixup of crash on reload, due to anchors in env not NULLed after
	dealloc during deinit.
	- Fixup of chroot call. Happens after privileges are dropped, so
	that checking the passwd entry still works.
	- minor touch up of clear() hashtable function.
	- VERB_DETAIL prints out what chdir, username, chroot is being done.
	- when id numbers run out, caches are cleared, as in design notes.
	Tested with a mock setup with very few bits in id, it worked.
	- harden-dnssec-stripped: yes is now default. It insists on dnssec
	data for trust anchors. Included tests for the feature.

	31 October 2007: Wouter
	- cache-max-ttl config option.
	- building outside sourcedir works again.
	- defaults more secure:
	username: "unbound"
	chroot: "/etc/unbound"
	The operator can override them to be less secure ("") if necessary.
	- fix horrible oversight in sorting rrset references in a message,
	sort per reference key pointer, not on referencepointer itself.
	- pidfile: "/etc/unbound/unbound.pid" is now the default.
	- tests changed to reflect the updated default.
	- created hashtable clear() function that respects locks.

	30 October 2007: Wouter
	- fixup assertion failure that relied on compressed names to be
	smaller than uncompressed names. A packet from comrite.com was seen
	to be compressed to a larger size. Added it as unit test.
	- quieter logging at low verbosity level for common tcp messages.
	- no greedy TTL update.

	23 October 2007: Wouter
	- fixup (grand-)parent problem for dnssec-lameness detection.
	- fixup tests to do additional section processing for lame replies,
	since the detection needs that.
	- no longer trust in query section in reply during dnssec lame detect.
	- dnssec lameness does not make the server never ever queried, but
	non-preferred. If no other servers exist or answer, the dnssec lame
	server is used; the fastest dnssec lame server is chosen.
	- added test then when trust anchor cannot be primed (nodata), the
	insecure mode from unbound works.
	- Fixup max queries per thread, any more are dropped.

	22 October 2007: Wouter
	- added donotquerylocalhost config option. Can be turned off for
	out test cases.
	- ISO C compat changes.
	- detect RA-no-AA lameness, as LAME.
	- DNSSEC-lameness detection, as LAME.
	See notes in requirements.txt for choices made.
	- tests for lameness detection.
	- added all to make test target; need unbound for fwd tests.
	- testbound does not pollute /etc/unbound.

	19 October 2007: Wouter
	- added configure (and its files) to svn, so that the trunk is easier
	to use. ./configure, config.guess, config.sub, ltmain.sh,
	and config.h.in.
	- added yacc/lex generated files, util/configlexer.c,
	util/configparser.c util/configparser.h, to svn.
	- without lex no attempt to use it.
	- unsecure response validation collated into one block.
	- remove warning about const cast of cfgfile name.
	- outgoing-interfaces can be different from service interfaces.
	- ldns-src configure is done during unbound configure and
	ldns-src make is done during unbound make, and so inherits the
	make arguments from the unbound make invocation.
	- nicer error when libevent problem causes instant exit on signal.
	- read root hints from a root hint file (like BIND does).

	18 October 2007: Wouter
	- addresses are logged with errors.
	- fixup testcode fake event to remove pending before callback
	since the callback may create new pending items.
	- tests updated because retries are now in iterator module.
	- ldns-testpkts code is checked for differences between unbound
	and ldns by makedist.sh.
	- ldns trunk from today added in svn repo for fallback in case
	no ldns is installed on the system.
	make download_ldns refreshes the tarball with ldns svn trunk.
	- ldns-src.tar.gz is used if no ldns is found on the system, and
	statically linked into unbound.
	- start of regional allocator code.
	- regional uses less memory and variables, simplified code.
	- remove of region-allocator.
	- alloc cache keeps a cache of recently released regional blocks,
	up to a maximum.
	- make unit test cleanly free memory.

	17 October 2007: Wouter
	- fixup another cycle detect and ns-addr timeout resolution bug.
	This time by refusing delegations from the cache without addresses
	when resolving a mandatory-glue nameserver-address for that zone.
	We're going to have to ask a TLD server anyway; might as well be
	the TLD server for this name. And this resolves a lot of cases where
	the other nameserver names lead to cycles or are not available.
	- changed random generator from random(3) clone to arc4random wrapped
	for thread safety. The random generator is initialised with
	entropy from the system.
	- fix crash where failure to prime DNSKEY tried to print null pointer
	in the log message.
	- removed some debug prints, only verb_algo (4) enables them.
	- fixup test; new random generator took new paths; such as one
	where no scripted answer was available.
	- mark insecure RRs as insecure.
	- fixup removal of nonsecure items from the additional.
	- reduced timeout values to more realistic, 376 msec (262 msec has
	90% of roundtrip times, 512 msec has 99% of roundtrip times.)
	- server selection failover to next server after timeout (376 msec).

	16 October 2007: Wouter
	- no malloc in log_hex.
	- assertions around system calls.
	- protect against gethostname without ending zero.
	- ntop output is null terminated by unbound.
	- pidfile content null termination
	- various snprintf use sizeof(stringbuf) instead of fixed constant.
	- changed loopdetect % 8 with & 0x7 since % can become negative for
	weird negative input and particular interpretation of integer math.
	- dname_pkt_copy checks length of result, to protect result buffers.
	prints an error, this should not happen. Bad strings should have
	been rejected earlier in the program.
	- remove a size_t underflow from msgreply size func.

	15 October 2007: Wouter
	- nicer warning.
	- fix IP6 TCP, wrong definition check. With test package.
	- fixup the fact that the query section was not compressed to,
	the code was there but was called by value instead of by reference.
	And test for the case, uses xxd and nc.
	- more portable ip6 check for sockaddr types.

	8 October 2007: Wouter
	- --disable-rpath option in configure for 64bit systems with
	several dynamic lib dirs.

	7 October 2007: Wouter
	- fixup tests for no AD bit in non-DO queries.
	- test that makes sure AD bit is not set on non-DO query.

	6 October 2007: Wouter
	- removed logfile open early. It did not have the proper permissions;
	it was opened as root instead of the user. And we cannot change user
	id yet, since chroot and bind ports need to be done.
	- callback checks for event callbacks done from mini_event. Because
	of deletions cannot do this from netevent. This means when using
	libevent the protection does not work on event-callbacks.
	- fixup too small reply (did not zero counts).
	- fixup reply no longer AD bit when query without DO bit.

	5 October 2007: Wouter
	- function pointer whitelist.

	4 October 2007: Wouter
	- overwrite sensitive random seed value after use.
	- switch to logfile very soon if not -d (console attached).
	- error messages do not reveal the trustanchor contents.
	- start work on function pointer whitelists.

	3 October 2007: Wouter
	- fix for multiple empty nonterminals, after multiple DSes in the
	chain of trust.
	- mesh checks if modules are looping, and stops them.
	- refetch with CNAMEd nameserver address regression test added.
	- fixup line count bug in testcode, so testbound prints correct line
	number with parse errors.
	- unit test for multiple ENT case.
	- fix for cname out of validated unsec zone.
	- fixup nasty id=0 reuse. Also added assertions to detect its
	return (the assertion catches in the existing test cases).

	1 October 2007: Wouter
	- skip F77, CXX, objC tests in configure step.
	- fixup crash in refetch glue after a CNAME.
	and protection against similar failures (with error print).

	28 September 2007: Wouter
	- test case for unbound-checkconf, fixed so it also checks the
	interface: statements.

	26 September 2007: Wouter
	- SIGHUP will reopen the log file.
	- Option to log to syslog.
	- please lint, fixup tests (that went to syslog on open, oops).
	- config check program.

	25 September 2007: Wouter
	- tests for NSEC3. Fixup bitmap checks for NSEC3.
	- positive ANY response needs to check if wildcard expansion, and
	check that original data did not exist.
	- tests for NSEC3 that wrong use of OPTOUT is bad. For insecure
	delegation, for abuse of child zone apex nsec3.
	- create 0.5 release tag.

	24 September 2007: Wouter
	- do not make test programs by default.
	- But 'make test' will perform all of the tests.
	- Advertise builtin select libevent alternative when no libevent
	is found.
	- signit can generate NSEC3 hashes, for generating tests.
	- multiple nsec3 parameters in message test.
	- too high nsec3 iterations becomes insecure test.

	21 September 2007: Wouter
	- fixup empty_DS_name allocated in wrong region (port DEC Alpha).
	- fixup testcode lock safety (port FreeBSD).
	- removes subscript has type char warnings (port Solaris 9).
	- fixup of field with format type to int (port MacOS/X intel).
	- added test for infinite loop case in nonRD answer validation.
	It was a more general problem, but hard to reproduce. When an
	unsigned rrset is being validated and the key fetched, the DS
	sequence is followed, but if the final name has no DS, then no
	proof is possible - the signature has been stripped off.

	20 September 2007: Wouter
	- fixup and test for NSEC wildcard with empty nonterminals.
	- makedist.sh fixup for svn info.
	- acl features request in plan.
	- improved DS empty nonterminal handling.
	- compat with ANS nxdomain for empty nonterminals. Attempts the nodata
	proof anyway, which succeeds in ANS failure case.
	- striplab protection in case it becomes -1.
	- plans for static and blacklist config.

	19 September 2007: Wouter
	- comments about non-packed usage.
	- plan for overload support in 0.6.
	- added testbound tests for a failed resolution from the logs
	and for failed prime when missing glue.
	- fixup so useless delegation points are not returned from the
	cache. Also the safety belt is used if priming fails to complete.
	- fixup NSEC rdata not to be lowercased, bind compat.

	18 September 2007: Wouter
	- wildcard nsec3 testcases, and fixup to get correct wildcard name.
	- validator prints subtype classification for debug.

	17 September 2007: Wouter
	- NSEC3 hash cache unit test.
	- validator nsec3 nameerror test.

	14 September 2007: Wouter
	- nsec3 nodata proof, nods proof, wildcard proof.
	- nsec3 support for cname chain ending in noerror or nodata.
	- validator calls nsec3 proof routines if no NSECs prove anything.
	- fixup iterator bug where it stored the answer to a cname under
	the wrong qname into the cache. When prepending the cnames, the
	qname has to be reset to the original qname.

	13 September 2007: Wouter
	- nsec3 find matching and covering, ce proof, prove namerror msg.

	12 September 2007: Wouter
	- fixup of manual page warnings, like for NSD bugreport.
	- nsec3 work, config, max iterations, filter, and hash cache.

	6 September 2007: Wouter
	- fixup to find libevent on mac port install.
	- fixup size_t vs unsigned portability in validator/sigcrypt.
	- please compiler on different platforms, for unreachable code.
	- val_nsec3 file.
	- pthread_rwlock type is optional, in case of old pthread libs.

	5 September 2007: Wouter
	- cname, name error validator tests.
	- logging of qtype ANY works.
	- ANY type answers get RRSIG in answer section of replies (but not
	in other sections, unless DO bit is on).
	- testbound can replay a TCP query (set MATCH TCP in the QUERY).
	- DS and noDS referral validation test.
	- if you configure many trust anchors, parent trust anchors can
	securely deny existence of child trust anchors, if validated.
	- not all *.name NSECs are present because a wildcard was matched,
	and *.name NSECs can prove nodata for empty nonterminals.
	Also, for wildcard name NSECs, check they are not from the parent
	zone (for wildcarded zone cuts), and check absence of CNAME bit,
	for a nodata proof.
	- configure option for memory allocation debugging.
	- port configure option for memory allocation to solaris10.

	4 September 2007: Wouter
	- fixup of Leakage warning when serviced queries processed multiple
	callbacks for the same query from the same server.
	- testbound removes config file from /tmp on failed exit.
	- fixup for referral cleanup of the additional section.
	- tests for cname, referral validation.
	- neater testbound tpkg output.
	- DNAMEs no longer match their apex when synthesized from the cache.
	- find correct signer name for DNAME responses.
	- wildcarded DNAME test and fixup code to detect.
	- prepend NSEC and NSEC3 rrsets in the iterator while chasing CNAMEs.
	So that wildcarded CNAMEs get their NSEC with them to the answer.
	- test for a CNAME to a DNAME to a CNAME to an answer, all from
	different domains, for key fetching and signature checking of
	CNAME'd messages.

	3 September 2007: Wouter
	- Fixed error in iterator that would cause assertion failure in
	validator. CNAME to a NXDOMAIN response was collated into a response
	with both a CNAME and the NXDOMAIN rcode. Added a test that the
	rcode is changed to NOERROR (because of the CNAME).
	- timeout on tcp does not lead to spurious leakage detect.
	- account memory for name of lame zones, so that memory leakages does
	not show lame cache growth as a leakage growth.
	- config setting for lameness cache expressed in bytes, instead of
	number of entries.
	- tool too summarize allocations per code line.

	31 August 2007: Wouter
	- can read bind trusted-keys { ... }; files, in a compatibility mode.
	- iterator should not detach target queries that it still could need.
	the protection against multiple outstanding queries is moved to a
	current_query num check.
	- validator nodata, positive, referral tests.
	- dname print can print '*' wildcard.

	30 August 2007: Wouter
	- fixup override date config option.
	- config options to control memory usage.
	- caught bad free of un-alloced data in worker_send error case.
	- memory accounting for key cache (trust anchors and temporary cache).
	- memory accounting fixup for outside network tcp pending waits.
	- memory accounting fixup for outside network tcp callbacks.
	- memory accounting for iterator fixed storage.
	- key cache size and slabs config options.
	- lib crypto cleanups at exit.

	29 August 2007: Wouter
	- test tool to sign rrsets for testing validator with.
	- added RSA and DSA test keys, public and private pairs, 512 bits.
	- default configuration is with validation enabled.
	Only a trust-anchor needs to be configured for DNSSEC to work.
	- do not convert to DER for DSA signature verification.
	- validator replay test file, for a DS to DNSKEY DSA key prime and
	positive response.

	28 August 2007: Wouter
	- removed double use for udp buffers, that could fail,
	instead performs a malloc to do the backup.
	- validator validates referral messages, by validating all the rrsets
	and stores the rrsets in the cache. Further referral (nonRD queries)
	replies are made from the rrset cache directly. Unless unchecked
	rrsets are encountered, there are then validated.
	- enforce that signing is done by a parent domain (or same domain).
	- adjust TTL downwards if rrset TTL bigger than signature allows.
	- permissive mode feature, sets AD bit for secure, but bogus does
	not give servfail (bogus is changed into indeterminate).
	- optimization of rrset verification. rr canonical sorting is reused,
	for the same rrset. canonical rrset image in buffer is reused for
	the same signature.
	- if the rrset is too big (64k exactly + large owner name) the
	canonicalization routine will fail if it does not fit in buffer.
	- faster verification for large sigsets.
	- verb_detail mode reports validation failures, but not the entire
	algorithm for validation. Key prime failures are reported as
	verb_ops level.

	27 August 2007: Wouter
	- do not garble the edns if a cache answer fails.
	- answer norecursive from cache if possible.
	- honor clean_additional setting when returning secure non-recursive
	referrals.
	- do not store referral in msg cache for nonRD queries.
	- store verification status in the rrset cache to speed up future
	verification.
	- mark rrsets indeterminate and insecure if they are found to be so.
	and store this in the cache.

	24 August 2007: Wouter
	- message is bogus if unsecure authority rrsets are present.
	- val-clean-additional option, so you can turn it off.
	- move rrset verification out of the specific proof types into one
	routine. This makes the proof routines prettier.
	- fixup cname handling in validator, cname-to-positive and cname-to-
	nodata work.
	- Do not synthesize DNSKEY and DS responses from the rrset cache if
	the rrset is from the additional section. Signatures may have
	fallen off the packet, and cause validation failure.
	- more verbose signature date errors (with the date attached).
	- increased default infrastructure cache size. It is important for
	performance, and 1000 entries are only 212k (or a 400 k total cache
	size). To 10000 entries (for 2M entries, 4M cache size).

	23 August 2007: Wouter
	- CNAME handling - move needs_validation to before val_new().
	val_new() setups the chase-reply to be an edited copy of the msg.
	new classification, and find signer can find for it.
	removal of unsigned crap from additional, and query restart for
	cname.
	- refuse to follow wildcarded DNAMEs when validating.
	But you can query for qtype ANY, or qtype DNAME and validate that.

	22 August 2007: Wouter
	- bogus TTL.
	- review - use val_error().

	21 August 2007: Wouter
	- ANY response validation.
	- store security status in cache.
	- check cache security status and either send the query to be
	validated, return the query to client, or send servfail to client.
	Sets AD bit on validated replies.
	- do not examine security status on an error reply in mesh_done.
	- construct DS, DNSKEY messages from rrset cache.
	- manual page entry for override-date.

	20 August 2007: Wouter
	- validate and positive validation, positive wildcard NSEC validation.
	- nodata validation, nxdomain validation.

	18 August 2007: Wouter
	- process DNSKEY response in FINDKEY state.

	17 August 2007: Wouter
	- work on DS2KE routine.
	- val_nsec.c for validator NSEC proofs.
	- unit test for NSEC bitmap reading.
	- dname iswild and canonical_compare with unit tests.

	16 August 2007: Wouter
	- DS sig unit test.
	- latest release libevent 1.3c and 1.3d have threading fixed.
	- key entry fixup data pointer and ttl absolute.
	- This makes a key-prime succeed in validator, with DS or DNSKEY as
	trust-anchor.
	- fixup canonical compare byfield routine, fix bug and also neater.
	- fixed iterator response type classification for queries of type
	ANY and NS.
	dig ANY gives sometimes NS rrset in AN and NS section, and parser
	removes the NS section duplicate. dig NS gives sometimes the NS
	in the answer section, as referral.
	- validator FINDKEY state.

	15 August 2007: Wouter
	- crypto calls to verify signatures.
	- unit test for rrsig verification.

	14 August 2007: Wouter
	- default outgoing ports changed to avoid port 2049 by default.
	This port is widely blocked by firewalls.
	- count infra lameness cache in memory size.
	- accounting of memory improved
	- outbound entries are allocated in the query region they are for.
	- extensive debugging for memory allocations.
	- --enable-lock-checks can be used to enable lock checking.
	- protect undefs in config.h from autoheaders ministrations.
	- print all received udp packets. log hex will print on multiple
	lines if needed.
	- fixed error in parser with backwards rrsig references.
	- mark cycle targets for iterator did not have CD flag so failed
	its task.

	13 August 2007: Wouter
	- fixup makefile, if lexer is missing give nice error and do not
	mess up the dependencies.
	- canonical compare routine updated.
	- canonical hinfo compare.
	- printout list of the queries that the mesh is working on.

	10 August 2007: Wouter
	- malloc and free overrides that track total allocation and frees.
	for memory debugging.
	- work on canonical sort.

	9 August 2007: Wouter
	- canonicalization, signature checks
	- dname signature label count and unit test.
	- added debug heap size print to memory printout.
	- typo fixup in worker.c
	- -R needed on solaris.
	- validator override option for date check testing.

	8 August 2007: Wouter
	- ldns _raw routines created (in ldns trunk).
	- sigcrypt DS digest routines
	- val_utils uses sigcrypt to perform signature cryptography.
	- sigcrypt keyset processing

	7 August 2007: Wouter
	- security status type.
	- security status is copied when rdata is equal for rrsets.
	- rrset id is updated to invalidate all the message cache entries
	that refer to NSEC, NSEC3, DNAME rrsets that have changed.
	- val_util work
	- val_sigcrypt file for validator signature checks.

	6 August 2007: Wouter
	- key cache for validator.
	- moved isroot and dellabel to own dname routines, with unit test.

	3 August 2007: Wouter
	- replanning.
	- scrubber check section of lame NS set.
	- trust anchors can be in config file or read from zone file,
	DS and DNSKEY entries.
	- unit test trust anchor storage.
	- trust anchors converted to packed rrsets.
	- key entry definition.

	2 August 2007: Wouter
	- configure change for latest libevent trunk version (needs -lrt).
	- query_done and walk_supers are moved out of module interface.
	- fixup delegation point duplicates.
	- fixup iterator scrubber; lame NS set is let through the scrubber
	so that the classification is lame.
	- validator module exists, and does nothing but pass through,
	with calling of next module and return.
	- validator work.

	1 August 2007: Wouter
	- set version to 0.5
	- module work for module to module interconnections.
	- config of modules.
	- detect cycle takes flags.

	31 July 2007: Wouter
	- updated plan
	- release 0.4 tag.

	30 July 2007: Wouter
	- changed random state init, so that sequential process IDs are not
	cancelled out by sequential thread-ids in the random number seed.
	- the fwd_three test, which sends three queries to unbound, and
	unbound is kept waiting by ldns-testns for 3 seconds, failed
	because the retry timeout for default by unbound is 3 seconds too,
	it would hit that timeout and fail the test. Changed so that unbound
	is kept waiting for 2 seconds instead.

	27 July 2007: Wouter
	- removed useless -C debug option. It did not work.
	- text edit of documentation.
	- added doc/CREDITS file, referred to by the manpages.
	- updated planning.

	26 July 2007: Wouter
	- cycle detection, for query state dependencies. Will attempt to
	circumvent the cycle, but if no other targets available fails.
	- unit test for AXFR, IXFR response.
	- test for cycle detection.

	25 July 2007: Wouter
	- testbound read ADDRESS and check it.
	- test for version.bind and friends.
	- test for iterator chaining through several referrals.
	- test and fixup for refetch for glue. Refetch fails if glue
	is still not provided.

	24 July 2007: Wouter
	- Example section in config manual.
	- Addr stored for range and moment in replay.

	20 July 2007: Wouter
	- Check CNAME chain before returning cache entry with CNAMEs.
	- Option harden-glue, default is on. It will discard out of zone
	data. If disabled, performance is faster, but spoofing attempts
	become a possibility. Note that still normalize scrubbing is done,
	and that the potentially spoofed data is used for infrastructure
	and not returned to the client.
	- if glue times out, refetch by asking parent of delegation again.
	Much like asking for DS at the parent side.
	- TODO items from forgery-resilience draft.
	and on memory handling improvements.
	- renamed module_event_timeout to module_event_noreply.
	- memory reporting code; reports on memory usage after handling
	a network packet (not on cache replies).

	19 July 2007: Wouter
	- shuffle NS selection when getting nameserver target addresses.
	- fixup of deadlock warnings, yield cpu in checklock code so that
	freebsd scheduler selects correct process to run.
	- added identity and version config options and replies.
	- store cname messages complete answers.

	18 July 2007: Wouter
	- do not query addresses, 127.0.0.1, and ::1 by default.

	17 July 2007: Wouter
	- forward zone options in config file.
	- forward per zone in iterator. takes precedence over stubs.
	- fixup commithooks.
	- removed forward-to and forward-to-port features, subsumed by
	new forward zones.
	- fix parser to handle absent server: clause.
	- change untrusted rrset test to account for scrubber that is now
	applied during the test (which removes the poison, by the way).
	- feature, addresses can be specified with @portnumber, like nsd.conf.
	- test config files changed over to new forwarder syntax.

	27 June 2007: Wouter
	- delete of mesh does a postorder traverse of the tree.
	- found and fixed a memory leak. For TTL=0 messages, that would
	not be cached, instead the msg-replyinfo structure was leaked.
	- changed server selection so it will filter out hosts that are
	unresponsive. This is defined as a host with the maximum rto value.
	This means that unbound tried the host for retries up to 120 secs.
	The rto value will time out after host-ttl seconds from the cache.
	This keeps such unresolvable queries from taking up resources.
	- utility for keeping histogram.

	26 June 2007: Wouter
	- mesh is called by worker, and iterator uses it.
	This removes the hierarchical code.
	QueryTargets state and Finished state are merged for iterator.
	- forwarder mode no longer sets AA bit on first reply.
	- rcode in walk_supers is not needed.

	25 June 2007: Wouter
	- more mesh work.
	- error encode routine for ease.

	22 June 2007: Wouter
	- removed unused _node iterator value from rbtree_t. Takes up space.
	- iterator can handle querytargets state without a delegation point
	set, so that a priming(stub) subquery error can be handled.
	- iterator stores if it is priming or not.
	- log_query_info() neater logging.
	- changed iterator so that it does not alter module_qstate.qinfo
	but keeps a chase query info. Also query_flags are not altered,
	the iterator uses chase_flags.
	- fixup crash in case no ports for the family exist.

	21 June 2007: Wouter
	- Fixup secondary buffer in case of error callback.
	- cleanup slumber list of runnable states.
	- module_subreq_depth fails to work in slumber list.
	- fixup query release for cached results to sub targets.
	- neater error for tcp connection failure, shows addr in verbose.
	- rbtree_init so that it can be used with preallocated memory.

	20 June 2007: Wouter
	- new -C option to enable coredumps after forking away.
	- doc update.
	- fixup CNAME generation by scrubber, and memory allocation of it.
	- fixup deletion of serviced queries when all callbacks delete too.
	- set num target queries to 0 when you move them to slumber list.
	- typo in check caused subquery errors to be ignored, fixed.
	- make lint happy about rlim_t.
	- freeup of modules after freeup of module-states.
	- duplicate replies work, this uses secondary udp buffer in outnet.

	19 June 2007: Wouter
	- nicer layout in stats.c, review 0.3 change.
	- spelling improvement, review 0.3 change.
	- uncapped timeout for server selection, so that very fast or slow
	servers will stand out from the rest.
	- target-fetch-policy: "3 2 1 0 0" config setting.
	- fixup queries answered without RD bit (for root prime results).
	- refuse AXFR and IXFR requests.
	- fixup RD flag in error reply from iterator. fixup RA flag from
	worker error reply.
	- fixup encoding of very short edns buffer sizes, now sets TC bit.
	- config options harden-short-bufsize and harden-large-queries.

	18 June 2007: Wouter
	- same, move subqueries to slumber list when first has resolved.
	- fixup last fix for duplicate callbacks.
	- another offbyone in targetcounter. Also in Java prototype by the way.

	15 June 2007: Wouter
	- if a query asks to be notified of the same serviced query result
	multiple times, this will succeed. Only one callback will happen;
	multiple outbound-list entries result (but the double cleanup of it
	will not matter).
	- when iterator moves on due to CNAME or referral, it will remove
	the subqueries (for other targets). These are put on the slumber
	list.
	- state module wait subq is OK with no new subqs, an old one may have
	stopped, with an error, and it is still waiting for other ones.
	- if a query loops, halt entire query (easy way to clean up properly).

	14 June 2007: Wouter
	- num query targets was > 0 , not >= 0 compared, so that fetch
	policy of 0 did nothing.

	13 June 2007: Wouter
	- debug option: configure --enable-static-exe for compile where
	ldns and libevent are linked statically. Default is off.
	- make install and make uninstall. Works with static-exe and without.
	installation of unbound binary and manual pages.
	- alignment problem fix on solaris 64.
	- fixup address in case of TCP error.

	12 June 2007: Wouter
	- num target queries was set to 0 at a bad time. Default it to 0 and
	increase as target queries are done.
	- synthesize CNAME and DNAME responses from the cache.
	- Updated doxygen config for doxygen 1.5.
	- aclocal newer version.
	- doxygen 1.5 fixes for comments (for the strict check on docs).

	11 June 2007: Wouter
	- replies on TCP queries have the address field set in replyinfo,
	for serviced queries, because the initiator does not know that
	a TCP fallback has occured.
	- omit DNSSEC types from nonDO replies, except if qtype is ANY or
	if qtype directly queries for the type (and then only show that
	'unknown type' in the answer section).
	- fixed message parsing where rrsigs on their own would be put
	in the signature list over the rrsig type.

	7 June 2007: Wouter
	- fixup error in double linked list insertion for subqueries and
	for outbound list of serviced queries for iterator module.
	- nicer printout of outgoing port selection.
	- fixup cname target readout.
	- nicer debug output.
	- fixup rrset counts when prepending CNAMEs to the answer.
	- fixup rrset TTL for prepended CNAMEs.
	- process better check for looping modules, and which submodule to
	run next.
	- subreq insertion code fixup for slumber list.
	- VERB_DETAIL, verbosity: 2 level gives short but readable output.
	VERB_ALGO, verbosity: 3 gives extensive output.
	- fixup RA bit in cached replies.
	- fixup CNAME responses from the cache no longer partial response.
	- error in network send handled without leakage.
	- enable ip6 from config, and try ip6 addresses if available,
	if ip6 is not connected, skips to next server.

	5 June 2007: Wouter
	- iterator state finished.
	- subrequests without parent store in cache and stop.
	- worker slumber list for ongoing promiscuous queries.
	- subrequest error handling.
	- priming failure returns SERVFAIL.
	- priming gives LAME result, returns SERVFAIL.
	- debug routine to print dns_msg as handled by iterator.
	- memleak in config file stubs fixup.
	- more small bugs, in scrubber, query compare no ID for lookup,
	in dname validation for NS targets.
	- sets entry.key for new special allocs.
	- lognametypeclass can display unknown types and classes.

	4 June 2007: Wouter
	- random selection of equally preferred nameserver targets.
	- reply info copy routine. Reuses existing code.
	- cache lameness in response handling.
	- do not touch qstate after worker_process_query because it may have
	been deleted by that routine.
	- Prime response state.
	- Process target response state.
	- some memcmp changed to dname_compare for case preservation.

	1 June 2007: Wouter
	- normalize incoming messages. Like unbound-java, with CNAME chain
	checked, DNAME checked, CNAME's synthesized, glue checked.
	- sanitize incoming messages.
	- split msgreply encode functions into own file msgencode.c.
	- msg_parse to queryinfo/replyinfo conversion more versatile.
	- process_response, classify response, delegpt_from_message.

	31 May 2007: Wouter
	- querytargets state.
	- dname_subdomain_c() routine.
	- server selection, based on RTT. ip6 is filtered out if not available,
	and lameness is checked too.
	- delegation point copy routine.

	30 May 2007: Wouter
	- removed FLAG_CD from message and rrset caches. This was useful for
	an agnostic forwarder, but not for a sophisticated (trust value per
	rrset enabled) cache.
	- iterator response typing.
	- iterator cname handle.
	- iterator prime start.
	- subquery work.
	- processInitRequest and processInitRequest2.
	- cache synthesizes referral messages, with DS and NSEC.
	- processInitRequest3.
	- if a request creates multiple subrequests these are all activated.

	29 May 2007: Wouter
	- routines to lock and unlock array of rrsets moved to cache/rrset.
	- lookup message from msg cache (and copy to region).
	- fixed cast error in dns msg lookup.
	- message with duplicate rrset does not increase its TTLs twice.
	- 'qnamesize' changed to 'qname_len' for similar naming scheme.

	25 May 2007: Wouter
	- Acknowledge use of unbound-java code in iterator. Nicer readme.
	- services/cache/dns.c DNS Cache. Hybrid cache uses msgcache and
	rrset cache from module environment.
	- packed rrset key has type and class as easily accessible struct
	members. They are still kept in network format for fast msg encode.
	- dns cache find_delegation routine.
	- iterator main functions setup.
	- dns cache lookup setup.

	24 May 2007: Wouter
	- small changes to prepare for subqueries.
	- iterator forwarder feature separated out.
	- iterator hints stub code, config file stub code, so that first
	testing can proceed locally.
	- replay tests now have config option to enable forwarding mode.

	23 May 2007: Wouter
	- outside network does precise timers for roundtrip estimates for rtt
	and for setting timeout for UDP. Pending_udp takes milliseconds.
	- cleaner iterator sockaddr conversion of forwarder address.
	- iterator/iter_utils and iter_delegpt setup.
	- root hints.

	22 May 2007: Wouter
	- outbound query list for modules and support to callback with the
	outbound entry to the module.
	- testbound support for new serviced queries.
	- test for retry to TCP cannot use testbound any longer.
	- testns test for EDNS fallback, test for TCP fallback already exists.
	- fixes for no-locking compile.
	- mini_event timer precision and fix for change in timeouts during
	timeout callback. Fix for fwd_three tests, performed nonexit query.

	21 May 2007: Wouter
	- small comment on hash table locking.
	- outside network serviced queries, contain edns and tcp fallback,
	and udp retries and rtt timing.

	16 May 2007: Wouter
	- lruhash_touch() would cause locking order problems. Fixup in
	lock-verify in case locking cycle is found.
	- services/cache/rrset.c for rrset cache code.
	- special rrset_cache LRU updating function that uses the rrset id.
	- no dependencies calculation when make clean is called.
	- config settings for infra cache.
	- daemon code slightly cleaner, only creates caches once.

	15 May 2007: Wouter
	- host cache code.
	- unit test for host cache.

	14 May 2007: Wouter
	- Port to OS/X and Dec Alpha. Printf format and alignment fixes.
	- extensive lock debug report on join timeout.
	- proper RTT calculation, in utility code.
	- setup of services/cache/infra, host cache.

	11 May 2007: Wouter
	- iterator/iterator.c module.
	- fixup to pass reply_info in testcode and in netevent.

	10 May 2007: Wouter
	- created release-0.3 svn tag.
	- util/module.h
	- fixed compression - no longer compresses root name.

	9 May 2007: Wouter
	- outside network cleans up waiting tcp queries on exit.
	- fallback to TCP.
	- testbound replay with retry in TCP mode.
	- tpkg test for retry in TCP mode, against ldns-testns server.
	- daemon checks max number of open files and complains if not enough.
	- test where data expires in the cache.
	- compiletests: fixed empty body ifstatements in alloc.c, in case
	locks are disabled.

	8 May 2007: Wouter
	- outgoing network keeps list of available tcp buffers for outgoing
	tcp queries.
	- outgoing-num-tcp config option.
	- outgoing network keeps waiting list of queries waiting for buffer.
	- netevent supports outgoing tcp commpoints, nonblocking connects.

	7 May 2007: Wouter
	- EDNS read from query, used to make reply smaller.
	- advertised edns value constants.
	- EDNS BADVERS response, if asked for too high edns version.
	- EDNS extended error responses once the EDNS record from the query
	has successfully been parsed.

	4 May 2007: Wouter
	- msgreply sizefunc is more accurate.
	- config settings for rrset cache size and slabs.
	- hashtable insert takes argument so that a thread can use its own
	alloc cache to store released keys.
	- alloc cache special_release() locks if necessary.
	- rrset trustworthiness type added.
	- thread keeps a scratchpad region for handling messages.
	- writev used in netevent to write tcp length and data after another.
	This saves a roundtrip on tcp replies.
	- test for one rrset updated in the cache.
	- test for one rrset which is not updated, as it is not deemed
	trustworthy enough.
	- test for TTL refreshed in rrset.

	3 May 2007: Wouter
	- fill refs. Use new parse and encode to answer queries.
	- stores rrsets in cache.
	- uses new msgreply format in cache.

	2 May 2007: Wouter
	- dname unit tests in own file and spread out neatly in functions.
	- more dname unit tests.
	- message encoding creates truncated TC flagged messages if they do
	not fit, and will leave out (whole)rrsets from additional if needed.

	1 May 2007: Wouter
	- decompress query section, extremely lenient acceptance.
	But only for answers from other servers, not for plain queries.
	- compression and decompression test cases.
	- some stats added.
	- example.conf interface: line is changed from 127.0.0.1 which leads
	to problems if used (restricting communication to the localhost),
	to a documentation and test address.

	27 April 2007: Wouter
	- removed iov usage, it is not good for dns message encoding.
	- owner name compression more optimal.
	- rrsig owner name compression.
	- rdata domain name compression.

	26 April 2007: Wouter
	- floating point exception fix in lock-verify.
	- lint uses make dependency
	- fixup lint in dname owner domain name compression code.
	- define for offset range that can be compressed to.

	25 April 2007: Wouter
	- prettier code; parse_rrset->type kept in host byte order.
	- datatype used for hashvalue of converted rrsig structure.
	- unit test compares edns section data too.

	24 April 2007: Wouter
	- ttl per RR, for RRSIG rrsets and others.
	- dname_print debug function.
	- if type is not known, size calc will skip DNAME decompression.
	- RRSIG parsing and storing and putting in messages.
	- dnssec enabled unit tests (from nlnetlabs.nl and se queries).
	- EDNS extraction routine.

	20 April 2007: Wouter
	- code comes through all of the unit tests now.
	- disabled warning about spurious extra data.
	- documented the RRSIG parse plan in msgparse.h.
	- rrsig reading and outputting.

	19 April 2007: Wouter
	- fix unit test to actually to tests.
	- fix write iov helper, and fakevent code.
	- extra builtin testcase (small packet).
	- ttl converted to network format in packets.
	- flags converted correctly
	- rdatalen off by 2 error fixup.
	- uses less iov space for header.

	18 April 2007: Wouter
	- review of msgparse code.
	- smaller test cases.

	17 April 2007: Wouter
	- copy and decompress dnames.
	- store calculated hash value too.
	- routine to create message out of stored information.
	- util/data/msgparse.c for message parsing code.
	- unit test, and first fixes because of test.
	* forgot rrset_count addition.
	* did & of ptr on stack for memory position calculation.
	* dname_pkt_copy forgot to read next label length.
	- test from file and fixes
	* double frees fixed in error conditions.
	* types with less than full rdata allowed by parser.
	Some dynamic update packets seem to use it.

	16 April 2007: Wouter
	- following a small change in LDNS, parsing code calculates the
	memory size to allocate for rrs.
	- code to handle ID creation.

	13 April 2007: Wouter
	- parse routines. Code that parses rrsets, rrs.

	12 April 2007: Wouter
	- dname compare routine that preserves case, with unit tests.

	11 April 2007: Wouter
	- parse work - dname packet parse, msgparse, querysection parse,
	start of sectionparse.

	10 April 2007: Wouter
	- Improved alignment of reply_info packet, nice for 32 and 64 bit.
	- Put RRset counts in reply_info, because the number of RRs can change
	due to RRset updates.
	- import of region-allocator code from nsd.
	- set alloc special type to ub_packed_rrset_key.
	Uses lruhash entry overflow chain next pointer in alloc cache.
	- doxygen documentation for region-allocator.
	- setup for parse scratch data.

	5 April 2007: Wouter
	- discussed packed rrset with Jelte.

	4 April 2007: Wouter
	- moved to version 0.3.
	- added util/data/dname.c
	- layout of memory for rrsets.

	3 April 2007: Wouter
	- detect sign of msghdr.msg_iovlen so that the cast to that type
	in netevent (which is there to please lint) can be correct.
	The type on several OSes ranges from int, int32, uint32, size_t.
	Detects unsigned or signed using math trick.
	- constants for DNS flags.
	- compilation without locks fixup.
	- removed include of unportable header from lookup3.c.
	- more portable use of struct msghdr.
	- casts for printf warning portability.
	- tweaks to tests to port them to the testbed.
	- 0.2 tag created.

	2 April 2007: Wouter
	- check sizes of udp received messages, not too short.
	- review changes. Some memmoves can be memcpys: 4byte aligned.
	set id correctly on cached answers.
	- review changes msgreply.c, memleak on error condition. AA flag
	clear on cached reply. Lowercase queries on hashing.
	unit test on lowercasing. Test AA bit not set on cached reply.
	Note that no TTLs are managed.

	29 March 2007: Wouter
	- writev or sendmsg used when answering from cache.
	This avoids a copy of the data.
	- do not do useless byteswap on query id. Store reply flags in uint16
	for easier access (and no repeated byteswapping).
	- reviewed code.
	- configure detects and config.h includes sys/uio.h for writev decl.

	28 March 2007: Wouter
	- new config option: num-queries-per-thread.
	- added tpkg test for answering three queries at the same time
	using one thread (from the query service list).

	27 March 2007: Wouter
	- added test for cache and not cached answers, in testbound replays.
	- testbound can give config file and commandline options from the
	replay file to unbound.
	- created test that checks if items drop out of the cache.
	- added word 'partitioned hash table' to documentation on slab hash.
	A slab hash is a partitioned hash table.
	- worker can handle multiple queries at a time.

	26 March 2007: Wouter
	- config settings for slab hash message cache.
	- test for cached answer.
	- Fixup deleting fake answer from testbound list.

	23 March 2007: Wouter
	- review of yesterday's commits.
	- covered up memory leak of the entry locks.
	- answers from the cache correctly. Copies flags correctly.
	- sanity check for incoming query replies.
	- slabbed hash table. Much nicer contention, need dual cpu to see.

	22 March 2007: Wouter
	- AIX configure check.
	- lock-verify can handle references to locks that are created
	in files it has not yet read in.
	- threaded hash table test.
	- unit test runs lock-verify afterwards and checks result.
	- need writelock to update data on hash_insert.
	- message cache code, msgreply code.

	21 March 2007: Wouter
	- unit test of hash table, fixup locking problem in table_grow().
	- fixup accounting of sizes for removing items from hashtable.
	- unit test for hash table, single threaded test of integrity.
	- lock-verify reports errors nicely. More quiet in operation.

	16 March 2007: Wouter
	- lock-verifier, checks consistent order of locking.

	14 March 2007: Wouter
	- hash table insert (and subroutines) and lookup implemented.
	- hash table remove.
	- unit tests for hash internal bin, lru functions.

	13 March 2007: Wouter
	- lock_unprotect in checklocks.
	- util/storage/lruhash.h for LRU hash table structure.

	12 March 2007: Wouter
	- configure.ac moved to 0.2.
	- query_info and replymsg util/data structure.

	9 March 2007: Wouter
	- added rwlock writelock checking.
	So it will keep track of the writelock, and readlocks are enforced
	to not change protected memory areas.
	- log_hex function to dump hex strings to the logfile.
	- checklocks zeroes its destroyed lock after checking memory areas.
	- unit test for alloc.
	- identifier for union in checklocks to please older compilers.
	- created 0.1 tag.

	8 March 2007: Wouter
	- Reviewed checklock code.

	7 March 2007: Wouter
	- created a wrapper around thread calls that performs some basic
	checking for data race and deadlock, and basic performance
	contention measurement.

	6 March 2007: Wouter
	- Testbed works with threading (different machines, different options).
	- alloc work, does the special type.

	2 March 2007: Wouter
	- do not compile fork funcs unless needed. Otherwise will give
	type errors as their typedefs have not been enabled.
	- log shows thread numbers much more nicely (and portably).
	- even on systems with nonthreadsafe libevent signal handling,
	unbound will exit if given a signal.
	Reloads will not work, and exit is not graceful.
	- start of alloc framework layout.

	1 March 2007: Wouter
	- Signals, libevent and threads work well, with libevent patch and
	changes to code (close after event_del).
	- set ipc pipes nonblocking.

	27 February 2007: Wouter
	- ub_thread_join portable definition.
	- forking is used if no threading is available.
	Tested, it works, since pipes work across processes as well.
	Thread_join is replaced with waitpid.
	- During reloads the daemon will temporarily handle signals,
	so that they do not result in problems.
	- Also randomize the outgoing port range for tests.
	- If query list is full, will stop selecting listening ports for read.
	This makes all threads service incoming requests, instead of one.
	No memory is leaking during reloads, service of queries, etc.
	- test that uses ldns-testns -f to test threading. Have to answer
	three queries at the same time.
	- with verbose=0 operates quietly.

	26 February 2007: Wouter
	- ub_random code used to select ID and port.
	- log code prints thread id.
	- unbound can thread itself, with reload(HUP) and quit working
	correctly.
	- don't open pipes for #0, doesn't need it.
	- listens to SIGTERM, SIGQUIT, SIGINT (all quit) and SIGHUP (reload).

	23 February 2007: Wouter
	- Can do reloads on sigHUP. Everything is stopped, and freed,
	except the listening ports. Then the config file is reread.
	And everything is started again (and listening ports if needed).
	- Ports for queries are shared.
	- config file added interface:, chroot: and username:.
	- config file: directory, logfile, pidfile. And they work too.
	- will daemonize by default now. Use -d to stay in the foreground.
	- got BSD random[256 state] code, made it threadsafe. util/random.

	22 February 2007: Wouter
	- Have a config file. Removed commandline options, moved to config.
	- tests use config file.

	21 February 2007: Wouter
	- put -c option in man page.
	- minievent fd array capped by FD_SETSIZE.

	20 February 2007: Wouter
	- Added locks code and pthread spinlock detection.
	- can use no locks, or solaris native thread library.
	- added yacc and lex configure, and config file parsing code.
	also makedist.sh, and manpage.
	- put include errno.h in config.h

	19 February 2007: Wouter
	- Created 0.0 svn tag.
	- added acx_pthread.m4 autoconf check for pthreads from
	the autoconf archive. It is GPL-with-autoconf-exception Licensed.
	You can specify --with-pthreads, or --without-pthreads to configure.

	16 February 2007: Wouter
	- Updated testbed script, works better by using make on remote end.
	- removed check decls, we can compile without them.
	- makefile supports LIBOBJ replacements.
	- docs checks ignore compat code.
	- added util/mini-event.c and .h, a select based alternative used with
	./configure --with-libevent=no
	It is limited to 1024 file descriptors, and has less features.
	- will not create ip6 sockets if ip6 not on the machine.

	15 February 2007: Wouter
	- port to FreeBSD 4.11 Dec Alpha. Also works on Solaris 10 sparc64,
	Solaris 9, FreeBSD 6, Linux i386 and OSX powerpc.
	- malloc rndstate, so that it is aligned for access.
	- fixed rbtree cleanup with postorder traverse.
	- fixed pending messages are deleted when handled.
	- You can control verbosity; default is not verbose, every -v
	adds more verbosity.

	14 February 2007: Wouter
	- Included configure.ac changes from ldns.
	- detect (some) headers before the standards check.
	- do not use isblank to test c99, since its not available on solaris9.
	- review of testcode.
	* entries in a RANGE are no longer reversed.
	* print name of file with replay entry parse errors.
	- port to OSX: cast to int for some prints of sizet.
	- Makefile copies ldnstestpkts.c before doing dependencies on it.

	13 February 2007: Wouter
	- work on fake events, first fwd replay works.
	- events can do timeouts and errors on queries to servers.
	- test package that runs replay scenarios.

	12 February 2007: Wouter
	- work on fake events.

	9 February 2007: Wouter
	- replay file reading.
	- fake event setup, it creates fake structures, and teardowns,
	added signal callbacks to reply to be able to fake those,
	and main structure of event replay routines.

	8 February 2007: Wouter
	- added tcp test.
	- replay storage.
	- testcode/fake_event work.

	7 February 2007: Wouter
	- return answer with the same ID as query was sent with.
	- created udp forwarder test. I've done some effort to make it perform
	quickly. After servers are created, no big sleep statements but
	it checks the logfiles to see if servers have come up. Takes 0.14s.
	- set addrlen value when calling recvfrom.
	- comparison of addrs more portable.
	- LIBEVENT option for testbed to set libevent directory.
	- work on tcp input.

	6 February 2007: Wouter
	- reviewed code and improved in places.

	5 February 2007: Wouter
	- Picked up stdc99 and other define tests from ldns. Improved
	POSIX define test to include getaddrinfo.
	- defined constants for netevent callback error code.
	- unit test for strisip6.

	2 February 2007: Wouter
	- Created udp4 and udp6 port arrays to provide service for both
	address families.
	- uses IPV6_USE_MIN_MTU for udp6 ,IPV6_V6ONLY to make ip6 sockets.
	- listens on both ip4 and ip6 ports to provide correct return address.
	- worker fwder address filled correctly.
	- fixup timer code.
	- forwards udp queries and sends answer.

	1 February 2007: Wouter
	- outside network more UDP work.
	- moved * closer to type.
	- comm_timer object and events.

	31 January 2007: Wouter
	- Added makedist.sh script to make release tarball.
	- Removed listen callback layer, did not add anything.
	- Added UDP recv to netevent, worker callback for udp.
	- netevent communication reply storage structure.
	- minimal query header sanity checking for worker.
	- copied over rbtree implementation from NSD (BSD licensed too).
	- outgoing network query service work.

	30 January 2007: Wouter
	- links in example/ldns-testpkts.c and .h for premade packet support.
	- added callback argument to listen_dnsport and daemon/worker.

	29 January 2007: Wouter
	- unbound.8 a short manpage.

	26 January 2007: Wouter
	- fixed memleak.
	- make lint works on BSD and Linux (openssl defines).
	- make tags works.
	- testbound program start.

	25 January 2007: Wouter
	- fixed lint so it may work on BSD.
	- put license into header of every file.
	- created verbosity flag.
	- fixed libevent configure flag.
	- detects event_base_free() in new libevent 1.2 version.
	- getopt in daemon. fatal_exit() and verbose() logging funcs.
	- created log_assert, that throws assertions to the logfile.
	- listen_dnsport service. Binds ports.

	24 January 2007: Wouter
	- cleaned up configure.ac.

	23 January 2007: Wouter
	- added libevent to configure to link with.
	- util/netevent setup work.
	- configure searches for libevent.
	- search for libs at end of configure (when other headers and types
	have been found).
	- doxygen works with ATTR_UNUSED().
	- util/netevent implementation.

	22 January 2007: Wouter
	- Designed header file for network communication.

	16 January 2007: Wouter
	- added readme.svn and readme.tests.

	4 January 2007: Wouter
	- Testbed script (run on multiple platforms the test set).
	Works on Sunos9, Sunos10, FreeBSD 6.1, Fedora core 5.
	- added unit test tpkg.

	3 January 2007: Wouter
	- committed first set of files into subversion repository.
	svn co svn+ssh://unbound.net/svn/unbound
	You need a ssh login. There is no https access yet.
	- Added LICENSE, the BSD license.
	- Added doc/README with compile help.
	- main program stub and quiet makefile.
	- minimal logging service (to stderr).
	- added postcommit hook that serves emails.
	- added first test 00-lint. postcommit also checks if build succeeds.
	- 01-doc: doxygen doc target added for html docs. And stringent test
	on documented files, functions and parameters.

	15 December 2006: Wouter
	- Created Makefile.in and configure.ac.
	Index: head/contrib/unbound/doc/README
	===================================================================
	--- head/contrib/unbound/doc/README (revision 349719)
	+++ head/contrib/unbound/doc/README (revision 349720)
	@@ -1,151 +1,151 @@
	-README for Unbound 1.8.1
	+README for Unbound 1.9.2
	Copyright 2007 NLnet Labs
	http://unbound.net

	This software is under BSD license, see LICENSE for details.
	The DNS64 module has BSD license in dns64/dns64.c.
	The DNSTAP code has BSD license in dnstap/dnstap.c.

	* Download the latest release version of this software from
	http://unbound.net
	or get a beta version from the svn repository at
	http://unbound.net/svn/

	* Uses the following libraries;
	* libevent http://www.monkey.org/~provos/libevent/ (BSD license)
	(optional) can use builtin alternative instead.
	* libexpat (for the unbound-anchor helper program) (MIT license)

	* Make and install: ./configure; make; make install
	* --with-libevent=/path/to/libevent
	Can be set to either the system install or the build directory.
	--with-libevent=no (default) gives a builtin alternative
	implementation. libevent is useful when having many (thousands)
	of outgoing ports. This improves randomization and spoof
	resistance. For the default of 16 ports the builtin alternative
	works well and is a little faster.
	* --with-libexpat=/path/to/libexpat
	Can be set to the install directory of libexpat.
	* --without-pthreads
	This disables pthreads. Without this option the pthreads library
	is detected automatically. Use this option to disable threading
	altogether, or, on Solaris, also use --with(out)-solaris-threads.
	* --enable-checking
	This enables assertions in the code that guard against a variety of
	programming errors, among which buffer overflows. The program exits
	with an error if an assertion fails (but the buffer did not overflow).
	* --enable-static-exe
	This enables a debug option to statically link against the
	libevent library.
	* --enable-lock-checks
	This enables a debug option to check lock and unlock calls. It needs
	a recent pthreads library to work.
	* --enable-alloc-checks
	This enables a debug option to check malloc (calloc, realloc, free).
	The server periodically checks if the amount of memory used fits with
	the amount of memory it thinks it should be using, and reports
	memory usage in detail.
	* --with-conf-file=filename
	Set default location of config file,
	the default is /usr/local/etc/unbound/unbound.conf.
	* --with-pidfile=filename
	Set default location of pidfile,
	the default is /usr/local/etc/unbound/unbound.pid.
	* --with-run-dir=path
	Set default working directory,
	the default is /usr/local/etc/unbound.
	* --with-chroot-dir=path
	Set default chroot directory,
	the default is /usr/local/etc/unbound.
	* --with-rootkey-file=path
	Set the default root.key path. This file is read and written.
	the default is /usr/local/etc/unbound/root.key
	* --with-rootcert-file=path
	Set the default root update certificate path. A builtin certificate
	is used if this file is empty or does not exist.
	the default is /usr/local/etc/unbound/icannbundle.pem
	* --with-username=user
	Set default user name to change to,
	the default is the "unbound" user.
	* --with-pyunbound
	Create libunbound wrapper usable from python.
	Needs python-devel and swig development tools.
	* --with-pythonmodule
	Compile the python module that processes responses in the server.
	* --disable-sha2
	Disable support for RSASHA256 and RSASHA512 crypto.
	* --disable-gost
	Disable support for GOST crypto, RFC 5933.
	* --enable-subnet
	Enable EDNS client subnet processing.

	* 'make test' runs a series of self checks.

	Known issues
	------------
	o If there are no replies for a forward or stub zone, for a reverse zone,
	you may need to add a local-zone: name transparent or nodefault to the
	server: section of the config file to unblock the reverse zone.
	Only happens for (sub)zones that are blocked by default; e.g. 10.in-addr.arpa
	o If libevent is older (before 1.3c), unbound will exit instead of reload
	on sighup. On a restart 'did not exit gracefully last time' warning is
	printed. Perform ./configure --with-libevent=no or update libevent, rerun
	configure and recompile unbound to make sighup work correctly.
	It is strongly suggested to use a recent version of libevent.
	o If you are not receiving the correct source IP address on replies (e.g.
	you are running a multihomed, anycast server), the interface-automatic
	option can be enabled to set socket options to achieve the correct
	source IP address on UDP replies. Listing all IP addresses explicitly in
	the config file is an alternative. The interface-automatic option uses
	non portable socket options, Linux and FreeBSD should work fine.
	o The warning 'openssl has no entropy, seeding with time', with chroot
	enabled, may be solved with a symbolic link to /dev/random from <chrootdir>.
	o On Solaris 5.10 some libtool packages from repositories do not work with
	gcc, showing errors gcc: unrecognized option `-KPIC'
	To solve this do ./configure libtool=./libtool [your options...].
	On Solaris you may pass CFLAGS="-xO4 -xtarget=generic" if you use sun-cc.
	o If unbound-control (or munin graphs) do not work, this can often be because
	the unbound-control-setup script creates the keys with restricted
	permissions, and the files need to be made readable or ownered by both the
	unbound daemon and unbound-control.
	o Crosscompile seems to hang. You tried to install unbound under wine.
	wine regedit and remove all the unbound entries from the registry or
	delete .wine/drive_c.

	Acknowledgements
	----------------
	o Unbound was written in portable C by Wouter Wijngaards (NLnet Labs).
	o Thanks to David Blacka and Matt Larson (Verisign) for the unbound-java
	prototype. Design and code from that prototype has been used to create
	this program. Such as the iterator state machine and the cache design.
	o Other code origins are from the NSD (NLnet Labs) and LDNS (NLnet Labs)
	projects. Such as buffer, region-allocator and red-black tree code.
	o See Credits file for contributors.


	Your Support
	------------
	NLnet Labs offers all of its software products as open source, most are
	published under a BSD license. You can download them, not only from the
	NLnet Labs website but also through the various OS distributions for
	which NSD, ldns, and Unbound are packaged. We therefore have little idea
	who uses our software in production environments and have no direct ties
	with 'our customers'.

	Therefore, we ask you to contact us at users@NLnetLabs.nl and tell us
	whether you use one of our products in your production environment,
	what that environment looks like, and maybe even share some praise.
	We would like to refer to the fact that your organization is using our
	products. We will only do that if you explicitly allow us. In all other
	cases we will keep the information you share with us to ourselves.

	In addition to the moral support you can also support us
	financially. NLnet Labs is a recognized not-for-profit charity foundation
	that is chartered to develop open-source software and open-standards
	for the Internet. If you use our software to satisfaction please express
	that by giving us a donation. For small donations PayPal can be used. For
	larger and regular donations please contact us at users@NLnetLabs.nl. Also
	see http://www.nlnetlabs.nl/labs/contributors/.


	* mailto:unbound-bugs@nlnetlabs.nl
	Index: head/contrib/unbound/doc/example.conf
	===================================================================
	--- head/contrib/unbound/doc/example.conf (revision 349719)
	+++ head/contrib/unbound/doc/example.conf (revision 349720)
	@@ -1,950 +1,994 @@
	#
	# Example configuration file.
	#
	-# See unbound.conf(5) man page, version 1.8.1.
	+# See unbound.conf(5) man page, version 1.9.2.
	#
	# this is a comment.

	#Use this to include other text into the file.
	#include: "otherfile.conf"

	# The server clause sets the main parameters.
	server:
	# whitespace is not necessary, but looks cleaner.

	# verbosity number, 0 is least verbose. 1 is default.
	verbosity: 1

	# print statistics to the log (for every thread) every N seconds.
	# Set to "" or 0 to disable. Default is disabled.
	# statistics-interval: 0

	# enable shm for stats, default no. if you enable also enable
	# statistics-interval, every time it also writes stats to the
	# shared memory segment keyed with shm-key.
	# shm-enable: no

	# shm for stats uses this key, and key+1 for the shared mem segment.
	# shm-key: 11777

	# enable cumulative statistics, without clearing them after printing.
	# statistics-cumulative: no

	# enable extended statistics (query types, answer codes, status)
	# printed from unbound-control. default off, because of speed.
	# extended-statistics: no

	# number of threads to create. 1 disables threading.
	# num-threads: 1

	# specify the interfaces to answer queries from by ip-address.
	# The default is to listen to localhost (127.0.0.1 and ::1).
	# specify 0.0.0.0 and ::0 to bind to all available interfaces.
	# specify every interface[@port] on a new 'interface:' labelled line.
	# The listen interfaces are not changed on reload, only on restart.
	# interface: 192.0.2.153
	# interface: 192.0.2.154
	# interface: 192.0.2.154@5003
	# interface: 2001:DB8::5

	# enable this feature to copy the source address of queries to reply.
	# Socket options are not supported on all platforms. experimental.
	# interface-automatic: no

	# port to answer queries from
	# port: 53

	# specify the interfaces to send outgoing queries to authoritative
	# server from by ip-address. If none, the default (all) interface
	# is used. Specify every interface on a 'outgoing-interface:' line.
	# outgoing-interface: 192.0.2.153
	# outgoing-interface: 2001:DB8::5
	# outgoing-interface: 2001:DB8::6

	# Specify a netblock to use remainder 64 bits as random bits for
	# upstream queries. Uses freebind option (Linux).
	# outgoing-interface: 2001:DB8::/64
	# Also (Linux:) ip -6 addr add 2001:db8::/64 dev lo
	# And: ip -6 route add local 2001:db8::/64 dev lo
	# And set prefer-ip6: yes to use the ip6 randomness from a netblock.
	# Set this to yes to prefer ipv6 upstream servers over ipv4.
	# prefer-ip6: no

	# number of ports to allocate per thread, determines the size of the
	# port range that can be open simultaneously. About double the
	# num-queries-per-thread, or, use as many as the OS will allow you.
	# outgoing-range: 4096

	# permit unbound to use this port number or port range for
	# making outgoing queries, using an outgoing interface.
	# outgoing-port-permit: 32768

	# deny unbound the use this of port number or port range for
	# making outgoing queries, using an outgoing interface.
	# Use this to make sure unbound does not grab a UDP port that some
	# other server on this computer needs. The default is to avoid
	# IANA-assigned port numbers.
	# If multiple outgoing-port-permit and outgoing-port-avoid options
	# are present, they are processed in order.
	# outgoing-port-avoid: "3200-3208"

	# number of outgoing simultaneous tcp buffers to hold per thread.
	# outgoing-num-tcp: 10

	# number of incoming simultaneous tcp buffers to hold per thread.
	# incoming-num-tcp: 10

	# buffer size for UDP port 53 incoming (SO_RCVBUF socket option).
	# 0 is system default. Use 4m to catch query spikes for busy servers.
	# so-rcvbuf: 0

	# buffer size for UDP port 53 outgoing (SO_SNDBUF socket option).
	# 0 is system default. Use 4m to handle spikes on very busy servers.
	# so-sndbuf: 0

	# use SO_REUSEPORT to distribute queries over threads.
	+ # at extreme load it could be better to turn it off to distribute even.
	# so-reuseport: yes

	# use IP_TRANSPARENT so the interface: addresses can be non-local
	# and you can config non-existing IPs that are going to work later on
	# (uses IP_BINDANY on FreeBSD).
	# ip-transparent: no

	# use IP_FREEBIND so the interface: addresses can be non-local
	# and you can bind to nonexisting IPs and interfaces that are down.
	# Linux only. On Linux you also have ip-transparent that is similar.
	# ip-freebind: no

	# EDNS reassembly buffer to advertise to UDP peers (the actual buffer
	# is set with msg-buffer-size). 1472 can solve fragmentation (timeouts)
	# edns-buffer-size: 4096

	# Maximum UDP response size (not applied to TCP response).
	# Suggested values are 512 to 4096. Default is 4096. 65536 disables it.
	# max-udp-size: 4096

	+ # max memory to use for stream(tcp and tls) waiting result buffers.
	+ # stream-wait-size: 4m
	+
	# buffer size for handling DNS data. No messages larger than this
	# size can be sent or received, by UDP or TCP. In bytes.
	# msg-buffer-size: 65552

	# the amount of memory to use for the message cache.
	# plain value in bytes or you can append k, m or G. default is "4Mb".
	# msg-cache-size: 4m

	# the number of slabs to use for the message cache.
	# the number of slabs must be a power of 2.
	# more slabs reduce lock contention, but fragment memory usage.
	# msg-cache-slabs: 4

	# the number of queries that a thread gets to service.
	# num-queries-per-thread: 1024

	# if very busy, 50% queries run to completion, 50% get timeout in msec
	# jostle-timeout: 200

	# msec to wait before close of port on timeout UDP. 0 disables.
	# delay-close: 0

	+ # msec for waiting for an unknown server to reply. Increase if you
	+ # are behind a slow satellite link, to eg. 1128.
	+ # unknown-server-time-limit: 376
	+
	# the amount of memory to use for the RRset cache.
	# plain value in bytes or you can append k, m or G. default is "4Mb".
	# rrset-cache-size: 4m

	# the number of slabs to use for the RRset cache.
	# the number of slabs must be a power of 2.
	# more slabs reduce lock contention, but fragment memory usage.
	# rrset-cache-slabs: 4

	# the time to live (TTL) value lower bound, in seconds. Default 0.
	# If more than an hour could easily give trouble due to stale data.
	# cache-min-ttl: 0

	# the time to live (TTL) value cap for RRsets and messages in the
	# cache. Items are not cached for longer. In seconds.
	# cache-max-ttl: 86400

	# the time to live (TTL) value cap for negative responses in the cache
	# cache-max-negative-ttl: 3600

	# the time to live (TTL) value for cached roundtrip times, lameness and
	# EDNS version information for hosts. In seconds.
	# infra-host-ttl: 900

	# minimum wait time for responses, increase if uplink is long. In msec.
	# infra-cache-min-rtt: 50

	# the number of slabs to use for the Infrastructure cache.
	# the number of slabs must be a power of 2.
	# more slabs reduce lock contention, but fragment memory usage.
	# infra-cache-slabs: 4

	# the maximum number of hosts that are cached (roundtrip, EDNS, lame).
	# infra-cache-numhosts: 10000

	# define a number of tags here, use with local-zone, access-control.
	# repeat the define-tag statement to add additional tags.
	# define-tag: "tag1 tag2 tag3"

	# Enable IPv4, "yes" or "no".
	# do-ip4: yes

	# Enable IPv6, "yes" or "no".
	# do-ip6: yes

	# Enable UDP, "yes" or "no".
	# do-udp: yes

	# Enable TCP, "yes" or "no".
	# do-tcp: yes

	# upstream connections use TCP only (and no UDP), "yes" or "no"
	# useful for tunneling scenarios, default no.
	# tcp-upstream: no

	# upstream connections also use UDP (even if do-udp is no).
	# useful if if you want UDP upstream, but don't provide UDP downstream.
	# udp-upstream-without-downstream: no

	# Maximum segment size (MSS) of TCP socket on which the server
	# responds to queries. Default is 0, system default MSS.
	# tcp-mss: 0

	# Maximum segment size (MSS) of TCP socket for outgoing queries.
	# Default is 0, system default MSS.
	# outgoing-tcp-mss: 0

	# Idle TCP timeout, connection closed in milliseconds
	# tcp-idle-timeout: 30000

	# Enable EDNS TCP keepalive option.
	# edns-tcp-keepalive: no

	# Timeout for EDNS TCP keepalive, in msec.
	# edns-tcp-keepalive-timeout: 120000

	# Use systemd socket activation for UDP, TCP, and control sockets.
	# use-systemd: no

	# Detach from the terminal, run in background, "yes" or "no".
	# Set the value to "no" when unbound runs as systemd service.
	# do-daemonize: yes

	# control which clients are allowed to make (recursive) queries
	# to this server. Specify classless netblocks with /size and action.
	# By default everything is refused, except for localhost.
	# Choose deny (drop message), refuse (polite error reply),
	# allow (recursive ok), allow_setrd (recursive ok, rd bit is forced on),
	# allow_snoop (recursive and nonrecursive ok)
	# deny_non_local (drop queries unless can be answered from local-data)
	# refuse_non_local (like deny_non_local but polite error reply).
	# access-control: 0.0.0.0/0 refuse
	# access-control: 127.0.0.0/8 allow
	# access-control: ::0/0 refuse
	# access-control: ::1 allow
	# access-control: ::ffff:127.0.0.1 allow

	# tag access-control with list of tags (in "" with spaces between)
	# Clients using this access control element use localzones that
	# are tagged with one of these tags.
	# access-control-tag: 192.0.2.0/24 "tag2 tag3"

	# set action for particular tag for given access control element
	# if you have multiple tag values, the tag used to lookup the action
	# is the first tag match between access-control-tag and local-zone-tag
	# where "first" comes from the order of the define-tag values.
	# access-control-tag-action: 192.0.2.0/24 tag3 refuse

	# set redirect data for particular tag for access control element
	# access-control-tag-data: 192.0.2.0/24 tag2 "A 127.0.0.1"

	# Set view for access control element
	# access-control-view: 192.0.2.0/24 viewname

	# if given, a chroot(2) is done to the given directory.
	# i.e. you can chroot to the working directory, for example,
	# for extra security, but make sure all files are in that directory.
	#
	# If chroot is enabled, you should pass the configfile (from the
	# commandline) as a full path from the original root. After the
	# chroot has been performed the now defunct portion of the config
	# file path is removed to be able to reread the config after a reload.
	#
	# All other file paths (working dir, logfile, roothints, and
	# key files) can be specified in several ways:
	# o as an absolute path relative to the new root.
	# o as a relative path to the working directory.
	# o as an absolute path relative to the original root.
	# In the last case the path is adjusted to remove the unused portion.
	#
	# The pid file can be absolute and outside of the chroot, it is
	# written just prior to performing the chroot and dropping permissions.
	#
	# Additionally, unbound may need to access /dev/random (for entropy).
	# How to do this is specific to your OS.
	#
	# If you give "" no chroot is performed. The path must not end in a /.
	# chroot: "/var/unbound"

	# if given, user privileges are dropped (after binding port),
	# and the given username is assumed. Default is user "unbound".
	# If you give "" no privileges are dropped.
	# username: "unbound"

	# the working directory. The relative files in this config are
	# relative to this directory. If you give "" the working directory
	# is not changed.
	# If you give a server: directory: dir before include: file statements
	# then those includes can be relative to the working directory.
	# directory: "/var/unbound"

	# the log file, "" means log to stderr.
	# Use of this option sets use-syslog to "no".
	# logfile: ""

	# Log to syslog(3) if yes. The log facility LOG_DAEMON is used to
	# log to. If yes, it overrides the logfile.
	# use-syslog: yes

	# Log identity to report. if empty, defaults to the name of argv[0]
	# (usually "unbound").
	# log-identity: ""

	# print UTC timestamp in ascii to logfile, default is epoch in seconds.
	# log-time-ascii: no

	# print one line with time, IP, name, type, class for every query.
	# log-queries: no

	# print one line per reply, with time, IP, name, type, class, rcode,
	# timetoresolve, fromcache and responsesize.
	# log-replies: no

	+ # log with tag 'query' and 'reply' instead of 'info' for
	+ # filtering log-queries and log-replies from the log.
	+ # log-tag-queryreply: no
	+
	# log the local-zone actions, like local-zone type inform is enabled
	# also for the other local zone types.
	# log-local-actions: no

	# print log lines that say why queries return SERVFAIL to clients.
	# log-servfail: no

	# the pid file. Can be an absolute path outside of chroot/work dir.
	# pidfile: "/var/unbound/unbound.pid"

	# file to read root hints from.
	# get one from https://www.internic.net/domain/named.cache
	# root-hints: ""

	# enable to not answer id.server and hostname.bind queries.
	# hide-identity: no

	# enable to not answer version.server and version.bind queries.
	# hide-version: no

	# enable to not answer trustanchor.unbound queries.
	# hide-trustanchor: no

	# the identity to report. Leave "" or default to return hostname.
	# identity: ""

	# the version to report. Leave "" or default to return package version.
	# version: ""

	# the target fetch policy.
	# series of integers describing the policy per dependency depth.
	# The number of values in the list determines the maximum dependency
	# depth the recursor will pursue before giving up. Each integer means:
	# -1 : fetch all targets opportunistically,
	# 0: fetch on demand,
	# positive value: fetch that many targets opportunistically.
	# Enclose the list of numbers between quotes ("").
	# target-fetch-policy: "3 2 1 0 0"

	# Harden against very small EDNS buffer sizes.
	# harden-short-bufsize: no

	# Harden against unseemly large queries.
	# harden-large-queries: no

	# Harden against out of zone rrsets, to avoid spoofing attempts.
	# harden-glue: yes

	# Harden against receiving dnssec-stripped data. If you turn it
	# off, failing to validate dnskey data for a trustanchor will
	# trigger insecure mode for that zone (like without a trustanchor).
	# Default on, which insists on dnssec data for trust-anchored zones.
	# harden-dnssec-stripped: yes

	# Harden against queries that fall under dnssec-signed nxdomain names.
	# harden-below-nxdomain: yes

	# Harden the referral path by performing additional queries for
	# infrastructure data. Validates the replies (if possible).
	# Default off, because the lookups burden the server. Experimental
	# implementation of draft-wijngaards-dnsext-resolver-side-mitigation.
	# harden-referral-path: no

	# Harden against algorithm downgrade when multiple algorithms are
	# advertised in the DS record. If no, allows the weakest algorithm
	# to validate the zone.
	# harden-algo-downgrade: no

	# Sent minimum amount of information to upstream servers to enhance
	# privacy. Only sent minimum required labels of the QNAME and set QTYPE
	# to A when possible.
	# qname-minimisation: yes

	# QNAME minimisation in strict mode. Do not fall-back to sending full
	# QNAME to potentially broken nameservers. A lot of domains will not be
	# resolvable when this option in enabled.
	# This option only has effect when qname-minimisation is enabled.
	# qname-minimisation-strict: no

	# Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN
	# and other denials, using information from previous NXDOMAINs answers.
	# aggressive-nsec: no

	# Use 0x20-encoded random bits in the query to foil spoof attempts.
	# This feature is an experimental implementation of draft dns-0x20.
	# use-caps-for-id: no

	# Domains (and domains in them) without support for dns-0x20 and
	# the fallback fails because they keep sending different answers.
	# caps-whitelist: "licdn.com"
	# caps-whitelist: "senderbase.org"

	# Enforce privacy of these addresses. Strips them away from answers.
	# It may cause DNSSEC validation to additionally mark it as bogus.
	# Protects against 'DNS Rebinding' (uses browser as network proxy).
	# Only 'private-domain' and 'local-data' names are allowed to have
	# these private addresses. No default.
	# private-address: 10.0.0.0/8
	# private-address: 172.16.0.0/12
	# private-address: 192.168.0.0/16
	# private-address: 169.254.0.0/16
	# private-address: fd00::/8
	# private-address: fe80::/10
	# private-address: ::ffff:0:0/96

	# Allow the domain (and its subdomains) to contain private addresses.
	# local-data statements are allowed to contain private addresses too.
	# private-domain: "example.com"

	# If nonzero, unwanted replies are not only reported in statistics,
	# but also a running total is kept per thread. If it reaches the
	# threshold, a warning is printed and a defensive action is taken,
	# the cache is cleared to flush potential poison out of it.
	# A suggested value is 10000000, the default is 0 (turned off).
	# unwanted-reply-threshold: 0

	# Do not query the following addresses. No DNS queries are sent there.
	# List one address per entry. List classless netblocks with /size,
	# do-not-query-address: 127.0.0.1/8
	# do-not-query-address: ::1

	# if yes, the above default do-not-query-address entries are present.
	# if no, localhost can be queried (for testing and debugging).
	# do-not-query-localhost: yes

	# if yes, perform prefetching of almost expired message cache entries.
	# prefetch: no

	# if yes, perform key lookups adjacent to normal lookups.
	# prefetch-key: no

	+ # deny queries of type ANY with an empty response.
	+ # deny-any: no
	+
	# if yes, Unbound rotates RRSet order in response.
	# rrset-roundrobin: no

	# if yes, Unbound doesn't insert authority/additional sections
	# into response messages when those sections are not required.
	# minimal-responses: yes

	# true to disable DNSSEC lameness check in iterator.
	# disable-dnssec-lame-check: no

	# module configuration of the server. A string with identifiers
	# separated by spaces. Syntax: "[dns64] [validator] iterator"
	+ # most modules have to be listed at the beginning of the line,
	+ # except cachedb(just before iterator), and python (at the beginning,
	+ # or, just before the iterator).
	# module-config: "validator iterator"

	# File with trusted keys, kept uptodate using RFC5011 probes,
	# initial file like trust-anchor-file, then it stores metadata.
	# Use several entries, one per domain name, to track multiple zones.
	#
	# If you want to perform DNSSEC validation, run unbound-anchor before
	# you start unbound (i.e. in the system boot scripts). And enable:
	# Please note usage of unbound-anchor root anchor is at your own risk
	# and under the terms of our LICENSE (see that file in the source).
	# auto-trust-anchor-file: "/var/unbound/root.key"

	# trust anchor signaling sends a RFC8145 key tag query after priming.
	# trust-anchor-signaling: yes
	-
	+
	# Root key trust anchor sentinel (draft-ietf-dnsop-kskroll-sentinel)
	# root-key-sentinel: yes

	# File with DLV trusted keys. Same format as trust-anchor-file.
	# There can be only one DLV configured, it is trusted from root down.
	# DLV is going to be decommissioned. Please do not use it any more.
	# dlv-anchor-file: "dlv.isc.org.key"

	# File with trusted keys for validation. Specify more than one file
	# with several entries, one file per entry.
	# Zone file format, with DS and DNSKEY entries.
	# Note this gets out of date, use auto-trust-anchor-file please.
	# trust-anchor-file: ""

	# Trusted key for validation. DS or DNSKEY. specify the RR on a
	# single line, surrounded by "". TTL is ignored. class is IN default.
	# Note this gets out of date, use auto-trust-anchor-file please.
	# (These examples are from August 2007 and may not be valid anymore).
	# trust-anchor: "nlnetlabs.nl. DNSKEY 257 3 5 AQPzzTWMz8qSWIQlfRnPckx2BiVmkVN6LPupO3mbz7FhLSnm26n6iG9N Lby97Ji453aWZY3M5/xJBSOS2vWtco2t8C0+xeO1bc/d6ZTy32DHchpW 6rDH1vp86Ll+ha0tmwyy9QP7y2bVw5zSbFCrefk8qCUBgfHm9bHzMG1U BYtEIQ=="
	# trust-anchor: "jelte.nlnetlabs.nl. DS 42860 5 1 14D739EB566D2B1A5E216A0BA4D17FA9B038BE4A"

	# File with trusted keys for validation. Specify more than one file
	# with several entries, one file per entry. Like trust-anchor-file
	# but has a different file format. Format is BIND-9 style format,
	# the trusted-keys { name flag proto algo "key"; }; clauses are read.
	# you need external update procedures to track changes in keys.
	# trusted-keys-file: ""

	# Ignore chain of trust. Domain is treated as insecure.
	# domain-insecure: "example.com"

	# Override the date for validation with a specific fixed date.
	# Do not set this unless you are debugging signature inception
	# and expiration. "" or "0" turns the feature off. -1 ignores date.
	# val-override-date: ""

	# The time to live for bogus data, rrsets and messages. This avoids
	# some of the revalidation, until the time interval expires. in secs.
	# val-bogus-ttl: 60

	# The signature inception and expiration dates are allowed to be off
	# by 10% of the signature lifetime (expir-incep) from our local clock.
	# This leeway is capped with a minimum and a maximum. In seconds.
	# val-sig-skew-min: 3600
	# val-sig-skew-max: 86400

	# Should additional section of secure message also be kept clean of
	# unsecure data. Useful to shield the users of this validator from
	# potential bogus data in the additional section. All unsigned data
	# in the additional section is removed from secure messages.
	# val-clean-additional: yes

	# Turn permissive mode on to permit bogus messages. Thus, messages
	# for which security checks failed will be returned to clients,
	# instead of SERVFAIL. It still performs the security checks, which
	# result in interesting log files and possibly the AD bit in
	# replies if the message is found secure. The default is off.
	# val-permissive-mode: no

	# Ignore the CD flag in incoming queries and refuse them bogus data.
	# Enable it if the only clients of unbound are legacy servers (w2008)
	# that set CD but cannot validate themselves.
	# ignore-cd-flag: no

	# Serve expired responses from cache, with TTL 0 in the response,
	# and then attempt to fetch the data afresh.
	# serve-expired: no
	#
	# Limit serving of expired responses to configured seconds after
	# expiration. 0 disables the limit.
	# serve-expired-ttl: 0
	#
	# Set the TTL of expired records to the serve-expired-ttl value after a
	# failed attempt to retrieve the record from upstream. This makes sure
	# that the expired records will be served as long as there are queries
	# for it.
	# serve-expired-ttl-reset: no

	# Have the validator log failed validations for your diagnosis.
	# 0: off. 1: A line per failed user query. 2: With reason and bad IP.
	# val-log-level: 0

	# It is possible to configure NSEC3 maximum iteration counts per
	# keysize. Keep this table very short, as linear search is done.
	# A message with an NSEC3 with larger count is marked insecure.
	# List in ascending order the keysize and count values.
	# val-nsec3-keysize-iterations: "1024 150 2048 500 4096 2500"

	# instruct the auto-trust-anchor-file probing to add anchors after ttl.
	# add-holddown: 2592000 # 30 days

	# instruct the auto-trust-anchor-file probing to del anchors after ttl.
	# del-holddown: 2592000 # 30 days

	# auto-trust-anchor-file probing removes missing anchors after ttl.
	# If the value 0 is given, missing anchors are not removed.
	# keep-missing: 31622400 # 366 days

	# debug option that allows very small holddown times for key rollover,
	# otherwise the RFC mandates probe intervals must be at least 1 hour.
	# permit-small-holddown: no

	# the amount of memory to use for the key cache.
	# plain value in bytes or you can append k, m or G. default is "4Mb".
	# key-cache-size: 4m

	# the number of slabs to use for the key cache.
	# the number of slabs must be a power of 2.
	# more slabs reduce lock contention, but fragment memory usage.
	# key-cache-slabs: 4

	# the amount of memory to use for the negative cache (used for DLV).
	# plain value in bytes or you can append k, m or G. default is "1Mb".
	# neg-cache-size: 1m

	# By default, for a number of zones a small default 'nothing here'
	# reply is built-in. Query traffic is thus blocked. If you
	# wish to serve such zone you can unblock them by uncommenting one
	# of the nodefault statements below.
	# You may also have to use domain-insecure: zone to make DNSSEC work,
	# unless you have your own trust anchors for this zone.
	# local-zone: "localhost." nodefault
	# local-zone: "127.in-addr.arpa." nodefault
	# local-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." nodefault
	# local-zone: "onion." nodefault
	# local-zone: "test." nodefault
	# local-zone: "invalid." nodefault
	# local-zone: "10.in-addr.arpa." nodefault
	# local-zone: "16.172.in-addr.arpa." nodefault
	# local-zone: "17.172.in-addr.arpa." nodefault
	# local-zone: "18.172.in-addr.arpa." nodefault
	# local-zone: "19.172.in-addr.arpa." nodefault
	# local-zone: "20.172.in-addr.arpa." nodefault
	# local-zone: "21.172.in-addr.arpa." nodefault
	# local-zone: "22.172.in-addr.arpa." nodefault
	# local-zone: "23.172.in-addr.arpa." nodefault
	# local-zone: "24.172.in-addr.arpa." nodefault
	# local-zone: "25.172.in-addr.arpa." nodefault
	# local-zone: "26.172.in-addr.arpa." nodefault
	# local-zone: "27.172.in-addr.arpa." nodefault
	# local-zone: "28.172.in-addr.arpa." nodefault
	# local-zone: "29.172.in-addr.arpa." nodefault
	# local-zone: "30.172.in-addr.arpa." nodefault
	# local-zone: "31.172.in-addr.arpa." nodefault
	# local-zone: "168.192.in-addr.arpa." nodefault
	# local-zone: "0.in-addr.arpa." nodefault
	# local-zone: "254.169.in-addr.arpa." nodefault
	# local-zone: "2.0.192.in-addr.arpa." nodefault
	# local-zone: "100.51.198.in-addr.arpa." nodefault
	# local-zone: "113.0.203.in-addr.arpa." nodefault
	# local-zone: "255.255.255.255.in-addr.arpa." nodefault
	# local-zone: "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." nodefault
	# local-zone: "d.f.ip6.arpa." nodefault
	# local-zone: "8.e.f.ip6.arpa." nodefault
	# local-zone: "9.e.f.ip6.arpa." nodefault
	# local-zone: "a.e.f.ip6.arpa." nodefault
	# local-zone: "b.e.f.ip6.arpa." nodefault
	# local-zone: "8.b.d.0.1.0.0.2.ip6.arpa." nodefault
	# And for 64.100.in-addr.arpa. to 127.100.in-addr.arpa.

	# If unbound is running service for the local host then it is useful
	# to perform lan-wide lookups to the upstream, and unblock the
	# long list of local-zones above. If this unbound is a dns server
	# for a network of computers, disabled is better and stops information
	# leakage of local lan information.
	# unblock-lan-zones: no

	# The insecure-lan-zones option disables validation for
	# these zones, as if they were all listed as domain-insecure.
	# insecure-lan-zones: no

	# a number of locally served zones can be configured.
	# local-zone: <zone> <type>
	# local-data: "<resource record string>"
	# o deny serves local data (if any), else, drops queries.
	# o refuse serves local data (if any), else, replies with error.
	# o static serves local data, else, nxdomain or nodata answer.
	# o transparent gives local data, but resolves normally for other names
	# o redirect serves the zone data for any subdomain in the zone.
	# o nodefault can be used to normally resolve AS112 zones.
	# o typetransparent resolves normally for other types and other names
	# o inform acts like transparent, but logs client IP address
	# o inform_deny drops queries and logs client IP address
	+ # o inform_redirect redirects queries and logs client IP address
	# o always_transparent, always_refuse, always_nxdomain, resolve in
	# that way but ignore local data for that name
	# o noview breaks out of that view towards global local-zones.
	#
	# defaults are localhost address, reverse for 127.0.0.1 and ::1
	# and nxdomain for AS112 zones. If you configure one of these zones
	# the default content is omitted, or you can omit it with 'nodefault'.
	#
	# If you configure local-data without specifying local-zone, by
	# default a transparent local-zone is created for the data.
	#
	# You can add locally served data with
	# local-zone: "local." static
	# local-data: "mycomputer.local. IN A 192.0.2.51"
	# local-data: 'mytext.local TXT "content of text record"'
	#
	# You can override certain queries with
	# local-data: "adserver.example.com A 127.0.0.1"
	#
	# You can redirect a domain to a fixed address with
	# (this makes example.com, www.example.com, etc, all go to 192.0.2.3)
	# local-zone: "example.com" redirect
	# local-data: "example.com A 192.0.2.3"
	#
	# Shorthand to make PTR records, "IPv4 name" or "IPv6 name".
	# You can also add PTR records using local-data directly, but then
	# you need to do the reverse notation yourself.
	# local-data-ptr: "192.0.2.3 www.example.com"

	# tag a localzone with a list of tag names (in "" with spaces between)
	# local-zone-tag: "example.com" "tag2 tag3"

	# add a netblock specific override to a localzone, with zone type
	# local-zone-override: "example.com" 192.0.2.0/24 refuse

	# service clients over TLS (on the TCP sockets), with plain DNS inside
	# the TLS stream. Give the certificate to use and private key.
	# default is "" (disabled). requires restart to take effect.
	# tls-service-key: "path/to/privatekeyfile.key"
	# tls-service-pem: "path/to/publiccertfile.pem"
	# tls-port: 853

	+ # cipher setting for TLSv1.2
	+ # tls-ciphers: "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256"
	+ # cipher setting for TLSv1.3
	+ # tls-ciphersuites: "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_8_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
	+
	+ # Add the secret file for TLS Session Ticket.
	+ # Secret file must be 80 bytes of random data.
	+ # First key use to encrypt and decrypt TLS session tickets.
	+ # Other keys use to decrypt only.
	+ # requires restart to take effect.
	+ # tls-session-ticket-keys: "path/to/secret_file1"
	+ # tls-session-ticket-keys: "path/to/secret_file2"
	+
	# request upstream over TLS (with plain DNS inside the TLS stream).
	# Default is no. Can be turned on and off with unbound-control.
	# tls-upstream: no

	# Certificates used to authenticate connections made upstream.
	# tls-cert-bundle: ""

	# Add system certs to the cert bundle, from the Windows Cert Store
	# tls-win-cert: no

	# Also serve tls on these port numbers (eg. 443, ...), by listing
	# tls-additional-port: portno for each of the port numbers.

	# DNS64 prefix. Must be specified when DNS64 is use.
	# Enable dns64 in module-config. Used to synthesize IPv6 from IPv4.
	# dns64-prefix: 64:ff9b::0/96

	# DNS64 ignore AAAA records for these domains and use A instead.
	# dns64-ignore-aaaa: "example.com"

	# ratelimit for uncached, new queries, this limits recursion effort.
	# ratelimiting is experimental, and may help against randomqueryflood.
	# if 0(default) it is disabled, otherwise state qps allowed per zone.
	# ratelimit: 0

	# ratelimits are tracked in a cache, size in bytes of cache (or k,m).
	# ratelimit-size: 4m
	# ratelimit cache slabs, reduces lock contention if equal to cpucount.
	# ratelimit-slabs: 4

	# 0 blocks when ratelimited, otherwise let 1/xth traffic through
	# ratelimit-factor: 10

	# override the ratelimit for a specific domain name.
	# give this setting multiple times to have multiple overrides.
	# ratelimit-for-domain: example.com 1000
	# override the ratelimits for all domains below a domain name
	# can give this multiple times, the name closest to the zone is used.
	# ratelimit-below-domain: com 1000

	# global query ratelimit for all ip addresses.
	# feature is experimental.
	# if 0(default) it is disabled, otherwise states qps allowed per ip address
	# ip-ratelimit: 0

	# ip ratelimits are tracked in a cache, size in bytes of cache (or k,m).
	# ip-ratelimit-size: 4m
	# ip ratelimit cache slabs, reduces lock contention if equal to cpucount.
	# ip-ratelimit-slabs: 4

	# 0 blocks when ip is ratelimited, otherwise let 1/xth traffic through
	# ip-ratelimit-factor: 10

	# Limit the number of connections simultaneous from a netblock
	# tcp-connection-limit: 192.0.2.0/24 12

	- # what is considered a low rtt (ping time for upstream server), in msec
	- # low-rtt: 45
	- # select low rtt this many times out of 1000. 0 means the fast server
	- # select is disabled. prefetches are not sped up.
	- # low-rtt-permil: 0
	+ # select from the fastest servers this many times out of 1000. 0 means
	+ # the fast server select is disabled. prefetches are not sped up.
	+ # fast-server-permil: 0
	+ # the number of servers that will be used in the fast server selection.
	+ # fast-server-num: 3

	# Specific options for ipsecmod. unbound needs to be configured with
	# --enable-ipsecmod for these to take effect.
	#
	# Enable or disable ipsecmod (it still needs to be defined in
	# module-config above). Can be used when ipsecmod needs to be
	# enabled/disabled via remote-control(below).
	# ipsecmod-enabled: yes
	#
	# Path to executable external hook. It must be defined when ipsecmod is
	# listed in module-config (above).
	# ipsecmod-hook: "./my_executable"
	#
	# When enabled unbound will reply with SERVFAIL if the return value of
	# the ipsecmod-hook is not 0.
	# ipsecmod-strict: no
	#
	# Maximum time to live (TTL) for cached A/AAAA records with IPSECKEY.
	# ipsecmod-max-ttl: 3600
	#
	# Reply with A/AAAA even if the relevant IPSECKEY is bogus. Mainly used for
	# testing.
	# ipsecmod-ignore-bogus: no
	#
	# Domains for which ipsecmod will be triggered. If not defined (default)
	# all domains are treated as being whitelisted.
	# ipsecmod-whitelist: "example.com"
	# ipsecmod-whitelist: "nlnetlabs.nl"


	# Python config section. To enable:
	# o use --with-pythonmodule to configure before compiling.
	# o list python in the module-config string (above) to enable.
	+# It can be at the start, it gets validated results, or just before
	+# the iterator and process before DNSSEC validation.
	# o and give a python-script to run.
	python:
	# Script file to load
	# python-script: "/var/unbound/ubmodule-tst.py"

	# Remote control config section.
	remote-control:
	# Enable remote control with unbound-control(8) here.
	# set up the keys and certificates with unbound-control-setup.
	# control-enable: no

	# what interfaces are listened to for remote control.
	# give 0.0.0.0 and ::0 to listen to all interfaces.
	# set to an absolute path to use a unix local name pipe, certificates
	# are not used for that, so key and cert files need not be present.
	# control-interface: 127.0.0.1
	# control-interface: ::1

	# port number for remote control operations.
	# control-port: 8953

	# for localhost, you can disable use of TLS by setting this to "no"
	# For local sockets this option is ignored, and TLS is not used.
	# control-use-cert: "yes"

	# unbound server key file.
	# server-key-file: "/var/unbound/unbound_server.key"

	# unbound server certificate file.
	# server-cert-file: "/var/unbound/unbound_server.pem"

	# unbound-control key file.
	# control-key-file: "/var/unbound/unbound_control.key"

	# unbound-control certificate file.
	# control-cert-file: "/var/unbound/unbound_control.pem"

	# Stub zones.
	# Create entries like below, to make all queries for 'example.com' and
	# 'example.org' go to the given list of nameservers. list zero or more
	# nameservers by hostname or by ipaddress. If you set stub-prime to yes,
	# the list is treated as priming hints (default is no).
	# With stub-first yes, it attempts without the stub if it fails.
	# Consider adding domain-insecure: name and local-zone: name nodefault
	# to the server: section if the stub is a locally served zone.
	# stub-zone:
	# name: "example.com"
	# stub-addr: 192.0.2.68
	# stub-prime: no
	# stub-first: no
	# stub-tls-upstream: no
	# stub-no-cache: no
	# stub-zone:
	# name: "example.org"
	# stub-host: ns.example.com.

	# Forward zones
	# Create entries like below, to make all queries for 'example.com' and
	# 'example.org' go to the given list of servers. These servers have to handle
	# recursion to other nameservers. List zero or more nameservers by hostname
	# or by ipaddress. Use an entry with name "." to forward all queries.
	# If you enable forward-first, it attempts without the forward if it fails.
	# forward-zone:
	# name: "example.com"
	# forward-addr: 192.0.2.68
	# forward-addr: 192.0.2.73@5355 # forward to port 5355.
	# forward-first: no
	# forward-tls-upstream: no
	# forward-no-cache: no
	# forward-zone:
	# name: "example.org"
	# forward-host: fwd.example.com

	# Authority zones
	# The data for these zones is kept locally, from a file or downloaded.
	# The data can be served to downstream clients, or used instead of the
	# upstream (which saves a lookup to the upstream). The first example
	# has a copy of the root for local usage. The second serves example.org
	# authoritatively. zonefile: reads from file (and writes to it if you also
	# download it), master: fetches with AXFR and IXFR, or url to zonefile.
	# With allow-notify: you can give additional (apart from masters) sources of
	# notifies.
	# auth-zone:
	# name: "."
	+# master: 199.9.14.201 # b.root-servers.net
	+# master: 192.33.4.12 # c.root-servers.net
	+# master: 199.7.91.13 # d.root-servers.net
	+# master: 192.5.5.241 # f.root-servers.net
	+# master: 192.112.36.4 # g.root-servers.net
	+# master: 193.0.14.129 # k.root-servers.net
	+# master: 192.0.47.132 # xfr.cjr.dns.icann.org
	+# master: 192.0.32.132 # xfr.lax.dns.icann.org
	+# master: 2001:500:200::b # b.root-servers.net
	+# master: 2001:500:2::c # c.root-servers.net
	+# master: 2001:500:2d::d # d.root-servers.net
	+# master: 2001:500:2f::f # f.root-servers.net
	+# master: 2001:500:12::d0d # g.root-servers.net
	+# master: 2001:7fd::1 # k.root-servers.net
	+# master: 2620:0:2830:202::132 # xfr.cjr.dns.icann.org
	+# master: 2620:0:2d0:202::132 # xfr.lax.dns.icann.org
	+# fallback-enabled: yes
	# for-downstream: no
	# for-upstream: yes
	-# fallback-enabled: yes
	-# master: b.root-servers.net
	-# master: c.root-servers.net
	-# master: e.root-servers.net
	-# master: f.root-servers.net
	-# master: g.root-servers.net
	-# master: k.root-servers.net
	# auth-zone:
	# name: "example.org"
	# for-downstream: yes
	# for-upstream: yes
	# zonefile: "example.org.zone"

	# Views
	# Create named views. Name must be unique. Map views to requests using
	# the access-control-view option. Views can contain zero or more local-zone
	# and local-data options. Options from matching views will override global
	# options. Global options will be used if no matching view is found.
	# With view-first yes, it will try to answer using the global local-zone and
	# local-data elements if there is no view specific match.
	# view:
	# name: "viewname"
	# local-zone: "example.com" redirect
	# local-data: "example.com A 192.0.2.3"
	# local-data-ptr: "192.0.2.3 www.example.com"
	# view-first: no
	# view:
	# name: "anotherview"
	# local-zone: "example.com" refuse

	# DNSCrypt
	# Caveats:
	# 1. the keys/certs cannot be produced by unbound. You can use dnscrypt-wrapper
	# for this: https://github.com/cofyc/dnscrypt-wrapper/blob/master/README.md#usage
	# 2. dnscrypt channel attaches to an interface. you MUST set interfaces to
	# listen on `dnscrypt-port` with the follo0wing snippet:
	# server:
	# interface: 0.0.0.0@443
	# interface: ::0@443
	#
	# Finally, `dnscrypt` config has its own section.
	# dnscrypt:
	# dnscrypt-enable: yes
	# dnscrypt-port: 443
	# dnscrypt-provider: 2.dnscrypt-cert.example.com.
	# dnscrypt-secret-key: /path/unbound-conf/keys1/1.key
	# dnscrypt-secret-key: /path/unbound-conf/keys2/1.key
	# dnscrypt-provider-cert: /path/unbound-conf/keys1/1.cert
	# dnscrypt-provider-cert: /path/unbound-conf/keys2/1.cert

	# CacheDB
	# Enable external backend DB as auxiliary cache. Specify the backend name
	# (default is "testframe", which has no use other than for debugging and
	# testing) and backend-specific options. The 'cachedb' module must be
	-# included in module-config.
	+# included in module-config, just before the iterator module.
	# cachedb:
	# backend: "testframe"
	# # secret seed string to calculate hashed keys
	# secret-seed: "default"
	#
	# # For "redis" backend:
	# # redis server's IP address or host name
	# redis-server-host: 127.0.0.1
	# # redis server's TCP port
	# redis-server-port: 6379
	# # timeout (in ms) for communication with the redis server
	# redis-timeout: 100
	Index: head/contrib/unbound/doc/example.conf.in
	===================================================================
	--- head/contrib/unbound/doc/example.conf.in (revision 349719)
	+++ head/contrib/unbound/doc/example.conf.in (revision 349720)
	@@ -1,950 +1,994 @@
	#
	# Example configuration file.
	#
	-# See unbound.conf(5) man page, version 1.8.1.
	+# See unbound.conf(5) man page, version 1.9.2.
	#
	# this is a comment.

	#Use this to include other text into the file.
	#include: "otherfile.conf"

	# The server clause sets the main parameters.
	server:
	# whitespace is not necessary, but looks cleaner.

	# verbosity number, 0 is least verbose. 1 is default.
	verbosity: 1

	# print statistics to the log (for every thread) every N seconds.
	# Set to "" or 0 to disable. Default is disabled.
	# statistics-interval: 0

	# enable shm for stats, default no. if you enable also enable
	# statistics-interval, every time it also writes stats to the
	# shared memory segment keyed with shm-key.
	# shm-enable: no

	# shm for stats uses this key, and key+1 for the shared mem segment.
	# shm-key: 11777

	# enable cumulative statistics, without clearing them after printing.
	# statistics-cumulative: no

	# enable extended statistics (query types, answer codes, status)
	# printed from unbound-control. default off, because of speed.
	# extended-statistics: no

	# number of threads to create. 1 disables threading.
	# num-threads: 1

	# specify the interfaces to answer queries from by ip-address.
	# The default is to listen to localhost (127.0.0.1 and ::1).
	# specify 0.0.0.0 and ::0 to bind to all available interfaces.
	# specify every interface[@port] on a new 'interface:' labelled line.
	# The listen interfaces are not changed on reload, only on restart.
	# interface: 192.0.2.153
	# interface: 192.0.2.154
	# interface: 192.0.2.154@5003
	# interface: 2001:DB8::5

	# enable this feature to copy the source address of queries to reply.
	# Socket options are not supported on all platforms. experimental.
	# interface-automatic: no

	# port to answer queries from
	# port: 53

	# specify the interfaces to send outgoing queries to authoritative
	# server from by ip-address. If none, the default (all) interface
	# is used. Specify every interface on a 'outgoing-interface:' line.
	# outgoing-interface: 192.0.2.153
	# outgoing-interface: 2001:DB8::5
	# outgoing-interface: 2001:DB8::6

	# Specify a netblock to use remainder 64 bits as random bits for
	# upstream queries. Uses freebind option (Linux).
	# outgoing-interface: 2001:DB8::/64
	# Also (Linux:) ip -6 addr add 2001:db8::/64 dev lo
	# And: ip -6 route add local 2001:db8::/64 dev lo
	# And set prefer-ip6: yes to use the ip6 randomness from a netblock.
	# Set this to yes to prefer ipv6 upstream servers over ipv4.
	# prefer-ip6: no

	# number of ports to allocate per thread, determines the size of the
	# port range that can be open simultaneously. About double the
	# num-queries-per-thread, or, use as many as the OS will allow you.
	# outgoing-range: 4096

	# permit unbound to use this port number or port range for
	# making outgoing queries, using an outgoing interface.
	# outgoing-port-permit: 32768

	# deny unbound the use this of port number or port range for
	# making outgoing queries, using an outgoing interface.
	# Use this to make sure unbound does not grab a UDP port that some
	# other server on this computer needs. The default is to avoid
	# IANA-assigned port numbers.
	# If multiple outgoing-port-permit and outgoing-port-avoid options
	# are present, they are processed in order.
	# outgoing-port-avoid: "3200-3208"

	# number of outgoing simultaneous tcp buffers to hold per thread.
	# outgoing-num-tcp: 10

	# number of incoming simultaneous tcp buffers to hold per thread.
	# incoming-num-tcp: 10

	# buffer size for UDP port 53 incoming (SO_RCVBUF socket option).
	# 0 is system default. Use 4m to catch query spikes for busy servers.
	# so-rcvbuf: 0

	# buffer size for UDP port 53 outgoing (SO_SNDBUF socket option).
	# 0 is system default. Use 4m to handle spikes on very busy servers.
	# so-sndbuf: 0

	# use SO_REUSEPORT to distribute queries over threads.
	+ # at extreme load it could be better to turn it off to distribute even.
	# so-reuseport: yes

	# use IP_TRANSPARENT so the interface: addresses can be non-local
	# and you can config non-existing IPs that are going to work later on
	# (uses IP_BINDANY on FreeBSD).
	# ip-transparent: no

	# use IP_FREEBIND so the interface: addresses can be non-local
	# and you can bind to nonexisting IPs and interfaces that are down.
	# Linux only. On Linux you also have ip-transparent that is similar.
	# ip-freebind: no

	# EDNS reassembly buffer to advertise to UDP peers (the actual buffer
	# is set with msg-buffer-size). 1472 can solve fragmentation (timeouts)
	# edns-buffer-size: 4096

	# Maximum UDP response size (not applied to TCP response).
	# Suggested values are 512 to 4096. Default is 4096. 65536 disables it.
	# max-udp-size: 4096

	+ # max memory to use for stream(tcp and tls) waiting result buffers.
	+ # stream-wait-size: 4m
	+
	# buffer size for handling DNS data. No messages larger than this
	# size can be sent or received, by UDP or TCP. In bytes.
	# msg-buffer-size: 65552

	# the amount of memory to use for the message cache.
	# plain value in bytes or you can append k, m or G. default is "4Mb".
	# msg-cache-size: 4m

	# the number of slabs to use for the message cache.
	# the number of slabs must be a power of 2.
	# more slabs reduce lock contention, but fragment memory usage.
	# msg-cache-slabs: 4

	# the number of queries that a thread gets to service.
	# num-queries-per-thread: 1024

	# if very busy, 50% queries run to completion, 50% get timeout in msec
	# jostle-timeout: 200

	# msec to wait before close of port on timeout UDP. 0 disables.
	# delay-close: 0

	+ # msec for waiting for an unknown server to reply. Increase if you
	+ # are behind a slow satellite link, to eg. 1128.
	+ # unknown-server-time-limit: 376
	+
	# the amount of memory to use for the RRset cache.
	# plain value in bytes or you can append k, m or G. default is "4Mb".
	# rrset-cache-size: 4m

	# the number of slabs to use for the RRset cache.
	# the number of slabs must be a power of 2.
	# more slabs reduce lock contention, but fragment memory usage.
	# rrset-cache-slabs: 4

	# the time to live (TTL) value lower bound, in seconds. Default 0.
	# If more than an hour could easily give trouble due to stale data.
	# cache-min-ttl: 0

	# the time to live (TTL) value cap for RRsets and messages in the
	# cache. Items are not cached for longer. In seconds.
	# cache-max-ttl: 86400

	# the time to live (TTL) value cap for negative responses in the cache
	# cache-max-negative-ttl: 3600

	# the time to live (TTL) value for cached roundtrip times, lameness and
	# EDNS version information for hosts. In seconds.
	# infra-host-ttl: 900

	# minimum wait time for responses, increase if uplink is long. In msec.
	# infra-cache-min-rtt: 50

	# the number of slabs to use for the Infrastructure cache.
	# the number of slabs must be a power of 2.
	# more slabs reduce lock contention, but fragment memory usage.
	# infra-cache-slabs: 4

	# the maximum number of hosts that are cached (roundtrip, EDNS, lame).
	# infra-cache-numhosts: 10000

	# define a number of tags here, use with local-zone, access-control.
	# repeat the define-tag statement to add additional tags.
	# define-tag: "tag1 tag2 tag3"

	# Enable IPv4, "yes" or "no".
	# do-ip4: yes

	# Enable IPv6, "yes" or "no".
	# do-ip6: yes

	# Enable UDP, "yes" or "no".
	# do-udp: yes

	# Enable TCP, "yes" or "no".
	# do-tcp: yes

	# upstream connections use TCP only (and no UDP), "yes" or "no"
	# useful for tunneling scenarios, default no.
	# tcp-upstream: no

	# upstream connections also use UDP (even if do-udp is no).
	# useful if if you want UDP upstream, but don't provide UDP downstream.
	# udp-upstream-without-downstream: no

	# Maximum segment size (MSS) of TCP socket on which the server
	# responds to queries. Default is 0, system default MSS.
	# tcp-mss: 0

	# Maximum segment size (MSS) of TCP socket for outgoing queries.
	# Default is 0, system default MSS.
	# outgoing-tcp-mss: 0

	# Idle TCP timeout, connection closed in milliseconds
	# tcp-idle-timeout: 30000

	# Enable EDNS TCP keepalive option.
	# edns-tcp-keepalive: no

	# Timeout for EDNS TCP keepalive, in msec.
	# edns-tcp-keepalive-timeout: 120000

	# Use systemd socket activation for UDP, TCP, and control sockets.
	# use-systemd: no

	# Detach from the terminal, run in background, "yes" or "no".
	# Set the value to "no" when unbound runs as systemd service.
	# do-daemonize: yes

	# control which clients are allowed to make (recursive) queries
	# to this server. Specify classless netblocks with /size and action.
	# By default everything is refused, except for localhost.
	# Choose deny (drop message), refuse (polite error reply),
	# allow (recursive ok), allow_setrd (recursive ok, rd bit is forced on),
	# allow_snoop (recursive and nonrecursive ok)
	# deny_non_local (drop queries unless can be answered from local-data)
	# refuse_non_local (like deny_non_local but polite error reply).
	# access-control: 0.0.0.0/0 refuse
	# access-control: 127.0.0.0/8 allow
	# access-control: ::0/0 refuse
	# access-control: ::1 allow
	# access-control: ::ffff:127.0.0.1 allow

	# tag access-control with list of tags (in "" with spaces between)
	# Clients using this access control element use localzones that
	# are tagged with one of these tags.
	# access-control-tag: 192.0.2.0/24 "tag2 tag3"

	# set action for particular tag for given access control element
	# if you have multiple tag values, the tag used to lookup the action
	# is the first tag match between access-control-tag and local-zone-tag
	# where "first" comes from the order of the define-tag values.
	# access-control-tag-action: 192.0.2.0/24 tag3 refuse

	# set redirect data for particular tag for access control element
	# access-control-tag-data: 192.0.2.0/24 tag2 "A 127.0.0.1"

	# Set view for access control element
	# access-control-view: 192.0.2.0/24 viewname

	# if given, a chroot(2) is done to the given directory.
	# i.e. you can chroot to the working directory, for example,
	# for extra security, but make sure all files are in that directory.
	#
	# If chroot is enabled, you should pass the configfile (from the
	# commandline) as a full path from the original root. After the
	# chroot has been performed the now defunct portion of the config
	# file path is removed to be able to reread the config after a reload.
	#
	# All other file paths (working dir, logfile, roothints, and
	# key files) can be specified in several ways:
	# o as an absolute path relative to the new root.
	# o as a relative path to the working directory.
	# o as an absolute path relative to the original root.
	# In the last case the path is adjusted to remove the unused portion.
	#
	# The pid file can be absolute and outside of the chroot, it is
	# written just prior to performing the chroot and dropping permissions.
	#
	# Additionally, unbound may need to access /dev/random (for entropy).
	# How to do this is specific to your OS.
	#
	# If you give "" no chroot is performed. The path must not end in a /.
	# chroot: "@UNBOUND_CHROOT_DIR@"

	# if given, user privileges are dropped (after binding port),
	# and the given username is assumed. Default is user "unbound".
	# If you give "" no privileges are dropped.
	# username: "@UNBOUND_USERNAME@"

	# the working directory. The relative files in this config are
	# relative to this directory. If you give "" the working directory
	# is not changed.
	# If you give a server: directory: dir before include: file statements
	# then those includes can be relative to the working directory.
	# directory: "@UNBOUND_RUN_DIR@"

	# the log file, "" means log to stderr.
	# Use of this option sets use-syslog to "no".
	# logfile: ""

	# Log to syslog(3) if yes. The log facility LOG_DAEMON is used to
	# log to. If yes, it overrides the logfile.
	# use-syslog: yes

	# Log identity to report. if empty, defaults to the name of argv[0]
	# (usually "unbound").
	# log-identity: ""

	# print UTC timestamp in ascii to logfile, default is epoch in seconds.
	# log-time-ascii: no

	# print one line with time, IP, name, type, class for every query.
	# log-queries: no

	# print one line per reply, with time, IP, name, type, class, rcode,
	# timetoresolve, fromcache and responsesize.
	# log-replies: no

	+ # log with tag 'query' and 'reply' instead of 'info' for
	+ # filtering log-queries and log-replies from the log.
	+ # log-tag-queryreply: no
	+
	# log the local-zone actions, like local-zone type inform is enabled
	# also for the other local zone types.
	# log-local-actions: no

	# print log lines that say why queries return SERVFAIL to clients.
	# log-servfail: no

	# the pid file. Can be an absolute path outside of chroot/work dir.
	# pidfile: "@UNBOUND_PIDFILE@"

	# file to read root hints from.
	# get one from https://www.internic.net/domain/named.cache
	# root-hints: ""

	# enable to not answer id.server and hostname.bind queries.
	# hide-identity: no

	# enable to not answer version.server and version.bind queries.
	# hide-version: no

	# enable to not answer trustanchor.unbound queries.
	# hide-trustanchor: no

	# the identity to report. Leave "" or default to return hostname.
	# identity: ""

	# the version to report. Leave "" or default to return package version.
	# version: ""

	# the target fetch policy.
	# series of integers describing the policy per dependency depth.
	# The number of values in the list determines the maximum dependency
	# depth the recursor will pursue before giving up. Each integer means:
	# -1 : fetch all targets opportunistically,
	# 0: fetch on demand,
	# positive value: fetch that many targets opportunistically.
	# Enclose the list of numbers between quotes ("").
	# target-fetch-policy: "3 2 1 0 0"

	# Harden against very small EDNS buffer sizes.
	# harden-short-bufsize: no

	# Harden against unseemly large queries.
	# harden-large-queries: no

	# Harden against out of zone rrsets, to avoid spoofing attempts.
	# harden-glue: yes

	# Harden against receiving dnssec-stripped data. If you turn it
	# off, failing to validate dnskey data for a trustanchor will
	# trigger insecure mode for that zone (like without a trustanchor).
	# Default on, which insists on dnssec data for trust-anchored zones.
	# harden-dnssec-stripped: yes

	# Harden against queries that fall under dnssec-signed nxdomain names.
	# harden-below-nxdomain: yes

	# Harden the referral path by performing additional queries for
	# infrastructure data. Validates the replies (if possible).
	# Default off, because the lookups burden the server. Experimental
	# implementation of draft-wijngaards-dnsext-resolver-side-mitigation.
	# harden-referral-path: no

	# Harden against algorithm downgrade when multiple algorithms are
	# advertised in the DS record. If no, allows the weakest algorithm
	# to validate the zone.
	# harden-algo-downgrade: no

	# Sent minimum amount of information to upstream servers to enhance
	# privacy. Only sent minimum required labels of the QNAME and set QTYPE
	# to A when possible.
	# qname-minimisation: yes

	# QNAME minimisation in strict mode. Do not fall-back to sending full
	# QNAME to potentially broken nameservers. A lot of domains will not be
	# resolvable when this option in enabled.
	# This option only has effect when qname-minimisation is enabled.
	# qname-minimisation-strict: no

	# Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN
	# and other denials, using information from previous NXDOMAINs answers.
	# aggressive-nsec: no

	# Use 0x20-encoded random bits in the query to foil spoof attempts.
	# This feature is an experimental implementation of draft dns-0x20.
	# use-caps-for-id: no

	# Domains (and domains in them) without support for dns-0x20 and
	# the fallback fails because they keep sending different answers.
	# caps-whitelist: "licdn.com"
	# caps-whitelist: "senderbase.org"

	# Enforce privacy of these addresses. Strips them away from answers.
	# It may cause DNSSEC validation to additionally mark it as bogus.
	# Protects against 'DNS Rebinding' (uses browser as network proxy).
	# Only 'private-domain' and 'local-data' names are allowed to have
	# these private addresses. No default.
	# private-address: 10.0.0.0/8
	# private-address: 172.16.0.0/12
	# private-address: 192.168.0.0/16
	# private-address: 169.254.0.0/16
	# private-address: fd00::/8
	# private-address: fe80::/10
	# private-address: ::ffff:0:0/96

	# Allow the domain (and its subdomains) to contain private addresses.
	# local-data statements are allowed to contain private addresses too.
	# private-domain: "example.com"

	# If nonzero, unwanted replies are not only reported in statistics,
	# but also a running total is kept per thread. If it reaches the
	# threshold, a warning is printed and a defensive action is taken,
	# the cache is cleared to flush potential poison out of it.
	# A suggested value is 10000000, the default is 0 (turned off).
	# unwanted-reply-threshold: 0

	# Do not query the following addresses. No DNS queries are sent there.
	# List one address per entry. List classless netblocks with /size,
	# do-not-query-address: 127.0.0.1/8
	# do-not-query-address: ::1

	# if yes, the above default do-not-query-address entries are present.
	# if no, localhost can be queried (for testing and debugging).
	# do-not-query-localhost: yes

	# if yes, perform prefetching of almost expired message cache entries.
	# prefetch: no

	# if yes, perform key lookups adjacent to normal lookups.
	# prefetch-key: no

	+ # deny queries of type ANY with an empty response.
	+ # deny-any: no
	+
	# if yes, Unbound rotates RRSet order in response.
	# rrset-roundrobin: no

	# if yes, Unbound doesn't insert authority/additional sections
	# into response messages when those sections are not required.
	# minimal-responses: yes

	# true to disable DNSSEC lameness check in iterator.
	# disable-dnssec-lame-check: no

	# module configuration of the server. A string with identifiers
	# separated by spaces. Syntax: "[dns64] [validator] iterator"
	+ # most modules have to be listed at the beginning of the line,
	+ # except cachedb(just before iterator), and python (at the beginning,
	+ # or, just before the iterator).
	# module-config: "validator iterator"

	# File with trusted keys, kept uptodate using RFC5011 probes,
	# initial file like trust-anchor-file, then it stores metadata.
	# Use several entries, one per domain name, to track multiple zones.
	#
	# If you want to perform DNSSEC validation, run unbound-anchor before
	# you start unbound (i.e. in the system boot scripts). And enable:
	# Please note usage of unbound-anchor root anchor is at your own risk
	# and under the terms of our LICENSE (see that file in the source).
	# auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"

	# trust anchor signaling sends a RFC8145 key tag query after priming.
	# trust-anchor-signaling: yes
	-
	+
	# Root key trust anchor sentinel (draft-ietf-dnsop-kskroll-sentinel)
	# root-key-sentinel: yes

	# File with DLV trusted keys. Same format as trust-anchor-file.
	# There can be only one DLV configured, it is trusted from root down.
	# DLV is going to be decommissioned. Please do not use it any more.
	# dlv-anchor-file: "dlv.isc.org.key"

	# File with trusted keys for validation. Specify more than one file
	# with several entries, one file per entry.
	# Zone file format, with DS and DNSKEY entries.
	# Note this gets out of date, use auto-trust-anchor-file please.
	# trust-anchor-file: ""

	# Trusted key for validation. DS or DNSKEY. specify the RR on a
	# single line, surrounded by "". TTL is ignored. class is IN default.
	# Note this gets out of date, use auto-trust-anchor-file please.
	# (These examples are from August 2007 and may not be valid anymore).
	# trust-anchor: "nlnetlabs.nl. DNSKEY 257 3 5 AQPzzTWMz8qSWIQlfRnPckx2BiVmkVN6LPupO3mbz7FhLSnm26n6iG9N Lby97Ji453aWZY3M5/xJBSOS2vWtco2t8C0+xeO1bc/d6ZTy32DHchpW 6rDH1vp86Ll+ha0tmwyy9QP7y2bVw5zSbFCrefk8qCUBgfHm9bHzMG1U BYtEIQ=="
	# trust-anchor: "jelte.nlnetlabs.nl. DS 42860 5 1 14D739EB566D2B1A5E216A0BA4D17FA9B038BE4A"

	# File with trusted keys for validation. Specify more than one file
	# with several entries, one file per entry. Like trust-anchor-file
	# but has a different file format. Format is BIND-9 style format,
	# the trusted-keys { name flag proto algo "key"; }; clauses are read.
	# you need external update procedures to track changes in keys.
	# trusted-keys-file: ""

	# Ignore chain of trust. Domain is treated as insecure.
	# domain-insecure: "example.com"

	# Override the date for validation with a specific fixed date.
	# Do not set this unless you are debugging signature inception
	# and expiration. "" or "0" turns the feature off. -1 ignores date.
	# val-override-date: ""

	# The time to live for bogus data, rrsets and messages. This avoids
	# some of the revalidation, until the time interval expires. in secs.
	# val-bogus-ttl: 60

	# The signature inception and expiration dates are allowed to be off
	# by 10% of the signature lifetime (expir-incep) from our local clock.
	# This leeway is capped with a minimum and a maximum. In seconds.
	# val-sig-skew-min: 3600
	# val-sig-skew-max: 86400

	# Should additional section of secure message also be kept clean of
	# unsecure data. Useful to shield the users of this validator from
	# potential bogus data in the additional section. All unsigned data
	# in the additional section is removed from secure messages.
	# val-clean-additional: yes

	# Turn permissive mode on to permit bogus messages. Thus, messages
	# for which security checks failed will be returned to clients,
	# instead of SERVFAIL. It still performs the security checks, which
	# result in interesting log files and possibly the AD bit in
	# replies if the message is found secure. The default is off.
	# val-permissive-mode: no

	# Ignore the CD flag in incoming queries and refuse them bogus data.
	# Enable it if the only clients of unbound are legacy servers (w2008)
	# that set CD but cannot validate themselves.
	# ignore-cd-flag: no

	# Serve expired responses from cache, with TTL 0 in the response,
	# and then attempt to fetch the data afresh.
	# serve-expired: no
	#
	# Limit serving of expired responses to configured seconds after
	# expiration. 0 disables the limit.
	# serve-expired-ttl: 0
	#
	# Set the TTL of expired records to the serve-expired-ttl value after a
	# failed attempt to retrieve the record from upstream. This makes sure
	# that the expired records will be served as long as there are queries
	# for it.
	# serve-expired-ttl-reset: no

	# Have the validator log failed validations for your diagnosis.
	# 0: off. 1: A line per failed user query. 2: With reason and bad IP.
	# val-log-level: 0

	# It is possible to configure NSEC3 maximum iteration counts per
	# keysize. Keep this table very short, as linear search is done.
	# A message with an NSEC3 with larger count is marked insecure.
	# List in ascending order the keysize and count values.
	# val-nsec3-keysize-iterations: "1024 150 2048 500 4096 2500"

	# instruct the auto-trust-anchor-file probing to add anchors after ttl.
	# add-holddown: 2592000 # 30 days

	# instruct the auto-trust-anchor-file probing to del anchors after ttl.
	# del-holddown: 2592000 # 30 days

	# auto-trust-anchor-file probing removes missing anchors after ttl.
	# If the value 0 is given, missing anchors are not removed.
	# keep-missing: 31622400 # 366 days

	# debug option that allows very small holddown times for key rollover,
	# otherwise the RFC mandates probe intervals must be at least 1 hour.
	# permit-small-holddown: no

	# the amount of memory to use for the key cache.
	# plain value in bytes or you can append k, m or G. default is "4Mb".
	# key-cache-size: 4m

	# the number of slabs to use for the key cache.
	# the number of slabs must be a power of 2.
	# more slabs reduce lock contention, but fragment memory usage.
	# key-cache-slabs: 4

	# the amount of memory to use for the negative cache (used for DLV).
	# plain value in bytes or you can append k, m or G. default is "1Mb".
	# neg-cache-size: 1m

	# By default, for a number of zones a small default 'nothing here'
	# reply is built-in. Query traffic is thus blocked. If you
	# wish to serve such zone you can unblock them by uncommenting one
	# of the nodefault statements below.
	# You may also have to use domain-insecure: zone to make DNSSEC work,
	# unless you have your own trust anchors for this zone.
	# local-zone: "localhost." nodefault
	# local-zone: "127.in-addr.arpa." nodefault
	# local-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." nodefault
	# local-zone: "onion." nodefault
	# local-zone: "test." nodefault
	# local-zone: "invalid." nodefault
	# local-zone: "10.in-addr.arpa." nodefault
	# local-zone: "16.172.in-addr.arpa." nodefault
	# local-zone: "17.172.in-addr.arpa." nodefault
	# local-zone: "18.172.in-addr.arpa." nodefault
	# local-zone: "19.172.in-addr.arpa." nodefault
	# local-zone: "20.172.in-addr.arpa." nodefault
	# local-zone: "21.172.in-addr.arpa." nodefault
	# local-zone: "22.172.in-addr.arpa." nodefault
	# local-zone: "23.172.in-addr.arpa." nodefault
	# local-zone: "24.172.in-addr.arpa." nodefault
	# local-zone: "25.172.in-addr.arpa." nodefault
	# local-zone: "26.172.in-addr.arpa." nodefault
	# local-zone: "27.172.in-addr.arpa." nodefault
	# local-zone: "28.172.in-addr.arpa." nodefault
	# local-zone: "29.172.in-addr.arpa." nodefault
	# local-zone: "30.172.in-addr.arpa." nodefault
	# local-zone: "31.172.in-addr.arpa." nodefault
	# local-zone: "168.192.in-addr.arpa." nodefault
	# local-zone: "0.in-addr.arpa." nodefault
	# local-zone: "254.169.in-addr.arpa." nodefault
	# local-zone: "2.0.192.in-addr.arpa." nodefault
	# local-zone: "100.51.198.in-addr.arpa." nodefault
	# local-zone: "113.0.203.in-addr.arpa." nodefault
	# local-zone: "255.255.255.255.in-addr.arpa." nodefault
	# local-zone: "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." nodefault
	# local-zone: "d.f.ip6.arpa." nodefault
	# local-zone: "8.e.f.ip6.arpa." nodefault
	# local-zone: "9.e.f.ip6.arpa." nodefault
	# local-zone: "a.e.f.ip6.arpa." nodefault
	# local-zone: "b.e.f.ip6.arpa." nodefault
	# local-zone: "8.b.d.0.1.0.0.2.ip6.arpa." nodefault
	# And for 64.100.in-addr.arpa. to 127.100.in-addr.arpa.

	# If unbound is running service for the local host then it is useful
	# to perform lan-wide lookups to the upstream, and unblock the
	# long list of local-zones above. If this unbound is a dns server
	# for a network of computers, disabled is better and stops information
	# leakage of local lan information.
	# unblock-lan-zones: no

	# The insecure-lan-zones option disables validation for
	# these zones, as if they were all listed as domain-insecure.
	# insecure-lan-zones: no

	# a number of locally served zones can be configured.
	# local-zone: <zone> <type>
	# local-data: "<resource record string>"
	# o deny serves local data (if any), else, drops queries.
	# o refuse serves local data (if any), else, replies with error.
	# o static serves local data, else, nxdomain or nodata answer.
	# o transparent gives local data, but resolves normally for other names
	# o redirect serves the zone data for any subdomain in the zone.
	# o nodefault can be used to normally resolve AS112 zones.
	# o typetransparent resolves normally for other types and other names
	# o inform acts like transparent, but logs client IP address
	# o inform_deny drops queries and logs client IP address
	+ # o inform_redirect redirects queries and logs client IP address
	# o always_transparent, always_refuse, always_nxdomain, resolve in
	# that way but ignore local data for that name
	# o noview breaks out of that view towards global local-zones.
	#
	# defaults are localhost address, reverse for 127.0.0.1 and ::1
	# and nxdomain for AS112 zones. If you configure one of these zones
	# the default content is omitted, or you can omit it with 'nodefault'.
	#
	# If you configure local-data without specifying local-zone, by
	# default a transparent local-zone is created for the data.
	#
	# You can add locally served data with
	# local-zone: "local." static
	# local-data: "mycomputer.local. IN A 192.0.2.51"
	# local-data: 'mytext.local TXT "content of text record"'
	#
	# You can override certain queries with
	# local-data: "adserver.example.com A 127.0.0.1"
	#
	# You can redirect a domain to a fixed address with
	# (this makes example.com, www.example.com, etc, all go to 192.0.2.3)
	# local-zone: "example.com" redirect
	# local-data: "example.com A 192.0.2.3"
	#
	# Shorthand to make PTR records, "IPv4 name" or "IPv6 name".
	# You can also add PTR records using local-data directly, but then
	# you need to do the reverse notation yourself.
	# local-data-ptr: "192.0.2.3 www.example.com"

	# tag a localzone with a list of tag names (in "" with spaces between)
	# local-zone-tag: "example.com" "tag2 tag3"

	# add a netblock specific override to a localzone, with zone type
	# local-zone-override: "example.com" 192.0.2.0/24 refuse

	# service clients over TLS (on the TCP sockets), with plain DNS inside
	# the TLS stream. Give the certificate to use and private key.
	# default is "" (disabled). requires restart to take effect.
	# tls-service-key: "path/to/privatekeyfile.key"
	# tls-service-pem: "path/to/publiccertfile.pem"
	# tls-port: 853

	+ # cipher setting for TLSv1.2
	+ # tls-ciphers: "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256"
	+ # cipher setting for TLSv1.3
	+ # tls-ciphersuites: "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_8_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
	+
	+ # Add the secret file for TLS Session Ticket.
	+ # Secret file must be 80 bytes of random data.
	+ # First key use to encrypt and decrypt TLS session tickets.
	+ # Other keys use to decrypt only.
	+ # requires restart to take effect.
	+ # tls-session-ticket-keys: "path/to/secret_file1"
	+ # tls-session-ticket-keys: "path/to/secret_file2"
	+
	# request upstream over TLS (with plain DNS inside the TLS stream).
	# Default is no. Can be turned on and off with unbound-control.
	# tls-upstream: no

	# Certificates used to authenticate connections made upstream.
	# tls-cert-bundle: ""

	# Add system certs to the cert bundle, from the Windows Cert Store
	# tls-win-cert: no

	# Also serve tls on these port numbers (eg. 443, ...), by listing
	# tls-additional-port: portno for each of the port numbers.

	# DNS64 prefix. Must be specified when DNS64 is use.
	# Enable dns64 in module-config. Used to synthesize IPv6 from IPv4.
	# dns64-prefix: 64:ff9b::0/96

	# DNS64 ignore AAAA records for these domains and use A instead.
	# dns64-ignore-aaaa: "example.com"

	# ratelimit for uncached, new queries, this limits recursion effort.
	# ratelimiting is experimental, and may help against randomqueryflood.
	# if 0(default) it is disabled, otherwise state qps allowed per zone.
	# ratelimit: 0

	# ratelimits are tracked in a cache, size in bytes of cache (or k,m).
	# ratelimit-size: 4m
	# ratelimit cache slabs, reduces lock contention if equal to cpucount.
	# ratelimit-slabs: 4

	# 0 blocks when ratelimited, otherwise let 1/xth traffic through
	# ratelimit-factor: 10

	# override the ratelimit for a specific domain name.
	# give this setting multiple times to have multiple overrides.
	# ratelimit-for-domain: example.com 1000
	# override the ratelimits for all domains below a domain name
	# can give this multiple times, the name closest to the zone is used.
	# ratelimit-below-domain: com 1000

	# global query ratelimit for all ip addresses.
	# feature is experimental.
	# if 0(default) it is disabled, otherwise states qps allowed per ip address
	# ip-ratelimit: 0

	# ip ratelimits are tracked in a cache, size in bytes of cache (or k,m).
	# ip-ratelimit-size: 4m
	# ip ratelimit cache slabs, reduces lock contention if equal to cpucount.
	# ip-ratelimit-slabs: 4

	# 0 blocks when ip is ratelimited, otherwise let 1/xth traffic through
	# ip-ratelimit-factor: 10

	# Limit the number of connections simultaneous from a netblock
	# tcp-connection-limit: 192.0.2.0/24 12

	- # what is considered a low rtt (ping time for upstream server), in msec
	- # low-rtt: 45
	- # select low rtt this many times out of 1000. 0 means the fast server
	- # select is disabled. prefetches are not sped up.
	- # low-rtt-permil: 0
	+ # select from the fastest servers this many times out of 1000. 0 means
	+ # the fast server select is disabled. prefetches are not sped up.
	+ # fast-server-permil: 0
	+ # the number of servers that will be used in the fast server selection.
	+ # fast-server-num: 3

	# Specific options for ipsecmod. unbound needs to be configured with
	# --enable-ipsecmod for these to take effect.
	#
	# Enable or disable ipsecmod (it still needs to be defined in
	# module-config above). Can be used when ipsecmod needs to be
	# enabled/disabled via remote-control(below).
	# ipsecmod-enabled: yes
	#
	# Path to executable external hook. It must be defined when ipsecmod is
	# listed in module-config (above).
	# ipsecmod-hook: "./my_executable"
	#
	# When enabled unbound will reply with SERVFAIL if the return value of
	# the ipsecmod-hook is not 0.
	# ipsecmod-strict: no
	#
	# Maximum time to live (TTL) for cached A/AAAA records with IPSECKEY.
	# ipsecmod-max-ttl: 3600
	#
	# Reply with A/AAAA even if the relevant IPSECKEY is bogus. Mainly used for
	# testing.
	# ipsecmod-ignore-bogus: no
	#
	# Domains for which ipsecmod will be triggered. If not defined (default)
	# all domains are treated as being whitelisted.
	# ipsecmod-whitelist: "example.com"
	# ipsecmod-whitelist: "nlnetlabs.nl"


	# Python config section. To enable:
	# o use --with-pythonmodule to configure before compiling.
	# o list python in the module-config string (above) to enable.
	+# It can be at the start, it gets validated results, or just before
	+# the iterator and process before DNSSEC validation.
	# o and give a python-script to run.
	python:
	# Script file to load
	# python-script: "@UNBOUND_SHARE_DIR@/ubmodule-tst.py"

	# Remote control config section.
	remote-control:
	# Enable remote control with unbound-control(8) here.
	# set up the keys and certificates with unbound-control-setup.
	# control-enable: no

	# what interfaces are listened to for remote control.
	# give 0.0.0.0 and ::0 to listen to all interfaces.
	# set to an absolute path to use a unix local name pipe, certificates
	# are not used for that, so key and cert files need not be present.
	# control-interface: 127.0.0.1
	# control-interface: ::1

	# port number for remote control operations.
	# control-port: 8953

	# for localhost, you can disable use of TLS by setting this to "no"
	# For local sockets this option is ignored, and TLS is not used.
	# control-use-cert: "yes"

	# unbound server key file.
	# server-key-file: "@UNBOUND_RUN_DIR@/unbound_server.key"

	# unbound server certificate file.
	# server-cert-file: "@UNBOUND_RUN_DIR@/unbound_server.pem"

	# unbound-control key file.
	# control-key-file: "@UNBOUND_RUN_DIR@/unbound_control.key"

	# unbound-control certificate file.
	# control-cert-file: "@UNBOUND_RUN_DIR@/unbound_control.pem"

	# Stub zones.
	# Create entries like below, to make all queries for 'example.com' and
	# 'example.org' go to the given list of nameservers. list zero or more
	# nameservers by hostname or by ipaddress. If you set stub-prime to yes,
	# the list is treated as priming hints (default is no).
	# With stub-first yes, it attempts without the stub if it fails.
	# Consider adding domain-insecure: name and local-zone: name nodefault
	# to the server: section if the stub is a locally served zone.
	# stub-zone:
	# name: "example.com"
	# stub-addr: 192.0.2.68
	# stub-prime: no
	# stub-first: no
	# stub-tls-upstream: no
	# stub-no-cache: no
	# stub-zone:
	# name: "example.org"
	# stub-host: ns.example.com.

	# Forward zones
	# Create entries like below, to make all queries for 'example.com' and
	# 'example.org' go to the given list of servers. These servers have to handle
	# recursion to other nameservers. List zero or more nameservers by hostname
	# or by ipaddress. Use an entry with name "." to forward all queries.
	# If you enable forward-first, it attempts without the forward if it fails.
	# forward-zone:
	# name: "example.com"
	# forward-addr: 192.0.2.68
	# forward-addr: 192.0.2.73@5355 # forward to port 5355.
	# forward-first: no
	# forward-tls-upstream: no
	# forward-no-cache: no
	# forward-zone:
	# name: "example.org"
	# forward-host: fwd.example.com

	# Authority zones
	# The data for these zones is kept locally, from a file or downloaded.
	# The data can be served to downstream clients, or used instead of the
	# upstream (which saves a lookup to the upstream). The first example
	# has a copy of the root for local usage. The second serves example.org
	# authoritatively. zonefile: reads from file (and writes to it if you also
	# download it), master: fetches with AXFR and IXFR, or url to zonefile.
	# With allow-notify: you can give additional (apart from masters) sources of
	# notifies.
	# auth-zone:
	# name: "."
	+# master: 199.9.14.201 # b.root-servers.net
	+# master: 192.33.4.12 # c.root-servers.net
	+# master: 199.7.91.13 # d.root-servers.net
	+# master: 192.5.5.241 # f.root-servers.net
	+# master: 192.112.36.4 # g.root-servers.net
	+# master: 193.0.14.129 # k.root-servers.net
	+# master: 192.0.47.132 # xfr.cjr.dns.icann.org
	+# master: 192.0.32.132 # xfr.lax.dns.icann.org
	+# master: 2001:500:200::b # b.root-servers.net
	+# master: 2001:500:2::c # c.root-servers.net
	+# master: 2001:500:2d::d # d.root-servers.net
	+# master: 2001:500:2f::f # f.root-servers.net
	+# master: 2001:500:12::d0d # g.root-servers.net
	+# master: 2001:7fd::1 # k.root-servers.net
	+# master: 2620:0:2830:202::132 # xfr.cjr.dns.icann.org
	+# master: 2620:0:2d0:202::132 # xfr.lax.dns.icann.org
	+# fallback-enabled: yes
	# for-downstream: no
	# for-upstream: yes
	-# fallback-enabled: yes
	-# master: b.root-servers.net
	-# master: c.root-servers.net
	-# master: e.root-servers.net
	-# master: f.root-servers.net
	-# master: g.root-servers.net
	-# master: k.root-servers.net
	# auth-zone:
	# name: "example.org"
	# for-downstream: yes
	# for-upstream: yes
	# zonefile: "example.org.zone"

	# Views
	# Create named views. Name must be unique. Map views to requests using
	# the access-control-view option. Views can contain zero or more local-zone
	# and local-data options. Options from matching views will override global
	# options. Global options will be used if no matching view is found.
	# With view-first yes, it will try to answer using the global local-zone and
	# local-data elements if there is no view specific match.
	# view:
	# name: "viewname"
	# local-zone: "example.com" redirect
	# local-data: "example.com A 192.0.2.3"
	# local-data-ptr: "192.0.2.3 www.example.com"
	# view-first: no
	# view:
	# name: "anotherview"
	# local-zone: "example.com" refuse

	# DNSCrypt
	# Caveats:
	# 1. the keys/certs cannot be produced by unbound. You can use dnscrypt-wrapper
	# for this: https://github.com/cofyc/dnscrypt-wrapper/blob/master/README.md#usage
	# 2. dnscrypt channel attaches to an interface. you MUST set interfaces to
	# listen on `dnscrypt-port` with the follo0wing snippet:
	# server:
	# interface: 0.0.0.0@443
	# interface: ::0@443
	#
	# Finally, `dnscrypt` config has its own section.
	# dnscrypt:
	# dnscrypt-enable: yes
	# dnscrypt-port: 443
	# dnscrypt-provider: 2.dnscrypt-cert.example.com.
	# dnscrypt-secret-key: /path/unbound-conf/keys1/1.key
	# dnscrypt-secret-key: /path/unbound-conf/keys2/1.key
	# dnscrypt-provider-cert: /path/unbound-conf/keys1/1.cert
	# dnscrypt-provider-cert: /path/unbound-conf/keys2/1.cert

	# CacheDB
	# Enable external backend DB as auxiliary cache. Specify the backend name
	# (default is "testframe", which has no use other than for debugging and
	# testing) and backend-specific options. The 'cachedb' module must be
	-# included in module-config.
	+# included in module-config, just before the iterator module.
	# cachedb:
	# backend: "testframe"
	# # secret seed string to calculate hashed keys
	# secret-seed: "default"
	#
	# # For "redis" backend:
	# # redis server's IP address or host name
	# redis-server-host: 127.0.0.1
	# # redis server's TCP port
	# redis-server-port: 6379
	# # timeout (in ms) for communication with the redis server
	# redis-timeout: 100
	Index: head/contrib/unbound/doc/libunbound.3
	===================================================================
	--- head/contrib/unbound/doc/libunbound.3 (revision 349719)
	+++ head/contrib/unbound/doc/libunbound.3 (revision 349720)
	@@ -1,423 +1,433 @@
	-.TH "libunbound" "3" "Oct 8, 2018" "NLnet Labs" "unbound 1.8.1"
	+.TH "libunbound" "3" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
	.\"
	.\" libunbound.3 -- unbound library functions manual
	.\"
	.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
	.\"
	.\" See LICENSE for the license.
	.\"
	.\"
	.SH "NAME"
	.B libunbound,
	.B unbound.h,
	.B ub_ctx,
	.B ub_result,
	.B ub_callback_type,
	.B ub_ctx_create,
	.B ub_ctx_delete,
	.B ub_ctx_set_option,
	.B ub_ctx_get_option,
	.B ub_ctx_config,
	.B ub_ctx_set_fwd,
	.B ub_ctx_set_stub,
	+.B ub_ctx_set_tls,
	.B ub_ctx_resolvconf,
	.B ub_ctx_hosts,
	.B ub_ctx_add_ta,
	.B ub_ctx_add_ta_autr,
	.B ub_ctx_add_ta_file,
	.B ub_ctx_trustedkeys,
	.B ub_ctx_debugout,
	.B ub_ctx_debuglevel,
	.B ub_ctx_async,
	.B ub_poll,
	.B ub_wait,
	.B ub_fd,
	.B ub_process,
	.B ub_resolve,
	.B ub_resolve_async,
	.B ub_cancel,
	.B ub_resolve_free,
	.B ub_strerror,
	.B ub_ctx_print_local_zones,
	.B ub_ctx_zone_add,
	.B ub_ctx_zone_remove,
	.B ub_ctx_data_add,
	.B ub_ctx_data_remove
	-\- Unbound DNS validating resolver 1.8.1 functions.
	+\- Unbound DNS validating resolver 1.9.2 functions.
	.SH "SYNOPSIS"
	.B #include <unbound.h>
	.LP
	\fIstruct ub_ctx *\fR
	\fBub_ctx_create\fR(\fIvoid\fR);
	.LP
	\fIvoid\fR
	\fBub_ctx_delete\fR(\fIstruct ub_ctx*\fR ctx);
	.LP
	\fIint\fR
	\fBub_ctx_set_option\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR opt, \fIchar*\fR val);
	.LP
	\fIint\fR
	\fBub_ctx_get_option\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR opt, \fIchar**\fR val);
	.LP
	\fIint\fR
	\fBub_ctx_config\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR fname);
	.LP
	\fIint\fR
	\fBub_ctx_set_fwd\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR addr);
	.LP
	\fIint\fR
	\fBub_ctx_set_stub\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR zone,
	\fIchar*\fR addr,
	.br
	\fIint\fR isprime);
	.LP
	\fIint\fR
	+\fBub_ctx_set_tls\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR tls);
	+.LP
	+\fIint\fR
	\fBub_ctx_resolvconf\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR fname);
	.LP
	\fIint\fR
	\fBub_ctx_hosts\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR fname);
	.LP
	\fIint\fR
	\fBub_ctx_add_ta\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR ta);
	.LP
	\fIint\fR
	\fBub_ctx_add_ta_autr\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR fname);
	.LP
	\fIint\fR
	\fBub_ctx_add_ta_file\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR fname);
	.LP
	\fIint\fR
	\fBub_ctx_trustedkeys\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR fname);
	.LP
	\fIint\fR
	\fBub_ctx_debugout\fR(\fIstruct ub_ctx\fR ctx, \fIFILE\fR out);
	.LP
	\fIint\fR
	\fBub_ctx_debuglevel\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR d);
	.LP
	\fIint\fR
	\fBub_ctx_async\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR dothread);
	.LP
	\fIint\fR
	\fBub_poll\fR(\fIstruct ub_ctx*\fR ctx);
	.LP
	\fIint\fR
	\fBub_wait\fR(\fIstruct ub_ctx*\fR ctx);
	.LP
	\fIint\fR
	\fBub_fd\fR(\fIstruct ub_ctx*\fR ctx);
	.LP
	\fIint\fR
	\fBub_process\fR(\fIstruct ub_ctx*\fR ctx);
	.LP
	\fIint\fR
	\fBub_resolve\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR name,
	.br
	\fIint\fR rrtype, \fIint\fR rrclass, \fIstruct ub_result**\fR result);
	.LP
	\fIint\fR
	\fBub_resolve_async\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR name,
	.br
	\fIint\fR rrtype, \fIint\fR rrclass, \fIvoid*\fR mydata,
	.br
	\fIub_callback_type\fR callback, \fIint*\fR async_id);
	.LP
	\fIint\fR
	\fBub_cancel\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR async_id);
	.LP
	\fIvoid\fR
	\fBub_resolve_free\fR(\fIstruct ub_result*\fR result);
	.LP
	\fIconst char *\fR
	\fBub_strerror\fR(\fIint\fR err);
	.LP
	\fIint\fR
	\fBub_ctx_print_local_zones\fR(\fIstruct ub_ctx*\fR ctx);
	.LP
	\fIint\fR
	\fBub_ctx_zone_add\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR zone_name, \fIchar*\fR zone_type);
	.LP
	\fIint\fR
	\fBub_ctx_zone_remove\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR zone_name);
	.LP
	\fIint\fR
	\fBub_ctx_data_add\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR data);
	.LP
	\fIint\fR
	\fBub_ctx_data_remove\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR data);
	.SH "DESCRIPTION"
	.B Unbound
	is an implementation of a DNS resolver, that does caching and
	DNSSEC validation. This is the library API, for using the \-lunbound library.
	The server daemon is described in \fIunbound\fR(8).
	The library works independent from a running unbound server, and
	can be used to convert hostnames to ip addresses, and back,
	and obtain other information from the DNS. The library performs public\-key
	validation of results with DNSSEC.
	.P
	The library uses a variable of type \fIstruct ub_ctx\fR to keep context
	between calls. The user must maintain it, creating it with
	.B ub_ctx_create
	and deleting it with
	.B ub_ctx_delete\fR.
	It can be created and deleted at any time. Creating it anew removes any
	previous configuration (such as trusted keys) and clears any cached results.
	.P
	The functions are thread\-safe, and a context can be used in a threaded (as
	well as in a non\-threaded) environment. Also resolution (and validation)
	can be performed blocking and non\-blocking (also called asynchronous).
	The async method returns from the call immediately, so that processing
	can go on, while the results become available later.
	.P
	The functions are discussed in turn below.
	.SH "FUNCTIONS"
	.TP
	.B ub_ctx_create
	Create a new context, initialised with defaults.
	The information from /etc/resolv.conf and /etc/hosts is not utilised
	by default. Use
	.B ub_ctx_resolvconf
	and
	.B ub_ctx_hosts
	to read them.
	Before you call this, use the openssl functions CRYPTO_set_id_callback and
	CRYPTO_set_locking_callback to set up asynchronous operation if you use
	lib openssl (the application calls these functions once for initialisation).
	Openssl 1.0.0 or later uses the CRYPTO_THREADID_set_callback function.
	.TP
	.B ub_ctx_delete
	Delete validation context and free associated resources.
	Outstanding async queries are killed and callbacks are not called for them.
	.TP
	.B ub_ctx_set_option
	A power\-user interface that lets you specify one of the options from the
	config file format, see \fIunbound.conf\fR(5). Not all options are
	relevant. For some specific options, such as adding trust anchors, special
	routines exist. Pass the option name with the trailing ':'.
	.TP
	.B ub_ctx_get_option
	A power\-user interface that gets an option value. Some options cannot be
	gotten, and others return a newline separated list. Pass the option name
	without trailing ':'. The returned value must be free(2)d by the caller.
	.TP
	.B ub_ctx_config
	A power\-user interface that lets you specify an unbound config file, see
	\fIunbound.conf\fR(5), which is read for configuration. Not all options are
	relevant. For some specific options, such as adding trust anchors, special
	routines exist. This function is thread\-safe only if a single instance of
	ub_ctx* exists in the application. If several instances exist the
	application has to ensure that ub_ctx_config is not called in parallel by
	the different instances.
	.TP
	.B ub_ctx_set_fwd
	Set machine to forward DNS queries to, the caching resolver to use.
	IP4 or IP6 address. Forwards all DNS requests to that machine, which
	is expected to run a recursive resolver. If the proxy is not
	DNSSEC capable, validation may fail. Can be called several times, in
	that case the addresses are used as backup servers.
	At this time it is only possible to set configuration before the
	first resolve is done.
	.TP
	.B ub_ctx_set_stub
	Set a stub zone, authoritative dns servers to use for a particular zone.
	IP4 or IP6 address. If the address is NULL the stub entry is removed.
	Set isprime true if you configure root hints with it. Otherwise similar to
	the stub zone item from unbound's config file. Can be called several times,
	for different zones, or to add multiple addresses for a particular zone.
	+At this time it is only possible to set configuration before the
	+first resolve is done.
	+.TP
	+.B ub_ctx_set_tls
	+Enable DNS over TLS (DoT) for machines set with
	+.B ub_ctx_set_fwd.
	At this time it is only possible to set configuration before the
	first resolve is done.
	.TP
	.B ub_ctx_resolvconf
	By default the root servers are queried and full resolver mode is used, but
	you can use this call to read the list of nameservers to use from the
	filename given.
	Usually "/etc/resolv.conf". Uses those nameservers as caching proxies.
	If they do not support DNSSEC, validation may fail.
	Only nameservers are picked up, the searchdomain, ndots and other
	settings from \fIresolv.conf\fR(5) are ignored.
	If fname NULL is passed, "/etc/resolv.conf" is used (if on Windows,
	the system\-wide configured nameserver is picked instead).
	At this time it is only possible to set configuration before the
	first resolve is done.
	.TP
	.B ub_ctx_hosts
	Read list of hosts from the filename given.
	Usually "/etc/hosts". When queried for, these addresses are not marked
	DNSSEC secure. If fname NULL is passed, "/etc/hosts" is used
	(if on Windows, etc/hosts from WINDIR is picked instead).
	At this time it is only possible to set configuration before the
	first resolve is done.
	.TP
	.B
	ub_ctx_add_ta
	Add a trust anchor to the given context.
	At this time it is only possible to add trusted keys before the
	first resolve is done.
	The format is a string, similar to the zone\-file format,
	[domainname] [type] [rdata contents]. Both DS and DNSKEY records are accepted.
	.TP
	.B ub_ctx_add_ta_autr
	Add filename with automatically tracked trust anchor to the given context.
	Pass name of a file with the managed trust anchor. You can create this
	file with \fIunbound\-anchor\fR(8) for the root anchor. You can also
	create it with an initial file with one line with a DNSKEY or DS record.
	If the file is writable, it is updated when the trust anchor changes.
	At this time it is only possible to add trusted keys before the
	first resolve is done.
	.TP
	.B ub_ctx_add_ta_file
	Add trust anchors to the given context.
	Pass name of a file with DS and DNSKEY records in zone file format.
	At this time it is only possible to add trusted keys before the
	first resolve is done.
	.TP
	.B ub_ctx_trustedkeys
	Add trust anchors to the given context.
	Pass the name of a bind\-style config file with trusted\-keys{}.
	At this time it is only possible to add trusted keys before the
	first resolve is done.
	.TP
	.B ub_ctx_debugout
	Set debug and error log output to the given stream. Pass NULL to disable
	output. Default is stderr. File\-names or using syslog can be enabled
	using config options, this routine is for using your own stream.
	.TP
	.B ub_ctx_debuglevel
	Set debug verbosity for the context. Output is directed to stderr.
	Higher debug level gives more output.
	.TP
	.B ub_ctx_async
	Set a context behaviour for asynchronous action.
	if set to true, enables threading and a call to
	.B ub_resolve_async
	creates a thread to handle work in the background.
	If false, a process is forked to handle work in the background.
	Changes to this setting after
	.B ub_resolve_async
	calls have been made have no effect (delete and re\-create the context
	to change).
	.TP
	.B ub_poll
	Poll a context to see if it has any new results.
	Do not poll in a loop, instead extract the fd below to poll for readiness,
	and then check, or wait using the wait routine.
	Returns 0 if nothing to read, or nonzero if a result is available.
	If nonzero, call
	.B ub_process
	to do callbacks.
	.TP
	.B ub_wait
	Wait for a context to finish with results. Calls
	.B ub_process
	after the wait for you. After the wait, there are no more outstanding
	asynchronous queries.
	.TP
	.B ub_fd
	Get file descriptor. Wait for it to become readable, at this point
	answers are returned from the asynchronous validating resolver.
	Then call the \fBub_process\fR to continue processing.
	.TP
	.B ub_process
	Call this routine to continue processing results from the validating
	resolver (when the fd becomes readable).
	Will perform necessary callbacks.
	.TP
	.B ub_resolve
	Perform resolution and validation of the target name.
	The name is a domain name in a zero terminated text string.
	The rrtype and rrclass are DNS type and class codes.
	The result structure is newly allocated with the resulting data.
	.TP
	.B ub_resolve_async
	Perform asynchronous resolution and validation of the target name.
	Arguments mean the same as for \fBub_resolve\fR except no
	data is returned immediately, instead a callback is called later.
	The callback receives a copy of the mydata pointer, that you can use to pass
	information to the callback. The callback type is a function pointer to
	a function declared as
	.IP
	void my_callback_function(void* my_arg, int err,
	.br
	struct ub_result* result);
	.IP
	The async_id is returned so you can (at your option) decide to track it
	and cancel the request if needed. If you pass a NULL pointer the async_id
	is not returned.
	.TP
	.B ub_cancel
	Cancel an async query in progress. This may return an error if the query
	does not exist, or the query is already being delivered, in that case you
	may still get a callback for the query.
	.TP
	.B ub_resolve_free
	Free struct ub_result contents after use.
	.TP
	.B ub_strerror
	Convert error value from one of the unbound library functions
	to a human readable string.
	.TP
	.B ub_ctx_print_local_zones
	Debug printout the local authority information to debug output.
	.TP
	.B ub_ctx_zone_add
	Add new zone to local authority info, like local\-zone \fIunbound.conf\fR(5)
	statement.
	.TP
	.B ub_ctx_zone_remove
	Delete zone from local authority info.
	.TP
	.B ub_ctx_data_add
	Add resource record data to local authority info, like local\-data
	\fIunbound.conf\fR(5) statement.
	.TP
	.B ub_ctx_data_remove
	Delete local authority data from the name given.
	.SH "RESULT DATA STRUCTURE"
	The result of the DNS resolution and validation is returned as
	\fIstruct ub_result\fR. The result structure contains the following entries.
	.P
	.nf
	struct ub_result {
	char* qname; /* text string, original question */
	int qtype; /* type code asked for */
	int qclass; /* class code asked for */
	char** data; /* array of rdata items, NULL terminated*/
	int* len; /* array with lengths of rdata items */
	char* canonname; /* canonical name of result */
	int rcode; /* additional error code in case of no data */
	void* answer_packet; /* full network format answer packet */
	int answer_len; /* length of packet in octets */
	int havedata; /* true if there is data */
	int nxdomain; /* true if nodata because name does not exist */
	int secure; /* true if result is secure */
	int bogus; /* true if a security failure happened */
	char* why_bogus; /* string with error if bogus */
	int ttl; /* number of seconds the result is valid */
	};
	.fi
	.P
	If both secure and bogus are false, security was not enabled for the
	domain of the query. Else, they are not both true, one of them is true.
	.SH "RETURN VALUES"
	Many routines return an error code. The value 0 (zero) denotes no error
	happened. Other values can be passed to
	.B ub_strerror
	to obtain a readable error string.
	.B ub_strerror
	returns a zero terminated string.
	.B ub_ctx_create
	returns NULL on an error (a malloc failure).
	.B ub_poll
	returns true if some information may be available, false otherwise.
	.B ub_fd
	returns a file descriptor or \-1 on error.
	.B ub_ctx_config
	and
	.B ub_ctx_resolvconf
	attempt to leave errno informative on a function return with file read failure.
	.SH "SEE ALSO"
	\fIunbound.conf\fR(5),
	\fIunbound\fR(8).
	.SH "AUTHORS"
	.B Unbound
	developers are mentioned in the CREDITS file in the distribution.
	Index: head/contrib/unbound/doc/libunbound.3.in
	===================================================================
	--- head/contrib/unbound/doc/libunbound.3.in (revision 349719)
	+++ head/contrib/unbound/doc/libunbound.3.in (revision 349720)
	@@ -1,423 +1,433 @@
	-.TH "libunbound" "3" "Oct 8, 2018" "NLnet Labs" "unbound 1.8.1"
	+.TH "libunbound" "3" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
	.\"
	.\" libunbound.3 -- unbound library functions manual
	.\"
	.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
	.\"
	.\" See LICENSE for the license.
	.\"
	.\"
	.SH "NAME"
	.B libunbound,
	.B unbound.h,
	.B ub_ctx,
	.B ub_result,
	.B ub_callback_type,
	.B ub_ctx_create,
	.B ub_ctx_delete,
	.B ub_ctx_set_option,
	.B ub_ctx_get_option,
	.B ub_ctx_config,
	.B ub_ctx_set_fwd,
	.B ub_ctx_set_stub,
	+.B ub_ctx_set_tls,
	.B ub_ctx_resolvconf,
	.B ub_ctx_hosts,
	.B ub_ctx_add_ta,
	.B ub_ctx_add_ta_autr,
	.B ub_ctx_add_ta_file,
	.B ub_ctx_trustedkeys,
	.B ub_ctx_debugout,
	.B ub_ctx_debuglevel,
	.B ub_ctx_async,
	.B ub_poll,
	.B ub_wait,
	.B ub_fd,
	.B ub_process,
	.B ub_resolve,
	.B ub_resolve_async,
	.B ub_cancel,
	.B ub_resolve_free,
	.B ub_strerror,
	.B ub_ctx_print_local_zones,
	.B ub_ctx_zone_add,
	.B ub_ctx_zone_remove,
	.B ub_ctx_data_add,
	.B ub_ctx_data_remove
	-\- Unbound DNS validating resolver 1.8.1 functions.
	+\- Unbound DNS validating resolver 1.9.2 functions.
	.SH "SYNOPSIS"
	.B #include <unbound.h>
	.LP
	\fIstruct ub_ctx *\fR
	\fBub_ctx_create\fR(\fIvoid\fR);
	.LP
	\fIvoid\fR
	\fBub_ctx_delete\fR(\fIstruct ub_ctx*\fR ctx);
	.LP
	\fIint\fR
	\fBub_ctx_set_option\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR opt, \fIchar*\fR val);
	.LP
	\fIint\fR
	\fBub_ctx_get_option\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR opt, \fIchar**\fR val);
	.LP
	\fIint\fR
	\fBub_ctx_config\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR fname);
	.LP
	\fIint\fR
	\fBub_ctx_set_fwd\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR addr);
	.LP
	\fIint\fR
	\fBub_ctx_set_stub\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR zone,
	\fIchar*\fR addr,
	.br
	\fIint\fR isprime);
	.LP
	\fIint\fR
	+\fBub_ctx_set_tls\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR tls);
	+.LP
	+\fIint\fR
	\fBub_ctx_resolvconf\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR fname);
	.LP
	\fIint\fR
	\fBub_ctx_hosts\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR fname);
	.LP
	\fIint\fR
	\fBub_ctx_add_ta\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR ta);
	.LP
	\fIint\fR
	\fBub_ctx_add_ta_autr\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR fname);
	.LP
	\fIint\fR
	\fBub_ctx_add_ta_file\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR fname);
	.LP
	\fIint\fR
	\fBub_ctx_trustedkeys\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR fname);
	.LP
	\fIint\fR
	\fBub_ctx_debugout\fR(\fIstruct ub_ctx\fR ctx, \fIFILE\fR out);
	.LP
	\fIint\fR
	\fBub_ctx_debuglevel\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR d);
	.LP
	\fIint\fR
	\fBub_ctx_async\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR dothread);
	.LP
	\fIint\fR
	\fBub_poll\fR(\fIstruct ub_ctx*\fR ctx);
	.LP
	\fIint\fR
	\fBub_wait\fR(\fIstruct ub_ctx*\fR ctx);
	.LP
	\fIint\fR
	\fBub_fd\fR(\fIstruct ub_ctx*\fR ctx);
	.LP
	\fIint\fR
	\fBub_process\fR(\fIstruct ub_ctx*\fR ctx);
	.LP
	\fIint\fR
	\fBub_resolve\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR name,
	.br
	\fIint\fR rrtype, \fIint\fR rrclass, \fIstruct ub_result**\fR result);
	.LP
	\fIint\fR
	\fBub_resolve_async\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR name,
	.br
	\fIint\fR rrtype, \fIint\fR rrclass, \fIvoid*\fR mydata,
	.br
	\fIub_callback_type\fR callback, \fIint*\fR async_id);
	.LP
	\fIint\fR
	\fBub_cancel\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR async_id);
	.LP
	\fIvoid\fR
	\fBub_resolve_free\fR(\fIstruct ub_result*\fR result);
	.LP
	\fIconst char *\fR
	\fBub_strerror\fR(\fIint\fR err);
	.LP
	\fIint\fR
	\fBub_ctx_print_local_zones\fR(\fIstruct ub_ctx*\fR ctx);
	.LP
	\fIint\fR
	\fBub_ctx_zone_add\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR zone_name, \fIchar*\fR zone_type);
	.LP
	\fIint\fR
	\fBub_ctx_zone_remove\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR zone_name);
	.LP
	\fIint\fR
	\fBub_ctx_data_add\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR data);
	.LP
	\fIint\fR
	\fBub_ctx_data_remove\fR(\fIstruct ub_ctx\fR ctx, \fIchar\fR data);
	.SH "DESCRIPTION"
	.B Unbound
	is an implementation of a DNS resolver, that does caching and
	DNSSEC validation. This is the library API, for using the \-lunbound library.
	The server daemon is described in \fIunbound\fR(8).
	The library works independent from a running unbound server, and
	can be used to convert hostnames to ip addresses, and back,
	and obtain other information from the DNS. The library performs public\-key
	validation of results with DNSSEC.
	.P
	The library uses a variable of type \fIstruct ub_ctx\fR to keep context
	between calls. The user must maintain it, creating it with
	.B ub_ctx_create
	and deleting it with
	.B ub_ctx_delete\fR.
	It can be created and deleted at any time. Creating it anew removes any
	previous configuration (such as trusted keys) and clears any cached results.
	.P
	The functions are thread\-safe, and a context can be used in a threaded (as
	well as in a non\-threaded) environment. Also resolution (and validation)
	can be performed blocking and non\-blocking (also called asynchronous).
	The async method returns from the call immediately, so that processing
	can go on, while the results become available later.
	.P
	The functions are discussed in turn below.
	.SH "FUNCTIONS"
	.TP
	.B ub_ctx_create
	Create a new context, initialised with defaults.
	The information from /etc/resolv.conf and /etc/hosts is not utilised
	by default. Use
	.B ub_ctx_resolvconf
	and
	.B ub_ctx_hosts
	to read them.
	Before you call this, use the openssl functions CRYPTO_set_id_callback and
	CRYPTO_set_locking_callback to set up asynchronous operation if you use
	lib openssl (the application calls these functions once for initialisation).
	Openssl 1.0.0 or later uses the CRYPTO_THREADID_set_callback function.
	.TP
	.B ub_ctx_delete
	Delete validation context and free associated resources.
	Outstanding async queries are killed and callbacks are not called for them.
	.TP
	.B ub_ctx_set_option
	A power\-user interface that lets you specify one of the options from the
	config file format, see \fIunbound.conf\fR(5). Not all options are
	relevant. For some specific options, such as adding trust anchors, special
	routines exist. Pass the option name with the trailing ':'.
	.TP
	.B ub_ctx_get_option
	A power\-user interface that gets an option value. Some options cannot be
	gotten, and others return a newline separated list. Pass the option name
	without trailing ':'. The returned value must be free(2)d by the caller.
	.TP
	.B ub_ctx_config
	A power\-user interface that lets you specify an unbound config file, see
	\fIunbound.conf\fR(5), which is read for configuration. Not all options are
	relevant. For some specific options, such as adding trust anchors, special
	routines exist. This function is thread\-safe only if a single instance of
	ub_ctx* exists in the application. If several instances exist the
	application has to ensure that ub_ctx_config is not called in parallel by
	the different instances.
	.TP
	.B ub_ctx_set_fwd
	Set machine to forward DNS queries to, the caching resolver to use.
	IP4 or IP6 address. Forwards all DNS requests to that machine, which
	is expected to run a recursive resolver. If the proxy is not
	DNSSEC capable, validation may fail. Can be called several times, in
	that case the addresses are used as backup servers.
	At this time it is only possible to set configuration before the
	first resolve is done.
	.TP
	.B ub_ctx_set_stub
	Set a stub zone, authoritative dns servers to use for a particular zone.
	IP4 or IP6 address. If the address is NULL the stub entry is removed.
	Set isprime true if you configure root hints with it. Otherwise similar to
	the stub zone item from unbound's config file. Can be called several times,
	for different zones, or to add multiple addresses for a particular zone.
	+At this time it is only possible to set configuration before the
	+first resolve is done.
	+.TP
	+.B ub_ctx_set_tls
	+Enable DNS over TLS (DoT) for machines set with
	+.B ub_ctx_set_fwd.
	At this time it is only possible to set configuration before the
	first resolve is done.
	.TP
	.B ub_ctx_resolvconf
	By default the root servers are queried and full resolver mode is used, but
	you can use this call to read the list of nameservers to use from the
	filename given.
	Usually "/etc/resolv.conf". Uses those nameservers as caching proxies.
	If they do not support DNSSEC, validation may fail.
	Only nameservers are picked up, the searchdomain, ndots and other
	settings from \fIresolv.conf\fR(5) are ignored.
	If fname NULL is passed, "/etc/resolv.conf" is used (if on Windows,
	the system\-wide configured nameserver is picked instead).
	At this time it is only possible to set configuration before the
	first resolve is done.
	.TP
	.B ub_ctx_hosts
	Read list of hosts from the filename given.
	Usually "/etc/hosts". When queried for, these addresses are not marked
	DNSSEC secure. If fname NULL is passed, "/etc/hosts" is used
	(if on Windows, etc/hosts from WINDIR is picked instead).
	At this time it is only possible to set configuration before the
	first resolve is done.
	.TP
	.B
	ub_ctx_add_ta
	Add a trust anchor to the given context.
	At this time it is only possible to add trusted keys before the
	first resolve is done.
	The format is a string, similar to the zone\-file format,
	[domainname] [type] [rdata contents]. Both DS and DNSKEY records are accepted.
	.TP
	.B ub_ctx_add_ta_autr
	Add filename with automatically tracked trust anchor to the given context.
	Pass name of a file with the managed trust anchor. You can create this
	file with \fIunbound\-anchor\fR(8) for the root anchor. You can also
	create it with an initial file with one line with a DNSKEY or DS record.
	If the file is writable, it is updated when the trust anchor changes.
	At this time it is only possible to add trusted keys before the
	first resolve is done.
	.TP
	.B ub_ctx_add_ta_file
	Add trust anchors to the given context.
	Pass name of a file with DS and DNSKEY records in zone file format.
	At this time it is only possible to add trusted keys before the
	first resolve is done.
	.TP
	.B ub_ctx_trustedkeys
	Add trust anchors to the given context.
	Pass the name of a bind\-style config file with trusted\-keys{}.
	At this time it is only possible to add trusted keys before the
	first resolve is done.
	.TP
	.B ub_ctx_debugout
	Set debug and error log output to the given stream. Pass NULL to disable
	output. Default is stderr. File\-names or using syslog can be enabled
	using config options, this routine is for using your own stream.
	.TP
	.B ub_ctx_debuglevel
	Set debug verbosity for the context. Output is directed to stderr.
	Higher debug level gives more output.
	.TP
	.B ub_ctx_async
	Set a context behaviour for asynchronous action.
	if set to true, enables threading and a call to
	.B ub_resolve_async
	creates a thread to handle work in the background.
	If false, a process is forked to handle work in the background.
	Changes to this setting after
	.B ub_resolve_async
	calls have been made have no effect (delete and re\-create the context
	to change).
	.TP
	.B ub_poll
	Poll a context to see if it has any new results.
	Do not poll in a loop, instead extract the fd below to poll for readiness,
	and then check, or wait using the wait routine.
	Returns 0 if nothing to read, or nonzero if a result is available.
	If nonzero, call
	.B ub_process
	to do callbacks.
	.TP
	.B ub_wait
	Wait for a context to finish with results. Calls
	.B ub_process
	after the wait for you. After the wait, there are no more outstanding
	asynchronous queries.
	.TP
	.B ub_fd
	Get file descriptor. Wait for it to become readable, at this point
	answers are returned from the asynchronous validating resolver.
	Then call the \fBub_process\fR to continue processing.
	.TP
	.B ub_process
	Call this routine to continue processing results from the validating
	resolver (when the fd becomes readable).
	Will perform necessary callbacks.
	.TP
	.B ub_resolve
	Perform resolution and validation of the target name.
	The name is a domain name in a zero terminated text string.
	The rrtype and rrclass are DNS type and class codes.
	The result structure is newly allocated with the resulting data.
	.TP
	.B ub_resolve_async
	Perform asynchronous resolution and validation of the target name.
	Arguments mean the same as for \fBub_resolve\fR except no
	data is returned immediately, instead a callback is called later.
	The callback receives a copy of the mydata pointer, that you can use to pass
	information to the callback. The callback type is a function pointer to
	a function declared as
	.IP
	void my_callback_function(void* my_arg, int err,
	.br
	struct ub_result* result);
	.IP
	The async_id is returned so you can (at your option) decide to track it
	and cancel the request if needed. If you pass a NULL pointer the async_id
	is not returned.
	.TP
	.B ub_cancel
	Cancel an async query in progress. This may return an error if the query
	does not exist, or the query is already being delivered, in that case you
	may still get a callback for the query.
	.TP
	.B ub_resolve_free
	Free struct ub_result contents after use.
	.TP
	.B ub_strerror
	Convert error value from one of the unbound library functions
	to a human readable string.
	.TP
	.B ub_ctx_print_local_zones
	Debug printout the local authority information to debug output.
	.TP
	.B ub_ctx_zone_add
	Add new zone to local authority info, like local\-zone \fIunbound.conf\fR(5)
	statement.
	.TP
	.B ub_ctx_zone_remove
	Delete zone from local authority info.
	.TP
	.B ub_ctx_data_add
	Add resource record data to local authority info, like local\-data
	\fIunbound.conf\fR(5) statement.
	.TP
	.B ub_ctx_data_remove
	Delete local authority data from the name given.
	.SH "RESULT DATA STRUCTURE"
	The result of the DNS resolution and validation is returned as
	\fIstruct ub_result\fR. The result structure contains the following entries.
	.P
	.nf
	struct ub_result {
	char* qname; /* text string, original question */
	int qtype; /* type code asked for */
	int qclass; /* class code asked for */
	char** data; /* array of rdata items, NULL terminated*/
	int* len; /* array with lengths of rdata items */
	char* canonname; /* canonical name of result */
	int rcode; /* additional error code in case of no data */
	void* answer_packet; /* full network format answer packet */
	int answer_len; /* length of packet in octets */
	int havedata; /* true if there is data */
	int nxdomain; /* true if nodata because name does not exist */
	int secure; /* true if result is secure */
	int bogus; /* true if a security failure happened */
	char* why_bogus; /* string with error if bogus */
	int ttl; /* number of seconds the result is valid */
	};
	.fi
	.P
	If both secure and bogus are false, security was not enabled for the
	domain of the query. Else, they are not both true, one of them is true.
	.SH "RETURN VALUES"
	Many routines return an error code. The value 0 (zero) denotes no error
	happened. Other values can be passed to
	.B ub_strerror
	to obtain a readable error string.
	.B ub_strerror
	returns a zero terminated string.
	.B ub_ctx_create
	returns NULL on an error (a malloc failure).
	.B ub_poll
	returns true if some information may be available, false otherwise.
	.B ub_fd
	returns a file descriptor or \-1 on error.
	.B ub_ctx_config
	and
	.B ub_ctx_resolvconf
	attempt to leave errno informative on a function return with file read failure.
	.SH "SEE ALSO"
	\fIunbound.conf\fR(5),
	\fIunbound\fR(8).
	.SH "AUTHORS"
	.B Unbound
	developers are mentioned in the CREDITS file in the distribution.
	Index: head/contrib/unbound/doc/unbound-anchor.8
	===================================================================
	--- head/contrib/unbound/doc/unbound-anchor.8 (revision 349719)
	+++ head/contrib/unbound/doc/unbound-anchor.8 (revision 349720)
	@@ -1,182 +1,182 @@
	-.TH "unbound-anchor" "8" "Oct 8, 2018" "NLnet Labs" "unbound 1.8.1"
	+.TH "unbound-anchor" "8" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
	.\"
	.\" unbound-anchor.8 -- unbound anchor maintenance utility manual
	.\"
	.\" Copyright (c) 2008, NLnet Labs. All rights reserved.
	.\"
	.\" See LICENSE for the license.
	.\"
	.\"
	.SH "NAME"
	.B unbound\-anchor
	\- Unbound anchor utility.
	.SH "SYNOPSIS"
	.B unbound\-anchor
	.RB [ opts ]
	.SH "DESCRIPTION"
	.B Unbound\-anchor
	performs setup or update of the root trust anchor for DNSSEC validation.
	The program fetches the trust anchor with the method from RFC7958 when
	regular RFC5011 update fails to bring it up to date.
	It can be run (as root) from the commandline, or run as part of startup
	scripts. Before you start the \fIunbound\fR(8) DNS server.
	.P
	Suggested usage:
	.P
	.nf
	# in the init scripts.
	# provide or update the root anchor (if necessary)
	unbound-anchor \-a "/var/unbound/root.key"
	# Please note usage of this root anchor is at your own risk
	# and under the terms of our LICENSE (see source).
	#
	# start validating resolver
	# the unbound.conf contains:
	# auto-trust-anchor-file: "/var/unbound/root.key"
	unbound \-c unbound.conf
	.fi
	.P
	This tool provides builtin default contents for the root anchor and root
	update certificate files.
	.P
	It tests if the root anchor file works, and if not, and an update is possible,
	attempts to update the root anchor using the root update certificate.
	It performs a https fetch of root-anchors.xml and checks the results (RFC7958),
	if all checks are successful, it updates the root anchor file. Otherwise
	the root anchor file is unchanged. It performs RFC5011 tracking if the
	DNSSEC information available via the DNS makes that possible.
	.P
	It does not perform an update if the certificate is expired, if the network
	is down or other errors occur.
	.P
	The available options are:
	.TP
	.B \-a \fIfile
	The root anchor key file, that is read in and written out.
	Default is /var/unbound/root.key.
	If the file does not exist, or is empty, a builtin root key is written to it.
	.TP
	.B \-c \fIfile
	The root update certificate file, that is read in.
	Default is /var/unbound/icannbundle.pem.
	If the file does not exist, or is empty, a builtin certificate is used.
	.TP
	.B \-l
	List the builtin root key and builtin root update certificate on stdout.
	.TP
	.B \-u \fIname
	The server name, it connects to https://name. Specify without https:// prefix.
	The default is "data.iana.org". It connects to the port specified with \-P.
	You can pass an IPv4 address or IPv6 address (no brackets) if you want.
	.TP
	.B \-x \fIpath
	The pathname to the root\-anchors.xml file on the server. (forms URL with \-u).
	The default is /root\-anchors/root\-anchors.xml.
	.TP
	.B \-s \fIpath
	The pathname to the root\-anchors.p7s file on the server. (forms URL with \-u).
	The default is /root\-anchors/root\-anchors.p7s. This file has to be a PKCS7
	signature over the xml file, using the pem file (\-c) as trust anchor.
	.TP
	.B \-n \fIname
	The emailAddress for the Subject of the signer's certificate from the p7s
	signature file. Only signatures from this name are allowed. default is
	dnssec@iana.org. If you pass "" then the emailAddress is not checked.
	.TP
	.B \-4
	Use IPv4 for domain resolution and contacting the server on https. Default is
	to use IPv4 and IPv6 where appropriate.
	.TP
	.B \-6
	Use IPv6 for domain resolution and contacting the server on https. Default is
	to use IPv4 and IPv6 where appropriate.
	.TP
	.B \-f \fIresolv.conf
	Use the given resolv.conf file. Not enabled by default, but you could try to
	pass /etc/resolv.conf on some systems. It contains the IP addresses of the
	recursive nameservers to use. However, since this tool could be used to
	bootstrap that very recursive nameserver, it would not be useful (since
	that server is not up yet, since we are bootstrapping it). It could be
	useful in a situation where you know an upstream cache is deployed (and
	running) and in captive portal situations.
	.TP
	.B \-r \fIroot.hints
	Use the given root.hints file (same syntax as the BIND and Unbound root hints
	file) to bootstrap domain resolution. By default a list of builtin root
	hints is used. Unbound\-anchor goes to the network itself for these roots,
	to resolve the server (\-u option) and to check the root DNSKEY records.
	It does so, because the tool when used for bootstrapping the recursive
	resolver, cannot use that recursive resolver itself because it is bootstrapping
	that server.
	.TP
	.B \-R
	Allow fallback from \-f resolv.conf file to direct root servers query.
	It allows you to prefer local resolvers, but fallback automatically
	to direct root query if they do not respond or do not support DNSSEC.
	.TP
	.B \-v
	More verbose. Once prints informational messages, multiple times may enable
	large debug amounts (such as full certificates or byte\-dumps of downloaded
	files). By default it prints almost nothing. It also prints nothing on
	errors by default; in that case the original root anchor file is simply
	left undisturbed, so that a recursive server can start right after it.
	.TP
	.B \-C \fIunbound.conf
	Debug option to read unbound.conf into the resolver process used.
	.TP
	.B \-P \fIport
	Set the port number to use for the https connection. The default is 443.
	.TP
	.B \-F
	Debug option to force update of the root anchor through downloading the xml
	file and verifying it with the certificate. By default it first tries to
	update by contacting the DNS, which uses much less bandwidth, is much
	faster (200 msec not 2 sec), and is nicer to the deployed infrastructure.
	With this option, it still attempts to do so (and may verbosely tell you),
	but then ignores the result and goes on to use the xml fallback method.
	.TP
	.B \-h
	Show the version and commandline option help.
	.SH "EXIT CODE"
	This tool exits with value 1 if the root anchor was updated using the
	certificate or if the builtin root-anchor was used. It exits with code
	0 if no update was necessary, if the update was possible with RFC5011
	tracking, or if an error occurred.
	.P
	You can check the exit value in this manner:
	.nf
	unbound-anchor \-a "root.key" \|\| logger "Please check root.key"
	.fi
	Or something more suitable for your operational environment.
	.SH "TRUST"
	The root keys and update certificate included in this tool
	are provided for convenience and under the terms of our
	license (see the LICENSE file in the source distribution or
	http://unbound.nlnetlabs.nl/svn/trunk/LICENSE) and might be stale or
	not suitable to your purpose.
	.P
	By running "unbound\-anchor \-l" the keys and certificate that are
	configured in the code are printed for your convenience.
	.P
	The build\-in configuration can be overridden by providing a root\-cert
	file and a rootkey file.
	.SH "FILES"
	.TP
	.I /var/unbound/root.key
	The root anchor file, updated with 5011 tracking, and read and written to.
	The file is created if it does not exist.
	.TP
	.I /var/unbound/icannbundle.pem
	The trusted self\-signed certificate that is used to verify the downloaded
	DNSSEC root trust anchor. You can update it by fetching it from
	https://data.iana.org/root\-anchors/icannbundle.pem (and validate it).
	If the file does not exist or is empty, a builtin version is used.
	.TP
	.I https://data.iana.org/root\-anchors/root\-anchors.xml
	Source for the root key information.
	.TP
	.I https://data.iana.org/root\-anchors/root\-anchors.p7s
	Signature on the root key information.
	.SH "SEE ALSO"
	\fIunbound.conf\fR(5),
	\fIunbound\fR(8).
	Index: head/contrib/unbound/doc/unbound-anchor.8.in
	===================================================================
	--- head/contrib/unbound/doc/unbound-anchor.8.in (revision 349719)
	+++ head/contrib/unbound/doc/unbound-anchor.8.in (revision 349720)
	@@ -1,182 +1,182 @@
	-.TH "unbound-anchor" "8" "Oct 8, 2018" "NLnet Labs" "unbound 1.8.1"
	+.TH "unbound-anchor" "8" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
	.\"
	.\" unbound-anchor.8 -- unbound anchor maintenance utility manual
	.\"
	.\" Copyright (c) 2008, NLnet Labs. All rights reserved.
	.\"
	.\" See LICENSE for the license.
	.\"
	.\"
	.SH "NAME"
	.B unbound\-anchor
	\- Unbound anchor utility.
	.SH "SYNOPSIS"
	.B unbound\-anchor
	.RB [ opts ]
	.SH "DESCRIPTION"
	.B Unbound\-anchor
	performs setup or update of the root trust anchor for DNSSEC validation.
	The program fetches the trust anchor with the method from RFC7958 when
	regular RFC5011 update fails to bring it up to date.
	It can be run (as root) from the commandline, or run as part of startup
	scripts. Before you start the \fIunbound\fR(8) DNS server.
	.P
	Suggested usage:
	.P
	.nf
	# in the init scripts.
	# provide or update the root anchor (if necessary)
	unbound-anchor \-a "@UNBOUND_ROOTKEY_FILE@"
	# Please note usage of this root anchor is at your own risk
	# and under the terms of our LICENSE (see source).
	#
	# start validating resolver
	# the unbound.conf contains:
	# auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
	unbound \-c unbound.conf
	.fi
	.P
	This tool provides builtin default contents for the root anchor and root
	update certificate files.
	.P
	It tests if the root anchor file works, and if not, and an update is possible,
	attempts to update the root anchor using the root update certificate.
	It performs a https fetch of root-anchors.xml and checks the results (RFC7958),
	if all checks are successful, it updates the root anchor file. Otherwise
	the root anchor file is unchanged. It performs RFC5011 tracking if the
	DNSSEC information available via the DNS makes that possible.
	.P
	It does not perform an update if the certificate is expired, if the network
	is down or other errors occur.
	.P
	The available options are:
	.TP
	.B \-a \fIfile
	The root anchor key file, that is read in and written out.
	Default is @UNBOUND_ROOTKEY_FILE@.
	If the file does not exist, or is empty, a builtin root key is written to it.
	.TP
	.B \-c \fIfile
	The root update certificate file, that is read in.
	Default is @UNBOUND_ROOTCERT_FILE@.
	If the file does not exist, or is empty, a builtin certificate is used.
	.TP
	.B \-l
	List the builtin root key and builtin root update certificate on stdout.
	.TP
	.B \-u \fIname
	The server name, it connects to https://name. Specify without https:// prefix.
	The default is "data.iana.org". It connects to the port specified with \-P.
	You can pass an IPv4 address or IPv6 address (no brackets) if you want.
	.TP
	.B \-x \fIpath
	The pathname to the root\-anchors.xml file on the server. (forms URL with \-u).
	The default is /root\-anchors/root\-anchors.xml.
	.TP
	.B \-s \fIpath
	The pathname to the root\-anchors.p7s file on the server. (forms URL with \-u).
	The default is /root\-anchors/root\-anchors.p7s. This file has to be a PKCS7
	signature over the xml file, using the pem file (\-c) as trust anchor.
	.TP
	.B \-n \fIname
	The emailAddress for the Subject of the signer's certificate from the p7s
	signature file. Only signatures from this name are allowed. default is
	dnssec@iana.org. If you pass "" then the emailAddress is not checked.
	.TP
	.B \-4
	Use IPv4 for domain resolution and contacting the server on https. Default is
	to use IPv4 and IPv6 where appropriate.
	.TP
	.B \-6
	Use IPv6 for domain resolution and contacting the server on https. Default is
	to use IPv4 and IPv6 where appropriate.
	.TP
	.B \-f \fIresolv.conf
	Use the given resolv.conf file. Not enabled by default, but you could try to
	pass /etc/resolv.conf on some systems. It contains the IP addresses of the
	recursive nameservers to use. However, since this tool could be used to
	bootstrap that very recursive nameserver, it would not be useful (since
	that server is not up yet, since we are bootstrapping it). It could be
	useful in a situation where you know an upstream cache is deployed (and
	running) and in captive portal situations.
	.TP
	.B \-r \fIroot.hints
	Use the given root.hints file (same syntax as the BIND and Unbound root hints
	file) to bootstrap domain resolution. By default a list of builtin root
	hints is used. Unbound\-anchor goes to the network itself for these roots,
	to resolve the server (\-u option) and to check the root DNSKEY records.
	It does so, because the tool when used for bootstrapping the recursive
	resolver, cannot use that recursive resolver itself because it is bootstrapping
	that server.
	.TP
	.B \-R
	Allow fallback from \-f resolv.conf file to direct root servers query.
	It allows you to prefer local resolvers, but fallback automatically
	to direct root query if they do not respond or do not support DNSSEC.
	.TP
	.B \-v
	More verbose. Once prints informational messages, multiple times may enable
	large debug amounts (such as full certificates or byte\-dumps of downloaded
	files). By default it prints almost nothing. It also prints nothing on
	errors by default; in that case the original root anchor file is simply
	left undisturbed, so that a recursive server can start right after it.
	.TP
	.B \-C \fIunbound.conf
	Debug option to read unbound.conf into the resolver process used.
	.TP
	.B \-P \fIport
	Set the port number to use for the https connection. The default is 443.
	.TP
	.B \-F
	Debug option to force update of the root anchor through downloading the xml
	file and verifying it with the certificate. By default it first tries to
	update by contacting the DNS, which uses much less bandwidth, is much
	faster (200 msec not 2 sec), and is nicer to the deployed infrastructure.
	With this option, it still attempts to do so (and may verbosely tell you),
	but then ignores the result and goes on to use the xml fallback method.
	.TP
	.B \-h
	Show the version and commandline option help.
	.SH "EXIT CODE"
	This tool exits with value 1 if the root anchor was updated using the
	certificate or if the builtin root-anchor was used. It exits with code
	0 if no update was necessary, if the update was possible with RFC5011
	tracking, or if an error occurred.
	.P
	You can check the exit value in this manner:
	.nf
	unbound-anchor \-a "root.key" \|\| logger "Please check root.key"
	.fi
	Or something more suitable for your operational environment.
	.SH "TRUST"
	The root keys and update certificate included in this tool
	are provided for convenience and under the terms of our
	license (see the LICENSE file in the source distribution or
	http://unbound.nlnetlabs.nl/svn/trunk/LICENSE) and might be stale or
	not suitable to your purpose.
	.P
	By running "unbound\-anchor \-l" the keys and certificate that are
	configured in the code are printed for your convenience.
	.P
	The build\-in configuration can be overridden by providing a root\-cert
	file and a rootkey file.
	.SH "FILES"
	.TP
	.I @UNBOUND_ROOTKEY_FILE@
	The root anchor file, updated with 5011 tracking, and read and written to.
	The file is created if it does not exist.
	.TP
	.I @UNBOUND_ROOTCERT_FILE@
	The trusted self\-signed certificate that is used to verify the downloaded
	DNSSEC root trust anchor. You can update it by fetching it from
	https://data.iana.org/root\-anchors/icannbundle.pem (and validate it).
	If the file does not exist or is empty, a builtin version is used.
	.TP
	.I https://data.iana.org/root\-anchors/root\-anchors.xml
	Source for the root key information.
	.TP
	.I https://data.iana.org/root\-anchors/root\-anchors.p7s
	Signature on the root key information.
	.SH "SEE ALSO"
	\fIunbound.conf\fR(5),
	\fIunbound\fR(8).
	Index: head/contrib/unbound/doc/unbound-checkconf.8
	===================================================================
	--- head/contrib/unbound/doc/unbound-checkconf.8 (revision 349719)
	+++ head/contrib/unbound/doc/unbound-checkconf.8 (revision 349720)
	@@ -1,52 +1,52 @@
	-.TH "unbound-checkconf" "8" "Oct 8, 2018" "NLnet Labs" "unbound 1.8.1"
	+.TH "unbound-checkconf" "8" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
	.\"
	.\" unbound-checkconf.8 -- unbound configuration checker manual
	.\"
	.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
	.\"
	.\" See LICENSE for the license.
	.\"
	.\"
	.SH "NAME"
	.B unbound\-checkconf
	\- Check unbound configuration file for errors.
	.SH "SYNOPSIS"
	.B unbound\-checkconf
	.RB [ \-h ]
	.RB [ \-f ]
	.RB [ \-o
	.IR option ]
	.RI [ cfgfile ]
	.SH "DESCRIPTION"
	.B Unbound\-checkconf
	checks the configuration file for the
	\fIunbound\fR(8)
	DNS resolver for syntax and other errors.
	The config file syntax is described in
	\fIunbound.conf\fR(5).
	.P
	The available options are:
	.TP
	.B \-h
	Show the version and commandline option help.
	.TP
	.B \-f
	Print full pathname, with chroot applied to it. Use with the \-o option.
	.TP
	.B \-o\fI option
	If given, after checking the config file the value of this option is
	printed to stdout. For "" (disabled) options an empty line is printed.
	.TP
	.I cfgfile
	The config file to read with settings for unbound. It is checked.
	If omitted, the config file at the default location is checked.
	.SH "EXIT CODE"
	The unbound\-checkconf program exits with status code 1 on error,
	0 for a correct config file.
	.SH "FILES"
	.TP
	.I /var/unbound/unbound.conf
	unbound configuration file.
	.SH "SEE ALSO"
	\fIunbound.conf\fR(5),
	\fIunbound\fR(8).
	Index: head/contrib/unbound/doc/unbound-checkconf.8.in
	===================================================================
	--- head/contrib/unbound/doc/unbound-checkconf.8.in (revision 349719)
	+++ head/contrib/unbound/doc/unbound-checkconf.8.in (revision 349720)
	@@ -1,52 +1,52 @@
	-.TH "unbound-checkconf" "8" "Oct 8, 2018" "NLnet Labs" "unbound 1.8.1"
	+.TH "unbound-checkconf" "8" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
	.\"
	.\" unbound-checkconf.8 -- unbound configuration checker manual
	.\"
	.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
	.\"
	.\" See LICENSE for the license.
	.\"
	.\"
	.SH "NAME"
	.B unbound\-checkconf
	\- Check unbound configuration file for errors.
	.SH "SYNOPSIS"
	.B unbound\-checkconf
	.RB [ \-h ]
	.RB [ \-f ]
	.RB [ \-o
	.IR option ]
	.RI [ cfgfile ]
	.SH "DESCRIPTION"
	.B Unbound\-checkconf
	checks the configuration file for the
	\fIunbound\fR(8)
	DNS resolver for syntax and other errors.
	The config file syntax is described in
	\fIunbound.conf\fR(5).
	.P
	The available options are:
	.TP
	.B \-h
	Show the version and commandline option help.
	.TP
	.B \-f
	Print full pathname, with chroot applied to it. Use with the \-o option.
	.TP
	.B \-o\fI option
	If given, after checking the config file the value of this option is
	printed to stdout. For "" (disabled) options an empty line is printed.
	.TP
	.I cfgfile
	The config file to read with settings for unbound. It is checked.
	If omitted, the config file at the default location is checked.
	.SH "EXIT CODE"
	The unbound\-checkconf program exits with status code 1 on error,
	0 for a correct config file.
	.SH "FILES"
	.TP
	.I @ub_conf_file@
	unbound configuration file.
	.SH "SEE ALSO"
	\fIunbound.conf\fR(5),
	\fIunbound\fR(8).
	Index: head/contrib/unbound/doc/unbound-control.8
	===================================================================
	--- head/contrib/unbound/doc/unbound-control.8 (revision 349719)
	+++ head/contrib/unbound/doc/unbound-control.8 (revision 349720)
	@@ -1,662 +1,673 @@
	-.TH "unbound-control" "8" "Oct 8, 2018" "NLnet Labs" "unbound 1.8.1"
	+.TH "unbound-control" "8" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
	.\"
	.\" unbound-control.8 -- unbound remote control manual
	.\"
	.\" Copyright (c) 2008, NLnet Labs. All rights reserved.
	.\"
	.\" See LICENSE for the license.
	.\"
	.\"
	.SH "NAME"
	.B unbound\-control,
	.B unbound\-control\-setup
	\- Unbound remote server control utility.
	.SH "SYNOPSIS"
	.B unbound\-control
	.RB [ \-hq ]
	.RB [ \-c
	.IR cfgfile ]
	.RB [ \-s
	.IR server ]
	.IR command
	.SH "DESCRIPTION"
	.B Unbound\-control
	performs remote administration on the \fIunbound\fR(8) DNS server.
	It reads the configuration file, contacts the unbound server over SSL
	sends the command and displays the result.
	.P
	The available options are:
	.TP
	.B \-h
	Show the version and commandline option help.
	.TP
	.B \-c \fIcfgfile
	The config file to read with settings. If not given the default
	config file /var/unbound/unbound.conf is used.
	.TP
	.B \-s \fIserver[@port]
	IPv4 or IPv6 address of the server to contact. If not given, the
	address is read from the config file.
	.TP
	.B \-q
	quiet, if the option is given it does not print anything if it works ok.
	.SH "COMMANDS"
	There are several commands that the server understands.
	.TP
	.B start
	Start the server. Simply execs \fIunbound\fR(8). The unbound executable
	is searched for in the \fBPATH\fR set in the environment. It is started
	with the config file specified using \fI\-c\fR or the default config file.
	.TP
	.B stop
	Stop the server. The server daemon exits.
	.TP
	.B reload
	Reload the server. This flushes the cache and reads the config file fresh.
	.TP
	.B verbosity \fInumber
	Change verbosity value for logging. Same values as \fBverbosity\fR keyword in
	\fIunbound.conf\fR(5). This new setting lasts until the server is issued
	a reload (taken from config file again), or the next verbosity control command.
	.TP
	.B log_reopen
	Reopen the logfile, close and open it. Useful for logrotation to make the
	daemon release the file it is logging to. If you are using syslog it will
	attempt to close and open the syslog (which may not work if chrooted).
	.TP
	.B stats
	Print statistics. Resets the internal counters to zero, this can be
	controlled using the \fBstatistics\-cumulative\fR config statement.
	Statistics are printed with one [name]: [value] per line.
	.TP
	.B stats_noreset
	Peek at statistics. Prints them like the \fBstats\fR command does, but does not
	reset the internal counters to zero.
	.TP
	.B status
	Display server status. Exit code 3 if not running (the connection to the
	port is refused), 1 on error, 0 if running.
	.TP
	.B local_zone \fIname\fR \fItype
	Add new local zone with name and type. Like \fBlocal\-zone\fR config statement.
	If the zone already exists, the type is changed to the given argument.
	.TP
	.B local_zone_remove \fIname
	Remove the local zone with the given name. Removes all local data inside
	it. If the zone does not exist, the command succeeds.
	.TP
	.B local_data \fIRR data...
	Add new local data, the given resource record. Like \fBlocal\-data\fR
	config statement, except for when no covering zone exists. In that case
	this remote control command creates a transparent zone with the same
	name as this record. This command is not good at returning detailed syntax
	errors.
	.TP
	.B local_data_remove \fIname
	Remove all RR data from local name. If the name already has no items,
	nothing happens. Often results in NXDOMAIN for the name (in a static zone),
	but if the name has become an empty nonterminal (there is still data in
	domain names below the removed name), NOERROR nodata answers are the
	result for that name.
	.TP
	.B local_zones
	Add local zones read from stdin of unbound\-control. Input is read per line,
	with name space type on a line. For bulk additions.
	.TP
	.B local_zones_remove
	Remove local zones read from stdin of unbound\-control. Input is one name per
	line. For bulk removals.
	.TP
	.B local_datas
	Add local data RRs read from stdin of unbound\-control. Input is one RR per
	line. For bulk additions.
	.TP
	.B local_datas_remove
	Remove local data RRs read from stdin of unbound\-control. Input is one name per
	line. For bulk removals.
	.TP
	.B dump_cache
	The contents of the cache is printed in a text format to stdout. You can
	redirect it to a file to store the cache in a file.
	.TP
	.B load_cache
	The contents of the cache is loaded from stdin. Uses the same format as
	dump_cache uses. Loading the cache with old, or wrong data can result
	in old or wrong data returned to clients. Loading data into the cache
	in this way is supported in order to aid with debugging.
	.TP
	.B lookup \fIname
	Print to stdout the name servers that would be used to look up the
	name specified.
	.TP
	.B flush \fIname
	Remove the name from the cache. Removes the types
	A, AAAA, NS, SOA, CNAME, DNAME, MX, PTR, SRV and NAPTR.
	Because that is fast to do. Other record types can be removed using
	.B flush_type
	or
	.B flush_zone\fR.
	.TP
	.B flush_type \fIname\fR \fItype
	Remove the name, type information from the cache.
	.TP
	.B flush_zone \fIname
	Remove all information at or below the name from the cache.
	The rrsets and key entries are removed so that new lookups will be performed.
	This needs to walk and inspect the entire cache, and is a slow operation.
	The entries are set to expired in the implementation of this command (so,
	with serve\-expired enabled, it'll serve that information but schedule a
	prefetch for new information).
	.TP
	.B flush_bogus
	Remove all bogus data from the cache.
	.TP
	.B flush_negative
	Remove all negative data from the cache. This is nxdomain answers,
	nodata answers and servfail answers. Also removes bad key entries
	(which could be due to failed lookups) from the dnssec key cache, and
	iterator last-resort lookup failures from the rrset cache.
	.TP
	.B flush_stats
	Reset statistics to zero.
	.TP
	.B flush_requestlist
	Drop the queries that are worked on. Stops working on the queries that the
	server is working on now. The cache is unaffected. No reply is sent for
	those queries, probably making those users request again later.
	Useful to make the server restart working on queries with new settings,
	such as a higher verbosity level.
	.TP
	.B dump_requestlist
	Show what is worked on. Prints all queries that the server is currently
	working on. Prints the time that users have been waiting. For internal
	requests, no time is printed. And then prints out the module status.
	This prints the queries from the first thread, and not queries that are
	being serviced from other threads.
	.TP
	.B flush_infra \fIall\|IP
	If all then entire infra cache is emptied. If a specific IP address, the
	entry for that address is removed from the cache. It contains EDNS, ping
	and lameness data.
	.TP
	.B dump_infra
	Show the contents of the infra cache.
	.TP
	.B set_option \fIopt: val
	Set the option to the given value without a reload. The cache is
	therefore not flushed. The option must end with a ':' and whitespace
	must be between the option and the value. Some values may not have an
	effect if set this way, the new values are not written to the config file,
	not all options are supported. This is different from the set_option call
	in libunbound, where all values work because unbound has not been initialized.
	.IP
	The values that work are: statistics\-interval, statistics\-cumulative,
	do\-not\-query\-localhost, harden\-short\-bufsize, harden\-large\-queries,
	harden\-glue, harden\-dnssec\-stripped, harden\-below\-nxdomain,
	harden\-referral\-path, prefetch, prefetch\-key, log\-queries,
	hide\-identity, hide\-version, identity, version, val\-log\-level,
	val\-log\-squelch, ignore\-cd\-flag, add\-holddown, del\-holddown,
	keep\-missing, tcp\-upstream, ssl\-upstream, max\-udp\-size, ratelimit,
	ip\-ratelimit, cache\-max\-ttl, cache\-min\-ttl, cache\-max\-negative\-ttl.
	.TP
	.B get_option \fIopt
	Get the value of the option. Give the option name without a trailing ':'.
	The value is printed. If the value is "", nothing is printed
	and the connection closes. On error 'error ...' is printed (it gives
	a syntax error on unknown option). For some options a list of values,
	one on each line, is printed. The options are shown from the config file
	as modified with set_option. For some options an override may have been
	taken that does not show up with this command, not results from e.g. the
	verbosity and forward control commands. Not all options work, see list_stubs,
	list_forwards, list_local_zones and list_local_data for those.
	.TP
	.B list_stubs
	List the stub zones in use. These are printed one by one to the output.
	This includes the root hints in use.
	.TP
	.B list_forwards
	List the forward zones in use. These are printed zone by zone to the output.
	.TP
	.B list_insecure
	List the zones with domain\-insecure.
	.TP
	.B list_local_zones
	List the local zones in use. These are printed one per line with zone type.
	.TP
	.B list_local_data
	List the local data RRs in use. The resource records are printed.
	.TP
	.B insecure_add \fIzone
	Add a \fBdomain\-insecure\fR for the given zone, like the statement in unbound.conf.
	Adds to the running unbound without affecting the cache contents (which may
	still be bogus, use \fBflush_zone\fR to remove it), does not affect the config file.
	.TP
	.B insecure_remove \fIzone
	Removes domain\-insecure for the given zone.
	.TP
	.B forward_add \fR[\fI+i\fR] \fIzone addr ...
	Add a new forward zone to running unbound. With +i option also adds a
	\fIdomain\-insecure\fR for the zone (so it can resolve insecurely if you have
	a DNSSEC root trust anchor configured for other names).
	The addr can be IP4, IP6 or nameserver names, like \fIforward-zone\fR config
	in unbound.conf.
	.TP
	.B forward_remove \fR[\fI+i\fR] \fIzone
	Remove a forward zone from running unbound. The +i also removes a
	\fIdomain\-insecure\fR for the zone.
	.TP
	.B stub_add \fR[\fI+ip\fR] \fIzone addr ...
	Add a new stub zone to running unbound. With +i option also adds a
	\fIdomain\-insecure\fR for the zone. With +p the stub zone is set to prime,
	without it it is set to notprime. The addr can be IP4, IP6 or nameserver
	names, like the \fIstub-zone\fR config in unbound.conf.
	.TP
	.B stub_remove \fR[\fI+i\fR] \fIzone
	Remove a stub zone from running unbound. The +i also removes a
	\fIdomain\-insecure\fR for the zone.
	.TP
	.B forward \fR[\fIoff\fR \| \fIaddr ...\fR ]
	Setup forwarding mode. Configures if the server should ask other upstream
	nameservers, should go to the internet root nameservers itself, or show
	the current config. You could pass the nameservers after a DHCP update.
	.IP
	Without arguments the current list of addresses used to forward all queries
	to is printed. On startup this is from the forward\-zone "." configuration.
	Afterwards it shows the status. It prints off when no forwarding is used.
	.IP
	If \fIoff\fR is passed, forwarding is disabled and the root nameservers
	are used. This can be used to avoid to avoid buggy or non\-DNSSEC supporting
	nameservers returned from DHCP. But may not work in hotels or hotspots.
	.IP
	If one or more IPv4 or IPv6 addresses are given, those are then used to forward
	queries to. The addresses must be separated with spaces. With '@port' the
	port number can be set explicitly (default port is 53 (DNS)).
	.IP
	By default the forwarder information from the config file for the root "." is
	used. The config file is not changed, so after a reload these changes are
	gone. Other forward zones from the config file are not affected by this command.
	.TP
	.B ratelimit_list \fR[\fI+a\fR]
	List the domains that are ratelimited. Printed one per line with current
	estimated qps and qps limit from config. With +a it prints all domains, not
	just the ratelimited domains, with their estimated qps. The ratelimited
	domains return an error for uncached (new) queries, but cached queries work
	as normal.
	.TP
	.B ip_ratelimit_list \fR[\fI+a\fR]
	List the ip addresses that are ratelimited. Printed one per line with current
	estimated qps and qps limit from config. With +a it prints all ips, not
	just the ratelimited ips, with their estimated qps. The ratelimited
	ips are dropped before checking the cache.
	.TP
	.B list_auth_zones
	List the auth zones that are configured. Printed one per line with a
	status, indicating if the zone is expired and current serial number.
	.TP
	.B auth_zone_reload \fIzone\fR
	Reload the auth zone from zonefile. The zonefile is read in overwriting
	the current contents of the zone in memory. This changes the auth zone
	contents itself, not the cache contents. Such cache contents exists if
	you set unbound to validate with for-upstream yes and that can be cleared
	with \fBflush_zone\fR \fIzone\fR.
	.TP
	.B auth_zone_transfer \fIzone\fR
	Transfer the auth zone from master. The auth zone probe sequence is started,
	where the masters are probed to see if they have an updated zone (with the SOA
	serial check). And then the zone is transferred for a newer zone version.
	.TP
	.B view_list_local_zones \fIview\fR
	\fIlist_local_zones\fR for given view.
	.TP
	.B view_local_zone \fIview\fR \fIname\fR \fItype
	\fIlocal_zone\fR for given view.
	.TP
	.B view_local_zone_remove \fIview\fR \fIname
	\fIlocal_zone_remove\fR for given view.
	.TP
	.B view_list_local_data \fIview\fR
	\fIlist_local_data\fR for given view.
	.TP
	.B view_local_data \fIview\fR \fIRR data...
	\fIlocal_data\fR for given view.
	.TP
	.B view_local_data_remove \fIview\fR \fIname
	\fIlocal_data_remove\fR for given view.
	+.TP
	+.B view_local_datas \fIview\fR
	+Add a list of \fIlocal_data\fR for given view from stdin. Like local_datas.
	.SH "EXIT CODE"
	The unbound\-control program exits with status code 1 on error, 0 on success.
	.SH "SET UP"
	The setup requires a self\-signed certificate and private keys for both
	the server and client. The script \fIunbound\-control\-setup\fR generates
	these in the default run directory, or with \-d in another directory.
	If you change the access control permissions on the key files you can decide
	who can use unbound\-control, by default owner and group but not all users.
	Run the script under the same username as you have configured in unbound.conf
	or as root, so that the daemon is permitted to read the files, for example with:
	.nf
	sudo \-u unbound unbound\-control\-setup
	.fi
	If you have not configured
	a username in unbound.conf, the keys need read permission for the user
	credentials under which the daemon is started.
	The script preserves private keys present in the directory.
	After running the script as root, turn on \fBcontrol\-enable\fR in
	\fIunbound.conf\fR.
	.SH "STATISTIC COUNTERS"
	The \fIstats\fR command shows a number of statistic counters.
	.TP
	.I threadX.num.queries
	number of queries received by thread
	.TP
	.I threadX.num.queries_ip_ratelimited
	number of queries rate limited by thread
	.TP
	.I threadX.num.cachehits
	number of queries that were successfully answered using a cache lookup
	.TP
	.I threadX.num.cachemiss
	number of queries that needed recursive processing
	.TP
	.I threadX.num.dnscrypt.crypted
	number of queries that were encrypted and successfully decapsulated by dnscrypt.
	.TP
	.I threadX.num.dnscrypt.cert
	number of queries that were requesting dnscrypt certificates.
	.TP
	.I threadX.num.dnscrypt.cleartext
	number of queries received on dnscrypt port that were cleartext and not a
	request for certificates.
	.TP
	.I threadX.num.dnscrypt.malformed
	number of request that were neither cleartext, not valid dnscrypt messages.
	.TP
	.I threadX.num.prefetch
	number of cache prefetches performed. This number is included in
	cachehits, as the original query had the unprefetched answer from cache,
	and resulted in recursive processing, taking a slot in the requestlist.
	Not part of the recursivereplies (or the histogram thereof) or cachemiss,
	as a cache response was sent.
	.TP
	.I threadX.num.zero_ttl
	number of replies with ttl zero, because they served an expired cache entry.
	.TP
	.I threadX.num.recursivereplies
	The number of replies sent to queries that needed recursive processing. Could be smaller than threadX.num.cachemiss if due to timeouts no replies were sent for some queries.
	.TP
	.I threadX.requestlist.avg
	The average number of requests in the internal recursive processing request list on insert of a new incoming recursive processing query.
	.TP
	.I threadX.requestlist.max
	Maximum size attained by the internal recursive processing request list.
	.TP
	.I threadX.requestlist.overwritten
	Number of requests in the request list that were overwritten by newer entries. This happens if there is a flood of queries that recursive processing and the server has a hard time.
	.TP
	.I threadX.requestlist.exceeded
	Queries that were dropped because the request list was full. This happens if a flood of queries need recursive processing, and the server can not keep up.
	.TP
	.I threadX.requestlist.current.all
	Current size of the request list, includes internally generated queries (such
	as priming queries and glue lookups).
	.TP
	.I threadX.requestlist.current.user
	Current size of the request list, only the requests from client queries.
	.TP
	.I threadX.recursion.time.avg
	Average time it took to answer queries that needed recursive processing. Note that queries that were answered from the cache are not in this average.
	.TP
	.I threadX.recursion.time.median
	The median of the time it took to answer queries that needed recursive
	processing. The median means that 50% of the user queries were answered in
	less than this time. Because of big outliers (usually queries to non
	responsive servers), the average can be bigger than the median. This median
	has been calculated by interpolation from a histogram.
	.TP
	.I threadX.tcpusage
	The currently held tcp buffers for incoming connections. A spot value on
	the time of the request. This helps you spot if the incoming\-num\-tcp
	buffers are full.
	.TP
	.I total.num.queries
	summed over threads.
	.TP
	.I total.num.cachehits
	summed over threads.
	.TP
	.I total.num.cachemiss
	summed over threads.
	.TP
	.I total.num.dnscrypt.crypted
	summed over threads.
	.TP
	.I total.num.dnscrypt.cert
	summed over threads.
	.TP
	.I total.num.dnscrypt.cleartext
	summed over threads.
	.TP
	.I total.num.dnscrypt.malformed
	summed over threads.
	.TP
	.I total.num.prefetch
	summed over threads.
	.TP
	.I total.num.zero_ttl
	summed over threads.
	.TP
	.I total.num.recursivereplies
	summed over threads.
	.TP
	.I total.requestlist.avg
	averaged over threads.
	.TP
	.I total.requestlist.max
	the maximum of the thread requestlist.max values.
	.TP
	.I total.requestlist.overwritten
	summed over threads.
	.TP
	.I total.requestlist.exceeded
	summed over threads.
	.TP
	.I total.requestlist.current.all
	summed over threads.
	.TP
	.I total.recursion.time.median
	averaged over threads.
	.TP
	.I total.tcpusage
	summed over threads.
	.TP
	.I time.now
	current time in seconds since 1970.
	.TP
	.I time.up
	uptime since server boot in seconds.
	.TP
	.I time.elapsed
	time since last statistics printout, in seconds.
	.SH EXTENDED STATISTICS
	.TP
	.I mem.cache.rrset
	Memory in bytes in use by the RRset cache.
	.TP
	.I mem.cache.message
	Memory in bytes in use by the message cache.
	.TP
	.I mem.cache.dnscrypt_shared_secret
	Memory in bytes in use by the dnscrypt shared secrets cache.
	.TP
	.I mem.cache.dnscrypt_nonce
	Memory in bytes in use by the dnscrypt nonce cache.
	.TP
	.I mem.mod.iterator
	Memory in bytes in use by the iterator module.
	.TP
	.I mem.mod.validator
	Memory in bytes in use by the validator module. Includes the key cache and
	negative cache.
	.TP
	+.I mem.streamwait
	+Memory in bytes in used by the TCP and TLS stream wait buffers. These are
	+answers waiting to be written back to the clients.
	+.TP
	.I histogram.<sec>.<usec>.to.<sec>.<usec>
	Shows a histogram, summed over all threads. Every element counts the
	recursive queries whose reply time fit between the lower and upper bound.
	Times larger or equal to the lowerbound, and smaller than the upper bound.
	There are 40 buckets, with bucket sizes doubling.
	.TP
	.I num.query.type.A
	The total number of queries over all threads with query type A.
	Printed for the other query types as well, but only for the types for which
	queries were received, thus =0 entries are omitted for brevity.
	.TP
	.I num.query.type.other
	Number of queries with query types 256\-65535.
	.TP
	.I num.query.class.IN
	The total number of queries over all threads with query class IN (internet).
	Also printed for other classes (such as CH (CHAOS) sometimes used for
	debugging), or NONE, ANY, used by dynamic update.
	num.query.class.other is printed for classes 256\-65535.
	.TP
	.I num.query.opcode.QUERY
	The total number of queries over all threads with query opcode QUERY.
	Also printed for other opcodes, UPDATE, ...
	.TP
	.I num.query.tcp
	Number of queries that were made using TCP towards the unbound server.
	.TP
	.I num.query.tcpout
	Number of queries that the unbound server made using TCP outgoing towards
	other servers.
	.TP
	.I num.query.tls
	Number of queries that were made using TLS towards the unbound server.
	These are also counted in num.query.tcp, because TLS uses TCP.
	+.TP
	+.I num.query.tls.resume
	+Number of TLS session resumptions, these are queries over TLS towards
	+the unbound server where the client negotiated a TLS session resumption key.
	.TP
	.I num.query.ipv6
	Number of queries that were made using IPv6 towards the unbound server.
	.TP
	.I num.query.flags.RD
	The number of queries that had the RD flag set in the header.
	Also printed for flags QR, AA, TC, RA, Z, AD, CD.
	Note that queries with flags QR, AA or TC may have been rejected
	because of that.
	.TP
	.I num.query.edns.present
	number of queries that had an EDNS OPT record present.
	.TP
	.I num.query.edns.DO
	number of queries that had an EDNS OPT record with the DO (DNSSEC OK) bit set.
	These queries are also included in the num.query.edns.present number.
	.TP
	.I num.query.ratelimited
	The number of queries that are turned away from being send to nameserver due to
	ratelimiting.
	.TP
	.I num.query.dnscrypt.shared_secret.cachemiss
	The number of dnscrypt queries that did not find a shared secret in the cache.
	The can be use to compute the shared secret hitrate.
	.TP
	.I num.query.dnscrypt.replay
	The number of dnscrypt queries that found a nonce hit in the nonce cache and
	hence are considered a query replay.
	.TP
	.I num.answer.rcode.NXDOMAIN
	The number of answers to queries, from cache or from recursion, that had the
	return code NXDOMAIN. Also printed for the other return codes.
	.TP
	.I num.answer.rcode.nodata
	The number of answers to queries that had the pseudo return code nodata.
	This means the actual return code was NOERROR, but additionally, no data was
	carried in the answer (making what is called a NOERROR/NODATA answer).
	These queries are also included in the num.answer.rcode.NOERROR number.
	Common for AAAA lookups when an A record exists, and no AAAA.
	.TP
	.I num.answer.secure
	Number of answers that were secure. The answer validated correctly.
	The AD bit might have been set in some of these answers, where the client
	signalled (with DO or AD bit in the query) that they were ready to accept
	the AD bit in the answer.
	.TP
	.I num.answer.bogus
	Number of answers that were bogus. These answers resulted in SERVFAIL
	to the client because the answer failed validation.
	.TP
	.I num.rrset.bogus
	The number of rrsets marked bogus by the validator. Increased for every
	RRset inspection that fails.
	.TP
	.I unwanted.queries
	Number of queries that were refused or dropped because they failed the
	access control settings.
	.TP
	.I unwanted.replies
	Replies that were unwanted or unsolicited. Could have been random traffic,
	delayed duplicates, very late answers, or could be spoofing attempts.
	Some low level of late answers and delayed duplicates are to be expected
	with the UDP protocol. Very high values could indicate a threat (spoofing).
	.TP
	.I msg.cache.count
	The number of items (DNS replies) in the message cache.
	.TP
	.I rrset.cache.count
	The number of RRsets in the rrset cache. This includes rrsets used by
	the messages in the message cache, but also delegation information.
	.TP
	.I infra.cache.count
	The number of items in the infra cache. These are IP addresses with their
	timing and protocol support information.
	.TP
	.I key.cache.count
	The number of items in the key cache. These are DNSSEC keys, one item
	per delegation point, and their validation status.
	.TP
	.I dnscrypt_shared_secret.cache.count
	The number of items in the shared secret cache. These are precomputed shared
	secrets for a given client public key/server secret key pair. Shared secrets
	are CPU intensive and this cache allows unbound to avoid recomputing the
	shared secret when multiple dnscrypt queries are sent from the same client.
	.TP
	.I dnscrypt_nonce.cache.count
	The number of items in the client nonce cache. This cache is used to prevent
	dnscrypt queries replay. The client nonce must be unique for each client public
	key/server secret key pair. This cache should be able to host QPS * `replay
	window` interval keys to prevent replay of a query during `replay window`
	seconds.
	.TP
	.I num.query.authzone.up
	The number of queries answered from auth\-zone data, upstream queries.
	These queries would otherwise have been sent (with fallback enabled) to
	the internet, but are now answered from the auth zone.
	.TP
	.I num.query.authzone.down
	The number of queries for downstream answered from auth\-zone data.
	These queries are from downstream clients, and have had an answer from
	the data in the auth zone.
	.TP
	.I num.query.aggressive.NOERROR
	The number of queries answered using cached NSEC records with NODATA RCODE.
	These queries would otherwise have been sent to the internet, but are now
	answered using cached data.
	.TP
	.I num.query.aggressive.NXDOMAIN
	The number of queries answered using cached NSEC records with NXDOMAIN RCODE.
	These queries would otherwise have been sent to the internet, but are now
	answered using cached data.
	.TP
	.I num.query.subnet
	Number of queries that got an answer that contained EDNS client subnet data.
	.TP
	.I num.query.subnet_cache
	Number of queries answered from the edns client subnet cache. These are
	counted as cachemiss by the main counters, but hit the client subnet
	specific cache, after getting processed by the edns client subnet module.
	.SH "FILES"
	.TP
	.I /var/unbound/unbound.conf
	unbound configuration file.
	.TP
	.I /var/unbound
	directory with private keys (unbound_server.key and unbound_control.key) and
	self\-signed certificates (unbound_server.pem and unbound_control.pem).
	.SH "SEE ALSO"
	\fIunbound.conf\fR(5),
	\fIunbound\fR(8).
	Index: head/contrib/unbound/doc/unbound-control.8.in
	===================================================================
	--- head/contrib/unbound/doc/unbound-control.8.in (revision 349719)
	+++ head/contrib/unbound/doc/unbound-control.8.in (revision 349720)
	@@ -1,662 +1,673 @@
	-.TH "unbound-control" "8" "Oct 8, 2018" "NLnet Labs" "unbound 1.8.1"
	+.TH "unbound-control" "8" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
	.\"
	.\" unbound-control.8 -- unbound remote control manual
	.\"
	.\" Copyright (c) 2008, NLnet Labs. All rights reserved.
	.\"
	.\" See LICENSE for the license.
	.\"
	.\"
	.SH "NAME"
	.B unbound\-control,
	.B unbound\-control\-setup
	\- Unbound remote server control utility.
	.SH "SYNOPSIS"
	.B unbound\-control
	.RB [ \-hq ]
	.RB [ \-c
	.IR cfgfile ]
	.RB [ \-s
	.IR server ]
	.IR command
	.SH "DESCRIPTION"
	.B Unbound\-control
	performs remote administration on the \fIunbound\fR(8) DNS server.
	It reads the configuration file, contacts the unbound server over SSL
	sends the command and displays the result.
	.P
	The available options are:
	.TP
	.B \-h
	Show the version and commandline option help.
	.TP
	.B \-c \fIcfgfile
	The config file to read with settings. If not given the default
	config file @ub_conf_file@ is used.
	.TP
	.B \-s \fIserver[@port]
	IPv4 or IPv6 address of the server to contact. If not given, the
	address is read from the config file.
	.TP
	.B \-q
	quiet, if the option is given it does not print anything if it works ok.
	.SH "COMMANDS"
	There are several commands that the server understands.
	.TP
	.B start
	Start the server. Simply execs \fIunbound\fR(8). The unbound executable
	is searched for in the \fBPATH\fR set in the environment. It is started
	with the config file specified using \fI\-c\fR or the default config file.
	.TP
	.B stop
	Stop the server. The server daemon exits.
	.TP
	.B reload
	Reload the server. This flushes the cache and reads the config file fresh.
	.TP
	.B verbosity \fInumber
	Change verbosity value for logging. Same values as \fBverbosity\fR keyword in
	\fIunbound.conf\fR(5). This new setting lasts until the server is issued
	a reload (taken from config file again), or the next verbosity control command.
	.TP
	.B log_reopen
	Reopen the logfile, close and open it. Useful for logrotation to make the
	daemon release the file it is logging to. If you are using syslog it will
	attempt to close and open the syslog (which may not work if chrooted).
	.TP
	.B stats
	Print statistics. Resets the internal counters to zero, this can be
	controlled using the \fBstatistics\-cumulative\fR config statement.
	Statistics are printed with one [name]: [value] per line.
	.TP
	.B stats_noreset
	Peek at statistics. Prints them like the \fBstats\fR command does, but does not
	reset the internal counters to zero.
	.TP
	.B status
	Display server status. Exit code 3 if not running (the connection to the
	port is refused), 1 on error, 0 if running.
	.TP
	.B local_zone \fIname\fR \fItype
	Add new local zone with name and type. Like \fBlocal\-zone\fR config statement.
	If the zone already exists, the type is changed to the given argument.
	.TP
	.B local_zone_remove \fIname
	Remove the local zone with the given name. Removes all local data inside
	it. If the zone does not exist, the command succeeds.
	.TP
	.B local_data \fIRR data...
	Add new local data, the given resource record. Like \fBlocal\-data\fR
	config statement, except for when no covering zone exists. In that case
	this remote control command creates a transparent zone with the same
	name as this record. This command is not good at returning detailed syntax
	errors.
	.TP
	.B local_data_remove \fIname
	Remove all RR data from local name. If the name already has no items,
	nothing happens. Often results in NXDOMAIN for the name (in a static zone),
	but if the name has become an empty nonterminal (there is still data in
	domain names below the removed name), NOERROR nodata answers are the
	result for that name.
	.TP
	.B local_zones
	Add local zones read from stdin of unbound\-control. Input is read per line,
	with name space type on a line. For bulk additions.
	.TP
	.B local_zones_remove
	Remove local zones read from stdin of unbound\-control. Input is one name per
	line. For bulk removals.
	.TP
	.B local_datas
	Add local data RRs read from stdin of unbound\-control. Input is one RR per
	line. For bulk additions.
	.TP
	.B local_datas_remove
	Remove local data RRs read from stdin of unbound\-control. Input is one name per
	line. For bulk removals.
	.TP
	.B dump_cache
	The contents of the cache is printed in a text format to stdout. You can
	redirect it to a file to store the cache in a file.
	.TP
	.B load_cache
	The contents of the cache is loaded from stdin. Uses the same format as
	dump_cache uses. Loading the cache with old, or wrong data can result
	in old or wrong data returned to clients. Loading data into the cache
	in this way is supported in order to aid with debugging.
	.TP
	.B lookup \fIname
	Print to stdout the name servers that would be used to look up the
	name specified.
	.TP
	.B flush \fIname
	Remove the name from the cache. Removes the types
	A, AAAA, NS, SOA, CNAME, DNAME, MX, PTR, SRV and NAPTR.
	Because that is fast to do. Other record types can be removed using
	.B flush_type
	or
	.B flush_zone\fR.
	.TP
	.B flush_type \fIname\fR \fItype
	Remove the name, type information from the cache.
	.TP
	.B flush_zone \fIname
	Remove all information at or below the name from the cache.
	The rrsets and key entries are removed so that new lookups will be performed.
	This needs to walk and inspect the entire cache, and is a slow operation.
	The entries are set to expired in the implementation of this command (so,
	with serve\-expired enabled, it'll serve that information but schedule a
	prefetch for new information).
	.TP
	.B flush_bogus
	Remove all bogus data from the cache.
	.TP
	.B flush_negative
	Remove all negative data from the cache. This is nxdomain answers,
	nodata answers and servfail answers. Also removes bad key entries
	(which could be due to failed lookups) from the dnssec key cache, and
	iterator last-resort lookup failures from the rrset cache.
	.TP
	.B flush_stats
	Reset statistics to zero.
	.TP
	.B flush_requestlist
	Drop the queries that are worked on. Stops working on the queries that the
	server is working on now. The cache is unaffected. No reply is sent for
	those queries, probably making those users request again later.
	Useful to make the server restart working on queries with new settings,
	such as a higher verbosity level.
	.TP
	.B dump_requestlist
	Show what is worked on. Prints all queries that the server is currently
	working on. Prints the time that users have been waiting. For internal
	requests, no time is printed. And then prints out the module status.
	This prints the queries from the first thread, and not queries that are
	being serviced from other threads.
	.TP
	.B flush_infra \fIall\|IP
	If all then entire infra cache is emptied. If a specific IP address, the
	entry for that address is removed from the cache. It contains EDNS, ping
	and lameness data.
	.TP
	.B dump_infra
	Show the contents of the infra cache.
	.TP
	.B set_option \fIopt: val
	Set the option to the given value without a reload. The cache is
	therefore not flushed. The option must end with a ':' and whitespace
	must be between the option and the value. Some values may not have an
	effect if set this way, the new values are not written to the config file,
	not all options are supported. This is different from the set_option call
	in libunbound, where all values work because unbound has not been initialized.
	.IP
	The values that work are: statistics\-interval, statistics\-cumulative,
	do\-not\-query\-localhost, harden\-short\-bufsize, harden\-large\-queries,
	harden\-glue, harden\-dnssec\-stripped, harden\-below\-nxdomain,
	harden\-referral\-path, prefetch, prefetch\-key, log\-queries,
	hide\-identity, hide\-version, identity, version, val\-log\-level,
	val\-log\-squelch, ignore\-cd\-flag, add\-holddown, del\-holddown,
	keep\-missing, tcp\-upstream, ssl\-upstream, max\-udp\-size, ratelimit,
	ip\-ratelimit, cache\-max\-ttl, cache\-min\-ttl, cache\-max\-negative\-ttl.
	.TP
	.B get_option \fIopt
	Get the value of the option. Give the option name without a trailing ':'.
	The value is printed. If the value is "", nothing is printed
	and the connection closes. On error 'error ...' is printed (it gives
	a syntax error on unknown option). For some options a list of values,
	one on each line, is printed. The options are shown from the config file
	as modified with set_option. For some options an override may have been
	taken that does not show up with this command, not results from e.g. the
	verbosity and forward control commands. Not all options work, see list_stubs,
	list_forwards, list_local_zones and list_local_data for those.
	.TP
	.B list_stubs
	List the stub zones in use. These are printed one by one to the output.
	This includes the root hints in use.
	.TP
	.B list_forwards
	List the forward zones in use. These are printed zone by zone to the output.
	.TP
	.B list_insecure
	List the zones with domain\-insecure.
	.TP
	.B list_local_zones
	List the local zones in use. These are printed one per line with zone type.
	.TP
	.B list_local_data
	List the local data RRs in use. The resource records are printed.
	.TP
	.B insecure_add \fIzone
	Add a \fBdomain\-insecure\fR for the given zone, like the statement in unbound.conf.
	Adds to the running unbound without affecting the cache contents (which may
	still be bogus, use \fBflush_zone\fR to remove it), does not affect the config file.
	.TP
	.B insecure_remove \fIzone
	Removes domain\-insecure for the given zone.
	.TP
	.B forward_add \fR[\fI+i\fR] \fIzone addr ...
	Add a new forward zone to running unbound. With +i option also adds a
	\fIdomain\-insecure\fR for the zone (so it can resolve insecurely if you have
	a DNSSEC root trust anchor configured for other names).
	The addr can be IP4, IP6 or nameserver names, like \fIforward-zone\fR config
	in unbound.conf.
	.TP
	.B forward_remove \fR[\fI+i\fR] \fIzone
	Remove a forward zone from running unbound. The +i also removes a
	\fIdomain\-insecure\fR for the zone.
	.TP
	.B stub_add \fR[\fI+ip\fR] \fIzone addr ...
	Add a new stub zone to running unbound. With +i option also adds a
	\fIdomain\-insecure\fR for the zone. With +p the stub zone is set to prime,
	without it it is set to notprime. The addr can be IP4, IP6 or nameserver
	names, like the \fIstub-zone\fR config in unbound.conf.
	.TP
	.B stub_remove \fR[\fI+i\fR] \fIzone
	Remove a stub zone from running unbound. The +i also removes a
	\fIdomain\-insecure\fR for the zone.
	.TP
	.B forward \fR[\fIoff\fR \| \fIaddr ...\fR ]
	Setup forwarding mode. Configures if the server should ask other upstream
	nameservers, should go to the internet root nameservers itself, or show
	the current config. You could pass the nameservers after a DHCP update.
	.IP
	Without arguments the current list of addresses used to forward all queries
	to is printed. On startup this is from the forward\-zone "." configuration.
	Afterwards it shows the status. It prints off when no forwarding is used.
	.IP
	If \fIoff\fR is passed, forwarding is disabled and the root nameservers
	are used. This can be used to avoid to avoid buggy or non\-DNSSEC supporting
	nameservers returned from DHCP. But may not work in hotels or hotspots.
	.IP
	If one or more IPv4 or IPv6 addresses are given, those are then used to forward
	queries to. The addresses must be separated with spaces. With '@port' the
	port number can be set explicitly (default port is 53 (DNS)).
	.IP
	By default the forwarder information from the config file for the root "." is
	used. The config file is not changed, so after a reload these changes are
	gone. Other forward zones from the config file are not affected by this command.
	.TP
	.B ratelimit_list \fR[\fI+a\fR]
	List the domains that are ratelimited. Printed one per line with current
	estimated qps and qps limit from config. With +a it prints all domains, not
	just the ratelimited domains, with their estimated qps. The ratelimited
	domains return an error for uncached (new) queries, but cached queries work
	as normal.
	.TP
	.B ip_ratelimit_list \fR[\fI+a\fR]
	List the ip addresses that are ratelimited. Printed one per line with current
	estimated qps and qps limit from config. With +a it prints all ips, not
	just the ratelimited ips, with their estimated qps. The ratelimited
	ips are dropped before checking the cache.
	.TP
	.B list_auth_zones
	List the auth zones that are configured. Printed one per line with a
	status, indicating if the zone is expired and current serial number.
	.TP
	.B auth_zone_reload \fIzone\fR
	Reload the auth zone from zonefile. The zonefile is read in overwriting
	the current contents of the zone in memory. This changes the auth zone
	contents itself, not the cache contents. Such cache contents exists if
	you set unbound to validate with for-upstream yes and that can be cleared
	with \fBflush_zone\fR \fIzone\fR.
	.TP
	.B auth_zone_transfer \fIzone\fR
	Transfer the auth zone from master. The auth zone probe sequence is started,
	where the masters are probed to see if they have an updated zone (with the SOA
	serial check). And then the zone is transferred for a newer zone version.
	.TP
	.B view_list_local_zones \fIview\fR
	\fIlist_local_zones\fR for given view.
	.TP
	.B view_local_zone \fIview\fR \fIname\fR \fItype
	\fIlocal_zone\fR for given view.
	.TP
	.B view_local_zone_remove \fIview\fR \fIname
	\fIlocal_zone_remove\fR for given view.
	.TP
	.B view_list_local_data \fIview\fR
	\fIlist_local_data\fR for given view.
	.TP
	.B view_local_data \fIview\fR \fIRR data...
	\fIlocal_data\fR for given view.
	.TP
	.B view_local_data_remove \fIview\fR \fIname
	\fIlocal_data_remove\fR for given view.
	+.TP
	+.B view_local_datas \fIview\fR
	+Add a list of \fIlocal_data\fR for given view from stdin. Like local_datas.
	.SH "EXIT CODE"
	The unbound\-control program exits with status code 1 on error, 0 on success.
	.SH "SET UP"
	The setup requires a self\-signed certificate and private keys for both
	the server and client. The script \fIunbound\-control\-setup\fR generates
	these in the default run directory, or with \-d in another directory.
	If you change the access control permissions on the key files you can decide
	who can use unbound\-control, by default owner and group but not all users.
	Run the script under the same username as you have configured in unbound.conf
	or as root, so that the daemon is permitted to read the files, for example with:
	.nf
	sudo \-u unbound unbound\-control\-setup
	.fi
	If you have not configured
	a username in unbound.conf, the keys need read permission for the user
	credentials under which the daemon is started.
	The script preserves private keys present in the directory.
	After running the script as root, turn on \fBcontrol\-enable\fR in
	\fIunbound.conf\fR.
	.SH "STATISTIC COUNTERS"
	The \fIstats\fR command shows a number of statistic counters.
	.TP
	.I threadX.num.queries
	number of queries received by thread
	.TP
	.I threadX.num.queries_ip_ratelimited
	number of queries rate limited by thread
	.TP
	.I threadX.num.cachehits
	number of queries that were successfully answered using a cache lookup
	.TP
	.I threadX.num.cachemiss
	number of queries that needed recursive processing
	.TP
	.I threadX.num.dnscrypt.crypted
	number of queries that were encrypted and successfully decapsulated by dnscrypt.
	.TP
	.I threadX.num.dnscrypt.cert
	number of queries that were requesting dnscrypt certificates.
	.TP
	.I threadX.num.dnscrypt.cleartext
	number of queries received on dnscrypt port that were cleartext and not a
	request for certificates.
	.TP
	.I threadX.num.dnscrypt.malformed
	number of request that were neither cleartext, not valid dnscrypt messages.
	.TP
	.I threadX.num.prefetch
	number of cache prefetches performed. This number is included in
	cachehits, as the original query had the unprefetched answer from cache,
	and resulted in recursive processing, taking a slot in the requestlist.
	Not part of the recursivereplies (or the histogram thereof) or cachemiss,
	as a cache response was sent.
	.TP
	.I threadX.num.zero_ttl
	number of replies with ttl zero, because they served an expired cache entry.
	.TP
	.I threadX.num.recursivereplies
	The number of replies sent to queries that needed recursive processing. Could be smaller than threadX.num.cachemiss if due to timeouts no replies were sent for some queries.
	.TP
	.I threadX.requestlist.avg
	The average number of requests in the internal recursive processing request list on insert of a new incoming recursive processing query.
	.TP
	.I threadX.requestlist.max
	Maximum size attained by the internal recursive processing request list.
	.TP
	.I threadX.requestlist.overwritten
	Number of requests in the request list that were overwritten by newer entries. This happens if there is a flood of queries that recursive processing and the server has a hard time.
	.TP
	.I threadX.requestlist.exceeded
	Queries that were dropped because the request list was full. This happens if a flood of queries need recursive processing, and the server can not keep up.
	.TP
	.I threadX.requestlist.current.all
	Current size of the request list, includes internally generated queries (such
	as priming queries and glue lookups).
	.TP
	.I threadX.requestlist.current.user
	Current size of the request list, only the requests from client queries.
	.TP
	.I threadX.recursion.time.avg
	Average time it took to answer queries that needed recursive processing. Note that queries that were answered from the cache are not in this average.
	.TP
	.I threadX.recursion.time.median
	The median of the time it took to answer queries that needed recursive
	processing. The median means that 50% of the user queries were answered in
	less than this time. Because of big outliers (usually queries to non
	responsive servers), the average can be bigger than the median. This median
	has been calculated by interpolation from a histogram.
	.TP
	.I threadX.tcpusage
	The currently held tcp buffers for incoming connections. A spot value on
	the time of the request. This helps you spot if the incoming\-num\-tcp
	buffers are full.
	.TP
	.I total.num.queries
	summed over threads.
	.TP
	.I total.num.cachehits
	summed over threads.
	.TP
	.I total.num.cachemiss
	summed over threads.
	.TP
	.I total.num.dnscrypt.crypted
	summed over threads.
	.TP
	.I total.num.dnscrypt.cert
	summed over threads.
	.TP
	.I total.num.dnscrypt.cleartext
	summed over threads.
	.TP
	.I total.num.dnscrypt.malformed
	summed over threads.
	.TP
	.I total.num.prefetch
	summed over threads.
	.TP
	.I total.num.zero_ttl
	summed over threads.
	.TP
	.I total.num.recursivereplies
	summed over threads.
	.TP
	.I total.requestlist.avg
	averaged over threads.
	.TP
	.I total.requestlist.max
	the maximum of the thread requestlist.max values.
	.TP
	.I total.requestlist.overwritten
	summed over threads.
	.TP
	.I total.requestlist.exceeded
	summed over threads.
	.TP
	.I total.requestlist.current.all
	summed over threads.
	.TP
	.I total.recursion.time.median
	averaged over threads.
	.TP
	.I total.tcpusage
	summed over threads.
	.TP
	.I time.now
	current time in seconds since 1970.
	.TP
	.I time.up
	uptime since server boot in seconds.
	.TP
	.I time.elapsed
	time since last statistics printout, in seconds.
	.SH EXTENDED STATISTICS
	.TP
	.I mem.cache.rrset
	Memory in bytes in use by the RRset cache.
	.TP
	.I mem.cache.message
	Memory in bytes in use by the message cache.
	.TP
	.I mem.cache.dnscrypt_shared_secret
	Memory in bytes in use by the dnscrypt shared secrets cache.
	.TP
	.I mem.cache.dnscrypt_nonce
	Memory in bytes in use by the dnscrypt nonce cache.
	.TP
	.I mem.mod.iterator
	Memory in bytes in use by the iterator module.
	.TP
	.I mem.mod.validator
	Memory in bytes in use by the validator module. Includes the key cache and
	negative cache.
	.TP
	+.I mem.streamwait
	+Memory in bytes in used by the TCP and TLS stream wait buffers. These are
	+answers waiting to be written back to the clients.
	+.TP
	.I histogram.<sec>.<usec>.to.<sec>.<usec>
	Shows a histogram, summed over all threads. Every element counts the
	recursive queries whose reply time fit between the lower and upper bound.
	Times larger or equal to the lowerbound, and smaller than the upper bound.
	There are 40 buckets, with bucket sizes doubling.
	.TP
	.I num.query.type.A
	The total number of queries over all threads with query type A.
	Printed for the other query types as well, but only for the types for which
	queries were received, thus =0 entries are omitted for brevity.
	.TP
	.I num.query.type.other
	Number of queries with query types 256\-65535.
	.TP
	.I num.query.class.IN
	The total number of queries over all threads with query class IN (internet).
	Also printed for other classes (such as CH (CHAOS) sometimes used for
	debugging), or NONE, ANY, used by dynamic update.
	num.query.class.other is printed for classes 256\-65535.
	.TP
	.I num.query.opcode.QUERY
	The total number of queries over all threads with query opcode QUERY.
	Also printed for other opcodes, UPDATE, ...
	.TP
	.I num.query.tcp
	Number of queries that were made using TCP towards the unbound server.
	.TP
	.I num.query.tcpout
	Number of queries that the unbound server made using TCP outgoing towards
	other servers.
	.TP
	.I num.query.tls
	Number of queries that were made using TLS towards the unbound server.
	These are also counted in num.query.tcp, because TLS uses TCP.
	+.TP
	+.I num.query.tls.resume
	+Number of TLS session resumptions, these are queries over TLS towards
	+the unbound server where the client negotiated a TLS session resumption key.
	.TP
	.I num.query.ipv6
	Number of queries that were made using IPv6 towards the unbound server.
	.TP
	.I num.query.flags.RD
	The number of queries that had the RD flag set in the header.
	Also printed for flags QR, AA, TC, RA, Z, AD, CD.
	Note that queries with flags QR, AA or TC may have been rejected
	because of that.
	.TP
	.I num.query.edns.present
	number of queries that had an EDNS OPT record present.
	.TP
	.I num.query.edns.DO
	number of queries that had an EDNS OPT record with the DO (DNSSEC OK) bit set.
	These queries are also included in the num.query.edns.present number.
	.TP
	.I num.query.ratelimited
	The number of queries that are turned away from being send to nameserver due to
	ratelimiting.
	.TP
	.I num.query.dnscrypt.shared_secret.cachemiss
	The number of dnscrypt queries that did not find a shared secret in the cache.
	The can be use to compute the shared secret hitrate.
	.TP
	.I num.query.dnscrypt.replay
	The number of dnscrypt queries that found a nonce hit in the nonce cache and
	hence are considered a query replay.
	.TP
	.I num.answer.rcode.NXDOMAIN
	The number of answers to queries, from cache or from recursion, that had the
	return code NXDOMAIN. Also printed for the other return codes.
	.TP
	.I num.answer.rcode.nodata
	The number of answers to queries that had the pseudo return code nodata.
	This means the actual return code was NOERROR, but additionally, no data was
	carried in the answer (making what is called a NOERROR/NODATA answer).
	These queries are also included in the num.answer.rcode.NOERROR number.
	Common for AAAA lookups when an A record exists, and no AAAA.
	.TP
	.I num.answer.secure
	Number of answers that were secure. The answer validated correctly.
	The AD bit might have been set in some of these answers, where the client
	signalled (with DO or AD bit in the query) that they were ready to accept
	the AD bit in the answer.
	.TP
	.I num.answer.bogus
	Number of answers that were bogus. These answers resulted in SERVFAIL
	to the client because the answer failed validation.
	.TP
	.I num.rrset.bogus
	The number of rrsets marked bogus by the validator. Increased for every
	RRset inspection that fails.
	.TP
	.I unwanted.queries
	Number of queries that were refused or dropped because they failed the
	access control settings.
	.TP
	.I unwanted.replies
	Replies that were unwanted or unsolicited. Could have been random traffic,
	delayed duplicates, very late answers, or could be spoofing attempts.
	Some low level of late answers and delayed duplicates are to be expected
	with the UDP protocol. Very high values could indicate a threat (spoofing).
	.TP
	.I msg.cache.count
	The number of items (DNS replies) in the message cache.
	.TP
	.I rrset.cache.count
	The number of RRsets in the rrset cache. This includes rrsets used by
	the messages in the message cache, but also delegation information.
	.TP
	.I infra.cache.count
	The number of items in the infra cache. These are IP addresses with their
	timing and protocol support information.
	.TP
	.I key.cache.count
	The number of items in the key cache. These are DNSSEC keys, one item
	per delegation point, and their validation status.
	.TP
	.I dnscrypt_shared_secret.cache.count
	The number of items in the shared secret cache. These are precomputed shared
	secrets for a given client public key/server secret key pair. Shared secrets
	are CPU intensive and this cache allows unbound to avoid recomputing the
	shared secret when multiple dnscrypt queries are sent from the same client.
	.TP
	.I dnscrypt_nonce.cache.count
	The number of items in the client nonce cache. This cache is used to prevent
	dnscrypt queries replay. The client nonce must be unique for each client public
	key/server secret key pair. This cache should be able to host QPS * `replay
	window` interval keys to prevent replay of a query during `replay window`
	seconds.
	.TP
	.I num.query.authzone.up
	The number of queries answered from auth\-zone data, upstream queries.
	These queries would otherwise have been sent (with fallback enabled) to
	the internet, but are now answered from the auth zone.
	.TP
	.I num.query.authzone.down
	The number of queries for downstream answered from auth\-zone data.
	These queries are from downstream clients, and have had an answer from
	the data in the auth zone.
	.TP
	.I num.query.aggressive.NOERROR
	The number of queries answered using cached NSEC records with NODATA RCODE.
	These queries would otherwise have been sent to the internet, but are now
	answered using cached data.
	.TP
	.I num.query.aggressive.NXDOMAIN
	The number of queries answered using cached NSEC records with NXDOMAIN RCODE.
	These queries would otherwise have been sent to the internet, but are now
	answered using cached data.
	.TP
	.I num.query.subnet
	Number of queries that got an answer that contained EDNS client subnet data.
	.TP
	.I num.query.subnet_cache
	Number of queries answered from the edns client subnet cache. These are
	counted as cachemiss by the main counters, but hit the client subnet
	specific cache, after getting processed by the edns client subnet module.
	.SH "FILES"
	.TP
	.I @ub_conf_file@
	unbound configuration file.
	.TP
	.I @UNBOUND_RUN_DIR@
	directory with private keys (unbound_server.key and unbound_control.key) and
	self\-signed certificates (unbound_server.pem and unbound_control.pem).
	.SH "SEE ALSO"
	\fIunbound.conf\fR(5),
	\fIunbound\fR(8).
	Index: head/contrib/unbound/doc/unbound-host.1
	===================================================================
	--- head/contrib/unbound/doc/unbound-host.1 (revision 349719)
	+++ head/contrib/unbound/doc/unbound-host.1 (revision 349720)
	@@ -1,118 +1,118 @@
	-.TH "unbound\-host" "1" "Oct 8, 2018" "NLnet Labs" "unbound 1.8.1"
	+.TH "unbound\-host" "1" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
	.\"
	.\" unbound-host.1 -- unbound DNS lookup utility
	.\"
	.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
	.\"
	.\" See LICENSE for the license.
	.\"
	.\"
	.SH "NAME"
	.B unbound\-host
	\- unbound DNS lookup utility
	.SH "SYNOPSIS"
	.B unbound\-host
	.RB [ \-C
	.IR configfile ]
	.RB [ \-vdhr46D ]
	.RB [ \-c
	.IR class ]
	.RB [ \-t
	.IR type ]
	.RB [ \-y
	.IR key ]
	.RB [ \-f
	.IR keyfile ]
	.RB [ \-F
	.IR namedkeyfile ]
	.I hostname
	.SH "DESCRIPTION"
	.B Unbound\-host
	uses the unbound validating resolver to query for the hostname and display
	results. With the \fB\-v\fR option it displays validation
	status: secure, insecure, bogus (security failure).
	.P
	By default it reads no configuration file whatsoever. It attempts to reach
	the internet root servers. With \fB\-C\fR an unbound config file and with
	\fB\-r\fR resolv.conf can be read.
	.P
	The available options are:
	.TP
	.I hostname
	This name is resolved (looked up in the DNS).
	If a IPv4 or IPv6 address is given, a reverse lookup is performed.
	.TP
	.B \-h
	Show the version and commandline option help.
	.TP
	.B \-v
	Enable verbose output and it shows validation results, on every line.
	Secure means that the NXDOMAIN (no such domain name), nodata (no such data)
	or positive data response validated correctly with one of the keys.
	Insecure means that that domain name has no security set up for it.
	Bogus (security failure) means that the response failed one or more checks,
	it is likely wrong, outdated, tampered with, or broken.
	.TP
	.B \-d
	Enable debug output to stderr. One \-d shows what the resolver and validator
	are doing and may tell you what is going on. More times, \-d \-d, gives a
	lot of output, with every packet sent and received.
	.TP
	.B \-c \fIclass
	Specify the class to lookup for, the default is IN the internet class.
	.TP
	.B \-t \fItype
	Specify the type of data to lookup. The default looks for IPv4, IPv6 and
	mail handler data, or domain name pointers for reverse queries.
	.TP
	.B \-y \fIkey
	Specify a public key to use as trust anchor. This is the base for a chain
	of trust that is built up from the trust anchor to the response, in order
	to validate the response message. Can be given as a DS or DNSKEY record.
	For example \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD".
	.TP
	.B \-D
	Enables DNSSEC validation. Reads the root anchor from the default configured
	root anchor at the default location, \fI/var/unbound/root.key\fR.
	.TP
	.B \-f \fIkeyfile
	Reads keys from a file. Every line has a DS or DNSKEY record, in the format
	as for \-y. The zone file format, the same as dig and drill produce.
	.TP
	.B \-F \fInamedkeyfile
	Reads keys from a BIND\-style named.conf file. Only the trusted\-key {}; entries
	are read.
	.TP
	.B \-C \fIconfigfile
	Uses the specified unbound.conf to prime
	.IR libunbound (3).
	Pass it as first argument if you want to override some options from the
	config file with further arguments on the commandline.
	.TP
	.B \-r
	Read /etc/resolv.conf, and use the forward DNS servers from there (those could
	have been set by DHCP). More info in
	.IR resolv.conf (5).
	Breaks validation if those servers do not support DNSSEC.
	.TP
	.B \-4
	Use solely the IPv4 network for sending packets.
	.TP
	.B \-6
	Use solely the IPv6 network for sending packets.
	.SH "EXAMPLES"
	Some examples of use. The keys shown below are fakes, thus a security failure
	is encountered.
	.P
	$ unbound\-host www.example.com
	.P
	$ unbound\-host \-v \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" www.example.com
	.P
	$ unbound\-host \-v \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" 192.0.2.153
	.SH "EXIT CODE"
	The unbound\-host program exits with status code 1 on error,
	0 on no error. The data may not be available on exit code 0, exit code 1
	means the lookup encountered a fatal error.
	.SH "SEE ALSO"
	\fIunbound.conf\fR(5),
	\fIunbound\fR(8).
	Index: head/contrib/unbound/doc/unbound-host.1.in
	===================================================================
	--- head/contrib/unbound/doc/unbound-host.1.in (revision 349719)
	+++ head/contrib/unbound/doc/unbound-host.1.in (revision 349720)
	@@ -1,118 +1,118 @@
	-.TH "unbound\-host" "1" "Oct 8, 2018" "NLnet Labs" "unbound 1.8.1"
	+.TH "unbound\-host" "1" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
	.\"
	.\" unbound-host.1 -- unbound DNS lookup utility
	.\"
	.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
	.\"
	.\" See LICENSE for the license.
	.\"
	.\"
	.SH "NAME"
	.B unbound\-host
	\- unbound DNS lookup utility
	.SH "SYNOPSIS"
	.B unbound\-host
	.RB [ \-C
	.IR configfile ]
	.RB [ \-vdhr46D ]
	.RB [ \-c
	.IR class ]
	.RB [ \-t
	.IR type ]
	.RB [ \-y
	.IR key ]
	.RB [ \-f
	.IR keyfile ]
	.RB [ \-F
	.IR namedkeyfile ]
	.I hostname
	.SH "DESCRIPTION"
	.B Unbound\-host
	uses the unbound validating resolver to query for the hostname and display
	results. With the \fB\-v\fR option it displays validation
	status: secure, insecure, bogus (security failure).
	.P
	By default it reads no configuration file whatsoever. It attempts to reach
	the internet root servers. With \fB\-C\fR an unbound config file and with
	\fB\-r\fR resolv.conf can be read.
	.P
	The available options are:
	.TP
	.I hostname
	This name is resolved (looked up in the DNS).
	If a IPv4 or IPv6 address is given, a reverse lookup is performed.
	.TP
	.B \-h
	Show the version and commandline option help.
	.TP
	.B \-v
	Enable verbose output and it shows validation results, on every line.
	Secure means that the NXDOMAIN (no such domain name), nodata (no such data)
	or positive data response validated correctly with one of the keys.
	Insecure means that that domain name has no security set up for it.
	Bogus (security failure) means that the response failed one or more checks,
	it is likely wrong, outdated, tampered with, or broken.
	.TP
	.B \-d
	Enable debug output to stderr. One \-d shows what the resolver and validator
	are doing and may tell you what is going on. More times, \-d \-d, gives a
	lot of output, with every packet sent and received.
	.TP
	.B \-c \fIclass
	Specify the class to lookup for, the default is IN the internet class.
	.TP
	.B \-t \fItype
	Specify the type of data to lookup. The default looks for IPv4, IPv6 and
	mail handler data, or domain name pointers for reverse queries.
	.TP
	.B \-y \fIkey
	Specify a public key to use as trust anchor. This is the base for a chain
	of trust that is built up from the trust anchor to the response, in order
	to validate the response message. Can be given as a DS or DNSKEY record.
	For example \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD".
	.TP
	.B \-D
	Enables DNSSEC validation. Reads the root anchor from the default configured
	root anchor at the default location, \fI@UNBOUND_ROOTKEY_FILE@\fR.
	.TP
	.B \-f \fIkeyfile
	Reads keys from a file. Every line has a DS or DNSKEY record, in the format
	as for \-y. The zone file format, the same as dig and drill produce.
	.TP
	.B \-F \fInamedkeyfile
	Reads keys from a BIND\-style named.conf file. Only the trusted\-key {}; entries
	are read.
	.TP
	.B \-C \fIconfigfile
	Uses the specified unbound.conf to prime
	.IR libunbound (3).
	Pass it as first argument if you want to override some options from the
	config file with further arguments on the commandline.
	.TP
	.B \-r
	Read /etc/resolv.conf, and use the forward DNS servers from there (those could
	have been set by DHCP). More info in
	.IR resolv.conf (5).
	Breaks validation if those servers do not support DNSSEC.
	.TP
	.B \-4
	Use solely the IPv4 network for sending packets.
	.TP
	.B \-6
	Use solely the IPv6 network for sending packets.
	.SH "EXAMPLES"
	Some examples of use. The keys shown below are fakes, thus a security failure
	is encountered.
	.P
	$ unbound\-host www.example.com
	.P
	$ unbound\-host \-v \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" www.example.com
	.P
	$ unbound\-host \-v \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" 192.0.2.153
	.SH "EXIT CODE"
	The unbound\-host program exits with status code 1 on error,
	0 on no error. The data may not be available on exit code 0, exit code 1
	means the lookup encountered a fatal error.
	.SH "SEE ALSO"
	\fIunbound.conf\fR(5),
	\fIunbound\fR(8).
	Index: head/contrib/unbound/doc/unbound.8
	===================================================================
	--- head/contrib/unbound/doc/unbound.8 (revision 349719)
	+++ head/contrib/unbound/doc/unbound.8 (revision 349720)
	@@ -1,85 +1,85 @@
	-.TH "unbound" "8" "Oct 8, 2018" "NLnet Labs" "unbound 1.8.1"
	+.TH "unbound" "8" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
	.\"
	.\" unbound.8 -- unbound manual
	.\"
	.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
	.\"
	.\" See LICENSE for the license.
	.\"
	.\"
	.SH "NAME"
	.B unbound
	-\- Unbound DNS validating resolver 1.8.1.
	+\- Unbound DNS validating resolver 1.9.2.
	.SH "SYNOPSIS"
	.B unbound
	.RB [ \-h ]
	.RB [ \-d ]
	.RB [ \-p ]
	.RB [ \-v ]
	.RB [ \-c
	.IR cfgfile ]
	.SH "DESCRIPTION"
	.B Unbound
	is a caching DNS resolver.
	.P
	It uses a built in list of authoritative nameservers for the root zone (.),
	the so called root hints.
	On receiving a DNS query it will ask the root nameservers for
	an answer and will in almost all cases receive a delegation to a top level
	domain (TLD) authoritative nameserver.
	It will then ask that nameserver for an answer.
	It will recursively continue until an answer is found or no answer is
	available (NXDOMAIN).
	For performance and efficiency reasons that answer is cached for a
	certain time (the answer's time\-to\-live or TTL).
	A second query for the same name will then be answered from the cache.
	Unbound can also do DNSSEC validation.
	.P
	To use a locally running
	.B Unbound
	for resolving put
	.sp
	.RS 6n
	nameserver 127.0.0.1
	.RE
	.sp
	into
	.IR resolv.conf (5).
	.P
	If authoritative DNS is needed as well using
	.IR nsd (8),
	careful setup is required because authoritative nameservers and
	resolvers are using the same port number (53).
	.P
	The available options are:
	.TP
	.B \-h
	Show the version and commandline option help.
	.TP
	.B \-c\fI cfgfile
	Set the config file with settings for unbound to read instead of reading the
	file at the default location, /var/unbound/unbound.conf. The syntax is
	described in \fIunbound.conf\fR(5).
	.TP
	.B \-d
	Debug flag: do not fork into the background, but stay attached to
	the console. This flag will also delay writing to the log file until
	the thread\-spawn time, so that most config and setup errors appear on
	stderr. If given twice or more, logging does not switch to the log file
	or to syslog, but the log messages are printed to stderr all the time.
	.TP
	.B \-p
	Don't use a pidfile. This argument should only be used by supervision
	systems which can ensure that only one instance of unbound will run
	concurrently.
	.TP
	.B \-v
	Increase verbosity. If given multiple times, more information is logged.
	This is in addition to the verbosity (if any) from the config file.
	.SH "SEE ALSO"
	\fIunbound.conf\fR(5),
	\fIunbound\-checkconf\fR(8),
	\fInsd\fR(8).
	.SH "AUTHORS"
	.B Unbound
	developers are mentioned in the CREDITS file in the distribution.
	Index: head/contrib/unbound/doc/unbound.8.in
	===================================================================
	--- head/contrib/unbound/doc/unbound.8.in (revision 349719)
	+++ head/contrib/unbound/doc/unbound.8.in (revision 349720)
	@@ -1,85 +1,85 @@
	-.TH "unbound" "8" "Oct 8, 2018" "NLnet Labs" "unbound 1.8.1"
	+.TH "unbound" "8" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
	.\"
	.\" unbound.8 -- unbound manual
	.\"
	.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
	.\"
	.\" See LICENSE for the license.
	.\"
	.\"
	.SH "NAME"
	.B unbound
	-\- Unbound DNS validating resolver 1.8.1.
	+\- Unbound DNS validating resolver 1.9.2.
	.SH "SYNOPSIS"
	.B unbound
	.RB [ \-h ]
	.RB [ \-d ]
	.RB [ \-p ]
	.RB [ \-v ]
	.RB [ \-c
	.IR cfgfile ]
	.SH "DESCRIPTION"
	.B Unbound
	is a caching DNS resolver.
	.P
	It uses a built in list of authoritative nameservers for the root zone (.),
	the so called root hints.
	On receiving a DNS query it will ask the root nameservers for
	an answer and will in almost all cases receive a delegation to a top level
	domain (TLD) authoritative nameserver.
	It will then ask that nameserver for an answer.
	It will recursively continue until an answer is found or no answer is
	available (NXDOMAIN).
	For performance and efficiency reasons that answer is cached for a
	certain time (the answer's time\-to\-live or TTL).
	A second query for the same name will then be answered from the cache.
	Unbound can also do DNSSEC validation.
	.P
	To use a locally running
	.B Unbound
	for resolving put
	.sp
	.RS 6n
	nameserver 127.0.0.1
	.RE
	.sp
	into
	.IR resolv.conf (5).
	.P
	If authoritative DNS is needed as well using
	.IR nsd (8),
	careful setup is required because authoritative nameservers and
	resolvers are using the same port number (53).
	.P
	The available options are:
	.TP
	.B \-h
	Show the version and commandline option help.
	.TP
	.B \-c\fI cfgfile
	Set the config file with settings for unbound to read instead of reading the
	file at the default location, @ub_conf_file@. The syntax is
	described in \fIunbound.conf\fR(5).
	.TP
	.B \-d
	Debug flag: do not fork into the background, but stay attached to
	the console. This flag will also delay writing to the log file until
	the thread\-spawn time, so that most config and setup errors appear on
	stderr. If given twice or more, logging does not switch to the log file
	or to syslog, but the log messages are printed to stderr all the time.
	.TP
	.B \-p
	Don't use a pidfile. This argument should only be used by supervision
	systems which can ensure that only one instance of unbound will run
	concurrently.
	.TP
	.B \-v
	Increase verbosity. If given multiple times, more information is logged.
	This is in addition to the verbosity (if any) from the config file.
	.SH "SEE ALSO"
	\fIunbound.conf\fR(5),
	\fIunbound\-checkconf\fR(8),
	\fInsd\fR(8).
	.SH "AUTHORS"
	.B Unbound
	developers are mentioned in the CREDITS file in the distribution.
	Index: head/contrib/unbound/doc/unbound.conf.5
	===================================================================
	--- head/contrib/unbound/doc/unbound.conf.5 (revision 349719)
	+++ head/contrib/unbound/doc/unbound.conf.5 (revision 349720)
	@@ -1,2048 +1,2135 @@
	-.TH "unbound.conf" "5" "Oct 8, 2018" "NLnet Labs" "unbound 1.8.1"
	+.TH "unbound.conf" "5" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
	.\"
	.\" unbound.conf.5 -- unbound.conf manual
	.\"
	.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
	.\"
	.\" See LICENSE for the license.
	.\"
	.\"
	.SH "NAME"
	.B unbound.conf
	\- Unbound configuration file.
	.SH "SYNOPSIS"
	.B unbound.conf
	.SH "DESCRIPTION"
	.B unbound.conf
	is used to configure
	\fIunbound\fR(8).
	The file format has attributes and values. Some attributes have attributes
	inside them.
	The notation is: attribute: value.
	.P
	Comments start with # and last to the end of line. Empty lines are
	ignored as is whitespace at the beginning of a line.
	.P
	The utility
	\fIunbound\-checkconf\fR(8)
	can be used to check unbound.conf prior to usage.
	.SH "EXAMPLE"
	An example config file is shown below. Copy this to /etc/unbound/unbound.conf
	and start the server with:
	.P
	.nf
	$ unbound \-c /etc/unbound/unbound.conf
	.fi
	.P
	Most settings are the defaults. Stop the server with:
	.P
	.nf
	$ kill `cat /etc/unbound/unbound.pid`
	.fi
	.P
	Below is a minimal config file. The source distribution contains an extensive
	example.conf file with all the options.
	.P
	.nf
	# unbound.conf(5) config file for unbound(8).
	server:
	directory: "/etc/unbound"
	username: unbound
	# make sure unbound can access entropy from inside the chroot.
	# e.g. on linux the use these commands (on BSD, devfs(8) is used):
	# mount \-\-bind \-n /dev/random /etc/unbound/dev/random
	# and mount \-\-bind \-n /dev/log /etc/unbound/dev/log
	chroot: "/etc/unbound"
	# logfile: "/etc/unbound/unbound.log" #uncomment to use logfile.
	pidfile: "/etc/unbound/unbound.pid"
	# verbosity: 1 # uncomment and increase to get more logging.
	# listen on all interfaces, answer queries from the local subnet.
	interface: 0.0.0.0
	interface: ::0
	access\-control: 10.0.0.0/8 allow
	access\-control: 2001:DB8::/64 allow
	.fi
	.SH "FILE FORMAT"
	There must be whitespace between keywords. Attribute keywords end with a colon ':'.
	An attribute is followed by its containing attributes, or a value.
	.P
	Files can be included using the
	.B include:
	directive. It can appear anywhere, it accepts a single file name as argument.
	Processing continues as if the text from the included file was copied into
	the config file at that point. If also using chroot, using full path names
	for the included files works, relative pathnames for the included names work
	if the directory where the daemon is started equals its chroot/working
	directory or is specified before the include statement with directory: dir.
	Wildcards can be used to include multiple files, see \fIglob\fR(7).
	.SS "Server Options"
	These options are part of the
	.B server:
	clause.
	.TP
	.B verbosity: \fI<number>
	The verbosity number, level 0 means no verbosity, only errors. Level 1
	gives operational information. Level 2 gives detailed operational
	information. Level 3 gives query level information, output per query.
	Level 4 gives algorithm level information. Level 5 logs client
	identification for cache misses. Default is level 1.
	The verbosity can also be increased from the commandline, see \fIunbound\fR(8).
	.TP
	.B statistics\-interval: \fI<seconds>
	The number of seconds between printing statistics to the log for every thread.
	Disable with value 0 or "". Default is disabled. The histogram statistics
	are only printed if replies were sent during the statistics interval,
	requestlist statistics are printed for every interval (but can be 0).
	This is because the median calculation requires data to be present.
	.TP
	.B statistics\-cumulative: \fI<yes or no>
	If enabled, statistics are cumulative since starting unbound, without clearing
	the statistics counters after logging the statistics. Default is no.
	.TP
	.B extended\-statistics: \fI<yes or no>
	If enabled, extended statistics are printed from \fIunbound\-control\fR(8).
	Default is off, because keeping track of more statistics takes time. The
	counters are listed in \fIunbound\-control\fR(8).
	.TP
	.B num\-threads: \fI<number>
	The number of threads to create to serve clients. Use 1 for no threading.
	.TP
	.B port: \fI<port number>
	The port number, default 53, on which the server responds to queries.
	.TP
	.B interface: \fI<ip address[@port]>
	Interface to use to connect to the network. This interface is listened to
	for queries from clients, and answers to clients are given from it.
	Can be given multiple times to work on several interfaces. If none are
	given the default is to listen to localhost.
	The interfaces are not changed on a reload (kill \-HUP) but only on restart.
	A port number can be specified with @port (without spaces between
	interface and port number), if not specified the default port (from
	\fBport\fR) is used.
	.TP
	.B ip\-address: \fI<ip address[@port]>
	Same as interface: (for ease of compatibility with nsd.conf).
	.TP
	.B interface\-automatic: \fI<yes or no>
	Detect source interface on UDP queries and copy them to replies. This
	feature is experimental, and needs support in your OS for particular socket
	options. Default value is no.
	.TP
	.B outgoing\-interface: \fI<ip address or ip6 netblock>
	Interface to use to connect to the network. This interface is used to send
	queries to authoritative servers and receive their replies. Can be given
	multiple times to work on several interfaces. If none are given the
	default (all) is used. You can specify the same interfaces in
	.B interface:
	and
	.B outgoing\-interface:
	lines, the interfaces are then used for both purposes. Outgoing queries are
	sent via a random outgoing interface to counter spoofing.
	.IP
	If an IPv6 netblock is specified instead of an individual IPv6 address,
	outgoing UDP queries will use a randomised source address taken from the
	netblock to counter spoofing. Requires the IPv6 netblock to be routed to the
	host running unbound, and requires OS support for unprivileged non-local binds
	(currently only supported on Linux). Several netblocks may be specified with
	multiple
	.B outgoing\-interface:
	options, but do not specify both an individual IPv6 address and an IPv6
	netblock, or the randomisation will be compromised. Consider combining with
	.B prefer\-ip6: yes
	to increase the likelihood of IPv6 nameservers being selected for queries.
	On Linux you need these two commands to be able to use the freebind socket
	option to receive traffic for the ip6 netblock:
	ip \-6 addr add mynetblock/64 dev lo &&
	ip \-6 route add local mynetblock/64 dev lo
	.TP
	.B outgoing\-range: \fI<number>
	Number of ports to open. This number of file descriptors can be opened per
	thread. Must be at least 1. Default depends on compile options. Larger
	numbers need extra resources from the operating system. For performance a
	very large value is best, use libevent to make this possible.
	.TP
	.B outgoing\-port\-permit: \fI<port number or range>
	Permit unbound to open this port or range of ports for use to send queries.
	A larger number of permitted outgoing ports increases resilience against
	spoofing attempts. Make sure these ports are not needed by other daemons.
	By default only ports above 1024 that have not been assigned by IANA are used.
	Give a port number or a range of the form "low\-high", without spaces.
	.IP
	The \fBoutgoing\-port\-permit\fR and \fBoutgoing\-port\-avoid\fR statements
	are processed in the line order of the config file, adding the permitted ports
	and subtracting the avoided ports from the set of allowed ports. The
	processing starts with the non IANA allocated ports above 1024 in the set
	of allowed ports.
	.TP
	.B outgoing\-port\-avoid: \fI<port number or range>
	Do not permit unbound to open this port or range of ports for use to send
	queries. Use this to make sure unbound does not grab a port that another
	daemon needs. The port is avoided on all outgoing interfaces, both IP4 and IP6.
	By default only ports above 1024 that have not been assigned by IANA are used.
	Give a port number or a range of the form "low\-high", without spaces.
	.TP
	.B outgoing\-num\-tcp: \fI<number>
	Number of outgoing TCP buffers to allocate per thread. Default is 10. If
	set to 0, or if do\-tcp is "no", no TCP queries to authoritative servers
	are done. For larger installations increasing this value is a good idea.
	.TP
	.B incoming\-num\-tcp: \fI<number>
	Number of incoming TCP buffers to allocate per thread. Default is
	10. If set to 0, or if do\-tcp is "no", no TCP queries from clients are
	accepted. For larger installations increasing this value is a good idea.
	.TP
	.B edns\-buffer\-size: \fI<number>
	Number of bytes size to advertise as the EDNS reassembly buffer size.
	This is the value put into datagrams over UDP towards peers. The actual
	buffer size is determined by msg\-buffer\-size (both for TCP and UDP). Do
	not set higher than that value. Default is 4096 which is RFC recommended.
	If you have fragmentation reassembly problems, usually seen as timeouts,
	then a value of 1472 can fix it. Setting to 512 bypasses even the most
	stringent path MTU problems, but is seen as extreme, since the amount
	of TCP fallback generated is excessive (probably also for this resolver,
	consider tuning the outgoing tcp number).
	.TP
	.B max\-udp\-size: \fI<number>
	Maximum UDP response size (not applied to TCP response). 65536 disables the
	udp response size maximum, and uses the choice from the client, always.
	Suggested values are 512 to 4096. Default is 4096.
	.TP
	+.B stream\-wait\-size: \fI<number>
	+Number of bytes size maximum to use for waiting stream buffers. Default is
	+4 megabytes. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes,
	+megabytes or gigabytes (1024*1024 bytes in a megabyte). As TCP and TLS streams
	+queue up multiple results, the amount of memory used for these buffers does
	+not exceed this number, otherwise the responses are dropped. This manages
	+the total memory usage of the server (under heavy use), the number of requests
	+that can be queued up per connection is also limited, with further requests
	+waiting in TCP buffers.
	+.TP
	.B msg\-buffer\-size: \fI<number>
	Number of bytes size of the message buffers. Default is 65552 bytes, enough
	for 64 Kb packets, the maximum DNS message size. No message larger than this
	can be sent or received. Can be reduced to use less memory, but some requests
	for DNS data, such as for huge resource records, will result in a SERVFAIL
	reply to the client.
	.TP
	.B msg\-cache\-size: \fI<number>
	Number of bytes size of the message cache. Default is 4 megabytes.
	A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
	or gigabytes (1024*1024 bytes in a megabyte).
	.TP
	.B msg\-cache\-slabs: \fI<number>
	Number of slabs in the message cache. Slabs reduce lock contention by threads.
	Must be set to a power of 2. Setting (close) to the number of cpus is a
	reasonable guess.
	.TP
	.B num\-queries\-per\-thread: \fI<number>
	The number of queries that every thread will service simultaneously.
	If more queries arrive that need servicing, and no queries can be jostled out
	(see \fIjostle\-timeout\fR), then the queries are dropped. This forces
	the client to resend after a timeout; allowing the server time to work on
	the existing queries. Default depends on compile options, 512 or 1024.
	.TP
	.B jostle\-timeout: \fI<msec>
	Timeout used when the server is very busy. Set to a value that usually
	results in one roundtrip to the authority servers. If too many queries
	arrive, then 50% of the queries are allowed to run to completion, and
	the other 50% are replaced with the new incoming query if they have already
	spent more than their allowed time. This protects against denial of
	service by slow queries or high query rates. Default 200 milliseconds.
	The effect is that the qps for long-lasting queries is about
	(numqueriesperthread / 2) / (average time for such long queries) qps.
	The qps for short queries can be about (numqueriesperthread / 2)
	/ (jostletimeout in whole seconds) qps per thread, about (1024/2)*5 = 2560
	qps by default.
	.TP
	.B delay\-close: \fI<msec>
	Extra delay for timeouted UDP ports before they are closed, in msec.
	Default is 0, and that disables it. This prevents very delayed answer
	packets from the upstream (recursive) servers from bouncing against
	closed ports and setting off all sort of close-port counters, with
	eg. 1500 msec. When timeouts happen you need extra sockets, it checks
	the ID and remote IP of packets, and unwanted packets are added to the
	unwanted packet counter.
	.TP
	+.B unknown\-server\-time\-limit: \fI<msec>
	+The wait time in msec for waiting for an unknown server to reply.
	+Increase this if you are behind a slow satellite link, to eg. 1128.
	+That would then avoid re\-querying every initial query because it times out.
	+Default is 376 msec.
	+.TP
	.B so\-rcvbuf: \fI<number>
	If not 0, then set the SO_RCVBUF socket option to get more buffer
	space on UDP port 53 incoming queries. So that short spikes on busy
	servers do not drop packets (see counter in netstat \-su). Default is
	0 (use system value). Otherwise, the number of bytes to ask for, try
	"4m" on a busy server. The OS caps it at a maximum, on linux unbound
	needs root permission to bypass the limit, or the admin can use sysctl
	net.core.rmem_max. On BSD change kern.ipc.maxsockbuf in /etc/sysctl.conf.
	On OpenBSD change header and recompile kernel. On Solaris ndd \-set
	/dev/udp udp_max_buf 8388608.
	.TP
	.B so\-sndbuf: \fI<number>
	If not 0, then set the SO_SNDBUF socket option to get more buffer space on
	UDP port 53 outgoing queries. This for very busy servers handles spikes
	in answer traffic, otherwise 'send: resource temporarily unavailable'
	can get logged, the buffer overrun is also visible by netstat \-su.
	Default is 0 (use system value). Specify the number of bytes to ask
	for, try "4m" on a very busy server. The OS caps it at a maximum, on
	linux unbound needs root permission to bypass the limit, or the admin
	can use sysctl net.core.wmem_max. On BSD, Solaris changes are similar
	to so\-rcvbuf.
	.TP
	.B so\-reuseport: \fI<yes or no>
	If yes, then open dedicated listening sockets for incoming queries for each
	thread and try to set the SO_REUSEPORT socket option on each socket. May
	distribute incoming queries to threads more evenly. Default is yes.
	On Linux it is supported in kernels >= 3.9. On other systems, FreeBSD, OSX
	it may also work. You can enable it (on any platform and kernel),
	it then attempts to open the port and passes the option if it was available
	at compile time, if that works it is used, if it fails, it continues
	silently (unless verbosity 3) without the option.
	+At extreme load it could be better to turn it off to distribute the queries
	+evenly, reported for Linux systems (4.4.x).
	.TP
	.B ip\-transparent: \fI<yes or no>
	If yes, then use IP_TRANSPARENT socket option on sockets where unbound
	is listening for incoming traffic. Default no. Allows you to bind to
	non\-local interfaces. For example for non\-existent IP addresses that
	are going to exist later on, with host failover configuration. This is
	a lot like interface\-automatic, but that one services all interfaces
	and with this option you can select which (future) interfaces unbound
	provides service on. This option needs unbound to be started with root
	permissions on some systems. The option uses IP_BINDANY on FreeBSD systems
	and SO_BINDANY on OpenBSD systems.
	.TP
	.B ip\-freebind: \fI<yes or no>
	If yes, then use IP_FREEBIND socket option on sockets where unbound
	is listening to incoming traffic. Default no. Allows you to bind to
	IP addresses that are nonlocal or do not exist, like when the network
	interface or IP address is down. Exists only on Linux, where the similar
	ip\-transparent option is also available.
	.TP
	.B rrset\-cache\-size: \fI<number>
	Number of bytes size of the RRset cache. Default is 4 megabytes.
	A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
	or gigabytes (1024*1024 bytes in a megabyte).
	.TP
	.B rrset\-cache\-slabs: \fI<number>
	Number of slabs in the RRset cache. Slabs reduce lock contention by threads.
	Must be set to a power of 2.
	.TP
	.B cache\-max\-ttl: \fI<seconds>
	Time to live maximum for RRsets and messages in the cache. Default is
	-86400 seconds (1 day). If the maximum kicks in, responses to clients
	-still get decrementing TTLs based on the original (larger) values.
	-When the internal TTL expires, the cache item has expired.
	+86400 seconds (1 day). When the TTL expires, the cache item has expired.
	Can be set lower to force the resolver to query for data often, and not
	-trust (very large) TTL values.
	+trust (very large) TTL values. Downstream clients also see the lower TTL.
	.TP
	.B cache\-min\-ttl: \fI<seconds>
	Time to live minimum for RRsets and messages in the cache. Default is 0.
	If the minimum kicks in, the data is cached for longer than the domain
	owner intended, and thus less queries are made to look up the data.
	Zero makes sure the data in the cache is as the domain owner intended,
	higher values, especially more than an hour or so, can lead to trouble as
	the data in the cache does not match up with the actual data any more.
	.TP
	.B cache\-max\-negative\-ttl: \fI<seconds>
	Time to live maximum for negative responses, these have a SOA in the
	authority section that is limited in time. Default is 3600.
	This applies to nxdomain and nodata answers.
	.TP
	.B infra\-host\-ttl: \fI<seconds>
	Time to live for entries in the host cache. The host cache contains
	roundtrip timing, lameness and EDNS support information. Default is 900.
	.TP
	.B infra\-cache\-slabs: \fI<number>
	Number of slabs in the infrastructure cache. Slabs reduce lock contention
	by threads. Must be set to a power of 2.
	.TP
	.B infra\-cache\-numhosts: \fI<number>
	Number of hosts for which information is cached. Default is 10000.
	.TP
	.B infra\-cache\-min\-rtt: \fI<msec>
	Lower limit for dynamic retransmit timeout calculation in infrastructure
	cache. Default is 50 milliseconds. Increase this value if using forwarders
	needing more time to do recursive name resolution.
	.TP
	.B define\-tag: \fI<"list of tags">
	Define the tags that can be used with local\-zone and access\-control.
	Enclose the list between quotes ("") and put spaces between tags.
	.TP
	.B do\-ip4: \fI<yes or no>
	Enable or disable whether ip4 queries are answered or issued. Default is yes.
	.TP
	.B do\-ip6: \fI<yes or no>
	Enable or disable whether ip6 queries are answered or issued. Default is yes.
	If disabled, queries are not answered on IPv6, and queries are not sent on
	IPv6 to the internet nameservers. With this option you can disable the
	ipv6 transport for sending DNS traffic, it does not impact the contents of
	the DNS traffic, which may have ip4 and ip6 addresses in it.
	.TP
	.B prefer\-ip6: \fI<yes or no>
	If enabled, prefer IPv6 transport for sending DNS queries to internet
	nameservers. Default is no.
	.TP
	.B do\-udp: \fI<yes or no>
	Enable or disable whether UDP queries are answered or issued. Default is yes.
	.TP
	.B do\-tcp: \fI<yes or no>
	Enable or disable whether TCP queries are answered or issued. Default is yes.
	.TP
	.B tcp\-mss: \fI<number>
	Maximum segment size (MSS) of TCP socket on which the server responds
	to queries. Value lower than common MSS on Ethernet
	(1220 for example) will address path MTU problem.
	Note that not all platform supports socket option to set MSS (TCP_MAXSEG).
	Default is system default MSS determined by interface MTU and
	negotiation between server and client.
	.TP
	.B outgoing\-tcp\-mss: \fI<number>
	Maximum segment size (MSS) of TCP socket for outgoing queries
	(from Unbound to other servers). Value lower than
	common MSS on Ethernet (1220 for example) will address path MTU problem.
	Note that not all platform supports socket option to set MSS (TCP_MAXSEG).
	Default is system default MSS determined by interface MTU and
	negotiation between Unbound and other servers.
	.TP
	.B tcp-idle-timeout: \fI<msec>\fR
	The period Unbound will wait for a query on a TCP connection.
	If this timeout expires Unbound closes the connection.
	This option defaults to 30000 milliseconds.
	When the number of free incoming TCP buffers falls below 50% of the
	total number configured, the option value used is progressively
	reduced, first to 1% of the configured value, then to 0.2% of the
	configured value if the number of free buffers falls below 35% of the
	total number configured, and finally to 0 if the number of free buffers
	falls below 20% of the total number configured. A minimum timeout of
	200 milliseconds is observed regardless of the option value used.
	.TP
	.B edns-tcp-keepalive: \fI<yes or no>\fR
	Enable or disable EDNS TCP Keepalive. Default is no.
	.TP
	.B edns-tcp-keepalive-timeout: \fI<msec>\fR
	The period Unbound will wait for a query on a TCP connection when
	EDNS TCP Keepalive is active. If this timeout expires Unbound closes
	the connection. If the client supports the EDNS TCP Keepalive option,
	Unbound sends the timeout value to the client to encourage it to
	close the connection before the server times out.
	This option defaults to 120000 milliseconds.
	When the number of free incoming TCP buffers falls below 50% of
	the total number configured, the advertised timeout is progressively
	reduced to 1% of the configured value, then to 0.2% of the configured
	value if the number of free buffers falls below 35% of the total number
	configured, and finally to 0 if the number of free buffers falls below
	20% of the total number configured.
	A minimum actual timeout of 200 milliseconds is observed regardless of the
	advertised timeout.
	.TP
	.B tcp\-upstream: \fI<yes or no>
	Enable or disable whether the upstream queries use TCP only for transport.
	Default is no. Useful in tunneling scenarios.
	.TP
	.B udp\-upstream\-without\-downstream: \fI<yes or no>
	Enable udp upstream even if do-udp is no. Default is no, and this does not
	change anything. Useful for TLS service providers, that want no udp downstream
	but use udp to fetch data upstream.
	.TP
	.B tls\-upstream: \fI<yes or no>
	Enabled or disable whether the upstream queries use TLS only for transport.
	Default is no. Useful in tunneling scenarios. The TLS contains plain DNS in
	TCP wireformat. The other server must support this (see
	\fBtls\-service\-key\fR).
	If you enable this, also configure a tls\-cert\-bundle or use tls\-win\-cert to
	load CA certs, otherwise the connections cannot be authenticated.
	+This option enables TLS for all of them, but if you do not set this you can
	+configure TLS specifically for some forward zones with forward\-tls\-upstream. And also with stub\-tls\-upstream.
	.TP
	.B ssl\-upstream: \fI<yes or no>
	Alternate syntax for \fBtls\-upstream\fR. If both are present in the config
	file the last is used.
	.TP
	.B tls\-service\-key: \fI<file>
	-If enabled, the server provider TLS service on its TCP sockets. The clients
	-have to use tls\-upstream: yes. The file is the private key for the TLS
	-session. The public certificate is in the tls\-service\-pem file. Default
	-is "", turned off. Requires a restart (a reload is not enough) if changed,
	-because the private key is read while root permissions are held and before
	-chroot (if any). Normal DNS TCP service is not provided and gives errors,
	-this service is best run with a different \fBport:\fR config or \fI@port\fR
	-suffixes in the \fBinterface\fR config.
	+If enabled, the server provides TLS service on the TCP ports marked
	+implicitly or explicitly for TLS service with tls\-port. The file must
	+contain the private key for the TLS session, the public certificate is in
	+the tls\-service\-pem file and it must also be specified if tls\-service\-key
	+is specified. The default is "", turned off. Enabling or disabling
	+this service requires a restart (a reload is not enough), because the
	+key is read while root permissions are held and before chroot (if any).
	+The ports enabled implicitly or explicitly via \fBtls\-port:\fR do not provide
	+normal DNS TCP service.
	.TP
	.B ssl\-service\-key: \fI<file>
	Alternate syntax for \fBtls\-service\-key\fR.
	.TP
	.B tls\-service\-pem: \fI<file>
	The public key certificate pem file for the tls service. Default is "",
	turned off.
	.TP
	.B ssl\-service\-pem: \fI<file>
	Alternate syntax for \fBtls\-service\-pem\fR.
	.TP
	.B tls\-port: \fI<number>
	The port number on which to provide TCP TLS service, default 853, only
	interfaces configured with that port number as @number get the TLS service.
	.TP
	.B ssl\-port: \fI<number>
	Alternate syntax for \fBtls\-port\fR.
	.TP
	.B tls\-cert\-bundle: \fI<file>
	If null or "", no file is used. Set it to the certificate bundle file,
	for example "/etc/pki/tls/certs/ca\-bundle.crt". These certificates are used
	for authenticating connections made to outside peers. For example auth\-zone
	urls, and also DNS over TLS connections.
	.TP
	.B ssl\-cert\-bundle: \fI<file>
	Alternate syntax for \fBtls\-cert\-bundle\fR.
	.TP
	.B tls\-win\-cert: \fI<yes or no>
	Add the system certificates to the cert bundle certificates for authentication.
	If no cert bundle, it uses only these certificates. Default is no.
	On windows this option uses the certificates from the cert store. Use
	the tls\-cert\-bundle option on other systems.
	.TP
	.B tls\-additional\-port: \fI<portnr>
	List portnumbers as tls\-additional\-port, and when interfaces are defined,
	eg. with the @port suffix, as this port number, they provide dns over TLS
	service. Can list multiple, each on a new statement.
	.TP
	+.B tls-session-ticket-keys: \fI<file>
	+If not "", lists files with 80 bytes of random contents that are used to
	+perform TLS session resumption for clients using the unbound server.
	+These files contain the secret key for the TLS session tickets.
	+First key use to encrypt and decrypt TLS session tickets.
	+Other keys use to decrypt only. With this you can roll over to new keys,
	+by generating a new first file and allowing decrypt of the old file by
	+listing it after the first file for some time, after the wait clients are not
	+using the old key any more and the old key can be removed.
	+One way to create the file is dd if=/dev/random bs=1 count=80 of=ticket.dat
	+The first 16 bytes should be different from the old one if you create a second key, that is the name used to identify the key. Then there is 32 bytes random
	+data for an AES key and then 32 bytes random data for the HMAC key.
	+.TP
	+.B tls\-ciphers: \fI<string with cipher list>
	+Set the list of ciphers to allow when serving TLS. Use "" for defaults,
	+and that is the default.
	+.TP
	+.B tls\-ciphersuites: \fI<string with ciphersuites list>
	+Set the list of ciphersuites to allow when serving TLS. This is for newer
	+TLS 1.3 connections. Use "" for defaults, and that is the default.
	+.TP
	.B use\-systemd: \fI<yes or no>
	Enable or disable systemd socket activation.
	Default is no.
	.TP
	.B do\-daemonize: \fI<yes or no>
	Enable or disable whether the unbound server forks into the background as
	a daemon. Set the value to \fIno\fR when unbound runs as systemd service.
	Default is yes.
	.TP
	.B tcp\-connection\-limit: \fI<IP netblock> <limit>
	Allow up to \fIlimit\fR simultaneous TCP connections from the given netblock.
	When at the limit, further connections are accepted but closed immediately.
	This option is experimental at this time.
	.TP
	.B access\-control: \fI<IP netblock> <action>
	The netblock is given as an IP4 or IP6 address with /size appended for a
	classless network block. The action can be \fIdeny\fR, \fIrefuse\fR,
	\fIallow\fR, \fIallow_setrd\fR, \fIallow_snoop\fR, \fIdeny_non_local\fR or
	\fIrefuse_non_local\fR.
	The most specific netblock match is used, if none match \fIdeny\fR is used.
	+The order of the access\-control statements therefore does not matter.
	.IP
	The action \fIdeny\fR stops queries from hosts from that netblock.
	.IP
	The action \fIrefuse\fR stops queries too, but sends a DNS rcode REFUSED
	error message back.
	.IP
	The action \fIallow\fR gives access to clients from that netblock.
	It gives only access for recursion clients (which is
	what almost all clients need). Nonrecursive queries are refused.
	.IP
	The \fIallow\fR action does allow nonrecursive queries to access the
	local\-data that is configured. The reason is that this does not involve
	the unbound server recursive lookup algorithm, and static data is served
	in the reply. This supports normal operations where nonrecursive queries
	are made for the authoritative data. For nonrecursive queries any replies
	from the dynamic cache are refused.
	.IP
	The \fIallow_setrd\fR action ignores the recursion desired (RD) bit and
	treats all requests as if the recursion desired bit is set. Note that this
	behavior violates RFC 1034 which states that a name server should never perform
	recursive service unless asked via the RD bit since this interferes with
	trouble shooting of name servers and their databases. This prohibited behavior
	may be useful if another DNS server must forward requests for specific
	zones to a resolver DNS server, but only supports stub domains and
	sends queries to the resolver DNS server with the RD bit cleared.
	.IP
	The action \fIallow_snoop\fR gives nonrecursive access too. This give
	both recursive and non recursive access. The name \fIallow_snoop\fR refers
	to cache snooping, a technique to use nonrecursive queries to examine
	the cache contents (for malicious acts). However, nonrecursive queries can
	also be a valuable debugging tool (when you want to examine the cache
	contents). In that case use \fIallow_snoop\fR for your administration host.
	.IP
	By default only localhost is \fIallow\fRed, the rest is \fIrefuse\fRd.
	The default is \fIrefuse\fRd, because that is protocol\-friendly. The DNS
	protocol is not designed to handle dropped packets due to policy, and
	dropping may result in (possibly excessive) retried queries.
	.IP
	The deny_non_local and refuse_non_local settings are for hosts that are
	only allowed to query for the authoritative local\-data, they are not
	allowed full recursion but only the static data. With deny_non_local,
	messages that are disallowed are dropped, with refuse_non_local they
	receive error code REFUSED.
	.TP
	.B access\-control\-tag: \fI<IP netblock> <"list of tags">
	Assign tags to access-control elements. Clients using this access control
	element use localzones that are tagged with one of these tags. Tags must be
	defined in \fIdefine\-tags\fR. Enclose list of tags in quotes ("") and put
	spaces between tags. If access\-control\-tag is configured for a netblock that
	does not have an access\-control, an access\-control element with action
	\fIallow\fR is configured for this netblock.
	.TP
	.B access\-control\-tag\-action: \fI<IP netblock> <tag> <action>
	Set action for particular tag for given access control element. If you have
	multiple tag values, the tag used to lookup the action is the first tag match
	between access\-control\-tag and local\-zone\-tag where "first" comes from the
	order of the define-tag values.
	.TP
	.B access\-control\-tag\-data: \fI<IP netblock> <tag> <"resource record string">
	Set redirect data for particular tag for given access control element.
	.TP
	.B access\-control\-view: \fI<IP netblock> <view name>
	Set view for given access control element.
	.TP
	.B chroot: \fI<directory>
	If chroot is enabled, you should pass the configfile (from the
	commandline) as a full path from the original root. After the
	chroot has been performed the now defunct portion of the config
	file path is removed to be able to reread the config after a reload.
	.IP
	All other file paths (working dir, logfile, roothints, and
	key files) can be specified in several ways:
	as an absolute path relative to the new root,
	as a relative path to the working directory, or
	as an absolute path relative to the original root.
	In the last case the path is adjusted to remove the unused portion.
	.IP
	The pidfile can be either a relative path to the working directory, or
	an absolute path relative to the original root. It is written just prior
	to chroot and dropping permissions. This allows the pidfile to be
	/var/run/unbound.pid and the chroot to be /var/unbound, for example.
	.IP
	Additionally, unbound may need to access /dev/random (for entropy)
	from inside the chroot.
	.IP
	If given a chroot is done to the given directory. By default chroot is
	enabled and the default is "/var/unbound". If you give "" no
	chroot is performed.
	.TP
	.B username: \fI<name>
	If given, after binding the port the user privileges are dropped. Default is
	"unbound". If you give username: "" no user change is performed.
	.IP
	If this user is not capable of binding the
	port, reloads (by signal HUP) will still retain the opened ports.
	If you change the port number in the config file, and that new port number
	requires privileges, then a reload will fail; a restart is needed.
	.TP
	.B directory: \fI<directory>
	Sets the working directory for the program. Default is "/var/unbound".
	On Windows the string "%EXECUTABLE%" tries to change to the directory
	that unbound.exe resides in.
	If you give a server: directory: dir before include: file statements
	then those includes can be relative to the working directory.
	.TP
	.B logfile: \fI<filename>
	If "" is given, logging goes to stderr, or nowhere once daemonized.
	The logfile is appended to, in the following format:
	.nf
	[seconds since 1970] unbound[pid:tid]: type: message.
	.fi
	If this option is given, the use\-syslog is option is set to "no".
	The logfile is reopened (for append) when the config file is reread, on
	SIGHUP.
	.TP
	.B use\-syslog: \fI<yes or no>
	Sets unbound to send log messages to the syslogd, using
	\fIsyslog\fR(3).
	The log facility LOG_DAEMON is used, with identity "unbound".
	The logfile setting is overridden when use\-syslog is turned on.
	The default is to log to syslog.
	.TP
	.B log\-identity: \fI<string>
	If "" is given (default), then the name of the executable, usually "unbound"
	is used to report to the log. Enter a string to override it
	with that, which is useful on systems that run more than one instance of
	unbound, with different configurations, so that the logs can be easily
	distinguished against.
	.TP
	.B log\-time\-ascii: \fI<yes or no>
	Sets logfile lines to use a timestamp in UTC ascii. Default is no, which
	prints the seconds since 1970 in brackets. No effect if using syslog, in
	that case syslog formats the timestamp printed into the log files.
	.TP
	.B log\-queries: \fI<yes or no>
	Prints one line per query to the log, with the log timestamp and IP address,
	name, type and class. Default is no. Note that it takes time to print these
	lines which makes the server (significantly) slower. Odd (nonprintable)
	characters in names are printed as '?'.
	.TP
	.B log\-replies: \fI<yes or no>
	Prints one line per reply to the log, with the log timestamp and IP address,
	name, type, class, return code, time to resolve, from cache and response size.
	Default is no. Note that it takes time to print these
	lines which makes the server (significantly) slower. Odd (nonprintable)
	characters in names are printed as '?'.
	.TP
	+.B log\-tag\-queryreply: \fI<yes or no>
	+Prints the word 'query' and 'reply' with log\-queries and log\-replies.
	+This makes filtering logs easier. The default is off (for backwards
	+compatibility).
	+.TP
	.B log\-local\-actions: \fI<yes or no>
	Print log lines to inform about local zone actions. These lines are like the
	local\-zone type inform prints out, but they are also printed for the other
	types of local zones.
	.TP
	.B log\-servfail: \fI<yes or no>
	Print log lines that say why queries return SERVFAIL to clients.
	This is separate from the verbosity debug logs, much smaller, and printed
	at the error level, not the info level of debug info from verbosity.
	.TP
	.B pidfile: \fI<filename>
	The process id is written to the file. Default is "/var/unbound/unbound.pid".
	So,
	.nf
	kill \-HUP `cat /var/unbound/unbound.pid`
	.fi
	triggers a reload,
	.nf
	kill \-TERM `cat /var/unbound/unbound.pid`
	.fi
	gracefully terminates.
	.TP
	.B root\-hints: \fI<filename>
	Read the root hints from this file. Default is nothing, using builtin hints
	for the IN class. The file has the format of zone files, with root
	nameserver names and addresses only. The default may become outdated,
	when servers change, therefore it is good practice to use a root\-hints file.
	.TP
	.B hide\-identity: \fI<yes or no>
	If enabled id.server and hostname.bind queries are refused.
	.TP
	.B identity: \fI<string>
	Set the identity to report. If set to "", the default, then the hostname
	of the server is returned.
	.TP
	.B hide\-version: \fI<yes or no>
	If enabled version.server and version.bind queries are refused.
	.TP
	.B version: \fI<string>
	Set the version to report. If set to "", the default, then the package
	version is returned.
	.TP
	.B hide\-trustanchor: \fI<yes or no>
	If enabled trustanchor.unbound queries are refused.
	.TP
	.B target\-fetch\-policy: \fI<"list of numbers">
	Set the target fetch policy used by unbound to determine if it should fetch
	nameserver target addresses opportunistically. The policy is described per
	dependency depth.
	.IP
	The number of values determines the maximum dependency depth
	that unbound will pursue in answering a query.
	A value of \-1 means to fetch all targets opportunistically for that dependency
	depth. A value of 0 means to fetch on demand only. A positive value fetches
	that many targets opportunistically.
	.IP
	Enclose the list between quotes ("") and put spaces between numbers.
	The default is "3 2 1 0 0". Setting all zeroes, "0 0 0 0 0" gives behaviour
	closer to that of BIND 9, while setting "\-1 \-1 \-1 \-1 \-1" gives behaviour
	rumoured to be closer to that of BIND 8.
	.TP
	.B harden\-short\-bufsize: \fI<yes or no>
	Very small EDNS buffer sizes from queries are ignored. Default is off, since
	it is legal protocol wise to send these, and unbound tries to give very
	small answers to these queries, where possible.
	.TP
	.B harden\-large\-queries: \fI<yes or no>
	Very large queries are ignored. Default is off, since it is legal protocol
	wise to send these, and could be necessary for operation if TSIG or EDNS
	payload is very large.
	.TP
	.B harden\-glue: \fI<yes or no>
	Will trust glue only if it is within the servers authority. Default is on.
	.TP
	.B harden\-dnssec\-stripped: \fI<yes or no>
	Require DNSSEC data for trust\-anchored zones, if such data is absent,
	the zone becomes bogus. If turned off, and no DNSSEC data is received
	(or the DNSKEY data fails to validate), then the zone is made insecure,
	this behaves like there is no trust anchor. You could turn this off if
	you are sometimes behind an intrusive firewall (of some sort) that
	removes DNSSEC data from packets, or a zone changes from signed to
	unsigned to badly signed often. If turned off you run the risk of a
	downgrade attack that disables security for a zone. Default is on.
	.TP
	.B harden\-below\-nxdomain: \fI<yes or no>
	From RFC 8020 (with title "NXDOMAIN: There Really Is Nothing Underneath"),
	returns nxdomain to queries for a name
	below another name that is already known to be nxdomain. DNSSEC mandates
	noerror for empty nonterminals, hence this is possible. Very old software
	might return nxdomain for empty nonterminals (that usually happen for reverse
	IP address lookups), and thus may be incompatible with this. To try to avoid
	this only DNSSEC-secure nxdomains are used, because the old software does not
	have DNSSEC. Default is on.
	The nxdomain must be secure, this means nsec3 with optout is insufficient.
	.TP
	.B harden\-referral\-path: \fI<yes or no>
	Harden the referral path by performing additional queries for
	infrastructure data. Validates the replies if trust anchors are configured
	and the zones are signed. This enforces DNSSEC validation on nameserver
	NS sets and the nameserver addresses that are encountered on the referral
	path to the answer.
	Default no, because it burdens the authority servers, and it is
	not RFC standard, and could lead to performance problems because of the
	extra query load that is generated. Experimental option.
	If you enable it consider adding more numbers after the target\-fetch\-policy
	to increase the max depth that is checked to.
	.TP
	.B harden\-algo\-downgrade: \fI<yes or no>
	Harden against algorithm downgrade when multiple algorithms are
	advertised in the DS record. If no, allows the weakest algorithm to
	validate the zone. Default is no. Zone signers must produce zones
	that allow this feature to work, but sometimes they do not, and turning
	this option off avoids that validation failure.
	.TP
	.B use\-caps\-for\-id: \fI<yes or no>
	Use 0x20\-encoded random bits in the query to foil spoof attempts.
	This perturbs the lowercase and uppercase of query names sent to
	authority servers and checks if the reply still has the correct casing.
	Disabled by default.
	This feature is an experimental implementation of draft dns\-0x20.
	.TP
	.B caps\-whitelist: \fI<domain>
	Whitelist the domain so that it does not receive caps\-for\-id perturbed
	queries. For domains that do not support 0x20 and also fail with fallback
	because they keep sending different answers, like some load balancers.
	Can be given multiple times, for different domains.
	.TP
	.B qname\-minimisation: \fI<yes or no>
	Send minimum amount of information to upstream servers to enhance privacy.
	-Only sent minimum required labels of the QNAME and set QTYPE to A when
	+Only send minimum required labels of the QNAME and set QTYPE to A when
	possible. Best effort approach; full QNAME and original QTYPE will be sent when
	upstream replies with a RCODE other than NOERROR, except when receiving
	NXDOMAIN from a DNSSEC signed zone. Default is yes.
	.TP
	.B qname\-minimisation\-strict: \fI<yes or no>
	QNAME minimisation in strict mode. Do not fall-back to sending full QNAME to
	potentially broken nameservers. A lot of domains will not be resolvable when
	this option in enabled. Only use if you know what you are doing.
	This option only has effect when qname-minimisation is enabled. Default is off.
	.TP
	.B aggressive\-nsec: \fI<yes or no>
	Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN
	and other denials, using information from previous NXDOMAINs answers.
	Default is no. It helps to reduce the query rate towards targets that get
	a very high nonexistent name lookup rate.
	.TP
	.B private\-address: \fI<IP address or subnet>
	Give IPv4 of IPv6 addresses or classless subnets. These are addresses
	on your private network, and are not allowed to be returned for
	public internet names. Any occurrence of such addresses are removed
	from DNS answers. Additionally, the DNSSEC validator may mark the
	answers bogus. This protects against so\-called DNS Rebinding, where
	a user browser is turned into a network proxy, allowing remote access
	through the browser to other parts of your private network. Some names
	can be allowed to contain your private addresses, by default all the
	\fBlocal\-data\fR that you configured is allowed to, and you can specify
	additional names using \fBprivate\-domain\fR. No private addresses are
	enabled by default. We consider to enable this for the RFC1918 private
	IP address space by default in later releases. That would enable private
	addresses for 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16
	fd00::/8 and fe80::/10, since the RFC standards say these addresses
	should not be visible on the public internet. Turning on 127.0.0.0/8
	would hinder many spamblocklists as they use that. Adding ::ffff:0:0/96
	stops IPv4-mapped IPv6 addresses from bypassing the filter.
	.TP
	.B private\-domain: \fI<domain name>
	Allow this domain, and all its subdomains to contain private addresses.
	Give multiple times to allow multiple domain names to contain private
	addresses. Default is none.
	.TP
	.B unwanted\-reply\-threshold: \fI<number>
	If set, a total number of unwanted replies is kept track of in every thread.
	When it reaches the threshold, a defensive action is taken and a warning
	is printed to the log. The defensive action is to clear the rrset and
	message caches, hopefully flushing away any poison. A value of 10 million
	is suggested. Default is 0 (turned off).
	.TP
	.B do\-not\-query\-address: \fI<IP address>
	Do not query the given IP address. Can be IP4 or IP6. Append /num to
	indicate a classless delegation netblock, for example like
	10.2.3.4/24 or 2001::11/64.
	.TP
	.B do\-not\-query\-localhost: \fI<yes or no>
	If yes, localhost is added to the do\-not\-query\-address entries, both
	IP6 ::1 and IP4 127.0.0.1/8. If no, then localhost can be used to send
	queries to. Default is yes.
	.TP
	.B prefetch: \fI<yes or no>
	If yes, message cache elements are prefetched before they expire to
	keep the cache up to date. Default is no. Turning it on gives about
	10 percent more traffic and load on the machine, but popular items do
	not expire from the cache.
	.TP
	-.B prefetch-key: \fI<yes or no>
	+.B prefetch\-key: \fI<yes or no>
	If yes, fetch the DNSKEYs earlier in the validation process, when a DS
	record is encountered. This lowers the latency of requests. It does use
	a little more CPU. Also if the cache is set to 0, it is no use. Default is no.
	.TP
	-.B rrset-roundrobin: \fI<yes or no>
	+.B deny\-any: \fI<yes or no>
	+If yes, deny queries of type ANY with an empty response. Default is no.
	+If disabled, unbound responds with a short list of resource records if some
	+can be found in the cache and makes the upstream type ANY query if there
	+are none.
	+.TP
	+.B rrset\-roundrobin: \fI<yes or no>
	If yes, Unbound rotates RRSet order in response (the random number is taken
	from the query ID, for speed and thread safety). Default is no.
	.TP
	.B minimal-responses: \fI<yes or no>
	If yes, Unbound doesn't insert authority/additional sections into response
	messages when those sections are not required. This reduces response
	size significantly, and may avoid TCP fallback for some responses.
	This may cause a slight speedup. The default is yes, even though the DNS
	protocol RFCs mandate these sections, and the additional content could
	be of use and save roundtrips for clients. Because they are not used,
	and the saved roundtrips are easier saved with prefetch, whilst this is
	faster.
	.TP
	.B disable-dnssec-lame-check: \fI<yes or no>
	If true, disables the DNSSEC lameness check in the iterator. This check
	sees if RRSIGs are present in the answer, when dnssec is expected,
	and retries another authority if RRSIGs are unexpectedly missing.
	The validator will insist in RRSIGs for DNSSEC signed domains regardless
	of this setting, if a trust anchor is loaded.
	.TP
	.B module\-config: \fI<"module names">
	Module configuration, a list of module names separated by spaces, surround
	the string with quotes (""). The modules can be validator, iterator.
	Setting this to "iterator" will result in a non\-validating server.
	Setting this to "validator iterator" will turn on DNSSEC validation.
	The ordering of the modules is important.
	You must also set trust\-anchors for validation to be useful.
	+The default is "validator iterator". When the server is built with
	+EDNS client subnet support the default is "subnetcache validator iterator".
	+Most modules that need to be listed here have to be listed at the beginning
	+of the line. The cachedb module has to be listed just before the iterator.
	+The python module can be listed in different places, it then processes the
	+output of the module it is just before.
	.TP
	.B trust\-anchor\-file: \fI<filename>
	File with trusted keys for validation. Both DS and DNSKEY entries can appear
	in the file. The format of the file is the standard DNS Zone file format.
	Default is "", or no trust anchor file.
	.TP
	.B auto\-trust\-anchor\-file: \fI<filename>
	File with trust anchor for one zone, which is tracked with RFC5011 probes.
	The probes are several times per month, thus the machine must be online
	frequently. The initial file can be one with contents as described in
	\fBtrust\-anchor\-file\fR. The file is written to when the anchor is updated,
	so the unbound user must have write permission. Write permission to the file,
	but also to the directory it is in (to create a temporary file, which is
	necessary to deal with filesystem full events), it must also be inside the
	chroot (if that is used).
	.TP
	.B trust\-anchor: \fI<"Resource Record">
	A DS or DNSKEY RR for a key to use for validation. Multiple entries can be
	given to specify multiple trusted keys, in addition to the trust\-anchor\-files.
	The resource record is entered in the same format as 'dig' or 'drill' prints
	them, the same format as in the zone file. Has to be on a single line, with
	"" around it. A TTL can be specified for ease of cut and paste, but is ignored.
	A class can be specified, but class IN is default.
	.TP
	.B trusted\-keys\-file: \fI<filename>
	File with trusted keys for validation. Specify more than one file
	with several entries, one file per entry. Like \fBtrust\-anchor\-file\fR
	but has a different file format. Format is BIND\-9 style format,
	the trusted\-keys { name flag proto algo "key"; }; clauses are read.
	It is possible to use wildcards with this statement, the wildcard is
	expanded on start and on reload.
	.TP
	.B trust\-anchor\-signaling: \fI<yes or no>
	Send RFC8145 key tag query after trust anchor priming. Default is on.
	.TP
	.B root\-key\-sentinel: \fI<yes or no>
	Root key trust anchor sentinel. Default is on.
	.TP
	.B dlv\-anchor\-file: \fI<filename>
	This option was used during early days DNSSEC deployment when no parent-side
	DS record registrations were easily available. Nowadays, it is best to have
	DS records registered with the parent zone (many top level zones are signed).
	File with trusted keys for DLV (DNSSEC Lookaside Validation). Both DS and
	DNSKEY entries can be used in the file, in the same format as for
	\fItrust\-anchor\-file:\fR statements. Only one DLV can be configured, more
	would be slow. The DLV configured is used as a root trusted DLV, this
	means that it is a lookaside for the root. Default is "", or no dlv anchor
	file. DLV is going to be decommissioned. Please do not use it any more.
	.TP
	.B dlv\-anchor: \fI<"Resource Record">
	Much like trust\-anchor, this is a DLV anchor with the DS or DNSKEY inline.
	DLV is going to be decommissioned. Please do not use it any more.
	.TP
	.B domain\-insecure: \fI<domain name>
	Sets domain name to be insecure, DNSSEC chain of trust is ignored towards
	the domain name. So a trust anchor above the domain name can not make the
	domain secure with a DS record, such a DS record is then ignored.
	Also keys from DLV are ignored for the domain. Can be given multiple times
	to specify multiple domains that are treated as if unsigned. If you set
	trust anchors for the domain they override this setting (and the domain
	is secured).
	.IP
	This can be useful if you want to make sure a trust anchor for external
	lookups does not affect an (unsigned) internal domain. A DS record
	externally can create validation failures for that internal domain.
	.TP
	.B val\-override\-date: \fI<rrsig\-style date spec>
	Default is "" or "0", which disables this debugging feature. If enabled by
	giving a RRSIG style date, that date is used for verifying RRSIG inception
	and expiration dates, instead of the current date. Do not set this unless
	you are debugging signature inception and expiration. The value \-1 ignores
	the date altogether, useful for some special applications.
	.TP
	.B val\-sig\-skew\-min: \fI<seconds>
	Minimum number of seconds of clock skew to apply to validated signatures.
	A value of 10% of the signature lifetime (expiration \- inception) is
	used, capped by this setting. Default is 3600 (1 hour) which allows for
	daylight savings differences. Lower this value for more strict checking
	of short lived signatures.
	.TP
	.B val\-sig\-skew\-max: \fI<seconds>
	Maximum number of seconds of clock skew to apply to validated signatures.
	A value of 10% of the signature lifetime (expiration \- inception)
	is used, capped by this setting. Default is 86400 (24 hours) which
	allows for timezone setting problems in stable domains. Setting both
	min and max very low disables the clock skew allowances. Setting both
	min and max very high makes the validator check the signature timestamps
	less strictly.
	.TP
	.B val\-bogus\-ttl: \fI<number>
	The time to live for bogus data. This is data that has failed validation;
	due to invalid signatures or other checks. The TTL from that data cannot be
	trusted, and this value is used instead. The value is in seconds, default 60.
	The time interval prevents repeated revalidation of bogus data.
	.TP
	.B val\-clean\-additional: \fI<yes or no>
	Instruct the validator to remove data from the additional section of secure
	messages that are not signed properly. Messages that are insecure, bogus,
	indeterminate or unchecked are not affected. Default is yes. Use this setting
	to protect the users that rely on this validator for authentication from
	potentially bad data in the additional section.
	.TP
	.B val\-log\-level: \fI<number>
	Have the validator print validation failures to the log. Regardless of
	the verbosity setting. Default is 0, off. At 1, for every user query
	that fails a line is printed to the logs. This way you can monitor what
	happens with validation. Use a diagnosis tool, such as dig or drill,
	to find out why validation is failing for these queries. At 2, not only
	the query that failed is printed but also the reason why unbound thought
	it was wrong and which server sent the faulty data.
	.TP
	.B val\-permissive\-mode: \fI<yes or no>
	Instruct the validator to mark bogus messages as indeterminate. The security
	checks are performed, but if the result is bogus (failed security), the
	reply is not withheld from the client with SERVFAIL as usual. The client
	receives the bogus data. For messages that are found to be secure the AD bit
	is set in replies. Also logging is performed as for full validation.
	The default value is "no".
	.TP
	.B ignore\-cd\-flag: \fI<yes or no>
	Instruct unbound to ignore the CD flag from clients and refuse to
	return bogus answers to them. Thus, the CD (Checking Disabled) flag
	does not disable checking any more. This is useful if legacy (w2008)
	servers that set the CD flag but cannot validate DNSSEC themselves are
	the clients, and then unbound provides them with DNSSEC protection.
	The default value is "no".
	.TP
	.B serve\-expired: \fI<yes or no>
	If enabled, unbound attempts to serve old responses from cache with a
	TTL of 0 in the response without waiting for the actual resolution to finish.
	The actual resolution answer ends up in the cache later on. Default is "no".
	.TP
	.B serve\-expired\-ttl: \fI<seconds>
	Limit serving of expired responses to configured seconds after expiration. 0
	disables the limit. This option only applies when \fBserve\-expired\fR is
	enabled. The default is 0.
	.TP
	.B serve\-expired\-ttl\-reset: \fI<yes or no>
	Set the TTL of expired records to the \fBserve\-expired\-ttl\fR value after a
	failed attempt to retrieve the record from upstream. This makes sure that the
	expired records will be served as long as there are queries for it. Default is
	"no".
	.TP
	.B val\-nsec3\-keysize\-iterations: \fI<"list of values">
	List of keysize and iteration count values, separated by spaces, surrounded
	by quotes. Default is "1024 150 2048 500 4096 2500". This determines the
	maximum allowed NSEC3 iteration count before a message is simply marked
	insecure instead of performing the many hashing iterations. The list must
	be in ascending order and have at least one entry. If you set it to
	"1024 65535" there is no restriction to NSEC3 iteration values.
	This table must be kept short; a very long list could cause slower operation.
	.TP
	.B add\-holddown: \fI<seconds>
	Instruct the \fBauto\-trust\-anchor\-file\fR probe mechanism for RFC5011
	autotrust updates to add new trust anchors only after they have been
	visible for this time. Default is 30 days as per the RFC.
	.TP
	.B del\-holddown: \fI<seconds>
	Instruct the \fBauto\-trust\-anchor\-file\fR probe mechanism for RFC5011
	autotrust updates to remove revoked trust anchors after they have been
	kept in the revoked list for this long. Default is 30 days as per
	the RFC.
	.TP
	.B keep\-missing: \fI<seconds>
	Instruct the \fBauto\-trust\-anchor\-file\fR probe mechanism for RFC5011
	autotrust updates to remove missing trust anchors after they have been
	unseen for this long. This cleans up the state file if the target zone
	does not perform trust anchor revocation, so this makes the auto probe
	mechanism work with zones that perform regular (non\-5011) rollovers.
	The default is 366 days. The value 0 does not remove missing anchors,
	as per the RFC.
	.TP
	.B permit\-small\-holddown: \fI<yes or no>
	Debug option that allows the autotrust 5011 rollover timers to assume
	very small values. Default is no.
	.TP
	.B key\-cache\-size: \fI<number>
	Number of bytes size of the key cache. Default is 4 megabytes.
	A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
	or gigabytes (1024*1024 bytes in a megabyte).
	.TP
	.B key\-cache\-slabs: \fI<number>
	Number of slabs in the key cache. Slabs reduce lock contention by threads.
	Must be set to a power of 2. Setting (close) to the number of cpus is a
	reasonable guess.
	.TP
	.B neg\-cache\-size: \fI<number>
	Number of bytes size of the aggressive negative cache. Default is 1 megabyte.
	A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
	or gigabytes (1024*1024 bytes in a megabyte).
	.TP
	.B unblock\-lan\-zones: \fI<yes or no>
	Default is disabled. If enabled, then for private address space,
	the reverse lookups are no longer filtered. This allows unbound when
	running as dns service on a host where it provides service for that host,
	to put out all of the queries for the 'lan' upstream. When enabled,
	only localhost, 127.0.0.1 reverse and ::1 reverse zones are configured
	with default local zones. Disable the option when unbound is running
	as a (DHCP-) DNS network resolver for a group of machines, where such
	lookups should be filtered (RFC compliance), this also stops potential
	data leakage about the local network to the upstream DNS servers.
	.TP
	.B insecure\-lan\-zones: \fI<yes or no>
	Default is disabled. If enabled, then reverse lookups in private
	address space are not validated. This is usually required whenever
	\fIunblock\-lan\-zones\fR is used.
	.TP
	.B local\-zone: \fI<zone> <type>
	Configure a local zone. The type determines the answer to give if
	there is no match from local\-data. The types are deny, refuse, static,
	transparent, redirect, nodefault, typetransparent, inform, inform_deny,
	-always_transparent, always_refuse, always_nxdomain, noview,
	+inform_redirect, always_transparent, always_refuse, always_nxdomain, noview,
	and are explained below. After that the default settings are listed. Use
	local\-data: to enter data into the local zone. Answers for local zones
	are authoritative DNS answers. By default the zones are class IN.
	.IP
	If you need more complicated authoritative data, with referrals, wildcards,
	CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for
	it as detailed in the stub zone section below.
	.TP 10
	\h'5'\fIdeny\fR
	Do not send an answer, drop the query.
	If there is a match from local data, the query is answered.
	.TP 10
	\h'5'\fIrefuse\fR
	Send an error message reply, with rcode REFUSED.
	If there is a match from local data, the query is answered.
	.TP 10
	\h'5'\fIstatic\fR
	If there is a match from local data, the query is answered.
	Otherwise, the query is answered with nodata or nxdomain.
	For a negative answer a SOA is included in the answer if present
	as local\-data for the zone apex domain.
	.TP 10
	\h'5'\fItransparent\fR
	If there is a match from local data, the query is answered.
	Otherwise if the query has a different name, the query is resolved normally.
	If the query is for a name given in localdata but no such type of data is
	given in localdata, then a noerror nodata answer is returned.
	If no local\-zone is given local\-data causes a transparent zone
	to be created by default.
	.TP 10
	\h'5'\fItypetransparent\fR
	If there is a match from local data, the query is answered. If the query
	is for a different name, or for the same name but for a different type,
	the query is resolved normally. So, similar to transparent but types
	that are not listed in local data are resolved normally, so if an A record
	is in the local data that does not cause a nodata reply for AAAA queries.
	.TP 10
	\h'5'\fIredirect\fR
	The query is answered from the local data for the zone name.
	There may be no local data beneath the zone name.
	This answers queries for the zone, and all subdomains of the zone
	with the local data for the zone.
	It can be used to redirect a domain to return a different address record
	to the end user, with
	local\-zone: "example.com." redirect and
	local\-data: "example.com. A 127.0.0.1"
	queries for www.example.com and www.foo.example.com are redirected, so
	that users with web browsers cannot access sites with suffix example.com.
	.TP 10
	\h'5'\fIinform\fR
	The query is answered normally, same as transparent. The client IP
	address (@portnumber) is printed to the logfile. The log message is:
	timestamp, unbound-pid, info: zonename inform IP@port queryname type
	class. This option can be used for normal resolution, but machines
	looking up infected names are logged, eg. to run antivirus on them.
	.TP 10
	\h'5'\fIinform_deny\fR
	The query is dropped, like 'deny', and logged, like 'inform'. Ie. find
	infected machines without answering the queries.
	.TP 10
	+\h'5'\fIinform_redirect\fR
	+The query is redirected, like 'redirect', and logged, like 'inform'.
	+Ie. answer queries with fixed data and also log the machines that ask.
	+.TP 10
	\h'5'\fIalways_transparent\fR
	Like transparent, but ignores local data and resolves normally.
	.TP 10
	\h'5'\fIalways_refuse\fR
	Like refuse, but ignores local data and refuses the query.
	.TP 10
	\h'5'\fIalways_nxdomain\fR
	Like static, but ignores local data and returns nxdomain for the query.
	.TP 10
	\h'5'\fInoview\fR
	Breaks out of that view and moves towards the global local zones for answer
	to the query. If the view first is no, it'll resolve normally. If view first
	is enabled, it'll break perform that step and check the global answers.
	For when the view has view specific overrides but some zone has to be
	answered from global local zone contents.
	.TP 10
	\h'5'\fInodefault\fR
	Used to turn off default contents for AS112 zones. The other types
	also turn off default contents for the zone. The 'nodefault' option
	has no other effect than turning off default contents for the
	given zone. Use \fInodefault\fR if you use exactly that zone, if you want to
	use a subzone, use \fItransparent\fR.
	.P
	The default zones are localhost, reverse 127.0.0.1 and ::1, the onion, test,
	invalid and the AS112 zones. The AS112 zones are reverse DNS zones for
	private use and reserved IP addresses for which the servers on the internet
	cannot provide correct answers. They are configured by default to give
	nxdomain (no reverse information) answers. The defaults can be turned off
	by specifying your own local\-zone of that name, or using the 'nodefault'
	type. Below is a list of the default zone contents.
	.TP 10
	\h'5'\fIlocalhost\fR
	The IP4 and IP6 localhost information is given. NS and SOA records are provided
	for completeness and to satisfy some DNS update tools. Default content:
	.nf
	local\-zone: "localhost." redirect
	local\-data: "localhost. 10800 IN NS localhost."
	local\-data: "localhost. 10800 IN
	SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
	local\-data: "localhost. 10800 IN A 127.0.0.1"
	local\-data: "localhost. 10800 IN AAAA ::1"
	.fi
	.TP 10
	\h'5'\fIreverse IPv4 loopback\fR
	Default content:
	.nf
	local\-zone: "127.in\-addr.arpa." static
	local\-data: "127.in\-addr.arpa. 10800 IN NS localhost."
	local\-data: "127.in\-addr.arpa. 10800 IN
	SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
	local\-data: "1.0.0.127.in\-addr.arpa. 10800 IN
	PTR localhost."
	.fi
	.TP 10
	\h'5'\fIreverse IPv6 loopback\fR
	Default content:
	.nf
	local\-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
	0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." static
	local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
	0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN
	NS localhost."
	local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
	0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN
	SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
	local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
	0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN
	PTR localhost."
	.fi
	.TP 10
	\h'5'\fIonion (RFC 7686)\fR
	Default content:
	.nf
	local\-zone: "onion." static
	local\-data: "onion. 10800 IN NS localhost."
	local\-data: "onion. 10800 IN
	SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
	.fi
	.TP 10
	\h'5'\fItest (RFC 2606)\fR
	Default content:
	.nf
	local\-zone: "test." static
	local\-data: "test. 10800 IN NS localhost."
	local\-data: "test. 10800 IN
	SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
	.fi
	.TP 10
	\h'5'\fIinvalid (RFC 2606)\fR
	Default content:
	.nf
	local\-zone: "invalid." static
	local\-data: "invalid. 10800 IN NS localhost."
	local\-data: "invalid. 10800 IN
	SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
	.fi
	.TP 10
	\h'5'\fIreverse RFC1918 local use zones\fR
	Reverse data for zones 10.in\-addr.arpa, 16.172.in\-addr.arpa to
	31.172.in\-addr.arpa, 168.192.in\-addr.arpa.
	The \fBlocal\-zone:\fR is set static and as \fBlocal\-data:\fR SOA and NS
	records are provided.
	.TP 10
	\h'5'\fIreverse RFC3330 IP4 this, link\-local, testnet and broadcast\fR
	Reverse data for zones 0.in\-addr.arpa, 254.169.in\-addr.arpa,
	2.0.192.in\-addr.arpa (TEST NET 1), 100.51.198.in\-addr.arpa (TEST NET 2),
	113.0.203.in\-addr.arpa (TEST NET 3), 255.255.255.255.in\-addr.arpa.
	And from 64.100.in\-addr.arpa to 127.100.in\-addr.arpa (Shared Address Space).
	.TP 10
	\h'5'\fIreverse RFC4291 IP6 unspecified\fR
	Reverse data for zone
	.nf
	0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
	0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.
	.fi
	.TP 10
	\h'5'\fIreverse RFC4193 IPv6 Locally Assigned Local Addresses\fR
	Reverse data for zone D.F.ip6.arpa.
	.TP 10
	\h'5'\fIreverse RFC4291 IPv6 Link Local Addresses\fR
	Reverse data for zones 8.E.F.ip6.arpa to B.E.F.ip6.arpa.
	.TP 10
	\h'5'\fIreverse IPv6 Example Prefix\fR
	Reverse data for zone 8.B.D.0.1.0.0.2.ip6.arpa. This zone is used for
	tutorials and examples. You can remove the block on this zone with:
	.nf
	local\-zone: 8.B.D.0.1.0.0.2.ip6.arpa. nodefault
	.fi
	You can also selectively unblock a part of the zone by making that part
	transparent with a local\-zone statement.
	This also works with the other default zones.
	.\" End of local-zone listing.
	.TP 5
	.B local\-data: \fI"<resource record string>"
	Configure local data, which is served in reply to queries for it.
	The query has to match exactly unless you configure the local\-zone as
	redirect. If not matched exactly, the local\-zone type determines
	further processing. If local\-data is configured that is not a subdomain of
	a local\-zone, a transparent local\-zone is configured.
	For record types such as TXT, use single quotes, as in
	local\-data: 'example. TXT "text"'.
	.IP
	If you need more complicated authoritative data, with referrals, wildcards,
	CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for
	it as detailed in the stub zone section below.
	.TP 5
	.B local\-data\-ptr: \fI"IPaddr name"
	Configure local data shorthand for a PTR record with the reversed IPv4 or
	IPv6 address and the host name. For example "192.0.2.4 www.example.com".
	TTL can be inserted like this: "2001:DB8::4 7200 www.example.com"
	.TP 5
	.B local\-zone\-tag: \fI<zone> <"list of tags">
	Assign tags to localzones. Tagged localzones will only be applied when the
	used access-control element has a matching tag. Tags must be defined in
	\fIdefine\-tags\fR. Enclose list of tags in quotes ("") and put spaces between
	-tags.
	+tags. When there are multiple tags it checks if the intersection of the
	+list of tags for the query and local\-zone\-tag is non-empty.
	.TP 5
	.B local\-zone\-override: \fI<zone> <IP netblock> <type>
	Override the localzone type for queries from addresses matching netblock.
	Use this localzone type, regardless the type configured for the local-zone
	(both tagged and untagged) and regardless the type configured using
	access\-control\-tag\-action.
	.TP 5
	.B ratelimit: \fI<number or 0>
	Enable ratelimiting of queries sent to nameserver for performing recursion.
	If 0, the default, it is disabled. This option is experimental at this time.
	The ratelimit is in queries per second that are allowed. More queries are
	turned away with an error (servfail). This stops recursive floods, eg. random
	query names, but not spoofed reflection floods. Cached responses are not
	ratelimited by this setting. The zone of the query is determined by examining
	the nameservers for it, the zone name is used to keep track of the rate.
	For example, 1000 may be a suitable value to stop the server from being
	overloaded with random names, and keeps unbound from sending traffic to the
	nameservers for those zones.
	.TP 5
	.B ratelimit\-size: \fI<memory size>
	Give the size of the data structure in which the current ongoing rates are
	kept track in. Default 4m. In bytes or use m(mega), k(kilo), g(giga).
	The ratelimit structure is small, so this data structure likely does
	not need to be large.
	.TP 5
	.B ratelimit\-slabs: \fI<number>
	Give power of 2 number of slabs, this is used to reduce lock contention
	in the ratelimit tracking data structure. Close to the number of cpus is
	a fairly good setting.
	.TP 5
	.B ratelimit\-factor: \fI<number>
	Set the amount of queries to rate limit when the limit is exceeded.
	If set to 0, all queries are dropped for domains where the limit is
	exceeded. If set to another value, 1 in that number is allowed through
	to complete. Default is 10, allowing 1/10 traffic to flow normally.
	This can make ordinary queries complete (if repeatedly queried for),
	and enter the cache, whilst also mitigating the traffic flow by the
	factor given.
	.TP 5
	.B ratelimit\-for\-domain: \fI<domain> <number qps or 0>
	Override the global ratelimit for an exact match domain name with the listed
	number. You can give this for any number of names. For example, for
	a top\-level\-domain you may want to have a higher limit than other names.
	A value of 0 will disable ratelimiting for that domain.
	.TP 5
	.B ratelimit\-below\-domain: \fI<domain> <number qps or 0>
	Override the global ratelimit for a domain name that ends in this name.
	You can give this multiple times, it then describes different settings
	in different parts of the namespace. The closest matching suffix is used
	to determine the qps limit. The rate for the exact matching domain name
	is not changed, use ratelimit\-for\-domain to set that, you might want
	to use different settings for a top\-level\-domain and subdomains.
	A value of 0 will disable ratelimiting for domain names that end in this name.
	.TP 5
	.B ip\-ratelimit: \fI<number or 0>
	Enable global ratelimiting of queries accepted per ip address.
	If 0, the default, it is disabled. This option is experimental at this time.
	The ratelimit is in queries per second that are allowed. More queries are
	completely dropped and will not receive a reply, SERVFAIL or otherwise.
	IP ratelimiting happens before looking in the cache. This may be useful for
	mitigating amplification attacks.
	.TP 5
	.B ip\-ratelimit\-size: \fI<memory size>
	Give the size of the data structure in which the current ongoing rates are
	kept track in. Default 4m. In bytes or use m(mega), k(kilo), g(giga).
	The ip ratelimit structure is small, so this data structure likely does
	not need to be large.
	.TP 5
	.B ip\-ratelimit\-slabs: \fI<number>
	Give power of 2 number of slabs, this is used to reduce lock contention
	in the ip ratelimit tracking data structure. Close to the number of cpus is
	a fairly good setting.
	.TP 5
	.B ip\-ratelimit\-factor: \fI<number>
	Set the amount of queries to rate limit when the limit is exceeded.
	If set to 0, all queries are dropped for addresses where the limit is
	exceeded. If set to another value, 1 in that number is allowed through
	to complete. Default is 10, allowing 1/10 traffic to flow normally.
	This can make ordinary queries complete (if repeatedly queried for),
	and enter the cache, whilst also mitigating the traffic flow by the
	factor given.
	.TP 5
	-.B low\-rtt: \fI<msec time>
	-Set the time in millisecond that is considere a low ping time for fast
	-server selection with the low\-rtt\-permil option, that turns this on or off.
	-The default is 45 msec, a number from IPv6 quick response documents.
	+.B fast\-server\-permil: \fI<number>
	+Specify how many times out of 1000 to pick from the set of fastest servers.
	+0 turns the feature off. A value of 900 would pick from the fastest
	+servers 90 percent of the time, and would perform normal exploration of random
	+servers for the remaining time. When prefetch is enabled (or serve\-expired),
	+such prefetches are not sped up, because there is no one waiting for it, and it
	+presents a good moment to perform server exploration. The
	+\fBfast\-server\-num\fR option can be used to specify the size of the fastest
	+servers set. The default for fast\-server\-permil is 0.
	.TP 5
	-.B low\-rtt\-permil: \fI<number>
	-Specify how many times out of 1000 to pick the fast server from the low
	-rtt band. 0 turns the feature off. A value of 900 would pick the fast
	-server when such fast servers are available 90 percent of the time, and
	-the remaining time perform normal exploration of random servers.
	-When prefetch is enabled (or serve\-expired), such prefetches are not
	-sped up, because there is no one waiting for it, and it presents a good
	-moment to perform server exploration. The low\-rtt option can be used
	-to specify which servers are picked for fast server selection, servers
	-with a ping roundtrip time below that value are considered.
	-The default for low\-rtt\-permil is 0.
	+.B fast\-server\-num: \fI<number>
	+Set the number of servers that should be used for fast server selection. Only
	+use the fastest specified number of servers with the fast\-server\-permil
	+option, that turns this on or off. The default is to use the fastest 3 servers.
	.SS "Remote Control Options"
	In the
	.B remote\-control:
	clause are the declarations for the remote control facility. If this is
	enabled, the \fIunbound\-control\fR(8) utility can be used to send
	commands to the running unbound server. The server uses these clauses
	to setup TLSv1 security for the connection. The
	\fIunbound\-control\fR(8) utility also reads the \fBremote\-control\fR
	section for options. To setup the correct self\-signed certificates use the
	\fIunbound\-control\-setup\fR(8) utility.
	.TP 5
	.B control\-enable: \fI<yes or no>
	The option is used to enable remote control, default is "no".
	If turned off, the server does not listen for control commands.
	.TP 5
	.B control\-interface: \fI<ip address or path>
	Give IPv4 or IPv6 addresses or local socket path to listen on for
	control commands.
	By default localhost (127.0.0.1 and ::1) is listened to.
	Use 0.0.0.0 and ::0 to listen to all interfaces.
	If you change this and permissions have been dropped, you must restart
	the server for the change to take effect.
	.IP
	If you set it to an absolute path, a local socket is used. The local socket
	does not use the certificates and keys, so those files need not be present.
	To restrict access, unbound sets permissions on the file to the user and
	group that is configured, the access bits are set to allow the group members
	to access the control socket file. Put users that need to access the socket
	in the that group. To restrict access further, create a directory to put
	the control socket in and restrict access to that directory.
	.TP 5
	.B control\-port: \fI<port number>
	The port number to listen on for IPv4 or IPv6 control interfaces,
	default is 8953.
	If you change this and permissions have been dropped, you must restart
	the server for the change to take effect.
	.TP 5
	.B control\-use\-cert: \fI<yes or no>
	For localhost control-interface you can disable the use of TLS by setting
	this option to "no", default is "yes". For local sockets, TLS is disabled
	and the value of this option is ignored.
	.TP 5
	.B server\-key\-file: \fI<private key file>
	Path to the server private key, by default unbound_server.key.
	This file is generated by the \fIunbound\-control\-setup\fR utility.
	This file is used by the unbound server, but not by \fIunbound\-control\fR.
	.TP 5
	.B server\-cert\-file: \fI<certificate file.pem>
	Path to the server self signed certificate, by default unbound_server.pem.
	This file is generated by the \fIunbound\-control\-setup\fR utility.
	This file is used by the unbound server, and also by \fIunbound\-control\fR.
	.TP 5
	.B control\-key\-file: \fI<private key file>
	Path to the control client private key, by default unbound_control.key.
	This file is generated by the \fIunbound\-control\-setup\fR utility.
	This file is used by \fIunbound\-control\fR.
	.TP 5
	.B control\-cert\-file: \fI<certificate file.pem>
	Path to the control client certificate, by default unbound_control.pem.
	This certificate has to be signed with the server certificate.
	This file is generated by the \fIunbound\-control\-setup\fR utility.
	This file is used by \fIunbound\-control\fR.
	.SS "Stub Zone Options"
	.LP
	There may be multiple
	.B stub\-zone:
	clauses. Each with a name: and zero or more hostnames or IP addresses.
	For the stub zone this list of nameservers is used. Class IN is assumed.
	The servers should be authority servers, not recursors; unbound performs
	the recursive processing itself for stub zones.
	.P
	The stub zone can be used to configure authoritative data to be used
	by the resolver that cannot be accessed using the public internet servers.
	This is useful for company\-local data or private zones. Setup an
	authoritative server on a different host (or different port). Enter a config
	entry for unbound with
	.B stub\-addr:
	<ip address of host[@port]>.
	The unbound resolver can then access the data, without referring to the
	public internet for it.
	.P
	This setup allows DNSSEC signed zones to be served by that
	authoritative server, in which case a trusted key entry with the public key
	can be put in config, so that unbound can validate the data and set the AD
	bit on replies for the private zone (authoritative servers do not set the
	AD bit). This setup makes unbound capable of answering queries for the
	private zone, and can even set the AD bit ('authentic'), but the AA
	('authoritative') bit is not set on these replies.
	.P
	Consider adding \fBserver:\fR statements for \fBdomain\-insecure:\fR and
	for \fBlocal\-zone:\fI name nodefault\fR for the zone if it is a locally
	served zone. The insecure clause stops DNSSEC from invalidating the
	zone. The local zone nodefault (or \fItransparent\fR) clause makes the
	(reverse\-) zone bypass unbound's filtering of RFC1918 zones.
	.TP
	.B name: \fI<domain name>
	Name of the stub zone.
	.TP
	.B stub\-host: \fI<domain name>
	Name of stub zone nameserver. Is itself resolved before it is used.
	.TP
	.B stub\-addr: \fI<IP address>
	IP address of stub zone nameserver. Can be IP 4 or IP 6.
	To use a nondefault port for DNS communication append '@' with the port number.
	.TP
	.B stub\-prime: \fI<yes or no>
	This option is by default no. If enabled it performs NS set priming,
	which is similar to root hints, where it starts using the list of nameservers
	currently published by the zone. Thus, if the hint list is slightly outdated,
	the resolver picks up a correct list online.
	.TP
	.B stub\-first: \fI<yes or no>
	If enabled, a query is attempted without the stub clause if it fails.
	The data could not be retrieved and would have caused SERVFAIL because
	the servers are unreachable, instead it is tried without this clause.
	The default is no.
	.TP
	.B stub\-tls\-upstream: \fI<yes or no>
	Enabled or disable whether the queries to this stub use TLS for transport.
	Default is no.
	.TP
	.B stub\-ssl\-upstream: \fI<yes or no>
	Alternate syntax for \fBstub\-tls\-upstream\fR.
	.TP
	.B stub\-no\-cache: \fI<yes or no>
	Default is no. If enabled, data inside the stub is not cached. This is
	useful when you want immediate changes to be visible.
	.SS "Forward Zone Options"
	.LP
	There may be multiple
	.B forward\-zone:
	clauses. Each with a \fBname:\fR and zero or more hostnames or IP
	addresses. For the forward zone this list of nameservers is used to
	forward the queries to. The servers listed as \fBforward\-host:\fR and
	\fBforward\-addr:\fR have to handle further recursion for the query. Thus,
	those servers are not authority servers, but are (just like unbound is)
	recursive servers too; unbound does not perform recursion itself for the
	forward zone, it lets the remote server do it. Class IN is assumed.
	CNAMEs are chased by unbound itself, asking the remote server for every
	name in the indirection chain, to protect the local cache from illegal
	indirect referenced items.
	A forward\-zone entry with name "." and a forward\-addr target will
	forward all queries to that other server (unless it can answer from
	the cache).
	.TP
	.B name: \fI<domain name>
	Name of the forward zone.
	.TP
	.B forward\-host: \fI<domain name>
	Name of server to forward to. Is itself resolved before it is used.
	.TP
	.B forward\-addr: \fI<IP address>
	IP address of server to forward to. Can be IP 4 or IP 6.
	To use a nondefault port for DNS communication append '@' with the port number.
	If tls is enabled, then you can append a '#' and a name, then it'll check
	the tls authentication certificates with that name. If you combine
	the '@' and '#', the '@' comes first.
	.IP
	At high verbosity it logs the TLS certificate, with TLS enabled.
	If you leave out the '#' and auth name from the forward\-addr, any
	name is accepted. The cert must also match a CA from the tls\-cert\-bundle.
	-The cert name match code needs OpenSSL 1.1.0 or later to be enabled.
	.TP
	.B forward\-first: \fI<yes or no>
	-If enabled, a query is attempted without the forward clause if it fails.
	-The data could not be retrieved and would have caused SERVFAIL because
	-the servers are unreachable, instead it is tried without this clause.
	-The default is no.
	+If a forwarded query is met with a SERVFAIL error, and this option is
	+enabled, unbound will fall back to normal recursive resolution for this
	+query as if no query forwarding had been specified. The default is "no".
	.TP
	.B forward\-tls\-upstream: \fI<yes or no>
	Enabled or disable whether the queries to this forwarder use TLS for transport.
	Default is no.
	If you enable this, also configure a tls\-cert\-bundle or use tls\-win\-cert to
	load CA certs, otherwise the connections cannot be authenticated.
	.TP
	.B forward\-ssl\-upstream: \fI<yes or no>
	Alternate syntax for \fBforward\-tls\-upstream\fR.
	.TP
	.B forward\-no\-cache: \fI<yes or no>
	Default is no. If enabled, data inside the forward is not cached. This is
	useful when you want immediate changes to be visible.
	.SS "Authority Zone Options"
	.LP
	Authority zones are configured with \fBauth\-zone:\fR, and each one must
	have a \fBname:\fR. There can be multiple ones, by listing multiple auth\-zone clauses, each with a different name, pertaining to that part of the namespace.
	The authority zone with the name closest to the name looked up is used.
	Authority zones are processed after \fBlocal\-zones\fR and before
	cache (\fBfor\-downstream:\fR \fIyes\fR), and when used in this manner
	make unbound respond like an authority server. Authority zones are also
	processed after cache, just before going to the network to fetch
	information for recursion (\fBfor\-upstream:\fR \fIyes\fR), and when used
	in this manner provide a local copy of an authority server that speeds up
	lookups of that data.
	.LP
	Authority zones can be read from zonefile. And can be kept updated via
	AXFR and IXFR. After update the zonefile is rewritten. The update mechanism
	uses the SOA timer values and performs SOA UDP queries to detect zone changes.
	+.LP
	+If the update fetch fails, the timers in the SOA record are used to time
	+another fetch attempt. Until the SOA expiry timer is reached. Then the
	+zone is expired. When a zone is expired, queries are SERVFAIL, and
	+any new serial number is accepted from the master (even if older), and if
	+fallback is enabled, the fallback activates to fetch from the upstream instead
	+of the SERVFAIL.
	.TP
	.B name: \fI<zone name>
	Name of the authority zone.
	.TP
	.B master: \fI<IP address or host name>
	Where to download a copy of the zone from, with AXFR and IXFR. Multiple
	masters can be specified. They are all tried if one fails.
	+With the "ip#name" notation a AXFR over TLS can be used.
	.TP
	.B url: \fI<url to zonefile>
	Where to download a zonefile for the zone. With http or https. An example
	for the url is "http://www.example.com/example.org.zone". Multiple url
	statements can be given, they are tried in turn. If only urls are given
	the SOA refresh timer is used to wait for making new downloads. If also
	masters are listed, the masters are first probed with UDP SOA queries to
	see if the SOA serial number has changed, reducing the number of downloads.
	If none of the urls work, the masters are tried with IXFR and AXFR.
	For https, the \fBtls\-cert\-bundle\fR and the hostname from the url are used
	to authenticate the connection.
	.TP
	.B allow\-notify: \fI<IP address or host name or netblockIP/prefix>
	With allow\-notify you can specify additional sources of notifies.
	When notified, the server attempts to first probe and then zone transfer.
	If the notify is from a master, it first attempts that master. Otherwise
	other masters are attempted. If there are no masters, but only urls, the
	file is downloaded when notified. The masters from master: statements are
	allowed notify by default.
	.TP
	.B fallback\-enabled: \fI<yes or no>
	Default no. If enabled, unbound falls back to querying the internet as
	a resolver for this zone when lookups fail. For example for DNSSEC
	validation failures.
	.TP
	.B for\-downstream: \fI<yes or no>
	Default yes. If enabled, unbound serves authority responses to
	downstream clients for this zone. This option makes unbound behave, for
	the queries with names in this zone, like one of the authority servers for
	that zone. Turn it off if you want unbound to provide recursion for the
	zone but have a local copy of zone data. If for\-downstream is no and
	for\-upstream is yes, then unbound will DNSSEC validate the contents of the
	zone before serving the zone contents to clients and store validation
	results in the cache.
	.TP
	.B for\-upstream: \fI<yes or no>
	Default yes. If enabled, unbound fetches data from this data collection
	for answering recursion queries. Instead of sending queries over the internet
	to the authority servers for this zone, it'll fetch the data directly from
	the zone data. Turn it on when you want unbound to provide recursion for
	downstream clients, and use the zone data as a local copy to speed up lookups.
	.TP
	.B zonefile: \fI<filename>
	The filename where the zone is stored. If not given then no zonefile is used.
	If the file does not exist or is empty, unbound will attempt to fetch zone
	data (eg. from the master servers).
	.SS "View Options"
	.LP
	There may be multiple
	.B view:
	clauses. Each with a \fBname:\fR and zero or more \fBlocal\-zone\fR and
	-\fBlocal\-data\fR elements. View can be mapped to requests by specifying the
	+\fBlocal\-data\fR elements. Views can also contain view\-first,
	+response\-ip, response\-ip\-data and local\-data\-ptr elements.
	+View can be mapped to requests by specifying the
	view name in an \fBaccess\-control\-view\fR element. Options from matching
	views will override global options. Global options will be used if no matching
	view is found, or when the matching view does not have the option specified.
	.TP
	.B name: \fI<view name>
	Name of the view. Must be unique. This name is used in access\-control\-view
	elements.
	.TP
	.B local\-zone: \fI<zone> <type>
	View specific local\-zone elements. Has the same types and behaviour as the
	global local\-zone elements. When there is at least one local\-zone specified
	and view\-first is no, the default local-zones will be added to this view.
	Defaults can be disabled using the nodefault type. When view\-first is yes or
	when a view does not have a local\-zone, the global local\-zone will be used
	including it's default zones.
	.TP
	.B local\-data: \fI"<resource record string>"
	View specific local\-data elements. Has the same behaviour as the global
	local\-data elements.
	.TP
	.B local\-data\-ptr: \fI"IPaddr name"
	View specific local\-data\-ptr elements. Has the same behaviour as the global
	local\-data\-ptr elements.
	.TP
	.B view\-first: \fI<yes or no>
	If enabled, it attempts to use the global local\-zone and local\-data if there
	is no match in the view specific options.
	The default is no.
	.SS "Python Module Options"
	.LP
	The
	.B python:
	clause gives the settings for the \fIpython\fR(1) script module. This module
	acts like the iterator and validator modules do, on queries and answers.
	To enable the script module it has to be compiled into the daemon,
	and the word "python" has to be put in the \fBmodule\-config:\fR option
	(usually first, or between the validator and iterator).
	.LP
	If the \fBchroot:\fR option is enabled, you should make sure Python's
	library directory structure is bind mounted in the new root environment, see
	\fImount\fR(8). Also the \fBpython\-script:\fR path should be specified as an
	absolute path relative to the new root, or as a relative path to the working
	directory.
	.TP
	.B python\-script: \fI<python file>\fR
	The script file to load.
	.SS "DNS64 Module Options"
	.LP
	The dns64 module must be configured in the \fBmodule\-config:\fR "dns64
	validator iterator" directive and be compiled into the daemon to be
	enabled. These settings go in the \fBserver:\fR section.
	.TP
	.B dns64\-prefix: \fI<IPv6 prefix>\fR
	This sets the DNS64 prefix to use to synthesize AAAA records with.
	It must be /96 or shorter. The default prefix is 64:ff9b::/96.
	.TP
	.B dns64\-synthall: \fI<yes or no>\fR
	Debug option, default no. If enabled, synthesize all AAAA records
	despite the presence of actual AAAA records.
	.TP
	.B dns64\-ignore\-aaaa: \fI<name>\fR
	List domain for which the AAAA records are ignored and the A record is
	used by dns64 processing instead. Can be entered multiple times, list a
	new domain for which it applies, one per line. Applies also to names
	underneath the name given.
	.SS "DNSCrypt Options"
	.LP
	The
	.B dnscrypt:
	clause gives the settings of the dnscrypt channel. While those options are
	available, they are only meaningful if unbound was compiled with
	\fB\-\-enable\-dnscrypt\fR.
	Currently certificate and secret/public keys cannot be generated by unbound.
	You can use dnscrypt-wrapper to generate those: https://github.com/cofyc/\
	dnscrypt-wrapper/blob/master/README.md#usage
	.TP
	.B dnscrypt\-enable: \fI<yes or no>\fR
	Whether or not the \fBdnscrypt\fR config should be enabled. You may define
	configuration but not activate it.
	The default is no.
	.TP
	.B dnscrypt\-port: \fI<port number>
	On which port should \fBdnscrypt\fR should be activated. Note that you should
	have a matching \fBinterface\fR option defined in the \fBserver\fR section for
	this port.
	.TP
	.B dnscrypt\-provider: \fI<provider name>\fR
	The provider name to use to distribute certificates. This is of the form:
	\fB2.dnscrypt-cert.example.com.\fR. The name \fIMUST\fR end with a dot.
	.TP
	.B dnscrypt\-secret\-key: \fI<path to secret key file>\fR
	Path to the time limited secret key file. This option may be specified multiple
	times.
	.TP
	.B dnscrypt\-provider\-cert: \fI<path to cert file>\fR
	Path to the certificate related to the \fBdnscrypt\-secret\-key\fRs.
	This option may be specified multiple times.
	.TP
	.B dnscrypt\-provider\-cert\-rotated: \fI<path to cert file>\fR
	Path to a certificate that we should be able to serve existing connection from
	but do not want to advertise over \fBdnscrypt\-provider\fR's TXT record certs
	distribution.
	A typical use case is when rotating certificates, existing clients may still use
	the client magic from the old cert in their queries until they fetch and update
	the new cert. Likewise, it would allow one to prime the new cert/key without
	distributing the new cert yet, this can be useful when using a network of
	servers using anycast and on which the configuration may not get updated at the
	exact same time. By priming the cert, the servers can handle both old and new
	certs traffic while distributing only one.
	This option may be specified multiple times.
	.TP
	.B dnscrypt\-shared\-secret\-cache\-size: \fI<memory size>
	Give the size of the data structure in which the shared secret keys are kept
	in. Default 4m. In bytes or use m(mega), k(kilo), g(giga).
	The shared secret cache is used when a same client is making multiple queries
	using the same public key. It saves a substantial amount of CPU.
	.TP
	.B dnscrypt\-shared\-secret\-cache\-slabs: \fI<number>
	Give power of 2 number of slabs, this is used to reduce lock contention
	in the dnscrypt shared secrets cache. Close to the number of cpus is
	a fairly good setting.
	.TP
	.B dnscrypt\-nonce\-cache\-size: \fI<memory size>
	Give the size of the data structure in which the client nonces are kept in.
	Default 4m. In bytes or use m(mega), k(kilo), g(giga).
	The nonce cache is used to prevent dnscrypt message replaying. Client nonce
	should be unique for any pair of client pk/server sk.
	.TP
	.B dnscrypt\-nonce\-cache\-slabs: \fI<number>
	Give power of 2 number of slabs, this is used to reduce lock contention
	in the dnscrypt nonce cache. Close to the number of cpus is
	a fairly good setting.
	.SS "EDNS Client Subnet Module Options"
	.LP
	The ECS module must be configured in the \fBmodule\-config:\fR "subnetcache
	validator iterator" directive and be compiled into the daemon to be
	enabled. These settings go in the \fBserver:\fR section.
	.LP
	If the destination address is whitelisted with Unbound will add the EDNS0
	option to the query containing the relevant part of the client's address. When
	an answer contains the ECS option the response and the option are placed in a
	specialized cache. If the authority indicated no support, the response is
	stored in the regular cache.
	.LP
	Additionally, when a client includes the option in its queries, Unbound will
	forward the option to the authority if present in the whitelist, or
	\fBclient\-subnet\-always\-forward\fR is set to yes. In this case the lookup in
	the regular cache is skipped.
	.LP
	The maximum size of the ECS cache is controlled by 'msg-cache-size' in the
	configuration file. On top of that, for each query only 100 different subnets
	are allowed to be stored for each address family. Exceeding that number, older
	entries will be purged from cache.
	.TP
	.B send\-client\-subnet: \fI<IP address>\fR
	Send client source address to this authority. Append /num to indicate a
	classless delegation netblock, for example like 10.2.3.4/24 or 2001::11/64. Can
	be given multiple times. Authorities not listed will not receive edns-subnet
	information, unless domain in query is specified in \fBclient\-subnet\-zone\fR.
	.TP
	.B client\-subnet\-zone: \fI<domain>\fR
	Send client source address in queries for this domain and its subdomains. Can be
	given multiple times. Zones not listed will not receive edns-subnet information,
	unless hosted by authority specified in \fBsend\-client\-subnet\fR.
	.TP
	.B client\-subnet\-always\-forward: \fI<yes or no>\fR
	Specify whether the ECS whitelist check (configured using
	\fBsend\-client\-subnet\fR) is applied for all queries, even if the triggering
	query contains an ECS record, or only for queries for which the ECS record is
	generated using the querier address (and therefore did not contain ECS data in
	the client query). If enabled, the whitelist check is skipped when the client
	query contains an ECS record. Default is no.
	.TP
	.B max\-client\-subnet\-ipv6: \fI<number>\fR
	Specifies the maximum prefix length of the client source address we are willing
	to expose to third parties for IPv6. Defaults to 56.
	.TP
	.B max\-client\-subnet\-ipv4: \fI<number>\fR
	Specifies the maximum prefix length of the client source address we are willing
	to expose to third parties for IPv4. Defaults to 24.
	+.TP
	+.B min\-client\-subnet\-ipv6: \fI<number>\fR
	+Specifies the minimum prefix length of the IPv6 source mask we are willing to
	+accept in queries. Shorter source masks result in REFUSED answers. Source mask
	+of 0 is always accepted. Default is 0.
	+.TP
	+.B min\-client\-subnet\-ipv4: \fI<number>\fR
	+Specifies the minimum prefix length of the IPv4 source mask we are willing to
	+accept in queries. Shorter source masks result in REFUSED answers. Source mask
	+of 0 is always accepted. Default is 0.
	+.TP
	+.B max\-ecs\-tree\-size\-ipv4: \fI<number>\fR
	+Specifies the maximum number of subnets ECS answers kept in the ECS radix tree.
	+This number applies for each qname/qclass/qtype tuple. Defaults to 100.
	+.TP
	+.B max\-ecs\-tree\-size\-ipv6: \fI<number>\fR
	+Specifies the maximum number of subnets ECS answers kept in the ECS radix tree.
	+This number applies for each qname/qclass/qtype tuple. Defaults to 100.
	.SS "Opportunistic IPsec Support Module Options"
	.LP
	The IPsec module must be configured in the \fBmodule\-config:\fR "ipsecmod
	validator iterator" directive and be compiled into the daemon to be
	enabled. These settings go in the \fBserver:\fR section.
	.LP
	When unbound receives an A/AAAA query that is not in the cache and finds a
	valid answer, it will withhold returning the answer and instead will generate
	an IPSECKEY subquery for the same domain name. If an answer was found, unbound
	will call an external hook passing the following arguments:
	.TP 10
	\h'5'\fIQNAME\fR
	Domain name of the A/AAAA and IPSECKEY query. In string format.
	.TP 10
	\h'5'\fIIPSECKEY TTL\fR
	TTL of the IPSECKEY RRset.
	.TP 10
	\h'5'\fIA/AAAA\fR
	String of space separated IP addresses present in the A/AAAA RRset. The IP
	addresses are in string format.
	.TP 10
	\h'5'\fIIPSECKEY\fR
	String of space separated IPSECKEY RDATA present in the IPSECKEY RRset. The
	IPSECKEY RDATA are in DNS presentation format.
	.LP
	The A/AAAA answer is then cached and returned to the client. If the external
	hook was called the TTL changes to ensure it doesn't surpass
	\fBipsecmod-max-ttl\fR.
	.LP
	The same procedure is also followed when \fBprefetch:\fR is used, but the
	A/AAAA answer is given to the client before the hook is called.
	\fBipsecmod-max-ttl\fR ensures that the A/AAAA answer given from cache is still
	relevant for opportunistic IPsec.
	.TP
	.B ipsecmod-enabled: \fI<yes or no>\fR
	Specifies whether the IPsec module is enabled or not. The IPsec module still
	needs to be defined in the \fBmodule\-config:\fR directive. This option
	facilitates turning on/off the module without restarting/reloading unbound.
	Defaults to yes.
	.TP
	.B ipsecmod\-hook: \fI<filename>\fR
	Specifies the external hook that unbound will call with \fIsystem\fR(3). The
	file can be specified as an absolute/relative path. The file needs the proper
	permissions to be able to be executed by the same user that runs unbound. It
	must be present when the IPsec module is defined in the \fBmodule\-config:\fR
	directive.
	.TP
	.B ipsecmod-strict: \fI<yes or no>\fR
	If enabled unbound requires the external hook to return a success value of 0.
	Failing to do so unbound will reply with SERVFAIL. The A/AAAA answer will also
	not be cached. Defaults to no.
	.TP
	.B ipsecmod\-max-ttl: \fI<seconds>\fR
	Time to live maximum for A/AAAA cached records after calling the external hook.
	Defaults to 3600.
	.TP
	.B ipsecmod-ignore-bogus: \fI<yes or no>\fR
	Specifies the behaviour of unbound when the IPSECKEY answer is bogus. If set
	to yes, the hook will be called and the A/AAAA answer will be returned to the
	client. If set to no, the hook will not be called and the answer to the
	A/AAAA query will be SERVFAIL. Mainly used for testing. Defaults to no.
	.TP
	.B ipsecmod\-whitelist: \fI<domain>\fR
	Whitelist the domain so that the module logic will be executed. Can
	be given multiple times, for different domains. If the option is not
	specified, all domains are treated as being whitelisted (default).
	.SS "Cache DB Module Options"
	.LP
	The Cache DB module must be configured in the \fBmodule\-config:\fR
	"validator cachedb iterator" directive and be compiled into the daemon
	with \fB\-\-enable\-cachedb\fR.
	If this module is enabled and configured, the specified backend database
	works as a second level cache:
	When Unbound cannot find an answer to a query in its built-in in-memory
	cache, it consults the specified backend.
	If it finds a valid answer in the backend, Unbound uses it to respond
	to the query without performing iterative DNS resolution.
	If Unbound cannot even find an answer in the backend, it resolves the
	query as usual, and stores the answer in the backend.
	.P
	If Unbound was built with
	\fB\-\-with\-libhiredis\fR
	on a system that has installed the hiredis C client library of Redis,
	then the "redis" backend can be used.
	This backend communicates with the specified Redis server over a TCP
	connection to store and retrieve cache data.
	It can be used as a persistent and/or shared cache backend.
	It should be noted that Unbound never removes data stored in the Redis server,
	even if some data have expired in terms of DNS TTL or the Redis server has
	cached too much data;
	if necessary the Redis server must be configured to limit the cache size,
	preferably with some kind of least-recently-used eviction policy.
	This backend uses synchronous communication with the Redis server
	based on the assumption that the communication is stable and sufficiently
	fast.
	The thread waiting for a response from the Redis server cannot handle
	other DNS queries.
	Although the backend has the ability to reconnect to the server when
	the connection is closed unexpectedly and there is a configurable timeout
	in case the server is overly slow or hangs up, these cases are assumed
	to be very rare.
	If connection close or timeout happens too often, Unbound will be
	effectively unusable with this backend.
	It's the administrator's responsibility to make the assumption hold.
	.P
	The
	.B cachedb:
	clause gives custom settings of the cache DB module.
	.TP
	.B backend: \fI<backend name>\fR
	Specify the backend database name.
	The default database is the in-memory backend named "testframe", which,
	as the name suggests, is not of any practical use.
	Depending on the build-time configuration, "redis" backend may also be
	used as described above.
	.TP
	.B secret-seed: \fI<"secret string">\fR
	Specify a seed to calculate a hash value from query information.
	This value will be used as the key of the corresponding answer for the
	backend database and can be customized if the hash should not be predictable
	operationally.
	If the backend database is shared by multiple Unbound instances,
	all instances must use the same secret seed.
	This option defaults to "default".
	.P
	The following
	.B cachedb
	otions are specific to the redis backend.
	.TP
	.B redis-server-host: \fI<server address or name>\fR
	The IP (either v6 or v4) address or domain name of the Redis server.
	In general an IP address should be specified as otherwise Unbound will have to
	resolve the name of the server every time it establishes a connection
	to the server.
	This option defaults to "127.0.0.1".
	.TP
	.B redis-server-port: \fI<port number>\fR
	The TCP port number of the Redis server.
	This option defaults to 6379.
	.TP
	.B redis-timeout: \fI<msec>\fR
	The period until when Unbound waits for a response from the Redis sever.
	If this timeout expires Unbound closes the connection, treats it as
	if the Redis server does not have the requested data, and will try to
	re-establish a new connection later.
	This option defaults to 100 milliseconds.
	.SH "MEMORY CONTROL EXAMPLE"
	In the example config settings below memory usage is reduced. Some service
	levels are lower, notable very large data and a high TCP load are no longer
	supported. Very large data and high TCP loads are exceptional for the DNS.
	DNSSEC validation is enabled, just add trust anchors.
	If you do not have to worry about programs using more than 3 Mb of memory,
	the below example is not for you. Use the defaults to receive full service,
	which on BSD\-32bit tops out at 30\-40 Mb after heavy usage.
	.P
	.nf
	# example settings that reduce memory usage
	server:
	num\-threads: 1
	outgoing\-num\-tcp: 1 # this limits TCP service, uses less buffers.
	incoming\-num\-tcp: 1
	outgoing\-range: 60 # uses less memory, but less performance.
	msg\-buffer\-size: 8192 # note this limits service, 'no huge stuff'.
	msg\-cache\-size: 100k
	msg\-cache\-slabs: 1
	rrset\-cache\-size: 100k
	rrset\-cache\-slabs: 1
	infra\-cache\-numhosts: 200
	infra\-cache\-slabs: 1
	key\-cache\-size: 100k
	key\-cache\-slabs: 1
	neg\-cache\-size: 10k
	num\-queries\-per\-thread: 30
	target\-fetch\-policy: "2 1 0 0 0 0"
	harden\-large\-queries: "yes"
	harden\-short\-bufsize: "yes"
	.fi
	.SH "FILES"
	.TP
	.I /var/unbound
	default unbound working directory.
	.TP
	.I /var/unbound
	default
	\fIchroot\fR(2)
	location.
	.TP
	.I /var/unbound/unbound.conf
	unbound configuration file.
	.TP
	.I /var/unbound/unbound.pid
	default unbound pidfile with process ID of the running daemon.
	.TP
	.I unbound.log
	unbound log file. default is to log to
	\fIsyslog\fR(3).
	.SH "SEE ALSO"
	\fIunbound\fR(8),
	\fIunbound\-checkconf\fR(8).
	.SH "AUTHORS"
	.B Unbound
	was written by NLnet Labs. Please see CREDITS file
	in the distribution for further details.
	Index: head/contrib/unbound/doc/unbound.conf.5.in
	===================================================================
	--- head/contrib/unbound/doc/unbound.conf.5.in (revision 349719)
	+++ head/contrib/unbound/doc/unbound.conf.5.in (revision 349720)
	@@ -1,2048 +1,2135 @@
	-.TH "unbound.conf" "5" "Oct 8, 2018" "NLnet Labs" "unbound 1.8.1"
	+.TH "unbound.conf" "5" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
	.\"
	.\" unbound.conf.5 -- unbound.conf manual
	.\"
	.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
	.\"
	.\" See LICENSE for the license.
	.\"
	.\"
	.SH "NAME"
	.B unbound.conf
	\- Unbound configuration file.
	.SH "SYNOPSIS"
	.B unbound.conf
	.SH "DESCRIPTION"
	.B unbound.conf
	is used to configure
	\fIunbound\fR(8).
	The file format has attributes and values. Some attributes have attributes
	inside them.
	The notation is: attribute: value.
	.P
	Comments start with # and last to the end of line. Empty lines are
	ignored as is whitespace at the beginning of a line.
	.P
	The utility
	\fIunbound\-checkconf\fR(8)
	can be used to check unbound.conf prior to usage.
	.SH "EXAMPLE"
	An example config file is shown below. Copy this to /etc/unbound/unbound.conf
	and start the server with:
	.P
	.nf
	$ unbound \-c /etc/unbound/unbound.conf
	.fi
	.P
	Most settings are the defaults. Stop the server with:
	.P
	.nf
	$ kill `cat /etc/unbound/unbound.pid`
	.fi
	.P
	Below is a minimal config file. The source distribution contains an extensive
	example.conf file with all the options.
	.P
	.nf
	# unbound.conf(5) config file for unbound(8).
	server:
	directory: "/etc/unbound"
	username: unbound
	# make sure unbound can access entropy from inside the chroot.
	# e.g. on linux the use these commands (on BSD, devfs(8) is used):
	# mount \-\-bind \-n /dev/random /etc/unbound/dev/random
	# and mount \-\-bind \-n /dev/log /etc/unbound/dev/log
	chroot: "/etc/unbound"
	# logfile: "/etc/unbound/unbound.log" #uncomment to use logfile.
	pidfile: "/etc/unbound/unbound.pid"
	# verbosity: 1 # uncomment and increase to get more logging.
	# listen on all interfaces, answer queries from the local subnet.
	interface: 0.0.0.0
	interface: ::0
	access\-control: 10.0.0.0/8 allow
	access\-control: 2001:DB8::/64 allow
	.fi
	.SH "FILE FORMAT"
	There must be whitespace between keywords. Attribute keywords end with a colon ':'.
	An attribute is followed by its containing attributes, or a value.
	.P
	Files can be included using the
	.B include:
	directive. It can appear anywhere, it accepts a single file name as argument.
	Processing continues as if the text from the included file was copied into
	the config file at that point. If also using chroot, using full path names
	for the included files works, relative pathnames for the included names work
	if the directory where the daemon is started equals its chroot/working
	directory or is specified before the include statement with directory: dir.
	Wildcards can be used to include multiple files, see \fIglob\fR(7).
	.SS "Server Options"
	These options are part of the
	.B server:
	clause.
	.TP
	.B verbosity: \fI<number>
	The verbosity number, level 0 means no verbosity, only errors. Level 1
	gives operational information. Level 2 gives detailed operational
	information. Level 3 gives query level information, output per query.
	Level 4 gives algorithm level information. Level 5 logs client
	identification for cache misses. Default is level 1.
	The verbosity can also be increased from the commandline, see \fIunbound\fR(8).
	.TP
	.B statistics\-interval: \fI<seconds>
	The number of seconds between printing statistics to the log for every thread.
	Disable with value 0 or "". Default is disabled. The histogram statistics
	are only printed if replies were sent during the statistics interval,
	requestlist statistics are printed for every interval (but can be 0).
	This is because the median calculation requires data to be present.
	.TP
	.B statistics\-cumulative: \fI<yes or no>
	If enabled, statistics are cumulative since starting unbound, without clearing
	the statistics counters after logging the statistics. Default is no.
	.TP
	.B extended\-statistics: \fI<yes or no>
	If enabled, extended statistics are printed from \fIunbound\-control\fR(8).
	Default is off, because keeping track of more statistics takes time. The
	counters are listed in \fIunbound\-control\fR(8).
	.TP
	.B num\-threads: \fI<number>
	The number of threads to create to serve clients. Use 1 for no threading.
	.TP
	.B port: \fI<port number>
	The port number, default 53, on which the server responds to queries.
	.TP
	.B interface: \fI<ip address[@port]>
	Interface to use to connect to the network. This interface is listened to
	for queries from clients, and answers to clients are given from it.
	Can be given multiple times to work on several interfaces. If none are
	given the default is to listen to localhost.
	The interfaces are not changed on a reload (kill \-HUP) but only on restart.
	A port number can be specified with @port (without spaces between
	interface and port number), if not specified the default port (from
	\fBport\fR) is used.
	.TP
	.B ip\-address: \fI<ip address[@port]>
	Same as interface: (for ease of compatibility with nsd.conf).
	.TP
	.B interface\-automatic: \fI<yes or no>
	Detect source interface on UDP queries and copy them to replies. This
	feature is experimental, and needs support in your OS for particular socket
	options. Default value is no.
	.TP
	.B outgoing\-interface: \fI<ip address or ip6 netblock>
	Interface to use to connect to the network. This interface is used to send
	queries to authoritative servers and receive their replies. Can be given
	multiple times to work on several interfaces. If none are given the
	default (all) is used. You can specify the same interfaces in
	.B interface:
	and
	.B outgoing\-interface:
	lines, the interfaces are then used for both purposes. Outgoing queries are
	sent via a random outgoing interface to counter spoofing.
	.IP
	If an IPv6 netblock is specified instead of an individual IPv6 address,
	outgoing UDP queries will use a randomised source address taken from the
	netblock to counter spoofing. Requires the IPv6 netblock to be routed to the
	host running unbound, and requires OS support for unprivileged non-local binds
	(currently only supported on Linux). Several netblocks may be specified with
	multiple
	.B outgoing\-interface:
	options, but do not specify both an individual IPv6 address and an IPv6
	netblock, or the randomisation will be compromised. Consider combining with
	.B prefer\-ip6: yes
	to increase the likelihood of IPv6 nameservers being selected for queries.
	On Linux you need these two commands to be able to use the freebind socket
	option to receive traffic for the ip6 netblock:
	ip \-6 addr add mynetblock/64 dev lo &&
	ip \-6 route add local mynetblock/64 dev lo
	.TP
	.B outgoing\-range: \fI<number>
	Number of ports to open. This number of file descriptors can be opened per
	thread. Must be at least 1. Default depends on compile options. Larger
	numbers need extra resources from the operating system. For performance a
	very large value is best, use libevent to make this possible.
	.TP
	.B outgoing\-port\-permit: \fI<port number or range>
	Permit unbound to open this port or range of ports for use to send queries.
	A larger number of permitted outgoing ports increases resilience against
	spoofing attempts. Make sure these ports are not needed by other daemons.
	By default only ports above 1024 that have not been assigned by IANA are used.
	Give a port number or a range of the form "low\-high", without spaces.
	.IP
	The \fBoutgoing\-port\-permit\fR and \fBoutgoing\-port\-avoid\fR statements
	are processed in the line order of the config file, adding the permitted ports
	and subtracting the avoided ports from the set of allowed ports. The
	processing starts with the non IANA allocated ports above 1024 in the set
	of allowed ports.
	.TP
	.B outgoing\-port\-avoid: \fI<port number or range>
	Do not permit unbound to open this port or range of ports for use to send
	queries. Use this to make sure unbound does not grab a port that another
	daemon needs. The port is avoided on all outgoing interfaces, both IP4 and IP6.
	By default only ports above 1024 that have not been assigned by IANA are used.
	Give a port number or a range of the form "low\-high", without spaces.
	.TP
	.B outgoing\-num\-tcp: \fI<number>
	Number of outgoing TCP buffers to allocate per thread. Default is 10. If
	set to 0, or if do\-tcp is "no", no TCP queries to authoritative servers
	are done. For larger installations increasing this value is a good idea.
	.TP
	.B incoming\-num\-tcp: \fI<number>
	Number of incoming TCP buffers to allocate per thread. Default is
	10. If set to 0, or if do\-tcp is "no", no TCP queries from clients are
	accepted. For larger installations increasing this value is a good idea.
	.TP
	.B edns\-buffer\-size: \fI<number>
	Number of bytes size to advertise as the EDNS reassembly buffer size.
	This is the value put into datagrams over UDP towards peers. The actual
	buffer size is determined by msg\-buffer\-size (both for TCP and UDP). Do
	not set higher than that value. Default is 4096 which is RFC recommended.
	If you have fragmentation reassembly problems, usually seen as timeouts,
	then a value of 1472 can fix it. Setting to 512 bypasses even the most
	stringent path MTU problems, but is seen as extreme, since the amount
	of TCP fallback generated is excessive (probably also for this resolver,
	consider tuning the outgoing tcp number).
	.TP
	.B max\-udp\-size: \fI<number>
	Maximum UDP response size (not applied to TCP response). 65536 disables the
	udp response size maximum, and uses the choice from the client, always.
	Suggested values are 512 to 4096. Default is 4096.
	.TP
	+.B stream\-wait\-size: \fI<number>
	+Number of bytes size maximum to use for waiting stream buffers. Default is
	+4 megabytes. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes,
	+megabytes or gigabytes (1024*1024 bytes in a megabyte). As TCP and TLS streams
	+queue up multiple results, the amount of memory used for these buffers does
	+not exceed this number, otherwise the responses are dropped. This manages
	+the total memory usage of the server (under heavy use), the number of requests
	+that can be queued up per connection is also limited, with further requests
	+waiting in TCP buffers.
	+.TP
	.B msg\-buffer\-size: \fI<number>
	Number of bytes size of the message buffers. Default is 65552 bytes, enough
	for 64 Kb packets, the maximum DNS message size. No message larger than this
	can be sent or received. Can be reduced to use less memory, but some requests
	for DNS data, such as for huge resource records, will result in a SERVFAIL
	reply to the client.
	.TP
	.B msg\-cache\-size: \fI<number>
	Number of bytes size of the message cache. Default is 4 megabytes.
	A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
	or gigabytes (1024*1024 bytes in a megabyte).
	.TP
	.B msg\-cache\-slabs: \fI<number>
	Number of slabs in the message cache. Slabs reduce lock contention by threads.
	Must be set to a power of 2. Setting (close) to the number of cpus is a
	reasonable guess.
	.TP
	.B num\-queries\-per\-thread: \fI<number>
	The number of queries that every thread will service simultaneously.
	If more queries arrive that need servicing, and no queries can be jostled out
	(see \fIjostle\-timeout\fR), then the queries are dropped. This forces
	the client to resend after a timeout; allowing the server time to work on
	the existing queries. Default depends on compile options, 512 or 1024.
	.TP
	.B jostle\-timeout: \fI<msec>
	Timeout used when the server is very busy. Set to a value that usually
	results in one roundtrip to the authority servers. If too many queries
	arrive, then 50% of the queries are allowed to run to completion, and
	the other 50% are replaced with the new incoming query if they have already
	spent more than their allowed time. This protects against denial of
	service by slow queries or high query rates. Default 200 milliseconds.
	The effect is that the qps for long-lasting queries is about
	(numqueriesperthread / 2) / (average time for such long queries) qps.
	The qps for short queries can be about (numqueriesperthread / 2)
	/ (jostletimeout in whole seconds) qps per thread, about (1024/2)*5 = 2560
	qps by default.
	.TP
	.B delay\-close: \fI<msec>
	Extra delay for timeouted UDP ports before they are closed, in msec.
	Default is 0, and that disables it. This prevents very delayed answer
	packets from the upstream (recursive) servers from bouncing against
	closed ports and setting off all sort of close-port counters, with
	eg. 1500 msec. When timeouts happen you need extra sockets, it checks
	the ID and remote IP of packets, and unwanted packets are added to the
	unwanted packet counter.
	.TP
	+.B unknown\-server\-time\-limit: \fI<msec>
	+The wait time in msec for waiting for an unknown server to reply.
	+Increase this if you are behind a slow satellite link, to eg. 1128.
	+That would then avoid re\-querying every initial query because it times out.
	+Default is 376 msec.
	+.TP
	.B so\-rcvbuf: \fI<number>
	If not 0, then set the SO_RCVBUF socket option to get more buffer
	space on UDP port 53 incoming queries. So that short spikes on busy
	servers do not drop packets (see counter in netstat \-su). Default is
	0 (use system value). Otherwise, the number of bytes to ask for, try
	"4m" on a busy server. The OS caps it at a maximum, on linux unbound
	needs root permission to bypass the limit, or the admin can use sysctl
	net.core.rmem_max. On BSD change kern.ipc.maxsockbuf in /etc/sysctl.conf.
	On OpenBSD change header and recompile kernel. On Solaris ndd \-set
	/dev/udp udp_max_buf 8388608.
	.TP
	.B so\-sndbuf: \fI<number>
	If not 0, then set the SO_SNDBUF socket option to get more buffer space on
	UDP port 53 outgoing queries. This for very busy servers handles spikes
	in answer traffic, otherwise 'send: resource temporarily unavailable'
	can get logged, the buffer overrun is also visible by netstat \-su.
	Default is 0 (use system value). Specify the number of bytes to ask
	for, try "4m" on a very busy server. The OS caps it at a maximum, on
	linux unbound needs root permission to bypass the limit, or the admin
	can use sysctl net.core.wmem_max. On BSD, Solaris changes are similar
	to so\-rcvbuf.
	.TP
	.B so\-reuseport: \fI<yes or no>
	If yes, then open dedicated listening sockets for incoming queries for each
	thread and try to set the SO_REUSEPORT socket option on each socket. May
	distribute incoming queries to threads more evenly. Default is yes.
	On Linux it is supported in kernels >= 3.9. On other systems, FreeBSD, OSX
	it may also work. You can enable it (on any platform and kernel),
	it then attempts to open the port and passes the option if it was available
	at compile time, if that works it is used, if it fails, it continues
	silently (unless verbosity 3) without the option.
	+At extreme load it could be better to turn it off to distribute the queries
	+evenly, reported for Linux systems (4.4.x).
	.TP
	.B ip\-transparent: \fI<yes or no>
	If yes, then use IP_TRANSPARENT socket option on sockets where unbound
	is listening for incoming traffic. Default no. Allows you to bind to
	non\-local interfaces. For example for non\-existent IP addresses that
	are going to exist later on, with host failover configuration. This is
	a lot like interface\-automatic, but that one services all interfaces
	and with this option you can select which (future) interfaces unbound
	provides service on. This option needs unbound to be started with root
	permissions on some systems. The option uses IP_BINDANY on FreeBSD systems
	and SO_BINDANY on OpenBSD systems.
	.TP
	.B ip\-freebind: \fI<yes or no>
	If yes, then use IP_FREEBIND socket option on sockets where unbound
	is listening to incoming traffic. Default no. Allows you to bind to
	IP addresses that are nonlocal or do not exist, like when the network
	interface or IP address is down. Exists only on Linux, where the similar
	ip\-transparent option is also available.
	.TP
	.B rrset\-cache\-size: \fI<number>
	Number of bytes size of the RRset cache. Default is 4 megabytes.
	A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
	or gigabytes (1024*1024 bytes in a megabyte).
	.TP
	.B rrset\-cache\-slabs: \fI<number>
	Number of slabs in the RRset cache. Slabs reduce lock contention by threads.
	Must be set to a power of 2.
	.TP
	.B cache\-max\-ttl: \fI<seconds>
	Time to live maximum for RRsets and messages in the cache. Default is
	-86400 seconds (1 day). If the maximum kicks in, responses to clients
	-still get decrementing TTLs based on the original (larger) values.
	-When the internal TTL expires, the cache item has expired.
	+86400 seconds (1 day). When the TTL expires, the cache item has expired.
	Can be set lower to force the resolver to query for data often, and not
	-trust (very large) TTL values.
	+trust (very large) TTL values. Downstream clients also see the lower TTL.
	.TP
	.B cache\-min\-ttl: \fI<seconds>
	Time to live minimum for RRsets and messages in the cache. Default is 0.
	If the minimum kicks in, the data is cached for longer than the domain
	owner intended, and thus less queries are made to look up the data.
	Zero makes sure the data in the cache is as the domain owner intended,
	higher values, especially more than an hour or so, can lead to trouble as
	the data in the cache does not match up with the actual data any more.
	.TP
	.B cache\-max\-negative\-ttl: \fI<seconds>
	Time to live maximum for negative responses, these have a SOA in the
	authority section that is limited in time. Default is 3600.
	This applies to nxdomain and nodata answers.
	.TP
	.B infra\-host\-ttl: \fI<seconds>
	Time to live for entries in the host cache. The host cache contains
	roundtrip timing, lameness and EDNS support information. Default is 900.
	.TP
	.B infra\-cache\-slabs: \fI<number>
	Number of slabs in the infrastructure cache. Slabs reduce lock contention
	by threads. Must be set to a power of 2.
	.TP
	.B infra\-cache\-numhosts: \fI<number>
	Number of hosts for which information is cached. Default is 10000.
	.TP
	.B infra\-cache\-min\-rtt: \fI<msec>
	Lower limit for dynamic retransmit timeout calculation in infrastructure
	cache. Default is 50 milliseconds. Increase this value if using forwarders
	needing more time to do recursive name resolution.
	.TP
	.B define\-tag: \fI<"list of tags">
	Define the tags that can be used with local\-zone and access\-control.
	Enclose the list between quotes ("") and put spaces between tags.
	.TP
	.B do\-ip4: \fI<yes or no>
	Enable or disable whether ip4 queries are answered or issued. Default is yes.
	.TP
	.B do\-ip6: \fI<yes or no>
	Enable or disable whether ip6 queries are answered or issued. Default is yes.
	If disabled, queries are not answered on IPv6, and queries are not sent on
	IPv6 to the internet nameservers. With this option you can disable the
	ipv6 transport for sending DNS traffic, it does not impact the contents of
	the DNS traffic, which may have ip4 and ip6 addresses in it.
	.TP
	.B prefer\-ip6: \fI<yes or no>
	If enabled, prefer IPv6 transport for sending DNS queries to internet
	nameservers. Default is no.
	.TP
	.B do\-udp: \fI<yes or no>
	Enable or disable whether UDP queries are answered or issued. Default is yes.
	.TP
	.B do\-tcp: \fI<yes or no>
	Enable or disable whether TCP queries are answered or issued. Default is yes.
	.TP
	.B tcp\-mss: \fI<number>
	Maximum segment size (MSS) of TCP socket on which the server responds
	to queries. Value lower than common MSS on Ethernet
	(1220 for example) will address path MTU problem.
	Note that not all platform supports socket option to set MSS (TCP_MAXSEG).
	Default is system default MSS determined by interface MTU and
	negotiation between server and client.
	.TP
	.B outgoing\-tcp\-mss: \fI<number>
	Maximum segment size (MSS) of TCP socket for outgoing queries
	(from Unbound to other servers). Value lower than
	common MSS on Ethernet (1220 for example) will address path MTU problem.
	Note that not all platform supports socket option to set MSS (TCP_MAXSEG).
	Default is system default MSS determined by interface MTU and
	negotiation between Unbound and other servers.
	.TP
	.B tcp-idle-timeout: \fI<msec>\fR
	The period Unbound will wait for a query on a TCP connection.
	If this timeout expires Unbound closes the connection.
	This option defaults to 30000 milliseconds.
	When the number of free incoming TCP buffers falls below 50% of the
	total number configured, the option value used is progressively
	reduced, first to 1% of the configured value, then to 0.2% of the
	configured value if the number of free buffers falls below 35% of the
	total number configured, and finally to 0 if the number of free buffers
	falls below 20% of the total number configured. A minimum timeout of
	200 milliseconds is observed regardless of the option value used.
	.TP
	.B edns-tcp-keepalive: \fI<yes or no>\fR
	Enable or disable EDNS TCP Keepalive. Default is no.
	.TP
	.B edns-tcp-keepalive-timeout: \fI<msec>\fR
	The period Unbound will wait for a query on a TCP connection when
	EDNS TCP Keepalive is active. If this timeout expires Unbound closes
	the connection. If the client supports the EDNS TCP Keepalive option,
	Unbound sends the timeout value to the client to encourage it to
	close the connection before the server times out.
	This option defaults to 120000 milliseconds.
	When the number of free incoming TCP buffers falls below 50% of
	the total number configured, the advertised timeout is progressively
	reduced to 1% of the configured value, then to 0.2% of the configured
	value if the number of free buffers falls below 35% of the total number
	configured, and finally to 0 if the number of free buffers falls below
	20% of the total number configured.
	A minimum actual timeout of 200 milliseconds is observed regardless of the
	advertised timeout.
	.TP
	.B tcp\-upstream: \fI<yes or no>
	Enable or disable whether the upstream queries use TCP only for transport.
	Default is no. Useful in tunneling scenarios.
	.TP
	.B udp\-upstream\-without\-downstream: \fI<yes or no>
	Enable udp upstream even if do-udp is no. Default is no, and this does not
	change anything. Useful for TLS service providers, that want no udp downstream
	but use udp to fetch data upstream.
	.TP
	.B tls\-upstream: \fI<yes or no>
	Enabled or disable whether the upstream queries use TLS only for transport.
	Default is no. Useful in tunneling scenarios. The TLS contains plain DNS in
	TCP wireformat. The other server must support this (see
	\fBtls\-service\-key\fR).
	If you enable this, also configure a tls\-cert\-bundle or use tls\-win\-cert to
	load CA certs, otherwise the connections cannot be authenticated.
	+This option enables TLS for all of them, but if you do not set this you can
	+configure TLS specifically for some forward zones with forward\-tls\-upstream. And also with stub\-tls\-upstream.
	.TP
	.B ssl\-upstream: \fI<yes or no>
	Alternate syntax for \fBtls\-upstream\fR. If both are present in the config
	file the last is used.
	.TP
	.B tls\-service\-key: \fI<file>
	-If enabled, the server provider TLS service on its TCP sockets. The clients
	-have to use tls\-upstream: yes. The file is the private key for the TLS
	-session. The public certificate is in the tls\-service\-pem file. Default
	-is "", turned off. Requires a restart (a reload is not enough) if changed,
	-because the private key is read while root permissions are held and before
	-chroot (if any). Normal DNS TCP service is not provided and gives errors,
	-this service is best run with a different \fBport:\fR config or \fI@port\fR
	-suffixes in the \fBinterface\fR config.
	+If enabled, the server provides TLS service on the TCP ports marked
	+implicitly or explicitly for TLS service with tls\-port. The file must
	+contain the private key for the TLS session, the public certificate is in
	+the tls\-service\-pem file and it must also be specified if tls\-service\-key
	+is specified. The default is "", turned off. Enabling or disabling
	+this service requires a restart (a reload is not enough), because the
	+key is read while root permissions are held and before chroot (if any).
	+The ports enabled implicitly or explicitly via \fBtls\-port:\fR do not provide
	+normal DNS TCP service.
	.TP
	.B ssl\-service\-key: \fI<file>
	Alternate syntax for \fBtls\-service\-key\fR.
	.TP
	.B tls\-service\-pem: \fI<file>
	The public key certificate pem file for the tls service. Default is "",
	turned off.
	.TP
	.B ssl\-service\-pem: \fI<file>
	Alternate syntax for \fBtls\-service\-pem\fR.
	.TP
	.B tls\-port: \fI<number>
	The port number on which to provide TCP TLS service, default 853, only
	interfaces configured with that port number as @number get the TLS service.
	.TP
	.B ssl\-port: \fI<number>
	Alternate syntax for \fBtls\-port\fR.
	.TP
	.B tls\-cert\-bundle: \fI<file>
	If null or "", no file is used. Set it to the certificate bundle file,
	for example "/etc/pki/tls/certs/ca\-bundle.crt". These certificates are used
	for authenticating connections made to outside peers. For example auth\-zone
	urls, and also DNS over TLS connections.
	.TP
	.B ssl\-cert\-bundle: \fI<file>
	Alternate syntax for \fBtls\-cert\-bundle\fR.
	.TP
	.B tls\-win\-cert: \fI<yes or no>
	Add the system certificates to the cert bundle certificates for authentication.
	If no cert bundle, it uses only these certificates. Default is no.
	On windows this option uses the certificates from the cert store. Use
	the tls\-cert\-bundle option on other systems.
	.TP
	.B tls\-additional\-port: \fI<portnr>
	List portnumbers as tls\-additional\-port, and when interfaces are defined,
	eg. with the @port suffix, as this port number, they provide dns over TLS
	service. Can list multiple, each on a new statement.
	.TP
	+.B tls-session-ticket-keys: \fI<file>
	+If not "", lists files with 80 bytes of random contents that are used to
	+perform TLS session resumption for clients using the unbound server.
	+These files contain the secret key for the TLS session tickets.
	+First key use to encrypt and decrypt TLS session tickets.
	+Other keys use to decrypt only. With this you can roll over to new keys,
	+by generating a new first file and allowing decrypt of the old file by
	+listing it after the first file for some time, after the wait clients are not
	+using the old key any more and the old key can be removed.
	+One way to create the file is dd if=/dev/random bs=1 count=80 of=ticket.dat
	+The first 16 bytes should be different from the old one if you create a second key, that is the name used to identify the key. Then there is 32 bytes random
	+data for an AES key and then 32 bytes random data for the HMAC key.
	+.TP
	+.B tls\-ciphers: \fI<string with cipher list>
	+Set the list of ciphers to allow when serving TLS. Use "" for defaults,
	+and that is the default.
	+.TP
	+.B tls\-ciphersuites: \fI<string with ciphersuites list>
	+Set the list of ciphersuites to allow when serving TLS. This is for newer
	+TLS 1.3 connections. Use "" for defaults, and that is the default.
	+.TP
	.B use\-systemd: \fI<yes or no>
	Enable or disable systemd socket activation.
	Default is no.
	.TP
	.B do\-daemonize: \fI<yes or no>
	Enable or disable whether the unbound server forks into the background as
	a daemon. Set the value to \fIno\fR when unbound runs as systemd service.
	Default is yes.
	.TP
	.B tcp\-connection\-limit: \fI<IP netblock> <limit>
	Allow up to \fIlimit\fR simultaneous TCP connections from the given netblock.
	When at the limit, further connections are accepted but closed immediately.
	This option is experimental at this time.
	.TP
	.B access\-control: \fI<IP netblock> <action>
	The netblock is given as an IP4 or IP6 address with /size appended for a
	classless network block. The action can be \fIdeny\fR, \fIrefuse\fR,
	\fIallow\fR, \fIallow_setrd\fR, \fIallow_snoop\fR, \fIdeny_non_local\fR or
	\fIrefuse_non_local\fR.
	The most specific netblock match is used, if none match \fIdeny\fR is used.
	+The order of the access\-control statements therefore does not matter.
	.IP
	The action \fIdeny\fR stops queries from hosts from that netblock.
	.IP
	The action \fIrefuse\fR stops queries too, but sends a DNS rcode REFUSED
	error message back.
	.IP
	The action \fIallow\fR gives access to clients from that netblock.
	It gives only access for recursion clients (which is
	what almost all clients need). Nonrecursive queries are refused.
	.IP
	The \fIallow\fR action does allow nonrecursive queries to access the
	local\-data that is configured. The reason is that this does not involve
	the unbound server recursive lookup algorithm, and static data is served
	in the reply. This supports normal operations where nonrecursive queries
	are made for the authoritative data. For nonrecursive queries any replies
	from the dynamic cache are refused.
	.IP
	The \fIallow_setrd\fR action ignores the recursion desired (RD) bit and
	treats all requests as if the recursion desired bit is set. Note that this
	behavior violates RFC 1034 which states that a name server should never perform
	recursive service unless asked via the RD bit since this interferes with
	trouble shooting of name servers and their databases. This prohibited behavior
	may be useful if another DNS server must forward requests for specific
	zones to a resolver DNS server, but only supports stub domains and
	sends queries to the resolver DNS server with the RD bit cleared.
	.IP
	The action \fIallow_snoop\fR gives nonrecursive access too. This give
	both recursive and non recursive access. The name \fIallow_snoop\fR refers
	to cache snooping, a technique to use nonrecursive queries to examine
	the cache contents (for malicious acts). However, nonrecursive queries can
	also be a valuable debugging tool (when you want to examine the cache
	contents). In that case use \fIallow_snoop\fR for your administration host.
	.IP
	By default only localhost is \fIallow\fRed, the rest is \fIrefuse\fRd.
	The default is \fIrefuse\fRd, because that is protocol\-friendly. The DNS
	protocol is not designed to handle dropped packets due to policy, and
	dropping may result in (possibly excessive) retried queries.
	.IP
	The deny_non_local and refuse_non_local settings are for hosts that are
	only allowed to query for the authoritative local\-data, they are not
	allowed full recursion but only the static data. With deny_non_local,
	messages that are disallowed are dropped, with refuse_non_local they
	receive error code REFUSED.
	.TP
	.B access\-control\-tag: \fI<IP netblock> <"list of tags">
	Assign tags to access-control elements. Clients using this access control
	element use localzones that are tagged with one of these tags. Tags must be
	defined in \fIdefine\-tags\fR. Enclose list of tags in quotes ("") and put
	spaces between tags. If access\-control\-tag is configured for a netblock that
	does not have an access\-control, an access\-control element with action
	\fIallow\fR is configured for this netblock.
	.TP
	.B access\-control\-tag\-action: \fI<IP netblock> <tag> <action>
	Set action for particular tag for given access control element. If you have
	multiple tag values, the tag used to lookup the action is the first tag match
	between access\-control\-tag and local\-zone\-tag where "first" comes from the
	order of the define-tag values.
	.TP
	.B access\-control\-tag\-data: \fI<IP netblock> <tag> <"resource record string">
	Set redirect data for particular tag for given access control element.
	.TP
	.B access\-control\-view: \fI<IP netblock> <view name>
	Set view for given access control element.
	.TP
	.B chroot: \fI<directory>
	If chroot is enabled, you should pass the configfile (from the
	commandline) as a full path from the original root. After the
	chroot has been performed the now defunct portion of the config
	file path is removed to be able to reread the config after a reload.
	.IP
	All other file paths (working dir, logfile, roothints, and
	key files) can be specified in several ways:
	as an absolute path relative to the new root,
	as a relative path to the working directory, or
	as an absolute path relative to the original root.
	In the last case the path is adjusted to remove the unused portion.
	.IP
	The pidfile can be either a relative path to the working directory, or
	an absolute path relative to the original root. It is written just prior
	to chroot and dropping permissions. This allows the pidfile to be
	/var/run/unbound.pid and the chroot to be /var/unbound, for example.
	.IP
	Additionally, unbound may need to access /dev/random (for entropy)
	from inside the chroot.
	.IP
	If given a chroot is done to the given directory. By default chroot is
	enabled and the default is "@UNBOUND_CHROOT_DIR@". If you give "" no
	chroot is performed.
	.TP
	.B username: \fI<name>
	If given, after binding the port the user privileges are dropped. Default is
	"@UNBOUND_USERNAME@". If you give username: "" no user change is performed.
	.IP
	If this user is not capable of binding the
	port, reloads (by signal HUP) will still retain the opened ports.
	If you change the port number in the config file, and that new port number
	requires privileges, then a reload will fail; a restart is needed.
	.TP
	.B directory: \fI<directory>
	Sets the working directory for the program. Default is "@UNBOUND_RUN_DIR@".
	On Windows the string "%EXECUTABLE%" tries to change to the directory
	that unbound.exe resides in.
	If you give a server: directory: dir before include: file statements
	then those includes can be relative to the working directory.
	.TP
	.B logfile: \fI<filename>
	If "" is given, logging goes to stderr, or nowhere once daemonized.
	The logfile is appended to, in the following format:
	.nf
	[seconds since 1970] unbound[pid:tid]: type: message.
	.fi
	If this option is given, the use\-syslog is option is set to "no".
	The logfile is reopened (for append) when the config file is reread, on
	SIGHUP.
	.TP
	.B use\-syslog: \fI<yes or no>
	Sets unbound to send log messages to the syslogd, using
	\fIsyslog\fR(3).
	The log facility LOG_DAEMON is used, with identity "unbound".
	The logfile setting is overridden when use\-syslog is turned on.
	The default is to log to syslog.
	.TP
	.B log\-identity: \fI<string>
	If "" is given (default), then the name of the executable, usually "unbound"
	is used to report to the log. Enter a string to override it
	with that, which is useful on systems that run more than one instance of
	unbound, with different configurations, so that the logs can be easily
	distinguished against.
	.TP
	.B log\-time\-ascii: \fI<yes or no>
	Sets logfile lines to use a timestamp in UTC ascii. Default is no, which
	prints the seconds since 1970 in brackets. No effect if using syslog, in
	that case syslog formats the timestamp printed into the log files.
	.TP
	.B log\-queries: \fI<yes or no>
	Prints one line per query to the log, with the log timestamp and IP address,
	name, type and class. Default is no. Note that it takes time to print these
	lines which makes the server (significantly) slower. Odd (nonprintable)
	characters in names are printed as '?'.
	.TP
	.B log\-replies: \fI<yes or no>
	Prints one line per reply to the log, with the log timestamp and IP address,
	name, type, class, return code, time to resolve, from cache and response size.
	Default is no. Note that it takes time to print these
	lines which makes the server (significantly) slower. Odd (nonprintable)
	characters in names are printed as '?'.
	.TP
	+.B log\-tag\-queryreply: \fI<yes or no>
	+Prints the word 'query' and 'reply' with log\-queries and log\-replies.
	+This makes filtering logs easier. The default is off (for backwards
	+compatibility).
	+.TP
	.B log\-local\-actions: \fI<yes or no>
	Print log lines to inform about local zone actions. These lines are like the
	local\-zone type inform prints out, but they are also printed for the other
	types of local zones.
	.TP
	.B log\-servfail: \fI<yes or no>
	Print log lines that say why queries return SERVFAIL to clients.
	This is separate from the verbosity debug logs, much smaller, and printed
	at the error level, not the info level of debug info from verbosity.
	.TP
	.B pidfile: \fI<filename>
	The process id is written to the file. Default is "@UNBOUND_PIDFILE@".
	So,
	.nf
	kill \-HUP `cat @UNBOUND_PIDFILE@`
	.fi
	triggers a reload,
	.nf
	kill \-TERM `cat @UNBOUND_PIDFILE@`
	.fi
	gracefully terminates.
	.TP
	.B root\-hints: \fI<filename>
	Read the root hints from this file. Default is nothing, using builtin hints
	for the IN class. The file has the format of zone files, with root
	nameserver names and addresses only. The default may become outdated,
	when servers change, therefore it is good practice to use a root\-hints file.
	.TP
	.B hide\-identity: \fI<yes or no>
	If enabled id.server and hostname.bind queries are refused.
	.TP
	.B identity: \fI<string>
	Set the identity to report. If set to "", the default, then the hostname
	of the server is returned.
	.TP
	.B hide\-version: \fI<yes or no>
	If enabled version.server and version.bind queries are refused.
	.TP
	.B version: \fI<string>
	Set the version to report. If set to "", the default, then the package
	version is returned.
	.TP
	.B hide\-trustanchor: \fI<yes or no>
	If enabled trustanchor.unbound queries are refused.
	.TP
	.B target\-fetch\-policy: \fI<"list of numbers">
	Set the target fetch policy used by unbound to determine if it should fetch
	nameserver target addresses opportunistically. The policy is described per
	dependency depth.
	.IP
	The number of values determines the maximum dependency depth
	that unbound will pursue in answering a query.
	A value of \-1 means to fetch all targets opportunistically for that dependency
	depth. A value of 0 means to fetch on demand only. A positive value fetches
	that many targets opportunistically.
	.IP
	Enclose the list between quotes ("") and put spaces between numbers.
	The default is "3 2 1 0 0". Setting all zeroes, "0 0 0 0 0" gives behaviour
	closer to that of BIND 9, while setting "\-1 \-1 \-1 \-1 \-1" gives behaviour
	rumoured to be closer to that of BIND 8.
	.TP
	.B harden\-short\-bufsize: \fI<yes or no>
	Very small EDNS buffer sizes from queries are ignored. Default is off, since
	it is legal protocol wise to send these, and unbound tries to give very
	small answers to these queries, where possible.
	.TP
	.B harden\-large\-queries: \fI<yes or no>
	Very large queries are ignored. Default is off, since it is legal protocol
	wise to send these, and could be necessary for operation if TSIG or EDNS
	payload is very large.
	.TP
	.B harden\-glue: \fI<yes or no>
	Will trust glue only if it is within the servers authority. Default is on.
	.TP
	.B harden\-dnssec\-stripped: \fI<yes or no>
	Require DNSSEC data for trust\-anchored zones, if such data is absent,
	the zone becomes bogus. If turned off, and no DNSSEC data is received
	(or the DNSKEY data fails to validate), then the zone is made insecure,
	this behaves like there is no trust anchor. You could turn this off if
	you are sometimes behind an intrusive firewall (of some sort) that
	removes DNSSEC data from packets, or a zone changes from signed to
	unsigned to badly signed often. If turned off you run the risk of a
	downgrade attack that disables security for a zone. Default is on.
	.TP
	.B harden\-below\-nxdomain: \fI<yes or no>
	From RFC 8020 (with title "NXDOMAIN: There Really Is Nothing Underneath"),
	returns nxdomain to queries for a name
	below another name that is already known to be nxdomain. DNSSEC mandates
	noerror for empty nonterminals, hence this is possible. Very old software
	might return nxdomain for empty nonterminals (that usually happen for reverse
	IP address lookups), and thus may be incompatible with this. To try to avoid
	this only DNSSEC-secure nxdomains are used, because the old software does not
	have DNSSEC. Default is on.
	The nxdomain must be secure, this means nsec3 with optout is insufficient.
	.TP
	.B harden\-referral\-path: \fI<yes or no>
	Harden the referral path by performing additional queries for
	infrastructure data. Validates the replies if trust anchors are configured
	and the zones are signed. This enforces DNSSEC validation on nameserver
	NS sets and the nameserver addresses that are encountered on the referral
	path to the answer.
	Default no, because it burdens the authority servers, and it is
	not RFC standard, and could lead to performance problems because of the
	extra query load that is generated. Experimental option.
	If you enable it consider adding more numbers after the target\-fetch\-policy
	to increase the max depth that is checked to.
	.TP
	.B harden\-algo\-downgrade: \fI<yes or no>
	Harden against algorithm downgrade when multiple algorithms are
	advertised in the DS record. If no, allows the weakest algorithm to
	validate the zone. Default is no. Zone signers must produce zones
	that allow this feature to work, but sometimes they do not, and turning
	this option off avoids that validation failure.
	.TP
	.B use\-caps\-for\-id: \fI<yes or no>
	Use 0x20\-encoded random bits in the query to foil spoof attempts.
	This perturbs the lowercase and uppercase of query names sent to
	authority servers and checks if the reply still has the correct casing.
	Disabled by default.
	This feature is an experimental implementation of draft dns\-0x20.
	.TP
	.B caps\-whitelist: \fI<domain>
	Whitelist the domain so that it does not receive caps\-for\-id perturbed
	queries. For domains that do not support 0x20 and also fail with fallback
	because they keep sending different answers, like some load balancers.
	Can be given multiple times, for different domains.
	.TP
	.B qname\-minimisation: \fI<yes or no>
	Send minimum amount of information to upstream servers to enhance privacy.
	-Only sent minimum required labels of the QNAME and set QTYPE to A when
	+Only send minimum required labels of the QNAME and set QTYPE to A when
	possible. Best effort approach; full QNAME and original QTYPE will be sent when
	upstream replies with a RCODE other than NOERROR, except when receiving
	NXDOMAIN from a DNSSEC signed zone. Default is yes.
	.TP
	.B qname\-minimisation\-strict: \fI<yes or no>
	QNAME minimisation in strict mode. Do not fall-back to sending full QNAME to
	potentially broken nameservers. A lot of domains will not be resolvable when
	this option in enabled. Only use if you know what you are doing.
	This option only has effect when qname-minimisation is enabled. Default is off.
	.TP
	.B aggressive\-nsec: \fI<yes or no>
	Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN
	and other denials, using information from previous NXDOMAINs answers.
	Default is no. It helps to reduce the query rate towards targets that get
	a very high nonexistent name lookup rate.
	.TP
	.B private\-address: \fI<IP address or subnet>
	Give IPv4 of IPv6 addresses or classless subnets. These are addresses
	on your private network, and are not allowed to be returned for
	public internet names. Any occurrence of such addresses are removed
	from DNS answers. Additionally, the DNSSEC validator may mark the
	answers bogus. This protects against so\-called DNS Rebinding, where
	a user browser is turned into a network proxy, allowing remote access
	through the browser to other parts of your private network. Some names
	can be allowed to contain your private addresses, by default all the
	\fBlocal\-data\fR that you configured is allowed to, and you can specify
	additional names using \fBprivate\-domain\fR. No private addresses are
	enabled by default. We consider to enable this for the RFC1918 private
	IP address space by default in later releases. That would enable private
	addresses for 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16
	fd00::/8 and fe80::/10, since the RFC standards say these addresses
	should not be visible on the public internet. Turning on 127.0.0.0/8
	would hinder many spamblocklists as they use that. Adding ::ffff:0:0/96
	stops IPv4-mapped IPv6 addresses from bypassing the filter.
	.TP
	.B private\-domain: \fI<domain name>
	Allow this domain, and all its subdomains to contain private addresses.
	Give multiple times to allow multiple domain names to contain private
	addresses. Default is none.
	.TP
	.B unwanted\-reply\-threshold: \fI<number>
	If set, a total number of unwanted replies is kept track of in every thread.
	When it reaches the threshold, a defensive action is taken and a warning
	is printed to the log. The defensive action is to clear the rrset and
	message caches, hopefully flushing away any poison. A value of 10 million
	is suggested. Default is 0 (turned off).
	.TP
	.B do\-not\-query\-address: \fI<IP address>
	Do not query the given IP address. Can be IP4 or IP6. Append /num to
	indicate a classless delegation netblock, for example like
	10.2.3.4/24 or 2001::11/64.
	.TP
	.B do\-not\-query\-localhost: \fI<yes or no>
	If yes, localhost is added to the do\-not\-query\-address entries, both
	IP6 ::1 and IP4 127.0.0.1/8. If no, then localhost can be used to send
	queries to. Default is yes.
	.TP
	.B prefetch: \fI<yes or no>
	If yes, message cache elements are prefetched before they expire to
	keep the cache up to date. Default is no. Turning it on gives about
	10 percent more traffic and load on the machine, but popular items do
	not expire from the cache.
	.TP
	-.B prefetch-key: \fI<yes or no>
	+.B prefetch\-key: \fI<yes or no>
	If yes, fetch the DNSKEYs earlier in the validation process, when a DS
	record is encountered. This lowers the latency of requests. It does use
	a little more CPU. Also if the cache is set to 0, it is no use. Default is no.
	.TP
	-.B rrset-roundrobin: \fI<yes or no>
	+.B deny\-any: \fI<yes or no>
	+If yes, deny queries of type ANY with an empty response. Default is no.
	+If disabled, unbound responds with a short list of resource records if some
	+can be found in the cache and makes the upstream type ANY query if there
	+are none.
	+.TP
	+.B rrset\-roundrobin: \fI<yes or no>
	If yes, Unbound rotates RRSet order in response (the random number is taken
	from the query ID, for speed and thread safety). Default is no.
	.TP
	.B minimal-responses: \fI<yes or no>
	If yes, Unbound doesn't insert authority/additional sections into response
	messages when those sections are not required. This reduces response
	size significantly, and may avoid TCP fallback for some responses.
	This may cause a slight speedup. The default is yes, even though the DNS
	protocol RFCs mandate these sections, and the additional content could
	be of use and save roundtrips for clients. Because they are not used,
	and the saved roundtrips are easier saved with prefetch, whilst this is
	faster.
	.TP
	.B disable-dnssec-lame-check: \fI<yes or no>
	If true, disables the DNSSEC lameness check in the iterator. This check
	sees if RRSIGs are present in the answer, when dnssec is expected,
	and retries another authority if RRSIGs are unexpectedly missing.
	The validator will insist in RRSIGs for DNSSEC signed domains regardless
	of this setting, if a trust anchor is loaded.
	.TP
	.B module\-config: \fI<"module names">
	Module configuration, a list of module names separated by spaces, surround
	the string with quotes (""). The modules can be validator, iterator.
	Setting this to "iterator" will result in a non\-validating server.
	Setting this to "validator iterator" will turn on DNSSEC validation.
	The ordering of the modules is important.
	You must also set trust\-anchors for validation to be useful.
	+The default is "validator iterator". When the server is built with
	+EDNS client subnet support the default is "subnetcache validator iterator".
	+Most modules that need to be listed here have to be listed at the beginning
	+of the line. The cachedb module has to be listed just before the iterator.
	+The python module can be listed in different places, it then processes the
	+output of the module it is just before.
	.TP
	.B trust\-anchor\-file: \fI<filename>
	File with trusted keys for validation. Both DS and DNSKEY entries can appear
	in the file. The format of the file is the standard DNS Zone file format.
	Default is "", or no trust anchor file.
	.TP
	.B auto\-trust\-anchor\-file: \fI<filename>
	File with trust anchor for one zone, which is tracked with RFC5011 probes.
	The probes are several times per month, thus the machine must be online
	frequently. The initial file can be one with contents as described in
	\fBtrust\-anchor\-file\fR. The file is written to when the anchor is updated,
	so the unbound user must have write permission. Write permission to the file,
	but also to the directory it is in (to create a temporary file, which is
	necessary to deal with filesystem full events), it must also be inside the
	chroot (if that is used).
	.TP
	.B trust\-anchor: \fI<"Resource Record">
	A DS or DNSKEY RR for a key to use for validation. Multiple entries can be
	given to specify multiple trusted keys, in addition to the trust\-anchor\-files.
	The resource record is entered in the same format as 'dig' or 'drill' prints
	them, the same format as in the zone file. Has to be on a single line, with
	"" around it. A TTL can be specified for ease of cut and paste, but is ignored.
	A class can be specified, but class IN is default.
	.TP
	.B trusted\-keys\-file: \fI<filename>
	File with trusted keys for validation. Specify more than one file
	with several entries, one file per entry. Like \fBtrust\-anchor\-file\fR
	but has a different file format. Format is BIND\-9 style format,
	the trusted\-keys { name flag proto algo "key"; }; clauses are read.
	It is possible to use wildcards with this statement, the wildcard is
	expanded on start and on reload.
	.TP
	.B trust\-anchor\-signaling: \fI<yes or no>
	Send RFC8145 key tag query after trust anchor priming. Default is on.
	.TP
	.B root\-key\-sentinel: \fI<yes or no>
	Root key trust anchor sentinel. Default is on.
	.TP
	.B dlv\-anchor\-file: \fI<filename>
	This option was used during early days DNSSEC deployment when no parent-side
	DS record registrations were easily available. Nowadays, it is best to have
	DS records registered with the parent zone (many top level zones are signed).
	File with trusted keys for DLV (DNSSEC Lookaside Validation). Both DS and
	DNSKEY entries can be used in the file, in the same format as for
	\fItrust\-anchor\-file:\fR statements. Only one DLV can be configured, more
	would be slow. The DLV configured is used as a root trusted DLV, this
	means that it is a lookaside for the root. Default is "", or no dlv anchor
	file. DLV is going to be decommissioned. Please do not use it any more.
	.TP
	.B dlv\-anchor: \fI<"Resource Record">
	Much like trust\-anchor, this is a DLV anchor with the DS or DNSKEY inline.
	DLV is going to be decommissioned. Please do not use it any more.
	.TP
	.B domain\-insecure: \fI<domain name>
	Sets domain name to be insecure, DNSSEC chain of trust is ignored towards
	the domain name. So a trust anchor above the domain name can not make the
	domain secure with a DS record, such a DS record is then ignored.
	Also keys from DLV are ignored for the domain. Can be given multiple times
	to specify multiple domains that are treated as if unsigned. If you set
	trust anchors for the domain they override this setting (and the domain
	is secured).
	.IP
	This can be useful if you want to make sure a trust anchor for external
	lookups does not affect an (unsigned) internal domain. A DS record
	externally can create validation failures for that internal domain.
	.TP
	.B val\-override\-date: \fI<rrsig\-style date spec>
	Default is "" or "0", which disables this debugging feature. If enabled by
	giving a RRSIG style date, that date is used for verifying RRSIG inception
	and expiration dates, instead of the current date. Do not set this unless
	you are debugging signature inception and expiration. The value \-1 ignores
	the date altogether, useful for some special applications.
	.TP
	.B val\-sig\-skew\-min: \fI<seconds>
	Minimum number of seconds of clock skew to apply to validated signatures.
	A value of 10% of the signature lifetime (expiration \- inception) is
	used, capped by this setting. Default is 3600 (1 hour) which allows for
	daylight savings differences. Lower this value for more strict checking
	of short lived signatures.
	.TP
	.B val\-sig\-skew\-max: \fI<seconds>
	Maximum number of seconds of clock skew to apply to validated signatures.
	A value of 10% of the signature lifetime (expiration \- inception)
	is used, capped by this setting. Default is 86400 (24 hours) which
	allows for timezone setting problems in stable domains. Setting both
	min and max very low disables the clock skew allowances. Setting both
	min and max very high makes the validator check the signature timestamps
	less strictly.
	.TP
	.B val\-bogus\-ttl: \fI<number>
	The time to live for bogus data. This is data that has failed validation;
	due to invalid signatures or other checks. The TTL from that data cannot be
	trusted, and this value is used instead. The value is in seconds, default 60.
	The time interval prevents repeated revalidation of bogus data.
	.TP
	.B val\-clean\-additional: \fI<yes or no>
	Instruct the validator to remove data from the additional section of secure
	messages that are not signed properly. Messages that are insecure, bogus,
	indeterminate or unchecked are not affected. Default is yes. Use this setting
	to protect the users that rely on this validator for authentication from
	potentially bad data in the additional section.
	.TP
	.B val\-log\-level: \fI<number>
	Have the validator print validation failures to the log. Regardless of
	the verbosity setting. Default is 0, off. At 1, for every user query
	that fails a line is printed to the logs. This way you can monitor what
	happens with validation. Use a diagnosis tool, such as dig or drill,
	to find out why validation is failing for these queries. At 2, not only
	the query that failed is printed but also the reason why unbound thought
	it was wrong and which server sent the faulty data.
	.TP
	.B val\-permissive\-mode: \fI<yes or no>
	Instruct the validator to mark bogus messages as indeterminate. The security
	checks are performed, but if the result is bogus (failed security), the
	reply is not withheld from the client with SERVFAIL as usual. The client
	receives the bogus data. For messages that are found to be secure the AD bit
	is set in replies. Also logging is performed as for full validation.
	The default value is "no".
	.TP
	.B ignore\-cd\-flag: \fI<yes or no>
	Instruct unbound to ignore the CD flag from clients and refuse to
	return bogus answers to them. Thus, the CD (Checking Disabled) flag
	does not disable checking any more. This is useful if legacy (w2008)
	servers that set the CD flag but cannot validate DNSSEC themselves are
	the clients, and then unbound provides them with DNSSEC protection.
	The default value is "no".
	.TP
	.B serve\-expired: \fI<yes or no>
	If enabled, unbound attempts to serve old responses from cache with a
	TTL of 0 in the response without waiting for the actual resolution to finish.
	The actual resolution answer ends up in the cache later on. Default is "no".
	.TP
	.B serve\-expired\-ttl: \fI<seconds>
	Limit serving of expired responses to configured seconds after expiration. 0
	disables the limit. This option only applies when \fBserve\-expired\fR is
	enabled. The default is 0.
	.TP
	.B serve\-expired\-ttl\-reset: \fI<yes or no>
	Set the TTL of expired records to the \fBserve\-expired\-ttl\fR value after a
	failed attempt to retrieve the record from upstream. This makes sure that the
	expired records will be served as long as there are queries for it. Default is
	"no".
	.TP
	.B val\-nsec3\-keysize\-iterations: \fI<"list of values">
	List of keysize and iteration count values, separated by spaces, surrounded
	by quotes. Default is "1024 150 2048 500 4096 2500". This determines the
	maximum allowed NSEC3 iteration count before a message is simply marked
	insecure instead of performing the many hashing iterations. The list must
	be in ascending order and have at least one entry. If you set it to
	"1024 65535" there is no restriction to NSEC3 iteration values.
	This table must be kept short; a very long list could cause slower operation.
	.TP
	.B add\-holddown: \fI<seconds>
	Instruct the \fBauto\-trust\-anchor\-file\fR probe mechanism for RFC5011
	autotrust updates to add new trust anchors only after they have been
	visible for this time. Default is 30 days as per the RFC.
	.TP
	.B del\-holddown: \fI<seconds>
	Instruct the \fBauto\-trust\-anchor\-file\fR probe mechanism for RFC5011
	autotrust updates to remove revoked trust anchors after they have been
	kept in the revoked list for this long. Default is 30 days as per
	the RFC.
	.TP
	.B keep\-missing: \fI<seconds>
	Instruct the \fBauto\-trust\-anchor\-file\fR probe mechanism for RFC5011
	autotrust updates to remove missing trust anchors after they have been
	unseen for this long. This cleans up the state file if the target zone
	does not perform trust anchor revocation, so this makes the auto probe
	mechanism work with zones that perform regular (non\-5011) rollovers.
	The default is 366 days. The value 0 does not remove missing anchors,
	as per the RFC.
	.TP
	.B permit\-small\-holddown: \fI<yes or no>
	Debug option that allows the autotrust 5011 rollover timers to assume
	very small values. Default is no.
	.TP
	.B key\-cache\-size: \fI<number>
	Number of bytes size of the key cache. Default is 4 megabytes.
	A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
	or gigabytes (1024*1024 bytes in a megabyte).
	.TP
	.B key\-cache\-slabs: \fI<number>
	Number of slabs in the key cache. Slabs reduce lock contention by threads.
	Must be set to a power of 2. Setting (close) to the number of cpus is a
	reasonable guess.
	.TP
	.B neg\-cache\-size: \fI<number>
	Number of bytes size of the aggressive negative cache. Default is 1 megabyte.
	A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
	or gigabytes (1024*1024 bytes in a megabyte).
	.TP
	.B unblock\-lan\-zones: \fI<yes or no>
	Default is disabled. If enabled, then for private address space,
	the reverse lookups are no longer filtered. This allows unbound when
	running as dns service on a host where it provides service for that host,
	to put out all of the queries for the 'lan' upstream. When enabled,
	only localhost, 127.0.0.1 reverse and ::1 reverse zones are configured
	with default local zones. Disable the option when unbound is running
	as a (DHCP-) DNS network resolver for a group of machines, where such
	lookups should be filtered (RFC compliance), this also stops potential
	data leakage about the local network to the upstream DNS servers.
	.TP
	.B insecure\-lan\-zones: \fI<yes or no>
	Default is disabled. If enabled, then reverse lookups in private
	address space are not validated. This is usually required whenever
	\fIunblock\-lan\-zones\fR is used.
	.TP
	.B local\-zone: \fI<zone> <type>
	Configure a local zone. The type determines the answer to give if
	there is no match from local\-data. The types are deny, refuse, static,
	transparent, redirect, nodefault, typetransparent, inform, inform_deny,
	-always_transparent, always_refuse, always_nxdomain, noview,
	+inform_redirect, always_transparent, always_refuse, always_nxdomain, noview,
	and are explained below. After that the default settings are listed. Use
	local\-data: to enter data into the local zone. Answers for local zones
	are authoritative DNS answers. By default the zones are class IN.
	.IP
	If you need more complicated authoritative data, with referrals, wildcards,
	CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for
	it as detailed in the stub zone section below.
	.TP 10
	\h'5'\fIdeny\fR
	Do not send an answer, drop the query.
	If there is a match from local data, the query is answered.
	.TP 10
	\h'5'\fIrefuse\fR
	Send an error message reply, with rcode REFUSED.
	If there is a match from local data, the query is answered.
	.TP 10
	\h'5'\fIstatic\fR
	If there is a match from local data, the query is answered.
	Otherwise, the query is answered with nodata or nxdomain.
	For a negative answer a SOA is included in the answer if present
	as local\-data for the zone apex domain.
	.TP 10
	\h'5'\fItransparent\fR
	If there is a match from local data, the query is answered.
	Otherwise if the query has a different name, the query is resolved normally.
	If the query is for a name given in localdata but no such type of data is
	given in localdata, then a noerror nodata answer is returned.
	If no local\-zone is given local\-data causes a transparent zone
	to be created by default.
	.TP 10
	\h'5'\fItypetransparent\fR
	If there is a match from local data, the query is answered. If the query
	is for a different name, or for the same name but for a different type,
	the query is resolved normally. So, similar to transparent but types
	that are not listed in local data are resolved normally, so if an A record
	is in the local data that does not cause a nodata reply for AAAA queries.
	.TP 10
	\h'5'\fIredirect\fR
	The query is answered from the local data for the zone name.
	There may be no local data beneath the zone name.
	This answers queries for the zone, and all subdomains of the zone
	with the local data for the zone.
	It can be used to redirect a domain to return a different address record
	to the end user, with
	local\-zone: "example.com." redirect and
	local\-data: "example.com. A 127.0.0.1"
	queries for www.example.com and www.foo.example.com are redirected, so
	that users with web browsers cannot access sites with suffix example.com.
	.TP 10
	\h'5'\fIinform\fR
	The query is answered normally, same as transparent. The client IP
	address (@portnumber) is printed to the logfile. The log message is:
	timestamp, unbound-pid, info: zonename inform IP@port queryname type
	class. This option can be used for normal resolution, but machines
	looking up infected names are logged, eg. to run antivirus on them.
	.TP 10
	\h'5'\fIinform_deny\fR
	The query is dropped, like 'deny', and logged, like 'inform'. Ie. find
	infected machines without answering the queries.
	.TP 10
	+\h'5'\fIinform_redirect\fR
	+The query is redirected, like 'redirect', and logged, like 'inform'.
	+Ie. answer queries with fixed data and also log the machines that ask.
	+.TP 10
	\h'5'\fIalways_transparent\fR
	Like transparent, but ignores local data and resolves normally.
	.TP 10
	\h'5'\fIalways_refuse\fR
	Like refuse, but ignores local data and refuses the query.
	.TP 10
	\h'5'\fIalways_nxdomain\fR
	Like static, but ignores local data and returns nxdomain for the query.
	.TP 10
	\h'5'\fInoview\fR
	Breaks out of that view and moves towards the global local zones for answer
	to the query. If the view first is no, it'll resolve normally. If view first
	is enabled, it'll break perform that step and check the global answers.
	For when the view has view specific overrides but some zone has to be
	answered from global local zone contents.
	.TP 10
	\h'5'\fInodefault\fR
	Used to turn off default contents for AS112 zones. The other types
	also turn off default contents for the zone. The 'nodefault' option
	has no other effect than turning off default contents for the
	given zone. Use \fInodefault\fR if you use exactly that zone, if you want to
	use a subzone, use \fItransparent\fR.
	.P
	The default zones are localhost, reverse 127.0.0.1 and ::1, the onion, test,
	invalid and the AS112 zones. The AS112 zones are reverse DNS zones for
	private use and reserved IP addresses for which the servers on the internet
	cannot provide correct answers. They are configured by default to give
	nxdomain (no reverse information) answers. The defaults can be turned off
	by specifying your own local\-zone of that name, or using the 'nodefault'
	type. Below is a list of the default zone contents.
	.TP 10
	\h'5'\fIlocalhost\fR
	The IP4 and IP6 localhost information is given. NS and SOA records are provided
	for completeness and to satisfy some DNS update tools. Default content:
	.nf
	local\-zone: "localhost." redirect
	local\-data: "localhost. 10800 IN NS localhost."
	local\-data: "localhost. 10800 IN
	SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
	local\-data: "localhost. 10800 IN A 127.0.0.1"
	local\-data: "localhost. 10800 IN AAAA ::1"
	.fi
	.TP 10
	\h'5'\fIreverse IPv4 loopback\fR
	Default content:
	.nf
	local\-zone: "127.in\-addr.arpa." static
	local\-data: "127.in\-addr.arpa. 10800 IN NS localhost."
	local\-data: "127.in\-addr.arpa. 10800 IN
	SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
	local\-data: "1.0.0.127.in\-addr.arpa. 10800 IN
	PTR localhost."
	.fi
	.TP 10
	\h'5'\fIreverse IPv6 loopback\fR
	Default content:
	.nf
	local\-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
	0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." static
	local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
	0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN
	NS localhost."
	local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
	0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN
	SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
	local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
	0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN
	PTR localhost."
	.fi
	.TP 10
	\h'5'\fIonion (RFC 7686)\fR
	Default content:
	.nf
	local\-zone: "onion." static
	local\-data: "onion. 10800 IN NS localhost."
	local\-data: "onion. 10800 IN
	SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
	.fi
	.TP 10
	\h'5'\fItest (RFC 2606)\fR
	Default content:
	.nf
	local\-zone: "test." static
	local\-data: "test. 10800 IN NS localhost."
	local\-data: "test. 10800 IN
	SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
	.fi
	.TP 10
	\h'5'\fIinvalid (RFC 2606)\fR
	Default content:
	.nf
	local\-zone: "invalid." static
	local\-data: "invalid. 10800 IN NS localhost."
	local\-data: "invalid. 10800 IN
	SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
	.fi
	.TP 10
	\h'5'\fIreverse RFC1918 local use zones\fR
	Reverse data for zones 10.in\-addr.arpa, 16.172.in\-addr.arpa to
	31.172.in\-addr.arpa, 168.192.in\-addr.arpa.
	The \fBlocal\-zone:\fR is set static and as \fBlocal\-data:\fR SOA and NS
	records are provided.
	.TP 10
	\h'5'\fIreverse RFC3330 IP4 this, link\-local, testnet and broadcast\fR
	Reverse data for zones 0.in\-addr.arpa, 254.169.in\-addr.arpa,
	2.0.192.in\-addr.arpa (TEST NET 1), 100.51.198.in\-addr.arpa (TEST NET 2),
	113.0.203.in\-addr.arpa (TEST NET 3), 255.255.255.255.in\-addr.arpa.
	And from 64.100.in\-addr.arpa to 127.100.in\-addr.arpa (Shared Address Space).
	.TP 10
	\h'5'\fIreverse RFC4291 IP6 unspecified\fR
	Reverse data for zone
	.nf
	0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
	0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.
	.fi
	.TP 10
	\h'5'\fIreverse RFC4193 IPv6 Locally Assigned Local Addresses\fR
	Reverse data for zone D.F.ip6.arpa.
	.TP 10
	\h'5'\fIreverse RFC4291 IPv6 Link Local Addresses\fR
	Reverse data for zones 8.E.F.ip6.arpa to B.E.F.ip6.arpa.
	.TP 10
	\h'5'\fIreverse IPv6 Example Prefix\fR
	Reverse data for zone 8.B.D.0.1.0.0.2.ip6.arpa. This zone is used for
	tutorials and examples. You can remove the block on this zone with:
	.nf
	local\-zone: 8.B.D.0.1.0.0.2.ip6.arpa. nodefault
	.fi
	You can also selectively unblock a part of the zone by making that part
	transparent with a local\-zone statement.
	This also works with the other default zones.
	.\" End of local-zone listing.
	.TP 5
	.B local\-data: \fI"<resource record string>"
	Configure local data, which is served in reply to queries for it.
	The query has to match exactly unless you configure the local\-zone as
	redirect. If not matched exactly, the local\-zone type determines
	further processing. If local\-data is configured that is not a subdomain of
	a local\-zone, a transparent local\-zone is configured.
	For record types such as TXT, use single quotes, as in
	local\-data: 'example. TXT "text"'.
	.IP
	If you need more complicated authoritative data, with referrals, wildcards,
	CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for
	it as detailed in the stub zone section below.
	.TP 5
	.B local\-data\-ptr: \fI"IPaddr name"
	Configure local data shorthand for a PTR record with the reversed IPv4 or
	IPv6 address and the host name. For example "192.0.2.4 www.example.com".
	TTL can be inserted like this: "2001:DB8::4 7200 www.example.com"
	.TP 5
	.B local\-zone\-tag: \fI<zone> <"list of tags">
	Assign tags to localzones. Tagged localzones will only be applied when the
	used access-control element has a matching tag. Tags must be defined in
	\fIdefine\-tags\fR. Enclose list of tags in quotes ("") and put spaces between
	-tags.
	+tags. When there are multiple tags it checks if the intersection of the
	+list of tags for the query and local\-zone\-tag is non-empty.
	.TP 5
	.B local\-zone\-override: \fI<zone> <IP netblock> <type>
	Override the localzone type for queries from addresses matching netblock.
	Use this localzone type, regardless the type configured for the local-zone
	(both tagged and untagged) and regardless the type configured using
	access\-control\-tag\-action.
	.TP 5
	.B ratelimit: \fI<number or 0>
	Enable ratelimiting of queries sent to nameserver for performing recursion.
	If 0, the default, it is disabled. This option is experimental at this time.
	The ratelimit is in queries per second that are allowed. More queries are
	turned away with an error (servfail). This stops recursive floods, eg. random
	query names, but not spoofed reflection floods. Cached responses are not
	ratelimited by this setting. The zone of the query is determined by examining
	the nameservers for it, the zone name is used to keep track of the rate.
	For example, 1000 may be a suitable value to stop the server from being
	overloaded with random names, and keeps unbound from sending traffic to the
	nameservers for those zones.
	.TP 5
	.B ratelimit\-size: \fI<memory size>
	Give the size of the data structure in which the current ongoing rates are
	kept track in. Default 4m. In bytes or use m(mega), k(kilo), g(giga).
	The ratelimit structure is small, so this data structure likely does
	not need to be large.
	.TP 5
	.B ratelimit\-slabs: \fI<number>
	Give power of 2 number of slabs, this is used to reduce lock contention
	in the ratelimit tracking data structure. Close to the number of cpus is
	a fairly good setting.
	.TP 5
	.B ratelimit\-factor: \fI<number>
	Set the amount of queries to rate limit when the limit is exceeded.
	If set to 0, all queries are dropped for domains where the limit is
	exceeded. If set to another value, 1 in that number is allowed through
	to complete. Default is 10, allowing 1/10 traffic to flow normally.
	This can make ordinary queries complete (if repeatedly queried for),
	and enter the cache, whilst also mitigating the traffic flow by the
	factor given.
	.TP 5
	.B ratelimit\-for\-domain: \fI<domain> <number qps or 0>
	Override the global ratelimit for an exact match domain name with the listed
	number. You can give this for any number of names. For example, for
	a top\-level\-domain you may want to have a higher limit than other names.
	A value of 0 will disable ratelimiting for that domain.
	.TP 5
	.B ratelimit\-below\-domain: \fI<domain> <number qps or 0>
	Override the global ratelimit for a domain name that ends in this name.
	You can give this multiple times, it then describes different settings
	in different parts of the namespace. The closest matching suffix is used
	to determine the qps limit. The rate for the exact matching domain name
	is not changed, use ratelimit\-for\-domain to set that, you might want
	to use different settings for a top\-level\-domain and subdomains.
	A value of 0 will disable ratelimiting for domain names that end in this name.
	.TP 5
	.B ip\-ratelimit: \fI<number or 0>
	Enable global ratelimiting of queries accepted per ip address.
	If 0, the default, it is disabled. This option is experimental at this time.
	The ratelimit is in queries per second that are allowed. More queries are
	completely dropped and will not receive a reply, SERVFAIL or otherwise.
	IP ratelimiting happens before looking in the cache. This may be useful for
	mitigating amplification attacks.
	.TP 5
	.B ip\-ratelimit\-size: \fI<memory size>
	Give the size of the data structure in which the current ongoing rates are
	kept track in. Default 4m. In bytes or use m(mega), k(kilo), g(giga).
	The ip ratelimit structure is small, so this data structure likely does
	not need to be large.
	.TP 5
	.B ip\-ratelimit\-slabs: \fI<number>
	Give power of 2 number of slabs, this is used to reduce lock contention
	in the ip ratelimit tracking data structure. Close to the number of cpus is
	a fairly good setting.
	.TP 5
	.B ip\-ratelimit\-factor: \fI<number>
	Set the amount of queries to rate limit when the limit is exceeded.
	If set to 0, all queries are dropped for addresses where the limit is
	exceeded. If set to another value, 1 in that number is allowed through
	to complete. Default is 10, allowing 1/10 traffic to flow normally.
	This can make ordinary queries complete (if repeatedly queried for),
	and enter the cache, whilst also mitigating the traffic flow by the
	factor given.
	.TP 5
	-.B low\-rtt: \fI<msec time>
	-Set the time in millisecond that is considere a low ping time for fast
	-server selection with the low\-rtt\-permil option, that turns this on or off.
	-The default is 45 msec, a number from IPv6 quick response documents.
	+.B fast\-server\-permil: \fI<number>
	+Specify how many times out of 1000 to pick from the set of fastest servers.
	+0 turns the feature off. A value of 900 would pick from the fastest
	+servers 90 percent of the time, and would perform normal exploration of random
	+servers for the remaining time. When prefetch is enabled (or serve\-expired),
	+such prefetches are not sped up, because there is no one waiting for it, and it
	+presents a good moment to perform server exploration. The
	+\fBfast\-server\-num\fR option can be used to specify the size of the fastest
	+servers set. The default for fast\-server\-permil is 0.
	.TP 5
	-.B low\-rtt\-permil: \fI<number>
	-Specify how many times out of 1000 to pick the fast server from the low
	-rtt band. 0 turns the feature off. A value of 900 would pick the fast
	-server when such fast servers are available 90 percent of the time, and
	-the remaining time perform normal exploration of random servers.
	-When prefetch is enabled (or serve\-expired), such prefetches are not
	-sped up, because there is no one waiting for it, and it presents a good
	-moment to perform server exploration. The low\-rtt option can be used
	-to specify which servers are picked for fast server selection, servers
	-with a ping roundtrip time below that value are considered.
	-The default for low\-rtt\-permil is 0.
	+.B fast\-server\-num: \fI<number>
	+Set the number of servers that should be used for fast server selection. Only
	+use the fastest specified number of servers with the fast\-server\-permil
	+option, that turns this on or off. The default is to use the fastest 3 servers.
	.SS "Remote Control Options"
	In the
	.B remote\-control:
	clause are the declarations for the remote control facility. If this is
	enabled, the \fIunbound\-control\fR(8) utility can be used to send
	commands to the running unbound server. The server uses these clauses
	to setup TLSv1 security for the connection. The
	\fIunbound\-control\fR(8) utility also reads the \fBremote\-control\fR
	section for options. To setup the correct self\-signed certificates use the
	\fIunbound\-control\-setup\fR(8) utility.
	.TP 5
	.B control\-enable: \fI<yes or no>
	The option is used to enable remote control, default is "no".
	If turned off, the server does not listen for control commands.
	.TP 5
	.B control\-interface: \fI<ip address or path>
	Give IPv4 or IPv6 addresses or local socket path to listen on for
	control commands.
	By default localhost (127.0.0.1 and ::1) is listened to.
	Use 0.0.0.0 and ::0 to listen to all interfaces.
	If you change this and permissions have been dropped, you must restart
	the server for the change to take effect.
	.IP
	If you set it to an absolute path, a local socket is used. The local socket
	does not use the certificates and keys, so those files need not be present.
	To restrict access, unbound sets permissions on the file to the user and
	group that is configured, the access bits are set to allow the group members
	to access the control socket file. Put users that need to access the socket
	in the that group. To restrict access further, create a directory to put
	the control socket in and restrict access to that directory.
	.TP 5
	.B control\-port: \fI<port number>
	The port number to listen on for IPv4 or IPv6 control interfaces,
	default is 8953.
	If you change this and permissions have been dropped, you must restart
	the server for the change to take effect.
	.TP 5
	.B control\-use\-cert: \fI<yes or no>
	For localhost control-interface you can disable the use of TLS by setting
	this option to "no", default is "yes". For local sockets, TLS is disabled
	and the value of this option is ignored.
	.TP 5
	.B server\-key\-file: \fI<private key file>
	Path to the server private key, by default unbound_server.key.
	This file is generated by the \fIunbound\-control\-setup\fR utility.
	This file is used by the unbound server, but not by \fIunbound\-control\fR.
	.TP 5
	.B server\-cert\-file: \fI<certificate file.pem>
	Path to the server self signed certificate, by default unbound_server.pem.
	This file is generated by the \fIunbound\-control\-setup\fR utility.
	This file is used by the unbound server, and also by \fIunbound\-control\fR.
	.TP 5
	.B control\-key\-file: \fI<private key file>
	Path to the control client private key, by default unbound_control.key.
	This file is generated by the \fIunbound\-control\-setup\fR utility.
	This file is used by \fIunbound\-control\fR.
	.TP 5
	.B control\-cert\-file: \fI<certificate file.pem>
	Path to the control client certificate, by default unbound_control.pem.
	This certificate has to be signed with the server certificate.
	This file is generated by the \fIunbound\-control\-setup\fR utility.
	This file is used by \fIunbound\-control\fR.
	.SS "Stub Zone Options"
	.LP
	There may be multiple
	.B stub\-zone:
	clauses. Each with a name: and zero or more hostnames or IP addresses.
	For the stub zone this list of nameservers is used. Class IN is assumed.
	The servers should be authority servers, not recursors; unbound performs
	the recursive processing itself for stub zones.
	.P
	The stub zone can be used to configure authoritative data to be used
	by the resolver that cannot be accessed using the public internet servers.
	This is useful for company\-local data or private zones. Setup an
	authoritative server on a different host (or different port). Enter a config
	entry for unbound with
	.B stub\-addr:
	<ip address of host[@port]>.
	The unbound resolver can then access the data, without referring to the
	public internet for it.
	.P
	This setup allows DNSSEC signed zones to be served by that
	authoritative server, in which case a trusted key entry with the public key
	can be put in config, so that unbound can validate the data and set the AD
	bit on replies for the private zone (authoritative servers do not set the
	AD bit). This setup makes unbound capable of answering queries for the
	private zone, and can even set the AD bit ('authentic'), but the AA
	('authoritative') bit is not set on these replies.
	.P
	Consider adding \fBserver:\fR statements for \fBdomain\-insecure:\fR and
	for \fBlocal\-zone:\fI name nodefault\fR for the zone if it is a locally
	served zone. The insecure clause stops DNSSEC from invalidating the
	zone. The local zone nodefault (or \fItransparent\fR) clause makes the
	(reverse\-) zone bypass unbound's filtering of RFC1918 zones.
	.TP
	.B name: \fI<domain name>
	Name of the stub zone.
	.TP
	.B stub\-host: \fI<domain name>
	Name of stub zone nameserver. Is itself resolved before it is used.
	.TP
	.B stub\-addr: \fI<IP address>
	IP address of stub zone nameserver. Can be IP 4 or IP 6.
	To use a nondefault port for DNS communication append '@' with the port number.
	.TP
	.B stub\-prime: \fI<yes or no>
	This option is by default no. If enabled it performs NS set priming,
	which is similar to root hints, where it starts using the list of nameservers
	currently published by the zone. Thus, if the hint list is slightly outdated,
	the resolver picks up a correct list online.
	.TP
	.B stub\-first: \fI<yes or no>
	If enabled, a query is attempted without the stub clause if it fails.
	The data could not be retrieved and would have caused SERVFAIL because
	the servers are unreachable, instead it is tried without this clause.
	The default is no.
	.TP
	.B stub\-tls\-upstream: \fI<yes or no>
	Enabled or disable whether the queries to this stub use TLS for transport.
	Default is no.
	.TP
	.B stub\-ssl\-upstream: \fI<yes or no>
	Alternate syntax for \fBstub\-tls\-upstream\fR.
	.TP
	.B stub\-no\-cache: \fI<yes or no>
	Default is no. If enabled, data inside the stub is not cached. This is
	useful when you want immediate changes to be visible.
	.SS "Forward Zone Options"
	.LP
	There may be multiple
	.B forward\-zone:
	clauses. Each with a \fBname:\fR and zero or more hostnames or IP
	addresses. For the forward zone this list of nameservers is used to
	forward the queries to. The servers listed as \fBforward\-host:\fR and
	\fBforward\-addr:\fR have to handle further recursion for the query. Thus,
	those servers are not authority servers, but are (just like unbound is)
	recursive servers too; unbound does not perform recursion itself for the
	forward zone, it lets the remote server do it. Class IN is assumed.
	CNAMEs are chased by unbound itself, asking the remote server for every
	name in the indirection chain, to protect the local cache from illegal
	indirect referenced items.
	A forward\-zone entry with name "." and a forward\-addr target will
	forward all queries to that other server (unless it can answer from
	the cache).
	.TP
	.B name: \fI<domain name>
	Name of the forward zone.
	.TP
	.B forward\-host: \fI<domain name>
	Name of server to forward to. Is itself resolved before it is used.
	.TP
	.B forward\-addr: \fI<IP address>
	IP address of server to forward to. Can be IP 4 or IP 6.
	To use a nondefault port for DNS communication append '@' with the port number.
	If tls is enabled, then you can append a '#' and a name, then it'll check
	the tls authentication certificates with that name. If you combine
	the '@' and '#', the '@' comes first.
	.IP
	At high verbosity it logs the TLS certificate, with TLS enabled.
	If you leave out the '#' and auth name from the forward\-addr, any
	name is accepted. The cert must also match a CA from the tls\-cert\-bundle.
	-The cert name match code needs OpenSSL 1.1.0 or later to be enabled.
	.TP
	.B forward\-first: \fI<yes or no>
	-If enabled, a query is attempted without the forward clause if it fails.
	-The data could not be retrieved and would have caused SERVFAIL because
	-the servers are unreachable, instead it is tried without this clause.
	-The default is no.
	+If a forwarded query is met with a SERVFAIL error, and this option is
	+enabled, unbound will fall back to normal recursive resolution for this
	+query as if no query forwarding had been specified. The default is "no".
	.TP
	.B forward\-tls\-upstream: \fI<yes or no>
	Enabled or disable whether the queries to this forwarder use TLS for transport.
	Default is no.
	If you enable this, also configure a tls\-cert\-bundle or use tls\-win\-cert to
	load CA certs, otherwise the connections cannot be authenticated.
	.TP
	.B forward\-ssl\-upstream: \fI<yes or no>
	Alternate syntax for \fBforward\-tls\-upstream\fR.
	.TP
	.B forward\-no\-cache: \fI<yes or no>
	Default is no. If enabled, data inside the forward is not cached. This is
	useful when you want immediate changes to be visible.
	.SS "Authority Zone Options"
	.LP
	Authority zones are configured with \fBauth\-zone:\fR, and each one must
	have a \fBname:\fR. There can be multiple ones, by listing multiple auth\-zone clauses, each with a different name, pertaining to that part of the namespace.
	The authority zone with the name closest to the name looked up is used.
	Authority zones are processed after \fBlocal\-zones\fR and before
	cache (\fBfor\-downstream:\fR \fIyes\fR), and when used in this manner
	make unbound respond like an authority server. Authority zones are also
	processed after cache, just before going to the network to fetch
	information for recursion (\fBfor\-upstream:\fR \fIyes\fR), and when used
	in this manner provide a local copy of an authority server that speeds up
	lookups of that data.
	.LP
	Authority zones can be read from zonefile. And can be kept updated via
	AXFR and IXFR. After update the zonefile is rewritten. The update mechanism
	uses the SOA timer values and performs SOA UDP queries to detect zone changes.
	+.LP
	+If the update fetch fails, the timers in the SOA record are used to time
	+another fetch attempt. Until the SOA expiry timer is reached. Then the
	+zone is expired. When a zone is expired, queries are SERVFAIL, and
	+any new serial number is accepted from the master (even if older), and if
	+fallback is enabled, the fallback activates to fetch from the upstream instead
	+of the SERVFAIL.
	.TP
	.B name: \fI<zone name>
	Name of the authority zone.
	.TP
	.B master: \fI<IP address or host name>
	Where to download a copy of the zone from, with AXFR and IXFR. Multiple
	masters can be specified. They are all tried if one fails.
	+With the "ip#name" notation a AXFR over TLS can be used.
	.TP
	.B url: \fI<url to zonefile>
	Where to download a zonefile for the zone. With http or https. An example
	for the url is "http://www.example.com/example.org.zone". Multiple url
	statements can be given, they are tried in turn. If only urls are given
	the SOA refresh timer is used to wait for making new downloads. If also
	masters are listed, the masters are first probed with UDP SOA queries to
	see if the SOA serial number has changed, reducing the number of downloads.
	If none of the urls work, the masters are tried with IXFR and AXFR.
	For https, the \fBtls\-cert\-bundle\fR and the hostname from the url are used
	to authenticate the connection.
	.TP
	.B allow\-notify: \fI<IP address or host name or netblockIP/prefix>
	With allow\-notify you can specify additional sources of notifies.
	When notified, the server attempts to first probe and then zone transfer.
	If the notify is from a master, it first attempts that master. Otherwise
	other masters are attempted. If there are no masters, but only urls, the
	file is downloaded when notified. The masters from master: statements are
	allowed notify by default.
	.TP
	.B fallback\-enabled: \fI<yes or no>
	Default no. If enabled, unbound falls back to querying the internet as
	a resolver for this zone when lookups fail. For example for DNSSEC
	validation failures.
	.TP
	.B for\-downstream: \fI<yes or no>
	Default yes. If enabled, unbound serves authority responses to
	downstream clients for this zone. This option makes unbound behave, for
	the queries with names in this zone, like one of the authority servers for
	that zone. Turn it off if you want unbound to provide recursion for the
	zone but have a local copy of zone data. If for\-downstream is no and
	for\-upstream is yes, then unbound will DNSSEC validate the contents of the
	zone before serving the zone contents to clients and store validation
	results in the cache.
	.TP
	.B for\-upstream: \fI<yes or no>
	Default yes. If enabled, unbound fetches data from this data collection
	for answering recursion queries. Instead of sending queries over the internet
	to the authority servers for this zone, it'll fetch the data directly from
	the zone data. Turn it on when you want unbound to provide recursion for
	downstream clients, and use the zone data as a local copy to speed up lookups.
	.TP
	.B zonefile: \fI<filename>
	The filename where the zone is stored. If not given then no zonefile is used.
	If the file does not exist or is empty, unbound will attempt to fetch zone
	data (eg. from the master servers).
	.SS "View Options"
	.LP
	There may be multiple
	.B view:
	clauses. Each with a \fBname:\fR and zero or more \fBlocal\-zone\fR and
	-\fBlocal\-data\fR elements. View can be mapped to requests by specifying the
	+\fBlocal\-data\fR elements. Views can also contain view\-first,
	+response\-ip, response\-ip\-data and local\-data\-ptr elements.
	+View can be mapped to requests by specifying the
	view name in an \fBaccess\-control\-view\fR element. Options from matching
	views will override global options. Global options will be used if no matching
	view is found, or when the matching view does not have the option specified.
	.TP
	.B name: \fI<view name>
	Name of the view. Must be unique. This name is used in access\-control\-view
	elements.
	.TP
	.B local\-zone: \fI<zone> <type>
	View specific local\-zone elements. Has the same types and behaviour as the
	global local\-zone elements. When there is at least one local\-zone specified
	and view\-first is no, the default local-zones will be added to this view.
	Defaults can be disabled using the nodefault type. When view\-first is yes or
	when a view does not have a local\-zone, the global local\-zone will be used
	including it's default zones.
	.TP
	.B local\-data: \fI"<resource record string>"
	View specific local\-data elements. Has the same behaviour as the global
	local\-data elements.
	.TP
	.B local\-data\-ptr: \fI"IPaddr name"
	View specific local\-data\-ptr elements. Has the same behaviour as the global
	local\-data\-ptr elements.
	.TP
	.B view\-first: \fI<yes or no>
	If enabled, it attempts to use the global local\-zone and local\-data if there
	is no match in the view specific options.
	The default is no.
	.SS "Python Module Options"
	.LP
	The
	.B python:
	clause gives the settings for the \fIpython\fR(1) script module. This module
	acts like the iterator and validator modules do, on queries and answers.
	To enable the script module it has to be compiled into the daemon,
	and the word "python" has to be put in the \fBmodule\-config:\fR option
	(usually first, or between the validator and iterator).
	.LP
	If the \fBchroot:\fR option is enabled, you should make sure Python's
	library directory structure is bind mounted in the new root environment, see
	\fImount\fR(8). Also the \fBpython\-script:\fR path should be specified as an
	absolute path relative to the new root, or as a relative path to the working
	directory.
	.TP
	.B python\-script: \fI<python file>\fR
	The script file to load.
	.SS "DNS64 Module Options"
	.LP
	The dns64 module must be configured in the \fBmodule\-config:\fR "dns64
	validator iterator" directive and be compiled into the daemon to be
	enabled. These settings go in the \fBserver:\fR section.
	.TP
	.B dns64\-prefix: \fI<IPv6 prefix>\fR
	This sets the DNS64 prefix to use to synthesize AAAA records with.
	It must be /96 or shorter. The default prefix is 64:ff9b::/96.
	.TP
	.B dns64\-synthall: \fI<yes or no>\fR
	Debug option, default no. If enabled, synthesize all AAAA records
	despite the presence of actual AAAA records.
	.TP
	.B dns64\-ignore\-aaaa: \fI<name>\fR
	List domain for which the AAAA records are ignored and the A record is
	used by dns64 processing instead. Can be entered multiple times, list a
	new domain for which it applies, one per line. Applies also to names
	underneath the name given.
	.SS "DNSCrypt Options"
	.LP
	The
	.B dnscrypt:
	clause gives the settings of the dnscrypt channel. While those options are
	available, they are only meaningful if unbound was compiled with
	\fB\-\-enable\-dnscrypt\fR.
	Currently certificate and secret/public keys cannot be generated by unbound.
	You can use dnscrypt-wrapper to generate those: https://github.com/cofyc/\
	dnscrypt-wrapper/blob/master/README.md#usage
	.TP
	.B dnscrypt\-enable: \fI<yes or no>\fR
	Whether or not the \fBdnscrypt\fR config should be enabled. You may define
	configuration but not activate it.
	The default is no.
	.TP
	.B dnscrypt\-port: \fI<port number>
	On which port should \fBdnscrypt\fR should be activated. Note that you should
	have a matching \fBinterface\fR option defined in the \fBserver\fR section for
	this port.
	.TP
	.B dnscrypt\-provider: \fI<provider name>\fR
	The provider name to use to distribute certificates. This is of the form:
	\fB2.dnscrypt-cert.example.com.\fR. The name \fIMUST\fR end with a dot.
	.TP
	.B dnscrypt\-secret\-key: \fI<path to secret key file>\fR
	Path to the time limited secret key file. This option may be specified multiple
	times.
	.TP
	.B dnscrypt\-provider\-cert: \fI<path to cert file>\fR
	Path to the certificate related to the \fBdnscrypt\-secret\-key\fRs.
	This option may be specified multiple times.
	.TP
	.B dnscrypt\-provider\-cert\-rotated: \fI<path to cert file>\fR
	Path to a certificate that we should be able to serve existing connection from
	but do not want to advertise over \fBdnscrypt\-provider\fR's TXT record certs
	distribution.
	A typical use case is when rotating certificates, existing clients may still use
	the client magic from the old cert in their queries until they fetch and update
	the new cert. Likewise, it would allow one to prime the new cert/key without
	distributing the new cert yet, this can be useful when using a network of
	servers using anycast and on which the configuration may not get updated at the
	exact same time. By priming the cert, the servers can handle both old and new
	certs traffic while distributing only one.
	This option may be specified multiple times.
	.TP
	.B dnscrypt\-shared\-secret\-cache\-size: \fI<memory size>
	Give the size of the data structure in which the shared secret keys are kept
	in. Default 4m. In bytes or use m(mega), k(kilo), g(giga).
	The shared secret cache is used when a same client is making multiple queries
	using the same public key. It saves a substantial amount of CPU.
	.TP
	.B dnscrypt\-shared\-secret\-cache\-slabs: \fI<number>
	Give power of 2 number of slabs, this is used to reduce lock contention
	in the dnscrypt shared secrets cache. Close to the number of cpus is
	a fairly good setting.
	.TP
	.B dnscrypt\-nonce\-cache\-size: \fI<memory size>
	Give the size of the data structure in which the client nonces are kept in.
	Default 4m. In bytes or use m(mega), k(kilo), g(giga).
	The nonce cache is used to prevent dnscrypt message replaying. Client nonce
	should be unique for any pair of client pk/server sk.
	.TP
	.B dnscrypt\-nonce\-cache\-slabs: \fI<number>
	Give power of 2 number of slabs, this is used to reduce lock contention
	in the dnscrypt nonce cache. Close to the number of cpus is
	a fairly good setting.
	.SS "EDNS Client Subnet Module Options"
	.LP
	The ECS module must be configured in the \fBmodule\-config:\fR "subnetcache
	validator iterator" directive and be compiled into the daemon to be
	enabled. These settings go in the \fBserver:\fR section.
	.LP
	If the destination address is whitelisted with Unbound will add the EDNS0
	option to the query containing the relevant part of the client's address. When
	an answer contains the ECS option the response and the option are placed in a
	specialized cache. If the authority indicated no support, the response is
	stored in the regular cache.
	.LP
	Additionally, when a client includes the option in its queries, Unbound will
	forward the option to the authority if present in the whitelist, or
	\fBclient\-subnet\-always\-forward\fR is set to yes. In this case the lookup in
	the regular cache is skipped.
	.LP
	The maximum size of the ECS cache is controlled by 'msg-cache-size' in the
	configuration file. On top of that, for each query only 100 different subnets
	are allowed to be stored for each address family. Exceeding that number, older
	entries will be purged from cache.
	.TP
	.B send\-client\-subnet: \fI<IP address>\fR
	Send client source address to this authority. Append /num to indicate a
	classless delegation netblock, for example like 10.2.3.4/24 or 2001::11/64. Can
	be given multiple times. Authorities not listed will not receive edns-subnet
	information, unless domain in query is specified in \fBclient\-subnet\-zone\fR.
	.TP
	.B client\-subnet\-zone: \fI<domain>\fR
	Send client source address in queries for this domain and its subdomains. Can be
	given multiple times. Zones not listed will not receive edns-subnet information,
	unless hosted by authority specified in \fBsend\-client\-subnet\fR.
	.TP
	.B client\-subnet\-always\-forward: \fI<yes or no>\fR
	Specify whether the ECS whitelist check (configured using
	\fBsend\-client\-subnet\fR) is applied for all queries, even if the triggering
	query contains an ECS record, or only for queries for which the ECS record is
	generated using the querier address (and therefore did not contain ECS data in
	the client query). If enabled, the whitelist check is skipped when the client
	query contains an ECS record. Default is no.
	.TP
	.B max\-client\-subnet\-ipv6: \fI<number>\fR
	Specifies the maximum prefix length of the client source address we are willing
	to expose to third parties for IPv6. Defaults to 56.
	.TP
	.B max\-client\-subnet\-ipv4: \fI<number>\fR
	Specifies the maximum prefix length of the client source address we are willing
	to expose to third parties for IPv4. Defaults to 24.
	+.TP
	+.B min\-client\-subnet\-ipv6: \fI<number>\fR
	+Specifies the minimum prefix length of the IPv6 source mask we are willing to
	+accept in queries. Shorter source masks result in REFUSED answers. Source mask
	+of 0 is always accepted. Default is 0.
	+.TP
	+.B min\-client\-subnet\-ipv4: \fI<number>\fR
	+Specifies the minimum prefix length of the IPv4 source mask we are willing to
	+accept in queries. Shorter source masks result in REFUSED answers. Source mask
	+of 0 is always accepted. Default is 0.
	+.TP
	+.B max\-ecs\-tree\-size\-ipv4: \fI<number>\fR
	+Specifies the maximum number of subnets ECS answers kept in the ECS radix tree.
	+This number applies for each qname/qclass/qtype tuple. Defaults to 100.
	+.TP
	+.B max\-ecs\-tree\-size\-ipv6: \fI<number>\fR
	+Specifies the maximum number of subnets ECS answers kept in the ECS radix tree.
	+This number applies for each qname/qclass/qtype tuple. Defaults to 100.
	.SS "Opportunistic IPsec Support Module Options"
	.LP
	The IPsec module must be configured in the \fBmodule\-config:\fR "ipsecmod
	validator iterator" directive and be compiled into the daemon to be
	enabled. These settings go in the \fBserver:\fR section.
	.LP
	When unbound receives an A/AAAA query that is not in the cache and finds a
	valid answer, it will withhold returning the answer and instead will generate
	an IPSECKEY subquery for the same domain name. If an answer was found, unbound
	will call an external hook passing the following arguments:
	.TP 10
	\h'5'\fIQNAME\fR
	Domain name of the A/AAAA and IPSECKEY query. In string format.
	.TP 10
	\h'5'\fIIPSECKEY TTL\fR
	TTL of the IPSECKEY RRset.
	.TP 10
	\h'5'\fIA/AAAA\fR
	String of space separated IP addresses present in the A/AAAA RRset. The IP
	addresses are in string format.
	.TP 10
	\h'5'\fIIPSECKEY\fR
	String of space separated IPSECKEY RDATA present in the IPSECKEY RRset. The
	IPSECKEY RDATA are in DNS presentation format.
	.LP
	The A/AAAA answer is then cached and returned to the client. If the external
	hook was called the TTL changes to ensure it doesn't surpass
	\fBipsecmod-max-ttl\fR.
	.LP
	The same procedure is also followed when \fBprefetch:\fR is used, but the
	A/AAAA answer is given to the client before the hook is called.
	\fBipsecmod-max-ttl\fR ensures that the A/AAAA answer given from cache is still
	relevant for opportunistic IPsec.
	.TP
	.B ipsecmod-enabled: \fI<yes or no>\fR
	Specifies whether the IPsec module is enabled or not. The IPsec module still
	needs to be defined in the \fBmodule\-config:\fR directive. This option
	facilitates turning on/off the module without restarting/reloading unbound.
	Defaults to yes.
	.TP
	.B ipsecmod\-hook: \fI<filename>\fR
	Specifies the external hook that unbound will call with \fIsystem\fR(3). The
	file can be specified as an absolute/relative path. The file needs the proper
	permissions to be able to be executed by the same user that runs unbound. It
	must be present when the IPsec module is defined in the \fBmodule\-config:\fR
	directive.
	.TP
	.B ipsecmod-strict: \fI<yes or no>\fR
	If enabled unbound requires the external hook to return a success value of 0.
	Failing to do so unbound will reply with SERVFAIL. The A/AAAA answer will also
	not be cached. Defaults to no.
	.TP
	.B ipsecmod\-max-ttl: \fI<seconds>\fR
	Time to live maximum for A/AAAA cached records after calling the external hook.
	Defaults to 3600.
	.TP
	.B ipsecmod-ignore-bogus: \fI<yes or no>\fR
	Specifies the behaviour of unbound when the IPSECKEY answer is bogus. If set
	to yes, the hook will be called and the A/AAAA answer will be returned to the
	client. If set to no, the hook will not be called and the answer to the
	A/AAAA query will be SERVFAIL. Mainly used for testing. Defaults to no.
	.TP
	.B ipsecmod\-whitelist: \fI<domain>\fR
	Whitelist the domain so that the module logic will be executed. Can
	be given multiple times, for different domains. If the option is not
	specified, all domains are treated as being whitelisted (default).
	.SS "Cache DB Module Options"
	.LP
	The Cache DB module must be configured in the \fBmodule\-config:\fR
	"validator cachedb iterator" directive and be compiled into the daemon
	with \fB\-\-enable\-cachedb\fR.
	If this module is enabled and configured, the specified backend database
	works as a second level cache:
	When Unbound cannot find an answer to a query in its built-in in-memory
	cache, it consults the specified backend.
	If it finds a valid answer in the backend, Unbound uses it to respond
	to the query without performing iterative DNS resolution.
	If Unbound cannot even find an answer in the backend, it resolves the
	query as usual, and stores the answer in the backend.
	.P
	If Unbound was built with
	\fB\-\-with\-libhiredis\fR
	on a system that has installed the hiredis C client library of Redis,
	then the "redis" backend can be used.
	This backend communicates with the specified Redis server over a TCP
	connection to store and retrieve cache data.
	It can be used as a persistent and/or shared cache backend.
	It should be noted that Unbound never removes data stored in the Redis server,
	even if some data have expired in terms of DNS TTL or the Redis server has
	cached too much data;
	if necessary the Redis server must be configured to limit the cache size,
	preferably with some kind of least-recently-used eviction policy.
	This backend uses synchronous communication with the Redis server
	based on the assumption that the communication is stable and sufficiently
	fast.
	The thread waiting for a response from the Redis server cannot handle
	other DNS queries.
	Although the backend has the ability to reconnect to the server when
	the connection is closed unexpectedly and there is a configurable timeout
	in case the server is overly slow or hangs up, these cases are assumed
	to be very rare.
	If connection close or timeout happens too often, Unbound will be
	effectively unusable with this backend.
	It's the administrator's responsibility to make the assumption hold.
	.P
	The
	.B cachedb:
	clause gives custom settings of the cache DB module.
	.TP
	.B backend: \fI<backend name>\fR
	Specify the backend database name.
	The default database is the in-memory backend named "testframe", which,
	as the name suggests, is not of any practical use.
	Depending on the build-time configuration, "redis" backend may also be
	used as described above.
	.TP
	.B secret-seed: \fI<"secret string">\fR
	Specify a seed to calculate a hash value from query information.
	This value will be used as the key of the corresponding answer for the
	backend database and can be customized if the hash should not be predictable
	operationally.
	If the backend database is shared by multiple Unbound instances,
	all instances must use the same secret seed.
	This option defaults to "default".
	.P
	The following
	.B cachedb
	otions are specific to the redis backend.
	.TP
	.B redis-server-host: \fI<server address or name>\fR
	The IP (either v6 or v4) address or domain name of the Redis server.
	In general an IP address should be specified as otherwise Unbound will have to
	resolve the name of the server every time it establishes a connection
	to the server.
	This option defaults to "127.0.0.1".
	.TP
	.B redis-server-port: \fI<port number>\fR
	The TCP port number of the Redis server.
	This option defaults to 6379.
	.TP
	.B redis-timeout: \fI<msec>\fR
	The period until when Unbound waits for a response from the Redis sever.
	If this timeout expires Unbound closes the connection, treats it as
	if the Redis server does not have the requested data, and will try to
	re-establish a new connection later.
	This option defaults to 100 milliseconds.
	.SH "MEMORY CONTROL EXAMPLE"
	In the example config settings below memory usage is reduced. Some service
	levels are lower, notable very large data and a high TCP load are no longer
	supported. Very large data and high TCP loads are exceptional for the DNS.
	DNSSEC validation is enabled, just add trust anchors.
	If you do not have to worry about programs using more than 3 Mb of memory,
	the below example is not for you. Use the defaults to receive full service,
	which on BSD\-32bit tops out at 30\-40 Mb after heavy usage.
	.P
	.nf
	# example settings that reduce memory usage
	server:
	num\-threads: 1
	outgoing\-num\-tcp: 1 # this limits TCP service, uses less buffers.
	incoming\-num\-tcp: 1
	outgoing\-range: 60 # uses less memory, but less performance.
	msg\-buffer\-size: 8192 # note this limits service, 'no huge stuff'.
	msg\-cache\-size: 100k
	msg\-cache\-slabs: 1
	rrset\-cache\-size: 100k
	rrset\-cache\-slabs: 1
	infra\-cache\-numhosts: 200
	infra\-cache\-slabs: 1
	key\-cache\-size: 100k
	key\-cache\-slabs: 1
	neg\-cache\-size: 10k
	num\-queries\-per\-thread: 30
	target\-fetch\-policy: "2 1 0 0 0 0"
	harden\-large\-queries: "yes"
	harden\-short\-bufsize: "yes"
	.fi
	.SH "FILES"
	.TP
	.I @UNBOUND_RUN_DIR@
	default unbound working directory.
	.TP
	.I @UNBOUND_CHROOT_DIR@
	default
	\fIchroot\fR(2)
	location.
	.TP
	.I @ub_conf_file@
	unbound configuration file.
	.TP
	.I @UNBOUND_PIDFILE@
	default unbound pidfile with process ID of the running daemon.
	.TP
	.I unbound.log
	unbound log file. default is to log to
	\fIsyslog\fR(3).
	.SH "SEE ALSO"
	\fIunbound\fR(8),
	\fIunbound\-checkconf\fR(8).
	.SH "AUTHORS"
	.B Unbound
	was written by NLnet Labs. Please see CREDITS file
	in the distribution for further details.
	Index: head/contrib/unbound/doc/unbound.doxygen
	===================================================================
	--- head/contrib/unbound/doc/unbound.doxygen (revision 349719)
	+++ head/contrib/unbound/doc/unbound.doxygen (revision 349720)
	@@ -1,1650 +1,1656 @@
	# Doxyfile 1.7.1

	# This file describes the settings to be used by the documentation system
	# doxygen (www.doxygen.org) for a project
	#
	# All text after a hash (#) is considered a comment and will be ignored
	# The format is:
	# TAG = value [value, ...]
	# For lists items can also be appended using:
	# TAG += value [value, ...]
	# Values that contain spaces should be placed between quotes (" ")

	#---------------------------------------------------------------------------
	# Project related configuration options
	#---------------------------------------------------------------------------

	# This tag specifies the encoding used for all characters in the config file
	# that follow. The default is UTF-8 which is also the encoding used for all
	# text before the first occurrence of this tag. Doxygen uses libiconv (or the
	# iconv built into libc) for the transcoding. See
	# http://www.gnu.org/software/libiconv for the list of possible encodings.

	DOXYFILE_ENCODING = UTF-8

	# The PROJECT_NAME tag is a single word (or a sequence of words surrounded
	# by quotes) that should identify the project.

	PROJECT_NAME = unbound

	# The PROJECT_NUMBER tag can be used to enter a project or revision number.
	# This could be handy for archiving the generated documentation or
	# if some version control system is used.

	PROJECT_NUMBER = 0.1

	# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute)
	# base path where the generated documentation will be put.
	# If a relative path is entered, it will be relative to the location
	# where doxygen was started. If left blank the current directory will be used.

	OUTPUT_DIRECTORY = doc

	# If the CREATE_SUBDIRS tag is set to YES, then doxygen will create
	# 4096 sub-directories (in 2 levels) under the output directory of each output
	# format and will distribute the generated files over these directories.
	# Enabling this option can be useful when feeding doxygen a huge amount of
	# source files, where putting all generated files in the same directory would
	# otherwise cause performance problems for the file system.

	CREATE_SUBDIRS = NO

	# The OUTPUT_LANGUAGE tag is used to specify the language in which all
	# documentation generated by doxygen is written. Doxygen will use this
	# information to generate all constant output in the proper language.
	# The default language is English, other supported languages are:
	# Afrikaans, Arabic, Brazilian, Catalan, Chinese, Chinese-Traditional,
	# Croatian, Czech, Danish, Dutch, Esperanto, Farsi, Finnish, French, German,
	# Greek, Hungarian, Italian, Japanese, Japanese-en (Japanese with English
	# messages), Korean, Korean-en, Lithuanian, Norwegian, Macedonian, Persian,
	# Polish, Portuguese, Romanian, Russian, Serbian, Serbian-Cyrilic, Slovak,
	# Slovene, Spanish, Swedish, Ukrainian, and Vietnamese.

	OUTPUT_LANGUAGE = English

	# If the BRIEF_MEMBER_DESC tag is set to YES (the default) Doxygen will
	# include brief member descriptions after the members that are listed in
	# the file and class documentation (similar to JavaDoc).
	# Set to NO to disable this.

	BRIEF_MEMBER_DESC = YES

	# If the REPEAT_BRIEF tag is set to YES (the default) Doxygen will prepend
	# the brief description of a member or function before the detailed description.
	# Note: if both HIDE_UNDOC_MEMBERS and BRIEF_MEMBER_DESC are set to NO, the
	# brief descriptions will be completely suppressed.

	REPEAT_BRIEF = YES

	# This tag implements a quasi-intelligent brief description abbreviator
	# that is used to form the text in various listings. Each string
	# in this list, if found as the leading text of the brief description, will be
	# stripped from the text and the result after processing the whole list, is
	# used as the annotated text. Otherwise, the brief description is used as-is.
	# If left blank, the following values are used ("$name" is automatically
	# replaced with the name of the entity): "The $name class" "The $name widget"
	# "The $name file" "is" "provides" "specifies" "contains"
	# "represents" "a" "an" "the"

	ABBREVIATE_BRIEF =

	# If the ALWAYS_DETAILED_SEC and REPEAT_BRIEF tags are both set to YES then
	# Doxygen will generate a detailed section even if there is only a brief
	# description.

	ALWAYS_DETAILED_SEC = NO

	# If the INLINE_INHERITED_MEMB tag is set to YES, doxygen will show all
	# inherited members of a class in the documentation of that class as if those
	# members were ordinary class members. Constructors, destructors and assignment
	# operators of the base classes will not be shown.

	INLINE_INHERITED_MEMB = NO

	# If the FULL_PATH_NAMES tag is set to YES then Doxygen will prepend the full
	# path before files name in the file list and in the header files. If set
	# to NO the shortest path that makes the file name unique will be used.

	FULL_PATH_NAMES = YES

	# If the FULL_PATH_NAMES tag is set to YES then the STRIP_FROM_PATH tag
	# can be used to strip a user-defined part of the path. Stripping is
	# only done if one of the specified strings matches the left-hand part of
	# the path. The tag can be used to show relative paths in the file list.
	# If left blank the directory from which doxygen is run is used as the
	# path to strip.

	STRIP_FROM_PATH =

	# The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of
	# the path mentioned in the documentation of a class, which tells
	# the reader which header file to include in order to use a class.
	# If left blank only the name of the header file containing the class
	# definition is used. Otherwise one should specify the include paths that
	# are normally passed to the compiler using the -I flag.

	STRIP_FROM_INC_PATH =

	# If the SHORT_NAMES tag is set to YES, doxygen will generate much shorter
	# (but less readable) file names. This can be useful is your file systems
	# doesn't support long names like on DOS, Mac, or CD-ROM.

	SHORT_NAMES = NO

	# If the JAVADOC_AUTOBRIEF tag is set to YES then Doxygen
	# will interpret the first line (until the first dot) of a JavaDoc-style
	# comment as the brief description. If set to NO, the JavaDoc
	# comments will behave just like regular Qt-style comments
	# (thus requiring an explicit @brief command for a brief description.)

	JAVADOC_AUTOBRIEF = YES

	# If the QT_AUTOBRIEF tag is set to YES then Doxygen will
	# interpret the first line (until the first dot) of a Qt-style
	# comment as the brief description. If set to NO, the comments
	# will behave just like regular Qt-style comments (thus requiring
	# an explicit \brief command for a brief description.)

	QT_AUTOBRIEF = NO

	# The MULTILINE_CPP_IS_BRIEF tag can be set to YES to make Doxygen
	# treat a multi-line C++ special comment block (i.e. a block of //! or ///
	# comments) as a brief description. This used to be the default behaviour.
	# The new default is to treat a multi-line C++ comment block as a detailed
	# description. Set this tag to YES if you prefer the old behaviour instead.

	MULTILINE_CPP_IS_BRIEF = NO

	# If the INHERIT_DOCS tag is set to YES (the default) then an undocumented
	# member inherits the documentation from any documented member that it
	# re-implements.

	INHERIT_DOCS = YES

	# If the SEPARATE_MEMBER_PAGES tag is set to YES, then doxygen will produce
	# a new page for each member. If set to NO, the documentation of a member will
	# be part of the file/class/namespace that contains it.

	SEPARATE_MEMBER_PAGES = NO

	# The TAB_SIZE tag can be used to set the number of spaces in a tab.
	# Doxygen uses this value to replace tabs by spaces in code fragments.

	TAB_SIZE = 8

	# This tag can be used to specify a number of aliases that acts
	# as commands in the documentation. An alias has the form "name=value".
	# For example adding "sideeffect=\par Side Effects:\n" will allow you to
	# put the command \sideeffect (or @sideeffect) in the documentation, which
	# will result in a user-defined paragraph with heading "Side Effects:".
	# You can put \n's in the value part of an alias to insert newlines.

	ALIASES =

	# Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C
	# sources only. Doxygen will then generate output that is more tailored for C.
	# For instance, some of the names that are used will be different. The list
	# of all members will be omitted, etc.

	OPTIMIZE_OUTPUT_FOR_C = YES

	# Set the OPTIMIZE_OUTPUT_JAVA tag to YES if your project consists of Java
	# sources only. Doxygen will then generate output that is more tailored for
	# Java. For instance, namespaces will be presented as packages, qualified
	# scopes will look different, etc.

	OPTIMIZE_OUTPUT_JAVA = NO

	# Set the OPTIMIZE_FOR_FORTRAN tag to YES if your project consists of Fortran
	# sources only. Doxygen will then generate output that is more tailored for
	# Fortran.

	OPTIMIZE_FOR_FORTRAN = NO

	# Set the OPTIMIZE_OUTPUT_VHDL tag to YES if your project consists of VHDL
	# sources. Doxygen will then generate output that is tailored for
	# VHDL.

	OPTIMIZE_OUTPUT_VHDL = NO

	# Doxygen selects the parser to use depending on the extension of the files it
	# parses. With this tag you can assign which parser to use for a given extension.
	# Doxygen has a built-in mapping, but you can override or extend it using this
	# tag. The format is ext=language, where ext is a file extension, and language
	# is one of the parsers supported by doxygen: IDL, Java, Javascript, CSharp, C,
	# C++, D, PHP, Objective-C, Python, Fortran, VHDL, C, C++. For instance to make
	# doxygen treat .inc files as Fortran files (default is PHP), and .f files as C
	# (default is Fortran), use: inc=Fortran f=C. Note that for custom extensions
	# you also need to set FILE_PATTERNS otherwise the files are not read by doxygen.

	EXTENSION_MAPPING =

	# If you use STL classes (i.e. std::string, std::vector, etc.) but do not want
	# to include (a tag file for) the STL sources as input, then you should
	# set this tag to YES in order to let doxygen match functions declarations and
	# definitions whose arguments contain STL classes (e.g. func(std::string); v.s.
	# func(std::string) {}). This also make the inheritance and collaboration
	# diagrams that involve STL classes more complete and accurate.

	BUILTIN_STL_SUPPORT = NO

	# If you use Microsoft's C++/CLI language, you should set this option to YES to
	# enable parsing support.

	CPP_CLI_SUPPORT = NO

	# Set the SIP_SUPPORT tag to YES if your project consists of sip sources only.
	# Doxygen will parse them like normal C++ but will assume all classes use public
	# instead of private inheritance when no explicit protection keyword is present.

	SIP_SUPPORT = NO

	# For Microsoft's IDL there are propget and propput attributes to indicate getter
	# and setter methods for a property. Setting this option to YES (the default)
	# will make doxygen to replace the get and set methods by a property in the
	# documentation. This will only work if the methods are indeed getting or
	# setting a simple type. If this is not the case, or you want to show the
	# methods anyway, you should set this option to NO.

	IDL_PROPERTY_SUPPORT = YES

	# If member grouping is used in the documentation and the DISTRIBUTE_GROUP_DOC
	# tag is set to YES, then doxygen will reuse the documentation of the first
	# member in the group (if any) for the other members of the group. By default
	# all members of a group must be documented explicitly.

	DISTRIBUTE_GROUP_DOC = NO

	# Set the SUBGROUPING tag to YES (the default) to allow class member groups of
	# the same type (for instance a group of public functions) to be put as a
	# subgroup of that type (e.g. under the Public Functions section). Set it to
	# NO to prevent subgrouping. Alternatively, this can be done per class using
	# the \nosubgrouping command.

	SUBGROUPING = YES

	# When TYPEDEF_HIDES_STRUCT is enabled, a typedef of a struct, union, or enum
	# is documented as struct, union, or enum with the name of the typedef. So
	# typedef struct TypeS {} TypeT, will appear in the documentation as a struct
	# with name TypeT. When disabled the typedef will appear as a member of a file,
	# namespace, or class. And the struct will be named TypeS. This can typically
	# be useful for C code in case the coding convention dictates that all compound
	# types are typedef'ed and only the typedef is referenced, never the tag name.

	TYPEDEF_HIDES_STRUCT = NO

	# The SYMBOL_CACHE_SIZE determines the size of the internal cache use to
	# determine which symbols to keep in memory and which to flush to disk.
	# When the cache is full, less often used symbols will be written to disk.
	# For small to medium size projects (<1000 input files) the default value is
	# probably good enough. For larger projects a too small cache size can cause
	# doxygen to be busy swapping symbols to and from disk most of the time
	# causing a significant performance penality.
	# If the system has enough physical memory increasing the cache will improve the
	# performance by keeping more symbols in memory. Note that the value works on
	# a logarithmic scale so increasing the size by one will rougly double the
	# memory usage. The cache size is given by this formula:
	# 2^(16+SYMBOL_CACHE_SIZE). The valid range is 0..9, the default is 0,
	# corresponding to a cache size of 2^16 = 65536 symbols

	#SYMBOL_CACHE_SIZE = 0

	#---------------------------------------------------------------------------
	# Build related configuration options
	#---------------------------------------------------------------------------

	# If the EXTRACT_ALL tag is set to YES doxygen will assume all entities in
	# documentation are documented, even if no documentation was available.
	# Private class members and static file members will be hidden unless
	# the EXTRACT_PRIVATE and EXTRACT_STATIC tags are set to YES

	EXTRACT_ALL = NO

	# If the EXTRACT_PRIVATE tag is set to YES all private members of a class
	# will be included in the documentation.

	EXTRACT_PRIVATE = YES

	# If the EXTRACT_STATIC tag is set to YES all static members of a file
	# will be included in the documentation.

	EXTRACT_STATIC = YES

	# If the EXTRACT_LOCAL_CLASSES tag is set to YES classes (and structs)
	# defined locally in source files will be included in the documentation.
	# If set to NO only classes defined in header files are included.

	EXTRACT_LOCAL_CLASSES = YES

	# This flag is only useful for Objective-C code. When set to YES local
	# methods, which are defined in the implementation section but not in
	# the interface are included in the documentation.
	# If set to NO (the default) only methods in the interface are included.

	EXTRACT_LOCAL_METHODS = YES

	# If this flag is set to YES, the members of anonymous namespaces will be
	# extracted and appear in the documentation as a namespace called
	# 'anonymous_namespace{file}', where file will be replaced with the base
	# name of the file that contains the anonymous namespace. By default
	# anonymous namespace are hidden.

	EXTRACT_ANON_NSPACES = NO

	# If the HIDE_UNDOC_MEMBERS tag is set to YES, Doxygen will hide all
	# undocumented members of documented classes, files or namespaces.
	# If set to NO (the default) these members will be included in the
	# various overviews, but no documentation section is generated.
	# This option has no effect if EXTRACT_ALL is enabled.

	HIDE_UNDOC_MEMBERS = NO

	# If the HIDE_UNDOC_CLASSES tag is set to YES, Doxygen will hide all
	# undocumented classes that are normally visible in the class hierarchy.
	# If set to NO (the default) these classes will be included in the various
	# overviews. This option has no effect if EXTRACT_ALL is enabled.

	HIDE_UNDOC_CLASSES = NO

	# If the HIDE_FRIEND_COMPOUNDS tag is set to YES, Doxygen will hide all
	# friend (class\|struct\|union) declarations.
	# If set to NO (the default) these declarations will be included in the
	# documentation.

	HIDE_FRIEND_COMPOUNDS = NO

	# If the HIDE_IN_BODY_DOCS tag is set to YES, Doxygen will hide any
	# documentation blocks found inside the body of a function.
	# If set to NO (the default) these blocks will be appended to the
	# function's detailed documentation block.

	HIDE_IN_BODY_DOCS = NO

	# The INTERNAL_DOCS tag determines if documentation
	# that is typed after a \internal command is included. If the tag is set
	# to NO (the default) then the documentation will be excluded.
	# Set it to YES to include the internal documentation.

	INTERNAL_DOCS = NO

	# If the CASE_SENSE_NAMES tag is set to NO then Doxygen will only generate
	# file names in lower-case letters. If set to YES upper-case letters are also
	# allowed. This is useful if you have classes or files whose names only differ
	# in case and if your file system supports case sensitive file names. Windows
	# and Mac users are advised to set this option to NO.

	CASE_SENSE_NAMES = YES

	# If the HIDE_SCOPE_NAMES tag is set to NO (the default) then Doxygen
	# will show members with their full class and namespace scopes in the
	# documentation. If set to YES the scope will be hidden.

	HIDE_SCOPE_NAMES = NO

	# If the SHOW_INCLUDE_FILES tag is set to YES (the default) then Doxygen
	# will put a list of the files that are included by a file in the documentation
	# of that file.

	SHOW_INCLUDE_FILES = YES

	# If the FORCE_LOCAL_INCLUDES tag is set to YES then Doxygen
	# will list include files with double quotes in the documentation
	# rather than with sharp brackets.

	FORCE_LOCAL_INCLUDES = NO

	# If the INLINE_INFO tag is set to YES (the default) then a tag [inline]
	# is inserted in the documentation for inline members.

	INLINE_INFO = YES

	# If the SORT_MEMBER_DOCS tag is set to YES (the default) then doxygen
	# will sort the (detailed) documentation of file and class members
	# alphabetically by member name. If set to NO the members will appear in
	# declaration order.

	SORT_MEMBER_DOCS = NO

	# If the SORT_BRIEF_DOCS tag is set to YES then doxygen will sort the
	# brief documentation of file, namespace and class members alphabetically
	# by member name. If set to NO (the default) the members will appear in
	# declaration order.

	SORT_BRIEF_DOCS = NO

	# If the SORT_MEMBERS_CTORS_1ST tag is set to YES then doxygen
	# will sort the (brief and detailed) documentation of class members so that
	# constructors and destructors are listed first. If set to NO (the default)
	# the constructors will appear in the respective orders defined by
	# SORT_MEMBER_DOCS and SORT_BRIEF_DOCS.
	# This tag will be ignored for brief docs if SORT_BRIEF_DOCS is set to NO
	# and ignored for detailed docs if SORT_MEMBER_DOCS is set to NO.

	SORT_MEMBERS_CTORS_1ST = NO

	# If the SORT_GROUP_NAMES tag is set to YES then doxygen will sort the
	# hierarchy of group names into alphabetical order. If set to NO (the default)
	# the group names will appear in their defined order.

	SORT_GROUP_NAMES = NO

	# If the SORT_BY_SCOPE_NAME tag is set to YES, the class list will be
	# sorted by fully-qualified names, including namespaces. If set to
	# NO (the default), the class list will be sorted only by class name,
	# not including the namespace part.
	# Note: This option is not very useful if HIDE_SCOPE_NAMES is set to YES.
	# Note: This option applies only to the class list, not to the
	# alphabetical list.

	SORT_BY_SCOPE_NAME = NO

	# The GENERATE_TODOLIST tag can be used to enable (YES) or
	# disable (NO) the todo list. This list is created by putting \todo
	# commands in the documentation.

	GENERATE_TODOLIST = YES

	# The GENERATE_TESTLIST tag can be used to enable (YES) or
	# disable (NO) the test list. This list is created by putting \test
	# commands in the documentation.

	GENERATE_TESTLIST = YES

	# The GENERATE_BUGLIST tag can be used to enable (YES) or
	# disable (NO) the bug list. This list is created by putting \bug
	# commands in the documentation.

	GENERATE_BUGLIST = YES

	# The GENERATE_DEPRECATEDLIST tag can be used to enable (YES) or
	# disable (NO) the deprecated list. This list is created by putting
	# \deprecated commands in the documentation.

	GENERATE_DEPRECATEDLIST= YES

	# The ENABLED_SECTIONS tag can be used to enable conditional
	# documentation sections, marked by \if sectionname ... \endif.

	ENABLED_SECTIONS =

	# The MAX_INITIALIZER_LINES tag determines the maximum number of lines
	# the initial value of a variable or define consists of for it to appear in
	# the documentation. If the initializer consists of more lines than specified
	# here it will be hidden. Use a value of 0 to hide initializers completely.
	# The appearance of the initializer of individual variables and defines in the
	# documentation can be controlled using \showinitializer or \hideinitializer
	# command in the documentation regardless of this setting.

	MAX_INITIALIZER_LINES = 30

	# Set the SHOW_USED_FILES tag to NO to disable the list of files generated
	# at the bottom of the documentation of classes and structs. If set to YES the
	# list will mention the files that were used to generate the documentation.

	SHOW_USED_FILES = YES

	# If the sources in your project are distributed over multiple directories
	# then setting the SHOW_DIRECTORIES tag to YES will show the directory hierarchy
	# in the documentation. The default is NO.

	#SHOW_DIRECTORIES = YES

	# Set the SHOW_FILES tag to NO to disable the generation of the Files page.
	# This will remove the Files entry from the Quick Index and from the
	# Folder Tree View (if specified). The default is YES.

	SHOW_FILES = YES

	# Set the SHOW_NAMESPACES tag to NO to disable the generation of the
	# Namespaces page.
	# This will remove the Namespaces entry from the Quick Index
	# and from the Folder Tree View (if specified). The default is YES.

	SHOW_NAMESPACES = YES

	# The FILE_VERSION_FILTER tag can be used to specify a program or script that
	# doxygen should invoke to get the current version for each file (typically from
	# the version control system). Doxygen will invoke the program by executing (via
	# popen()) the command <command> <input-file>, where <command> is the value of
	# the FILE_VERSION_FILTER tag, and <input-file> is the name of an input file
	# provided by doxygen. Whatever the program writes to standard output
	# is used as the file version. See the manual for examples.

	FILE_VERSION_FILTER =

	# The LAYOUT_FILE tag can be used to specify a layout file which will be parsed
	# by doxygen. The layout file controls the global structure of the generated
	# output files in an output format independent way. The create the layout file
	# that represents doxygen's defaults, run doxygen with the -l option.
	# You can optionally specify a file name after the option, if omitted
	# DoxygenLayout.xml will be used as the name of the layout file.

	LAYOUT_FILE =

	#---------------------------------------------------------------------------
	# configuration options related to warning and progress messages
	#---------------------------------------------------------------------------

	# The QUIET tag can be used to turn on/off the messages that are generated
	# by doxygen. Possible values are YES and NO. If left blank NO is used.

	QUIET = YES

	# The WARNINGS tag can be used to turn on/off the warning messages that are
	# generated by doxygen. Possible values are YES and NO. If left blank
	# NO is used.

	WARNINGS = YES

	# If WARN_IF_UNDOCUMENTED is set to YES, then doxygen will generate warnings
	# for undocumented members. If EXTRACT_ALL is set to YES then this flag will
	# automatically be disabled.

	WARN_IF_UNDOCUMENTED = NO

	# If WARN_IF_DOC_ERROR is set to YES, doxygen will generate warnings for
	# potential errors in the documentation, such as not documenting some
	# parameters in a documented function, or documenting parameters that
	# don't exist or using markup commands wrongly.

	WARN_IF_DOC_ERROR = YES

	# This WARN_NO_PARAMDOC option can be abled to get warnings for
	# functions that are documented, but have no documentation for their parameters
	# or return value. If set to NO (the default) doxygen will only warn about
	# wrong or incomplete parameter documentation, but not about the absence of
	# documentation.

	WARN_NO_PARAMDOC = YES

	# The WARN_FORMAT tag determines the format of the warning messages that
	# doxygen can produce. The string should contain the $file, $line, and $text
	# tags, which will be replaced by the file and line number from which the
	# warning originated and the warning text. Optionally the format may contain
	# $version, which will be replaced by the version of the file (if it could
	# be obtained via FILE_VERSION_FILTER)

	WARN_FORMAT = "$file:$line: $text"

	# The WARN_LOGFILE tag can be used to specify a file to which warning
	# and error messages should be written. If left blank the output is written
	# to stderr.

	WARN_LOGFILE =

	#---------------------------------------------------------------------------
	# configuration options related to the input files
	#---------------------------------------------------------------------------

	# The INPUT tag can be used to specify the files and/or directories that contain
	# documented source files. You may enter file names like "myfile.cpp" or
	# directories like "/usr/src/myproject". Separate the files or directories
	# with spaces.

	INPUT = .

	# This tag can be used to specify the character encoding of the source files
	# that doxygen parses. Internally doxygen uses the UTF-8 encoding, which is
	# also the default input encoding. Doxygen uses libiconv (or the iconv built
	# into libc) for the transcoding. See http://www.gnu.org/software/libiconv for
	# the list of possible encodings.

	INPUT_ENCODING = UTF-8

	# If the value of the INPUT tag contains directories, you can use the
	# FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp
	# and *.h) to filter out the source-files in the directories. If left
	# blank the following patterns are tested:
	# .c .cc .cxx .cpp .c++ .java .ii .ixx .ipp .i++ .inl .h .hh .hxx
	# .hpp .h++ .idl .odl .cs .php .php3 .inc .m .mm .py .f90

	FILE_PATTERNS =

	# The RECURSIVE tag can be used to turn specify whether or not subdirectories
	# should be searched for input files as well. Possible values are YES and NO.
	# If left blank NO is used.

	RECURSIVE = YES

	# The EXCLUDE tag can be used to specify files and/or directories that should
	# excluded from the INPUT source files. This way you can easily exclude a
	# subdirectory from a directory tree whose root is specified with the INPUT tag.

	EXCLUDE = ./build \
	./compat \
	+ ./contrib \
	util/configparser.c \
	util/configparser.h \
	util/configlexer.c \
	util/locks.h \
	+ pythonmod/doc \
	+ pythonmod/examples \
	pythonmod/unboundmodule.py \
	pythonmod/interface.h \
	- pythonmod/examples/resgen.py \
	- pythonmod/examples/resmod.py \
	- pythonmod/examples/resip.py \
	+ pythonmod/ubmodule-msg.py \
	+ pythonmod/ubmodule-tst.py \
	+ unboundmodule.py \
	libunbound/python/unbound.py \
	libunbound/python/libunbound_wrap.c \
	+ libunbound/python/doc \
	+ libunbound/python/examples \
	./ldns-src \
	+ README.md \
	doc/control_proto_spec.txt \
	doc/requirements.txt

	# The EXCLUDE_SYMLINKS tag can be used select whether or not files or
	# directories that are symbolic links (a Unix filesystem feature) are excluded
	# from the input.

	EXCLUDE_SYMLINKS = NO

	# If the value of the INPUT tag contains directories, you can use the
	# EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude
	# certain files from those directories. Note that the wildcards are matched
	# against the file with absolute path, so to exclude all test directories
	# for example use the pattern /test/

	EXCLUDE_PATTERNS =

	# The EXCLUDE_SYMBOLS tag can be used to specify one or more symbol names
	# (namespaces, classes, functions, etc.) that should be excluded from the
	# output. The symbol name can be a fully qualified name, a word, or if the
	# wildcard * is used, a substring. Examples: ANamespace, AClass,
	# AClass::ANamespace, ANamespace::*Test

	EXCLUDE_SYMBOLS =

	# The EXAMPLE_PATH tag can be used to specify one or more files or
	# directories that contain example code fragments that are included (see
	# the \include command).

	EXAMPLE_PATH =

	# If the value of the EXAMPLE_PATH tag contains directories, you can use the
	# EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp
	# and *.h) to filter out the source-files in the directories. If left
	# blank all files are included.

	EXAMPLE_PATTERNS =

	# If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be
	# searched for input files to be used with the \include or \dontinclude
	# commands irrespective of the value of the RECURSIVE tag.
	# Possible values are YES and NO. If left blank NO is used.

	EXAMPLE_RECURSIVE = NO

	# The IMAGE_PATH tag can be used to specify one or more files or
	# directories that contain image that are included in the documentation (see
	# the \image command).

	IMAGE_PATH =

	# The INPUT_FILTER tag can be used to specify a program that doxygen should
	# invoke to filter for each input file. Doxygen will invoke the filter program
	# by executing (via popen()) the command <filter> <input-file>, where <filter>
	# is the value of the INPUT_FILTER tag, and <input-file> is the name of an
	# input file. Doxygen will then use the output that the filter program writes
	# to standard output.
	# If FILTER_PATTERNS is specified, this tag will be
	# ignored.

	INPUT_FILTER =

	# The FILTER_PATTERNS tag can be used to specify filters on a per file pattern
	# basis.
	# Doxygen will compare the file name with each pattern and apply the
	# filter if there is a match.
	# The filters are a list of the form:
	# pattern=filter (like *.cpp=my_cpp_filter). See INPUT_FILTER for further
	# info on how filters are used. If FILTER_PATTERNS is empty, INPUT_FILTER
	# is applied to all files.

	FILTER_PATTERNS =

	# If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using
	# INPUT_FILTER) will be used to filter the input files when producing source
	# files to browse (i.e. when SOURCE_BROWSER is set to YES).

	FILTER_SOURCE_FILES = NO

	#---------------------------------------------------------------------------
	# configuration options related to source browsing
	#---------------------------------------------------------------------------

	# If the SOURCE_BROWSER tag is set to YES then a list of source files will
	# be generated. Documented entities will be cross-referenced with these sources.
	# Note: To get rid of all source code in the generated output, make sure also
	# VERBATIM_HEADERS is set to NO.

	SOURCE_BROWSER = NO

	# Setting the INLINE_SOURCES tag to YES will include the body
	# of functions and classes directly in the documentation.

	INLINE_SOURCES = NO

	# Setting the STRIP_CODE_COMMENTS tag to YES (the default) will instruct
	# doxygen to hide any special comment blocks from generated source code
	# fragments. Normal C and C++ comments will always remain visible.

	STRIP_CODE_COMMENTS = YES

	# If the REFERENCED_BY_RELATION tag is set to YES
	# then for each documented function all documented
	# functions referencing it will be listed.

	REFERENCED_BY_RELATION = YES

	# If the REFERENCES_RELATION tag is set to YES
	# then for each documented function all documented entities
	# called/used by that function will be listed.

	REFERENCES_RELATION = YES

	# If the REFERENCES_LINK_SOURCE tag is set to YES (the default)
	# and SOURCE_BROWSER tag is set to YES, then the hyperlinks from
	# functions in REFERENCES_RELATION and REFERENCED_BY_RELATION lists will
	# link to the source code.
	# Otherwise they will link to the documentation.

	REFERENCES_LINK_SOURCE = YES

	# If the USE_HTAGS tag is set to YES then the references to source code
	# will point to the HTML generated by the htags(1) tool instead of doxygen
	# built-in source browser. The htags tool is part of GNU's global source
	# tagging system (see http://www.gnu.org/software/global/global.html). You
	# will need version 4.8.6 or higher.

	USE_HTAGS = NO

	# If the VERBATIM_HEADERS tag is set to YES (the default) then Doxygen
	# will generate a verbatim copy of the header file for each class for
	# which an include is specified. Set to NO to disable this.

	VERBATIM_HEADERS = NO

	#---------------------------------------------------------------------------
	# configuration options related to the alphabetical class index
	#---------------------------------------------------------------------------

	# If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index
	# of all compounds will be generated. Enable this if the project
	# contains a lot of classes, structs, unions or interfaces.

	ALPHABETICAL_INDEX = YES

	# If the alphabetical index is enabled (see ALPHABETICAL_INDEX) then
	# the COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns
	# in which this list will be split (can be a number in the range [1..20])

	COLS_IN_ALPHA_INDEX = 5

	# In case all classes in a project start with a common prefix, all
	# classes will be put under the same header in the alphabetical index.
	# The IGNORE_PREFIX tag can be used to specify one or more prefixes that
	# should be ignored while generating the index headers.

	IGNORE_PREFIX =

	#---------------------------------------------------------------------------
	# configuration options related to the HTML output
	#---------------------------------------------------------------------------

	# If the GENERATE_HTML tag is set to YES (the default) Doxygen will
	# generate HTML output.

	GENERATE_HTML = YES

	# The HTML_OUTPUT tag is used to specify where the HTML docs will be put.
	# If a relative path is entered the value of OUTPUT_DIRECTORY will be
	# put in front of it. If left blank `html' will be used as the default path.

	HTML_OUTPUT = html

	# The HTML_FILE_EXTENSION tag can be used to specify the file extension for
	# each generated HTML page (for example: .htm,.php,.asp). If it is left blank
	# doxygen will generate files with .html extension.

	HTML_FILE_EXTENSION = .html

	# The HTML_HEADER tag can be used to specify a personal HTML header for
	# each generated HTML page. If it is left blank doxygen will generate a
	# standard header.

	HTML_HEADER =

	# The HTML_FOOTER tag can be used to specify a personal HTML footer for
	# each generated HTML page. If it is left blank doxygen will generate a
	# standard footer.

	HTML_FOOTER =

	# If the HTML_TIMESTAMP tag is set to YES then the generated HTML
	# documentation will contain the timesstamp.

	HTML_TIMESTAMP = NO

	# The HTML_STYLESHEET tag can be used to specify a user-defined cascading
	# style sheet that is used by each HTML page. It can be used to
	# fine-tune the look of the HTML output. If the tag is left blank doxygen
	# will generate a default style sheet. Note that doxygen will try to copy
	# the style sheet file to the HTML output directory, so don't put your own
	# stylesheet in the HTML output directory as well, or it will be erased!

	HTML_STYLESHEET =

	# The HTML_COLORSTYLE_HUE tag controls the color of the HTML output.
	# Doxygen will adjust the colors in the stylesheet and background images
	# according to this color. Hue is specified as an angle on a colorwheel,
	# see http://en.wikipedia.org/wiki/Hue for more information.
	# For instance the value 0 represents red, 60 is yellow, 120 is green,
	# 180 is cyan, 240 is blue, 300 purple, and 360 is red again.
	# The allowed range is 0 to 359.

	#HTML_COLORSTYLE_HUE = 220

	# The HTML_COLORSTYLE_SAT tag controls the purity (or saturation) of
	# the colors in the HTML output. For a value of 0 the output will use
	# grayscales only. A value of 255 will produce the most vivid colors.

	#HTML_COLORSTYLE_SAT = 100

	# The HTML_COLORSTYLE_GAMMA tag controls the gamma correction applied to
	# the luminance component of the colors in the HTML output. Values below
	# 100 gradually make the output lighter, whereas values above 100 make
	# the output darker. The value divided by 100 is the actual gamma applied,
	# so 80 represents a gamma of 0.8, The value 220 represents a gamma of 2.2,
	# and 100 does not change the gamma.

	#HTML_COLORSTYLE_GAMMA = 80

	# If the HTML_TIMESTAMP tag is set to YES then the footer of each generated HTML
	# page will contain the date and time when the page was generated. Setting
	# this to NO can help when comparing the output of multiple runs.

	HTML_TIMESTAMP = YES

	# If the HTML_ALIGN_MEMBERS tag is set to YES, the members of classes,
	# files or namespaces will be aligned in HTML using tables. If set to
	# NO a bullet list will be used.

	#HTML_ALIGN_MEMBERS = YES

	# If the HTML_DYNAMIC_SECTIONS tag is set to YES then the generated HTML
	# documentation will contain sections that can be hidden and shown after the
	# page has loaded. For this to work a browser that supports
	# JavaScript and DHTML is required (for instance Mozilla 1.0+, Firefox
	# Netscape 6.0+, Internet explorer 5.0+, Konqueror, or Safari).

	HTML_DYNAMIC_SECTIONS = NO

	# If the GENERATE_DOCSET tag is set to YES, additional index files
	# will be generated that can be used as input for Apple's Xcode 3
	# integrated development environment, introduced with OSX 10.5 (Leopard).
	# To create a documentation set, doxygen will generate a Makefile in the
	# HTML output directory. Running make will produce the docset in that
	# directory and running "make install" will install the docset in
	# ~/Library/Developer/Shared/Documentation/DocSets so that Xcode will find
	# it at startup.
	# See http://developer.apple.com/tools/creatingdocsetswithdoxygen.html
	# for more information.

	GENERATE_DOCSET = NO

	# When GENERATE_DOCSET tag is set to YES, this tag determines the name of the
	# feed. A documentation feed provides an umbrella under which multiple
	# documentation sets from a single provider (such as a company or product suite)
	# can be grouped.

	DOCSET_FEEDNAME = "Doxygen generated docs"

	# When GENERATE_DOCSET tag is set to YES, this tag specifies a string that
	# should uniquely identify the documentation set bundle. This should be a
	# reverse domain-name style string, e.g. com.mycompany.MyDocSet. Doxygen
	# will append .docset to the name.

	DOCSET_BUNDLE_ID = org.doxygen.Project

	# When GENERATE_PUBLISHER_ID tag specifies a string that should uniquely identify
	# the documentation publisher. This should be a reverse domain-name style
	# string, e.g. com.mycompany.MyDocSet.documentation.

	#DOCSET_PUBLISHER_ID = org.doxygen.Publisher

	# The GENERATE_PUBLISHER_NAME tag identifies the documentation publisher.

	#DOCSET_PUBLISHER_NAME = Publisher

	# If the GENERATE_HTMLHELP tag is set to YES, additional index files
	# will be generated that can be used as input for tools like the
	# Microsoft HTML help workshop to generate a compiled HTML help file (.chm)
	# of the generated HTML documentation.

	GENERATE_HTMLHELP = NO

	# If the GENERATE_HTMLHELP tag is set to YES, the CHM_FILE tag can
	# be used to specify the file name of the resulting .chm file. You
	# can add a path in front of the file if the result should not be
	# written to the html output directory.

	CHM_FILE =

	# If the GENERATE_HTMLHELP tag is set to YES, the HHC_LOCATION tag can
	# be used to specify the location (absolute path including file name) of
	# the HTML help compiler (hhc.exe). If non-empty doxygen will try to run
	# the HTML help compiler on the generated index.hhp.

	HHC_LOCATION =

	# If the GENERATE_HTMLHELP tag is set to YES, the GENERATE_CHI flag
	# controls if a separate .chi index file is generated (YES) or that
	# it should be included in the master .chm file (NO).

	GENERATE_CHI = NO

	# If the GENERATE_HTMLHELP tag is set to YES, the CHM_INDEX_ENCODING
	# is used to encode HtmlHelp index (hhk), content (hhc) and project file
	# content.

	CHM_INDEX_ENCODING =

	# If the GENERATE_HTMLHELP tag is set to YES, the BINARY_TOC flag
	# controls whether a binary table of contents is generated (YES) or a
	# normal table of contents (NO) in the .chm file.

	BINARY_TOC = NO

	# The TOC_EXPAND flag can be set to YES to add extra items for group members
	# to the contents of the HTML help documentation and to the tree view.

	TOC_EXPAND = NO

	# If the GENERATE_QHP tag is set to YES and both QHP_NAMESPACE and
	# QHP_VIRTUAL_FOLDER are set, an additional index file will be generated
	# that can be used as input for Qt's qhelpgenerator to generate a
	# Qt Compressed Help (.qch) of the generated HTML documentation.

	GENERATE_QHP = NO

	# If the QHG_LOCATION tag is specified, the QCH_FILE tag can
	# be used to specify the file name of the resulting .qch file.
	# The path specified is relative to the HTML output folder.

	QCH_FILE =

	# The QHP_NAMESPACE tag specifies the namespace to use when generating
	# Qt Help Project output. For more information please see
	# http://doc.trolltech.com/qthelpproject.html#namespace

	QHP_NAMESPACE = org.doxygen.Project

	# The QHP_VIRTUAL_FOLDER tag specifies the namespace to use when generating
	# Qt Help Project output. For more information please see
	# http://doc.trolltech.com/qthelpproject.html#virtual-folders

	QHP_VIRTUAL_FOLDER = doc

	# If QHP_CUST_FILTER_NAME is set, it specifies the name of a custom filter to
	# add. For more information please see
	# http://doc.trolltech.com/qthelpproject.html#custom-filters

	QHP_CUST_FILTER_NAME =

	# The QHP_CUST_FILT_ATTRS tag specifies the list of the attributes of the
	# custom filter to add. For more information please see
	# <a href="http://doc.trolltech.com/qthelpproject.html#custom-filters">
	# Qt Help Project / Custom Filters</a>.

	QHP_CUST_FILTER_ATTRS =

	# The QHP_SECT_FILTER_ATTRS tag specifies the list of the attributes this
	# project's
	# filter section matches.
	# <a href="http://doc.trolltech.com/qthelpproject.html#filter-attributes">
	# Qt Help Project / Filter Attributes</a>.

	QHP_SECT_FILTER_ATTRS =

	# If the GENERATE_QHP tag is set to YES, the QHG_LOCATION tag can
	# be used to specify the location of Qt's qhelpgenerator.
	# If non-empty doxygen will try to run qhelpgenerator on the generated
	# .qhp file.

	QHG_LOCATION =

	# If the GENERATE_ECLIPSEHELP tag is set to YES, additional index files
	# will be generated, which together with the HTML files, form an Eclipse help
	# plugin. To install this plugin and make it available under the help contents
	# menu in Eclipse, the contents of the directory containing the HTML and XML
	# files needs to be copied into the plugins directory of eclipse. The name of
	# the directory within the plugins directory should be the same as
	# the ECLIPSE_DOC_ID value. After copying Eclipse needs to be restarted before
	# the help appears.

	GENERATE_ECLIPSEHELP = NO

	# A unique identifier for the eclipse help plugin. When installing the plugin
	# the directory name containing the HTML and XML files should also have
	# this name.

	ECLIPSE_DOC_ID = org.doxygen.Project

	# The DISABLE_INDEX tag can be used to turn on/off the condensed index at
	# top of each HTML page. The value NO (the default) enables the index and
	# the value YES disables it.

	DISABLE_INDEX = NO

	# This tag can be used to set the number of enum values (range [1..20])
	# that doxygen will group on one line in the generated HTML documentation.

	ENUM_VALUES_PER_LINE = 4

	# The GENERATE_TREEVIEW tag is used to specify whether a tree-like index
	# structure should be generated to display hierarchical information.
	# If the tag value is set to YES, a side panel will be generated
	# containing a tree-like index structure (just like the one that
	# is generated for HTML Help). For this to work a browser that supports
	# JavaScript, DHTML, CSS and frames is required (i.e. any modern browser).
	# Windows users are probably better off using the HTML help feature.

	GENERATE_TREEVIEW = NO

	# By enabling USE_INLINE_TREES, doxygen will generate the Groups, Directories,
	# and Class Hierarchy pages using a tree view instead of an ordered list.

	#USE_INLINE_TREES = NO

	# If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be
	# used to set the initial width (in pixels) of the frame in which the tree
	# is shown.

	TREEVIEW_WIDTH = 250

	# When the EXT_LINKS_IN_WINDOW option is set to YES doxygen will open
	# links to external symbols imported via tag files in a separate window.

	#EXT_LINKS_IN_WINDOW = NO

	# Use this tag to change the font size of Latex formulas included
	# as images in the HTML documentation. The default is 10. Note that
	# when you change the font size after a successful doxygen run you need
	# to manually remove any form_*.png images from the HTML output directory
	# to force them to be regenerated.

	FORMULA_FONTSIZE = 10

	# Use the FORMULA_TRANPARENT tag to determine whether or not the images
	# generated for formulas are transparent PNGs. Transparent PNGs are
	# not supported properly for IE 6.0, but are supported on all modern browsers.
	# Note that when changing this option you need to delete any form_*.png files
	# in the HTML output before the changes have effect.

	#FORMULA_TRANSPARENT = YES

	# When the SEARCHENGINE tag is enabled doxygen will generate a search box
	# for the HTML output. The underlying search engine uses javascript
	# and DHTML and should work on any modern browser. Note that when using
	# HTML help (GENERATE_HTMLHELP), Qt help (GENERATE_QHP), or docsets
	# (GENERATE_DOCSET) there is already a search function so this one should
	# typically be disabled. For large projects the javascript based search engine
	# can be slow, then enabling SERVER_BASED_SEARCH may provide a better solution.

	SEARCHENGINE = NO

	# When the SERVER_BASED_SEARCH tag is enabled the search engine will be
	# implemented using a PHP enabled web server instead of at the web client
	# using Javascript. Doxygen will generate the search PHP script and index
	# file to put on the web server. The advantage of the server
	# based approach is that it scales better to large projects and allows
	# full text search. The disadvances is that it is more difficult to setup
	# and does not have live searching capabilities.

	SERVER_BASED_SEARCH = NO

	#---------------------------------------------------------------------------
	# configuration options related to the LaTeX output
	#---------------------------------------------------------------------------

	# If the GENERATE_LATEX tag is set to YES (the default) Doxygen will
	# generate Latex output.

	GENERATE_LATEX = NO

	# The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put.
	# If a relative path is entered the value of OUTPUT_DIRECTORY will be
	# put in front of it. If left blank `latex' will be used as the default path.

	LATEX_OUTPUT = latex

	# The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be
	# invoked. If left blank `latex' will be used as the default command name.
	# Note that when enabling USE_PDFLATEX this option is only used for
	# generating bitmaps for formulas in the HTML output, but not in the
	# Makefile that is written to the output directory.

	LATEX_CMD_NAME = latex

	# The MAKEINDEX_CMD_NAME tag can be used to specify the command name to
	# generate index for LaTeX. If left blank `makeindex' will be used as the
	# default command name.

	MAKEINDEX_CMD_NAME = makeindex

	# If the COMPACT_LATEX tag is set to YES Doxygen generates more compact
	# LaTeX documents. This may be useful for small projects and may help to
	# save some trees in general.

	COMPACT_LATEX = NO

	# The PAPER_TYPE tag can be used to set the paper type that is used
	# by the printer. Possible values are: a4, a4wide, letter, legal and
	# executive. If left blank a4wide will be used.

	PAPER_TYPE = a4wide

	# The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX
	# packages that should be included in the LaTeX output.

	EXTRA_PACKAGES =

	# The LATEX_HEADER tag can be used to specify a personal LaTeX header for
	# the generated latex document. The header should contain everything until
	# the first chapter. If it is left blank doxygen will generate a
	# standard header. Notice: only use this tag if you know what you are doing!

	LATEX_HEADER =

	# If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated
	# is prepared for conversion to pdf (using ps2pdf). The pdf file will
	# contain links (just like the HTML output) instead of page references
	# This makes the output suitable for online browsing using a pdf viewer.

	PDF_HYPERLINKS = NO

	# If the USE_PDFLATEX tag is set to YES, pdflatex will be used instead of
	# plain latex in the generated Makefile. Set this option to YES to get a
	# higher quality PDF documentation.

	USE_PDFLATEX = NO

	# If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \\batchmode.
	# command to the generated LaTeX files. This will instruct LaTeX to keep
	# running if errors occur, instead of asking the user for help.
	# This option is also used when generating formulas in HTML.

	LATEX_BATCHMODE = NO

	# If LATEX_HIDE_INDICES is set to YES then doxygen will not
	# include the index chapters (such as File Index, Compound Index, etc.)
	# in the output.

	LATEX_HIDE_INDICES = NO

	# If LATEX_SOURCE_CODE is set to YES then doxygen will include
	# source code with syntax highlighting in the LaTeX output.
	# Note that which sources are shown also depends on other settings
	# such as SOURCE_BROWSER.

	LATEX_SOURCE_CODE = NO

	#---------------------------------------------------------------------------
	# configuration options related to the RTF output
	#---------------------------------------------------------------------------

	# If the GENERATE_RTF tag is set to YES Doxygen will generate RTF output
	# The RTF output is optimized for Word 97 and may not look very pretty with
	# other RTF readers or editors.

	GENERATE_RTF = NO

	# The RTF_OUTPUT tag is used to specify where the RTF docs will be put.
	# If a relative path is entered the value of OUTPUT_DIRECTORY will be
	# put in front of it. If left blank `rtf' will be used as the default path.

	RTF_OUTPUT = rtf

	# If the COMPACT_RTF tag is set to YES Doxygen generates more compact
	# RTF documents. This may be useful for small projects and may help to
	# save some trees in general.

	COMPACT_RTF = NO

	# If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated
	# will contain hyperlink fields. The RTF file will
	# contain links (just like the HTML output) instead of page references.
	# This makes the output suitable for online browsing using WORD or other
	# programs which support those fields.
	# Note: wordpad (write) and others do not support links.

	RTF_HYPERLINKS = NO

	# Load stylesheet definitions from file. Syntax is similar to doxygen's
	# config file, i.e. a series of assignments. You only have to provide
	# replacements, missing definitions are set to their default value.

	RTF_STYLESHEET_FILE =

	# Set optional variables used in the generation of an rtf document.
	# Syntax is similar to doxygen's config file.

	RTF_EXTENSIONS_FILE =

	#---------------------------------------------------------------------------
	# configuration options related to the man page output
	#---------------------------------------------------------------------------

	# If the GENERATE_MAN tag is set to YES (the default) Doxygen will
	# generate man pages

	GENERATE_MAN = NO

	# The MAN_OUTPUT tag is used to specify where the man pages will be put.
	# If a relative path is entered the value of OUTPUT_DIRECTORY will be
	# put in front of it. If left blank `man' will be used as the default path.

	MAN_OUTPUT = man

	# The MAN_EXTENSION tag determines the extension that is added to
	# the generated man pages (default is the subroutine's section .3)

	MAN_EXTENSION = .3

	# If the MAN_LINKS tag is set to YES and Doxygen generates man output,
	# then it will generate one additional man file for each entity
	# documented in the real man page(s). These additional files
	# only source the real man page, but without them the man command
	# would be unable to find the correct page. The default is NO.

	MAN_LINKS = NO

	#---------------------------------------------------------------------------
	# configuration options related to the XML output
	#---------------------------------------------------------------------------

	# If the GENERATE_XML tag is set to YES Doxygen will
	# generate an XML file that captures the structure of
	# the code including all documentation.

	GENERATE_XML = YES

	# The XML_OUTPUT tag is used to specify where the XML pages will be put.
	# If a relative path is entered the value of OUTPUT_DIRECTORY will be
	# put in front of it. If left blank `xml' will be used as the default path.

	XML_OUTPUT = xml

	# The XML_SCHEMA tag can be used to specify an XML schema,
	# which can be used by a validating XML parser to check the
	# syntax of the XML files.

	#XML_SCHEMA =

	# The XML_DTD tag can be used to specify an XML DTD,
	# which can be used by a validating XML parser to check the
	# syntax of the XML files.

	#XML_DTD =

	# If the XML_PROGRAMLISTING tag is set to YES Doxygen will
	# dump the program listings (including syntax highlighting
	# and cross-referencing information) to the XML output. Note that
	# enabling this will significantly increase the size of the XML output.

	XML_PROGRAMLISTING = YES

	#---------------------------------------------------------------------------
	# configuration options for the AutoGen Definitions output
	#---------------------------------------------------------------------------

	# If the GENERATE_AUTOGEN_DEF tag is set to YES Doxygen will
	# generate an AutoGen Definitions (see autogen.sf.net) file
	# that captures the structure of the code including all
	# documentation. Note that this feature is still experimental
	# and incomplete at the moment.

	GENERATE_AUTOGEN_DEF = NO

	#---------------------------------------------------------------------------
	# configuration options related to the Perl module output
	#---------------------------------------------------------------------------

	# If the GENERATE_PERLMOD tag is set to YES Doxygen will
	# generate a Perl module file that captures the structure of
	# the code including all documentation. Note that this
	# feature is still experimental and incomplete at the
	# moment.

	GENERATE_PERLMOD = NO

	# If the PERLMOD_LATEX tag is set to YES Doxygen will generate
	# the necessary Makefile rules, Perl scripts and LaTeX code to be able
	# to generate PDF and DVI output from the Perl module output.

	PERLMOD_LATEX = NO

	# If the PERLMOD_PRETTY tag is set to YES the Perl module output will be
	# nicely formatted so it can be parsed by a human reader.
	# This is useful
	# if you want to understand what is going on.
	# On the other hand, if this
	# tag is set to NO the size of the Perl module output will be much smaller
	# and Perl will parse it just the same.

	PERLMOD_PRETTY = YES

	# The names of the make variables in the generated doxyrules.make file
	# are prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX.
	# This is useful so different doxyrules.make files included by the same
	# Makefile don't overwrite each other's variables.

	PERLMOD_MAKEVAR_PREFIX =

	#---------------------------------------------------------------------------
	# Configuration options related to the preprocessor
	#---------------------------------------------------------------------------

	# If the ENABLE_PREPROCESSING tag is set to YES (the default) Doxygen will
	# evaluate all C-preprocessor directives found in the sources and include
	# files.

	ENABLE_PREPROCESSING = YES

	# If the MACRO_EXPANSION tag is set to YES Doxygen will expand all macro
	# names in the source code. If set to NO (the default) only conditional
	# compilation will be performed. Macro expansion can be done in a controlled
	# way by setting EXPAND_ONLY_PREDEF to YES.

	MACRO_EXPANSION = YES

	# If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES
	# then the macro expansion is limited to the macros specified with the
	# PREDEFINED and EXPAND_AS_DEFINED tags.

	EXPAND_ONLY_PREDEF = YES

	# If the SEARCH_INCLUDES tag is set to YES (the default) the includes files
	# in the INCLUDE_PATH (see below) will be search if a #include is found.

	SEARCH_INCLUDES = YES

	# The INCLUDE_PATH tag can be used to specify one or more directories that
	# contain include files that are not input files but should be processed by
	# the preprocessor.

	INCLUDE_PATH =

	# You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard
	# patterns (like .h and .hpp) to filter out the header-files in the
	# directories. If left blank, the patterns specified with FILE_PATTERNS will
	# be used.

	INCLUDE_FILE_PATTERNS = *.h

	# The PREDEFINED tag can be used to specify one or more macro names that
	# are defined before the preprocessor is started (similar to the -D option of
	# gcc). The argument of the tag is a list of macros of the form: name
	# or name=definition (no spaces). If the definition and the = are
	# omitted =1 is assumed. To prevent a macro definition from being
	# undefined via #undef or recursively expanded use the := operator
	# instead of the = operator.

	PREDEFINED = DOXYGEN

	# If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then
	# this tag can be used to specify a list of macro names that should be expanded.
	# The macro definition that is found in the sources will be used.
	# Use the PREDEFINED tag if you want to use a different macro definition.

	EXPAND_AS_DEFINED = ATTR_UNUSED

	# If the SKIP_FUNCTION_MACROS tag is set to YES (the default) then
	# doxygen's preprocessor will remove all function-like macros that are alone
	# on a line, have an all uppercase name, and do not end with a semicolon. Such
	# function macros are typically used for boiler-plate code, and will confuse
	# the parser if not removed.

	SKIP_FUNCTION_MACROS = YES

	#---------------------------------------------------------------------------
	# Configuration::additions related to external references
	#---------------------------------------------------------------------------

	# The TAGFILES option can be used to specify one or more tagfiles.
	# Optionally an initial location of the external documentation
	# can be added for each tagfile. The format of a tag file without
	# this location is as follows:
	#
	# TAGFILES = file1 file2 ...
	# Adding location for the tag files is done as follows:
	#
	# TAGFILES = file1=loc1 "file2 = loc2" ...
	# where "loc1" and "loc2" can be relative or absolute paths or
	# URLs. If a location is present for each tag, the installdox tool
	# does not have to be run to correct the links.
	# Note that each tag file must have a unique name
	# (where the name does NOT include the path)
	# If a tag file is not located in the directory in which doxygen
	# is run, you must also specify the path to the tagfile here.

	TAGFILES =

	# When a file name is specified after GENERATE_TAGFILE, doxygen will create
	# a tag file that is based on the input files it reads.

	GENERATE_TAGFILE =

	# If the ALLEXTERNALS tag is set to YES all external classes will be listed
	# in the class index. If set to NO only the inherited external classes
	# will be listed.

	ALLEXTERNALS = NO

	# If the EXTERNAL_GROUPS tag is set to YES all external groups will be listed
	# in the modules index. If set to NO, only the current project's groups will
	# be listed.

	EXTERNAL_GROUPS = YES

	# The PERL_PATH should be the absolute path and name of the perl script
	# interpreter (i.e. the result of `which perl').

	PERL_PATH = /usr/bin/perl

	#---------------------------------------------------------------------------
	# Configuration options related to the dot tool
	#---------------------------------------------------------------------------

	# If the CLASS_DIAGRAMS tag is set to YES (the default) Doxygen will
	# generate a inheritance diagram (in HTML, RTF and LaTeX) for classes with base
	# or super classes. Setting the tag to NO turns the diagrams off. Note that
	# this option is superseded by the HAVE_DOT option below. This is only a
	# fallback. It is recommended to install and use dot, since it yields more
	# powerful graphs.

	CLASS_DIAGRAMS = YES

	# You can define message sequence charts within doxygen comments using the \msc
	# command. Doxygen will then run the mscgen tool (see
	# http://www.mcternan.me.uk/mscgen/) to produce the chart and insert it in the
	# documentation. The MSCGEN_PATH tag allows you to specify the directory where
	# the mscgen tool resides. If left empty the tool is assumed to be found in the
	# default search path.

	MSCGEN_PATH =

	# If set to YES, the inheritance and collaboration graphs will hide
	# inheritance and usage relations if the target is undocumented
	# or is not a class.

	HIDE_UNDOC_RELATIONS = YES

	# If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is
	# available from the path. This tool is part of Graphviz, a graph visualization
	# toolkit from AT&T and Lucent Bell Labs. The other options in this section
	# have no effect if this option is set to NO (the default)

	HAVE_DOT = NO

	# The DOT_NUM_THREADS specifies the number of dot invocations doxygen is
	# allowed to run in parallel. When set to 0 (the default) doxygen will
	# base this on the number of processors available in the system. You can set it
	# explicitly to a value larger than 0 to get control over the balance
	# between CPU load and processing speed.

	#DOT_NUM_THREADS = 0

	# By default doxygen will write a font called FreeSans.ttf to the output
	# directory and reference it in all dot files that doxygen generates. This
	# font does not include all possible unicode characters however, so when you need
	# these (or just want a differently looking font) you can specify the font name
	# using DOT_FONTNAME. You need need to make sure dot is able to find the font,
	# which can be done by putting it in a standard location or by setting the
	# DOTFONTPATH environment variable or by setting DOT_FONTPATH to the directory
	# containing the font.

	#DOT_FONTNAME = FreeSans.ttf

	# The DOT_FONTSIZE tag can be used to set the size of the font of dot graphs.
	# The default size is 10pt.

	DOT_FONTSIZE = 10

	# By default doxygen will tell dot to use the output directory to look for the
	# FreeSans.ttf font (which doxygen will put there itself). If you specify a
	# different font using DOT_FONTNAME you can set the path where dot
	# can find it using this tag.

	DOT_FONTPATH =

	# If the CLASS_GRAPH and HAVE_DOT tags are set to YES then doxygen
	# will generate a graph for each documented class showing the direct and
	# indirect inheritance relations. Setting this tag to YES will force the
	# the CLASS_DIAGRAMS tag to NO.

	CLASS_GRAPH = YES

	# If the COLLABORATION_GRAPH and HAVE_DOT tags are set to YES then doxygen
	# will generate a graph for each documented class showing the direct and
	# indirect implementation dependencies (inheritance, containment, and
	# class references variables) of the class with other documented classes.

	COLLABORATION_GRAPH = YES

	# If the GROUP_GRAPHS and HAVE_DOT tags are set to YES then doxygen
	# will generate a graph for groups, showing the direct groups dependencies

	GROUP_GRAPHS = YES

	# If the UML_LOOK tag is set to YES doxygen will generate inheritance and
	# collaboration diagrams in a style similar to the OMG's Unified Modeling
	# Language.

	UML_LOOK = NO

	# If set to YES, the inheritance and collaboration graphs will show the
	# relations between templates and their instances.

	TEMPLATE_RELATIONS = NO

	# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDE_GRAPH, and HAVE_DOT
	# tags are set to YES then doxygen will generate a graph for each documented
	# file showing the direct and indirect include dependencies of the file with
	# other documented files.

	INCLUDE_GRAPH = YES

	# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDED_BY_GRAPH, and
	# HAVE_DOT tags are set to YES then doxygen will generate a graph for each
	# documented header file showing the documented files that directly or
	# indirectly include this file.

	INCLUDED_BY_GRAPH = YES

	# If the CALL_GRAPH and HAVE_DOT options are set to YES then
	# doxygen will generate a call dependency graph for every global function
	# or class method. Note that enabling this option will significantly increase
	# the time of a run. So in most cases it will be better to enable call graphs
	# for selected functions only using the \callgraph command.

	CALL_GRAPH = NO

	# If the CALLER_GRAPH and HAVE_DOT tags are set to YES then
	# doxygen will generate a caller dependency graph for every global function
	# or class method. Note that enabling this option will significantly increase
	# the time of a run. So in most cases it will be better to enable caller
	# graphs for selected functions only using the \callergraph command.

	CALLER_GRAPH = NO

	# If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen
	# will graphical hierarchy of all classes instead of a textual one.

	GRAPHICAL_HIERARCHY = YES

	# If the DIRECTORY_GRAPH, SHOW_DIRECTORIES and HAVE_DOT tags are set to YES
	# then doxygen will show the dependencies a directory has on other directories
	# in a graphical way. The dependency relations are determined by the #include
	# relations between the files in the directories.

	DIRECTORY_GRAPH = YES

	# The DOT_IMAGE_FORMAT tag can be used to set the image format of the images
	# generated by dot. Possible values are png, jpg, or gif
	# If left blank png will be used.

	DOT_IMAGE_FORMAT = png

	# The tag DOT_PATH can be used to specify the path where the dot tool can be
	# found. If left blank, it is assumed the dot tool can be found in the path.

	DOT_PATH =

	# The DOTFILE_DIRS tag can be used to specify one or more directories that
	# contain dot files that are included in the documentation (see the
	# \dotfile command).

	DOTFILE_DIRS =

	# The DOT_GRAPH_MAX_NODES tag can be used to set the maximum number of
	# nodes that will be shown in the graph. If the number of nodes in a graph
	# becomes larger than this value, doxygen will truncate the graph, which is
	# visualized by representing a node as a red box. Note that doxygen if the
	# number of direct children of the root node in a graph is already larger than
	# DOT_GRAPH_MAX_NODES then the graph will not be shown at all. Also note
	# that the size of a graph can be further restricted by MAX_DOT_GRAPH_DEPTH.

	DOT_GRAPH_MAX_NODES = 50

	# The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the
	# graphs generated by dot. A depth value of 3 means that only nodes reachable
	# from the root by following a path via at most 3 edges will be shown. Nodes
	# that lay further from the root node will be omitted. Note that setting this
	# option to 1 or 2 may greatly reduce the computation time needed for large
	# code bases. Also note that the size of a graph can be further restricted by
	# DOT_GRAPH_MAX_NODES. Using a depth of 0 means no depth restriction.

	MAX_DOT_GRAPH_DEPTH = 0

	# Set the DOT_TRANSPARENT tag to YES to generate images with a transparent
	# background. This is disabled by default, because dot on Windows does not
	# seem to support this out of the box. Warning: Depending on the platform used,
	# enabling this option may lead to badly anti-aliased labels on the edges of
	# a graph (i.e. they become hard to read).

	DOT_TRANSPARENT = NO

	# Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output
	# files in one run (i.e. multiple -o and -T options on the command line). This
	# makes dot run faster, but since only newer versions of dot (>1.8.10)
	# support this, this feature is disabled by default.

	DOT_MULTI_TARGETS = NO

	# If the GENERATE_LEGEND tag is set to YES (the default) Doxygen will
	# generate a legend page explaining the meaning of the various boxes and
	# arrows in the dot generated graphs.

	GENERATE_LEGEND = YES

	# If the DOT_CLEANUP tag is set to YES (the default) Doxygen will
	# remove the intermediate dot files that are used to generate
	# the various graphs.

	DOT_CLEANUP = YES
	Index: head/contrib/unbound/edns-subnet/addrtree.c
	===================================================================
	--- head/contrib/unbound/edns-subnet/addrtree.c (revision 349719)
	+++ head/contrib/unbound/edns-subnet/addrtree.c (revision 349720)
	@@ -1,532 +1,532 @@
	/*
	* edns-subnet/addrtree.c -- radix tree for edns subnet cache.
	*
	* Copyright (c) 2013, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/
	/** \file
	* addrtree -- radix tree for edns subnet cache.
	*/

	#include "config.h"
	#include "util/log.h"
	#include "util/data/msgreply.h"
	#include "util/module.h"
	#include "addrtree.h"

	/**
	* Create a new edge
	* @param node: Child node this edge will connect to.
	* @param addr: full key to this edge.
	* @param addrlen: length of relevant part of key for this node
	* @param parent_node: Parent node for node
	* @param parent_index: Index of child node at parent node
	* @return new addredge or NULL on failure
	*/
	static struct addredge *
	edge_create(struct addrnode node, const addrkey_t addr,
	addrlen_t addrlen, struct addrnode *parent_node, int parent_index)
	{
	size_t n;
	struct addredge edge = (struct addredge )malloc( sizeof (*edge) );
	if (!edge)
	return NULL;
	edge->node = node;
	edge->len = addrlen;
	edge->parent_index = parent_index;
	edge->parent_node = parent_node;
	/* ceil() */
	n = (size_t)((addrlen / KEYWIDTH) + ((addrlen % KEYWIDTH != 0)?1:0));
	edge->str = (addrkey_t *)calloc(n, sizeof (addrkey_t));
	if (!edge->str) {
	free(edge);
	return NULL;
	}
	memcpy(edge->str, addr, n * sizeof (addrkey_t));
	/* Only manipulate other objects after successful alloc */
	node->parent_edge = edge;
	log_assert(parent_node->edge[parent_index] == NULL);
	parent_node->edge[parent_index] = edge;
	return edge;
	}

	/**
	* Create a new node
	* @param tree: Tree the node lives in.
	* @param elem: Element to store at this node
	* @param scope: Scopemask from server reply
	* @param ttl: Element is valid up to this time. Absolute, seconds
	* @return new addrnode or NULL on failure
	*/
	static struct addrnode *
	node_create(struct addrtree tree, void elem, addrlen_t scope,
	time_t ttl)
	{
	struct addrnode* node = (struct addrnode )malloc( sizeof (node) );
	if (!node)
	return NULL;
	node->elem = elem;
	tree->node_count++;
	node->scope = scope;
	node->ttl = ttl;
	node->edge[0] = NULL;
	node->edge[1] = NULL;
	node->parent_edge = NULL;
	node->next = NULL;
	node->prev = NULL;
	return node;
	}

	/** Size in bytes of node and parent edge
	* @param tree: tree the node lives in
	* @param n: node which size must be calculated
	* @return size in bytes.
	**/
	static inline size_t
	node_size(const struct addrtree tree, const struct addrnode n)
	{
	return sizeof n + sizeof n->parent_edge + n->parent_edge->len +
	(n->elem?tree->sizefunc(n->elem):0);
	}

	struct addrtree *
	addrtree_create(addrlen_t max_depth, void (delfunc)(void , void *),
	- size_t (sizefunc)(void ), void *env, unsigned int max_node_count)
	+ size_t (sizefunc)(void ), void *env, uint32_t max_node_count)
	{
	struct addrtree *tree;
	log_assert(delfunc != NULL);
	log_assert(sizefunc != NULL);
	tree = (struct addrtree )calloc(1, sizeof(tree));
	if (!tree)
	return NULL;
	tree->root = node_create(tree, NULL, 0, 0);
	if (!tree->root) {
	free(tree);
	return NULL;
	}
	tree->size_bytes = sizeof tree + sizeof tree->root;
	tree->first = NULL;
	tree->last = NULL;
	tree->max_depth = max_depth;
	tree->delfunc = delfunc;
	tree->sizefunc = sizefunc;
	tree->env = env;
	tree->node_count = 0;
	tree->max_node_count = max_node_count;
	return tree;
	}

	/**
	* Scrub a node clean of elem
	* @param tree: tree the node lives in.
	* @param node: node to be cleaned.
	*/
	static void
	clean_node(struct addrtree tree, struct addrnode node)
	{
	if (!node->elem) return;
	tree->size_bytes -= tree->sizefunc(node->elem);
	tree->delfunc(tree->env, node->elem);
	node->elem = NULL;
	}

	/** Remove specified node from LRU list */
	static void
	lru_pop(struct addrtree tree, struct addrnode node)
	{
	if (node == tree->first) {
	if (!node->next) { /* it is the last as well */
	tree->first = NULL;
	tree->last = NULL;
	} else {
	tree->first = node->next;
	tree->first->prev = NULL;
	}
	} else if (node == tree->last) { /* but not the first */
	tree->last = node->prev;
	tree->last->next = NULL;
	} else {
	node->prev->next = node->next;
	node->next->prev = node->prev;
	}
	}

	/** Add node to LRU list as most recently used. */
	static void
	lru_push(struct addrtree tree, struct addrnode node)
	{
	if (!tree->first) {
	tree->first = node;
	node->prev = NULL;
	} else {
	tree->last->next = node;
	node->prev = tree->last;
	}
	tree->last = node;
	node->next = NULL;
	}

	/** Move node to the end of LRU list */
	static void
	lru_update(struct addrtree tree, struct addrnode node)
	{
	if (tree->root == node) return;
	lru_pop(tree, node);
	lru_push(tree, node);
	}

	/**
	* Purge a node from the tree. Node and parentedge are cleaned and
	* free'd.
	* @param tree: Tree the node lives in.
	* @param node: Node to be freed
	*/
	static void
	purge_node(struct addrtree tree, struct addrnode node)
	{
	struct addredge parent_edge, child_edge = NULL;
	int index;
	int keep = node->edge[0] && node->edge[1];

	clean_node(tree, node);
	parent_edge = node->parent_edge;
	if (keep \|\| !parent_edge) return;
	tree->node_count--;
	index = parent_edge->parent_index;
	child_edge = node->edge[!node->edge[0]];
	if (child_edge) {
	child_edge->parent_node = parent_edge->parent_node;
	child_edge->parent_index = index;
	}
	parent_edge->parent_node->edge[index] = child_edge;
	tree->size_bytes -= node_size(tree, node);
	free(parent_edge->str);
	free(parent_edge);
	lru_pop(tree, node);
	free(node);
	}

	/**
	* If a limit is set remove old nodes while above that limit.
	* @param tree: Tree to be cleaned up.
	*/
	static void
	lru_cleanup(struct addrtree *tree)
	{
	struct addrnode n, p;
	int children;
	if (tree->max_node_count == 0) return;
	while (tree->node_count > tree->max_node_count) {
	n = tree->first;
	if (!n) break;
	children = (n->edge[0] != NULL) + (n->edge[1] != NULL);
	/** Don't remove this node, it is either the root or we can't
	* do without it because it has 2 children */
	if (children == 2 \|\| !n->parent_edge) {
	lru_update(tree, n);
	continue;
	}
	p = n->parent_edge->parent_node;
	purge_node(tree, n);
	/** Since we removed n, n's parent p is eligible for deletion
	* if it is not the root node, caries no data and has only 1
	* child */
	children = (p->edge[0] != NULL) + (p->edge[1] != NULL);
	if (!p->elem && children == 1 && p->parent_edge) {
	purge_node(tree, p);
	}
	}
	}

	inline size_t
	addrtree_size(const struct addrtree *tree)
	{
	return tree?tree->size_bytes:0;
	}

	void addrtree_delete(struct addrtree *tree)
	{
	struct addrnode *n;
	if (!tree) return;
	clean_node(tree, tree->root);
	free(tree->root);
	tree->size_bytes -= sizeof(struct addrnode);
	while ((n = tree->first)) {
	tree->first = n->next;
	clean_node(tree, n);
	tree->size_bytes -= node_size(tree, n);
	free(n->parent_edge->str);
	free(n->parent_edge);
	free(n);
	}
	log_assert(sizeof *tree == addrtree_size(tree));
	free(tree);
	}

	/**
	* Get N'th bit from address
	* @param addr: address to inspect
	* @param addrlen: length of addr in bits
	* @param n: index of bit to test. Must be in range [0, addrlen)
	* @return 0 or 1
	*/
	static int
	getbit(const addrkey_t *addr, addrlen_t addrlen, addrlen_t n)
	{
	log_assert(addrlen > n);
	(void)addrlen;
	return (int)(addr[n/KEYWIDTH]>>((KEYWIDTH-1)-(n%KEYWIDTH))) & 1;
	}

	/**
	* Test for equality on N'th bit.
	* @return 0 for equal, 1 otherwise
	*/
	static inline int
	cmpbit(const addrkey_t key1, const addrkey_t key2, addrlen_t n)
	{
	addrkey_t c = key1[n/KEYWIDTH] ^ key2[n/KEYWIDTH];
	return (int)(c >> ((KEYWIDTH-1)-(n%KEYWIDTH))) & 1;
	}

	/**
	* Common number of bits in prefix.
	* @param s1: first prefix.
	* @param l1: length of s1 in bits.
	* @param s2: second prefix.
	* @param l2: length of s2 in bits.
	* @param skip: nr of bits already checked.
	* @return common number of bits.
	*/
	static addrlen_t
	bits_common(const addrkey_t *s1, addrlen_t l1,
	const addrkey_t *s2, addrlen_t l2, addrlen_t skip)
	{
	addrlen_t len, i;
	len = (l1 > l2) ? l2 : l1;
	log_assert(skip < len);
	for (i = skip; i < len; i++) {
	if (cmpbit(s1, s2, i)) return i;
	}
	return len;
	}

	/**
	* Tests if s1 is a substring of s2
	* @param s1: first prefix.
	* @param l1: length of s1 in bits.
	* @param s2: second prefix.
	* @param l2: length of s2 in bits.
	* @param skip: nr of bits already checked.
	* @return 1 for substring, 0 otherwise
	*/
	static int
	issub(const addrkey_t *s1, addrlen_t l1,
	const addrkey_t *s2, addrlen_t l2, addrlen_t skip)
	{
	return bits_common(s1, l1, s2, l2, skip) == l1;
	}

	void
	addrtree_insert(struct addrtree tree, const addrkey_t addr,
	addrlen_t sourcemask, addrlen_t scope, void *elem, time_t ttl,
	time_t now)
	{
	struct addrnode newnode, node;
	struct addredge *edge;
	int index;
	addrlen_t common, depth;

	node = tree->root;
	log_assert(node != NULL);

	/* Protect our cache against too much fine-grained data */
	if (tree->max_depth < scope) scope = tree->max_depth;
	/* Server answer was less specific than question */
	if (scope < sourcemask) sourcemask = scope;

	depth = 0;
	while (1) {
	log_assert(depth <= sourcemask);
	/* Case 1: update existing node */
	if (depth == sourcemask) {
	/* update this node's scope and data */
	clean_node(tree, node);
	node->ttl = ttl;
	node->elem = elem;
	node->scope = scope;
	tree->size_bytes += tree->sizefunc(elem);
	return;
	}
	index = getbit(addr, sourcemask, depth);
	/* Get an edge to an unexpired node */
	edge = node->edge[index];
	while (edge) {
	/* Purge all expired nodes on path */
	if (!edge->node->elem \|\| edge->node->ttl >= now)
	break;
	purge_node(tree, edge->node);
	edge = node->edge[index];
	}
	/* Case 2: New leafnode */
	if (!edge) {
	newnode = node_create(tree, elem, scope, ttl);
	if (!newnode) return;
	if (!edge_create(newnode, addr, sourcemask, node,
	index)) {
	clean_node(tree, newnode);
	tree->node_count--;
	free(newnode);
	return;
	}
	tree->size_bytes += node_size(tree, newnode);
	lru_push(tree, newnode);
	lru_cleanup(tree);
	return;
	}
	/* Case 3: Traverse edge */
	common = bits_common(edge->str, edge->len, addr, sourcemask,
	depth);
	if (common == edge->len) {
	/* We update the scope of intermediate nodes. Apparently
	* the * authority changed its mind. If we would not do
	* this we might not be able to reach our new node. */
	node->scope = scope;
	depth = edge->len;
	node = edge->node;
	continue;
	}
	/* Case 4: split. */
	if (!(newnode = node_create(tree, NULL, 0, 0)))
	return;
	node->edge[index] = NULL;
	if (!edge_create(newnode, addr, common, node, index)) {
	node->edge[index] = edge;
	clean_node(tree, newnode);
	tree->node_count--;
	free(newnode);
	return;
	}
	lru_push(tree, newnode);
	/* connect existing child to our new node */
	index = getbit(edge->str, edge->len, common);
	newnode->edge[index] = edge;
	edge->parent_node = newnode;
	edge->parent_index = (int)index;

	if (common == sourcemask) {
	/* Data is stored in the node */
	newnode->elem = elem;
	newnode->scope = scope;
	newnode->ttl = ttl;
	}

	tree->size_bytes += node_size(tree, newnode);

	if (common != sourcemask) {
	/* Data is stored in other leafnode */
	node = newnode;
	newnode = node_create(tree, elem, scope, ttl);
	if (!edge_create(newnode, addr, sourcemask, node,
	index^1)) {
	clean_node(tree, newnode);
	tree->node_count--;
	free(newnode);
	return;
	}
	tree->size_bytes += node_size(tree, newnode);
	lru_push(tree, newnode);
	}
	lru_cleanup(tree);
	return;
	}
	}

	struct addrnode *
	addrtree_find(struct addrtree tree, const addrkey_t addr,
	addrlen_t sourcemask, time_t now)
	{
	struct addrnode *node = tree->root;
	struct addredge *edge = NULL;
	addrlen_t depth = 0;

	log_assert(node != NULL);
	while (1) {
	/* Current node more specific then question. */
	log_assert(depth <= sourcemask);
	/* does this node have data? if yes, see if we have a match */
	if (node->elem && node->ttl >= now) {
	/* saved at wrong depth */;
	log_assert(node->scope >= depth);
	if (depth == node->scope \|\|
	(node->scope > sourcemask &&
	depth == sourcemask)) {
	/* Authority indicates it does not have a more
	* precise answer or we cannot ask a more
	* specific question. */
	lru_update(tree, node);
	return node;
	}
	}
	/* This is our final depth, but we haven't found an answer. */
	if (depth == sourcemask)
	return NULL;
	/* Find an edge to traverse */
	edge = node->edge[getbit(addr, sourcemask, depth)];
	if (!edge \|\| !edge->node)
	return NULL;
	if (edge->len > sourcemask )
	return NULL;
	if (!issub(edge->str, edge->len, addr, sourcemask, depth))
	return NULL;
	log_assert(depth < edge->len);
	depth = edge->len;
	node = edge->node;
	}
	}

	/** Wrappers for static functions to unit test */
	int unittest_wrapper_addrtree_cmpbit(const addrkey_t *key1,
	const addrkey_t *key2, addrlen_t n) {
	return cmpbit(key1, key2, n);
	}
	addrlen_t unittest_wrapper_addrtree_bits_common(const addrkey_t *s1,
	addrlen_t l1, const addrkey_t *s2, addrlen_t l2, addrlen_t skip) {
	return bits_common(s1, l1, s2, l2, skip);
	}
	int unittest_wrapper_addrtree_getbit(const addrkey_t *addr,
	addrlen_t addrlen, addrlen_t n) {
	return getbit(addr, addrlen, n);
	}
	int unittest_wrapper_addrtree_issub(const addrkey_t *s1, addrlen_t l1,
	const addrkey_t *s2, addrlen_t l2, addrlen_t skip) {
	return issub(s1, l1, s2, l2, skip);
	}
	Index: head/contrib/unbound/edns-subnet/addrtree.h
	===================================================================
	--- head/contrib/unbound/edns-subnet/addrtree.h (revision 349719)
	+++ head/contrib/unbound/edns-subnet/addrtree.h (revision 349720)
	@@ -1,187 +1,187 @@
	/*
	* edns-subnet/addrtree.h -- radix tree for edns subnet cache.
	*
	* Copyright (c) 2013, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	* The addrtree is a radix tree designed for edns subnet. Most notable
	* is the addition of 'scope' to a node. Scope is only relevant for
	* nodes with elem set, it indicates the number of bits the authority
	* desires.
	*
	* For retrieving data one needs an address and address length
	* (sourcemask). While traversing the tree the first matching node is
	* returned. A node matches when
	* node.scope<=sourcemask && node.elem!=NULL
	* (This is the most specific answer the authority has.)
	* or
	* node.sourcemask==sourcemask && node.elem!=NULL
	* (This is the most specific question the client can ask.)
	*
	* Insertion needs an address, sourcemask and scope. The length of the
	* address is capped by min(sourcemask, scope). While traversing the
	* tree the scope of all visited nodes is updated. This ensures we are
	* always able to find the most specific answer available.
	*/

	#ifndef ADDRTREE_H
	#define ADDRTREE_H

	typedef uint8_t addrlen_t;
	typedef uint8_t addrkey_t;
	#define KEYWIDTH 8

	struct addrtree {
	struct addrnode *root;
	/** Number of elements in the tree (not always equal to number of
	* nodes) */
	- unsigned int node_count;
	+ uint32_t node_count;
	/** Maximum number of allowed nodes, will be enforced by LRU list.
	* Excluding the root node, 0 for unlimited */
	- unsigned int max_node_count;
	+ uint32_t max_node_count;
	/** Size of tree in bytes */
	size_t size_bytes;
	/** Maximum prefix length we are willing to cache. */
	addrlen_t max_depth;
	/** External function to delete elem. Called as
	* delfunc(addrnode->elem, addrtree->env) */
	void (delfunc)(void , void *);
	/** Environment for delfunc */
	void *env;
	/** External function returning size of elem. Called as
	* sizefunc(addrnode->elem) */
	size_t (sizefunc)(void );
	/** first node in LRU list, first candidate to go */
	struct addrnode* first;
	/** last node in LRU list, last candidate to go */
	struct addrnode *last;
	};

	struct addrnode {
	/** Payload of node, may be NULL */
	void *elem;
	/** Abs time in seconds in which elem is meaningful */
	time_t ttl;
	/** Number of significant bits in address. */
	addrlen_t scope;
	/** A node can have 0-2 edges, set to NULL for unused */
	struct addredge *edge[2];
	/** edge between this node and parent */
	struct addredge *parent_edge;
	/** previous node in LRU list */
	struct addrnode *prev;
	/** next node in LRU list */
	struct addrnode *next;
	};

	struct addredge {
	/** address of connected node */
	addrkey_t *str;
	/** length in bits of str */
	addrlen_t len;
	/** child node this edge is connected to */
	struct addrnode *node;
	/** Parent node this ege is connected to */
	struct addrnode *parent_node;
	/** Index of this edge in parent_node */
	int parent_index;
	};

	/**
	* Size of tree in bytes.
	* @param tree: Tree.
	* @return size of tree in bytes.
	*/
	size_t addrtree_size(const struct addrtree *tree);

	/**
	* Create a new tree.
	* @param max_depth: Tree will cap keys to this length.
	* @param delfunc: f(element, env) delete element.
	* @param sizefunc: f(element) returning the size of element.
	* @param env: Module environment for alloc information.
	* @param max_node_count: Maximum size of this data structure in nodes.
	* 0 for unlimited.
	* @return new addrtree or NULL on failure.
	*/
	struct addrtree *
	addrtree_create(addrlen_t max_depth, void (delfunc)(void , void *),
	- size_t (sizefunc)(void ), void *env, unsigned int max_node_count);
	+ size_t (sizefunc)(void ), void *env, uint32_t max_node_count);

	/**
	* Free tree and all nodes below.
	* @param tree: Tree to be freed.
	*/
	void addrtree_delete(struct addrtree *tree);

	/**
	* Insert an element in the tree. Failures are silent. Sourcemask and
	* scope might be changed according to local policy. Caller should no
	* longer access elem, it could be free'd now or later during future
	* inserts.
	*
	* @param tree: Tree insert elem in.
	* @param addr: key for element lookup.
	* @param sourcemask: Length of addr in bits.
	* @param scope: Number of significant bits in addr.
	* @param elem: data to store in the tree.
	* @param ttl: elem is valid up to this time, seconds.
	* @param now: Current time in seconds.
	*/
	void addrtree_insert(struct addrtree tree, const addrkey_t addr,
	addrlen_t sourcemask, addrlen_t scope, void *elem, time_t ttl,
	time_t now);

	/**
	* Find a node containing an element in the tree.
	*
	* @param tree: Tree to search.
	* @param addr: key for element lookup.
	* @param sourcemask: Length of addr in bits.
	* @param now: Current time in seconds.
	* @return addrnode or NULL on miss.
	*/
	struct addrnode * addrtree_find(struct addrtree *tree,
	const addrkey_t *addr, addrlen_t sourcemask, time_t now);

	/** Wrappers for static functions to unit test */
	int unittest_wrapper_addrtree_cmpbit(const addrkey_t *key1,
	const addrkey_t *key2, addrlen_t n);
	addrlen_t unittest_wrapper_addrtree_bits_common(const addrkey_t *s1,
	addrlen_t l1, const addrkey_t *s2, addrlen_t l2, addrlen_t skip);
	int unittest_wrapper_addrtree_getbit(const addrkey_t *addr,
	addrlen_t addrlen, addrlen_t n);
	int unittest_wrapper_addrtree_issub(const addrkey_t *s1, addrlen_t l1,
	const addrkey_t *s2, addrlen_t l2, addrlen_t skip);
	#endif /* ADDRTREE_H */
	Index: head/contrib/unbound/edns-subnet/subnetmod.c
	===================================================================
	--- head/contrib/unbound/edns-subnet/subnetmod.c (revision 349719)
	+++ head/contrib/unbound/edns-subnet/subnetmod.c (revision 349720)
	@@ -1,823 +1,866 @@
	/*
	* edns-subnet/subnetmod.c - edns subnet module. Must be called before validator
	* and iterator.
	*
	* Copyright (c) 2013, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/
	/**
	* \file
	* subnet module for unbound.
	*/

	#include "config.h"

	#ifdef CLIENT_SUBNET /* keeps splint happy */

	#include "edns-subnet/subnetmod.h"
	#include "edns-subnet/edns-subnet.h"
	#include "edns-subnet/addrtree.h"
	#include "edns-subnet/subnet-whitelist.h"

	#include "services/mesh.h"
	#include "services/cache/dns.h"
	#include "util/module.h"
	#include "util/regional.h"
	#include "util/storage/slabhash.h"
	#include "util/config_file.h"
	#include "util/data/msgreply.h"
	#include "sldns/sbuffer.h"
	+#include "iterator/iter_utils.h"

	-#define ECS_MAX_TREESIZE 100
	-
	/** externally called */
	void
	subnet_data_delete(void d, void ATTR_UNUSED(arg))
	{
	struct subnet_msg_cache_data *r;
	r = (struct subnet_msg_cache_data*)d;
	addrtree_delete(r->tree4);
	addrtree_delete(r->tree6);
	free(r);
	}

	/** externally called */
	size_t
	msg_cache_sizefunc(void k, void d)
	{
	struct msgreply_entry q = (struct msgreply_entry)k;
	struct subnet_msg_cache_data r = (struct subnet_msg_cache_data)d;
	size_t s = sizeof(struct msgreply_entry)
	+ sizeof(struct subnet_msg_cache_data)
	+ q->key.qname_len + lock_get_mem(&q->entry.lock);
	s += addrtree_size(r->tree4);
	s += addrtree_size(r->tree6);
	return s;
	}

	/** new query for ecs module */
	static int
	subnet_new_qstate(struct module_qstate *qstate, int id)
	{
	struct subnet_qstate sq = (struct subnet_qstate)regional_alloc(
	qstate->region, sizeof(struct subnet_qstate));
	if(!sq)
	return 0;
	qstate->minfo[id] = sq;
	memset(sq, 0, sizeof(*sq));
	+ sq->started_no_cache_store = qstate->no_cache_store;
	return 1;
	}

	/** Add ecs struct to edns list, after parsing it to wire format. */
	static void
	ecs_opt_list_append(struct ecs_data* ecs, struct edns_option** list,
	struct module_qstate *qstate)
	{
	size_t sn_octs, sn_octs_remainder;
	sldns_buffer* buf = qstate->env->scratch_buffer;

	if(ecs->subnet_validdata) {
	log_assert(ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4 \|\|
	ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP6);
	log_assert(ecs->subnet_addr_fam != EDNSSUBNET_ADDRFAM_IP4 \|\|
	ecs->subnet_source_mask <= INET_SIZE*8);
	log_assert(ecs->subnet_addr_fam != EDNSSUBNET_ADDRFAM_IP6 \|\|
	ecs->subnet_source_mask <= INET6_SIZE*8);

	sn_octs = ecs->subnet_source_mask / 8;
	sn_octs_remainder =
	(size_t)((ecs->subnet_source_mask % 8)>0?1:0);

	log_assert(sn_octs + sn_octs_remainder <= INET6_SIZE);

	sldns_buffer_clear(buf);
	sldns_buffer_write_u16(buf, ecs->subnet_addr_fam);
	sldns_buffer_write_u8(buf, ecs->subnet_source_mask);
	sldns_buffer_write_u8(buf, ecs->subnet_scope_mask);
	sldns_buffer_write(buf, ecs->subnet_addr, sn_octs);
	if(sn_octs_remainder)
	sldns_buffer_write_u8(buf, ecs->subnet_addr[sn_octs] &
	~(0xFF >> (ecs->subnet_source_mask % 8)));
	sldns_buffer_flip(buf);

	edns_opt_list_append(list,
	qstate->env->cfg->client_subnet_opcode,
	sn_octs + sn_octs_remainder + 4,
	sldns_buffer_begin(buf), qstate->region);
	}
	}

	int ecs_whitelist_check(struct query_info* qinfo,
	uint16_t ATTR_UNUSED(flags), struct module_qstate* qstate,
	struct sockaddr_storage* addr, socklen_t addrlen,
	uint8_t* ATTR_UNUSED(zone), size_t ATTR_UNUSED(zonelen),
	struct regional* ATTR_UNUSED(region), int id, void* ATTR_UNUSED(cbargs))
	{
	struct subnet_qstate *sq;
	struct subnet_env *sn_env;

	if(!(sq=(struct subnet_qstate*)qstate->minfo[id]))
	return 1;
	sn_env = (struct subnet_env*)qstate->env->modinfo[id];

	/* Cache by default, might be disabled after parsing EDNS option
	* received from nameserver. */
	- qstate->no_cache_store = 0;
	+ if(!iter_stub_fwd_no_cache(qstate, &qstate->qinfo)) {
	+ qstate->no_cache_store = 0;
	+ }

	if(sq->ecs_server_out.subnet_validdata && ((sq->subnet_downstream &&
	qstate->env->cfg->client_subnet_always_forward) \|\|
	ecs_is_whitelisted(sn_env->whitelist,
	addr, addrlen, qinfo->qname, qinfo->qname_len,
	qinfo->qclass))) {
	/* Address on whitelist or client query contains ECS option, we
	* want to sent out ECS. Only add option if it is not already
	* set. */
	if(!(sq->subnet_sent)) {
	ecs_opt_list_append(&sq->ecs_server_out,
	&qstate->edns_opts_back_out, qstate);
	sq->subnet_sent = 1;
	}
	}
	else if(sq->subnet_sent) {
	/* Outgoing ECS option is set, but we don't want to sent it to
	* this address, remove option. */
	edns_opt_list_remove(&qstate->edns_opts_back_out,
	qstate->env->cfg->client_subnet_opcode);
	sq->subnet_sent = 0;
	}
	return 1;
	}


	+void
	+subnet_markdel(void* key)
	+{
	+ struct msgreply_entry e = (struct msgreply_entry)key;
	+ e->key.qtype = 0;
	+ e->key.qclass = 0;
	+}
	+
	int
	subnetmod_init(struct module_env *env, int id)
	{
	struct subnet_env sn_env = (struct subnet_env)calloc(1,
	sizeof(struct subnet_env));
	if(!sn_env) {
	log_err("malloc failure");
	return 0;
	}
	alloc_init(&sn_env->alloc, NULL, 0);
	env->modinfo[id] = (void*)sn_env;
	/* Copy msg_cache settings */
	sn_env->subnet_msg_cache = slabhash_create(env->cfg->msg_cache_slabs,
	HASH_DEFAULT_STARTARRAY, env->cfg->msg_cache_size,
	msg_cache_sizefunc, query_info_compare, query_entry_delete,
	subnet_data_delete, NULL);
	+ slabhash_setmarkdel(sn_env->subnet_msg_cache, &subnet_markdel);
	if(!sn_env->subnet_msg_cache) {
	log_err("subnet: could not create cache");
	free(sn_env);
	env->modinfo[id] = NULL;
	return 0;
	}
	/* whitelist for edns subnet capable servers */
	sn_env->whitelist = ecs_whitelist_create();
	if(!sn_env->whitelist \|\|
	!ecs_whitelist_apply_cfg(sn_env->whitelist, env->cfg)) {
	log_err("subnet: could not create ECS whitelist");
	slabhash_delete(sn_env->subnet_msg_cache);
	free(sn_env);
	env->modinfo[id] = NULL;
	return 0;
	}

	verbose(VERB_QUERY, "subnet: option registered (%d)",
	env->cfg->client_subnet_opcode);
	/* Create new mesh state for all queries. */
	env->unique_mesh = 1;
	if(!edns_register_option(env->cfg->client_subnet_opcode,
	env->cfg->client_subnet_always_forward /* bypass cache */,
	0 /* no aggregation */, env)) {
	log_err("subnet: could not register opcode");
	ecs_whitelist_delete(sn_env->whitelist);
	slabhash_delete(sn_env->subnet_msg_cache);
	free(sn_env);
	env->modinfo[id] = NULL;
	return 0;
	}
	inplace_cb_register((void*)ecs_whitelist_check, inplace_cb_query, NULL,
	env, id);
	inplace_cb_register((void*)ecs_edns_back_parsed,
	inplace_cb_edns_back_parsed, NULL, env, id);
	inplace_cb_register((void*)ecs_query_response,
	inplace_cb_query_response, NULL, env, id);
	lock_rw_init(&sn_env->biglock);
	return 1;
	}

	void
	subnetmod_deinit(struct module_env *env, int id)
	{
	struct subnet_env *sn_env;
	if(!env \|\| !env->modinfo[id])
	return;
	sn_env = (struct subnet_env*)env->modinfo[id];
	lock_rw_destroy(&sn_env->biglock);
	inplace_cb_delete(env, inplace_cb_edns_back_parsed, id);
	inplace_cb_delete(env, inplace_cb_query, id);
	inplace_cb_delete(env, inplace_cb_query_response, id);
	ecs_whitelist_delete(sn_env->whitelist);
	slabhash_delete(sn_env->subnet_msg_cache);
	alloc_clear(&sn_env->alloc);
	free(sn_env);
	env->modinfo[id] = NULL;
	}

	/** Tells client that upstream has no/improper support */
	static void
	cp_edns_bad_response(struct ecs_data target, struct ecs_data source)
	{
	target->subnet_scope_mask = 0;
	target->subnet_source_mask = source->subnet_source_mask;
	target->subnet_addr_fam = source->subnet_addr_fam;
	memcpy(target->subnet_addr, source->subnet_addr, INET6_SIZE);
	target->subnet_validdata = 1;
	}

	static void
	delfunc(void envptr, void elemptr) {
	struct reply_info elem = (struct reply_info )elemptr;
	struct subnet_env env = (struct subnet_env )envptr;
	reply_info_parsedelete(elem, &env->alloc);
	}

	static size_t
	sizefunc(void *elemptr) {
	struct reply_info elem = (struct reply_info )elemptr;
	return sizeof (struct reply_info) - sizeof (struct rrset_ref)
	+ elem->rrset_count * sizeof (struct rrset_ref)
	+ elem->rrset_count * sizeof (struct ub_packed_rrset_key *);
	}

	/**
	* Select tree from cache entry based on edns data.
	* If for address family not present it will create a new one.
	* NULL on failure to create. */
	static struct addrtree*
	get_tree(struct subnet_msg_cache_data data, struct ecs_data edns,
	struct subnet_env env, struct config_file cfg)
	{
	struct addrtree *tree;
	if (edns->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4) {
	if (!data->tree4)
	data->tree4 = addrtree_create(
	cfg->max_client_subnet_ipv4, &delfunc,
	- &sizefunc, env, ECS_MAX_TREESIZE);
	+ &sizefunc, env, cfg->max_ecs_tree_size_ipv4);
	tree = data->tree4;
	} else {
	if (!data->tree6)
	data->tree6 = addrtree_create(
	cfg->max_client_subnet_ipv6, &delfunc,
	- &sizefunc, env, ECS_MAX_TREESIZE);
	+ &sizefunc, env, cfg->max_ecs_tree_size_ipv6);
	tree = data->tree6;
	}
	return tree;
	}

	static void
	update_cache(struct module_qstate *qstate, int id)
	{
	struct msgreply_entry *mrep_entry;
	struct addrtree *tree;
	struct reply_info *rep;
	struct query_info qinf;
	struct subnet_env *sne = qstate->env->modinfo[id];
	struct subnet_qstate sq = (struct subnet_qstate)qstate->minfo[id];
	struct slabhash *subnet_msg_cache = sne->subnet_msg_cache;
	struct ecs_data *edns = &sq->ecs_client_in;
	size_t i;

	/* We already calculated hash upon lookup */
	hashvalue_type h = qstate->minfo[id] ?
	((struct subnet_qstate*)qstate->minfo[id])->qinfo_hash :
	query_info_hash(&qstate->qinfo, qstate->query_flags);
	/* Step 1, general qinfo lookup */
	struct lruhash_entry *lru_entry = slabhash_lookup(subnet_msg_cache, h,
	&qstate->qinfo, 1);
	- int acquired_lock = (lru_entry != NULL);
	+ int need_to_insert = (lru_entry == NULL);
	if (!lru_entry) {
	+ void* data = calloc(1,
	+ sizeof(struct subnet_msg_cache_data));
	+ if(!data) {
	+ log_err("malloc failed");
	+ return;
	+ }
	qinf = qstate->qinfo;
	qinf.qname = memdup(qstate->qinfo.qname,
	qstate->qinfo.qname_len);
	if(!qinf.qname) {
	+ free(data);
	log_err("memdup failed");
	return;
	}
	- mrep_entry = query_info_entrysetup(&qinf, NULL, h);
	+ mrep_entry = query_info_entrysetup(&qinf, data, h);
	free(qinf.qname); /* if qname 'consumed', it is set to NULL */
	if (!mrep_entry) {
	+ free(data);
	log_err("query_info_entrysetup failed");
	return;
	}
	lru_entry = &mrep_entry->entry;
	lock_rw_wrlock(&lru_entry->lock);
	- lru_entry->data = calloc(1,
	- sizeof(struct subnet_msg_cache_data));
	- if (!lru_entry->data) {
	- log_err("malloc failed");
	- return;
	- }
	}
	+ /* lru_entry->lock is locked regardless of how we got here,
	+ * either from the slabhash_lookup, or above in the new allocated */
	/* Step 2, find the correct tree */
	if (!(tree = get_tree(lru_entry->data, edns, sne, qstate->env->cfg))) {
	- if (acquired_lock) lock_rw_unlock(&lru_entry->lock);
	+ lock_rw_unlock(&lru_entry->lock);
	log_err("Subnet cache insertion failed");
	return;
	}
	lock_quick_lock(&sne->alloc.lock);
	rep = reply_info_copy(qstate->return_msg->rep, &sne->alloc, NULL);
	lock_quick_unlock(&sne->alloc.lock);
	if (!rep) {
	- if (acquired_lock) lock_rw_unlock(&lru_entry->lock);
	+ lock_rw_unlock(&lru_entry->lock);
	log_err("Subnet cache insertion failed");
	return;
	}

	/* store RRsets */
	for(i=0; i<rep->rrset_count; i++) {
	rep->ref[i].key = rep->rrsets[i];
	rep->ref[i].id = rep->rrsets[i]->id;
	}
	reply_info_set_ttls(rep, *qstate->env->now);
	rep->flags \|= (BIT_RA \| BIT_QR); /* fix flags to be sensible for */
	rep->flags &= ~(BIT_AA \| BIT_CD);/* a reply based on the cache */
	addrtree_insert(tree, (addrkey_t*)edns->subnet_addr,
	edns->subnet_source_mask,
	sq->ecs_server_in.subnet_scope_mask, rep,
	rep->ttl, *qstate->env->now);
	- if (acquired_lock) {
	- lock_rw_unlock(&lru_entry->lock);
	- } else {
	- lock_rw_unlock(&lru_entry->lock);
	+
	+ lock_rw_unlock(&lru_entry->lock);
	+ if (need_to_insert) {
	slabhash_insert(subnet_msg_cache, h, lru_entry, lru_entry->data,
	NULL);
	}
	}

	/** Lookup in cache and reply true iff reply is sent. */
	static int
	lookup_and_reply(struct module_qstate qstate, int id, struct subnet_qstate sq)
	{
	struct lruhash_entry *e;
	struct module_env *env = qstate->env;
	struct subnet_env sne = (struct subnet_env)env->modinfo[id];
	hashvalue_type h = query_info_hash(&qstate->qinfo, qstate->query_flags);
	struct subnet_msg_cache_data *data;
	struct ecs_data *ecs = &sq->ecs_client_in;
	struct addrtree *tree;
	struct addrnode *node;
	uint8_t scope;

	memset(&sq->ecs_client_out, 0, sizeof(sq->ecs_client_out));

	if (sq) sq->qinfo_hash = h; /* Might be useful on cache miss */
	e = slabhash_lookup(sne->subnet_msg_cache, h, &qstate->qinfo, 1);
	if (!e) return 0; /* qinfo not in cache */
	data = e->data;
	tree = (ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4)?
	data->tree4 : data->tree6;
	if (!tree) { /* qinfo in cache but not for this family */
	lock_rw_unlock(&e->lock);
	return 0;
	}
	node = addrtree_find(tree, (addrkey_t*)ecs->subnet_addr,
	ecs->subnet_source_mask, *env->now);
	if (!node) { /* plain old cache miss */
	lock_rw_unlock(&e->lock);
	return 0;
	}

	qstate->return_msg = tomsg(NULL, &qstate->qinfo,
	(struct reply_info )node->elem, qstate->region, env->now,
	env->scratch);
	scope = (uint8_t)node->scope;
	lock_rw_unlock(&e->lock);

	if (!qstate->return_msg) { /* Failed allocation or expired TTL */
	return 0;
	}

	if (sq->subnet_downstream) { /* relay to interested client */
	sq->ecs_client_out.subnet_scope_mask = scope;
	sq->ecs_client_out.subnet_addr_fam = ecs->subnet_addr_fam;
	sq->ecs_client_out.subnet_source_mask = ecs->subnet_source_mask;
	memcpy(&sq->ecs_client_out.subnet_addr, &ecs->subnet_addr,
	INET6_SIZE);
	sq->ecs_client_out.subnet_validdata = 1;
	}
	return 1;
	}

	/**
	* Test first bits of addresses for equality. Caller is responsible
	* for making sure that both a and b are at least net/8 octets long.
	* @param a: first address.
	* @param a: seconds address.
	* @param net: Number of bits to test.
	* @return: 1 if equal, 0 otherwise.
	*/
	static int
	common_prefix(uint8_t a, uint8_t b, uint8_t net)
	{
	size_t n = (size_t)net / 8;
	return !memcmp(a, b, n) && ((net % 8) == 0 \|\| a[n] == b[n]);
	}

	static enum module_ext_state
	eval_response(struct module_qstate qstate, int id, struct subnet_qstate sq)
	{
	struct subnet_env *sne = qstate->env->modinfo[id];

	struct ecs_data c_in = &sq->ecs_client_in; / rcvd from client */
	struct ecs_data c_out = &sq->ecs_client_out;/ will send to client */
	struct ecs_data s_in = &sq->ecs_server_in; / rcvd from auth */
	struct ecs_data s_out = &sq->ecs_server_out;/ sent to auth */

	memset(c_out, 0, sizeof(*c_out));

	if (!qstate->return_msg) {
	/* already an answer and its not a message, but retain
	* the actual rcode, instead of module_error, so send
	* module_finished */
	return module_finished;
	}

	/* We have not asked for subnet data */
	if (!sq->subnet_sent) {
	if (s_in->subnet_validdata)
	verbose(VERB_QUERY, "subnet: received spurious data");
	if (sq->subnet_downstream) /* Copy back to client */
	cp_edns_bad_response(c_out, c_in);
	return module_finished;
	}

	/* subnet sent but nothing came back */
	if (!s_in->subnet_validdata) {
	/* The authority indicated no support for edns subnet. As a
	* consequence the answer ended up in the regular cache. It
	* is still usefull to put it in the edns subnet cache for
	* when a client explicitly asks for subnet specific answer. */
	verbose(VERB_QUERY, "subnet: Authority indicates no support");
	- lock_rw_wrlock(&sne->biglock);
	- update_cache(qstate, id);
	- lock_rw_unlock(&sne->biglock);
	+ if(!sq->started_no_cache_store) {
	+ lock_rw_wrlock(&sne->biglock);
	+ update_cache(qstate, id);
	+ lock_rw_unlock(&sne->biglock);
	+ }
	if (sq->subnet_downstream)
	cp_edns_bad_response(c_out, c_in);
	return module_finished;
	}

	/* Being here means we have asked for and got a subnet specific
	* answer. Also, the answer from the authority is not yet cached
	* anywhere. */

	/* can we accept response? */
	if(s_out->subnet_addr_fam != s_in->subnet_addr_fam \|\|
	s_out->subnet_source_mask != s_in->subnet_source_mask \|\|
	!common_prefix(s_out->subnet_addr, s_in->subnet_addr,
	s_out->subnet_source_mask))
	{
	/* we can not accept, restart query without option */
	verbose(VERB_QUERY, "subnet: forged data");
	s_out->subnet_validdata = 0;
	(void)edns_opt_list_remove(&qstate->edns_opts_back_out,
	qstate->env->cfg->client_subnet_opcode);
	sq->subnet_sent = 0;
	return module_restart_next;
	}

	lock_rw_wrlock(&sne->biglock);
	- update_cache(qstate, id);
	+ if(!sq->started_no_cache_store) {
	+ update_cache(qstate, id);
	+ }
	sne->num_msg_nocache++;
	lock_rw_unlock(&sne->biglock);

	if (sq->subnet_downstream) {
	/* Client wants to see the answer, echo option back
	* and adjust the scope. */
	c_out->subnet_addr_fam = c_in->subnet_addr_fam;
	c_out->subnet_source_mask = c_in->subnet_source_mask;
	memcpy(&c_out->subnet_addr, &c_in->subnet_addr, INET6_SIZE);
	c_out->subnet_scope_mask = s_in->subnet_scope_mask;
	+ /* Limit scope returned to client to scope used for caching. */
	+ if(c_out->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4) {
	+ if(c_out->subnet_scope_mask >
	+ qstate->env->cfg->max_client_subnet_ipv4) {
	+ c_out->subnet_scope_mask =
	+ qstate->env->cfg->max_client_subnet_ipv4;
	+ }
	+ }
	+ else if(c_out->subnet_scope_mask >
	+ qstate->env->cfg->max_client_subnet_ipv6) {
	+ c_out->subnet_scope_mask =
	+ qstate->env->cfg->max_client_subnet_ipv6;
	+ }
	c_out->subnet_validdata = 1;
	}
	return module_finished;
	}

	/** Parse EDNS opt data containing ECS */
	static int
	parse_subnet_option(struct edns_option* ecs_option, struct ecs_data* ecs)
	{
	memset(ecs, 0, sizeof(*ecs));
	if (ecs_option->opt_len < 4)
	return 0;

	ecs->subnet_addr_fam = sldns_read_uint16(ecs_option->opt_data);
	ecs->subnet_source_mask = ecs_option->opt_data[2];
	ecs->subnet_scope_mask = ecs_option->opt_data[3];
	/* remaining bytes indicate address */

	/* validate input*/
	/* option length matches calculated length? */
	if (ecs_option->opt_len != (size_t)((ecs->subnet_source_mask+7)/8 + 4))
	return 0;
	if (ecs_option->opt_len - 4 > INET6_SIZE \|\| ecs_option->opt_len == 0)
	return 0;
	if (ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4) {
	if (ecs->subnet_source_mask > 32 \|\| ecs->subnet_scope_mask > 32)
	return 0;
	} else if (ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP6) {
	if (ecs->subnet_source_mask > 128 \|\|
	ecs->subnet_scope_mask > 128)
	return 0;
	} else
	return 0;

	/* valid ECS data, write to ecs_data */
	if (copy_clear(ecs->subnet_addr, INET6_SIZE, ecs_option->opt_data + 4,
	ecs_option->opt_len - 4, ecs->subnet_source_mask))
	return 0;
	ecs->subnet_validdata = 1;
	return 1;
	}

	static void
	subnet_option_from_ss(struct sockaddr_storage ss, struct ecs_data ecs,
	struct config_file* cfg)
	{
	void* sinaddr;

	/* Construct subnet option from original query */
	if(((struct sockaddr_in*)ss)->sin_family == AF_INET) {
	ecs->subnet_source_mask = cfg->max_client_subnet_ipv4;
	ecs->subnet_addr_fam = EDNSSUBNET_ADDRFAM_IP4;
	sinaddr = &((struct sockaddr_in*)ss)->sin_addr;
	if (!copy_clear( ecs->subnet_addr, INET6_SIZE,
	(uint8_t *)sinaddr, INET_SIZE,
	ecs->subnet_source_mask)) {
	ecs->subnet_validdata = 1;
	}
	}
	#ifdef INET6
	else {
	ecs->subnet_source_mask = cfg->max_client_subnet_ipv6;
	ecs->subnet_addr_fam = EDNSSUBNET_ADDRFAM_IP6;
	sinaddr = &((struct sockaddr_in6*)ss)->sin6_addr;
	if (!copy_clear( ecs->subnet_addr, INET6_SIZE,
	(uint8_t *)sinaddr, INET6_SIZE,
	ecs->subnet_source_mask)) {
	ecs->subnet_validdata = 1;
	}
	}
	#else
	/* We don't know how to handle ip6, just pass */
	#endif /* INET6 */
	}

	int
	ecs_query_response(struct module_qstate* qstate, struct dns_msg* response,
	int id, void* ATTR_UNUSED(cbargs))
	{
	struct subnet_qstate *sq;

	if(!response \|\| !(sq=(struct subnet_qstate*)qstate->minfo[id]))
	return 1;

	if(sq->subnet_sent &&
	FLAGS_GET_RCODE(response->rep->flags) == LDNS_RCODE_REFUSED) {
	/* REFUSED response to ECS query, remove ECS option. */
	edns_opt_list_remove(&qstate->edns_opts_back_out,
	qstate->env->cfg->client_subnet_opcode);
	sq->subnet_sent = 0;
	memset(&sq->ecs_server_out, 0, sizeof(sq->ecs_server_out));
	}
	return 1;
	}

	int
	ecs_edns_back_parsed(struct module_qstate* qstate, int id,
	void* ATTR_UNUSED(cbargs))
	{
	struct subnet_qstate *sq;
	struct edns_option* ecs_opt;

	if(!(sq=(struct subnet_qstate*)qstate->minfo[id]))
	return 1;
	if((ecs_opt = edns_opt_list_find(
	qstate->edns_opts_back_in,
	qstate->env->cfg->client_subnet_opcode))) {
	if(parse_subnet_option(ecs_opt, &sq->ecs_server_in) &&
	sq->subnet_sent &&
	sq->ecs_server_in.subnet_validdata)
	/* Only skip global cache store if we sent an ECS option
	* and received one back. Answers from non-whitelisted
	* servers will end up in global cache. Answers for
	* queries with 0 source will not (unless nameserver
	* does not support ECS). */
	qstate->no_cache_store = 1;
	}

	return 1;
	}

	void
	subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
	int id, struct outbound_entry* outbound)
	{
	struct subnet_env *sne = qstate->env->modinfo[id];
	struct subnet_qstate sq = (struct subnet_qstate)qstate->minfo[id];

	verbose(VERB_QUERY, "subnet[module %d] operate: extstate:%s "
	"event:%s", id, strextstate(qstate->ext_state[id]),
	strmodulevent(event));
	log_query_info(VERB_QUERY, "subnet operate: query", &qstate->qinfo);

	if((event == module_event_new \|\| event == module_event_pass) &&
	sq == NULL) {
	struct edns_option* ecs_opt;
	if(!subnet_new_qstate(qstate, id)) {
	qstate->return_msg = NULL;
	qstate->ext_state[id] = module_finished;
	return;
	}

	sq = (struct subnet_qstate*)qstate->minfo[id];

	if((ecs_opt = edns_opt_list_find(
	qstate->edns_opts_front_in,
	qstate->env->cfg->client_subnet_opcode))) {
	if(!parse_subnet_option(ecs_opt, &sq->ecs_client_in)) {
	/* Wrongly formatted ECS option. RFC mandates to
	* return FORMERROR. */
	qstate->return_rcode = LDNS_RCODE_FORMERR;
	qstate->ext_state[id] = module_finished;
	return;
	}
	sq->subnet_downstream = 1;
	}
	else if(qstate->mesh_info->reply_list) {
	subnet_option_from_ss(
	&qstate->mesh_info->reply_list->query_reply.addr,
	&sq->ecs_client_in, qstate->env->cfg);
	}

	if(sq->ecs_client_in.subnet_validdata == 0) {
	/* No clients are interested in result or we could not
	* parse it, we don't do client subnet */
	sq->ecs_server_out.subnet_validdata = 0;
	verbose(VERB_ALGO, "subnet: pass to next module");
	qstate->ext_state[id] = module_wait_module;
	return;
	}

	+ /* Limit to minimum allowed source mask */
	+ if(sq->ecs_client_in.subnet_source_mask != 0 && (
	+ (sq->ecs_client_in.subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4 &&
	+ sq->ecs_client_in.subnet_source_mask < qstate->env->cfg->min_client_subnet_ipv4) \|\|
	+ (sq->ecs_client_in.subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP6 &&
	+ sq->ecs_client_in.subnet_source_mask < qstate->env->cfg->min_client_subnet_ipv6))) {
	+ qstate->return_rcode = LDNS_RCODE_REFUSED;
	+ qstate->ext_state[id] = module_finished;
	+ return;
	+ }
	+
	lock_rw_wrlock(&sne->biglock);
	if (lookup_and_reply(qstate, id, sq)) {
	sne->num_msg_cache++;
	lock_rw_unlock(&sne->biglock);
	verbose(VERB_QUERY, "subnet: answered from cache");
	qstate->ext_state[id] = module_finished;

	ecs_opt_list_append(&sq->ecs_client_out,
	&qstate->edns_opts_front_out, qstate);
	return;
	}
	lock_rw_unlock(&sne->biglock);

	sq->ecs_server_out.subnet_addr_fam =
	sq->ecs_client_in.subnet_addr_fam;
	sq->ecs_server_out.subnet_source_mask =
	sq->ecs_client_in.subnet_source_mask;
	/* Limit source prefix to configured maximum */
	if(sq->ecs_server_out.subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4
	&& sq->ecs_server_out.subnet_source_mask >
	qstate->env->cfg->max_client_subnet_ipv4)
	sq->ecs_server_out.subnet_source_mask =
	qstate->env->cfg->max_client_subnet_ipv4;
	else if(sq->ecs_server_out.subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP6
	&& sq->ecs_server_out.subnet_source_mask >
	qstate->env->cfg->max_client_subnet_ipv6)
	sq->ecs_server_out.subnet_source_mask =
	qstate->env->cfg->max_client_subnet_ipv6;
	/* Safe to copy completely, even if the source is limited by the
	* configuration. ecs_opt_list_append() will limit the address.
	* */
	memcpy(&sq->ecs_server_out.subnet_addr,
	sq->ecs_client_in.subnet_addr, INET6_SIZE);
	sq->ecs_server_out.subnet_scope_mask = 0;
	sq->ecs_server_out.subnet_validdata = 1;
	if(sq->ecs_server_out.subnet_source_mask != 0 &&
	qstate->env->cfg->client_subnet_always_forward &&
	sq->subnet_downstream)
	/* ECS specific data required, do not look at the global
	* cache in other modules. */
	qstate->no_cache_lookup = 1;

	/* pass request to next module */
	verbose(VERB_ALGO,
	"subnet: not found in cache. pass to next module");
	qstate->ext_state[id] = module_wait_module;
	return;
	}
	/* Query handed back by next module, we have a 'final' answer */
	if(sq && event == module_event_moddone) {
	qstate->ext_state[id] = eval_response(qstate, id, sq);
	if(qstate->ext_state[id] == module_finished &&
	qstate->return_msg) {
	ecs_opt_list_append(&sq->ecs_client_out,
	&qstate->edns_opts_front_out, qstate);
	}
	+ qstate->no_cache_store = sq->started_no_cache_store;
	return;
	}
	if(sq && outbound) {
	return;
	}
	/* We are being revisited */
	if(event == module_event_pass \|\| event == module_event_new) {
	/* Just pass it on, we already did the work */
	verbose(VERB_ALGO, "subnet: pass to next module");
	qstate->ext_state[id] = module_wait_module;
	return;
	}
	if(!sq && (event == module_event_moddone)) {
	/* during priming, module done but we never started */
	qstate->ext_state[id] = module_finished;
	return;
	}
	log_err("subnet: bad event %s", strmodulevent(event));
	qstate->ext_state[id] = module_error;
	return;
	}

	void
	subnetmod_clear(struct module_qstate *ATTR_UNUSED(qstate),
	int ATTR_UNUSED(id))
	{
	/* qstate has no data outside region */
	}

	void
	subnetmod_inform_super(struct module_qstate *ATTR_UNUSED(qstate),
	int ATTR_UNUSED(id), struct module_qstate *ATTR_UNUSED(super))
	{
	/* Not used */
	}

	size_t
	subnetmod_get_mem(struct module_env *env, int id)
	{
	struct subnet_env *sn_env = env->modinfo[id];
	if (!sn_env) return 0;
	return sizeof(*sn_env) +
	slabhash_get_mem(sn_env->subnet_msg_cache) +
	ecs_whitelist_get_mem(sn_env->whitelist);
	}

	/**
	* The module function block
	*/
	static struct module_func_block subnetmod_block = {
	"subnet", &subnetmod_init, &subnetmod_deinit, &subnetmod_operate,
	&subnetmod_inform_super, &subnetmod_clear, &subnetmod_get_mem
	};

	struct module_func_block*
	subnetmod_get_funcblock(void)
	{
	return &subnetmod_block;
	}

	/** Wrappers for static functions to unit test */
	size_t
	unittest_wrapper_subnetmod_sizefunc(void *elemptr)
	{
	return sizefunc(elemptr);
	}

	#endif /* CLIENT_SUBNET */
	Index: head/contrib/unbound/edns-subnet/subnetmod.h
	===================================================================
	--- head/contrib/unbound/edns-subnet/subnetmod.h (revision 349719)
	+++ head/contrib/unbound/edns-subnet/subnetmod.h (revision 349720)
	@@ -1,134 +1,139 @@
	/*
	* edns-subnet/subnetmod.h - edns subnet module. Must be called before validator
	* and iterator.
	*
	* Copyright (c) 2013, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/
	/**
	* \file
	* subnet module for unbound.
	*/

	#ifndef SUBNETMOD_H
	#define SUBNETMOD_H
	#include "util/module.h"
	#include "services/outbound_list.h"
	#include "util/alloc.h"
	#include "util/net_help.h"
	#include "util/storage/slabhash.h"
	#include "edns-subnet/addrtree.h"
	#include "edns-subnet/edns-subnet.h"

	/**
	* Global state for the subnet module.
	*/
	struct subnet_env {
	/** shared message cache
	* key: struct query_info*
	* data: struct subnet_msg_cache_data* */
	struct slabhash* subnet_msg_cache;
	/** access control, which upstream servers we send client address */
	struct ecs_whitelist* whitelist;
	/** allocation service */
	struct alloc_cache alloc;
	lock_rw_type biglock;
	/** number of messages from cache */
	size_t num_msg_cache;
	/** number of messages not from cache */
	size_t num_msg_nocache;
	};

	struct subnet_msg_cache_data {
	struct addrtree* tree4;
	struct addrtree* tree6;
	};

	struct subnet_qstate {
	/** We need the hash for both cache lookup and insert */
	hashvalue_type qinfo_hash;
	/** ecs_data for client communication */
	struct ecs_data ecs_client_in;
	struct ecs_data ecs_client_out;
	/** ecss data for server communication */
	struct ecs_data ecs_server_in;
	struct ecs_data ecs_server_out;
	int subnet_downstream;
	int subnet_sent;
	+ /** has the subnet module been started with no_cache_store? */
	+ int started_no_cache_store;
	};

	void subnet_data_delete(void* d, void* ATTR_UNUSED(arg));
	size_t msg_cache_sizefunc(void* k, void* d);

	/**
	* Get the module function block.
	* @return: function block with function pointers to module methods.
	*/
	struct module_func_block* subnetmod_get_funcblock(void);

	/** subnet module init */
	int subnetmod_init(struct module_env* env, int id);

	/** subnet module deinit */
	void subnetmod_deinit(struct module_env* env, int id);

	/** subnet module operate on a query */
	void subnetmod_operate(struct module_qstate* qstate, enum module_ev event,
	int id, struct outbound_entry* outbound);

	/** subnet module */
	void subnetmod_inform_super(struct module_qstate* qstate, int id,
	struct module_qstate* super);

	/** subnet module cleanup query state */
	void subnetmod_clear(struct module_qstate* qstate, int id);

	/** subnet module alloc size routine */
	size_t subnetmod_get_mem(struct module_env* env, int id);

	/** Wrappers for static functions to unit test */
	size_t unittest_wrapper_subnetmod_sizefunc(void *elemptr);

	/** Whitelist check, called just before query is sent upstream. */
	int ecs_whitelist_check(struct query_info* qinfo, uint16_t flags,
	struct module_qstate* qstate, struct sockaddr_storage* addr,
	socklen_t addrlen, uint8_t* zone, size_t zonelen,
	struct regional* region, int id, void* cbargs);

	/** Check whether response from server contains ECS record, if so, skip cache
	* store. Called just after parsing EDNS data from server. */
	int ecs_edns_back_parsed(struct module_qstate* qstate, int id, void* cbargs);

	/** Remove ECS record from back_out when query resulted in REFUSED response. */
	int ecs_query_response(struct module_qstate* qstate, struct dns_msg* response,
	int id, void* cbargs);
	+
	+/** mark subnet msg to be deleted */
	+void subnet_markdel(void* key);

	#endif /* SUBNETMOD_H */
	Index: head/contrib/unbound/install-sh
	===================================================================
	--- head/contrib/unbound/install-sh (revision 349719)
	+++ head/contrib/unbound/install-sh (revision 349720)
	@@ -1,501 +1,501 @@
	-#!/bin/sh
	+#!/usr/bin/sh
	# install - install a program, script, or datafile

	scriptversion=2013-12-25.23; # UTC

	# This originates from X11R5 (mit/util/scripts/install.sh), which was
	# later released in X11R6 (xc/config/util/install.sh) with the
	# following copyright and license.
	#
	# Copyright (C) 1994 X Consortium
	#
	# Permission is hereby granted, free of charge, to any person obtaining a copy
	# of this software and associated documentation files (the "Software"), to
	# deal in the Software without restriction, including without limitation the
	# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
	# sell copies of the Software, and to permit persons to whom the Software is
	# furnished to do so, subject to the following conditions:
	#
	# The above copyright notice and this permission notice shall be included in
	# all copies or substantial portions of the Software.
	#
	# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
	# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
	# X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
	# AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNEC-
	# TION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
	#
	# Except as contained in this notice, the name of the X Consortium shall not
	# be used in advertising or otherwise to promote the sale, use or other deal-
	# ings in this Software without prior written authorization from the X Consor-
	# tium.
	#
	#
	# FSF changes to this file are in the public domain.
	#
	# Calling this script install-sh is preferred over install.sh, to prevent
	# 'make' implicit rules from creating a file called install from it
	# when there is no Makefile.
	#
	# This script is compatible with the BSD install script, but was written
	# from scratch.

	tab=' '
	nl='
	'
	IFS=" $tab$nl"

	# Set DOITPROG to "echo" to test this script.

	doit=${DOITPROG-}
	doit_exec=${doit:-exec}

	# Put in absolute file names if you don't have them in your path;
	# or use environment vars.

	chgrpprog=${CHGRPPROG-chgrp}
	chmodprog=${CHMODPROG-chmod}
	chownprog=${CHOWNPROG-chown}
	cmpprog=${CMPPROG-cmp}
	cpprog=${CPPROG-cp}
	mkdirprog=${MKDIRPROG-mkdir}
	mvprog=${MVPROG-mv}
	rmprog=${RMPROG-rm}
	stripprog=${STRIPPROG-strip}

	posix_mkdir=

	# Desired mode of installed file.
	mode=0755

	chgrpcmd=
	chmodcmd=$chmodprog
	chowncmd=
	mvcmd=$mvprog
	rmcmd="$rmprog -f"
	stripcmd=

	src=
	dst=
	dir_arg=
	dst_arg=

	copy_on_change=false
	is_target_a_directory=possibly

	usage="\
	Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE
	or: $0 [OPTION]... SRCFILES... DIRECTORY
	or: $0 [OPTION]... -t DIRECTORY SRCFILES...
	or: $0 [OPTION]... -d DIRECTORIES...

	In the 1st form, copy SRCFILE to DSTFILE.
	In the 2nd and 3rd, copy all SRCFILES to DIRECTORY.
	In the 4th, create DIRECTORIES.

	Options:
	--help display this help and exit.
	--version display version info and exit.

	-c (ignored)
	-C install only if different (preserve the last data modification time)
	-d create directories instead of installing files.
	-g GROUP $chgrpprog installed files to GROUP.
	-m MODE $chmodprog installed files to MODE.
	-o USER $chownprog installed files to USER.
	-s $stripprog installed files.
	-t DIRECTORY install into DIRECTORY.
	-T report an error if DSTFILE is a directory.

	Environment variables override the default commands:
	CHGRPPROG CHMODPROG CHOWNPROG CMPPROG CPPROG MKDIRPROG MVPROG
	RMPROG STRIPPROG
	"

	while test $# -ne 0; do
	case $1 in
	-c) ;;

	-C) copy_on_change=true;;

	-d) dir_arg=true;;

	-g) chgrpcmd="$chgrpprog $2"
	shift;;

	--help) echo "$usage"; exit $?;;

	-m) mode=$2
	case $mode in
	' ' \| "$tab" \| "$nl" \| ''* \| '?' \| '[')
	echo "$0: invalid mode: $mode" >&2
	exit 1;;
	esac
	shift;;

	-o) chowncmd="$chownprog $2"
	shift;;

	-s) stripcmd=$stripprog;;

	-t)
	is_target_a_directory=always
	dst_arg=$2
	# Protect names problematic for 'test' and other utilities.
	case $dst_arg in
	-* \| [=!]) dst_arg=./$dst_arg;;
	esac
	shift;;

	-T) is_target_a_directory=never;;

	--version) echo "$0 $scriptversion"; exit $?;;

	--) shift
	break;;

	-*) echo "$0: invalid option: $1" >&2
	exit 1;;

	*) break;;
	esac
	shift
	done

	# We allow the use of options -d and -T together, by making -d
	# take the precedence; this is for compatibility with GNU install.

	if test -n "$dir_arg"; then
	if test -n "$dst_arg"; then
	echo "$0: target directory not allowed when installing a directory." >&2
	exit 1
	fi
	fi

	if test $# -ne 0 && test -z "$dir_arg$dst_arg"; then
	# When -d is used, all remaining arguments are directories to create.
	# When -t is used, the destination is already specified.
	# Otherwise, the last argument is the destination. Remove it from $@.
	for arg
	do
	if test -n "$dst_arg"; then
	# $@ is not empty: it contains at least $arg.
	set fnord "$@" "$dst_arg"
	shift # fnord
	fi
	shift # arg
	dst_arg=$arg
	# Protect names problematic for 'test' and other utilities.
	case $dst_arg in
	-* \| [=!]) dst_arg=./$dst_arg;;
	esac
	done
	fi

	if test $# -eq 0; then
	if test -z "$dir_arg"; then
	echo "$0: no input file specified." >&2
	exit 1
	fi
	# It's OK to call 'install-sh -d' without argument.
	# This can happen when creating conditional directories.
	exit 0
	fi

	if test -z "$dir_arg"; then
	if test $# -gt 1 \|\| test "$is_target_a_directory" = always; then
	if test ! -d "$dst_arg"; then
	echo "$0: $dst_arg: Is not a directory." >&2
	exit 1
	fi
	fi
	fi

	if test -z "$dir_arg"; then
	do_exit='(exit $ret); exit $ret'
	trap "ret=129; $do_exit" 1
	trap "ret=130; $do_exit" 2
	trap "ret=141; $do_exit" 13
	trap "ret=143; $do_exit" 15

	# Set umask so as not to create temps with too-generous modes.
	# However, 'strip' requires both read and write access to temps.
	case $mode in
	# Optimize common cases.
	*644) cp_umask=133;;
	*755) cp_umask=22;;

	*[0-7])
	if test -z "$stripcmd"; then
	u_plus_rw=
	else
	u_plus_rw='% 200'
	fi
	cp_umask=`expr '(' 777 - $mode % 1000 ')' $u_plus_rw`;;
	*)
	if test -z "$stripcmd"; then
	u_plus_rw=
	else
	u_plus_rw=,u+rw
	fi
	cp_umask=$mode$u_plus_rw;;
	esac
	fi

	for src
	do
	# Protect names problematic for 'test' and other utilities.
	case $src in
	-* \| [=!]) src=./$src;;
	esac

	if test -n "$dir_arg"; then
	dst=$src
	dstdir=$dst
	test -d "$dstdir"
	dstdir_status=$?
	else

	# Waiting for this to be detected by the "$cpprog $src $dsttmp" command
	# might cause directories to be created, which would be especially bad
	# if $src (and thus $dsttmp) contains '*'.
	if test ! -f "$src" && test ! -d "$src"; then
	echo "$0: $src does not exist." >&2
	exit 1
	fi

	if test -z "$dst_arg"; then
	echo "$0: no destination specified." >&2
	exit 1
	fi
	dst=$dst_arg

	# If destination is a directory, append the input filename; won't work
	# if double slashes aren't ignored.
	if test -d "$dst"; then
	if test "$is_target_a_directory" = never; then
	echo "$0: $dst_arg: Is a directory" >&2
	exit 1
	fi
	dstdir=$dst
	dst=$dstdir/`basename "$src"`
	dstdir_status=0
	else
	dstdir=`dirname "$dst"`
	test -d "$dstdir"
	dstdir_status=$?
	fi
	fi

	obsolete_mkdir_used=false

	if test $dstdir_status != 0; then
	case $posix_mkdir in
	'')
	# Create intermediate dirs using mode 755 as modified by the umask.
	# This is like FreeBSD 'install' as of 1997-10-28.
	umask=`umask`
	case $stripcmd.$umask in
	# Optimize common cases.
	*[2367][2367]) mkdir_umask=$umask;;
	.*0[02][02] \| .[02][02] \| .[02]) mkdir_umask=22;;

	*[0-7])
	mkdir_umask=`expr $umask + 22 \
	- $umask % 100 % 40 + $umask % 20 \
	- $umask % 10 % 4 + $umask % 2
	`;;
	*) mkdir_umask=$umask,go-w;;
	esac

	# With -d, create the new directory with the user-specified mode.
	# Otherwise, rely on $mkdir_umask.
	if test -n "$dir_arg"; then
	mkdir_mode=-m$mode
	else
	mkdir_mode=
	fi

	posix_mkdir=false
	case $umask in
	*[123567][0-7][0-7])
	# POSIX mkdir -p sets u+wx bits regardless of umask, which
	# is incompatible with FreeBSD 'install' when (umask & 300) != 0.
	;;
	*)
	tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
	trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0

	if (umask $mkdir_umask &&
	exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
	then
	if test -z "$dir_arg" \|\| {
	# Check for POSIX incompatibilities with -m.
	# HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
	# other-writable bit of parent directory when it shouldn't.
	# FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
	ls_ld_tmpdir=`ls -ld "$tmpdir"`
	case $ls_ld_tmpdir in
	d????-?r-*) different_mode=700;;
	d????-?--*) different_mode=755;;
	*) false;;
	esac &&
	$mkdirprog -m$different_mode -p -- "$tmpdir" && {
	ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
	test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
	}
	}
	then posix_mkdir=:
	fi
	rmdir "$tmpdir/d" "$tmpdir"
	else
	# Remove any dirs left behind by ancient mkdir implementations.
	rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
	fi
	trap '' 0;;
	esac;;
	esac

	if
	$posix_mkdir && (
	umask $mkdir_umask &&
	$doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir"
	)
	then :
	else

	# The umask is ridiculous, or mkdir does not conform to POSIX,
	# or it failed possibly due to a race condition. Create the
	# directory the slow way, step by step, checking for races as we go.

	case $dstdir in
	/*) prefix='/';;
	[-=!]*) prefix='./';;
	*) prefix='';;
	esac

	oIFS=$IFS
	IFS=/
	set -f
	set fnord $dstdir
	shift
	set +f
	IFS=$oIFS

	prefixes=

	for d
	do
	test X"$d" = X && continue

	prefix=$prefix$d
	if test -d "$prefix"; then
	prefixes=
	else
	if $posix_mkdir; then
	(umask=$mkdir_umask &&
	$doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
	# Don't fail if two instances are running concurrently.
	test -d "$prefix" \|\| exit 1
	else
	case $prefix in
	\') qprefix=`echo "$prefix" \| sed "s/'/'\\\\\\\\''/g"`;;
	*) qprefix=$prefix;;
	esac
	prefixes="$prefixes '$qprefix'"
	fi
	fi
	prefix=$prefix/
	done

	if test -n "$prefixes"; then
	# Don't fail if two instances are running concurrently.
	(umask $mkdir_umask &&
	eval "\$doit_exec \$mkdirprog $prefixes") \|\|
	test -d "$dstdir" \|\| exit 1
	obsolete_mkdir_used=true
	fi
	fi
	fi

	if test -n "$dir_arg"; then
	{ test -z "$chowncmd" \|\| $doit $chowncmd "$dst"; } &&
	{ test -z "$chgrpcmd" \|\| $doit $chgrpcmd "$dst"; } &&
	{ test "$obsolete_mkdir_used$chowncmd$chgrpcmd" = false \|\|
	test -z "$chmodcmd" \|\| $doit $chmodcmd $mode "$dst"; } \|\| exit 1
	else

	# Make a couple of temp file names in the proper directory.
	dsttmp=$dstdir/_inst.$$_
	rmtmp=$dstdir/_rm.$$_

	# Trap to clean up those temp files at exit.
	trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0

	# Copy the file name to the temp name.
	(umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") &&

	# and set any options; do chmod last to preserve setuid bits.
	#
	# If any of these fail, we abort the whole thing. If we want to
	# ignore errors from any of these, just make sure not to ignore
	# errors from the above "$doit $cpprog $src $dsttmp" command.
	#
	{ test -z "$chowncmd" \|\| $doit $chowncmd "$dsttmp"; } &&
	{ test -z "$chgrpcmd" \|\| $doit $chgrpcmd "$dsttmp"; } &&
	{ test -z "$stripcmd" \|\| $doit $stripcmd "$dsttmp"; } &&
	{ test -z "$chmodcmd" \|\| $doit $chmodcmd $mode "$dsttmp"; } &&

	# If -C, don't bother to copy if it wouldn't change the file.
	if $copy_on_change &&
	old=`LC_ALL=C ls -dlL "$dst" 2>/dev/null` &&
	new=`LC_ALL=C ls -dlL "$dsttmp" 2>/dev/null` &&
	set -f &&
	set X $old && old=:$2:$4:$5:$6 &&
	set X $new && new=:$2:$4:$5:$6 &&
	set +f &&
	test "$old" = "$new" &&
	$cmpprog "$dst" "$dsttmp" >/dev/null 2>&1
	then
	rm -f "$dsttmp"
	else
	# Rename the file to the real destination.
	$doit $mvcmd -f "$dsttmp" "$dst" 2>/dev/null \|\|

	# The rename failed, perhaps because mv can't rename something else
	# to itself, or perhaps because mv is so ancient that it does not
	# support -f.
	{
	# Now remove or move aside any old file at destination location.
	# We try this two ways since rm can't unlink itself on some
	# systems and the destination file might be busy for other
	# reasons. In this case, the final cleanup might fail but the new
	# file should still install successfully.
	{
	test ! -f "$dst" \|\|
	$doit $rmcmd -f "$dst" 2>/dev/null \|\|
	{ $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
	{ $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
	} \|\|
	{ echo "$0: cannot unlink or rename $dst" >&2
	(exit 1); exit 1
	}
	} &&

	# Now rename the file to the real destination.
	$doit $mvcmd "$dsttmp" "$dst"
	}
	fi \|\| exit 1

	trap '' 0
	fi
	done

	# Local variables:
	# eval: (add-hook 'write-file-hooks 'time-stamp)
	# time-stamp-start: "scriptversion="
	# time-stamp-format: "%:y-%02m-%02d.%02H"
	# time-stamp-time-zone: "UTC"
	# time-stamp-end: "; # UTC"
	# End:
	Index: head/contrib/unbound/iterator/iter_fwd.c
	===================================================================
	--- head/contrib/unbound/iterator/iter_fwd.c (revision 349719)
	+++ head/contrib/unbound/iterator/iter_fwd.c (revision 349720)
	@@ -1,518 +1,518 @@
	/*
	* iterator/iter_fwd.c - iterative resolver module forward zones.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains functions to assist the iterator module.
	* Keep track of forward zones and config settings.
	*/
	#include "config.h"
	#include "iterator/iter_fwd.h"
	#include "iterator/iter_delegpt.h"
	#include "util/log.h"
	#include "util/config_file.h"
	#include "util/net_help.h"
	#include "util/data/dname.h"
	#include "sldns/rrdef.h"
	#include "sldns/str2wire.h"

	int
	fwd_cmp(const void* k1, const void* k2)
	{
	int m;
	struct iter_forward_zone* n1 = (struct iter_forward_zone*)k1;
	struct iter_forward_zone* n2 = (struct iter_forward_zone*)k2;
	if(n1->dclass != n2->dclass) {
	if(n1->dclass < n2->dclass)
	return -1;
	return 1;
	}
	return dname_lab_cmp(n1->name, n1->namelabs, n2->name, n2->namelabs,
	&m);
	}

	struct iter_forwards*
	forwards_create(void)
	{
	struct iter_forwards* fwd = (struct iter_forwards*)calloc(1,
	sizeof(struct iter_forwards));
	if(!fwd)
	return NULL;
	return fwd;
	}

	static void fwd_zone_free(struct iter_forward_zone* n)
	{
	if(!n) return;
	delegpt_free_mlc(n->dp);
	free(n->name);
	free(n);
	}

	static void delfwdnode(rbnode_type* n, void* ATTR_UNUSED(arg))
	{
	struct iter_forward_zone* node = (struct iter_forward_zone*)n;
	fwd_zone_free(node);
	}

	static void fwd_del_tree(struct iter_forwards* fwd)
	{
	if(fwd->tree)
	traverse_postorder(fwd->tree, &delfwdnode, NULL);
	free(fwd->tree);
	}

	void
	forwards_delete(struct iter_forwards* fwd)
	{
	if(!fwd)
	return;
	fwd_del_tree(fwd);
	free(fwd);
	}

	/** insert info into forward structure */
	static int
	forwards_insert_data(struct iter_forwards* fwd, uint16_t c, uint8_t* nm,
	size_t nmlen, int nmlabs, struct delegpt* dp)
	{
	struct iter_forward_zone* node = (struct iter_forward_zone*)malloc(
	sizeof(struct iter_forward_zone));
	if(!node) {
	delegpt_free_mlc(dp);
	return 0;
	}
	node->node.key = node;
	node->dclass = c;
	node->name = memdup(nm, nmlen);
	if(!node->name) {
	delegpt_free_mlc(dp);
	free(node);
	return 0;
	}
	node->namelen = nmlen;
	node->namelabs = nmlabs;
	node->dp = dp;
	if(!rbtree_insert(fwd->tree, &node->node)) {
	char buf[257];
	dname_str(nm, buf);
	log_err("duplicate forward zone %s ignored.", buf);
	delegpt_free_mlc(dp);
	free(node->name);
	free(node);
	}
	return 1;
	}

	/** insert new info into forward structure given dp */
	static int
	forwards_insert(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp)
	{
	return forwards_insert_data(fwd, c, dp->name, dp->namelen,
	dp->namelabs, dp);
	}

	/** initialise parent pointers in the tree */
	static void
	fwd_init_parents(struct iter_forwards* fwd)
	{
	struct iter_forward_zone* node, prev = NULL, p;
	int m;
	RBTREE_FOR(node, struct iter_forward_zone*, fwd->tree) {
	node->parent = NULL;
	if(!prev \|\| prev->dclass != node->dclass) {
	prev = node;
	continue;
	}
	(void)dname_lab_cmp(prev->name, prev->namelabs, node->name,
	node->namelabs, &m); /* we know prev is smaller */
	/* sort order like: . com. bla.com. zwb.com. net. */
	/* find the previous, or parent-parent-parent */
	for(p = prev; p; p = p->parent)
	/* looking for name with few labels, a parent */
	if(p->namelabs <= m) {
	/* ==: since prev matched m, this is closest*/
	/* <: prev matches more, but is not a parent,
	* this one is a (grand)parent */
	node->parent = p;
	break;
	}
	prev = node;
	}
	}

	/** set zone name */
	static struct delegpt*
	read_fwds_name(struct config_stub* s)
	{
	struct delegpt* dp;
	uint8_t* dname;
	size_t dname_len;
	if(!s->name) {
	log_err("forward zone without a name (use name \".\" to forward everything)");
	return NULL;
	}
	dname = sldns_str2wire_dname(s->name, &dname_len);
	if(!dname) {
	log_err("cannot parse forward zone name %s", s->name);
	return NULL;
	}
	if(!(dp=delegpt_create_mlc(dname))) {
	free(dname);
	log_err("out of memory");
	return NULL;
	}
	free(dname);
	return dp;
	}

	/** set fwd host names */
	static int
	read_fwds_host(struct config_stub* s, struct delegpt* dp)
	{
	struct config_strlist* p;
	uint8_t* dname;
	size_t dname_len;
	for(p = s->hosts; p; p = p->next) {
	log_assert(p->str);
	dname = sldns_str2wire_dname(p->str, &dname_len);
	if(!dname) {
	log_err("cannot parse forward %s server name: '%s'",
	s->name, p->str);
	return 0;
	}
	if(!delegpt_add_ns_mlc(dp, dname, 0)) {
	free(dname);
	log_err("out of memory");
	return 0;
	}
	free(dname);
	}
	return 1;
	}

	/** set fwd server addresses */
	static int
	read_fwds_addr(struct config_stub* s, struct delegpt* dp)
	{
	struct config_strlist* p;
	struct sockaddr_storage addr;
	socklen_t addrlen;
	char* tls_auth_name;
	for(p = s->addrs; p; p = p->next) {
	log_assert(p->str);
	if(!authextstrtoaddr(p->str, &addr, &addrlen, &tls_auth_name)) {
	log_err("cannot parse forward %s ip address: '%s'",
	s->name, p->str);
	return 0;
	}
	-#ifndef HAVE_SSL_SET1_HOST
	+#if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
	if(tls_auth_name)
	log_err("no name verification functionality in "
	"ssl library, ignored name for %s", p->str);
	#endif
	if(!delegpt_add_addr_mlc(dp, &addr, addrlen, 0, 0,
	tls_auth_name)) {
	log_err("out of memory");
	return 0;
	}
	}
	return 1;
	}

	/** read forwards config */
	static int
	read_forwards(struct iter_forwards* fwd, struct config_file* cfg)
	{
	struct config_stub* s;
	for(s = cfg->forwards; s; s = s->next) {
	struct delegpt* dp;
	if(!(dp=read_fwds_name(s)))
	return 0;
	if(!read_fwds_host(s, dp) \|\| !read_fwds_addr(s, dp)) {
	delegpt_free_mlc(dp);
	return 0;
	}
	/* set flag that parent side NS information is included.
	* Asking a (higher up) server on the internet is not useful */
	/* the flag is turned off for 'forward-first' so that the
	* last resort will ask for parent-side NS record and thus
	* fallback to the internet name servers on a failure */
	dp->has_parent_side_NS = (uint8_t)!s->isfirst;
	/* Do not cache if set. */
	dp->no_cache = s->no_cache;
	/* use SSL for queries to this forwarder */
	dp->ssl_upstream = (uint8_t)s->ssl_upstream;
	verbose(VERB_QUERY, "Forward zone server list:");
	delegpt_log(VERB_QUERY, dp);
	if(!forwards_insert(fwd, LDNS_RR_CLASS_IN, dp))
	return 0;
	}
	return 1;
	}

	/** insert a stub hole (if necessary) for stub name */
	static int
	fwd_add_stub_hole(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
	{
	struct iter_forward_zone key;
	key.node.key = &key;
	key.dclass = c;
	key.name = nm;
	key.namelabs = dname_count_size_labels(key.name, &key.namelen);
	return forwards_insert_data(fwd, key.dclass, key.name,
	key.namelen, key.namelabs, NULL);
	}

	/** make NULL entries for stubs */
	static int
	make_stub_holes(struct iter_forwards* fwd, struct config_file* cfg)
	{
	struct config_stub* s;
	uint8_t* dname;
	size_t dname_len;
	for(s = cfg->stubs; s; s = s->next) {
	if(!s->name) continue;
	dname = sldns_str2wire_dname(s->name, &dname_len);
	if(!dname) {
	log_err("cannot parse stub name '%s'", s->name);
	return 0;
	}
	if(!fwd_add_stub_hole(fwd, LDNS_RR_CLASS_IN, dname)) {
	free(dname);
	log_err("out of memory");
	return 0;
	}
	free(dname);
	}
	return 1;
	}

	int
	forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg)
	{
	fwd_del_tree(fwd);
	fwd->tree = rbtree_create(fwd_cmp);
	if(!fwd->tree)
	return 0;

	/* read forward zones */
	if(!read_forwards(fwd, cfg))
	return 0;
	if(!make_stub_holes(fwd, cfg))
	return 0;
	fwd_init_parents(fwd);
	return 1;
	}

	struct delegpt*
	forwards_find(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass)
	{
	rbnode_type* res = NULL;
	struct iter_forward_zone key;
	key.node.key = &key;
	key.dclass = qclass;
	key.name = qname;
	key.namelabs = dname_count_size_labels(qname, &key.namelen);
	res = rbtree_search(fwd->tree, &key);
	if(res) return ((struct iter_forward_zone*)res)->dp;
	return NULL;
	}

	struct delegpt*
	forwards_lookup(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass)
	{
	/* lookup the forward zone in the tree */
	rbnode_type* res = NULL;
	struct iter_forward_zone *result;
	struct iter_forward_zone key;
	key.node.key = &key;
	key.dclass = qclass;
	key.name = qname;
	key.namelabs = dname_count_size_labels(qname, &key.namelen);
	if(rbtree_find_less_equal(fwd->tree, &key, &res)) {
	/* exact */
	result = (struct iter_forward_zone*)res;
	} else {
	/* smaller element (or no element) */
	int m;
	result = (struct iter_forward_zone*)res;
	if(!result \|\| result->dclass != qclass)
	return NULL;
	/* count number of labels matched */
	(void)dname_lab_cmp(result->name, result->namelabs, key.name,
	key.namelabs, &m);
	while(result) { /* go up until qname is subdomain of stub */
	if(result->namelabs <= m)
	break;
	result = result->parent;
	}
	}
	if(result)
	return result->dp;
	return NULL;
	}

	struct delegpt*
	forwards_lookup_root(struct iter_forwards* fwd, uint16_t qclass)
	{
	uint8_t root = 0;
	return forwards_lookup(fwd, &root, qclass);
	}

	int
	forwards_next_root(struct iter_forwards* fwd, uint16_t* dclass)
	{
	struct iter_forward_zone key;
	rbnode_type* n;
	struct iter_forward_zone* p;
	if(*dclass == 0) {
	/* first root item is first item in tree */
	n = rbtree_first(fwd->tree);
	if(n == RBTREE_NULL)
	return 0;
	p = (struct iter_forward_zone*)n;
	if(dname_is_root(p->name)) {
	*dclass = p->dclass;
	return 1;
	}
	/* root not first item? search for higher items */
	*dclass = p->dclass + 1;
	return forwards_next_root(fwd, dclass);
	}
	/* find class n in tree, we may get a direct hit, or if we don't
	* this is the last item of the previous class so rbtree_next() takes
	* us to the next root (if any) */
	key.node.key = &key;
	key.name = (uint8_t*)"\000";
	key.namelen = 1;
	key.namelabs = 0;
	key.dclass = *dclass;
	n = NULL;
	if(rbtree_find_less_equal(fwd->tree, &key, &n)) {
	/* exact */
	return 1;
	} else {
	/* smaller element */
	if(!n \|\| n == RBTREE_NULL)
	return 0; /* nothing found */
	n = rbtree_next(n);
	if(n == RBTREE_NULL)
	return 0; /* no higher */
	p = (struct iter_forward_zone*)n;
	if(dname_is_root(p->name)) {
	*dclass = p->dclass;
	return 1;
	}
	/* not a root node, return next higher item */
	*dclass = p->dclass+1;
	return forwards_next_root(fwd, dclass);
	}
	}

	size_t
	forwards_get_mem(struct iter_forwards* fwd)
	{
	struct iter_forward_zone* p;
	size_t s;
	if(!fwd)
	return 0;
	s = sizeof(fwd) + sizeof(fwd->tree);
	RBTREE_FOR(p, struct iter_forward_zone*, fwd->tree) {
	s += sizeof(*p) + p->namelen + delegpt_get_mem(p->dp);
	}
	return s;
	}

	static struct iter_forward_zone*
	fwd_zone_find(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
	{
	struct iter_forward_zone key;
	key.node.key = &key;
	key.dclass = c;
	key.name = nm;
	key.namelabs = dname_count_size_labels(nm, &key.namelen);
	return (struct iter_forward_zone*)rbtree_search(fwd->tree, &key);
	}

	int
	forwards_add_zone(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp)
	{
	struct iter_forward_zone *z;
	if((z=fwd_zone_find(fwd, c, dp->name)) != NULL) {
	(void)rbtree_delete(fwd->tree, &z->node);
	fwd_zone_free(z);
	}
	if(!forwards_insert(fwd, c, dp))
	return 0;
	fwd_init_parents(fwd);
	return 1;
	}

	void
	forwards_delete_zone(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
	{
	struct iter_forward_zone *z;
	if(!(z=fwd_zone_find(fwd, c, nm)))
	return; /* nothing to do */
	(void)rbtree_delete(fwd->tree, &z->node);
	fwd_zone_free(z);
	fwd_init_parents(fwd);
	}

	int
	forwards_add_stub_hole(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
	{
	if(!fwd_add_stub_hole(fwd, c, nm)) {
	return 0;
	}
	fwd_init_parents(fwd);
	return 1;
	}

	void
	forwards_delete_stub_hole(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
	{
	struct iter_forward_zone *z;
	if(!(z=fwd_zone_find(fwd, c, nm)))
	return; /* nothing to do */
	if(z->dp != NULL)
	return; /* not a stub hole */
	(void)rbtree_delete(fwd->tree, &z->node);
	fwd_zone_free(z);
	fwd_init_parents(fwd);
	}

	Index: head/contrib/unbound/iterator/iter_hints.c
	===================================================================
	--- head/contrib/unbound/iterator/iter_hints.c (revision 349719)
	+++ head/contrib/unbound/iterator/iter_hints.c (revision 349720)
	@@ -1,555 +1,555 @@
	/*
	* iterator/iter_hints.c - iterative resolver module stub and root hints.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains functions to assist the iterator module.
	* Keep track of stub and root hints, and read those from config.
	*/
	#include "config.h"
	#include "iterator/iter_hints.h"
	#include "iterator/iter_delegpt.h"
	#include "util/log.h"
	#include "util/config_file.h"
	#include "util/net_help.h"
	#include "util/data/dname.h"
	#include "sldns/rrdef.h"
	#include "sldns/str2wire.h"
	#include "sldns/wire2str.h"

	struct iter_hints*
	hints_create(void)
	{
	struct iter_hints* hints = (struct iter_hints*)calloc(1,
	sizeof(struct iter_hints));
	if(!hints)
	return NULL;
	return hints;
	}

	static void hints_stub_free(struct iter_hints_stub* s)
	{
	if(!s) return;
	delegpt_free_mlc(s->dp);
	free(s);
	}

	static void delhintnode(rbnode_type* n, void* ATTR_UNUSED(arg))
	{
	struct iter_hints_stub* node = (struct iter_hints_stub*)n;
	hints_stub_free(node);
	}

	static void hints_del_tree(struct iter_hints* hints)
	{
	traverse_postorder(&hints->tree, &delhintnode, NULL);
	}

	void
	hints_delete(struct iter_hints* hints)
	{
	if(!hints)
	return;
	hints_del_tree(hints);
	free(hints);
	}

	/** add hint to delegation hints */
	static int
	ah(struct delegpt* dp, const char* sv, const char* ip)
	{
	struct sockaddr_storage addr;
	socklen_t addrlen;
	size_t dname_len;
	uint8_t* dname = sldns_str2wire_dname(sv, &dname_len);
	if(!dname) {
	log_err("could not parse %s", sv);
	return 0;
	}
	if(!delegpt_add_ns_mlc(dp, dname, 0) \|\|
	!extstrtoaddr(ip, &addr, &addrlen) \|\|
	!delegpt_add_target_mlc(dp, dname, dname_len,
	&addr, addrlen, 0, 0)) {
	free(dname);
	return 0;
	}
	free(dname);
	return 1;
	}

	/** obtain compiletime provided root hints */
	static struct delegpt*
	compile_time_root_prime(int do_ip4, int do_ip6)
	{
	/* from:
	; This file is made available by InterNIC
	; under anonymous FTP as
	; file /domain/named.cache
	; on server FTP.INTERNIC.NET
	; -OR- RS.INTERNIC.NET
	;
	; related version of root zone: changes-on-20120103
	*/
	struct delegpt* dp = delegpt_create_mlc((uint8_t*)"\000");
	if(!dp)
	return NULL;
	dp->has_parent_side_NS = 1;
	if(do_ip4) {
	if(!ah(dp, "A.ROOT-SERVERS.NET.", "198.41.0.4")) goto failed;
	if(!ah(dp, "B.ROOT-SERVERS.NET.", "199.9.14.201")) goto failed;
	if(!ah(dp, "C.ROOT-SERVERS.NET.", "192.33.4.12")) goto failed;
	if(!ah(dp, "D.ROOT-SERVERS.NET.", "199.7.91.13")) goto failed;
	if(!ah(dp, "E.ROOT-SERVERS.NET.", "192.203.230.10")) goto failed;
	if(!ah(dp, "F.ROOT-SERVERS.NET.", "192.5.5.241")) goto failed;
	if(!ah(dp, "G.ROOT-SERVERS.NET.", "192.112.36.4")) goto failed;
	if(!ah(dp, "H.ROOT-SERVERS.NET.", "198.97.190.53")) goto failed;
	if(!ah(dp, "I.ROOT-SERVERS.NET.", "192.36.148.17")) goto failed;
	if(!ah(dp, "J.ROOT-SERVERS.NET.", "192.58.128.30")) goto failed;
	if(!ah(dp, "K.ROOT-SERVERS.NET.", "193.0.14.129")) goto failed;
	if(!ah(dp, "L.ROOT-SERVERS.NET.", "199.7.83.42")) goto failed;
	if(!ah(dp, "M.ROOT-SERVERS.NET.", "202.12.27.33")) goto failed;
	}
	if(do_ip6) {
	if(!ah(dp, "A.ROOT-SERVERS.NET.", "2001:503:ba3e::2:30")) goto failed;
	if(!ah(dp, "B.ROOT-SERVERS.NET.", "2001:500:200::b")) goto failed;
	if(!ah(dp, "C.ROOT-SERVERS.NET.", "2001:500:2::c")) goto failed;
	if(!ah(dp, "D.ROOT-SERVERS.NET.", "2001:500:2d::d")) goto failed;
	if(!ah(dp, "E.ROOT-SERVERS.NET.", "2001:500:a8::e")) goto failed;
	if(!ah(dp, "F.ROOT-SERVERS.NET.", "2001:500:2f::f")) goto failed;
	if(!ah(dp, "G.ROOT-SERVERS.NET.", "2001:500:12::d0d")) goto failed;
	if(!ah(dp, "H.ROOT-SERVERS.NET.", "2001:500:1::53")) goto failed;
	if(!ah(dp, "I.ROOT-SERVERS.NET.", "2001:7fe::53")) goto failed;
	if(!ah(dp, "J.ROOT-SERVERS.NET.", "2001:503:c27::2:30")) goto failed;
	if(!ah(dp, "K.ROOT-SERVERS.NET.", "2001:7fd::1")) goto failed;
	if(!ah(dp, "L.ROOT-SERVERS.NET.", "2001:500:9f::42")) goto failed;
	if(!ah(dp, "M.ROOT-SERVERS.NET.", "2001:dc3::35")) goto failed;
	}
	return dp;
	failed:
	delegpt_free_mlc(dp);
	return 0;
	}

	/** insert new hint info into hint structure */
	static int
	hints_insert(struct iter_hints* hints, uint16_t c, struct delegpt* dp,
	int noprime)
	{
	struct iter_hints_stub* node = (struct iter_hints_stub*)malloc(
	sizeof(struct iter_hints_stub));
	if(!node) {
	delegpt_free_mlc(dp);
	return 0;
	}
	node->dp = dp;
	node->noprime = (uint8_t)noprime;
	if(!name_tree_insert(&hints->tree, &node->node, dp->name, dp->namelen,
	dp->namelabs, c)) {
	char buf[257];
	dname_str(dp->name, buf);
	log_err("second hints for zone %s ignored.", buf);
	delegpt_free_mlc(dp);
	free(node);
	}
	return 1;
	}

	/** set stub name */
	static struct delegpt*
	read_stubs_name(struct config_stub* s)
	{
	struct delegpt* dp;
	size_t dname_len;
	uint8_t* dname;
	if(!s->name) {
	log_err("stub zone without a name");
	return NULL;
	}
	dname = sldns_str2wire_dname(s->name, &dname_len);
	if(!dname) {
	log_err("cannot parse stub zone name %s", s->name);
	return NULL;
	}
	if(!(dp=delegpt_create_mlc(dname))) {
	free(dname);
	log_err("out of memory");
	return NULL;
	}
	free(dname);
	return dp;
	}

	/** set stub host names */
	static int
	read_stubs_host(struct config_stub* s, struct delegpt* dp)
	{
	struct config_strlist* p;
	size_t dname_len;
	uint8_t* dname;
	for(p = s->hosts; p; p = p->next) {
	log_assert(p->str);
	dname = sldns_str2wire_dname(p->str, &dname_len);
	if(!dname) {
	log_err("cannot parse stub %s nameserver name: '%s'",
	s->name, p->str);
	return 0;
	}
	if(!delegpt_add_ns_mlc(dp, dname, 0)) {
	free(dname);
	log_err("out of memory");
	return 0;
	}
	free(dname);
	}
	return 1;
	}

	/** set stub server addresses */
	static int
	read_stubs_addr(struct config_stub* s, struct delegpt* dp)
	{
	struct config_strlist* p;
	struct sockaddr_storage addr;
	socklen_t addrlen;
	char* auth_name;
	for(p = s->addrs; p; p = p->next) {
	log_assert(p->str);
	if(!authextstrtoaddr(p->str, &addr, &addrlen, &auth_name)) {
	log_err("cannot parse stub %s ip address: '%s'",
	s->name, p->str);
	return 0;
	}
	-#ifndef HAVE_SSL_SET1_HOST
	+#if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
	if(auth_name)
	log_err("no name verification functionality in "
	"ssl library, ignored name for %s", p->str);
	#endif
	if(!delegpt_add_addr_mlc(dp, &addr, addrlen, 0, 0,
	auth_name)) {
	log_err("out of memory");
	return 0;
	}
	}
	return 1;
	}

	/** read stubs config */
	static int
	read_stubs(struct iter_hints* hints, struct config_file* cfg)
	{
	struct config_stub* s;
	struct delegpt* dp;
	for(s = cfg->stubs; s; s = s->next) {
	if(!(dp=read_stubs_name(s)))
	return 0;
	if(!read_stubs_host(s, dp) \|\| !read_stubs_addr(s, dp)) {
	delegpt_free_mlc(dp);
	return 0;
	}
	/* the flag is turned off for 'stub-first' so that the
	* last resort will ask for parent-side NS record and thus
	* fallback to the internet name servers on a failure */
	dp->has_parent_side_NS = (uint8_t)!s->isfirst;
	/* Do not cache if set. */
	dp->no_cache = s->no_cache;
	/* ssl_upstream */
	dp->ssl_upstream = (uint8_t)s->ssl_upstream;
	delegpt_log(VERB_QUERY, dp);
	if(!hints_insert(hints, LDNS_RR_CLASS_IN, dp, !s->isprime))
	return 0;
	}
	return 1;
	}

	/** read root hints from file */
	static int
	read_root_hints(struct iter_hints* hints, char* fname)
	{
	struct sldns_file_parse_state pstate;
	struct delegpt* dp;
	uint8_t rr[LDNS_RR_BUF_SIZE];
	size_t rr_len, dname_len;
	int status;
	uint16_t c = LDNS_RR_CLASS_IN;
	FILE* f = fopen(fname, "r");
	if(!f) {
	log_err("could not read root hints %s: %s",
	fname, strerror(errno));
	return 0;
	}
	dp = delegpt_create_mlc(NULL);
	if(!dp) {
	log_err("out of memory reading root hints");
	fclose(f);
	return 0;
	}
	verbose(VERB_QUERY, "Reading root hints from %s", fname);
	memset(&pstate, 0, sizeof(pstate));
	pstate.lineno = 1;
	dp->has_parent_side_NS = 1;
	while(!feof(f)) {
	rr_len = sizeof(rr);
	dname_len = 0;
	status = sldns_fp2wire_rr_buf(f, rr, &rr_len, &dname_len,
	&pstate);
	if(status != 0) {
	log_err("reading root hints %s %d:%d: %s", fname,
	pstate.lineno, LDNS_WIREPARSE_OFFSET(status),
	sldns_get_errorstr_parse(status));
	goto stop_read;
	}
	if(rr_len == 0)
	continue; /* EMPTY line, TTL or ORIGIN */
	if(sldns_wirerr_get_type(rr, rr_len, dname_len)
	== LDNS_RR_TYPE_NS) {
	if(!delegpt_add_ns_mlc(dp, sldns_wirerr_get_rdata(rr,
	rr_len, dname_len), 0)) {
	log_err("out of memory reading root hints");
	goto stop_read;
	}
	c = sldns_wirerr_get_class(rr, rr_len, dname_len);
	if(!dp->name) {
	if(!delegpt_set_name_mlc(dp, rr)) {
	log_err("out of memory.");
	goto stop_read;
	}
	}
	} else if(sldns_wirerr_get_type(rr, rr_len, dname_len)
	== LDNS_RR_TYPE_A && sldns_wirerr_get_rdatalen(rr,
	rr_len, dname_len) == INET_SIZE) {
	struct sockaddr_in sa;
	socklen_t len = (socklen_t)sizeof(sa);
	memset(&sa, 0, len);
	sa.sin_family = AF_INET;
	sa.sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
	memmove(&sa.sin_addr,
	sldns_wirerr_get_rdata(rr, rr_len, dname_len),
	INET_SIZE);
	if(!delegpt_add_target_mlc(dp, rr, dname_len,
	(struct sockaddr_storage*)&sa, len,
	0, 0)) {
	log_err("out of memory reading root hints");
	goto stop_read;
	}
	} else if(sldns_wirerr_get_type(rr, rr_len, dname_len)
	== LDNS_RR_TYPE_AAAA && sldns_wirerr_get_rdatalen(rr,
	rr_len, dname_len) == INET6_SIZE) {
	struct sockaddr_in6 sa;
	socklen_t len = (socklen_t)sizeof(sa);
	memset(&sa, 0, len);
	sa.sin6_family = AF_INET6;
	sa.sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
	memmove(&sa.sin6_addr,
	sldns_wirerr_get_rdata(rr, rr_len, dname_len),
	INET6_SIZE);
	if(!delegpt_add_target_mlc(dp, rr, dname_len,
	(struct sockaddr_storage*)&sa, len,
	0, 0)) {
	log_err("out of memory reading root hints");
	goto stop_read;
	}
	} else {
	char buf[17];
	sldns_wire2str_type_buf(sldns_wirerr_get_type(rr,
	rr_len, dname_len), buf, sizeof(buf));
	log_warn("root hints %s:%d skipping type %s",
	fname, pstate.lineno, buf);
	}
	}
	fclose(f);
	if(!dp->name) {
	log_warn("root hints %s: no NS content", fname);
	delegpt_free_mlc(dp);
	return 1;
	}
	if(!hints_insert(hints, c, dp, 0)) {
	return 0;
	}
	delegpt_log(VERB_QUERY, dp);
	return 1;

	stop_read:
	delegpt_free_mlc(dp);
	fclose(f);
	return 0;
	}

	/** read root hints list */
	static int
	read_root_hints_list(struct iter_hints* hints, struct config_file* cfg)
	{
	struct config_strlist* p;
	for(p = cfg->root_hints; p; p = p->next) {
	log_assert(p->str);
	if(p->str && p->str[0]) {
	char* f = p->str;
	if(cfg->chrootdir && cfg->chrootdir[0] &&
	strncmp(p->str, cfg->chrootdir,
	strlen(cfg->chrootdir)) == 0)
	f += strlen(cfg->chrootdir);
	if(!read_root_hints(hints, f))
	return 0;
	}
	}
	return 1;
	}

	int
	hints_apply_cfg(struct iter_hints* hints, struct config_file* cfg)
	{
	hints_del_tree(hints);
	name_tree_init(&hints->tree);

	/* read root hints */
	if(!read_root_hints_list(hints, cfg))
	return 0;

	/* read stub hints */
	if(!read_stubs(hints, cfg))
	return 0;

	/* use fallback compiletime root hints */
	if(!hints_lookup_root(hints, LDNS_RR_CLASS_IN)) {
	struct delegpt* dp = compile_time_root_prime(cfg->do_ip4,
	cfg->do_ip6);
	verbose(VERB_ALGO, "no config, using builtin root hints.");
	if(!dp)
	return 0;
	if(!hints_insert(hints, LDNS_RR_CLASS_IN, dp, 0))
	return 0;
	}

	name_tree_init_parents(&hints->tree);
	return 1;
	}

	struct delegpt*
	hints_lookup_root(struct iter_hints* hints, uint16_t qclass)
	{
	uint8_t rootlab = 0;
	struct iter_hints_stub *stub;
	stub = (struct iter_hints_stub*)name_tree_find(&hints->tree,
	&rootlab, 1, 1, qclass);
	if(!stub)
	return NULL;
	return stub->dp;
	}

	struct iter_hints_stub*
	hints_lookup_stub(struct iter_hints* hints, uint8_t* qname,
	uint16_t qclass, struct delegpt* cache_dp)
	{
	size_t len;
	int labs;
	struct iter_hints_stub *r;

	/* first lookup the stub */
	labs = dname_count_size_labels(qname, &len);
	r = (struct iter_hints_stub*)name_tree_lookup(&hints->tree, qname,
	len, labs, qclass);
	if(!r) return NULL;

	/* If there is no cache (root prime situation) */
	if(cache_dp == NULL) {
	if(r->dp->namelabs != 1)
	return r; /* no cache dp, use any non-root stub */
	return NULL;
	}

	/*
	* If the stub is same as the delegation we got
	* And has noprime set, we need to 'prime' to use this stub instead.
	*/
	if(r->noprime && query_dname_compare(cache_dp->name, r->dp->name)==0)
	return r; /* use this stub instead of cached dp */

	/*
	* If our cached delegation point is above the hint, we need to prime.
	*/
	if(dname_strict_subdomain(r->dp->name, r->dp->namelabs,
	cache_dp->name, cache_dp->namelabs))
	return r; /* need to prime this stub */
	return NULL;
	}

	int hints_next_root(struct iter_hints* hints, uint16_t* qclass)
	{
	return name_tree_next_root(&hints->tree, qclass);
	}

	size_t
	hints_get_mem(struct iter_hints* hints)
	{
	size_t s;
	struct iter_hints_stub* p;
	if(!hints) return 0;
	s = sizeof(*hints);
	RBTREE_FOR(p, struct iter_hints_stub*, &hints->tree) {
	s += sizeof(*p) + delegpt_get_mem(p->dp);
	}
	return s;
	}

	int
	hints_add_stub(struct iter_hints* hints, uint16_t c, struct delegpt* dp,
	int noprime)
	{
	struct iter_hints_stub *z;
	if((z=(struct iter_hints_stub*)name_tree_find(&hints->tree,
	dp->name, dp->namelen, dp->namelabs, c)) != NULL) {
	(void)rbtree_delete(&hints->tree, &z->node);
	hints_stub_free(z);
	}
	if(!hints_insert(hints, c, dp, noprime))
	return 0;
	name_tree_init_parents(&hints->tree);
	return 1;
	}

	void
	hints_delete_stub(struct iter_hints* hints, uint16_t c, uint8_t* nm)
	{
	struct iter_hints_stub *z;
	size_t len;
	int labs = dname_count_size_labels(nm, &len);
	if(!(z=(struct iter_hints_stub*)name_tree_find(&hints->tree,
	nm, len, labs, c)))
	return; /* nothing to do */
	(void)rbtree_delete(&hints->tree, &z->node);
	hints_stub_free(z);
	name_tree_init_parents(&hints->tree);
	}

	Index: head/contrib/unbound/iterator/iter_scrub.c
	===================================================================
	--- head/contrib/unbound/iterator/iter_scrub.c (revision 349719)
	+++ head/contrib/unbound/iterator/iter_scrub.c (revision 349720)
	@@ -1,812 +1,825 @@
	/*
	* iterator/iter_scrub.c - scrubbing, normalization, sanitization of DNS msgs.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file has routine(s) for cleaning up incoming DNS messages from
	* possible useless or malicious junk in it.
	*/
	#include "config.h"
	#include "iterator/iter_scrub.h"
	#include "iterator/iterator.h"
	#include "iterator/iter_priv.h"
	#include "services/cache/rrset.h"
	#include "util/log.h"
	#include "util/net_help.h"
	#include "util/regional.h"
	#include "util/config_file.h"
	#include "util/module.h"
	#include "util/data/msgparse.h"
	#include "util/data/dname.h"
	#include "util/data/msgreply.h"
	#include "util/alloc.h"
	#include "sldns/sbuffer.h"

	/** RRset flag used during scrubbing. The RRset is OK. */
	#define RRSET_SCRUB_OK 0x80

	/** remove rrset, update loop variables */
	static void
	remove_rrset(const char* str, sldns_buffer* pkt, struct msg_parse* msg,
	struct rrset_parse* prev, struct rrset_parse** rrset)
	{
	if(verbosity >= VERB_QUERY && str
	&& (*rrset)->dname_len <= LDNS_MAX_DOMAINLEN) {
	uint8_t buf[LDNS_MAX_DOMAINLEN+1];
	dname_pkt_copy(pkt, buf, (*rrset)->dname);
	log_nametypeclass(VERB_QUERY, str, buf,
	(rrset)->type, ntohs((rrset)->rrset_class));
	}
	if(prev)
	prev->rrset_all_next = (*rrset)->rrset_all_next;
	else msg->rrset_first = (*rrset)->rrset_all_next;
	if(msg->rrset_last == *rrset)
	msg->rrset_last = prev;
	msg->rrset_count --;
	switch((*rrset)->section) {
	case LDNS_SECTION_ANSWER: msg->an_rrsets--; break;
	case LDNS_SECTION_AUTHORITY: msg->ns_rrsets--; break;
	case LDNS_SECTION_ADDITIONAL: msg->ar_rrsets--; break;
	default: log_assert(0);
	}
	msgparse_bucket_remove(msg, *rrset);
	rrset = (rrset)->rrset_all_next;
	}

	/** return true if rr type has additional names in it */
	static int
	has_additional(uint16_t t)
	{
	switch(t) {
	case LDNS_RR_TYPE_MB:
	case LDNS_RR_TYPE_MD:
	case LDNS_RR_TYPE_MF:
	case LDNS_RR_TYPE_NS:
	case LDNS_RR_TYPE_MX:
	case LDNS_RR_TYPE_KX:
	case LDNS_RR_TYPE_SRV:
	return 1;
	case LDNS_RR_TYPE_NAPTR:
	/* TODO: NAPTR not supported, glue stripped off */
	return 0;
	}
	return 0;
	}

	/** get additional name from rrset RR, return false if no name present */
	static int
	get_additional_name(struct rrset_parse* rrset, struct rr_parse* rr,
	uint8_t** nm, size_t* nmlen, sldns_buffer* pkt)
	{
	size_t offset = 0;
	size_t len, oldpos;
	switch(rrset->type) {
	case LDNS_RR_TYPE_MB:
	case LDNS_RR_TYPE_MD:
	case LDNS_RR_TYPE_MF:
	case LDNS_RR_TYPE_NS:
	offset = 0;
	break;
	case LDNS_RR_TYPE_MX:
	case LDNS_RR_TYPE_KX:
	offset = 2;
	break;
	case LDNS_RR_TYPE_SRV:
	offset = 6;
	break;
	case LDNS_RR_TYPE_NAPTR:
	/* TODO: NAPTR not supported, glue stripped off */
	return 0;
	default:
	return 0;
	}
	len = sldns_read_uint16(rr->ttl_data+sizeof(uint32_t));
	if(len < offset+1)
	return 0; /* rdata field too small */
	*nm = rr->ttl_data+sizeof(uint32_t)+sizeof(uint16_t)+offset;
	oldpos = sldns_buffer_position(pkt);
	sldns_buffer_set_position(pkt, (size_t)(*nm - sldns_buffer_begin(pkt)));
	*nmlen = pkt_dname_len(pkt);
	sldns_buffer_set_position(pkt, oldpos);
	if(*nmlen == 0)
	return 0;
	return 1;
	}

	/** Place mark on rrsets in additional section they are OK */
	static void
	mark_additional_rrset(sldns_buffer* pkt, struct msg_parse* msg,
	struct rrset_parse* rrset)
	{
	/* Mark A and AAAA for NS as appropriate additional section info. */
	uint8_t* nm = NULL;
	size_t nmlen = 0;
	struct rr_parse* rr;

	if(!has_additional(rrset->type))
	return;
	for(rr = rrset->rr_first; rr; rr = rr->next) {
	if(get_additional_name(rrset, rr, &nm, &nmlen, pkt)) {
	/* mark A */
	hashvalue_type h = pkt_hash_rrset(pkt, nm,
	LDNS_RR_TYPE_A, rrset->rrset_class, 0);
	struct rrset_parse* r = msgparse_hashtable_lookup(
	msg, pkt, h, 0, nm, nmlen,
	LDNS_RR_TYPE_A, rrset->rrset_class);
	if(r && r->section == LDNS_SECTION_ADDITIONAL) {
	r->flags \|= RRSET_SCRUB_OK;
	}

	/* mark AAAA */
	h = pkt_hash_rrset(pkt, nm, LDNS_RR_TYPE_AAAA,
	rrset->rrset_class, 0);
	r = msgparse_hashtable_lookup(msg, pkt, h, 0, nm,
	nmlen, LDNS_RR_TYPE_AAAA, rrset->rrset_class);
	if(r && r->section == LDNS_SECTION_ADDITIONAL) {
	r->flags \|= RRSET_SCRUB_OK;
	}
	}
	}
	}

	/** Get target name of a CNAME */
	static int
	parse_get_cname_target(struct rrset_parse* rrset, uint8_t** sname,
	size_t* snamelen)
	{
	if(rrset->rr_count != 1) {
	struct rr_parse* sig;
	verbose(VERB_ALGO, "Found CNAME rrset with "
	"size > 1: %u", (unsigned)rrset->rr_count);
	/* use the first CNAME! */
	rrset->rr_count = 1;
	rrset->size = rrset->rr_first->size;
	for(sig=rrset->rrsig_first; sig; sig=sig->next)
	rrset->size += sig->size;
	rrset->rr_last = rrset->rr_first;
	rrset->rr_first->next = NULL;
	}
	if(rrset->rr_first->size < sizeof(uint16_t)+1)
	return 0; /* CNAME rdata too small */
	*sname = rrset->rr_first->ttl_data + sizeof(uint32_t)
	+ sizeof(uint16_t); /* skip ttl, rdatalen */
	*snamelen = rrset->rr_first->size - sizeof(uint16_t);
	return 1;
	}

	/** Synthesize CNAME from DNAME, false if too long */
	static int
	synth_cname(uint8_t* qname, size_t qnamelen, struct rrset_parse* dname_rrset,
	uint8_t* alias, size_t* aliaslen, sldns_buffer* pkt)
	{
	/* we already know that sname is a strict subdomain of DNAME owner */
	uint8_t* dtarg = NULL;
	size_t dtarglen;
	if(!parse_get_cname_target(dname_rrset, &dtarg, &dtarglen))
	return 0;
	log_assert(qnamelen > dname_rrset->dname_len);
	/* DNAME from com. to net. with qname example.com. -> example.net. */
	/* so: \3com\0 to \3net\0 and qname \7example\3com\0 */
	*aliaslen = qnamelen + dtarglen - dname_rrset->dname_len;
	if(*aliaslen > LDNS_MAX_DOMAINLEN)
	return 0; /* should have been RCODE YXDOMAIN */
	/* decompress dnames into buffer, we know it fits */
	dname_pkt_copy(pkt, alias, qname);
	dname_pkt_copy(pkt, alias+(qnamelen-dname_rrset->dname_len), dtarg);
	return 1;
	}

	/** synthesize a CNAME rrset */
	static struct rrset_parse*
	synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
	size_t aliaslen, struct regional* region, struct msg_parse* msg,
	struct rrset_parse* rrset, struct rrset_parse* prev,
	struct rrset_parse* nx, sldns_buffer* pkt)
	{
	struct rrset_parse* cn = (struct rrset_parse*)regional_alloc(region,
	sizeof(struct rrset_parse));
	if(!cn)
	return NULL;
	memset(cn, 0, sizeof(*cn));
	cn->rr_first = (struct rr_parse*)regional_alloc(region,
	sizeof(struct rr_parse));
	if(!cn->rr_first)
	return NULL;
	cn->rr_last = cn->rr_first;
	/* CNAME from sname to alias */
	cn->dname = (uint8_t)regional_alloc(region, snamelen);
	if(!cn->dname)
	return NULL;
	dname_pkt_copy(pkt, cn->dname, *sname);
	cn->dname_len = *snamelen;
	cn->type = LDNS_RR_TYPE_CNAME;
	cn->section = rrset->section;
	cn->rrset_class = rrset->rrset_class;
	cn->rr_count = 1;
	cn->size = sizeof(uint16_t) + aliaslen;
	cn->hash=pkt_hash_rrset(pkt, cn->dname, cn->type, cn->rrset_class, 0);
	/* allocate TTL + rdatalen + uncompressed dname */
	memset(cn->rr_first, 0, sizeof(struct rr_parse));
	cn->rr_first->outside_packet = 1;
	cn->rr_first->ttl_data = (uint8_t*)regional_alloc(region,
	sizeof(uint32_t)+sizeof(uint16_t)+aliaslen);
	if(!cn->rr_first->ttl_data)
	return NULL;
	sldns_write_uint32(cn->rr_first->ttl_data, 0); /* TTL = 0 */
	sldns_write_uint16(cn->rr_first->ttl_data+4, aliaslen);
	memmove(cn->rr_first->ttl_data+6, alias, aliaslen);
	cn->rr_first->size = sizeof(uint16_t)+aliaslen;

	/* link it in */
	cn->rrset_all_next = nx;
	if(prev)
	prev->rrset_all_next = cn;
	else msg->rrset_first = cn;
	if(nx == NULL)
	msg->rrset_last = cn;
	msg->rrset_count ++;
	msg->an_rrsets++;
	/* it is not inserted in the msg hashtable. */

	*sname = cn->rr_first->ttl_data + sizeof(uint32_t)+sizeof(uint16_t);
	*snamelen = aliaslen;
	return cn;
	}

	/** check if DNAME applies to a name */
	static int
	pkt_strict_sub(sldns_buffer* pkt, uint8_t* sname, uint8_t* dr)
	{
	uint8_t buf1[LDNS_MAX_DOMAINLEN+1];
	uint8_t buf2[LDNS_MAX_DOMAINLEN+1];
	/* decompress names */
	dname_pkt_copy(pkt, buf1, sname);
	dname_pkt_copy(pkt, buf2, dr);
	return dname_strict_subdomain_c(buf1, buf2);
	}

	/** check subdomain with decompression */
	static int
	pkt_sub(sldns_buffer* pkt, uint8_t* comprname, uint8_t* zone)
	{
	uint8_t buf[LDNS_MAX_DOMAINLEN+1];
	dname_pkt_copy(pkt, buf, comprname);
	return dname_subdomain_c(buf, zone);
	}

	/** check subdomain with decompression, compressed is parent */
	static int
	sub_of_pkt(sldns_buffer* pkt, uint8_t* zone, uint8_t* comprname)
	{
	uint8_t buf[LDNS_MAX_DOMAINLEN+1];
	dname_pkt_copy(pkt, buf, comprname);
	return dname_subdomain_c(zone, buf);
	}

	+/** Check if there are SOA records in the authority section (negative) */
	+static int
	+soa_in_auth(struct msg_parse* msg)
	+{
	+ struct rrset_parse* rrset;
	+ for(rrset = msg->rrset_first; rrset; rrset = rrset->rrset_all_next)
	+ if(rrset->type == LDNS_RR_TYPE_SOA &&
	+ rrset->section == LDNS_SECTION_AUTHORITY)
	+ return 1;
	+ return 0;
	+}
	+
	/**
	* This routine normalizes a response. This includes removing "irrelevant"
	* records from the answer and additional sections and (re)synthesizing
	* CNAMEs from DNAMEs, if present.
	*
	* @param pkt: packet.
	* @param msg: msg to normalize.
	* @param qinfo: original query.
	* @param region: where to allocate synthesized CNAMEs.
	* @return 0 on error.
	*/
	static int
	scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
	struct query_info* qinfo, struct regional* region)
	{
	uint8_t* sname = qinfo->qname;
	size_t snamelen = qinfo->qname_len;
	struct rrset_parse* rrset, prev, nsset=NULL;

	if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR &&
	FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN)
	return 1;

	/* For the ANSWER section, remove all "irrelevant" records and add
	* synthesized CNAMEs from DNAMEs
	* This will strip out-of-order CNAMEs as well. */

	/* walk through the parse packet rrset list, keep track of previous
	* for insert and delete ease, and examine every RRset */
	prev = NULL;
	rrset = msg->rrset_first;
	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
	if(rrset->type == LDNS_RR_TYPE_DNAME &&
	pkt_strict_sub(pkt, sname, rrset->dname)) {
	/* check if next rrset is correct CNAME. else,
	* synthesize a CNAME */
	struct rrset_parse* nx = rrset->rrset_all_next;
	uint8_t alias[LDNS_MAX_DOMAINLEN+1];
	size_t aliaslen = 0;
	if(rrset->rr_count != 1) {
	verbose(VERB_ALGO, "Found DNAME rrset with "
	"size > 1: %u",
	(unsigned)rrset->rr_count);
	return 0;
	}
	if(!synth_cname(sname, snamelen, rrset, alias,
	&aliaslen, pkt)) {
	verbose(VERB_ALGO, "synthesized CNAME "
	"too long");
	return 0;
	}
	if(nx && nx->type == LDNS_RR_TYPE_CNAME &&
	dname_pkt_compare(pkt, sname, nx->dname) == 0) {
	/* check next cname */
	uint8_t* t = NULL;
	size_t tlen = 0;
	if(!parse_get_cname_target(nx, &t, &tlen))
	return 0;
	if(dname_pkt_compare(pkt, alias, t) == 0) {
	/* it's OK and better capitalized */
	prev = rrset;
	rrset = nx;
	continue;
	}
	/* synth ourselves */
	}
	/* synth a CNAME rrset */
	prev = synth_cname_rrset(&sname, &snamelen, alias,
	aliaslen, region, msg, rrset, rrset, nx, pkt);
	if(!prev) {
	log_err("out of memory synthesizing CNAME");
	return 0;
	}
	/* FIXME: resolve the conflict between synthesized
	* CNAME ttls and the cache. */
	rrset = nx;
	continue;

	}

	/* The only records in the ANSWER section not allowed to */
	if(dname_pkt_compare(pkt, sname, rrset->dname) != 0) {
	remove_rrset("normalize: removing irrelevant RRset:",
	pkt, msg, prev, &rrset);
	continue;
	}

	/* Follow the CNAME chain. */
	if(rrset->type == LDNS_RR_TYPE_CNAME) {
	struct rrset_parse* nx = rrset->rrset_all_next;
	uint8_t* oldsname = sname;
	/* see if the next one is a DNAME, if so, swap them */
	if(nx && nx->section == LDNS_SECTION_ANSWER &&
	nx->type == LDNS_RR_TYPE_DNAME &&
	nx->rr_count == 1 &&
	pkt_strict_sub(pkt, sname, nx->dname)) {
	/* there is a DNAME after this CNAME, it
	* is in the ANSWER section, and the DNAME
	* applies to the name we cover */
	/* check if the alias of the DNAME equals
	* this CNAME */
	uint8_t alias[LDNS_MAX_DOMAINLEN+1];
	size_t aliaslen = 0;
	uint8_t* t = NULL;
	size_t tlen = 0;
	if(synth_cname(sname, snamelen, nx, alias,
	&aliaslen, pkt) &&
	parse_get_cname_target(rrset, &t, &tlen) &&
	dname_pkt_compare(pkt, alias, t) == 0) {
	/* the synthesized CNAME equals the
	* current CNAME. This CNAME is the
	* one that the DNAME creates, and this
	* CNAME is better capitalised */
	verbose(VERB_ALGO, "normalize: re-order of DNAME and its CNAME");
	if(prev) prev->rrset_all_next = nx;
	else msg->rrset_first = nx;
	if(nx->rrset_all_next == NULL)
	msg->rrset_last = rrset;
	rrset->rrset_all_next =
	nx->rrset_all_next;
	nx->rrset_all_next = rrset;
	/* prev = nx; unused, enable if there
	* is other rrset removal code after
	* this */
	}
	}

	/* move to next name in CNAME chain */
	if(!parse_get_cname_target(rrset, &sname, &snamelen))
	return 0;
	prev = rrset;
	rrset = rrset->rrset_all_next;
	/* in CNAME ANY response, can have data after CNAME */
	if(qinfo->qtype == LDNS_RR_TYPE_ANY) {
	while(rrset && rrset->section ==
	LDNS_SECTION_ANSWER &&
	dname_pkt_compare(pkt, oldsname,
	rrset->dname) == 0) {
	prev = rrset;
	rrset = rrset->rrset_all_next;
	}
	}
	continue;
	}

	/* Otherwise, make sure that the RRset matches the qtype. */
	if(qinfo->qtype != LDNS_RR_TYPE_ANY &&
	qinfo->qtype != rrset->type) {
	remove_rrset("normalize: removing irrelevant RRset:",
	pkt, msg, prev, &rrset);
	continue;
	}

	/* Mark the additional names from relevant rrset as OK. */
	/* only for RRsets that match the query name, other ones
	* will be removed by sanitize, so no additional for them */
	if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) == 0)
	mark_additional_rrset(pkt, msg, rrset);

	prev = rrset;
	rrset = rrset->rrset_all_next;
	}

	/* Mark additional names from AUTHORITY */
	while(rrset && rrset->section == LDNS_SECTION_AUTHORITY) {
	if(rrset->type==LDNS_RR_TYPE_DNAME \|\|
	rrset->type==LDNS_RR_TYPE_CNAME \|\|
	rrset->type==LDNS_RR_TYPE_A \|\|
	rrset->type==LDNS_RR_TYPE_AAAA) {
	remove_rrset("normalize: removing irrelevant "
	"RRset:", pkt, msg, prev, &rrset);
	continue;
	}
	/* only one NS set allowed in authority section */
	if(rrset->type==LDNS_RR_TYPE_NS) {
	/* NS set must be pertinent to the query */
	if(!sub_of_pkt(pkt, qinfo->qname, rrset->dname)) {
	remove_rrset("normalize: removing irrelevant "
	"RRset:", pkt, msg, prev, &rrset);
	continue;
	}
	+ /* we don't want NS sets for NXDOMAIN answers,
	+ * because they could contain poisonous contents,
	+ * from. eg. fragmentation attacks, inserted after
	+ * long RRSIGs in the packet get to the packet
	+ * border and such */
	+ /* also for NODATA answers */
	+ if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN \|\|
	+ (FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR
	+ && soa_in_auth(msg) && msg->an_rrsets == 0)) {
	+ remove_rrset("normalize: removing irrelevant "
	+ "RRset:", pkt, msg, prev, &rrset);
	+ continue;
	+ }
	if(nsset == NULL) {
	nsset = rrset;
	} else {
	remove_rrset("normalize: removing irrelevant "
	"RRset:", pkt, msg, prev, &rrset);
	continue;
	}
	}
	/* if this is type DS and we query for type DS we just got
	* a referral answer for our type DS query, fix packet */
	if(rrset->type==LDNS_RR_TYPE_DS &&
	qinfo->qtype == LDNS_RR_TYPE_DS &&
	dname_pkt_compare(pkt, qinfo->qname, rrset->dname) == 0) {
	rrset->section = LDNS_SECTION_ANSWER;
	msg->ancount = rrset->rr_count + rrset->rrsig_count;
	msg->nscount = 0;
	msg->arcount = 0;
	msg->an_rrsets = 1;
	msg->ns_rrsets = 0;
	msg->ar_rrsets = 0;
	msg->rrset_count = 1;
	msg->rrset_first = rrset;
	msg->rrset_last = rrset;
	rrset->rrset_all_next = NULL;
	return 1;
	}
	mark_additional_rrset(pkt, msg, rrset);
	prev = rrset;
	rrset = rrset->rrset_all_next;
	}

	/* For each record in the additional section, remove it if it is an
	* address record and not in the collection of additional names
	* found in ANSWER and AUTHORITY. */
	/* These records have not been marked OK previously */
	while(rrset && rrset->section == LDNS_SECTION_ADDITIONAL) {
	/* FIXME: what about other types? */
	if(rrset->type==LDNS_RR_TYPE_A \|\|
	rrset->type==LDNS_RR_TYPE_AAAA)
	{
	if((rrset->flags & RRSET_SCRUB_OK)) {
	/* remove flag to clean up flags variable */
	rrset->flags &= ~RRSET_SCRUB_OK;
	} else {
	remove_rrset("normalize: removing irrelevant "
	"RRset:", pkt, msg, prev, &rrset);
	continue;
	}
	}
	if(rrset->type==LDNS_RR_TYPE_DNAME \|\|
	rrset->type==LDNS_RR_TYPE_CNAME \|\|
	rrset->type==LDNS_RR_TYPE_NS) {
	remove_rrset("normalize: removing irrelevant "
	"RRset:", pkt, msg, prev, &rrset);
	continue;
	}
	prev = rrset;
	rrset = rrset->rrset_all_next;
	}

	return 1;
	}

	/**
	* Store potential poison in the cache (only if hardening disabled).
	* The rrset is stored in the cache but removed from the message.
	* So that it will be used for infrastructure purposes, but not be
	* returned to the client.
	* @param pkt: packet
	* @param msg: message parsed
	* @param env: environment with cache
	* @param rrset: to store.
	*/
	static void
	store_rrset(sldns_buffer* pkt, struct msg_parse* msg, struct module_env* env,
	struct rrset_parse* rrset)
	{
	struct ub_packed_rrset_key* k;
	struct packed_rrset_data* d;
	struct rrset_ref ref;
	time_t now = *env->now;

	k = alloc_special_obtain(env->alloc);
	if(!k)
	return;
	k->entry.data = NULL;
	if(!parse_copy_decompress_rrset(pkt, msg, rrset, NULL, k)) {
	alloc_special_release(env->alloc, k);
	return;
	}
	d = (struct packed_rrset_data*)k->entry.data;
	packed_rrset_ttl_add(d, now);
	ref.key = k;
	ref.id = k->id;
	/ignore ret: it was in the cache, ref updated /
	(void)rrset_cache_update(env->rrset_cache, &ref, env->alloc, now);
	}

	-/** Check if there are SOA records in the authority section (negative) */
	-static int
	-soa_in_auth(struct msg_parse* msg)
	-{
	- struct rrset_parse* rrset;
	- for(rrset = msg->rrset_first; rrset; rrset = rrset->rrset_all_next)
	- if(rrset->type == LDNS_RR_TYPE_SOA &&
	- rrset->section == LDNS_SECTION_AUTHORITY)
	- return 1;
	- return 0;
	-}
	-
	/**
	* Check if right hand name in NSEC is within zone
	* @param rrset: the NSEC rrset
	* @param zonename: the zone name.
	* @return true if BAD.
	*/
	static int sanitize_nsec_is_overreach(struct rrset_parse* rrset,
	uint8_t* zonename)
	{
	struct rr_parse* rr;
	uint8_t* rhs;
	size_t len;
	log_assert(rrset->type == LDNS_RR_TYPE_NSEC);
	for(rr = rrset->rr_first; rr; rr = rr->next) {
	rhs = rr->ttl_data+4+2;
	len = sldns_read_uint16(rr->ttl_data+4);
	if(!dname_valid(rhs, len)) {
	/* malformed domain name in rdata */
	return 1;
	}
	if(!dname_subdomain_c(rhs, zonename)) {
	/* overreaching */
	return 1;
	}
	}
	/* all NSEC RRs OK */
	return 0;
	}

	/**
	* Given a response event, remove suspect RRsets from the response.
	* "Suspect" rrsets are potentially poison. Note that this routine expects
	* the response to be in a "normalized" state -- that is, all "irrelevant"
	* RRsets have already been removed, CNAMEs are in order, etc.
	*
	* @param pkt: packet.
	* @param msg: msg to normalize.
	* @param qinfo: the question originally asked.
	* @param zonename: name of server zone.
	* @param env: module environment with config and cache.
	* @param ie: iterator environment with private address data.
	* @return 0 on error.
	*/
	static int
	scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
	struct iter_env* ie)
	{
	int del_addi = 0; /* if additional-holding rrsets are deleted, we
	do not trust the normalized additional-A-AAAA any more */
	struct rrset_parse* rrset, *prev;
	prev = NULL;
	rrset = msg->rrset_first;

	/* the first DNAME is allowed to stay. It needs checking before
	* it can be used from the cache. After normalization, an initial
	* DNAME will have a correctly synthesized CNAME after it. */
	if(rrset && rrset->type == LDNS_RR_TYPE_DNAME &&
	rrset->section == LDNS_SECTION_ANSWER &&
	pkt_strict_sub(pkt, qinfo->qname, rrset->dname) &&
	pkt_sub(pkt, rrset->dname, zonename)) {
	prev = rrset; /* DNAME allowed to stay in answer section */
	rrset = rrset->rrset_all_next;
	}

	/* remove all records from the answer section that are
	* not the same domain name as the query domain name.
	* The answer section should contain rrsets with the same name
	* as the question. For DNAMEs a CNAME has been synthesized.
	* Wildcards have the query name in answer section.
	* ANY queries get query name in answer section.
	* Remainders of CNAME chains are cut off and resolved by iterator. */
	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
	if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) != 0) {
	if(has_additional(rrset->type)) del_addi = 1;
	remove_rrset("sanitize: removing extraneous answer "
	"RRset:", pkt, msg, prev, &rrset);
	continue;
	}
	prev = rrset;
	rrset = rrset->rrset_all_next;
	}

	/* At this point, we brutally remove ALL rrsets that aren't
	* children of the originating zone. The idea here is that,
	* as far as we know, the server that we contacted is ONLY
	* authoritative for the originating zone. It, of course, MAY
	* be authoritative for any other zones, and of course, MAY
	* NOT be authoritative for some subdomains of the originating
	* zone. */
	prev = NULL;
	rrset = msg->rrset_first;
	while(rrset) {

	/* remove private addresses */
	if( (rrset->type == LDNS_RR_TYPE_A \|\|
	rrset->type == LDNS_RR_TYPE_AAAA)) {

	/* do not set servfail since this leads to too
	* many drops of other people using rfc1918 space */
	/* also do not remove entire rrset, unless all records
	* in it are bad */
	if(priv_rrset_bad(ie->priv, pkt, rrset)) {
	remove_rrset(NULL, pkt, msg, prev, &rrset);
	continue;
	}
	}

	/* skip DNAME records -- they will always be followed by a
	* synthesized CNAME, which will be relevant.
	* FIXME: should this do something differently with DNAME
	* rrsets NOT in Section.ANSWER? */
	/* But since DNAME records are also subdomains of the zone,
	* same check can be used */

	if(!pkt_sub(pkt, rrset->dname, zonename)) {
	if(msg->an_rrsets == 0 &&
	rrset->type == LDNS_RR_TYPE_NS &&
	rrset->section == LDNS_SECTION_AUTHORITY &&
	FLAGS_GET_RCODE(msg->flags) ==
	LDNS_RCODE_NOERROR && !soa_in_auth(msg) &&
	sub_of_pkt(pkt, zonename, rrset->dname)) {
	/* noerror, nodata and this NS rrset is above
	* the zone. This is LAME!
	* Leave in the NS for lame classification. */
	/* remove everything from the additional
	* (we dont want its glue that was approved
	* during the normalize action) */
	del_addi = 1;
	} else if(!env->cfg->harden_glue && (
	rrset->type == LDNS_RR_TYPE_A \|\|
	rrset->type == LDNS_RR_TYPE_AAAA)) {
	/* store in cache! Since it is relevant
	* (from normalize) it will be picked up
	* from the cache to be used later */
	store_rrset(pkt, msg, env, rrset);
	remove_rrset("sanitize: storing potential "
	"poison RRset:", pkt, msg, prev, &rrset);
	continue;
	} else {
	if(has_additional(rrset->type)) del_addi = 1;
	remove_rrset("sanitize: removing potential "
	"poison RRset:", pkt, msg, prev, &rrset);
	continue;
	}
	}
	if(del_addi && rrset->section == LDNS_SECTION_ADDITIONAL) {
	remove_rrset("sanitize: removing potential "
	"poison reference RRset:", pkt, msg, prev, &rrset);
	continue;
	}
	/* check if right hand side of NSEC is within zone */
	if(rrset->type == LDNS_RR_TYPE_NSEC &&
	sanitize_nsec_is_overreach(rrset, zonename)) {
	remove_rrset("sanitize: removing overreaching NSEC "
	"RRset:", pkt, msg, prev, &rrset);
	continue;
	}
	prev = rrset;
	rrset = rrset->rrset_all_next;
	}
	return 1;
	}

	int
	scrub_message(sldns_buffer* pkt, struct msg_parse* msg,
	struct query_info* qinfo, uint8_t* zonename, struct regional* region,
	struct module_env* env, struct iter_env* ie)
	{
	/* basic sanity checks */
	log_nametypeclass(VERB_ALGO, "scrub for", zonename, LDNS_RR_TYPE_NS,
	qinfo->qclass);
	if(msg->qdcount > 1)
	return 0;
	if( !(msg->flags&BIT_QR) )
	return 0;
	msg->flags &= ~(BIT_AD\|BIT_Z); /* force off bit AD and Z */

	/* make sure that a query is echoed back when NOERROR or NXDOMAIN */
	/* this is not required for basic operation but is a forgery
	* resistance (security) feature */
	if((FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR \|\|
	FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN) &&
	msg->qdcount == 0)
	return 0;

	/* if a query is echoed back, make sure it is correct. Otherwise,
	* this may be not a reply to our query. */
	if(msg->qdcount == 1) {
	if(dname_pkt_compare(pkt, msg->qname, qinfo->qname) != 0)
	return 0;
	if(msg->qtype != qinfo->qtype \|\| msg->qclass != qinfo->qclass)
	return 0;
	}

	/* normalize the response, this cleans up the additional. */
	if(!scrub_normalize(pkt, msg, qinfo, region))
	return 0;
	/* delete all out-of-zone information */
	if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie))
	return 0;
	return 1;
	}
	Index: head/contrib/unbound/iterator/iter_utils.c
	===================================================================
	--- head/contrib/unbound/iterator/iter_utils.c (revision 349719)
	+++ head/contrib/unbound/iterator/iter_utils.c (revision 349720)
	@@ -1,1212 +1,1380 @@
	/*
	* iterator/iter_utils.c - iterative resolver module utility functions.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains functions to assist the iterator module.
	* Configuration options. Forward zones.
	*/
	#include "config.h"
	#include "iterator/iter_utils.h"
	#include "iterator/iterator.h"
	#include "iterator/iter_hints.h"
	#include "iterator/iter_fwd.h"
	#include "iterator/iter_donotq.h"
	#include "iterator/iter_delegpt.h"
	#include "iterator/iter_priv.h"
	#include "services/cache/infra.h"
	#include "services/cache/dns.h"
	#include "services/cache/rrset.h"
	#include "util/net_help.h"
	#include "util/module.h"
	#include "util/log.h"
	#include "util/config_file.h"
	#include "util/regional.h"
	#include "util/data/msgparse.h"
	#include "util/data/dname.h"
	#include "util/random.h"
	#include "util/fptr_wlist.h"
	#include "validator/val_anchor.h"
	#include "validator/val_kcache.h"
	#include "validator/val_kentry.h"
	#include "validator/val_utils.h"
	#include "validator/val_sigcrypt.h"
	#include "sldns/sbuffer.h"
	#include "sldns/str2wire.h"

	/** time when nameserver glue is said to be 'recent' */
	#define SUSPICION_RECENT_EXPIRY 86400
	/** penalty to validation failed blacklisted IPs */
	#define BLACKLIST_PENALTY (USEFUL_SERVER_TOP_TIMEOUT*4)

	/** fillup fetch policy array */
	static void
	fetch_fill(struct iter_env* ie, const char* str)
	{
	char* s = (char)str, e;
	int i;
	for(i=0; i<ie->max_dependency_depth+1; i++) {
	ie->target_fetch_policy[i] = strtol(s, &e, 10);
	if(s == e)
	fatal_exit("cannot parse fetch policy number %s", s);
	s = e;
	}
	}

	/** Read config string that represents the target fetch policy */
	static int
	read_fetch_policy(struct iter_env* ie, const char* str)
	{
	int count = cfg_count_numbers(str);
	if(count < 1) {
	log_err("Cannot parse target fetch policy: \"%s\"", str);
	return 0;
	}
	ie->max_dependency_depth = count - 1;
	ie->target_fetch_policy = (int*)calloc(
	(size_t)ie->max_dependency_depth+1, sizeof(int));
	if(!ie->target_fetch_policy) {
	log_err("alloc fetch policy: out of memory");
	return 0;
	}
	fetch_fill(ie, str);
	return 1;
	}

	/** apply config caps whitelist items to name tree */
	static int
	caps_white_apply_cfg(rbtree_type* ntree, struct config_file* cfg)
	{
	struct config_strlist* p;
	for(p=cfg->caps_whitelist; p; p=p->next) {
	struct name_tree_node* n;
	size_t len;
	uint8_t* nm = sldns_str2wire_dname(p->str, &len);
	if(!nm) {
	log_err("could not parse %s", p->str);
	return 0;
	}
	n = (struct name_tree_node)calloc(1, sizeof(n));
	if(!n) {
	log_err("out of memory");
	free(nm);
	return 0;
	}
	n->node.key = n;
	n->name = nm;
	n->len = len;
	n->labs = dname_count_labels(nm);
	n->dclass = LDNS_RR_CLASS_IN;
	if(!name_tree_insert(ntree, n, nm, len, n->labs, n->dclass)) {
	/* duplicate element ignored, idempotent */
	free(n->name);
	free(n);
	}
	}
	name_tree_init_parents(ntree);
	return 1;
	}

	int
	iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
	{
	int i;
	/* target fetch policy */
	if(!read_fetch_policy(iter_env, cfg->target_fetch_policy))
	return 0;
	for(i=0; i<iter_env->max_dependency_depth+1; i++)
	verbose(VERB_QUERY, "target fetch policy for level %d is %d",
	i, iter_env->target_fetch_policy[i]);

	if(!iter_env->donotq)
	iter_env->donotq = donotq_create();
	if(!iter_env->donotq \|\| !donotq_apply_cfg(iter_env->donotq, cfg)) {
	log_err("Could not set donotqueryaddresses");
	return 0;
	}
	if(!iter_env->priv)
	iter_env->priv = priv_create();
	if(!iter_env->priv \|\| !priv_apply_cfg(iter_env->priv, cfg)) {
	log_err("Could not set private addresses");
	return 0;
	}
	if(cfg->caps_whitelist) {
	if(!iter_env->caps_white)
	iter_env->caps_white = rbtree_create(name_tree_compare);
	if(!iter_env->caps_white \|\| !caps_white_apply_cfg(
	iter_env->caps_white, cfg)) {
	log_err("Could not set capsforid whitelist");
	return 0;
	}

	}
	iter_env->supports_ipv6 = cfg->do_ip6;
	iter_env->supports_ipv4 = cfg->do_ip4;
	return 1;
	}

	/** filter out unsuitable targets
	* @param iter_env: iterator environment with ipv6-support flag.
	* @param env: module environment with infra cache.
	* @param name: zone name
	* @param namelen: length of name
	* @param qtype: query type (host order).
	* @param now: current time
	* @param a: address in delegation point we are examining.
	* @return an integer that signals the target suitability.
	* as follows:
	* -1: The address should be omitted from the list.
	* Because:
	* o The address is bogus (DNSSEC validation failure).
	* o Listed as donotquery
	* o is ipv6 but no ipv6 support (in operating system).
	* o is ipv4 but no ipv4 support (in operating system).
	* o is lame
	* Otherwise, an rtt in milliseconds.
	* 0 .. USEFUL_SERVER_TOP_TIMEOUT-1
	* The roundtrip time timeout estimate. less than 2 minutes.
	* Note that util/rtt.c has a MIN_TIMEOUT of 50 msec, thus
	* values 0 .. 49 are not used, unless that is changed.
	* USEFUL_SERVER_TOP_TIMEOUT
	* This value exactly is given for unresponsive blacklisted.
	* USEFUL_SERVER_TOP_TIMEOUT+1
	* For non-blacklisted servers: huge timeout, but has traffic.
	* USEFUL_SERVER_TOP_TIMEOUT*1 ..
	* parent-side lame servers get this penalty. A dispreferential
	* server. (lame in delegpt).
	* USEFUL_SERVER_TOP_TIMEOUT*2 ..
	* dnsseclame servers get penalty
	* USEFUL_SERVER_TOP_TIMEOUT*3 ..
	* recursion lame servers get penalty
	* UNKNOWN_SERVER_NICENESS
	* If no information is known about the server, this is
	* returned. 376 msec or so.
	* +BLACKLIST_PENALTY (of USEFUL_TOP_TIMEOUT*4) for dnssec failed IPs.
	*
	* When a final value is chosen that is dnsseclame ; dnsseclameness checking
	* is turned off (so we do not discard the reply).
	* When a final value is chosen that is recursionlame; RD bit is set on query.
	* Because of the numbers this means recursionlame also have dnssec lameness
	* checking turned off.
	*/
	static int
	iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
	uint8_t* name, size_t namelen, uint16_t qtype, time_t now,
	struct delegpt_addr* a)
	{
	int rtt, lame, reclame, dnsseclame;
	if(a->bogus)
	return -1; /* address of server is bogus */
	if(donotq_lookup(iter_env->donotq, &a->addr, a->addrlen)) {
	log_addr(VERB_ALGO, "skip addr on the donotquery list",
	&a->addr, a->addrlen);
	return -1; /* server is on the donotquery list */
	}
	if(!iter_env->supports_ipv6 && addr_is_ip6(&a->addr, a->addrlen)) {
	return -1; /* there is no ip6 available */
	}
	if(!iter_env->supports_ipv4 && !addr_is_ip6(&a->addr, a->addrlen)) {
	return -1; /* there is no ip4 available */
	}
	/* check lameness - need zone , class info */
	if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen,
	name, namelen, qtype, &lame, &dnsseclame, &reclame,
	&rtt, now)) {
	log_addr(VERB_ALGO, "servselect", &a->addr, a->addrlen);
	verbose(VERB_ALGO, " rtt=%d%s%s%s%s", rtt,
	lame?" LAME":"",
	dnsseclame?" DNSSEC_LAME":"",
	reclame?" REC_LAME":"",
	a->lame?" ADDR_LAME":"");
	if(lame)
	return -1; /* server is lame */
	else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT)
	/* server is unresponsive,
	* we used to return TOP_TIMEOUT, but fairly useless,
	* because if == TOP_TIMEOUT is dropped because
	* blacklisted later, instead, remove it here, so
	* other choices (that are not blacklisted) can be
	* tried */
	return -1;
	/* select remainder from worst to best */
	else if(reclame)
	return rtt+USEFUL_SERVER_TOP_TIMEOUT3; / nonpref */
	else if(dnsseclame \|\| a->dnsseclame)
	return rtt+USEFUL_SERVER_TOP_TIMEOUT2; / nonpref */
	else if(a->lame)
	return rtt+USEFUL_SERVER_TOP_TIMEOUT+1; /* nonpref */
	else return rtt;
	}
	/* no server information present */
	if(a->dnsseclame)
	return UNKNOWN_SERVER_NICENESS+USEFUL_SERVER_TOP_TIMEOUT2; / nonpref */
	else if(a->lame)
	return USEFUL_SERVER_TOP_TIMEOUT+1+UNKNOWN_SERVER_NICENESS; /* nonpref */
	return UNKNOWN_SERVER_NICENESS;
	}

	/** lookup RTT information, and also store fastest rtt (if any) */
	static int
	iter_fill_rtt(struct iter_env* iter_env, struct module_env* env,
	uint8_t* name, size_t namelen, uint16_t qtype, time_t now,
	- struct delegpt* dp, int* best_rtt, struct sock_list* blacklist)
	+ struct delegpt* dp, int* best_rtt, struct sock_list* blacklist,
	+ size_t* num_suitable_results)
	{
	int got_it = 0;
	struct delegpt_addr* a;
	+ *num_suitable_results = 0;
	+
	if(dp->bogus)
	return 0; /* NS bogus, all bogus, nothing found */
	for(a=dp->result_list; a; a = a->next_result) {
	a->sel_rtt = iter_filter_unsuitable(iter_env, env,
	name, namelen, qtype, now, a);
	if(a->sel_rtt != -1) {
	if(sock_list_find(blacklist, &a->addr, a->addrlen))
	a->sel_rtt += BLACKLIST_PENALTY;

	if(!got_it) {
	*best_rtt = a->sel_rtt;
	got_it = 1;
	} else if(a->sel_rtt < *best_rtt) {
	*best_rtt = a->sel_rtt;
	}
	+ (*num_suitable_results)++;
	}
	}
	return got_it;
	}

	+/** compare two rtts, return -1, 0 or 1 */
	+static int
	+rtt_compare(const void* x, const void* y)
	+{
	+ if((int)x == (int)y)
	+ return 0;
	+ if((int)x > (int)y)
	+ return 1;
	+ return -1;
	+}
	+
	+/** get RTT for the Nth fastest server */
	+static int
	+nth_rtt(struct delegpt_addr* result_list, size_t num_results, size_t n)
	+{
	+ int rtt_band;
	+ size_t i;
	+ int* rtt_list, *rtt_index;
	+
	+ if(num_results < 1 \|\| n >= num_results) {
	+ return -1;
	+ }
	+
	+ rtt_list = calloc(num_results, sizeof(int));
	+ if(!rtt_list) {
	+ log_err("malloc failure: allocating rtt_list");
	+ return -1;
	+ }
	+ rtt_index = rtt_list;
	+
	+ for(i=0; i<num_results && result_list; i++) {
	+ if(result_list->sel_rtt != -1) {
	+ *rtt_index = result_list->sel_rtt;
	+ rtt_index++;
	+ }
	+ result_list=result_list->next_result;
	+ }
	+ qsort(rtt_list, num_results, sizeof(*rtt_list), rtt_compare);
	+
	+ log_assert(n > 0);
	+ rtt_band = rtt_list[n-1];
	+ free(rtt_list);
	+
	+ return rtt_band;
	+}
	+
	/** filter the address list, putting best targets at front,
	* returns number of best targets (or 0, no suitable targets) */
	static int
	iter_filter_order(struct iter_env* iter_env, struct module_env* env,
	uint8_t* name, size_t namelen, uint16_t qtype, time_t now,
	struct delegpt* dp, int* selected_rtt, int open_target,
	struct sock_list* blacklist, time_t prefetch)
	{
	- int got_num = 0, low_rtt = 0, swap_to_front, rtt_band = RTT_BAND;
	+ int got_num = 0, low_rtt = 0, swap_to_front, rtt_band = RTT_BAND, nth;
	+ size_t num_results;
	struct delegpt_addr* a, n, prev=NULL;

	/* fillup sel_rtt and find best rtt in the bunch */
	got_num = iter_fill_rtt(iter_env, env, name, namelen, qtype, now, dp,
	- &low_rtt, blacklist);
	+ &low_rtt, blacklist, &num_results);
	if(got_num == 0)
	return 0;
	if(low_rtt >= USEFUL_SERVER_TOP_TIMEOUT &&
	(delegpt_count_missing_targets(dp) > 0 \|\| open_target > 0)) {
	verbose(VERB_ALGO, "Bad choices, trying to get more choice");
	return 0; /* we want more choice. The best choice is a bad one.
	return 0 to force the caller to fetch more */
	}

	- if(env->cfg->low_rtt_permil != 0 && prefetch == 0 &&
	- low_rtt < env->cfg->low_rtt &&
	- ub_random_max(env->rnd, 1000) < env->cfg->low_rtt_permil) {
	+ if(env->cfg->fast_server_permil != 0 && prefetch == 0 &&
	+ num_results > env->cfg->fast_server_num &&
	+ ub_random_max(env->rnd, 1000) < env->cfg->fast_server_permil) {
	/* the query is not prefetch, but for a downstream client,
	- * there is a low_rtt (fast) server. We choose that x% of the
	- * time */
	- /* pick rtt numbers from 0..LOWBAND_RTT */
	- rtt_band = env->cfg->low_rtt - low_rtt;
	+ * there are more servers available then the fastest N we want
	+ * to choose from. Limit our choice to the fastest servers. */
	+ nth = nth_rtt(dp->result_list, num_results,
	+ env->cfg->fast_server_num);
	+ if(nth > 0) {
	+ rtt_band = nth - low_rtt;
	+ if(rtt_band > RTT_BAND)
	+ rtt_band = RTT_BAND;
	+ }
	}

	got_num = 0;
	a = dp->result_list;
	while(a) {
	/* skip unsuitable targets */
	if(a->sel_rtt == -1) {
	prev = a;
	a = a->next_result;
	continue;
	}
	/* classify the server address and determine what to do */
	swap_to_front = 0;
	if(a->sel_rtt >= low_rtt && a->sel_rtt - low_rtt <= rtt_band) {
	got_num++;
	swap_to_front = 1;
	} else if(a->sel_rtt<low_rtt && low_rtt-a->sel_rtt<=rtt_band) {
	got_num++;
	swap_to_front = 1;
	}
	/* swap to front if necessary, or move to next result */
	if(swap_to_front && prev) {
	n = a->next_result;
	prev->next_result = n;
	a->next_result = dp->result_list;
	dp->result_list = a;
	a = n;
	} else {
	prev = a;
	a = a->next_result;
	}
	}
	*selected_rtt = low_rtt;

	if (env->cfg->prefer_ip6) {
	int got_num6 = 0;
	int low_rtt6 = 0;
	int i;
	int attempt = -1; /* filter to make sure addresses have
	less attempts on them than the first, to force round
	robin when all the IPv6 addresses fail */
	int num4ok = 0; /* number ip4 at low attempt count */
	int num4_lowrtt = 0;
	prev = NULL;
	a = dp->result_list;
	for(i = 0; i < got_num; i++) {
	swap_to_front = 0;
	if(a->addr.ss_family != AF_INET6 && attempt == -1) {
	/* if we only have ip4 at low attempt count,
	* then ip6 is failing, and we need to
	* select one of the remaining IPv4 addrs */
	attempt = a->attempts;
	num4ok++;
	num4_lowrtt = a->sel_rtt;
	} else if(a->addr.ss_family != AF_INET6 && attempt == a->attempts) {
	num4ok++;
	if(num4_lowrtt == 0 \|\| a->sel_rtt < num4_lowrtt) {
	num4_lowrtt = a->sel_rtt;
	}
	}
	if(a->addr.ss_family == AF_INET6) {
	if(attempt == -1) {
	attempt = a->attempts;
	} else if(a->attempts > attempt) {
	break;
	}
	got_num6++;
	swap_to_front = 1;
	if(low_rtt6 == 0 \|\| a->sel_rtt < low_rtt6) {
	low_rtt6 = a->sel_rtt;
	}
	}
	/* swap to front if IPv6, or move to next result */
	if(swap_to_front && prev) {
	n = a->next_result;
	prev->next_result = n;
	a->next_result = dp->result_list;
	dp->result_list = a;
	a = n;
	} else {
	prev = a;
	a = a->next_result;
	}
	}
	if(got_num6 > 0) {
	got_num = got_num6;
	*selected_rtt = low_rtt6;
	} else if(num4ok > 0) {
	got_num = num4ok;
	*selected_rtt = num4_lowrtt;
	}
	}
	return got_num;
	}

	struct delegpt_addr*
	iter_server_selection(struct iter_env* iter_env,
	struct module_env* env, struct delegpt* dp,
	uint8_t* name, size_t namelen, uint16_t qtype, int* dnssec_lame,
	int* chase_to_rd, int open_target, struct sock_list* blacklist,
	time_t prefetch)
	{
	int sel;
	int selrtt;
	struct delegpt_addr* a, *prev;
	int num = iter_filter_order(iter_env, env, name, namelen, qtype,
	*env->now, dp, &selrtt, open_target, blacklist, prefetch);

	if(num == 0)
	return NULL;
	verbose(VERB_ALGO, "selrtt %d", selrtt);
	if(selrtt > BLACKLIST_PENALTY) {
	if(selrtt-BLACKLIST_PENALTY > USEFUL_SERVER_TOP_TIMEOUT*3) {
	verbose(VERB_ALGO, "chase to "
	"blacklisted recursion lame server");
	*chase_to_rd = 1;
	}
	if(selrtt-BLACKLIST_PENALTY > USEFUL_SERVER_TOP_TIMEOUT*2) {
	verbose(VERB_ALGO, "chase to "
	"blacklisted dnssec lame server");
	*dnssec_lame = 1;
	}
	} else {
	if(selrtt > USEFUL_SERVER_TOP_TIMEOUT*3) {
	verbose(VERB_ALGO, "chase to recursion lame server");
	*chase_to_rd = 1;
	}
	if(selrtt > USEFUL_SERVER_TOP_TIMEOUT*2) {
	verbose(VERB_ALGO, "chase to dnssec lame server");
	*dnssec_lame = 1;
	}
	if(selrtt == USEFUL_SERVER_TOP_TIMEOUT) {
	verbose(VERB_ALGO, "chase to blacklisted lame server");
	return NULL;
	}
	}

	if(num == 1) {
	a = dp->result_list;
	if(++a->attempts < OUTBOUND_MSG_RETRY)
	return a;
	dp->result_list = a->next_result;
	return a;
	}

	/* randomly select a target from the list */
	log_assert(num > 1);
	/* grab secure random number, to pick unexpected server.
	* also we need it to be threadsafe. */
	sel = ub_random_max(env->rnd, num);
	a = dp->result_list;
	prev = NULL;
	while(sel > 0 && a) {
	prev = a;
	a = a->next_result;
	sel--;
	}
	if(!a) /* robustness */
	return NULL;
	if(++a->attempts < OUTBOUND_MSG_RETRY)
	return a;
	/* remove it from the delegation point result list */
	if(prev)
	prev->next_result = a->next_result;
	else dp->result_list = a->next_result;
	return a;
	}

	struct dns_msg*
	dns_alloc_msg(sldns_buffer* pkt, struct msg_parse* msg,
	struct regional* region)
	{
	struct dns_msg* m = (struct dns_msg*)regional_alloc(region,
	sizeof(struct dns_msg));
	if(!m)
	return NULL;
	memset(m, 0, sizeof(*m));
	if(!parse_create_msg(pkt, msg, NULL, &m->qinfo, &m->rep, region)) {
	log_err("malloc failure: allocating incoming dns_msg");
	return NULL;
	}
	return m;
	}

	struct dns_msg*
	dns_copy_msg(struct dns_msg* from, struct regional* region)
	{
	struct dns_msg* m = (struct dns_msg*)regional_alloc(region,
	sizeof(struct dns_msg));
	if(!m)
	return NULL;
	m->qinfo = from->qinfo;
	if(!(m->qinfo.qname = regional_alloc_init(region, from->qinfo.qname,
	from->qinfo.qname_len)))
	return NULL;
	if(!(m->rep = reply_info_copy(from->rep, NULL, region)))
	return NULL;
	return m;
	}

	void
	iter_dns_store(struct module_env* env, struct query_info* msgqinf,
	struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
	struct regional* region, uint16_t flags)
	{
	if(!dns_cache_store(env, msgqinf, msgrep, is_referral, leeway,
	pside, region, flags))
	log_err("out of memory: cannot store data in cache");
	}

	int
	iter_ns_probability(struct ub_randstate* rnd, int n, int m)
	{
	int sel;
	if(n == m) /* 100% chance */
	return 1;
	/* we do not need secure random numbers here, but
	* we do need it to be threadsafe, so we use this */
	sel = ub_random_max(rnd, m);
	return (sel < n);
	}

	/** detect dependency cycle for query and target */
	static int
	causes_cycle(struct module_qstate* qstate, uint8_t* name, size_t namelen,
	uint16_t t, uint16_t c)
	{
	struct query_info qinf;
	qinf.qname = name;
	qinf.qname_len = namelen;
	qinf.qtype = t;
	qinf.qclass = c;
	qinf.local_alias = NULL;
	fptr_ok(fptr_whitelist_modenv_detect_cycle(
	qstate->env->detect_cycle));
	return (*qstate->env->detect_cycle)(qstate, &qinf,
	(uint16_t)(BIT_RD\|BIT_CD), qstate->is_priming,
	qstate->is_valrec);
	}

	void
	iter_mark_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)
	{
	struct delegpt_ns* ns;
	for(ns = dp->nslist; ns; ns = ns->next) {
	if(ns->resolved)
	continue;
	/* see if this ns as target causes dependency cycle */
	if(causes_cycle(qstate, ns->name, ns->namelen,
	LDNS_RR_TYPE_AAAA, qstate->qinfo.qclass) \|\|
	causes_cycle(qstate, ns->name, ns->namelen,
	LDNS_RR_TYPE_A, qstate->qinfo.qclass)) {
	log_nametypeclass(VERB_QUERY, "skipping target due "
	"to dependency cycle (harden-glue: no may "
	"fix some of the cycles)",
	ns->name, LDNS_RR_TYPE_A,
	qstate->qinfo.qclass);
	ns->resolved = 1;
	}
	}
	}

	void
	iter_mark_pside_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)
	{
	struct delegpt_ns* ns;
	for(ns = dp->nslist; ns; ns = ns->next) {
	if(ns->done_pside4 && ns->done_pside6)
	continue;
	/* see if this ns as target causes dependency cycle */
	if(causes_cycle(qstate, ns->name, ns->namelen,
	LDNS_RR_TYPE_A, qstate->qinfo.qclass)) {
	log_nametypeclass(VERB_QUERY, "skipping target due "
	"to dependency cycle", ns->name,
	LDNS_RR_TYPE_A, qstate->qinfo.qclass);
	ns->done_pside4 = 1;
	}
	if(causes_cycle(qstate, ns->name, ns->namelen,
	LDNS_RR_TYPE_AAAA, qstate->qinfo.qclass)) {
	log_nametypeclass(VERB_QUERY, "skipping target due "
	"to dependency cycle", ns->name,
	LDNS_RR_TYPE_AAAA, qstate->qinfo.qclass);
	ns->done_pside6 = 1;
	}
	}
	}

	int
	iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
	struct delegpt* dp)
	{
	struct delegpt_ns* ns;
	/* check:
	* o RD qflag is on.
	* o no addresses are provided.
	* o all NS items are required glue.
	* OR
	* o RD qflag is on.
	* o no addresses are provided.
	* o the query is for one of the nameservers in dp,
	* and that nameserver is a glue-name for this dp.
	*/
	if(!(qflags&BIT_RD))
	return 0;
	/* either available or unused targets */
	if(dp->usable_list \|\| dp->result_list)
	return 0;

	/* see if query is for one of the nameservers, which is glue */
	if( (qinfo->qtype == LDNS_RR_TYPE_A \|\|
	qinfo->qtype == LDNS_RR_TYPE_AAAA) &&
	dname_subdomain_c(qinfo->qname, dp->name) &&
	delegpt_find_ns(dp, qinfo->qname, qinfo->qname_len))
	return 1;

	for(ns = dp->nslist; ns; ns = ns->next) {
	if(ns->resolved) /* skip failed targets */
	continue;
	if(!dname_subdomain_c(ns->name, dp->name))
	return 0; /* one address is not required glue */
	}
	return 1;
	}

	int
	iter_qname_indicates_dnssec(struct module_env* env, struct query_info *qinfo)
	{
	struct trust_anchor* a;
	if(!env \|\| !env->anchors \|\| !qinfo \|\| !qinfo->qname)
	return 0;
	/* a trust anchor exists above the name? */
	if((a=anchors_lookup(env->anchors, qinfo->qname, qinfo->qname_len,
	qinfo->qclass))) {
	if(a->numDS == 0 && a->numDNSKEY == 0) {
	/* insecure trust point */
	lock_basic_unlock(&a->lock);
	return 0;
	}
	lock_basic_unlock(&a->lock);
	return 1;
	}
	/* no trust anchor above it. */
	return 0;
	}

	int
	iter_indicates_dnssec(struct module_env* env, struct delegpt* dp,
	struct dns_msg* msg, uint16_t dclass)
	{
	struct trust_anchor* a;
	/* information not available, !env->anchors can be common */
	if(!env \|\| !env->anchors \|\| !dp \|\| !dp->name)
	return 0;
	/* a trust anchor exists with this name, RRSIGs expected */
	if((a=anchor_find(env->anchors, dp->name, dp->namelabs, dp->namelen,
	dclass))) {
	if(a->numDS == 0 && a->numDNSKEY == 0) {
	/* insecure trust point */
	lock_basic_unlock(&a->lock);
	return 0;
	}
	lock_basic_unlock(&a->lock);
	return 1;
	}
	/* see if DS rrset was given, in AUTH section */
	if(msg && msg->rep &&
	reply_find_rrset_section_ns(msg->rep, dp->name, dp->namelen,
	LDNS_RR_TYPE_DS, dclass))
	return 1;
	/* look in key cache */
	if(env->key_cache) {
	struct key_entry_key* kk = key_cache_obtain(env->key_cache,
	dp->name, dp->namelen, dclass, env->scratch, *env->now);
	if(kk) {
	if(query_dname_compare(kk->name, dp->name) == 0) {
	if(key_entry_isgood(kk) \|\| key_entry_isbad(kk)) {
	regional_free_all(env->scratch);
	return 1;
	} else if(key_entry_isnull(kk)) {
	regional_free_all(env->scratch);
	return 0;
	}
	}
	regional_free_all(env->scratch);
	}
	}
	return 0;
	}

	int
	iter_msg_has_dnssec(struct dns_msg* msg)
	{
	size_t i;
	if(!msg \|\| !msg->rep)
	return 0;
	for(i=0; i<msg->rep->an_numrrsets + msg->rep->ns_numrrsets; i++) {
	if(((struct packed_rrset_data*)msg->rep->rrsets[i]->
	entry.data)->rrsig_count > 0)
	return 1;
	}
	/* empty message has no DNSSEC info, with DNSSEC the reply is
	* not empty (NSEC) */
	return 0;
	}

	int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp,
	enum response_type type, uint16_t dclass)
	{
	if(!msg \|\| !dp \|\| !msg->rep \|\| !dp->name)
	return 0;
	/* SOA RRset - always from reply zone */
	if(reply_find_rrset_section_an(msg->rep, dp->name, dp->namelen,
	LDNS_RR_TYPE_SOA, dclass) \|\|
	reply_find_rrset_section_ns(msg->rep, dp->name, dp->namelen,
	LDNS_RR_TYPE_SOA, dclass))
	return 1;
	if(type == RESPONSE_TYPE_REFERRAL) {
	size_t i;
	/* if it adds a single label, i.e. we expect .com,
	* and referral to example.com. NS ... , then origin zone
	* is .com. For a referral to sub.example.com. NS ... then
	* we do not know, since example.com. may be in between. */
	for(i=0; i<msg->rep->an_numrrsets+msg->rep->ns_numrrsets;
	i++) {
	struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
	if(ntohs(s->rk.type) == LDNS_RR_TYPE_NS &&
	ntohs(s->rk.rrset_class) == dclass) {
	int l = dname_count_labels(s->rk.dname);
	if(l == dp->namelabs + 1 &&
	dname_strict_subdomain(s->rk.dname,
	l, dp->name, dp->namelabs))
	return 1;
	}
	}
	return 0;
	}
	log_assert(type==RESPONSE_TYPE_ANSWER \|\| type==RESPONSE_TYPE_CNAME);
	/* not a referral, and not lame delegation (upwards), so,
	* any NS rrset must be from the zone itself */
	if(reply_find_rrset_section_an(msg->rep, dp->name, dp->namelen,
	LDNS_RR_TYPE_NS, dclass) \|\|
	reply_find_rrset_section_ns(msg->rep, dp->name, dp->namelen,
	LDNS_RR_TYPE_NS, dclass))
	return 1;
	/* a DNSKEY set is expected at the zone apex as well */
	/* this is for 'minimal responses' for DNSKEYs */
	if(reply_find_rrset_section_an(msg->rep, dp->name, dp->namelen,
	LDNS_RR_TYPE_DNSKEY, dclass))
	return 1;
	return 0;
	}

	/**
	* check equality of two rrsets
	* @param k1: rrset
	* @param k2: rrset
	* @return true if equal
	*/
	static int
	rrset_equal(struct ub_packed_rrset_key* k1, struct ub_packed_rrset_key* k2)
	{
	struct packed_rrset_data* d1 = (struct packed_rrset_data*)
	k1->entry.data;
	struct packed_rrset_data* d2 = (struct packed_rrset_data*)
	k2->entry.data;
	size_t i, t;
	if(k1->rk.dname_len != k2->rk.dname_len \|\|
	k1->rk.flags != k2->rk.flags \|\|
	k1->rk.type != k2->rk.type \|\|
	k1->rk.rrset_class != k2->rk.rrset_class \|\|
	query_dname_compare(k1->rk.dname, k2->rk.dname) != 0)
	return 0;
	if( /* do not check ttl: d1->ttl != d2->ttl \|\| */
	d1->count != d2->count \|\|
	d1->rrsig_count != d2->rrsig_count \|\|
	d1->trust != d2->trust \|\|
	d1->security != d2->security)
	return 0;
	t = d1->count + d1->rrsig_count;
	for(i=0; i<t; i++) {
	if(d1->rr_len[i] != d2->rr_len[i] \|\|
	/* no ttl check: d1->rr_ttl[i] != d2->rr_ttl[i] \|\|*/
	memcmp(d1->rr_data[i], d2->rr_data[i],
	d1->rr_len[i]) != 0)
	return 0;
	}
	return 1;
	}

	+/** compare rrsets and sort canonically. Compares rrset name, type, class.
	+ * return 0 if equal, +1 if x > y, and -1 if x < y.
	+ */
	+static int
	+rrset_canonical_sort_cmp(const void* x, const void* y)
	+{
	+ struct ub_packed_rrset_key* rrx = (struct ub_packed_rrset_key*)x;
	+ struct ub_packed_rrset_key* rry = (struct ub_packed_rrset_key*)y;
	+ int r = dname_canonical_compare(rrx->rk.dname, rry->rk.dname);
	+ if(r != 0)
	+ return r;
	+ if(rrx->rk.type != rry->rk.type) {
	+ if(ntohs(rrx->rk.type) > ntohs(rry->rk.type))
	+ return 1;
	+ else return -1;
	+ }
	+ if(rrx->rk.rrset_class != rry->rk.rrset_class) {
	+ if(ntohs(rrx->rk.rrset_class) > ntohs(rry->rk.rrset_class))
	+ return 1;
	+ else return -1;
	+ }
	+ return 0;
	+}
	+
	int
	reply_equal(struct reply_info* p, struct reply_info* q, struct regional* region)
	{
	size_t i;
	+ struct ub_packed_rrset_key sorted_p, sorted_q;
	if(p->flags != q->flags \|\|
	p->qdcount != q->qdcount \|\|
	/* do not check TTL, this may differ */
	/*
	p->ttl != q->ttl \|\|
	p->prefetch_ttl != q->prefetch_ttl \|\|
	*/
	p->security != q->security \|\|
	p->an_numrrsets != q->an_numrrsets \|\|
	p->ns_numrrsets != q->ns_numrrsets \|\|
	p->ar_numrrsets != q->ar_numrrsets \|\|
	p->rrset_count != q->rrset_count)
	return 0;
	+ /* sort the rrsets in the authority and additional sections before
	+ * compare, the query and answer sections are ordered in the sequence
	+ * they should have (eg. one after the other for aliases). */
	+ sorted_p = (struct ub_packed_rrset_key**)regional_alloc_init(
	+ region, p->rrsets, sizeof(sorted_p)p->rrset_count);
	+ if(!sorted_p) return 0;
	+ log_assert(p->an_numrrsets + p->ns_numrrsets + p->ar_numrrsets <=
	+ p->rrset_count);
	+ qsort(sorted_p + p->an_numrrsets, p->ns_numrrsets,
	+ sizeof(*sorted_p), rrset_canonical_sort_cmp);
	+ qsort(sorted_p + p->an_numrrsets + p->ns_numrrsets, p->ar_numrrsets,
	+ sizeof(*sorted_p), rrset_canonical_sort_cmp);
	+
	+ sorted_q = (struct ub_packed_rrset_key**)regional_alloc_init(
	+ region, q->rrsets, sizeof(sorted_q)q->rrset_count);
	+ if(!sorted_q) {
	+ regional_free_all(region);
	+ return 0;
	+ }
	+ log_assert(q->an_numrrsets + q->ns_numrrsets + q->ar_numrrsets <=
	+ q->rrset_count);
	+ qsort(sorted_q + q->an_numrrsets, q->ns_numrrsets,
	+ sizeof(*sorted_q), rrset_canonical_sort_cmp);
	+ qsort(sorted_q + q->an_numrrsets + q->ns_numrrsets, q->ar_numrrsets,
	+ sizeof(*sorted_q), rrset_canonical_sort_cmp);
	+
	+ /* compare the rrsets */
	for(i=0; i<p->rrset_count; i++) {
	- if(!rrset_equal(p->rrsets[i], q->rrsets[i])) {
	- if(!rrset_canonical_equal(region, p->rrsets[i],
	- q->rrsets[i])) {
	+ if(!rrset_equal(sorted_p[i], sorted_q[i])) {
	+ if(!rrset_canonical_equal(region, sorted_p[i],
	+ sorted_q[i])) {
	regional_free_all(region);
	return 0;
	}
	- regional_free_all(region);
	}
	}
	+ regional_free_all(region);
	return 1;
	}

	void
	caps_strip_reply(struct reply_info* rep)
	{
	size_t i;
	if(!rep) return;
	/* see if message is a referral, in which case the additional and
	* NS record cannot be removed */
	/* referrals have the AA flag unset (strict check, not elsewhere in
	* unbound, but for 0x20 this is very convenient). */
	if(!(rep->flags&BIT_AA))
	return;
	/* remove the additional section from the reply */
	if(rep->ar_numrrsets != 0) {
	verbose(VERB_ALGO, "caps fallback: removing additional section");
	rep->rrset_count -= rep->ar_numrrsets;
	rep->ar_numrrsets = 0;
	}
	/* is there an NS set in the authority section to remove? */
	/* the failure case (Cisco firewalls) only has one rrset in authsec */
	for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
	struct ub_packed_rrset_key* s = rep->rrsets[i];
	if(ntohs(s->rk.type) == LDNS_RR_TYPE_NS) {
	/* remove NS rrset and break from loop (loop limits
	* have changed) */
	/* move last rrset into this position (there is no
	* additional section any more) */
	verbose(VERB_ALGO, "caps fallback: removing NS rrset");
	if(i < rep->rrset_count-1)
	rep->rrsets[i]=rep->rrsets[rep->rrset_count-1];
	rep->rrset_count --;
	rep->ns_numrrsets --;
	break;
	}
	}
	}

	int caps_failed_rcode(struct reply_info* rep)
	{
	return !(FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR \|\|
	FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN);
	}

	void
	iter_store_parentside_rrset(struct module_env* env,
	struct ub_packed_rrset_key* rrset)
	{
	struct rrset_ref ref;
	rrset = packed_rrset_copy_alloc(rrset, env->alloc, *env->now);
	if(!rrset) {
	log_err("malloc failure in store_parentside_rrset");
	return;
	}
	rrset->rk.flags \|= PACKED_RRSET_PARENT_SIDE;
	rrset->entry.hash = rrset_key_hash(&rrset->rk);
	ref.key = rrset;
	ref.id = rrset->id;
	/* ignore ret: if it was in the cache, ref updated */
	(void)rrset_cache_update(env->rrset_cache, &ref, env->alloc, *env->now);
	}

	/** fetch NS record from reply, if any */
	static struct ub_packed_rrset_key*
	reply_get_NS_rrset(struct reply_info* rep)
	{
	size_t i;
	for(i=0; i<rep->rrset_count; i++) {
	if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NS)) {
	return rep->rrsets[i];
	}
	}
	return NULL;
	}

	void
	iter_store_parentside_NS(struct module_env* env, struct reply_info* rep)
	{
	struct ub_packed_rrset_key* rrset = reply_get_NS_rrset(rep);
	if(rrset) {
	log_rrset_key(VERB_ALGO, "store parent-side NS", rrset);
	iter_store_parentside_rrset(env, rrset);
	}
	}

	void iter_store_parentside_neg(struct module_env* env,
	struct query_info* qinfo, struct reply_info* rep)
	{
	/* TTL: NS from referral in iq->deleg_msg,
	* or first RR from iq->response,
	* or servfail5secs if !iq->response */
	time_t ttl = NORR_TTL;
	struct ub_packed_rrset_key* neg;
	struct packed_rrset_data* newd;
	if(rep) {
	struct ub_packed_rrset_key* rrset = reply_get_NS_rrset(rep);
	if(!rrset && rep->rrset_count != 0) rrset = rep->rrsets[0];
	if(rrset) ttl = ub_packed_rrset_ttl(rrset);
	}
	/* create empty rrset to store */
	neg = (struct ub_packed_rrset_key*)regional_alloc(env->scratch,
	sizeof(struct ub_packed_rrset_key));
	if(!neg) {
	log_err("out of memory in store_parentside_neg");
	return;
	}
	memset(&neg->entry, 0, sizeof(neg->entry));
	neg->entry.key = neg;
	neg->rk.type = htons(qinfo->qtype);
	neg->rk.rrset_class = htons(qinfo->qclass);
	neg->rk.flags = 0;
	neg->rk.dname = regional_alloc_init(env->scratch, qinfo->qname,
	qinfo->qname_len);
	if(!neg->rk.dname) {
	log_err("out of memory in store_parentside_neg");
	return;
	}
	neg->rk.dname_len = qinfo->qname_len;
	neg->entry.hash = rrset_key_hash(&neg->rk);
	newd = (struct packed_rrset_data*)regional_alloc_zero(env->scratch,
	sizeof(struct packed_rrset_data) + sizeof(size_t) +
	sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t));
	if(!newd) {
	log_err("out of memory in store_parentside_neg");
	return;
	}
	neg->entry.data = newd;
	newd->ttl = ttl;
	/* entry must have one RR, otherwise not valid in cache.
	* put in one RR with empty rdata: those are ignored as nameserver */
	newd->count = 1;
	newd->rrsig_count = 0;
	newd->trust = rrset_trust_ans_noAA;
	newd->rr_len = (size_t)((uint8_t)newd +
	sizeof(struct packed_rrset_data));
	newd->rr_len[0] = 0 /* zero len rdata */ + sizeof(uint16_t);
	packed_rrset_ptr_fixup(newd);
	newd->rr_ttl[0] = newd->ttl;
	sldns_write_uint16(newd->rr_data[0], 0 /* zero len rdata */);
	/* store it */
	log_rrset_key(VERB_ALGO, "store parent-side negative", neg);
	iter_store_parentside_rrset(env, neg);
	}

	int
	iter_lookup_parent_NS_from_cache(struct module_env* env, struct delegpt* dp,
	struct regional* region, struct query_info* qinfo)
	{
	struct ub_packed_rrset_key* akey;
	akey = rrset_cache_lookup(env->rrset_cache, dp->name,
	dp->namelen, LDNS_RR_TYPE_NS, qinfo->qclass,
	PACKED_RRSET_PARENT_SIDE, *env->now, 0);
	if(akey) {
	log_rrset_key(VERB_ALGO, "found parent-side NS in cache", akey);
	dp->has_parent_side_NS = 1;
	/* and mark the new names as lame */
	if(!delegpt_rrset_add_ns(dp, region, akey, 1)) {
	lock_rw_unlock(&akey->entry.lock);
	return 0;
	}
	lock_rw_unlock(&akey->entry.lock);
	}
	return 1;
	}

	int iter_lookup_parent_glue_from_cache(struct module_env* env,
	struct delegpt* dp, struct regional* region, struct query_info* qinfo)
	{
	struct ub_packed_rrset_key* akey;
	struct delegpt_ns* ns;
	size_t num = delegpt_count_targets(dp);
	for(ns = dp->nslist; ns; ns = ns->next) {
	/* get cached parentside A */
	akey = rrset_cache_lookup(env->rrset_cache, ns->name,
	ns->namelen, LDNS_RR_TYPE_A, qinfo->qclass,
	PACKED_RRSET_PARENT_SIDE, *env->now, 0);
	if(akey) {
	log_rrset_key(VERB_ALGO, "found parent-side", akey);
	ns->done_pside4 = 1;
	/* a negative-cache-element has no addresses it adds */
	if(!delegpt_add_rrset_A(dp, region, akey, 1))
	log_err("malloc failure in lookup_parent_glue");
	lock_rw_unlock(&akey->entry.lock);
	}
	/* get cached parentside AAAA */
	akey = rrset_cache_lookup(env->rrset_cache, ns->name,
	ns->namelen, LDNS_RR_TYPE_AAAA, qinfo->qclass,
	PACKED_RRSET_PARENT_SIDE, *env->now, 0);
	if(akey) {
	log_rrset_key(VERB_ALGO, "found parent-side", akey);
	ns->done_pside6 = 1;
	/* a negative-cache-element has no addresses it adds */
	if(!delegpt_add_rrset_AAAA(dp, region, akey, 1))
	log_err("malloc failure in lookup_parent_glue");
	lock_rw_unlock(&akey->entry.lock);
	}
	}
	/* see if new (but lame) addresses have become available */
	return delegpt_count_targets(dp) != num;
	}

	int
	iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd,
	uint16_t* c)
	{
	uint16_t c1 = c, c2 = c;
	int r1 = hints_next_root(hints, &c1);
	int r2 = forwards_next_root(fwd, &c2);
	if(!r1 && !r2) /* got none, end of list */
	return 0;
	else if(!r1) /* got one, return that */
	*c = c2;
	else if(!r2)
	*c = c1;
	else if(c1 < c2) /* got both take smallest */
	*c = c1;
	else *c = c2;
	return 1;
	}

	void
	iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns, uint8_t* z)
	{
	/* Only the DS record for the delegation itself is expected.
	* We allow DS for everything between the bailiwick and the
	* zonecut, thus DS records must be at or above the zonecut.
	* And the DS records must be below the server authority zone.
	* The answer section is already scrubbed. */
	size_t i = msg->rep->an_numrrsets;
	while(i < (msg->rep->an_numrrsets + msg->rep->ns_numrrsets)) {
	struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
	if(ntohs(s->rk.type) == LDNS_RR_TYPE_DS &&
	(!ns \|\| !dname_subdomain_c(ns->rk.dname, s->rk.dname)
	\|\| query_dname_compare(z, s->rk.dname) == 0)) {
	log_nametypeclass(VERB_ALGO, "removing irrelevant DS",
	s->rk.dname, ntohs(s->rk.type),
	ntohs(s->rk.rrset_class));
	memmove(msg->rep->rrsets+i, msg->rep->rrsets+i+1,
	sizeof(struct ub_packed_rrset_key)
	(msg->rep->rrset_count-i-1));
	msg->rep->ns_numrrsets--;
	msg->rep->rrset_count--;
	/* stay at same i, but new record */
	continue;
	}
	i++;
	}
	}

	+void
	+iter_scrub_nxdomain(struct dns_msg* msg)
	+{
	+ if(msg->rep->an_numrrsets == 0)
	+ return;
	+
	+ memmove(msg->rep->rrsets, msg->rep->rrsets+msg->rep->an_numrrsets,
	+ sizeof(struct ub_packed_rrset_key)
	+ (msg->rep->rrset_count-msg->rep->an_numrrsets));
	+ msg->rep->rrset_count -= msg->rep->an_numrrsets;
	+ msg->rep->an_numrrsets = 0;
	+}
	+
	void iter_dec_attempts(struct delegpt* dp, int d)
	{
	struct delegpt_addr* a;
	for(a=dp->target_list; a; a = a->next_target) {
	if(a->attempts >= OUTBOUND_MSG_RETRY) {
	/* add back to result list */
	a->next_result = dp->result_list;
	dp->result_list = a;
	}
	if(a->attempts > d)
	a->attempts -= d;
	else a->attempts = 0;
	}
	}

	void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old)
	{
	struct delegpt_addr* a, o, prev;
	for(a=dp->target_list; a; a = a->next_target) {
	o = delegpt_find_addr(old, &a->addr, a->addrlen);
	if(o) {
	log_addr(VERB_ALGO, "copy attempt count previous dp",
	&a->addr, a->addrlen);
	a->attempts = o->attempts;
	}
	}
	prev = NULL;
	a = dp->usable_list;
	while(a) {
	if(a->attempts >= OUTBOUND_MSG_RETRY) {
	log_addr(VERB_ALGO, "remove from usable list dp",
	&a->addr, a->addrlen);
	/* remove from result list */
	if(prev)
	prev->next_usable = a->next_usable;
	else dp->usable_list = a->next_usable;
	/* prev stays the same */
	a = a->next_usable;
	continue;
	}
	prev = a;
	a = a->next_usable;
	}
	}

	int
	iter_ds_toolow(struct dns_msg* msg, struct delegpt* dp)
	{
	/* if for query example.com, there is example.com SOA or a subdomain
	* of example.com, then we are too low and need to fetch NS. */
	size_t i;
	/* if we have a DNAME or CNAME we are probably wrong */
	/* if we have a qtype DS in the answer section, its fine */
	for(i=0; i < msg->rep->an_numrrsets; i++) {
	struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
	if(ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME \|\|
	ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
	/* not the right answer, maybe too low, check the
	* RRSIG signer name (if there is any) for a hint
	* that it is from the dp zone anyway */
	uint8_t* sname;
	size_t slen;
	val_find_rrset_signer(s, &sname, &slen);
	if(sname && query_dname_compare(dp->name, sname)==0)
	return 0; /* it is fine, from the right dp */
	return 1;
	}
	if(ntohs(s->rk.type) == LDNS_RR_TYPE_DS)
	return 0; /* fine, we have a DS record */
	}
	for(i=msg->rep->an_numrrsets;
	i < msg->rep->an_numrrsets + msg->rep->ns_numrrsets; i++) {
	struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
	if(ntohs(s->rk.type) == LDNS_RR_TYPE_SOA) {
	if(dname_subdomain_c(s->rk.dname, msg->qinfo.qname))
	return 1; /* point is too low */
	if(query_dname_compare(s->rk.dname, dp->name)==0)
	return 0; /* right dp */
	}
	if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC \|\|
	ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
	uint8_t* sname;
	size_t slen;
	val_find_rrset_signer(s, &sname, &slen);
	if(sname && query_dname_compare(dp->name, sname)==0)
	return 0; /* it is fine, from the right dp */
	return 1;
	}
	}
	/* we do not know */
	return 1;
	}

	int iter_dp_cangodown(struct query_info* qinfo, struct delegpt* dp)
	{
	/* no delegation point, do not see how we can go down,
	* robust check, it should really exist */
	if(!dp) return 0;

	/* see if dp equals the qname, then we cannot go down further */
	if(query_dname_compare(qinfo->qname, dp->name) == 0)
	return 0;
	/* if dp is one label above the name we also cannot go down further */
	if(dname_count_labels(qinfo->qname) == dp->namelabs+1)
	return 0;
	return 1;
	+}
	+
	+int
	+iter_stub_fwd_no_cache(struct module_qstate qstate, struct query_info qinf)
	+{
	+ struct iter_hints_stub *stub;
	+ struct delegpt *dp;
	+
	+ /* Check for stub. */
	+ stub = hints_lookup_stub(qstate->env->hints, qinf->qname,
	+ qinf->qclass, NULL);
	+ dp = forwards_lookup(qstate->env->fwds, qinf->qname, qinf->qclass);
	+
	+ /* see if forward or stub is more pertinent */
	+ if(stub && stub->dp && dp) {
	+ if(dname_strict_subdomain(dp->name, dp->namelabs,
	+ stub->dp->name, stub->dp->namelabs)) {
	+ stub = NULL; /* ignore stub, forward is lower */
	+ } else {
	+ dp = NULL; /* ignore forward, stub is lower */
	+ }
	+ }
	+
	+ /* check stub */
	+ if (stub != NULL && stub->dp != NULL) {
	+ if(stub->dp->no_cache) {
	+ char qname[255+1];
	+ char dpname[255+1];
	+ dname_str(qinf->qname, qname);
	+ dname_str(stub->dp->name, dpname);
	+ verbose(VERB_ALGO, "stub for %s %s has no_cache", qname, dpname);
	+ }
	+ return (stub->dp->no_cache);
	+ }
	+
	+ /* Check for forward. */
	+ if (dp) {
	+ if(dp->no_cache) {
	+ char qname[255+1];
	+ char dpname[255+1];
	+ dname_str(qinf->qname, qname);
	+ dname_str(dp->name, dpname);
	+ verbose(VERB_ALGO, "forward for %s %s has no_cache", qname, dpname);
	+ }
	+ return (dp->no_cache);
	+ }
	+ return 0;
	}
	Index: head/contrib/unbound/iterator/iter_utils.h
	===================================================================
	--- head/contrib/unbound/iterator/iter_utils.h (revision 349719)
	+++ head/contrib/unbound/iterator/iter_utils.h (revision 349720)
	@@ -1,372 +1,388 @@
	/*
	* iterator/iter_utils.h - iterative resolver module utility functions.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains functions to assist the iterator module.
	* Configuration options. Forward zones.
	*/

	#ifndef ITERATOR_ITER_UTILS_H
	#define ITERATOR_ITER_UTILS_H
	#include "iterator/iter_resptype.h"
	struct sldns_buffer;
	struct iter_env;
	struct iter_hints;
	struct iter_forwards;
	struct config_file;
	struct module_env;
	struct delegpt_addr;
	struct delegpt;
	struct regional;
	struct msg_parse;
	struct ub_randstate;
	struct query_info;
	struct reply_info;
	struct module_qstate;
	struct sock_list;
	struct ub_packed_rrset_key;

	/**
	* Process config options and set iterator module state.
	* Sets default values if no config is found.
	* @param iter_env: iterator module state.
	* @param cfg: config options.
	* @return 0 on error.
	*/
	int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);

	/**
	* Select a valid, nice target to send query to.
	* Sorting and removing unsuitable targets is combined.
	*
	* @param iter_env: iterator module global state, with ip6 enabled and
	* do-not-query-addresses.
	* @param env: environment with infra cache (lameness, rtt info).
	* @param dp: delegation point with result list.
	* @param name: zone name (for lameness check).
	* @param namelen: length of name.
	* @param qtype: query type that we want to send.
	* @param dnssec_lame: set to 1, if a known dnssec-lame server is selected
	* these are not preferred, but are used as a last resort.
	* @param chase_to_rd: set to 1 if a known recursion lame server is selected
	* these are not preferred, but are used as a last resort.
	* @param open_target: number of currently outstanding target queries.
	* If we wait for these, perhaps more server addresses become available.
	* @param blacklist: the IP blacklist to use.
	* @param prefetch: if not 0, prefetch is in use for this query.
	* This means the query can have different timing, because prefetch is
	* not waited upon by the downstream client, and thus a good time to
	* perform exploration of other targets.
	* @return best target or NULL if no target.
	* if not null, that target is removed from the result list in the dp.
	*/
	struct delegpt_addr* iter_server_selection(struct iter_env* iter_env,
	struct module_env* env, struct delegpt* dp, uint8_t* name,
	size_t namelen, uint16_t qtype, int* dnssec_lame,
	int* chase_to_rd, int open_target, struct sock_list* blacklist,
	time_t prefetch);

	/**
	* Allocate dns_msg from parsed msg, in regional.
	* @param pkt: packet.
	* @param msg: parsed message (cleaned and ready for regional allocation).
	* @param regional: regional to use for allocation.
	* @return newly allocated dns_msg, or NULL on memory error.
	*/
	struct dns_msg* dns_alloc_msg(struct sldns_buffer* pkt, struct msg_parse* msg,
	struct regional* regional);

	/**
	* Copy a dns_msg to this regional.
	* @param from: dns message, also in regional.
	* @param regional: regional to use for allocation.
	* @return newly allocated dns_msg, or NULL on memory error.
	*/
	struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);

	/**
	* Allocate a dns_msg with malloc/alloc structure and store in dns cache.
	* @param env: environment, with alloc structure and dns cache.
	* @param qinf: query info, the query for which answer is stored.
	* @param rep: reply in dns_msg from dns_alloc_msg for example.
	* @param is_referral: If true, then the given message to be stored is a
	* referral. The cache implementation may use this as a hint.
	* @param leeway: prefetch TTL leeway to expire old rrsets quicker.
	* @param pside: true if dp is parentside, thus message is 'fresh' and NS
	* can be prefetch-updates.
	* @param region: to copy modified (cache is better) rrs back to.
	* @param flags: with BIT_CD for dns64 AAAA translated queries.
	* @return void, because we are not interested in alloc errors,
	* the iterator and validator can operate on the results in their
	* scratch space (the qstate.region) and are not dependent on the cache.
	* It is useful to log the alloc failure (for the server operator),
	* but the query resolution can continue without cache storage.
	*/
	void iter_dns_store(struct module_env* env, struct query_info* qinf,
	struct reply_info* rep, int is_referral, time_t leeway, int pside,
	struct regional* region, uint16_t flags);

	/**
	* Select randomly with n/m probability.
	* For shuffle NS records for address fetching.
	* @param rnd: random table
	* @param n: probability.
	* @param m: divisor for probability.
	* @return true with n/m probability.
	*/
	int iter_ns_probability(struct ub_randstate* rnd, int n, int m);

	/**
	* Mark targets that result in a dependency cycle as done, so they
	* will not get selected as targets.
	* @param qstate: query state.
	* @param dp: delegpt to mark ns in.
	*/
	void iter_mark_cycle_targets(struct module_qstate* qstate, struct delegpt* dp);

	/**
	* Mark targets that result in a dependency cycle as done, so they
	* will not get selected as targets. For the parent-side lookups.
	* @param qstate: query state.
	* @param dp: delegpt to mark ns in.
	*/
	void iter_mark_pside_cycle_targets(struct module_qstate* qstate,
	struct delegpt* dp);

	/**
	* See if delegation is useful or offers immediately no targets for
	* further recursion.
	* @param qinfo: query name and type
	* @param qflags: query flags with RD flag
	* @param dp: delegpt to check.
	* @return true if dp is useless.
	*/
	int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
	struct delegpt* dp);

	/**
	* See if qname has DNSSEC needs. This is true if there is a trust anchor above
	* it. Whether there is an insecure delegation to the data is unknown.
	* @param env: environment with anchors.
	* @param qinfo: query name and class.
	* @return true if trust anchor above qname, false if no anchor or insecure
	* point above qname.
	*/
	int iter_qname_indicates_dnssec(struct module_env* env,
	struct query_info *qinfo);

	/**
	* See if delegation is expected to have DNSSEC information (RRSIGs) in
	* its answers, or not. Inspects delegation point (name), trust anchors,
	* and delegation message (DS RRset) to determine this.
	* @param env: module env with trust anchors.
	* @param dp: delegation point.
	* @param msg: delegation message, with DS if a secure referral.
	* @param dclass: class of query.
	* @return 1 if dnssec is expected, 0 if not or insecure point above qname.
	*/
	int iter_indicates_dnssec(struct module_env* env, struct delegpt* dp,
	struct dns_msg* msg, uint16_t dclass);

	/**
	* See if a message contains DNSSEC.
	* This is examined by looking for RRSIGs. With DNSSEC a valid answer,
	* nxdomain, nodata, referral or cname reply has RRSIGs in answer or auth
	* sections, sigs on answer data, SOA, DS, or NSEC/NSEC3 records.
	* @param msg: message to examine.
	* @return true if DNSSEC information was found.
	*/
	int iter_msg_has_dnssec(struct dns_msg* msg);

	/**
	* See if a message is known to be from a certain zone.
	* This looks for SOA or NS rrsets, for answers.
	* For referrals, when one label is delegated, the zone is detected.
	* Does not look at signatures.
	* @param msg: the message to inspect.
	* @param dp: delegation point with zone name to look for.
	* @param type: type of message.
	* @param dclass: class of query.
	* @return true if message is certain to be from zone in dp->name.
	* false if not sure (empty msg), or not from the zone.
	*/
	int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp,
	enum response_type type, uint16_t dclass);

	/**
	* Check if two replies are equal
	* For fallback procedures
	* @param p: reply one. The reply has rrset data pointers in region.
	* Does not check rrset-IDs
	* @param q: reply two
	* @param region: scratch buffer.
	* @return if one and two are equal.
	*/
	int reply_equal(struct reply_info* p, struct reply_info* q, struct regional* region);

	/**
	* Remove unused bits from the reply if possible.
	* So that caps-for-id (0x20) fallback is more likely to be successful.
	* This removes like, the additional section, and NS record in the authority
	* section if those records are gratuitous (not for a referral).
	* @param rep: the reply to strip stuff out of.
	*/
	void caps_strip_reply(struct reply_info* rep);

	/**
	* see if reply has a 'useful' rcode for capsforid comparison, so
	* not SERVFAIL or REFUSED, and thus NOERROR or NXDOMAIN.
	* @param rep: reply to check.
	* @return true if the rcode is a bad type of message.
	*/
	int caps_failed_rcode(struct reply_info* rep);

	/**
	* Store parent-side rrset in separate rrset cache entries for later
	* last-resort * lookups in case the child-side versions of this information
	* fails.
	* @param env: environment with cache, time, ...
	* @param rrset: the rrset to store (copied).
	* Failure to store is logged, but otherwise ignored.
	*/
	void iter_store_parentside_rrset(struct module_env* env,
	struct ub_packed_rrset_key* rrset);

	/**
	* Store parent-side NS records from a referral message
	* @param env: environment with cache, time, ...
	* @param rep: response with NS rrset.
	* Failure to store is logged, but otherwise ignored.
	*/
	void iter_store_parentside_NS(struct module_env* env, struct reply_info* rep);

	/**
	* Store parent-side negative element, the parentside rrset does not exist,
	* creates an rrset with empty rdata in the rrset cache with PARENTSIDE flag.
	* @param env: environment with cache, time, ...
	* @param qinfo: the identity of the rrset that is missing.
	* @param rep: delegation response or answer response, to glean TTL from.
	* (malloc) failure is logged but otherwise ignored.
	*/
	void iter_store_parentside_neg(struct module_env* env,
	struct query_info* qinfo, struct reply_info* rep);

	/**
	* Add parent NS record if that exists in the cache. This is both new
	* information and acts like a timeout throttle on retries.
	* @param env: query env with rrset cache and time.
	* @param dp: delegation point to store result in. Also this dp is used to
	* see which NS name is needed.
	* @param region: region to alloc result in.
	* @param qinfo: pertinent information, the qclass.
	* @return false on malloc failure.
	* if true, the routine worked and if such cached information
	* existed dp->has_parent_side_NS is set true.
	*/
	int iter_lookup_parent_NS_from_cache(struct module_env* env,
	struct delegpt* dp, struct regional* region, struct query_info* qinfo);

	/**
	* Add parent-side glue if that exists in the cache. This is both new
	* information and acts like a timeout throttle on retries to fetch them.
	* @param env: query env with rrset cache and time.
	* @param dp: delegation point to store result in. Also this dp is used to
	* see which NS name is needed.
	* @param region: region to alloc result in.
	* @param qinfo: pertinent information, the qclass.
	* @return: true, it worked, no malloc failures, and new addresses (lame)
	* have been added, giving extra options as query targets.
	*/
	int iter_lookup_parent_glue_from_cache(struct module_env* env,
	struct delegpt* dp, struct regional* region, struct query_info* qinfo);

	/**
	* Lookup next root-hint or root-forward entry.
	* @param hints: the hints.
	* @param fwd: the forwards.
	* @param c: the class to start searching at. 0 means find first one.
	* @return false if no classes found, true if found and returned in c.
	*/
	int iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd,
	uint16_t* c);

	/**
	* Remove DS records that are inappropriate before they are cached.
	* @param msg: the response to scrub.
	* @param ns: RRSET that is the NS record for the referral.
	* if NULL, then all DS records are removed from the authority section.
	* @param z: zone name that the response is from.
	*/
	void iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns,
	uint8_t* z);

	/**
	+ * Prepare an NXDOMAIN message to be used for a subdomain answer by removing all
	+ * RRs from the ANSWER section.
	+ * @param msg: the response to scrub.
	+ */
	+void iter_scrub_nxdomain(struct dns_msg* msg);
	+
	+/**
	* Remove query attempts from all available ips. For 0x20.
	* @param dp: delegpt.
	* @param d: decrease.
	*/
	void iter_dec_attempts(struct delegpt* dp, int d);

	/**
	* Add retry counts from older delegpt to newer delegpt.
	* Does not waste time on timeout'd (or other failing) addresses.
	* @param dp: new delegationpoint.
	* @param old: old delegationpoint.
	*/
	void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old);

	/**
	* See if a DS response (type ANSWER) is too low: a nodata answer with
	* a SOA record in the authority section at-or-below the qchase.qname.
	* Also returns true if we are not sure (i.e. empty message, CNAME nosig).
	* @param msg: the response.
	* @param dp: the dp name is used to check if the RRSIG gives a clue that
	* it was originated from the correct nameserver.
	* @return true if too low.
	*/
	int iter_ds_toolow(struct dns_msg* msg, struct delegpt* dp);

	/**
	* See if delegpt can go down a step to the qname or not
	* @param qinfo: the query name looked up.
	* @param dp: checked if the name can go lower to the qname
	* @return true if can go down, false if that would not be possible.
	* the current response seems to be the one and only, best possible, response.
	*/
	int iter_dp_cangodown(struct query_info* qinfo, struct delegpt* dp);
	+
	+/**
	+ * Lookup if no_cache is set in stub or fwd.
	+ * @param qstate: query state with env with hints and fwds.
	+ * @param qinf: query name to lookup for.
	+ * @return true if no_cache is set in stub or fwd.
	+ */
	+int iter_stub_fwd_no_cache(struct module_qstate *qstate,
	+ struct query_info *qinf);

	#endif /* ITERATOR_ITER_UTILS_H */
	Index: head/contrib/unbound/iterator/iterator.c
	===================================================================
	--- head/contrib/unbound/iterator/iterator.c (revision 349719)
	+++ head/contrib/unbound/iterator/iterator.c (revision 349720)
	@@ -1,3894 +1,3899 @@
	/*
	* iterator/iterator.c - iterative resolver DNS query response module
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains a module that performs recursive iterative DNS query
	* processing.
	*/

	#include "config.h"
	#include "iterator/iterator.h"
	#include "iterator/iter_utils.h"
	#include "iterator/iter_hints.h"
	#include "iterator/iter_fwd.h"
	#include "iterator/iter_donotq.h"
	#include "iterator/iter_delegpt.h"
	#include "iterator/iter_resptype.h"
	#include "iterator/iter_scrub.h"
	#include "iterator/iter_priv.h"
	#include "validator/val_neg.h"
	#include "services/cache/dns.h"
	#include "services/cache/infra.h"
	#include "services/authzone.h"
	#include "util/module.h"
	#include "util/netevent.h"
	#include "util/net_help.h"
	#include "util/regional.h"
	#include "util/data/dname.h"
	#include "util/data/msgencode.h"
	#include "util/fptr_wlist.h"
	#include "util/config_file.h"
	#include "util/random.h"
	#include "sldns/rrdef.h"
	#include "sldns/wire2str.h"
	#include "sldns/str2wire.h"
	#include "sldns/parseutil.h"
	#include "sldns/sbuffer.h"

	+/* in msec */
	+int UNKNOWN_SERVER_NICENESS = 376;
	+
	int
	iter_init(struct module_env* env, int id)
	{
	struct iter_env* iter_env = (struct iter_env*)calloc(1,
	sizeof(struct iter_env));
	if(!iter_env) {
	log_err("malloc failure");
	return 0;
	}
	env->modinfo[id] = (void*)iter_env;

	lock_basic_init(&iter_env->queries_ratelimit_lock);
	lock_protect(&iter_env->queries_ratelimit_lock,
	&iter_env->num_queries_ratelimited,
	sizeof(iter_env->num_queries_ratelimited));

	if(!iter_apply_cfg(iter_env, env->cfg)) {
	log_err("iterator: could not apply configuration settings.");
	return 0;
	}

	return 1;
	}

	/** delete caps_whitelist element */
	static void
	caps_free(struct rbnode_type* n, void* ATTR_UNUSED(d))
	{
	if(n) {
	free(((struct name_tree_node*)n)->name);
	free(n);
	}
	}

	void
	iter_deinit(struct module_env* env, int id)
	{
	struct iter_env* iter_env;
	if(!env \|\| !env->modinfo[id])
	return;
	iter_env = (struct iter_env*)env->modinfo[id];
	lock_basic_destroy(&iter_env->queries_ratelimit_lock);
	free(iter_env->target_fetch_policy);
	priv_delete(iter_env->priv);
	donotq_delete(iter_env->donotq);
	if(iter_env->caps_white) {
	traverse_postorder(iter_env->caps_white, caps_free, NULL);
	free(iter_env->caps_white);
	}
	free(iter_env);
	env->modinfo[id] = NULL;
	}

	/** new query for iterator */
	static int
	iter_new(struct module_qstate* qstate, int id)
	{
	struct iter_qstate* iq = (struct iter_qstate*)regional_alloc(
	qstate->region, sizeof(struct iter_qstate));
	qstate->minfo[id] = iq;
	if(!iq)
	return 0;
	memset(iq, 0, sizeof(*iq));
	iq->state = INIT_REQUEST_STATE;
	iq->final_state = FINISHED_STATE;
	iq->an_prepend_list = NULL;
	iq->an_prepend_last = NULL;
	iq->ns_prepend_list = NULL;
	iq->ns_prepend_last = NULL;
	iq->dp = NULL;
	iq->depth = 0;
	iq->num_target_queries = 0;
	iq->num_current_queries = 0;
	iq->query_restart_count = 0;
	iq->referral_count = 0;
	iq->sent_count = 0;
	iq->ratelimit_ok = 0;
	iq->target_count = NULL;
	iq->wait_priming_stub = 0;
	iq->refetch_glue = 0;
	iq->dnssec_expected = 0;
	iq->dnssec_lame_query = 0;
	iq->chase_flags = qstate->query_flags;
	/* Start with the (current) qname. */
	iq->qchase = qstate->qinfo;
	outbound_list_init(&iq->outlist);
	iq->minimise_count = 0;
	iq->minimise_timeout_count = 0;
	if (qstate->env->cfg->qname_minimisation)
	iq->minimisation_state = INIT_MINIMISE_STATE;
	else
	iq->minimisation_state = DONOT_MINIMISE_STATE;

	memset(&iq->qinfo_out, 0, sizeof(struct query_info));
	return 1;
	}

	/**
	* Transition to the next state. This can be used to advance a currently
	* processing event. It cannot be used to reactivate a forEvent.
	*
	* @param iq: iterator query state
	* @param nextstate The state to transition to.
	* @return true. This is so this can be called as the return value for the
	* actual process*State() methods. (Transitioning to the next state
	* implies further processing).
	*/
	static int
	next_state(struct iter_qstate* iq, enum iter_state nextstate)
	{
	/* If transitioning to a "response" state, make sure that there is a
	* response */
	if(iter_state_is_responsestate(nextstate)) {
	if(iq->response == NULL) {
	log_err("transitioning to response state sans "
	"response.");
	}
	}
	iq->state = nextstate;
	return 1;
	}

	/**
	* Transition an event to its final state. Final states always either return
	* a result up the module chain, or reactivate a dependent event. Which
	* final state to transition to is set in the module state for the event when
	* it was created, and depends on the original purpose of the event.
	*
	* The response is stored in the qstate->buf buffer.
	*
	* @param iq: iterator query state
	* @return false. This is so this method can be used as the return value for
	* the processState methods. (Transitioning to the final state
	*/
	static int
	final_state(struct iter_qstate* iq)
	{
	return next_state(iq, iq->final_state);
	}

	/**
	* Callback routine to handle errors in parent query states
	* @param qstate: query state that failed.
	* @param id: module id.
	* @param super: super state.
	*/
	static void
	error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
	{
	struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id];

	if(qstate->qinfo.qtype == LDNS_RR_TYPE_A \|\|
	qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA) {
	/* mark address as failed. */
	struct delegpt_ns* dpns = NULL;
	super_iq->num_target_queries--;
	if(super_iq->dp)
	dpns = delegpt_find_ns(super_iq->dp,
	qstate->qinfo.qname, qstate->qinfo.qname_len);
	if(!dpns) {
	/* not interested */
	/* this can happen, for eg. qname minimisation asked
	* for an NXDOMAIN to be validated, and used qtype
	* A for that, and the error of that, the name, is
	* not listed in super_iq->dp */
	verbose(VERB_ALGO, "subq error, but not interested");
	log_query_info(VERB_ALGO, "superq", &super->qinfo);
	return;
	} else {
	/* see if the failure did get (parent-lame) info */
	if(!cache_fill_missing(super->env, super_iq->qchase.qclass,
	super->region, super_iq->dp))
	log_err("out of memory adding missing");
	}
	dpns->resolved = 1; /* mark as failed */
	}
	if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS) {
	/* prime failed to get delegation */
	super_iq->dp = NULL;
	}
	/* evaluate targets again */
	super_iq->state = QUERYTARGETS_STATE;
	/* super becomes runnable, and will process this change */
	}

	/**
	* Return an error to the client
	* @param qstate: our query state
	* @param id: module id
	* @param rcode: error code (DNS errcode).
	* @return: 0 for use by caller, to make notation easy, like:
	* return error_response(..).
	*/
	static int
	error_response(struct module_qstate* qstate, int id, int rcode)
	{
	verbose(VERB_QUERY, "return error response %s",
	sldns_lookup_by_id(sldns_rcodes, rcode)?
	sldns_lookup_by_id(sldns_rcodes, rcode)->name:"??");
	qstate->return_rcode = rcode;
	qstate->return_msg = NULL;
	qstate->ext_state[id] = module_finished;
	return 0;
	}

	/**
	* Return an error to the client and cache the error code in the
	* message cache (so per qname, qtype, qclass).
	* @param qstate: our query state
	* @param id: module id
	* @param rcode: error code (DNS errcode).
	* @return: 0 for use by caller, to make notation easy, like:
	* return error_response(..).
	*/
	static int
	error_response_cache(struct module_qstate* qstate, int id, int rcode)
	{
	if(!qstate->no_cache_store) {
	/* store in cache */
	struct reply_info err;
	if(qstate->prefetch_leeway > NORR_TTL) {
	verbose(VERB_ALGO, "error response for prefetch in cache");
	/* attempt to adjust the cache entry prefetch */
	if(dns_cache_prefetch_adjust(qstate->env, &qstate->qinfo,
	NORR_TTL, qstate->query_flags))
	return error_response(qstate, id, rcode);
	/* if that fails (not in cache), fall through to store err */
	}
	if(qstate->env->cfg->serve_expired) {
	/* if serving expired contents, and such content is
	* already available, don't overwrite this servfail */
	struct msgreply_entry* msg;
	if((msg=msg_cache_lookup(qstate->env,
	qstate->qinfo.qname, qstate->qinfo.qname_len,
	qstate->qinfo.qtype, qstate->qinfo.qclass,
	qstate->query_flags, 0,
	qstate->env->cfg->serve_expired_ttl_reset))
	!= NULL) {
	if(qstate->env->cfg->serve_expired_ttl_reset) {
	struct reply_info* rep =
	(struct reply_info*)msg->entry.data;
	if(rep && *qstate->env->now +
	qstate->env->cfg->serve_expired_ttl >
	rep->serve_expired_ttl) {
	rep->serve_expired_ttl =
	*qstate->env->now +
	qstate->env->cfg->serve_expired_ttl;
	}
	}
	lock_rw_unlock(&msg->entry.lock);
	return error_response(qstate, id, rcode);
	}
	/* serving expired contents, but nothing is cached
	* at all, so the servfail cache entry is useful
	* (stops waste of time on this servfail NORR_TTL) */
	+ } else {
	+ /* don't overwrite existing (non-expired) data in
	+ * cache with a servfail */
	+ struct msgreply_entry* msg;
	+ if((msg=msg_cache_lookup(qstate->env,
	+ qstate->qinfo.qname, qstate->qinfo.qname_len,
	+ qstate->qinfo.qtype, qstate->qinfo.qclass,
	+ qstate->query_flags, *qstate->env->now, 0))
	+ != NULL) {
	+ struct reply_info* rep = (struct reply_info*)
	+ msg->entry.data;
	+ if(FLAGS_GET_RCODE(rep->flags) ==
	+ LDNS_RCODE_NOERROR \|\|
	+ FLAGS_GET_RCODE(rep->flags) ==
	+ LDNS_RCODE_NXDOMAIN) {
	+ /* we have a good entry,
	+ * don't overwrite */
	+ lock_rw_unlock(&msg->entry.lock);
	+ return error_response(qstate, id, rcode);
	+ }
	+ lock_rw_unlock(&msg->entry.lock);
	+ }
	+
	}
	memset(&err, 0, sizeof(err));
	err.flags = (uint16_t)(BIT_QR \| BIT_RA);
	FLAGS_SET_RCODE(err.flags, rcode);
	err.qdcount = 1;
	err.ttl = NORR_TTL;
	err.prefetch_ttl = PREFETCH_TTL_CALC(err.ttl);
	err.serve_expired_ttl = NORR_TTL;
	/* do not waste time trying to validate this servfail */
	err.security = sec_status_indeterminate;
	verbose(VERB_ALGO, "store error response in message cache");
	iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL,
	qstate->query_flags);
	}
	return error_response(qstate, id, rcode);
	}

	/** check if prepend item is duplicate item */
	static int
	prepend_is_duplicate(struct ub_packed_rrset_key** sets, size_t to,
	struct ub_packed_rrset_key* dup)
	{
	size_t i;
	for(i=0; i<to; i++) {
	if(sets[i]->rk.type == dup->rk.type &&
	sets[i]->rk.rrset_class == dup->rk.rrset_class &&
	sets[i]->rk.dname_len == dup->rk.dname_len &&
	query_dname_compare(sets[i]->rk.dname, dup->rk.dname)
	== 0)
	return 1;
	}
	return 0;
	}

	/** prepend the prepend list in the answer and authority section of dns_msg */
	static int
	iter_prepend(struct iter_qstate* iq, struct dns_msg* msg,
	struct regional* region)
	{
	struct iter_prep_list* p;
	struct ub_packed_rrset_key** sets;
	size_t num_an = 0, num_ns = 0;;
	for(p = iq->an_prepend_list; p; p = p->next)
	num_an++;
	for(p = iq->ns_prepend_list; p; p = p->next)
	num_ns++;
	if(num_an + num_ns == 0)
	return 1;
	verbose(VERB_ALGO, "prepending %d rrsets", (int)num_an + (int)num_ns);
	if(num_an > RR_COUNT_MAX \|\| num_ns > RR_COUNT_MAX \|\|
	msg->rep->rrset_count > RR_COUNT_MAX) return 0; /* overflow */
	sets = regional_alloc(region, (num_an+num_ns+msg->rep->rrset_count) *
	sizeof(struct ub_packed_rrset_key*));
	if(!sets)
	return 0;
	/* ANSWER section */
	num_an = 0;
	for(p = iq->an_prepend_list; p; p = p->next) {
	sets[num_an++] = p->rrset;
	}
	memcpy(sets+num_an, msg->rep->rrsets, msg->rep->an_numrrsets *
	sizeof(struct ub_packed_rrset_key*));
	/* AUTH section */
	num_ns = 0;
	for(p = iq->ns_prepend_list; p; p = p->next) {
	if(prepend_is_duplicate(sets+msg->rep->an_numrrsets+num_an,
	num_ns, p->rrset) \|\| prepend_is_duplicate(
	msg->rep->rrsets+msg->rep->an_numrrsets,
	msg->rep->ns_numrrsets, p->rrset))
	continue;
	sets[msg->rep->an_numrrsets + num_an + num_ns++] = p->rrset;
	}
	memcpy(sets + num_an + msg->rep->an_numrrsets + num_ns,
	msg->rep->rrsets + msg->rep->an_numrrsets,
	(msg->rep->ns_numrrsets + msg->rep->ar_numrrsets) *
	sizeof(struct ub_packed_rrset_key*));

	/* NXDOMAIN rcode can stay if we prepended DNAME/CNAMEs, because
	* this is what recursors should give. */
	msg->rep->rrset_count += num_an + num_ns;
	msg->rep->an_numrrsets += num_an;
	msg->rep->ns_numrrsets += num_ns;
	msg->rep->rrsets = sets;
	return 1;
	}

	/**
	* Find rrset in ANSWER prepend list.
	* to avoid duplicate DNAMEs when a DNAME is traversed twice.
	* @param iq: iterator query state.
	* @param rrset: rrset to add.
	* @return false if not found
	*/
	static int
	iter_find_rrset_in_prepend_answer(struct iter_qstate* iq,
	struct ub_packed_rrset_key* rrset)
	{
	struct iter_prep_list* p = iq->an_prepend_list;
	while(p) {
	if(ub_rrset_compare(p->rrset, rrset) == 0 &&
	rrsetdata_equal((struct packed_rrset_data*)p->rrset
	->entry.data, (struct packed_rrset_data*)rrset
	->entry.data))
	return 1;
	p = p->next;
	}
	return 0;
	}

	/**
	* Add rrset to ANSWER prepend list
	* @param qstate: query state.
	* @param iq: iterator query state.
	* @param rrset: rrset to add.
	* @return false on failure (malloc).
	*/
	static int
	iter_add_prepend_answer(struct module_qstate* qstate, struct iter_qstate* iq,
	struct ub_packed_rrset_key* rrset)
	{
	struct iter_prep_list* p = (struct iter_prep_list*)regional_alloc(
	qstate->region, sizeof(struct iter_prep_list));
	if(!p)
	return 0;
	p->rrset = rrset;
	p->next = NULL;
	/* add at end */
	if(iq->an_prepend_last)
	iq->an_prepend_last->next = p;
	else iq->an_prepend_list = p;
	iq->an_prepend_last = p;
	return 1;
	}

	/**
	* Add rrset to AUTHORITY prepend list
	* @param qstate: query state.
	* @param iq: iterator query state.
	* @param rrset: rrset to add.
	* @return false on failure (malloc).
	*/
	static int
	iter_add_prepend_auth(struct module_qstate* qstate, struct iter_qstate* iq,
	struct ub_packed_rrset_key* rrset)
	{
	struct iter_prep_list* p = (struct iter_prep_list*)regional_alloc(
	qstate->region, sizeof(struct iter_prep_list));
	if(!p)
	return 0;
	p->rrset = rrset;
	p->next = NULL;
	/* add at end */
	if(iq->ns_prepend_last)
	iq->ns_prepend_last->next = p;
	else iq->ns_prepend_list = p;
	iq->ns_prepend_last = p;
	return 1;
	}

	/**
	* Given a CNAME response (defined as a response containing a CNAME or DNAME
	* that does not answer the request), process the response, modifying the
	* state as necessary. This follows the CNAME/DNAME chain and returns the
	* final query name.
	*
	* sets the new query name, after following the CNAME/DNAME chain.
	* @param qstate: query state.
	* @param iq: iterator query state.
	* @param msg: the response.
	* @param mname: returned target new query name.
	* @param mname_len: length of mname.
	* @return false on (malloc) error.
	*/
	static int
	handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,
	struct dns_msg* msg, uint8_t** mname, size_t* mname_len)
	{
	size_t i;
	/* Start with the (current) qname. */
	*mname = iq->qchase.qname;
	*mname_len = iq->qchase.qname_len;

	/* Iterate over the ANSWER rrsets in order, looking for CNAMEs and
	* DNAMES. */
	for(i=0; i<msg->rep->an_numrrsets; i++) {
	struct ub_packed_rrset_key* r = msg->rep->rrsets[i];
	/* If there is a (relevant) DNAME, add it to the list.
	* We always expect there to be CNAME that was generated
	* by this DNAME following, so we don't process the DNAME
	* directly. */
	if(ntohs(r->rk.type) == LDNS_RR_TYPE_DNAME &&
	dname_strict_subdomain_c(*mname, r->rk.dname) &&
	!iter_find_rrset_in_prepend_answer(iq, r)) {
	if(!iter_add_prepend_answer(qstate, iq, r))
	return 0;
	continue;
	}

	if(ntohs(r->rk.type) == LDNS_RR_TYPE_CNAME &&
	query_dname_compare(*mname, r->rk.dname) == 0 &&
	!iter_find_rrset_in_prepend_answer(iq, r)) {
	/* Add this relevant CNAME rrset to the prepend list.*/
	if(!iter_add_prepend_answer(qstate, iq, r))
	return 0;
	get_cname_target(r, mname, mname_len);
	}

	/* Other rrsets in the section are ignored. */
	}
	/* add authority rrsets to authority prepend, for wildcarded CNAMEs */
	for(i=msg->rep->an_numrrsets; i<msg->rep->an_numrrsets +
	msg->rep->ns_numrrsets; i++) {
	struct ub_packed_rrset_key* r = msg->rep->rrsets[i];
	/* only add NSEC/NSEC3, as they may be needed for validation */
	if(ntohs(r->rk.type) == LDNS_RR_TYPE_NSEC \|\|
	ntohs(r->rk.type) == LDNS_RR_TYPE_NSEC3) {
	if(!iter_add_prepend_auth(qstate, iq, r))
	return 0;
	}
	}
	return 1;
	}

	/** see if last resort is possible - does config allow queries to parent */
	static int
	can_have_last_resort(struct module_env* env, uint8_t* nm, size_t nmlen,
	uint16_t qclass, struct delegpt** retdp)
	{
	struct delegpt* fwddp;
	struct iter_hints_stub* stub;
	int labs = dname_count_labels(nm);
	/* do not process a last resort (the parent side) if a stub
	* or forward is configured, because we do not want to go 'above'
	* the configured servers */
	if(!dname_is_root(nm) && (stub = (struct iter_hints_stub*)
	name_tree_find(&env->hints->tree, nm, nmlen, labs, qclass)) &&
	/* has_parent side is turned off for stub_first, where we
	* are allowed to go to the parent */
	stub->dp->has_parent_side_NS) {
	if(retdp) *retdp = stub->dp;
	return 0;
	}
	if((fwddp = forwards_find(env->fwds, nm, qclass)) &&
	/* has_parent_side is turned off for forward_first, where
	* we are allowed to go to the parent */
	fwddp->has_parent_side_NS) {
	if(retdp) *retdp = fwddp;
	return 0;
	}
	return 1;
	}

	/** see if target name is caps-for-id whitelisted */
	static int
	is_caps_whitelisted(struct iter_env* ie, struct iter_qstate* iq)
	{
	if(!ie->caps_white) return 0; /* no whitelist, or no capsforid */
	return name_tree_lookup(ie->caps_white, iq->qchase.qname,
	iq->qchase.qname_len, dname_count_labels(iq->qchase.qname),
	iq->qchase.qclass) != NULL;
	}

	/** create target count structure for this query */
	static void
	target_count_create(struct iter_qstate* iq)
	{
	if(!iq->target_count) {
	iq->target_count = (int*)calloc(2, sizeof(int));
	/* if calloc fails we simply do not track this number */
	if(iq->target_count)
	iq->target_count[0] = 1;
	}
	}

	static void
	target_count_increase(struct iter_qstate* iq, int num)
	{
	target_count_create(iq);
	if(iq->target_count)
	iq->target_count[1] += num;
	}

	/**
	* Generate a subrequest.
	* Generate a local request event. Local events are tied to this module, and
	* have a corresponding (first tier) event that is waiting for this event to
	* resolve to continue.
	*
	* @param qname The query name for this request.
	* @param qnamelen length of qname
	* @param qtype The query type for this request.
	* @param qclass The query class for this request.
	* @param qstate The event that is generating this event.
	* @param id: module id.
	* @param iq: The iterator state that is generating this event.
	* @param initial_state The initial response state (normally this
	* is QUERY_RESP_STATE, unless it is known that the request won't
	* need iterative processing
	* @param finalstate The final state for the response to this request.
	* @param subq_ret: if newly allocated, the subquerystate, or NULL if it does
	* not need initialisation.
	* @param v: if true, validation is done on the subquery.
	* @return false on error (malloc).
	*/
	static int
	generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
	uint16_t qclass, struct module_qstate* qstate, int id,
	struct iter_qstate* iq, enum iter_state initial_state,
	enum iter_state finalstate, struct module_qstate** subq_ret, int v)
	{
	struct module_qstate* subq = NULL;
	struct iter_qstate* subiq = NULL;
	uint16_t qflags = 0; /* OPCODE QUERY, no flags */
	struct query_info qinf;
	int prime = (finalstate == PRIME_RESP_STATE)?1:0;
	int valrec = 0;
	qinf.qname = qname;
	qinf.qname_len = qnamelen;
	qinf.qtype = qtype;
	qinf.qclass = qclass;
	qinf.local_alias = NULL;

	/* RD should be set only when sending the query back through the INIT
	* state. */
	if(initial_state == INIT_REQUEST_STATE)
	qflags \|= BIT_RD;
	/* We set the CD flag so we can send this through the "head" of
	* the resolution chain, which might have a validator. We are
	* uninterested in validating things not on the direct resolution
	* path. */
	if(!v) {
	qflags \|= BIT_CD;
	valrec = 1;
	}

	/* attach subquery, lookup existing or make a new one */
	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
	if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime, valrec,
	&subq)) {
	return 0;
	}
	*subq_ret = subq;
	if(subq) {
	/* initialise the new subquery */
	subq->curmod = id;
	subq->ext_state[id] = module_state_initial;
	subq->minfo[id] = regional_alloc(subq->region,
	sizeof(struct iter_qstate));
	if(!subq->minfo[id]) {
	log_err("init subq: out of memory");
	fptr_ok(fptr_whitelist_modenv_kill_sub(
	qstate->env->kill_sub));
	(*qstate->env->kill_sub)(subq);
	return 0;
	}
	subiq = (struct iter_qstate*)subq->minfo[id];
	memset(subiq, 0, sizeof(*subiq));
	subiq->num_target_queries = 0;
	target_count_create(iq);
	subiq->target_count = iq->target_count;
	if(iq->target_count)
	iq->target_count[0] ++; /* extra reference */
	subiq->num_current_queries = 0;
	subiq->depth = iq->depth+1;
	outbound_list_init(&subiq->outlist);
	subiq->state = initial_state;
	subiq->final_state = finalstate;
	subiq->qchase = subq->qinfo;
	subiq->chase_flags = subq->query_flags;
	subiq->refetch_glue = 0;
	if(qstate->env->cfg->qname_minimisation)
	subiq->minimisation_state = INIT_MINIMISE_STATE;
	else
	subiq->minimisation_state = DONOT_MINIMISE_STATE;
	memset(&subiq->qinfo_out, 0, sizeof(struct query_info));
	}
	return 1;
	}

	/**
	* Generate and send a root priming request.
	* @param qstate: the qtstate that triggered the need to prime.
	* @param iq: iterator query state.
	* @param id: module id.
	* @param qclass: the class to prime.
	* @return 0 on failure
	*/
	static int
	prime_root(struct module_qstate* qstate, struct iter_qstate* iq, int id,
	uint16_t qclass)
	{
	struct delegpt* dp;
	struct module_qstate* subq;
	verbose(VERB_DETAIL, "priming . %s NS",
	sldns_lookup_by_id(sldns_rr_classes, (int)qclass)?
	sldns_lookup_by_id(sldns_rr_classes, (int)qclass)->name:"??");
	dp = hints_lookup_root(qstate->env->hints, qclass);
	if(!dp) {
	verbose(VERB_ALGO, "Cannot prime due to lack of hints");
	return 0;
	}
	/* Priming requests start at the QUERYTARGETS state, skipping
	* the normal INIT state logic (which would cause an infloop). */
	if(!generate_sub_request((uint8_t*)"\000", 1, LDNS_RR_TYPE_NS,
	qclass, qstate, id, iq, QUERYTARGETS_STATE, PRIME_RESP_STATE,
	&subq, 0)) {
	verbose(VERB_ALGO, "could not prime root");
	return 0;
	}
	if(subq) {
	struct iter_qstate* subiq =
	(struct iter_qstate*)subq->minfo[id];
	/* Set the initial delegation point to the hint.
	* copy dp, it is now part of the root prime query.
	* dp was part of in the fixed hints structure. */
	subiq->dp = delegpt_copy(dp, subq->region);
	if(!subiq->dp) {
	log_err("out of memory priming root, copydp");
	fptr_ok(fptr_whitelist_modenv_kill_sub(
	qstate->env->kill_sub));
	(*qstate->env->kill_sub)(subq);
	return 0;
	}
	/* there should not be any target queries. */
	subiq->num_target_queries = 0;
	subiq->dnssec_expected = iter_indicates_dnssec(
	qstate->env, subiq->dp, NULL, subq->qinfo.qclass);
	}

	/* this module stops, our submodule starts, and does the query. */
	qstate->ext_state[id] = module_wait_subquery;
	return 1;
	}

	/**
	* Generate and process a stub priming request. This method tests for the
	* need to prime a stub zone, so it is safe to call for every request.
	*
	* @param qstate: the qtstate that triggered the need to prime.
	* @param iq: iterator query state.
	* @param id: module id.
	* @param qname: request name.
	* @param qclass: request class.
	* @return true if a priming subrequest was made, false if not. The will only
	* issue a priming request if it detects an unprimed stub.
	* Uses value of 2 to signal during stub-prime in root-prime situation
	* that a noprime-stub is available and resolution can continue.
	*/
	static int
	prime_stub(struct module_qstate* qstate, struct iter_qstate* iq, int id,
	uint8_t* qname, uint16_t qclass)
	{
	/* Lookup the stub hint. This will return null if the stub doesn't
	* need to be re-primed. */
	struct iter_hints_stub* stub;
	struct delegpt* stub_dp;
	struct module_qstate* subq;

	if(!qname) return 0;
	stub = hints_lookup_stub(qstate->env->hints, qname, qclass, iq->dp);
	/* The stub (if there is one) does not need priming. */
	if(!stub)
	return 0;
	stub_dp = stub->dp;
	/* if we have an auth_zone dp, and stub is equal, don't prime stub
	* yet, unless we want to fallback and avoid the auth_zone */
	if(!iq->auth_zone_avoid && iq->dp && iq->dp->auth_dp &&
	query_dname_compare(iq->dp->name, stub_dp->name) == 0)
	return 0;

	/* is it a noprime stub (always use) */
	if(stub->noprime) {
	int r = 0;
	if(iq->dp == NULL) r = 2;
	/* copy the dp out of the fixed hints structure, so that
	* it can be changed when servicing this query */
	iq->dp = delegpt_copy(stub_dp, qstate->region);
	if(!iq->dp) {
	log_err("out of memory priming stub");
	errinf(qstate, "malloc failure, priming stub");
	(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	return 1; /* return 1 to make module stop, with error */
	}
	log_nametypeclass(VERB_DETAIL, "use stub", stub_dp->name,
	LDNS_RR_TYPE_NS, qclass);
	return r;
	}

	/* Otherwise, we need to (re)prime the stub. */
	log_nametypeclass(VERB_DETAIL, "priming stub", stub_dp->name,
	LDNS_RR_TYPE_NS, qclass);

	/* Stub priming events start at the QUERYTARGETS state to avoid the
	* redundant INIT state processing. */
	if(!generate_sub_request(stub_dp->name, stub_dp->namelen,
	LDNS_RR_TYPE_NS, qclass, qstate, id, iq,
	QUERYTARGETS_STATE, PRIME_RESP_STATE, &subq, 0)) {
	verbose(VERB_ALGO, "could not prime stub");
	errinf(qstate, "could not generate lookup for stub prime");
	(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	return 1; /* return 1 to make module stop, with error */
	}
	if(subq) {
	struct iter_qstate* subiq =
	(struct iter_qstate*)subq->minfo[id];

	/* Set the initial delegation point to the hint. */
	/* make copy to avoid use of stub dp by different qs/threads */
	subiq->dp = delegpt_copy(stub_dp, subq->region);
	if(!subiq->dp) {
	log_err("out of memory priming stub, copydp");
	fptr_ok(fptr_whitelist_modenv_kill_sub(
	qstate->env->kill_sub));
	(*qstate->env->kill_sub)(subq);
	errinf(qstate, "malloc failure, in stub prime");
	(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	return 1; /* return 1 to make module stop, with error */
	}
	/* there should not be any target queries -- although there
	* wouldn't be anyway, since stub hints never have
	* missing targets. */
	subiq->num_target_queries = 0;
	subiq->wait_priming_stub = 1;
	subiq->dnssec_expected = iter_indicates_dnssec(
	qstate->env, subiq->dp, NULL, subq->qinfo.qclass);
	}

	/* this module stops, our submodule starts, and does the query. */
	qstate->ext_state[id] = module_wait_subquery;
	return 1;
	}

	/**
	* Generate a delegation point for an auth zone (unless cached dp is better)
	* false on alloc failure.
	*/
	static int
	auth_zone_delegpt(struct module_qstate* qstate, struct iter_qstate* iq,
	uint8_t* delname, size_t delnamelen)
	{
	struct auth_zone* z;
	if(iq->auth_zone_avoid)
	return 1;
	if(!delname) {
	delname = iq->qchase.qname;
	delnamelen = iq->qchase.qname_len;
	}
	lock_rw_rdlock(&qstate->env->auth_zones->lock);
	z = auth_zones_find_zone(qstate->env->auth_zones, delname, delnamelen,
	qstate->qinfo.qclass);
	if(!z) {
	lock_rw_unlock(&qstate->env->auth_zones->lock);
	return 1;
	}
	lock_rw_rdlock(&z->lock);
	lock_rw_unlock(&qstate->env->auth_zones->lock);
	if(z->for_upstream) {
	if(iq->dp && query_dname_compare(z->name, iq->dp->name) == 0
	&& iq->dp->auth_dp && qstate->blacklist &&
	z->fallback_enabled) {
	/* cache is blacklisted and fallback, and we
	* already have an auth_zone dp */
	if(verbosity>=VERB_ALGO) {
	char buf[255+1];
	dname_str(z->name, buf);
	verbose(VERB_ALGO, "auth_zone %s "
	"fallback because cache blacklisted",
	buf);
	}
	lock_rw_unlock(&z->lock);
	iq->dp = NULL;
	return 1;
	}
	if(iq->dp==NULL \|\| dname_subdomain_c(z->name, iq->dp->name)) {
	struct delegpt* dp;
	if(qstate->blacklist && z->fallback_enabled) {
	/* cache is blacklisted because of a DNSSEC
	* validation failure, and the zone allows
	* fallback to the internet, query there. */
	if(verbosity>=VERB_ALGO) {
	char buf[255+1];
	dname_str(z->name, buf);
	verbose(VERB_ALGO, "auth_zone %s "
	"fallback because cache blacklisted",
	buf);
	}
	lock_rw_unlock(&z->lock);
	return 1;
	}
	dp = (struct delegpt*)regional_alloc_zero(
	qstate->region, sizeof(*dp));
	if(!dp) {
	log_err("alloc failure");
	if(z->fallback_enabled) {
	lock_rw_unlock(&z->lock);
	return 1; /* just fallback */
	}
	lock_rw_unlock(&z->lock);
	errinf(qstate, "malloc failure");
	return 0;
	}
	dp->name = regional_alloc_init(qstate->region,
	z->name, z->namelen);
	if(!dp->name) {
	log_err("alloc failure");
	if(z->fallback_enabled) {
	lock_rw_unlock(&z->lock);
	return 1; /* just fallback */
	}
	lock_rw_unlock(&z->lock);
	errinf(qstate, "malloc failure");
	return 0;
	}
	dp->namelen = z->namelen;
	dp->namelabs = z->namelabs;
	dp->auth_dp = 1;
	iq->dp = dp;
	}
	}

	lock_rw_unlock(&z->lock);
	return 1;
	}

	/**
	* Generate A and AAAA checks for glue that is in-zone for the referral
	* we just got to obtain authoritative information on the addresses.
	*
	* @param qstate: the qtstate that triggered the need to prime.
	* @param iq: iterator query state.
	* @param id: module id.
	*/
	static void
	generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq,
	int id)
	{
	struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
	struct module_qstate* subq;
	size_t i;
	struct reply_info* rep = iq->response->rep;
	struct ub_packed_rrset_key* s;
	log_assert(iq->dp);

	if(iq->depth == ie->max_dependency_depth)
	return;
	/* walk through additional, and check if in-zone,
	* only relevant A, AAAA are left after scrub anyway */
	for(i=rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) {
	s = rep->rrsets[i];
	/* check ALL addresses that are transmitted in additional*/
	/* is it an address ? */
	if( !(ntohs(s->rk.type)==LDNS_RR_TYPE_A \|\|
	ntohs(s->rk.type)==LDNS_RR_TYPE_AAAA)) {
	continue;
	}
	/* is this query the same as the A/AAAA check for it */
	if(qstate->qinfo.qtype == ntohs(s->rk.type) &&
	qstate->qinfo.qclass == ntohs(s->rk.rrset_class) &&
	query_dname_compare(qstate->qinfo.qname,
	s->rk.dname)==0 &&
	(qstate->query_flags&BIT_RD) &&
	!(qstate->query_flags&BIT_CD))
	continue;

	/* generate subrequest for it */
	log_nametypeclass(VERB_ALGO, "schedule addr fetch",
	s->rk.dname, ntohs(s->rk.type),
	ntohs(s->rk.rrset_class));
	if(!generate_sub_request(s->rk.dname, s->rk.dname_len,
	ntohs(s->rk.type), ntohs(s->rk.rrset_class),
	qstate, id, iq,
	INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) {
	verbose(VERB_ALGO, "could not generate addr check");
	return;
	}
	/* ignore subq - not need for more init */
	}
	}

	/**
	* Generate a NS check request to obtain authoritative information
	* on an NS rrset.
	*
	* @param qstate: the qtstate that triggered the need to prime.
	* @param iq: iterator query state.
	* @param id: module id.
	*/
	static void
	generate_ns_check(struct module_qstate* qstate, struct iter_qstate* iq, int id)
	{
	struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
	struct module_qstate* subq;
	log_assert(iq->dp);

	if(iq->depth == ie->max_dependency_depth)
	return;
	if(!can_have_last_resort(qstate->env, iq->dp->name, iq->dp->namelen,
	iq->qchase.qclass, NULL))
	return;
	/* is this query the same as the nscheck? */
	if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS &&
	query_dname_compare(iq->dp->name, qstate->qinfo.qname)==0 &&
	(qstate->query_flags&BIT_RD) && !(qstate->query_flags&BIT_CD)){
	/* spawn off A, AAAA queries for in-zone glue to check */
	generate_a_aaaa_check(qstate, iq, id);
	return;
	}
	/* no need to get the NS record for DS, it is above the zonecut */
	if(qstate->qinfo.qtype == LDNS_RR_TYPE_DS)
	return;

	log_nametypeclass(VERB_ALGO, "schedule ns fetch",
	iq->dp->name, LDNS_RR_TYPE_NS, iq->qchase.qclass);
	if(!generate_sub_request(iq->dp->name, iq->dp->namelen,
	LDNS_RR_TYPE_NS, iq->qchase.qclass, qstate, id, iq,
	INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) {
	verbose(VERB_ALGO, "could not generate ns check");
	return;
	}
	if(subq) {
	struct iter_qstate* subiq =
	(struct iter_qstate*)subq->minfo[id];

	/* make copy to avoid use of stub dp by different qs/threads */
	/* refetch glue to start higher up the tree */
	subiq->refetch_glue = 1;
	subiq->dp = delegpt_copy(iq->dp, subq->region);
	if(!subiq->dp) {
	log_err("out of memory generating ns check, copydp");
	fptr_ok(fptr_whitelist_modenv_kill_sub(
	qstate->env->kill_sub));
	(*qstate->env->kill_sub)(subq);
	return;
	}
	}
	}

	/**
	* Generate a DNSKEY prefetch query to get the DNSKEY for the DS record we
	* just got in a referral (where we have dnssec_expected, thus have trust
	* anchors above it). Note that right after calling this routine the
	* iterator detached subqueries (because of following the referral), and thus
	* the DNSKEY query becomes detached, its return stored in the cache for
	* later lookup by the validator. This cache lookup by the validator avoids
	* the roundtrip incurred by the DNSKEY query. The DNSKEY query is now
	* performed at about the same time the original query is sent to the domain,
	* thus the two answers are likely to be returned at about the same time,
	* saving a roundtrip from the validated lookup.
	*
	* @param qstate: the qtstate that triggered the need to prime.
	* @param iq: iterator query state.
	* @param id: module id.
	*/
	static void
	generate_dnskey_prefetch(struct module_qstate* qstate,
	struct iter_qstate* iq, int id)
	{
	struct module_qstate* subq;
	log_assert(iq->dp);

	/* is this query the same as the prefetch? */
	if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY &&
	query_dname_compare(iq->dp->name, qstate->qinfo.qname)==0 &&
	(qstate->query_flags&BIT_RD) && !(qstate->query_flags&BIT_CD)){
	return;
	}

	/* if the DNSKEY is in the cache this lookup will stop quickly */
	log_nametypeclass(VERB_ALGO, "schedule dnskey prefetch",
	iq->dp->name, LDNS_RR_TYPE_DNSKEY, iq->qchase.qclass);
	if(!generate_sub_request(iq->dp->name, iq->dp->namelen,
	LDNS_RR_TYPE_DNSKEY, iq->qchase.qclass, qstate, id, iq,
	INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0)) {
	/* we'll be slower, but it'll work */
	verbose(VERB_ALGO, "could not generate dnskey prefetch");
	return;
	}
	if(subq) {
	struct iter_qstate* subiq =
	(struct iter_qstate*)subq->minfo[id];
	/* this qstate has the right delegation for the dnskey lookup*/
	/* make copy to avoid use of stub dp by different qs/threads */
	subiq->dp = delegpt_copy(iq->dp, subq->region);
	/* if !subiq->dp, it'll start from the cache, no problem */
	}
	}

	/**
	* See if the query needs forwarding.
	*
	* @param qstate: query state.
	* @param iq: iterator query state.
	* @return true if the request is forwarded, false if not.
	* If returns true but, iq->dp is NULL then a malloc failure occurred.
	*/
	static int
	forward_request(struct module_qstate* qstate, struct iter_qstate* iq)
	{
	struct delegpt* dp;
	uint8_t* delname = iq->qchase.qname;
	size_t delnamelen = iq->qchase.qname_len;
	if(iq->refetch_glue && iq->dp) {
	delname = iq->dp->name;
	delnamelen = iq->dp->namelen;
	}
	/* strip one label off of DS query to lookup higher for it */
	if( (iq->qchase.qtype == LDNS_RR_TYPE_DS \|\| iq->refetch_glue)
	&& !dname_is_root(iq->qchase.qname))
	dname_remove_label(&delname, &delnamelen);
	dp = forwards_lookup(qstate->env->fwds, delname, iq->qchase.qclass);
	if(!dp)
	return 0;
	/* send recursion desired to forward addr */
	iq->chase_flags \|= BIT_RD;
	iq->dp = delegpt_copy(dp, qstate->region);
	/* iq->dp checked by caller */
	verbose(VERB_ALGO, "forwarding request");
	return 1;
	}

	-static int
	-iter_stub_fwd_no_cache(struct module_qstate qstate, struct iter_qstate iq)
	-{
	- struct iter_hints_stub *stub;
	- struct delegpt *dp;
	-
	- /* Check for stub. */
	- stub = hints_lookup_stub(qstate->env->hints, iq->qchase.qname,
	- iq->qchase.qclass, iq->dp);
	- dp = forwards_lookup(qstate->env->fwds, iq->qchase.qname, iq->qchase.qclass);
	-
	- /* see if forward or stub is more pertinent */
	- if(stub && stub->dp && dp) {
	- if(dname_strict_subdomain(dp->name, dp->namelabs,
	- stub->dp->name, stub->dp->namelabs)) {
	- stub = NULL; /* ignore stub, forward is lower */
	- } else {
	- dp = NULL; /* ignore forward, stub is lower */
	- }
	- }
	-
	- /* check stub */
	- if (stub != NULL && stub->dp != NULL) {
	- if(stub->dp->no_cache) {
	- char qname[255+1];
	- char dpname[255+1];
	- dname_str(iq->qchase.qname, qname);
	- dname_str(stub->dp->name, dpname);
	- verbose(VERB_ALGO, "stub for %s %s has no_cache", qname, dpname);
	- }
	- return (stub->dp->no_cache);
	- }
	-
	- /* Check for forward. */
	- if (dp) {
	- if(dp->no_cache) {
	- char qname[255+1];
	- char dpname[255+1];
	- dname_str(iq->qchase.qname, qname);
	- dname_str(dp->name, dpname);
	- verbose(VERB_ALGO, "forward for %s %s has no_cache", qname, dpname);
	- }
	- return (dp->no_cache);
	- }
	- return 0;
	-}
	-
	/**
	* Process the initial part of the request handling. This state roughly
	* corresponds to resolver algorithms steps 1 (find answer in cache) and 2
	* (find the best servers to ask).
	*
	* Note that all requests start here, and query restarts revisit this state.
	*
	* This state either generates: 1) a response, from cache or error, 2) a
	* priming event, or 3) forwards the request to the next state (init2,
	* generally).
	*
	* @param qstate: query state.
	* @param iq: iterator query state.
	* @param ie: iterator shared global environment.
	* @param id: module id.
	* @return true if the event needs more request processing immediately,
	* false if not.
	*/
	static int
	processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
	struct iter_env* ie, int id)
	{
	uint8_t* delname;
	size_t delnamelen;
	struct dns_msg* msg = NULL;

	log_query_info(VERB_DETAIL, "resolving", &qstate->qinfo);
	/* check effort */

	/* We enforce a maximum number of query restarts. This is primarily a
	* cheap way to prevent CNAME loops. */
	if(iq->query_restart_count > MAX_RESTART_COUNT) {
	verbose(VERB_QUERY, "request has exceeded the maximum number"
	" of query restarts with %d", iq->query_restart_count);
	errinf(qstate, "request has exceeded the maximum number "
	"restarts (eg. indirections)");
	if(iq->qchase.qname)
	errinf_dname(qstate, "stop at", iq->qchase.qname);
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}

	/* We enforce a maximum recursion/dependency depth -- in general,
	* this is unnecessary for dependency loops (although it will
	* catch those), but it provides a sensible limit to the amount
	* of work required to answer a given query. */
	verbose(VERB_ALGO, "request has dependency depth of %d", iq->depth);
	if(iq->depth > ie->max_dependency_depth) {
	verbose(VERB_QUERY, "request has exceeded the maximum "
	"dependency depth with depth of %d", iq->depth);
	errinf(qstate, "request has exceeded the maximum dependency "
	"depth (eg. nameserver lookup recursion)");
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}

	/* If the request is qclass=ANY, setup to generate each class */
	if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) {
	iq->qchase.qclass = 0;
	return next_state(iq, COLLECT_CLASS_STATE);
	}

	/*
	* If we are restricted by a forward-zone or a stub-zone, we
	* can't re-fetch glue for this delegation point.
	* we won’t try to re-fetch glue if the iq->dp is null.
	*/
	if (iq->refetch_glue &&
	iq->dp &&
	!can_have_last_resort(qstate->env, iq->dp->name,
	iq->dp->namelen, iq->qchase.qclass, NULL)) {
	iq->refetch_glue = 0;
	}

	/* Resolver Algorithm Step 1 -- Look for the answer in local data. */

	/* This either results in a query restart (CNAME cache response), a
	* terminating response (ANSWER), or a cache miss (null). */

	- if (iter_stub_fwd_no_cache(qstate, iq)) {
	+ if (iter_stub_fwd_no_cache(qstate, &iq->qchase)) {
	/* Asked to not query cache. */
	verbose(VERB_ALGO, "no-cache set, going to the network");
	qstate->no_cache_lookup = 1;
	qstate->no_cache_store = 1;
	msg = NULL;
	} else if(qstate->blacklist) {
	/* if cache, or anything else, was blacklisted then
	* getting older results from cache is a bad idea, no cache */
	verbose(VERB_ALGO, "cache blacklisted, going to the network");
	msg = NULL;
	} else if(!qstate->no_cache_lookup) {
	msg = dns_cache_lookup(qstate->env, iq->qchase.qname,
	iq->qchase.qname_len, iq->qchase.qtype,
	iq->qchase.qclass, qstate->query_flags,
	qstate->region, qstate->env->scratch, 0);
	if(!msg && qstate->env->neg_cache &&
	iter_qname_indicates_dnssec(qstate->env, &iq->qchase)) {
	/* lookup in negative cache; may result in
	* NOERROR/NODATA or NXDOMAIN answers that need validation */
	msg = val_neg_getmsg(qstate->env->neg_cache, &iq->qchase,
	qstate->region, qstate->env->rrset_cache,
	qstate->env->scratch_buffer,
	qstate->env->now, 1/add SOA*/, NULL,
	qstate->env->cfg);
	}
	/* item taken from cache does not match our query name, thus
	* security needs to be re-examined later */
	if(msg && query_dname_compare(qstate->qinfo.qname,
	iq->qchase.qname) != 0)
	msg->rep->security = sec_status_unchecked;
	}
	if(msg) {
	/* handle positive cache response */
	enum response_type type = response_type_from_cache(msg,
	&iq->qchase);
	if(verbosity >= VERB_ALGO) {
	log_dns_msg("msg from cache lookup", &msg->qinfo,
	msg->rep);
	verbose(VERB_ALGO, "msg ttl is %d, prefetch ttl %d",
	(int)msg->rep->ttl,
	(int)msg->rep->prefetch_ttl);
	}

	if(type == RESPONSE_TYPE_CNAME) {
	uint8_t* sname = 0;
	size_t slen = 0;
	verbose(VERB_ALGO, "returning CNAME response from "
	"cache");
	if(!handle_cname_response(qstate, iq, msg,
	&sname, &slen)) {
	errinf(qstate, "failed to prepend CNAME "
	"components, malloc failure");
	return error_response(qstate, id,
	LDNS_RCODE_SERVFAIL);
	}
	iq->qchase.qname = sname;
	iq->qchase.qname_len = slen;
	/* This is a query restart, even if it is a cheap
	* one. */
	iq->dp = NULL;
	iq->refetch_glue = 0;
	iq->query_restart_count++;
	iq->sent_count = 0;
	sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region);
	if(qstate->env->cfg->qname_minimisation)
	iq->minimisation_state = INIT_MINIMISE_STATE;
	return next_state(iq, INIT_REQUEST_STATE);
	}

	/* if from cache, NULL, else insert 'cache IP' len=0 */
	if(qstate->reply_origin)
	sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region);
	if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_SERVFAIL)
	errinf(qstate, "SERVFAIL in cache");
	/* it is an answer, response, to final state */
	verbose(VERB_ALGO, "returning answer from cache.");
	iq->response = msg;
	return final_state(iq);
	}

	/* attempt to forward the request */
	if(forward_request(qstate, iq))
	{
	if(!iq->dp) {
	log_err("alloc failure for forward dp");
	errinf(qstate, "malloc failure for forward zone");
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	iq->refetch_glue = 0;
	iq->minimisation_state = DONOT_MINIMISE_STATE;
	/* the request has been forwarded.
	* forwarded requests need to be immediately sent to the
	* next state, QUERYTARGETS. */
	return next_state(iq, QUERYTARGETS_STATE);
	}

	/* Resolver Algorithm Step 2 -- find the "best" servers. */

	/* first, adjust for DS queries. To avoid the grandparent problem,
	* we just look for the closest set of server to the parent of qname.
	* When re-fetching glue we also need to ask the parent.
	*/
	if(iq->refetch_glue) {
	if(!iq->dp) {
	log_err("internal or malloc fail: no dp for refetch");
	errinf(qstate, "malloc failure, for delegation info");
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	delname = iq->dp->name;
	delnamelen = iq->dp->namelen;
	} else {
	delname = iq->qchase.qname;
	delnamelen = iq->qchase.qname_len;
	}
	if(iq->qchase.qtype == LDNS_RR_TYPE_DS \|\| iq->refetch_glue \|\|
	(iq->qchase.qtype == LDNS_RR_TYPE_NS && qstate->prefetch_leeway
	&& can_have_last_resort(qstate->env, delname, delnamelen, iq->qchase.qclass, NULL))) {
	/* remove first label from delname, root goes to hints,
	* but only to fetch glue, not for qtype=DS. */
	/* also when prefetching an NS record, fetch it again from
	* its parent, just as if it expired, so that you do not
	* get stuck on an older nameserver that gives old NSrecords */
	if(dname_is_root(delname) && (iq->refetch_glue \|\|
	(iq->qchase.qtype == LDNS_RR_TYPE_NS &&
	qstate->prefetch_leeway)))
	delname = NULL; /* go to root priming */
	else dname_remove_label(&delname, &delnamelen);
	}
	/* delname is the name to lookup a delegation for. If NULL rootprime */
	while(1) {

	/* Lookup the delegation in the cache. If null, then the
	* cache needs to be primed for the qclass. */
	if(delname)
	iq->dp = dns_cache_find_delegation(qstate->env, delname,
	delnamelen, iq->qchase.qtype, iq->qchase.qclass,
	qstate->region, &iq->deleg_msg,
	*qstate->env->now+qstate->prefetch_leeway);
	else iq->dp = NULL;

	/* If the cache has returned nothing, then we have a
	* root priming situation. */
	if(iq->dp == NULL) {
	int r;
	/* if under auth zone, no prime needed */
	if(!auth_zone_delegpt(qstate, iq, delname, delnamelen))
	return error_response(qstate, id,
	LDNS_RCODE_SERVFAIL);
	if(iq->dp) /* use auth zone dp */
	return next_state(iq, INIT_REQUEST_2_STATE);
	/* if there is a stub, then no root prime needed */
	r = prime_stub(qstate, iq, id, delname,
	iq->qchase.qclass);
	if(r == 2)
	break; /* got noprime-stub-zone, continue */
	else if(r)
	return 0; /* stub prime request made */
	if(forwards_lookup_root(qstate->env->fwds,
	iq->qchase.qclass)) {
	/* forward zone root, no root prime needed */
	/* fill in some dp - safety belt */
	iq->dp = hints_lookup_root(qstate->env->hints,
	iq->qchase.qclass);
	if(!iq->dp) {
	log_err("internal error: no hints dp");
	errinf(qstate, "no hints for this class");
	return error_response(qstate, id,
	LDNS_RCODE_SERVFAIL);
	}
	iq->dp = delegpt_copy(iq->dp, qstate->region);
	if(!iq->dp) {
	log_err("out of memory in safety belt");
	errinf(qstate, "malloc failure, in safety belt");
	return error_response(qstate, id,
	LDNS_RCODE_SERVFAIL);
	}
	return next_state(iq, INIT_REQUEST_2_STATE);
	}
	/* Note that the result of this will set a new
	* DelegationPoint based on the result of priming. */
	if(!prime_root(qstate, iq, id, iq->qchase.qclass))
	return error_response(qstate, id,
	LDNS_RCODE_REFUSED);

	/* priming creates and sends a subordinate query, with
	* this query as the parent. So further processing for
	* this event will stop until reactivated by the
	* results of priming. */
	return 0;
	}
	if(!iq->ratelimit_ok && qstate->prefetch_leeway)
	iq->ratelimit_ok = 1; /* allow prefetches, this keeps
	otherwise valid data in the cache */
	if(!iq->ratelimit_ok && infra_ratelimit_exceeded(
	qstate->env->infra_cache, iq->dp->name,
	iq->dp->namelen, *qstate->env->now)) {
	/* and increment the rate, so that the rate for time
	* now will also exceed the rate, keeping cache fresh */
	(void)infra_ratelimit_inc(qstate->env->infra_cache,
	iq->dp->name, iq->dp->namelen,
	- *qstate->env->now);
	+ *qstate->env->now, &qstate->qinfo,
	+ qstate->reply);
	/* see if we are passed through with slip factor */
	if(qstate->env->cfg->ratelimit_factor != 0 &&
	ub_random_max(qstate->env->rnd,
	qstate->env->cfg->ratelimit_factor) == 1) {
	iq->ratelimit_ok = 1;
	log_nametypeclass(VERB_ALGO, "ratelimit allowed through for "
	"delegation point", iq->dp->name,
	LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
	} else {
	lock_basic_lock(&ie->queries_ratelimit_lock);
	ie->num_queries_ratelimited++;
	lock_basic_unlock(&ie->queries_ratelimit_lock);
	log_nametypeclass(VERB_ALGO, "ratelimit exceeded with "
	"delegation point", iq->dp->name,
	LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
	qstate->was_ratelimited = 1;
	errinf(qstate, "query was ratelimited");
	errinf_dname(qstate, "for zone", iq->dp->name);
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	}

	/* see if this dp not useless.
	* It is useless if:
	* o all NS items are required glue.
	* or the query is for NS item that is required glue.
	* o no addresses are provided.
	* o RD qflag is on.
	* Instead, go up one level, and try to get even further
	* If the root was useless, use safety belt information.
	* Only check cache returns, because replies for servers
	* could be useless but lead to loops (bumping into the
	* same server reply) if useless-checked.
	*/
	if(iter_dp_is_useless(&qstate->qinfo, qstate->query_flags,
	iq->dp)) {
	struct delegpt* retdp = NULL;
	if(!can_have_last_resort(qstate->env, iq->dp->name, iq->dp->namelen, iq->qchase.qclass, &retdp)) {
	if(retdp) {
	verbose(VERB_QUERY, "cache has stub "
	"or fwd but no addresses, "
	"fallback to config");
	iq->dp = delegpt_copy(retdp,
	qstate->region);
	if(!iq->dp) {
	log_err("out of memory in "
	"stub/fwd fallback");
	errinf(qstate, "malloc failure, for fallback to config");
	return error_response(qstate,
	id, LDNS_RCODE_SERVFAIL);
	}
	break;
	}
	verbose(VERB_ALGO, "useless dp "
	"but cannot go up, servfail");
	delegpt_log(VERB_ALGO, iq->dp);
	errinf(qstate, "no useful nameservers, "
	"and cannot go up");
	errinf_dname(qstate, "for zone", iq->dp->name);
	return error_response(qstate, id,
	LDNS_RCODE_SERVFAIL);
	}
	if(dname_is_root(iq->dp->name)) {
	/* use safety belt */
	verbose(VERB_QUERY, "Cache has root NS but "
	"no addresses. Fallback to the safety belt.");
	iq->dp = hints_lookup_root(qstate->env->hints,
	iq->qchase.qclass);
	/* note deleg_msg is from previous lookup,
	* but RD is on, so it is not used */
	if(!iq->dp) {
	log_err("internal error: no hints dp");
	return error_response(qstate, id,
	LDNS_RCODE_REFUSED);
	}
	iq->dp = delegpt_copy(iq->dp, qstate->region);
	if(!iq->dp) {
	log_err("out of memory in safety belt");
	errinf(qstate, "malloc failure, in safety belt, for root");
	return error_response(qstate, id,
	LDNS_RCODE_SERVFAIL);
	}
	break;
	} else {
	verbose(VERB_ALGO,
	"cache delegation was useless:");
	delegpt_log(VERB_ALGO, iq->dp);
	/* go up */
	delname = iq->dp->name;
	delnamelen = iq->dp->namelen;
	dname_remove_label(&delname, &delnamelen);
	}
	} else break;
	}

	verbose(VERB_ALGO, "cache delegation returns delegpt");
	delegpt_log(VERB_ALGO, iq->dp);

	/* Otherwise, set the current delegation point and move on to the
	* next state. */
	return next_state(iq, INIT_REQUEST_2_STATE);
	}

	/**
	* Process the second part of the initial request handling. This state
	* basically exists so that queries that generate root priming events have
	* the same init processing as ones that do not. Request events that reach
	* this state must have a valid currentDelegationPoint set.
	*
	* This part is primarily handling stub zone priming. Events that reach this
	* state must have a current delegation point.
	*
	* @param qstate: query state.
	* @param iq: iterator query state.
	* @param id: module id.
	* @return true if the event needs more request processing immediately,
	* false if not.
	*/
	static int
	processInitRequest2(struct module_qstate* qstate, struct iter_qstate* iq,
	int id)
	{
	uint8_t* delname;
	size_t delnamelen;
	log_query_info(VERB_QUERY, "resolving (init part 2): ",
	&qstate->qinfo);

	delname = iq->qchase.qname;
	delnamelen = iq->qchase.qname_len;
	if(iq->refetch_glue) {
	struct iter_hints_stub* stub;
	if(!iq->dp) {
	log_err("internal or malloc fail: no dp for refetch");
	errinf(qstate, "malloc failure, no delegation info");
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	/* Do not send queries above stub, do not set delname to dp if
	* this is above stub without stub-first. */
	stub = hints_lookup_stub(
	qstate->env->hints, iq->qchase.qname, iq->qchase.qclass,
	iq->dp);
	if(!stub \|\| !stub->dp->has_parent_side_NS \|\|
	dname_subdomain_c(iq->dp->name, stub->dp->name)) {
	delname = iq->dp->name;
	delnamelen = iq->dp->namelen;
	}
	}
	if(iq->qchase.qtype == LDNS_RR_TYPE_DS \|\| iq->refetch_glue) {
	if(!dname_is_root(delname))
	dname_remove_label(&delname, &delnamelen);
	iq->refetch_glue = 0; /* if CNAME causes restart, no refetch */
	}

	/* see if we have an auth zone to answer from, improves dp from cache
	* (if any dp from cache) with auth zone dp, if that is lower */
	if(!auth_zone_delegpt(qstate, iq, delname, delnamelen))
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);

	/* Check to see if we need to prime a stub zone. */
	if(prime_stub(qstate, iq, id, delname, iq->qchase.qclass)) {
	/* A priming sub request was made */
	return 0;
	}

	/* most events just get forwarded to the next state. */
	return next_state(iq, INIT_REQUEST_3_STATE);
	}

	/**
	* Process the third part of the initial request handling. This state exists
	* as a separate state so that queries that generate stub priming events
	* will get the tail end of the init process but not repeat the stub priming
	* check.
	*
	* @param qstate: query state.
	* @param iq: iterator query state.
	* @param id: module id.
	* @return true, advancing the event to the QUERYTARGETS_STATE.
	*/
	static int
	processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq,
	int id)
	{
	log_query_info(VERB_QUERY, "resolving (init part 3): ",
	&qstate->qinfo);
	/* if the cache reply dp equals a validation anchor or msg has DS,
	* then DNSSEC RRSIGs are expected in the reply */
	iq->dnssec_expected = iter_indicates_dnssec(qstate->env, iq->dp,
	iq->deleg_msg, iq->qchase.qclass);

	/* If the RD flag wasn't set, then we just finish with the
	* cached referral as the response. */
	if(!(qstate->query_flags & BIT_RD) && iq->deleg_msg) {
	iq->response = iq->deleg_msg;
	if(verbosity >= VERB_ALGO && iq->response)
	log_dns_msg("no RD requested, using delegation msg",
	&iq->response->qinfo, iq->response->rep);
	if(qstate->reply_origin)
	sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region);
	return final_state(iq);
	}
	/* After this point, unset the RD flag -- this query is going to
	* be sent to an auth. server. */
	iq->chase_flags &= ~BIT_RD;

	/* if dnssec expected, fetch key for the trust-anchor or cached-DS */
	if(iq->dnssec_expected && qstate->env->cfg->prefetch_key &&
	!(qstate->query_flags&BIT_CD)) {
	generate_dnskey_prefetch(qstate, iq, id);
	fptr_ok(fptr_whitelist_modenv_detach_subs(
	qstate->env->detach_subs));
	(*qstate->env->detach_subs)(qstate);
	}

	/* Jump to the next state. */
	return next_state(iq, QUERYTARGETS_STATE);
	}

	/**
	* Given a basic query, generate a parent-side "target" query.
	* These are subordinate queries for missing delegation point target addresses,
	* for which only the parent of the delegation provides correct IP addresses.
	*
	* @param qstate: query state.
	* @param iq: iterator query state.
	* @param id: module id.
	* @param name: target qname.
	* @param namelen: target qname length.
	* @param qtype: target qtype (either A or AAAA).
	* @param qclass: target qclass.
	* @return true on success, false on failure.
	*/
	static int
	generate_parentside_target_query(struct module_qstate* qstate,
	struct iter_qstate* iq, int id, uint8_t* name, size_t namelen,
	uint16_t qtype, uint16_t qclass)
	{
	struct module_qstate* subq;
	if(!generate_sub_request(name, namelen, qtype, qclass, qstate,
	id, iq, INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0))
	return 0;
	if(subq) {
	struct iter_qstate* subiq =
	(struct iter_qstate*)subq->minfo[id];
	/* blacklist the cache - we want to fetch parent stuff */
	sock_list_insert(&subq->blacklist, NULL, 0, subq->region);
	subiq->query_for_pside_glue = 1;
	if(dname_subdomain_c(name, iq->dp->name)) {
	subiq->dp = delegpt_copy(iq->dp, subq->region);
	subiq->dnssec_expected = iter_indicates_dnssec(
	qstate->env, subiq->dp, NULL,
	subq->qinfo.qclass);
	subiq->refetch_glue = 1;
	} else {
	subiq->dp = dns_cache_find_delegation(qstate->env,
	name, namelen, qtype, qclass, subq->region,
	&subiq->deleg_msg,
	*qstate->env->now+subq->prefetch_leeway);
	/* if no dp, then it's from root, refetch unneeded */
	if(subiq->dp) {
	subiq->dnssec_expected = iter_indicates_dnssec(
	qstate->env, subiq->dp, NULL,
	subq->qinfo.qclass);
	subiq->refetch_glue = 1;
	}
	}
	}
	log_nametypeclass(VERB_QUERY, "new pside target", name, qtype, qclass);
	return 1;
	}

	/**
	* Given a basic query, generate a "target" query. These are subordinate
	* queries for missing delegation point target addresses.
	*
	* @param qstate: query state.
	* @param iq: iterator query state.
	* @param id: module id.
	* @param name: target qname.
	* @param namelen: target qname length.
	* @param qtype: target qtype (either A or AAAA).
	* @param qclass: target qclass.
	* @return true on success, false on failure.
	*/
	static int
	generate_target_query(struct module_qstate* qstate, struct iter_qstate* iq,
	int id, uint8_t* name, size_t namelen, uint16_t qtype, uint16_t qclass)
	{
	struct module_qstate* subq;
	if(!generate_sub_request(name, namelen, qtype, qclass, qstate,
	id, iq, INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0))
	return 0;
	log_nametypeclass(VERB_QUERY, "new target", name, qtype, qclass);
	return 1;
	}

	/**
	* Given an event at a certain state, generate zero or more target queries
	* for it's current delegation point.
	*
	* @param qstate: query state.
	* @param iq: iterator query state.
	* @param ie: iterator shared global environment.
	* @param id: module id.
	* @param maxtargets: The maximum number of targets to query for.
	* if it is negative, there is no maximum number of targets.
	* @param num: returns the number of queries generated and processed,
	* which may be zero if there were no missing targets.
	* @return false on error.
	*/
	static int
	query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
	struct iter_env* ie, int id, int maxtargets, int* num)
	{
	int query_count = 0;
	struct delegpt_ns* ns;
	int missing;
	int toget = 0;

	if(iq->depth == ie->max_dependency_depth)
	return 0;
	if(iq->depth > 0 && iq->target_count &&
	iq->target_count[1] > MAX_TARGET_COUNT) {
	char s[LDNS_MAX_DOMAINLEN+1];
	dname_str(qstate->qinfo.qname, s);
	verbose(VERB_QUERY, "request %s has exceeded the maximum "
	"number of glue fetches %d", s, iq->target_count[1]);
	return 0;
	}

	iter_mark_cycle_targets(qstate, iq->dp);
	missing = (int)delegpt_count_missing_targets(iq->dp);
	log_assert(maxtargets != 0); /* that would not be useful */

	/* Generate target requests. Basically, any missing targets
	* are queried for here, regardless if it is necessary to do
	* so to continue processing. */
	if(maxtargets < 0 \|\| maxtargets > missing)
	toget = missing;
	else toget = maxtargets;
	if(toget == 0) {
	*num = 0;
	return 1;
	}
	/* select 'toget' items from the total of 'missing' items */
	log_assert(toget <= missing);

	/* loop over missing targets */
	for(ns = iq->dp->nslist; ns; ns = ns->next) {
	if(ns->resolved)
	continue;

	/* randomly select this item with probability toget/missing */
	if(!iter_ns_probability(qstate->env->rnd, toget, missing)) {
	/* do not select this one, next; select toget number
	* of items from a list one less in size */
	missing --;
	continue;
	}

	if(ie->supports_ipv6 && !ns->got6) {
	/* Send the AAAA request. */
	if(!generate_target_query(qstate, iq, id,
	ns->name, ns->namelen,
	LDNS_RR_TYPE_AAAA, iq->qchase.qclass)) {
	*num = query_count;
	if(query_count > 0)
	qstate->ext_state[id] = module_wait_subquery;
	return 0;
	}
	query_count++;
	}
	/* Send the A request. */
	if(ie->supports_ipv4 && !ns->got4) {
	if(!generate_target_query(qstate, iq, id,
	ns->name, ns->namelen,
	LDNS_RR_TYPE_A, iq->qchase.qclass)) {
	*num = query_count;
	if(query_count > 0)
	qstate->ext_state[id] = module_wait_subquery;
	return 0;
	}
	query_count++;
	}

	/* mark this target as in progress. */
	ns->resolved = 1;
	missing--;
	toget--;
	if(toget == 0)
	break;
	}
	*num = query_count;
	if(query_count > 0)
	qstate->ext_state[id] = module_wait_subquery;

	return 1;
	}

	/**
	* Called by processQueryTargets when it would like extra targets to query
	* but it seems to be out of options. At last resort some less appealing
	* options are explored. If there are no more options, the result is SERVFAIL
	*
	* @param qstate: query state.
	* @param iq: iterator query state.
	* @param ie: iterator shared global environment.
	* @param id: module id.
	* @return true if the event requires more request processing immediately,
	* false if not.
	*/
	static int
	processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
	struct iter_env* ie, int id)
	{
	struct delegpt_ns* ns;
	int query_count = 0;
	verbose(VERB_ALGO, "No more query targets, attempting last resort");
	log_assert(iq->dp);

	if(!can_have_last_resort(qstate->env, iq->dp->name, iq->dp->namelen,
	iq->qchase.qclass, NULL)) {
	/* fail -- no more targets, no more hope of targets, no hope
	* of a response. */
	errinf(qstate, "all the configured stub or forward servers failed,");
	errinf_dname(qstate, "at zone", iq->dp->name);
	verbose(VERB_QUERY, "configured stub or forward servers failed -- returning SERVFAIL");
	return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	if(!iq->dp->has_parent_side_NS && dname_is_root(iq->dp->name)) {
	struct delegpt* p = hints_lookup_root(qstate->env->hints,
	iq->qchase.qclass);
	if(p) {
	- struct delegpt_ns* ns;
	struct delegpt_addr* a;
	iq->chase_flags &= ~BIT_RD; /* go to authorities */
	for(ns = p->nslist; ns; ns=ns->next) {
	(void)delegpt_add_ns(iq->dp, qstate->region,
	ns->name, ns->lame);
	}
	for(a = p->target_list; a; a=a->next_target) {
	(void)delegpt_add_addr(iq->dp, qstate->region,
	&a->addr, a->addrlen, a->bogus,
	a->lame, a->tls_auth_name);
	}
	}
	iq->dp->has_parent_side_NS = 1;
	} else if(!iq->dp->has_parent_side_NS) {
	if(!iter_lookup_parent_NS_from_cache(qstate->env, iq->dp,
	qstate->region, &qstate->qinfo)
	\|\| !iq->dp->has_parent_side_NS) {
	/* if: malloc failure in lookup go up to try */
	/* if: no parent NS in cache - go up one level */
	verbose(VERB_ALGO, "try to grab parent NS");
	iq->store_parent_NS = iq->dp;
	iq->chase_flags &= ~BIT_RD; /* go to authorities */
	iq->deleg_msg = NULL;
	iq->refetch_glue = 1;
	iq->query_restart_count++;
	iq->sent_count = 0;
	if(qstate->env->cfg->qname_minimisation)
	iq->minimisation_state = INIT_MINIMISE_STATE;
	return next_state(iq, INIT_REQUEST_STATE);
	}
	}
	/* see if that makes new names available */
	if(!cache_fill_missing(qstate->env, iq->qchase.qclass,
	qstate->region, iq->dp))
	log_err("out of memory in cache_fill_missing");
	if(iq->dp->usable_list) {
	verbose(VERB_ALGO, "try parent-side-name, w. glue from cache");
	return next_state(iq, QUERYTARGETS_STATE);
	}
	/* try to fill out parent glue from cache */
	if(iter_lookup_parent_glue_from_cache(qstate->env, iq->dp,
	qstate->region, &qstate->qinfo)) {
	/* got parent stuff from cache, see if we can continue */
	verbose(VERB_ALGO, "try parent-side glue from cache");
	return next_state(iq, QUERYTARGETS_STATE);
	}
	/* query for an extra name added by the parent-NS record */
	if(delegpt_count_missing_targets(iq->dp) > 0) {
	int qs = 0;
	verbose(VERB_ALGO, "try parent-side target name");
	if(!query_for_targets(qstate, iq, ie, id, 1, &qs)) {
	errinf(qstate, "could not fetch nameserver");
	errinf_dname(qstate, "at zone", iq->dp->name);
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	iq->num_target_queries += qs;
	target_count_increase(iq, qs);
	if(qs != 0) {
	qstate->ext_state[id] = module_wait_subquery;
	return 0; /* and wait for them */
	}
	}
	if(iq->depth == ie->max_dependency_depth) {
	verbose(VERB_QUERY, "maxdepth and need more nameservers, fail");
	errinf(qstate, "cannot fetch more nameservers because at max dependency depth");
	return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	if(iq->depth > 0 && iq->target_count &&
	iq->target_count[1] > MAX_TARGET_COUNT) {
	char s[LDNS_MAX_DOMAINLEN+1];
	dname_str(qstate->qinfo.qname, s);
	verbose(VERB_QUERY, "request %s has exceeded the maximum "
	"number of glue fetches %d", s, iq->target_count[1]);
	errinf(qstate, "exceeded the maximum number of glue fetches");
	return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	/* mark cycle targets for parent-side lookups */
	iter_mark_pside_cycle_targets(qstate, iq->dp);
	/* see if we can issue queries to get nameserver addresses */
	/* this lookup is not randomized, but sequential. */
	for(ns = iq->dp->nslist; ns; ns = ns->next) {
	/* if this nameserver is at a delegation point, but that
	* delegation point is a stub and we cannot go higher, skip*/
	if( ((ie->supports_ipv6 && !ns->done_pside6) \|\|
	(ie->supports_ipv4 && !ns->done_pside4)) &&
	!can_have_last_resort(qstate->env, ns->name, ns->namelen,
	iq->qchase.qclass, NULL)) {
	log_nametypeclass(VERB_ALGO, "cannot pside lookup ns "
	"because it is also a stub/forward,",
	ns->name, LDNS_RR_TYPE_NS, iq->qchase.qclass);
	if(ie->supports_ipv6) ns->done_pside6 = 1;
	if(ie->supports_ipv4) ns->done_pside4 = 1;
	continue;
	}
	/* query for parent-side A and AAAA for nameservers */
	if(ie->supports_ipv6 && !ns->done_pside6) {
	/* Send the AAAA request. */
	if(!generate_parentside_target_query(qstate, iq, id,
	ns->name, ns->namelen,
	LDNS_RR_TYPE_AAAA, iq->qchase.qclass)) {
	errinf_dname(qstate, "could not generate nameserver AAAA lookup for", ns->name);
	return error_response(qstate, id,
	LDNS_RCODE_SERVFAIL);
	}
	ns->done_pside6 = 1;
	query_count++;
	}
	if(ie->supports_ipv4 && !ns->done_pside4) {
	/* Send the A request. */
	if(!generate_parentside_target_query(qstate, iq, id,
	ns->name, ns->namelen,
	LDNS_RR_TYPE_A, iq->qchase.qclass)) {
	errinf_dname(qstate, "could not generate nameserver A lookup for", ns->name);
	return error_response(qstate, id,
	LDNS_RCODE_SERVFAIL);
	}
	ns->done_pside4 = 1;
	query_count++;
	}
	if(query_count != 0) { /* suspend to await results */
	verbose(VERB_ALGO, "try parent-side glue lookup");
	iq->num_target_queries += query_count;
	target_count_increase(iq, query_count);
	qstate->ext_state[id] = module_wait_subquery;
	return 0;
	}
	}

	/* if this was a parent-side glue query itself, then store that
	* failure in cache. */
	if(!qstate->no_cache_store && iq->query_for_pside_glue
	&& !iq->pside_glue)
	iter_store_parentside_neg(qstate->env, &qstate->qinfo,
	iq->deleg_msg?iq->deleg_msg->rep:
	(iq->response?iq->response->rep:NULL));

	errinf(qstate, "all servers for this domain failed,");
	errinf_dname(qstate, "at zone", iq->dp->name);
	verbose(VERB_QUERY, "out of query targets -- returning SERVFAIL");
	/* fail -- no more targets, no more hope of targets, no hope
	* of a response. */
	return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
	}

	/**
	* Try to find the NS record set that will resolve a qtype DS query. Due
	* to grandparent/grandchild reasons we did not get a proper lookup right
	* away. We need to create type NS queries until we get the right parent
	* for this lookup. We remove labels from the query to find the right point.
	* If we end up at the old dp name, then there is no solution.
	*
	* @param qstate: query state.
	* @param iq: iterator query state.
	* @param id: module id.
	* @return true if the event requires more immediate processing, false if
	* not. This is generally only true when forwarding the request to
	* the final state (i.e., on answer).
	*/
	static int
	processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id)
	{
	struct module_qstate* subq = NULL;
	verbose(VERB_ALGO, "processDSNSFind");

	if(!iq->dsns_point) {
	/* initialize */
	iq->dsns_point = iq->qchase.qname;
	iq->dsns_point_len = iq->qchase.qname_len;
	}
	/* robustcheck for internal error: we are not underneath the dp */
	if(!dname_subdomain_c(iq->dsns_point, iq->dp->name)) {
	errinf_dname(qstate, "for DS query parent-child nameserver search the query is not under the zone", iq->dp->name);
	return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
	}

	/* go up one (more) step, until we hit the dp, if so, end */
	dname_remove_label(&iq->dsns_point, &iq->dsns_point_len);
	if(query_dname_compare(iq->dsns_point, iq->dp->name) == 0) {
	/* there was no inbetween nameserver, use the old delegation
	* point again. And this time, because dsns_point is nonNULL
	* we are going to accept the (bad) result */
	iq->state = QUERYTARGETS_STATE;
	return 1;
	}
	iq->state = DSNS_FIND_STATE;

	/* spawn NS lookup (validation not needed, this is for DS lookup) */
	log_nametypeclass(VERB_ALGO, "fetch nameservers",
	iq->dsns_point, LDNS_RR_TYPE_NS, iq->qchase.qclass);
	if(!generate_sub_request(iq->dsns_point, iq->dsns_point_len,
	LDNS_RR_TYPE_NS, iq->qchase.qclass, qstate, id, iq,
	INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0)) {
	errinf_dname(qstate, "for DS query parent-child nameserver search, could not generate NS lookup for", iq->dsns_point);
	return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
	}

	return 0;
	}

	/**
	* This is the request event state where the request will be sent to one of
	* its current query targets. This state also handles issuing target lookup
	* queries for missing target IP addresses. Queries typically iterate on
	* this state, both when they are just trying different targets for a given
	* delegation point, and when they change delegation points. This state
	* roughly corresponds to RFC 1034 algorithm steps 3 and 4.
	*
	* @param qstate: query state.
	* @param iq: iterator query state.
	* @param ie: iterator shared global environment.
	* @param id: module id.
	* @return true if the event requires more request processing immediately,
	* false if not. This state only returns true when it is generating
	* a SERVFAIL response because the query has hit a dead end.
	*/
	static int
	processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
	struct iter_env* ie, int id)
	{
	int tf_policy;
	struct delegpt_addr* target;
	struct outbound_entry* outq;
	int auth_fallback = 0;
	+ uint8_t* qout_orig = NULL;
	+ size_t qout_orig_len = 0;

	/* NOTE: a request will encounter this state for each target it
	* needs to send a query to. That is, at least one per referral,
	* more if some targets timeout or return throwaway answers. */

	log_query_info(VERB_QUERY, "processQueryTargets:", &qstate->qinfo);
	verbose(VERB_ALGO, "processQueryTargets: targetqueries %d, "
	"currentqueries %d sentcount %d", iq->num_target_queries,
	iq->num_current_queries, iq->sent_count);

	/* Make sure that we haven't run away */
	/* FIXME: is this check even necessary? */
	if(iq->referral_count > MAX_REFERRAL_COUNT) {
	verbose(VERB_QUERY, "request has exceeded the maximum "
	"number of referrrals with %d", iq->referral_count);
	errinf(qstate, "exceeded the maximum of referrals");
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	if(iq->sent_count > MAX_SENT_COUNT) {
	verbose(VERB_QUERY, "request has exceeded the maximum "
	"number of sends with %d", iq->sent_count);
	errinf(qstate, "exceeded the maximum number of sends");
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}

	/* Make sure we have a delegation point, otherwise priming failed
	* or another failure occurred */
	if(!iq->dp) {
	verbose(VERB_QUERY, "Failed to get a delegation, giving up");
	errinf(qstate, "failed to get a delegation (eg. prime failure)");
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	if(!ie->supports_ipv6)
	delegpt_no_ipv6(iq->dp);
	if(!ie->supports_ipv4)
	delegpt_no_ipv4(iq->dp);
	delegpt_log(VERB_ALGO, iq->dp);

	if(iq->num_current_queries>0) {
	/* already busy answering a query, this restart is because
	* more delegpt addrs became available, wait for existing
	* query. */
	verbose(VERB_ALGO, "woke up, but wait for outstanding query");
	qstate->ext_state[id] = module_wait_reply;
	return 0;
	}

	if(iq->minimisation_state == INIT_MINIMISE_STATE
	&& !(iq->chase_flags & BIT_RD)) {
	/* (Re)set qinfo_out to (new) delegation point, except when
	* qinfo_out is already a subdomain of dp. This happens when
	* increasing by more than one label at once (QNAMEs with more
	* than MAX_MINIMISE_COUNT labels). */
	if(!(iq->qinfo_out.qname_len
	&& dname_subdomain_c(iq->qchase.qname,
	iq->qinfo_out.qname)
	&& dname_subdomain_c(iq->qinfo_out.qname,
	iq->dp->name))) {
	iq->qinfo_out.qname = iq->dp->name;
	iq->qinfo_out.qname_len = iq->dp->namelen;
	iq->qinfo_out.qtype = LDNS_RR_TYPE_A;
	iq->qinfo_out.qclass = iq->qchase.qclass;
	iq->qinfo_out.local_alias = NULL;
	iq->minimise_count = 0;
	}

	iq->minimisation_state = MINIMISE_STATE;
	}
	if(iq->minimisation_state == MINIMISE_STATE) {
	int qchaselabs = dname_count_labels(iq->qchase.qname);
	int labdiff = qchaselabs -
	dname_count_labels(iq->qinfo_out.qname);

	+ qout_orig = iq->qinfo_out.qname;
	+ qout_orig_len = iq->qinfo_out.qname_len;
	iq->qinfo_out.qname = iq->qchase.qname;
	iq->qinfo_out.qname_len = iq->qchase.qname_len;
	iq->minimise_count++;
	iq->minimise_timeout_count = 0;

	iter_dec_attempts(iq->dp, 1);

	/* Limit number of iterations for QNAMEs with more
	* than MAX_MINIMISE_COUNT labels. Send first MINIMISE_ONE_LAB
	* labels of QNAME always individually.
	*/
	if(qchaselabs > MAX_MINIMISE_COUNT && labdiff > 1 &&
	iq->minimise_count > MINIMISE_ONE_LAB) {
	if(iq->minimise_count < MAX_MINIMISE_COUNT) {
	int multilabs = qchaselabs - 1 -
	MINIMISE_ONE_LAB;
	int extralabs = multilabs /
	MINIMISE_MULTIPLE_LABS;

	if (MAX_MINIMISE_COUNT - iq->minimise_count >=
	multilabs % MINIMISE_MULTIPLE_LABS)
	/* Default behaviour is to add 1 label
	* every iteration. Therefore, decrement
	* the extralabs by 1 */
	extralabs--;
	if (extralabs < labdiff)
	labdiff -= extralabs;
	else
	labdiff = 1;
	}
	/* Last minimised iteration, send all labels with
	* QTYPE=NS */
	else
	labdiff = 1;
	}

	if(labdiff > 1) {
	verbose(VERB_QUERY, "removing %d labels", labdiff-1);
	dname_remove_labels(&iq->qinfo_out.qname,
	&iq->qinfo_out.qname_len,
	labdiff-1);
	}
	if(labdiff < 1 \|\| (labdiff < 2
	&& (iq->qchase.qtype == LDNS_RR_TYPE_DS
	\|\| iq->qchase.qtype == LDNS_RR_TYPE_A)))
	/* Stop minimising this query, resolve "as usual" */
	iq->minimisation_state = DONOT_MINIMISE_STATE;
	else if(!qstate->no_cache_lookup) {
	struct dns_msg* msg = dns_cache_lookup(qstate->env,
	iq->qinfo_out.qname, iq->qinfo_out.qname_len,
	iq->qinfo_out.qtype, iq->qinfo_out.qclass,
	qstate->query_flags, qstate->region,
	qstate->env->scratch, 0);
	if(msg && msg->rep->an_numrrsets == 0
	&& FLAGS_GET_RCODE(msg->rep->flags) ==
	LDNS_RCODE_NOERROR)
	/* no need to send query if it is already
	* cached as NOERROR/NODATA */
	return 1;
	}
	}
	if(iq->minimisation_state == SKIP_MINIMISE_STATE) {
	if(iq->minimise_timeout_count < MAX_MINIMISE_TIMEOUT_COUNT)
	/* Do not increment qname, continue incrementing next
	* iteration */
	iq->minimisation_state = MINIMISE_STATE;
	else if(!qstate->env->cfg->qname_minimisation_strict)
	/* Too many time-outs detected for this QNAME and QTYPE.
	* We give up, disable QNAME minimisation. */
	iq->minimisation_state = DONOT_MINIMISE_STATE;
	}
	if(iq->minimisation_state == DONOT_MINIMISE_STATE)
	iq->qinfo_out = iq->qchase;

	/* now find an answer to this query */
	/* see if authority zones have an answer */
	/* now we know the dp, we can check the auth zone for locally hosted
	* contents */
	if(!iq->auth_zone_avoid && qstate->blacklist) {
	if(auth_zones_can_fallback(qstate->env->auth_zones,
	iq->dp->name, iq->dp->namelen, iq->qinfo_out.qclass)) {
	/* if cache is blacklisted and this zone allows us
	* to fallback to the internet, then do so, and
	* fetch results from the internet servers */
	iq->auth_zone_avoid = 1;
	}
	}
	if(iq->auth_zone_avoid) {
	iq->auth_zone_avoid = 0;
	auth_fallback = 1;
	} else if(auth_zones_lookup(qstate->env->auth_zones, &iq->qinfo_out,
	qstate->region, &iq->response, &auth_fallback, iq->dp->name,
	iq->dp->namelen)) {
	/* use this as a response to be processed by the iterator */
	if(verbosity >= VERB_ALGO) {
	log_dns_msg("msg from auth zone",
	&iq->response->qinfo, iq->response->rep);
	}
	if((iq->chase_flags&BIT_RD) && !(iq->response->rep->flags&BIT_AA)) {
	verbose(VERB_ALGO, "forwarder, ignoring referral from auth zone");
	} else {
	lock_rw_wrlock(&qstate->env->auth_zones->lock);
	qstate->env->auth_zones->num_query_up++;
	lock_rw_unlock(&qstate->env->auth_zones->lock);
	iq->num_current_queries++;
	iq->chase_to_rd = 0;
	iq->dnssec_lame_query = 0;
	iq->auth_zone_response = 1;
	return next_state(iq, QUERY_RESP_STATE);
	}
	}
	iq->auth_zone_response = 0;
	if(auth_fallback == 0) {
	/* like we got servfail from the auth zone lookup, and
	* no internet fallback */
	verbose(VERB_ALGO, "auth zone lookup failed, no fallback,"
	" servfail");
	errinf(qstate, "auth zone lookup failed, fallback is off");
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	- if(iq->dp && iq->dp->auth_dp) {
	+ if(iq->dp->auth_dp) {
	/* we wanted to fallback, but had no delegpt, only the
	* auth zone generated delegpt, create an actual one */
	iq->auth_zone_avoid = 1;
	return next_state(iq, INIT_REQUEST_STATE);
	}
	/* but mostly, fallback==1 (like, when no such auth zone exists)
	* and we continue with lookups */

	tf_policy = 0;
	/* < not <=, because although the array is large enough for <=, the
	* generated query will immediately be discarded due to depth and
	* that servfail is cached, which is not good as opportunism goes. */
	if(iq->depth < ie->max_dependency_depth
	&& iq->sent_count < TARGET_FETCH_STOP) {
	tf_policy = ie->target_fetch_policy[iq->depth];
	}

	/* if in 0x20 fallback get as many targets as possible */
	if(iq->caps_fallback) {
	int extra = 0;
	size_t naddr, nres, navail;
	if(!query_for_targets(qstate, iq, ie, id, -1, &extra)) {
	errinf(qstate, "could not fetch nameservers for 0x20 fallback");
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	iq->num_target_queries += extra;
	target_count_increase(iq, extra);
	if(iq->num_target_queries > 0) {
	/* wait to get all targets, we want to try em */
	verbose(VERB_ALGO, "wait for all targets for fallback");
	qstate->ext_state[id] = module_wait_reply;
	+ /* undo qname minimise step because we'll get back here
	+ * to do it again */
	+ if(qout_orig && iq->minimise_count > 0) {
	+ iq->minimise_count--;
	+ iq->qinfo_out.qname = qout_orig;
	+ iq->qinfo_out.qname_len = qout_orig_len;
	+ }
	return 0;
	}
	/* did we do enough fallback queries already? */
	delegpt_count_addr(iq->dp, &naddr, &nres, &navail);
	/* the current caps_server is the number of fallbacks sent.
	* the original query is one that matched too, so we have
	* caps_server+1 number of matching queries now */
	if(iq->caps_server+1 >= naddr*3 \|\|
	iq->caps_server*2+2 >= MAX_SENT_COUNT) {
	/* 2 on sentcount check because ipv6 may fail /
	/* we're done, process the response */
	verbose(VERB_ALGO, "0x20 fallback had %d responses "
	"match for %d wanted, done.",
	(int)iq->caps_server+1, (int)naddr*3);
	iq->response = iq->caps_response;
	iq->caps_fallback = 0;
	iter_dec_attempts(iq->dp, 3); /* space for fallback */
	iq->num_current_queries++; /* RespState decrements it*/
	iq->referral_count++; /* make sure we don't loop */
	iq->sent_count = 0;
	iq->state = QUERY_RESP_STATE;
	return 1;
	}
	verbose(VERB_ALGO, "0x20 fallback number %d",
	(int)iq->caps_server);

	/* if there is a policy to fetch missing targets
	* opportunistically, do it. we rely on the fact that once a
	* query (or queries) for a missing name have been issued,
	* they will not show up again. */
	} else if(tf_policy != 0) {
	int extra = 0;
	verbose(VERB_ALGO, "attempt to get extra %d targets",
	tf_policy);
	(void)query_for_targets(qstate, iq, ie, id, tf_policy, &extra);
	/* errors ignored, these targets are not strictly necessary for
	* this result, we do not have to reply with SERVFAIL */
	iq->num_target_queries += extra;
	target_count_increase(iq, extra);
	}

	/* Add the current set of unused targets to our queue. */
	delegpt_add_unused_targets(iq->dp);

	/* Select the next usable target, filtering out unsuitable targets. */
	target = iter_server_selection(ie, qstate->env, iq->dp,
	iq->dp->name, iq->dp->namelen, iq->qchase.qtype,
	&iq->dnssec_lame_query, &iq->chase_to_rd,
	iq->num_target_queries, qstate->blacklist,
	qstate->prefetch_leeway);

	/* If no usable target was selected... */
	if(!target) {
	/* Here we distinguish between three states: generate a new
	* target query, just wait, or quit (with a SERVFAIL).
	* We have the following information: number of active
	* target queries, number of active current queries,
	* the presence of missing targets at this delegation
	* point, and the given query target policy. */

	/* Check for the wait condition. If this is true, then
	* an action must be taken. */
	if(iq->num_target_queries==0 && iq->num_current_queries==0) {
	/* If there is nothing to wait for, then we need
	* to distinguish between generating (a) new target
	* query, or failing. */
	if(delegpt_count_missing_targets(iq->dp) > 0) {
	int qs = 0;
	verbose(VERB_ALGO, "querying for next "
	"missing target");
	if(!query_for_targets(qstate, iq, ie, id,
	1, &qs)) {
	errinf(qstate, "could not fetch nameserver");
	errinf_dname(qstate, "at zone", iq->dp->name);
	return error_response(qstate, id,
	LDNS_RCODE_SERVFAIL);
	}
	if(qs == 0 &&
	delegpt_count_missing_targets(iq->dp) == 0){
	/* it looked like there were missing
	* targets, but they did not turn up.
	* Try the bad choices again (if any),
	* when we get back here missing==0,
	* so this is not a loop. */
	return 1;
	}
	iq->num_target_queries += qs;
	target_count_increase(iq, qs);
	}
	/* Since a target query might have been made, we
	* need to check again. */
	if(iq->num_target_queries == 0) {
	/* if in capsforid fallback, instead of last
	* resort, we agree with the current reply
	* we have (if any) (our count of addrs bad)*/
	if(iq->caps_fallback && iq->caps_reply) {
	/* we're done, process the response */
	verbose(VERB_ALGO, "0x20 fallback had %d responses, "
	"but no more servers except "
	"last resort, done.",
	(int)iq->caps_server+1);
	iq->response = iq->caps_response;
	iq->caps_fallback = 0;
	iter_dec_attempts(iq->dp, 3); /* space for fallback */
	iq->num_current_queries++; /* RespState decrements it*/
	iq->referral_count++; /* make sure we don't loop */
	iq->sent_count = 0;
	iq->state = QUERY_RESP_STATE;
	return 1;
	}
	return processLastResort(qstate, iq, ie, id);
	}
	}

	/* otherwise, we have no current targets, so submerge
	* until one of the target or direct queries return. */
	if(iq->num_target_queries>0 && iq->num_current_queries>0) {
	verbose(VERB_ALGO, "no current targets -- waiting "
	"for %d targets to resolve or %d outstanding"
	" queries to respond", iq->num_target_queries,
	iq->num_current_queries);
	qstate->ext_state[id] = module_wait_reply;
	} else if(iq->num_target_queries>0) {
	verbose(VERB_ALGO, "no current targets -- waiting "
	"for %d targets to resolve.",
	iq->num_target_queries);
	qstate->ext_state[id] = module_wait_subquery;
	} else {
	verbose(VERB_ALGO, "no current targets -- waiting "
	"for %d outstanding queries to respond.",
	iq->num_current_queries);
	qstate->ext_state[id] = module_wait_reply;
	}
	+ /* undo qname minimise step because we'll get back here
	+ * to do it again */
	+ if(qout_orig && iq->minimise_count > 0) {
	+ iq->minimise_count--;
	+ iq->qinfo_out.qname = qout_orig;
	+ iq->qinfo_out.qname_len = qout_orig_len;
	+ }
	return 0;
	}

	/* if not forwarding, check ratelimits per delegationpoint name */
	if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) {
	if(!infra_ratelimit_inc(qstate->env->infra_cache, iq->dp->name,
	- iq->dp->namelen, *qstate->env->now)) {
	+ iq->dp->namelen, *qstate->env->now, &qstate->qinfo,
	+ qstate->reply)) {
	lock_basic_lock(&ie->queries_ratelimit_lock);
	ie->num_queries_ratelimited++;
	lock_basic_unlock(&ie->queries_ratelimit_lock);
	verbose(VERB_ALGO, "query exceeded ratelimits");
	qstate->was_ratelimited = 1;
	errinf_dname(qstate, "exceeded ratelimit for zone",
	iq->dp->name);
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	}

	/* We have a valid target. */
	if(verbosity >= VERB_QUERY) {
	log_query_info(VERB_QUERY, "sending query:", &iq->qinfo_out);
	log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name,
	&target->addr, target->addrlen);
	verbose(VERB_ALGO, "dnssec status: %s%s",
	iq->dnssec_expected?"expected": "not expected",
	iq->dnssec_lame_query?" but lame_query anyway": "");
	}
	fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query));
	outq = (*qstate->env->send_query)(&iq->qinfo_out,
	iq->chase_flags \| (iq->chase_to_rd?BIT_RD:0),
	/* unset CD if to forwarder(RD set) and not dnssec retry
	* (blacklist nonempty) and no trust-anchors are configured
	* above the qname or on the first attempt when dnssec is on */
	EDNS_DO\| ((iq->chase_to_rd\|\|(iq->chase_flags&BIT_RD)!=0)&&
	!qstate->blacklist&&(!iter_qname_indicates_dnssec(qstate->env,
	&iq->qinfo_out)\|\|target->attempts==1)?0:BIT_CD),
	iq->dnssec_expected, iq->caps_fallback \|\| is_caps_whitelisted(
	ie, iq), &target->addr, target->addrlen,
	iq->dp->name, iq->dp->namelen,
	(iq->dp->ssl_upstream \|\| qstate->env->cfg->ssl_upstream),
	target->tls_auth_name, qstate);
	if(!outq) {
	log_addr(VERB_DETAIL, "error sending query to auth server",
	&target->addr, target->addrlen);
	if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok)
	infra_ratelimit_dec(qstate->env->infra_cache, iq->dp->name,
	iq->dp->namelen, *qstate->env->now);
	if(qstate->env->cfg->qname_minimisation)
	iq->minimisation_state = SKIP_MINIMISE_STATE;
	return next_state(iq, QUERYTARGETS_STATE);
	}
	outbound_list_insert(&iq->outlist, outq);
	iq->num_current_queries++;
	iq->sent_count++;
	qstate->ext_state[id] = module_wait_reply;

	return 0;
	}

	/** find NS rrset in given list */
	static struct ub_packed_rrset_key*
	find_NS(struct reply_info* rep, size_t from, size_t to)
	{
	size_t i;
	for(i=from; i<to; i++) {
	if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS)
	return rep->rrsets[i];
	}
	return NULL;
	}


	/**
	* Process the query response. All queries end up at this state first. This
	* process generally consists of analyzing the response and routing the
	* event to the next state (either bouncing it back to a request state, or
	* terminating the processing for this event).
	*
	* @param qstate: query state.
	* @param iq: iterator query state.
	* @param id: module id.
	* @return true if the event requires more immediate processing, false if
	* not. This is generally only true when forwarding the request to
	* the final state (i.e., on answer).
	*/
	static int
	processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
	int id)
	{
	int dnsseclame = 0;
	enum response_type type;
	iq->num_current_queries--;

	if(!inplace_cb_query_response_call(qstate->env, qstate, iq->response))
	log_err("unable to call query_response callback");

	if(iq->response == NULL) {
	/* Don't increment qname when QNAME minimisation is enabled */
	if(qstate->env->cfg->qname_minimisation) {
	iq->minimise_timeout_count++;
	iq->minimisation_state = SKIP_MINIMISE_STATE;
	}
	iq->chase_to_rd = 0;
	iq->dnssec_lame_query = 0;
	verbose(VERB_ALGO, "query response was timeout");
	return next_state(iq, QUERYTARGETS_STATE);
	}
	type = response_type_from_server(
	(int)((iq->chase_flags&BIT_RD) \|\| iq->chase_to_rd),
	iq->response, &iq->qinfo_out, iq->dp);
	iq->chase_to_rd = 0;
	if(type == RESPONSE_TYPE_REFERRAL && (iq->chase_flags&BIT_RD) &&
	!iq->auth_zone_response) {
	/* When forwarding (RD bit is set), we handle referrals
	* differently. No queries should be sent elsewhere */
	type = RESPONSE_TYPE_ANSWER;
	}
	if(!qstate->env->cfg->disable_dnssec_lame_check && iq->dnssec_expected
	&& !iq->dnssec_lame_query &&
	!(iq->chase_flags&BIT_RD)
	&& iq->sent_count < DNSSEC_LAME_DETECT_COUNT
	&& type != RESPONSE_TYPE_LAME
	&& type != RESPONSE_TYPE_REC_LAME
	&& type != RESPONSE_TYPE_THROWAWAY
	&& type != RESPONSE_TYPE_UNTYPED) {
	/* a possible answer, see if it is missing DNSSEC */
	/* but not when forwarding, so we dont mark fwder lame */
	if(!iter_msg_has_dnssec(iq->response)) {
	/* Mark this address as dnsseclame in this dp,
	* because that will make serverselection disprefer
	* it, but also, once it is the only final option,
	* use dnssec-lame-bypass if it needs to query there.*/
	if(qstate->reply) {
	struct delegpt_addr* a = delegpt_find_addr(
	iq->dp, &qstate->reply->addr,
	qstate->reply->addrlen);
	if(a) a->dnsseclame = 1;
	}
	/* test the answer is from the zone we expected,
	* otherwise, (due to parent,child on same server), we
	* might mark the server,zone lame inappropriately */
	if(!iter_msg_from_zone(iq->response, iq->dp, type,
	iq->qchase.qclass))
	qstate->reply = NULL;
	type = RESPONSE_TYPE_LAME;
	dnsseclame = 1;
	}
	} else iq->dnssec_lame_query = 0;
	/* see if referral brings us close to the target */
	if(type == RESPONSE_TYPE_REFERRAL) {
	struct ub_packed_rrset_key* ns = find_NS(
	iq->response->rep, iq->response->rep->an_numrrsets,
	iq->response->rep->an_numrrsets
	+ iq->response->rep->ns_numrrsets);
	if(!ns) ns = find_NS(iq->response->rep, 0,
	iq->response->rep->an_numrrsets);
	if(!ns \|\| !dname_strict_subdomain_c(ns->rk.dname, iq->dp->name)
	\|\| !dname_subdomain_c(iq->qchase.qname, ns->rk.dname)){
	verbose(VERB_ALGO, "bad referral, throwaway");
	type = RESPONSE_TYPE_THROWAWAY;
	} else
	iter_scrub_ds(iq->response, ns, iq->dp->name);
	} else iter_scrub_ds(iq->response, NULL, NULL);
	if(type == RESPONSE_TYPE_THROWAWAY &&
	FLAGS_GET_RCODE(iq->response->rep->flags) == LDNS_RCODE_YXDOMAIN) {
	/* YXDOMAIN is a permanent error, no need to retry */
	type = RESPONSE_TYPE_ANSWER;
	}
	if(type == RESPONSE_TYPE_CNAME && iq->response->rep->an_numrrsets >= 1
	&& ntohs(iq->response->rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_DNAME) {
	uint8_t* sname = NULL;
	size_t snamelen = 0;
	get_cname_target(iq->response->rep->rrsets[0], &sname,
	&snamelen);
	if(snamelen && dname_subdomain_c(sname, iq->response->rep->rrsets[0]->rk.dname)) {
	/* DNAME to a subdomain loop; do not recurse */
	type = RESPONSE_TYPE_ANSWER;
	}
	} else if(type == RESPONSE_TYPE_CNAME &&
	iq->qchase.qtype == LDNS_RR_TYPE_CNAME &&
	iq->minimisation_state == MINIMISE_STATE &&
	query_dname_compare(iq->qchase.qname, iq->qinfo_out.qname) == 0) {
	/* The minimised query for full QTYPE and hidden QTYPE can be
	* classified as CNAME response type, even when the original
	* QTYPE=CNAME. This should be treated as answer response type.
	*/
	type = RESPONSE_TYPE_ANSWER;
	}

	/* handle each of the type cases */
	if(type == RESPONSE_TYPE_ANSWER) {
	/* ANSWER type responses terminate the query algorithm,
	* so they sent on their */
	if(verbosity >= VERB_DETAIL) {
	verbose(VERB_DETAIL, "query response was %s",
	FLAGS_GET_RCODE(iq->response->rep->flags)
	==LDNS_RCODE_NXDOMAIN?"NXDOMAIN ANSWER":
	(iq->response->rep->an_numrrsets?"ANSWER":
	"nodata ANSWER"));
	}
	/* if qtype is DS, check we have the right level of answer,
	* like grandchild answer but we need the middle, reject it */
	if(iq->qchase.qtype == LDNS_RR_TYPE_DS && !iq->dsns_point
	&& !(iq->chase_flags&BIT_RD)
	&& iter_ds_toolow(iq->response, iq->dp)
	&& iter_dp_cangodown(&iq->qchase, iq->dp)) {
	/* close down outstanding requests to be discarded */
	outbound_list_clear(&iq->outlist);
	iq->num_current_queries = 0;
	fptr_ok(fptr_whitelist_modenv_detach_subs(
	qstate->env->detach_subs));
	(*qstate->env->detach_subs)(qstate);
	iq->num_target_queries = 0;
	return processDSNSFind(qstate, iq, id);
	}
	if(!qstate->no_cache_store)
	iter_dns_store(qstate->env, &iq->response->qinfo,
	iq->response->rep, 0, qstate->prefetch_leeway,
	iq->dp&&iq->dp->has_parent_side_NS,
	qstate->region, qstate->query_flags);
	/* close down outstanding requests to be discarded */
	outbound_list_clear(&iq->outlist);
	iq->num_current_queries = 0;
	fptr_ok(fptr_whitelist_modenv_detach_subs(
	qstate->env->detach_subs));
	(*qstate->env->detach_subs)(qstate);
	iq->num_target_queries = 0;
	if(qstate->reply)
	sock_list_insert(&qstate->reply_origin,
	&qstate->reply->addr, qstate->reply->addrlen,
	qstate->region);
	if(iq->minimisation_state != DONOT_MINIMISE_STATE
	&& !(iq->chase_flags & BIT_RD)) {
	if(FLAGS_GET_RCODE(iq->response->rep->flags) !=
	LDNS_RCODE_NOERROR) {
	- if(qstate->env->cfg->qname_minimisation_strict)
	- return final_state(iq);
	+ if(qstate->env->cfg->qname_minimisation_strict) {
	+ if(FLAGS_GET_RCODE(iq->response->rep->flags) ==
	+ LDNS_RCODE_NXDOMAIN) {
	+ iter_scrub_nxdomain(iq->response);
	+ return final_state(iq);
	+ }
	+ return error_response(qstate, id,
	+ LDNS_RCODE_SERVFAIL);
	+ }
	/* Best effort qname-minimisation.
	* Stop minimising and send full query when
	* RCODE is not NOERROR. */
	iq->minimisation_state = DONOT_MINIMISE_STATE;
	}
	if(FLAGS_GET_RCODE(iq->response->rep->flags) ==
	LDNS_RCODE_NXDOMAIN) {
	/* Stop resolving when NXDOMAIN is DNSSEC
	* signed. Based on assumption that nameservers
	* serving signed zones do not return NXDOMAIN
	* for empty-non-terminals. */
	if(iq->dnssec_expected)
	return final_state(iq);
	/* Make subrequest to validate intermediate
	* NXDOMAIN if harden-below-nxdomain is
	* enabled. */
	if(qstate->env->cfg->harden_below_nxdomain) {
	struct module_qstate* subq = NULL;
	log_query_info(VERB_QUERY,
	"schedule NXDOMAIN validation:",
	&iq->response->qinfo);
	if(!generate_sub_request(
	iq->response->qinfo.qname,
	iq->response->qinfo.qname_len,
	iq->response->qinfo.qtype,
	iq->response->qinfo.qclass,
	qstate, id, iq,
	INIT_REQUEST_STATE,
	FINISHED_STATE, &subq, 1))
	verbose(VERB_ALGO,
	"could not validate NXDOMAIN "
	"response");
	outbound_list_clear(&iq->outlist);
	iq->num_current_queries = 0;
	fptr_ok(fptr_whitelist_modenv_detach_subs(
	qstate->env->detach_subs));
	(*qstate->env->detach_subs)(qstate);
	iq->num_target_queries = 0;
	}
	}
	return next_state(iq, QUERYTARGETS_STATE);
	}
	return final_state(iq);
	} else if(type == RESPONSE_TYPE_REFERRAL) {
	/* REFERRAL type responses get a reset of the
	* delegation point, and back to the QUERYTARGETS_STATE. */
	verbose(VERB_DETAIL, "query response was REFERRAL");

	if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) {
	/* we have a referral, no ratelimit, we can send
	* our queries to the given name */
	infra_ratelimit_dec(qstate->env->infra_cache,
	iq->dp->name, iq->dp->namelen,
	*qstate->env->now);
	}

	/* if hardened, only store referral if we asked for it */
	if(!qstate->no_cache_store &&
	(!qstate->env->cfg->harden_referral_path \|\|
	( qstate->qinfo.qtype == LDNS_RR_TYPE_NS
	&& (qstate->query_flags&BIT_RD)
	&& !(qstate->query_flags&BIT_CD)
	/* we know that all other NS rrsets are scrubbed
	* away, thus on referral only one is left.
	* see if that equals the query name... */
	&& ( /* auth section, but sometimes in answer section*/
	reply_find_rrset_section_ns(iq->response->rep,
	iq->qchase.qname, iq->qchase.qname_len,
	LDNS_RR_TYPE_NS, iq->qchase.qclass)
	\|\| reply_find_rrset_section_an(iq->response->rep,
	iq->qchase.qname, iq->qchase.qname_len,
	LDNS_RR_TYPE_NS, iq->qchase.qclass)
	)
	))) {
	/* Store the referral under the current query */
	/* no prefetch-leeway, since its not the answer */
	iter_dns_store(qstate->env, &iq->response->qinfo,
	iq->response->rep, 1, 0, 0, NULL, 0);
	if(iq->store_parent_NS)
	iter_store_parentside_NS(qstate->env,
	iq->response->rep);
	if(qstate->env->neg_cache)
	val_neg_addreferral(qstate->env->neg_cache,
	iq->response->rep, iq->dp->name);
	}
	/* store parent-side-in-zone-glue, if directly queried for */
	if(!qstate->no_cache_store && iq->query_for_pside_glue
	&& !iq->pside_glue) {
	iq->pside_glue = reply_find_rrset(iq->response->rep,
	iq->qchase.qname, iq->qchase.qname_len,
	iq->qchase.qtype, iq->qchase.qclass);
	if(iq->pside_glue) {
	log_rrset_key(VERB_ALGO, "found parent-side "
	"glue", iq->pside_glue);
	iter_store_parentside_rrset(qstate->env,
	iq->pside_glue);
	}
	}

	/* Reset the event state, setting the current delegation
	* point to the referral. */
	iq->deleg_msg = iq->response;
	iq->dp = delegpt_from_message(iq->response, qstate->region);
	if (qstate->env->cfg->qname_minimisation)
	iq->minimisation_state = INIT_MINIMISE_STATE;
	if(!iq->dp) {
	errinf(qstate, "malloc failure, for delegation point");
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	if(!cache_fill_missing(qstate->env, iq->qchase.qclass,
	qstate->region, iq->dp)) {
	errinf(qstate, "malloc failure, copy extra info into delegation point");
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	if(iq->store_parent_NS && query_dname_compare(iq->dp->name,
	iq->store_parent_NS->name) == 0)
	iter_merge_retry_counts(iq->dp, iq->store_parent_NS);
	delegpt_log(VERB_ALGO, iq->dp);
	/* Count this as a referral. */
	iq->referral_count++;
	iq->sent_count = 0;
	/* see if the next dp is a trust anchor, or a DS was sent
	* along, indicating dnssec is expected for next zone */
	iq->dnssec_expected = iter_indicates_dnssec(qstate->env,
	iq->dp, iq->response, iq->qchase.qclass);
	/* if dnssec, validating then also fetch the key for the DS */
	if(iq->dnssec_expected && qstate->env->cfg->prefetch_key &&
	!(qstate->query_flags&BIT_CD))
	generate_dnskey_prefetch(qstate, iq, id);

	/* spawn off NS and addr to auth servers for the NS we just
	* got in the referral. This gets authoritative answer
	* (answer section trust level) rrset.
	* right after, we detach the subs, answer goes to cache. */
	if(qstate->env->cfg->harden_referral_path)
	generate_ns_check(qstate, iq, id);

	/* stop current outstanding queries.
	* FIXME: should the outstanding queries be waited for and
	* handled? Say by a subquery that inherits the outbound_entry.
	*/
	outbound_list_clear(&iq->outlist);
	iq->num_current_queries = 0;
	fptr_ok(fptr_whitelist_modenv_detach_subs(
	qstate->env->detach_subs));
	(*qstate->env->detach_subs)(qstate);
	iq->num_target_queries = 0;
	verbose(VERB_ALGO, "cleared outbound list for next round");
	return next_state(iq, QUERYTARGETS_STATE);
	} else if(type == RESPONSE_TYPE_CNAME) {
	uint8_t* sname = NULL;
	size_t snamelen = 0;
	/* CNAME type responses get a query restart (i.e., get a
	* reset of the query state and go back to INIT_REQUEST_STATE).
	*/
	verbose(VERB_DETAIL, "query response was CNAME");
	if(verbosity >= VERB_ALGO)
	log_dns_msg("cname msg", &iq->response->qinfo,
	iq->response->rep);
	/* if qtype is DS, check we have the right level of answer,
	* like grandchild answer but we need the middle, reject it */
	if(iq->qchase.qtype == LDNS_RR_TYPE_DS && !iq->dsns_point
	&& !(iq->chase_flags&BIT_RD)
	&& iter_ds_toolow(iq->response, iq->dp)
	&& iter_dp_cangodown(&iq->qchase, iq->dp)) {
	outbound_list_clear(&iq->outlist);
	iq->num_current_queries = 0;
	fptr_ok(fptr_whitelist_modenv_detach_subs(
	qstate->env->detach_subs));
	(*qstate->env->detach_subs)(qstate);
	iq->num_target_queries = 0;
	return processDSNSFind(qstate, iq, id);
	}
	/* Process the CNAME response. */
	if(!handle_cname_response(qstate, iq, iq->response,
	&sname, &snamelen)) {
	errinf(qstate, "malloc failure, CNAME info");
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	/* cache the CNAME response under the current query */
	/* NOTE : set referral=1, so that rrsets get stored but not
	* the partial query answer (CNAME only). */
	/* prefetchleeway applied because this updates answer parts */
	if(!qstate->no_cache_store)
	iter_dns_store(qstate->env, &iq->response->qinfo,
	iq->response->rep, 1, qstate->prefetch_leeway,
	iq->dp&&iq->dp->has_parent_side_NS, NULL,
	qstate->query_flags);
	/* set the current request's qname to the new value. */
	iq->qchase.qname = sname;
	iq->qchase.qname_len = snamelen;
	/* Clear the query state, since this is a query restart. */
	iq->deleg_msg = NULL;
	iq->dp = NULL;
	iq->dsns_point = NULL;
	iq->auth_zone_response = 0;
	iq->sent_count = 0;
	if(iq->minimisation_state != MINIMISE_STATE)
	/* Only count as query restart when it is not an extra
	* query as result of qname minimisation. */
	iq->query_restart_count++;
	if(qstate->env->cfg->qname_minimisation)
	iq->minimisation_state = INIT_MINIMISE_STATE;

	/* stop current outstanding queries.
	* FIXME: should the outstanding queries be waited for and
	* handled? Say by a subquery that inherits the outbound_entry.
	*/
	outbound_list_clear(&iq->outlist);
	iq->num_current_queries = 0;
	fptr_ok(fptr_whitelist_modenv_detach_subs(
	qstate->env->detach_subs));
	(*qstate->env->detach_subs)(qstate);
	iq->num_target_queries = 0;
	if(qstate->reply)
	sock_list_insert(&qstate->reply_origin,
	&qstate->reply->addr, qstate->reply->addrlen,
	qstate->region);
	verbose(VERB_ALGO, "cleared outbound list for query restart");
	/* go to INIT_REQUEST_STATE for new qname. */
	return next_state(iq, INIT_REQUEST_STATE);
	} else if(type == RESPONSE_TYPE_LAME) {
	/* Cache the LAMEness. */
	verbose(VERB_DETAIL, "query response was %sLAME",
	dnsseclame?"DNSSEC ":"");
	if(!dname_subdomain_c(iq->qchase.qname, iq->dp->name)) {
	log_err("mark lame: mismatch in qname and dpname");
	/* throwaway this reply below */
	} else if(qstate->reply) {
	/* need addr for lameness cache, but we may have
	* gotten this from cache, so test to be sure */
	if(!infra_set_lame(qstate->env->infra_cache,
	&qstate->reply->addr, qstate->reply->addrlen,
	iq->dp->name, iq->dp->namelen,
	*qstate->env->now, dnsseclame, 0,
	iq->qchase.qtype))
	log_err("mark host lame: out of memory");
	}
	} else if(type == RESPONSE_TYPE_REC_LAME) {
	/* Cache the LAMEness. */
	verbose(VERB_DETAIL, "query response REC_LAME: "
	"recursive but not authoritative server");
	if(!dname_subdomain_c(iq->qchase.qname, iq->dp->name)) {
	log_err("mark rec_lame: mismatch in qname and dpname");
	/* throwaway this reply below */
	} else if(qstate->reply) {
	/* need addr for lameness cache, but we may have
	* gotten this from cache, so test to be sure */
	verbose(VERB_DETAIL, "mark as REC_LAME");
	if(!infra_set_lame(qstate->env->infra_cache,
	&qstate->reply->addr, qstate->reply->addrlen,
	iq->dp->name, iq->dp->namelen,
	*qstate->env->now, 0, 1, iq->qchase.qtype))
	log_err("mark host lame: out of memory");
	}
	} else if(type == RESPONSE_TYPE_THROWAWAY) {
	/* LAME and THROWAWAY responses are handled the same way.
	* In this case, the event is just sent directly back to
	* the QUERYTARGETS_STATE without resetting anything,
	* because, clearly, the next target must be tried. */
	verbose(VERB_DETAIL, "query response was THROWAWAY");
	} else {
	log_warn("A query response came back with an unknown type: %d",
	(int)type);
	}

	/* LAME, THROWAWAY and "unknown" all end up here.
	* Recycle to the QUERYTARGETS state to hopefully try a
	* different target. */
	if (qstate->env->cfg->qname_minimisation &&
	!qstate->env->cfg->qname_minimisation_strict)
	iq->minimisation_state = DONOT_MINIMISE_STATE;
	if(iq->auth_zone_response) {
	/* can we fallback? */
	iq->auth_zone_response = 0;
	if(!auth_zones_can_fallback(qstate->env->auth_zones,
	iq->dp->name, iq->dp->namelen, qstate->qinfo.qclass)) {
	verbose(VERB_ALGO, "auth zone response bad, and no"
	" fallback possible, servfail");
	errinf_dname(qstate, "response is bad, no fallback, "
	"for auth zone", iq->dp->name);
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	verbose(VERB_ALGO, "auth zone response was bad, "
	"fallback enabled");
	iq->auth_zone_avoid = 1;
	if(iq->dp->auth_dp) {
	/* we are using a dp for the auth zone, with no
	* nameservers, get one first */
	iq->dp = NULL;
	return next_state(iq, INIT_REQUEST_STATE);
	}
	}
	return next_state(iq, QUERYTARGETS_STATE);
	}

	/**
	* Return priming query results to interested super querystates.
	*
	* Sets the delegation point and delegation message (not nonRD queries).
	* This is a callback from walk_supers.
	*
	* @param qstate: priming query state that finished.
	* @param id: module id.
	* @param forq: the qstate for which priming has been done.
	*/
	static void
	prime_supers(struct module_qstate* qstate, int id, struct module_qstate* forq)
	{
	struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id];
	struct delegpt* dp = NULL;

	log_assert(qstate->is_priming \|\| foriq->wait_priming_stub);
	log_assert(qstate->return_rcode == LDNS_RCODE_NOERROR);
	/* Convert our response to a delegation point */
	dp = delegpt_from_message(qstate->return_msg, forq->region);
	if(!dp) {
	/* if there is no convertable delegation point, then
	* the ANSWER type was (presumably) a negative answer. */
	verbose(VERB_ALGO, "prime response was not a positive "
	"ANSWER; failing");
	foriq->dp = NULL;
	foriq->state = QUERYTARGETS_STATE;
	return;
	}

	log_query_info(VERB_DETAIL, "priming successful for", &qstate->qinfo);
	delegpt_log(VERB_ALGO, dp);
	foriq->dp = dp;
	foriq->deleg_msg = dns_copy_msg(qstate->return_msg, forq->region);
	if(!foriq->deleg_msg) {
	log_err("copy prime response: out of memory");
	foriq->dp = NULL;
	foriq->state = QUERYTARGETS_STATE;
	return;
	}

	/* root priming responses go to init stage 2, priming stub
	* responses to to stage 3. */
	if(foriq->wait_priming_stub) {
	foriq->state = INIT_REQUEST_3_STATE;
	foriq->wait_priming_stub = 0;
	} else foriq->state = INIT_REQUEST_2_STATE;
	/* because we are finished, the parent will be reactivated */
	}

	/**
	* This handles the response to a priming query. This is used to handle both
	* root and stub priming responses. This is basically the equivalent of the
	* QUERY_RESP_STATE, but will not handle CNAME responses and will treat
	* REFERRALs as ANSWERS. It will also update and reactivate the originating
	* event.
	*
	* @param qstate: query state.
	* @param id: module id.
	* @return true if the event needs more immediate processing, false if not.
	* This state always returns false.
	*/
	static int
	processPrimeResponse(struct module_qstate* qstate, int id)
	{
	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
	enum response_type type;
	iq->response->rep->flags &= ~(BIT_RD\|BIT_RA); /* ignore rec-lame */
	type = response_type_from_server(
	(int)((iq->chase_flags&BIT_RD) \|\| iq->chase_to_rd),
	iq->response, &iq->qchase, iq->dp);
	if(type == RESPONSE_TYPE_ANSWER) {
	qstate->return_rcode = LDNS_RCODE_NOERROR;
	qstate->return_msg = iq->response;
	} else {
	errinf(qstate, "prime response did not get an answer");
	errinf_dname(qstate, "for", qstate->qinfo.qname);
	qstate->return_rcode = LDNS_RCODE_SERVFAIL;
	qstate->return_msg = NULL;
	}

	/* validate the root or stub after priming (if enabled).
	* This is the same query as the prime query, but with validation.
	* Now that we are primed, the additional queries that validation
	* may need can be resolved, such as DLV. */
	if(qstate->env->cfg->harden_referral_path) {
	struct module_qstate* subq = NULL;
	log_nametypeclass(VERB_ALGO, "schedule prime validation",
	qstate->qinfo.qname, qstate->qinfo.qtype,
	qstate->qinfo.qclass);
	if(!generate_sub_request(qstate->qinfo.qname,
	qstate->qinfo.qname_len, qstate->qinfo.qtype,
	qstate->qinfo.qclass, qstate, id, iq,
	INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) {
	verbose(VERB_ALGO, "could not generate prime check");
	}
	generate_a_aaaa_check(qstate, iq, id);
	}

	/* This event is finished. */
	qstate->ext_state[id] = module_finished;
	return 0;
	}

	/**
	* Do final processing on responses to target queries. Events reach this
	* state after the iterative resolution algorithm terminates. This state is
	* responsible for reactivating the original event, and housekeeping related
	* to received target responses (caching, updating the current delegation
	* point, etc).
	* Callback from walk_supers for every super state that is interested in
	* the results from this query.
	*
	* @param qstate: query state.
	* @param id: module id.
	* @param forq: super query state.
	*/
	static void
	processTargetResponse(struct module_qstate* qstate, int id,
	struct module_qstate* forq)
	{
	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
	struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id];
	struct ub_packed_rrset_key* rrset;
	struct delegpt_ns* dpns;
	log_assert(qstate->return_rcode == LDNS_RCODE_NOERROR);

	foriq->state = QUERYTARGETS_STATE;
	log_query_info(VERB_ALGO, "processTargetResponse", &qstate->qinfo);
	log_query_info(VERB_ALGO, "processTargetResponse super", &forq->qinfo);

	/* Tell the originating event that this target query has finished
	* (regardless if it succeeded or not). */
	foriq->num_target_queries--;

	/* check to see if parent event is still interested (in orig name). */
	if(!foriq->dp) {
	verbose(VERB_ALGO, "subq: parent not interested, was reset");
	return; /* not interested anymore */
	}
	dpns = delegpt_find_ns(foriq->dp, qstate->qinfo.qname,
	qstate->qinfo.qname_len);
	if(!dpns) {
	/* If not interested, just stop processing this event */
	verbose(VERB_ALGO, "subq: parent not interested anymore");
	/* could be because parent was jostled out of the cache,
	and a new identical query arrived, that does not want it*/
	return;
	}

	/* if iq->query_for_pside_glue then add the pside_glue (marked lame) */
	if(iq->pside_glue) {
	/* if the pside_glue is NULL, then it could not be found,
	* the done_pside is already set when created and a cache
	* entry created in processFinished so nothing to do here */
	log_rrset_key(VERB_ALGO, "add parentside glue to dp",
	iq->pside_glue);
	if(!delegpt_add_rrset(foriq->dp, forq->region,
	iq->pside_glue, 1))
	log_err("out of memory adding pside glue");
	}

	/* This response is relevant to the current query, so we
	* add (attempt to add, anyway) this target(s) and reactivate
	* the original event.
	* NOTE: we could only look for the AnswerRRset if the
	* response type was ANSWER. */
	rrset = reply_find_answer_rrset(&iq->qchase, qstate->return_msg->rep);
	if(rrset) {
	/* if CNAMEs have been followed - add new NS to delegpt. */
	/* BTW. RFC 1918 says NS should not have got CNAMEs. Robust. */
	if(!delegpt_find_ns(foriq->dp, rrset->rk.dname,
	rrset->rk.dname_len)) {
	/* if dpns->lame then set newcname ns lame too */
	if(!delegpt_add_ns(foriq->dp, forq->region,
	rrset->rk.dname, dpns->lame))
	log_err("out of memory adding cnamed-ns");
	}
	/* if dpns->lame then set the address(es) lame too */
	if(!delegpt_add_rrset(foriq->dp, forq->region, rrset,
	dpns->lame))
	log_err("out of memory adding targets");
	verbose(VERB_ALGO, "added target response");
	delegpt_log(VERB_ALGO, foriq->dp);
	} else {
	verbose(VERB_ALGO, "iterator TargetResponse failed");
	dpns->resolved = 1; /* fail the target */
	}
	}

	/**
	* Process response for DS NS Find queries, that attempt to find the delegation
	* point where we ask the DS query from.
	*
	* @param qstate: query state.
	* @param id: module id.
	* @param forq: super query state.
	*/
	static void
	processDSNSResponse(struct module_qstate* qstate, int id,
	struct module_qstate* forq)
	{
	struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id];

	/* if the finished (iq->response) query has no NS set: continue
	* up to look for the right dp; nothing to change, do DPNSstate */
	if(qstate->return_rcode != LDNS_RCODE_NOERROR)
	return; /* seek further */
	/* find the NS RRset (without allowing CNAMEs) */
	if(!reply_find_rrset(qstate->return_msg->rep, qstate->qinfo.qname,
	qstate->qinfo.qname_len, LDNS_RR_TYPE_NS,
	qstate->qinfo.qclass)){
	return; /* seek further */
	}

	/* else, store as DP and continue at querytargets */
	foriq->state = QUERYTARGETS_STATE;
	foriq->dp = delegpt_from_message(qstate->return_msg, forq->region);
	if(!foriq->dp) {
	log_err("out of memory in dsns dp alloc");
	errinf(qstate, "malloc failure, in DS search");
	return; /* dp==NULL in QUERYTARGETS makes SERVFAIL */
	}
	/* success, go query the querytargets in the new dp (and go down) */
	}

	/**
	* Process response for qclass=ANY queries for a particular class.
	* Append to result or error-exit.
	*
	* @param qstate: query state.
	* @param id: module id.
	* @param forq: super query state.
	*/
	static void
	processClassResponse(struct module_qstate* qstate, int id,
	struct module_qstate* forq)
	{
	struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id];
	struct dns_msg* from = qstate->return_msg;
	log_query_info(VERB_ALGO, "processClassResponse", &qstate->qinfo);
	log_query_info(VERB_ALGO, "processClassResponse super", &forq->qinfo);
	if(qstate->return_rcode != LDNS_RCODE_NOERROR) {
	/* cause servfail for qclass ANY query */
	foriq->response = NULL;
	foriq->state = FINISHED_STATE;
	return;
	}
	/* append result */
	if(!foriq->response) {
	/* allocate the response: copy RCODE, sec_state */
	foriq->response = dns_copy_msg(from, forq->region);
	if(!foriq->response) {
	log_err("malloc failed for qclass ANY response");
	foriq->state = FINISHED_STATE;
	return;
	}
	foriq->response->qinfo.qclass = forq->qinfo.qclass;
	/* qclass ANY does not receive the AA flag on replies */
	foriq->response->rep->authoritative = 0;
	} else {
	struct dns_msg* to = foriq->response;
	/* add _from_ this response _to_ existing collection */
	/* if there are records, copy RCODE */
	/* lower sec_state if this message is lower */
	if(from->rep->rrset_count != 0) {
	size_t n = from->rep->rrset_count+to->rep->rrset_count;
	struct ub_packed_rrset_key dest, d;
	/* copy appropriate rcode */
	to->rep->flags = from->rep->flags;
	/* copy rrsets */
	if(from->rep->rrset_count > RR_COUNT_MAX \|\|
	to->rep->rrset_count > RR_COUNT_MAX) {
	log_err("malloc failed (too many rrsets) in collect ANY");
	foriq->state = FINISHED_STATE;
	return; /* integer overflow protection */
	}
	dest = regional_alloc(forq->region, sizeof(dest[0])*n);
	if(!dest) {
	log_err("malloc failed in collect ANY");
	foriq->state = FINISHED_STATE;
	return;
	}
	d = dest;
	/* copy AN */
	memcpy(dest, to->rep->rrsets, to->rep->an_numrrsets
	* sizeof(dest[0]));
	dest += to->rep->an_numrrsets;
	memcpy(dest, from->rep->rrsets, from->rep->an_numrrsets
	* sizeof(dest[0]));
	dest += from->rep->an_numrrsets;
	/* copy NS */
	memcpy(dest, to->rep->rrsets+to->rep->an_numrrsets,
	to->rep->ns_numrrsets * sizeof(dest[0]));
	dest += to->rep->ns_numrrsets;
	memcpy(dest, from->rep->rrsets+from->rep->an_numrrsets,
	from->rep->ns_numrrsets * sizeof(dest[0]));
	dest += from->rep->ns_numrrsets;
	/* copy AR */
	memcpy(dest, to->rep->rrsets+to->rep->an_numrrsets+
	to->rep->ns_numrrsets,
	to->rep->ar_numrrsets * sizeof(dest[0]));
	dest += to->rep->ar_numrrsets;
	memcpy(dest, from->rep->rrsets+from->rep->an_numrrsets+
	from->rep->ns_numrrsets,
	from->rep->ar_numrrsets * sizeof(dest[0]));
	/* update counts */
	to->rep->rrsets = d;
	to->rep->an_numrrsets += from->rep->an_numrrsets;
	to->rep->ns_numrrsets += from->rep->ns_numrrsets;
	to->rep->ar_numrrsets += from->rep->ar_numrrsets;
	to->rep->rrset_count = n;
	}
	if(from->rep->security < to->rep->security) /* lowest sec */
	to->rep->security = from->rep->security;
	if(from->rep->qdcount != 0) /* insert qd if appropriate */
	to->rep->qdcount = from->rep->qdcount;
	if(from->rep->ttl < to->rep->ttl) /* use smallest TTL */
	to->rep->ttl = from->rep->ttl;
	if(from->rep->prefetch_ttl < to->rep->prefetch_ttl)
	to->rep->prefetch_ttl = from->rep->prefetch_ttl;
	if(from->rep->serve_expired_ttl < to->rep->serve_expired_ttl)
	to->rep->serve_expired_ttl = from->rep->serve_expired_ttl;
	}
	/* are we done? */
	foriq->num_current_queries --;
	if(foriq->num_current_queries == 0)
	foriq->state = FINISHED_STATE;
	}

	/**
	* Collect class ANY responses and make them into one response. This
	* state is started and it creates queries for all classes (that have
	* root hints). The answers are then collected.
	*
	* @param qstate: query state.
	* @param id: module id.
	* @return true if the event needs more immediate processing, false if not.
	*/
	static int
	processCollectClass(struct module_qstate* qstate, int id)
	{
	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
	struct module_qstate* subq;
	/* If qchase.qclass == 0 then send out queries for all classes.
	* Otherwise, do nothing (wait for all answers to arrive and the
	* processClassResponse to put them together, and that moves us
	* towards the Finished state when done. */
	if(iq->qchase.qclass == 0) {
	uint16_t c = 0;
	iq->qchase.qclass = LDNS_RR_CLASS_ANY;
	while(iter_get_next_root(qstate->env->hints,
	qstate->env->fwds, &c)) {
	/* generate query for this class */
	log_nametypeclass(VERB_ALGO, "spawn collect query",
	qstate->qinfo.qname, qstate->qinfo.qtype, c);
	if(!generate_sub_request(qstate->qinfo.qname,
	qstate->qinfo.qname_len, qstate->qinfo.qtype,
	c, qstate, id, iq, INIT_REQUEST_STATE,
	FINISHED_STATE, &subq,
	(int)!(qstate->query_flags&BIT_CD))) {
	errinf(qstate, "could not generate class ANY"
	" lookup query");
	return error_response(qstate, id,
	LDNS_RCODE_SERVFAIL);
	}
	/* ignore subq, no special init required */
	iq->num_current_queries ++;
	if(c == 0xffff)
	break;
	else c++;
	}
	/* if no roots are configured at all, return */
	if(iq->num_current_queries == 0) {
	verbose(VERB_ALGO, "No root hints or fwds, giving up "
	"on qclass ANY");
	return error_response(qstate, id, LDNS_RCODE_REFUSED);
	}
	/* return false, wait for queries to return */
	}
	/* if woke up here because of an answer, wait for more answers */
	return 0;
	}

	/**
	* This handles the final state for first-tier responses (i.e., responses to
	* externally generated queries).
	*
	* @param qstate: query state.
	* @param iq: iterator query state.
	* @param id: module id.
	* @return true if the event needs more processing, false if not. Since this
	* is the final state for an event, it always returns false.
	*/
	static int
	processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
	int id)
	{
	log_query_info(VERB_QUERY, "finishing processing for",
	&qstate->qinfo);

	/* store negative cache element for parent side glue. */
	if(!qstate->no_cache_store && iq->query_for_pside_glue
	&& !iq->pside_glue)
	iter_store_parentside_neg(qstate->env, &qstate->qinfo,
	iq->deleg_msg?iq->deleg_msg->rep:
	(iq->response?iq->response->rep:NULL));
	if(!iq->response) {
	verbose(VERB_ALGO, "No response is set, servfail");
	errinf(qstate, "(no response found at query finish)");
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}

	/* Make sure that the RA flag is set (since the presence of
	* this module means that recursion is available) */
	iq->response->rep->flags \|= BIT_RA;

	/* Clear the AA flag */
	/* FIXME: does this action go here or in some other module? */
	iq->response->rep->flags &= ~BIT_AA;

	/* make sure QR flag is on */
	iq->response->rep->flags \|= BIT_QR;

	/* we have finished processing this query */
	qstate->ext_state[id] = module_finished;

	/* TODO: we are using a private TTL, trim the response. */
	/* if (mPrivateTTL > 0){IterUtils.setPrivateTTL(resp, mPrivateTTL); } */

	/* prepend any items we have accumulated */
	if(iq->an_prepend_list \|\| iq->ns_prepend_list) {
	if(!iter_prepend(iq, iq->response, qstate->region)) {
	log_err("prepend rrsets: out of memory");
	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}
	/* reset the query name back */
	iq->response->qinfo = qstate->qinfo;
	/* the security state depends on the combination */
	iq->response->rep->security = sec_status_unchecked;
	/* store message with the finished prepended items,
	* but only if we did recursion. The nonrecursion referral
	* from cache does not need to be stored in the msg cache. */
	if(!qstate->no_cache_store && qstate->query_flags&BIT_RD) {
	iter_dns_store(qstate->env, &qstate->qinfo,
	iq->response->rep, 0, qstate->prefetch_leeway,
	iq->dp&&iq->dp->has_parent_side_NS,
	qstate->region, qstate->query_flags);
	}
	}
	qstate->return_rcode = LDNS_RCODE_NOERROR;
	qstate->return_msg = iq->response;
	return 0;
	}

	/*
	* Return priming query results to interested super querystates.
	*
	* Sets the delegation point and delegation message (not nonRD queries).
	* This is a callback from walk_supers.
	*
	* @param qstate: query state that finished.
	* @param id: module id.
	* @param super: the qstate to inform.
	*/
	void
	iter_inform_super(struct module_qstate* qstate, int id,
	struct module_qstate* super)
	{
	if(!qstate->is_priming && super->qinfo.qclass == LDNS_RR_CLASS_ANY)
	processClassResponse(qstate, id, super);
	else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
	super->minfo[id])->state == DSNS_FIND_STATE)
	processDSNSResponse(qstate, id, super);
	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
	error_supers(qstate, id, super);
	else if(qstate->is_priming)
	prime_supers(qstate, id, super);
	else processTargetResponse(qstate, id, super);
	}

	/**
	* Handle iterator state.
	* Handle events. This is the real processing loop for events, responsible
	* for moving events through the various states. If a processing method
	* returns true, then it will be advanced to the next state. If false, then
	* processing will stop.
	*
	* @param qstate: query state.
	* @param ie: iterator shared global environment.
	* @param iq: iterator query state.
	* @param id: module id.
	*/
	static void
	iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
	struct iter_env* ie, int id)
	{
	int cont = 1;
	while(cont) {
	verbose(VERB_ALGO, "iter_handle processing q with state %s",
	iter_state_to_string(iq->state));
	switch(iq->state) {
	case INIT_REQUEST_STATE:
	cont = processInitRequest(qstate, iq, ie, id);
	break;
	case INIT_REQUEST_2_STATE:
	cont = processInitRequest2(qstate, iq, id);
	break;
	case INIT_REQUEST_3_STATE:
	cont = processInitRequest3(qstate, iq, id);
	break;
	case QUERYTARGETS_STATE:
	cont = processQueryTargets(qstate, iq, ie, id);
	break;
	case QUERY_RESP_STATE:
	cont = processQueryResponse(qstate, iq, id);
	break;
	case PRIME_RESP_STATE:
	cont = processPrimeResponse(qstate, id);
	break;
	case COLLECT_CLASS_STATE:
	cont = processCollectClass(qstate, id);
	break;
	case DSNS_FIND_STATE:
	cont = processDSNSFind(qstate, iq, id);
	break;
	case FINISHED_STATE:
	cont = processFinished(qstate, iq, id);
	break;
	default:
	log_warn("iterator: invalid state: %d",
	iq->state);
	cont = 0;
	break;
	}
	}
	}

	/**
	* This is the primary entry point for processing request events. Note that
	* this method should only be used by external modules.
	* @param qstate: query state.
	* @param ie: iterator shared global environment.
	* @param iq: iterator query state.
	* @param id: module id.
	*/
	static void
	process_request(struct module_qstate* qstate, struct iter_qstate* iq,
	struct iter_env* ie, int id)
	{
	/* external requests start in the INIT state, and finish using the
	* FINISHED state. */
	iq->state = INIT_REQUEST_STATE;
	iq->final_state = FINISHED_STATE;
	verbose(VERB_ALGO, "process_request: new external request event");
	iter_handle(qstate, iq, ie, id);
	}

	/** process authoritative server reply */
	static void
	process_response(struct module_qstate* qstate, struct iter_qstate* iq,
	struct iter_env* ie, int id, struct outbound_entry* outbound,
	enum module_ev event)
	{
	struct msg_parse* prs;
	struct edns_data edns;
	sldns_buffer* pkt;

	verbose(VERB_ALGO, "process_response: new external response event");
	iq->response = NULL;
	iq->state = QUERY_RESP_STATE;
	if(event == module_event_noreply \|\| event == module_event_error) {
	if(event == module_event_noreply && iq->sent_count >= 3 &&
	qstate->env->cfg->use_caps_bits_for_id &&
	- !iq->caps_fallback) {
	+ !iq->caps_fallback && !is_caps_whitelisted(ie, iq)) {
	/* start fallback */
	iq->caps_fallback = 1;
	iq->caps_server = 0;
	iq->caps_reply = NULL;
	iq->caps_response = NULL;
	iq->caps_minimisation_state = DONOT_MINIMISE_STATE;
	iq->state = QUERYTARGETS_STATE;
	iq->num_current_queries--;
	/* need fresh attempts for the 0x20 fallback, if
	* that was the cause for the failure */
	iter_dec_attempts(iq->dp, 3);
	verbose(VERB_DETAIL, "Capsforid: timeouts, starting fallback");
	goto handle_it;
	}
	goto handle_it;
	}
	if( (event != module_event_reply && event != module_event_capsfail)
	\|\| !qstate->reply) {
	log_err("Bad event combined with response");
	outbound_list_remove(&iq->outlist, outbound);
	errinf(qstate, "module iterator received wrong internal event with a response message");
	(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	return;
	}

	/* parse message */
	prs = (struct msg_parse*)regional_alloc(qstate->env->scratch,
	sizeof(struct msg_parse));
	if(!prs) {
	log_err("out of memory on incoming message");
	/* like packet got dropped */
	goto handle_it;
	}
	memset(prs, 0, sizeof(*prs));
	memset(&edns, 0, sizeof(edns));
	pkt = qstate->reply->c->buffer;
	sldns_buffer_set_position(pkt, 0);
	if(parse_packet(pkt, prs, qstate->env->scratch) != LDNS_RCODE_NOERROR) {
	verbose(VERB_ALGO, "parse error on reply packet");
	goto handle_it;
	}
	/* edns is not examined, but removed from message to help cache */
	if(parse_extract_edns(prs, &edns, qstate->env->scratch) !=
	LDNS_RCODE_NOERROR)
	goto handle_it;

	/* Copy the edns options we may got from the back end */
	if(edns.opt_list) {
	qstate->edns_opts_back_in = edns_opt_copy_region(edns.opt_list,
	qstate->region);
	if(!qstate->edns_opts_back_in) {
	log_err("out of memory on incoming message");
	/* like packet got dropped */
	goto handle_it;
	}
	if(!inplace_cb_edns_back_parsed_call(qstate->env, qstate)) {
	log_err("unable to call edns_back_parsed callback");
	goto handle_it;
	}
	}

	/* remove CD-bit, we asked for in case we handle validation ourself */
	prs->flags &= ~BIT_CD;

	/* normalize and sanitize: easy to delete items from linked lists */
	if(!scrub_message(pkt, prs, &iq->qinfo_out, iq->dp->name,
	qstate->env->scratch, qstate->env, ie)) {
	/* if 0x20 enabled, start fallback, but we have no message */
	if(event == module_event_capsfail && !iq->caps_fallback) {
	iq->caps_fallback = 1;
	iq->caps_server = 0;
	iq->caps_reply = NULL;
	iq->caps_response = NULL;
	iq->caps_minimisation_state = DONOT_MINIMISE_STATE;
	iq->state = QUERYTARGETS_STATE;
	iq->num_current_queries--;
	verbose(VERB_DETAIL, "Capsforid: scrub failed, starting fallback with no response");
	}
	goto handle_it;
	}

	/* allocate response dns_msg in region */
	iq->response = dns_alloc_msg(pkt, prs, qstate->region);
	if(!iq->response)
	goto handle_it;
	log_query_info(VERB_DETAIL, "response for", &qstate->qinfo);
	log_name_addr(VERB_DETAIL, "reply from", iq->dp->name,
	&qstate->reply->addr, qstate->reply->addrlen);
	if(verbosity >= VERB_ALGO)
	log_dns_msg("incoming scrubbed packet:", &iq->response->qinfo,
	iq->response->rep);

	if(event == module_event_capsfail \|\| iq->caps_fallback) {
	if(qstate->env->cfg->qname_minimisation &&
	iq->minimisation_state != DONOT_MINIMISE_STATE) {
	/* Skip QNAME minimisation for next query, since that
	* one has to match the current query. */
	iq->minimisation_state = SKIP_MINIMISE_STATE;
	}
	/* for fallback we care about main answer, not additionals */
	/* removing that makes comparison more likely to succeed */
	caps_strip_reply(iq->response->rep);

	if(iq->caps_fallback &&
	iq->caps_minimisation_state != iq->minimisation_state) {
	/* QNAME minimisation state has changed, restart caps
	* fallback. */
	iq->caps_fallback = 0;
	}

	if(!iq->caps_fallback) {
	/* start fallback */
	iq->caps_fallback = 1;
	iq->caps_server = 0;
	iq->caps_reply = iq->response->rep;
	iq->caps_response = iq->response;
	iq->caps_minimisation_state = iq->minimisation_state;
	iq->state = QUERYTARGETS_STATE;
	iq->num_current_queries--;
	verbose(VERB_DETAIL, "Capsforid: starting fallback");
	goto handle_it;
	} else {
	/* check if reply is the same, otherwise, fail */
	if(!iq->caps_reply) {
	iq->caps_reply = iq->response->rep;
	iq->caps_response = iq->response;
	iq->caps_server = -1; /*become zero at ++,
	so that we start the full set of trials */
	} else if(caps_failed_rcode(iq->caps_reply) &&
	!caps_failed_rcode(iq->response->rep)) {
	/* prefer to upgrade to non-SERVFAIL */
	iq->caps_reply = iq->response->rep;
	iq->caps_response = iq->response;
	} else if(!caps_failed_rcode(iq->caps_reply) &&
	caps_failed_rcode(iq->response->rep)) {
	/* if we have non-SERVFAIL as answer then
	* we can ignore SERVFAILs for the equality
	* comparison */
	/* no instructions here, skip other else */
	} else if(caps_failed_rcode(iq->caps_reply) &&
	caps_failed_rcode(iq->response->rep)) {
	/* failure is same as other failure in fallbk*/
	/* no instructions here, skip other else */
	} else if(!reply_equal(iq->response->rep, iq->caps_reply,
	qstate->env->scratch)) {
	verbose(VERB_DETAIL, "Capsforid fallback: "
	"getting different replies, failed");
	outbound_list_remove(&iq->outlist, outbound);
	errinf(qstate, "0x20 failed, then got different replies in fallback");
	(void)error_response(qstate, id,
	LDNS_RCODE_SERVFAIL);
	return;
	}
	/* continue the fallback procedure at next server */
	iq->caps_server++;
	iq->state = QUERYTARGETS_STATE;
	iq->num_current_queries--;
	verbose(VERB_DETAIL, "Capsforid: reply is equal. "
	"go to next fallback");
	goto handle_it;
	}
	}
	iq->caps_fallback = 0; /* if we were in fallback, 0x20 is OK now */

	handle_it:
	outbound_list_remove(&iq->outlist, outbound);
	iter_handle(qstate, iq, ie, id);
	}

	void
	iter_operate(struct module_qstate* qstate, enum module_ev event, int id,
	struct outbound_entry* outbound)
	{
	struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
	verbose(VERB_QUERY, "iterator[module %d] operate: extstate:%s event:%s",
	id, strextstate(qstate->ext_state[id]), strmodulevent(event));
	if(iq) log_query_info(VERB_QUERY, "iterator operate: query",
	&qstate->qinfo);
	if(iq && qstate->qinfo.qname != iq->qchase.qname)
	log_query_info(VERB_QUERY, "iterator operate: chased to",
	&iq->qchase);

	/* perform iterator state machine */
	if((event == module_event_new \|\| event == module_event_pass) &&
	iq == NULL) {
	if(!iter_new(qstate, id)) {
	errinf(qstate, "malloc failure, new iterator module allocation");
	(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	return;
	}
	iq = (struct iter_qstate*)qstate->minfo[id];
	process_request(qstate, iq, ie, id);
	return;
	}
	if(iq && event == module_event_pass) {
	iter_handle(qstate, iq, ie, id);
	return;
	}
	if(iq && outbound) {
	process_response(qstate, iq, ie, id, outbound, event);
	return;
	}
	if(event == module_event_error) {
	verbose(VERB_ALGO, "got called with event error, giving up");
	errinf(qstate, "iterator module got the error event");
	(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	return;
	}

	log_err("bad event for iterator");
	errinf(qstate, "iterator module received wrong event");
	(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
	}

	void
	iter_clear(struct module_qstate* qstate, int id)
	{
	struct iter_qstate* iq;
	if(!qstate)
	return;
	iq = (struct iter_qstate*)qstate->minfo[id];
	if(iq) {
	outbound_list_clear(&iq->outlist);
	if(iq->target_count && --iq->target_count[0] == 0)
	free(iq->target_count);
	iq->num_current_queries = 0;
	}
	qstate->minfo[id] = NULL;
	}

	size_t
	iter_get_mem(struct module_env* env, int id)
	{
	struct iter_env* ie = (struct iter_env*)env->modinfo[id];
	if(!ie)
	return 0;
	return sizeof(ie) + sizeof(int)((size_t)ie->max_dependency_depth+1)
	+ donotq_get_mem(ie->donotq) + priv_get_mem(ie->priv);
	}

	/**
	* The iterator function block
	*/
	static struct module_func_block iter_block = {
	"iterator",
	&iter_init, &iter_deinit, &iter_operate, &iter_inform_super,
	&iter_clear, &iter_get_mem
	};

	struct module_func_block*
	iter_get_funcblock(void)
	{
	return &iter_block;
	}

	const char*
	iter_state_to_string(enum iter_state state)
	{
	switch (state)
	{
	case INIT_REQUEST_STATE :
	return "INIT REQUEST STATE";
	case INIT_REQUEST_2_STATE :
	return "INIT REQUEST STATE (stage 2)";
	case INIT_REQUEST_3_STATE:
	return "INIT REQUEST STATE (stage 3)";
	case QUERYTARGETS_STATE :
	return "QUERY TARGETS STATE";
	case PRIME_RESP_STATE :
	return "PRIME RESPONSE STATE";
	case COLLECT_CLASS_STATE :
	return "COLLECT CLASS STATE";
	case DSNS_FIND_STATE :
	return "DSNS FIND STATE";
	case QUERY_RESP_STATE :
	return "QUERY RESPONSE STATE";
	case FINISHED_STATE :
	return "FINISHED RESPONSE STATE";
	default :
	return "UNKNOWN ITER STATE";
	}
	}

	int
	iter_state_is_responsestate(enum iter_state s)
	{
	switch(s) {
	case INIT_REQUEST_STATE :
	case INIT_REQUEST_2_STATE :
	case INIT_REQUEST_3_STATE :
	case QUERYTARGETS_STATE :
	case COLLECT_CLASS_STATE :
	return 0;
	default:
	break;
	}
	return 1;
	}
	Index: head/contrib/unbound/iterator/iterator.h
	===================================================================
	--- head/contrib/unbound/iterator/iterator.h (revision 349719)
	+++ head/contrib/unbound/iterator/iterator.h (revision 349720)
	@@ -1,459 +1,459 @@
	/*
	* iterator/iterator.h - iterative resolver DNS query response module
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains a module that performs recursive iterative DNS query
	* processing.
	*/

	#ifndef ITERATOR_ITERATOR_H
	#define ITERATOR_ITERATOR_H
	#include "services/outbound_list.h"
	#include "util/data/msgreply.h"
	#include "util/module.h"
	struct delegpt;
	struct iter_hints;
	struct iter_forwards;
	struct iter_donotq;
	struct iter_prep_list;
	struct iter_priv;
	struct rbtree_type;

	/** max number of targets spawned for a query and its subqueries */
	#define MAX_TARGET_COUNT 64
	/** max number of query restarts. Determines max number of CNAME chain. */
	#define MAX_RESTART_COUNT 8
	/** max number of referrals. Makes sure resolver does not run away */
	#define MAX_REFERRAL_COUNT 130
	/** max number of queries-sent-out. Make sure large NS set does not loop */
	#define MAX_SENT_COUNT 32
	/** max number of queries for which to perform dnsseclameness detection,
	* (rrsigs missing detection) after that, just pick up that response */
	#define DNSSEC_LAME_DETECT_COUNT 4
	/**
	* max number of QNAME minimisation iterations. Limits number of queries for
	* QNAMEs with a lot of labels.
	*/
	#define MAX_MINIMISE_COUNT 10
	/* max number of time-outs for minimised query. Prevents resolving failures
	* when the QNAME minimisation QTYPE is blocked. */
	#define MAX_MINIMISE_TIMEOUT_COUNT 3
	/**
	* number of labels from QNAME that are always send individually when using
	* QNAME minimisation, even when the number of labels of the QNAME is bigger
	* tham MAX_MINIMISE_COUNT */
	#define MINIMISE_ONE_LAB 4
	#define MINIMISE_MULTIPLE_LABS (MAX_MINIMISE_COUNT - MINIMISE_ONE_LAB)
	/** at what query-sent-count to stop target fetch policy */
	#define TARGET_FETCH_STOP 3
	/** how nice is a server without further information, in msec
	* Equals rtt initial timeout value.
	*/
	-#define UNKNOWN_SERVER_NICENESS 376
	+extern int UNKNOWN_SERVER_NICENESS;
	/** maximum timeout before a host is deemed unsuitable, in msec.
	* After host_ttl this will be timed out and the host will be tried again.
	* Equals RTT_MAX_TIMEOUT
	*/
	#define USEFUL_SERVER_TOP_TIMEOUT 120000
	/** number of retries on outgoing queries */
	#define OUTBOUND_MSG_RETRY 5
	/** RTT band, within this amount from the best, servers are chosen randomly.
	* Chosen so that the UNKNOWN_SERVER_NICENESS falls within the band of a
	* fast server, this causes server exploration as a side benefit. msec. */
	#define RTT_BAND 400
	/** Start value for blacklisting a host, 2USEFUL_SERVER_TOP_TIMEOUT in sec /
	#define INFRA_BACKOFF_INITIAL 240

	/**
	* Global state for the iterator.
	*/
	struct iter_env {
	/** A flag to indicate whether or not we have an IPv6 route */
	int supports_ipv6;

	/** A flag to indicate whether or not we have an IPv4 route */
	int supports_ipv4;

	/** A set of inetaddrs that should never be queried. */
	struct iter_donotq* donotq;

	/** private address space and private domains */
	struct iter_priv* priv;

	/** whitelist for capsforid names */
	struct rbtree_type* caps_white;

	/** The maximum dependency depth that this resolver will pursue. */
	int max_dependency_depth;

	/**
	* The target fetch policy for each dependency level. This is
	* described as a simple number (per dependency level):
	* negative numbers (usually just -1) mean fetch-all,
	* 0 means only fetch on demand, and
	* positive numbers mean to fetch at most that many targets.
	* array of max_dependency_depth+1 size.
	*/
	int* target_fetch_policy;

	/** lock on ratelimit counter */
	lock_basic_type queries_ratelimit_lock;
	/** number of queries that have been ratelimited */
	size_t num_queries_ratelimited;
	};

	/**
	* QNAME minimisation state
	*/
	enum minimisation_state {
	/**
	* (Re)start minimisation. Outgoing QNAME should be set to dp->name.
	* State entered on new query or after following referral or CNAME.
	*/
	INIT_MINIMISE_STATE = 0,
	/**
	* QNAME minimisation ongoing. Increase QNAME on every iteration.
	*/
	MINIMISE_STATE,
	/**
	* Don't increment QNAME this iteration
	*/
	SKIP_MINIMISE_STATE,
	/**
	* Send out full QNAME + original QTYPE
	*/
	DONOT_MINIMISE_STATE,
	};

	/**
	* State of the iterator for a query.
	*/
	enum iter_state {
	/**
	* Externally generated queries start at this state. Query restarts are
	* reset to this state.
	*/
	INIT_REQUEST_STATE = 0,

	/**
	* Root priming events reactivate here, most other events pass
	* through this naturally as the 2nd part of the INIT_REQUEST_STATE.
	*/
	INIT_REQUEST_2_STATE,

	/**
	* Stub priming events reactivate here, most other events pass
	* through this naturally as the 3rd part of the INIT_REQUEST_STATE.
	*/
	INIT_REQUEST_3_STATE,

	/**
	* Each time a delegation point changes for a given query or a
	* query times out and/or wakes up, this state is (re)visited.
	* This state is responsible for iterating through a list of
	* nameserver targets.
	*/
	QUERYTARGETS_STATE,

	/**
	* Responses to queries start at this state. This state handles
	* the decision tree associated with handling responses.
	*/
	QUERY_RESP_STATE,

	/** Responses to priming queries finish at this state. */
	PRIME_RESP_STATE,

	/** Collecting query class information, for qclass=ANY, when
	* it spawns off queries for every class, it returns here. */
	COLLECT_CLASS_STATE,

	/** Find NS record to resolve DS record from, walking to the right
	* NS spot until we find it */
	DSNS_FIND_STATE,

	/** Responses that are to be returned upstream end at this state.
	* As well as responses to target queries. */
	FINISHED_STATE
	};

	/**
	* Per query state for the iterator module.
	*/
	struct iter_qstate {
	/**
	* State of the iterator module.
	* This is the state that event is in or should sent to -- all
	* requests should start with the INIT_REQUEST_STATE. All
	* responses should start with QUERY_RESP_STATE. Subsequent
	* processing of the event will change this state.
	*/
	enum iter_state state;

	/**
	* Final state for the iterator module.
	* This is the state that responses should be routed to once the
	* response is final. For externally initiated queries, this
	* will be FINISHED_STATE, locally initiated queries will have
	* different final states.
	*/
	enum iter_state final_state;

	/**
	* The depth of this query, this means the depth of recursion.
	* This address is needed for another query, which is an address
	* needed for another query, etc. Original client query has depth 0.
	*/
	int depth;

	/**
	* The response
	*/
	struct dns_msg* response;

	/**
	* This is a list of RRsets that must be prepended to the
	* ANSWER section of a response before being sent upstream.
	*/
	struct iter_prep_list* an_prepend_list;
	/** Last element of the prepend list */
	struct iter_prep_list* an_prepend_last;

	/**
	* This is the list of RRsets that must be prepended to the
	* AUTHORITY section of the response before being sent upstream.
	*/
	struct iter_prep_list* ns_prepend_list;
	/** Last element of the authority prepend list */
	struct iter_prep_list* ns_prepend_last;

	/** query name used for chasing the results. Initially the same as
	* the state qinfo, but after CNAMEs this will be different.
	* The query info used to elicit the results needed. */
	struct query_info qchase;
	/** query flags to use when chasing the answer (i.e. RD flag) */
	uint16_t chase_flags;
	/** true if we set RD bit because of last resort recursion lame query*/
	int chase_to_rd;

	/**
	* This is the current delegation point for an in-progress query. This
	* object retains state as to which delegation targets need to be
	* (sub)queried for vs which ones have already been visited.
	*/
	struct delegpt* dp;

	/** state for 0x20 fallback when capsfail happens, 0 not a fallback */
	int caps_fallback;
	/** state for capsfail: current server number to try */
	size_t caps_server;
	/** state for capsfail: stored query for comparisons. Can be NULL if
	* no response had been seen prior to starting the fallback. */
	struct reply_info* caps_reply;
	struct dns_msg* caps_response;

	/** Current delegation message - returned for non-RD queries */
	struct dns_msg* deleg_msg;

	/** number of outstanding target sub queries */
	int num_target_queries;

	/** outstanding direct queries */
	int num_current_queries;

	/** the number of times this query has been restarted. */
	int query_restart_count;

	/** the number of times this query as followed a referral. */
	int referral_count;

	/** number of queries fired off */
	int sent_count;

	/** number of target queries spawned in [1], for this query and its
	* subqueries, the malloced-array is shared, [0] refcount. */
	int* target_count;

	/** if true, already tested for ratelimiting and passed the test */
	int ratelimit_ok;

	/**
	* The query must store NS records from referrals as parentside RRs
	* Enabled once it hits resolution problems, to throttle retries.
	* If enabled it is the pointer to the old delegation point with
	* the old retry counts for bad-nameserver-addresses.
	*/
	struct delegpt* store_parent_NS;

	/**
	* The query is for parent-side glue(A or AAAA) for a nameserver.
	* If the item is seen as glue in a referral, and pside_glue is NULL,
	* then it is stored in pside_glue for later.
	* If it was never seen, at the end, then a negative caching element
	* must be created.
	* The (data or negative) RR cache element then throttles retries.
	*/
	int query_for_pside_glue;
	/** the parent-side-glue element (NULL if none, its first match) */
	struct ub_packed_rrset_key* pside_glue;

	/** If nonNULL we are walking upwards from DS query to find NS */
	uint8_t* dsns_point;
	/** length of the dname in dsns_point */
	size_t dsns_point_len;

	/**
	* expected dnssec information for this iteration step.
	* If dnssec rrsigs are expected and not given, the server is marked
	* lame (dnssec-lame).
	*/
	int dnssec_expected;

	/**
	* We are expecting dnssec information, but we also know the server
	* is DNSSEC lame. The response need not be marked dnssec-lame again.
	*/
	int dnssec_lame_query;

	/**
	* This is flag that, if true, means that this event is
	* waiting for a stub priming query.
	*/
	int wait_priming_stub;

	/**
	* This is a flag that, if true, means that this query is
	* for (re)fetching glue from a zone. Since the address should
	* have been glue, query again to the servers that should have
	* been returning it as glue.
	* The delegation point must be set to the one that should not
	* be used when creating the state. A higher one will be attempted.
	*/
	int refetch_glue;

	/** list of pending queries to authoritative servers. */
	struct outbound_list outlist;

	/** QNAME minimisation state, RFC7816 */
	enum minimisation_state minimisation_state;

	/** State for capsfail: QNAME minimisation state for comparisons. */
	enum minimisation_state caps_minimisation_state;

	/**
	* The query info that is sent upstream. Will be a subset of qchase
	* when qname minimisation is enabled.
	*/
	struct query_info qinfo_out;

	/**
	* Count number of QNAME minimisation iterations. Used to limit number of
	* outgoing queries when QNAME minimisation is enabled.
	*/
	int minimise_count;

	/**
	* Count number of time-outs. Used to prevent resolving failures when
	* the QNAME minimisation QTYPE is blocked. */
	int minimise_timeout_count;

	/** True if the current response is from auth_zone */
	int auth_zone_response;
	/** True if the auth_zones should not be consulted for the query */
	int auth_zone_avoid;
	};

	/**
	* List of prepend items
	*/
	struct iter_prep_list {
	/** next in list */
	struct iter_prep_list* next;
	/** rrset */
	struct ub_packed_rrset_key* rrset;
	};

	/**
	* Get the iterator function block.
	* @return: function block with function pointers to iterator methods.
	*/
	struct module_func_block* iter_get_funcblock(void);

	/**
	* Get iterator state as a string
	* @param state: to convert
	* @return constant string that is printable.
	*/
	const char* iter_state_to_string(enum iter_state state);

	/**
	* See if iterator state is a response state
	* @param s: to inspect
	* @return true if response state.
	*/
	int iter_state_is_responsestate(enum iter_state s);

	/** iterator init */
	int iter_init(struct module_env* env, int id);

	/** iterator deinit */
	void iter_deinit(struct module_env* env, int id);

	/** iterator operate on a query */
	void iter_operate(struct module_qstate* qstate, enum module_ev event, int id,
	struct outbound_entry* outbound);

	/**
	* Return priming query results to interested super querystates.
	*
	* Sets the delegation point and delegation message (not nonRD queries).
	* This is a callback from walk_supers.
	*
	* @param qstate: query state that finished.
	* @param id: module id.
	* @param super: the qstate to inform.
	*/
	void iter_inform_super(struct module_qstate* qstate, int id,
	struct module_qstate* super);

	/** iterator cleanup query state */
	void iter_clear(struct module_qstate* qstate, int id);

	/** iterator alloc size routine */
	size_t iter_get_mem(struct module_env* env, int id);

	#endif /* ITERATOR_ITERATOR_H */
	Index: head/contrib/unbound/libunbound/libunbound.c
	===================================================================
	--- head/contrib/unbound/libunbound/libunbound.c (revision 349719)
	+++ head/contrib/unbound/libunbound/libunbound.c (revision 349720)
	@@ -1,1387 +1,1400 @@
	/*
	* unbound.c - unbound validating resolver public API implementation
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains functions to resolve DNS queries and
	* validate the answers. Synchronously and asynchronously.
	*
	*/

	/* include the public api first, it should be able to stand alone */
	#include "libunbound/unbound.h"
	#include "libunbound/unbound-event.h"
	#include "config.h"
	#include <ctype.h>
	#include "libunbound/context.h"
	#include "libunbound/libworker.h"
	#include "util/locks.h"
	#include "util/config_file.h"
	#include "util/alloc.h"
	#include "util/module.h"
	#include "util/regional.h"
	#include "util/log.h"
	#include "util/random.h"
	#include "util/net_help.h"
	#include "util/tube.h"
	#include "util/ub_event.h"
	#include "services/modstack.h"
	#include "services/localzone.h"
	#include "services/cache/infra.h"
	#include "services/cache/rrset.h"
	#include "services/authzone.h"
	#include "sldns/sbuffer.h"
	#ifdef HAVE_PTHREAD
	#include <signal.h>
	#endif
	#ifdef HAVE_SYS_WAIT_H
	#include <sys/wait.h>
	#endif
	#ifdef HAVE_TIME_H
	#include <time.h>
	#endif

	#if defined(UB_ON_WINDOWS) && defined (HAVE_WINDOWS_H)
	#include <windows.h>
	#include <iphlpapi.h>
	#endif /* UB_ON_WINDOWS */

	/** create context functionality, but no pipes */
	static struct ub_ctx* ub_ctx_create_nopipe(void)
	{
	struct ub_ctx* ctx;
	unsigned int seed;
	#ifdef USE_WINSOCK
	int r;
	WSADATA wsa_data;
	#endif

	checklock_start();
	log_init(NULL, 0, NULL); /* logs to stderr */
	log_ident_set("libunbound");
	#ifdef USE_WINSOCK
	if((r = WSAStartup(MAKEWORD(2,2), &wsa_data)) != 0) {
	log_err("could not init winsock. WSAStartup: %s",
	wsa_strerror(r));
	return NULL;
	}
	#endif
	verbosity = 0; /* errors only */
	checklock_start();
	ctx = (struct ub_ctx)calloc(1, sizeof(ctx));
	if(!ctx) {
	errno = ENOMEM;
	return NULL;
	}
	alloc_init(&ctx->superalloc, NULL, 0);
	seed = (unsigned int)time(NULL) ^ (unsigned int)getpid();
	if(!(ctx->seed_rnd = ub_initstate(seed, NULL))) {
	explicit_bzero(&seed, sizeof(seed));
	ub_randfree(ctx->seed_rnd);
	free(ctx);
	errno = ENOMEM;
	return NULL;
	}
	explicit_bzero(&seed, sizeof(seed));
	lock_basic_init(&ctx->qqpipe_lock);
	lock_basic_init(&ctx->rrpipe_lock);
	lock_basic_init(&ctx->cfglock);
	ctx->env = (struct module_env)calloc(1, sizeof(ctx->env));
	if(!ctx->env) {
	ub_randfree(ctx->seed_rnd);
	free(ctx);
	errno = ENOMEM;
	return NULL;
	}
	ctx->env->cfg = config_create_forlib();
	if(!ctx->env->cfg) {
	free(ctx->env);
	ub_randfree(ctx->seed_rnd);
	free(ctx);
	errno = ENOMEM;
	return NULL;
	}
	/* init edns_known_options */
	if(!edns_known_options_init(ctx->env)) {
	config_delete(ctx->env->cfg);
	free(ctx->env);
	ub_randfree(ctx->seed_rnd);
	free(ctx);
	errno = ENOMEM;
	return NULL;
	}
	ctx->env->auth_zones = auth_zones_create();
	if(!ctx->env->auth_zones) {
	edns_known_options_delete(ctx->env);
	config_delete(ctx->env->cfg);
	free(ctx->env);
	ub_randfree(ctx->seed_rnd);
	free(ctx);
	errno = ENOMEM;
	return NULL;
	}
	ctx->env->alloc = &ctx->superalloc;
	ctx->env->worker = NULL;
	ctx->env->need_to_validate = 0;
	modstack_init(&ctx->mods);
	rbtree_init(&ctx->queries, &context_query_cmp);
	return ctx;
	}

	struct ub_ctx*
	ub_ctx_create(void)
	{
	struct ub_ctx* ctx = ub_ctx_create_nopipe();
	if(!ctx)
	return NULL;
	if((ctx->qq_pipe = tube_create()) == NULL) {
	int e = errno;
	ub_randfree(ctx->seed_rnd);
	config_delete(ctx->env->cfg);
	modstack_desetup(&ctx->mods, ctx->env);
	edns_known_options_delete(ctx->env);
	free(ctx->env);
	free(ctx);
	errno = e;
	return NULL;
	}
	if((ctx->rr_pipe = tube_create()) == NULL) {
	int e = errno;
	tube_delete(ctx->qq_pipe);
	ub_randfree(ctx->seed_rnd);
	config_delete(ctx->env->cfg);
	modstack_desetup(&ctx->mods, ctx->env);
	edns_known_options_delete(ctx->env);
	free(ctx->env);
	free(ctx);
	errno = e;
	return NULL;
	}
	return ctx;
	}

	struct ub_ctx*
	ub_ctx_create_ub_event(struct ub_event_base* ueb)
	{
	struct ub_ctx* ctx = ub_ctx_create_nopipe();
	if(!ctx)
	return NULL;
	/* no pipes, but we have the locks to make sure everything works */
	ctx->created_bg = 0;
	ctx->dothread = 1; /* the processing is in the same process,
	makes ub_cancel and ub_ctx_delete do the right thing */
	ctx->event_base = ueb;
	return ctx;
	}

	struct ub_ctx*
	ub_ctx_create_event(struct event_base* eb)
	{
	struct ub_ctx* ctx = ub_ctx_create_nopipe();
	if(!ctx)
	return NULL;
	/* no pipes, but we have the locks to make sure everything works */
	ctx->created_bg = 0;
	ctx->dothread = 1; /* the processing is in the same process,
	makes ub_cancel and ub_ctx_delete do the right thing */
	ctx->event_base = ub_libevent_event_base(eb);
	if (!ctx->event_base) {
	ub_ctx_delete(ctx);
	return NULL;
	}
	return ctx;
	}

	/** delete q */
	static void
	delq(rbnode_type* n, void* ATTR_UNUSED(arg))
	{
	struct ctx_query* q = (struct ctx_query*)n;
	context_query_delete(q);
	}

	/** stop the bg thread */
	static void ub_stop_bg(struct ub_ctx* ctx)
	{
	/* stop the bg thread */
	lock_basic_lock(&ctx->cfglock);
	if(ctx->created_bg) {
	uint8_t* msg;
	uint32_t len;
	uint32_t cmd = UB_LIBCMD_QUIT;
	lock_basic_unlock(&ctx->cfglock);
	lock_basic_lock(&ctx->qqpipe_lock);
	(void)tube_write_msg(ctx->qq_pipe, (uint8_t*)&cmd,
	(uint32_t)sizeof(cmd), 0);
	lock_basic_unlock(&ctx->qqpipe_lock);
	lock_basic_lock(&ctx->rrpipe_lock);
	while(tube_read_msg(ctx->rr_pipe, &msg, &len, 0)) {
	/* discard all results except a quit confirm */
	if(context_serial_getcmd(msg, len) == UB_LIBCMD_QUIT) {
	free(msg);
	break;
	}
	free(msg);
	}
	lock_basic_unlock(&ctx->rrpipe_lock);

	/* if bg worker is a thread, wait for it to exit, so that all
	* resources are really gone. */
	lock_basic_lock(&ctx->cfglock);
	if(ctx->dothread) {
	lock_basic_unlock(&ctx->cfglock);
	ub_thread_join(ctx->bg_tid);
	} else {
	lock_basic_unlock(&ctx->cfglock);
	#ifndef UB_ON_WINDOWS
	if(waitpid(ctx->bg_pid, NULL, 0) == -1) {
	if(verbosity > 2)
	log_err("waitpid: %s", strerror(errno));
	}
	#endif
	}
	}
	else {
	lock_basic_unlock(&ctx->cfglock);
	}
	}

	void
	ub_ctx_delete(struct ub_ctx* ctx)
	{
	struct alloc_cache* a, *na;
	int do_stop = 1;
	if(!ctx) return;

	/* see if bg thread is created and if threads have been killed */
	/* no locks, because those may be held by terminated threads */
	/* for processes the read pipe is closed and we see that on read */
	#ifdef HAVE_PTHREAD
	if(ctx->created_bg && ctx->dothread) {
	if(pthread_kill(ctx->bg_tid, 0) == ESRCH) {
	/* thread has been killed */
	do_stop = 0;
	}
	}
	#endif /* HAVE_PTHREAD */
	if(do_stop)
	ub_stop_bg(ctx);
	libworker_delete_event(ctx->event_worker);

	modstack_desetup(&ctx->mods, ctx->env);
	a = ctx->alloc_list;
	while(a) {
	na = a->super;
	a->super = &ctx->superalloc;
	alloc_clear(a);
	free(a);
	a = na;
	}
	local_zones_delete(ctx->local_zones);
	lock_basic_destroy(&ctx->qqpipe_lock);
	lock_basic_destroy(&ctx->rrpipe_lock);
	lock_basic_destroy(&ctx->cfglock);
	tube_delete(ctx->qq_pipe);
	tube_delete(ctx->rr_pipe);
	if(ctx->env) {
	slabhash_delete(ctx->env->msg_cache);
	rrset_cache_delete(ctx->env->rrset_cache);
	infra_delete(ctx->env->infra_cache);
	config_delete(ctx->env->cfg);
	edns_known_options_delete(ctx->env);
	auth_zones_delete(ctx->env->auth_zones);
	free(ctx->env);
	}
	ub_randfree(ctx->seed_rnd);
	alloc_clear(&ctx->superalloc);
	traverse_postorder(&ctx->queries, delq, NULL);
	free(ctx);
	#ifdef USE_WINSOCK
	WSACleanup();
	#endif
	}

	int
	ub_ctx_set_option(struct ub_ctx* ctx, const char* opt, const char* val)
	{
	lock_basic_lock(&ctx->cfglock);
	if(ctx->finalized) {
	lock_basic_unlock(&ctx->cfglock);
	return UB_AFTERFINAL;
	}
	if(!config_set_option(ctx->env->cfg, opt, val)) {
	lock_basic_unlock(&ctx->cfglock);
	return UB_SYNTAX;
	}
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOERROR;
	}

	int
	ub_ctx_get_option(struct ub_ctx* ctx, const char* opt, char** str)
	{
	int r;
	lock_basic_lock(&ctx->cfglock);
	r = config_get_option_collate(ctx->env->cfg, opt, str);
	lock_basic_unlock(&ctx->cfglock);
	if(r == 0) r = UB_NOERROR;
	else if(r == 1) r = UB_SYNTAX;
	else if(r == 2) r = UB_NOMEM;
	return r;
	}

	int
	ub_ctx_config(struct ub_ctx* ctx, const char* fname)
	{
	lock_basic_lock(&ctx->cfglock);
	if(ctx->finalized) {
	lock_basic_unlock(&ctx->cfglock);
	return UB_AFTERFINAL;
	}
	if(!config_read(ctx->env->cfg, fname, NULL)) {
	lock_basic_unlock(&ctx->cfglock);
	return UB_SYNTAX;
	}
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOERROR;
	}

	int
	ub_ctx_add_ta(struct ub_ctx* ctx, const char* ta)
	{
	char* dup = strdup(ta);
	if(!dup) return UB_NOMEM;
	lock_basic_lock(&ctx->cfglock);
	if(ctx->finalized) {
	lock_basic_unlock(&ctx->cfglock);
	free(dup);
	return UB_AFTERFINAL;
	}
	if(!cfg_strlist_insert(&ctx->env->cfg->trust_anchor_list, dup)) {
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOMEM;
	}
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOERROR;
	}

	int
	ub_ctx_add_ta_file(struct ub_ctx* ctx, const char* fname)
	{
	char* dup = strdup(fname);
	if(!dup) return UB_NOMEM;
	lock_basic_lock(&ctx->cfglock);
	if(ctx->finalized) {
	lock_basic_unlock(&ctx->cfglock);
	free(dup);
	return UB_AFTERFINAL;
	}
	if(!cfg_strlist_insert(&ctx->env->cfg->trust_anchor_file_list, dup)) {
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOMEM;
	}
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOERROR;
	}

	int ub_ctx_add_ta_autr(struct ub_ctx* ctx, const char* fname)
	{
	char* dup = strdup(fname);
	if(!dup) return UB_NOMEM;
	lock_basic_lock(&ctx->cfglock);
	if(ctx->finalized) {
	lock_basic_unlock(&ctx->cfglock);
	free(dup);
	return UB_AFTERFINAL;
	}
	if(!cfg_strlist_insert(&ctx->env->cfg->auto_trust_anchor_file_list,
	dup)) {
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOMEM;
	}
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOERROR;
	}

	int
	ub_ctx_trustedkeys(struct ub_ctx* ctx, const char* fname)
	{
	char* dup = strdup(fname);
	if(!dup) return UB_NOMEM;
	lock_basic_lock(&ctx->cfglock);
	if(ctx->finalized) {
	lock_basic_unlock(&ctx->cfglock);
	free(dup);
	return UB_AFTERFINAL;
	}
	if(!cfg_strlist_insert(&ctx->env->cfg->trusted_keys_file_list, dup)) {
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOMEM;
	}
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOERROR;
	}

	int
	ub_ctx_debuglevel(struct ub_ctx* ctx, int d)
	{
	lock_basic_lock(&ctx->cfglock);
	verbosity = d;
	ctx->env->cfg->verbosity = d;
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOERROR;
	}

	int ub_ctx_debugout(struct ub_ctx* ctx, void* out)
	{
	lock_basic_lock(&ctx->cfglock);
	log_file((FILE*)out);
	ctx->logfile_override = 1;
	ctx->log_out = out;
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOERROR;
	}

	int
	ub_ctx_async(struct ub_ctx* ctx, int dothread)
	{
	#ifdef THREADS_DISABLED
	if(dothread) /* cannot do threading */
	return UB_NOERROR;
	#endif
	lock_basic_lock(&ctx->cfglock);
	if(ctx->finalized) {
	lock_basic_unlock(&ctx->cfglock);
	return UB_AFTERFINAL;
	}
	ctx->dothread = dothread;
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOERROR;
	}

	int
	ub_poll(struct ub_ctx* ctx)
	{
	/* no need to hold lock while testing for readability. */
	return tube_poll(ctx->rr_pipe);
	}

	int
	ub_fd(struct ub_ctx* ctx)
	{
	return tube_read_fd(ctx->rr_pipe);
	}

	/** process answer from bg worker */
	static int
	process_answer_detail(struct ub_ctx* ctx, uint8_t* msg, uint32_t len,
	ub_callback_type* cb, void** cbarg, int* err,
	struct ub_result** res)
	{
	struct ctx_query* q;
	if(context_serial_getcmd(msg, len) != UB_LIBCMD_ANSWER) {
	log_err("error: bad data from bg worker %d",
	(int)context_serial_getcmd(msg, len));
	return 0;
	}

	lock_basic_lock(&ctx->cfglock);
	q = context_deserialize_answer(ctx, msg, len, err);
	if(!q) {
	lock_basic_unlock(&ctx->cfglock);
	/* probably simply the lookup that failed, i.e.
	* response returned before cancel was sent out, so noerror */
	return 1;
	}
	log_assert(q->async);

	/* grab cb while locked */
	if(q->cancelled) {
	*cb = NULL;
	*cbarg = NULL;
	} else {
	*cb = q->cb;
	*cbarg = q->cb_arg;
	}
	if(*err) {
	*res = NULL;
	ub_resolve_free(q->res);
	} else {
	/* parse the message, extract rcode, fill result */
	sldns_buffer* buf = sldns_buffer_new(q->msg_len);
	struct regional* region = regional_create();
	*res = q->res;
	(*res)->rcode = LDNS_RCODE_SERVFAIL;
	if(region && buf) {
	sldns_buffer_clear(buf);
	sldns_buffer_write(buf, q->msg, q->msg_len);
	sldns_buffer_flip(buf);
	libworker_enter_result(*res, buf, region,
	q->msg_security);
	}
	(*res)->answer_packet = q->msg;
	(*res)->answer_len = (int)q->msg_len;
	q->msg = NULL;
	sldns_buffer_free(buf);
	regional_destroy(region);
	}
	q->res = NULL;
	/* delete the q from list */
	(void)rbtree_delete(&ctx->queries, q->node.key);
	ctx->num_async--;
	context_query_delete(q);
	lock_basic_unlock(&ctx->cfglock);

	if(*cb) return 2;
	ub_resolve_free(*res);
	return 1;
	}

	/** process answer from bg worker */
	static int
	process_answer(struct ub_ctx* ctx, uint8_t* msg, uint32_t len)
	{
	int err;
	ub_callback_type cb;
	void* cbarg;
	struct ub_result* res;
	int r;

	r = process_answer_detail(ctx, msg, len, &cb, &cbarg, &err, &res);

	/* no locks held while calling callback, so that library is
	* re-entrant. */
	if(r == 2)
	(*cb)(cbarg, err, res);

	return r;
	}

	int
	ub_process(struct ub_ctx* ctx)
	{
	int r;
	uint8_t* msg;
	uint32_t len;
	while(1) {
	msg = NULL;
	lock_basic_lock(&ctx->rrpipe_lock);
	r = tube_read_msg(ctx->rr_pipe, &msg, &len, 1);
	lock_basic_unlock(&ctx->rrpipe_lock);
	if(r == 0)
	return UB_PIPE;
	else if(r == -1)
	break;
	if(!process_answer(ctx, msg, len)) {
	free(msg);
	return UB_PIPE;
	}
	free(msg);
	}
	return UB_NOERROR;
	}

	int
	ub_wait(struct ub_ctx* ctx)
	{
	int err;
	ub_callback_type cb;
	void* cbarg;
	struct ub_result* res;
	int r;
	uint8_t* msg;
	uint32_t len;
	/* this is basically the same loop as _process(), but with changes.
	* holds the rrpipe lock and waits with tube_wait */
	while(1) {
	lock_basic_lock(&ctx->rrpipe_lock);
	lock_basic_lock(&ctx->cfglock);
	if(ctx->num_async == 0) {
	lock_basic_unlock(&ctx->cfglock);
	lock_basic_unlock(&ctx->rrpipe_lock);
	break;
	}
	lock_basic_unlock(&ctx->cfglock);

	/* keep rrpipe locked, while
	* o waiting for pipe readable
	* o parsing message
	* o possibly decrementing num_async
	* do callback without lock
	*/
	r = tube_wait(ctx->rr_pipe);
	if(r) {
	r = tube_read_msg(ctx->rr_pipe, &msg, &len, 1);
	if(r == 0) {
	lock_basic_unlock(&ctx->rrpipe_lock);
	return UB_PIPE;
	}
	if(r == -1) {
	lock_basic_unlock(&ctx->rrpipe_lock);
	continue;
	}
	r = process_answer_detail(ctx, msg, len,
	&cb, &cbarg, &err, &res);
	lock_basic_unlock(&ctx->rrpipe_lock);
	free(msg);
	if(r == 0)
	return UB_PIPE;
	if(r == 2)
	(*cb)(cbarg, err, res);
	} else {
	lock_basic_unlock(&ctx->rrpipe_lock);
	}
	}
	return UB_NOERROR;
	}

	int
	ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype,
	int rrclass, struct ub_result** result)
	{
	struct ctx_query* q;
	int r;
	*result = NULL;

	lock_basic_lock(&ctx->cfglock);
	if(!ctx->finalized) {
	r = context_finalize(ctx);
	if(r) {
	lock_basic_unlock(&ctx->cfglock);
	return r;
	}
	}
	/* create new ctx_query and attempt to add to the list */
	lock_basic_unlock(&ctx->cfglock);
	q = context_new(ctx, name, rrtype, rrclass, NULL, NULL, NULL);
	if(!q)
	return UB_NOMEM;
	/* become a resolver thread for a bit */

	r = libworker_fg(ctx, q);
	if(r) {
	lock_basic_lock(&ctx->cfglock);
	(void)rbtree_delete(&ctx->queries, q->node.key);
	context_query_delete(q);
	lock_basic_unlock(&ctx->cfglock);
	return r;
	}
	q->res->answer_packet = q->msg;
	q->res->answer_len = (int)q->msg_len;
	q->msg = NULL;
	*result = q->res;
	q->res = NULL;

	lock_basic_lock(&ctx->cfglock);
	(void)rbtree_delete(&ctx->queries, q->node.key);
	context_query_delete(q);
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOERROR;
	}

	int
	ub_resolve_event(struct ub_ctx* ctx, const char* name, int rrtype,
	int rrclass, void* mydata, ub_event_callback_type callback,
	int* async_id)
	{
	struct ctx_query* q;
	int r;

	if(async_id)
	*async_id = 0;
	lock_basic_lock(&ctx->cfglock);
	if(!ctx->finalized) {
	- int r = context_finalize(ctx);
	+ r = context_finalize(ctx);
	if(r) {
	lock_basic_unlock(&ctx->cfglock);
	return r;
	}
	}
	lock_basic_unlock(&ctx->cfglock);
	if(!ctx->event_worker) {
	ctx->event_worker = libworker_create_event(ctx,
	ctx->event_base);
	if(!ctx->event_worker) {
	return UB_INITFAIL;
	}
	}

	/* set time in case answer comes from cache */
	ub_comm_base_now(ctx->event_worker->base);

	/* create new ctx_query and attempt to add to the list */
	q = context_new(ctx, name, rrtype, rrclass, NULL, callback, mydata);
	if(!q)
	return UB_NOMEM;

	/* attach to mesh */
	if((r=libworker_attach_mesh(ctx, q, async_id)) != 0)
	return r;
	return UB_NOERROR;
	}


	int
	ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype,
	int rrclass, void* mydata, ub_callback_type callback, int* async_id)
	{
	struct ctx_query* q;
	uint8_t* msg = NULL;
	uint32_t len = 0;

	if(async_id)
	*async_id = 0;
	lock_basic_lock(&ctx->cfglock);
	if(!ctx->finalized) {
	int r = context_finalize(ctx);
	if(r) {
	lock_basic_unlock(&ctx->cfglock);
	return r;
	}
	}
	if(!ctx->created_bg) {
	int r;
	ctx->created_bg = 1;
	lock_basic_unlock(&ctx->cfglock);
	r = libworker_bg(ctx);
	if(r) {
	lock_basic_lock(&ctx->cfglock);
	ctx->created_bg = 0;
	lock_basic_unlock(&ctx->cfglock);
	return r;
	}
	} else {
	lock_basic_unlock(&ctx->cfglock);
	}

	/* create new ctx_query and attempt to add to the list */
	q = context_new(ctx, name, rrtype, rrclass, callback, NULL, mydata);
	if(!q)
	return UB_NOMEM;

	/* write over pipe to background worker */
	lock_basic_lock(&ctx->cfglock);
	msg = context_serialize_new_query(q, &len);
	if(!msg) {
	(void)rbtree_delete(&ctx->queries, q->node.key);
	ctx->num_async--;
	context_query_delete(q);
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOMEM;
	}
	if(async_id)
	*async_id = q->querynum;
	lock_basic_unlock(&ctx->cfglock);

	lock_basic_lock(&ctx->qqpipe_lock);
	if(!tube_write_msg(ctx->qq_pipe, msg, len, 0)) {
	lock_basic_unlock(&ctx->qqpipe_lock);
	free(msg);
	return UB_PIPE;
	}
	lock_basic_unlock(&ctx->qqpipe_lock);
	free(msg);
	return UB_NOERROR;
	}

	int
	ub_cancel(struct ub_ctx* ctx, int async_id)
	{
	struct ctx_query* q;
	uint8_t* msg = NULL;
	uint32_t len = 0;
	lock_basic_lock(&ctx->cfglock);
	q = (struct ctx_query*)rbtree_search(&ctx->queries, &async_id);
	if(!q \|\| !q->async) {
	/* it is not there, so nothing to do */
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOID;
	}
	log_assert(q->async);
	q->cancelled = 1;

	/* delete it */
	if(!ctx->dothread) { /* if forked */
	(void)rbtree_delete(&ctx->queries, q->node.key);
	ctx->num_async--;
	msg = context_serialize_cancel(q, &len);
	context_query_delete(q);
	lock_basic_unlock(&ctx->cfglock);
	if(!msg) {
	return UB_NOMEM;
	}
	/* send cancel to background worker */
	lock_basic_lock(&ctx->qqpipe_lock);
	if(!tube_write_msg(ctx->qq_pipe, msg, len, 0)) {
	lock_basic_unlock(&ctx->qqpipe_lock);
	free(msg);
	return UB_PIPE;
	}
	lock_basic_unlock(&ctx->qqpipe_lock);
	free(msg);
	} else {
	lock_basic_unlock(&ctx->cfglock);
	}
	return UB_NOERROR;
	}

	void
	ub_resolve_free(struct ub_result* result)
	{
	char** p;
	if(!result) return;
	free(result->qname);
	if(result->canonname != result->qname)
	free(result->canonname);
	if(result->data)
	for(p = result->data; *p; p++)
	free(*p);
	free(result->data);
	free(result->len);
	free(result->answer_packet);
	free(result->why_bogus);
	free(result);
	}

	const char*
	ub_strerror(int err)
	{
	switch(err) {
	case UB_NOERROR: return "no error";
	case UB_SOCKET: return "socket io error";
	case UB_NOMEM: return "out of memory";
	case UB_SYNTAX: return "syntax error";
	case UB_SERVFAIL: return "server failure";
	case UB_FORKFAIL: return "could not fork";
	case UB_INITFAIL: return "initialization failure";
	case UB_AFTERFINAL: return "setting change after finalize";
	case UB_PIPE: return "error in pipe communication with async";
	case UB_READFILE: return "error reading file";
	case UB_NOID: return "error async_id does not exist";
	default: return "unknown error";
	}
	}

	int
	ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr)
	{
	struct sockaddr_storage storage;
	socklen_t stlen;
	struct config_stub* s;
	char* dupl;
	lock_basic_lock(&ctx->cfglock);
	if(ctx->finalized) {
	lock_basic_unlock(&ctx->cfglock);
	errno=EINVAL;
	return UB_AFTERFINAL;
	}
	if(!addr) {
	/* disable fwd mode - the root stub should be first. */
	if(ctx->env->cfg->forwards &&
	strcmp(ctx->env->cfg->forwards->name, ".") == 0) {
	s = ctx->env->cfg->forwards;
	ctx->env->cfg->forwards = s->next;
	s->next = NULL;
	config_delstubs(s);
	}
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOERROR;
	}
	lock_basic_unlock(&ctx->cfglock);

	/* check syntax for addr */
	if(!extstrtoaddr(addr, &storage, &stlen)) {
	errno=EINVAL;
	return UB_SYNTAX;
	}

	/* it parses, add root stub in front of list */
	lock_basic_lock(&ctx->cfglock);
	if(!ctx->env->cfg->forwards \|\|
	strcmp(ctx->env->cfg->forwards->name, ".") != 0) {
	s = calloc(1, sizeof(*s));
	if(!s) {
	lock_basic_unlock(&ctx->cfglock);
	errno=ENOMEM;
	return UB_NOMEM;
	}
	s->name = strdup(".");
	if(!s->name) {
	free(s);
	lock_basic_unlock(&ctx->cfglock);
	errno=ENOMEM;
	return UB_NOMEM;
	}
	s->next = ctx->env->cfg->forwards;
	ctx->env->cfg->forwards = s;
	} else {
	log_assert(ctx->env->cfg->forwards);
	s = ctx->env->cfg->forwards;
	}
	dupl = strdup(addr);
	if(!dupl) {
	lock_basic_unlock(&ctx->cfglock);
	errno=ENOMEM;
	return UB_NOMEM;
	}
	if(!cfg_strlist_insert(&s->addrs, dupl)) {
	lock_basic_unlock(&ctx->cfglock);
	errno=ENOMEM;
	return UB_NOMEM;
	}
	+ lock_basic_unlock(&ctx->cfglock);
	+ return UB_NOERROR;
	+}
	+
	+int ub_ctx_set_tls(struct ub_ctx* ctx, int tls)
	+{
	+ lock_basic_lock(&ctx->cfglock);
	+ if(ctx->finalized) {
	+ lock_basic_unlock(&ctx->cfglock);
	+ errno=EINVAL;
	+ return UB_AFTERFINAL;
	+ }
	+ ctx->env->cfg->ssl_upstream = tls;
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOERROR;
	}

	int ub_ctx_set_stub(struct ub_ctx* ctx, const char* zone, const char* addr,
	int isprime)
	{
	char* a;
	struct config_stub *prev, elem;

	/* check syntax for zone name */
	if(zone) {
	uint8_t* nm;
	int nmlabs;
	size_t nmlen;
	if(!parse_dname(zone, &nm, &nmlen, &nmlabs)) {
	errno=EINVAL;
	return UB_SYNTAX;
	}
	free(nm);
	} else {
	zone = ".";
	}

	/* check syntax for addr (if not NULL) */
	if(addr) {
	struct sockaddr_storage storage;
	socklen_t stlen;
	if(!extstrtoaddr(addr, &storage, &stlen)) {
	errno=EINVAL;
	return UB_SYNTAX;
	}
	}

	lock_basic_lock(&ctx->cfglock);
	if(ctx->finalized) {
	lock_basic_unlock(&ctx->cfglock);
	errno=EINVAL;
	return UB_AFTERFINAL;
	}

	/* arguments all right, now find or add the stub */
	prev = &ctx->env->cfg->stubs;
	elem = cfg_stub_find(&prev, zone);
	if(!elem && !addr) {
	/* not found and we want to delete, nothing to do */
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOERROR;
	} else if(elem && !addr) {
	/* found, and we want to delete */
	*prev = elem->next;
	config_delstub(elem);
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOERROR;
	} else if(!elem) {
	/* not found, create the stub entry */
	elem=(struct config_stub*)calloc(1, sizeof(struct config_stub));
	if(elem) elem->name = strdup(zone);
	if(!elem \|\| !elem->name) {
	free(elem);
	lock_basic_unlock(&ctx->cfglock);
	errno = ENOMEM;
	return UB_NOMEM;
	}
	elem->next = ctx->env->cfg->stubs;
	ctx->env->cfg->stubs = elem;
	}

	/* add the address to the list and set settings */
	elem->isprime = isprime;
	a = strdup(addr);
	if(!a) {
	lock_basic_unlock(&ctx->cfglock);
	errno = ENOMEM;
	return UB_NOMEM;
	}
	if(!cfg_strlist_insert(&elem->addrs, a)) {
	lock_basic_unlock(&ctx->cfglock);
	errno = ENOMEM;
	return UB_NOMEM;
	}
	lock_basic_unlock(&ctx->cfglock);
	return UB_NOERROR;
	}

	int
	ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname)
	{
	FILE* in;
	int numserv = 0;
	char buf[1024];
	char* parse, *addr;
	int r;

	if(fname == NULL) {
	#if !defined(UB_ON_WINDOWS) \|\| !defined(HAVE_WINDOWS_H)
	fname = "/etc/resolv.conf";
	#else
	FIXED_INFO *info;
	ULONG buflen = sizeof(*info);
	IP_ADDR_STRING *ptr;

	info = (FIXED_INFO *) malloc(sizeof (FIXED_INFO));
	if (info == NULL)
	return UB_READFILE;

	if (GetNetworkParams(info, &buflen) == ERROR_BUFFER_OVERFLOW) {
	free(info);
	info = (FIXED_INFO *) malloc(buflen);
	if (info == NULL)
	return UB_READFILE;
	}

	if (GetNetworkParams(info, &buflen) == NO_ERROR) {
	int retval=0;
	ptr = &(info->DnsServerList);
	while (ptr) {
	numserv++;
	if((retval=ub_ctx_set_fwd(ctx,
	ptr->IpAddress.String))!=0) {
	free(info);
	return retval;
	}
	ptr = ptr->Next;
	}
	free(info);
	if (numserv==0)
	return UB_READFILE;
	return UB_NOERROR;
	}
	free(info);
	return UB_READFILE;
	#endif /* WINDOWS */
	}
	in = fopen(fname, "r");
	if(!in) {
	/* error in errno! perror(fname) */
	return UB_READFILE;
	}
	while(fgets(buf, (int)sizeof(buf), in)) {
	buf[sizeof(buf)-1] = 0;
	parse=buf;
	while(parse == ' ' \|\| parse == '\t')
	parse++;
	if(strncmp(parse, "nameserver", 10) == 0) {
	numserv++;
	parse += 10; /* skip 'nameserver' */
	/* skip whitespace */
	while(parse == ' ' \|\| parse == '\t')
	parse++;
	addr = parse;
	/* skip [0-9a-fA-F.:], i.e. IP4 and IP6 address /
	while(isxdigit((unsigned char)parse) \|\| parse=='.' \|\| *parse==':')
	parse++;
	/* terminate after the address, remove newline */
	*parse = 0;

	if((r = ub_ctx_set_fwd(ctx, addr)) != UB_NOERROR) {
	fclose(in);
	return r;
	}
	}
	}
	fclose(in);
	if(numserv == 0) {
	/* from resolv.conf(5) if none given, use localhost */
	return ub_ctx_set_fwd(ctx, "127.0.0.1");
	}
	return UB_NOERROR;
	}

	int
	ub_ctx_hosts(struct ub_ctx* ctx, const char* fname)
	{
	FILE* in;
	char buf[1024], ldata[1024];
	char* parse, addr, name, *ins;
	lock_basic_lock(&ctx->cfglock);
	if(ctx->finalized) {
	lock_basic_unlock(&ctx->cfglock);
	errno=EINVAL;
	return UB_AFTERFINAL;
	}
	lock_basic_unlock(&ctx->cfglock);
	if(fname == NULL) {
	#if defined(UB_ON_WINDOWS) && defined(HAVE_WINDOWS_H)
	/*
	* If this is Windows NT/XP/2K it's in
	* %WINDIR%\system32\drivers\etc\hosts.
	* If this is Windows 95/98/Me it's in %WINDIR%\hosts.
	*/
	name = getenv("WINDIR");
	if (name != NULL) {
	int retval=0;
	snprintf(buf, sizeof(buf), "%s%s", name,
	"\\system32\\drivers\\etc\\hosts");
	if((retval=ub_ctx_hosts(ctx, buf)) !=0 ) {
	snprintf(buf, sizeof(buf), "%s%s", name,
	"\\hosts");
	retval=ub_ctx_hosts(ctx, buf);
	}
	return retval;
	}
	return UB_READFILE;
	#else
	fname = "/etc/hosts";
	#endif /* WIN32 */
	}
	in = fopen(fname, "r");
	if(!in) {
	/* error in errno! perror(fname) */
	return UB_READFILE;
	}
	while(fgets(buf, (int)sizeof(buf), in)) {
	buf[sizeof(buf)-1] = 0;
	parse=buf;
	while(parse == ' ' \|\| parse == '\t')
	parse++;
	if(*parse == '#')
	continue; /* skip comment */
	/* format: <addr> spaces <name> spaces <name> ... */
	addr = parse;
	/* skip addr */
	while(isxdigit((unsigned char)parse) \|\| parse == '.' \|\| *parse == ':')
	parse++;
	if(*parse == '\r')
	parse++;
	if(parse == '\n' \|\| parse == 0)
	continue;
	if(*parse == '%')
	continue; /* ignore macOSX fe80::1%lo0 localhost */
	if(parse != ' ' && parse != '\t') {
	/* must have whitespace after address */
	fclose(in);
	errno=EINVAL;
	return UB_SYNTAX;
	}
	parse++ = 0; / end delimiter for addr ... */
	/* go to names and add them */
	while(*parse) {
	while(parse == ' ' \|\| parse == '\t' \|\| *parse=='\n'
	\|\| *parse=='\r')
	parse++;
	if(parse == 0 \|\| parse == '#')
	break;
	/* skip name, allows (too) many printable characters */
	name = parse;
	while('!' <= parse && parse <= '~')
	parse++;
	if(*parse)
	parse++ = 0; / end delimiter for name */
	snprintf(ldata, sizeof(ldata), "%s %s %s",
	name, str_is_ip6(addr)?"AAAA":"A", addr);
	ins = strdup(ldata);
	if(!ins) {
	/* out of memory */
	fclose(in);
	errno=ENOMEM;
	return UB_NOMEM;
	}
	lock_basic_lock(&ctx->cfglock);
	if(!cfg_strlist_insert(&ctx->env->cfg->local_data,
	ins)) {
	lock_basic_unlock(&ctx->cfglock);
	fclose(in);
	errno=ENOMEM;
	return UB_NOMEM;
	}
	lock_basic_unlock(&ctx->cfglock);
	}
	}
	fclose(in);
	return UB_NOERROR;
	}

	/** finalize the context, if not already finalized */
	static int ub_ctx_finalize(struct ub_ctx* ctx)
	{
	int res = 0;
	lock_basic_lock(&ctx->cfglock);
	if (!ctx->finalized) {
	res = context_finalize(ctx);
	}
	lock_basic_unlock(&ctx->cfglock);
	return res;
	}

	/* Print local zones and RR data */
	int ub_ctx_print_local_zones(struct ub_ctx* ctx)
	{
	int res = ub_ctx_finalize(ctx);
	if (res) return res;

	local_zones_print(ctx->local_zones);

	return UB_NOERROR;
	}

	/* Add a new zone */
	int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name,
	const char *zone_type)
	{
	enum localzone_type t;
	struct local_zone* z;
	uint8_t* nm;
	int nmlabs;
	size_t nmlen;

	int res = ub_ctx_finalize(ctx);
	if (res) return res;

	if(!local_zone_str2type(zone_type, &t)) {
	return UB_SYNTAX;
	}

	if(!parse_dname(zone_name, &nm, &nmlen, &nmlabs)) {
	return UB_SYNTAX;
	}

	lock_rw_wrlock(&ctx->local_zones->lock);
	if((z=local_zones_find(ctx->local_zones, nm, nmlen, nmlabs,
	LDNS_RR_CLASS_IN))) {
	/* already present in tree */
	lock_rw_wrlock(&z->lock);
	z->type = t; /* update type anyway */
	lock_rw_unlock(&z->lock);
	lock_rw_unlock(&ctx->local_zones->lock);
	free(nm);
	return UB_NOERROR;
	}
	if(!local_zones_add_zone(ctx->local_zones, nm, nmlen, nmlabs,
	LDNS_RR_CLASS_IN, t)) {
	lock_rw_unlock(&ctx->local_zones->lock);
	return UB_NOMEM;
	}
	lock_rw_unlock(&ctx->local_zones->lock);
	return UB_NOERROR;
	}

	/* Remove zone */
	int ub_ctx_zone_remove(struct ub_ctx* ctx, const char *zone_name)
	{
	struct local_zone* z;
	uint8_t* nm;
	int nmlabs;
	size_t nmlen;

	int res = ub_ctx_finalize(ctx);
	if (res) return res;

	if(!parse_dname(zone_name, &nm, &nmlen, &nmlabs)) {
	return UB_SYNTAX;
	}

	lock_rw_wrlock(&ctx->local_zones->lock);
	if((z=local_zones_find(ctx->local_zones, nm, nmlen, nmlabs,
	LDNS_RR_CLASS_IN))) {
	/* present in tree */
	local_zones_del_zone(ctx->local_zones, z);
	}
	lock_rw_unlock(&ctx->local_zones->lock);
	free(nm);
	return UB_NOERROR;
	}

	/* Add new RR data */
	int ub_ctx_data_add(struct ub_ctx* ctx, const char *data)
	{
	int res = ub_ctx_finalize(ctx);
	if (res) return res;

	res = local_zones_add_RR(ctx->local_zones, data);
	return (!res) ? UB_NOMEM : UB_NOERROR;
	}

	/* Remove RR data */
	int ub_ctx_data_remove(struct ub_ctx* ctx, const char *data)
	{
	uint8_t* nm;
	int nmlabs;
	size_t nmlen;
	int res = ub_ctx_finalize(ctx);
	if (res) return res;

	if(!parse_dname(data, &nm, &nmlen, &nmlabs))
	return UB_SYNTAX;

	local_zones_del_data(ctx->local_zones, nm, nmlen, nmlabs,
	LDNS_RR_CLASS_IN);

	free(nm);
	return UB_NOERROR;
	}

	const char* ub_version(void)
	{
	return PACKAGE_VERSION;
	}

	int
	ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base) {
	struct ub_event_base* new_base;

	if (!ctx \|\| !ctx->event_base \|\| !base) {
	return UB_INITFAIL;
	}
	if (ub_libevent_get_event_base(ctx->event_base) == base) {
	/* already set */
	return UB_NOERROR;
	}

	lock_basic_lock(&ctx->cfglock);
	/* destroy the current worker - safe to pass in NULL */
	libworker_delete_event(ctx->event_worker);
	ctx->event_worker = NULL;
	new_base = ub_libevent_event_base(base);
	if (new_base)
	ctx->event_base = new_base;
	ctx->created_bg = 0;
	ctx->dothread = 1;
	lock_basic_unlock(&ctx->cfglock);
	return new_base ? UB_NOERROR : UB_INITFAIL;
	}
	Index: head/contrib/unbound/libunbound/libworker.c
	===================================================================
	--- head/contrib/unbound/libunbound/libworker.c (revision 349719)
	+++ head/contrib/unbound/libunbound/libworker.c (revision 349720)
	@@ -1,1057 +1,1056 @@
	/*
	* libunbound/worker.c - worker thread or process that resolves
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains the worker process or thread that performs
	* the DNS resolving and validation. The worker is called by a procedure
	* and if in the background continues until exit, if in the foreground
	* returns from the procedure when done.
	*/
	#include "config.h"
	#ifdef HAVE_SSL
	#include <openssl/ssl.h>
	#endif
	#include "libunbound/libworker.h"
	#include "libunbound/context.h"
	#include "libunbound/unbound.h"
	#include "libunbound/worker.h"
	#include "libunbound/unbound-event.h"
	#include "services/outside_network.h"
	#include "services/mesh.h"
	#include "services/localzone.h"
	#include "services/cache/rrset.h"
	#include "services/outbound_list.h"
	#include "services/authzone.h"
	#include "util/fptr_wlist.h"
	#include "util/module.h"
	#include "util/regional.h"
	#include "util/random.h"
	#include "util/config_file.h"
	#include "util/netevent.h"
	#include "util/storage/lookup3.h"
	#include "util/storage/slabhash.h"
	#include "util/net_help.h"
	#include "util/data/dname.h"
	#include "util/data/msgreply.h"
	#include "util/data/msgencode.h"
	#include "util/tube.h"
	#include "iterator/iter_fwd.h"
	#include "iterator/iter_hints.h"
	#include "sldns/sbuffer.h"
	#include "sldns/str2wire.h"

	/** handle new query command for bg worker */
	static void handle_newq(struct libworker* w, uint8_t* buf, uint32_t len);

	/** delete libworker env */
	static void
	libworker_delete_env(struct libworker* w)
	{
	if(w->env) {
	outside_network_quit_prepare(w->back);
	mesh_delete(w->env->mesh);
	context_release_alloc(w->ctx, w->env->alloc,
	!w->is_bg \|\| w->is_bg_thread);
	sldns_buffer_free(w->env->scratch_buffer);
	regional_destroy(w->env->scratch);
	forwards_delete(w->env->fwds);
	hints_delete(w->env->hints);
	ub_randfree(w->env->rnd);
	free(w->env);
	}
	#ifdef HAVE_SSL
	SSL_CTX_free(w->sslctx);
	#endif
	outside_network_delete(w->back);
	}

	/** delete libworker struct */
	static void
	libworker_delete(struct libworker* w)
	{
	if(!w) return;
	libworker_delete_env(w);
	comm_base_delete(w->base);
	free(w);
	}

	void
	libworker_delete_event(struct libworker* w)
	{
	if(!w) return;
	libworker_delete_env(w);
	comm_base_delete_no_base(w->base);
	free(w);
	}

	/** setup fresh libworker struct */
	static struct libworker*
	libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb)
	{
	unsigned int seed;
	struct libworker* w = (struct libworker)calloc(1, sizeof(w));
	struct config_file* cfg = ctx->env->cfg;
	int* ports;
	int numports;
	if(!w) return NULL;
	w->is_bg = is_bg;
	w->ctx = ctx;
	w->env = (struct module_env)malloc(sizeof(w->env));
	if(!w->env) {
	free(w);
	return NULL;
	}
	w->env = ctx->env;
	w->env->alloc = context_obtain_alloc(ctx, !w->is_bg \|\| w->is_bg_thread);
	if(!w->env->alloc) {
	libworker_delete(w);
	return NULL;
	}
	w->thread_num = w->env->alloc->thread_num;
	alloc_set_id_cleanup(w->env->alloc, &libworker_alloc_cleanup, w);
	if(!w->is_bg \|\| w->is_bg_thread) {
	lock_basic_lock(&ctx->cfglock);
	}
	w->env->scratch = regional_create_custom(cfg->msg_buffer_size);
	w->env->scratch_buffer = sldns_buffer_new(cfg->msg_buffer_size);
	w->env->fwds = forwards_create();
	if(w->env->fwds && !forwards_apply_cfg(w->env->fwds, cfg)) {
	forwards_delete(w->env->fwds);
	w->env->fwds = NULL;
	}
	w->env->hints = hints_create();
	if(w->env->hints && !hints_apply_cfg(w->env->hints, cfg)) {
	hints_delete(w->env->hints);
	w->env->hints = NULL;
	}
	if(cfg->ssl_upstream \|\| (cfg->tls_cert_bundle && cfg->tls_cert_bundle[0]) \|\| cfg->tls_win_cert) {
	w->sslctx = connect_sslctx_create(NULL, NULL,
	cfg->tls_cert_bundle, cfg->tls_win_cert);
	if(!w->sslctx) {
	/* to make the setup fail after unlock */
	hints_delete(w->env->hints);
	w->env->hints = NULL;
	}
	}
	if(!w->is_bg \|\| w->is_bg_thread) {
	lock_basic_unlock(&ctx->cfglock);
	}
	if(!w->env->scratch \|\| !w->env->scratch_buffer \|\| !w->env->fwds \|\|
	!w->env->hints) {
	libworker_delete(w);
	return NULL;
	}
	w->env->worker = (struct worker*)w;
	w->env->probe_timer = NULL;
	seed = (unsigned int)time(NULL) ^ (unsigned int)getpid() ^
	(((unsigned int)w->thread_num)<<17);
	seed ^= (unsigned int)w->env->alloc->next_id;
	if(!w->is_bg \|\| w->is_bg_thread) {
	lock_basic_lock(&ctx->cfglock);
	}
	if(!(w->env->rnd = ub_initstate(seed, ctx->seed_rnd))) {
	if(!w->is_bg \|\| w->is_bg_thread) {
	lock_basic_unlock(&ctx->cfglock);
	}
	explicit_bzero(&seed, sizeof(seed));
	libworker_delete(w);
	return NULL;
	}
	if(!w->is_bg \|\| w->is_bg_thread) {
	lock_basic_unlock(&ctx->cfglock);
	}
	if(1) {
	/* primitive lockout for threading: if it overwrites another
	* thread it is like wiping the cache (which is likely empty
	* at the start) */
	/* note we are holding the ctx lock in normal threaded
	* cases so that is solved properly, it is only for many ctx
	* in different threads that this may clash */
	static int done_raninit = 0;
	if(!done_raninit) {
	done_raninit = 1;
	hash_set_raninit((uint32_t)ub_random(w->env->rnd));
	}
	}
	explicit_bzero(&seed, sizeof(seed));

	if(eb)
	w->base = comm_base_create_event(eb);
	else w->base = comm_base_create(0);
	if(!w->base) {
	libworker_delete(w);
	return NULL;
	}
	w->env->worker_base = w->base;
	if(!w->is_bg \|\| w->is_bg_thread) {
	lock_basic_lock(&ctx->cfglock);
	}
	numports = cfg_condense_ports(cfg, &ports);
	if(numports == 0) {
	- int locked = !w->is_bg \|\| w->is_bg_thread;
	- libworker_delete(w);
	- if(locked) {
	+ if(!w->is_bg \|\| w->is_bg_thread) {
	lock_basic_unlock(&ctx->cfglock);
	}
	+ libworker_delete(w);
	return NULL;
	}
	w->back = outside_network_create(w->base, cfg->msg_buffer_size,
	(size_t)cfg->outgoing_num_ports, cfg->out_ifs,
	cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6,
	cfg->do_tcp?cfg->outgoing_num_tcp:0,
	w->env->infra_cache, w->env->rnd, cfg->use_caps_bits_for_id,
	ports, numports, cfg->unwanted_threshold,
	cfg->outgoing_tcp_mss, &libworker_alloc_cleanup, w,
	cfg->do_udp \|\| cfg->udp_upstream_without_downstream, w->sslctx,
	cfg->delay_close, NULL);
	w->env->outnet = w->back;
	if(!w->is_bg \|\| w->is_bg_thread) {
	lock_basic_unlock(&ctx->cfglock);
	}
	free(ports);
	if(!w->back) {
	libworker_delete(w);
	return NULL;
	}
	w->env->mesh = mesh_create(&ctx->mods, w->env);
	if(!w->env->mesh) {
	libworker_delete(w);
	return NULL;
	}
	w->env->send_query = &libworker_send_query;
	w->env->detach_subs = &mesh_detach_subs;
	w->env->attach_sub = &mesh_attach_sub;
	w->env->add_sub = &mesh_add_sub;
	w->env->kill_sub = &mesh_state_delete;
	w->env->detect_cycle = &mesh_detect_cycle;
	comm_base_timept(w->base, &w->env->now, &w->env->now_tv);
	return w;
	}

	struct libworker* libworker_create_event(struct ub_ctx* ctx,
	struct ub_event_base* eb)
	{
	return libworker_setup(ctx, 0, eb);
	}

	/** handle cancel command for bg worker */
	static void
	handle_cancel(struct libworker* w, uint8_t* buf, uint32_t len)
	{
	struct ctx_query* q;
	if(w->is_bg_thread) {
	lock_basic_lock(&w->ctx->cfglock);
	q = context_deserialize_cancel(w->ctx, buf, len);
	lock_basic_unlock(&w->ctx->cfglock);
	} else {
	q = context_deserialize_cancel(w->ctx, buf, len);
	}
	if(!q) {
	/* probably simply lookup failed, i.e. the message had been
	* processed and answered before the cancel arrived */
	return;
	}
	q->cancelled = 1;
	free(buf);
	}

	/** do control command coming into bg server */
	static void
	libworker_do_cmd(struct libworker* w, uint8_t* msg, uint32_t len)
	{
	switch(context_serial_getcmd(msg, len)) {
	default:
	case UB_LIBCMD_ANSWER:
	log_err("unknown command for bg worker %d",
	(int)context_serial_getcmd(msg, len));
	/* and fall through to quit */
	/* fallthrough */
	case UB_LIBCMD_QUIT:
	free(msg);
	comm_base_exit(w->base);
	break;
	case UB_LIBCMD_NEWQUERY:
	handle_newq(w, msg, len);
	break;
	case UB_LIBCMD_CANCEL:
	handle_cancel(w, msg, len);
	break;
	}
	}

	/** handle control command coming into server */
	void
	libworker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
	uint8_t* msg, size_t len, int err, void* arg)
	{
	struct libworker* w = (struct libworker*)arg;

	if(err != 0) {
	free(msg);
	/* it is of no use to go on, exit */
	comm_base_exit(w->base);
	return;
	}
	libworker_do_cmd(w, msg, len); /* also frees the buf */
	}

	/** the background thread func */
	static void*
	libworker_dobg(void* arg)
	{
	/* setup */
	uint32_t m;
	struct libworker* w = (struct libworker*)arg;
	struct ub_ctx* ctx;
	if(!w) {
	log_err("libunbound bg worker init failed, nomem");
	return NULL;
	}
	ctx = w->ctx;
	log_thread_set(&w->thread_num);
	#ifdef THREADS_DISABLED
	/* we are forked */
	w->is_bg_thread = 0;
	/* close non-used parts of the pipes */
	tube_close_write(ctx->qq_pipe);
	tube_close_read(ctx->rr_pipe);
	#endif
	if(!tube_setup_bg_listen(ctx->qq_pipe, w->base,
	libworker_handle_control_cmd, w)) {
	log_err("libunbound bg worker init failed, no bglisten");
	return NULL;
	}
	if(!tube_setup_bg_write(ctx->rr_pipe, w->base)) {
	log_err("libunbound bg worker init failed, no bgwrite");
	return NULL;
	}

	/* do the work */
	comm_base_dispatch(w->base);

	/* cleanup */
	m = UB_LIBCMD_QUIT;
	w->want_quit = 1;
	tube_remove_bg_listen(w->ctx->qq_pipe);
	tube_remove_bg_write(w->ctx->rr_pipe);
	libworker_delete(w);
	(void)tube_write_msg(ctx->rr_pipe, (uint8_t*)&m,
	(uint32_t)sizeof(m), 0);
	#ifdef THREADS_DISABLED
	/* close pipes from forked process before exit */
	tube_close_read(ctx->qq_pipe);
	tube_close_write(ctx->rr_pipe);
	#endif
	return NULL;
	}

	int libworker_bg(struct ub_ctx* ctx)
	{
	struct libworker* w;
	/* fork or threadcreate */
	lock_basic_lock(&ctx->cfglock);
	if(ctx->dothread) {
	lock_basic_unlock(&ctx->cfglock);
	w = libworker_setup(ctx, 1, NULL);
	if(!w) return UB_NOMEM;
	w->is_bg_thread = 1;
	#ifdef ENABLE_LOCK_CHECKS
	w->thread_num = 1; /* for nicer DEBUG checklocks */
	#endif
	ub_thread_create(&ctx->bg_tid, libworker_dobg, w);
	} else {
	lock_basic_unlock(&ctx->cfglock);
	#ifndef HAVE_FORK
	/* no fork on windows */
	return UB_FORKFAIL;
	#else /* HAVE_FORK */
	switch((ctx->bg_pid=fork())) {
	case 0:
	w = libworker_setup(ctx, 1, NULL);
	if(!w) fatal_exit("out of memory");
	/* close non-used parts of the pipes */
	tube_close_write(ctx->qq_pipe);
	tube_close_read(ctx->rr_pipe);
	(void)libworker_dobg(w);
	exit(0);
	break;
	case -1:
	return UB_FORKFAIL;
	default:
	/* close non-used parts, so that the worker
	* bgprocess gets 'pipe closed' when the
	* main process exits */
	tube_close_read(ctx->qq_pipe);
	tube_close_write(ctx->rr_pipe);
	break;
	}
	#endif /* HAVE_FORK */
	}
	return UB_NOERROR;
	}

	/** insert canonname */
	static int
	fill_canon(struct ub_result* res, uint8_t* s)
	{
	char buf[255+2];
	dname_str(s, buf);
	res->canonname = strdup(buf);
	return res->canonname != 0;
	}

	/** fill data into result */
	static int
	fill_res(struct ub_result* res, struct ub_packed_rrset_key* answer,
	uint8_t* finalcname, struct query_info* rq, struct reply_info* rep)
	{
	size_t i;
	struct packed_rrset_data* data;
	res->ttl = 0;
	if(!answer) {
	if(finalcname) {
	if(!fill_canon(res, finalcname))
	return 0; /* out of memory */
	}
	if(rep->rrset_count != 0)
	res->ttl = (int)rep->ttl;
	res->data = (char*)calloc(1, sizeof(char));
	res->len = (int*)calloc(1, sizeof(int));
	return (res->data && res->len);
	}
	data = (struct packed_rrset_data*)answer->entry.data;
	if(query_dname_compare(rq->qname, answer->rk.dname) != 0) {
	if(!fill_canon(res, answer->rk.dname))
	return 0; /* out of memory */
	} else res->canonname = NULL;
	res->data = (char*)calloc(data->count+1, sizeof(char));
	res->len = (int*)calloc(data->count+1, sizeof(int));
	if(!res->data \|\| !res->len)
	return 0; /* out of memory */
	for(i=0; i<data->count; i++) {
	/* remove rdlength from rdata */
	res->len[i] = (int)(data->rr_len[i] - 2);
	res->data[i] = memdup(data->rr_data[i]+2, (size_t)res->len[i]);
	if(!res->data[i])
	return 0; /* out of memory */
	}
	/* ttl for positive answers, from CNAME and answer RRs */
	if(data->count != 0) {
	size_t j;
	res->ttl = (int)data->ttl;
	for(j=0; j<rep->an_numrrsets; j++) {
	struct packed_rrset_data* d =
	(struct packed_rrset_data*)rep->rrsets[j]->
	entry.data;
	if((int)d->ttl < res->ttl)
	res->ttl = (int)d->ttl;
	}
	}
	/* ttl for negative answers */
	if(data->count == 0 && rep->rrset_count != 0)
	res->ttl = (int)rep->ttl;
	res->data[data->count] = NULL;
	res->len[data->count] = 0;
	return 1;
	}

	/** fill result from parsed message, on error fills servfail */
	void
	libworker_enter_result(struct ub_result* res, sldns_buffer* buf,
	struct regional* temp, enum sec_status msg_security)
	{
	struct query_info rq;
	struct reply_info* rep;
	res->rcode = LDNS_RCODE_SERVFAIL;
	rep = parse_reply_in_temp_region(buf, temp, &rq);
	if(!rep) {
	log_err("cannot parse buf");
	return; /* error parsing buf, or out of memory */
	}
	if(!fill_res(res, reply_find_answer_rrset(&rq, rep),
	reply_find_final_cname_target(&rq, rep), &rq, rep))
	return; /* out of memory */
	/* rcode, havedata, nxdomain, secure, bogus */
	res->rcode = (int)FLAGS_GET_RCODE(rep->flags);
	if(res->data && res->data[0])
	res->havedata = 1;
	if(res->rcode == LDNS_RCODE_NXDOMAIN)
	res->nxdomain = 1;
	if(msg_security == sec_status_secure)
	res->secure = 1;
	if(msg_security == sec_status_bogus \|\|
	msg_security == sec_status_secure_sentinel_fail)
	res->bogus = 1;
	}

	/** fillup fg results */
	static void
	libworker_fillup_fg(struct ctx_query* q, int rcode, sldns_buffer* buf,
	enum sec_status s, char* why_bogus, int was_ratelimited)
	{
	q->res->was_ratelimited = was_ratelimited;
	if(why_bogus)
	q->res->why_bogus = strdup(why_bogus);
	if(rcode != 0) {
	q->res->rcode = rcode;
	q->msg_security = s;
	return;
	}

	q->res->rcode = LDNS_RCODE_SERVFAIL;
	q->msg_security = 0;
	q->msg = memdup(sldns_buffer_begin(buf), sldns_buffer_limit(buf));
	q->msg_len = sldns_buffer_limit(buf);
	if(!q->msg) {
	return; /* the error is in the rcode */
	}

	/* canonname and results */
	q->msg_security = s;
	libworker_enter_result(q->res, buf, q->w->env->scratch, s);
	}

	void
	libworker_fg_done_cb(void* arg, int rcode, sldns_buffer* buf, enum sec_status s,
	char* why_bogus, int was_ratelimited)
	{
	struct ctx_query* q = (struct ctx_query*)arg;
	/* fg query is done; exit comm base */
	comm_base_exit(q->w->base);

	libworker_fillup_fg(q, rcode, buf, s, why_bogus, was_ratelimited);
	}

	/** setup qinfo and edns */
	static int
	setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
	struct query_info* qinfo, struct edns_data* edns)
	{
	qinfo->qtype = (uint16_t)q->res->qtype;
	qinfo->qclass = (uint16_t)q->res->qclass;
	qinfo->local_alias = NULL;
	qinfo->qname = sldns_str2wire_dname(q->res->qname, &qinfo->qname_len);
	if(!qinfo->qname) {
	return 0;
	}
	qinfo->local_alias = NULL;
	edns->edns_present = 1;
	edns->ext_rcode = 0;
	edns->edns_version = 0;
	edns->bits = EDNS_DO;
	edns->opt_list = NULL;
	if(sldns_buffer_capacity(w->back->udp_buff) < 65535)
	edns->udp_size = (uint16_t)sldns_buffer_capacity(
	w->back->udp_buff);
	else edns->udp_size = 65535;
	return 1;
	}

	int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q)
	{
	struct libworker* w = libworker_setup(ctx, 0, NULL);
	uint16_t qflags, qid;
	struct query_info qinfo;
	struct edns_data edns;
	if(!w)
	return UB_INITFAIL;
	if(!setup_qinfo_edns(w, q, &qinfo, &edns)) {
	libworker_delete(w);
	return UB_SYNTAX;
	}
	qid = 0;
	qflags = BIT_RD;
	q->w = w;
	/* see if there is a fixed answer */
	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
	if(local_zones_answer(ctx->local_zones, w->env, &qinfo, &edns,
	w->back->udp_buff, w->env->scratch, NULL, NULL, 0, NULL, 0,
	NULL, 0, NULL, 0, NULL)) {
	regional_free_all(w->env->scratch);
	libworker_fillup_fg(q, LDNS_RCODE_NOERROR,
	w->back->udp_buff, sec_status_insecure, NULL, 0);
	libworker_delete(w);
	free(qinfo.qname);
	return UB_NOERROR;
	}
	if(ctx->env->auth_zones && auth_zones_answer(ctx->env->auth_zones,
	w->env, &qinfo, &edns, NULL, w->back->udp_buff, w->env->scratch)) {
	regional_free_all(w->env->scratch);
	libworker_fillup_fg(q, LDNS_RCODE_NOERROR,
	w->back->udp_buff, sec_status_insecure, NULL, 0);
	libworker_delete(w);
	free(qinfo.qname);
	return UB_NOERROR;
	}
	/* process new query */
	if(!mesh_new_callback(w->env->mesh, &qinfo, qflags, &edns,
	w->back->udp_buff, qid, libworker_fg_done_cb, q)) {
	free(qinfo.qname);
	return UB_NOMEM;
	}
	free(qinfo.qname);

	/* wait for reply */
	comm_base_dispatch(w->base);

	libworker_delete(w);
	return UB_NOERROR;
	}

	void
	libworker_event_done_cb(void* arg, int rcode, sldns_buffer* buf,
	enum sec_status s, char* why_bogus, int was_ratelimited)
	{
	struct ctx_query* q = (struct ctx_query*)arg;
	ub_event_callback_type cb = q->cb_event;
	void* cb_arg = q->cb_arg;
	int cancelled = q->cancelled;

	/* delete it now */
	struct ub_ctx* ctx = q->w->ctx;
	lock_basic_lock(&ctx->cfglock);
	(void)rbtree_delete(&ctx->queries, q->node.key);
	ctx->num_async--;
	context_query_delete(q);
	lock_basic_unlock(&ctx->cfglock);

	if(!cancelled) {
	/* call callback */
	int sec = 0;
	if(s == sec_status_bogus)
	sec = 1;
	else if(s == sec_status_secure)
	sec = 2;
	- (cb)(cb_arg, rcode, (void)sldns_buffer_begin(buf),
	- (int)sldns_buffer_limit(buf), sec, why_bogus, was_ratelimited);
	+ (cb)(cb_arg, rcode, (buf?(void)sldns_buffer_begin(buf):NULL),
	+ (buf?(int)sldns_buffer_limit(buf):0), sec, why_bogus, was_ratelimited);
	}
	}

	int libworker_attach_mesh(struct ub_ctx* ctx, struct ctx_query* q,
	int* async_id)
	{
	struct libworker* w = ctx->event_worker;
	uint16_t qflags, qid;
	struct query_info qinfo;
	struct edns_data edns;
	if(!w)
	return UB_INITFAIL;
	if(!setup_qinfo_edns(w, q, &qinfo, &edns))
	return UB_SYNTAX;
	qid = 0;
	qflags = BIT_RD;
	q->w = w;
	/* see if there is a fixed answer */
	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
	if(local_zones_answer(ctx->local_zones, w->env, &qinfo, &edns,
	w->back->udp_buff, w->env->scratch, NULL, NULL, 0, NULL, 0,
	NULL, 0, NULL, 0, NULL)) {
	regional_free_all(w->env->scratch);
	free(qinfo.qname);
	libworker_event_done_cb(q, LDNS_RCODE_NOERROR,
	w->back->udp_buff, sec_status_insecure, NULL, 0);
	return UB_NOERROR;
	}
	if(ctx->env->auth_zones && auth_zones_answer(ctx->env->auth_zones,
	w->env, &qinfo, &edns, NULL, w->back->udp_buff, w->env->scratch)) {
	regional_free_all(w->env->scratch);
	free(qinfo.qname);
	libworker_event_done_cb(q, LDNS_RCODE_NOERROR,
	w->back->udp_buff, sec_status_insecure, NULL, 0);
	return UB_NOERROR;
	}
	/* process new query */
	if(async_id)
	*async_id = q->querynum;
	if(!mesh_new_callback(w->env->mesh, &qinfo, qflags, &edns,
	w->back->udp_buff, qid, libworker_event_done_cb, q)) {
	free(qinfo.qname);
	return UB_NOMEM;
	}
	free(qinfo.qname);
	return UB_NOERROR;
	}

	/** add result to the bg worker result queue */
	static void
	add_bg_result(struct libworker* w, struct ctx_query* q, sldns_buffer* pkt,
	int err, char* reason, int was_ratelimited)
	{
	uint8_t* msg = NULL;
	uint32_t len = 0;

	if(w->want_quit) {
	context_query_delete(q);
	return;
	}
	/* serialize and delete unneeded q */
	if(w->is_bg_thread) {
	lock_basic_lock(&w->ctx->cfglock);
	if(reason)
	q->res->why_bogus = strdup(reason);
	q->res->was_ratelimited = was_ratelimited;
	if(pkt) {
	q->msg_len = sldns_buffer_remaining(pkt);
	q->msg = memdup(sldns_buffer_begin(pkt), q->msg_len);
	if(!q->msg) {
	msg = context_serialize_answer(q, UB_NOMEM, NULL, &len);
	} else {
	msg = context_serialize_answer(q, err, NULL, &len);
	}
	} else {
	msg = context_serialize_answer(q, err, NULL, &len);
	}
	lock_basic_unlock(&w->ctx->cfglock);
	} else {
	if(reason)
	q->res->why_bogus = strdup(reason);
	q->res->was_ratelimited = was_ratelimited;
	msg = context_serialize_answer(q, err, pkt, &len);
	(void)rbtree_delete(&w->ctx->queries, q->node.key);
	w->ctx->num_async--;
	context_query_delete(q);
	}

	if(!msg) {
	log_err("out of memory for async answer");
	return;
	}
	if(!tube_queue_item(w->ctx->rr_pipe, msg, len)) {
	log_err("out of memory for async answer");
	return;
	}
	}

	void
	libworker_bg_done_cb(void* arg, int rcode, sldns_buffer* buf, enum sec_status s,
	char* why_bogus, int was_ratelimited)
	{
	struct ctx_query* q = (struct ctx_query*)arg;

	if(q->cancelled \|\| q->w->back->want_to_quit) {
	if(q->w->is_bg_thread) {
	/* delete it now */
	struct ub_ctx* ctx = q->w->ctx;
	lock_basic_lock(&ctx->cfglock);
	(void)rbtree_delete(&ctx->queries, q->node.key);
	ctx->num_async--;
	context_query_delete(q);
	lock_basic_unlock(&ctx->cfglock);
	}
	/* cancelled, do not give answer */
	return;
	}
	q->msg_security = s;
	if(!buf) {
	buf = q->w->env->scratch_buffer;
	}
	if(rcode != 0) {
	error_encode(buf, rcode, NULL, 0, BIT_RD, NULL);
	}
	add_bg_result(q->w, q, buf, UB_NOERROR, why_bogus, was_ratelimited);
	}


	/** handle new query command for bg worker */
	static void
	handle_newq(struct libworker* w, uint8_t* buf, uint32_t len)
	{
	uint16_t qflags, qid;
	struct query_info qinfo;
	struct edns_data edns;
	struct ctx_query* q;
	if(w->is_bg_thread) {
	lock_basic_lock(&w->ctx->cfglock);
	q = context_lookup_new_query(w->ctx, buf, len);
	lock_basic_unlock(&w->ctx->cfglock);
	} else {
	q = context_deserialize_new_query(w->ctx, buf, len);
	}
	free(buf);
	if(!q) {
	log_err("failed to deserialize newq");
	return;
	}
	if(!setup_qinfo_edns(w, q, &qinfo, &edns)) {
	add_bg_result(w, q, NULL, UB_SYNTAX, NULL, 0);
	return;
	}
	qid = 0;
	qflags = BIT_RD;
	/* see if there is a fixed answer */
	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
	if(local_zones_answer(w->ctx->local_zones, w->env, &qinfo, &edns,
	w->back->udp_buff, w->env->scratch, NULL, NULL, 0, NULL, 0,
	NULL, 0, NULL, 0, NULL)) {
	regional_free_all(w->env->scratch);
	q->msg_security = sec_status_insecure;
	add_bg_result(w, q, w->back->udp_buff, UB_NOERROR, NULL, 0);
	free(qinfo.qname);
	return;
	}
	if(w->ctx->env->auth_zones && auth_zones_answer(w->ctx->env->auth_zones,
	w->env, &qinfo, &edns, NULL, w->back->udp_buff, w->env->scratch)) {
	regional_free_all(w->env->scratch);
	q->msg_security = sec_status_insecure;
	add_bg_result(w, q, w->back->udp_buff, UB_NOERROR, NULL, 0);
	free(qinfo.qname);
	return;
	}
	q->w = w;
	/* process new query */
	if(!mesh_new_callback(w->env->mesh, &qinfo, qflags, &edns,
	w->back->udp_buff, qid, libworker_bg_done_cb, q)) {
	add_bg_result(w, q, NULL, UB_NOMEM, NULL, 0);
	}
	free(qinfo.qname);
	}

	void libworker_alloc_cleanup(void* arg)
	{
	struct libworker* w = (struct libworker*)arg;
	slabhash_clear(&w->env->rrset_cache->table);
	slabhash_clear(w->env->msg_cache);
	}

	struct outbound_entry* libworker_send_query(struct query_info* qinfo,
	uint16_t flags, int dnssec, int want_dnssec, int nocaps,
	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
	size_t zonelen, int ssl_upstream, char* tls_auth_name,
	struct module_qstate* q)
	{
	struct libworker* w = (struct libworker*)q->env->worker;
	struct outbound_entry* e = (struct outbound_entry*)regional_alloc(
	q->region, sizeof(*e));
	if(!e)
	return NULL;
	e->qstate = q;
	e->qsent = outnet_serviced_query(w->back, qinfo, flags, dnssec,
	want_dnssec, nocaps, q->env->cfg->tcp_upstream, ssl_upstream,
	tls_auth_name, addr, addrlen, zone, zonelen, q,
	libworker_handle_service_reply, e, w->back->udp_buff, q->env);
	if(!e->qsent) {
	return NULL;
	}
	return e;
	}

	int
	libworker_handle_reply(struct comm_point* c, void* arg, int error,
	struct comm_reply* reply_info)
	{
	struct module_qstate* q = (struct module_qstate*)arg;
	struct libworker* lw = (struct libworker*)q->env->worker;
	struct outbound_entry e;
	e.qstate = q;
	e.qsent = NULL;

	if(error != 0) {
	mesh_report_reply(lw->env->mesh, &e, reply_info, error);
	return 0;
	}
	/* sanity check. */
	if(!LDNS_QR_WIRE(sldns_buffer_begin(c->buffer))
	\|\| LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) !=
	LDNS_PACKET_QUERY
	\|\| LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) > 1) {
	/* error becomes timeout for the module as if this reply
	* never arrived. */
	mesh_report_reply(lw->env->mesh, &e, reply_info,
	NETEVENT_TIMEOUT);
	return 0;
	}
	mesh_report_reply(lw->env->mesh, &e, reply_info, NETEVENT_NOERROR);
	return 0;
	}

	int
	libworker_handle_service_reply(struct comm_point* c, void* arg, int error,
	struct comm_reply* reply_info)
	{
	struct outbound_entry* e = (struct outbound_entry*)arg;
	struct libworker* lw = (struct libworker*)e->qstate->env->worker;

	if(error != 0) {
	mesh_report_reply(lw->env->mesh, e, reply_info, error);
	return 0;
	}
	/* sanity check. */
	if(!LDNS_QR_WIRE(sldns_buffer_begin(c->buffer))
	\|\| LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) !=
	LDNS_PACKET_QUERY
	\|\| LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) > 1) {
	/* error becomes timeout for the module as if this reply
	* never arrived. */
	mesh_report_reply(lw->env->mesh, e, reply_info,
	NETEVENT_TIMEOUT);
	return 0;
	}
	mesh_report_reply(lw->env->mesh, e, reply_info, NETEVENT_NOERROR);
	return 0;
	}

	/* --- fake callbacks for fptr_wlist to work --- */
	void worker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
	uint8_t* ATTR_UNUSED(buffer), size_t ATTR_UNUSED(len),
	int ATTR_UNUSED(error), void* ATTR_UNUSED(arg))
	{
	log_assert(0);
	}

	int worker_handle_request(struct comm_point* ATTR_UNUSED(c),
	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
	struct comm_reply* ATTR_UNUSED(repinfo))
	{
	log_assert(0);
	return 0;
	}

	int worker_handle_reply(struct comm_point* ATTR_UNUSED(c),
	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
	struct comm_reply* ATTR_UNUSED(reply_info))
	{
	log_assert(0);
	return 0;
	}

	int worker_handle_service_reply(struct comm_point* ATTR_UNUSED(c),
	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
	struct comm_reply* ATTR_UNUSED(reply_info))
	{
	log_assert(0);
	return 0;
	}

	int remote_accept_callback(struct comm_point* ATTR_UNUSED(c),
	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
	struct comm_reply* ATTR_UNUSED(repinfo))
	{
	log_assert(0);
	return 0;
	}

	int remote_control_callback(struct comm_point* ATTR_UNUSED(c),
	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
	struct comm_reply* ATTR_UNUSED(repinfo))
	{
	log_assert(0);
	return 0;
	}

	void worker_sighandler(int ATTR_UNUSED(sig), void* ATTR_UNUSED(arg))
	{
	log_assert(0);
	}

	struct outbound_entry* worker_send_query(struct query_info* ATTR_UNUSED(qinfo),
	uint16_t ATTR_UNUSED(flags), int ATTR_UNUSED(dnssec),
	int ATTR_UNUSED(want_dnssec), int ATTR_UNUSED(nocaps),
	struct sockaddr_storage* ATTR_UNUSED(addr), socklen_t ATTR_UNUSED(addrlen),
	uint8_t* ATTR_UNUSED(zone), size_t ATTR_UNUSED(zonelen),
	int ATTR_UNUSED(ssl_upstream), char* ATTR_UNUSED(tls_auth_name),
	struct module_qstate* ATTR_UNUSED(q))
	{
	log_assert(0);
	return 0;
	}

	void
	worker_alloc_cleanup(void* ATTR_UNUSED(arg))
	{
	log_assert(0);
	}

	void worker_stat_timer_cb(void* ATTR_UNUSED(arg))
	{
	log_assert(0);
	}

	void worker_probe_timer_cb(void* ATTR_UNUSED(arg))
	{
	log_assert(0);
	}

	void worker_start_accept(void* ATTR_UNUSED(arg))
	{
	log_assert(0);
	}

	void worker_stop_accept(void* ATTR_UNUSED(arg))
	{
	log_assert(0);
	}

	int order_lock_cmp(const void* ATTR_UNUSED(e1), const void* ATTR_UNUSED(e2))
	{
	log_assert(0);
	return 0;
	}

	int
	codeline_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
	{
	log_assert(0);
	return 0;
	}

	int replay_var_compare(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
	{
	log_assert(0);
	return 0;
	}

	void remote_get_opt_ssl(char* ATTR_UNUSED(str), void* ATTR_UNUSED(arg))
	{
	log_assert(0);
	}

	#ifdef UB_ON_WINDOWS
	void
	worker_win_stop_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev), void*
	ATTR_UNUSED(arg)) {
	log_assert(0);
	}

	void
	wsvc_cron_cb(void* ATTR_UNUSED(arg))
	{
	log_assert(0);
	}
	#endif /* UB_ON_WINDOWS */
	Index: head/contrib/unbound/libunbound/ubsyms.def
	===================================================================
	--- head/contrib/unbound/libunbound/ubsyms.def (revision 349719)
	+++ head/contrib/unbound/libunbound/ubsyms.def (revision 349720)
	@@ -1,35 +1,36 @@
	ub_cancel
	ub_ctx_add_ta
	ub_ctx_add_ta_autr
	ub_ctx_add_ta_file
	ub_ctx_async
	ub_ctx_config
	ub_ctx_create
	ub_ctx_create_event
	ub_ctx_create_ub_event
	ub_ctx_data_add
	ub_ctx_data_remove
	ub_ctx_debuglevel
	ub_ctx_debugout
	ub_ctx_delete
	ub_ctx_get_option
	ub_ctx_hosts
	ub_ctx_print_local_zones
	ub_ctx_resolvconf
	ub_ctx_set_event
	ub_ctx_set_fwd
	ub_ctx_set_option
	ub_ctx_set_stub
	+ub_ctx_set_tls
	ub_ctx_trustedkeys
	ub_ctx_zone_add
	ub_ctx_zone_remove
	ub_fd
	ub_poll
	ub_process
	ub_resolve
	ub_resolve_async
	ub_resolve_event
	ub_resolve_free
	ub_strerror
	ub_version
	ub_wait
	Index: head/contrib/unbound/libunbound/unbound.h
	===================================================================
	--- head/contrib/unbound/libunbound/unbound.h (revision 349719)
	+++ head/contrib/unbound/libunbound/unbound.h (revision 349720)
	@@ -1,804 +1,819 @@
	/*
	* unbound.h - unbound validating resolver public API
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains functions to resolve DNS queries and
	* validate the answers. Synchronously and asynchronously.
	*
	* Several ways to use this interface from an application wishing
	* to perform (validated) DNS lookups.
	*
	* All start with
	* ctx = ub_ctx_create();
	* err = ub_ctx_add_ta(ctx, "...");
	* err = ub_ctx_add_ta(ctx, "...");
	* ... some lookups
	* ... call ub_ctx_delete(ctx); when you want to stop.
	*
	* Application not threaded. Blocking.
	* int err = ub_resolve(ctx, "www.example.com", ...
	* if(err) fprintf(stderr, "lookup error: %s\n", ub_strerror(err));
	* ... use the answer
	*
	* Application not threaded. Non-blocking ('asynchronous').
	* err = ub_resolve_async(ctx, "www.example.com", ... my_callback);
	* ... application resumes processing ...
	* ... and when either ub_poll(ctx) is true
	* ... or when the file descriptor ub_fd(ctx) is readable,
	* ... or whenever, the app calls ...
	* ub_process(ctx);
	* ... if no result is ready, the app resumes processing above,
	* ... or process() calls my_callback() with results.
	*
	* ... if the application has nothing more to do, wait for answer
	* ub_wait(ctx);
	*
	* Application threaded. Blocking.
	* Blocking, same as above. The current thread does the work.
	* Multiple threads can use the same context, each does work and uses
	* shared cache data from the context.
	*
	* Application threaded. Non-blocking ('asynchronous').
	* ... setup threaded-asynchronous config option
	* err = ub_ctx_async(ctx, 1);
	* ... same as async for non-threaded
	* ... the callbacks are called in the thread that calls process(ctx)
	*
	* Openssl needs to have locking in place, and the application must set
	* it up, because a mere library cannot do this, use the calls
	* CRYPTO_set_id_callback and CRYPTO_set_locking_callback.
	*
	* If no threading is compiled in, the above async example uses fork(2) to
	* create a process to perform the work. The forked process exits when the
	* calling process exits, or ctx_delete() is called.
	* Otherwise, for asynchronous with threading, a worker thread is created.
	*
	* The blocking calls use shared ctx-cache when threaded. Thus
	* ub_resolve() and ub_resolve_async() && ub_wait() are
	* not the same. The first makes the current thread do the work, setting
	* up buffers, etc, to perform the work (but using shared cache data).
	* The second calls another worker thread (or process) to perform the work.
	* And no buffers need to be set up, but a context-switch happens.
	*/
	#ifndef _UB_UNBOUND_H
	#define _UB_UNBOUND_H

	#ifdef __cplusplus
	extern "C" {
	#endif

	/** the version of this header file */
	#define UNBOUND_VERSION_MAJOR @UNBOUND_VERSION_MAJOR@
	#define UNBOUND_VERSION_MINOR @UNBOUND_VERSION_MINOR@
	#define UNBOUND_VERSION_MICRO @UNBOUND_VERSION_MICRO@

	/**
	* The validation context is created to hold the resolver status,
	* validation keys and a small cache (containing messages, rrsets,
	* roundtrip times, trusted keys, lameness information).
	*
	* Its contents are internally defined.
	*/
	struct ub_ctx;

	/**
	* The validation and resolution results.
	* Allocated by the resolver, and need to be freed by the application
	* with ub_resolve_free().
	*/
	struct ub_result {
	/** The original question, name text string. */
	char* qname;
	/** the type asked for */
	int qtype;
	/** the class asked for */
	int qclass;

	/**
	* a list of network order DNS rdata items, terminated with a
	* NULL pointer, so that data[0] is the first result entry,
	* data[1] the second, and the last entry is NULL.
	* If there was no data, data[0] is NULL.
	*/
	char** data;

	/** the length in bytes of the data items, len[i] for data[i] */
	int* len;

	/**
	* canonical name for the result (the final cname).
	* zero terminated string.
	* May be NULL if no canonical name exists.
	*/
	char* canonname;

	/**
	* DNS RCODE for the result. May contain additional error code if
	* there was no data due to an error. 0 (NOERROR) if okay.
	*/
	int rcode;

	/**
	* The DNS answer packet. Network formatted. Can contain DNSSEC types.
	*/
	void* answer_packet;
	/** length of the answer packet in octets. */
	int answer_len;

	/**
	* If there is any data, this is true.
	* If false, there was no data (nxdomain may be true, rcode can be set).
	*/
	int havedata;

	/**
	* If there was no data, and the domain did not exist, this is true.
	* If it is false, and there was no data, then the domain name
	* is purported to exist, but the requested data type is not available.
	*/
	int nxdomain;

	/**
	* True, if the result is validated securely.
	* False, if validation failed or domain queried has no security info.
	*
	* It is possible to get a result with no data (havedata is false),
	* and secure is true. This means that the non-existence of the data
	* was cryptographically proven (with signatures).
	*/
	int secure;

	/**
	* If the result was not secure (secure==0), and this result is due
	* to a security failure, bogus is true.
	* This means the data has been actively tampered with, signatures
	* failed, expected signatures were not present, timestamps on
	* signatures were out of date and so on.
	*
	* If !secure and !bogus, this can happen if the data is not secure
	* because security is disabled for that domain name.
	* This means the data is from a domain where data is not signed.
	*/
	int bogus;

	/**
	* If the result is bogus this contains a string (zero terminated)
	* that describes the failure. There may be other errors as well
	* as the one described, the description may not be perfectly accurate.
	* Is NULL if the result is not bogus.
	*/
	char* why_bogus;

	/**
	* If the query or one of its subqueries was ratelimited. Useful if
	* ratelimiting is enabled and answer is SERVFAIL.
	*/
	int was_ratelimited;

	/**
	* TTL for the result, in seconds. If the security is bogus, then
	* you also cannot trust this value.
	*/
	int ttl;
	};

	/**
	* Callback for results of async queries.
	* The readable function definition looks like:
	* void my_callback(void* my_arg, int err, struct ub_result* result);
	* It is called with
	* void* my_arg: your pointer to a (struct of) data of your choice,
	* or NULL.
	* int err: if 0 all is OK, otherwise an error occured and no results
	* are forthcoming.
	* struct result: pointer to more detailed result structure.
	* This structure is allocated on the heap and needs to be
	* freed with ub_resolve_free(result);
	*/
	typedef void (ub_callback_type)(void, int, struct ub_result*);

	/**
	* Create a resolving and validation context.
	* The information from /etc/resolv.conf and /etc/hosts is not utilised by
	* default. Use ub_ctx_resolvconf and ub_ctx_hosts to read them.
	* @return a new context. default initialisation.
	* returns NULL on error.
	*/
	struct ub_ctx* ub_ctx_create(void);

	/**
	* Destroy a validation context and free all its resources.
	* Outstanding async queries are killed and callbacks are not called for them.
	* @param ctx: context to delete.
	*/
	void ub_ctx_delete(struct ub_ctx* ctx);

	/**
	* Set an option for the context.
	* @param ctx: context.
	* @param opt: option name from the unbound.conf config file format.
	* (not all settings applicable). The name includes the trailing ':'
	* for example ub_ctx_set_option(ctx, "logfile:", "mylog.txt");
	* This is a power-users interface that lets you specify all sorts
	* of options.
	* For some specific options, such as adding trust anchors, special
	* routines exist.
	* @param val: value of the option.
	* @return: 0 if OK, else error.
	*/
	int ub_ctx_set_option(struct ub_ctx* ctx, const char* opt, const char* val);

	/**
	* Get an option from the context.
	* @param ctx: context.
	* @param opt: option name from the unbound.conf config file format.
	* (not all settings applicable). The name excludes the trailing ':'
	* for example ub_ctx_get_option(ctx, "logfile", &result);
	* This is a power-users interface that lets you specify all sorts
	* of options.
	* @param str: the string is malloced and returned here. NULL on error.
	* The caller must free() the string. In cases with multiple
	* entries (auto-trust-anchor-file), a newline delimited list is
	* returned in the string.
	* @return 0 if OK else an error code (malloc failure, syntax error).
	*/
	int ub_ctx_get_option(struct ub_ctx* ctx, const char* opt, char** str);

	/**
	* setup configuration for the given context.
	* @param ctx: context.
	* @param fname: unbound config file (not all settings applicable).
	* This is a power-users interface that lets you specify all sorts
	* of options.
	* For some specific options, such as adding trust anchors, special
	* routines exist.
	* @return: 0 if OK, else error.
	*/
	int ub_ctx_config(struct ub_ctx* ctx, const char* fname);

	/**
	* Set machine to forward DNS queries to, the caching resolver to use.
	* IP4 or IP6 address. Forwards all DNS requests to that machine, which
	* is expected to run a recursive resolver. If the proxy is not
	* DNSSEC-capable, validation may fail. Can be called several times, in
	* that case the addresses are used as backup servers.
	*
	* To read the list of nameservers from /etc/resolv.conf (from DHCP or so),
	* use the call ub_ctx_resolvconf.
	*
	* @param ctx: context.
	* At this time it is only possible to set configuration before the
	* first resolve is done.
	* @param addr: address, IP4 or IP6 in string format.
	* If the addr is NULL, forwarding is disabled.
	* @return 0 if OK, else error.
	*/
	int ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr);

	/**
	+ * Use DNS over TLS to send queries to machines set with ub_ctx_set_fwd().
	+ *
	+ * @param ctx: context.
	+ * At this time it is only possible to set configuration before the
	+ * first resolve is done.
	+ * @param tls: enable or disable DNS over TLS
	+ * @return 0 if OK, else error.
	+ */
	+int ub_ctx_set_tls(struct ub_ctx* ctx, int tls);
	+
	+/**
	* Add a stub zone, with given address to send to. This is for custom
	* root hints or pointing to a local authoritative dns server.
	* For dns resolvers and the 'DHCP DNS' ip address, use ub_ctx_set_fwd.
	* This is similar to a stub-zone entry in unbound.conf.
	*
	* @param ctx: context.
	* It is only possible to set configuration before the
	* first resolve is done.
	* @param zone: name of the zone, string.
	* @param addr: address, IP4 or IP6 in string format.
	* The addr is added to the list of stub-addresses if the entry exists.
	* If the addr is NULL the stub entry is removed.
	* @param isprime: set to true to set stub-prime to yes for the stub.
	* For local authoritative servers, people usually set it to false,
	* For root hints it should be set to true.
	* @return 0 if OK, else error.
	*/
	int ub_ctx_set_stub(struct ub_ctx* ctx, const char* zone, const char* addr,
	int isprime);

	/**
	* Read list of nameservers to use from the filename given.
	* Usually "/etc/resolv.conf". Uses those nameservers as caching proxies.
	* If they do not support DNSSEC, validation may fail.
	*
	* Only nameservers are picked up, the searchdomain, ndots and other
	* settings from resolv.conf(5) are ignored.
	*
	* @param ctx: context.
	* At this time it is only possible to set configuration before the
	* first resolve is done.
	* @param fname: file name string. If NULL "/etc/resolv.conf" is used.
	* @return 0 if OK, else error.
	*/
	int ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname);

	/**
	* Read list of hosts from the filename given.
	* Usually "/etc/hosts".
	* These addresses are not flagged as DNSSEC secure when queried for.
	*
	* @param ctx: context.
	* At this time it is only possible to set configuration before the
	* first resolve is done.
	* @param fname: file name string. If NULL "/etc/hosts" is used.
	* @return 0 if OK, else error.
	*/
	int ub_ctx_hosts(struct ub_ctx* ctx, const char* fname);

	/**
	* Add a trust anchor to the given context.
	* The trust anchor is a string, on one line, that holds a valid DNSKEY or
	* DS RR.
	* @param ctx: context.
	* At this time it is only possible to add trusted keys before the
	* first resolve is done.
	* @param ta: string, with zone-format RR on one line.
	* [domainname] [TTL optional] [type] [class optional] [rdata contents]
	* @return 0 if OK, else error.
	*/
	int ub_ctx_add_ta(struct ub_ctx* ctx, const char* ta);

	/**
	* Add trust anchors to the given context.
	* Pass name of a file with DS and DNSKEY records (like from dig or drill).
	* @param ctx: context.
	* At this time it is only possible to add trusted keys before the
	* first resolve is done.
	* @param fname: filename of file with keyfile with trust anchors.
	* @return 0 if OK, else error.
	*/
	int ub_ctx_add_ta_file(struct ub_ctx* ctx, const char* fname);

	/**
	* Add trust anchor to the given context that is tracked with RFC5011
	* automated trust anchor maintenance. The file is written to when the
	* trust anchor is changed.
	* Pass the name of a file that was output from eg. unbound-anchor,
	* or you can start it by providing a trusted DNSKEY or DS record on one
	* line in the file.
	* @param ctx: context.
	* At this time it is only possible to add trusted keys before the
	* first resolve is done.
	* @param fname: filename of file with trust anchor.
	* @return 0 if OK, else error.
	*/
	int ub_ctx_add_ta_autr(struct ub_ctx* ctx, const char* fname);

	/**
	* Add trust anchors to the given context.
	* Pass the name of a bind-style config file with trusted-keys{}.
	* @param ctx: context.
	* At this time it is only possible to add trusted keys before the
	* first resolve is done.
	* @param fname: filename of file with bind-style config entries with trust
	* anchors.
	* @return 0 if OK, else error.
	*/
	int ub_ctx_trustedkeys(struct ub_ctx* ctx, const char* fname);

	/**
	* Set debug output (and error output) to the specified stream.
	* Pass NULL to disable. Default is stderr.
	* @param ctx: context.
	* @param out: FILE* out file stream to log to.
	* Type void* to avoid stdio dependency of this header file.
	* @return 0 if OK, else error.
	*/
	int ub_ctx_debugout(struct ub_ctx* ctx, void* out);

	/**
	* Set debug verbosity for the context
	* Output is directed to stderr.
	* @param ctx: context.
	* @param d: debug level, 0 is off, 1 is very minimal, 2 is detailed,
	* and 3 is lots.
	* @return 0 if OK, else error.
	*/
	int ub_ctx_debuglevel(struct ub_ctx* ctx, int d);

	/**
	* Set a context behaviour for asynchronous action.
	* @param ctx: context.
	* @param dothread: if true, enables threading and a call to resolve_async()
	* creates a thread to handle work in the background.
	* If false, a process is forked to handle work in the background.
	* Changes to this setting after async() calls have been made have
	* no effect (delete and re-create the context to change).
	* @return 0 if OK, else error.
	*/
	int ub_ctx_async(struct ub_ctx* ctx, int dothread);

	/**
	* Poll a context to see if it has any new results
	* Do not poll in a loop, instead extract the fd below to poll for readiness,
	* and then check, or wait using the wait routine.
	* @param ctx: context.
	* @return: 0 if nothing to read, or nonzero if a result is available.
	* If nonzero, call ctx_process() to do callbacks.
	*/
	int ub_poll(struct ub_ctx* ctx);

	/**
	* Wait for a context to finish with results. Calls ub_process() after
	* the wait for you. After the wait, there are no more outstanding
	* asynchronous queries.
	* @param ctx: context.
	* @return: 0 if OK, else error.
	*/
	int ub_wait(struct ub_ctx* ctx);

	/**
	* Get file descriptor. Wait for it to become readable, at this point
	* answers are returned from the asynchronous validating resolver.
	* Then call the ub_process to continue processing.
	* This routine works immediately after context creation, the fd
	* does not change.
	* @param ctx: context.
	* @return: -1 on error, or file descriptor to use select(2) with.
	*/
	int ub_fd(struct ub_ctx* ctx);

	/**
	* Call this routine to continue processing results from the validating
	* resolver (when the fd becomes readable).
	* Will perform necessary callbacks.
	* @param ctx: context
	* @return: 0 if OK, else error.
	*/
	int ub_process(struct ub_ctx* ctx);

	/**
	* Perform resolution and validation of the target name.
	* @param ctx: context.
	* The context is finalized, and can no longer accept config changes.
	* @param name: domain name in text format (a zero terminated text string).
	* @param rrtype: type of RR in host order, 1 is A (address).
	* @param rrclass: class of RR in host order, 1 is IN (for internet).
	* @param result: the result data is returned in a newly allocated result
	* structure. May be NULL on return, return value is set to an error
	* in that case (out of memory).
	* @return 0 if OK, else error.
	*/
	int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype,
	int rrclass, struct ub_result** result);

	/**
	* Perform resolution and validation of the target name.
	* Asynchronous, after a while, the callback will be called with your
	* data and the result.
	* @param ctx: context.
	* If no thread or process has been created yet to perform the
	* work in the background, it is created now.
	* The context is finalized, and can no longer accept config changes.
	* @param name: domain name in text format (a string).
	* @param rrtype: type of RR in host order, 1 is A.
	* @param rrclass: class of RR in host order, 1 is IN (for internet).
	* @param mydata: this data is your own data (you can pass NULL),
	* and is passed on to the callback function.
	* @param callback: this is called on completion of the resolution.
	* It is called as:
	* void callback(void* mydata, int err, struct ub_result* result)
	* with mydata: the same as passed here, you may pass NULL,
	* with err: is 0 when a result has been found.
	* with result: a newly allocated result structure.
	* The result may be NULL, in that case err is set.
	*
	* If an error happens during processing, your callback will be called
	* with error set to a nonzero value (and result==NULL).
	* @param async_id: if you pass a non-NULL value, an identifier number is
	* returned for the query as it is in progress. It can be used to
	* cancel the query.
	* @return 0 if OK, else error.
	*/
	int ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype,
	int rrclass, void* mydata, ub_callback_type callback, int* async_id);

	/**
	* Cancel an async query in progress.
	* Its callback will not be called.
	*
	* @param ctx: context.
	* @param async_id: which query to cancel.
	* @return 0 if OK, else error.
	* This routine can return an error if the async_id passed does not exist
	* or has already been delivered. If another thread is processing results
	* at the same time, the result may be delivered at the same time and the
	* cancel fails with an error. Also the cancel can fail due to a system
	* error, no memory or socket failures.
	*/
	int ub_cancel(struct ub_ctx* ctx, int async_id);

	/**
	* Free storage associated with a result structure.
	* @param result: to free
	*/
	void ub_resolve_free(struct ub_result* result);

	/**
	* Convert error value to a human readable string.
	* @param err: error code from one of the libunbound functions.
	* @return pointer to constant text string, zero terminated.
	*/
	const char* ub_strerror(int err);

	/**
	* Debug routine. Print the local zone information to debug output.
	* @param ctx: context. Is finalized by the routine.
	* @return 0 if OK, else error.
	*/
	int ub_ctx_print_local_zones(struct ub_ctx* ctx);

	/**
	* Add a new zone with the zonetype to the local authority info of the
	* library.
	* @param ctx: context. Is finalized by the routine.
	* @param zone_name: name of the zone in text, "example.com"
	* If it already exists, the type is updated.
	* @param zone_type: type of the zone (like for unbound.conf) in text.
	* @return 0 if OK, else error.
	*/
	int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name,
	const char *zone_type);

	/**
	* Remove zone from local authority info of the library.
	* @param ctx: context. Is finalized by the routine.
	* @param zone_name: name of the zone in text, "example.com"
	* If it does not exist, nothing happens.
	* @return 0 if OK, else error.
	*/
	int ub_ctx_zone_remove(struct ub_ctx* ctx, const char *zone_name);

	/**
	* Add localdata to the library local authority info.
	* Similar to local-data config statement.
	* @param ctx: context. Is finalized by the routine.
	* @param data: the resource record in text format, for example
	* "www.example.com IN A 127.0.0.1"
	* @return 0 if OK, else error.
	*/
	int ub_ctx_data_add(struct ub_ctx* ctx, const char *data);

	/**
	* Remove localdata from the library local authority info.
	* @param ctx: context. Is finalized by the routine.
	* @param data: the name to delete all data from, like "www.example.com".
	* @return 0 if OK, else error.
	*/
	int ub_ctx_data_remove(struct ub_ctx* ctx, const char *data);

	/**
	* Get a version string from the libunbound implementation.
	* @return a static constant string with the version number.
	*/
	const char* ub_version(void);

	/**
	* Some global statistics that are not in struct stats_info,
	* this struct is shared on a shm segment (shm-key in unbound.conf)
	*/
	struct ub_shm_stat_info {
	int num_threads;

	struct {
	long long now_sec, now_usec;
	long long up_sec, up_usec;
	long long elapsed_sec, elapsed_usec;
	} time;

	struct {
	long long msg;
	long long rrset;
	long long val;
	long long iter;
	long long subnet;
	long long ipsecmod;
	long long respip;
	long long dnscrypt_shared_secret;
	long long dnscrypt_nonce;
	} mem;
	};

	/** number of qtype that is stored for in array */
	#define UB_STATS_QTYPE_NUM 256
	/** number of qclass that is stored for in array */
	#define UB_STATS_QCLASS_NUM 256
	/** number of rcodes in stats */
	#define UB_STATS_RCODE_NUM 16
	/** number of opcodes in stats */
	#define UB_STATS_OPCODE_NUM 16
	/** number of histogram buckets */
	#define UB_STATS_BUCKET_NUM 40

	/** per worker statistics. */
	struct ub_server_stats {
	/** number of queries from clients received. */
	long long num_queries;
	/** number of queries that have been dropped/ratelimited by ip. */
	long long num_queries_ip_ratelimited;
	/** number of queries that had a cache-miss. */
	long long num_queries_missed_cache;
	/** number of prefetch queries - cachehits with prefetch */
	long long num_queries_prefetch;

	/**
	* Sum of the querylistsize of the worker for
	* every query that missed cache. To calculate average.
	*/
	long long sum_query_list_size;
	/** max value of query list size reached. */
	long long max_query_list_size;

	/** Extended stats below (bool) */
	int extended;

	/** qtype stats */
	long long qtype[UB_STATS_QTYPE_NUM];
	/** bigger qtype values not in array */
	long long qtype_big;
	/** qclass stats */
	long long qclass[UB_STATS_QCLASS_NUM];
	/** bigger qclass values not in array */
	long long qclass_big;
	/** query opcodes */
	long long qopcode[UB_STATS_OPCODE_NUM];
	/** number of queries over TCP */
	long long qtcp;
	/** number of outgoing queries over TCP */
	long long qtcp_outgoing;
	/** number of queries over (DNS over) TLS */
	long long qtls;
	/** number of queries over IPv6 */
	long long qipv6;
	/** number of queries with QR bit */
	long long qbit_QR;
	/** number of queries with AA bit */
	long long qbit_AA;
	/** number of queries with TC bit */
	long long qbit_TC;
	/** number of queries with RD bit */
	long long qbit_RD;
	/** number of queries with RA bit */
	long long qbit_RA;
	/** number of queries with Z bit */
	long long qbit_Z;
	/** number of queries with AD bit */
	long long qbit_AD;
	/** number of queries with CD bit */
	long long qbit_CD;
	/** number of queries with EDNS OPT record */
	long long qEDNS;
	/** number of queries with EDNS with DO flag */
	long long qEDNS_DO;
	/** answer rcodes */
	long long ans_rcode[UB_STATS_RCODE_NUM];
	/** answers with pseudo rcode 'nodata' */
	long long ans_rcode_nodata;
	/** answers that were secure (AD) */
	long long ans_secure;
	/** answers that were bogus (withheld as SERVFAIL) */
	long long ans_bogus;
	/** rrsets marked bogus by validator */
	long long rrset_bogus;
	/** number of queries that have been ratelimited by domain recursion. */
	long long queries_ratelimited;
	/** unwanted traffic received on server-facing ports */
	long long unwanted_replies;
	/** unwanted traffic received on client-facing ports */
	long long unwanted_queries;
	/** usage of tcp accept list */
	long long tcp_accept_usage;
	/** answers served from expired cache */
	long long zero_ttl_responses;
	/** histogram data exported to array
	* if the array is the same size, no data is lost, and
	* if all histograms are same size (is so by default) then
	* adding up works well. */
	long long hist[UB_STATS_BUCKET_NUM];

	/** number of message cache entries */
	long long msg_cache_count;
	/** number of rrset cache entries */
	long long rrset_cache_count;
	/** number of infra cache entries */
	long long infra_cache_count;
	/** number of key cache entries */
	long long key_cache_count;

	/** number of queries that used dnscrypt */
	long long num_query_dnscrypt_crypted;
	/** number of queries that queried dnscrypt certificates */
	long long num_query_dnscrypt_cert;
	/** number of queries in clear text and not asking for the certificates */
	long long num_query_dnscrypt_cleartext;
	/** number of malformed encrypted queries */
	long long num_query_dnscrypt_crypted_malformed;
	/** number of queries which did not have a shared secret in cache */
	long long num_query_dnscrypt_secret_missed_cache;
	/** number of dnscrypt shared secret cache entries */
	long long shared_secret_cache_count;
	/** number of queries which are replays */
	long long num_query_dnscrypt_replay;
	/** number of dnscrypt nonces cache entries */
	long long nonce_cache_count;
	/** number of queries for unbound's auth_zones, upstream query */
	long long num_query_authzone_up;
	/** number of queries for unbound's auth_zones, downstream answers */
	long long num_query_authzone_down;
	/** number of times neg cache records were used to generate NOERROR
	* responses. */
	long long num_neg_cache_noerror;
	/** number of times neg cache records were used to generate NXDOMAIN
	* responses. */
	long long num_neg_cache_nxdomain;
	/** number of queries answered from edns-subnet specific data */
	long long num_query_subnet;
	/** number of queries answered from edns-subnet specific data, and
	* the answer was from the edns-subnet cache. */
	long long num_query_subnet_cache;
	+ /** number of bytes in the stream wait buffers */
	+ long long mem_stream_wait;
	+ /** number of TLS connection resume */
	+ long long qtls_resume;
	};

	/**
	* Statistics to send over the control pipe when asked
	* This struct is made to be memcopied, sent in binary.
	* shm mapped with (number+1) at num_threads+1, with first as total
	*/
	struct ub_stats_info {
	/** the thread stats */
	struct ub_server_stats svr;

	/** mesh stats: current number of states */
	long long mesh_num_states;
	/** mesh stats: current number of reply (user) states */
	long long mesh_num_reply_states;
	/** mesh stats: number of reply states overwritten with a new one */
	long long mesh_jostled;
	/** mesh stats: number of incoming queries dropped */
	long long mesh_dropped;
	/** mesh stats: replies sent */
	long long mesh_replies_sent;
	/** mesh stats: sum of waiting times for the replies */
	long long mesh_replies_sum_wait_sec, mesh_replies_sum_wait_usec;
	/** mesh stats: median of waiting times for replies (in sec) */
	double mesh_time_median;
	};

	#ifdef __cplusplus
	}
	#endif

	#endif /* _UB_UNBOUND_H */
	Index: head/contrib/unbound/ltmain.sh
	===================================================================
	--- head/contrib/unbound/ltmain.sh (revision 349719)
	+++ head/contrib/unbound/ltmain.sh (revision 349720)
	@@ -1,11147 +1,11149 @@
	#! /bin/sh
	## DO NOT EDIT - This file generated from ./build-aux/ltmain.in
	## by inline-source v2014-01-03.01

	# libtool (GNU libtool) 2.4.6
	# Provide generalized library-building support services.
	# Written by Gordon Matzigkeit <gord@gnu.ai.mit.edu>, 1996

	# Copyright (C) 1996-2015 Free Software Foundation, Inc.
	# This is free software; see the source for copying conditions. There is NO
	# warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

	# GNU Libtool is free software; you can redistribute it and/or modify
	# it under the terms of the GNU General Public License as published by
	# the Free Software Foundation; either version 2 of the License, or
	# (at your option) any later version.
	#
	# As a special exception to the GNU General Public License,
	# if you distribute this file as part of a program or library that
	# is built using GNU Libtool, you may include this file under the
	# same distribution terms that you use for the rest of that program.
	#
	# GNU Libtool is distributed in the hope that it will be useful, but
	# WITHOUT ANY WARRANTY; without even the implied warranty of
	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	# General Public License for more details.
	#
	# You should have received a copy of the GNU General Public License
	# along with this program. If not, see <http://www.gnu.org/licenses/>.


	PROGRAM=libtool
	PACKAGE=libtool
	VERSION=2.4.6
	package_revision=2.4.6


	## ------ ##
	## Usage. ##
	## ------ ##

	# Run './libtool --help' for help with using this script from the
	# command line.


	## ------------------------------- ##
	## User overridable command paths. ##
	## ------------------------------- ##

	# After configure completes, it has a better idea of some of the
	# shell tools we need than the defaults used by the functions shared
	# with bootstrap, so set those here where they can still be over-
	# ridden by the user, but otherwise take precedence.

	: ${AUTOCONF="autoconf"}
	: ${AUTOMAKE="automake"}


	## -------------------------- ##
	## Source external libraries. ##
	## -------------------------- ##

	# Much of our low-level functionality needs to be sourced from external
	# libraries, which are installed to $pkgauxdir.

	# Set a version string for this script.
	scriptversion=2015-01-20.17; # UTC

	# General shell script boiler plate, and helper functions.
	# Written by Gary V. Vaughan, 2004

	# Copyright (C) 2004-2015 Free Software Foundation, Inc.
	# This is free software; see the source for copying conditions. There is NO
	# warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

	# This program is free software; you can redistribute it and/or modify
	# it under the terms of the GNU General Public License as published by
	# the Free Software Foundation; either version 3 of the License, or
	# (at your option) any later version.

	# As a special exception to the GNU General Public License, if you distribute
	# this file as part of a program or library that is built using GNU Libtool,
	# you may include this file under the same distribution terms that you use
	# for the rest of that program.

	# This program is distributed in the hope that it will be useful,
	# but WITHOUT ANY WARRANTY; without even the implied warranty of
	# MERCHANTABILITY or FITNES FOR A PARTICULAR PURPOSE. See the GNU
	# General Public License for more details.

	# You should have received a copy of the GNU General Public License
	# along with this program. If not, see <http://www.gnu.org/licenses/>.

	# Please report bugs or propose patches to gary@gnu.org.


	## ------ ##
	## Usage. ##
	## ------ ##

	# Evaluate this file near the top of your script to gain access to
	# the functions and variables defined here:
	#
	# . `echo "$0" \| ${SED-sed} 's\|[^/]*$\|\|'`/build-aux/funclib.sh
	#
	# If you need to override any of the default environment variable
	# settings, do that before evaluating this file.


	## -------------------- ##
	## Shell normalisation. ##
	## -------------------- ##

	# Some shells need a little help to be as Bourne compatible as possible.
	# Before doing anything else, make sure all that help has been provided!

	DUALCASE=1; export DUALCASE # for MKS sh
	if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then :
	emulate sh
	NULLCMD=:
	# Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which
	# is contrary to our usage. Disable this feature.
	alias -g '${1+"$@"}'='"$@"'
	setopt NO_GLOB_SUBST
	else
	case `(set -o) 2>/dev/null` in posix) set -o posix ;; esac
	fi

	# NLS nuisances: We save the old values in case they are required later.
	_G_user_locale=
	_G_safe_locale=
	for _G_var in LANG LANGUAGE LC_ALL LC_CTYPE LC_COLLATE LC_MESSAGES
	do
	eval "if test set = \"\${$_G_var+set}\"; then
	save_$_G_var=\$$_G_var
	$_G_var=C
	export $_G_var
	_G_user_locale=\"$_G_var=\\\$save_\$_G_var; \$_G_user_locale\"
	_G_safe_locale=\"$_G_var=C; \$_G_safe_locale\"
	fi"
	done

	# CDPATH.
	(unset CDPATH) >/dev/null 2>&1 && unset CDPATH

	# Make sure IFS has a sensible default
	sp=' '
	nl='
	'
	IFS="$sp $nl"

	# There are apparently some retarded systems that use ';' as a PATH separator!
	if test "${PATH_SEPARATOR+set}" != set; then
	PATH_SEPARATOR=:
	(PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && {
	(PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 \|\|
	PATH_SEPARATOR=';'
	}
	fi



	## ------------------------- ##
	## Locate command utilities. ##
	## ------------------------- ##


	# func_executable_p FILE
	# ----------------------
	# Check that FILE is an executable regular file.
	func_executable_p ()
	{
	test -f "$1" && test -x "$1"
	}


	# func_path_progs PROGS_LIST CHECK_FUNC [PATH]
	# --------------------------------------------
	# Search for either a program that responds to --version with output
	# containing "GNU", or else returned by CHECK_FUNC otherwise, by
	# trying all the directories in PATH with each of the elements of
	# PROGS_LIST.
	#
	# CHECK_FUNC should accept the path to a candidate program, and
	# set $func_check_prog_result if it truncates its output less than
	# $_G_path_prog_max characters.
	func_path_progs ()
	{
	_G_progs_list=$1
	_G_check_func=$2
	_G_PATH=${3-"$PATH"}

	_G_path_prog_max=0
	_G_path_prog_found=false
	_G_save_IFS=$IFS; IFS=${PATH_SEPARATOR-:}
	for _G_dir in $_G_PATH; do
	IFS=$_G_save_IFS
	test -z "$_G_dir" && _G_dir=.
	for _G_prog_name in $_G_progs_list; do
	for _exeext in '' .EXE; do
	_G_path_prog=$_G_dir/$_G_prog_name$_exeext
	func_executable_p "$_G_path_prog" \|\| continue
	case `"$_G_path_prog" --version 2>&1` in
	GNU) func_path_progs_result=$_G_path_prog _G_path_prog_found=: ;;
	*) $_G_check_func $_G_path_prog
	func_path_progs_result=$func_check_prog_result
	;;
	esac
	$_G_path_prog_found && break 3
	done
	done
	done
	IFS=$_G_save_IFS
	test -z "$func_path_progs_result" && {
	echo "no acceptable sed could be found in \$PATH" >&2
	exit 1
	}
	}


	# We want to be able to use the functions in this file before configure
	# has figured out where the best binaries are kept, which means we have
	# to search for them ourselves - except when the results are already set
	# where we skip the searches.

	# Unless the user overrides by setting SED, search the path for either GNU
	# sed, or the sed that truncates its output the least.
	test -z "$SED" && {
	_G_sed_script=s/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/
	for _G_i in 1 2 3 4 5 6 7; do
	_G_sed_script=$_G_sed_script$nl$_G_sed_script
	done
	echo "$_G_sed_script" 2>/dev/null \| sed 99q >conftest.sed
	_G_sed_script=

	func_check_prog_sed ()
	{
	_G_path_prog=$1

	_G_count=0
	printf 0123456789 >conftest.in
	while :
	do
	cat conftest.in conftest.in >conftest.tmp
	mv conftest.tmp conftest.in
	cp conftest.in conftest.nl
	echo '' >> conftest.nl
	"$_G_path_prog" -f conftest.sed <conftest.nl >conftest.out 2>/dev/null \|\| break
	diff conftest.out conftest.nl >/dev/null 2>&1 \|\| break
	_G_count=`expr $_G_count + 1`
	if test "$_G_count" -gt "$_G_path_prog_max"; then
	# Best one so far, save it but keep looking for a better one
	func_check_prog_result=$_G_path_prog
	_G_path_prog_max=$_G_count
	fi
	# 10*(2^10) chars as input seems more than enough
	test 10 -lt "$_G_count" && break
	done
	rm -f conftest.in conftest.tmp conftest.nl conftest.out
	}

	func_path_progs "sed gsed" func_check_prog_sed $PATH:/usr/xpg4/bin
	rm -f conftest.sed
	SED=$func_path_progs_result
	}


	# Unless the user overrides by setting GREP, search the path for either GNU
	# grep, or the grep that truncates its output the least.
	test -z "$GREP" && {
	func_check_prog_grep ()
	{
	_G_path_prog=$1

	_G_count=0
	_G_path_prog_max=0
	printf 0123456789 >conftest.in
	while :
	do
	cat conftest.in conftest.in >conftest.tmp
	mv conftest.tmp conftest.in
	cp conftest.in conftest.nl
	echo 'GREP' >> conftest.nl
	"$_G_path_prog" -e 'GREP$' -e '-(cannot match)-' <conftest.nl >conftest.out 2>/dev/null \|\| break
	diff conftest.out conftest.nl >/dev/null 2>&1 \|\| break
	_G_count=`expr $_G_count + 1`
	if test "$_G_count" -gt "$_G_path_prog_max"; then
	# Best one so far, save it but keep looking for a better one
	func_check_prog_result=$_G_path_prog
	_G_path_prog_max=$_G_count
	fi
	# 10*(2^10) chars as input seems more than enough
	test 10 -lt "$_G_count" && break
	done
	rm -f conftest.in conftest.tmp conftest.nl conftest.out
	}

	func_path_progs "grep ggrep" func_check_prog_grep $PATH:/usr/xpg4/bin
	GREP=$func_path_progs_result
	}


	## ------------------------------- ##
	## User overridable command paths. ##
	## ------------------------------- ##

	# All uppercase variable names are used for environment variables. These
	# variables can be overridden by the user before calling a script that
	# uses them if a suitable command of that name is not already available
	# in the command search PATH.

	: ${CP="cp -f"}
	: ${ECHO="printf %s\n"}
	: ${EGREP="$GREP -E"}
	: ${FGREP="$GREP -F"}
	: ${LN_S="ln -s"}
	: ${MAKE="make"}
	: ${MKDIR="mkdir"}
	: ${MV="mv -f"}
	: ${RM="rm -f"}
	: ${SHELL="${CONFIG_SHELL-/bin/sh}"}


	## -------------------- ##
	## Useful sed snippets. ##
	## -------------------- ##

	sed_dirname='s\|/[^/]*$\|\|'
	sed_basename='s\|^.*/\|\|'

	# Sed substitution that helps us do robust quoting. It backslashifies
	# metacharacters that are still active within double-quoted strings.
	sed_quote_subst='s\|$[`"$\\]$\|\\\1\|g'

	# Same as above, but do not quote variable references.
	sed_double_quote_subst='s/$["`\\]$/\\\1/g'

	# Sed substitution that turns a string into a regex matching for the
	# string literally.
	sed_make_literal_regex='s\|[].[^$\\*\/]\|\\&\|g'

	# Sed substitution that converts a w32 file name or path
	# that contains forward slashes, into one that contains
	# (escaped) backslashes. A very naive implementation.
	sed_naive_backslashify='s\|\\\\*\|\\\|g;s\|/\|\\\|g;s\|\\\|\\\\\|g'

	# Re-'\' parameter expansions in output of sed_double_quote_subst that
	# were '\'-ed in input to the same. If an odd number of '\' preceded a
	# '$' in input to sed_double_quote_subst, that '$' was protected from
	# expansion. Since each input '\' is now two '\'s, look for any number
	# of runs of four '\'s followed by two '\'s and then a '$'. '\' that '$'.
	_G_bs='\\'
	_G_bs2='\\\\'
	_G_bs4='\\\\\\\\'
	_G_dollar='\$'
	sed_double_backslash="\
	s/$_G_bs4/&\\
	/g
	s/^$_G_bs2$_G_dollar/$_G_bs&/
	s/\$[^$_G_bs]\$$_G_bs2$_G_dollar/\\1$_G_bs2$_G_bs$_G_dollar/g
	s/\n//g"


	## ----------------- ##
	## Global variables. ##
	## ----------------- ##

	# Except for the global variables explicitly listed below, the following
	# functions in the '^func_' namespace, and the '^require_' namespace
	# variables initialised in the 'Resource management' section, sourcing
	# this file will not pollute your global namespace with anything
	# else. There's no portable way to scope variables in Bourne shell
	# though, so actually running these functions will sometimes place
	# results into a variable named after the function, and often use
	# temporary variables in the '^_G_' namespace. If you are careful to
	# avoid using those namespaces casually in your sourcing script, things
	# should continue to work as you expect. And, of course, you can freely
	# overwrite any of the functions or variables defined here before
	# calling anything to customize them.

	EXIT_SUCCESS=0
	EXIT_FAILURE=1
	EXIT_MISMATCH=63 # $? = 63 is used to indicate version mismatch to missing.
	EXIT_SKIP=77 # $? = 77 is used to indicate a skipped test to automake.

	# Allow overriding, eg assuming that you follow the convention of
	# putting '$debug_cmd' at the start of all your functions, you can get
	# bash to show function call trace with:
	#
	# debug_cmd='eval echo "${FUNCNAME[0]} $*" >&2' bash your-script-name
	debug_cmd=${debug_cmd-":"}
	exit_cmd=:

	# By convention, finish your script with:
	#
	# exit $exit_status
	#
	# so that you can set exit_status to non-zero if you want to indicate
	# something went wrong during execution without actually bailing out at
	# the point of failure.
	exit_status=$EXIT_SUCCESS

	# Work around backward compatibility issue on IRIX 6.5. On IRIX 6.4+, sh
	# is ksh but when the shell is invoked as "sh" and the current value of
	# the _XPG environment variable is not equal to 1 (one), the special
	# positional parameter $0, within a function call, is the name of the
	# function.
	progpath=$0

	# The name of this program.
	progname=`$ECHO "$progpath" \|$SED "$sed_basename"`

	# Make sure we have an absolute progpath for reexecution:
	case $progpath in
	[\\/]\|[A-Za-z]:\\) ;;
	[\\/])
	progdir=`$ECHO "$progpath" \|$SED "$sed_dirname"`
	progdir=`cd "$progdir" && pwd`
	progpath=$progdir/$progname
	;;
	*)
	_G_IFS=$IFS
	IFS=${PATH_SEPARATOR-:}
	for progdir in $PATH; do
	IFS=$_G_IFS
	test -x "$progdir/$progname" && break
	done
	IFS=$_G_IFS
	test -n "$progdir" \|\| progdir=`pwd`
	progpath=$progdir/$progname
	;;
	esac


	## ----------------- ##
	## Standard options. ##
	## ----------------- ##

	# The following options affect the operation of the functions defined
	# below, and should be set appropriately depending on run-time para-
	# meters passed on the command line.

	opt_dry_run=false
	opt_quiet=false
	opt_verbose=false

	# Categories 'all' and 'none' are always available. Append any others
	# you will pass as the first argument to func_warning from your own
	# code.
	warning_categories=

	# By default, display warnings according to 'opt_warning_types'. Set
	# 'warning_func' to ':' to elide all warnings, or func_fatal_error to
	# treat the next displayed warning as a fatal error.
	warning_func=func_warn_and_continue

	# Set to 'all' to display all warnings, 'none' to suppress all
	# warnings, or a space delimited list of some subset of
	# 'warning_categories' to display only the listed warnings.
	opt_warning_types=all


	## -------------------- ##
	## Resource management. ##
	## -------------------- ##

	# This section contains definitions for functions that each ensure a
	# particular resource (a file, or a non-empty configuration variable for
	# example) is available, and if appropriate to extract default values
	# from pertinent package files. Call them using their associated
	# 'require_*' variable to ensure that they are executed, at most, once.
	#
	# It's entirely deliberate that calling these functions can set
	# variables that don't obey the namespace limitations obeyed by the rest
	# of this file, in order that that they be as useful as possible to
	# callers.


	# require_term_colors
	# -------------------
	# Allow display of bold text on terminals that support it.
	require_term_colors=func_require_term_colors
	func_require_term_colors ()
	{
	$debug_cmd

	test -t 1 && {
	# COLORTERM and USE_ANSI_COLORS environment variables take
	# precedence, because most terminfo databases neglect to describe
	# whether color sequences are supported.
	test -n "${COLORTERM+set}" && : ${USE_ANSI_COLORS="1"}

	if test 1 = "$USE_ANSI_COLORS"; then
	# Standard ANSI escape sequences
	tc_reset='[0m'
	tc_bold='[1m'; tc_standout='[7m'
	tc_red='[31m'; tc_green='[32m'
	tc_blue='[34m'; tc_cyan='[36m'
	else
	# Otherwise trust the terminfo database after all.
	test -n "`tput sgr0 2>/dev/null`" && {
	tc_reset=`tput sgr0`
	test -n "`tput bold 2>/dev/null`" && tc_bold=`tput bold`
	tc_standout=$tc_bold
	test -n "`tput smso 2>/dev/null`" && tc_standout=`tput smso`
	test -n "`tput setaf 1 2>/dev/null`" && tc_red=`tput setaf 1`
	test -n "`tput setaf 2 2>/dev/null`" && tc_green=`tput setaf 2`
	test -n "`tput setaf 4 2>/dev/null`" && tc_blue=`tput setaf 4`
	test -n "`tput setaf 5 2>/dev/null`" && tc_cyan=`tput setaf 5`
	}
	fi
	}

	require_term_colors=:
	}


	## ----------------- ##
	## Function library. ##
	## ----------------- ##

	# This section contains a variety of useful functions to call in your
	# scripts. Take note of the portable wrappers for features provided by
	# some modern shells, which will fall back to slower equivalents on
	# less featureful shells.


	# func_append VAR VALUE
	# ---------------------
	# Append VALUE onto the existing contents of VAR.

	# We should try to minimise forks, especially on Windows where they are
	# unreasonably slow, so skip the feature probes when bash or zsh are
	# being used:
	if test set = "${BASH_VERSION+set}${ZSH_VERSION+set}"; then
	: ${_G_HAVE_ARITH_OP="yes"}
	: ${_G_HAVE_XSI_OPS="yes"}
	# The += operator was introduced in bash 3.1
	case $BASH_VERSION in
	[12].* \| 3.0 \| 3.0*) ;;
	*)
	: ${_G_HAVE_PLUSEQ_OP="yes"}
	;;
	esac
	fi

	# _G_HAVE_PLUSEQ_OP
	# Can be empty, in which case the shell is probed, "yes" if += is
	# useable or anything else if it does not work.
	test -z "$_G_HAVE_PLUSEQ_OP" \
	&& (eval 'x=a; x+=" b"; test "a b" = "$x"') 2>/dev/null \
	&& _G_HAVE_PLUSEQ_OP=yes

	if test yes = "$_G_HAVE_PLUSEQ_OP"
	then
	# This is an XSI compatible shell, allowing a faster implementation...
	eval 'func_append ()
	{
	$debug_cmd

	eval "$1+=\$2"
	}'
	else
	# ...otherwise fall back to using expr, which is often a shell builtin.
	func_append ()
	{
	$debug_cmd

	eval "$1=\$$1\$2"
	}
	fi


	# func_append_quoted VAR VALUE
	# ----------------------------
	# Quote VALUE and append to the end of shell variable VAR, separated
	# by a space.
	if test yes = "$_G_HAVE_PLUSEQ_OP"; then
	eval 'func_append_quoted ()
	{
	$debug_cmd

	func_quote_for_eval "$2"
	eval "$1+=\\ \$func_quote_for_eval_result"
	}'
	else
	func_append_quoted ()
	{
	$debug_cmd

	func_quote_for_eval "$2"
	eval "$1=\$$1\\ \$func_quote_for_eval_result"
	}
	fi


	# func_append_uniq VAR VALUE
	# --------------------------
	# Append unique VALUE onto the existing contents of VAR, assuming
	# entries are delimited by the first character of VALUE. For example:
	#
	# func_append_uniq options " --another-option option-argument"
	#
	# will only append to $options if " --another-option option-argument "
	# is not already present somewhere in $options already (note spaces at
	# each end implied by leading space in second argument).
	func_append_uniq ()
	{
	$debug_cmd

	eval _G_current_value='`$ECHO $'$1'`'
	_G_delim=`expr "$2" : '$.$'`

	case $_G_delim$_G_current_value$_G_delim in
	"$2$_G_delim") ;;
	*) func_append "$@" ;;
	esac
	}


	# func_arith TERM...
	# ------------------
	# Set func_arith_result to the result of evaluating TERMs.
	test -z "$_G_HAVE_ARITH_OP" \
	&& (eval 'test 2 = $(( 1 + 1 ))') 2>/dev/null \
	&& _G_HAVE_ARITH_OP=yes

	if test yes = "$_G_HAVE_ARITH_OP"; then
	eval 'func_arith ()
	{
	$debug_cmd

	func_arith_result=$(( $* ))
	}'
	else
	func_arith ()
	{
	$debug_cmd

	func_arith_result=`expr "$@"`
	}
	fi


	# func_basename FILE
	# ------------------
	# Set func_basename_result to FILE with everything up to and including
	# the last / stripped.
	if test yes = "$_G_HAVE_XSI_OPS"; then
	# If this shell supports suffix pattern removal, then use it to avoid
	# forking. Hide the definitions single quotes in case the shell chokes
	# on unsupported syntax...
	_b='func_basename_result=${1##*/}'
	_d='case $1 in
	/) func_dirname_result=${1%/*}$2 ;;
	* ) func_dirname_result=$3 ;;
	esac'

	else
	# ...otherwise fall back to using sed.
	_b='func_basename_result=`$ECHO "$1" \|$SED "$sed_basename"`'
	_d='func_dirname_result=`$ECHO "$1" \|$SED "$sed_dirname"`
	if test "X$func_dirname_result" = "X$1"; then
	func_dirname_result=$3
	else
	func_append func_dirname_result "$2"
	fi'
	fi

	eval 'func_basename ()
	{
	$debug_cmd

	'"$_b"'
	}'


	# func_dirname FILE APPEND NONDIR_REPLACEMENT
	# -------------------------------------------
	# Compute the dirname of FILE. If nonempty, add APPEND to the result,
	# otherwise set result to NONDIR_REPLACEMENT.
	eval 'func_dirname ()
	{
	$debug_cmd

	'"$_d"'
	}'


	# func_dirname_and_basename FILE APPEND NONDIR_REPLACEMENT
	# --------------------------------------------------------
	# Perform func_basename and func_dirname in a single function
	# call:
	# dirname: Compute the dirname of FILE. If nonempty,
	# add APPEND to the result, otherwise set result
	# to NONDIR_REPLACEMENT.
	# value returned in "$func_dirname_result"
	# basename: Compute filename of FILE.
	# value retuned in "$func_basename_result"
	# For efficiency, we do not delegate to the functions above but instead
	# duplicate the functionality here.
	eval 'func_dirname_and_basename ()
	{
	$debug_cmd

	'"$_b"'
	'"$_d"'
	}'


	# func_echo ARG...
	# ----------------
	# Echo program name prefixed message.
	func_echo ()
	{
	$debug_cmd

	_G_message=$*

	func_echo_IFS=$IFS
	IFS=$nl
	for _G_line in $_G_message; do
	IFS=$func_echo_IFS
	$ECHO "$progname: $_G_line"
	done
	IFS=$func_echo_IFS
	}


	# func_echo_all ARG...
	# --------------------
	# Invoke $ECHO with all args, space-separated.
	func_echo_all ()
	{
	$ECHO "$*"
	}


	# func_echo_infix_1 INFIX ARG...
	# ------------------------------
	# Echo program name, followed by INFIX on the first line, with any
	# additional lines not showing INFIX.
	func_echo_infix_1 ()
	{
	$debug_cmd

	$require_term_colors

	_G_infix=$1; shift
	_G_indent=$_G_infix
	_G_prefix="$progname: $_G_infix: "
	_G_message=$*

	# Strip color escape sequences before counting printable length
	for _G_tc in "$tc_reset" "$tc_bold" "$tc_standout" "$tc_red" "$tc_green" "$tc_blue" "$tc_cyan"
	do
	test -n "$_G_tc" && {
	_G_esc_tc=`$ECHO "$_G_tc" \| $SED "$sed_make_literal_regex"`
	_G_indent=`$ECHO "$_G_indent" \| $SED "s\|$_G_esc_tc\|\|g"`
	}
	done
	_G_indent="$progname: "`echo "$_G_indent" \| $SED 's\|.\| \|g'`" " ## exclude from sc_prohibit_nested_quotes

	func_echo_infix_1_IFS=$IFS
	IFS=$nl
	for _G_line in $_G_message; do
	IFS=$func_echo_infix_1_IFS
	$ECHO "$_G_prefix$tc_bold$_G_line$tc_reset" >&2
	_G_prefix=$_G_indent
	done
	IFS=$func_echo_infix_1_IFS
	}


	# func_error ARG...
	# -----------------
	# Echo program name prefixed message to standard error.
	func_error ()
	{
	$debug_cmd

	$require_term_colors

	func_echo_infix_1 " $tc_standout${tc_red}error$tc_reset" "$*" >&2
	}


	# func_fatal_error ARG...
	# -----------------------
	# Echo program name prefixed message to standard error, and exit.
	func_fatal_error ()
	{
	$debug_cmd

	func_error "$*"
	exit $EXIT_FAILURE
	}


	# func_grep EXPRESSION FILENAME
	# -----------------------------
	# Check whether EXPRESSION matches any line of FILENAME, without output.
	func_grep ()
	{
	$debug_cmd

	$GREP "$1" "$2" >/dev/null 2>&1
	}


	# func_len STRING
	# ---------------
	# Set func_len_result to the length of STRING. STRING may not
	# start with a hyphen.
	test -z "$_G_HAVE_XSI_OPS" \
	&& (eval 'x=a/b/c;
	test 5aa/bb/cc = "${#x}${x%%/}${x%/}${x#/}${x##/}"') 2>/dev/null \
	&& _G_HAVE_XSI_OPS=yes

	if test yes = "$_G_HAVE_XSI_OPS"; then
	eval 'func_len ()
	{
	$debug_cmd

	func_len_result=${#1}
	}'
	else
	func_len ()
	{
	$debug_cmd

	func_len_result=`expr "$1" : ".*" 2>/dev/null \|\| echo $max_cmd_len`
	}
	fi


	# func_mkdir_p DIRECTORY-PATH
	# ---------------------------
	# Make sure the entire path to DIRECTORY-PATH is available.
	func_mkdir_p ()
	{
	$debug_cmd

	_G_directory_path=$1
	_G_dir_list=

	if test -n "$_G_directory_path" && test : != "$opt_dry_run"; then

	# Protect directory names starting with '-'
	case $_G_directory_path in
	-*) _G_directory_path=./$_G_directory_path ;;
	esac

	# While some portion of DIR does not yet exist...
	while test ! -d "$_G_directory_path"; do
	# ...make a list in topmost first order. Use a colon delimited
	# list incase some portion of path contains whitespace.
	_G_dir_list=$_G_directory_path:$_G_dir_list

	# If the last portion added has no slash in it, the list is done
	case $_G_directory_path in /) ;; *) break ;; esac

	# ...otherwise throw away the child directory and loop
	_G_directory_path=`$ECHO "$_G_directory_path" \| $SED -e "$sed_dirname"`
	done
	_G_dir_list=`$ECHO "$_G_dir_list" \| $SED 's\|:*$\|\|'`

	func_mkdir_p_IFS=$IFS; IFS=:
	for _G_dir in $_G_dir_list; do
	IFS=$func_mkdir_p_IFS
	# mkdir can fail with a 'File exist' error if two processes
	# try to create one of the directories concurrently. Don't
	# stop in that case!
	$MKDIR "$_G_dir" 2>/dev/null \|\| :
	done
	IFS=$func_mkdir_p_IFS

	# Bail out if we (or some other process) failed to create a directory.
	test -d "$_G_directory_path" \|\| \
	func_fatal_error "Failed to create '$1'"
	fi
	}


	# func_mktempdir [BASENAME]
	# -------------------------
	# Make a temporary directory that won't clash with other running
	# libtool processes, and avoids race conditions if possible. If
	# given, BASENAME is the basename for that directory.
	func_mktempdir ()
	{
	$debug_cmd

	_G_template=${TMPDIR-/tmp}/${1-$progname}

	if test : = "$opt_dry_run"; then
	# Return a directory name, but don't create it in dry-run mode
	_G_tmpdir=$_G_template-$$
	else

	# If mktemp works, use that first and foremost
	_G_tmpdir=`mktemp -d "$_G_template-XXXXXXXX" 2>/dev/null`

	if test ! -d "$_G_tmpdir"; then
	# Failing that, at least try and use $RANDOM to avoid a race
	_G_tmpdir=$_G_template-${RANDOM-0}$$

	func_mktempdir_umask=`umask`
	umask 0077
	$MKDIR "$_G_tmpdir"
	umask $func_mktempdir_umask
	fi

	# If we're not in dry-run mode, bomb out on failure
	test -d "$_G_tmpdir" \|\| \
	func_fatal_error "cannot create temporary directory '$_G_tmpdir'"
	fi

	$ECHO "$_G_tmpdir"
	}


	# func_normal_abspath PATH
	# ------------------------
	# Remove doubled-up and trailing slashes, "." path components,
	# and cancel out any ".." path components in PATH after making
	# it an absolute path.
	func_normal_abspath ()
	{
	$debug_cmd

	# These SED scripts presuppose an absolute path with a trailing slash.
	_G_pathcar='s\|^/$[^/]$.$\|\1\|'
	_G_pathcdr='s\|^/[^/]*\|\|'
	_G_removedotparts=':dotsl
	s\|/\./\|/\|g
	t dotsl
	s\|/\.$\|/\|'
	_G_collapseslashes='s\|/\{1,\}\|/\|g'
	_G_finalslash='s\|/*$\|/\|'

	# Start from root dir and reassemble the path.
	func_normal_abspath_result=
	func_normal_abspath_tpath=$1
	func_normal_abspath_altnamespace=
	case $func_normal_abspath_tpath in
	"")
	# Empty path, that just means $cwd.
	func_stripname '' '/' "`pwd`"
	func_normal_abspath_result=$func_stripname_result
	return
	;;
	# The next three entries are used to spot a run of precisely
	# two leading slashes without using negated character classes;
	# we take advantage of case's first-match behaviour.
	///*)
	# Unusual form of absolute path, do nothing.
	;;
	//*)
	# Not necessarily an ordinary path; POSIX reserves leading '//'
	# and for example Cygwin uses it to access remote file shares
	# over CIFS/SMB, so we conserve a leading double slash if found.
	func_normal_abspath_altnamespace=/
	;;
	/*)
	# Absolute path, do nothing.
	;;
	*)
	# Relative path, prepend $cwd.
	func_normal_abspath_tpath=`pwd`/$func_normal_abspath_tpath
	;;
	esac

	# Cancel out all the simple stuff to save iterations. We also want
	# the path to end with a slash for ease of parsing, so make sure
	# there is one (and only one) here.
	func_normal_abspath_tpath=`$ECHO "$func_normal_abspath_tpath" \| $SED \
	-e "$_G_removedotparts" -e "$_G_collapseslashes" -e "$_G_finalslash"`
	while :; do
	# Processed it all yet?
	if test / = "$func_normal_abspath_tpath"; then
	# If we ascended to the root using ".." the result may be empty now.
	if test -z "$func_normal_abspath_result"; then
	func_normal_abspath_result=/
	fi
	break
	fi
	func_normal_abspath_tcomponent=`$ECHO "$func_normal_abspath_tpath" \| $SED \
	-e "$_G_pathcar"`
	func_normal_abspath_tpath=`$ECHO "$func_normal_abspath_tpath" \| $SED \
	-e "$_G_pathcdr"`
	# Figure out what to do with it
	case $func_normal_abspath_tcomponent in
	"")
	# Trailing empty path component, ignore it.
	;;
	..)
	# Parent dir; strip last assembled component from result.
	func_dirname "$func_normal_abspath_result"
	func_normal_abspath_result=$func_dirname_result
	;;
	*)
	# Actual path component, append it.
	func_append func_normal_abspath_result "/$func_normal_abspath_tcomponent"
	;;
	esac
	done
	# Restore leading double-slash if one was found on entry.
	func_normal_abspath_result=$func_normal_abspath_altnamespace$func_normal_abspath_result
	}


	# func_notquiet ARG...
	# --------------------
	# Echo program name prefixed message only when not in quiet mode.
	func_notquiet ()
	{
	$debug_cmd

	$opt_quiet \|\| func_echo ${1+"$@"}

	# A bug in bash halts the script if the last line of a function
	# fails when set -e is in force, so we need another command to
	# work around that:
	:
	}


	# func_relative_path SRCDIR DSTDIR
	# --------------------------------
	# Set func_relative_path_result to the relative path from SRCDIR to DSTDIR.
	func_relative_path ()
	{
	$debug_cmd

	func_relative_path_result=
	func_normal_abspath "$1"
	func_relative_path_tlibdir=$func_normal_abspath_result
	func_normal_abspath "$2"
	func_relative_path_tbindir=$func_normal_abspath_result

	# Ascend the tree starting from libdir
	while :; do
	# check if we have found a prefix of bindir
	case $func_relative_path_tbindir in
	$func_relative_path_tlibdir)
	# found an exact match
	func_relative_path_tcancelled=
	break
	;;
	$func_relative_path_tlibdir*)
	# found a matching prefix
	func_stripname "$func_relative_path_tlibdir" '' "$func_relative_path_tbindir"
	func_relative_path_tcancelled=$func_stripname_result
	if test -z "$func_relative_path_result"; then
	func_relative_path_result=.
	fi
	break
	;;
	*)
	func_dirname $func_relative_path_tlibdir
	func_relative_path_tlibdir=$func_dirname_result
	if test -z "$func_relative_path_tlibdir"; then
	# Have to descend all the way to the root!
	func_relative_path_result=../$func_relative_path_result
	func_relative_path_tcancelled=$func_relative_path_tbindir
	break
	fi
	func_relative_path_result=../$func_relative_path_result
	;;
	esac
	done

	# Now calculate path; take care to avoid doubling-up slashes.
	func_stripname '' '/' "$func_relative_path_result"
	func_relative_path_result=$func_stripname_result
	func_stripname '/' '/' "$func_relative_path_tcancelled"
	if test -n "$func_stripname_result"; then
	func_append func_relative_path_result "/$func_stripname_result"
	fi

	# Normalisation. If bindir is libdir, return '.' else relative path.
	if test -n "$func_relative_path_result"; then
	func_stripname './' '' "$func_relative_path_result"
	func_relative_path_result=$func_stripname_result
	fi

	test -n "$func_relative_path_result" \|\| func_relative_path_result=.

	:
	}


	# func_quote_for_eval ARG...
	# --------------------------
	# Aesthetically quote ARGs to be evaled later.
	# This function returns two values:
	# i) func_quote_for_eval_result
	# double-quoted, suitable for a subsequent eval
	# ii) func_quote_for_eval_unquoted_result
	# has all characters that are still active within double
	# quotes backslashified.
	func_quote_for_eval ()
	{
	$debug_cmd

	func_quote_for_eval_unquoted_result=
	func_quote_for_eval_result=
	while test 0 -lt $#; do
	case $1 in
	[\\\`\"\$])
	_G_unquoted_arg=`printf '%s\n' "$1" \|$SED "$sed_quote_subst"` ;;
	*)
	_G_unquoted_arg=$1 ;;
	esac
	if test -n "$func_quote_for_eval_unquoted_result"; then
	func_append func_quote_for_eval_unquoted_result " $_G_unquoted_arg"
	else
	func_append func_quote_for_eval_unquoted_result "$_G_unquoted_arg"
	fi

	case $_G_unquoted_arg in
	# Double-quote args containing shell metacharacters to delay
	# word splitting, command substitution and variable expansion
	# for a subsequent eval.
	# Many Bourne shells cannot handle close brackets correctly
	# in scan sets, so we specify it separately.
	[\[\~\#\^\&\\{\}\\|\;\<\>\?\'\ \ ]\|]*\|"")
	_G_quoted_arg=\"$_G_unquoted_arg\"
	;;
	*)
	_G_quoted_arg=$_G_unquoted_arg
	;;
	esac

	if test -n "$func_quote_for_eval_result"; then
	func_append func_quote_for_eval_result " $_G_quoted_arg"
	else
	func_append func_quote_for_eval_result "$_G_quoted_arg"
	fi
	shift
	done
	}


	# func_quote_for_expand ARG
	# -------------------------
	# Aesthetically quote ARG to be evaled later; same as above,
	# but do not quote variable references.
	func_quote_for_expand ()
	{
	$debug_cmd

	case $1 in
	[\\\`\"])
	_G_arg=`$ECHO "$1" \| $SED \
	-e "$sed_double_quote_subst" -e "$sed_double_backslash"` ;;
	*)
	_G_arg=$1 ;;
	esac

	case $_G_arg in
	# Double-quote args containing shell metacharacters to delay
	# word splitting and command substitution for a subsequent eval.
	# Many Bourne shells cannot handle close brackets correctly
	# in scan sets, so we specify it separately.
	[\[\~\#\^\&\\{\}\\|\;\<\>\?\'\ \ ]\|]*\|"")
	_G_arg=\"$_G_arg\"
	;;
	esac

	func_quote_for_expand_result=$_G_arg
	}


	# func_stripname PREFIX SUFFIX NAME
	# ---------------------------------
	# strip PREFIX and SUFFIX from NAME, and store in func_stripname_result.
	# PREFIX and SUFFIX must not contain globbing or regex special
	# characters, hashes, percent signs, but SUFFIX may contain a leading
	# dot (in which case that matches only a dot).
	if test yes = "$_G_HAVE_XSI_OPS"; then
	eval 'func_stripname ()
	{
	$debug_cmd

	# pdksh 5.2.14 does not do ${X%$Y} correctly if both X and Y are
	# positional parameters, so assign one to ordinary variable first.
	func_stripname_result=$3
	func_stripname_result=${func_stripname_result#"$1"}
	func_stripname_result=${func_stripname_result%"$2"}
	}'
	else
	func_stripname ()
	{
	$debug_cmd

	case $2 in
	.*) func_stripname_result=`$ECHO "$3" \| $SED -e "s%^$1%%" -e "s%\\\\$2\$%%"`;;
	*) func_stripname_result=`$ECHO "$3" \| $SED -e "s%^$1%%" -e "s%$2\$%%"`;;
	esac
	}
	fi


	# func_show_eval CMD [FAIL_EXP]
	# -----------------------------
	# Unless opt_quiet is true, then output CMD. Then, if opt_dryrun is
	# not true, evaluate CMD. If the evaluation of CMD fails, and FAIL_EXP
	# is given, then evaluate it.
	func_show_eval ()
	{
	$debug_cmd

	_G_cmd=$1
	_G_fail_exp=${2-':'}

	func_quote_for_expand "$_G_cmd"
	eval "func_notquiet $func_quote_for_expand_result"

	$opt_dry_run \|\| {
	eval "$_G_cmd"
	_G_status=$?
	if test 0 -ne "$_G_status"; then
	eval "(exit $_G_status); $_G_fail_exp"
	fi
	}
	}


	# func_show_eval_locale CMD [FAIL_EXP]
	# ------------------------------------
	# Unless opt_quiet is true, then output CMD. Then, if opt_dryrun is
	# not true, evaluate CMD. If the evaluation of CMD fails, and FAIL_EXP
	# is given, then evaluate it. Use the saved locale for evaluation.
	func_show_eval_locale ()
	{
	$debug_cmd

	_G_cmd=$1
	_G_fail_exp=${2-':'}

	$opt_quiet \|\| {
	func_quote_for_expand "$_G_cmd"
	eval "func_echo $func_quote_for_expand_result"
	}

	$opt_dry_run \|\| {
	eval "$_G_user_locale
	$_G_cmd"
	_G_status=$?
	eval "$_G_safe_locale"
	if test 0 -ne "$_G_status"; then
	eval "(exit $_G_status); $_G_fail_exp"
	fi
	}
	}


	# func_tr_sh
	# ----------
	# Turn $1 into a string suitable for a shell variable name.
	# Result is stored in $func_tr_sh_result. All characters
	# not in the set a-zA-Z0-9_ are replaced with '_'. Further,
	# if $1 begins with a digit, a '_' is prepended as well.
	func_tr_sh ()
	{
	$debug_cmd

	case $1 in
	[0-9]* \| [!a-zA-Z0-9_])
	func_tr_sh_result=`$ECHO "$1" \| $SED -e 's/^$[0-9]$/_\1/' -e 's/[^a-zA-Z0-9_]/_/g'`
	;;
	* )
	func_tr_sh_result=$1
	;;
	esac
	}


	# func_verbose ARG...
	# -------------------
	# Echo program name prefixed message in verbose mode only.
	func_verbose ()
	{
	$debug_cmd

	$opt_verbose && func_echo "$*"

	:
	}


	# func_warn_and_continue ARG...
	# -----------------------------
	# Echo program name prefixed warning message to standard error.
	func_warn_and_continue ()
	{
	$debug_cmd

	$require_term_colors

	func_echo_infix_1 "${tc_red}warning$tc_reset" "$*" >&2
	}


	# func_warning CATEGORY ARG...
	# ----------------------------
	# Echo program name prefixed warning message to standard error. Warning
	# messages can be filtered according to CATEGORY, where this function
	# elides messages where CATEGORY is not listed in the global variable
	# 'opt_warning_types'.
	func_warning ()
	{
	$debug_cmd

	# CATEGORY must be in the warning_categories list!
	case " $warning_categories " in
	" $1 ") ;;
	*) func_internal_error "invalid warning category '$1'" ;;
	esac

	_G_category=$1
	shift

	case " $opt_warning_types " in
	" $_G_category ") $warning_func ${1+"$@"} ;;
	esac
	}


	# func_sort_ver VER1 VER2
	# -----------------------
	# 'sort -V' is not generally available.
	# Note this deviates from the version comparison in automake
	# in that it treats 1.5 < 1.5.0, and treats 1.4.4a < 1.4-p3a
	# but this should suffice as we won't be specifying old
	# version formats or redundant trailing .0 in bootstrap.conf.
	# If we did want full compatibility then we should probably
	# use m4_version_compare from autoconf.
	func_sort_ver ()
	{
	$debug_cmd

	printf '%s\n%s\n' "$1" "$2" \
	\| sort -t. -k 1,1n -k 2,2n -k 3,3n -k 4,4n -k 5,5n -k 6,6n -k 7,7n -k 8,8n -k 9,9n
	}

	# func_lt_ver PREV CURR
	# ---------------------
	# Return true if PREV and CURR are in the correct order according to
	# func_sort_ver, otherwise false. Use it like this:
	#
	# func_lt_ver "$prev_ver" "$proposed_ver" \|\| func_fatal_error "..."
	func_lt_ver ()
	{
	$debug_cmd

	test "x$1" = x`func_sort_ver "$1" "$2" \| $SED 1q`
	}


	# Local variables:
	# mode: shell-script
	# sh-indentation: 2
	# eval: (add-hook 'before-save-hook 'time-stamp)
	# time-stamp-pattern: "10/scriptversion=%:y-%02m-%02d.%02H; # UTC"
	# time-stamp-time-zone: "UTC"
	# End:
	#! /bin/sh

	# Set a version string for this script.
	scriptversion=2014-01-07.03; # UTC

	# A portable, pluggable option parser for Bourne shell.
	# Written by Gary V. Vaughan, 2010

	# Copyright (C) 2010-2015 Free Software Foundation, Inc.
	# This is free software; see the source for copying conditions. There is NO
	# warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

	# This program is free software: you can redistribute it and/or modify
	# it under the terms of the GNU General Public License as published by
	# the Free Software Foundation, either version 3 of the License, or
	# (at your option) any later version.

	# This program is distributed in the hope that it will be useful,
	# but WITHOUT ANY WARRANTY; without even the implied warranty of
	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	# GNU General Public License for more details.

	# You should have received a copy of the GNU General Public License
	# along with this program. If not, see <http://www.gnu.org/licenses/>.

	# Please report bugs or propose patches to gary@gnu.org.


	## ------ ##
	## Usage. ##
	## ------ ##

	# This file is a library for parsing options in your shell scripts along
	# with assorted other useful supporting features that you can make use
	# of too.
	#
	# For the simplest scripts you might need only:
	#
	# #!/bin/sh
	# . relative/path/to/funclib.sh
	# . relative/path/to/options-parser
	# scriptversion=1.0
	# func_options ${1+"$@"}
	# eval set dummy "$func_options_result"; shift
	# ...rest of your script...
	#
	# In order for the '--version' option to work, you will need to have a
	# suitably formatted comment like the one at the top of this file
	# starting with '# Written by ' and ending with '# warranty; '.
	#
	# For '-h' and '--help' to work, you will also need a one line
	# description of your script's purpose in a comment directly above the
	# '# Written by ' line, like the one at the top of this file.
	#
	# The default options also support '--debug', which will turn on shell
	# execution tracing (see the comment above debug_cmd below for another
	# use), and '--verbose' and the func_verbose function to allow your script
	# to display verbose messages only when your user has specified
	# '--verbose'.
	#
	# After sourcing this file, you can plug processing for additional
	# options by amending the variables from the 'Configuration' section
	# below, and following the instructions in the 'Option parsing'
	# section further down.

	## -------------- ##
	## Configuration. ##
	## -------------- ##

	# You should override these variables in your script after sourcing this
	# file so that they reflect the customisations you have added to the
	# option parser.

	# The usage line for option parsing errors and the start of '-h' and
	# '--help' output messages. You can embed shell variables for delayed
	# expansion at the time the message is displayed, but you will need to
	# quote other shell meta-characters carefully to prevent them being
	# expanded when the contents are evaled.
	usage='$progpath [OPTION]...'

	# Short help message in response to '-h' and '--help'. Add to this or
	# override it after sourcing this library to reflect the full set of
	# options your script accepts.
	usage_message="\
	--debug enable verbose shell tracing
	-W, --warnings=CATEGORY
	report the warnings falling in CATEGORY [all]
	-v, --verbose verbosely report processing
	--version print version information and exit
	-h, --help print short or long help message and exit
	"

	# Additional text appended to 'usage_message' in response to '--help'.
	long_help_message="
	Warning categories include:
	'all' show all warnings
	'none' turn off all the warnings
	'error' warnings are treated as fatal errors"

	# Help message printed before fatal option parsing errors.
	fatal_help="Try '\$progname --help' for more information."



	## ------------------------- ##
	## Hook function management. ##
	## ------------------------- ##

	# This section contains functions for adding, removing, and running hooks
	# to the main code. A hook is just a named list of of function, that can
	# be run in order later on.

	# func_hookable FUNC_NAME
	# -----------------------
	# Declare that FUNC_NAME will run hooks added with
	# 'func_add_hook FUNC_NAME ...'.
	func_hookable ()
	{
	$debug_cmd

	func_append hookable_fns " $1"
	}


	# func_add_hook FUNC_NAME HOOK_FUNC
	# ---------------------------------
	# Request that FUNC_NAME call HOOK_FUNC before it returns. FUNC_NAME must
	# first have been declared "hookable" by a call to 'func_hookable'.
	func_add_hook ()
	{
	$debug_cmd

	case " $hookable_fns " in
	" $1 ") ;;
	*) func_fatal_error "'$1' does not accept hook functions." ;;
	esac

	eval func_append ${1}_hooks '" $2"'
	}


	# func_remove_hook FUNC_NAME HOOK_FUNC
	# ------------------------------------
	# Remove HOOK_FUNC from the list of functions called by FUNC_NAME.
	func_remove_hook ()
	{
	$debug_cmd

	eval ${1}_hooks='`$ECHO "\$'$1'_hooks" \|$SED "s\| '$2'\|\|"`'
	}


	# func_run_hooks FUNC_NAME [ARG]...
	# ---------------------------------
	# Run all hook functions registered to FUNC_NAME.
	# It is assumed that the list of hook functions contains nothing more
	# than a whitespace-delimited list of legal shell function names, and
	# no effort is wasted trying to catch shell meta-characters or preserve
	# whitespace.
	func_run_hooks ()
	{
	$debug_cmd

	case " $hookable_fns " in
	" $1 ") ;;
	*) func_fatal_error "'$1' does not support hook funcions.n" ;;
	esac

	eval _G_hook_fns=\$$1_hooks; shift

	for _G_hook in $_G_hook_fns; do
	eval $_G_hook '"$@"'

	# store returned options list back into positional
	# parameters for next 'cmd' execution.
	eval _G_hook_result=\$${_G_hook}_result
	eval set dummy "$_G_hook_result"; shift
	done

	func_quote_for_eval ${1+"$@"}
	func_run_hooks_result=$func_quote_for_eval_result
	}



	## --------------- ##
	## Option parsing. ##
	## --------------- ##

	# In order to add your own option parsing hooks, you must accept the
	# full positional parameter list in your hook function, remove any
	# options that you action, and then pass back the remaining unprocessed
	# options in '<hooked_function_name>_result', escaped suitably for
	# 'eval'. Like this:
	#
	# my_options_prep ()
	# {
	# $debug_cmd
	#
	# # Extend the existing usage message.
	# usage_message=$usage_message'
	# -s, --silent don'\''t print informational messages
	# '
	#
	# func_quote_for_eval ${1+"$@"}
	# my_options_prep_result=$func_quote_for_eval_result
	# }
	# func_add_hook func_options_prep my_options_prep
	#
	#
	# my_silent_option ()
	# {
	# $debug_cmd
	#
	# # Note that for efficiency, we parse as many options as we can
	# # recognise in a loop before passing the remainder back to the
	# # caller on the first unrecognised argument we encounter.
	# while test $# -gt 0; do
	# opt=$1; shift
	# case $opt in
	# --silent\|-s) opt_silent=: ;;
	# # Separate non-argument short options:
	# -s*) func_split_short_opt "$_G_opt"
	# set dummy "$func_split_short_opt_name" \
	# "-$func_split_short_opt_arg" ${1+"$@"}
	# shift
	# ;;
	# ) set dummy "$_G_opt" "$"; shift; break ;;
	# esac
	# done
	#
	# func_quote_for_eval ${1+"$@"}
	# my_silent_option_result=$func_quote_for_eval_result
	# }
	# func_add_hook func_parse_options my_silent_option
	#
	#
	# my_option_validation ()
	# {
	# $debug_cmd
	#
	# $opt_silent && $opt_verbose && func_fatal_help "\
	# '--silent' and '--verbose' options are mutually exclusive."
	#
	# func_quote_for_eval ${1+"$@"}
	# my_option_validation_result=$func_quote_for_eval_result
	# }
	# func_add_hook func_validate_options my_option_validation
	#
	# You'll alse need to manually amend $usage_message to reflect the extra
	# options you parse. It's preferable to append if you can, so that
	# multiple option parsing hooks can be added safely.


	# func_options [ARG]...
	# ---------------------
	# All the functions called inside func_options are hookable. See the
	# individual implementations for details.
	func_hookable func_options
	func_options ()
	{
	$debug_cmd

	func_options_prep ${1+"$@"}
	eval func_parse_options \
	${func_options_prep_result+"$func_options_prep_result"}
	eval func_validate_options \
	${func_parse_options_result+"$func_parse_options_result"}

	eval func_run_hooks func_options \
	${func_validate_options_result+"$func_validate_options_result"}

	# save modified positional parameters for caller
	func_options_result=$func_run_hooks_result
	}


	# func_options_prep [ARG]...
	# --------------------------
	# All initialisations required before starting the option parse loop.
	# Note that when calling hook functions, we pass through the list of
	# positional parameters. If a hook function modifies that list, and
	# needs to propogate that back to rest of this script, then the complete
	# modified list must be put in 'func_run_hooks_result' before
	# returning.
	func_hookable func_options_prep
	func_options_prep ()
	{
	$debug_cmd

	# Option defaults:
	opt_verbose=false
	opt_warning_types=

	func_run_hooks func_options_prep ${1+"$@"}

	# save modified positional parameters for caller
	func_options_prep_result=$func_run_hooks_result
	}


	# func_parse_options [ARG]...
	# ---------------------------
	# The main option parsing loop.
	func_hookable func_parse_options
	func_parse_options ()
	{
	$debug_cmd

	func_parse_options_result=

	# this just eases exit handling
	while test $# -gt 0; do
	# Defer to hook functions for initial option parsing, so they
	# get priority in the event of reusing an option name.
	func_run_hooks func_parse_options ${1+"$@"}

	# Adjust func_parse_options positional parameters to match
	eval set dummy "$func_run_hooks_result"; shift

	# Break out of the loop if we already parsed every option.
	test $# -gt 0 \|\| break

	_G_opt=$1
	shift
	case $_G_opt in
	--debug\|-x) debug_cmd='set -x'
	func_echo "enabling shell trace mode"
	$debug_cmd
	;;

	--no-warnings\|--no-warning\|--no-warn)
	set dummy --warnings none ${1+"$@"}
	shift
	;;

	--warnings\|--warning\|-W)
	test $# = 0 && func_missing_arg $_G_opt && break
	case " $warning_categories $1" in
	" $1 ")
	# trailing space prevents matching last $1 above
	func_append_uniq opt_warning_types " $1"
	;;
	*all)
	opt_warning_types=$warning_categories
	;;
	*none)
	opt_warning_types=none
	warning_func=:
	;;
	*error)
	opt_warning_types=$warning_categories
	warning_func=func_fatal_error
	;;
	*)
	func_fatal_error \
	"unsupported warning category: '$1'"
	;;
	esac
	shift
	;;

	--verbose\|-v) opt_verbose=: ;;
	--version) func_version ;;
	-\?\|-h) func_usage ;;
	--help) func_help ;;

	# Separate optargs to long options (plugins may need this):
	--=) func_split_equals "$_G_opt"
	set dummy "$func_split_equals_lhs" \
	"$func_split_equals_rhs" ${1+"$@"}
	shift
	;;

	# Separate optargs to short options:
	-W*)
	func_split_short_opt "$_G_opt"
	set dummy "$func_split_short_opt_name" \
	"$func_split_short_opt_arg" ${1+"$@"}
	shift
	;;

	# Separate non-argument short options:
	-\?\|-h\|-v\|-x)
	func_split_short_opt "$_G_opt"
	set dummy "$func_split_short_opt_name" \
	"-$func_split_short_opt_arg" ${1+"$@"}
	shift
	;;

	--) break ;;
	-*) func_fatal_help "unrecognised option: '$_G_opt'" ;;
	*) set dummy "$_G_opt" ${1+"$@"}; shift; break ;;
	esac
	done

	# save modified positional parameters for caller
	func_quote_for_eval ${1+"$@"}
	func_parse_options_result=$func_quote_for_eval_result
	}


	# func_validate_options [ARG]...
	# ------------------------------
	# Perform any sanity checks on option settings and/or unconsumed
	# arguments.
	func_hookable func_validate_options
	func_validate_options ()
	{
	$debug_cmd

	# Display all warnings if -W was not given.
	test -n "$opt_warning_types" \|\| opt_warning_types=" $warning_categories"

	func_run_hooks func_validate_options ${1+"$@"}

	# Bail if the options were screwed!
	$exit_cmd $EXIT_FAILURE

	# save modified positional parameters for caller
	func_validate_options_result=$func_run_hooks_result
	}



	## ----------------- ##
	## Helper functions. ##
	## ----------------- ##

	# This section contains the helper functions used by the rest of the
	# hookable option parser framework in ascii-betical order.


	# func_fatal_help ARG...
	# ----------------------
	# Echo program name prefixed message to standard error, followed by
	# a help hint, and exit.
	func_fatal_help ()
	{
	$debug_cmd

	eval \$ECHO \""Usage: $usage"\"
	eval \$ECHO \""$fatal_help"\"
	func_error ${1+"$@"}
	exit $EXIT_FAILURE
	}


	# func_help
	# ---------
	# Echo long help message to standard output and exit.
	func_help ()
	{
	$debug_cmd

	func_usage_message
	$ECHO "$long_help_message"
	exit 0
	}


	# func_missing_arg ARGNAME
	# ------------------------
	# Echo program name prefixed message to standard error and set global
	# exit_cmd.
	func_missing_arg ()
	{
	$debug_cmd

	func_error "Missing argument for '$1'."
	exit_cmd=exit
	}


	# func_split_equals STRING
	# ------------------------
	# Set func_split_equals_lhs and func_split_equals_rhs shell variables after
	# splitting STRING at the '=' sign.
	test -z "$_G_HAVE_XSI_OPS" \
	&& (eval 'x=a/b/c;
	test 5aa/bb/cc = "${#x}${x%%/}${x%/}${x#/}${x##/}"') 2>/dev/null \
	&& _G_HAVE_XSI_OPS=yes

	if test yes = "$_G_HAVE_XSI_OPS"
	then
	# This is an XSI compatible shell, allowing a faster implementation...
	eval 'func_split_equals ()
	{
	$debug_cmd

	func_split_equals_lhs=${1%%=*}
	func_split_equals_rhs=${1#*=}
	test "x$func_split_equals_lhs" = "x$1" \
	&& func_split_equals_rhs=
	}'
	else
	# ...otherwise fall back to using expr, which is often a shell builtin.
	func_split_equals ()
	{
	$debug_cmd

	func_split_equals_lhs=`expr "x$1" : 'x$[^=]*$'`
	func_split_equals_rhs=
	test "x$func_split_equals_lhs" = "x$1" \
	\|\| func_split_equals_rhs=`expr "x$1" : 'x[^=]=$.$$'`
	}
	fi #func_split_equals


	# func_split_short_opt SHORTOPT
	# -----------------------------
	# Set func_split_short_opt_name and func_split_short_opt_arg shell
	# variables after splitting SHORTOPT after the 2nd character.
	if test yes = "$_G_HAVE_XSI_OPS"
	then
	# This is an XSI compatible shell, allowing a faster implementation...
	eval 'func_split_short_opt ()
	{
	$debug_cmd

	func_split_short_opt_arg=${1#??}
	func_split_short_opt_name=${1%"$func_split_short_opt_arg"}
	}'
	else
	# ...otherwise fall back to using expr, which is often a shell builtin.
	func_split_short_opt ()
	{
	$debug_cmd

	func_split_short_opt_name=`expr "x$1" : 'x-$.$'`
	func_split_short_opt_arg=`expr "x$1" : 'x-.$.*$$'`
	}
	fi #func_split_short_opt


	# func_usage
	# ----------
	# Echo short help message to standard output and exit.
	func_usage ()
	{
	$debug_cmd

	func_usage_message
	$ECHO "Run '$progname --help \|${PAGER-more}' for full usage"
	exit 0
	}


	# func_usage_message
	# ------------------
	# Echo short help message to standard output.
	func_usage_message ()
	{
	$debug_cmd

	eval \$ECHO \""Usage: $usage"\"
	echo
	$SED -n 's\|^# \|\|
	/^Written by/{
	x;p;x
	}
	h
	/^Written by/q' < "$progpath"
	echo
	eval \$ECHO \""$usage_message"\"
	}


	# func_version
	# ------------
	# Echo version message to standard output and exit.
	func_version ()
	{
	$debug_cmd

	printf '%s\n' "$progname $scriptversion"
	$SED -n '
	/(C)/!b go
	:more
	/\./!{
	N
	s\|\n# \| \|
	b more
	}
	:go
	/^# Written by /,/# warranty; / {
	s\|^# \|\|
	s\|^# *$\|\|
	s\|$(C)$[ 0-9,-][ ,-]$[1-9][0-9] $\|\1 \2\|
	p
	}
	/^# Written by / {
	s\|^# \|\|
	p
	}
	/^warranty; /q' < "$progpath"

	exit $?
	}


	# Local variables:
	# mode: shell-script
	# sh-indentation: 2
	# eval: (add-hook 'before-save-hook 'time-stamp)
	# time-stamp-pattern: "10/scriptversion=%:y-%02m-%02d.%02H; # UTC"
	# time-stamp-time-zone: "UTC"
	# End:

	# Set a version string.
	scriptversion='(GNU libtool) 2.4.6'


	# func_echo ARG...
	# ----------------
	# Libtool also displays the current mode in messages, so override
	# funclib.sh func_echo with this custom definition.
	func_echo ()
	{
	$debug_cmd

	_G_message=$*

	func_echo_IFS=$IFS
	IFS=$nl
	for _G_line in $_G_message; do
	IFS=$func_echo_IFS
	$ECHO "$progname${opt_mode+: $opt_mode}: $_G_line"
	done
	IFS=$func_echo_IFS
	}


	# func_warning ARG...
	# -------------------
	# Libtool warnings are not categorized, so override funclib.sh
	# func_warning with this simpler definition.
	func_warning ()
	{
	$debug_cmd

	$warning_func ${1+"$@"}
	}


	## ---------------- ##
	## Options parsing. ##
	## ---------------- ##

	# Hook in the functions to make sure our own options are parsed during
	# the option parsing loop.

	usage='$progpath [OPTION]... [MODE-ARG]...'

	# Short help message in response to '-h'.
	usage_message="Options:
	--config show all configuration variables
	--debug enable verbose shell tracing
	-n, --dry-run display commands without modifying any files
	--features display basic configuration information and exit
	--mode=MODE use operation mode MODE
	--no-warnings equivalent to '-Wnone'
	--preserve-dup-deps don't remove duplicate dependency libraries
	--quiet, --silent don't print informational messages
	--tag=TAG use configuration variables from tag TAG
	-v, --verbose print more informational messages than default
	--version print version information
	-W, --warnings=CATEGORY report the warnings falling in CATEGORY [all]
	-h, --help, --help-all print short, long, or detailed help message
	"

	# Additional text appended to 'usage_message' in response to '--help'.
	func_help ()
	{
	$debug_cmd

	func_usage_message
	$ECHO "$long_help_message

	MODE must be one of the following:

	clean remove files from the build directory
	compile compile a source file into a libtool object
	execute automatically set library path, then run a program
	finish complete the installation of libtool libraries
	install install libraries or executables
	link create a library or an executable
	uninstall remove libraries from an installed directory

	MODE-ARGS vary depending on the MODE. When passed as first option,
	'--mode=MODE' may be abbreviated as 'MODE' or a unique abbreviation of that.
	Try '$progname --help --mode=MODE' for a more detailed description of MODE.

	When reporting a bug, please describe a test case to reproduce it and
	include the following information:

	host-triplet: $host
	shell: $SHELL
	compiler: $LTCC
	compiler flags: $LTCFLAGS
	linker: $LD (gnu? $with_gnu_ld)
	version: $progname (GNU libtool) 2.4.6
	automake: `($AUTOMAKE --version) 2>/dev/null \|$SED 1q`
	autoconf: `($AUTOCONF --version) 2>/dev/null \|$SED 1q`

	Report bugs to <bug-libtool@gnu.org>.
	GNU libtool home page: <http://www.gnu.org/software/libtool/>.
	General help using GNU software: <http://www.gnu.org/gethelp/>."
	exit 0
	}


	# func_lo2o OBJECT-NAME
	# ---------------------
	# Transform OBJECT-NAME from a '.lo' suffix to the platform specific
	# object suffix.

	lo2o=s/\\.lo\$/.$objext/
	o2lo=s/\\.$objext\$/.lo/

	if test yes = "$_G_HAVE_XSI_OPS"; then
	eval 'func_lo2o ()
	{
	case $1 in
	*.lo) func_lo2o_result=${1%.lo}.$objext ;;
	* ) func_lo2o_result=$1 ;;
	esac
	}'

	# func_xform LIBOBJ-OR-SOURCE
	# ---------------------------
	# Transform LIBOBJ-OR-SOURCE from a '.o' or '.c' (or otherwise)
	# suffix to a '.lo' libtool-object suffix.
	eval 'func_xform ()
	{
	func_xform_result=${1%.*}.lo
	}'
	else
	# ...otherwise fall back to using sed.
	func_lo2o ()
	{
	func_lo2o_result=`$ECHO "$1" \| $SED "$lo2o"`
	}

	func_xform ()
	{
	func_xform_result=`$ECHO "$1" \| $SED 's\|\.[^.]*$\|.lo\|'`
	}
	fi


	# func_fatal_configuration ARG...
	# -------------------------------
	# Echo program name prefixed message to standard error, followed by
	# a configuration failure hint, and exit.
	func_fatal_configuration ()
	{
	- func__fatal_error ${1+"$@"} \
	+ func_fatal_error ${1+"$@"} \
	"See the $PACKAGE documentation for more information." \
	"Fatal configuration error."
	}


	# func_config
	# -----------
	# Display the configuration for all the tags in this script.
	func_config ()
	{
	re_begincf='^# ### BEGIN LIBTOOL'
	re_endcf='^# ### END LIBTOOL'

	# Default configuration.
	$SED "1,/$re_begincf CONFIG/d;/$re_endcf CONFIG/,\$d" < "$progpath"

	# Now print the configurations for the tags.
	for tagname in $taglist; do
	$SED -n "/$re_begincf TAG CONFIG: $tagname\$/,/$re_endcf TAG CONFIG: $tagname\$/p" < "$progpath"
	done

	exit $?
	}


	# func_features
	# -------------
	# Display the features supported by this script.
	func_features ()
	{
	echo "host: $host"
	if test yes = "$build_libtool_libs"; then
	echo "enable shared libraries"
	else
	echo "disable shared libraries"
	fi
	if test yes = "$build_old_libs"; then
	echo "enable static libraries"
	else
	echo "disable static libraries"
	fi

	exit $?
	}


	# func_enable_tag TAGNAME
	# -----------------------
	# Verify that TAGNAME is valid, and either flag an error and exit, or
	# enable the TAGNAME tag. We also add TAGNAME to the global $taglist
	# variable here.
	func_enable_tag ()
	{
	# Global variable:
	tagname=$1

	re_begincf="^# ### BEGIN LIBTOOL TAG CONFIG: $tagname\$"
	re_endcf="^# ### END LIBTOOL TAG CONFIG: $tagname\$"
	sed_extractcf=/$re_begincf/,/$re_endcf/p

	# Validate tagname.
	case $tagname in
	[!-_A-Za-z0-9,/])
	func_fatal_error "invalid tag name: $tagname"
	;;
	esac

	# Don't test for the "default" C tag, as we know it's
	# there but not specially marked.
	case $tagname in
	CC) ;;
	*)
	if $GREP "$re_begincf" "$progpath" >/dev/null 2>&1; then
	taglist="$taglist $tagname"

	# Evaluate the configuration. Be careful to quote the path
	# and the sed script, to avoid splitting on whitespace, but
	# also don't use non-portable quotes within backquotes within
	# quotes we have to do it in 2 steps:
	extractedcf=`$SED -n -e "$sed_extractcf" < "$progpath"`
	eval "$extractedcf"
	else
	func_error "ignoring unknown tag $tagname"
	fi
	;;
	esac
	}


	# func_check_version_match
	# ------------------------
	# Ensure that we are using m4 macros, and libtool script from the same
	# release of libtool.
	func_check_version_match ()
	{
	if test "$package_revision" != "$macro_revision"; then
	if test "$VERSION" != "$macro_version"; then
	if test -z "$macro_version"; then
	cat >&2 <<_LT_EOF
	$progname: Version mismatch error. This is $PACKAGE $VERSION, but the
	$progname: definition of this LT_INIT comes from an older release.
	$progname: You should recreate aclocal.m4 with macros from $PACKAGE $VERSION
	$progname: and run autoconf again.
	_LT_EOF
	else
	cat >&2 <<_LT_EOF
	$progname: Version mismatch error. This is $PACKAGE $VERSION, but the
	$progname: definition of this LT_INIT comes from $PACKAGE $macro_version.
	$progname: You should recreate aclocal.m4 with macros from $PACKAGE $VERSION
	$progname: and run autoconf again.
	_LT_EOF
	fi
	else
	cat >&2 <<_LT_EOF
	$progname: Version mismatch error. This is $PACKAGE $VERSION, revision $package_revision,
	$progname: but the definition of this LT_INIT comes from revision $macro_revision.
	$progname: You should recreate aclocal.m4 with macros from revision $package_revision
	$progname: of $PACKAGE $VERSION and run autoconf again.
	_LT_EOF
	fi

	exit $EXIT_MISMATCH
	fi
	}


	# libtool_options_prep [ARG]...
	# -----------------------------
	# Preparation for options parsed by libtool.
	libtool_options_prep ()
	{
	$debug_mode

	# Option defaults:
	opt_config=false
	opt_dlopen=
	opt_dry_run=false
	opt_help=false
	opt_mode=
	opt_preserve_dup_deps=false
	opt_quiet=false

	nonopt=
	preserve_args=

	# Shorthand for --mode=foo, only valid as the first argument
	case $1 in
	clean\|clea\|cle\|cl)
	shift; set dummy --mode clean ${1+"$@"}; shift
	;;
	compile\|compil\|compi\|comp\|com\|co\|c)
	shift; set dummy --mode compile ${1+"$@"}; shift
	;;
	execute\|execut\|execu\|exec\|exe\|ex\|e)
	shift; set dummy --mode execute ${1+"$@"}; shift
	;;
	finish\|finis\|fini\|fin\|fi\|f)
	shift; set dummy --mode finish ${1+"$@"}; shift
	;;
	install\|instal\|insta\|inst\|ins\|in\|i)
	shift; set dummy --mode install ${1+"$@"}; shift
	;;
	link\|lin\|li\|l)
	shift; set dummy --mode link ${1+"$@"}; shift
	;;
	uninstall\|uninstal\|uninsta\|uninst\|unins\|unin\|uni\|un\|u)
	shift; set dummy --mode uninstall ${1+"$@"}; shift
	;;
	esac

	# Pass back the list of options.
	func_quote_for_eval ${1+"$@"}
	libtool_options_prep_result=$func_quote_for_eval_result
	}
	func_add_hook func_options_prep libtool_options_prep


	# libtool_parse_options [ARG]...
	# ---------------------------------
	# Provide handling for libtool specific options.
	libtool_parse_options ()
	{
	$debug_cmd

	# Perform our own loop to consume as many options as possible in
	# each iteration.
	while test $# -gt 0; do
	_G_opt=$1
	shift
	case $_G_opt in
	--dry-run\|--dryrun\|-n)
	opt_dry_run=:
	;;

	--config) func_config ;;

	--dlopen\|-dlopen)
	opt_dlopen="${opt_dlopen+$opt_dlopen
	}$1"
	shift
	;;

	--preserve-dup-deps)
	opt_preserve_dup_deps=: ;;

	--features) func_features ;;

	--finish) set dummy --mode finish ${1+"$@"}; shift ;;

	--help) opt_help=: ;;

	--help-all) opt_help=': help-all' ;;

	--mode) test $# = 0 && func_missing_arg $_G_opt && break
	opt_mode=$1
	case $1 in
	# Valid mode arguments:
	clean\|compile\|execute\|finish\|install\|link\|relink\|uninstall) ;;

	# Catch anything else as an error
	*) func_error "invalid argument for $_G_opt"
	exit_cmd=exit
	break
	;;
	esac
	shift
	;;

	--no-silent\|--no-quiet)
	opt_quiet=false
	func_append preserve_args " $_G_opt"
	;;

	--no-warnings\|--no-warning\|--no-warn)
	opt_warning=false
	func_append preserve_args " $_G_opt"
	;;

	--no-verbose)
	opt_verbose=false
	func_append preserve_args " $_G_opt"
	;;

	--silent\|--quiet)
	opt_quiet=:
	opt_verbose=false
	func_append preserve_args " $_G_opt"
	;;

	--tag) test $# = 0 && func_missing_arg $_G_opt && break
	opt_tag=$1
	func_append preserve_args " $_G_opt $1"
	func_enable_tag "$1"
	shift
	;;

	--verbose\|-v) opt_quiet=false
	opt_verbose=:
	func_append preserve_args " $_G_opt"
	;;

	# An option not handled by this hook function:
	*) set dummy "$_G_opt" ${1+"$@"}; shift; break ;;
	esac
	done


	# save modified positional parameters for caller
	func_quote_for_eval ${1+"$@"}
	libtool_parse_options_result=$func_quote_for_eval_result
	}
	func_add_hook func_parse_options libtool_parse_options



	# libtool_validate_options [ARG]...
	# ---------------------------------
	# Perform any sanity checks on option settings and/or unconsumed
	# arguments.
	libtool_validate_options ()
	{
	# save first non-option argument
	if test 0 -lt $#; then
	nonopt=$1
	shift
	fi

	# preserve --debug
	test : = "$debug_cmd" \|\| func_append preserve_args " --debug"

	case $host in
	# Solaris2 added to fix http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16452
	# see also: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59788
	cygwin \| mingw \| pw32 \| cegcc \| solaris2 \| os2)
	# don't eliminate duplications in $postdeps and $predeps
	opt_duplicate_compiler_generated_deps=:
	;;
	*)
	opt_duplicate_compiler_generated_deps=$opt_preserve_dup_deps
	;;
	esac

	$opt_help \|\| {
	# Sanity checks first:
	func_check_version_match

	test yes != "$build_libtool_libs" \
	&& test yes != "$build_old_libs" \
	&& func_fatal_configuration "not configured to build any kind of library"

	# Darwin sucks
	eval std_shrext=\"$shrext_cmds\"

	# Only execute mode is allowed to have -dlopen flags.
	if test -n "$opt_dlopen" && test execute != "$opt_mode"; then
	func_error "unrecognized option '-dlopen'"
	$ECHO "$help" 1>&2
	exit $EXIT_FAILURE
	fi

	# Change the help message to a mode-specific one.
	generic_help=$help
	help="Try '$progname --help --mode=$opt_mode' for more information."
	}

	# Pass back the unparsed argument list
	func_quote_for_eval ${1+"$@"}
	libtool_validate_options_result=$func_quote_for_eval_result
	}
	func_add_hook func_validate_options libtool_validate_options


	# Process options as early as possible so that --help and --version
	# can return quickly.
	func_options ${1+"$@"}
	eval set dummy "$func_options_result"; shift



	## ----------- ##
	## Main. ##
	## ----------- ##

	magic='%%%MAGIC variable%%%'
	magic_exe='%%%MAGIC EXE variable%%%'

	# Global variables.
	extracted_archives=
	extracted_serial=0

	# If this variable is set in any of the actions, the command in it
	# will be execed at the end. This prevents here-documents from being
	# left over by shells.
	exec_cmd=


	# A function that is used when there is no print builtin or printf.
	func_fallback_echo ()
	{
	eval 'cat <<_LTECHO_EOF
	$1
	_LTECHO_EOF'
	}

	# func_generated_by_libtool
	# True iff stdin has been generated by Libtool. This function is only
	# a basic sanity check; it will hardly flush out determined imposters.
	func_generated_by_libtool_p ()
	{
	$GREP "^# Generated by .*$PACKAGE" > /dev/null 2>&1
	}

	# func_lalib_p file
	# True iff FILE is a libtool '.la' library or '.lo' object file.
	# This function is only a basic sanity check; it will hardly flush out
	# determined imposters.
	func_lalib_p ()
	{
	test -f "$1" &&
	$SED -e 4q "$1" 2>/dev/null \| func_generated_by_libtool_p
	}

	# func_lalib_unsafe_p file
	# True iff FILE is a libtool '.la' library or '.lo' object file.
	# This function implements the same check as func_lalib_p without
	# resorting to external programs. To this end, it redirects stdin and
	# closes it afterwards, without saving the original file descriptor.
	# As a safety measure, use it only where a negative result would be
	# fatal anyway. Works if 'file' does not exist.
	func_lalib_unsafe_p ()
	{
	lalib_p=no
	if test -f "$1" && test -r "$1" && exec 5<&0 <"$1"; then
	for lalib_p_l in 1 2 3 4
	do
	read lalib_p_line
	case $lalib_p_line in
	\#\ Generated\ by\ $PACKAGE ) lalib_p=yes; break;;
	esac
	done
	exec 0<&5 5<&-
	fi
	test yes = "$lalib_p"
	}

	# func_ltwrapper_script_p file
	# True iff FILE is a libtool wrapper script
	# This function is only a basic sanity check; it will hardly flush out
	# determined imposters.
	func_ltwrapper_script_p ()
	{
	test -f "$1" &&
	$lt_truncate_bin < "$1" 2>/dev/null \| func_generated_by_libtool_p
	}

	# func_ltwrapper_executable_p file
	# True iff FILE is a libtool wrapper executable
	# This function is only a basic sanity check; it will hardly flush out
	# determined imposters.
	func_ltwrapper_executable_p ()
	{
	func_ltwrapper_exec_suffix=
	case $1 in
	*.exe) ;;
	*) func_ltwrapper_exec_suffix=.exe ;;
	esac
	$GREP "$magic_exe" "$1$func_ltwrapper_exec_suffix" >/dev/null 2>&1
	}

	# func_ltwrapper_scriptname file
	# Assumes file is an ltwrapper_executable
	# uses $file to determine the appropriate filename for a
	# temporary ltwrapper_script.
	func_ltwrapper_scriptname ()
	{
	func_dirname_and_basename "$1" "" "."
	func_stripname '' '.exe' "$func_basename_result"
	func_ltwrapper_scriptname_result=$func_dirname_result/$objdir/${func_stripname_result}_ltshwrapper
	}

	# func_ltwrapper_p file
	# True iff FILE is a libtool wrapper script or wrapper executable
	# This function is only a basic sanity check; it will hardly flush out
	# determined imposters.
	func_ltwrapper_p ()
	{
	func_ltwrapper_script_p "$1" \|\| func_ltwrapper_executable_p "$1"
	}


	# func_execute_cmds commands fail_cmd
	# Execute tilde-delimited COMMANDS.
	# If FAIL_CMD is given, eval that upon failure.
	# FAIL_CMD may read-access the current command in variable CMD!
	func_execute_cmds ()
	{
	$debug_cmd

	save_ifs=$IFS; IFS='~'
	for cmd in $1; do
	IFS=$sp$nl
	eval cmd=\"$cmd\"
	IFS=$save_ifs
	func_show_eval "$cmd" "${2-:}"
	done
	IFS=$save_ifs
	}


	# func_source file
	# Source FILE, adding directory component if necessary.
	# Note that it is not necessary on cygwin/mingw to append a dot to
	# FILE even if both FILE and FILE.exe exist: automatic-append-.exe
	# behavior happens only for exec(3), not for open(2)! Also, sourcing
	# 'FILE.' does not work on cygwin managed mounts.
	func_source ()
	{
	$debug_cmd

	case $1 in
	/ \| \\) . "$1" ;;
	*) . "./$1" ;;
	esac
	}


	# func_resolve_sysroot PATH
	# Replace a leading = in PATH with a sysroot. Store the result into
	# func_resolve_sysroot_result
	func_resolve_sysroot ()
	{
	func_resolve_sysroot_result=$1
	case $func_resolve_sysroot_result in
	=*)
	func_stripname '=' '' "$func_resolve_sysroot_result"
	func_resolve_sysroot_result=$lt_sysroot$func_stripname_result
	;;
	esac
	}

	# func_replace_sysroot PATH
	# If PATH begins with the sysroot, replace it with = and
	# store the result into func_replace_sysroot_result.
	func_replace_sysroot ()
	{
	case $lt_sysroot:$1 in
	?:"$lt_sysroot")
	func_stripname "$lt_sysroot" '' "$1"
	func_replace_sysroot_result='='$func_stripname_result
	;;
	*)
	# Including no sysroot.
	func_replace_sysroot_result=$1
	;;
	esac
	}

	# func_infer_tag arg
	# Infer tagged configuration to use if any are available and
	# if one wasn't chosen via the "--tag" command line option.
	# Only attempt this if the compiler in the base compile
	# command doesn't match the default compiler.
	# arg is usually of the form 'gcc ...'
	func_infer_tag ()
	{
	$debug_cmd

	if test -n "$available_tags" && test -z "$tagname"; then
	CC_quoted=
	for arg in $CC; do
	func_append_quoted CC_quoted "$arg"
	done
	CC_expanded=`func_echo_all $CC`
	CC_quoted_expanded=`func_echo_all $CC_quoted`
	case $@ in
	# Blanks in the command may have been stripped by the calling shell,
	# but not from the CC environment variable when configure was run.
	" $CC "* \| "$CC "* \| " $CC_expanded "* \| "$CC_expanded "* \| \
	" $CC_quoted"* \| "$CC_quoted "* \| " $CC_quoted_expanded "* \| "$CC_quoted_expanded "*) ;;
	# Blanks at the start of $base_compile will cause this to fail
	# if we don't check for them as well.
	*)
	for z in $available_tags; do
	if $GREP "^# ### BEGIN LIBTOOL TAG CONFIG: $z$" < "$progpath" > /dev/null; then
	# Evaluate the configuration.
	eval "`$SED -n -e '/^# ### BEGIN LIBTOOL TAG CONFIG: '$z'$/,/^# ### END LIBTOOL TAG CONFIG: '$z'$/p' < $progpath`"
	CC_quoted=
	for arg in $CC; do
	# Double-quote args containing other shell metacharacters.
	func_append_quoted CC_quoted "$arg"
	done
	CC_expanded=`func_echo_all $CC`
	CC_quoted_expanded=`func_echo_all $CC_quoted`
	case "$@ " in
	" $CC "* \| "$CC "* \| " $CC_expanded "* \| "$CC_expanded "* \| \
	" $CC_quoted"* \| "$CC_quoted "* \| " $CC_quoted_expanded "* \| "$CC_quoted_expanded "*)
	# The compiler in the base compile command matches
	# the one in the tagged configuration.
	# Assume this is the tagged configuration we want.
	tagname=$z
	break
	;;
	esac
	fi
	done
	# If $tagname still isn't set, then no tagged configuration
	# was found and let the user know that the "--tag" command
	# line option must be used.
	if test -z "$tagname"; then
	func_echo "unable to infer tagged configuration"
	func_fatal_error "specify a tag with '--tag'"
	# else
	# func_verbose "using $tagname tagged configuration"
	fi
	;;
	esac
	fi
	}



	# func_write_libtool_object output_name pic_name nonpic_name
	# Create a libtool object file (analogous to a ".la" file),
	# but don't create it if we're doing a dry run.
	func_write_libtool_object ()
	{
	write_libobj=$1
	if test yes = "$build_libtool_libs"; then
	write_lobj=\'$2\'
	else
	write_lobj=none
	fi

	if test yes = "$build_old_libs"; then
	write_oldobj=\'$3\'
	else
	write_oldobj=none
	fi

	$opt_dry_run \|\| {
	cat >${write_libobj}T <<EOF
	# $write_libobj - a libtool object file
	# Generated by $PROGRAM (GNU $PACKAGE) $VERSION
	#
	# Please DO NOT delete this file!
	# It is necessary for linking the library.

	# Name of the PIC object.
	pic_object=$write_lobj

	# Name of the non-PIC object
	non_pic_object=$write_oldobj

	EOF
	$MV "${write_libobj}T" "$write_libobj"
	}
	}


	##################################################
	# FILE NAME AND PATH CONVERSION HELPER FUNCTIONS #
	##################################################

	# func_convert_core_file_wine_to_w32 ARG
	# Helper function used by file name conversion functions when $build is *nix,
	# and $host is mingw, cygwin, or some other w32 environment. Relies on a
	# correctly configured wine environment available, with the winepath program
	# in $build's $PATH.
	#
	# ARG is the $build file name to be converted to w32 format.
	# Result is available in $func_convert_core_file_wine_to_w32_result, and will
	# be empty on error (or when ARG is empty)
	func_convert_core_file_wine_to_w32 ()
	{
	$debug_cmd

	func_convert_core_file_wine_to_w32_result=$1
	if test -n "$1"; then
	# Unfortunately, winepath does not exit with a non-zero error code, so we
	# are forced to check the contents of stdout. On the other hand, if the
	# command is not found, the shell will set an exit code of 127 and print
	# an error message to stdout. So we must check for both error code of
	# zero AND non-empty stdout, which explains the odd construction:
	func_convert_core_file_wine_to_w32_tmp=`winepath -w "$1" 2>/dev/null`
	if test "$?" -eq 0 && test -n "$func_convert_core_file_wine_to_w32_tmp"; then
	func_convert_core_file_wine_to_w32_result=`$ECHO "$func_convert_core_file_wine_to_w32_tmp" \|
	$SED -e "$sed_naive_backslashify"`
	else
	func_convert_core_file_wine_to_w32_result=
	fi
	fi
	}
	# end: func_convert_core_file_wine_to_w32


	# func_convert_core_path_wine_to_w32 ARG
	# Helper function used by path conversion functions when $build is *nix, and
	# $host is mingw, cygwin, or some other w32 environment. Relies on a correctly
	# configured wine environment available, with the winepath program in $build's
	# $PATH. Assumes ARG has no leading or trailing path separator characters.
	#
	# ARG is path to be converted from $build format to win32.
	# Result is available in $func_convert_core_path_wine_to_w32_result.
	# Unconvertible file (directory) names in ARG are skipped; if no directory names
	# are convertible, then the result may be empty.
	func_convert_core_path_wine_to_w32 ()
	{
	$debug_cmd

	# unfortunately, winepath doesn't convert paths, only file names
	func_convert_core_path_wine_to_w32_result=
	if test -n "$1"; then
	oldIFS=$IFS
	IFS=:
	for func_convert_core_path_wine_to_w32_f in $1; do
	IFS=$oldIFS
	func_convert_core_file_wine_to_w32 "$func_convert_core_path_wine_to_w32_f"
	if test -n "$func_convert_core_file_wine_to_w32_result"; then
	if test -z "$func_convert_core_path_wine_to_w32_result"; then
	func_convert_core_path_wine_to_w32_result=$func_convert_core_file_wine_to_w32_result
	else
	func_append func_convert_core_path_wine_to_w32_result ";$func_convert_core_file_wine_to_w32_result"
	fi
	fi
	done
	IFS=$oldIFS
	fi
	}
	# end: func_convert_core_path_wine_to_w32


	# func_cygpath ARGS...
	# Wrapper around calling the cygpath program via LT_CYGPATH. This is used when
	# when (1) $build is *nix and Cygwin is hosted via a wine environment; or (2)
	# $build is MSYS and $host is Cygwin, or (3) $build is Cygwin. In case (1) or
	# (2), returns the Cygwin file name or path in func_cygpath_result (input
	# file name or path is assumed to be in w32 format, as previously converted
	# from $build's *nix or MSYS format). In case (3), returns the w32 file name
	# or path in func_cygpath_result (input file name or path is assumed to be in
	# Cygwin format). Returns an empty string on error.
	#
	# ARGS are passed to cygpath, with the last one being the file name or path to
	# be converted.
	#
	# Specify the absolute *nix (or w32) name to cygpath in the LT_CYGPATH
	# environment variable; do not put it in $PATH.
	func_cygpath ()
	{
	$debug_cmd

	if test -n "$LT_CYGPATH" && test -f "$LT_CYGPATH"; then
	func_cygpath_result=`$LT_CYGPATH "$@" 2>/dev/null`
	if test "$?" -ne 0; then
	# on failure, ensure result is empty
	func_cygpath_result=
	fi
	else
	func_cygpath_result=
	func_error "LT_CYGPATH is empty or specifies non-existent file: '$LT_CYGPATH'"
	fi
	}
	#end: func_cygpath


	# func_convert_core_msys_to_w32 ARG
	# Convert file name or path ARG from MSYS format to w32 format. Return
	# result in func_convert_core_msys_to_w32_result.
	func_convert_core_msys_to_w32 ()
	{
	$debug_cmd

	# awkward: cmd appends spaces to result
	func_convert_core_msys_to_w32_result=`( cmd //c echo "$1" ) 2>/dev/null \|
	$SED -e 's/[ ]*$//' -e "$sed_naive_backslashify"`
	}
	#end: func_convert_core_msys_to_w32


	# func_convert_file_check ARG1 ARG2
	# Verify that ARG1 (a file name in $build format) was converted to $host
	# format in ARG2. Otherwise, emit an error message, but continue (resetting
	# func_to_host_file_result to ARG1).
	func_convert_file_check ()
	{
	$debug_cmd

	if test -z "$2" && test -n "$1"; then
	func_error "Could not determine host file name corresponding to"
	func_error " '$1'"
	func_error "Continuing, but uninstalled executables may not work."
	# Fallback:
	func_to_host_file_result=$1
	fi
	}
	# end func_convert_file_check


	# func_convert_path_check FROM_PATHSEP TO_PATHSEP FROM_PATH TO_PATH
	# Verify that FROM_PATH (a path in $build format) was converted to $host
	# format in TO_PATH. Otherwise, emit an error message, but continue, resetting
	# func_to_host_file_result to a simplistic fallback value (see below).
	func_convert_path_check ()
	{
	$debug_cmd

	if test -z "$4" && test -n "$3"; then
	func_error "Could not determine the host path corresponding to"
	func_error " '$3'"
	func_error "Continuing, but uninstalled executables may not work."
	# Fallback. This is a deliberately simplistic "conversion" and
	# should not be "improved". See libtool.info.
	if test "x$1" != "x$2"; then
	lt_replace_pathsep_chars="s\|$1\|$2\|g"
	func_to_host_path_result=`echo "$3" \|
	$SED -e "$lt_replace_pathsep_chars"`
	else
	func_to_host_path_result=$3
	fi
	fi
	}
	# end func_convert_path_check


	# func_convert_path_front_back_pathsep FRONTPAT BACKPAT REPL ORIG
	# Modifies func_to_host_path_result by prepending REPL if ORIG matches FRONTPAT
	# and appending REPL if ORIG matches BACKPAT.
	func_convert_path_front_back_pathsep ()
	{
	$debug_cmd

	case $4 in
	$1 ) func_to_host_path_result=$3$func_to_host_path_result
	;;
	esac
	case $4 in
	$2 ) func_append func_to_host_path_result "$3"
	;;
	esac
	}
	# end func_convert_path_front_back_pathsep


	##################################################
	# $build to $host FILE NAME CONVERSION FUNCTIONS #
	##################################################
	# invoked via '$to_host_file_cmd ARG'
	#
	# In each case, ARG is the path to be converted from $build to $host format.
	# Result will be available in $func_to_host_file_result.


	# func_to_host_file ARG
	# Converts the file name ARG from $build format to $host format. Return result
	# in func_to_host_file_result.
	func_to_host_file ()
	{
	$debug_cmd

	$to_host_file_cmd "$1"
	}
	# end func_to_host_file


	# func_to_tool_file ARG LAZY
	# converts the file name ARG from $build format to toolchain format. Return
	# result in func_to_tool_file_result. If the conversion in use is listed
	# in (the comma separated) LAZY, no conversion takes place.
	func_to_tool_file ()
	{
	$debug_cmd

	case ,$2, in
	,"$to_tool_file_cmd",)
	func_to_tool_file_result=$1
	;;
	*)
	$to_tool_file_cmd "$1"
	func_to_tool_file_result=$func_to_host_file_result
	;;
	esac
	}
	# end func_to_tool_file


	# func_convert_file_noop ARG
	# Copy ARG to func_to_host_file_result.
	func_convert_file_noop ()
	{
	func_to_host_file_result=$1
	}
	# end func_convert_file_noop


	# func_convert_file_msys_to_w32 ARG
	# Convert file name ARG from (mingw) MSYS to (mingw) w32 format; automatic
	# conversion to w32 is not available inside the cwrapper. Returns result in
	# func_to_host_file_result.
	func_convert_file_msys_to_w32 ()
	{
	$debug_cmd

	func_to_host_file_result=$1
	if test -n "$1"; then
	func_convert_core_msys_to_w32 "$1"
	func_to_host_file_result=$func_convert_core_msys_to_w32_result
	fi
	func_convert_file_check "$1" "$func_to_host_file_result"
	}
	# end func_convert_file_msys_to_w32


	# func_convert_file_cygwin_to_w32 ARG
	# Convert file name ARG from Cygwin to w32 format. Returns result in
	# func_to_host_file_result.
	func_convert_file_cygwin_to_w32 ()
	{
	$debug_cmd

	func_to_host_file_result=$1
	if test -n "$1"; then
	# because $build is cygwin, we call "the" cygpath in $PATH; no need to use
	# LT_CYGPATH in this case.
	func_to_host_file_result=`cygpath -m "$1"`
	fi
	func_convert_file_check "$1" "$func_to_host_file_result"
	}
	# end func_convert_file_cygwin_to_w32


	# func_convert_file_nix_to_w32 ARG
	# Convert file name ARG from *nix to w32 format. Requires a wine environment
	# and a working winepath. Returns result in func_to_host_file_result.
	func_convert_file_nix_to_w32 ()
	{
	$debug_cmd

	func_to_host_file_result=$1
	if test -n "$1"; then
	func_convert_core_file_wine_to_w32 "$1"
	func_to_host_file_result=$func_convert_core_file_wine_to_w32_result
	fi
	func_convert_file_check "$1" "$func_to_host_file_result"
	}
	# end func_convert_file_nix_to_w32


	# func_convert_file_msys_to_cygwin ARG
	# Convert file name ARG from MSYS to Cygwin format. Requires LT_CYGPATH set.
	# Returns result in func_to_host_file_result.
	func_convert_file_msys_to_cygwin ()
	{
	$debug_cmd

	func_to_host_file_result=$1
	if test -n "$1"; then
	func_convert_core_msys_to_w32 "$1"
	func_cygpath -u "$func_convert_core_msys_to_w32_result"
	func_to_host_file_result=$func_cygpath_result
	fi
	func_convert_file_check "$1" "$func_to_host_file_result"
	}
	# end func_convert_file_msys_to_cygwin


	# func_convert_file_nix_to_cygwin ARG
	# Convert file name ARG from *nix to Cygwin format. Requires Cygwin installed
	# in a wine environment, working winepath, and LT_CYGPATH set. Returns result
	# in func_to_host_file_result.
	func_convert_file_nix_to_cygwin ()
	{
	$debug_cmd

	func_to_host_file_result=$1
	if test -n "$1"; then
	# convert from *nix to w32, then use cygpath to convert from w32 to cygwin.
	func_convert_core_file_wine_to_w32 "$1"
	func_cygpath -u "$func_convert_core_file_wine_to_w32_result"
	func_to_host_file_result=$func_cygpath_result
	fi
	func_convert_file_check "$1" "$func_to_host_file_result"
	}
	# end func_convert_file_nix_to_cygwin


	#############################################
	# $build to $host PATH CONVERSION FUNCTIONS #
	#############################################
	# invoked via '$to_host_path_cmd ARG'
	#
	# In each case, ARG is the path to be converted from $build to $host format.
	# The result will be available in $func_to_host_path_result.
	#
	# Path separators are also converted from $build format to $host format. If
	# ARG begins or ends with a path separator character, it is preserved (but
	# converted to $host format) on output.
	#
	# All path conversion functions are named using the following convention:
	# file name conversion function : func_convert_file_X_to_Y ()
	# path conversion function : func_convert_path_X_to_Y ()
	# where, for any given $build/$host combination the 'X_to_Y' value is the
	# same. If conversion functions are added for new $build/$host combinations,
	# the two new functions must follow this pattern, or func_init_to_host_path_cmd
	# will break.


	# func_init_to_host_path_cmd
	# Ensures that function "pointer" variable $to_host_path_cmd is set to the
	# appropriate value, based on the value of $to_host_file_cmd.
	to_host_path_cmd=
	func_init_to_host_path_cmd ()
	{
	$debug_cmd

	if test -z "$to_host_path_cmd"; then
	func_stripname 'func_convert_file_' '' "$to_host_file_cmd"
	to_host_path_cmd=func_convert_path_$func_stripname_result
	fi
	}


	# func_to_host_path ARG
	# Converts the path ARG from $build format to $host format. Return result
	# in func_to_host_path_result.
	func_to_host_path ()
	{
	$debug_cmd

	func_init_to_host_path_cmd
	$to_host_path_cmd "$1"
	}
	# end func_to_host_path


	# func_convert_path_noop ARG
	# Copy ARG to func_to_host_path_result.
	func_convert_path_noop ()
	{
	func_to_host_path_result=$1
	}
	# end func_convert_path_noop


	# func_convert_path_msys_to_w32 ARG
	# Convert path ARG from (mingw) MSYS to (mingw) w32 format; automatic
	# conversion to w32 is not available inside the cwrapper. Returns result in
	# func_to_host_path_result.
	func_convert_path_msys_to_w32 ()
	{
	$debug_cmd

	func_to_host_path_result=$1
	if test -n "$1"; then
	# Remove leading and trailing path separator characters from ARG. MSYS
	# behavior is inconsistent here; cygpath turns them into '.;' and ';.';
	# and winepath ignores them completely.
	func_stripname : : "$1"
	func_to_host_path_tmp1=$func_stripname_result
	func_convert_core_msys_to_w32 "$func_to_host_path_tmp1"
	func_to_host_path_result=$func_convert_core_msys_to_w32_result
	func_convert_path_check : ";" \
	"$func_to_host_path_tmp1" "$func_to_host_path_result"
	func_convert_path_front_back_pathsep ":" ":" ";" "$1"
	fi
	}
	# end func_convert_path_msys_to_w32


	# func_convert_path_cygwin_to_w32 ARG
	# Convert path ARG from Cygwin to w32 format. Returns result in
	# func_to_host_file_result.
	func_convert_path_cygwin_to_w32 ()
	{
	$debug_cmd

	func_to_host_path_result=$1
	if test -n "$1"; then
	# See func_convert_path_msys_to_w32:
	func_stripname : : "$1"
	func_to_host_path_tmp1=$func_stripname_result
	func_to_host_path_result=`cygpath -m -p "$func_to_host_path_tmp1"`
	func_convert_path_check : ";" \
	"$func_to_host_path_tmp1" "$func_to_host_path_result"
	func_convert_path_front_back_pathsep ":" ":" ";" "$1"
	fi
	}
	# end func_convert_path_cygwin_to_w32


	# func_convert_path_nix_to_w32 ARG
	# Convert path ARG from *nix to w32 format. Requires a wine environment and
	# a working winepath. Returns result in func_to_host_file_result.
	func_convert_path_nix_to_w32 ()
	{
	$debug_cmd

	func_to_host_path_result=$1
	if test -n "$1"; then
	# See func_convert_path_msys_to_w32:
	func_stripname : : "$1"
	func_to_host_path_tmp1=$func_stripname_result
	func_convert_core_path_wine_to_w32 "$func_to_host_path_tmp1"
	func_to_host_path_result=$func_convert_core_path_wine_to_w32_result
	func_convert_path_check : ";" \
	"$func_to_host_path_tmp1" "$func_to_host_path_result"
	func_convert_path_front_back_pathsep ":" ":" ";" "$1"
	fi
	}
	# end func_convert_path_nix_to_w32


	# func_convert_path_msys_to_cygwin ARG
	# Convert path ARG from MSYS to Cygwin format. Requires LT_CYGPATH set.
	# Returns result in func_to_host_file_result.
	func_convert_path_msys_to_cygwin ()
	{
	$debug_cmd

	func_to_host_path_result=$1
	if test -n "$1"; then
	# See func_convert_path_msys_to_w32:
	func_stripname : : "$1"
	func_to_host_path_tmp1=$func_stripname_result
	func_convert_core_msys_to_w32 "$func_to_host_path_tmp1"
	func_cygpath -u -p "$func_convert_core_msys_to_w32_result"
	func_to_host_path_result=$func_cygpath_result
	func_convert_path_check : : \
	"$func_to_host_path_tmp1" "$func_to_host_path_result"
	func_convert_path_front_back_pathsep ":" ":" : "$1"
	fi
	}
	# end func_convert_path_msys_to_cygwin


	# func_convert_path_nix_to_cygwin ARG
	# Convert path ARG from *nix to Cygwin format. Requires Cygwin installed in a
	# a wine environment, working winepath, and LT_CYGPATH set. Returns result in
	# func_to_host_file_result.
	func_convert_path_nix_to_cygwin ()
	{
	$debug_cmd

	func_to_host_path_result=$1
	if test -n "$1"; then
	# Remove leading and trailing path separator characters from
	# ARG. msys behavior is inconsistent here, cygpath turns them
	# into '.;' and ';.', and winepath ignores them completely.
	func_stripname : : "$1"
	func_to_host_path_tmp1=$func_stripname_result
	func_convert_core_path_wine_to_w32 "$func_to_host_path_tmp1"
	func_cygpath -u -p "$func_convert_core_path_wine_to_w32_result"
	func_to_host_path_result=$func_cygpath_result
	func_convert_path_check : : \
	"$func_to_host_path_tmp1" "$func_to_host_path_result"
	func_convert_path_front_back_pathsep ":" ":" : "$1"
	fi
	}
	# end func_convert_path_nix_to_cygwin


	# func_dll_def_p FILE
	# True iff FILE is a Windows DLL '.def' file.
	# Keep in sync with _LT_DLL_DEF_P in libtool.m4
	func_dll_def_p ()
	{
	$debug_cmd

	func_dll_def_p_tmp=`$SED -n \
	-e 's/^[ ]*//' \
	-e '/^$;.$$/d' \
	-e 's/^$EXPORTS\\|LIBRARY$$[ ].$$/DEF/p' \
	-e q \
	"$1"`
	test DEF = "$func_dll_def_p_tmp"
	}


	# func_mode_compile arg...
	func_mode_compile ()
	{
	$debug_cmd

	# Get the compilation command and the source file.
	base_compile=
	srcfile=$nonopt # always keep a non-empty value in "srcfile"
	suppress_opt=yes
	suppress_output=
	arg_mode=normal
	libobj=
	later=
	pie_flag=

	for arg
	do
	case $arg_mode in
	arg )
	# do not "continue". Instead, add this to base_compile
	lastarg=$arg
	arg_mode=normal
	;;

	target )
	libobj=$arg
	arg_mode=normal
	continue
	;;

	normal )
	# Accept any command-line options.
	case $arg in
	-o)
	test -n "$libobj" && \
	func_fatal_error "you cannot specify '-o' more than once"
	arg_mode=target
	continue
	;;

	-pie \| -fpie \| -fPIE)
	func_append pie_flag " $arg"
	continue
	;;

	-shared \| -static \| -prefer-pic \| -prefer-non-pic)
	func_append later " $arg"
	continue
	;;

	-no-suppress)
	suppress_opt=no
	continue
	;;

	-Xcompiler)
	arg_mode=arg # the next one goes into the "base_compile" arg list
	continue # The current "srcfile" will either be retained or
	;; # replaced later. I would guess that would be a bug.

	-Wc,*)
	func_stripname '-Wc,' '' "$arg"
	args=$func_stripname_result
	lastarg=
	save_ifs=$IFS; IFS=,
	for arg in $args; do
	IFS=$save_ifs
	func_append_quoted lastarg "$arg"
	done
	IFS=$save_ifs
	func_stripname ' ' '' "$lastarg"
	lastarg=$func_stripname_result

	# Add the arguments to base_compile.
	func_append base_compile " $lastarg"
	continue
	;;

	*)
	# Accept the current argument as the source file.
	# The previous "srcfile" becomes the current argument.
	#
	lastarg=$srcfile
	srcfile=$arg
	;;
	esac # case $arg
	;;
	esac # case $arg_mode

	# Aesthetically quote the previous argument.
	func_append_quoted base_compile "$lastarg"
	done # for arg

	case $arg_mode in
	arg)
	func_fatal_error "you must specify an argument for -Xcompile"
	;;
	target)
	func_fatal_error "you must specify a target with '-o'"
	;;
	*)
	# Get the name of the library object.
	test -z "$libobj" && {
	func_basename "$srcfile"
	libobj=$func_basename_result
	}
	;;
	esac

	# Recognize several different file suffixes.
	# If the user specifies -o file.o, it is replaced with file.lo
	case $libobj in
	*.[cCFSifmso] \| \
	.ada \| .adb \| .ads \| .asm \| \
	.c++ \| .cc \| .ii \| .class \| .cpp \| .cxx \| \
	.[fF][09]? \| .for \| .java \| .go \| .obj \| .sx \| .cu \| .cup)
	func_xform "$libobj"
	libobj=$func_xform_result
	;;
	esac

	case $libobj in
	*.lo) func_lo2o "$libobj"; obj=$func_lo2o_result ;;
	*)
	func_fatal_error "cannot determine name of library object from '$libobj'"
	;;
	esac

	func_infer_tag $base_compile

	for arg in $later; do
	case $arg in
	-shared)
	test yes = "$build_libtool_libs" \
	\|\| func_fatal_configuration "cannot build a shared library"
	build_old_libs=no
	continue
	;;

	-static)
	build_libtool_libs=no
	build_old_libs=yes
	continue
	;;

	-prefer-pic)
	pic_mode=yes
	continue
	;;

	-prefer-non-pic)
	pic_mode=no
	continue
	;;
	esac
	done

	func_quote_for_eval "$libobj"
	test "X$libobj" != "X$func_quote_for_eval_result" \
	&& $ECHO "X$libobj" \| $GREP '[]~#^*{};<>?"'"'"' &()\|`$[]' \
	&& func_warning "libobj name '$libobj' may not contain shell special characters."
	func_dirname_and_basename "$obj" "/" ""
	objname=$func_basename_result
	xdir=$func_dirname_result
	lobj=$xdir$objdir/$objname

	test -z "$base_compile" && \
	func_fatal_help "you must specify a compilation command"

	# Delete any leftover library objects.
	if test yes = "$build_old_libs"; then
	removelist="$obj $lobj $libobj ${libobj}T"
	else
	removelist="$lobj $libobj ${libobj}T"
	fi

	# On Cygwin there's no "real" PIC flag so we must build both object types
	case $host_os in
	cygwin* \| mingw* \| pw32* \| os2* \| cegcc*)
	pic_mode=default
	;;
	esac
	if test no = "$pic_mode" && test pass_all != "$deplibs_check_method"; then
	# non-PIC code in shared libraries is not supported
	pic_mode=default
	fi

	# Calculate the filename of the output object if compiler does
	# not support -o with -c
	if test no = "$compiler_c_o"; then
	output_obj=`$ECHO "$srcfile" \| $SED 's%^./%%; s%\.[^.]$%%'`.$objext
	lockfile=$output_obj.lock
	else
	output_obj=
	need_locks=no
	lockfile=
	fi

	# Lock this critical section if it is needed
	# We use this script file to make the link, it avoids creating a new file
	if test yes = "$need_locks"; then
	until $opt_dry_run \|\| ln "$progpath" "$lockfile" 2>/dev/null; do
	func_echo "Waiting for $lockfile to be removed"
	sleep 2
	done
	elif test warn = "$need_locks"; then
	if test -f "$lockfile"; then
	$ECHO "\
	*** ERROR, $lockfile exists and contains:
	`cat $lockfile 2>/dev/null`

	This indicates that another process is trying to use the same
	temporary object file, and libtool could not work around it because
	your compiler does not support '-c' and '-o' together. If you
	repeat this compilation, it may succeed, by chance, but you had better
	avoid parallel builds (make -j) in this platform, or get a better
	compiler."

	$opt_dry_run \|\| $RM $removelist
	exit $EXIT_FAILURE
	fi
	func_append removelist " $output_obj"
	$ECHO "$srcfile" > "$lockfile"
	fi

	$opt_dry_run \|\| $RM $removelist
	func_append removelist " $lockfile"
	trap '$opt_dry_run \|\| $RM $removelist; exit $EXIT_FAILURE' 1 2 15

	func_to_tool_file "$srcfile" func_convert_file_msys_to_w32
	srcfile=$func_to_tool_file_result
	func_quote_for_eval "$srcfile"
	qsrcfile=$func_quote_for_eval_result

	# Only build a PIC object if we are building libtool libraries.
	if test yes = "$build_libtool_libs"; then
	# Without this assignment, base_compile gets emptied.
	fbsd_hideous_sh_bug=$base_compile

	if test no != "$pic_mode"; then
	command="$base_compile $qsrcfile $pic_flag"
	else
	# Don't build PIC code
	command="$base_compile $qsrcfile"
	fi

	func_mkdir_p "$xdir$objdir"

	if test -z "$output_obj"; then
	# Place PIC objects in $objdir
	func_append command " -o $lobj"
	fi

	func_show_eval_locale "$command" \
	'test -n "$output_obj" && $RM $removelist; exit $EXIT_FAILURE'

	if test warn = "$need_locks" &&
	test "X`cat $lockfile 2>/dev/null`" != "X$srcfile"; then
	$ECHO "\
	*** ERROR, $lockfile contains:
	`cat $lockfile 2>/dev/null`

	but it should contain:
	$srcfile

	This indicates that another process is trying to use the same
	temporary object file, and libtool could not work around it because
	your compiler does not support '-c' and '-o' together. If you
	repeat this compilation, it may succeed, by chance, but you had better
	avoid parallel builds (make -j) in this platform, or get a better
	compiler."

	$opt_dry_run \|\| $RM $removelist
	exit $EXIT_FAILURE
	fi

	# Just move the object if needed, then go on to compile the next one
	if test -n "$output_obj" && test "X$output_obj" != "X$lobj"; then
	func_show_eval '$MV "$output_obj" "$lobj"' \
	'error=$?; $opt_dry_run \|\| $RM $removelist; exit $error'
	fi

	# Allow error messages only from the first compilation.
	if test yes = "$suppress_opt"; then
	suppress_output=' >/dev/null 2>&1'
	fi
	fi

	# Only build a position-dependent object if we build old libraries.
	if test yes = "$build_old_libs"; then
	if test yes != "$pic_mode"; then
	# Don't build PIC code
	command="$base_compile $qsrcfile$pie_flag"
	else
	command="$base_compile $qsrcfile $pic_flag"
	fi
	if test yes = "$compiler_c_o"; then
	func_append command " -o $obj"
	fi

	# Suppress compiler output if we already did a PIC compilation.
	func_append command "$suppress_output"
	func_show_eval_locale "$command" \
	'$opt_dry_run \|\| $RM $removelist; exit $EXIT_FAILURE'

	if test warn = "$need_locks" &&
	test "X`cat $lockfile 2>/dev/null`" != "X$srcfile"; then
	$ECHO "\
	*** ERROR, $lockfile contains:
	`cat $lockfile 2>/dev/null`

	but it should contain:
	$srcfile

	This indicates that another process is trying to use the same
	temporary object file, and libtool could not work around it because
	your compiler does not support '-c' and '-o' together. If you
	repeat this compilation, it may succeed, by chance, but you had better
	avoid parallel builds (make -j) in this platform, or get a better
	compiler."

	$opt_dry_run \|\| $RM $removelist
	exit $EXIT_FAILURE
	fi

	# Just move the object if needed
	if test -n "$output_obj" && test "X$output_obj" != "X$obj"; then
	func_show_eval '$MV "$output_obj" "$obj"' \
	'error=$?; $opt_dry_run \|\| $RM $removelist; exit $error'
	fi
	fi

	$opt_dry_run \|\| {
	func_write_libtool_object "$libobj" "$objdir/$objname" "$objname"

	# Unlock the critical section if it was locked
	if test no != "$need_locks"; then
	removelist=$lockfile
	$RM "$lockfile"
	fi
	}

	exit $EXIT_SUCCESS
	}

	$opt_help \|\| {
	test compile = "$opt_mode" && func_mode_compile ${1+"$@"}
	}

	func_mode_help ()
	{
	# We need to display help for each of the modes.
	case $opt_mode in
	"")
	# Generic help is extracted from the usage comments
	# at the start of this file.
	func_help
	;;

	clean)
	$ECHO \
	"Usage: $progname [OPTION]... --mode=clean RM [RM-OPTION]... FILE...

	Remove files from the build directory.

	RM is the name of the program to use to delete files associated with each FILE
	(typically '/bin/rm'). RM-OPTIONS are options (such as '-f') to be passed
	to RM.

	If FILE is a libtool library, object or program, all the files associated
	with it are deleted. Otherwise, only FILE itself is deleted using RM."
	;;

	compile)
	$ECHO \
	"Usage: $progname [OPTION]... --mode=compile COMPILE-COMMAND... SOURCEFILE

	Compile a source file into a libtool library object.

	This mode accepts the following additional options:

	-o OUTPUT-FILE set the output file name to OUTPUT-FILE
	-no-suppress do not suppress compiler output for multiple passes
	-prefer-pic try to build PIC objects only
	-prefer-non-pic try to build non-PIC objects only
	-shared do not build a '.o' file suitable for static linking
	-static only build a '.o' file suitable for static linking
	-Wc,FLAG pass FLAG directly to the compiler

	COMPILE-COMMAND is a command to be used in creating a 'standard' object file
	from the given SOURCEFILE.

	The output file name is determined by removing the directory component from
	SOURCEFILE, then substituting the C source code suffix '.c' with the
	library object suffix, '.lo'."
	;;

	execute)
	$ECHO \
	"Usage: $progname [OPTION]... --mode=execute COMMAND [ARGS]...

	Automatically set library path, then run a program.

	This mode accepts the following additional options:

	-dlopen FILE add the directory containing FILE to the library path

	This mode sets the library path environment variable according to '-dlopen'
	flags.

	If any of the ARGS are libtool executable wrappers, then they are translated
	into their corresponding uninstalled binary, and any of their required library
	directories are added to the library path.

	Then, COMMAND is executed, with ARGS as arguments."
	;;

	finish)
	$ECHO \
	"Usage: $progname [OPTION]... --mode=finish [LIBDIR]...

	Complete the installation of libtool libraries.

	Each LIBDIR is a directory that contains libtool libraries.

	The commands that this mode executes may require superuser privileges. Use
	the '--dry-run' option if you just want to see what would be executed."
	;;

	install)
	$ECHO \
	"Usage: $progname [OPTION]... --mode=install INSTALL-COMMAND...

	Install executables or libraries.

	INSTALL-COMMAND is the installation command. The first component should be
	either the 'install' or 'cp' program.

	The following components of INSTALL-COMMAND are treated specially:

	-inst-prefix-dir PREFIX-DIR Use PREFIX-DIR as a staging area for installation

	The rest of the components are interpreted as arguments to that command (only
	BSD-compatible install options are recognized)."
	;;

	link)
	$ECHO \
	"Usage: $progname [OPTION]... --mode=link LINK-COMMAND...

	Link object files or libraries together to form another library, or to
	create an executable program.

	LINK-COMMAND is a command using the C compiler that you would use to create
	a program from several object files.

	The following components of LINK-COMMAND are treated specially:

	-all-static do not do any dynamic linking at all
	-avoid-version do not add a version suffix if possible
	-bindir BINDIR specify path to binaries directory (for systems where
	libraries must be found in the PATH setting at runtime)
	-dlopen FILE '-dlpreopen' FILE if it cannot be dlopened at runtime
	-dlpreopen FILE link in FILE and add its symbols to lt_preloaded_symbols
	-export-dynamic allow symbols from OUTPUT-FILE to be resolved with dlsym(3)
	-export-symbols SYMFILE
	try to export only the symbols listed in SYMFILE
	-export-symbols-regex REGEX
	try to export only the symbols matching REGEX
	-LLIBDIR search LIBDIR for required installed libraries
	-lNAME OUTPUT-FILE requires the installed library libNAME
	-module build a library that can dlopened
	-no-fast-install disable the fast-install mode
	-no-install link a not-installable executable
	-no-undefined declare that a library does not refer to external symbols
	-o OUTPUT-FILE create OUTPUT-FILE from the specified objects
	-objectlist FILE use a list of object files found in FILE to specify objects
	-os2dllname NAME force a short DLL name on OS/2 (no effect on other OSes)
	-precious-files-regex REGEX
	don't remove output files matching REGEX
	-release RELEASE specify package release information
	-rpath LIBDIR the created library will eventually be installed in LIBDIR
	-R[ ]LIBDIR add LIBDIR to the runtime path of programs and libraries
	-shared only do dynamic linking of libtool libraries
	-shrext SUFFIX override the standard shared library file extension
	-static do not do any dynamic linking of uninstalled libtool libraries
	-static-libtool-libs
	do not do any dynamic linking of libtool libraries
	-version-info CURRENT[:REVISION[:AGE]]
	specify library version info [each variable defaults to 0]
	-weak LIBNAME declare that the target provides the LIBNAME interface
	-Wc,FLAG
	-Xcompiler FLAG pass linker-specific FLAG directly to the compiler
	-Wl,FLAG
	-Xlinker FLAG pass linker-specific FLAG directly to the linker
	-XCClinker FLAG pass link-specific FLAG to the compiler driver (CC)

	All other options (arguments beginning with '-') are ignored.

	Every other argument is treated as a filename. Files ending in '.la' are
	treated as uninstalled libtool libraries, other files are standard or library
	object files.

	If the OUTPUT-FILE ends in '.la', then a libtool library is created,
	only library objects ('.lo' files) may be specified, and '-rpath' is
	required, except when creating a convenience library.

	If OUTPUT-FILE ends in '.a' or '.lib', then a standard library is created
	using 'ar' and 'ranlib', or on Windows using 'lib'.

	If OUTPUT-FILE ends in '.lo' or '.$objext', then a reloadable object file
	is created, otherwise an executable program is created."
	;;

	uninstall)
	$ECHO \
	"Usage: $progname [OPTION]... --mode=uninstall RM [RM-OPTION]... FILE...

	Remove libraries from an installation directory.

	RM is the name of the program to use to delete files associated with each FILE
	(typically '/bin/rm'). RM-OPTIONS are options (such as '-f') to be passed
	to RM.

	If FILE is a libtool library, all the files associated with it are deleted.
	Otherwise, only FILE itself is deleted using RM."
	;;

	*)
	func_fatal_help "invalid operation mode '$opt_mode'"
	;;
	esac

	echo
	$ECHO "Try '$progname --help' for more information about other modes."
	}

	# Now that we've collected a possible --mode arg, show help if necessary
	if $opt_help; then
	if test : = "$opt_help"; then
	func_mode_help
	else
	{
	func_help noexit
	for opt_mode in compile link execute install finish uninstall clean; do
	func_mode_help
	done
	} \| $SED -n '1p; 2,$s/^Usage:/ or: /p'
	{
	func_help noexit
	for opt_mode in compile link execute install finish uninstall clean; do
	echo
	func_mode_help
	done
	} \|
	$SED '1d
	/^When reporting/,/^Report/{
	H
	d
	}
	$x
	/information about other modes/d
	/more detailed .*MODE/d
	s/^Usage:.--mode=$[^ ]$ .*/Description of \1 mode:/'
	fi
	exit $?
	fi


	# func_mode_execute arg...
	func_mode_execute ()
	{
	$debug_cmd

	# The first argument is the command name.
	cmd=$nonopt
	test -z "$cmd" && \
	func_fatal_help "you must specify a COMMAND"

	# Handle -dlopen flags immediately.
	for file in $opt_dlopen; do
	test -f "$file" \
	\|\| func_fatal_help "'$file' is not a file"

	dir=
	case $file in
	*.la)
	func_resolve_sysroot "$file"
	file=$func_resolve_sysroot_result

	# Check to see that this really is a libtool archive.
	func_lalib_unsafe_p "$file" \
	\|\| func_fatal_help "'$lib' is not a valid libtool archive"

	# Read the libtool library.
	dlname=
	library_names=
	func_source "$file"

	# Skip this library if it cannot be dlopened.
	if test -z "$dlname"; then
	# Warn if it was a shared library.
	test -n "$library_names" && \
	func_warning "'$file' was not linked with '-export-dynamic'"
	continue
	fi

	func_dirname "$file" "" "."
	dir=$func_dirname_result

	if test -f "$dir/$objdir/$dlname"; then
	func_append dir "/$objdir"
	else
	if test ! -f "$dir/$dlname"; then
	func_fatal_error "cannot find '$dlname' in '$dir' or '$dir/$objdir'"
	fi
	fi
	;;

	*.lo)
	# Just add the directory containing the .lo file.
	func_dirname "$file" "" "."
	dir=$func_dirname_result
	;;

	*)
	func_warning "'-dlopen' is ignored for non-libtool libraries and objects"
	continue
	;;
	esac

	# Get the absolute pathname.
	absdir=`cd "$dir" && pwd`
	test -n "$absdir" && dir=$absdir

	# Now add the directory to shlibpath_var.
	if eval "test -z \"\$$shlibpath_var\""; then
	eval "$shlibpath_var=\"\$dir\""
	else
	eval "$shlibpath_var=\"\$dir:\$$shlibpath_var\""
	fi
	done

	# This variable tells wrapper scripts just to set shlibpath_var
	# rather than running their programs.
	libtool_execute_magic=$magic

	# Check if any of the arguments is a wrapper script.
	args=
	for file
	do
	case $file in
	-* \| .la \| .lo ) ;;
	*)
	# Do a test to see if this is really a libtool program.
	if func_ltwrapper_script_p "$file"; then
	func_source "$file"
	# Transform arg to wrapped name.
	file=$progdir/$program
	elif func_ltwrapper_executable_p "$file"; then
	func_ltwrapper_scriptname "$file"
	func_source "$func_ltwrapper_scriptname_result"
	# Transform arg to wrapped name.
	file=$progdir/$program
	fi
	;;
	esac
	# Quote arguments (to preserve shell metacharacters).
	func_append_quoted args "$file"
	done

	if $opt_dry_run; then
	# Display what would be done.
	if test -n "$shlibpath_var"; then
	eval "\$ECHO \"\$shlibpath_var=\$$shlibpath_var\""
	echo "export $shlibpath_var"
	fi
	$ECHO "$cmd$args"
	exit $EXIT_SUCCESS
	else
	if test -n "$shlibpath_var"; then
	# Export the shlibpath_var.
	eval "export $shlibpath_var"
	fi

	# Restore saved environment variables
	for lt_var in LANG LANGUAGE LC_ALL LC_CTYPE LC_COLLATE LC_MESSAGES
	do
	eval "if test \"\${save_$lt_var+set}\" = set; then
	$lt_var=\$save_$lt_var; export $lt_var
	else
	$lt_unset $lt_var
	fi"
	done

	# Now prepare to actually exec the command.
	exec_cmd=\$cmd$args
	fi
	}

	test execute = "$opt_mode" && func_mode_execute ${1+"$@"}


	# func_mode_finish arg...
	func_mode_finish ()
	{
	$debug_cmd

	libs=
	libdirs=
	admincmds=

	for opt in "$nonopt" ${1+"$@"}
	do
	if test -d "$opt"; then
	func_append libdirs " $opt"

	elif test -f "$opt"; then
	if func_lalib_unsafe_p "$opt"; then
	func_append libs " $opt"
	else
	func_warning "'$opt' is not a valid libtool archive"
	fi

	else
	func_fatal_error "invalid argument '$opt'"
	fi
	done

	if test -n "$libs"; then
	if test -n "$lt_sysroot"; then
	sysroot_regex=`$ECHO "$lt_sysroot" \| $SED "$sed_make_literal_regex"`
	sysroot_cmd="s/$[ ']$$sysroot_regex/\1/g;"
	else
	sysroot_cmd=
	fi

	# Remove sysroot references
	if $opt_dry_run; then
	for lib in $libs; do
	echo "removing references to $lt_sysroot and '=' prefixes from $lib"
	done
	else
	tmpdir=`func_mktempdir`
	for lib in $libs; do
	$SED -e "$sysroot_cmd s/$[ ']-[LR]$=/\1/g; s/$[ ']$=/\1/g" $lib \
	> $tmpdir/tmp-la
	mv -f $tmpdir/tmp-la $lib
	done
	${RM}r "$tmpdir"
	fi
	fi

	if test -n "$finish_cmds$finish_eval" && test -n "$libdirs"; then
	for libdir in $libdirs; do
	if test -n "$finish_cmds"; then
	# Do each command in the finish commands.
	func_execute_cmds "$finish_cmds" 'admincmds="$admincmds
	'"$cmd"'"'
	fi
	if test -n "$finish_eval"; then
	# Do the single finish_eval.
	eval cmds=\"$finish_eval\"
	$opt_dry_run \|\| eval "$cmds" \|\| func_append admincmds "
	$cmds"
	fi
	done
	fi

	# Exit here if they wanted silent mode.
	$opt_quiet && exit $EXIT_SUCCESS

	if test -n "$finish_cmds$finish_eval" && test -n "$libdirs"; then
	echo "----------------------------------------------------------------------"
	echo "Libraries have been installed in:"
	for libdir in $libdirs; do
	$ECHO " $libdir"
	done
	echo
	echo "If you ever happen to want to link against installed libraries"
	echo "in a given directory, LIBDIR, you must either use libtool, and"
	echo "specify the full pathname of the library, or use the '-LLIBDIR'"
	echo "flag during linking and do at least one of the following:"
	if test -n "$shlibpath_var"; then
	echo " - add LIBDIR to the '$shlibpath_var' environment variable"
	echo " during execution"
	fi
	if test -n "$runpath_var"; then
	echo " - add LIBDIR to the '$runpath_var' environment variable"
	echo " during linking"
	fi
	if test -n "$hardcode_libdir_flag_spec"; then
	libdir=LIBDIR
	eval flag=\"$hardcode_libdir_flag_spec\"

	$ECHO " - use the '$flag' linker flag"
	fi
	if test -n "$admincmds"; then
	$ECHO " - have your system administrator run these commands:$admincmds"
	fi
	if test -f /etc/ld.so.conf; then
	echo " - have your system administrator add LIBDIR to '/etc/ld.so.conf'"
	fi
	echo

	echo "See any operating system documentation about shared libraries for"
	case $host in
	solaris2.[6789]\|solaris2.1[0-9])
	echo "more information, such as the ld(1), crle(1) and ld.so(8) manual"
	echo "pages."
	;;
	*)
	echo "more information, such as the ld(1) and ld.so(8) manual pages."
	;;
	esac
	echo "----------------------------------------------------------------------"
	fi
	exit $EXIT_SUCCESS
	}

	test finish = "$opt_mode" && func_mode_finish ${1+"$@"}


	# func_mode_install arg...
	func_mode_install ()
	{
	$debug_cmd

	# There may be an optional sh(1) argument at the beginning of
	# install_prog (especially on Windows NT).
	if test "$SHELL" = "$nonopt" \|\| test /bin/sh = "$nonopt" \|\|
	# Allow the use of GNU shtool's install command.
	case $nonopt in shtool) :;; *) false;; esac
	then
	# Aesthetically quote it.
	func_quote_for_eval "$nonopt"
	install_prog="$func_quote_for_eval_result "
	arg=$1
	shift
	else
	install_prog=
	arg=$nonopt
	fi

	# The real first argument should be the name of the installation program.
	# Aesthetically quote it.
	func_quote_for_eval "$arg"
	func_append install_prog "$func_quote_for_eval_result"
	install_shared_prog=$install_prog
	case " $install_prog " in
	[\\\ /]cp\ ) install_cp=: ;;
	*) install_cp=false ;;
	esac

	# We need to accept at least all the BSD install flags.
	dest=
	files=
	opts=
	prev=
	install_type=
	isdir=false
	stripme=
	no_mode=:
	for arg
	do
	arg2=
	if test -n "$dest"; then
	func_append files " $dest"
	dest=$arg
	continue
	fi

	case $arg in
	-d) isdir=: ;;
	-f)
	if $install_cp; then :; else
	prev=$arg
	fi
	;;
	-g \| -m \| -o)
	prev=$arg
	;;
	-s)
	stripme=" -s"
	continue
	;;
	-*)
	;;
	*)
	# If the previous option needed an argument, then skip it.
	if test -n "$prev"; then
	if test X-m = "X$prev" && test -n "$install_override_mode"; then
	arg2=$install_override_mode
	no_mode=false
	fi
	prev=
	else
	dest=$arg
	continue
	fi
	;;
	esac

	# Aesthetically quote the argument.
	func_quote_for_eval "$arg"
	func_append install_prog " $func_quote_for_eval_result"
	if test -n "$arg2"; then
	func_quote_for_eval "$arg2"
	fi
	func_append install_shared_prog " $func_quote_for_eval_result"
	done

	test -z "$install_prog" && \
	func_fatal_help "you must specify an install program"

	test -n "$prev" && \
	func_fatal_help "the '$prev' option requires an argument"

	if test -n "$install_override_mode" && $no_mode; then
	if $install_cp; then :; else
	func_quote_for_eval "$install_override_mode"
	func_append install_shared_prog " -m $func_quote_for_eval_result"
	fi
	fi

	if test -z "$files"; then
	if test -z "$dest"; then
	func_fatal_help "no file or destination specified"
	else
	func_fatal_help "you must specify a destination"
	fi
	fi

	# Strip any trailing slash from the destination.
	func_stripname '' '/' "$dest"
	dest=$func_stripname_result

	# Check to see that the destination is a directory.
	test -d "$dest" && isdir=:
	if $isdir; then
	destdir=$dest
	destname=
	else
	func_dirname_and_basename "$dest" "" "."
	destdir=$func_dirname_result
	destname=$func_basename_result

	# Not a directory, so check to see that there is only one file specified.
	set dummy $files; shift
	test "$#" -gt 1 && \
	func_fatal_help "'$dest' is not a directory"
	fi
	case $destdir in
	[\\/]* \| [A-Za-z]:[\\/]*) ;;
	*)
	for file in $files; do
	case $file in
	*.lo) ;;
	*)
	func_fatal_help "'$destdir' must be an absolute directory name"
	;;
	esac
	done
	;;
	esac

	# This variable tells wrapper scripts just to set variables rather
	# than running their programs.
	libtool_install_magic=$magic

	staticlibs=
	future_libdirs=
	current_libdirs=
	for file in $files; do

	# Do each installation.
	case $file in
	*.$libext)
	# Do the static libraries later.
	func_append staticlibs " $file"
	;;

	*.la)
	func_resolve_sysroot "$file"
	file=$func_resolve_sysroot_result

	# Check to see that this really is a libtool archive.
	func_lalib_unsafe_p "$file" \
	\|\| func_fatal_help "'$file' is not a valid libtool archive"

	library_names=
	old_library=
	relink_command=
	func_source "$file"

	# Add the libdir to current_libdirs if it is the destination.
	if test "X$destdir" = "X$libdir"; then
	case "$current_libdirs " in
	" $libdir ") ;;
	*) func_append current_libdirs " $libdir" ;;
	esac
	else
	# Note the libdir as a future libdir.
	case "$future_libdirs " in
	" $libdir ") ;;
	*) func_append future_libdirs " $libdir" ;;
	esac
	fi

	func_dirname "$file" "/" ""
	dir=$func_dirname_result
	func_append dir "$objdir"

	if test -n "$relink_command"; then
	# Determine the prefix the user has applied to our future dir.
	inst_prefix_dir=`$ECHO "$destdir" \| $SED -e "s%$libdir\$%%"`

	# Don't allow the user to place us outside of our expected
	# location b/c this prevents finding dependent libraries that
	# are installed to the same prefix.
	# At present, this check doesn't affect windows .dll's that
	# are installed into $libdir/../bin (currently, that works fine)
	# but it's something to keep an eye on.
	test "$inst_prefix_dir" = "$destdir" && \
	func_fatal_error "error: cannot install '$file' to a directory not ending in $libdir"

	if test -n "$inst_prefix_dir"; then
	# Stick the inst_prefix_dir data into the link command.
	relink_command=`$ECHO "$relink_command" \| $SED "s%@inst_prefix_dir@%-inst-prefix-dir $inst_prefix_dir%"`
	else
	relink_command=`$ECHO "$relink_command" \| $SED "s%@inst_prefix_dir@%%"`
	fi

	func_warning "relinking '$file'"
	func_show_eval "$relink_command" \
	'func_fatal_error "error: relink '\''$file'\'' with the above command before installing it"'
	fi

	# See the names of the shared library.
	set dummy $library_names; shift
	if test -n "$1"; then
	realname=$1
	shift

	srcname=$realname
	test -n "$relink_command" && srcname=${realname}T

	# Install the shared library and build the symlinks.
	func_show_eval "$install_shared_prog $dir/$srcname $destdir/$realname" \
	'exit $?'
	tstripme=$stripme
	case $host_os in
	cygwin* \| mingw* \| pw32* \| cegcc*)
	case $realname in
	*.dll.a)
	tstripme=
	;;
	esac
	;;
	os2*)
	case $realname in
	*_dll.a)
	tstripme=
	;;
	esac
	;;
	esac
	if test -n "$tstripme" && test -n "$striplib"; then
	func_show_eval "$striplib $destdir/$realname" 'exit $?'
	fi

	if test "$#" -gt 0; then
	# Delete the old symlinks, and create new ones.
	# Try 'ln -sf' first, because the 'ln' binary might depend on
	# the symlink we replace! Solaris /bin/ln does not understand -f,
	# so we also need to try rm && ln -s.
	for linkname
	do
	test "$linkname" != "$realname" \
	&& func_show_eval "(cd $destdir && { $LN_S -f $realname $linkname \|\| { $RM $linkname && $LN_S $realname $linkname; }; })"
	done
	fi

	# Do each command in the postinstall commands.
	lib=$destdir/$realname
	func_execute_cmds "$postinstall_cmds" 'exit $?'
	fi

	# Install the pseudo-library for information purposes.
	func_basename "$file"
	name=$func_basename_result
	instname=$dir/${name}i
	func_show_eval "$install_prog $instname $destdir/$name" 'exit $?'

	# Maybe install the static library, too.
	test -n "$old_library" && func_append staticlibs " $dir/$old_library"
	;;

	*.lo)
	# Install (i.e. copy) a libtool object.

	# Figure out destination file name, if it wasn't already specified.
	if test -n "$destname"; then
	destfile=$destdir/$destname
	else
	func_basename "$file"
	destfile=$func_basename_result
	destfile=$destdir/$destfile
	fi

	# Deduce the name of the destination old-style object file.
	case $destfile in
	*.lo)
	func_lo2o "$destfile"
	staticdest=$func_lo2o_result
	;;
	*.$objext)
	staticdest=$destfile
	destfile=
	;;
	*)
	func_fatal_help "cannot copy a libtool object to '$destfile'"
	;;
	esac

	# Install the libtool object if requested.
	test -n "$destfile" && \
	func_show_eval "$install_prog $file $destfile" 'exit $?'

	# Install the old object if enabled.
	if test yes = "$build_old_libs"; then
	# Deduce the name of the old-style object file.
	func_lo2o "$file"
	staticobj=$func_lo2o_result
	func_show_eval "$install_prog \$staticobj \$staticdest" 'exit $?'
	fi
	exit $EXIT_SUCCESS
	;;

	*)
	# Figure out destination file name, if it wasn't already specified.
	if test -n "$destname"; then
	destfile=$destdir/$destname
	else
	func_basename "$file"
	destfile=$func_basename_result
	destfile=$destdir/$destfile
	fi

	# If the file is missing, and there is a .exe on the end, strip it
	# because it is most likely a libtool script we actually want to
	# install
	stripped_ext=
	case $file in
	*.exe)
	if test ! -f "$file"; then
	func_stripname '' '.exe' "$file"
	file=$func_stripname_result
	stripped_ext=.exe
	fi
	;;
	esac

	# Do a test to see if this is really a libtool program.
	case $host in
	cygwin \| mingw)
	if func_ltwrapper_executable_p "$file"; then
	func_ltwrapper_scriptname "$file"
	wrapper=$func_ltwrapper_scriptname_result
	else
	func_stripname '' '.exe' "$file"
	wrapper=$func_stripname_result
	fi
	;;
	*)
	wrapper=$file
	;;
	esac
	if func_ltwrapper_script_p "$wrapper"; then
	notinst_deplibs=
	relink_command=

	func_source "$wrapper"

	# Check the variables that should have been set.
	test -z "$generated_by_libtool_version" && \
	func_fatal_error "invalid libtool wrapper script '$wrapper'"

	finalize=:
	for lib in $notinst_deplibs; do
	# Check to see that each library is installed.
	libdir=
	if test -f "$lib"; then
	func_source "$lib"
	fi
	libfile=$libdir/`$ECHO "$lib" \| $SED 's%^.*/%%g'`
	if test -n "$libdir" && test ! -f "$libfile"; then
	func_warning "'$lib' has not been installed in '$libdir'"
	finalize=false
	fi
	done

	relink_command=
	func_source "$wrapper"

	outputname=
	if test no = "$fast_install" && test -n "$relink_command"; then
	$opt_dry_run \|\| {
	if $finalize; then
	tmpdir=`func_mktempdir`
	func_basename "$file$stripped_ext"
	file=$func_basename_result
	outputname=$tmpdir/$file
	# Replace the output file specification.
	relink_command=`$ECHO "$relink_command" \| $SED 's%@OUTPUT@%'"$outputname"'%g'`

	$opt_quiet \|\| {
	func_quote_for_expand "$relink_command"
	eval "func_echo $func_quote_for_expand_result"
	}
	if eval "$relink_command"; then :
	else
	func_error "error: relink '$file' with the above command before installing it"
	$opt_dry_run \|\| ${RM}r "$tmpdir"
	continue
	fi
	file=$outputname
	else
	func_warning "cannot relink '$file'"
	fi
	}
	else
	# Install the binary that we compiled earlier.
	file=`$ECHO "$file$stripped_ext" \| $SED "s%$[^/]*$$%$objdir/\1%"`
	fi
	fi

	# remove .exe since cygwin /usr/bin/install will append another
	# one anyway
	case $install_prog,$host in
	/usr/bin/install,cygwin)
	case $file:$destfile in
	.exe:.exe)
	# this is ok
	;;
	.exe:)
	destfile=$destfile.exe
	;;
	:.exe)
	func_stripname '' '.exe' "$destfile"
	destfile=$func_stripname_result
	;;
	esac
	;;
	esac
	func_show_eval "$install_prog\$stripme \$file \$destfile" 'exit $?'
	$opt_dry_run \|\| if test -n "$outputname"; then
	${RM}r "$tmpdir"
	fi
	;;
	esac
	done

	for file in $staticlibs; do
	func_basename "$file"
	name=$func_basename_result

	# Set up the ranlib parameters.
	oldlib=$destdir/$name
	func_to_tool_file "$oldlib" func_convert_file_msys_to_w32
	tool_oldlib=$func_to_tool_file_result

	func_show_eval "$install_prog \$file \$oldlib" 'exit $?'

	if test -n "$stripme" && test -n "$old_striplib"; then
	func_show_eval "$old_striplib $tool_oldlib" 'exit $?'
	fi

	# Do each command in the postinstall commands.
	func_execute_cmds "$old_postinstall_cmds" 'exit $?'
	done

	test -n "$future_libdirs" && \
	func_warning "remember to run '$progname --finish$future_libdirs'"

	if test -n "$current_libdirs"; then
	# Maybe just do a dry run.
	$opt_dry_run && current_libdirs=" -n$current_libdirs"
	exec_cmd='$SHELL "$progpath" $preserve_args --finish$current_libdirs'
	else
	exit $EXIT_SUCCESS
	fi
	}

	test install = "$opt_mode" && func_mode_install ${1+"$@"}


	# func_generate_dlsyms outputname originator pic_p
	# Extract symbols from dlprefiles and create ${outputname}S.o with
	# a dlpreopen symbol table.
	func_generate_dlsyms ()
	{
	$debug_cmd

	my_outputname=$1
	my_originator=$2
	my_pic_p=${3-false}
	my_prefix=`$ECHO "$my_originator" \| $SED 's%[^a-zA-Z0-9]%_%g'`
	my_dlsyms=

	if test -n "$dlfiles$dlprefiles" \|\| test no != "$dlself"; then
	if test -n "$NM" && test -n "$global_symbol_pipe"; then
	my_dlsyms=${my_outputname}S.c
	else
	func_error "not configured to extract global symbols from dlpreopened files"
	fi
	fi

	if test -n "$my_dlsyms"; then
	case $my_dlsyms in
	"") ;;
	*.c)
	# Discover the nlist of each of the dlfiles.
	nlist=$output_objdir/$my_outputname.nm

	func_show_eval "$RM $nlist ${nlist}S ${nlist}T"

	# Parse the name list into a source file.
	func_verbose "creating $output_objdir/$my_dlsyms"

	$opt_dry_run \|\| $ECHO > "$output_objdir/$my_dlsyms" "\
	/* $my_dlsyms - symbol resolution table for '$my_outputname' dlsym emulation. */
	/* Generated by $PROGRAM (GNU $PACKAGE) $VERSION */

	#ifdef __cplusplus
	extern \"C\" {
	#endif

	#if defined __GNUC__ && (((__GNUC__ == 4) && (__GNUC_MINOR__ >= 4)) \|\| (__GNUC__ > 4))
	#pragma GCC diagnostic ignored \"-Wstrict-prototypes\"
	#endif

	/* Keep this code in sync between libtool.m4, ltmain, lt_system.h, and tests. */
	#if defined _WIN32 \|\| defined __CYGWIN__ \|\| defined _WIN32_WCE
	/* DATA imports from DLLs on WIN32 can't be const, because runtime
	relocations are performed -- see ld's documentation on pseudo-relocs. */
	# define LT_DLSYM_CONST
	#elif defined __osf__
	/* This system does not cope well with relocations in const data. */
	# define LT_DLSYM_CONST
	#else
	# define LT_DLSYM_CONST const
	#endif

	#define STREQ(s1, s2) (strcmp ((s1), (s2)) == 0)

	/* External symbol declarations for the compiler. */\
	"

	if test yes = "$dlself"; then
	func_verbose "generating symbol list for '$output'"

	$opt_dry_run \|\| echo ': @PROGRAM@ ' > "$nlist"

	# Add our own program objects to the symbol list.
	progfiles=`$ECHO "$objs$old_deplibs" \| $SP2NL \| $SED "$lo2o" \| $NL2SP`
	for progfile in $progfiles; do
	func_to_tool_file "$progfile" func_convert_file_msys_to_w32
	func_verbose "extracting global C symbols from '$func_to_tool_file_result'"
	$opt_dry_run \|\| eval "$NM $func_to_tool_file_result \| $global_symbol_pipe >> '$nlist'"
	done

	if test -n "$exclude_expsyms"; then
	$opt_dry_run \|\| {
	eval '$EGREP -v " ($exclude_expsyms)$" "$nlist" > "$nlist"T'
	eval '$MV "$nlist"T "$nlist"'
	}
	fi

	if test -n "$export_symbols_regex"; then
	$opt_dry_run \|\| {
	eval '$EGREP -e "$export_symbols_regex" "$nlist" > "$nlist"T'
	eval '$MV "$nlist"T "$nlist"'
	}
	fi

	# Prepare the list of exported symbols
	if test -z "$export_symbols"; then
	export_symbols=$output_objdir/$outputname.exp
	$opt_dry_run \|\| {
	$RM $export_symbols
	eval "$SED -n -e '/^: @PROGRAM@ $/d' -e 's/^.* $.*$$/\1/p' "'< "$nlist" > "$export_symbols"'
	case $host in
	cygwin \| mingw \| cegcc )
	eval "echo EXPORTS "'> "$output_objdir/$outputname.def"'
	eval 'cat "$export_symbols" >> "$output_objdir/$outputname.def"'
	;;
	esac
	}
	else
	$opt_dry_run \|\| {
	eval "$SED -e 's/$[].[*^$]$/\\\\\1/g' -e 's/^/ /' -e 's/$/$/'"' < "$export_symbols" > "$output_objdir/$outputname.exp"'
	eval '$GREP -f "$output_objdir/$outputname.exp" < "$nlist" > "$nlist"T'
	eval '$MV "$nlist"T "$nlist"'
	case $host in
	cygwin \| mingw \| cegcc )
	eval "echo EXPORTS "'> "$output_objdir/$outputname.def"'
	eval 'cat "$nlist" >> "$output_objdir/$outputname.def"'
	;;
	esac
	}
	fi
	fi

	for dlprefile in $dlprefiles; do
	func_verbose "extracting global C symbols from '$dlprefile'"
	func_basename "$dlprefile"
	name=$func_basename_result
	case $host in
	cygwin \| mingw \| cegcc )
	# if an import library, we need to obtain dlname
	if func_win32_import_lib_p "$dlprefile"; then
	func_tr_sh "$dlprefile"
	eval "curr_lafile=\$libfile_$func_tr_sh_result"
	dlprefile_dlbasename=
	if test -n "$curr_lafile" && func_lalib_p "$curr_lafile"; then
	# Use subshell, to avoid clobbering current variable values
	dlprefile_dlname=`source "$curr_lafile" && echo "$dlname"`
	if test -n "$dlprefile_dlname"; then
	func_basename "$dlprefile_dlname"
	dlprefile_dlbasename=$func_basename_result
	else
	# no lafile. user explicitly requested -dlpreopen <import library>.
	$sharedlib_from_linklib_cmd "$dlprefile"
	dlprefile_dlbasename=$sharedlib_from_linklib_result
	fi
	fi
	$opt_dry_run \|\| {
	if test -n "$dlprefile_dlbasename"; then
	eval '$ECHO ": $dlprefile_dlbasename" >> "$nlist"'
	else
	func_warning "Could not compute DLL name from $name"
	eval '$ECHO ": $name " >> "$nlist"'
	fi
	func_to_tool_file "$dlprefile" func_convert_file_msys_to_w32
	eval "$NM \"$func_to_tool_file_result\" 2>/dev/null \| $global_symbol_pipe \|
	$SED -e '/I __imp/d' -e 's/I __nm_/D /;s/_nm__//' >> '$nlist'"
	}
	else # not an import lib
	$opt_dry_run \|\| {
	eval '$ECHO ": $name " >> "$nlist"'
	func_to_tool_file "$dlprefile" func_convert_file_msys_to_w32
	eval "$NM \"$func_to_tool_file_result\" 2>/dev/null \| $global_symbol_pipe >> '$nlist'"
	}
	fi
	;;
	*)
	$opt_dry_run \|\| {
	eval '$ECHO ": $name " >> "$nlist"'
	func_to_tool_file "$dlprefile" func_convert_file_msys_to_w32
	eval "$NM \"$func_to_tool_file_result\" 2>/dev/null \| $global_symbol_pipe >> '$nlist'"
	}
	;;
	esac
	done

	$opt_dry_run \|\| {
	# Make sure we have at least an empty file.
	test -f "$nlist" \|\| : > "$nlist"

	if test -n "$exclude_expsyms"; then
	$EGREP -v " ($exclude_expsyms)$" "$nlist" > "$nlist"T
	$MV "$nlist"T "$nlist"
	fi

	# Try sorting and uniquifying the output.
	if $GREP -v "^: " < "$nlist" \|
	if sort -k 3 </dev/null >/dev/null 2>&1; then
	sort -k 3
	else
	sort +2
	fi \|
	uniq > "$nlist"S; then
	:
	else
	$GREP -v "^: " < "$nlist" > "$nlist"S
	fi

	if test -f "$nlist"S; then
	eval "$global_symbol_to_cdecl"' < "$nlist"S >> "$output_objdir/$my_dlsyms"'
	else
	echo '/* NONE */' >> "$output_objdir/$my_dlsyms"
	fi

	func_show_eval '$RM "${nlist}I"'
	if test -n "$global_symbol_to_import"; then
	eval "$global_symbol_to_import"' < "$nlist"S > "$nlist"I'
	fi

	echo >> "$output_objdir/$my_dlsyms" "\

	/* The mapping between symbol names and symbols. */
	typedef struct {
	const char *name;
	void *address;
	} lt_dlsymlist;
	extern LT_DLSYM_CONST lt_dlsymlist
	lt_${my_prefix}_LTX_preloaded_symbols[];\
	"

	if test -s "$nlist"I; then
	echo >> "$output_objdir/$my_dlsyms" "\
	static void lt_syminit(void)
	{
	LT_DLSYM_CONST lt_dlsymlist *symbol = lt_${my_prefix}_LTX_preloaded_symbols;
	for (; symbol->name; ++symbol)
	{"
	$SED 's/./ if (STREQ (symbol->name, \"&\")) symbol->address = (void ) \&&;/' < "$nlist"I >> "$output_objdir/$my_dlsyms"
	echo >> "$output_objdir/$my_dlsyms" "\
	}
	}"
	fi
	echo >> "$output_objdir/$my_dlsyms" "\
	LT_DLSYM_CONST lt_dlsymlist
	lt_${my_prefix}_LTX_preloaded_symbols[] =
	{ {\"$my_originator\", (void *) 0},"

	if test -s "$nlist"I; then
	echo >> "$output_objdir/$my_dlsyms" "\
	{\"@INIT@\", (void *) &lt_syminit},"
	fi

	case $need_lib_prefix in
	no)
	eval "$global_symbol_to_c_name_address" < "$nlist" >> "$output_objdir/$my_dlsyms"
	;;
	*)
	eval "$global_symbol_to_c_name_address_lib_prefix" < "$nlist" >> "$output_objdir/$my_dlsyms"
	;;
	esac
	echo >> "$output_objdir/$my_dlsyms" "\
	{0, (void *) 0}
	};

	/* This works around a problem in FreeBSD linker */
	#ifdef FREEBSD_WORKAROUND
	static const void *lt_preloaded_setup() {
	return lt_${my_prefix}_LTX_preloaded_symbols;
	}
	#endif

	#ifdef __cplusplus
	}
	#endif\
	"
	} # !$opt_dry_run

	pic_flag_for_symtable=
	case "$compile_command " in
	" -static ") ;;
	*)
	case $host in
	# compiling the symbol table file with pic_flag works around
	# a FreeBSD bug that causes programs to crash when -lm is
	# linked before any other PIC object. But we must not use
	# pic_flag when linking with -static. The problem exists in
	# FreeBSD 2.2.6 and is fixed in FreeBSD 3.1.
	--freebsd2.\|--freebsd3.0\|--freebsdelf3.0*)
	pic_flag_for_symtable=" $pic_flag -DFREEBSD_WORKAROUND" ;;
	--hpux*)
	pic_flag_for_symtable=" $pic_flag" ;;
	*)
	$my_pic_p && pic_flag_for_symtable=" $pic_flag"
	;;
	esac
	;;
	esac
	symtab_cflags=
	for arg in $LTCFLAGS; do
	case $arg in
	-pie \| -fpie \| -fPIE) ;;
	*) func_append symtab_cflags " $arg" ;;
	esac
	done

	# Now compile the dynamic symbol file.
	func_show_eval '(cd $output_objdir && $LTCC$symtab_cflags -c$no_builtin_flag$pic_flag_for_symtable "$my_dlsyms")' 'exit $?'

	# Clean up the generated files.
	func_show_eval '$RM "$output_objdir/$my_dlsyms" "$nlist" "${nlist}S" "${nlist}T" "${nlist}I"'

	# Transform the symbol file into the correct name.
	symfileobj=$output_objdir/${my_outputname}S.$objext
	case $host in
	cygwin \| mingw \| cegcc )
	if test -f "$output_objdir/$my_outputname.def"; then
	compile_command=`$ECHO "$compile_command" \| $SED "s%@SYMFILE@%$output_objdir/$my_outputname.def $symfileobj%"`
	finalize_command=`$ECHO "$finalize_command" \| $SED "s%@SYMFILE@%$output_objdir/$my_outputname.def $symfileobj%"`
	else
	compile_command=`$ECHO "$compile_command" \| $SED "s%@SYMFILE@%$symfileobj%"`
	finalize_command=`$ECHO "$finalize_command" \| $SED "s%@SYMFILE@%$symfileobj%"`
	fi
	;;
	*)
	compile_command=`$ECHO "$compile_command" \| $SED "s%@SYMFILE@%$symfileobj%"`
	finalize_command=`$ECHO "$finalize_command" \| $SED "s%@SYMFILE@%$symfileobj%"`
	;;
	esac
	;;
	*)
	func_fatal_error "unknown suffix for '$my_dlsyms'"
	;;
	esac
	else
	# We keep going just in case the user didn't refer to
	# lt_preloaded_symbols. The linker will fail if global_symbol_pipe
	# really was required.

	# Nullify the symbol file.
	compile_command=`$ECHO "$compile_command" \| $SED "s% @SYMFILE@%%"`
	finalize_command=`$ECHO "$finalize_command" \| $SED "s% @SYMFILE@%%"`
	fi
	}

	# func_cygming_gnu_implib_p ARG
	# This predicate returns with zero status (TRUE) if
	# ARG is a GNU/binutils-style import library. Returns
	# with nonzero status (FALSE) otherwise.
	func_cygming_gnu_implib_p ()
	{
	$debug_cmd

	func_to_tool_file "$1" func_convert_file_msys_to_w32
	func_cygming_gnu_implib_tmp=`$NM "$func_to_tool_file_result" \| eval "$global_symbol_pipe" \| $EGREP ' (_head_[A-Za-z0-9_]+_[ad]l\|[A-Za-z0-9_]+_[ad]l_iname)$'`
	test -n "$func_cygming_gnu_implib_tmp"
	}

	# func_cygming_ms_implib_p ARG
	# This predicate returns with zero status (TRUE) if
	# ARG is an MS-style import library. Returns
	# with nonzero status (FALSE) otherwise.
	func_cygming_ms_implib_p ()
	{
	$debug_cmd

	func_to_tool_file "$1" func_convert_file_msys_to_w32
	func_cygming_ms_implib_tmp=`$NM "$func_to_tool_file_result" \| eval "$global_symbol_pipe" \| $GREP '_NULL_IMPORT_DESCRIPTOR'`
	test -n "$func_cygming_ms_implib_tmp"
	}

	# func_win32_libid arg
	# return the library type of file 'arg'
	#
	# Need a lot of goo to handle both DLLs and import libs
	# Has to be a shell function in order to 'eat' the argument
	# that is supplied when $file_magic_command is called.
	# Despite the name, also deal with 64 bit binaries.
	func_win32_libid ()
	{
	$debug_cmd

	win32_libid_type=unknown
	win32_fileres=`file -L $1 2>/dev/null`
	case $win32_fileres in
	ar\ archive\ import\ library) # definitely import
	win32_libid_type="x86 archive import"
	;;
	ar\ archive) # could be an import, or static
	# Keep the egrep pattern in sync with the one in _LT_CHECK_MAGIC_METHOD.
	if eval $OBJDUMP -f $1 \| $SED -e '10q' 2>/dev/null \|
	$EGREP 'file format (pei-i386(.architecture: i386)?\|pe-arm-wince\|pe-x86-64)' >/dev/null; then
	case $nm_interface in
	"MS dumpbin")
	if func_cygming_ms_implib_p "$1" \|\|
	func_cygming_gnu_implib_p "$1"
	then
	win32_nmres=import
	else
	win32_nmres=
	fi
	;;
	*)
	func_to_tool_file "$1" func_convert_file_msys_to_w32
	win32_nmres=`eval $NM -f posix -A \"$func_to_tool_file_result\" \|
	$SED -n -e '
	1,100{
	/ I /{
	s\|.*\|import\|
	p
	q
	}
	}'`
	;;
	esac
	case $win32_nmres in
	import*) win32_libid_type="x86 archive import";;
	*) win32_libid_type="x86 archive static";;
	esac
	fi
	;;
	DLL)
	win32_libid_type="x86 DLL"
	;;
	executable) # but shell scripts are "executable" too...
	case $win32_fileres in
	MS\ Windows\ PE\ Intel)
	win32_libid_type="x86 DLL"
	;;
	esac
	;;
	esac
	$ECHO "$win32_libid_type"
	}

	# func_cygming_dll_for_implib ARG
	#
	# Platform-specific function to extract the
	# name of the DLL associated with the specified
	# import library ARG.
	# Invoked by eval'ing the libtool variable
	# $sharedlib_from_linklib_cmd
	# Result is available in the variable
	# $sharedlib_from_linklib_result
	func_cygming_dll_for_implib ()
	{
	$debug_cmd

	sharedlib_from_linklib_result=`$DLLTOOL --identify-strict --identify "$1"`
	}

	# func_cygming_dll_for_implib_fallback_core SECTION_NAME LIBNAMEs
	#
	# The is the core of a fallback implementation of a
	# platform-specific function to extract the name of the
	# DLL associated with the specified import library LIBNAME.
	#
	# SECTION_NAME is either .idata$6 or .idata$7, depending
	# on the platform and compiler that created the implib.
	#
	# Echos the name of the DLL associated with the
	# specified import library.
	func_cygming_dll_for_implib_fallback_core ()
	{
	$debug_cmd

	match_literal=`$ECHO "$1" \| $SED "$sed_make_literal_regex"`
	$OBJDUMP -s --section "$1" "$2" 2>/dev/null \|
	$SED '/^Contents of section '"$match_literal"':/{
	# Place marker at beginning of archive member dllname section
	s/.*/====MARK====/
	p
	d
	}
	# These lines can sometimes be longer than 43 characters, but
	# are always uninteresting
	/:[ ]*file format pe[i]\{,1\}-/d
	/^In archive [^:]*:/d
	# Ensure marker is printed
	/^====MARK====/p
	# Remove all lines with less than 43 characters
	/^.\{43\}/!d
	# From remaining lines, remove first 43 characters
	s/^.\{43\}//' \|
	$SED -n '
	# Join marker and all lines until next marker into a single line
	/^====MARK====/ b para
	H
	$ b para
	b
	:para
	x
	s/\n//g
	# Remove the marker
	s/^====MARK====//
	# Remove trailing dots and whitespace
	s/[\. \t]*$//
	# Print
	/./p' \|
	# we now have a list, one entry per line, of the stringified
	# contents of the appropriate section of all members of the
	# archive that possess that section. Heuristic: eliminate
	# all those that have a first or second character that is
	# a '.' (that is, objdump's representation of an unprintable
	# character.) This should work for all archives with less than
	# 0x302f exports -- but will fail for DLLs whose name actually
	# begins with a literal '.' or a single character followed by
	# a '.'.
	#
	# Of those that remain, print the first one.
	$SED -e '/^\./d;/^.\./d;q'
	}

	# func_cygming_dll_for_implib_fallback ARG
	# Platform-specific function to extract the
	# name of the DLL associated with the specified
	# import library ARG.
	#
	# This fallback implementation is for use when $DLLTOOL
	# does not support the --identify-strict option.
	# Invoked by eval'ing the libtool variable
	# $sharedlib_from_linklib_cmd
	# Result is available in the variable
	# $sharedlib_from_linklib_result
	func_cygming_dll_for_implib_fallback ()
	{
	$debug_cmd

	if func_cygming_gnu_implib_p "$1"; then
	# binutils import library
	sharedlib_from_linklib_result=`func_cygming_dll_for_implib_fallback_core '.idata$7' "$1"`
	elif func_cygming_ms_implib_p "$1"; then
	# ms-generated import library
	sharedlib_from_linklib_result=`func_cygming_dll_for_implib_fallback_core '.idata$6' "$1"`
	else
	# unknown
	sharedlib_from_linklib_result=
	fi
	}


	# func_extract_an_archive dir oldlib
	func_extract_an_archive ()
	{
	$debug_cmd

	f_ex_an_ar_dir=$1; shift
	f_ex_an_ar_oldlib=$1
	if test yes = "$lock_old_archive_extraction"; then
	lockfile=$f_ex_an_ar_oldlib.lock
	until $opt_dry_run \|\| ln "$progpath" "$lockfile" 2>/dev/null; do
	func_echo "Waiting for $lockfile to be removed"
	sleep 2
	done
	fi
	func_show_eval "(cd \$f_ex_an_ar_dir && $AR x \"\$f_ex_an_ar_oldlib\")" \
	'stat=$?; rm -f "$lockfile"; exit $stat'
	if test yes = "$lock_old_archive_extraction"; then
	$opt_dry_run \|\| rm -f "$lockfile"
	fi
	if ($AR t "$f_ex_an_ar_oldlib" \| sort \| sort -uc >/dev/null 2>&1); then
	:
	else
	func_fatal_error "object name conflicts in archive: $f_ex_an_ar_dir/$f_ex_an_ar_oldlib"
	fi
	}


	# func_extract_archives gentop oldlib ...
	func_extract_archives ()
	{
	$debug_cmd

	my_gentop=$1; shift
	my_oldlibs=${1+"$@"}
	my_oldobjs=
	my_xlib=
	my_xabs=
	my_xdir=

	for my_xlib in $my_oldlibs; do
	# Extract the objects.
	case $my_xlib in
	[\\/]* \| [A-Za-z]:[\\/]*) my_xabs=$my_xlib ;;
	*) my_xabs=`pwd`"/$my_xlib" ;;
	esac
	func_basename "$my_xlib"
	my_xlib=$func_basename_result
	my_xlib_u=$my_xlib
	while :; do
	case " $extracted_archives " in
	" $my_xlib_u ")
	func_arith $extracted_serial + 1
	extracted_serial=$func_arith_result
	my_xlib_u=lt$extracted_serial-$my_xlib ;;
	*) break ;;
	esac
	done
	extracted_archives="$extracted_archives $my_xlib_u"
	my_xdir=$my_gentop/$my_xlib_u

	func_mkdir_p "$my_xdir"

	case $host in
	-darwin)
	func_verbose "Extracting $my_xabs"
	# Do not bother doing anything if just a dry run
	$opt_dry_run \|\| {
	darwin_orig_dir=`pwd`
	cd $my_xdir \|\| exit $?
	darwin_archive=$my_xabs
	darwin_curdir=`pwd`
	func_basename "$darwin_archive"
	darwin_base_archive=$func_basename_result
	darwin_arches=`$LIPO -info "$darwin_archive" 2>/dev/null \| $GREP Architectures 2>/dev/null \|\| true`
	if test -n "$darwin_arches"; then
	darwin_arches=`$ECHO "$darwin_arches" \| $SED -e 's/.*are://'`
	darwin_arch=
	func_verbose "$darwin_base_archive has multiple architectures $darwin_arches"
	for darwin_arch in $darwin_arches; do
	func_mkdir_p "unfat-$$/$darwin_base_archive-$darwin_arch"
	$LIPO -thin $darwin_arch -output "unfat-$$/$darwin_base_archive-$darwin_arch/$darwin_base_archive" "$darwin_archive"
	cd "unfat-$$/$darwin_base_archive-$darwin_arch"
	func_extract_an_archive "`pwd`" "$darwin_base_archive"
	cd "$darwin_curdir"
	$RM "unfat-$$/$darwin_base_archive-$darwin_arch/$darwin_base_archive"
	done # $darwin_arches
	## Okay now we've a bunch of thin objects, gotta fatten them up :)
	darwin_filelist=`find unfat-$$ -type f -name \.o -print -o -name \.lo -print \| $SED -e "$sed_basename" \| sort -u`
	darwin_file=
	darwin_files=
	for darwin_file in $darwin_filelist; do
	darwin_files=`find unfat-$$ -name $darwin_file -print \| sort \| $NL2SP`
	$LIPO -create -output "$darwin_file" $darwin_files
	done # $darwin_filelist
	$RM -rf unfat-$$
	cd "$darwin_orig_dir"
	else
	cd $darwin_orig_dir
	func_extract_an_archive "$my_xdir" "$my_xabs"
	fi # $darwin_arches
	} # !$opt_dry_run
	;;
	*)
	func_extract_an_archive "$my_xdir" "$my_xabs"
	;;
	esac
	my_oldobjs="$my_oldobjs "`find $my_xdir -name \.$objext -print -o -name \.lo -print \| sort \| $NL2SP`
	done

	func_extract_archives_result=$my_oldobjs
	}


	# func_emit_wrapper [arg=no]
	#
	# Emit a libtool wrapper script on stdout.
	# Don't directly open a file because we may want to
	# incorporate the script contents within a cygwin/mingw
	# wrapper executable. Must ONLY be called from within
	# func_mode_link because it depends on a number of variables
	# set therein.
	#
	# ARG is the value that the WRAPPER_SCRIPT_BELONGS_IN_OBJDIR
	# variable will take. If 'yes', then the emitted script
	# will assume that the directory where it is stored is
	# the $objdir directory. This is a cygwin/mingw-specific
	# behavior.
	func_emit_wrapper ()
	{
	func_emit_wrapper_arg1=${1-no}

	$ECHO "\
	#! $SHELL

	# $output - temporary wrapper script for $objdir/$outputname
	# Generated by $PROGRAM (GNU $PACKAGE) $VERSION
	#
	# The $output program cannot be directly executed until all the libtool
	# libraries that it depends on are installed.
	#
	# This wrapper script should never be moved out of the build directory.
	# If it is, it will not operate correctly.

	# Sed substitution that helps us do robust quoting. It backslashifies
	# metacharacters that are still active within double-quoted strings.
	sed_quote_subst='$sed_quote_subst'

	# Be Bourne compatible
	if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then
	emulate sh
	NULLCMD=:
	# Zsh 3.x and 4.x performs word splitting on \${1+\"\$@\"}, which
	# is contrary to our usage. Disable this feature.
	alias -g '\${1+\"\$@\"}'='\"\$@\"'
	setopt NO_GLOB_SUBST
	else
	case \`(set -o) 2>/dev/null\` in posix) set -o posix;; esac
	fi
	BIN_SH=xpg4; export BIN_SH # for Tru64
	DUALCASE=1; export DUALCASE # for MKS sh

	# The HP-UX ksh and POSIX shell print the target directory to stdout
	# if CDPATH is set.
	(unset CDPATH) >/dev/null 2>&1 && unset CDPATH

	relink_command=\"$relink_command\"

	# This environment variable determines our operation mode.
	if test \"\$libtool_install_magic\" = \"$magic\"; then
	# install mode needs the following variables:
	generated_by_libtool_version='$macro_version'
	notinst_deplibs='$notinst_deplibs'
	else
	# When we are sourced in execute mode, \$file and \$ECHO are already set.
	if test \"\$libtool_execute_magic\" != \"$magic\"; then
	file=\"\$0\""

	qECHO=`$ECHO "$ECHO" \| $SED "$sed_quote_subst"`
	$ECHO "\

	# A function that is used when there is no print builtin or printf.
	func_fallback_echo ()
	{
	eval 'cat <<_LTECHO_EOF
	\$1
	_LTECHO_EOF'
	}
	ECHO=\"$qECHO\"
	fi

	# Very basic option parsing. These options are (a) specific to
	# the libtool wrapper, (b) are identical between the wrapper
	# /script/ and the wrapper /executable/ that is used only on
	# windows platforms, and (c) all begin with the string "--lt-"
	# (application programs are unlikely to have options that match
	# this pattern).
	#
	# There are only two supported options: --lt-debug and
	# --lt-dump-script. There is, deliberately, no --lt-help.
	#
	# The first argument to this parsing function should be the
	# script's $0 value, followed by "$@".
	lt_option_debug=
	func_parse_lt_options ()
	{
	lt_script_arg0=\$0
	shift
	for lt_opt
	do
	case \"\$lt_opt\" in
	--lt-debug) lt_option_debug=1 ;;
	--lt-dump-script)
	lt_dump_D=\`\$ECHO \"X\$lt_script_arg0\" \| $SED -e 's/^X//' -e 's%/[^/]*$%%'\`
	test \"X\$lt_dump_D\" = \"X\$lt_script_arg0\" && lt_dump_D=.
	lt_dump_F=\`\$ECHO \"X\$lt_script_arg0\" \| $SED -e 's/^X//' -e 's%^.*/%%'\`
	cat \"\$lt_dump_D/\$lt_dump_F\"
	exit 0
	;;
	--lt-*)
	\$ECHO \"Unrecognized --lt- option: '\$lt_opt'\" 1>&2
	exit 1
	;;
	esac
	done

	# Print the debug banner immediately:
	if test -n \"\$lt_option_debug\"; then
	echo \"$outputname:$output:\$LINENO: libtool wrapper (GNU $PACKAGE) $VERSION\" 1>&2
	fi
	}

	# Used when --lt-debug. Prints its arguments to stdout
	# (redirection is the responsibility of the caller)
	func_lt_dump_args ()
	{
	lt_dump_args_N=1;
	for lt_arg
	do
	\$ECHO \"$outputname:$output:\$LINENO: newargv[\$lt_dump_args_N]: \$lt_arg\"
	lt_dump_args_N=\`expr \$lt_dump_args_N + 1\`
	done
	}

	# Core function for launching the target application
	func_exec_program_core ()
	{
	"
	case $host in
	# Backslashes separate directories on plain windows
	--mingw \| --os2* \| -cegcc)
	$ECHO "\
	if test -n \"\$lt_option_debug\"; then
	\$ECHO \"$outputname:$output:\$LINENO: newargv[0]: \$progdir\\\\\$program\" 1>&2
	func_lt_dump_args \${1+\"\$@\"} 1>&2
	fi
	exec \"\$progdir\\\\\$program\" \${1+\"\$@\"}
	"
	;;

	*)
	$ECHO "\
	if test -n \"\$lt_option_debug\"; then
	\$ECHO \"$outputname:$output:\$LINENO: newargv[0]: \$progdir/\$program\" 1>&2
	func_lt_dump_args \${1+\"\$@\"} 1>&2
	fi
	exec \"\$progdir/\$program\" \${1+\"\$@\"}
	"
	;;
	esac
	$ECHO "\
	\$ECHO \"\$0: cannot exec \$program \$*\" 1>&2
	exit 1
	}

	# A function to encapsulate launching the target application
	# Strips options in the --lt-* namespace from \$@ and
	# launches target application with the remaining arguments.
	func_exec_program ()
	{
	case \" \$* \" in
	\\ --lt-)
	for lt_wr_arg
	do
	case \$lt_wr_arg in
	--lt-*) ;;
	*) set x \"\$@\" \"\$lt_wr_arg\"; shift;;
	esac
	shift
	done ;;
	esac
	func_exec_program_core \${1+\"\$@\"}
	}

	# Parse options
	func_parse_lt_options \"\$0\" \${1+\"\$@\"}

	# Find the directory that this script lives in.
	thisdir=\`\$ECHO \"\$file\" \| $SED 's%/[^/]*$%%'\`
	test \"x\$thisdir\" = \"x\$file\" && thisdir=.

	# Follow symbolic links until we get to the real thisdir.
	file=\`ls -ld \"\$file\" \| $SED -n 's/.*-> //p'\`
	while test -n \"\$file\"; do
	destdir=\`\$ECHO \"\$file\" \| $SED 's%/[^/]*\$%%'\`

	# If there was a directory component, then change thisdir.
	if test \"x\$destdir\" != \"x\$file\"; then
	case \"\$destdir\" in
	[\\\\/]* \| [A-Za-z]:[\\\\/]*) thisdir=\"\$destdir\" ;;
	*) thisdir=\"\$thisdir/\$destdir\" ;;
	esac
	fi

	file=\`\$ECHO \"\$file\" \| $SED 's%^.*/%%'\`
	file=\`ls -ld \"\$thisdir/\$file\" \| $SED -n 's/.*-> //p'\`
	done

	# Usually 'no', except on cygwin/mingw when embedded into
	# the cwrapper.
	WRAPPER_SCRIPT_BELONGS_IN_OBJDIR=$func_emit_wrapper_arg1
	if test \"\$WRAPPER_SCRIPT_BELONGS_IN_OBJDIR\" = \"yes\"; then
	# special case for '.'
	if test \"\$thisdir\" = \".\"; then
	thisdir=\`pwd\`
	fi
	# remove .libs from thisdir
	case \"\$thisdir\" in
	[\\\\/]$objdir ) thisdir=\`\$ECHO \"\$thisdir\" \| $SED 's%[\\\\/][^\\\\/]$%%'\` ;;
	$objdir ) thisdir=. ;;
	esac
	fi

	# Try to get the absolute directory name.
	absdir=\`cd \"\$thisdir\" && pwd\`
	test -n \"\$absdir\" && thisdir=\"\$absdir\"
	"

	if test yes = "$fast_install"; then
	$ECHO "\
	program=lt-'$outputname'$exeext
	progdir=\"\$thisdir/$objdir\"

	if test ! -f \"\$progdir/\$program\" \|\|
	{ file=\`ls -1dt \"\$progdir/\$program\" \"\$progdir/../\$program\" 2>/dev/null \| $SED 1q\`; \\
	test \"X\$file\" != \"X\$progdir/\$program\"; }; then

	file=\"\$\$-\$program\"

	if test ! -d \"\$progdir\"; then
	$MKDIR \"\$progdir\"
	else
	$RM \"\$progdir/\$file\"
	fi"

	$ECHO "\

	# relink executable if necessary
	if test -n \"\$relink_command\"; then
	if relink_command_output=\`eval \$relink_command 2>&1\`; then :
	else
	\$ECHO \"\$relink_command_output\" >&2
	$RM \"\$progdir/\$file\"
	exit 1
	fi
	fi

	$MV \"\$progdir/\$file\" \"\$progdir/\$program\" 2>/dev/null \|\|
	{ $RM \"\$progdir/\$program\";
	$MV \"\$progdir/\$file\" \"\$progdir/\$program\"; }
	$RM \"\$progdir/\$file\"
	fi"
	else
	$ECHO "\
	program='$outputname'
	progdir=\"\$thisdir/$objdir\"
	"
	fi

	$ECHO "\

	if test -f \"\$progdir/\$program\"; then"

	# fixup the dll searchpath if we need to.
	#
	# Fix the DLL searchpath if we need to. Do this before prepending
	# to shlibpath, because on Windows, both are PATH and uninstalled
	# libraries must come first.
	if test -n "$dllsearchpath"; then
	$ECHO "\
	# Add the dll search path components to the executable PATH
	PATH=$dllsearchpath:\$PATH
	"
	fi

	# Export our shlibpath_var if we have one.
	if test yes = "$shlibpath_overrides_runpath" && test -n "$shlibpath_var" && test -n "$temp_rpath"; then
	$ECHO "\
	# Add our own library path to $shlibpath_var
	$shlibpath_var=\"$temp_rpath\$$shlibpath_var\"

	# Some systems cannot cope with colon-terminated $shlibpath_var
	# The second colon is a workaround for a bug in BeOS R4 sed
	$shlibpath_var=\`\$ECHO \"\$$shlibpath_var\" \| $SED 's/::*\$//'\`

	export $shlibpath_var
	"
	fi

	$ECHO "\
	if test \"\$libtool_execute_magic\" != \"$magic\"; then
	# Run the actual program with our arguments.
	func_exec_program \${1+\"\$@\"}
	fi
	else
	# The program doesn't exist.
	\$ECHO \"\$0: error: '\$progdir/\$program' does not exist\" 1>&2
	\$ECHO \"This script is just a wrapper for \$program.\" 1>&2
	\$ECHO \"See the $PACKAGE documentation for more information.\" 1>&2
	exit 1
	fi
	fi\
	"
	}


	# func_emit_cwrapperexe_src
	# emit the source code for a wrapper executable on stdout
	# Must ONLY be called from within func_mode_link because
	# it depends on a number of variable set therein.
	func_emit_cwrapperexe_src ()
	{
	cat <<EOF

	/* $cwrappersource - temporary wrapper executable for $objdir/$outputname
	Generated by $PROGRAM (GNU $PACKAGE) $VERSION

	The $output program cannot be directly executed until all the libtool
	libraries that it depends on are installed.

	This wrapper executable should never be moved out of the build directory.
	If it is, it will not operate correctly.
	*/
	EOF
	cat <<"EOF"
	#ifdef _MSC_VER
	# define _CRT_SECURE_NO_DEPRECATE 1
	#endif
	#include <stdio.h>
	#include <stdlib.h>
	#ifdef _MSC_VER
	# include <direct.h>
	# include <process.h>
	# include <io.h>
	#else
	# include <unistd.h>
	# include <stdint.h>
	# ifdef __CYGWIN__
	# include <io.h>
	# endif
	#endif
	#include <malloc.h>
	#include <stdarg.h>
	#include <assert.h>
	#include <string.h>
	#include <ctype.h>
	#include <errno.h>
	#include <fcntl.h>
	#include <sys/stat.h>

	#define STREQ(s1, s2) (strcmp ((s1), (s2)) == 0)

	/* declarations of non-ANSI functions */
	#if defined __MINGW32__
	# ifdef __STRICT_ANSI__
	int _putenv (const char *);
	# endif
	#elif defined __CYGWIN__
	# ifdef __STRICT_ANSI__
	char realpath (const char , char *);
	int putenv (char *);
	int setenv (const char , const char , int);
	# endif
	/* #elif defined other_platform \|\| defined ... */
	#endif

	/* portability defines, excluding path handling macros */
	#if defined _MSC_VER
	# define setmode _setmode
	# define stat _stat
	# define chmod _chmod
	# define getcwd _getcwd
	# define putenv _putenv
	# define S_IXUSR _S_IEXEC
	#elif defined __MINGW32__
	# define setmode _setmode
	# define stat _stat
	# define chmod _chmod
	# define getcwd _getcwd
	# define putenv _putenv
	#elif defined __CYGWIN__
	# define HAVE_SETENV
	# define FOPEN_WB "wb"
	/* #elif defined other platforms ... */
	#endif

	#if defined PATH_MAX
	# define LT_PATHMAX PATH_MAX
	#elif defined MAXPATHLEN
	# define LT_PATHMAX MAXPATHLEN
	#else
	# define LT_PATHMAX 1024
	#endif

	#ifndef S_IXOTH
	# define S_IXOTH 0
	#endif
	#ifndef S_IXGRP
	# define S_IXGRP 0
	#endif

	/* path handling portability macros */
	#ifndef DIR_SEPARATOR
	# define DIR_SEPARATOR '/'
	# define PATH_SEPARATOR ':'
	#endif

	#if defined _WIN32 \|\| defined __MSDOS__ \|\| defined __DJGPP__ \|\| \
	defined __OS2__
	# define HAVE_DOS_BASED_FILE_SYSTEM
	# define FOPEN_WB "wb"
	# ifndef DIR_SEPARATOR_2
	# define DIR_SEPARATOR_2 '\\'
	# endif
	# ifndef PATH_SEPARATOR_2
	# define PATH_SEPARATOR_2 ';'
	# endif
	#endif

	#ifndef DIR_SEPARATOR_2
	# define IS_DIR_SEPARATOR(ch) ((ch) == DIR_SEPARATOR)
	#else /* DIR_SEPARATOR_2 */
	# define IS_DIR_SEPARATOR(ch) \
	(((ch) == DIR_SEPARATOR) \|\| ((ch) == DIR_SEPARATOR_2))
	#endif /* DIR_SEPARATOR_2 */

	#ifndef PATH_SEPARATOR_2
	# define IS_PATH_SEPARATOR(ch) ((ch) == PATH_SEPARATOR)
	#else /* PATH_SEPARATOR_2 */
	# define IS_PATH_SEPARATOR(ch) ((ch) == PATH_SEPARATOR_2)
	#endif /* PATH_SEPARATOR_2 */

	#ifndef FOPEN_WB
	# define FOPEN_WB "w"
	#endif
	#ifndef _O_BINARY
	# define _O_BINARY 0
	#endif

	#define XMALLOC(type, num) ((type ) xmalloc ((num) sizeof(type)))
	#define XFREE(stale) do { \
	if (stale) { free (stale); stale = 0; } \
	} while (0)

	#if defined LT_DEBUGWRAPPER
	static int lt_debug = 1;
	#else
	static int lt_debug = 0;
	#endif

	const char program_name = "libtool-wrapper"; / in case xstrdup fails */

	void *xmalloc (size_t num);
	char xstrdup (const char string);
	const char base_name (const char name);
	char find_executable (const char wrapper);
	char chase_symlinks (const char pathspec);
	int make_executable (const char *path);
	int check_executable (const char *path);
	char strendzap (char str, const char *pat);
	void lt_debugprintf (const char file, int line, const char fmt, ...);
	void lt_fatal (const char file, int line, const char message, ...);
	static const char nonnull (const char s);
	static const char nonempty (const char s);
	void lt_setenv (const char name, const char value);
	char lt_extend_str (const char orig_value, const char *add, int to_end);
	void lt_update_exe_path (const char name, const char value);
	void lt_update_lib_path (const char name, const char value);
	char prepare_spawn (char argv);
	void lt_dump_script (FILE *f);
	EOF

	cat <<EOF
	#if __GNUC__ < 4 \|\| (__GNUC__ == 4 && __GNUC_MINOR__ < 5)
	# define externally_visible volatile
	#else
	# define externally_visible __attribute__((externally_visible)) volatile
	#endif
	externally_visible const char * MAGIC_EXE = "$magic_exe";
	const char * LIB_PATH_VARNAME = "$shlibpath_var";
	EOF

	if test yes = "$shlibpath_overrides_runpath" && test -n "$shlibpath_var" && test -n "$temp_rpath"; then
	func_to_host_path "$temp_rpath"
	cat <<EOF
	const char * LIB_PATH_VALUE = "$func_to_host_path_result";
	EOF
	else
	cat <<"EOF"
	const char * LIB_PATH_VALUE = "";
	EOF
	fi

	if test -n "$dllsearchpath"; then
	func_to_host_path "$dllsearchpath:"
	cat <<EOF
	const char * EXE_PATH_VARNAME = "PATH";
	const char * EXE_PATH_VALUE = "$func_to_host_path_result";
	EOF
	else
	cat <<"EOF"
	const char * EXE_PATH_VARNAME = "";
	const char * EXE_PATH_VALUE = "";
	EOF
	fi

	if test yes = "$fast_install"; then
	cat <<EOF
	const char * TARGET_PROGRAM_NAME = "lt-$outputname"; /* hopefully, no .exe */
	EOF
	else
	cat <<EOF
	const char * TARGET_PROGRAM_NAME = "$outputname"; /* hopefully, no .exe */
	EOF
	fi


	cat <<"EOF"

	#define LTWRAPPER_OPTION_PREFIX "--lt-"

	static const char *ltwrapper_option_prefix = LTWRAPPER_OPTION_PREFIX;
	static const char *dumpscript_opt = LTWRAPPER_OPTION_PREFIX "dump-script";
	static const char *debug_opt = LTWRAPPER_OPTION_PREFIX "debug";

	int
	main (int argc, char *argv[])
	{
	char **newargz;
	int newargc;
	char *tmp_pathspec;
	char *actual_cwrapper_path;
	char *actual_cwrapper_name;
	char *target_name;
	char *lt_argv_zero;
	int rval = 127;

	int i;

	program_name = (char *) xstrdup (base_name (argv[0]));
	newargz = XMALLOC (char *, (size_t) argc + 1);

	/* very simple arg parsing; don't want to rely on getopt
	* also, copy all non cwrapper options to newargz, except
	* argz[0], which is handled differently
	*/
	newargc=0;
	for (i = 1; i < argc; i++)
	{
	if (STREQ (argv[i], dumpscript_opt))
	{
	EOF
	case $host in
	mingw \| cygwin )
	# make stdout use "unix" line endings
	echo " setmode(1,_O_BINARY);"
	;;
	esac

	cat <<"EOF"
	lt_dump_script (stdout);
	return 0;
	}
	if (STREQ (argv[i], debug_opt))
	{
	lt_debug = 1;
	continue;
	}
	if (STREQ (argv[i], ltwrapper_option_prefix))
	{
	/* however, if there is an option in the LTWRAPPER_OPTION_PREFIX
	namespace, but it is not one of the ones we know about and
	have already dealt with, above (inluding dump-script), then
	report an error. Otherwise, targets might begin to believe
	they are allowed to use options in the LTWRAPPER_OPTION_PREFIX
	namespace. The first time any user complains about this, we'll
	need to make LTWRAPPER_OPTION_PREFIX a configure-time option
	or a configure.ac-settable value.
	*/
	lt_fatal (__FILE__, __LINE__,
	"unrecognized %s option: '%s'",
	ltwrapper_option_prefix, argv[i]);
	}
	/* otherwise ... */
	newargz[++newargc] = xstrdup (argv[i]);
	}
	newargz[++newargc] = NULL;

	EOF
	cat <<EOF
	/* The GNU banner must be the first non-error debug message */
	lt_debugprintf (__FILE__, __LINE__, "libtool wrapper (GNU $PACKAGE) $VERSION\n");
	EOF
	cat <<"EOF"
	lt_debugprintf (__FILE__, __LINE__, "(main) argv[0]: %s\n", argv[0]);
	lt_debugprintf (__FILE__, __LINE__, "(main) program_name: %s\n", program_name);

	tmp_pathspec = find_executable (argv[0]);
	if (tmp_pathspec == NULL)
	lt_fatal (__FILE__, __LINE__, "couldn't find %s", argv[0]);
	lt_debugprintf (__FILE__, __LINE__,
	"(main) found exe (before symlink chase) at: %s\n",
	tmp_pathspec);

	actual_cwrapper_path = chase_symlinks (tmp_pathspec);
	lt_debugprintf (__FILE__, __LINE__,
	"(main) found exe (after symlink chase) at: %s\n",
	actual_cwrapper_path);
	XFREE (tmp_pathspec);

	actual_cwrapper_name = xstrdup (base_name (actual_cwrapper_path));
	strendzap (actual_cwrapper_path, actual_cwrapper_name);

	/* wrapper name transforms */
	strendzap (actual_cwrapper_name, ".exe");
	tmp_pathspec = lt_extend_str (actual_cwrapper_name, ".exe", 1);
	XFREE (actual_cwrapper_name);
	actual_cwrapper_name = tmp_pathspec;
	tmp_pathspec = 0;

	/* target_name transforms -- use actual target program name; might have lt- prefix */
	target_name = xstrdup (base_name (TARGET_PROGRAM_NAME));
	strendzap (target_name, ".exe");
	tmp_pathspec = lt_extend_str (target_name, ".exe", 1);
	XFREE (target_name);
	target_name = tmp_pathspec;
	tmp_pathspec = 0;

	lt_debugprintf (__FILE__, __LINE__,
	"(main) libtool target name: %s\n",
	target_name);
	EOF

	cat <<EOF
	newargz[0] =
	XMALLOC (char, (strlen (actual_cwrapper_path) +
	strlen ("$objdir") + 1 + strlen (actual_cwrapper_name) + 1));
	strcpy (newargz[0], actual_cwrapper_path);
	strcat (newargz[0], "$objdir");
	strcat (newargz[0], "/");
	EOF

	cat <<"EOF"
	/* stop here, and copy so we don't have to do this twice */
	tmp_pathspec = xstrdup (newargz[0]);

	/* do NOT want the lt- prefix here, so use actual_cwrapper_name */
	strcat (newargz[0], actual_cwrapper_name);

	/* DO want the lt- prefix here if it exists, so use target_name */
	lt_argv_zero = lt_extend_str (tmp_pathspec, target_name, 1);
	XFREE (tmp_pathspec);
	tmp_pathspec = NULL;
	EOF

	case $host_os in
	mingw*)
	cat <<"EOF"
	{
	char* p;
	while ((p = strchr (newargz[0], '\\')) != NULL)
	{
	*p = '/';
	}
	while ((p = strchr (lt_argv_zero, '\\')) != NULL)
	{
	*p = '/';
	}
	}
	EOF
	;;
	esac

	cat <<"EOF"
	XFREE (target_name);
	XFREE (actual_cwrapper_path);
	XFREE (actual_cwrapper_name);

	lt_setenv ("BIN_SH", "xpg4"); /* for Tru64 */
	lt_setenv ("DUALCASE", "1"); /* for MSK sh */
	/* Update the DLL searchpath. EXE_PATH_VALUE ($dllsearchpath) must
	be prepended before (that is, appear after) LIB_PATH_VALUE ($temp_rpath)
	because on Windows, both *_VARNAMEs are PATH but uninstalled
	libraries must come first. */
	lt_update_exe_path (EXE_PATH_VARNAME, EXE_PATH_VALUE);
	lt_update_lib_path (LIB_PATH_VARNAME, LIB_PATH_VALUE);

	lt_debugprintf (__FILE__, __LINE__, "(main) lt_argv_zero: %s\n",
	nonnull (lt_argv_zero));
	for (i = 0; i < newargc; i++)
	{
	lt_debugprintf (__FILE__, __LINE__, "(main) newargz[%d]: %s\n",
	i, nonnull (newargz[i]));
	}

	EOF

	case $host_os in
	mingw*)
	cat <<"EOF"
	/* execv doesn't actually work on mingw as expected on unix */
	newargz = prepare_spawn (newargz);
	rval = (int) _spawnv (_P_WAIT, lt_argv_zero, (const char * const *) newargz);
	if (rval == -1)
	{
	/* failed to start process */
	lt_debugprintf (__FILE__, __LINE__,
	"(main) failed to launch target \"%s\": %s\n",
	lt_argv_zero, nonnull (strerror (errno)));
	return 127;
	}
	return rval;
	EOF
	;;
	*)
	cat <<"EOF"
	execv (lt_argv_zero, newargz);
	return rval; /* =127, but avoids unused variable warning */
	EOF
	;;
	esac

	cat <<"EOF"
	}

	void *
	xmalloc (size_t num)
	{
	void p = (void ) malloc (num);
	if (!p)
	lt_fatal (__FILE__, __LINE__, "memory exhausted");

	return p;
	}

	char *
	xstrdup (const char *string)
	{
	return string ? strcpy ((char *) xmalloc (strlen (string) + 1),
	string) : NULL;
	}

	const char *
	base_name (const char *name)
	{
	const char *base;

	#if defined HAVE_DOS_BASED_FILE_SYSTEM
	/* Skip over the disk name in MSDOS pathnames. */
	if (isalpha ((unsigned char) name[0]) && name[1] == ':')
	name += 2;
	#endif

	for (base = name; *name; name++)
	if (IS_DIR_SEPARATOR (*name))
	base = name + 1;
	return base;
	}

	int
	check_executable (const char *path)
	{
	struct stat st;

	lt_debugprintf (__FILE__, __LINE__, "(check_executable): %s\n",
	nonempty (path));
	if ((!path) \|\| (!*path))
	return 0;

	if ((stat (path, &st) >= 0)
	&& (st.st_mode & (S_IXUSR \| S_IXGRP \| S_IXOTH)))
	return 1;
	else
	return 0;
	}

	int
	make_executable (const char *path)
	{
	int rval = 0;
	struct stat st;

	lt_debugprintf (__FILE__, __LINE__, "(make_executable): %s\n",
	nonempty (path));
	if ((!path) \|\| (!*path))
	return 0;

	if (stat (path, &st) >= 0)
	{
	rval = chmod (path, st.st_mode \| S_IXOTH \| S_IXGRP \| S_IXUSR);
	}
	return rval;
	}

	/* Searches for the full path of the wrapper. Returns
	newly allocated full path name if found, NULL otherwise
	Does not chase symlinks, even on platforms that support them.
	*/
	char *
	find_executable (const char *wrapper)
	{
	int has_slash = 0;
	const char *p;
	const char *p_next;
	/* static buffer for getcwd */
	char tmp[LT_PATHMAX + 1];
	size_t tmp_len;
	char *concat_name;

	lt_debugprintf (__FILE__, __LINE__, "(find_executable): %s\n",
	nonempty (wrapper));

	if ((wrapper == NULL) \|\| (*wrapper == '\0'))
	return NULL;

	/* Absolute path? */
	#if defined HAVE_DOS_BASED_FILE_SYSTEM
	if (isalpha ((unsigned char) wrapper[0]) && wrapper[1] == ':')
	{
	concat_name = xstrdup (wrapper);
	if (check_executable (concat_name))
	return concat_name;
	XFREE (concat_name);
	}
	else
	{
	#endif
	if (IS_DIR_SEPARATOR (wrapper[0]))
	{
	concat_name = xstrdup (wrapper);
	if (check_executable (concat_name))
	return concat_name;
	XFREE (concat_name);
	}
	#if defined HAVE_DOS_BASED_FILE_SYSTEM
	}
	#endif

	for (p = wrapper; *p; p++)
	if (*p == '/')
	{
	has_slash = 1;
	break;
	}
	if (!has_slash)
	{
	/* no slashes; search PATH */
	const char *path = getenv ("PATH");
	if (path != NULL)
	{
	for (p = path; *p; p = p_next)
	{
	const char *q;
	size_t p_len;
	for (q = p; *q; q++)
	if (IS_PATH_SEPARATOR (*q))
	break;
	p_len = (size_t) (q - p);
	p_next = (*q == '\0' ? q : q + 1);
	if (p_len == 0)
	{
	/* empty path: current directory */
	if (getcwd (tmp, LT_PATHMAX) == NULL)
	lt_fatal (__FILE__, __LINE__, "getcwd failed: %s",
	nonnull (strerror (errno)));
	tmp_len = strlen (tmp);
	concat_name =
	XMALLOC (char, tmp_len + 1 + strlen (wrapper) + 1);
	memcpy (concat_name, tmp, tmp_len);
	concat_name[tmp_len] = '/';
	strcpy (concat_name + tmp_len + 1, wrapper);
	}
	else
	{
	concat_name =
	XMALLOC (char, p_len + 1 + strlen (wrapper) + 1);
	memcpy (concat_name, p, p_len);
	concat_name[p_len] = '/';
	strcpy (concat_name + p_len + 1, wrapper);
	}
	if (check_executable (concat_name))
	return concat_name;
	XFREE (concat_name);
	}
	}
	/* not found in PATH; assume curdir */
	}
	/* Relative path \| not found in path: prepend cwd */
	if (getcwd (tmp, LT_PATHMAX) == NULL)
	lt_fatal (__FILE__, __LINE__, "getcwd failed: %s",
	nonnull (strerror (errno)));
	tmp_len = strlen (tmp);
	concat_name = XMALLOC (char, tmp_len + 1 + strlen (wrapper) + 1);
	memcpy (concat_name, tmp, tmp_len);
	concat_name[tmp_len] = '/';
	strcpy (concat_name + tmp_len + 1, wrapper);

	if (check_executable (concat_name))
	return concat_name;
	XFREE (concat_name);
	return NULL;
	}

	char *
	chase_symlinks (const char *pathspec)
	{
	#ifndef S_ISLNK
	return xstrdup (pathspec);
	#else
	char buf[LT_PATHMAX];
	struct stat s;
	char *tmp_pathspec = xstrdup (pathspec);
	char *p;
	int has_symlinks = 0;
	while (strlen (tmp_pathspec) && !has_symlinks)
	{
	lt_debugprintf (__FILE__, __LINE__,
	"checking path component for symlinks: %s\n",
	tmp_pathspec);
	if (lstat (tmp_pathspec, &s) == 0)
	{
	if (S_ISLNK (s.st_mode) != 0)
	{
	has_symlinks = 1;
	break;
	}

	/* search backwards for last DIR_SEPARATOR */
	p = tmp_pathspec + strlen (tmp_pathspec) - 1;
	while ((p > tmp_pathspec) && (!IS_DIR_SEPARATOR (*p)))
	p--;
	if ((p == tmp_pathspec) && (!IS_DIR_SEPARATOR (*p)))
	{
	/* no more DIR_SEPARATORS left */
	break;
	}
	*p = '\0';
	}
	else
	{
	lt_fatal (__FILE__, __LINE__,
	"error accessing file \"%s\": %s",
	tmp_pathspec, nonnull (strerror (errno)));
	}
	}
	XFREE (tmp_pathspec);

	if (!has_symlinks)
	{
	return xstrdup (pathspec);
	}

	tmp_pathspec = realpath (pathspec, buf);
	if (tmp_pathspec == 0)
	{
	lt_fatal (__FILE__, __LINE__,
	"could not follow symlinks for %s", pathspec);
	}
	return xstrdup (tmp_pathspec);
	#endif
	}

	char *
	strendzap (char str, const char pat)
	{
	size_t len, patlen;

	assert (str != NULL);
	assert (pat != NULL);

	len = strlen (str);
	patlen = strlen (pat);

	if (patlen <= len)
	{
	str += len - patlen;
	if (STREQ (str, pat))
	*str = '\0';
	}
	return str;
	}

	void
	lt_debugprintf (const char file, int line, const char fmt, ...)
	{
	va_list args;
	if (lt_debug)
	{
	(void) fprintf (stderr, "%s:%s:%d: ", program_name, file, line);
	va_start (args, fmt);
	(void) vfprintf (stderr, fmt, args);
	va_end (args);
	}
	}

	static void
	lt_error_core (int exit_status, const char *file,
	int line, const char *mode,
	const char *message, va_list ap)
	{
	fprintf (stderr, "%s:%s:%d: %s: ", program_name, file, line, mode);
	vfprintf (stderr, message, ap);
	fprintf (stderr, ".\n");

	if (exit_status >= 0)
	exit (exit_status);
	}

	void
	lt_fatal (const char file, int line, const char message, ...)
	{
	va_list ap;
	va_start (ap, message);
	lt_error_core (EXIT_FAILURE, file, line, "FATAL", message, ap);
	va_end (ap);
	}

	static const char *
	nonnull (const char *s)
	{
	return s ? s : "(null)";
	}

	static const char *
	nonempty (const char *s)
	{
	return (s && !*s) ? "(empty)" : nonnull (s);
	}

	void
	lt_setenv (const char name, const char value)
	{
	lt_debugprintf (__FILE__, __LINE__,
	"(lt_setenv) setting '%s' to '%s'\n",
	nonnull (name), nonnull (value));
	{
	#ifdef HAVE_SETENV
	/* always make a copy, for consistency with !HAVE_SETENV */
	char *str = xstrdup (value);
	setenv (name, str, 1);
	#else
	size_t len = strlen (name) + 1 + strlen (value) + 1;
	char *str = XMALLOC (char, len);
	sprintf (str, "%s=%s", name, value);
	if (putenv (str) != EXIT_SUCCESS)
	{
	XFREE (str);
	}
	#endif
	}
	}

	char *
	lt_extend_str (const char orig_value, const char add, int to_end)
	{
	char *new_value;
	if (orig_value && *orig_value)
	{
	size_t orig_value_len = strlen (orig_value);
	size_t add_len = strlen (add);
	new_value = XMALLOC (char, add_len + orig_value_len + 1);
	if (to_end)
	{
	strcpy (new_value, orig_value);
	strcpy (new_value + orig_value_len, add);
	}
	else
	{
	strcpy (new_value, add);
	strcpy (new_value + add_len, orig_value);
	}
	}
	else
	{
	new_value = xstrdup (add);
	}
	return new_value;
	}

	void
	lt_update_exe_path (const char name, const char value)
	{
	lt_debugprintf (__FILE__, __LINE__,
	"(lt_update_exe_path) modifying '%s' by prepending '%s'\n",
	nonnull (name), nonnull (value));

	if (name && name && value && value)
	{
	char *new_value = lt_extend_str (getenv (name), value, 0);
	/* some systems can't cope with a ':'-terminated path #' */
	size_t len = strlen (new_value);
	while ((len > 0) && IS_PATH_SEPARATOR (new_value[len-1]))
	{
	new_value[--len] = '\0';
	}
	lt_setenv (name, new_value);
	XFREE (new_value);
	}
	}

	void
	lt_update_lib_path (const char name, const char value)
	{
	lt_debugprintf (__FILE__, __LINE__,
	"(lt_update_lib_path) modifying '%s' by prepending '%s'\n",
	nonnull (name), nonnull (value));

	if (name && name && value && value)
	{
	char *new_value = lt_extend_str (getenv (name), value, 0);
	lt_setenv (name, new_value);
	XFREE (new_value);
	}
	}

	EOF
	case $host_os in
	mingw*)
	cat <<"EOF"

	/* Prepares an argument vector before calling spawn().
	Note that spawn() does not by itself call the command interpreter
	(getenv ("COMSPEC") != NULL ? getenv ("COMSPEC") :
	({ OSVERSIONINFO v; v.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
	GetVersionEx(&v);
	v.dwPlatformId == VER_PLATFORM_WIN32_NT;
	}) ? "cmd.exe" : "command.com").
	Instead it simply concatenates the arguments, separated by ' ', and calls
	CreateProcess(). We must quote the arguments since Win32 CreateProcess()
	interprets characters like ' ', '\t', '\\', '"' (but not '<' and '>') in a
	special way:
	- Space and tab are interpreted as delimiters. They are not treated as
	delimiters if they are surrounded by double quotes: "...".
	- Unescaped double quotes are removed from the input. Their only effect is
	that within double quotes, space and tab are treated like normal
	characters.
	- Backslashes not followed by double quotes are not special.
	- But 2*n+1 backslashes followed by a double quote become
	n backslashes followed by a double quote (n >= 0):
	\" -> "
	\\\" -> \"
	\\\\\" -> \\"
	*/
	#define SHELL_SPECIAL_CHARS "\"\\ \001\002\003\004\005\006\007\010\011\012\013\014\015\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037"
	#define SHELL_SPACE_CHARS " \001\002\003\004\005\006\007\010\011\012\013\014\015\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037"
	char **
	prepare_spawn (char **argv)
	{
	size_t argc;
	char **new_argv;
	size_t i;

	/* Count number of arguments. */
	for (argc = 0; argv[argc] != NULL; argc++)
	;

	/* Allocate new argument vector. */
	new_argv = XMALLOC (char *, argc + 1);

	/* Put quoted arguments into the new argument vector. */
	for (i = 0; i < argc; i++)
	{
	const char *string = argv[i];

	if (string[0] == '\0')
	new_argv[i] = xstrdup ("\"\"");
	else if (strpbrk (string, SHELL_SPECIAL_CHARS) != NULL)
	{
	int quote_around = (strpbrk (string, SHELL_SPACE_CHARS) != NULL);
	size_t length;
	unsigned int backslashes;
	const char *s;
	char *quoted_string;
	char *p;

	length = 0;
	backslashes = 0;
	if (quote_around)
	length++;
	for (s = string; *s != '\0'; s++)
	{
	char c = *s;
	if (c == '"')
	length += backslashes + 1;
	length++;
	if (c == '\\')
	backslashes++;
	else
	backslashes = 0;
	}
	if (quote_around)
	length += backslashes + 1;

	quoted_string = XMALLOC (char, length + 1);

	p = quoted_string;
	backslashes = 0;
	if (quote_around)
	*p++ = '"';
	for (s = string; *s != '\0'; s++)
	{
	char c = *s;
	if (c == '"')
	{
	unsigned int j;
	for (j = backslashes + 1; j > 0; j--)
	*p++ = '\\';
	}
	*p++ = c;
	if (c == '\\')
	backslashes++;
	else
	backslashes = 0;
	}
	if (quote_around)
	{
	unsigned int j;
	for (j = backslashes; j > 0; j--)
	*p++ = '\\';
	*p++ = '"';
	}
	*p = '\0';

	new_argv[i] = quoted_string;
	}
	else
	new_argv[i] = (char *) string;
	}
	new_argv[argc] = NULL;

	return new_argv;
	}
	EOF
	;;
	esac

	cat <<"EOF"
	void lt_dump_script (FILE* f)
	{
	EOF
	func_emit_wrapper yes \|
	$SED -n -e '
	s/^$.\{79\}$$..*$/\1\
	\2/
	h
	s/$[\\"]$/\\\1/g
	s/$/\\n/
	s/$[^\n]$./ fputs ("\1", f);/p
	g
	D'
	cat <<"EOF"
	}
	EOF
	}
	# end: func_emit_cwrapperexe_src

	# func_win32_import_lib_p ARG
	# True if ARG is an import lib, as indicated by $file_magic_cmd
	func_win32_import_lib_p ()
	{
	$debug_cmd

	case `eval $file_magic_cmd \"\$1\" 2>/dev/null \| $SED -e 10q` in
	import) : ;;
	*) false ;;
	esac
	}

	# func_suncc_cstd_abi
	# !!ONLY CALL THIS FOR SUN CC AFTER $compile_command IS FULLY EXPANDED!!
	# Several compiler flags select an ABI that is incompatible with the
	# Cstd library. Avoid specifying it if any are in CXXFLAGS.
	func_suncc_cstd_abi ()
	{
	$debug_cmd

	case " $compile_command " in
	" -compat=g "\|\ -std=c++[0-9][0-9]\ \|" -library=stdcxx4 "\|" -library=stlport4 ")
	suncc_use_cstd_abi=no
	;;
	*)
	suncc_use_cstd_abi=yes
	;;
	esac
	}

	# func_mode_link arg...
	func_mode_link ()
	{
	$debug_cmd

	case $host in
	--cygwin* \| --mingw* \| --pw32* \| --os2* \| -cegcc)
	# It is impossible to link a dll without this setting, and
	# we shouldn't force the makefile maintainer to figure out
	# what system we are compiling for in order to pass an extra
	# flag for every libtool invocation.
	# allow_undefined=no

	# FIXME: Unfortunately, there are problems with the above when trying
	# to make a dll that has undefined symbols, in which case not
	# even a static library is built. For now, we need to specify
	# -no-undefined on the libtool link line when we can be certain
	# that all symbols are satisfied, otherwise we get a static library.
	allow_undefined=yes
	;;
	*)
	allow_undefined=yes
	;;
	esac
	libtool_args=$nonopt
	base_compile="$nonopt $@"
	compile_command=$nonopt
	finalize_command=$nonopt

	compile_rpath=
	finalize_rpath=
	compile_shlibpath=
	finalize_shlibpath=
	convenience=
	old_convenience=
	deplibs=
	old_deplibs=
	compiler_flags=
	linker_flags=
	dllsearchpath=
	lib_search_path=`pwd`
	inst_prefix_dir=
	new_inherited_linker_flags=

	avoid_version=no
	bindir=
	dlfiles=
	dlprefiles=
	dlself=no
	export_dynamic=no
	export_symbols=
	export_symbols_regex=
	generated=
	libobjs=
	ltlibs=
	module=no
	no_install=no
	objs=
	os2dllname=
	non_pic_objects=
	precious_files_regex=
	prefer_static_libs=no
	preload=false
	prev=
	prevarg=
	release=
	rpath=
	xrpath=
	perm_rpath=
	temp_rpath=
	thread_safe=no
	vinfo=
	vinfo_number=no
	weak_libs=
	single_module=$wl-single_module
	func_infer_tag $base_compile

	# We need to know -static, to get the right output filenames.
	for arg
	do
	case $arg in
	-shared)
	test yes != "$build_libtool_libs" \
	&& func_fatal_configuration "cannot build a shared library"
	build_old_libs=no
	break
	;;
	-all-static \| -static \| -static-libtool-libs)
	case $arg in
	-all-static)
	if test yes = "$build_libtool_libs" && test -z "$link_static_flag"; then
	func_warning "complete static linking is impossible in this configuration"
	fi
	if test -n "$link_static_flag"; then
	dlopen_self=$dlopen_self_static
	fi
	prefer_static_libs=yes
	;;
	-static)
	if test -z "$pic_flag" && test -n "$link_static_flag"; then
	dlopen_self=$dlopen_self_static
	fi
	prefer_static_libs=built
	;;
	-static-libtool-libs)
	if test -z "$pic_flag" && test -n "$link_static_flag"; then
	dlopen_self=$dlopen_self_static
	fi
	prefer_static_libs=yes
	;;
	esac
	build_libtool_libs=no
	build_old_libs=yes
	break
	;;
	esac
	done

	# See if our shared archives depend on static archives.
	test -n "$old_archive_from_new_cmds" && build_old_libs=yes

	# Go through the arguments, transforming them on the way.
	while test "$#" -gt 0; do
	arg=$1
	shift
	func_quote_for_eval "$arg"
	qarg=$func_quote_for_eval_unquoted_result
	func_append libtool_args " $func_quote_for_eval_result"

	# If the previous option needs an argument, assign it.
	if test -n "$prev"; then
	case $prev in
	output)
	func_append compile_command " @OUTPUT@"
	func_append finalize_command " @OUTPUT@"
	;;
	esac

	case $prev in
	bindir)
	bindir=$arg
	prev=
	continue
	;;
	dlfiles\|dlprefiles)
	$preload \|\| {
	# Add the symbol object into the linking commands.
	func_append compile_command " @SYMFILE@"
	func_append finalize_command " @SYMFILE@"
	preload=:
	}
	case $arg in
	.la \| .lo) ;; # We handle these cases below.
	force)
	if test no = "$dlself"; then
	dlself=needless
	export_dynamic=yes
	fi
	prev=
	continue
	;;
	self)
	if test dlprefiles = "$prev"; then
	dlself=yes
	elif test dlfiles = "$prev" && test yes != "$dlopen_self"; then
	dlself=yes
	else
	dlself=needless
	export_dynamic=yes
	fi
	prev=
	continue
	;;
	*)
	if test dlfiles = "$prev"; then
	func_append dlfiles " $arg"
	else
	func_append dlprefiles " $arg"
	fi
	prev=
	continue
	;;
	esac
	;;
	expsyms)
	export_symbols=$arg
	test -f "$arg" \
	\|\| func_fatal_error "symbol file '$arg' does not exist"
	prev=
	continue
	;;
	expsyms_regex)
	export_symbols_regex=$arg
	prev=
	continue
	;;
	framework)
	case $host in
	--darwin*)
	case "$deplibs " in
	" $qarg.ltframework ") ;;
	*) func_append deplibs " $qarg.ltframework" # this is fixed later
	;;
	esac
	;;
	esac
	prev=
	continue
	;;
	inst_prefix)
	inst_prefix_dir=$arg
	prev=
	continue
	;;
	mllvm)
	# Clang does not use LLVM to link, so we can simply discard any
	# '-mllvm $arg' options when doing the link step.
	prev=
	continue
	;;
	objectlist)
	if test -f "$arg"; then
	save_arg=$arg
	moreargs=
	for fil in `cat "$save_arg"`
	do
	# func_append moreargs " $fil"
	arg=$fil
	# A libtool-controlled object.

	# Check to see that this really is a libtool object.
	if func_lalib_unsafe_p "$arg"; then
	pic_object=
	non_pic_object=

	# Read the .lo file
	func_source "$arg"

	if test -z "$pic_object" \|\|
	test -z "$non_pic_object" \|\|
	test none = "$pic_object" &&
	test none = "$non_pic_object"; then
	func_fatal_error "cannot find name of object for '$arg'"
	fi

	# Extract subdirectory from the argument.
	func_dirname "$arg" "/" ""
	xdir=$func_dirname_result

	if test none != "$pic_object"; then
	# Prepend the subdirectory the object is found in.
	pic_object=$xdir$pic_object

	if test dlfiles = "$prev"; then
	if test yes = "$build_libtool_libs" && test yes = "$dlopen_support"; then
	func_append dlfiles " $pic_object"
	prev=
	continue
	else
	# If libtool objects are unsupported, then we need to preload.
	prev=dlprefiles
	fi
	fi

	# CHECK ME: I think I busted this. -Ossama
	if test dlprefiles = "$prev"; then
	# Preload the old-style object.
	func_append dlprefiles " $pic_object"
	prev=
	fi

	# A PIC object.
	func_append libobjs " $pic_object"
	arg=$pic_object
	fi

	# Non-PIC object.
	if test none != "$non_pic_object"; then
	# Prepend the subdirectory the object is found in.
	non_pic_object=$xdir$non_pic_object

	# A standard non-PIC object
	func_append non_pic_objects " $non_pic_object"
	if test -z "$pic_object" \|\| test none = "$pic_object"; then
	arg=$non_pic_object
	fi
	else
	# If the PIC object exists, use it instead.
	# $xdir was prepended to $pic_object above.
	non_pic_object=$pic_object
	func_append non_pic_objects " $non_pic_object"
	fi
	else
	# Only an error if not doing a dry-run.
	if $opt_dry_run; then
	# Extract subdirectory from the argument.
	func_dirname "$arg" "/" ""
	xdir=$func_dirname_result

	func_lo2o "$arg"
	pic_object=$xdir$objdir/$func_lo2o_result
	non_pic_object=$xdir$func_lo2o_result
	func_append libobjs " $pic_object"
	func_append non_pic_objects " $non_pic_object"
	else
	func_fatal_error "'$arg' is not a valid libtool object"
	fi
	fi
	done
	else
	func_fatal_error "link input file '$arg' does not exist"
	fi
	arg=$save_arg
	prev=
	continue
	;;
	os2dllname)
	os2dllname=$arg
	prev=
	continue
	;;
	precious_regex)
	precious_files_regex=$arg
	prev=
	continue
	;;
	release)
	release=-$arg
	prev=
	continue
	;;
	rpath \| xrpath)
	# We need an absolute path.
	case $arg in
	[\\/]* \| [A-Za-z]:[\\/]*) ;;
	*)
	func_fatal_error "only absolute run-paths are allowed"
	;;
	esac
	if test rpath = "$prev"; then
	case "$rpath " in
	" $arg ") ;;
	*) func_append rpath " $arg" ;;
	esac
	else
	case "$xrpath " in
	" $arg ") ;;
	*) func_append xrpath " $arg" ;;
	esac
	fi
	prev=
	continue
	;;
	shrext)
	shrext_cmds=$arg
	prev=
	continue
	;;
	weak)
	func_append weak_libs " $arg"
	prev=
	continue
	;;
	xcclinker)
	func_append linker_flags " $qarg"
	func_append compiler_flags " $qarg"
	prev=
	func_append compile_command " $qarg"
	func_append finalize_command " $qarg"
	continue
	;;
	xcompiler)
	func_append compiler_flags " $qarg"
	prev=
	func_append compile_command " $qarg"
	func_append finalize_command " $qarg"
	continue
	;;
	xlinker)
	func_append linker_flags " $qarg"
	func_append compiler_flags " $wl$qarg"
	prev=
	func_append compile_command " $wl$qarg"
	func_append finalize_command " $wl$qarg"
	continue
	;;
	*)
	eval "$prev=\"\$arg\""
	prev=
	continue
	;;
	esac
	fi # test -n "$prev"

	prevarg=$arg

	case $arg in
	-all-static)
	if test -n "$link_static_flag"; then
	# See comment for -static flag below, for more details.
	func_append compile_command " $link_static_flag"
	func_append finalize_command " $link_static_flag"
	fi
	continue
	;;

	-allow-undefined)
	# FIXME: remove this flag sometime in the future.
	func_fatal_error "'-allow-undefined' must not be used because it is the default"
	;;

	-avoid-version)
	avoid_version=yes
	continue
	;;

	-bindir)
	prev=bindir
	continue
	;;

	-dlopen)
	prev=dlfiles
	continue
	;;

	-dlpreopen)
	prev=dlprefiles
	continue
	;;

	-export-dynamic)
	export_dynamic=yes
	continue
	;;

	-export-symbols \| -export-symbols-regex)
	if test -n "$export_symbols" \|\| test -n "$export_symbols_regex"; then
	func_fatal_error "more than one -exported-symbols argument is not allowed"
	fi
	if test X-export-symbols = "X$arg"; then
	prev=expsyms
	else
	prev=expsyms_regex
	fi
	continue
	;;

	-framework)
	prev=framework
	continue
	;;

	-inst-prefix-dir)
	prev=inst_prefix
	continue
	;;

	# The native IRIX linker understands -LANG:, -LIST: and -LNO:*
	# so, if we see these flags be careful not to treat them like -L
	-L[A-Z][A-Z]:)
	case $with_gcc/$host in
	no/--irix* \| /--irix*)
	func_append compile_command " $arg"
	func_append finalize_command " $arg"
	;;
	esac
	continue
	;;

	-L*)
	func_stripname "-L" '' "$arg"
	if test -z "$func_stripname_result"; then
	if test "$#" -gt 0; then
	func_fatal_error "require no space between '-L' and '$1'"
	else
	func_fatal_error "need path for '-L' option"
	fi
	fi
	func_resolve_sysroot "$func_stripname_result"
	dir=$func_resolve_sysroot_result
	# We need an absolute path.
	case $dir in
	[\\/]* \| [A-Za-z]:[\\/]*) ;;
	*)
	absdir=`cd "$dir" && pwd`
	test -z "$absdir" && \
	func_fatal_error "cannot determine absolute directory name of '$dir'"
	dir=$absdir
	;;
	esac
	case "$deplibs " in
	" -L$dir " \| " $arg ")
	# Will only happen for absolute or sysroot arguments
	;;
	*)
	# Preserve sysroot, but never include relative directories
	case $dir in
	[\\/]* \| [A-Za-z]:[\\/]* \| =*) func_append deplibs " $arg" ;;
	*) func_append deplibs " -L$dir" ;;
	esac
	func_append lib_search_path " $dir"
	;;
	esac
	case $host in
	--cygwin* \| --mingw* \| --pw32* \| --os2* \| -cegcc)
	testbindir=`$ECHO "$dir" \| $SED 's/lib$/bin*'`
	case :$dllsearchpath: in
	":$dir:") ;;
	::) dllsearchpath=$dir;;
	*) func_append dllsearchpath ":$dir";;
	esac
	case :$dllsearchpath: in
	":$testbindir:") ;;
	::) dllsearchpath=$testbindir;;
	*) func_append dllsearchpath ":$testbindir";;
	esac
	;;
	esac
	continue
	;;

	-l*)
	if test X-lc = "X$arg" \|\| test X-lm = "X$arg"; then
	case $host in
	--cygwin* \| --mingw* \| --pw32* \| --beos* \| -cegcc \| --haiku*)
	# These systems don't actually have a C or math library (as such)
	continue
	;;
	--os2*)
	# These systems don't actually have a C library (as such)
	test X-lc = "X$arg" && continue
	;;
	--openbsd* \| --freebsd* \| --dragonfly* \| --bitrig*)
	# Do not include libc due to us having libc/libc_r.
	test X-lc = "X$arg" && continue
	;;
	--rhapsody* \| --darwin1.[012])
	# Rhapsody C and math libraries are in the System framework
	func_append deplibs " System.ltframework"
	continue
	;;
	--sco3.2v5* \| --sco5v6*)
	# Causes problems with __ctype
	test X-lc = "X$arg" && continue
	;;
	--sysv4.2uw2* \| --sysv5* \| --unixware* \| --OpenUNIX*)
	# Compiler inserts libc in the correct place for threads to work
	test X-lc = "X$arg" && continue
	;;
	esac
	elif test X-lc_r = "X$arg"; then
	case $host in
	--openbsd* \| --freebsd* \| --dragonfly* \| --bitrig*)
	# Do not include libc_r directly, use -pthread flag.
	continue
	;;
	esac
	fi
	func_append deplibs " $arg"
	continue
	;;

	-mllvm)
	prev=mllvm
	continue
	;;

	-module)
	module=yes
	continue
	;;

	# Tru64 UNIX uses -model [arg] to determine the layout of C++
	# classes, name mangling, and exception handling.
	# Darwin uses the -arch flag to determine output architecture.
	-model\|-arch\|-isysroot\|--sysroot)
	func_append compiler_flags " $arg"
	func_append compile_command " $arg"
	func_append finalize_command " $arg"
	prev=xcompiler
	continue
	;;

	-mt\|-mthreads\|-kthread\|-Kthread\|-pthread\|-pthreads\|--thread-safe \
	\|-threads\|-fopenmp\|-openmp\|-mp\|-xopenmp\|-omp\|-qsmp=*)
	func_append compiler_flags " $arg"
	func_append compile_command " $arg"
	func_append finalize_command " $arg"
	case "$new_inherited_linker_flags " in
	" $arg ") ;;
	* ) func_append new_inherited_linker_flags " $arg" ;;
	esac
	continue
	;;

	-multi_module)
	single_module=$wl-multi_module
	continue
	;;

	-no-fast-install)
	fast_install=no
	continue
	;;

	-no-install)
	case $host in
	--cygwin* \| --mingw* \| --pw32* \| --os2* \| --darwin* \| -cegcc)
	# The PATH hackery in wrapper scripts is required on Windows
	# and Darwin in order for the loader to find any dlls it needs.
	func_warning "'-no-install' is ignored for $host"
	func_warning "assuming '-no-fast-install' instead"
	fast_install=no
	;;
	*) no_install=yes ;;
	esac
	continue
	;;

	-no-undefined)
	allow_undefined=no
	continue
	;;

	-objectlist)
	prev=objectlist
	continue
	;;

	-os2dllname)
	prev=os2dllname
	continue
	;;

	-o) prev=output ;;

	-precious-files-regex)
	prev=precious_regex
	continue
	;;

	-release)
	prev=release
	continue
	;;

	-rpath)
	prev=rpath
	continue
	;;

	-R)
	prev=xrpath
	continue
	;;

	-R*)
	func_stripname '-R' '' "$arg"
	dir=$func_stripname_result
	# We need an absolute path.
	case $dir in
	[\\/]* \| [A-Za-z]:[\\/]*) ;;
	=*)
	func_stripname '=' '' "$dir"
	dir=$lt_sysroot$func_stripname_result
	;;
	*)
	func_fatal_error "only absolute run-paths are allowed"
	;;
	esac
	case "$xrpath " in
	" $dir ") ;;
	*) func_append xrpath " $dir" ;;
	esac
	continue
	;;

	-shared)
	# The effects of -shared are defined in a previous loop.
	continue
	;;

	-shrext)
	prev=shrext
	continue
	;;

	-static \| -static-libtool-libs)
	# The effects of -static are defined in a previous loop.
	# We used to do the same as -all-static on platforms that
	# didn't have a PIC flag, but the assumption that the effects
	# would be equivalent was wrong. It would break on at least
	# Digital Unix and AIX.
	continue
	;;

	-thread-safe)
	thread_safe=yes
	continue
	;;

	-version-info)
	prev=vinfo
	continue
	;;

	-version-number)
	prev=vinfo
	vinfo_number=yes
	continue
	;;

	-weak)
	prev=weak
	continue
	;;

	-Wc,*)
	func_stripname '-Wc,' '' "$arg"
	args=$func_stripname_result
	arg=
	save_ifs=$IFS; IFS=,
	for flag in $args; do
	IFS=$save_ifs
	func_quote_for_eval "$flag"
	func_append arg " $func_quote_for_eval_result"
	func_append compiler_flags " $func_quote_for_eval_result"
	done
	IFS=$save_ifs
	func_stripname ' ' '' "$arg"
	arg=$func_stripname_result
	;;

	-Wl,*)
	func_stripname '-Wl,' '' "$arg"
	args=$func_stripname_result
	arg=
	save_ifs=$IFS; IFS=,
	for flag in $args; do
	IFS=$save_ifs
	func_quote_for_eval "$flag"
	func_append arg " $wl$func_quote_for_eval_result"
	func_append compiler_flags " $wl$func_quote_for_eval_result"
	func_append linker_flags " $func_quote_for_eval_result"
	done
	IFS=$save_ifs
	func_stripname ' ' '' "$arg"
	arg=$func_stripname_result
	;;

	-Xcompiler)
	prev=xcompiler
	continue
	;;

	-Xlinker)
	prev=xlinker
	continue
	;;

	-XCClinker)
	prev=xcclinker
	continue
	;;

	# -msg_* for osf cc
	-msg_*)
	func_quote_for_eval "$arg"
	arg=$func_quote_for_eval_result
	;;

	# Flags to be passed through unchanged, with rationale:
	# -64, -mips[0-9] enable 64-bit mode for the SGI compiler
	# -r[0-9][0-9]* specify processor for the SGI compiler
	# -xarch=, -xtarget= enable 64-bit mode for the Sun compiler
	# +DA, +DD enable 64-bit mode for the HP compiler
	# -q* compiler args for the IBM compiler
	# -m, -t[45], -txscale* architecture-specific flags for GCC
	# -F/path path to uninstalled frameworks, gcc on darwin
	# -p, -pg, --coverage, -fprofile-* profiling flags for GCC
	# -fstack-protector* stack protector flags for GCC
	# @file GCC response files
	# -tp=* Portland pgcc target processor selection
	# --sysroot=* for sysroot support
	# -O, -g, -flto, -fwhopr, -fuse-linker-plugin GCC link-time optimization
	+ # -specs=* GCC specs files
	# -stdlib=* select c++ std lib with clang
	-64\|-mips[0-9]\|-r[0-9][0-9]\|-xarch=\|-xtarget=\|+DA\|+DD\|-q\|-m*\| \
	-t[45]\|-txscale\|-p\|-pg\|--coverage\|-fprofile-\|-F\|@\|-tp=\|--sysroot=*\| \
	- -O\|-g\|-flto\|-fwhopr\|-fuse-linker-plugin\|-fstack-protector\|-stdlib=)
	+ -O\|-g\|-flto\|-fwhopr\|-fuse-linker-plugin\|-fstack-protector\|-stdlib=\| \
	+ -specs=*)
	func_quote_for_eval "$arg"
	arg=$func_quote_for_eval_result
	func_append compile_command " $arg"
	func_append finalize_command " $arg"
	func_append compiler_flags " $arg"
	continue
	;;

	-Z*)
	if test os2 = "`expr $host : '.*$os2$'`"; then
	# OS/2 uses -Zxxx to specify OS/2-specific options
	compiler_flags="$compiler_flags $arg"
	func_append compile_command " $arg"
	func_append finalize_command " $arg"
	case $arg in
	-Zlinker \| -Zstack)
	prev=xcompiler
	;;
	esac
	continue
	else
	# Otherwise treat like 'Some other compiler flag' below
	func_quote_for_eval "$arg"
	arg=$func_quote_for_eval_result
	fi
	;;

	# Some other compiler flag.
	-* \| +*)
	func_quote_for_eval "$arg"
	arg=$func_quote_for_eval_result
	;;

	*.$objext)
	# A standard object.
	func_append objs " $arg"
	;;

	*.lo)
	# A libtool-controlled object.

	# Check to see that this really is a libtool object.
	if func_lalib_unsafe_p "$arg"; then
	pic_object=
	non_pic_object=

	# Read the .lo file
	func_source "$arg"

	if test -z "$pic_object" \|\|
	test -z "$non_pic_object" \|\|
	test none = "$pic_object" &&
	test none = "$non_pic_object"; then
	func_fatal_error "cannot find name of object for '$arg'"
	fi

	# Extract subdirectory from the argument.
	func_dirname "$arg" "/" ""
	xdir=$func_dirname_result

	test none = "$pic_object" \|\| {
	# Prepend the subdirectory the object is found in.
	pic_object=$xdir$pic_object

	if test dlfiles = "$prev"; then
	if test yes = "$build_libtool_libs" && test yes = "$dlopen_support"; then
	func_append dlfiles " $pic_object"
	prev=
	continue
	else
	# If libtool objects are unsupported, then we need to preload.
	prev=dlprefiles
	fi
	fi

	# CHECK ME: I think I busted this. -Ossama
	if test dlprefiles = "$prev"; then
	# Preload the old-style object.
	func_append dlprefiles " $pic_object"
	prev=
	fi

	# A PIC object.
	func_append libobjs " $pic_object"
	arg=$pic_object
	}

	# Non-PIC object.
	if test none != "$non_pic_object"; then
	# Prepend the subdirectory the object is found in.
	non_pic_object=$xdir$non_pic_object

	# A standard non-PIC object
	func_append non_pic_objects " $non_pic_object"
	if test -z "$pic_object" \|\| test none = "$pic_object"; then
	arg=$non_pic_object
	fi
	else
	# If the PIC object exists, use it instead.
	# $xdir was prepended to $pic_object above.
	non_pic_object=$pic_object
	func_append non_pic_objects " $non_pic_object"
	fi
	else
	# Only an error if not doing a dry-run.
	if $opt_dry_run; then
	# Extract subdirectory from the argument.
	func_dirname "$arg" "/" ""
	xdir=$func_dirname_result

	func_lo2o "$arg"
	pic_object=$xdir$objdir/$func_lo2o_result
	non_pic_object=$xdir$func_lo2o_result
	func_append libobjs " $pic_object"
	func_append non_pic_objects " $non_pic_object"
	else
	func_fatal_error "'$arg' is not a valid libtool object"
	fi
	fi
	;;

	*.$libext)
	# An archive.
	func_append deplibs " $arg"
	func_append old_deplibs " $arg"
	continue
	;;

	*.la)
	# A libtool-controlled library.

	func_resolve_sysroot "$arg"
	if test dlfiles = "$prev"; then
	# This library was specified with -dlopen.
	func_append dlfiles " $func_resolve_sysroot_result"
	prev=
	elif test dlprefiles = "$prev"; then
	# The library was specified with -dlpreopen.
	func_append dlprefiles " $func_resolve_sysroot_result"
	prev=
	else
	func_append deplibs " $func_resolve_sysroot_result"
	fi
	continue
	;;

	# Some other compiler argument.
	*)
	# Unknown arguments in both finalize_command and compile_command need
	# to be aesthetically quoted because they are evaled later.
	func_quote_for_eval "$arg"
	arg=$func_quote_for_eval_result
	;;
	esac # arg

	# Now actually substitute the argument into the commands.
	if test -n "$arg"; then
	func_append compile_command " $arg"
	func_append finalize_command " $arg"
	fi
	done # argument parsing loop

	test -n "$prev" && \
	func_fatal_help "the '$prevarg' option requires an argument"

	if test yes = "$export_dynamic" && test -n "$export_dynamic_flag_spec"; then
	eval arg=\"$export_dynamic_flag_spec\"
	func_append compile_command " $arg"
	func_append finalize_command " $arg"
	fi

	oldlibs=
	# calculate the name of the file, without its directory
	func_basename "$output"
	outputname=$func_basename_result
	libobjs_save=$libobjs

	if test -n "$shlibpath_var"; then
	# get the directories listed in $shlibpath_var
	eval shlib_search_path=\`\$ECHO \"\$$shlibpath_var\" \\| \$SED \'s/:/ /g\'\`
	else
	shlib_search_path=
	fi
	eval sys_lib_search_path=\"$sys_lib_search_path_spec\"
	eval sys_lib_dlsearch_path=\"$sys_lib_dlsearch_path_spec\"

	# Definition is injected by LT_CONFIG during libtool generation.
	func_munge_path_list sys_lib_dlsearch_path "$LT_SYS_LIBRARY_PATH"

	func_dirname "$output" "/" ""
	output_objdir=$func_dirname_result$objdir
	func_to_tool_file "$output_objdir/"
	tool_output_objdir=$func_to_tool_file_result
	# Create the object directory.
	func_mkdir_p "$output_objdir"

	# Determine the type of output
	case $output in
	"")
	func_fatal_help "you must specify an output file"
	;;
	*.$libext) linkmode=oldlib ;;
	.lo \| .$objext) linkmode=obj ;;
	*.la) linkmode=lib ;;
	*) linkmode=prog ;; # Anything else should be a program.
	esac

	specialdeplibs=

	libs=
	# Find all interdependent deplibs by searching for libraries
	# that are linked more than once (e.g. -la -lb -la)
	for deplib in $deplibs; do
	if $opt_preserve_dup_deps; then
	case "$libs " in
	" $deplib ") func_append specialdeplibs " $deplib" ;;
	esac
	fi
	func_append libs " $deplib"
	done

	if test lib = "$linkmode"; then
	libs="$predeps $libs $compiler_lib_search_path $postdeps"

	# Compute libraries that are listed more than once in $predeps
	# $postdeps and mark them as special (i.e., whose duplicates are
	# not to be eliminated).
	pre_post_deps=
	if $opt_duplicate_compiler_generated_deps; then
	for pre_post_dep in $predeps $postdeps; do
	case "$pre_post_deps " in
	" $pre_post_dep ") func_append specialdeplibs " $pre_post_deps" ;;
	esac
	func_append pre_post_deps " $pre_post_dep"
	done
	fi
	pre_post_deps=
	fi

	deplibs=
	newdependency_libs=
	newlib_search_path=
	need_relink=no # whether we're linking any uninstalled libtool libraries
	notinst_deplibs= # not-installed libtool libraries
	notinst_path= # paths that contain not-installed libtool libraries

	case $linkmode in
	lib)
	passes="conv dlpreopen link"
	for file in $dlfiles $dlprefiles; do
	case $file in
	*.la) ;;
	*)
	func_fatal_help "libraries can '-dlopen' only libtool libraries: $file"
	;;
	esac
	done
	;;
	prog)
	compile_deplibs=
	finalize_deplibs=
	alldeplibs=false
	newdlfiles=
	newdlprefiles=
	passes="conv scan dlopen dlpreopen link"
	;;
	*) passes="conv"
	;;
	esac

	for pass in $passes; do
	# The preopen pass in lib mode reverses $deplibs; put it back here
	# so that -L comes before libs that need it for instance...
	if test lib,link = "$linkmode,$pass"; then
	## FIXME: Find the place where the list is rebuilt in the wrong
	## order, and fix it there properly
	tmp_deplibs=
	for deplib in $deplibs; do
	tmp_deplibs="$deplib $tmp_deplibs"
	done
	deplibs=$tmp_deplibs
	fi

	if test lib,link = "$linkmode,$pass" \|\|
	test prog,scan = "$linkmode,$pass"; then
	libs=$deplibs
	deplibs=
	fi
	if test prog = "$linkmode"; then
	case $pass in
	dlopen) libs=$dlfiles ;;
	dlpreopen) libs=$dlprefiles ;;
	link) libs="$deplibs %DEPLIBS% $dependency_libs" ;;
	esac
	fi
	if test lib,dlpreopen = "$linkmode,$pass"; then
	# Collect and forward deplibs of preopened libtool libs
	for lib in $dlprefiles; do
	# Ignore non-libtool-libs
	dependency_libs=
	func_resolve_sysroot "$lib"
	case $lib in
	*.la) func_source "$func_resolve_sysroot_result" ;;
	esac

	# Collect preopened libtool deplibs, except any this library
	# has declared as weak libs
	for deplib in $dependency_libs; do
	func_basename "$deplib"
	deplib_base=$func_basename_result
	case " $weak_libs " in
	" $deplib_base ") ;;
	*) func_append deplibs " $deplib" ;;
	esac
	done
	done
	libs=$dlprefiles
	fi
	if test dlopen = "$pass"; then
	# Collect dlpreopened libraries
	save_deplibs=$deplibs
	deplibs=
	fi

	for deplib in $libs; do
	lib=
	found=false
	case $deplib in
	-mt\|-mthreads\|-kthread\|-Kthread\|-pthread\|-pthreads\|--thread-safe \
	\|-threads\|-fopenmp\|-openmp\|-mp\|-xopenmp\|-omp\|-qsmp=*)
	if test prog,link = "$linkmode,$pass"; then
	compile_deplibs="$deplib $compile_deplibs"
	finalize_deplibs="$deplib $finalize_deplibs"
	else
	func_append compiler_flags " $deplib"
	if test lib = "$linkmode"; then
	case "$new_inherited_linker_flags " in
	" $deplib ") ;;
	* ) func_append new_inherited_linker_flags " $deplib" ;;
	esac
	fi
	fi
	continue
	;;
	-l*)
	if test lib != "$linkmode" && test prog != "$linkmode"; then
	func_warning "'-l' is ignored for archives/objects"
	continue
	fi
	func_stripname '-l' '' "$deplib"
	name=$func_stripname_result
	if test lib = "$linkmode"; then
	searchdirs="$newlib_search_path $lib_search_path $compiler_lib_search_dirs $sys_lib_search_path $shlib_search_path"
	else
	searchdirs="$newlib_search_path $lib_search_path $sys_lib_search_path $shlib_search_path"
	fi
	for searchdir in $searchdirs; do
	for search_ext in .la $std_shrext .so .a; do
	# Search the libtool library
	lib=$searchdir/lib$name$search_ext
	if test -f "$lib"; then
	if test .la = "$search_ext"; then
	found=:
	else
	found=false
	fi
	break 2
	fi
	done
	done
	if $found; then
	# deplib is a libtool library
	# If $allow_libtool_libs_with_static_runtimes && $deplib is a stdlib,
	# We need to do some special things here, and not later.
	if test yes = "$allow_libtool_libs_with_static_runtimes"; then
	case " $predeps $postdeps " in
	" $deplib ")
	if func_lalib_p "$lib"; then
	library_names=
	old_library=
	func_source "$lib"
	for l in $old_library $library_names; do
	ll=$l
	done
	if test "X$ll" = "X$old_library"; then # only static version available
	found=false
	func_dirname "$lib" "" "."
	ladir=$func_dirname_result
	lib=$ladir/$old_library
	if test prog,link = "$linkmode,$pass"; then
	compile_deplibs="$deplib $compile_deplibs"
	finalize_deplibs="$deplib $finalize_deplibs"
	else
	deplibs="$deplib $deplibs"
	test lib = "$linkmode" && newdependency_libs="$deplib $newdependency_libs"
	fi
	continue
	fi
	fi
	;;
	*) ;;
	esac
	fi
	else
	# deplib doesn't seem to be a libtool library
	if test prog,link = "$linkmode,$pass"; then
	compile_deplibs="$deplib $compile_deplibs"
	finalize_deplibs="$deplib $finalize_deplibs"
	else
	deplibs="$deplib $deplibs"
	test lib = "$linkmode" && newdependency_libs="$deplib $newdependency_libs"
	fi
	continue
	fi
	;; # -l
	*.ltframework)
	if test prog,link = "$linkmode,$pass"; then
	compile_deplibs="$deplib $compile_deplibs"
	finalize_deplibs="$deplib $finalize_deplibs"
	else
	deplibs="$deplib $deplibs"
	if test lib = "$linkmode"; then
	case "$new_inherited_linker_flags " in
	" $deplib ") ;;
	* ) func_append new_inherited_linker_flags " $deplib" ;;
	esac
	fi
	fi
	continue
	;;
	-L*)
	case $linkmode in
	lib)
	deplibs="$deplib $deplibs"
	test conv = "$pass" && continue
	newdependency_libs="$deplib $newdependency_libs"
	func_stripname '-L' '' "$deplib"
	func_resolve_sysroot "$func_stripname_result"
	func_append newlib_search_path " $func_resolve_sysroot_result"
	;;
	prog)
	if test conv = "$pass"; then
	deplibs="$deplib $deplibs"
	continue
	fi
	if test scan = "$pass"; then
	deplibs="$deplib $deplibs"
	else
	compile_deplibs="$deplib $compile_deplibs"
	finalize_deplibs="$deplib $finalize_deplibs"
	fi
	func_stripname '-L' '' "$deplib"
	func_resolve_sysroot "$func_stripname_result"
	func_append newlib_search_path " $func_resolve_sysroot_result"
	;;
	*)
	func_warning "'-L' is ignored for archives/objects"
	;;
	esac # linkmode
	continue
	;; # -L
	-R*)
	if test link = "$pass"; then
	func_stripname '-R' '' "$deplib"
	func_resolve_sysroot "$func_stripname_result"
	dir=$func_resolve_sysroot_result
	# Make sure the xrpath contains only unique directories.
	case "$xrpath " in
	" $dir ") ;;
	*) func_append xrpath " $dir" ;;
	esac
	fi
	deplibs="$deplib $deplibs"
	continue
	;;
	*.la)
	func_resolve_sysroot "$deplib"
	lib=$func_resolve_sysroot_result
	;;
	*.$libext)
	if test conv = "$pass"; then
	deplibs="$deplib $deplibs"
	continue
	fi
	case $linkmode in
	lib)
	# Linking convenience modules into shared libraries is allowed,
	# but linking other static libraries is non-portable.
	case " $dlpreconveniencelibs " in
	" $deplib ") ;;
	*)
	valid_a_lib=false
	case $deplibs_check_method in
	match_pattern*)
	set dummy $deplibs_check_method; shift
	match_pattern_regex=`expr "$deplibs_check_method" : "$1 $.*$"`
	if eval "\$ECHO \"$deplib\"" 2>/dev/null \| $SED 10q \
	\| $EGREP "$match_pattern_regex" > /dev/null; then
	valid_a_lib=:
	fi
	;;
	pass_all)
	valid_a_lib=:
	;;
	esac
	if $valid_a_lib; then
	echo
	$ECHO "*** Warning: Linking the shared library $output against the"
	$ECHO "*** static library $deplib is not portable!"
	deplibs="$deplib $deplibs"
	else
	echo
	$ECHO "*** Warning: Trying to link with static lib archive $deplib."
	echo "*** I have the capability to make that library automatically link in when"
	echo "*** you link to this library. But I can only do this if you have a"
	echo "*** shared version of the library, which you do not appear to have"
	echo "*** because the file extensions .$libext of this argument makes me believe"
	echo "*** that it is just a static archive that I should not use here."
	fi
	;;
	esac
	continue
	;;
	prog)
	if test link != "$pass"; then
	deplibs="$deplib $deplibs"
	else
	compile_deplibs="$deplib $compile_deplibs"
	finalize_deplibs="$deplib $finalize_deplibs"
	fi
	continue
	;;
	esac # linkmode
	;; # *.$libext
	.lo \| .$objext)
	if test conv = "$pass"; then
	deplibs="$deplib $deplibs"
	elif test prog = "$linkmode"; then
	if test dlpreopen = "$pass" \|\| test yes != "$dlopen_support" \|\| test no = "$build_libtool_libs"; then
	# If there is no dlopen support or we're linking statically,
	# we need to preload.
	func_append newdlprefiles " $deplib"
	compile_deplibs="$deplib $compile_deplibs"
	finalize_deplibs="$deplib $finalize_deplibs"
	else
	func_append newdlfiles " $deplib"
	fi
	fi
	continue
	;;
	%DEPLIBS%)
	alldeplibs=:
	continue
	;;
	esac # case $deplib

	$found \|\| test -f "$lib" \
	\|\| func_fatal_error "cannot find the library '$lib' or unhandled argument '$deplib'"

	# Check to see that this really is a libtool archive.
	func_lalib_unsafe_p "$lib" \
	\|\| func_fatal_error "'$lib' is not a valid libtool archive"

	func_dirname "$lib" "" "."
	ladir=$func_dirname_result

	dlname=
	dlopen=
	dlpreopen=
	libdir=
	library_names=
	old_library=
	inherited_linker_flags=
	# If the library was installed with an old release of libtool,
	# it will not redefine variables installed, or shouldnotlink
	installed=yes
	shouldnotlink=no
	avoidtemprpath=


	# Read the .la file
	func_source "$lib"

	# Convert "-framework foo" to "foo.ltframework"
	if test -n "$inherited_linker_flags"; then
	tmp_inherited_linker_flags=`$ECHO "$inherited_linker_flags" \| $SED 's/-framework $[^ $]*$/\1.ltframework/g'`
	for tmp_inherited_linker_flag in $tmp_inherited_linker_flags; do
	case " $new_inherited_linker_flags " in
	" $tmp_inherited_linker_flag ") ;;
	*) func_append new_inherited_linker_flags " $tmp_inherited_linker_flag";;
	esac
	done
	fi
	dependency_libs=`$ECHO " $dependency_libs" \| $SED 's% $[^ $]*$.ltframework% -framework \1%g'`
	if test lib,link = "$linkmode,$pass" \|\|
	test prog,scan = "$linkmode,$pass" \|\|
	{ test prog != "$linkmode" && test lib != "$linkmode"; }; then
	test -n "$dlopen" && func_append dlfiles " $dlopen"
	test -n "$dlpreopen" && func_append dlprefiles " $dlpreopen"
	fi

	if test conv = "$pass"; then
	# Only check for convenience libraries
	deplibs="$lib $deplibs"
	if test -z "$libdir"; then
	if test -z "$old_library"; then
	func_fatal_error "cannot find name of link library for '$lib'"
	fi
	# It is a libtool convenience library, so add in its objects.
	func_append convenience " $ladir/$objdir/$old_library"
	func_append old_convenience " $ladir/$objdir/$old_library"
	elif test prog != "$linkmode" && test lib != "$linkmode"; then
	func_fatal_error "'$lib' is not a convenience library"
	fi
	tmp_libs=
	for deplib in $dependency_libs; do
	deplibs="$deplib $deplibs"
	if $opt_preserve_dup_deps; then
	case "$tmp_libs " in
	" $deplib ") func_append specialdeplibs " $deplib" ;;
	esac
	fi
	func_append tmp_libs " $deplib"
	done
	continue
	fi # $pass = conv


	# Get the name of the library we link against.
	linklib=
	if test -n "$old_library" &&
	{ test yes = "$prefer_static_libs" \|\|
	test built,no = "$prefer_static_libs,$installed"; }; then
	linklib=$old_library
	else
	for l in $old_library $library_names; do
	linklib=$l
	done
	fi
	if test -z "$linklib"; then
	func_fatal_error "cannot find name of link library for '$lib'"
	fi

	# This library was specified with -dlopen.
	if test dlopen = "$pass"; then
	test -z "$libdir" \
	&& func_fatal_error "cannot -dlopen a convenience library: '$lib'"
	if test -z "$dlname" \|\|
	test yes != "$dlopen_support" \|\|
	test no = "$build_libtool_libs"
	then
	# If there is no dlname, no dlopen support or we're linking
	# statically, we need to preload. We also need to preload any
	# dependent libraries so libltdl's deplib preloader doesn't
	# bomb out in the load deplibs phase.
	func_append dlprefiles " $lib $dependency_libs"
	else
	func_append newdlfiles " $lib"
	fi
	continue
	fi # $pass = dlopen

	# We need an absolute path.
	case $ladir in
	[\\/]* \| [A-Za-z]:[\\/]*) abs_ladir=$ladir ;;
	*)
	abs_ladir=`cd "$ladir" && pwd`
	if test -z "$abs_ladir"; then
	func_warning "cannot determine absolute directory name of '$ladir'"
	func_warning "passing it literally to the linker, although it might fail"
	abs_ladir=$ladir
	fi
	;;
	esac
	func_basename "$lib"
	laname=$func_basename_result

	# Find the relevant object directory and library name.
	if test yes = "$installed"; then
	if test ! -f "$lt_sysroot$libdir/$linklib" && test -f "$abs_ladir/$linklib"; then
	func_warning "library '$lib' was moved."
	dir=$ladir
	absdir=$abs_ladir
	libdir=$abs_ladir
	else
	dir=$lt_sysroot$libdir
	absdir=$lt_sysroot$libdir
	fi
	test yes = "$hardcode_automatic" && avoidtemprpath=yes
	else
	if test ! -f "$ladir/$objdir/$linklib" && test -f "$abs_ladir/$linklib"; then
	dir=$ladir
	absdir=$abs_ladir
	# Remove this search path later
	func_append notinst_path " $abs_ladir"
	else
	dir=$ladir/$objdir
	absdir=$abs_ladir/$objdir
	# Remove this search path later
	func_append notinst_path " $abs_ladir"
	fi
	fi # $installed = yes
	func_stripname 'lib' '.la' "$laname"
	name=$func_stripname_result

	# This library was specified with -dlpreopen.
	if test dlpreopen = "$pass"; then
	if test -z "$libdir" && test prog = "$linkmode"; then
	func_fatal_error "only libraries may -dlpreopen a convenience library: '$lib'"
	fi
	case $host in
	# special handling for platforms with PE-DLLs.
	cygwin \| mingw \| cegcc )
	# Linker will automatically link against shared library if both
	# static and shared are present. Therefore, ensure we extract
	# symbols from the import library if a shared library is present
	# (otherwise, the dlopen module name will be incorrect). We do
	# this by putting the import library name into $newdlprefiles.
	# We recover the dlopen module name by 'saving' the la file
	# name in a special purpose variable, and (later) extracting the
	# dlname from the la file.
	if test -n "$dlname"; then
	func_tr_sh "$dir/$linklib"
	eval "libfile_$func_tr_sh_result=\$abs_ladir/\$laname"
	func_append newdlprefiles " $dir/$linklib"
	else
	func_append newdlprefiles " $dir/$old_library"
	# Keep a list of preopened convenience libraries to check
	# that they are being used correctly in the link pass.
	test -z "$libdir" && \
	func_append dlpreconveniencelibs " $dir/$old_library"
	fi
	;;
	* )
	# Prefer using a static library (so that no silly _DYNAMIC symbols
	# are required to link).
	if test -n "$old_library"; then
	func_append newdlprefiles " $dir/$old_library"
	# Keep a list of preopened convenience libraries to check
	# that they are being used correctly in the link pass.
	test -z "$libdir" && \
	func_append dlpreconveniencelibs " $dir/$old_library"
	# Otherwise, use the dlname, so that lt_dlopen finds it.
	elif test -n "$dlname"; then
	func_append newdlprefiles " $dir/$dlname"
	else
	func_append newdlprefiles " $dir/$linklib"
	fi
	;;
	esac
	fi # $pass = dlpreopen

	if test -z "$libdir"; then
	# Link the convenience library
	if test lib = "$linkmode"; then
	deplibs="$dir/$old_library $deplibs"
	elif test prog,link = "$linkmode,$pass"; then
	compile_deplibs="$dir/$old_library $compile_deplibs"
	finalize_deplibs="$dir/$old_library $finalize_deplibs"
	else
	deplibs="$lib $deplibs" # used for prog,scan pass
	fi
	continue
	fi


	if test prog = "$linkmode" && test link != "$pass"; then
	func_append newlib_search_path " $ladir"
	deplibs="$lib $deplibs"

	linkalldeplibs=false
	if test no != "$link_all_deplibs" \|\| test -z "$library_names" \|\|
	test no = "$build_libtool_libs"; then
	linkalldeplibs=:
	fi

	tmp_libs=
	for deplib in $dependency_libs; do
	case $deplib in
	-L*) func_stripname '-L' '' "$deplib"
	func_resolve_sysroot "$func_stripname_result"
	func_append newlib_search_path " $func_resolve_sysroot_result"
	;;
	esac
	# Need to link against all dependency_libs?
	if $linkalldeplibs; then
	deplibs="$deplib $deplibs"
	else
	# Need to hardcode shared library paths
	# or/and link against static libraries
	newdependency_libs="$deplib $newdependency_libs"
	fi
	if $opt_preserve_dup_deps; then
	case "$tmp_libs " in
	" $deplib ") func_append specialdeplibs " $deplib" ;;
	esac
	fi
	func_append tmp_libs " $deplib"
	done # for deplib
	continue
	fi # $linkmode = prog...

	if test prog,link = "$linkmode,$pass"; then
	if test -n "$library_names" &&
	{ { test no = "$prefer_static_libs" \|\|
	test built,yes = "$prefer_static_libs,$installed"; } \|\|
	test -z "$old_library"; }; then
	# We need to hardcode the library path
	if test -n "$shlibpath_var" && test -z "$avoidtemprpath"; then
	# Make sure the rpath contains only unique directories.
	case $temp_rpath: in
	"$absdir:") ;;
	*) func_append temp_rpath "$absdir:" ;;
	esac
	fi

	# Hardcode the library path.
	# Skip directories that are in the system default run-time
	# search path.
	case " $sys_lib_dlsearch_path " in
	" $absdir ") ;;
	*)
	case "$compile_rpath " in
	" $absdir ") ;;
	*) func_append compile_rpath " $absdir" ;;
	esac
	;;
	esac
	case " $sys_lib_dlsearch_path " in
	" $libdir ") ;;
	*)
	case "$finalize_rpath " in
	" $libdir ") ;;
	*) func_append finalize_rpath " $libdir" ;;
	esac
	;;
	esac
	fi # $linkmode,$pass = prog,link...

	if $alldeplibs &&
	{ test pass_all = "$deplibs_check_method" \|\|
	{ test yes = "$build_libtool_libs" &&
	test -n "$library_names"; }; }; then
	# We only need to search for static libraries
	continue
	fi
	fi

	link_static=no # Whether the deplib will be linked statically
	use_static_libs=$prefer_static_libs
	if test built = "$use_static_libs" && test yes = "$installed"; then
	use_static_libs=no
	fi
	if test -n "$library_names" &&
	{ test no = "$use_static_libs" \|\| test -z "$old_library"; }; then
	case $host in
	cygwin \| mingw \| cegcc \| os2)
	# No point in relinking DLLs because paths are not encoded
	func_append notinst_deplibs " $lib"
	need_relink=no
	;;
	*)
	if test no = "$installed"; then
	func_append notinst_deplibs " $lib"
	need_relink=yes
	fi
	;;
	esac
	# This is a shared library

	# Warn about portability, can't link against -module's on some
	# systems (darwin). Don't bleat about dlopened modules though!
	dlopenmodule=
	for dlpremoduletest in $dlprefiles; do
	if test "X$dlpremoduletest" = "X$lib"; then
	dlopenmodule=$dlpremoduletest
	break
	fi
	done
	if test -z "$dlopenmodule" && test yes = "$shouldnotlink" && test link = "$pass"; then
	echo
	if test prog = "$linkmode"; then
	$ECHO "*** Warning: Linking the executable $output against the loadable module"
	else
	$ECHO "*** Warning: Linking the shared library $output against the loadable module"
	fi
	$ECHO "*** $linklib is not portable!"
	fi
	if test lib = "$linkmode" &&
	test yes = "$hardcode_into_libs"; then
	# Hardcode the library path.
	# Skip directories that are in the system default run-time
	# search path.
	case " $sys_lib_dlsearch_path " in
	" $absdir ") ;;
	*)
	case "$compile_rpath " in
	" $absdir ") ;;
	*) func_append compile_rpath " $absdir" ;;
	esac
	;;
	esac
	case " $sys_lib_dlsearch_path " in
	" $libdir ") ;;
	*)
	case "$finalize_rpath " in
	" $libdir ") ;;
	*) func_append finalize_rpath " $libdir" ;;
	esac
	;;
	esac
	fi

	if test -n "$old_archive_from_expsyms_cmds"; then
	# figure out the soname
	set dummy $library_names
	shift
	realname=$1
	shift
	libname=`eval "\\$ECHO \"$libname_spec\""`
	# use dlname if we got it. it's perfectly good, no?
	if test -n "$dlname"; then
	soname=$dlname
	elif test -n "$soname_spec"; then
	# bleh windows
	case $host in
	cygwin \| mingw* \| cegcc \| os2)
	func_arith $current - $age
	major=$func_arith_result
	versuffix=-$major
	;;
	esac
	eval soname=\"$soname_spec\"
	else
	soname=$realname
	fi

	# Make a new name for the extract_expsyms_cmds to use
	soroot=$soname
	func_basename "$soroot"
	soname=$func_basename_result
	func_stripname 'lib' '.dll' "$soname"
	newlib=libimp-$func_stripname_result.a

	# If the library has no export list, then create one now
	if test -f "$output_objdir/$soname-def"; then :
	else
	func_verbose "extracting exported symbol list from '$soname'"
	func_execute_cmds "$extract_expsyms_cmds" 'exit $?'
	fi

	# Create $newlib
	if test -f "$output_objdir/$newlib"; then :; else
	func_verbose "generating import library for '$soname'"
	func_execute_cmds "$old_archive_from_expsyms_cmds" 'exit $?'
	fi
	# make sure the library variables are pointing to the new library
	dir=$output_objdir
	linklib=$newlib
	fi # test -n "$old_archive_from_expsyms_cmds"

	if test prog = "$linkmode" \|\| test relink != "$opt_mode"; then
	add_shlibpath=
	add_dir=
	add=
	lib_linked=yes
	case $hardcode_action in
	immediate \| unsupported)
	if test no = "$hardcode_direct"; then
	add=$dir/$linklib
	case $host in
	--sco3.2v5.0.[024]*) add_dir=-L$dir ;;
	--sysv4uw2) add_dir=-L$dir ;;
	--sysv5OpenUNIX* \| --sysv5UnixWare7.[01].[10]* \| \
	--unixware7*) add_dir=-L$dir ;;
	--darwin* )
	# if the lib is a (non-dlopened) module then we cannot
	# link against it, someone is ignoring the earlier warnings
	if /usr/bin/file -L $add 2> /dev/null \|
	$GREP ": [^:]* bundle" >/dev/null; then
	if test "X$dlopenmodule" != "X$lib"; then
	$ECHO "*** Warning: lib $linklib is a module, not a shared library"
	if test -z "$old_library"; then
	echo
	echo "*** And there doesn't seem to be a static archive available"
	echo "*** The link will probably fail, sorry"
	else
	add=$dir/$old_library
	fi
	elif test -n "$old_library"; then
	add=$dir/$old_library
	fi
	fi
	esac
	elif test no = "$hardcode_minus_L"; then
	case $host in
	--sunos*) add_shlibpath=$dir ;;
	esac
	add_dir=-L$dir
	add=-l$name
	elif test no = "$hardcode_shlibpath_var"; then
	add_shlibpath=$dir
	add=-l$name
	else
	lib_linked=no
	fi
	;;
	relink)
	if test yes = "$hardcode_direct" &&
	test no = "$hardcode_direct_absolute"; then
	add=$dir/$linklib
	elif test yes = "$hardcode_minus_L"; then
	add_dir=-L$absdir
	# Try looking first in the location we're being installed to.
	if test -n "$inst_prefix_dir"; then
	case $libdir in
	[\\/]*)
	func_append add_dir " -L$inst_prefix_dir$libdir"
	;;
	esac
	fi
	add=-l$name
	elif test yes = "$hardcode_shlibpath_var"; then
	add_shlibpath=$dir
	add=-l$name
	else
	lib_linked=no
	fi
	;;
	*) lib_linked=no ;;
	esac

	if test yes != "$lib_linked"; then
	func_fatal_configuration "unsupported hardcode properties"
	fi

	if test -n "$add_shlibpath"; then
	case :$compile_shlibpath: in
	":$add_shlibpath:") ;;
	*) func_append compile_shlibpath "$add_shlibpath:" ;;
	esac
	fi
	if test prog = "$linkmode"; then
	test -n "$add_dir" && compile_deplibs="$add_dir $compile_deplibs"
	test -n "$add" && compile_deplibs="$add $compile_deplibs"
	else
	test -n "$add_dir" && deplibs="$add_dir $deplibs"
	test -n "$add" && deplibs="$add $deplibs"
	if test yes != "$hardcode_direct" &&
	test yes != "$hardcode_minus_L" &&
	test yes = "$hardcode_shlibpath_var"; then
	case :$finalize_shlibpath: in
	":$libdir:") ;;
	*) func_append finalize_shlibpath "$libdir:" ;;
	esac
	fi
	fi
	fi

	if test prog = "$linkmode" \|\| test relink = "$opt_mode"; then
	add_shlibpath=
	add_dir=
	add=
	# Finalize command for both is simple: just hardcode it.
	if test yes = "$hardcode_direct" &&
	test no = "$hardcode_direct_absolute"; then
	add=$libdir/$linklib
	elif test yes = "$hardcode_minus_L"; then
	add_dir=-L$libdir
	add=-l$name
	elif test yes = "$hardcode_shlibpath_var"; then
	case :$finalize_shlibpath: in
	":$libdir:") ;;
	*) func_append finalize_shlibpath "$libdir:" ;;
	esac
	add=-l$name
	elif test yes = "$hardcode_automatic"; then
	if test -n "$inst_prefix_dir" &&
	test -f "$inst_prefix_dir$libdir/$linklib"; then
	add=$inst_prefix_dir$libdir/$linklib
	else
	add=$libdir/$linklib
	fi
	else
	# We cannot seem to hardcode it, guess we'll fake it.
	add_dir=-L$libdir
	# Try looking first in the location we're being installed to.
	if test -n "$inst_prefix_dir"; then
	case $libdir in
	[\\/]*)
	func_append add_dir " -L$inst_prefix_dir$libdir"
	;;
	esac
	fi
	add=-l$name
	fi

	if test prog = "$linkmode"; then
	test -n "$add_dir" && finalize_deplibs="$add_dir $finalize_deplibs"
	test -n "$add" && finalize_deplibs="$add $finalize_deplibs"
	else
	test -n "$add_dir" && deplibs="$add_dir $deplibs"
	test -n "$add" && deplibs="$add $deplibs"
	fi
	fi
	elif test prog = "$linkmode"; then
	# Here we assume that one of hardcode_direct or hardcode_minus_L
	# is not unsupported. This is valid on all known static and
	# shared platforms.
	if test unsupported != "$hardcode_direct"; then
	test -n "$old_library" && linklib=$old_library
	compile_deplibs="$dir/$linklib $compile_deplibs"
	finalize_deplibs="$dir/$linklib $finalize_deplibs"
	else
	compile_deplibs="-l$name -L$dir $compile_deplibs"
	finalize_deplibs="-l$name -L$dir $finalize_deplibs"
	fi
	elif test yes = "$build_libtool_libs"; then
	# Not a shared library
	if test pass_all != "$deplibs_check_method"; then
	# We're trying link a shared library against a static one
	# but the system doesn't support it.

	# Just print a warning and add the library to dependency_libs so
	# that the program can be linked against the static library.
	echo
	$ECHO "*** Warning: This system cannot link to static lib archive $lib."
	echo "*** I have the capability to make that library automatically link in when"
	echo "*** you link to this library. But I can only do this if you have a"
	echo "*** shared version of the library, which you do not appear to have."
	if test yes = "$module"; then
	echo "*** But as you try to build a module library, libtool will still create "
	echo "*** a static module, that should work as long as the dlopening application"
	echo "*** is linked with the -dlopen flag to resolve symbols at runtime."
	if test -z "$global_symbol_pipe"; then
	echo
	echo "*** However, this would only work if libtool was able to extract symbol"
	echo "*** lists from a program, using 'nm' or equivalent, but libtool could"
	echo "*** not find such a program. So, this module is probably useless."
	echo "*** 'nm' from GNU binutils and a full rebuild may help."
	fi
	if test no = "$build_old_libs"; then
	build_libtool_libs=module
	build_old_libs=yes
	else
	build_libtool_libs=no
	fi
	fi
	else
	deplibs="$dir/$old_library $deplibs"
	link_static=yes
	fi
	fi # link shared/static library?

	if test lib = "$linkmode"; then
	if test -n "$dependency_libs" &&
	{ test yes != "$hardcode_into_libs" \|\|
	test yes = "$build_old_libs" \|\|
	test yes = "$link_static"; }; then
	# Extract -R from dependency_libs
	temp_deplibs=
	for libdir in $dependency_libs; do
	case $libdir in
	-R*) func_stripname '-R' '' "$libdir"
	temp_xrpath=$func_stripname_result
	case " $xrpath " in
	" $temp_xrpath ") ;;
	*) func_append xrpath " $temp_xrpath";;
	esac;;
	*) func_append temp_deplibs " $libdir";;
	esac
	done
	dependency_libs=$temp_deplibs
	fi

	func_append newlib_search_path " $absdir"
	# Link against this library
	test no = "$link_static" && newdependency_libs="$abs_ladir/$laname $newdependency_libs"
	# ... and its dependency_libs
	tmp_libs=
	for deplib in $dependency_libs; do
	newdependency_libs="$deplib $newdependency_libs"
	case $deplib in
	-L*) func_stripname '-L' '' "$deplib"
	func_resolve_sysroot "$func_stripname_result";;
	*) func_resolve_sysroot "$deplib" ;;
	esac
	if $opt_preserve_dup_deps; then
	case "$tmp_libs " in
	" $func_resolve_sysroot_result ")
	func_append specialdeplibs " $func_resolve_sysroot_result" ;;
	esac
	fi
	func_append tmp_libs " $func_resolve_sysroot_result"
	done

	if test no != "$link_all_deplibs"; then
	# Add the search paths of all dependency libraries
	for deplib in $dependency_libs; do
	path=
	case $deplib in
	-L*) path=$deplib ;;
	*.la)
	func_resolve_sysroot "$deplib"
	deplib=$func_resolve_sysroot_result
	func_dirname "$deplib" "" "."
	dir=$func_dirname_result
	# We need an absolute path.
	case $dir in
	[\\/]* \| [A-Za-z]:[\\/]*) absdir=$dir ;;
	*)
	absdir=`cd "$dir" && pwd`
	if test -z "$absdir"; then
	func_warning "cannot determine absolute directory name of '$dir'"
	absdir=$dir
	fi
	;;
	esac
	if $GREP "^installed=no" $deplib > /dev/null; then
	case $host in
	--darwin*)
	depdepl=
	eval deplibrary_names=`$SED -n -e 's/^library_names=$.*$$/\1/p' $deplib`
	if test -n "$deplibrary_names"; then
	for tmp in $deplibrary_names; do
	depdepl=$tmp
	done
	if test -f "$absdir/$objdir/$depdepl"; then
	depdepl=$absdir/$objdir/$depdepl
	darwin_install_name=`$OTOOL -L $depdepl \| awk '{if (NR == 2) {print $1;exit}}'`
	if test -z "$darwin_install_name"; then
	darwin_install_name=`$OTOOL64 -L $depdepl \| awk '{if (NR == 2) {print $1;exit}}'`
	fi
	func_append compiler_flags " $wl-dylib_file $wl$darwin_install_name:$depdepl"
	func_append linker_flags " -dylib_file $darwin_install_name:$depdepl"
	path=
	fi
	fi
	;;
	*)
	path=-L$absdir/$objdir
	;;
	esac
	else
	eval libdir=`$SED -n -e 's/^libdir=$.*$$/\1/p' $deplib`
	test -z "$libdir" && \
	func_fatal_error "'$deplib' is not a valid libtool archive"
	test "$absdir" != "$libdir" && \
	func_warning "'$deplib' seems to be moved"

	path=-L$absdir
	fi
	;;
	esac
	case " $deplibs " in
	" $path ") ;;
	*) deplibs="$path $deplibs" ;;
	esac
	done
	fi # link_all_deplibs != no
	fi # linkmode = lib
	done # for deplib in $libs
	if test link = "$pass"; then
	if test prog = "$linkmode"; then
	compile_deplibs="$new_inherited_linker_flags $compile_deplibs"
	finalize_deplibs="$new_inherited_linker_flags $finalize_deplibs"
	else
	compiler_flags="$compiler_flags "`$ECHO " $new_inherited_linker_flags" \| $SED 's% $[^ $]*$.ltframework% -framework \1%g'`
	fi
	fi
	dependency_libs=$newdependency_libs
	if test dlpreopen = "$pass"; then
	# Link the dlpreopened libraries before other libraries
	for deplib in $save_deplibs; do
	deplibs="$deplib $deplibs"
	done
	fi
	if test dlopen != "$pass"; then
	test conv = "$pass" \|\| {
	# Make sure lib_search_path contains only unique directories.
	lib_search_path=
	for dir in $newlib_search_path; do
	case "$lib_search_path " in
	" $dir ") ;;
	*) func_append lib_search_path " $dir" ;;
	esac
	done
	newlib_search_path=
	}

	if test prog,link = "$linkmode,$pass"; then
	vars="compile_deplibs finalize_deplibs"
	else
	vars=deplibs
	fi
	for var in $vars dependency_libs; do
	# Add libraries to $var in reverse order
	eval tmp_libs=\"\$$var\"
	new_libs=
	for deplib in $tmp_libs; do
	# FIXME: Pedantically, this is the right thing to do, so
	# that some nasty dependency loop isn't accidentally
	# broken:
	#new_libs="$deplib $new_libs"
	# Pragmatically, this seems to cause very few problems in
	# practice:
	case $deplib in
	-L*) new_libs="$deplib $new_libs" ;;
	-R*) ;;
	*)
	# And here is the reason: when a library appears more
	# than once as an explicit dependence of a library, or
	# is implicitly linked in more than once by the
	# compiler, it is considered special, and multiple
	# occurrences thereof are not removed. Compare this
	# with having the same library being listed as a
	# dependency of multiple other libraries: in this case,
	# we know (pedantically, we assume) the library does not
	# need to be listed more than once, so we keep only the
	# last copy. This is not always right, but it is rare
	# enough that we require users that really mean to play
	# such unportable linking tricks to link the library
	# using -Wl,-lname, so that libtool does not consider it
	# for duplicate removal.
	case " $specialdeplibs " in
	" $deplib ") new_libs="$deplib $new_libs" ;;
	*)
	case " $new_libs " in
	" $deplib ") ;;
	*) new_libs="$deplib $new_libs" ;;
	esac
	;;
	esac
	;;
	esac
	done
	tmp_libs=
	for deplib in $new_libs; do
	case $deplib in
	-L*)
	case " $tmp_libs " in
	" $deplib ") ;;
	*) func_append tmp_libs " $deplib" ;;
	esac
	;;
	*) func_append tmp_libs " $deplib" ;;
	esac
	done
	eval $var=\"$tmp_libs\"
	done # for var
	fi

	# Add Sun CC postdeps if required:
	test CXX = "$tagname" && {
	case $host_os in
	linux*)
	case `$CC -V 2>&1 \| sed 5q` in
	Sun\ C) # Sun C++ 5.9
	func_suncc_cstd_abi

	if test no != "$suncc_use_cstd_abi"; then
	func_append postdeps ' -library=Cstd -library=Crun'
	fi
	;;
	esac
	;;

	solaris*)
	func_cc_basename "$CC"
	case $func_cc_basename_result in
	CC* \| sunCC*)
	func_suncc_cstd_abi

	if test no != "$suncc_use_cstd_abi"; then
	func_append postdeps ' -library=Cstd -library=Crun'
	fi
	;;
	esac
	;;
	esac
	}

	# Last step: remove runtime libs from dependency_libs
	# (they stay in deplibs)
	tmp_libs=
	for i in $dependency_libs; do
	case " $predeps $postdeps $compiler_lib_search_path " in
	" $i ")
	i=
	;;
	esac
	if test -n "$i"; then
	func_append tmp_libs " $i"
	fi
	done
	dependency_libs=$tmp_libs
	done # for pass
	if test prog = "$linkmode"; then
	dlfiles=$newdlfiles
	fi
	if test prog = "$linkmode" \|\| test lib = "$linkmode"; then
	dlprefiles=$newdlprefiles
	fi

	case $linkmode in
	oldlib)
	if test -n "$dlfiles$dlprefiles" \|\| test no != "$dlself"; then
	func_warning "'-dlopen' is ignored for archives"
	fi

	case " $deplibs" in
	\ -l \| \ -L)
	func_warning "'-l' and '-L' are ignored for archives" ;;
	esac

	test -n "$rpath" && \
	func_warning "'-rpath' is ignored for archives"

	test -n "$xrpath" && \
	func_warning "'-R' is ignored for archives"

	test -n "$vinfo" && \
	func_warning "'-version-info/-version-number' is ignored for archives"

	test -n "$release" && \
	func_warning "'-release' is ignored for archives"

	test -n "$export_symbols$export_symbols_regex" && \
	func_warning "'-export-symbols' is ignored for archives"

	# Now set the variables for building old libraries.
	build_libtool_libs=no
	oldlibs=$output
	func_append objs "$old_deplibs"
	;;

	lib)
	# Make sure we only generate libraries of the form 'libNAME.la'.
	case $outputname in
	lib*)
	func_stripname 'lib' '.la' "$outputname"
	name=$func_stripname_result
	eval shared_ext=\"$shrext_cmds\"
	eval libname=\"$libname_spec\"
	;;
	*)
	test no = "$module" \
	&& func_fatal_help "libtool library '$output' must begin with 'lib'"

	if test no != "$need_lib_prefix"; then
	# Add the "lib" prefix for modules if required
	func_stripname '' '.la' "$outputname"
	name=$func_stripname_result
	eval shared_ext=\"$shrext_cmds\"
	eval libname=\"$libname_spec\"
	else
	func_stripname '' '.la' "$outputname"
	libname=$func_stripname_result
	fi
	;;
	esac

	if test -n "$objs"; then
	if test pass_all != "$deplibs_check_method"; then
	func_fatal_error "cannot build libtool library '$output' from non-libtool objects on this host:$objs"
	else
	echo
	$ECHO "*** Warning: Linking the shared library $output against the non-libtool"
	$ECHO "*** objects $objs is not portable!"
	func_append libobjs " $objs"
	fi
	fi

	test no = "$dlself" \
	\|\| func_warning "'-dlopen self' is ignored for libtool libraries"

	set dummy $rpath
	shift
	test 1 -lt "$#" \
	&& func_warning "ignoring multiple '-rpath's for a libtool library"

	install_libdir=$1

	oldlibs=
	if test -z "$rpath"; then
	if test yes = "$build_libtool_libs"; then
	# Building a libtool convenience library.
	# Some compilers have problems with a '.al' extension so
	# convenience libraries should have the same extension an
	# archive normally would.
	oldlibs="$output_objdir/$libname.$libext $oldlibs"
	build_libtool_libs=convenience
	build_old_libs=yes
	fi

	test -n "$vinfo" && \
	func_warning "'-version-info/-version-number' is ignored for convenience libraries"

	test -n "$release" && \
	func_warning "'-release' is ignored for convenience libraries"
	else

	# Parse the version information argument.
	save_ifs=$IFS; IFS=:
	set dummy $vinfo 0 0 0
	shift
	IFS=$save_ifs

	test -n "$7" && \
	func_fatal_help "too many parameters to '-version-info'"

	# convert absolute version numbers to libtool ages
	# this retains compatibility with .la files and attempts
	# to make the code below a bit more comprehensible

	case $vinfo_number in
	yes)
	number_major=$1
	number_minor=$2
	number_revision=$3
	#
	# There are really only two kinds -- those that
	# use the current revision as the major version
	# and those that subtract age and use age as
	# a minor version. But, then there is irix
	# that has an extra 1 added just for fun
	#
	case $version_type in
	# correct linux to gnu/linux during the next big refactor
	darwin\|freebsd-elf\|linux\|osf\|windows\|none)
	func_arith $number_major + $number_minor
	current=$func_arith_result
	age=$number_minor
	revision=$number_revision
	;;
	freebsd-aout\|qnx\|sunos)
	current=$number_major
	revision=$number_minor
	age=0
	;;
	irix\|nonstopux)
	func_arith $number_major + $number_minor
	current=$func_arith_result
	age=$number_minor
	revision=$number_minor
	lt_irix_increment=no
	;;
	esac
	;;
	no)
	current=$1
	revision=$2
	age=$3
	;;
	esac

	# Check that each of the things are valid numbers.
	case $current in
	0\|[1-9]\|[1-9][0-9]\|[1-9][0-9][0-9]\|[1-9][0-9][0-9][0-9]\|[1-9][0-9][0-9][0-9][0-9]) ;;
	*)
	func_error "CURRENT '$current' must be a nonnegative integer"
	func_fatal_error "'$vinfo' is not valid version information"
	;;
	esac

	case $revision in
	0\|[1-9]\|[1-9][0-9]\|[1-9][0-9][0-9]\|[1-9][0-9][0-9][0-9]\|[1-9][0-9][0-9][0-9][0-9]) ;;
	*)
	func_error "REVISION '$revision' must be a nonnegative integer"
	func_fatal_error "'$vinfo' is not valid version information"
	;;
	esac

	case $age in
	0\|[1-9]\|[1-9][0-9]\|[1-9][0-9][0-9]\|[1-9][0-9][0-9][0-9]\|[1-9][0-9][0-9][0-9][0-9]) ;;
	*)
	func_error "AGE '$age' must be a nonnegative integer"
	func_fatal_error "'$vinfo' is not valid version information"
	;;
	esac

	if test "$age" -gt "$current"; then
	func_error "AGE '$age' is greater than the current interface number '$current'"
	func_fatal_error "'$vinfo' is not valid version information"
	fi

	# Calculate the version variables.
	major=
	versuffix=
	verstring=
	case $version_type in
	none) ;;

	darwin)
	# Like Linux, but with the current version available in
	# verstring for coding it into the library header
	func_arith $current - $age
	major=.$func_arith_result
	versuffix=$major.$age.$revision
	# Darwin ld doesn't like 0 for these options...
	func_arith $current + 1
	minor_current=$func_arith_result
	xlcverstring="$wl-compatibility_version $wl$minor_current $wl-current_version $wl$minor_current.$revision"
	verstring="-compatibility_version $minor_current -current_version $minor_current.$revision"
	# On Darwin other compilers
	case $CC in
	nagfor*)
	verstring="$wl-compatibility_version $wl$minor_current $wl-current_version $wl$minor_current.$revision"
	;;
	*)
	verstring="-compatibility_version $minor_current -current_version $minor_current.$revision"
	;;
	esac
	;;

	freebsd-aout)
	major=.$current
	versuffix=.$current.$revision
	;;

	freebsd-elf)
	func_arith $current - $age
	major=.$func_arith_result
	versuffix=$major.$age.$revision
	;;

	irix \| nonstopux)
	if test no = "$lt_irix_increment"; then
	func_arith $current - $age
	else
	func_arith $current - $age + 1
	fi
	major=$func_arith_result

	case $version_type in
	nonstopux) verstring_prefix=nonstopux ;;
	*) verstring_prefix=sgi ;;
	esac
	verstring=$verstring_prefix$major.$revision

	# Add in all the interfaces that we are compatible with.
	loop=$revision
	while test 0 -ne "$loop"; do
	func_arith $revision - $loop
	iface=$func_arith_result
	func_arith $loop - 1
	loop=$func_arith_result
	verstring=$verstring_prefix$major.$iface:$verstring
	done

	# Before this point, $major must not contain '.'.
	major=.$major
	versuffix=$major.$revision
	;;

	linux) # correct to gnu/linux during the next big refactor
	func_arith $current - $age
	major=.$func_arith_result
	versuffix=$major.$age.$revision
	;;

	osf)
	func_arith $current - $age
	major=.$func_arith_result
	versuffix=.$current.$age.$revision
	verstring=$current.$age.$revision

	# Add in all the interfaces that we are compatible with.
	loop=$age
	while test 0 -ne "$loop"; do
	func_arith $current - $loop
	iface=$func_arith_result
	func_arith $loop - 1
	loop=$func_arith_result
	verstring=$verstring:$iface.0
	done

	# Make executables depend on our current version.
	func_append verstring ":$current.0"
	;;

	qnx)
	major=.$current
	versuffix=.$current
	;;

	sco)
	major=.$current
	versuffix=.$current
	;;

	sunos)
	major=.$current
	versuffix=.$current.$revision
	;;

	windows)
	# Use '-' rather than '.', since we only want one
	# extension on DOS 8.3 file systems.
	func_arith $current - $age
	major=$func_arith_result
	versuffix=-$major
	;;

	*)
	func_fatal_configuration "unknown library version type '$version_type'"
	;;
	esac

	# Clear the version info if we defaulted, and they specified a release.
	if test -z "$vinfo" && test -n "$release"; then
	major=
	case $version_type in
	darwin)
	# we can't check for "0.0" in archive_cmds due to quoting
	# problems, so we reset it completely
	verstring=
	;;
	*)
	verstring=0.0
	;;
	esac
	if test no = "$need_version"; then
	versuffix=
	else
	versuffix=.0.0
	fi
	fi

	# Remove version info from name if versioning should be avoided
	if test yes,no = "$avoid_version,$need_version"; then
	major=
	versuffix=
	verstring=
	fi

	# Check to see if the archive will have undefined symbols.
	if test yes = "$allow_undefined"; then
	if test unsupported = "$allow_undefined_flag"; then
	if test yes = "$build_old_libs"; then
	func_warning "undefined symbols not allowed in $host shared libraries; building static only"
	build_libtool_libs=no
	else
	func_fatal_error "can't build $host shared library unless -no-undefined is specified"
	fi
	fi
	else
	# Don't allow undefined symbols.
	allow_undefined_flag=$no_undefined_flag
	fi

	fi

	func_generate_dlsyms "$libname" "$libname" :
	func_append libobjs " $symfileobj"
	test " " = "$libobjs" && libobjs=

	if test relink != "$opt_mode"; then
	# Remove our outputs, but don't remove object files since they
	# may have been created when compiling PIC objects.
	removelist=
	tempremovelist=`$ECHO "$output_objdir/*"`
	for p in $tempremovelist; do
	case $p in
	.$objext \| .gcno)
	;;
	$output_objdir/$outputname \| $output_objdir/$libname.* \| $output_objdir/$libname$release.*)
	if test -n "$precious_files_regex"; then
	if $ECHO "$p" \| $EGREP -e "$precious_files_regex" >/dev/null 2>&1
	then
	continue
	fi
	fi
	func_append removelist " $p"
	;;
	*) ;;
	esac
	done
	test -n "$removelist" && \
	func_show_eval "${RM}r \$removelist"
	fi

	# Now set the variables for building old libraries.
	if test yes = "$build_old_libs" && test convenience != "$build_libtool_libs"; then
	func_append oldlibs " $output_objdir/$libname.$libext"

	# Transform .lo files to .o files.
	oldobjs="$objs "`$ECHO "$libobjs" \| $SP2NL \| $SED "/\.$libext$/d; $lo2o" \| $NL2SP`
	fi

	# Eliminate all temporary directories.
	#for path in $notinst_path; do
	# lib_search_path=`$ECHO "$lib_search_path " \| $SED "s% $path % %g"`
	# deplibs=`$ECHO "$deplibs " \| $SED "s% -L$path % %g"`
	# dependency_libs=`$ECHO "$dependency_libs " \| $SED "s% -L$path % %g"`
	#done

	if test -n "$xrpath"; then
	# If the user specified any rpath flags, then add them.
	temp_xrpath=
	for libdir in $xrpath; do
	func_replace_sysroot "$libdir"
	func_append temp_xrpath " -R$func_replace_sysroot_result"
	case "$finalize_rpath " in
	" $libdir ") ;;
	*) func_append finalize_rpath " $libdir" ;;
	esac
	done
	if test yes != "$hardcode_into_libs" \|\| test yes = "$build_old_libs"; then
	dependency_libs="$temp_xrpath $dependency_libs"
	fi
	fi

	# Make sure dlfiles contains only unique files that won't be dlpreopened
	old_dlfiles=$dlfiles
	dlfiles=
	for lib in $old_dlfiles; do
	case " $dlprefiles $dlfiles " in
	" $lib ") ;;
	*) func_append dlfiles " $lib" ;;
	esac
	done

	# Make sure dlprefiles contains only unique files
	old_dlprefiles=$dlprefiles
	dlprefiles=
	for lib in $old_dlprefiles; do
	case "$dlprefiles " in
	" $lib ") ;;
	*) func_append dlprefiles " $lib" ;;
	esac
	done

	if test yes = "$build_libtool_libs"; then
	if test -n "$rpath"; then
	case $host in
	--cygwin* \| --mingw* \| --pw32* \| --os2* \| --beos* \| -cegcc \| --haiku*)
	# these systems don't actually have a c library (as such)!
	;;
	--rhapsody* \| --darwin1.[012])
	# Rhapsody C library is in the System framework
	func_append deplibs " System.ltframework"
	;;
	--netbsd*)
	# Don't link with libc until the a.out ld.so is fixed.
	;;
	--openbsd* \| --freebsd* \| --dragonfly*)
	# Do not include libc due to us having libc/libc_r.
	;;
	--sco3.2v5* \| --sco5v6*)
	# Causes problems with __ctype
	;;
	--sysv4.2uw2* \| --sysv5* \| --unixware* \| --OpenUNIX*)
	# Compiler inserts libc in the correct place for threads to work
	;;
	*)
	# Add libc to deplibs on all other systems if necessary.
	if test yes = "$build_libtool_need_lc"; then
	func_append deplibs " -lc"
	fi
	;;
	esac
	fi

	# Transform deplibs into only deplibs that can be linked in shared.
	name_save=$name
	libname_save=$libname
	release_save=$release
	versuffix_save=$versuffix
	major_save=$major
	# I'm not sure if I'm treating the release correctly. I think
	# release should show up in the -l (ie -lgmp5) so we don't want to
	# add it in twice. Is that correct?
	release=
	versuffix=
	major=
	newdeplibs=
	droppeddeps=no
	case $deplibs_check_method in
	pass_all)
	# Don't check for shared/static. Everything works.
	# This might be a little naive. We might want to check
	# whether the library exists or not. But this is on
	# osf3 & osf4 and I'm not really sure... Just
	# implementing what was already the behavior.
	newdeplibs=$deplibs
	;;
	test_compile)
	# This code stresses the "libraries are programs" paradigm to its
	# limits. Maybe even breaks it. We compile a program, linking it
	# against the deplibs as a proxy for the library. Then we can check
	# whether they linked in statically or dynamically with ldd.
	$opt_dry_run \|\| $RM conftest.c
	cat > conftest.c <<EOF
	int main() { return 0; }
	EOF
	$opt_dry_run \|\| $RM conftest
	if $LTCC $LTCFLAGS -o conftest conftest.c $deplibs; then
	ldd_output=`ldd conftest`
	for i in $deplibs; do
	case $i in
	-l*)
	func_stripname -l '' "$i"
	name=$func_stripname_result
	if test yes = "$allow_libtool_libs_with_static_runtimes"; then
	case " $predeps $postdeps " in
	" $i ")
	func_append newdeplibs " $i"
	i=
	;;
	esac
	fi
	if test -n "$i"; then
	libname=`eval "\\$ECHO \"$libname_spec\""`
	deplib_matches=`eval "\\$ECHO \"$library_names_spec\""`
	set dummy $deplib_matches; shift
	deplib_match=$1
	if test `expr "$ldd_output" : ".*$deplib_match"` -ne 0; then
	func_append newdeplibs " $i"
	else
	droppeddeps=yes
	echo
	$ECHO "*** Warning: dynamic linker does not accept needed library $i."
	echo "*** I have the capability to make that library automatically link in when"
	echo "*** you link to this library. But I can only do this if you have a"
	echo "*** shared version of the library, which I believe you do not have"
	echo "*** because a test_compile did reveal that the linker did not use it for"
	echo "*** its dynamic dependency list that programs get resolved with at runtime."
	fi
	fi
	;;
	*)
	func_append newdeplibs " $i"
	;;
	esac
	done
	else
	# Error occurred in the first compile. Let's try to salvage
	# the situation: Compile a separate program for each library.
	for i in $deplibs; do
	case $i in
	-l*)
	func_stripname -l '' "$i"
	name=$func_stripname_result
	$opt_dry_run \|\| $RM conftest
	if $LTCC $LTCFLAGS -o conftest conftest.c $i; then
	ldd_output=`ldd conftest`
	if test yes = "$allow_libtool_libs_with_static_runtimes"; then
	case " $predeps $postdeps " in
	" $i ")
	func_append newdeplibs " $i"
	i=
	;;
	esac
	fi
	if test -n "$i"; then
	libname=`eval "\\$ECHO \"$libname_spec\""`
	deplib_matches=`eval "\\$ECHO \"$library_names_spec\""`
	set dummy $deplib_matches; shift
	deplib_match=$1
	if test `expr "$ldd_output" : ".*$deplib_match"` -ne 0; then
	func_append newdeplibs " $i"
	else
	droppeddeps=yes
	echo
	$ECHO "*** Warning: dynamic linker does not accept needed library $i."
	echo "*** I have the capability to make that library automatically link in when"
	echo "*** you link to this library. But I can only do this if you have a"
	echo "*** shared version of the library, which you do not appear to have"
	echo "*** because a test_compile did reveal that the linker did not use this one"
	echo "*** as a dynamic dependency that programs can get resolved with at runtime."
	fi
	fi
	else
	droppeddeps=yes
	echo
	$ECHO "*** Warning! Library $i is needed by this library but I was not able to"
	echo "*** make it link in! You will probably need to install it or some"
	echo "*** library that it depends on before this library will be fully"
	echo "*** functional. Installing it before continuing would be even better."
	fi
	;;
	*)
	func_append newdeplibs " $i"
	;;
	esac
	done
	fi
	;;
	file_magic*)
	set dummy $deplibs_check_method; shift
	file_magic_regex=`expr "$deplibs_check_method" : "$1 $.*$"`
	for a_deplib in $deplibs; do
	case $a_deplib in
	-l*)
	func_stripname -l '' "$a_deplib"
	name=$func_stripname_result
	if test yes = "$allow_libtool_libs_with_static_runtimes"; then
	case " $predeps $postdeps " in
	" $a_deplib ")
	func_append newdeplibs " $a_deplib"
	a_deplib=
	;;
	esac
	fi
	if test -n "$a_deplib"; then
	libname=`eval "\\$ECHO \"$libname_spec\""`
	if test -n "$file_magic_glob"; then
	libnameglob=`func_echo_all "$libname" \| $SED -e $file_magic_glob`
	else
	libnameglob=$libname
	fi
	test yes = "$want_nocaseglob" && nocaseglob=`shopt -p nocaseglob`
	for i in $lib_search_path $sys_lib_search_path $shlib_search_path; do
	if test yes = "$want_nocaseglob"; then
	shopt -s nocaseglob
	potential_libs=`ls $i/$libnameglob[.-]* 2>/dev/null`
	$nocaseglob
	else
	potential_libs=`ls $i/$libnameglob[.-]* 2>/dev/null`
	fi
	for potent_lib in $potential_libs; do
	# Follow soft links.
	if ls -lLd "$potent_lib" 2>/dev/null \|
	$GREP " -> " >/dev/null; then
	continue
	fi
	# The statement above tries to avoid entering an
	# endless loop below, in case of cyclic links.
	# We might still enter an endless loop, since a link
	# loop can be closed while we follow links,
	# but so what?
	potlib=$potent_lib
	while test -h "$potlib" 2>/dev/null; do
	potliblink=`ls -ld $potlib \| $SED 's/.* -> //'`
	case $potliblink in
	[\\/]* \| [A-Za-z]:[\\/]*) potlib=$potliblink;;
	) potlib=`$ECHO "$potlib" \| $SED 's\|[^/]$\|\|'`"$potliblink";;
	esac
	done
	if eval $file_magic_cmd \"\$potlib\" 2>/dev/null \|
	$SED -e 10q \|
	$EGREP "$file_magic_regex" > /dev/null; then
	func_append newdeplibs " $a_deplib"
	a_deplib=
	break 2
	fi
	done
	done
	fi
	if test -n "$a_deplib"; then
	droppeddeps=yes
	echo
	$ECHO "*** Warning: linker path does not have real file for library $a_deplib."
	echo "*** I have the capability to make that library automatically link in when"
	echo "*** you link to this library. But I can only do this if you have a"
	echo "*** shared version of the library, which you do not appear to have"
	echo "*** because I did check the linker path looking for a file starting"
	if test -z "$potlib"; then
	$ECHO "*** with $libname but no candidates were found. (...for file magic test)"
	else
	$ECHO "*** with $libname and none of the candidates passed a file format test"
	$ECHO "*** using a file magic. Last file checked: $potlib"
	fi
	fi
	;;
	*)
	# Add a -L argument.
	func_append newdeplibs " $a_deplib"
	;;
	esac
	done # Gone through all deplibs.
	;;
	match_pattern*)
	set dummy $deplibs_check_method; shift
	match_pattern_regex=`expr "$deplibs_check_method" : "$1 $.*$"`
	for a_deplib in $deplibs; do
	case $a_deplib in
	-l*)
	func_stripname -l '' "$a_deplib"
	name=$func_stripname_result
	if test yes = "$allow_libtool_libs_with_static_runtimes"; then
	case " $predeps $postdeps " in
	" $a_deplib ")
	func_append newdeplibs " $a_deplib"
	a_deplib=
	;;
	esac
	fi
	if test -n "$a_deplib"; then
	libname=`eval "\\$ECHO \"$libname_spec\""`
	for i in $lib_search_path $sys_lib_search_path $shlib_search_path; do
	potential_libs=`ls $i/$libname[.-]* 2>/dev/null`
	for potent_lib in $potential_libs; do
	potlib=$potent_lib # see symlink-check above in file_magic test
	if eval "\$ECHO \"$potent_lib\"" 2>/dev/null \| $SED 10q \| \
	$EGREP "$match_pattern_regex" > /dev/null; then
	func_append newdeplibs " $a_deplib"
	a_deplib=
	break 2
	fi
	done
	done
	fi
	if test -n "$a_deplib"; then
	droppeddeps=yes
	echo
	$ECHO "*** Warning: linker path does not have real file for library $a_deplib."
	echo "*** I have the capability to make that library automatically link in when"
	echo "*** you link to this library. But I can only do this if you have a"
	echo "*** shared version of the library, which you do not appear to have"
	echo "*** because I did check the linker path looking for a file starting"
	if test -z "$potlib"; then
	$ECHO "*** with $libname but no candidates were found. (...for regex pattern test)"
	else
	$ECHO "*** with $libname and none of the candidates passed a file format test"
	$ECHO "*** using a regex pattern. Last file checked: $potlib"
	fi
	fi
	;;
	*)
	# Add a -L argument.
	func_append newdeplibs " $a_deplib"
	;;
	esac
	done # Gone through all deplibs.
	;;
	none \| unknown \| *)
	newdeplibs=
	tmp_deplibs=`$ECHO " $deplibs" \| $SED 's/ -lc$//; s/ -[LR][^ ]*//g'`
	if test yes = "$allow_libtool_libs_with_static_runtimes"; then
	for i in $predeps $postdeps; do
	# can't use Xsed below, because $i might contain '/'
	tmp_deplibs=`$ECHO " $tmp_deplibs" \| $SED "s\|$i\|\|"`
	done
	fi
	case $tmp_deplibs in
	[!\ \ ])
	echo
	if test none = "$deplibs_check_method"; then
	echo "*** Warning: inter-library dependencies are not supported in this platform."
	else
	echo "*** Warning: inter-library dependencies are not known to be supported."
	fi
	echo "*** All declared inter-library dependencies are being dropped."
	droppeddeps=yes
	;;
	esac
	;;
	esac
	versuffix=$versuffix_save
	major=$major_save
	release=$release_save
	libname=$libname_save
	name=$name_save

	case $host in
	--rhapsody* \| --darwin1.[012])
	# On Rhapsody replace the C library with the System framework
	newdeplibs=`$ECHO " $newdeplibs" \| $SED 's/ -lc / System.ltframework /'`
	;;
	esac

	if test yes = "$droppeddeps"; then
	if test yes = "$module"; then
	echo
	echo "*** Warning: libtool could not satisfy all declared inter-library"
	$ECHO "*** dependencies of module $libname. Therefore, libtool will create"
	echo "*** a static module, that should work as long as the dlopening"
	echo "*** application is linked with the -dlopen flag."
	if test -z "$global_symbol_pipe"; then
	echo
	echo "*** However, this would only work if libtool was able to extract symbol"
	echo "*** lists from a program, using 'nm' or equivalent, but libtool could"
	echo "*** not find such a program. So, this module is probably useless."
	echo "*** 'nm' from GNU binutils and a full rebuild may help."
	fi
	if test no = "$build_old_libs"; then
	oldlibs=$output_objdir/$libname.$libext
	build_libtool_libs=module
	build_old_libs=yes
	else
	build_libtool_libs=no
	fi
	else
	echo "*** The inter-library dependencies that have been dropped here will be"
	echo "*** automatically added whenever a program is linked with this library"
	echo "*** or is declared to -dlopen it."

	if test no = "$allow_undefined"; then
	echo
	echo "*** Since this library must not contain undefined symbols,"
	echo "*** because either the platform does not support them or"
	echo "*** it was explicitly requested with -no-undefined,"
	echo "*** libtool will only create a static version of it."
	if test no = "$build_old_libs"; then
	oldlibs=$output_objdir/$libname.$libext
	build_libtool_libs=module
	build_old_libs=yes
	else
	build_libtool_libs=no
	fi
	fi
	fi
	fi
	# Done checking deplibs!
	deplibs=$newdeplibs
	fi
	# Time to change all our "foo.ltframework" stuff back to "-framework foo"
	case $host in
	--darwin*)
	newdeplibs=`$ECHO " $newdeplibs" \| $SED 's% $[^ $]*$.ltframework% -framework \1%g'`
	new_inherited_linker_flags=`$ECHO " $new_inherited_linker_flags" \| $SED 's% $[^ $]*$.ltframework% -framework \1%g'`
	deplibs=`$ECHO " $deplibs" \| $SED 's% $[^ $]*$.ltframework% -framework \1%g'`
	;;
	esac

	# move library search paths that coincide with paths to not yet
	# installed libraries to the beginning of the library search list
	new_libs=
	for path in $notinst_path; do
	case " $new_libs " in
	" -L$path/$objdir ") ;;
	*)
	case " $deplibs " in
	" -L$path/$objdir ")
	func_append new_libs " -L$path/$objdir" ;;
	esac
	;;
	esac
	done
	for deplib in $deplibs; do
	case $deplib in
	-L*)
	case " $new_libs " in
	" $deplib ") ;;
	*) func_append new_libs " $deplib" ;;
	esac
	;;
	*) func_append new_libs " $deplib" ;;
	esac
	done
	deplibs=$new_libs

	# All the library-specific variables (install_libdir is set above).
	library_names=
	old_library=
	dlname=

	# Test again, we may have decided not to build it any more
	if test yes = "$build_libtool_libs"; then
	# Remove $wl instances when linking with ld.
	# FIXME: should test the right _cmds variable.
	case $archive_cmds in
	\$LD\ ) wl= ;;
	esac
	if test yes = "$hardcode_into_libs"; then
	# Hardcode the library paths
	hardcode_libdirs=
	dep_rpath=
	rpath=$finalize_rpath
	test relink = "$opt_mode" \|\| rpath=$compile_rpath$rpath
	for libdir in $rpath; do
	if test -n "$hardcode_libdir_flag_spec"; then
	if test -n "$hardcode_libdir_separator"; then
	func_replace_sysroot "$libdir"
	libdir=$func_replace_sysroot_result
	if test -z "$hardcode_libdirs"; then
	hardcode_libdirs=$libdir
	else
	# Just accumulate the unique libdirs.
	case $hardcode_libdir_separator$hardcode_libdirs$hardcode_libdir_separator in
	"$hardcode_libdir_separator$libdir$hardcode_libdir_separator")
	;;
	*)
	func_append hardcode_libdirs "$hardcode_libdir_separator$libdir"
	;;
	esac
	fi
	else
	eval flag=\"$hardcode_libdir_flag_spec\"
	func_append dep_rpath " $flag"
	fi
	elif test -n "$runpath_var"; then
	case "$perm_rpath " in
	" $libdir ") ;;
	*) func_append perm_rpath " $libdir" ;;
	esac
	fi
	done
	# Substitute the hardcoded libdirs into the rpath.
	if test -n "$hardcode_libdir_separator" &&
	test -n "$hardcode_libdirs"; then
	libdir=$hardcode_libdirs
	eval "dep_rpath=\"$hardcode_libdir_flag_spec\""
	fi
	if test -n "$runpath_var" && test -n "$perm_rpath"; then
	# We should set the runpath_var.
	rpath=
	for dir in $perm_rpath; do
	func_append rpath "$dir:"
	done
	eval "$runpath_var='$rpath\$$runpath_var'; export $runpath_var"
	fi
	test -n "$dep_rpath" && deplibs="$dep_rpath $deplibs"
	fi

	shlibpath=$finalize_shlibpath
	test relink = "$opt_mode" \|\| shlibpath=$compile_shlibpath$shlibpath
	if test -n "$shlibpath"; then
	eval "$shlibpath_var='$shlibpath\$$shlibpath_var'; export $shlibpath_var"
	fi

	# Get the real and link names of the library.
	eval shared_ext=\"$shrext_cmds\"
	eval library_names=\"$library_names_spec\"
	set dummy $library_names
	shift
	realname=$1
	shift

	if test -n "$soname_spec"; then
	eval soname=\"$soname_spec\"
	else
	soname=$realname
	fi
	if test -z "$dlname"; then
	dlname=$soname
	fi

	lib=$output_objdir/$realname
	linknames=
	for link
	do
	func_append linknames " $link"
	done

	# Use standard objects if they are pic
	test -z "$pic_flag" && libobjs=`$ECHO "$libobjs" \| $SP2NL \| $SED "$lo2o" \| $NL2SP`
	test "X$libobjs" = "X " && libobjs=

	delfiles=
	if test -n "$export_symbols" && test -n "$include_expsyms"; then
	$opt_dry_run \|\| cp "$export_symbols" "$output_objdir/$libname.uexp"
	export_symbols=$output_objdir/$libname.uexp
	func_append delfiles " $export_symbols"
	fi

	orig_export_symbols=
	case $host_os in
	cygwin* \| mingw* \| cegcc*)
	if test -n "$export_symbols" && test -z "$export_symbols_regex"; then
	# exporting using user supplied symfile
	func_dll_def_p "$export_symbols" \|\| {
	# and it's NOT already a .def file. Must figure out
	# which of the given symbols are data symbols and tag
	# them as such. So, trigger use of export_symbols_cmds.
	# export_symbols gets reassigned inside the "prepare
	# the list of exported symbols" if statement, so the
	# include_expsyms logic still works.
	orig_export_symbols=$export_symbols
	export_symbols=
	always_export_symbols=yes
	}
	fi
	;;
	esac

	# Prepare the list of exported symbols
	if test -z "$export_symbols"; then
	if test yes = "$always_export_symbols" \|\| test -n "$export_symbols_regex"; then
	func_verbose "generating symbol list for '$libname.la'"
	export_symbols=$output_objdir/$libname.exp
	$opt_dry_run \|\| $RM $export_symbols
	cmds=$export_symbols_cmds
	save_ifs=$IFS; IFS='~'
	for cmd1 in $cmds; do
	IFS=$save_ifs
	# Take the normal branch if the nm_file_list_spec branch
	# doesn't work or if tool conversion is not needed.
	case $nm_file_list_spec~$to_tool_file_cmd in
	~func_convert_file_noop \| ~func_convert_file_msys_to_w32 \| ~*)
	try_normal_branch=yes
	eval cmd=\"$cmd1\"
	func_len " $cmd"
	len=$func_len_result
	;;
	*)
	try_normal_branch=no
	;;
	esac
	if test yes = "$try_normal_branch" \
	&& { test "$len" -lt "$max_cmd_len" \
	\|\| test "$max_cmd_len" -le -1; }
	then
	func_show_eval "$cmd" 'exit $?'
	skipped_export=false
	elif test -n "$nm_file_list_spec"; then
	func_basename "$output"
	output_la=$func_basename_result
	save_libobjs=$libobjs
	save_output=$output
	output=$output_objdir/$output_la.nm
	func_to_tool_file "$output"
	libobjs=$nm_file_list_spec$func_to_tool_file_result
	func_append delfiles " $output"
	func_verbose "creating $NM input file list: $output"
	for obj in $save_libobjs; do
	func_to_tool_file "$obj"
	$ECHO "$func_to_tool_file_result"
	done > "$output"
	eval cmd=\"$cmd1\"
	func_show_eval "$cmd" 'exit $?'
	output=$save_output
	libobjs=$save_libobjs
	skipped_export=false
	else
	# The command line is too long to execute in one step.
	func_verbose "using reloadable object file for export list..."
	skipped_export=:
	# Break out early, otherwise skipped_export may be
	# set to false by a later but shorter cmd.
	break
	fi
	done
	IFS=$save_ifs
	if test -n "$export_symbols_regex" && test : != "$skipped_export"; then
	func_show_eval '$EGREP -e "$export_symbols_regex" "$export_symbols" > "${export_symbols}T"'
	func_show_eval '$MV "${export_symbols}T" "$export_symbols"'
	fi
	fi
	fi

	if test -n "$export_symbols" && test -n "$include_expsyms"; then
	tmp_export_symbols=$export_symbols
	test -n "$orig_export_symbols" && tmp_export_symbols=$orig_export_symbols
	$opt_dry_run \|\| eval '$ECHO "$include_expsyms" \| $SP2NL >> "$tmp_export_symbols"'
	fi

	if test : != "$skipped_export" && test -n "$orig_export_symbols"; then
	# The given exports_symbols file has to be filtered, so filter it.
	func_verbose "filter symbol list for '$libname.la' to tag DATA exports"
	# FIXME: $output_objdir/$libname.filter potentially contains lots of
	# 's' commands, which not all seds can handle. GNU sed should be fine
	# though. Also, the filter scales superlinearly with the number of
	# global variables. join(1) would be nice here, but unfortunately
	# isn't a blessed tool.
	$opt_dry_run \|\| $SED -e '/[ ,]DATA/!d;s,$.$$[ \,].$,s\|^\1$\|\1\2\|,' < $export_symbols > $output_objdir/$libname.filter
	func_append delfiles " $export_symbols $output_objdir/$libname.filter"
	export_symbols=$output_objdir/$libname.def
	$opt_dry_run \|\| $SED -f $output_objdir/$libname.filter < $orig_export_symbols > $export_symbols
	fi

	tmp_deplibs=
	for test_deplib in $deplibs; do
	case " $convenience " in
	" $test_deplib ") ;;
	*)
	func_append tmp_deplibs " $test_deplib"
	;;
	esac
	done
	deplibs=$tmp_deplibs

	if test -n "$convenience"; then
	if test -n "$whole_archive_flag_spec" &&
	test yes = "$compiler_needs_object" &&
	test -z "$libobjs"; then
	# extract the archives, so we have objects to list.
	# TODO: could optimize this to just extract one archive.
	whole_archive_flag_spec=
	fi
	if test -n "$whole_archive_flag_spec"; then
	save_libobjs=$libobjs
	eval libobjs=\"\$libobjs $whole_archive_flag_spec\"
	test "X$libobjs" = "X " && libobjs=
	else
	gentop=$output_objdir/${outputname}x
	func_append generated " $gentop"

	func_extract_archives $gentop $convenience
	func_append libobjs " $func_extract_archives_result"
	test "X$libobjs" = "X " && libobjs=
	fi
	fi

	if test yes = "$thread_safe" && test -n "$thread_safe_flag_spec"; then
	eval flag=\"$thread_safe_flag_spec\"
	func_append linker_flags " $flag"
	fi

	# Make a backup of the uninstalled library when relinking
	if test relink = "$opt_mode"; then
	$opt_dry_run \|\| eval '(cd $output_objdir && $RM ${realname}U && $MV $realname ${realname}U)' \|\| exit $?
	fi

	# Do each of the archive commands.
	if test yes = "$module" && test -n "$module_cmds"; then
	if test -n "$export_symbols" && test -n "$module_expsym_cmds"; then
	eval test_cmds=\"$module_expsym_cmds\"
	cmds=$module_expsym_cmds
	else
	eval test_cmds=\"$module_cmds\"
	cmds=$module_cmds
	fi
	else
	if test -n "$export_symbols" && test -n "$archive_expsym_cmds"; then
	eval test_cmds=\"$archive_expsym_cmds\"
	cmds=$archive_expsym_cmds
	else
	eval test_cmds=\"$archive_cmds\"
	cmds=$archive_cmds
	fi
	fi

	if test : != "$skipped_export" &&
	func_len " $test_cmds" &&
	len=$func_len_result &&
	test "$len" -lt "$max_cmd_len" \|\| test "$max_cmd_len" -le -1; then
	:
	else
	# The command line is too long to link in one step, link piecewise
	# or, if using GNU ld and skipped_export is not :, use a linker
	# script.

	# Save the value of $output and $libobjs because we want to
	# use them later. If we have whole_archive_flag_spec, we
	# want to use save_libobjs as it was before
	# whole_archive_flag_spec was expanded, because we can't
	# assume the linker understands whole_archive_flag_spec.
	# This may have to be revisited, in case too many
	# convenience libraries get linked in and end up exceeding
	# the spec.
	if test -z "$convenience" \|\| test -z "$whole_archive_flag_spec"; then
	save_libobjs=$libobjs
	fi
	save_output=$output
	func_basename "$output"
	output_la=$func_basename_result

	# Clear the reloadable object creation command queue and
	# initialize k to one.
	test_cmds=
	concat_cmds=
	objlist=
	last_robj=
	k=1

	if test -n "$save_libobjs" && test : != "$skipped_export" && test yes = "$with_gnu_ld"; then
	output=$output_objdir/$output_la.lnkscript
	func_verbose "creating GNU ld script: $output"
	echo 'INPUT (' > $output
	for obj in $save_libobjs
	do
	func_to_tool_file "$obj"
	$ECHO "$func_to_tool_file_result" >> $output
	done
	echo ')' >> $output
	func_append delfiles " $output"
	func_to_tool_file "$output"
	output=$func_to_tool_file_result
	elif test -n "$save_libobjs" && test : != "$skipped_export" && test -n "$file_list_spec"; then
	output=$output_objdir/$output_la.lnk
	func_verbose "creating linker input file list: $output"
	: > $output
	set x $save_libobjs
	shift
	firstobj=
	if test yes = "$compiler_needs_object"; then
	firstobj="$1 "
	shift
	fi
	for obj
	do
	func_to_tool_file "$obj"
	$ECHO "$func_to_tool_file_result" >> $output
	done
	func_append delfiles " $output"
	func_to_tool_file "$output"
	output=$firstobj\"$file_list_spec$func_to_tool_file_result\"
	else
	if test -n "$save_libobjs"; then
	func_verbose "creating reloadable object files..."
	output=$output_objdir/$output_la-$k.$objext
	eval test_cmds=\"$reload_cmds\"
	func_len " $test_cmds"
	len0=$func_len_result
	len=$len0

	# Loop over the list of objects to be linked.
	for obj in $save_libobjs
	do
	func_len " $obj"
	func_arith $len + $func_len_result
	len=$func_arith_result
	if test -z "$objlist" \|\|
	test "$len" -lt "$max_cmd_len"; then
	func_append objlist " $obj"
	else
	# The command $test_cmds is almost too long, add a
	# command to the queue.
	if test 1 -eq "$k"; then
	# The first file doesn't have a previous command to add.
	reload_objs=$objlist
	eval concat_cmds=\"$reload_cmds\"
	else
	# All subsequent reloadable object files will link in
	# the last one created.
	reload_objs="$objlist $last_robj"
	eval concat_cmds=\"\$concat_cmds~$reload_cmds~\$RM $last_robj\"
	fi
	last_robj=$output_objdir/$output_la-$k.$objext
	func_arith $k + 1
	k=$func_arith_result
	output=$output_objdir/$output_la-$k.$objext
	objlist=" $obj"
	func_len " $last_robj"
	func_arith $len0 + $func_len_result
	len=$func_arith_result
	fi
	done
	# Handle the remaining objects by creating one last
	# reloadable object file. All subsequent reloadable object
	# files will link in the last one created.
	test -z "$concat_cmds" \|\| concat_cmds=$concat_cmds~
	reload_objs="$objlist $last_robj"
	eval concat_cmds=\"\$concat_cmds$reload_cmds\"
	if test -n "$last_robj"; then
	eval concat_cmds=\"\$concat_cmds~\$RM $last_robj\"
	fi
	func_append delfiles " $output"

	else
	output=
	fi

	${skipped_export-false} && {
	func_verbose "generating symbol list for '$libname.la'"
	export_symbols=$output_objdir/$libname.exp
	$opt_dry_run \|\| $RM $export_symbols
	libobjs=$output
	# Append the command to create the export file.
	test -z "$concat_cmds" \|\| concat_cmds=$concat_cmds~
	eval concat_cmds=\"\$concat_cmds$export_symbols_cmds\"
	if test -n "$last_robj"; then
	eval concat_cmds=\"\$concat_cmds~\$RM $last_robj\"
	fi
	}

	test -n "$save_libobjs" &&
	func_verbose "creating a temporary reloadable object file: $output"

	# Loop through the commands generated above and execute them.
	save_ifs=$IFS; IFS='~'
	for cmd in $concat_cmds; do
	IFS=$save_ifs
	$opt_quiet \|\| {
	func_quote_for_expand "$cmd"
	eval "func_echo $func_quote_for_expand_result"
	}
	$opt_dry_run \|\| eval "$cmd" \|\| {
	lt_exit=$?

	# Restore the uninstalled library and exit
	if test relink = "$opt_mode"; then
	( cd "$output_objdir" && \
	$RM "${realname}T" && \
	$MV "${realname}U" "$realname" )
	fi

	exit $lt_exit
	}
	done
	IFS=$save_ifs

	if test -n "$export_symbols_regex" && ${skipped_export-false}; then
	func_show_eval '$EGREP -e "$export_symbols_regex" "$export_symbols" > "${export_symbols}T"'
	func_show_eval '$MV "${export_symbols}T" "$export_symbols"'
	fi
	fi

	${skipped_export-false} && {
	if test -n "$export_symbols" && test -n "$include_expsyms"; then
	tmp_export_symbols=$export_symbols
	test -n "$orig_export_symbols" && tmp_export_symbols=$orig_export_symbols
	$opt_dry_run \|\| eval '$ECHO "$include_expsyms" \| $SP2NL >> "$tmp_export_symbols"'
	fi

	if test -n "$orig_export_symbols"; then
	# The given exports_symbols file has to be filtered, so filter it.
	func_verbose "filter symbol list for '$libname.la' to tag DATA exports"
	# FIXME: $output_objdir/$libname.filter potentially contains lots of
	# 's' commands, which not all seds can handle. GNU sed should be fine
	# though. Also, the filter scales superlinearly with the number of
	# global variables. join(1) would be nice here, but unfortunately
	# isn't a blessed tool.
	$opt_dry_run \|\| $SED -e '/[ ,]DATA/!d;s,$.$$[ \,].$,s\|^\1$\|\1\2\|,' < $export_symbols > $output_objdir/$libname.filter
	func_append delfiles " $export_symbols $output_objdir/$libname.filter"
	export_symbols=$output_objdir/$libname.def
	$opt_dry_run \|\| $SED -f $output_objdir/$libname.filter < $orig_export_symbols > $export_symbols
	fi
	}

	libobjs=$output
	# Restore the value of output.
	output=$save_output

	if test -n "$convenience" && test -n "$whole_archive_flag_spec"; then
	eval libobjs=\"\$libobjs $whole_archive_flag_spec\"
	test "X$libobjs" = "X " && libobjs=
	fi
	# Expand the library linking commands again to reset the
	# value of $libobjs for piecewise linking.

	# Do each of the archive commands.
	if test yes = "$module" && test -n "$module_cmds"; then
	if test -n "$export_symbols" && test -n "$module_expsym_cmds"; then
	cmds=$module_expsym_cmds
	else
	cmds=$module_cmds
	fi
	else
	if test -n "$export_symbols" && test -n "$archive_expsym_cmds"; then
	cmds=$archive_expsym_cmds
	else
	cmds=$archive_cmds
	fi
	fi
	fi

	if test -n "$delfiles"; then
	# Append the command to remove temporary files to $cmds.
	eval cmds=\"\$cmds~\$RM $delfiles\"
	fi

	# Add any objects from preloaded convenience libraries
	if test -n "$dlprefiles"; then
	gentop=$output_objdir/${outputname}x
	func_append generated " $gentop"

	func_extract_archives $gentop $dlprefiles
	func_append libobjs " $func_extract_archives_result"
	test "X$libobjs" = "X " && libobjs=
	fi

	save_ifs=$IFS; IFS='~'
	for cmd in $cmds; do
	IFS=$sp$nl
	eval cmd=\"$cmd\"
	IFS=$save_ifs
	$opt_quiet \|\| {
	func_quote_for_expand "$cmd"
	eval "func_echo $func_quote_for_expand_result"
	}
	$opt_dry_run \|\| eval "$cmd" \|\| {
	lt_exit=$?

	# Restore the uninstalled library and exit
	if test relink = "$opt_mode"; then
	( cd "$output_objdir" && \
	$RM "${realname}T" && \
	$MV "${realname}U" "$realname" )
	fi

	exit $lt_exit
	}
	done
	IFS=$save_ifs

	# Restore the uninstalled library and exit
	if test relink = "$opt_mode"; then
	$opt_dry_run \|\| eval '(cd $output_objdir && $RM ${realname}T && $MV $realname ${realname}T && $MV ${realname}U $realname)' \|\| exit $?

	if test -n "$convenience"; then
	if test -z "$whole_archive_flag_spec"; then
	func_show_eval '${RM}r "$gentop"'
	fi
	fi

	exit $EXIT_SUCCESS
	fi

	# Create links to the real library.
	for linkname in $linknames; do
	if test "$realname" != "$linkname"; then
	func_show_eval '(cd "$output_objdir" && $RM "$linkname" && $LN_S "$realname" "$linkname")' 'exit $?'
	fi
	done

	# If -module or -export-dynamic was specified, set the dlname.
	if test yes = "$module" \|\| test yes = "$export_dynamic"; then
	# On all known operating systems, these are identical.
	dlname=$soname
	fi
	fi
	;;

	obj)
	if test -n "$dlfiles$dlprefiles" \|\| test no != "$dlself"; then
	func_warning "'-dlopen' is ignored for objects"
	fi

	case " $deplibs" in
	\ -l \| \ -L)
	func_warning "'-l' and '-L' are ignored for objects" ;;
	esac

	test -n "$rpath" && \
	func_warning "'-rpath' is ignored for objects"

	test -n "$xrpath" && \
	func_warning "'-R' is ignored for objects"

	test -n "$vinfo" && \
	func_warning "'-version-info' is ignored for objects"

	test -n "$release" && \
	func_warning "'-release' is ignored for objects"

	case $output in
	*.lo)
	test -n "$objs$old_deplibs" && \
	func_fatal_error "cannot build library object '$output' from non-libtool objects"

	libobj=$output
	func_lo2o "$libobj"
	obj=$func_lo2o_result
	;;
	*)
	libobj=
	obj=$output
	;;
	esac

	# Delete the old objects.
	$opt_dry_run \|\| $RM $obj $libobj

	# Objects from convenience libraries. This assumes
	# single-version convenience libraries. Whenever we create
	# different ones for PIC/non-PIC, this we'll have to duplicate
	# the extraction.
	reload_conv_objs=
	gentop=
	# if reload_cmds runs $LD directly, get rid of -Wl from
	# whole_archive_flag_spec and hope we can get by with turning comma
	# into space.
	case $reload_cmds in
	\$LD[\ \$]) wl= ;;
	esac
	if test -n "$convenience"; then
	if test -n "$whole_archive_flag_spec"; then
	eval tmp_whole_archive_flags=\"$whole_archive_flag_spec\"
	test -n "$wl" \|\| tmp_whole_archive_flags=`$ECHO "$tmp_whole_archive_flags" \| $SED 's\|,\| \|g'`
	reload_conv_objs=$reload_objs\ $tmp_whole_archive_flags
	else
	gentop=$output_objdir/${obj}x
	func_append generated " $gentop"

	func_extract_archives $gentop $convenience
	reload_conv_objs="$reload_objs $func_extract_archives_result"
	fi
	fi

	# If we're not building shared, we need to use non_pic_objs
	test yes = "$build_libtool_libs" \|\| libobjs=$non_pic_objects

	# Create the old-style object.
	reload_objs=$objs$old_deplibs' '`$ECHO "$libobjs" \| $SP2NL \| $SED "/\.$libext$/d; /\.lib$/d; $lo2o" \| $NL2SP`' '$reload_conv_objs

	output=$obj
	func_execute_cmds "$reload_cmds" 'exit $?'

	# Exit if we aren't doing a library object file.
	if test -z "$libobj"; then
	if test -n "$gentop"; then
	func_show_eval '${RM}r "$gentop"'
	fi

	exit $EXIT_SUCCESS
	fi

	test yes = "$build_libtool_libs" \|\| {
	if test -n "$gentop"; then
	func_show_eval '${RM}r "$gentop"'
	fi

	# Create an invalid libtool object if no PIC, so that we don't
	# accidentally link it into a program.
	# $show "echo timestamp > $libobj"
	# $opt_dry_run \|\| eval "echo timestamp > $libobj" \|\| exit $?
	exit $EXIT_SUCCESS
	}

	if test -n "$pic_flag" \|\| test default != "$pic_mode"; then
	# Only do commands if we really have different PIC objects.
	reload_objs="$libobjs $reload_conv_objs"
	output=$libobj
	func_execute_cmds "$reload_cmds" 'exit $?'
	fi

	if test -n "$gentop"; then
	func_show_eval '${RM}r "$gentop"'
	fi

	exit $EXIT_SUCCESS
	;;

	prog)
	case $host in
	cygwin) func_stripname '' '.exe' "$output"
	output=$func_stripname_result.exe;;
	esac
	test -n "$vinfo" && \
	func_warning "'-version-info' is ignored for programs"

	test -n "$release" && \
	func_warning "'-release' is ignored for programs"

	$preload \
	&& test unknown,unknown,unknown = "$dlopen_support,$dlopen_self,$dlopen_self_static" \
	&& func_warning "'LT_INIT([dlopen])' not used. Assuming no dlopen support."

	case $host in
	--rhapsody* \| --darwin1.[012])
	# On Rhapsody replace the C library is the System framework
	compile_deplibs=`$ECHO " $compile_deplibs" \| $SED 's/ -lc / System.ltframework /'`
	finalize_deplibs=`$ECHO " $finalize_deplibs" \| $SED 's/ -lc / System.ltframework /'`
	;;
	esac

	case $host in
	--darwin*)
	# Don't allow lazy linking, it breaks C++ global constructors
	# But is supposedly fixed on 10.4 or later (yay!).
	if test CXX = "$tagname"; then
	case ${MACOSX_DEPLOYMENT_TARGET-10.0} in
	10.[0123])
	func_append compile_command " $wl-bind_at_load"
	func_append finalize_command " $wl-bind_at_load"
	;;
	esac
	fi
	# Time to change all our "foo.ltframework" stuff back to "-framework foo"
	compile_deplibs=`$ECHO " $compile_deplibs" \| $SED 's% $[^ $]*$.ltframework% -framework \1%g'`
	finalize_deplibs=`$ECHO " $finalize_deplibs" \| $SED 's% $[^ $]*$.ltframework% -framework \1%g'`
	;;
	esac


	# move library search paths that coincide with paths to not yet
	# installed libraries to the beginning of the library search list
	new_libs=
	for path in $notinst_path; do
	case " $new_libs " in
	" -L$path/$objdir ") ;;
	*)
	case " $compile_deplibs " in
	" -L$path/$objdir ")
	func_append new_libs " -L$path/$objdir" ;;
	esac
	;;
	esac
	done
	for deplib in $compile_deplibs; do
	case $deplib in
	-L*)
	case " $new_libs " in
	" $deplib ") ;;
	*) func_append new_libs " $deplib" ;;
	esac
	;;
	*) func_append new_libs " $deplib" ;;
	esac
	done
	compile_deplibs=$new_libs


	func_append compile_command " $compile_deplibs"
	func_append finalize_command " $finalize_deplibs"

	if test -n "$rpath$xrpath"; then
	# If the user specified any rpath flags, then add them.
	for libdir in $rpath $xrpath; do
	# This is the magic to use -rpath.
	case "$finalize_rpath " in
	" $libdir ") ;;
	*) func_append finalize_rpath " $libdir" ;;
	esac
	done
	fi

	# Now hardcode the library paths
	rpath=
	hardcode_libdirs=
	for libdir in $compile_rpath $finalize_rpath; do
	if test -n "$hardcode_libdir_flag_spec"; then
	if test -n "$hardcode_libdir_separator"; then
	if test -z "$hardcode_libdirs"; then
	hardcode_libdirs=$libdir
	else
	# Just accumulate the unique libdirs.
	case $hardcode_libdir_separator$hardcode_libdirs$hardcode_libdir_separator in
	"$hardcode_libdir_separator$libdir$hardcode_libdir_separator")
	;;
	*)
	func_append hardcode_libdirs "$hardcode_libdir_separator$libdir"
	;;
	esac
	fi
	else
	eval flag=\"$hardcode_libdir_flag_spec\"
	func_append rpath " $flag"
	fi
	elif test -n "$runpath_var"; then
	case "$perm_rpath " in
	" $libdir ") ;;
	*) func_append perm_rpath " $libdir" ;;
	esac
	fi
	case $host in
	--cygwin* \| --mingw* \| --pw32* \| --os2* \| -cegcc)
	testbindir=`$ECHO "$libdir" \| $SED -e 's/lib$/bin*'`
	case :$dllsearchpath: in
	":$libdir:") ;;
	::) dllsearchpath=$libdir;;
	*) func_append dllsearchpath ":$libdir";;
	esac
	case :$dllsearchpath: in
	":$testbindir:") ;;
	::) dllsearchpath=$testbindir;;
	*) func_append dllsearchpath ":$testbindir";;
	esac
	;;
	esac
	done
	# Substitute the hardcoded libdirs into the rpath.
	if test -n "$hardcode_libdir_separator" &&
	test -n "$hardcode_libdirs"; then
	libdir=$hardcode_libdirs
	eval rpath=\" $hardcode_libdir_flag_spec\"
	fi
	compile_rpath=$rpath

	rpath=
	hardcode_libdirs=
	for libdir in $finalize_rpath; do
	if test -n "$hardcode_libdir_flag_spec"; then
	if test -n "$hardcode_libdir_separator"; then
	if test -z "$hardcode_libdirs"; then
	hardcode_libdirs=$libdir
	else
	# Just accumulate the unique libdirs.
	case $hardcode_libdir_separator$hardcode_libdirs$hardcode_libdir_separator in
	"$hardcode_libdir_separator$libdir$hardcode_libdir_separator")
	;;
	*)
	func_append hardcode_libdirs "$hardcode_libdir_separator$libdir"
	;;
	esac
	fi
	else
	eval flag=\"$hardcode_libdir_flag_spec\"
	func_append rpath " $flag"
	fi
	elif test -n "$runpath_var"; then
	case "$finalize_perm_rpath " in
	" $libdir ") ;;
	*) func_append finalize_perm_rpath " $libdir" ;;
	esac
	fi
	done
	# Substitute the hardcoded libdirs into the rpath.
	if test -n "$hardcode_libdir_separator" &&
	test -n "$hardcode_libdirs"; then
	libdir=$hardcode_libdirs
	eval rpath=\" $hardcode_libdir_flag_spec\"
	fi
	finalize_rpath=$rpath

	if test -n "$libobjs" && test yes = "$build_old_libs"; then
	# Transform all the library objects into standard objects.
	compile_command=`$ECHO "$compile_command" \| $SP2NL \| $SED "$lo2o" \| $NL2SP`
	finalize_command=`$ECHO "$finalize_command" \| $SP2NL \| $SED "$lo2o" \| $NL2SP`
	fi

	func_generate_dlsyms "$outputname" "@PROGRAM@" false

	# template prelinking step
	if test -n "$prelink_cmds"; then
	func_execute_cmds "$prelink_cmds" 'exit $?'
	fi

	wrappers_required=:
	case $host in
	cegcc \| mingw32ce)
	# Disable wrappers for cegcc and mingw32ce hosts, we are cross compiling anyway.
	wrappers_required=false
	;;
	cygwin \| mingw )
	test yes = "$build_libtool_libs" \|\| wrappers_required=false
	;;
	*)
	if test no = "$need_relink" \|\| test yes != "$build_libtool_libs"; then
	wrappers_required=false
	fi
	;;
	esac
	$wrappers_required \|\| {
	# Replace the output file specification.
	compile_command=`$ECHO "$compile_command" \| $SED 's%@OUTPUT@%'"$output"'%g'`
	link_command=$compile_command$compile_rpath

	# We have no uninstalled library dependencies, so finalize right now.
	exit_status=0
	func_show_eval "$link_command" 'exit_status=$?'

	if test -n "$postlink_cmds"; then
	func_to_tool_file "$output"
	postlink_cmds=`func_echo_all "$postlink_cmds" \| $SED -e 's%@OUTPUT@%'"$output"'%g' -e 's%@TOOL_OUTPUT@%'"$func_to_tool_file_result"'%g'`
	func_execute_cmds "$postlink_cmds" 'exit $?'
	fi

	# Delete the generated files.
	if test -f "$output_objdir/${outputname}S.$objext"; then
	func_show_eval '$RM "$output_objdir/${outputname}S.$objext"'
	fi

	exit $exit_status
	}

	if test -n "$compile_shlibpath$finalize_shlibpath"; then
	compile_command="$shlibpath_var=\"$compile_shlibpath$finalize_shlibpath\$$shlibpath_var\" $compile_command"
	fi
	if test -n "$finalize_shlibpath"; then
	finalize_command="$shlibpath_var=\"$finalize_shlibpath\$$shlibpath_var\" $finalize_command"
	fi

	compile_var=
	finalize_var=
	if test -n "$runpath_var"; then
	if test -n "$perm_rpath"; then
	# We should set the runpath_var.
	rpath=
	for dir in $perm_rpath; do
	func_append rpath "$dir:"
	done
	compile_var="$runpath_var=\"$rpath\$$runpath_var\" "
	fi
	if test -n "$finalize_perm_rpath"; then
	# We should set the runpath_var.
	rpath=
	for dir in $finalize_perm_rpath; do
	func_append rpath "$dir:"
	done
	finalize_var="$runpath_var=\"$rpath\$$runpath_var\" "
	fi
	fi

	if test yes = "$no_install"; then
	# We don't need to create a wrapper script.
	link_command=$compile_var$compile_command$compile_rpath
	# Replace the output file specification.
	link_command=`$ECHO "$link_command" \| $SED 's%@OUTPUT@%'"$output"'%g'`
	# Delete the old output file.
	$opt_dry_run \|\| $RM $output
	# Link the executable and exit
	func_show_eval "$link_command" 'exit $?'

	if test -n "$postlink_cmds"; then
	func_to_tool_file "$output"
	postlink_cmds=`func_echo_all "$postlink_cmds" \| $SED -e 's%@OUTPUT@%'"$output"'%g' -e 's%@TOOL_OUTPUT@%'"$func_to_tool_file_result"'%g'`
	func_execute_cmds "$postlink_cmds" 'exit $?'
	fi

	exit $EXIT_SUCCESS
	fi

	case $hardcode_action,$fast_install in
	relink,*)
	# Fast installation is not supported
	link_command=$compile_var$compile_command$compile_rpath
	relink_command=$finalize_var$finalize_command$finalize_rpath

	func_warning "this platform does not like uninstalled shared libraries"
	func_warning "'$output' will be relinked during installation"
	;;
	*,yes)
	link_command=$finalize_var$compile_command$finalize_rpath
	relink_command=`$ECHO "$compile_var$compile_command$compile_rpath" \| $SED 's%@OUTPUT@%\$progdir/\$file%g'`
	;;
	*,no)
	link_command=$compile_var$compile_command$compile_rpath
	relink_command=$finalize_var$finalize_command$finalize_rpath
	;;
	*,needless)
	link_command=$finalize_var$compile_command$finalize_rpath
	relink_command=
	;;
	esac

	# Replace the output file specification.
	link_command=`$ECHO "$link_command" \| $SED 's%@OUTPUT@%'"$output_objdir/$outputname"'%g'`

	# Delete the old output files.
	$opt_dry_run \|\| $RM $output $output_objdir/$outputname $output_objdir/lt-$outputname

	func_show_eval "$link_command" 'exit $?'

	if test -n "$postlink_cmds"; then
	func_to_tool_file "$output_objdir/$outputname"
	postlink_cmds=`func_echo_all "$postlink_cmds" \| $SED -e 's%@OUTPUT@%'"$output_objdir/$outputname"'%g' -e 's%@TOOL_OUTPUT@%'"$func_to_tool_file_result"'%g'`
	func_execute_cmds "$postlink_cmds" 'exit $?'
	fi

	# Now create the wrapper script.
	func_verbose "creating $output"

	# Quote the relink command for shipping.
	if test -n "$relink_command"; then
	# Preserve any variables that may affect compiler behavior
	for var in $variables_saved_for_relink; do
	if eval test -z \"\${$var+set}\"; then
	relink_command="{ test -z \"\${$var+set}\" \|\| $lt_unset $var \|\| { $var=; export $var; }; }; $relink_command"
	elif eval var_value=\$$var; test -z "$var_value"; then
	relink_command="$var=; export $var; $relink_command"
	else
	func_quote_for_eval "$var_value"
	relink_command="$var=$func_quote_for_eval_result; export $var; $relink_command"
	fi
	done
	relink_command="(cd `pwd`; $relink_command)"
	relink_command=`$ECHO "$relink_command" \| $SED "$sed_quote_subst"`
	fi

	# Only actually do things if not in dry run mode.
	$opt_dry_run \|\| {
	# win32 will think the script is a binary if it has
	# a .exe suffix, so we strip it off here.
	case $output in
	*.exe) func_stripname '' '.exe' "$output"
	output=$func_stripname_result ;;
	esac
	# test for cygwin because mv fails w/o .exe extensions
	case $host in
	cygwin)
	exeext=.exe
	func_stripname '' '.exe' "$outputname"
	outputname=$func_stripname_result ;;
	*) exeext= ;;
	esac
	case $host in
	cygwin \| mingw )
	func_dirname_and_basename "$output" "" "."
	output_name=$func_basename_result
	output_path=$func_dirname_result
	cwrappersource=$output_path/$objdir/lt-$output_name.c
	cwrapper=$output_path/$output_name.exe
	$RM $cwrappersource $cwrapper
	trap "$RM $cwrappersource $cwrapper; exit $EXIT_FAILURE" 1 2 15

	func_emit_cwrapperexe_src > $cwrappersource

	# The wrapper executable is built using the $host compiler,
	# because it contains $host paths and files. If cross-
	# compiling, it, like the target executable, must be
	# executed on the $host or under an emulation environment.
	$opt_dry_run \|\| {
	$LTCC $LTCFLAGS -o $cwrapper $cwrappersource
	$STRIP $cwrapper
	}

	# Now, create the wrapper script for func_source use:
	func_ltwrapper_scriptname $cwrapper
	$RM $func_ltwrapper_scriptname_result
	trap "$RM $func_ltwrapper_scriptname_result; exit $EXIT_FAILURE" 1 2 15
	$opt_dry_run \|\| {
	# note: this script will not be executed, so do not chmod.
	if test "x$build" = "x$host"; then
	$cwrapper --lt-dump-script > $func_ltwrapper_scriptname_result
	else
	func_emit_wrapper no > $func_ltwrapper_scriptname_result
	fi
	}
	;;
	* )
	$RM $output
	trap "$RM $output; exit $EXIT_FAILURE" 1 2 15

	func_emit_wrapper no > $output
	chmod +x $output
	;;
	esac
	}
	exit $EXIT_SUCCESS
	;;
	esac

	# See if we need to build an old-fashioned archive.
	for oldlib in $oldlibs; do

	case $build_libtool_libs in
	convenience)
	oldobjs="$libobjs_save $symfileobj"
	addlibs=$convenience
	build_libtool_libs=no
	;;
	module)
	oldobjs=$libobjs_save
	addlibs=$old_convenience
	build_libtool_libs=no
	;;
	*)
	oldobjs="$old_deplibs $non_pic_objects"
	$preload && test -f "$symfileobj" \
	&& func_append oldobjs " $symfileobj"
	addlibs=$old_convenience
	;;
	esac

	if test -n "$addlibs"; then
	gentop=$output_objdir/${outputname}x
	func_append generated " $gentop"

	func_extract_archives $gentop $addlibs
	func_append oldobjs " $func_extract_archives_result"
	fi

	# Do each command in the archive commands.
	if test -n "$old_archive_from_new_cmds" && test yes = "$build_libtool_libs"; then
	cmds=$old_archive_from_new_cmds
	else

	# Add any objects from preloaded convenience libraries
	if test -n "$dlprefiles"; then
	gentop=$output_objdir/${outputname}x
	func_append generated " $gentop"

	func_extract_archives $gentop $dlprefiles
	func_append oldobjs " $func_extract_archives_result"
	fi

	# POSIX demands no paths to be encoded in archives. We have
	# to avoid creating archives with duplicate basenames if we
	# might have to extract them afterwards, e.g., when creating a
	# static archive out of a convenience library, or when linking
	# the entirety of a libtool archive into another (currently
	# not supported by libtool).
	if (for obj in $oldobjs
	do
	func_basename "$obj"
	$ECHO "$func_basename_result"
	done \| sort \| sort -uc >/dev/null 2>&1); then
	:
	else
	echo "copying selected object files to avoid basename conflicts..."
	gentop=$output_objdir/${outputname}x
	func_append generated " $gentop"
	func_mkdir_p "$gentop"
	save_oldobjs=$oldobjs
	oldobjs=
	counter=1
	for obj in $save_oldobjs
	do
	func_basename "$obj"
	objbase=$func_basename_result
	case " $oldobjs " in
	" ") oldobjs=$obj ;;
	[\ /]"$objbase ")
	while :; do
	# Make sure we don't pick an alternate name that also
	# overlaps.
	newobj=lt$counter-$objbase
	func_arith $counter + 1
	counter=$func_arith_result
	case " $oldobjs " in
	[\ /]"$newobj ") ;;
	*) if test ! -f "$gentop/$newobj"; then break; fi ;;
	esac
	done
	func_show_eval "ln $obj $gentop/$newobj \|\| cp $obj $gentop/$newobj"
	func_append oldobjs " $gentop/$newobj"
	;;
	*) func_append oldobjs " $obj" ;;
	esac
	done
	fi
	func_to_tool_file "$oldlib" func_convert_file_msys_to_w32
	tool_oldlib=$func_to_tool_file_result
	eval cmds=\"$old_archive_cmds\"

	func_len " $cmds"
	len=$func_len_result
	if test "$len" -lt "$max_cmd_len" \|\| test "$max_cmd_len" -le -1; then
	cmds=$old_archive_cmds
	elif test -n "$archiver_list_spec"; then
	func_verbose "using command file archive linking..."
	for obj in $oldobjs
	do
	func_to_tool_file "$obj"
	$ECHO "$func_to_tool_file_result"
	done > $output_objdir/$libname.libcmd
	func_to_tool_file "$output_objdir/$libname.libcmd"
	oldobjs=" $archiver_list_spec$func_to_tool_file_result"
	cmds=$old_archive_cmds
	else
	# the command line is too long to link in one step, link in parts
	func_verbose "using piecewise archive linking..."
	save_RANLIB=$RANLIB
	RANLIB=:
	objlist=
	concat_cmds=
	save_oldobjs=$oldobjs
	oldobjs=
	# Is there a better way of finding the last object in the list?
	for obj in $save_oldobjs
	do
	last_oldobj=$obj
	done
	eval test_cmds=\"$old_archive_cmds\"
	func_len " $test_cmds"
	len0=$func_len_result
	len=$len0
	for obj in $save_oldobjs
	do
	func_len " $obj"
	func_arith $len + $func_len_result
	len=$func_arith_result
	func_append objlist " $obj"
	if test "$len" -lt "$max_cmd_len"; then
	:
	else
	# the above command should be used before it gets too long
	oldobjs=$objlist
	if test "$obj" = "$last_oldobj"; then
	RANLIB=$save_RANLIB
	fi
	test -z "$concat_cmds" \|\| concat_cmds=$concat_cmds~
	eval concat_cmds=\"\$concat_cmds$old_archive_cmds\"
	objlist=
	len=$len0
	fi
	done
	RANLIB=$save_RANLIB
	oldobjs=$objlist
	if test -z "$oldobjs"; then
	eval cmds=\"\$concat_cmds\"
	else
	eval cmds=\"\$concat_cmds~\$old_archive_cmds\"
	fi
	fi
	fi
	func_execute_cmds "$cmds" 'exit $?'
	done

	test -n "$generated" && \
	func_show_eval "${RM}r$generated"

	# Now create the libtool archive.
	case $output in
	*.la)
	old_library=
	test yes = "$build_old_libs" && old_library=$libname.$libext
	func_verbose "creating $output"

	# Preserve any variables that may affect compiler behavior
	for var in $variables_saved_for_relink; do
	if eval test -z \"\${$var+set}\"; then
	relink_command="{ test -z \"\${$var+set}\" \|\| $lt_unset $var \|\| { $var=; export $var; }; }; $relink_command"
	elif eval var_value=\$$var; test -z "$var_value"; then
	relink_command="$var=; export $var; $relink_command"
	else
	func_quote_for_eval "$var_value"
	relink_command="$var=$func_quote_for_eval_result; export $var; $relink_command"
	fi
	done
	# Quote the link command for shipping.
	relink_command="(cd `pwd`; $SHELL \"$progpath\" $preserve_args --mode=relink $libtool_args @inst_prefix_dir@)"
	relink_command=`$ECHO "$relink_command" \| $SED "$sed_quote_subst"`
	if test yes = "$hardcode_automatic"; then
	relink_command=
	fi

	# Only create the output if not a dry run.
	$opt_dry_run \|\| {
	for installed in no yes; do
	if test yes = "$installed"; then
	if test -z "$install_libdir"; then
	break
	fi
	output=$output_objdir/${outputname}i
	# Replace all uninstalled libtool libraries with the installed ones
	newdependency_libs=
	for deplib in $dependency_libs; do
	case $deplib in
	*.la)
	func_basename "$deplib"
	name=$func_basename_result
	func_resolve_sysroot "$deplib"
	eval libdir=`$SED -n -e 's/^libdir=$.*$$/\1/p' $func_resolve_sysroot_result`
	test -z "$libdir" && \
	func_fatal_error "'$deplib' is not a valid libtool archive"
	func_append newdependency_libs " ${lt_sysroot:+=}$libdir/$name"
	;;
	-L*)
	func_stripname -L '' "$deplib"
	func_replace_sysroot "$func_stripname_result"
	func_append newdependency_libs " -L$func_replace_sysroot_result"
	;;
	-R*)
	func_stripname -R '' "$deplib"
	func_replace_sysroot "$func_stripname_result"
	func_append newdependency_libs " -R$func_replace_sysroot_result"
	;;
	*) func_append newdependency_libs " $deplib" ;;
	esac
	done
	dependency_libs=$newdependency_libs
	newdlfiles=

	for lib in $dlfiles; do
	case $lib in
	*.la)
	func_basename "$lib"
	name=$func_basename_result
	eval libdir=`$SED -n -e 's/^libdir=$.*$$/\1/p' $lib`
	test -z "$libdir" && \
	func_fatal_error "'$lib' is not a valid libtool archive"
	func_append newdlfiles " ${lt_sysroot:+=}$libdir/$name"
	;;
	*) func_append newdlfiles " $lib" ;;
	esac
	done
	dlfiles=$newdlfiles
	newdlprefiles=
	for lib in $dlprefiles; do
	case $lib in
	*.la)
	# Only pass preopened files to the pseudo-archive (for
	# eventual linking with the app. that links it) if we
	# didn't already link the preopened objects directly into
	# the library:
	func_basename "$lib"
	name=$func_basename_result
	eval libdir=`$SED -n -e 's/^libdir=$.*$$/\1/p' $lib`
	test -z "$libdir" && \
	func_fatal_error "'$lib' is not a valid libtool archive"
	func_append newdlprefiles " ${lt_sysroot:+=}$libdir/$name"
	;;
	esac
	done
	dlprefiles=$newdlprefiles
	else
	newdlfiles=
	for lib in $dlfiles; do
	case $lib in
	[\\/]* \| [A-Za-z]:[\\/]*) abs=$lib ;;
	*) abs=`pwd`"/$lib" ;;
	esac
	func_append newdlfiles " $abs"
	done
	dlfiles=$newdlfiles
	newdlprefiles=
	for lib in $dlprefiles; do
	case $lib in
	[\\/]* \| [A-Za-z]:[\\/]*) abs=$lib ;;
	*) abs=`pwd`"/$lib" ;;
	esac
	func_append newdlprefiles " $abs"
	done
	dlprefiles=$newdlprefiles
	fi
	$RM $output
	# place dlname in correct position for cygwin
	# In fact, it would be nice if we could use this code for all target
	# systems that can't hard-code library paths into their executables
	# and that have no shared library path variable independent of PATH,
	# but it turns out we can't easily determine that from inspecting
	# libtool variables, so we have to hard-code the OSs to which it
	# applies here; at the moment, that means platforms that use the PE
	# object format with DLL files. See the long comment at the top of
	# tests/bindir.at for full details.
	tdlname=$dlname
	case $host,$output,$installed,$module,$dlname in
	cygwin,lai,yes,no,.dll \| mingw,lai,yes,no,.dll \| cegcc,lai,yes,no,.dll)
	# If a -bindir argument was supplied, place the dll there.
	if test -n "$bindir"; then
	func_relative_path "$install_libdir" "$bindir"
	tdlname=$func_relative_path_result/$dlname
	else
	# Otherwise fall back on heuristic.
	tdlname=../bin/$dlname
	fi
	;;
	esac
	$ECHO > $output "\
	# $outputname - a libtool library file
	# Generated by $PROGRAM (GNU $PACKAGE) $VERSION
	#
	# Please DO NOT delete this file!
	# It is necessary for linking the library.

	# The name that we can dlopen(3).
	dlname='$tdlname'

	# Names of this library.
	library_names='$library_names'

	# The name of the static archive.
	old_library='$old_library'

	# Linker flags that cannot go in dependency_libs.
	inherited_linker_flags='$new_inherited_linker_flags'

	# Libraries that this one depends upon.
	dependency_libs='$dependency_libs'

	# Names of additional weak libraries provided by this library
	weak_library_names='$weak_libs'

	# Version information for $libname.
	current=$current
	age=$age
	revision=$revision

	# Is this an already installed library?
	installed=$installed

	# Should we warn about portability when linking against -modules?
	shouldnotlink=$module

	# Files to dlopen/dlpreopen
	dlopen='$dlfiles'
	dlpreopen='$dlprefiles'

	# Directory that this library needs to be installed in:
	libdir='$install_libdir'"
	if test no,yes = "$installed,$need_relink"; then
	$ECHO >> $output "\
	relink_command=\"$relink_command\""
	fi
	done
	}

	# Do a symbolic link so that the libtool archive can be found in
	# LD_LIBRARY_PATH before the program is installed.
	func_show_eval '( cd "$output_objdir" && $RM "$outputname" && $LN_S "../$outputname" "$outputname" )' 'exit $?'
	;;
	esac
	exit $EXIT_SUCCESS
	}

	if test link = "$opt_mode" \|\| test relink = "$opt_mode"; then
	func_mode_link ${1+"$@"}
	fi


	# func_mode_uninstall arg...
	func_mode_uninstall ()
	{
	$debug_cmd

	RM=$nonopt
	files=
	rmforce=false
	exit_status=0

	# This variable tells wrapper scripts just to set variables rather
	# than running their programs.
	libtool_install_magic=$magic

	for arg
	do
	case $arg in
	-f) func_append RM " $arg"; rmforce=: ;;
	-*) func_append RM " $arg" ;;
	*) func_append files " $arg" ;;
	esac
	done

	test -z "$RM" && \
	func_fatal_help "you must specify an RM program"

	rmdirs=

	for file in $files; do
	func_dirname "$file" "" "."
	dir=$func_dirname_result
	if test . = "$dir"; then
	odir=$objdir
	else
	odir=$dir/$objdir
	fi
	func_basename "$file"
	name=$func_basename_result
	test uninstall = "$opt_mode" && odir=$dir

	# Remember odir for removal later, being careful to avoid duplicates
	if test clean = "$opt_mode"; then
	case " $rmdirs " in
	" $odir ") ;;
	*) func_append rmdirs " $odir" ;;
	esac
	fi

	# Don't error if the file doesn't exist and rm -f was used.
	if { test -L "$file"; } >/dev/null 2>&1 \|\|
	{ test -h "$file"; } >/dev/null 2>&1 \|\|
	test -f "$file"; then
	:
	elif test -d "$file"; then
	exit_status=1
	continue
	elif $rmforce; then
	continue
	fi

	rmfiles=$file

	case $name in
	*.la)
	# Possibly a libtool archive, so verify it.
	if func_lalib_p "$file"; then
	func_source $dir/$name

	# Delete the libtool libraries and symlinks.
	for n in $library_names; do
	func_append rmfiles " $odir/$n"
	done
	test -n "$old_library" && func_append rmfiles " $odir/$old_library"

	case $opt_mode in
	clean)
	case " $library_names " in
	" $dlname ") ;;
	*) test -n "$dlname" && func_append rmfiles " $odir/$dlname" ;;
	esac
	test -n "$libdir" && func_append rmfiles " $odir/$name $odir/${name}i"
	;;
	uninstall)
	if test -n "$library_names"; then
	# Do each command in the postuninstall commands.
	func_execute_cmds "$postuninstall_cmds" '$rmforce \|\| exit_status=1'
	fi

	if test -n "$old_library"; then
	# Do each command in the old_postuninstall commands.
	func_execute_cmds "$old_postuninstall_cmds" '$rmforce \|\| exit_status=1'
	fi
	# FIXME: should reinstall the best remaining shared library.
	;;
	esac
	fi
	;;

	*.lo)
	# Possibly a libtool object, so verify it.
	if func_lalib_p "$file"; then

	# Read the .lo file
	func_source $dir/$name

	# Add PIC object to the list of files to remove.
	if test -n "$pic_object" && test none != "$pic_object"; then
	func_append rmfiles " $dir/$pic_object"
	fi

	# Add non-PIC object to the list of files to remove.
	if test -n "$non_pic_object" && test none != "$non_pic_object"; then
	func_append rmfiles " $dir/$non_pic_object"
	fi
	fi
	;;

	*)
	if test clean = "$opt_mode"; then
	noexename=$name
	case $file in
	*.exe)
	func_stripname '' '.exe' "$file"
	file=$func_stripname_result
	func_stripname '' '.exe' "$name"
	noexename=$func_stripname_result
	# $file with .exe has already been added to rmfiles,
	# add $file without .exe
	func_append rmfiles " $file"
	;;
	esac
	# Do a test to see if this is a libtool program.
	if func_ltwrapper_p "$file"; then
	if func_ltwrapper_executable_p "$file"; then
	func_ltwrapper_scriptname "$file"
	relink_command=
	func_source $func_ltwrapper_scriptname_result
	func_append rmfiles " $func_ltwrapper_scriptname_result"
	else
	relink_command=
	func_source $dir/$noexename
	fi

	# note $name still contains .exe if it was in $file originally
	# as does the version of $file that was added into $rmfiles
	func_append rmfiles " $odir/$name $odir/${name}S.$objext"
	if test yes = "$fast_install" && test -n "$relink_command"; then
	func_append rmfiles " $odir/lt-$name"
	fi
	if test "X$noexename" != "X$name"; then
	func_append rmfiles " $odir/lt-$noexename.c"
	fi
	fi
	fi
	;;
	esac
	func_show_eval "$RM $rmfiles" 'exit_status=1'
	done

	# Try to remove the $objdir's in the directories where we deleted files
	for dir in $rmdirs; do
	if test -d "$dir"; then
	func_show_eval "rmdir $dir >/dev/null 2>&1"
	fi
	done

	exit $exit_status
	}

	if test uninstall = "$opt_mode" \|\| test clean = "$opt_mode"; then
	func_mode_uninstall ${1+"$@"}
	fi

	test -z "$opt_mode" && {
	help=$generic_help
	func_fatal_help "you must specify a MODE"
	}

	test -z "$exec_cmd" && \
	func_fatal_help "invalid operation mode '$opt_mode'"

	if test -n "$exec_cmd"; then
	eval exec "$exec_cmd"
	exit $EXIT_FAILURE
	fi

	exit $exit_status


	# The TAGs below are defined such that we never get into a situation
	# where we disable both kinds of libraries. Given conflicting
	# choices, we go for a static library, that is the most portable,
	# since we can't tell whether shared libraries were disabled because
	# the user asked for that or because the platform doesn't support
	# them. This is particularly important on AIX, because we don't
	# support having both static and shared libraries enabled at the same
	# time on that platform, so we default to a shared-only configuration.
	# If a disable-shared tag is given, we'll fallback to a static-only
	# configuration. But we'll never go from static-only to shared-only.

	# ### BEGIN LIBTOOL TAG CONFIG: disable-shared
	build_libtool_libs=no
	build_old_libs=yes
	# ### END LIBTOOL TAG CONFIG: disable-shared

	# ### BEGIN LIBTOOL TAG CONFIG: disable-static
	build_old_libs=`case $build_libtool_libs in yes) echo no;; *) echo yes;; esac`
	# ### END LIBTOOL TAG CONFIG: disable-static

	# Local Variables:
	# mode:shell-script
	# sh-indentation:2
	# End:
	Index: head/contrib/unbound/respip/respip.c
	===================================================================
	--- head/contrib/unbound/respip/respip.c (revision 349719)
	+++ head/contrib/unbound/respip/respip.c (revision 349720)
	@@ -1,1181 +1,1185 @@
	/*
	* respip/respip.c - filtering response IP module
	*/

	/**
	* \file
	*
	* This file contains a module that inspects a result of recursive resolution
	* to see if any IP address record should trigger a special action.
	* If applicable these actions can modify the original response.
	*/
	#include "config.h"

	#include "services/localzone.h"
	#include "services/cache/dns.h"
	#include "sldns/str2wire.h"
	#include "util/config_file.h"
	#include "util/fptr_wlist.h"
	#include "util/module.h"
	#include "util/net_help.h"
	#include "util/regional.h"
	#include "util/data/msgreply.h"
	#include "util/storage/dnstree.h"
	#include "respip/respip.h"
	#include "services/view.h"
	#include "sldns/rrdef.h"

	/**
	* Conceptual set of IP addresses for response AAAA or A records that should
	* trigger special actions.
	*/
	struct respip_set {
	struct regional* region;
	struct rbtree_type ip_tree;
	char* const* tagname; /* shallow copy of tag names, for logging */
	int num_tags; /* number of tagname entries */
	};

	/** An address span with response control information */
	struct resp_addr {
	/** node in address tree */
	struct addr_tree_node node;
	/** tag bitlist */
	uint8_t* taglist;
	/** length of the taglist (in bytes) */
	size_t taglen;
	/** action for this address span */
	enum respip_action action;
	/** "local data" for this node */
	struct ub_packed_rrset_key* data;
	};

	/** Subset of resp_addr.node, used for inform-variant logging */
	struct respip_addr_info {
	struct sockaddr_storage addr;
	socklen_t addrlen;
	int net;
	};

	/** Query state regarding the response-ip module. */
	enum respip_state {
	/**
	* The general state. Unless CNAME chasing takes place, all processing
	* is completed in this state without any other asynchronous event.
	*/
	RESPIP_INIT = 0,

	/**
	* A subquery for CNAME chasing is completed.
	*/
	RESPIP_SUBQUERY_FINISHED
	};

	/** Per query state for the response-ip module. */
	struct respip_qstate {
	enum respip_state state;
	};

	struct respip_set*
	respip_set_create(void)
	{
	struct respip_set* set = calloc(1, sizeof(*set));
	if(!set)
	return NULL;
	set->region = regional_create();
	if(!set->region) {
	free(set);
	return NULL;
	}
	addr_tree_init(&set->ip_tree);
	return set;
	}

	void
	respip_set_delete(struct respip_set* set)
	{
	if(!set)
	return;
	regional_destroy(set->region);
	free(set);
	}

	struct rbtree_type*
	respip_set_get_tree(struct respip_set* set)
	{
	if(!set)
	return NULL;
	return &set->ip_tree;
	}

	/** returns the node in the address tree for the specified netblock string;
	* non-existent node will be created if 'create' is true */
	static struct resp_addr*
	respip_find_or_create(struct respip_set* set, const char* ipstr, int create)
	{
	struct resp_addr* node;
	struct sockaddr_storage addr;
	int net;
	socklen_t addrlen;

	if(!netblockstrtoaddr(ipstr, 0, &addr, &addrlen, &net)) {
	log_err("cannot parse netblock: '%s'", ipstr);
	return NULL;
	}
	node = (struct resp_addr*)addr_tree_find(&set->ip_tree, &addr, addrlen, net);
	if(!node && create) {
	node = regional_alloc_zero(set->region, sizeof(*node));
	if(!node) {
	log_err("out of memory");
	return NULL;
	}
	node->action = respip_none;
	if(!addr_tree_insert(&set->ip_tree, &node->node, &addr,
	addrlen, net)) {
	/* We know we didn't find it, so this should be
	* impossible. */
	log_warn("unexpected: duplicate address: %s", ipstr);
	}
	}
	return node;
	}

	static int
	respip_tag_cfg(struct respip_set* set, const char* ipstr,
	const uint8_t* taglist, size_t taglen)
	{
	struct resp_addr* node;

	if(!(node=respip_find_or_create(set, ipstr, 1)))
	return 0;
	if(node->taglist) {
	log_warn("duplicate response-address-tag for '%s', overridden.",
	ipstr);
	}
	node->taglist = regional_alloc_init(set->region, taglist, taglen);
	if(!node->taglist) {
	log_err("out of memory");
	return 0;
	}
	node->taglen = taglen;
	return 1;
	}

	/** set action for the node specified by the netblock string */
	static int
	respip_action_cfg(struct respip_set* set, const char* ipstr,
	const char* actnstr)
	{
	struct resp_addr* node;
	enum respip_action action;

	if(!(node=respip_find_or_create(set, ipstr, 1)))
	return 0;
	if(node->action != respip_none) {
	verbose(VERB_QUERY, "duplicate response-ip action for '%s', overridden.",
	ipstr);
	}
	if(strcmp(actnstr, "deny") == 0)
	action = respip_deny;
	else if(strcmp(actnstr, "redirect") == 0)
	action = respip_redirect;
	else if(strcmp(actnstr, "inform") == 0)
	action = respip_inform;
	else if(strcmp(actnstr, "inform_deny") == 0)
	action = respip_inform_deny;
	+ else if(strcmp(actnstr, "inform_redirect") == 0)
	+ action = respip_inform_redirect;
	else if(strcmp(actnstr, "always_transparent") == 0)
	action = respip_always_transparent;
	else if(strcmp(actnstr, "always_refuse") == 0)
	action = respip_always_refuse;
	else if(strcmp(actnstr, "always_nxdomain") == 0)
	action = respip_always_nxdomain;
	else {
	log_err("unknown response-ip action %s", actnstr);
	return 0;
	}
	node->action = action;
	return 1;
	}

	/** allocate and initialize an rrset structure; this function is based
	* on new_local_rrset() from the localzone.c module */
	static struct ub_packed_rrset_key*
	new_rrset(struct regional* region, uint16_t rrtype, uint16_t rrclass)
	{
	struct packed_rrset_data* pd;
	struct ub_packed_rrset_key* rrset = regional_alloc_zero(
	region, sizeof(*rrset));
	if(!rrset) {
	log_err("out of memory");
	return NULL;
	}
	rrset->entry.key = rrset;
	pd = regional_alloc_zero(region, sizeof(*pd));
	if(!pd) {
	log_err("out of memory");
	return NULL;
	}
	pd->trust = rrset_trust_prim_noglue;
	pd->security = sec_status_insecure;
	rrset->entry.data = pd;
	rrset->rk.dname = regional_alloc_zero(region, 1);
	if(!rrset->rk.dname) {
	log_err("out of memory");
	return NULL;
	}
	rrset->rk.dname_len = 1;
	rrset->rk.type = htons(rrtype);
	rrset->rk.rrset_class = htons(rrclass);
	return rrset;
	}

	/** enter local data as resource records into a response-ip node */
	static int
	respip_enter_rr(struct regional* region, struct resp_addr* raddr,
	const char* rrstr, const char* netblock)
	{
	uint8_t* nm;
	uint16_t rrtype = 0, rrclass = 0;
	time_t ttl = 0;
	uint8_t rr[LDNS_RR_BUF_SIZE];
	uint8_t* rdata = NULL;
	size_t rdata_len = 0;
	char buf[65536];
	char bufshort[64];
	struct packed_rrset_data* pd;
	struct sockaddr* sa;
	int ret;
	- if(raddr->action != respip_redirect) {
	+ if(raddr->action != respip_redirect
	+ && raddr->action != respip_inform_redirect) {
	log_err("cannot parse response-ip-data %s: response-ip "
	"action for %s is not redirect", rrstr, netblock);
	return 0;
	}
	ret = snprintf(buf, sizeof(buf), ". %s", rrstr);
	if(ret < 0 \|\| ret >= (int)sizeof(buf)) {
	strlcpy(bufshort, rrstr, sizeof(bufshort));
	log_err("bad response-ip-data: %s...", bufshort);
	return 0;
	}
	if(!rrstr_get_rr_content(buf, &nm, &rrtype, &rrclass, &ttl, rr, sizeof(rr),
	&rdata, &rdata_len)) {
	log_err("bad response-ip-data: %s", rrstr);
	return 0;
	}
	free(nm);
	sa = (struct sockaddr*)&raddr->node.addr;
	if (rrtype == LDNS_RR_TYPE_CNAME && raddr->data) {
	log_err("CNAME response-ip data (%s) can not co-exist with other "
	"response-ip data for netblock %s", rrstr, netblock);
	return 0;
	} else if (raddr->data &&
	raddr->data->rk.type == htons(LDNS_RR_TYPE_CNAME)) {
	log_err("response-ip data (%s) can not be added; CNAME response-ip "
	"data already in place for netblock %s", rrstr, netblock);
	return 0;
	} else if((rrtype != LDNS_RR_TYPE_CNAME) &&
	((sa->sa_family == AF_INET && rrtype != LDNS_RR_TYPE_A) \|\|
	(sa->sa_family == AF_INET6 && rrtype != LDNS_RR_TYPE_AAAA))) {
	log_err("response-ip data %s record type does not correspond "
	"to netblock %s address family", rrstr, netblock);
	return 0;
	}

	if(!raddr->data) {
	raddr->data = new_rrset(region, rrtype, rrclass);
	if(!raddr->data)
	return 0;
	}
	pd = raddr->data->entry.data;
	return rrset_insert_rr(region, pd, rdata, rdata_len, ttl, rrstr);
	}

	static int
	respip_data_cfg(struct respip_set* set, const char* ipstr, const char* rrstr)
	{
	struct resp_addr* node;

	node=respip_find_or_create(set, ipstr, 0);
	if(!node \|\| node->action == respip_none) {
	log_err("cannot parse response-ip-data %s: "
	"response-ip node for %s not found", rrstr, ipstr);
	return 0;
	}
	return respip_enter_rr(set->region, node, rrstr, ipstr);
	}

	static int
	respip_set_apply_cfg(struct respip_set* set, char* const* tagname, int num_tags,
	struct config_strbytelist* respip_tags,
	struct config_str2list* respip_actions,
	struct config_str2list* respip_data)
	{
	struct config_strbytelist* p;
	struct config_str2list* pa;
	struct config_str2list* pd;

	set->tagname = tagname;
	set->num_tags = num_tags;

	p = respip_tags;
	while(p) {
	struct config_strbytelist* np = p->next;

	log_assert(p->str && p->str2);
	if(!respip_tag_cfg(set, p->str, p->str2, p->str2len)) {
	config_del_strbytelist(p);
	return 0;
	}
	free(p->str);
	free(p->str2);
	free(p);
	p = np;
	}

	pa = respip_actions;
	while(pa) {
	struct config_str2list* np = pa->next;
	log_assert(pa->str && pa->str2);
	if(!respip_action_cfg(set, pa->str, pa->str2)) {
	config_deldblstrlist(pa);
	return 0;
	}
	free(pa->str);
	free(pa->str2);
	free(pa);
	pa = np;
	}

	pd = respip_data;
	while(pd) {
	struct config_str2list* np = pd->next;
	log_assert(pd->str && pd->str2);
	if(!respip_data_cfg(set, pd->str, pd->str2)) {
	config_deldblstrlist(pd);
	return 0;
	}
	free(pd->str);
	free(pd->str2);
	free(pd);
	pd = np;
	}

	return 1;
	}

	int
	respip_global_apply_cfg(struct respip_set* set, struct config_file* cfg)
	{
	int ret = respip_set_apply_cfg(set, cfg->tagname, cfg->num_tags,
	cfg->respip_tags, cfg->respip_actions, cfg->respip_data);
	cfg->respip_data = NULL;
	cfg->respip_actions = NULL;
	cfg->respip_tags = NULL;
	return ret;
	}

	/** Iterate through raw view data and apply the view-specific respip
	* configuration; at this point we should have already seen all the views,
	* so if any of the views that respip data refer to does not exist, that's
	* an error. This additional iteration through view configuration data
	* is expected to not have significant performance impact (or rather, its
	* performance impact is not expected to be prohibitive in the configuration
	* processing phase).
	*/
	int
	respip_views_apply_cfg(struct views* vs, struct config_file* cfg,
	int* have_view_respip_cfg)
	{
	struct config_view* cv;
	struct view* v;
	int ret;

	for(cv = cfg->views; cv; cv = cv->next) {

	/** if no respip config for this view then there's
	* nothing to do; note that even though respip data must go
	* with respip action, we're checking for both here because
	* we want to catch the case where the respip action is missing
	* while the data is present */
	if(!cv->respip_actions && !cv->respip_data)
	continue;

	if(!(v = views_find_view(vs, cv->name, 1))) {
	log_err("view '%s' unexpectedly missing", cv->name);
	return 0;
	}
	if(!v->respip_set) {
	v->respip_set = respip_set_create();
	if(!v->respip_set) {
	log_err("out of memory");
	lock_rw_unlock(&v->lock);
	return 0;
	}
	}
	ret = respip_set_apply_cfg(v->respip_set, NULL, 0, NULL,
	cv->respip_actions, cv->respip_data);
	lock_rw_unlock(&v->lock);
	if(!ret) {
	log_err("Error while applying respip configuration "
	"for view '%s'", cv->name);
	return 0;
	}
	have_view_respip_cfg = (have_view_respip_cfg \|\|
	v->respip_set->ip_tree.count);
	cv->respip_actions = NULL;
	cv->respip_data = NULL;
	}
	return 1;
	}

	/**
	* make a deep copy of 'key' in 'region'.
	* This is largely derived from packed_rrset_copy_region() and
	* packed_rrset_ptr_fixup(), but differs in the following points:
	*
	* - It doesn't assume all data in 'key' are in a contiguous memory region.
	* Although that would be the case in most cases, 'key' can be passed from
	* a lower-level module and it might not build the rrset to meet the
	* assumption. In fact, an rrset specified as response-ip-data or generated
	* in local_data_find_tag_datas() breaks the assumption. So it would be
	* safer not to naively rely on the assumption. On the other hand, this
	* function ensures the copied rrset data are in a contiguous region so
	* that it won't cause a disruption even if an upper layer module naively
	* assumes the memory layout.
	* - It doesn't copy RRSIGs (if any) in 'key'. The rrset will be used in
	* a reply that was already faked, so it doesn't make much sense to provide
	* partial sigs even if they are valid themselves.
	* - It doesn't adjust TTLs as it basically has to be a verbatim copy of 'key'
	* just allocated in 'region' (the assumption is necessary TTL adjustment
	* has been already done in 'key').
	*
	* This function returns the copied rrset key on success, and NULL on memory
	* allocation failure.
	*/
	static struct ub_packed_rrset_key*
	copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region)
	{
	struct ub_packed_rrset_key* ck = regional_alloc(region,
	sizeof(struct ub_packed_rrset_key));
	struct packed_rrset_data* d;
	struct packed_rrset_data* data = key->entry.data;
	size_t dsize, i;
	uint8_t* nextrdata;

	/* derived from packed_rrset_copy_region(), but don't use
	* packed_rrset_sizeof() and do exclude RRSIGs */
	if(!ck)
	return NULL;
	ck->id = key->id;
	memset(&ck->entry, 0, sizeof(ck->entry));
	ck->entry.hash = key->entry.hash;
	ck->entry.key = ck;
	ck->rk = key->rk;
	ck->rk.dname = regional_alloc_init(region, key->rk.dname,
	key->rk.dname_len);
	if(!ck->rk.dname)
	return NULL;

	dsize = sizeof(struct packed_rrset_data) + data->count *
	(sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t));
	for(i=0; i<data->count; i++)
	dsize += data->rr_len[i];
	d = regional_alloc(region, dsize);
	if(!d)
	return NULL;
	d = data;
	d->rrsig_count = 0;
	ck->entry.data = d;

	/* derived from packed_rrset_ptr_fixup() with copying the data */
	d->rr_len = (size_t)((uint8_t)d + sizeof(struct packed_rrset_data));
	d->rr_data = (uint8_t**)&(d->rr_len[d->count]);
	d->rr_ttl = (time_t*)&(d->rr_data[d->count]);
	nextrdata = (uint8_t*)&(d->rr_ttl[d->count]);
	for(i=0; i<d->count; i++) {
	d->rr_len[i] = data->rr_len[i];
	d->rr_ttl[i] = data->rr_ttl[i];
	d->rr_data[i] = nextrdata;
	memcpy(d->rr_data[i], data->rr_data[i], data->rr_len[i]);
	nextrdata += d->rr_len[i];
	}

	return ck;
	}

	int
	respip_init(struct module_env* env, int id)
	{
	(void)env;
	(void)id;
	return 1;
	}

	void
	respip_deinit(struct module_env* env, int id)
	{
	(void)env;
	(void)id;
	}

	/** Convert a packed AAAA or A RRset to sockaddr. */
	static int
	rdata2sockaddr(const struct packed_rrset_data* rd, uint16_t rtype, size_t i,
	struct sockaddr_storage* ss, socklen_t* addrlenp)
	{
	/* unbound can accept and cache odd-length AAAA/A records, so we have
	* to validate the length. */
	if(rtype == LDNS_RR_TYPE_A && rd->rr_len[i] == 6) {
	struct sockaddr_in* sa4 = (struct sockaddr_in*)ss;

	memset(sa4, 0, sizeof(*sa4));
	sa4->sin_family = AF_INET;
	memcpy(&sa4->sin_addr, rd->rr_data[i] + 2,
	sizeof(sa4->sin_addr));
	addrlenp = sizeof(sa4);
	return 1;
	} else if(rtype == LDNS_RR_TYPE_AAAA && rd->rr_len[i] == 18) {
	struct sockaddr_in6* sa6 = (struct sockaddr_in6*)ss;

	memset(sa6, 0, sizeof(*sa6));
	sa6->sin6_family = AF_INET6;
	memcpy(&sa6->sin6_addr, rd->rr_data[i] + 2,
	sizeof(sa6->sin6_addr));
	addrlenp = sizeof(sa6);
	return 1;
	}
	return 0;
	}

	/**
	* Search the given 'iptree' for response address information that matches
	* any of the IP addresses in an AAAA or A in the answer section of the
	* response (stored in 'rep'). If found, a pointer to the matched resp_addr
	* structure will be returned, and '*rrset_id' is set to the index in
	* rep->rrsets for the RRset that contains the matching IP address record
	* (the index is normally 0, but can be larger than that if this is a CNAME
	* chain or type-ANY response).
	*/
	static const struct resp_addr*
	respip_addr_lookup(const struct reply_info rep, struct rbtree_type iptree,
	size_t* rrset_id)
	{
	size_t i;
	struct resp_addr* ra;
	struct sockaddr_storage ss;
	socklen_t addrlen;

	for(i=0; i<rep->an_numrrsets; i++) {
	size_t j;
	const struct packed_rrset_data* rd;
	uint16_t rtype = ntohs(rep->rrsets[i]->rk.type);

	if(rtype != LDNS_RR_TYPE_A && rtype != LDNS_RR_TYPE_AAAA)
	continue;
	rd = rep->rrsets[i]->entry.data;
	for(j = 0; j < rd->count; j++) {
	if(!rdata2sockaddr(rd, rtype, j, &ss, &addrlen))
	continue;
	ra = (struct resp_addr*)addr_tree_lookup(iptree, &ss,
	addrlen);
	if(ra) {
	*rrset_id = i;
	return ra;
	}
	}
	}

	return NULL;
	}

	/*
	* Create a new reply_info based on 'rep'. The new info is based on
	* the passed 'rep', but ignores any rrsets except for the first 'an_numrrsets'
	* RRsets in the answer section. These answer rrsets are copied to the
	* new info, up to 'copy_rrsets' rrsets (which must not be larger than
	* 'an_numrrsets'). If an_numrrsets > copy_rrsets, the remaining rrsets array
	* entries will be kept empty so the caller can fill them later. When rrsets
	* are copied, they are shallow copied. The caller must ensure that the
	* copied rrsets are valid throughout its lifetime and must provide appropriate
	* mutex if it can be shared by multiple threads.
	*/
	static struct reply_info *
	make_new_reply_info(const struct reply_info* rep, struct regional* region,
	size_t an_numrrsets, size_t copy_rrsets)
	{
	struct reply_info* new_rep;
	size_t i;

	/* create a base struct. we specify 'insecure' security status as
	* the modified response won't be DNSSEC-valid. In our faked response
	* the authority and additional sections will be empty (except possible
	* EDNS0 OPT RR in the additional section appended on sending it out),
	* so the total number of RRsets is an_numrrsets. */
	new_rep = construct_reply_info_base(region, rep->flags,
	rep->qdcount, rep->ttl, rep->prefetch_ttl,
	rep->serve_expired_ttl, an_numrrsets, 0, 0, an_numrrsets,
	sec_status_insecure);
	if(!new_rep)
	return NULL;
	if(!reply_info_alloc_rrset_keys(new_rep, NULL, region))
	return NULL;
	for(i=0; i<copy_rrsets; i++)
	new_rep->rrsets[i] = rep->rrsets[i];

	return new_rep;
	}

	/**
	* See if response-ip or tag data should override the original answer rrset
	* (which is rep->rrsets[rrset_id]) and if so override it.
	* This is (mostly) equivalent to localzone.c:local_data_answer() but for
	* response-ip actions.
	* Note that this function distinguishes error conditions from "success but
	* not overridden". This is because we want to avoid accidentally applying
	* the "no data" action in case of error.
	* @param raddr: address span that requires an action
	* @param action: action to apply
	* @param qtype: original query type
	* @param rep: original reply message
	* @param rrset_id: the rrset ID in 'rep' to which the action should apply
	* @param new_repp: see respip_rewrite_reply
	* @param tag: if >= 0 the tag ID used to determine the action and data
	* @param tag_datas: data corresponding to 'tag'.
	* @param tag_datas_size: size of 'tag_datas'
	* @param tagname: array of tag names, used for logging
	* @param num_tags: size of 'tagname', used for logging
	* @param redirect_rrsetp: ptr to redirect record
	* @param region: region for building new reply
	* @return 1 if overridden, 0 if not overridden, -1 on error.
	*/
	static int
	respip_data_answer(const struct resp_addr* raddr, enum respip_action action,
	uint16_t qtype, const struct reply_info* rep,
	size_t rrset_id, struct reply_info** new_repp, int tag,
	struct config_strlist** tag_datas, size_t tag_datas_size,
	char* const* tagname, int num_tags,
	struct ub_packed_rrset_key** redirect_rrsetp, struct regional* region)
	{
	struct ub_packed_rrset_key* rp = raddr->data;
	struct reply_info* new_rep;
	*redirect_rrsetp = NULL;

	if(action == respip_redirect && tag != -1 &&
	(size_t)tag<tag_datas_size && tag_datas[tag]) {
	struct query_info dataqinfo;
	struct ub_packed_rrset_key r;

	/* Extract parameters of the original answer rrset that can be
	* rewritten below, in the form of query_info. Note that these
	* can be different from the info of the original query if the
	* rrset is a CNAME target.*/
	memset(&dataqinfo, 0, sizeof(dataqinfo));
	dataqinfo.qname = rep->rrsets[rrset_id]->rk.dname;
	dataqinfo.qname_len = rep->rrsets[rrset_id]->rk.dname_len;
	dataqinfo.qtype = ntohs(rep->rrsets[rrset_id]->rk.type);
	dataqinfo.qclass = ntohs(rep->rrsets[rrset_id]->rk.rrset_class);

	memset(&r, 0, sizeof(r));
	if(local_data_find_tag_datas(&dataqinfo, tag_datas[tag], &r,
	region)) {
	verbose(VERB_ALGO,
	"response-ip redirect with tag data [%d] %s",
	tag, (tag<num_tags?tagname[tag]:"null"));
	/* use copy_rrset() to 'normalize' memory layout */
	rp = copy_rrset(&r, region);
	if(!rp)
	return -1;
	}
	}
	if(!rp)
	return 0;

	/* If we are using response-ip-data, we need to make a copy of rrset
	* to replace the rrset's dname. Note that, unlike local data, we
	* rename the dname for other actions than redirect. This is because
	* response-ip-data isn't associated to any specific name. */
	if(rp == raddr->data) {
	rp = copy_rrset(rp, region);
	if(!rp)
	return -1;
	rp->rk.dname = rep->rrsets[rrset_id]->rk.dname;
	rp->rk.dname_len = rep->rrsets[rrset_id]->rk.dname_len;
	}

	/* Build a new reply with redirect rrset. We keep any preceding CNAMEs
	* and replace the address rrset that triggers the action. If it's
	* type ANY query, however, no other answer records should be kept
	* (note that it can't be a CNAME chain in this case due to
	* sanitizing). */
	if(qtype == LDNS_RR_TYPE_ANY)
	rrset_id = 0;
	new_rep = make_new_reply_info(rep, region, rrset_id + 1, rrset_id);
	if(!new_rep)
	return -1;
	rp->rk.flags \|= PACKED_RRSET_FIXEDTTL; /* avoid adjusting TTL */
	new_rep->rrsets[rrset_id] = rp;

	*redirect_rrsetp = rp;
	*new_repp = new_rep;
	return 1;
	}

	/**
	* apply response ip action in case where no action data is provided.
	* this is similar to localzone.c:lz_zone_answer() but simplified due to
	* the characteristics of response ip:
	* - 'deny' variants will be handled at the caller side
	* - no specific processing for 'transparent' variants: unlike local zones,
	* there is no such a case of 'no data but name existing'. so all variants
	* just mean 'transparent if no data'.
	* @param qtype: query type
	* @param action: found action
	* @param rep:
	* @param new_repp
	* @param rrset_id
	* @param region: region for building new reply
	* @return 1 on success, 0 on error.
	*/
	static int
	respip_nodata_answer(uint16_t qtype, enum respip_action action,
	const struct reply_info *rep, size_t rrset_id,
	struct reply_info** new_repp, struct regional* region)
	{
	struct reply_info* new_rep;

	if(action == respip_refuse \|\| action == respip_always_refuse) {
	new_rep = make_new_reply_info(rep, region, 0, 0);
	if(!new_rep)
	return 0;
	FLAGS_SET_RCODE(new_rep->flags, LDNS_RCODE_REFUSED);
	*new_repp = new_rep;
	return 1;
	} else if(action == respip_static \|\| action == respip_redirect \|\|
	- action == respip_always_nxdomain) {
	+ action == respip_always_nxdomain \|\|
	+ action == respip_inform_redirect) {
	/* Since we don't know about other types of the owner name,
	* we generally return NOERROR/NODATA unless an NXDOMAIN action
	* is explicitly specified. */
	int rcode = (action == respip_always_nxdomain)?
	LDNS_RCODE_NXDOMAIN:LDNS_RCODE_NOERROR;

	/* We should empty the answer section except for any preceding
	* CNAMEs (in that case rrset_id > 0). Type-ANY case is
	* special as noted in respip_data_answer(). */
	if(qtype == LDNS_RR_TYPE_ANY)
	rrset_id = 0;
	new_rep = make_new_reply_info(rep, region, rrset_id, rrset_id);
	if(!new_rep)
	return 0;
	FLAGS_SET_RCODE(new_rep->flags, rcode);
	*new_repp = new_rep;
	return 1;
	}

	return 1;
	}

	/** Populate action info structure with the results of response-ip action
	* processing, iff as the result of response-ip processing we are actually
	* taking some action. Only action is set if action_only is true.
	* Returns true on success, false on failure.
	*/
	static int
	populate_action_info(struct respip_action_info* actinfo,
	enum respip_action action, const struct resp_addr* raddr,
	const struct ub_packed_rrset_key* ATTR_UNUSED(rrset),
	int ATTR_UNUSED(tag), const struct respip_set* ATTR_UNUSED(ipset),
	int ATTR_UNUSED(action_only), struct regional* region)
	{
	if(action == respip_none \|\| !raddr)
	return 1;
	actinfo->action = action;

	/* for inform variants, make a copy of the matched address block for
	* later logging. We make a copy to proactively avoid disruption if
	* and when we allow a dynamic update to the respip tree. */
	if(action == respip_inform \|\| action == respip_inform_deny) {
	struct respip_addr_info* a =
	regional_alloc_zero(region, sizeof(*a));
	if(!a) {
	log_err("out of memory");
	return 0;
	}
	a->addr = raddr->node.addr;
	a->addrlen = raddr->node.addrlen;
	a->net = raddr->node.net;
	actinfo->addrinfo = a;
	}

	return 1;
	}

	int
	respip_rewrite_reply(const struct query_info* qinfo,
	const struct respip_client_info* cinfo, const struct reply_info* rep,
	struct reply_info** new_repp, struct respip_action_info* actinfo,
	struct ub_packed_rrset_key** alias_rrset, int search_only,
	struct regional* region)
	{
	const uint8_t* ctaglist;
	size_t ctaglen;
	const uint8_t* tag_actions;
	size_t tag_actions_size;
	struct config_strlist** tag_datas;
	size_t tag_datas_size;
	struct view* view = NULL;
	struct respip_set* ipset = NULL;
	size_t rrset_id = 0;
	enum respip_action action = respip_none;
	int tag = -1;
	const struct resp_addr* raddr = NULL;
	int ret = 1;
	struct ub_packed_rrset_key* redirect_rrset = NULL;

	if(!cinfo)
	goto done;
	ctaglist = cinfo->taglist;
	ctaglen = cinfo->taglen;
	tag_actions = cinfo->tag_actions;
	tag_actions_size = cinfo->tag_actions_size;
	tag_datas = cinfo->tag_datas;
	tag_datas_size = cinfo->tag_datas_size;
	view = cinfo->view;
	ipset = cinfo->respip_set;

	/** Try to use response-ip config from the view first; use
	* global response-ip config if we don't have the view or we don't
	* have the matching per-view config (and the view allows the use
	* of global data in this case).
	* Note that we lock the view even if we only use view members that
	* currently don't change after creation. This is for safety for
	* future possible changes as the view documentation seems to expect
	* any of its member can change in the view's lifetime.
	* Note also that we assume 'view' is valid in this function, which
	* should be safe (see unbound bug #1191) */
	if(view) {
	lock_rw_rdlock(&view->lock);
	if(view->respip_set) {
	if((raddr = respip_addr_lookup(rep,
	&view->respip_set->ip_tree, &rrset_id))) {
	/** for per-view respip directives the action
	* can only be direct (i.e. not tag-based) */
	action = raddr->action;
	}
	}
	if(!raddr && !view->isfirst)
	goto done;
	}
	if(!raddr && ipset && (raddr = respip_addr_lookup(rep, &ipset->ip_tree,
	&rrset_id))) {
	action = (enum respip_action)local_data_find_tag_action(
	raddr->taglist, raddr->taglen, ctaglist, ctaglen,
	tag_actions, tag_actions_size,
	(enum localzone_type)raddr->action, &tag,
	ipset->tagname, ipset->num_tags);
	}
	if(raddr && !search_only) {
	int result = 0;

	/* first, see if we have response-ip or tag action for the
	* action except for 'always' variants. */
	if(action != respip_always_refuse
	&& action != respip_always_transparent
	&& action != respip_always_nxdomain
	&& (result = respip_data_answer(raddr, action,
	qinfo->qtype, rep, rrset_id, new_repp, tag, tag_datas,
	tag_datas_size, ipset->tagname, ipset->num_tags,
	&redirect_rrset, region)) < 0) {
	ret = 0;
	goto done;
	}

	/* if no action data applied, take action specific to the
	* action without data. */
	if(!result && !respip_nodata_answer(qinfo->qtype, action, rep,
	rrset_id, new_repp, region)) {
	ret = 0;
	goto done;
	}
	}
	done:
	if(view) {
	lock_rw_unlock(&view->lock);
	}
	if(ret) {
	/* If we're redirecting the original answer to a
	* CNAME, record the CNAME rrset so the caller can take
	* the appropriate action. Note that we don't check the
	* action type; it should normally be 'redirect', but it
	* can be of other type when a data-dependent tag action
	* uses redirect response-ip data.
	*/
	if(redirect_rrset &&
	redirect_rrset->rk.type == ntohs(LDNS_RR_TYPE_CNAME) &&
	qinfo->qtype != LDNS_RR_TYPE_ANY)
	*alias_rrset = redirect_rrset;
	/* on success, populate respip result structure */
	ret = populate_action_info(actinfo, action, raddr,
	redirect_rrset, tag, ipset, search_only, region);
	}
	return ret;
	}

	static int
	generate_cname_request(struct module_qstate* qstate,
	struct ub_packed_rrset_key* alias_rrset)
	{
	struct module_qstate* subq = NULL;
	struct query_info subqi;

	memset(&subqi, 0, sizeof(subqi));
	get_cname_target(alias_rrset, &subqi.qname, &subqi.qname_len);
	if(!subqi.qname)
	return 0; /* unexpected: not a valid CNAME RDATA */
	subqi.qtype = qstate->qinfo.qtype;
	subqi.qclass = qstate->qinfo.qclass;
	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
	return (*qstate->env->attach_sub)(qstate, &subqi, BIT_RD, 0, 0, &subq);
	}

	void
	respip_operate(struct module_qstate* qstate, enum module_ev event, int id,
	struct outbound_entry* outbound)
	{
	struct respip_qstate* rq = (struct respip_qstate*)qstate->minfo[id];

	log_query_info(VERB_QUERY, "respip operate: query", &qstate->qinfo);
	(void)outbound;

	if(event == module_event_new \|\| event == module_event_pass) {
	if(!rq) {
	rq = regional_alloc_zero(qstate->region, sizeof(*rq));
	if(!rq)
	goto servfail;
	rq->state = RESPIP_INIT;
	qstate->minfo[id] = rq;
	}
	if(rq->state == RESPIP_SUBQUERY_FINISHED) {
	qstate->ext_state[id] = module_finished;
	return;
	}
	verbose(VERB_ALGO, "respip: pass to next module");
	qstate->ext_state[id] = module_wait_module;
	} else if(event == module_event_moddone) {
	/* If the reply may be subject to response-ip rewriting
	* according to the query type, check the actions. If a
	* rewrite is necessary, we'll replace the reply in qstate
	* with the new one. */
	enum module_ext_state next_state = module_finished;

	if((qstate->qinfo.qtype == LDNS_RR_TYPE_A \|\|
	qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA \|\|
	qstate->qinfo.qtype == LDNS_RR_TYPE_ANY) &&
	qstate->return_msg && qstate->return_msg->rep) {
	struct respip_action_info actinfo = {respip_none, NULL};
	struct reply_info* new_rep = qstate->return_msg->rep;
	struct ub_packed_rrset_key* alias_rrset = NULL;

	if(!respip_rewrite_reply(&qstate->qinfo,
	qstate->client_info, qstate->return_msg->rep,
	&new_rep, &actinfo, &alias_rrset, 0,
	qstate->region)) {
	goto servfail;
	}
	if(actinfo.action != respip_none) {
	/* save action info for logging on a
	* per-front-end-query basis */
	if(!(qstate->respip_action_info =
	regional_alloc_init(qstate->region,
	&actinfo, sizeof(actinfo))))
	{
	log_err("out of memory");
	goto servfail;
	}
	} else {
	qstate->respip_action_info = NULL;
	}
	if (new_rep == qstate->return_msg->rep &&
	(actinfo.action == respip_deny \|\|
	actinfo.action == respip_inform_deny)) {
	/* for deny-variant actions (unless response-ip
	* data is applied), mark the query state so
	* the response will be dropped for all
	* clients. */
	qstate->is_drop = 1;
	} else if(alias_rrset) {
	if(!generate_cname_request(qstate, alias_rrset))
	goto servfail;
	next_state = module_wait_subquery;
	}
	qstate->return_msg->rep = new_rep;
	}
	qstate->ext_state[id] = next_state;
	} else
	qstate->ext_state[id] = module_finished;

	return;

	servfail:
	qstate->return_rcode = LDNS_RCODE_SERVFAIL;
	qstate->return_msg = NULL;
	}

	int
	respip_merge_cname(struct reply_info* base_rep,
	const struct query_info* qinfo, const struct reply_info* tgt_rep,
	const struct respip_client_info* cinfo, int must_validate,
	struct reply_info** new_repp, struct regional* region)
	{
	struct reply_info* new_rep;
	struct reply_info* tmp_rep = NULL; /* just a placeholder */
	struct ub_packed_rrset_key* alias_rrset = NULL; /* ditto */
	uint16_t tgt_rcode;
	size_t i, j;
	struct respip_action_info actinfo = {respip_none, NULL};

	/* If the query for the CNAME target would result in an unusual rcode,
	* we generally translate it as a failure for the base query
	* (which would then be translated into SERVFAIL). The only exception
	* is NXDOMAIN and YXDOMAIN, which are passed to the end client(s).
	* The YXDOMAIN case would be rare but still possible (when
	* DNSSEC-validated DNAME has been cached but synthesizing CNAME
	* can't be generated due to length limitation) */
	tgt_rcode = FLAGS_GET_RCODE(tgt_rep->flags);
	if((tgt_rcode != LDNS_RCODE_NOERROR &&
	tgt_rcode != LDNS_RCODE_NXDOMAIN &&
	tgt_rcode != LDNS_RCODE_YXDOMAIN) \|\|
	(must_validate && tgt_rep->security <= sec_status_bogus)) {
	return 0;
	}

	/* see if the target reply would be subject to a response-ip action. */
	if(!respip_rewrite_reply(qinfo, cinfo, tgt_rep, &tmp_rep, &actinfo,
	&alias_rrset, 1, region))
	return 0;
	if(actinfo.action != respip_none) {
	log_info("CNAME target of redirect response-ip action would "
	"be subject to response-ip action, too; stripped");
	*new_repp = base_rep;
	return 1;
	}

	/* Append target reply to the base. Since we cannot assume
	* tgt_rep->rrsets is valid throughout the lifetime of new_rep
	* or it can be safely shared by multiple threads, we need to make a
	* deep copy. */
	new_rep = make_new_reply_info(base_rep, region,
	base_rep->an_numrrsets + tgt_rep->an_numrrsets,
	base_rep->an_numrrsets);
	if(!new_rep)
	return 0;
	for(i=0,j=base_rep->an_numrrsets; i<tgt_rep->an_numrrsets; i++,j++) {
	new_rep->rrsets[j] = copy_rrset(tgt_rep->rrsets[i], region);
	if(!new_rep->rrsets[j])
	return 0;
	}

	FLAGS_SET_RCODE(new_rep->flags, tgt_rcode);
	*new_repp = new_rep;
	return 1;
	}

	void
	respip_inform_super(struct module_qstate* qstate, int id,
	struct module_qstate* super)
	{
	struct respip_qstate* rq = (struct respip_qstate*)super->minfo[id];
	struct reply_info* new_rep = NULL;

	rq->state = RESPIP_SUBQUERY_FINISHED;

	/* respip subquery should have always been created with a valid reply
	* in super. */
	log_assert(super->return_msg && super->return_msg->rep);

	/* return_msg can be NULL when, e.g., the sub query resulted in
	* SERVFAIL, in which case we regard it as a failure of the original
	* query. Other checks are probably redundant, but we check them
	* for safety. */
	if(!qstate->return_msg \|\| !qstate->return_msg->rep \|\|
	qstate->return_rcode != LDNS_RCODE_NOERROR)
	goto fail;

	if(!respip_merge_cname(super->return_msg->rep, &qstate->qinfo,
	qstate->return_msg->rep, super->client_info,
	super->env->need_to_validate, &new_rep, super->region))
	goto fail;
	super->return_msg->rep = new_rep;
	return;

	fail:
	super->return_rcode = LDNS_RCODE_SERVFAIL;
	super->return_msg = NULL;
	return;
	}

	void
	respip_clear(struct module_qstate* qstate, int id)
	{
	qstate->minfo[id] = NULL;
	}

	size_t
	respip_get_mem(struct module_env* env, int id)
	{
	(void)env;
	(void)id;
	return 0;
	}

	/**
	* The response-ip function block
	*/
	static struct module_func_block respip_block = {
	"respip",
	&respip_init, &respip_deinit, &respip_operate, &respip_inform_super,
	&respip_clear, &respip_get_mem
	};

	struct module_func_block*
	respip_get_funcblock(void)
	{
	return &respip_block;
	}

	enum respip_action
	resp_addr_get_action(const struct resp_addr* addr)
	{
	return addr ? addr->action : respip_none;
	}

	struct ub_packed_rrset_key*
	resp_addr_get_rrset(struct resp_addr* addr)
	{
	return addr ? addr->data : NULL;
	}

	int
	respip_set_is_empty(const struct respip_set* set)
	{
	return set ? set->ip_tree.count == 0 : 1;
	}

	void
	respip_inform_print(struct respip_addr_info* respip_addr, uint8_t* qname,
	uint16_t qtype, uint16_t qclass, struct local_rrset* local_alias,
	struct comm_reply* repinfo)
	{
	char srcip[128], respip[128], txt[512];
	unsigned port;

	if(local_alias)
	qname = local_alias->rrset->rk.dname;
	port = (unsigned)((repinfo->addr.ss_family == AF_INET) ?
	ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port) :
	ntohs(((struct sockaddr_in6*)&repinfo->addr)->sin6_port));
	addr_to_str(&repinfo->addr, repinfo->addrlen, srcip, sizeof(srcip));
	addr_to_str(&respip_addr->addr, respip_addr->addrlen,
	respip, sizeof(respip));
	snprintf(txt, sizeof(txt), "%s/%d inform %s@%u", respip,
	respip_addr->net, srcip, port);
	log_nametypeclass(0, txt, qname, qtype, qclass);
	}
	Index: head/contrib/unbound/services/authzone.c
	===================================================================
	--- head/contrib/unbound/services/authzone.c (revision 349719)
	+++ head/contrib/unbound/services/authzone.c (revision 349720)
	@@ -1,6616 +1,6891 @@
	/*
	* services/authzone.c - authoritative zone that is locally hosted.
	*
	* Copyright (c) 2017, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains the functions for an authority zone. This zone
	* is queried by the iterator, just like a stub or forward zone, but then
	* the data is locally held.
	*/

	#include "config.h"
	#include "services/authzone.h"
	#include "util/data/dname.h"
	#include "util/data/msgparse.h"
	#include "util/data/msgreply.h"
	#include "util/data/msgencode.h"
	#include "util/data/packed_rrset.h"
	#include "util/regional.h"
	#include "util/net_help.h"
	#include "util/netevent.h"
	#include "util/config_file.h"
	#include "util/log.h"
	#include "util/module.h"
	#include "util/random.h"
	#include "services/cache/dns.h"
	#include "services/outside_network.h"
	#include "services/listen_dnsport.h"
	#include "services/mesh.h"
	#include "sldns/rrdef.h"
	#include "sldns/pkthdr.h"
	#include "sldns/sbuffer.h"
	#include "sldns/str2wire.h"
	#include "sldns/wire2str.h"
	#include "sldns/parseutil.h"
	#include "sldns/keyraw.h"
	#include "validator/val_nsec3.h"
	#include "validator/val_secalgo.h"
	#include <ctype.h>

	/** bytes to use for NSEC3 hash buffer. 20 for sha1 */
	#define N3HASHBUFLEN 32
	/** max number of CNAMEs we are willing to follow (in one answer) */
	#define MAX_CNAME_CHAIN 8
	/** timeout for probe packets for SOA */
	#define AUTH_PROBE_TIMEOUT 100 /* msec */
	/** when to stop with SOA probes (when exponential timeouts exceed this) */
	#define AUTH_PROBE_TIMEOUT_STOP 1000 /* msec */
	/* auth transfer timeout for TCP connections, in msec */
	#define AUTH_TRANSFER_TIMEOUT 10000 /* msec */
	/* auth transfer max backoff for failed tranfers and probes */
	#define AUTH_TRANSFER_MAX_BACKOFF 86400 /* sec */
	/* auth http port number */
	#define AUTH_HTTP_PORT 80
	/* auth https port number */
	#define AUTH_HTTPS_PORT 443
	/* max depth for nested $INCLUDEs */
	#define MAX_INCLUDE_DEPTH 10
	+/** number of timeouts before we fallback from IXFR to AXFR,
	+ * because some versions of servers (eg. dnsmasq) drop IXFR packets. */
	+#define NUM_TIMEOUTS_FALLBACK_IXFR 3

	/** pick up nextprobe task to start waiting to perform transfer actions */
	static void xfr_set_timeout(struct auth_xfer* xfr, struct module_env* env,
	int failure, int lookup_only);
	/** move to sending the probe packets, next if fails. task_probe */
	static void xfr_probe_send_or_end(struct auth_xfer* xfr,
	struct module_env* env);
	/** pick up probe task with specified(or NULL) destination first,
	* or transfer task if nothing to probe, or false if already in progress */
	static int xfr_start_probe(struct auth_xfer* xfr, struct module_env* env,
	struct auth_master* spec);
	/** delete xfer structure (not its tree entry) */
	static void auth_xfer_delete(struct auth_xfer* xfr);

	/** create new dns_msg */
	static struct dns_msg*
	msg_create(struct regional* region, struct query_info* qinfo)
	{
	struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
	sizeof(struct dns_msg));
	if(!msg)
	return NULL;
	msg->qinfo.qname = regional_alloc_init(region, qinfo->qname,
	qinfo->qname_len);
	if(!msg->qinfo.qname)
	return NULL;
	msg->qinfo.qname_len = qinfo->qname_len;
	msg->qinfo.qtype = qinfo->qtype;
	msg->qinfo.qclass = qinfo->qclass;
	msg->qinfo.local_alias = NULL;
	/* non-packed reply_info, because it needs to grow the array */
	msg->rep = (struct reply_info*)regional_alloc_zero(region,
	sizeof(struct reply_info)-sizeof(struct rrset_ref));
	if(!msg->rep)
	return NULL;
	msg->rep->flags = (uint16_t)(BIT_QR \| BIT_AA);
	msg->rep->authoritative = 1;
	msg->rep->qdcount = 1;
	/* rrsets is NULL, no rrsets yet */
	return msg;
	}

	/** grow rrset array by one in msg */
	static int
	msg_grow_array(struct regional* region, struct dns_msg* msg)
	{
	if(msg->rep->rrsets == NULL) {
	msg->rep->rrsets = regional_alloc_zero(region,
	sizeof(struct ub_packed_rrset_key)(msg->rep->rrset_count+1));
	if(!msg->rep->rrsets)
	return 0;
	} else {
	struct ub_packed_rrset_key** rrsets_old = msg->rep->rrsets;
	msg->rep->rrsets = regional_alloc_zero(region,
	sizeof(struct ub_packed_rrset_key)(msg->rep->rrset_count+1));
	if(!msg->rep->rrsets)
	return 0;
	memmove(msg->rep->rrsets, rrsets_old,
	sizeof(struct ub_packed_rrset_key)msg->rep->rrset_count);
	}
	return 1;
	}

	/** get ttl of rrset */
	static time_t
	get_rrset_ttl(struct ub_packed_rrset_key* k)
	{
	struct packed_rrset_data* d = (struct packed_rrset_data*)
	k->entry.data;
	return d->ttl;
	}

	/** Copy rrset into region from domain-datanode and packet rrset */
	static struct ub_packed_rrset_key*
	auth_packed_rrset_copy_region(struct auth_zone* z, struct auth_data* node,
	struct auth_rrset* rrset, struct regional* region, time_t adjust)
	{
	struct ub_packed_rrset_key key;
	memset(&key, 0, sizeof(key));
	key.entry.key = &key;
	key.entry.data = rrset->data;
	key.rk.dname = node->name;
	key.rk.dname_len = node->namelen;
	key.rk.type = htons(rrset->type);
	key.rk.rrset_class = htons(z->dclass);
	key.entry.hash = rrset_key_hash(&key.rk);
	return packed_rrset_copy_region(&key, region, adjust);
	}

	/** fix up msg->rep TTL and prefetch ttl */
	static void
	msg_ttl(struct dns_msg* msg)
	{
	if(msg->rep->rrset_count == 0) return;
	if(msg->rep->rrset_count == 1) {
	msg->rep->ttl = get_rrset_ttl(msg->rep->rrsets[0]);
	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
	} else if(get_rrset_ttl(msg->rep->rrsets[msg->rep->rrset_count-1]) <
	msg->rep->ttl) {
	msg->rep->ttl = get_rrset_ttl(msg->rep->rrsets[
	msg->rep->rrset_count-1]);
	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
	}
	}

	/** see if rrset is a duplicate in the answer message */
	static int
	msg_rrset_duplicate(struct dns_msg* msg, uint8_t* nm, size_t nmlen,
	uint16_t type, uint16_t dclass)
	{
	size_t i;
	for(i=0; i<msg->rep->rrset_count; i++) {
	struct ub_packed_rrset_key* k = msg->rep->rrsets[i];
	if(ntohs(k->rk.type) == type && k->rk.dname_len == nmlen &&
	ntohs(k->rk.rrset_class) == dclass &&
	query_dname_compare(k->rk.dname, nm) == 0)
	return 1;
	}
	return 0;
	}

	/** add rrset to answer section (no auth, add rrsets yet) */
	static int
	msg_add_rrset_an(struct auth_zone* z, struct regional* region,
	struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset)
	{
	log_assert(msg->rep->ns_numrrsets == 0);
	log_assert(msg->rep->ar_numrrsets == 0);
	if(!rrset \|\| !node)
	return 1;
	if(msg_rrset_duplicate(msg, node->name, node->namelen, rrset->type,
	z->dclass))
	return 1;
	/* grow array */
	if(!msg_grow_array(region, msg))
	return 0;
	/* copy it */
	if(!(msg->rep->rrsets[msg->rep->rrset_count] =
	auth_packed_rrset_copy_region(z, node, rrset, region, 0)))
	return 0;
	msg->rep->rrset_count++;
	msg->rep->an_numrrsets++;
	msg_ttl(msg);
	return 1;
	}

	/** add rrset to authority section (no additonal section rrsets yet) */
	static int
	msg_add_rrset_ns(struct auth_zone* z, struct regional* region,
	struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset)
	{
	log_assert(msg->rep->ar_numrrsets == 0);
	if(!rrset \|\| !node)
	return 1;
	if(msg_rrset_duplicate(msg, node->name, node->namelen, rrset->type,
	z->dclass))
	return 1;
	/* grow array */
	if(!msg_grow_array(region, msg))
	return 0;
	/* copy it */
	if(!(msg->rep->rrsets[msg->rep->rrset_count] =
	auth_packed_rrset_copy_region(z, node, rrset, region, 0)))
	return 0;
	msg->rep->rrset_count++;
	msg->rep->ns_numrrsets++;
	msg_ttl(msg);
	return 1;
	}

	/** add rrset to additional section */
	static int
	msg_add_rrset_ar(struct auth_zone* z, struct regional* region,
	struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset)
	{
	if(!rrset \|\| !node)
	return 1;
	if(msg_rrset_duplicate(msg, node->name, node->namelen, rrset->type,
	z->dclass))
	return 1;
	/* grow array */
	if(!msg_grow_array(region, msg))
	return 0;
	/* copy it */
	if(!(msg->rep->rrsets[msg->rep->rrset_count] =
	auth_packed_rrset_copy_region(z, node, rrset, region, 0)))
	return 0;
	msg->rep->rrset_count++;
	msg->rep->ar_numrrsets++;
	msg_ttl(msg);
	return 1;
	}

	struct auth_zones* auth_zones_create(void)
	{
	struct auth_zones* az = (struct auth_zones)calloc(1, sizeof(az));
	if(!az) {
	log_err("out of memory");
	return NULL;
	}
	rbtree_init(&az->ztree, &auth_zone_cmp);
	rbtree_init(&az->xtree, &auth_xfer_cmp);
	lock_rw_init(&az->lock);
	lock_protect(&az->lock, &az->ztree, sizeof(az->ztree));
	lock_protect(&az->lock, &az->xtree, sizeof(az->xtree));
	/* also lock protects the rbnode's in struct auth_zone, auth_xfer */
	return az;
	}

	int auth_zone_cmp(const void* z1, const void* z2)
	{
	/* first sort on class, so that hierarchy can be maintained within
	* a class */
	struct auth_zone* a = (struct auth_zone*)z1;
	struct auth_zone* b = (struct auth_zone*)z2;
	int m;
	if(a->dclass != b->dclass) {
	if(a->dclass < b->dclass)
	return -1;
	return 1;
	}
	/* sorted such that higher zones sort before lower zones (their
	* contents) */
	return dname_lab_cmp(a->name, a->namelabs, b->name, b->namelabs, &m);
	}

	int auth_data_cmp(const void* z1, const void* z2)
	{
	struct auth_data* a = (struct auth_data*)z1;
	struct auth_data* b = (struct auth_data*)z2;
	int m;
	/* canonical sort, because DNSSEC needs that */
	return dname_canon_lab_cmp(a->name, a->namelabs, b->name,
	b->namelabs, &m);
	}

	int auth_xfer_cmp(const void* z1, const void* z2)
	{
	/* first sort on class, so that hierarchy can be maintained within
	* a class */
	struct auth_xfer* a = (struct auth_xfer*)z1;
	struct auth_xfer* b = (struct auth_xfer*)z2;
	int m;
	if(a->dclass != b->dclass) {
	if(a->dclass < b->dclass)
	return -1;
	return 1;
	}
	/* sorted such that higher zones sort before lower zones (their
	* contents) */
	return dname_lab_cmp(a->name, a->namelabs, b->name, b->namelabs, &m);
	}

	/** delete auth rrset node */
	static void
	auth_rrset_delete(struct auth_rrset* rrset)
	{
	if(!rrset) return;
	free(rrset->data);
	free(rrset);
	}

	/** delete auth data domain node */
	static void
	auth_data_delete(struct auth_data* n)
	{
	struct auth_rrset* p, *np;
	if(!n) return;
	p = n->rrsets;
	while(p) {
	np = p->next;
	auth_rrset_delete(p);
	p = np;
	}
	free(n->name);
	free(n);
	}

	/** helper traverse to delete zones */
	static void
	auth_data_del(rbnode_type* n, void* ATTR_UNUSED(arg))
	{
	struct auth_data* z = (struct auth_data*)n->key;
	auth_data_delete(z);
	}

	/** delete an auth zone structure (tree remove must be done elsewhere) */
	static void
	auth_zone_delete(struct auth_zone* z)
	{
	if(!z) return;
	lock_rw_destroy(&z->lock);
	traverse_postorder(&z->data, auth_data_del, NULL);
	free(z->name);
	free(z->zonefile);
	free(z);
	}

	struct auth_zone*
	auth_zone_create(struct auth_zones* az, uint8_t* nm, size_t nmlen,
	uint16_t dclass)
	{
	struct auth_zone* z = (struct auth_zone)calloc(1, sizeof(z));
	if(!z) {
	return NULL;
	}
	z->node.key = z;
	z->dclass = dclass;
	z->namelen = nmlen;
	z->namelabs = dname_count_labels(nm);
	z->name = memdup(nm, nmlen);
	if(!z->name) {
	free(z);
	return NULL;
	}
	rbtree_init(&z->data, &auth_data_cmp);
	lock_rw_init(&z->lock);
	lock_protect(&z->lock, &z->name, sizeof(*z)-sizeof(rbnode_type));
	lock_rw_wrlock(&z->lock);
	/* z lock protects all, except rbtree itself, which is az->lock */
	if(!rbtree_insert(&az->ztree, &z->node)) {
	lock_rw_unlock(&z->lock);
	auth_zone_delete(z);
	log_warn("duplicate auth zone");
	return NULL;
	}
	return z;
	}

	struct auth_zone*
	auth_zone_find(struct auth_zones* az, uint8_t* nm, size_t nmlen,
	uint16_t dclass)
	{
	struct auth_zone key;
	key.node.key = &key;
	key.dclass = dclass;
	key.name = nm;
	key.namelen = nmlen;
	key.namelabs = dname_count_labels(nm);
	return (struct auth_zone*)rbtree_search(&az->ztree, &key);
	}

	struct auth_xfer*
	auth_xfer_find(struct auth_zones* az, uint8_t* nm, size_t nmlen,
	uint16_t dclass)
	{
	struct auth_xfer key;
	key.node.key = &key;
	key.dclass = dclass;
	key.name = nm;
	key.namelen = nmlen;
	key.namelabs = dname_count_labels(nm);
	return (struct auth_xfer*)rbtree_search(&az->xtree, &key);
	}

	/** find an auth zone or sorted less-or-equal, return true if exact */
	static int
	auth_zone_find_less_equal(struct auth_zones* az, uint8_t* nm, size_t nmlen,
	uint16_t dclass, struct auth_zone** z)
	{
	struct auth_zone key;
	key.node.key = &key;
	key.dclass = dclass;
	key.name = nm;
	key.namelen = nmlen;
	key.namelabs = dname_count_labels(nm);
	return rbtree_find_less_equal(&az->ztree, &key, (rbnode_type**)z);
	}


	/** find the auth zone that is above the given name */
	struct auth_zone*
	auth_zones_find_zone(struct auth_zones* az, uint8_t* name, size_t name_len,
	uint16_t dclass)
	{
	uint8_t* nm = name;
	size_t nmlen = name_len;
	struct auth_zone* z;
	if(auth_zone_find_less_equal(az, nm, nmlen, dclass, &z)) {
	/* exact match */
	return z;
	} else {
	/* less-or-nothing */
	if(!z) return NULL; /* nothing smaller, nothing above it */
	/* we found smaller name; smaller may be above the name,
	* but not below it. */
	nm = dname_get_shared_topdomain(z->name, name);
	dname_count_size_labels(nm, &nmlen);
	z = NULL;
	}

	/* search up */
	while(!z) {
	z = auth_zone_find(az, nm, nmlen, dclass);
	if(z) return z;
	if(dname_is_root(nm)) break;
	dname_remove_label(&nm, &nmlen);
	}
	return NULL;
	}

	/** find or create zone with name str. caller must have lock on az.
	* returns a wrlocked zone */
	static struct auth_zone*
	auth_zones_find_or_add_zone(struct auth_zones* az, char* name)
	{
	uint8_t nm[LDNS_MAX_DOMAINLEN+1];
	size_t nmlen = sizeof(nm);
	struct auth_zone* z;

	if(sldns_str2wire_dname_buf(name, nm, &nmlen) != 0) {
	log_err("cannot parse auth zone name: %s", name);
	return 0;
	}
	z = auth_zone_find(az, nm, nmlen, LDNS_RR_CLASS_IN);
	if(!z) {
	/* not found, create the zone */
	z = auth_zone_create(az, nm, nmlen, LDNS_RR_CLASS_IN);
	} else {
	lock_rw_wrlock(&z->lock);
	}
	return z;
	}

	/** find or create xfer zone with name str. caller must have lock on az.
	* returns a locked xfer */
	static struct auth_xfer*
	auth_zones_find_or_add_xfer(struct auth_zones* az, struct auth_zone* z)
	{
	struct auth_xfer* x;
	x = auth_xfer_find(az, z->name, z->namelen, z->dclass);
	if(!x) {
	/* not found, create the zone */
	x = auth_xfer_create(az, z);
	} else {
	lock_basic_lock(&x->lock);
	}
	return x;
	}

	int
	auth_zone_set_zonefile(struct auth_zone* z, char* zonefile)
	{
	if(z->zonefile) free(z->zonefile);
	if(zonefile == NULL) {
	z->zonefile = NULL;
	} else {
	z->zonefile = strdup(zonefile);
	if(!z->zonefile) {
	log_err("malloc failure");
	return 0;
	}
	}
	return 1;
	}

	/** set auth zone fallback. caller must have lock on zone */
	int
	auth_zone_set_fallback(struct auth_zone* z, char* fallbackstr)
	{
	if(strcmp(fallbackstr, "yes") != 0 && strcmp(fallbackstr, "no") != 0){
	log_err("auth zone fallback, expected yes or no, got %s",
	fallbackstr);
	return 0;
	}
	z->fallback_enabled = (strcmp(fallbackstr, "yes")==0);
	return 1;
	}

	/** create domain with the given name */
	static struct auth_data*
	az_domain_create(struct auth_zone* z, uint8_t* nm, size_t nmlen)
	{
	struct auth_data* n = (struct auth_data)malloc(sizeof(n));
	if(!n) return NULL;
	memset(n, 0, sizeof(*n));
	n->node.key = n;
	n->name = memdup(nm, nmlen);
	if(!n->name) {
	free(n);
	return NULL;
	}
	n->namelen = nmlen;
	n->namelabs = dname_count_labels(nm);
	if(!rbtree_insert(&z->data, &n->node)) {
	log_warn("duplicate auth domain name");
	free(n->name);
	free(n);
	return NULL;
	}
	return n;
	}

	/** find domain with exactly the given name */
	static struct auth_data*
	az_find_name(struct auth_zone* z, uint8_t* nm, size_t nmlen)
	{
	struct auth_zone key;
	key.node.key = &key;
	key.name = nm;
	key.namelen = nmlen;
	key.namelabs = dname_count_labels(nm);
	return (struct auth_data*)rbtree_search(&z->data, &key);
	}

	/** Find domain name (or closest match) */
	static void
	az_find_domain(struct auth_zone* z, struct query_info* qinfo, int* node_exact,
	struct auth_data** node)
	{
	struct auth_zone key;
	key.node.key = &key;
	key.name = qinfo->qname;
	key.namelen = qinfo->qname_len;
	key.namelabs = dname_count_labels(key.name);
	*node_exact = rbtree_find_less_equal(&z->data, &key,
	(rbnode_type**)node);
	}

	/** find or create domain with name in zone */
	static struct auth_data*
	az_domain_find_or_create(struct auth_zone* z, uint8_t* dname,
	size_t dname_len)
	{
	struct auth_data* n = az_find_name(z, dname, dname_len);
	if(!n) {
	n = az_domain_create(z, dname, dname_len);
	}
	return n;
	}

	/** find rrset of given type in the domain */
	static struct auth_rrset*
	az_domain_rrset(struct auth_data* n, uint16_t t)
	{
	struct auth_rrset* rrset;
	if(!n) return NULL;
	rrset = n->rrsets;
	while(rrset) {
	if(rrset->type == t)
	return rrset;
	rrset = rrset->next;
	}
	return NULL;
	}

	/** remove rrset of this type from domain */
	static void
	domain_remove_rrset(struct auth_data* node, uint16_t rr_type)
	{
	struct auth_rrset* rrset, *prev;
	if(!node) return;
	prev = NULL;
	rrset = node->rrsets;
	while(rrset) {
	if(rrset->type == rr_type) {
	/* found it, now delete it */
	if(prev) prev->next = rrset->next;
	else node->rrsets = rrset->next;
	auth_rrset_delete(rrset);
	return;
	}
	prev = rrset;
	rrset = rrset->next;
	}
	}

	/** find an rr index in the rrset. returns true if found */
	static int
	az_rrset_find_rr(struct packed_rrset_data* d, uint8_t* rdata, size_t len,
	size_t* index)
	{
	size_t i;
	for(i=0; i<d->count; i++) {
	if(d->rr_len[i] != len)
	continue;
	if(memcmp(d->rr_data[i], rdata, len) == 0) {
	*index = i;
	return 1;
	}
	}
	return 0;
	}

	/** find an rrsig index in the rrset. returns true if found */
	static int
	az_rrset_find_rrsig(struct packed_rrset_data* d, uint8_t* rdata, size_t len,
	size_t* index)
	{
	size_t i;
	for(i=d->count; i<d->count + d->rrsig_count; i++) {
	if(d->rr_len[i] != len)
	continue;
	if(memcmp(d->rr_data[i], rdata, len) == 0) {
	*index = i;
	return 1;
	}
	}
	return 0;
	}

	/** see if rdata is duplicate */
	static int
	rdata_duplicate(struct packed_rrset_data* d, uint8_t* rdata, size_t len)
	{
	size_t i;
	for(i=0; i<d->count + d->rrsig_count; i++) {
	if(d->rr_len[i] != len)
	continue;
	if(memcmp(d->rr_data[i], rdata, len) == 0)
	return 1;
	}
	return 0;
	}

	/** get rrsig type covered from rdata.
	* @param rdata: rdata in wireformat, starting with 16bit rdlength.
	* @param rdatalen: length of rdata buffer.
	* @return type covered (or 0).
	*/
	static uint16_t
	rrsig_rdata_get_type_covered(uint8_t* rdata, size_t rdatalen)
	{
	if(rdatalen < 4)
	return 0;
	return sldns_read_uint16(rdata+2);
	}

	/** remove RR from existing RRset. Also sig, if it is a signature.
	* reallocates the packed rrset for a new one, false on alloc failure */
	static int
	rrset_remove_rr(struct auth_rrset* rrset, size_t index)
	{
	struct packed_rrset_data* d, *old = rrset->data;
	size_t i;
	if(index >= old->count + old->rrsig_count)
	return 0; /* index out of bounds */
	d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old) - (
	sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t) +
	old->rr_len[index]));
	if(!d) {
	log_err("malloc failure");
	return 0;
	}
	d->ttl = old->ttl;
	d->count = old->count;
	d->rrsig_count = old->rrsig_count;
	if(index < d->count) d->count--;
	else d->rrsig_count--;
	d->trust = old->trust;
	d->security = old->security;

	/* set rr_len, needed for ptr_fixup */
	d->rr_len = (size_t)((uint8_t)d +
	sizeof(struct packed_rrset_data));
	if(index > 0)
	memmove(d->rr_len, old->rr_len, (index)*sizeof(size_t));
	if(index+1 < old->count+old->rrsig_count)
	memmove(&d->rr_len[index], &old->rr_len[index+1],
	(old->count+old->rrsig_count - (index+1))*sizeof(size_t));
	packed_rrset_ptr_fixup(d);

	/* move over ttls */
	if(index > 0)
	memmove(d->rr_ttl, old->rr_ttl, (index)*sizeof(time_t));
	if(index+1 < old->count+old->rrsig_count)
	memmove(&d->rr_ttl[index], &old->rr_ttl[index+1],
	(old->count+old->rrsig_count - (index+1))*sizeof(time_t));

	/* move over rr_data */
	for(i=0; i<d->count+d->rrsig_count; i++) {
	size_t oldi;
	if(i < index) oldi = i;
	else oldi = i+1;
	memmove(d->rr_data[i], old->rr_data[oldi], d->rr_len[i]);
	}

	/* recalc ttl (lowest of remaining RR ttls) */
	if(d->count + d->rrsig_count > 0)
	d->ttl = d->rr_ttl[0];
	for(i=0; i<d->count+d->rrsig_count; i++) {
	if(d->rr_ttl[i] < d->ttl)
	d->ttl = d->rr_ttl[i];
	}

	free(rrset->data);
	rrset->data = d;
	return 1;
	}

	/** add RR to existing RRset. If insert_sig is true, add to rrsigs.
	* This reallocates the packed rrset for a new one */
	static int
	rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
	size_t rdatalen, int insert_sig)
	{
	struct packed_rrset_data* d, *old = rrset->data;
	size_t total, old_total;

	d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old)
	+ sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t)
	+ rdatalen);
	if(!d) {
	log_err("out of memory");
	return 0;
	}
	/* copy base values */
	memcpy(d, old, sizeof(struct packed_rrset_data));
	if(!insert_sig) {
	d->count++;
	} else {
	d->rrsig_count++;
	}
	old_total = old->count + old->rrsig_count;
	total = d->count + d->rrsig_count;
	/* set rr_len, needed for ptr_fixup */
	d->rr_len = (size_t)((uint8_t)d +
	sizeof(struct packed_rrset_data));
	if(old->count != 0)
	memmove(d->rr_len, old->rr_len, old->count*sizeof(size_t));
	if(old->rrsig_count != 0)
	memmove(d->rr_len+d->count, old->rr_len+old->count,
	old->rrsig_count*sizeof(size_t));
	if(!insert_sig)
	d->rr_len[d->count-1] = rdatalen;
	else d->rr_len[total-1] = rdatalen;
	packed_rrset_ptr_fixup(d);
	if((time_t)rr_ttl < d->ttl)
	d->ttl = rr_ttl;

	/* copy old values into new array */
	if(old->count != 0) {
	memmove(d->rr_ttl, old->rr_ttl, old->count*sizeof(time_t));
	/* all the old rr pieces are allocated sequential, so we
	* can copy them in one go */
	memmove(d->rr_data[0], old->rr_data[0],
	(old->rr_data[old->count-1] - old->rr_data[0]) +
	old->rr_len[old->count-1]);
	}
	if(old->rrsig_count != 0) {
	memmove(d->rr_ttl+d->count, old->rr_ttl+old->count,
	old->rrsig_count*sizeof(time_t));
	memmove(d->rr_data[d->count], old->rr_data[old->count],
	(old->rr_data[old_total-1] - old->rr_data[old->count]) +
	old->rr_len[old_total-1]);
	}

	/* insert new value */
	if(!insert_sig) {
	d->rr_ttl[d->count-1] = rr_ttl;
	memmove(d->rr_data[d->count-1], rdata, rdatalen);
	} else {
	d->rr_ttl[total-1] = rr_ttl;
	memmove(d->rr_data[total-1], rdata, rdatalen);
	}

	rrset->data = d;
	free(old);
	return 1;
	}

	/** Create new rrset for node with packed rrset with one RR element */
	static struct auth_rrset*
	rrset_create(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
	uint8_t* rdata, size_t rdatalen)
	{
	struct auth_rrset* rrset = (struct auth_rrset*)calloc(1,
	sizeof(*rrset));
	struct auth_rrset* p, *prev;
	struct packed_rrset_data* d;
	if(!rrset) {
	log_err("out of memory");
	return NULL;
	}
	rrset->type = rr_type;

	/* the rrset data structure, with one RR */
	d = (struct packed_rrset_data*)calloc(1,
	sizeof(struct packed_rrset_data) + sizeof(size_t) +
	sizeof(uint8_t*) + sizeof(time_t) + rdatalen);
	if(!d) {
	free(rrset);
	log_err("out of memory");
	return NULL;
	}
	rrset->data = d;
	d->ttl = rr_ttl;
	d->trust = rrset_trust_prim_noglue;
	d->rr_len = (size_t)((uint8_t)d + sizeof(struct packed_rrset_data));
	d->rr_data = (uint8_t**)&(d->rr_len[1]);
	d->rr_ttl = (time_t*)&(d->rr_data[1]);
	d->rr_data[0] = (uint8_t*)&(d->rr_ttl[1]);

	/* insert the RR */
	d->rr_len[0] = rdatalen;
	d->rr_ttl[0] = rr_ttl;
	memmove(d->rr_data[0], rdata, rdatalen);
	d->count++;

	/* insert rrset into linked list for domain */
	/* find sorted place to link the rrset into the list */
	prev = NULL;
	p = node->rrsets;
	while(p && p->type<=rr_type) {
	prev = p;
	p = p->next;
	}
	/* so, prev is smaller, and p is larger than rr_type */
	rrset->next = p;
	if(prev) prev->next = rrset;
	else node->rrsets = rrset;
	return rrset;
	}

	/** count number (and size) of rrsigs that cover a type */
	static size_t
	rrsig_num_that_cover(struct auth_rrset* rrsig, uint16_t rr_type, size_t* sigsz)
	{
	struct packed_rrset_data* d = rrsig->data;
	size_t i, num = 0;
	*sigsz = 0;
	log_assert(d && rrsig->type == LDNS_RR_TYPE_RRSIG);
	for(i=0; i<d->count+d->rrsig_count; i++) {
	if(rrsig_rdata_get_type_covered(d->rr_data[i],
	d->rr_len[i]) == rr_type) {
	num++;
	(*sigsz) += d->rr_len[i];
	}
	}
	return num;
	}

	/** See if rrsig set has covered sigs for rrset and move them over */
	static int
	rrset_moveover_rrsigs(struct auth_data* node, uint16_t rr_type,
	struct auth_rrset* rrset, struct auth_rrset* rrsig)
	{
	size_t sigs, sigsz, i, j, total;
	struct packed_rrset_data* sigold = rrsig->data;
	struct packed_rrset_data* old = rrset->data;
	struct packed_rrset_data* d, *sigd;

	log_assert(rrset->type == rr_type);
	log_assert(rrsig->type == LDNS_RR_TYPE_RRSIG);
	sigs = rrsig_num_that_cover(rrsig, rr_type, &sigsz);
	if(sigs == 0) {
	/* 0 rrsigs to move over, done */
	return 1;
	}

	/* allocate rrset sigsz larger for extra sigs elements, and
	* allocate rrsig sigsz smaller for less sigs elements. */
	d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old)
	+ sigs(sizeof(size_t) + sizeof(uint8_t) + sizeof(time_t))
	+ sigsz);
	if(!d) {
	log_err("out of memory");
	return 0;
	}
	/* copy base values */
	total = old->count + old->rrsig_count;
	memcpy(d, old, sizeof(struct packed_rrset_data));
	d->rrsig_count += sigs;
	/* setup rr_len */
	d->rr_len = (size_t)((uint8_t)d +
	sizeof(struct packed_rrset_data));
	if(total != 0)
	memmove(d->rr_len, old->rr_len, total*sizeof(size_t));
	j = d->count+d->rrsig_count-sigs;
	for(i=0; i<sigold->count+sigold->rrsig_count; i++) {
	if(rrsig_rdata_get_type_covered(sigold->rr_data[i],
	sigold->rr_len[i]) == rr_type) {
	d->rr_len[j] = sigold->rr_len[i];
	j++;
	}
	}
	packed_rrset_ptr_fixup(d);

	/* copy old values into new array */
	if(total != 0) {
	memmove(d->rr_ttl, old->rr_ttl, total*sizeof(time_t));
	/* all the old rr pieces are allocated sequential, so we
	* can copy them in one go */
	memmove(d->rr_data[0], old->rr_data[0],
	(old->rr_data[total-1] - old->rr_data[0]) +
	old->rr_len[total-1]);
	}

	/* move over the rrsigs to the larger rrset*/
	j = d->count+d->rrsig_count-sigs;
	for(i=0; i<sigold->count+sigold->rrsig_count; i++) {
	if(rrsig_rdata_get_type_covered(sigold->rr_data[i],
	sigold->rr_len[i]) == rr_type) {
	/* move this one over to location j */
	d->rr_ttl[j] = sigold->rr_ttl[i];
	memmove(d->rr_data[j], sigold->rr_data[i],
	sigold->rr_len[i]);
	if(d->rr_ttl[j] < d->ttl)
	d->ttl = d->rr_ttl[j];
	j++;
	}
	}

	/* put it in and deallocate the old rrset */
	rrset->data = d;
	free(old);

	/* now make rrsig set smaller */
	if(sigold->count+sigold->rrsig_count == sigs) {
	/* remove all sigs from rrsig, remove it entirely */
	domain_remove_rrset(node, LDNS_RR_TYPE_RRSIG);
	return 1;
	}
	log_assert(packed_rrset_sizeof(sigold) > sigs*(sizeof(size_t) +
	sizeof(uint8_t*) + sizeof(time_t)) + sigsz);
	sigd = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(sigold)
	- sigs(sizeof(size_t) + sizeof(uint8_t) + sizeof(time_t))
	- sigsz);
	if(!sigd) {
	/* no need to free up d, it has already been placed in the
	* node->rrset structure */
	log_err("out of memory");
	return 0;
	}
	/* copy base values */
	memcpy(sigd, sigold, sizeof(struct packed_rrset_data));
	/* in sigd the RRSIGs are stored in the base of the RR, in count */
	sigd->count -= sigs;
	/* setup rr_len */
	sigd->rr_len = (size_t)((uint8_t)sigd +
	sizeof(struct packed_rrset_data));
	j = 0;
	for(i=0; i<sigold->count+sigold->rrsig_count; i++) {
	if(rrsig_rdata_get_type_covered(sigold->rr_data[i],
	sigold->rr_len[i]) != rr_type) {
	sigd->rr_len[j] = sigold->rr_len[i];
	j++;
	}
	}
	packed_rrset_ptr_fixup(sigd);

	/* copy old values into new rrsig array */
	j = 0;
	for(i=0; i<sigold->count+sigold->rrsig_count; i++) {
	if(rrsig_rdata_get_type_covered(sigold->rr_data[i],
	sigold->rr_len[i]) != rr_type) {
	/* move this one over to location j */
	sigd->rr_ttl[j] = sigold->rr_ttl[i];
	memmove(sigd->rr_data[j], sigold->rr_data[i],
	sigold->rr_len[i]);
	if(j==0) sigd->ttl = sigd->rr_ttl[j];
	else {
	if(sigd->rr_ttl[j] < sigd->ttl)
	sigd->ttl = sigd->rr_ttl[j];
	}
	j++;
	}
	}

	/* put it in and deallocate the old rrset */
	rrsig->data = sigd;
	free(sigold);

	return 1;
	}

	/** copy the rrsigs from the rrset to the rrsig rrset, because the rrset
	* is going to be deleted. reallocates the RRSIG rrset data. */
	static int
	rrsigs_copy_from_rrset_to_rrsigset(struct auth_rrset* rrset,
	struct auth_rrset* rrsigset)
	{
	size_t i;
	if(rrset->data->rrsig_count == 0)
	return 1;

	/* move them over one by one, because there might be duplicates,
	* duplicates are ignored */
	for(i=rrset->data->count;
	i<rrset->data->count+rrset->data->rrsig_count; i++) {
	uint8_t* rdata = rrset->data->rr_data[i];
	size_t rdatalen = rrset->data->rr_len[i];
	time_t rr_ttl = rrset->data->rr_ttl[i];

	if(rdata_duplicate(rrsigset->data, rdata, rdatalen)) {
	continue;
	}
	if(!rrset_add_rr(rrsigset, rr_ttl, rdata, rdatalen, 0))
	return 0;
	}
	return 1;
	}

	/** Add rr to node, ignores duplicate RRs,
	* rdata points to buffer with rdatalen octets, starts with 2bytelength. */
	static int
	az_domain_add_rr(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
	uint8_t* rdata, size_t rdatalen, int* duplicate)
	{
	struct auth_rrset* rrset;
	/* packed rrsets have their rrsigs along with them, sort them out */
	if(rr_type == LDNS_RR_TYPE_RRSIG) {
	uint16_t ctype = rrsig_rdata_get_type_covered(rdata, rdatalen);
	if((rrset=az_domain_rrset(node, ctype))!= NULL) {
	/* a node of the correct type exists, add the RRSIG
	* to the rrset of the covered data type */
	if(rdata_duplicate(rrset->data, rdata, rdatalen)) {
	if(duplicate) *duplicate = 1;
	return 1;
	}
	if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 1))
	return 0;
	} else if((rrset=az_domain_rrset(node, rr_type))!= NULL) {
	/* add RRSIG to rrset of type RRSIG */
	if(rdata_duplicate(rrset->data, rdata, rdatalen)) {
	if(duplicate) *duplicate = 1;
	return 1;
	}
	if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 0))
	return 0;
	} else {
	/* create rrset of type RRSIG */
	if(!rrset_create(node, rr_type, rr_ttl, rdata,
	rdatalen))
	return 0;
	}
	} else {
	/* normal RR type */
	if((rrset=az_domain_rrset(node, rr_type))!= NULL) {
	/* add data to existing node with data type */
	if(rdata_duplicate(rrset->data, rdata, rdatalen)) {
	if(duplicate) *duplicate = 1;
	return 1;
	}
	if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 0))
	return 0;
	} else {
	struct auth_rrset* rrsig;
	/* create new node with data type */
	if(!(rrset=rrset_create(node, rr_type, rr_ttl, rdata,
	rdatalen)))
	return 0;

	/* see if node of type RRSIG has signatures that
	* cover the data type, and move them over */
	/* and then make the RRSIG type smaller */
	if((rrsig=az_domain_rrset(node, LDNS_RR_TYPE_RRSIG))
	!= NULL) {
	if(!rrset_moveover_rrsigs(node, rr_type,
	rrset, rrsig))
	return 0;
	}
	}
	}
	return 1;
	}

	/** insert RR into zone, ignore duplicates */
	static int
	az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
	size_t dname_len, int* duplicate)
	{
	struct auth_data* node;
	uint8_t* dname = rr;
	uint16_t rr_type = sldns_wirerr_get_type(rr, rr_len, dname_len);
	uint16_t rr_class = sldns_wirerr_get_class(rr, rr_len, dname_len);
	uint32_t rr_ttl = sldns_wirerr_get_ttl(rr, rr_len, dname_len);
	size_t rdatalen = ((size_t)sldns_wirerr_get_rdatalen(rr, rr_len,
	dname_len))+2;
	/* rdata points to rdata prefixed with uint16 rdatalength */
	uint8_t* rdata = sldns_wirerr_get_rdatawl(rr, rr_len, dname_len);

	if(rr_class != z->dclass) {
	log_err("wrong class for RR");
	return 0;
	}
	if(!(node=az_domain_find_or_create(z, dname, dname_len))) {
	log_err("cannot create domain");
	return 0;
	}
	if(!az_domain_add_rr(node, rr_type, rr_ttl, rdata, rdatalen,
	duplicate)) {
	log_err("cannot add RR to domain");
	return 0;
	}
	return 1;
	}

	/** Remove rr from node, ignores nonexisting RRs,
	* rdata points to buffer with rdatalen octets, starts with 2bytelength. */
	static int
	az_domain_remove_rr(struct auth_data* node, uint16_t rr_type,
	uint8_t* rdata, size_t rdatalen, int* nonexist)
	{
	struct auth_rrset* rrset;
	size_t index = 0;

	/* find the plain RR of the given type */
	if((rrset=az_domain_rrset(node, rr_type))!= NULL) {
	if(az_rrset_find_rr(rrset->data, rdata, rdatalen, &index)) {
	if(rrset->data->count == 1 &&
	rrset->data->rrsig_count == 0) {
	/* last RR, delete the rrset */
	domain_remove_rrset(node, rr_type);
	} else if(rrset->data->count == 1 &&
	rrset->data->rrsig_count != 0) {
	/* move RRSIGs to the RRSIG rrset, or
	* this one becomes that RRset */
	struct auth_rrset* rrsigset = az_domain_rrset(
	node, LDNS_RR_TYPE_RRSIG);
	if(rrsigset) {
	/* move left over rrsigs to the
	* existing rrset of type RRSIG */
	rrsigs_copy_from_rrset_to_rrsigset(
	rrset, rrsigset);
	/* and then delete the rrset */
	domain_remove_rrset(node, rr_type);
	} else {
	/* no rrset of type RRSIG, this
	* set is now of that type,
	* just remove the rr */
	if(!rrset_remove_rr(rrset, index))
	return 0;
	rrset->type = LDNS_RR_TYPE_RRSIG;
	rrset->data->count = rrset->data->rrsig_count;
	rrset->data->rrsig_count = 0;
	}
	} else {
	/* remove the RR from the rrset */
	if(!rrset_remove_rr(rrset, index))
	return 0;
	}
	return 1;
	}
	/* rr not found in rrset */
	}

	/* is it a type RRSIG, look under the covered type */
	if(rr_type == LDNS_RR_TYPE_RRSIG) {
	uint16_t ctype = rrsig_rdata_get_type_covered(rdata, rdatalen);
	if((rrset=az_domain_rrset(node, ctype))!= NULL) {
	if(az_rrset_find_rrsig(rrset->data, rdata, rdatalen,
	&index)) {
	/* rrsig should have d->count > 0, be
	* over some rr of that type */
	/* remove the rrsig from the rrsigs list of the
	* rrset */
	if(!rrset_remove_rr(rrset, index))
	return 0;
	return 1;
	}
	}
	/* also RRSIG not found */
	}

	/* nothing found to delete */
	if(nonexist) *nonexist = 1;
	return 1;
	}

	/** remove RR from zone, ignore if it does not exist, false on alloc failure*/
	static int
	az_remove_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
	size_t dname_len, int* nonexist)
	{
	struct auth_data* node;
	uint8_t* dname = rr;
	uint16_t rr_type = sldns_wirerr_get_type(rr, rr_len, dname_len);
	uint16_t rr_class = sldns_wirerr_get_class(rr, rr_len, dname_len);
	size_t rdatalen = ((size_t)sldns_wirerr_get_rdatalen(rr, rr_len,
	dname_len))+2;
	/* rdata points to rdata prefixed with uint16 rdatalength */
	uint8_t* rdata = sldns_wirerr_get_rdatawl(rr, rr_len, dname_len);

	if(rr_class != z->dclass) {
	log_err("wrong class for RR");
	/* really also a nonexisting entry, because no records
	* of that class in the zone, but return an error because
	* getting records of the wrong class is a failure of the
	* zone transfer */
	return 0;
	}
	node = az_find_name(z, dname, dname_len);
	if(!node) {
	/* node with that name does not exist */
	/* nonexisting entry, because no such name */
	*nonexist = 1;
	return 1;
	}
	if(!az_domain_remove_rr(node, rr_type, rdata, rdatalen, nonexist)) {
	/* alloc failure or so */
	return 0;
	}
	/* remove the node, if necessary */
	/* an rrsets==NULL entry is not kept around for empty nonterminals,
	* and also parent nodes are not kept around, so we just delete it */
	if(node->rrsets == NULL) {
	(void)rbtree_delete(&z->data, node);
	auth_data_delete(node);
	}
	return 1;
	}

	/** decompress an RR into the buffer where it'll be an uncompressed RR
	* with uncompressed dname and uncompressed rdata (dnames) */
	static int
	decompress_rr_into_buffer(struct sldns_buffer* buf, uint8_t* pkt,
	size_t pktlen, uint8_t* dname, uint16_t rr_type, uint16_t rr_class,
	uint32_t rr_ttl, uint8_t* rr_data, uint16_t rr_rdlen)
	{
	sldns_buffer pktbuf;
	size_t dname_len = 0;
	size_t rdlenpos;
	size_t rdlen;
	uint8_t* rd;
	const sldns_rr_descriptor* desc;
	sldns_buffer_init_frm_data(&pktbuf, pkt, pktlen);
	sldns_buffer_clear(buf);

	/* decompress dname */
	sldns_buffer_set_position(&pktbuf,
	(size_t)(dname - sldns_buffer_current(&pktbuf)));
	dname_len = pkt_dname_len(&pktbuf);
	if(dname_len == 0) return 0; /* parse fail on dname */
	if(!sldns_buffer_available(buf, dname_len)) return 0;
	dname_pkt_copy(&pktbuf, sldns_buffer_current(buf), dname);
	sldns_buffer_skip(buf, (ssize_t)dname_len);

	/* type, class, ttl and rdatalength fields */
	if(!sldns_buffer_available(buf, 10)) return 0;
	sldns_buffer_write_u16(buf, rr_type);
	sldns_buffer_write_u16(buf, rr_class);
	sldns_buffer_write_u32(buf, rr_ttl);
	rdlenpos = sldns_buffer_position(buf);
	sldns_buffer_write_u16(buf, 0); /* rd length position */

	/* decompress rdata */
	desc = sldns_rr_descript(rr_type);
	rd = rr_data;
	rdlen = rr_rdlen;
	if(rdlen > 0 && desc && desc->_dname_count > 0) {
	int count = (int)desc->_dname_count;
	int rdf = 0;
	size_t len; /* how much rdata to plain copy */
	size_t uncompressed_len, compressed_len;
	size_t oldpos;
	/* decompress dnames. */
	while(rdlen > 0 && count) {
	switch(desc->_wireformat[rdf]) {
	case LDNS_RDF_TYPE_DNAME:
	sldns_buffer_set_position(&pktbuf,
	(size_t)(rd -
	sldns_buffer_begin(&pktbuf)));
	oldpos = sldns_buffer_position(&pktbuf);
	/* moves pktbuf to right after the
	* compressed dname, and returns uncompressed
	* dname length */
	uncompressed_len = pkt_dname_len(&pktbuf);
	if(!uncompressed_len)
	return 0; /* parse error in dname */
	if(!sldns_buffer_available(buf,
	uncompressed_len))
	/* dname too long for buffer */
	return 0;
	dname_pkt_copy(&pktbuf,
	sldns_buffer_current(buf), rd);
	sldns_buffer_skip(buf, (ssize_t)uncompressed_len);
	compressed_len = sldns_buffer_position(
	&pktbuf) - oldpos;
	rd += compressed_len;
	rdlen -= compressed_len;
	count--;
	len = 0;
	break;
	case LDNS_RDF_TYPE_STR:
	len = rd[0] + 1;
	break;
	default:
	len = get_rdf_size(desc->_wireformat[rdf]);
	break;
	}
	if(len) {
	if(!sldns_buffer_available(buf, len))
	return 0; /* too long for buffer */
	sldns_buffer_write(buf, rd, len);
	rd += len;
	rdlen -= len;
	}
	rdf++;
	}
	}
	/* copy remaining data */
	if(rdlen > 0) {
	if(!sldns_buffer_available(buf, rdlen)) return 0;
	sldns_buffer_write(buf, rd, rdlen);
	}
	/* fixup rdlength */
	sldns_buffer_write_u16_at(buf, rdlenpos,
	sldns_buffer_position(buf)-rdlenpos-2);
	sldns_buffer_flip(buf);
	return 1;
	}

	/** insert RR into zone, from packet, decompress RR,
	* if duplicate is nonNULL set the flag but otherwise ignore duplicates */
	static int
	az_insert_rr_decompress(struct auth_zone* z, uint8_t* pkt, size_t pktlen,
	struct sldns_buffer* scratch_buffer, uint8_t* dname, uint16_t rr_type,
	uint16_t rr_class, uint32_t rr_ttl, uint8_t* rr_data,
	uint16_t rr_rdlen, int* duplicate)
	{
	uint8_t* rr;
	size_t rr_len;
	size_t dname_len;
	if(!decompress_rr_into_buffer(scratch_buffer, pkt, pktlen, dname,
	rr_type, rr_class, rr_ttl, rr_data, rr_rdlen)) {
	log_err("could not decompress RR");
	return 0;
	}
	rr = sldns_buffer_begin(scratch_buffer);
	rr_len = sldns_buffer_limit(scratch_buffer);
	dname_len = dname_valid(rr, rr_len);
	return az_insert_rr(z, rr, rr_len, dname_len, duplicate);
	}

	/** remove RR from zone, from packet, decompress RR,
	* if nonexist is nonNULL set the flag but otherwise ignore nonexisting entries*/
	static int
	az_remove_rr_decompress(struct auth_zone* z, uint8_t* pkt, size_t pktlen,
	struct sldns_buffer* scratch_buffer, uint8_t* dname, uint16_t rr_type,
	uint16_t rr_class, uint32_t rr_ttl, uint8_t* rr_data,
	uint16_t rr_rdlen, int* nonexist)
	{
	uint8_t* rr;
	size_t rr_len;
	size_t dname_len;
	if(!decompress_rr_into_buffer(scratch_buffer, pkt, pktlen, dname,
	rr_type, rr_class, rr_ttl, rr_data, rr_rdlen)) {
	log_err("could not decompress RR");
	return 0;
	}
	rr = sldns_buffer_begin(scratch_buffer);
	rr_len = sldns_buffer_limit(scratch_buffer);
	dname_len = dname_valid(rr, rr_len);
	return az_remove_rr(z, rr, rr_len, dname_len, nonexist);
	}

	/**
	* Parse zonefile
	* @param z: zone to read in.
	* @param in: file to read from (just opened).
	* @param rr: buffer to use for RRs, 64k.
	* passed so that recursive includes can use the same buffer and do
	* not grow the stack too much.
	* @param rrbuflen: sizeof rr buffer.
	* @param state: parse state with $ORIGIN, $TTL and 'prev-dname' and so on,
	* that is kept between includes.
	* The lineno is set at 1 and then increased by the function.
	* @param fname: file name.
	* @param depth: recursion depth for includes
	+ * @param cfg: config for chroot.
	* returns false on failure, has printed an error message
	*/
	static int
	az_parse_file(struct auth_zone* z, FILE* in, uint8_t* rr, size_t rrbuflen,
	- struct sldns_file_parse_state* state, char* fname, int depth)
	+ struct sldns_file_parse_state* state, char* fname, int depth,
	+ struct config_file* cfg)
	{
	size_t rr_len, dname_len;
	int status;
	state->lineno = 1;

	while(!feof(in)) {
	rr_len = rrbuflen;
	dname_len = 0;
	status = sldns_fp2wire_rr_buf(in, rr, &rr_len, &dname_len,
	state);
	if(status == LDNS_WIREPARSE_ERR_INCLUDE && rr_len == 0) {
	/* we have $INCLUDE or $something */
	if(strncmp((char*)rr, "$INCLUDE ", 9) == 0 \|\|
	strncmp((char*)rr, "$INCLUDE\t", 9) == 0) {
	FILE* inc;
	int lineno_orig = state->lineno;
	char* incfile = (char*)rr + 8;
	if(depth > MAX_INCLUDE_DEPTH) {
	log_err("%s:%d max include depth"
	"exceeded", fname, state->lineno);
	return 0;
	}
	/* skip spaces */
	while(incfile == ' ' \|\| incfile == '\t')
	incfile++;
	+ /* adjust for chroot on include file */
	+ if(cfg->chrootdir && cfg->chrootdir[0] &&
	+ strncmp(incfile, cfg->chrootdir,
	+ strlen(cfg->chrootdir)) == 0)
	+ incfile += strlen(cfg->chrootdir);
	incfile = strdup(incfile);
	if(!incfile) {
	log_err("malloc failure");
	return 0;
	}
	verbose(VERB_ALGO, "opening $INCLUDE %s",
	incfile);
	inc = fopen(incfile, "r");
	if(!inc) {
	log_err("%s:%d cannot open include "
	- "file %s: %s", z->zonefile,
	+ "file %s: %s", fname,
	lineno_orig, incfile,
	strerror(errno));
	free(incfile);
	return 0;
	}
	/* recurse read that file now */
	if(!az_parse_file(z, inc, rr, rrbuflen,
	- state, incfile, depth+1)) {
	+ state, incfile, depth+1, cfg)) {
	log_err("%s:%d cannot parse include "
	"file %s", fname,
	lineno_orig, incfile);
	fclose(inc);
	free(incfile);
	return 0;
	}
	fclose(inc);
	verbose(VERB_ALGO, "done with $INCLUDE %s",
	incfile);
	free(incfile);
	state->lineno = lineno_orig;
	}
	continue;
	}
	if(status != 0) {
	log_err("parse error %s %d:%d: %s", fname,
	state->lineno, LDNS_WIREPARSE_OFFSET(status),
	sldns_get_errorstr_parse(status));
	return 0;
	}
	if(rr_len == 0) {
	/* EMPTY line, TTL or ORIGIN */
	continue;
	}
	/* insert wirerr in rrbuf */
	if(!az_insert_rr(z, rr, rr_len, dname_len, NULL)) {
	char buf[17];
	sldns_wire2str_type_buf(sldns_wirerr_get_type(rr,
	rr_len, dname_len), buf, sizeof(buf));
	log_err("%s:%d cannot insert RR of type %s",
	fname, state->lineno, buf);
	return 0;
	}
	}
	return 1;
	}

	int
	-auth_zone_read_zonefile(struct auth_zone* z)
	+auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg)
	{
	uint8_t rr[LDNS_RR_BUF_SIZE];
	struct sldns_file_parse_state state;
	+ char* zfilename;
	FILE* in;
	if(!z \|\| !z->zonefile \|\| z->zonefile[0]==0)
	return 1; /* no file, or "", nothing to read */
	+
	+ zfilename = z->zonefile;
	+ if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(zfilename,
	+ cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
	+ zfilename += strlen(cfg->chrootdir);
	if(verbosity >= VERB_ALGO) {
	char nm[255+1];
	dname_str(z->name, nm);
	- verbose(VERB_ALGO, "read zonefile %s for %s", z->zonefile, nm);
	+ verbose(VERB_ALGO, "read zonefile %s for %s", zfilename, nm);
	}
	- in = fopen(z->zonefile, "r");
	+ in = fopen(zfilename, "r");
	if(!in) {
	char* n = sldns_wire2str_dname(z->name, z->namelen);
	if(z->zone_is_slave && errno == ENOENT) {
	/* we fetch the zone contents later, no file yet */
	verbose(VERB_ALGO, "no zonefile %s for %s",
	- z->zonefile, n?n:"error");
	+ zfilename, n?n:"error");
	free(n);
	return 1;
	}
	log_err("cannot open zonefile %s for %s: %s",
	- z->zonefile, n?n:"error", strerror(errno));
	+ zfilename, n?n:"error", strerror(errno));
	free(n);
	return 0;
	}

	/* clear the data tree */
	traverse_postorder(&z->data, auth_data_del, NULL);
	rbtree_init(&z->data, &auth_data_cmp);

	memset(&state, 0, sizeof(state));
	/* default TTL to 3600 */
	state.default_ttl = 3600;
	/* set $ORIGIN to the zone name */
	if(z->namelen <= sizeof(state.origin)) {
	memcpy(state.origin, z->name, z->namelen);
	state.origin_len = z->namelen;
	}
	/* parse the (toplevel) file */
	- if(!az_parse_file(z, in, rr, sizeof(rr), &state, z->zonefile, 0)) {
	+ if(!az_parse_file(z, in, rr, sizeof(rr), &state, zfilename, 0, cfg)) {
	char* n = sldns_wire2str_dname(z->name, z->namelen);
	log_err("error parsing zonefile %s for %s",
	- z->zonefile, n?n:"error");
	+ zfilename, n?n:"error");
	free(n);
	fclose(in);
	return 0;
	}
	fclose(in);
	return 1;
	}

	/** write buffer to file and check return codes */
	static int
	write_out(FILE* out, const char* str, size_t len)
	{
	size_t r;
	if(len == 0)
	return 1;
	r = fwrite(str, 1, len, out);
	if(r == 0) {
	log_err("write failed: %s", strerror(errno));
	return 0;
	} else if(r < len) {
	log_err("write failed: too short (disk full?)");
	return 0;
	}
	return 1;
	}

	/** convert auth rr to string */
	static int
	auth_rr_to_string(uint8_t* nm, size_t nmlen, uint16_t tp, uint16_t cl,
	struct packed_rrset_data* data, size_t i, char* s, size_t buflen)
	{
	int w = 0;
	size_t slen = buflen, datlen;
	uint8_t* dat;
	if(i >= data->count) tp = LDNS_RR_TYPE_RRSIG;
	dat = nm;
	datlen = nmlen;
	w += sldns_wire2str_dname_scan(&dat, &datlen, &s, &slen, NULL, 0);
	w += sldns_str_print(&s, &slen, "\t");
	w += sldns_str_print(&s, &slen, "%lu\t", (unsigned long)data->rr_ttl[i]);
	w += sldns_wire2str_class_print(&s, &slen, cl);
	w += sldns_str_print(&s, &slen, "\t");
	w += sldns_wire2str_type_print(&s, &slen, tp);
	w += sldns_str_print(&s, &slen, "\t");
	datlen = data->rr_len[i]-2;
	dat = data->rr_data[i]+2;
	w += sldns_wire2str_rdata_scan(&dat, &datlen, &s, &slen, tp, NULL, 0);

	if(tp == LDNS_RR_TYPE_DNSKEY) {
	w += sldns_str_print(&s, &slen, " ;{id = %u}",
	sldns_calc_keytag_raw(data->rr_data[i]+2,
	data->rr_len[i]-2));
	}
	w += sldns_str_print(&s, &slen, "\n");

	if(w > (int)buflen) {
	log_nametypeclass(0, "RR too long to print", nm, tp, cl);
	return 0;
	}
	return 1;
	}

	/** write rrset to file */
	static int
	auth_zone_write_rrset(struct auth_zone* z, struct auth_data* node,
	struct auth_rrset* r, FILE* out)
	{
	size_t i, count = r->data->count + r->data->rrsig_count;
	char buf[LDNS_RR_BUF_SIZE];
	for(i=0; i<count; i++) {
	if(!auth_rr_to_string(node->name, node->namelen, r->type,
	z->dclass, r->data, i, buf, sizeof(buf))) {
	verbose(VERB_ALGO, "failed to rr2str rr %d", (int)i);
	continue;
	}
	if(!write_out(out, buf, strlen(buf)))
	return 0;
	}
	return 1;
	}

	/** write domain to file */
	static int
	auth_zone_write_domain(struct auth_zone* z, struct auth_data* n, FILE* out)
	{
	struct auth_rrset* r;
	/* if this is zone apex, write SOA first */
	if(z->namelen == n->namelen) {
	struct auth_rrset* soa = az_domain_rrset(n, LDNS_RR_TYPE_SOA);
	if(soa) {
	if(!auth_zone_write_rrset(z, n, soa, out))
	return 0;
	}
	}
	/* write all the RRsets for this domain */
	for(r = n->rrsets; r; r = r->next) {
	if(z->namelen == n->namelen &&
	r->type == LDNS_RR_TYPE_SOA)
	continue; /* skip SOA here */
	if(!auth_zone_write_rrset(z, n, r, out))
	return 0;
	}
	return 1;
	}

	int auth_zone_write_file(struct auth_zone* z, const char* fname)
	{
	FILE* out;
	struct auth_data* n;
	out = fopen(fname, "w");
	if(!out) {
	log_err("could not open %s: %s", fname, strerror(errno));
	return 0;
	}
	RBTREE_FOR(n, struct auth_data*, &z->data) {
	if(!auth_zone_write_domain(z, n, out)) {
	log_err("could not write domain to %s", fname);
	fclose(out);
	return 0;
	}
	}
	fclose(out);
	return 1;
	}

	/** read all auth zones from file (if they have) */
	static int
	-auth_zones_read_zones(struct auth_zones* az)
	+auth_zones_read_zones(struct auth_zones* az, struct config_file* cfg)
	{
	struct auth_zone* z;
	lock_rw_wrlock(&az->lock);
	RBTREE_FOR(z, struct auth_zone*, &az->ztree) {
	lock_rw_wrlock(&z->lock);
	- if(!auth_zone_read_zonefile(z)) {
	+ if(!auth_zone_read_zonefile(z, cfg)) {
	lock_rw_unlock(&z->lock);
	lock_rw_unlock(&az->lock);
	return 0;
	}
	lock_rw_unlock(&z->lock);
	}
	lock_rw_unlock(&az->lock);
	return 1;
	}

	/** find serial number of zone or false if none */
	int
	auth_zone_get_serial(struct auth_zone* z, uint32_t* serial)
	{
	struct auth_data* apex;
	struct auth_rrset* soa;
	struct packed_rrset_data* d;
	apex = az_find_name(z, z->name, z->namelen);
	if(!apex) return 0;
	soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA);
	if(!soa \|\| soa->data->count==0)
	return 0; /* no RRset or no RRs in rrset */
	if(soa->data->rr_len[0] < 2+45) return 0; / SOA too short */
	d = soa->data;
	*serial = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-20));
	return 1;
	}

	/** Find auth_zone SOA and populate the values in xfr(soa values). */
	static int
	xfr_find_soa(struct auth_zone* z, struct auth_xfer* xfr)
	{
	struct auth_data* apex;
	struct auth_rrset* soa;
	struct packed_rrset_data* d;
	apex = az_find_name(z, z->name, z->namelen);
	if(!apex) return 0;
	soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA);
	if(!soa \|\| soa->data->count==0)
	return 0; /* no RRset or no RRs in rrset */
	if(soa->data->rr_len[0] < 2+45) return 0; / SOA too short */
	/* SOA record ends with serial, refresh, retry, expiry, minimum,
	* as 4 byte fields */
	d = soa->data;
	xfr->have_zone = 1;
	xfr->serial = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-20));
	xfr->refresh = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-16));
	xfr->retry = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-12));
	xfr->expiry = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-8));
	/* soa minimum at d->rr_len[0]-4 */
	return 1;
	}

	/**
	* Setup auth_xfer zone
	* This populates the have_zone, soa values, and so on times.
	* Doesn't do network traffic yet, can set option flags.
	* @param z: locked by caller, and modified for setup
	* @param x: locked by caller, and modified.
	* @return false on failure.
	*/
	static int
	auth_xfer_setup(struct auth_zone* z, struct auth_xfer* x)
	{
	/* for a zone without zone transfers, x==NULL, so skip them,
	* i.e. the zone config is fixed with no masters or urls */
	if(!z \|\| !x) return 1;
	if(!xfr_find_soa(z, x)) {
	return 1;
	}
	/* nothing for probe, nextprobe and transfer tasks */
	return 1;
	}

	/**
	* Setup all zones
	* @param az: auth zones structure
	* @return false on failure.
	*/
	static int
	auth_zones_setup_zones(struct auth_zones* az)
	{
	struct auth_zone* z;
	struct auth_xfer* x;
	lock_rw_wrlock(&az->lock);
	RBTREE_FOR(z, struct auth_zone*, &az->ztree) {
	lock_rw_wrlock(&z->lock);
	x = auth_xfer_find(az, z->name, z->namelen, z->dclass);
	if(x) {
	lock_basic_lock(&x->lock);
	}
	if(!auth_xfer_setup(z, x)) {
	if(x) {
	lock_basic_unlock(&x->lock);
	}
	lock_rw_unlock(&z->lock);
	lock_rw_unlock(&az->lock);
	return 0;
	}
	if(x) {
	lock_basic_unlock(&x->lock);
	}
	lock_rw_unlock(&z->lock);
	}
	lock_rw_unlock(&az->lock);
	return 1;
	}

	/** set config items and create zones */
	static int
	auth_zones_cfg(struct auth_zones* az, struct config_auth* c)
	{
	struct auth_zone* z;
	struct auth_xfer* x = NULL;

	/* create zone */
	lock_rw_wrlock(&az->lock);
	if(!(z=auth_zones_find_or_add_zone(az, c->name))) {
	lock_rw_unlock(&az->lock);
	return 0;
	}
	if(c->masters \|\| c->urls) {
	if(!(x=auth_zones_find_or_add_xfer(az, z))) {
	lock_rw_unlock(&az->lock);
	lock_rw_unlock(&z->lock);
	return 0;
	}
	}
	if(c->for_downstream)
	az->have_downstream = 1;
	lock_rw_unlock(&az->lock);

	/* set options */
	z->zone_deleted = 0;
	if(!auth_zone_set_zonefile(z, c->zonefile)) {
	if(x) {
	lock_basic_unlock(&x->lock);
	}
	lock_rw_unlock(&z->lock);
	return 0;
	}
	z->for_downstream = c->for_downstream;
	z->for_upstream = c->for_upstream;
	z->fallback_enabled = c->fallback_enabled;

	/* xfer zone */
	if(x) {
	z->zone_is_slave = 1;
	/* set options on xfer zone */
	if(!xfer_set_masters(&x->task_probe->masters, c, 0)) {
	lock_basic_unlock(&x->lock);
	lock_rw_unlock(&z->lock);
	return 0;
	}
	if(!xfer_set_masters(&x->task_transfer->masters, c, 1)) {
	lock_basic_unlock(&x->lock);
	lock_rw_unlock(&z->lock);
	return 0;
	}
	lock_basic_unlock(&x->lock);
	}

	lock_rw_unlock(&z->lock);
	return 1;
	}

	/** set all auth zones deleted, then in auth_zones_cfg, it marks them
	* as nondeleted (if they are still in the config), and then later
	* we can find deleted zones */
	static void
	az_setall_deleted(struct auth_zones* az)
	{
	struct auth_zone* z;
	lock_rw_wrlock(&az->lock);
	RBTREE_FOR(z, struct auth_zone*, &az->ztree) {
	lock_rw_wrlock(&z->lock);
	z->zone_deleted = 1;
	lock_rw_unlock(&z->lock);
	}
	lock_rw_unlock(&az->lock);
	}

	/** find zones that are marked deleted and delete them.
	* This is called from apply_cfg, and there are no threads and no
	* workers, so the xfr can just be deleted. */
	static void
	az_delete_deleted_zones(struct auth_zones* az)
	{
	struct auth_zone* z;
	struct auth_zone* delete_list = NULL, *next;
	struct auth_xfer* xfr;
	lock_rw_wrlock(&az->lock);
	RBTREE_FOR(z, struct auth_zone*, &az->ztree) {
	lock_rw_wrlock(&z->lock);
	if(z->zone_deleted) {
	/* we cannot alter the rbtree right now, but
	* we can put it on a linked list and then
	* delete it */
	z->delete_next = delete_list;
	delete_list = z;
	}
	lock_rw_unlock(&z->lock);
	}
	/* now we are out of the tree loop and we can loop and delete
	* the zones */
	z = delete_list;
	while(z) {
	next = z->delete_next;
	xfr = auth_xfer_find(az, z->name, z->namelen, z->dclass);
	if(xfr) {
	(void)rbtree_delete(&az->xtree, &xfr->node);
	auth_xfer_delete(xfr);
	}
	(void)rbtree_delete(&az->ztree, &z->node);
	auth_zone_delete(z);
	z = next;
	}
	lock_rw_unlock(&az->lock);
	}

	int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg,
	int setup)
	{
	struct config_auth* p;
	az_setall_deleted(az);
	for(p = cfg->auths; p; p = p->next) {
	if(!p->name \|\| p->name[0] == 0) {
	log_warn("auth-zone without a name, skipped");
	continue;
	}
	if(!auth_zones_cfg(az, p)) {
	log_err("cannot config auth zone %s", p->name);
	return 0;
	}
	}
	az_delete_deleted_zones(az);
	- if(!auth_zones_read_zones(az))
	+ if(!auth_zones_read_zones(az, cfg))
	return 0;
	if(setup) {
	if(!auth_zones_setup_zones(az))
	return 0;
	}
	return 1;
	}

	/** delete chunks
	* @param at: transfer structure with chunks list. The chunks and their
	* data are freed.
	*/
	static void
	auth_chunks_delete(struct auth_transfer* at)
	{
	if(at->chunks_first) {
	struct auth_chunk* c, *cn;
	c = at->chunks_first;
	while(c) {
	cn = c->next;
	free(c->data);
	free(c);
	c = cn;
	}
	}
	at->chunks_first = NULL;
	at->chunks_last = NULL;
	}

	/** free master addr list */
	static void
	auth_free_master_addrs(struct auth_addr* list)
	{
	struct auth_addr *n;
	while(list) {
	n = list->next;
	free(list);
	list = n;
	}
	}

	/** free the masters list */
	static void
	auth_free_masters(struct auth_master* list)
	{
	struct auth_master* n;
	while(list) {
	n = list->next;
	auth_free_master_addrs(list->list);
	free(list->host);
	free(list->file);
	free(list);
	list = n;
	}
	}

	/** delete auth xfer structure
	* @param xfr: delete this xfer and its tasks.
	*/
	static void
	auth_xfer_delete(struct auth_xfer* xfr)
	{
	if(!xfr) return;
	lock_basic_destroy(&xfr->lock);
	free(xfr->name);
	if(xfr->task_nextprobe) {
	comm_timer_delete(xfr->task_nextprobe->timer);
	free(xfr->task_nextprobe);
	}
	if(xfr->task_probe) {
	auth_free_masters(xfr->task_probe->masters);
	comm_point_delete(xfr->task_probe->cp);
	+ comm_timer_delete(xfr->task_probe->timer);
	free(xfr->task_probe);
	}
	if(xfr->task_transfer) {
	auth_free_masters(xfr->task_transfer->masters);
	comm_point_delete(xfr->task_transfer->cp);
	+ comm_timer_delete(xfr->task_transfer->timer);
	if(xfr->task_transfer->chunks_first) {
	auth_chunks_delete(xfr->task_transfer);
	}
	free(xfr->task_transfer);
	}
	auth_free_masters(xfr->allow_notify_list);
	free(xfr);
	}

	/** helper traverse to delete zones */
	static void
	auth_zone_del(rbnode_type* n, void* ATTR_UNUSED(arg))
	{
	struct auth_zone* z = (struct auth_zone*)n->key;
	auth_zone_delete(z);
	}

	/** helper traverse to delete xfer zones */
	static void
	auth_xfer_del(rbnode_type* n, void* ATTR_UNUSED(arg))
	{
	struct auth_xfer* z = (struct auth_xfer*)n->key;
	auth_xfer_delete(z);
	}

	void auth_zones_delete(struct auth_zones* az)
	{
	if(!az) return;
	lock_rw_destroy(&az->lock);
	traverse_postorder(&az->ztree, auth_zone_del, NULL);
	traverse_postorder(&az->xtree, auth_xfer_del, NULL);
	free(az);
	}

	/** true if domain has only nsec3 */
	static int
	domain_has_only_nsec3(struct auth_data* n)
	{
	struct auth_rrset* rrset = n->rrsets;
	int nsec3_seen = 0;
	while(rrset) {
	if(rrset->type == LDNS_RR_TYPE_NSEC3) {
	nsec3_seen = 1;
	} else if(rrset->type != LDNS_RR_TYPE_RRSIG) {
	return 0;
	}
	rrset = rrset->next;
	}
	return nsec3_seen;
	}

	/** see if the domain has a wildcard child '.domain' /
	static struct auth_data*
	az_find_wildcard_domain(struct auth_zone* z, uint8_t* nm, size_t nmlen)
	{
	uint8_t wc[LDNS_MAX_DOMAINLEN];
	if(nmlen+2 > sizeof(wc))
	return NULL; /* result would be too long */
	wc[0] = 1; /* length of wildcard label */
	wc[1] = (uint8_t)''; / wildcard label */
	memmove(wc+2, nm, nmlen);
	return az_find_name(z, wc, nmlen+2);
	}

	/** find wildcard between qname and cename */
	static struct auth_data*
	az_find_wildcard(struct auth_zone* z, struct query_info* qinfo,
	struct auth_data* ce)
	{
	uint8_t* nm = qinfo->qname;
	size_t nmlen = qinfo->qname_len;
	struct auth_data* node;
	if(!dname_subdomain_c(nm, z->name))
	return NULL; /* out of zone */
	while((node=az_find_wildcard_domain(z, nm, nmlen))==NULL) {
	/* see if we can go up to find the wildcard */
	if(nmlen == z->namelen)
	return NULL; /* top of zone reached */
	if(ce && nmlen == ce->namelen)
	return NULL; /* ce reached */
	if(dname_is_root(nm))
	return NULL; /* cannot go up */
	dname_remove_label(&nm, &nmlen);
	}
	return node;
	}

	/** domain is not exact, find first candidate ce (name that matches
	* a part of qname) in tree */
	static struct auth_data*
	az_find_candidate_ce(struct auth_zone* z, struct query_info* qinfo,
	struct auth_data* n)
	{
	uint8_t* nm;
	size_t nmlen;
	if(n) {
	nm = dname_get_shared_topdomain(qinfo->qname, n->name);
	} else {
	nm = qinfo->qname;
	}
	dname_count_size_labels(nm, &nmlen);
	n = az_find_name(z, nm, nmlen);
	/* delete labels and go up on name */
	while(!n) {
	if(dname_is_root(nm))
	return NULL; /* cannot go up */
	dname_remove_label(&nm, &nmlen);
	n = az_find_name(z, nm, nmlen);
	}
	return n;
	}

	/** go up the auth tree to next existing name. */
	static struct auth_data*
	az_domain_go_up(struct auth_zone* z, struct auth_data* n)
	{
	uint8_t* nm = n->name;
	size_t nmlen = n->namelen;
	while(!dname_is_root(nm)) {
	dname_remove_label(&nm, &nmlen);
	if((n=az_find_name(z, nm, nmlen)) != NULL)
	return n;
	}
	return NULL;
	}

	/** Find the closest encloser, an name that exists and is above the
	* qname.
	* return true if the node (param node) is existing, nonobscured and
	* can be used to generate answers from. It is then also node_exact.
	* returns false if the node is not good enough (or it wasn't node_exact)
	* in this case the ce can be filled.
	* if ce is NULL, no ce exists, and likely the zone is completely empty,
	* not even with a zone apex.
	* if ce is nonNULL it is the closest enclosing upper name (that exists
	* itself for answer purposes). That name may have DNAME, NS or wildcard
	* rrset is the closest DNAME or NS rrset that was found.
	*/
	static int
	az_find_ce(struct auth_zone* z, struct query_info* qinfo,
	struct auth_data* node, int node_exact, struct auth_data** ce,
	struct auth_rrset** rrset)
	{
	struct auth_data* n = node;
	*ce = NULL;
	*rrset = NULL;
	if(!node_exact) {
	/* if not exact, lookup closest exact match */
	n = az_find_candidate_ce(z, qinfo, n);
	} else {
	/* if exact, the node itself is the first candidate ce */
	*ce = n;
	}

	/* no direct answer from nsec3-only domains */
	if(n && domain_has_only_nsec3(n)) {
	node_exact = 0;
	*ce = NULL;
	}

	/* with exact matches, walk up the labels until we find the
	* delegation, or DNAME or zone end */
	while(n) {
	/* see if the current candidate has issues */
	/* not zone apex and has type NS */
	if(n->namelen != z->namelen &&
	(*rrset=az_domain_rrset(n, LDNS_RR_TYPE_NS)) &&
	/* delegate here, but DS at exact the dp has notype */
	(qinfo->qtype != LDNS_RR_TYPE_DS \|\|
	n->namelen != qinfo->qname_len)) {
	/* referral */
	/* this is ce and the lowernode is nonexisting */
	*ce = n;
	return 0;
	}
	/* not equal to qname and has type DNAME */
	if(n->namelen != qinfo->qname_len &&
	(*rrset=az_domain_rrset(n, LDNS_RR_TYPE_DNAME))) {
	/* this is ce and the lowernode is nonexisting */
	*ce = n;
	return 0;
	}

	if(*ce == NULL && !domain_has_only_nsec3(n)) {
	/* if not found yet, this exact name must be
	* our lowest match (but not nsec3onlydomain) */
	*ce = n;
	}

	/* walk up the tree by removing labels from name and lookup */
	n = az_domain_go_up(z, n);
	}
	/* found no problems, if it was an exact node, it is fine to use */
	return node_exact;
	}

	/** add additional A/AAAA from domain names in rrset rdata (+offset)
	* offset is number of bytes in rdata where the dname is located. */
	static int
	az_add_additionals_from(struct auth_zone* z, struct regional* region,
	struct dns_msg* msg, struct auth_rrset* rrset, size_t offset)
	{
	struct packed_rrset_data* d = rrset->data;
	size_t i;
	if(!d) return 0;
	for(i=0; i<d->count; i++) {
	size_t dlen;
	struct auth_data* domain;
	struct auth_rrset* ref;
	if(d->rr_len[i] < 2+offset)
	continue; /* too short */
	if(!(dlen = dname_valid(d->rr_data[i]+2+offset,
	d->rr_len[i]-2-offset)))
	continue; /* malformed */
	domain = az_find_name(z, d->rr_data[i]+2+offset, dlen);
	if(!domain)
	continue;
	if((ref=az_domain_rrset(domain, LDNS_RR_TYPE_A)) != NULL) {
	if(!msg_add_rrset_ar(z, region, msg, domain, ref))
	return 0;
	}
	if((ref=az_domain_rrset(domain, LDNS_RR_TYPE_AAAA)) != NULL) {
	if(!msg_add_rrset_ar(z, region, msg, domain, ref))
	return 0;
	}
	}
	return 1;
	}

	/** add negative SOA record (with negative TTL) */
	static int
	az_add_negative_soa(struct auth_zone* z, struct regional* region,
	struct dns_msg* msg)
	{
	uint32_t minimum;
	struct packed_rrset_data* d;
	struct auth_rrset* soa;
	struct auth_data* apex = az_find_name(z, z->name, z->namelen);
	if(!apex) return 0;
	soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA);
	if(!soa) return 0;
	/* must be first to put in message; we want to fix the TTL with
	* one RRset here, otherwise we'd need to loop over the RRs to get
	* the resulting lower TTL */
	log_assert(msg->rep->rrset_count == 0);
	if(!msg_add_rrset_ns(z, region, msg, apex, soa)) return 0;
	/* fixup TTL */
	d = (struct packed_rrset_data*)msg->rep->rrsets[msg->rep->rrset_count-1]->entry.data;
	/* last 4 bytes are minimum ttl in network format */
	if(d->count == 0) return 0;
	if(d->rr_len[0] < 2+4) return 0;
	minimum = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-4));
	d->ttl = (time_t)minimum;
	d->rr_ttl[0] = (time_t)minimum;
	msg->rep->ttl = get_rrset_ttl(msg->rep->rrsets[0]);
	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
	return 1;
	}

	/** See if the query goes to empty nonterminal (that has no auth_data,
	* but there are nodes underneath. We already checked that there are
	* not NS, or DNAME above, so that we only need to check if some node
	* exists below (with nonempty rr list), return true if emptynonterminal */
	static int
	az_empty_nonterminal(struct auth_zone* z, struct query_info* qinfo,
	struct auth_data* node)
	{
	struct auth_data* next;
	if(!node) {
	/* no smaller was found, use first (smallest) node as the
	* next one */
	next = (struct auth_data*)rbtree_first(&z->data);
	} else {
	next = (struct auth_data*)rbtree_next(&node->node);
	}
	while(next && (rbnode_type*)next != RBTREE_NULL && next->rrsets == NULL) {
	/* the next name has empty rrsets, is an empty nonterminal
	* itself, see if there exists something below it */
	next = (struct auth_data*)rbtree_next(&node->node);
	}
	if((rbnode_type*)next == RBTREE_NULL \|\| !next) {
	/* there is no next node, so something below it cannot
	* exist */
	return 0;
	}
	/* a next node exists, if there was something below the query,
	* this node has to be it. See if it is below the query name */
	if(dname_strict_subdomain_c(next->name, qinfo->qname))
	return 1;
	return 0;
	}

	/** create synth cname target name in buffer, or fail if too long */
	static size_t
	synth_cname_buf(uint8_t* qname, size_t qname_len, size_t dname_len,
	uint8_t* dtarg, size_t dtarglen, uint8_t* buf, size_t buflen)
	{
	size_t newlen = qname_len + dtarglen - dname_len;
	if(newlen > buflen) {
	/* YXDOMAIN error */
	return 0;
	}
	/* new name is concatenation of qname front (without DNAME owner)
	* and DNAME target name */
	memcpy(buf, qname, qname_len-dname_len);
	memmove(buf+(qname_len-dname_len), dtarg, dtarglen);
	return newlen;
	}

	/** create synthetic CNAME rrset for in a DNAME answer in region,
	* false on alloc failure, cname==NULL when name too long. */
	static int
	create_synth_cname(uint8_t* qname, size_t qname_len, struct regional* region,
	struct auth_data* node, struct auth_rrset* dname, uint16_t dclass,
	struct ub_packed_rrset_key** cname)
	{
	uint8_t buf[LDNS_MAX_DOMAINLEN];
	uint8_t* dtarg;
	size_t dtarglen, newlen;
	struct packed_rrset_data* d;

	/* get DNAME target name */
	if(dname->data->count < 1) return 0;
	if(dname->data->rr_len[0] < 3) return 0; /* at least rdatalen +1 */
	dtarg = dname->data->rr_data[0]+2;
	dtarglen = dname->data->rr_len[0]-2;
	if(sldns_read_uint16(dname->data->rr_data[0]) != dtarglen)
	return 0; /* rdatalen in DNAME rdata is malformed */
	if(dname_valid(dtarg, dtarglen) != dtarglen)
	return 0; /* DNAME RR has malformed rdata */

	/* synthesize a CNAME */
	newlen = synth_cname_buf(qname, qname_len, node->namelen,
	dtarg, dtarglen, buf, sizeof(buf));
	if(newlen == 0) {
	/* YXDOMAIN error */
	*cname = NULL;
	return 1;
	}
	cname = (struct ub_packed_rrset_key)regional_alloc(region,
	sizeof(struct ub_packed_rrset_key));
	if(!*cname)
	return 0; /* out of memory */
	memset(&(cname)->entry, 0, sizeof((cname)->entry));
	(cname)->entry.key = (cname);
	(*cname)->rk.type = htons(LDNS_RR_TYPE_CNAME);
	(*cname)->rk.rrset_class = htons(dclass);
	(*cname)->rk.flags = 0;
	(*cname)->rk.dname = regional_alloc_init(region, qname, qname_len);
	if(!(*cname)->rk.dname)
	return 0; /* out of memory */
	(*cname)->rk.dname_len = qname_len;
	(cname)->entry.hash = rrset_key_hash(&(cname)->rk);
	d = (struct packed_rrset_data*)regional_alloc_zero(region,
	sizeof(struct packed_rrset_data) + sizeof(size_t) +
	sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t)
	+ newlen);
	if(!d)
	return 0; /* out of memory */
	(*cname)->entry.data = d;
	d->ttl = 0; /* 0 for synthesized CNAME TTL */
	d->count = 1;
	d->rrsig_count = 0;
	d->trust = rrset_trust_ans_noAA;
	d->rr_len = (size_t)((uint8_t)d +
	sizeof(struct packed_rrset_data));
	d->rr_len[0] = newlen + sizeof(uint16_t);
	packed_rrset_ptr_fixup(d);
	d->rr_ttl[0] = d->ttl;
	sldns_write_uint16(d->rr_data[0], newlen);
	memmove(d->rr_data[0] + sizeof(uint16_t), buf, newlen);
	return 1;
	}

	/** add a synthesized CNAME to the answer section */
	static int
	add_synth_cname(struct auth_zone* z, uint8_t* qname, size_t qname_len,
	struct regional* region, struct dns_msg* msg, struct auth_data* dname,
	struct auth_rrset* rrset)
	{
	struct ub_packed_rrset_key* cname;
	/* synthesize a CNAME */
	if(!create_synth_cname(qname, qname_len, region, dname, rrset,
	z->dclass, &cname)) {
	/* out of memory */
	return 0;
	}
	if(!cname) {
	/* cname cannot be create because of YXDOMAIN */
	msg->rep->flags \|= LDNS_RCODE_YXDOMAIN;
	return 1;
	}
	/* add cname to message */
	if(!msg_grow_array(region, msg))
	return 0;
	msg->rep->rrsets[msg->rep->rrset_count] = cname;
	msg->rep->rrset_count++;
	msg->rep->an_numrrsets++;
	msg_ttl(msg);
	return 1;
	}

	/** Change a dname to a different one, for wildcard namechange */
	static void
	az_change_dnames(struct dns_msg* msg, uint8_t* oldname, uint8_t* newname,
	size_t newlen, int an_only)
	{
	size_t i;
	size_t start = 0, end = msg->rep->rrset_count;
	if(!an_only) start = msg->rep->an_numrrsets;
	if(an_only) end = msg->rep->an_numrrsets;
	for(i=start; i<end; i++) {
	/* allocated in region so we can change the ptrs */
	if(query_dname_compare(msg->rep->rrsets[i]->rk.dname, oldname)
	== 0) {
	msg->rep->rrsets[i]->rk.dname = newname;
	msg->rep->rrsets[i]->rk.dname_len = newlen;
	}
	}
	}

	/** find NSEC record covering the query */
	static struct auth_rrset*
	az_find_nsec_cover(struct auth_zone* z, struct auth_data** node)
	{
	uint8_t* nm = (*node)->name;
	size_t nmlen = (*node)->namelen;
	struct auth_rrset* rrset;
	/* find the NSEC for the smallest-or-equal node */
	/* if node == NULL, we did not find a smaller name. But the zone
	* name is the smallest name and should have an NSEC. So there is
	* no NSEC to return (for a properly signed zone) */
	/* for empty nonterminals, the auth-data node should not exist,
	* and thus we don't need to go rbtree_previous here to find
	* a domain with an NSEC record */
	/* but there could be glue, and if this is node, then it has no NSEC.
	* Go up to find nonglue (previous) NSEC-holding nodes */
	while((rrset=az_domain_rrset(*node, LDNS_RR_TYPE_NSEC)) == NULL) {
	if(dname_is_root(nm)) return NULL;
	if(nmlen == z->namelen) return NULL;
	dname_remove_label(&nm, &nmlen);
	/* adjust node for the nsec rrset to find in /
	*node = az_find_name(z, nm, nmlen);
	}
	return rrset;
	}

	/** Find NSEC and add for wildcard denial */
	static int
	az_nsec_wildcard_denial(struct auth_zone* z, struct regional* region,
	struct dns_msg* msg, uint8_t* cenm, size_t cenmlen)
	{
	struct query_info qinfo;
	int node_exact;
	struct auth_data* node;
	struct auth_rrset* nsec;
	uint8_t wc[LDNS_MAX_DOMAINLEN];
	if(cenmlen+2 > sizeof(wc))
	return 0; /* result would be too long */
	wc[0] = 1; /* length of wildcard label */
	wc[1] = (uint8_t)''; / wildcard label */
	memmove(wc+2, cenm, cenmlen);

	/* we have '.ce' in wc wildcard name buffer /
	/* get nsec cover for that */
	qinfo.qname = wc;
	qinfo.qname_len = cenmlen+2;
	qinfo.qtype = 0;
	qinfo.qclass = 0;
	az_find_domain(z, &qinfo, &node_exact, &node);
	if((nsec=az_find_nsec_cover(z, &node)) != NULL) {
	if(!msg_add_rrset_ns(z, region, msg, node, nsec)) return 0;
	}
	return 1;
	}

	/** Find the NSEC3PARAM rrset (if any) and if true you have the parameters */
	static int
	az_nsec3_param(struct auth_zone* z, int* algo, size_t* iter, uint8_t** salt,
	size_t* saltlen)
	{
	struct auth_data* apex;
	struct auth_rrset* param;
	size_t i;
	apex = az_find_name(z, z->name, z->namelen);
	if(!apex) return 0;
	param = az_domain_rrset(apex, LDNS_RR_TYPE_NSEC3PARAM);
	if(!param \|\| param->data->count==0)
	return 0; /* no RRset or no RRs in rrset */
	/* find out which NSEC3PARAM RR has supported parameters */
	/* skip unknown flags (dynamic signer is recalculating nsec3 chain) */
	for(i=0; i<param->data->count; i++) {
	uint8_t* rdata = param->data->rr_data[i]+2;
	size_t rdatalen = param->data->rr_len[i];
	if(rdatalen < 2+5)
	continue; /* too short */
	if(!nsec3_hash_algo_size_supported((int)(rdata[0])))
	continue; /* unsupported algo */
	if(rdatalen < (size_t)(2+5+(size_t)rdata[4]))
	continue; /* salt missing */
	if((rdata[1]&NSEC3_UNKNOWN_FLAGS)!=0)
	continue; /* unknown flags */
	*algo = (int)(rdata[0]);
	*iter = sldns_read_uint16(rdata+2);
	*saltlen = rdata[4];
	if(*saltlen == 0)
	*salt = NULL;
	else *salt = rdata+5;
	return 1;
	}
	/* no supported params */
	return 0;
	}

	/** Hash a name with nsec3param into buffer, it has zone name appended.
	* return length of hash */
	static size_t
	az_nsec3_hash(uint8_t* buf, size_t buflen, uint8_t* nm, size_t nmlen,
	int algo, size_t iter, uint8_t* salt, size_t saltlen)
	{
	size_t hlen = nsec3_hash_algo_size_supported(algo);
	/* buffer has domain name, nsec3hash, and 256 is for max saltlen
	* (salt has 0-255 length) */
	unsigned char p[LDNS_MAX_DOMAINLEN+1+N3HASHBUFLEN+256];
	size_t i;
	if(nmlen+saltlen > sizeof(p) \|\| hlen+saltlen > sizeof(p))
	return 0;
	if(hlen > buflen)
	return 0; /* somehow too large for destination buffer */
	/* hashfunc(name, salt) */
	memmove(p, nm, nmlen);
	query_dname_tolower(p);
	memmove(p+nmlen, salt, saltlen);
	(void)secalgo_nsec3_hash(algo, p, nmlen+saltlen, (unsigned char*)buf);
	for(i=0; i<iter; i++) {
	/* hashfunc(hash, salt) */
	memmove(p, buf, hlen);
	memmove(p+hlen, salt, saltlen);
	(void)secalgo_nsec3_hash(algo, p, hlen+saltlen,
	(unsigned char*)buf);
	}
	return hlen;
	}

	/** Hash name and return b32encoded hashname for lookup, zone name appended */
	static int
	az_nsec3_hashname(struct auth_zone* z, uint8_t* hashname, size_t* hashnmlen,
	uint8_t* nm, size_t nmlen, int algo, size_t iter, uint8_t* salt,
	size_t saltlen)
	{
	uint8_t hash[N3HASHBUFLEN];
	size_t hlen;
	int ret;
	hlen = az_nsec3_hash(hash, sizeof(hash), nm, nmlen, algo, iter,
	salt, saltlen);
	if(!hlen) return 0;
	/* b32 encode */
	if(hashnmlen < hlen2+1+z->namelen) /* approx b32 as hexb16 */
	return 0;
	ret = sldns_b32_ntop_extended_hex(hash, hlen, (char*)(hashname+1),
	(*hashnmlen)-1);
	if(ret<1)
	return 0;
	hashname[0] = (uint8_t)ret;
	ret++;
	if((*hashnmlen) - ret < z->namelen)
	return 0;
	memmove(hashname+ret, z->name, z->namelen);
	*hashnmlen = z->namelen+(size_t)ret;
	return 1;
	}

	/** Find the datanode that covers the nsec3hash-name */
	static struct auth_data*
	az_nsec3_findnode(struct auth_zone* z, uint8_t* hashnm, size_t hashnmlen)
	{
	struct query_info qinfo;
	struct auth_data* node;
	int node_exact;
	qinfo.qclass = 0;
	qinfo.qtype = 0;
	qinfo.qname = hashnm;
	qinfo.qname_len = hashnmlen;
	/* because canonical ordering and b32 nsec3 ordering are the same.
	* this is a good lookup to find the nsec3 name. */
	az_find_domain(z, &qinfo, &node_exact, &node);
	/* but we may have to skip non-nsec3 nodes */
	/* this may be a lot, the way to speed that up is to have a
	* separate nsec3 tree with nsec3 nodes */
	while(node && (rbnode_type*)node != RBTREE_NULL &&
	!az_domain_rrset(node, LDNS_RR_TYPE_NSEC3)) {
	node = (struct auth_data*)rbtree_previous(&node->node);
	}
	if((rbnode_type*)node == RBTREE_NULL)
	node = NULL;
	return node;
	}

	/** Find cover for hashed(nm, nmlen) (or NULL) */
	static struct auth_data*
	az_nsec3_find_cover(struct auth_zone* z, uint8_t* nm, size_t nmlen,
	int algo, size_t iter, uint8_t* salt, size_t saltlen)
	{
	struct auth_data* node;
	uint8_t hname[LDNS_MAX_DOMAINLEN];
	size_t hlen = sizeof(hname);
	if(!az_nsec3_hashname(z, hname, &hlen, nm, nmlen, algo, iter,
	salt, saltlen))
	return NULL;
	node = az_nsec3_findnode(z, hname, hlen);
	if(node)
	return node;
	/* we did not find any, perhaps because the NSEC3 hash is before
	* the first hash, we have to find the 'last hash' in the zone */
	node = (struct auth_data*)rbtree_last(&z->data);
	while(node && (rbnode_type*)node != RBTREE_NULL &&
	!az_domain_rrset(node, LDNS_RR_TYPE_NSEC3)) {
	node = (struct auth_data*)rbtree_previous(&node->node);
	}
	if((rbnode_type*)node == RBTREE_NULL)
	node = NULL;
	return node;
	}

	/** Find exact match for hashed(nm, nmlen) NSEC3 record or NULL */
	static struct auth_data*
	az_nsec3_find_exact(struct auth_zone* z, uint8_t* nm, size_t nmlen,
	int algo, size_t iter, uint8_t* salt, size_t saltlen)
	{
	struct auth_data* node;
	uint8_t hname[LDNS_MAX_DOMAINLEN];
	size_t hlen = sizeof(hname);
	if(!az_nsec3_hashname(z, hname, &hlen, nm, nmlen, algo, iter,
	salt, saltlen))
	return NULL;
	node = az_find_name(z, hname, hlen);
	if(az_domain_rrset(node, LDNS_RR_TYPE_NSEC3))
	return node;
	return NULL;
	}

	/** Return nextcloser name (as a ref into the qname). This is one label
	* more than the cenm (cename must be a suffix of qname) */
	static void
	az_nsec3_get_nextcloser(uint8_t* cenm, uint8_t* qname, size_t qname_len,
	uint8_t** nx, size_t* nxlen)
	{
	int celabs = dname_count_labels(cenm);
	int qlabs = dname_count_labels(qname);
	int strip = qlabs - celabs -1;
	log_assert(dname_strict_subdomain(qname, qlabs, cenm, celabs));
	*nx = qname;
	*nxlen = qname_len;
	if(strip>0)
	dname_remove_labels(nx, nxlen, strip);
	}

	/** Find the closest encloser that has exact NSEC3.
	* updated cenm to the new name. If it went up no-exact-ce is true. */
	static struct auth_data*
	az_nsec3_find_ce(struct auth_zone* z, uint8_t** cenm, size_t* cenmlen,
	int* no_exact_ce, int algo, size_t iter, uint8_t* salt, size_t saltlen)
	{
	struct auth_data* node;
	while((node = az_nsec3_find_exact(z, cenm, cenmlen,
	algo, iter, salt, saltlen)) == NULL) {
	if(*cenmlen == z->namelen) {
	/* next step up would take us out of the zone. fail */
	return NULL;
	}
	*no_exact_ce = 1;
	dname_remove_label(cenm, cenmlen);
	}
	return node;
	}

	/* Insert NSEC3 record in authority section, if NULL does nothing */
	static int
	az_nsec3_insert(struct auth_zone* z, struct regional* region,
	struct dns_msg* msg, struct auth_data* node)
	{
	struct auth_rrset* nsec3;
	if(!node) return 1; /* no node, skip this */
	nsec3 = az_domain_rrset(node, LDNS_RR_TYPE_NSEC3);
	if(!nsec3) return 1; /* if no nsec3 RR, skip it */
	if(!msg_add_rrset_ns(z, region, msg, node, nsec3)) return 0;
	return 1;
	}

	/** add NSEC3 records to the zone for the nsec3 proof.
	* Specify with the flags with parts of the proof are required.
	* the ce is the exact matching name (for notype) but also delegation points.
	* qname is the one where the nextcloser name can be derived from.
	* If NSEC3 is not properly there (in the zone) nothing is added.
	* always enabled: include nsec3 proving about the Closest Encloser.
	* that is an exact match that should exist for it.
	* If that does not exist, a higher exact match + nxproof is enabled
	* (for some sort of opt-out empty nonterminal cases).
	+ * nodataproof: search for exact match and include that instead.
	+ * ceproof: include ce proof NSEC3 (omitted for wildcard replies).
	* nxproof: include denial of the qname.
	* wcproof: include denial of wildcard (wildcard.ce).
	*/
	static int
	az_add_nsec3_proof(struct auth_zone* z, struct regional* region,
	struct dns_msg* msg, uint8_t* cenm, size_t cenmlen, uint8_t* qname,
	- size_t qname_len, int nxproof, int wcproof)
	+ size_t qname_len, int nodataproof, int ceproof, int nxproof,
	+ int wcproof)
	{
	int algo;
	size_t iter, saltlen;
	uint8_t* salt;
	int no_exact_ce = 0;
	struct auth_data* node;

	/* find parameters of nsec3 proof */
	if(!az_nsec3_param(z, &algo, &iter, &salt, &saltlen))
	return 1; /* no nsec3 */
	+ if(nodataproof) {
	+ /* see if the node has a hash of itself for the nodata
	+ * proof nsec3, this has to be an exact match nsec3. */
	+ struct auth_data* match;
	+ match = az_nsec3_find_exact(z, qname, qname_len, algo,
	+ iter, salt, saltlen);
	+ if(match) {
	+ if(!az_nsec3_insert(z, region, msg, match))
	+ return 0;
	+ /* only nodata NSEC3 needed, no CE or others. */
	+ return 1;
	+ }
	+ }
	/* find ce that has an NSEC3 */
	- node = az_nsec3_find_ce(z, &cenm, &cenmlen, &no_exact_ce,
	- algo, iter, salt, saltlen);
	- if(no_exact_ce) nxproof = 1;
	- if(!az_nsec3_insert(z, region, msg, node))
	- return 0;
	+ if(ceproof) {
	+ node = az_nsec3_find_ce(z, &cenm, &cenmlen, &no_exact_ce,
	+ algo, iter, salt, saltlen);
	+ if(no_exact_ce) nxproof = 1;
	+ if(!az_nsec3_insert(z, region, msg, node))
	+ return 0;
	+ }

	if(nxproof) {
	uint8_t* nx;
	size_t nxlen;
	/* create nextcloser domain name */
	az_nsec3_get_nextcloser(cenm, qname, qname_len, &nx, &nxlen);
	/* find nsec3 that matches or covers it */
	node = az_nsec3_find_cover(z, nx, nxlen, algo, iter, salt,
	saltlen);
	if(!az_nsec3_insert(z, region, msg, node))
	return 0;
	}
	if(wcproof) {
	/* create wildcard name .ce /
	uint8_t wc[LDNS_MAX_DOMAINLEN];
	size_t wclen;
	if(cenmlen+2 > sizeof(wc))
	return 0; /* result would be too long */
	wc[0] = 1; /* length of wildcard label */
	wc[1] = (uint8_t)''; / wildcard label */
	memmove(wc+2, cenm, cenmlen);
	wclen = cenmlen+2;
	/* find nsec3 that matches or covers it */
	node = az_nsec3_find_cover(z, wc, wclen, algo, iter, salt,
	saltlen);
	if(!az_nsec3_insert(z, region, msg, node))
	return 0;
	}
	return 1;
	}

	/** generate answer for positive answer */
	static int
	az_generate_positive_answer(struct auth_zone* z, struct regional* region,
	struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset)
	{
	if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0;
	/* see if we want additional rrs */
	if(rrset->type == LDNS_RR_TYPE_MX) {
	if(!az_add_additionals_from(z, region, msg, rrset, 2))
	return 0;
	} else if(rrset->type == LDNS_RR_TYPE_SRV) {
	if(!az_add_additionals_from(z, region, msg, rrset, 6))
	return 0;
	} else if(rrset->type == LDNS_RR_TYPE_NS) {
	if(!az_add_additionals_from(z, region, msg, rrset, 0))
	return 0;
	}
	return 1;
	}

	/** generate answer for type ANY answer */
	static int
	az_generate_any_answer(struct auth_zone* z, struct regional* region,
	struct dns_msg* msg, struct auth_data* node)
	{
	struct auth_rrset* rrset;
	int added = 0;
	/* add a couple (at least one) RRs */
	if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_SOA)) != NULL) {
	if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0;
	added++;
	}
	if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_MX)) != NULL) {
	if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0;
	added++;
	}
	if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_A)) != NULL) {
	if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0;
	added++;
	}
	if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_AAAA)) != NULL) {
	if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0;
	added++;
	}
	- if(added == 0 && node->rrsets) {
	+ if(added == 0 && node && node->rrsets) {
	if(!msg_add_rrset_an(z, region, msg, node,
	node->rrsets)) return 0;
	}
	return 1;
	}

	/** follow cname chain and add more data to the answer section */
	static int
	follow_cname_chain(struct auth_zone* z, uint16_t qtype,
	struct regional* region, struct dns_msg* msg,
	struct packed_rrset_data* d)
	{
	int maxchain = 0;
	/* see if we can add the target of the CNAME into the answer */
	while(maxchain++ < MAX_CNAME_CHAIN) {
	struct auth_data* node;
	struct auth_rrset* rrset;
	size_t clen;
	/* d has cname rdata */
	if(d->count == 0) break; /* no CNAME */
	if(d->rr_len[0] < 2+1) break; /* too small */
	if((clen=dname_valid(d->rr_data[0]+2, d->rr_len[0]-2))==0)
	break; /* malformed */
	if(!dname_subdomain_c(d->rr_data[0]+2, z->name))
	break; /* target out of zone */
	if((node = az_find_name(z, d->rr_data[0]+2, clen))==NULL)
	break; /* no such target name */
	if((rrset=az_domain_rrset(node, qtype))!=NULL) {
	/* done we found the target */
	if(!msg_add_rrset_an(z, region, msg, node, rrset))
	return 0;
	break;
	}
	if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_CNAME))==NULL)
	break; /* no further CNAME chain, notype */
	if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0;
	d = rrset->data;
	}
	return 1;
	}

	/** generate answer for cname answer */
	static int
	az_generate_cname_answer(struct auth_zone* z, struct query_info* qinfo,
	struct regional* region, struct dns_msg* msg,
	struct auth_data* node, struct auth_rrset* rrset)
	{
	if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0;
	if(!rrset) return 1;
	if(!follow_cname_chain(z, qinfo->qtype, region, msg, rrset->data))
	return 0;
	return 1;
	}

	/** generate answer for notype answer */
	static int
	az_generate_notype_answer(struct auth_zone* z, struct regional* region,
	struct dns_msg* msg, struct auth_data* node)
	{
	struct auth_rrset* rrset;
	if(!az_add_negative_soa(z, region, msg)) return 0;
	/* DNSSEC denial NSEC */
	if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_NSEC))!=NULL) {
	if(!msg_add_rrset_ns(z, region, msg, node, rrset)) return 0;
	} else if(node) {
	/* DNSSEC denial NSEC3 */
	if(!az_add_nsec3_proof(z, region, msg, node->name,
	node->namelen, msg->qinfo.qname,
	- msg->qinfo.qname_len, 0, 0))
	+ msg->qinfo.qname_len, 1, 1, 0, 0))
	return 0;
	}
	return 1;
	}

	/** generate answer for referral answer */
	static int
	az_generate_referral_answer(struct auth_zone* z, struct regional* region,
	struct dns_msg* msg, struct auth_data* ce, struct auth_rrset* rrset)
	{
	struct auth_rrset* ds, *nsec;
	/* turn off AA flag, referral is nonAA because it leaves the zone */
	log_assert(ce);
	msg->rep->flags &= ~BIT_AA;
	if(!msg_add_rrset_ns(z, region, msg, ce, rrset)) return 0;
	/* add DS or deny it */
	if((ds=az_domain_rrset(ce, LDNS_RR_TYPE_DS))!=NULL) {
	if(!msg_add_rrset_ns(z, region, msg, ce, ds)) return 0;
	} else {
	/* deny the DS */
	if((nsec=az_domain_rrset(ce, LDNS_RR_TYPE_NSEC))!=NULL) {
	if(!msg_add_rrset_ns(z, region, msg, ce, nsec))
	return 0;
	} else {
	if(!az_add_nsec3_proof(z, region, msg, ce->name,
	ce->namelen, msg->qinfo.qname,
	- msg->qinfo.qname_len, 0, 0))
	+ msg->qinfo.qname_len, 1, 1, 0, 0))
	return 0;
	}
	}
	/* add additional rrs for type NS */
	if(!az_add_additionals_from(z, region, msg, rrset, 0)) return 0;
	return 1;
	}

	/** generate answer for DNAME answer */
	static int
	az_generate_dname_answer(struct auth_zone* z, struct query_info* qinfo,
	struct regional* region, struct dns_msg* msg, struct auth_data* ce,
	struct auth_rrset* rrset)
	{
	log_assert(ce);
	/* add the DNAME and then a CNAME */
	if(!msg_add_rrset_an(z, region, msg, ce, rrset)) return 0;
	if(!add_synth_cname(z, qinfo->qname, qinfo->qname_len, region,
	msg, ce, rrset)) return 0;
	if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_YXDOMAIN)
	return 1;
	if(msg->rep->rrset_count == 0 \|\|
	!msg->rep->rrsets[msg->rep->rrset_count-1])
	return 0;
	if(!follow_cname_chain(z, qinfo->qtype, region, msg,
	(struct packed_rrset_data*)msg->rep->rrsets[
	msg->rep->rrset_count-1]->entry.data))
	return 0;
	return 1;
	}

	/** generate answer for wildcard answer */
	static int
	az_generate_wildcard_answer(struct auth_zone* z, struct query_info* qinfo,
	struct regional* region, struct dns_msg* msg, struct auth_data* ce,
	struct auth_data* wildcard, struct auth_data* node)
	{
	struct auth_rrset* rrset, *nsec;
	+ int insert_ce = 0;
	if((rrset=az_domain_rrset(wildcard, qinfo->qtype)) != NULL) {
	/* wildcard has type, add it */
	if(!msg_add_rrset_an(z, region, msg, wildcard, rrset))
	return 0;
	az_change_dnames(msg, wildcard->name, msg->qinfo.qname,
	msg->qinfo.qname_len, 1);
	} else if((rrset=az_domain_rrset(wildcard, LDNS_RR_TYPE_CNAME))!=NULL) {
	/* wildcard has cname instead, do that */
	if(!msg_add_rrset_an(z, region, msg, wildcard, rrset))
	return 0;
	az_change_dnames(msg, wildcard->name, msg->qinfo.qname,
	msg->qinfo.qname_len, 1);
	if(!follow_cname_chain(z, qinfo->qtype, region, msg,
	rrset->data))
	return 0;
	} else if(qinfo->qtype == LDNS_RR_TYPE_ANY && wildcard->rrsets) {
	/* add ANY rrsets from wildcard node */
	if(!az_generate_any_answer(z, region, msg, wildcard))
	return 0;
	az_change_dnames(msg, wildcard->name, msg->qinfo.qname,
	msg->qinfo.qname_len, 1);
	} else {
	/* wildcard has nodata, notype answer */
	/* call other notype routine for dnssec notype denials */
	if(!az_generate_notype_answer(z, region, msg, wildcard))
	return 0;
	+ /* because the notype, there is no positive data with an
	+ * RRSIG that indicates the wildcard position. Thus the
	+ * wildcard qname denial needs to have a CE nsec3. */
	+ insert_ce = 1;
	}

	/* ce and node for dnssec denial of wildcard original name */
	if((nsec=az_find_nsec_cover(z, &node)) != NULL) {
	if(!msg_add_rrset_ns(z, region, msg, node, nsec)) return 0;
	} else if(ce) {
	- if(!az_add_nsec3_proof(z, region, msg, ce->name,
	- ce->namelen, msg->qinfo.qname,
	- msg->qinfo.qname_len, 1, 0))
	+ uint8_t* wildup = wildcard->name;
	+ size_t wilduplen= wildcard->namelen;
	+ dname_remove_label(&wildup, &wilduplen);
	+ if(!az_add_nsec3_proof(z, region, msg, wildup,
	+ wilduplen, msg->qinfo.qname,
	+ msg->qinfo.qname_len, 0, insert_ce, 1, 0))
	return 0;
	}

	/* fixup name of wildcard from *.zone to qname, use already allocated
	* pointer to msg qname */
	az_change_dnames(msg, wildcard->name, msg->qinfo.qname,
	msg->qinfo.qname_len, 0);
	return 1;
	}

	/** generate answer for nxdomain answer */
	static int
	az_generate_nxdomain_answer(struct auth_zone* z, struct regional* region,
	struct dns_msg* msg, struct auth_data* ce, struct auth_data* node)
	{
	struct auth_rrset* nsec;
	msg->rep->flags \|= LDNS_RCODE_NXDOMAIN;
	if(!az_add_negative_soa(z, region, msg)) return 0;
	if((nsec=az_find_nsec_cover(z, &node)) != NULL) {
	if(!msg_add_rrset_ns(z, region, msg, node, nsec)) return 0;
	if(ce && !az_nsec_wildcard_denial(z, region, msg, ce->name,
	ce->namelen)) return 0;
	} else if(ce) {
	if(!az_add_nsec3_proof(z, region, msg, ce->name,
	ce->namelen, msg->qinfo.qname,
	- msg->qinfo.qname_len, 1, 1))
	+ msg->qinfo.qname_len, 0, 1, 1, 1))
	return 0;
	}
	return 1;
	}

	/** Create answers when an exact match exists for the domain name */
	static int
	az_generate_answer_with_node(struct auth_zone* z, struct query_info* qinfo,
	struct regional* region, struct dns_msg* msg, struct auth_data* node)
	{
	struct auth_rrset* rrset;
	/* positive answer, rrset we are looking for exists */
	if((rrset=az_domain_rrset(node, qinfo->qtype)) != NULL) {
	return az_generate_positive_answer(z, region, msg, node, rrset);
	}
	/* CNAME? */
	if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_CNAME)) != NULL) {
	return az_generate_cname_answer(z, qinfo, region, msg,
	node, rrset);
	}
	/* type ANY ? */
	if(qinfo->qtype == LDNS_RR_TYPE_ANY) {
	return az_generate_any_answer(z, region, msg, node);
	}
	/* NOERROR/NODATA (no such type at domain name) */
	return az_generate_notype_answer(z, region, msg, node);
	}

	/** Generate answer without an existing-node that we can use.
	* So it'll be a referral, DNAME or nxdomain */
	static int
	az_generate_answer_nonexistnode(struct auth_zone* z, struct query_info* qinfo,
	struct regional* region, struct dns_msg* msg, struct auth_data* ce,
	struct auth_rrset* rrset, struct auth_data* node)
	{
	struct auth_data* wildcard;

	/* we do not have an exact matching name (that exists) */
	/* see if we have a NS or DNAME in the ce */
	if(ce && rrset && rrset->type == LDNS_RR_TYPE_NS) {
	return az_generate_referral_answer(z, region, msg, ce, rrset);
	}
	if(ce && rrset && rrset->type == LDNS_RR_TYPE_DNAME) {
	return az_generate_dname_answer(z, qinfo, region, msg, ce,
	rrset);
	}
	/* if there is an empty nonterminal, wildcard and nxdomain don't
	* happen, it is a notype answer */
	if(az_empty_nonterminal(z, qinfo, node)) {
	return az_generate_notype_answer(z, region, msg, node);
	}
	/* see if we have a wildcard under the ce */
	if((wildcard=az_find_wildcard(z, qinfo, ce)) != NULL) {
	return az_generate_wildcard_answer(z, qinfo, region, msg,
	ce, wildcard, node);
	}
	/* generate nxdomain answer */
	return az_generate_nxdomain_answer(z, region, msg, ce, node);
	}

	/** Lookup answer in a zone. */
	static int
	auth_zone_generate_answer(struct auth_zone* z, struct query_info* qinfo,
	struct regional* region, struct dns_msg** msg, int* fallback)
	{
	struct auth_data* node, *ce;
	struct auth_rrset* rrset;
	int node_exact, node_exists;
	/* does the zone want fallback in case of failure? */
	*fallback = z->fallback_enabled;
	if(!(*msg=msg_create(region, qinfo))) return 0;

	/* lookup if there is a matching domain name for the query */
	az_find_domain(z, qinfo, &node_exact, &node);

	/* see if node exists for generating answers from (i.e. not glue and
	* obscured by NS or DNAME or NSEC3-only), and also return the
	* closest-encloser from that, closest node that should be used
	* to generate answers from that is above the query */
	node_exists = az_find_ce(z, qinfo, node, node_exact, &ce, &rrset);

	if(verbosity >= VERB_ALGO) {
	char zname[256], qname[256], nname[256], cename[256],
	tpstr[32], rrstr[32];
	sldns_wire2str_dname_buf(qinfo->qname, qinfo->qname_len, qname,
	sizeof(qname));
	sldns_wire2str_type_buf(qinfo->qtype, tpstr, sizeof(tpstr));
	sldns_wire2str_dname_buf(z->name, z->namelen, zname,
	sizeof(zname));
	if(node)
	sldns_wire2str_dname_buf(node->name, node->namelen,
	nname, sizeof(nname));
	else snprintf(nname, sizeof(nname), "NULL");
	if(ce)
	sldns_wire2str_dname_buf(ce->name, ce->namelen,
	cename, sizeof(cename));
	else snprintf(cename, sizeof(cename), "NULL");
	if(rrset) sldns_wire2str_type_buf(rrset->type, rrstr,
	sizeof(rrstr));
	else snprintf(rrstr, sizeof(rrstr), "NULL");
	log_info("auth_zone %s query %s %s, domain %s %s %s, "
	"ce %s, rrset %s", zname, qname, tpstr, nname,
	(node_exact?"exact":"notexact"),
	(node_exists?"exist":"notexist"), cename, rrstr);
	}

	if(node_exists) {
	/* the node is fine, generate answer from node */
	return az_generate_answer_with_node(z, qinfo, region, *msg,
	node);
	}
	return az_generate_answer_nonexistnode(z, qinfo, region, *msg,
	ce, rrset, node);
	}

	int auth_zones_lookup(struct auth_zones* az, struct query_info* qinfo,
	struct regional* region, struct dns_msg** msg, int* fallback,
	uint8_t* dp_nm, size_t dp_nmlen)
	{
	int r;
	struct auth_zone* z;
	/* find the zone that should contain the answer. */
	lock_rw_rdlock(&az->lock);
	z = auth_zone_find(az, dp_nm, dp_nmlen, qinfo->qclass);
	if(!z) {
	lock_rw_unlock(&az->lock);
	/* no auth zone, fallback to internet */
	*fallback = 1;
	return 0;
	}
	lock_rw_rdlock(&z->lock);
	lock_rw_unlock(&az->lock);

	/* if not for upstream queries, fallback */
	if(!z->for_upstream) {
	lock_rw_unlock(&z->lock);
	*fallback = 1;
	return 0;
	}
	+ if(z->zone_expired) {
	+ *fallback = z->fallback_enabled;
	+ lock_rw_unlock(&z->lock);
	+ return 0;
	+ }
	/* see what answer that zone would generate */
	r = auth_zone_generate_answer(z, qinfo, region, msg, fallback);
	lock_rw_unlock(&z->lock);
	return r;
	}

	/** encode auth answer */
	static void
	auth_answer_encode(struct query_info* qinfo, struct module_env* env,
	struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf,
	struct regional* temp, struct dns_msg* msg)
	{
	uint16_t udpsize;
	udpsize = edns->udp_size;
	edns->edns_version = EDNS_ADVERTISED_VERSION;
	edns->udp_size = EDNS_ADVERTISED_SIZE;
	edns->ext_rcode = 0;
	edns->bits &= EDNS_DO;

	if(!inplace_cb_reply_local_call(env, qinfo, NULL, msg->rep,
	(int)FLAGS_GET_RCODE(msg->rep->flags), edns, repinfo, temp)
	\|\| !reply_info_answer_encode(qinfo, msg->rep,
	(uint16_t)sldns_buffer_begin(buf),
	sldns_buffer_read_u16_at(buf, 2),
	buf, 0, 0, temp, udpsize, edns,
	(int)(edns->bits&EDNS_DO), 0)) {
	error_encode(buf, (LDNS_RCODE_SERVFAIL\|BIT_AA), qinfo,
	(uint16_t)sldns_buffer_begin(buf),
	sldns_buffer_read_u16_at(buf, 2), edns);
	}
	}

	/** encode auth error answer */
	static void
	auth_error_encode(struct query_info* qinfo, struct module_env* env,
	struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf,
	struct regional* temp, int rcode)
	{
	edns->edns_version = EDNS_ADVERTISED_VERSION;
	edns->udp_size = EDNS_ADVERTISED_SIZE;
	edns->ext_rcode = 0;
	edns->bits &= EDNS_DO;

	if(!inplace_cb_reply_local_call(env, qinfo, NULL, NULL,
	rcode, edns, repinfo, temp))
	edns->opt_list = NULL;
	error_encode(buf, rcode\|BIT_AA, qinfo,
	(uint16_t)sldns_buffer_begin(buf),
	sldns_buffer_read_u16_at(buf, 2), edns);
	}

	int auth_zones_answer(struct auth_zones* az, struct module_env* env,
	struct query_info* qinfo, struct edns_data* edns,
	struct comm_reply* repinfo, struct sldns_buffer* buf, struct regional* temp)
	{
	struct dns_msg* msg = NULL;
	struct auth_zone* z;
	int r;
	int fallback = 0;

	lock_rw_rdlock(&az->lock);
	if(!az->have_downstream) {
	/* no downstream auth zones */
	lock_rw_unlock(&az->lock);
	return 0;
	}
	if(qinfo->qtype == LDNS_RR_TYPE_DS) {
	uint8_t* delname = qinfo->qname;
	size_t delnamelen = qinfo->qname_len;
	dname_remove_label(&delname, &delnamelen);
	z = auth_zones_find_zone(az, delname, delnamelen,
	qinfo->qclass);
	} else {
	z = auth_zones_find_zone(az, qinfo->qname, qinfo->qname_len,
	qinfo->qclass);
	}
	if(!z) {
	/* no zone above it */
	lock_rw_unlock(&az->lock);
	return 0;
	}
	lock_rw_rdlock(&z->lock);
	lock_rw_unlock(&az->lock);
	if(!z->for_downstream) {
	lock_rw_unlock(&z->lock);
	return 0;
	}
	+ if(z->zone_expired) {
	+ if(z->fallback_enabled) {
	+ lock_rw_unlock(&z->lock);
	+ return 0;
	+ }
	+ lock_rw_unlock(&z->lock);
	+ lock_rw_wrlock(&az->lock);
	+ az->num_query_down++;
	+ lock_rw_unlock(&az->lock);
	+ auth_error_encode(qinfo, env, edns, repinfo, buf, temp,
	+ LDNS_RCODE_SERVFAIL);
	+ return 1;
	+ }

	/* answer it from zone z */
	r = auth_zone_generate_answer(z, qinfo, temp, &msg, &fallback);
	lock_rw_unlock(&z->lock);
	if(!r && fallback) {
	/* fallback to regular answering (recursive) */
	return 0;
	}
	lock_rw_wrlock(&az->lock);
	az->num_query_down++;
	lock_rw_unlock(&az->lock);

	/* encode answer */
	if(!r)
	auth_error_encode(qinfo, env, edns, repinfo, buf, temp,
	LDNS_RCODE_SERVFAIL);
	else auth_answer_encode(qinfo, env, edns, repinfo, buf, temp, msg);

	return 1;
	}

	int auth_zones_can_fallback(struct auth_zones* az, uint8_t* nm, size_t nmlen,
	uint16_t dclass)
	{
	int r;
	struct auth_zone* z;
	lock_rw_rdlock(&az->lock);
	z = auth_zone_find(az, nm, nmlen, dclass);
	if(!z) {
	lock_rw_unlock(&az->lock);
	/* no such auth zone, fallback */
	return 1;
	}
	lock_rw_rdlock(&z->lock);
	lock_rw_unlock(&az->lock);
	r = z->fallback_enabled \|\| (!z->for_upstream);
	lock_rw_unlock(&z->lock);
	return r;
	}

	int
	auth_zone_parse_notify_serial(sldns_buffer* pkt, uint32_t *serial)
	{
	struct query_info q;
	uint16_t rdlen;
	memset(&q, 0, sizeof(q));
	sldns_buffer_set_position(pkt, 0);
	if(!query_info_parse(&q, pkt)) return 0;
	if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) == 0) return 0;
	/* skip name of RR in answer section */
	if(sldns_buffer_remaining(pkt) < 1) return 0;
	if(pkt_dname_len(pkt) == 0) return 0;
	/* check type */
	if(sldns_buffer_remaining(pkt) < 10 /* type,class,ttl,rdatalen*/)
	return 0;
	if(sldns_buffer_read_u16(pkt) != LDNS_RR_TYPE_SOA) return 0;
	sldns_buffer_skip(pkt, 2); /* class */
	sldns_buffer_skip(pkt, 4); /* ttl */
	rdlen = sldns_buffer_read_u16(pkt); /* rdatalen */
	if(sldns_buffer_remaining(pkt) < rdlen) return 0;
	if(rdlen < 22) return 0; /* bad soa length */
	sldns_buffer_skip(pkt, (ssize_t)(rdlen-20));
	*serial = sldns_buffer_read_u32(pkt);
	/* return true when has serial in answer section */
	return 1;
	}

	/** see if addr appears in the list */
	static int
	addr_in_list(struct auth_addr* list, struct sockaddr_storage* addr,
	socklen_t addrlen)
	{
	struct auth_addr* p;
	for(p=list; p; p=p->next) {
	if(sockaddr_cmp_addr(addr, addrlen, &p->addr, p->addrlen)==0)
	return 1;
	}
	return 0;
	}

	/** check if an address matches a master specification (or one of its
	* addresses in the addr list) */
	static int
	addr_matches_master(struct auth_master* master, struct sockaddr_storage* addr,
	socklen_t addrlen, struct auth_master** fromhost)
	{
	struct sockaddr_storage a;
	socklen_t alen = 0;
	int net = 0;
	if(addr_in_list(master->list, addr, addrlen)) {
	*fromhost = master;
	return 1;
	}
	/* compare address (but not port number, that is the destination
	* port of the master, the port number of the received notify is
	* allowed to by any port on that master) */
	if(extstrtoaddr(master->host, &a, &alen) &&
	sockaddr_cmp_addr(addr, addrlen, &a, alen)==0) {
	*fromhost = master;
	return 1;
	}
	/* prefixes, addr/len, like 10.0.0.0/8 */
	/* not http and has a / and there is one / */
	if(master->allow_notify && !master->http &&
	strchr(master->host, '/') != NULL &&
	strchr(master->host, '/') == strrchr(master->host, '/') &&
	netblockstrtoaddr(master->host, UNBOUND_DNS_PORT, &a, &alen,
	&net) && alen == addrlen) {
	if(addr_in_common(addr, (addr_is_ip6(addr, addrlen)?128:32),
	&a, net, alen) >= net) {
	fromhost = NULL; / prefix does not have destination
	to send the probe or transfer with */
	return 1; /* matches the netblock */
	}
	}
	return 0;
	}

	/** check access list for notifies */
	static int
	az_xfr_allowed_notify(struct auth_xfer* xfr, struct sockaddr_storage* addr,
	socklen_t addrlen, struct auth_master** fromhost)
	{
	struct auth_master* p;
	for(p=xfr->allow_notify_list; p; p=p->next) {
	if(addr_matches_master(p, addr, addrlen, fromhost)) {
	return 1;
	}
	}
	return 0;
	}

	/** see if the serial means the zone has to be updated, i.e. the serial
	* is newer than the zone serial, or we have no zone */
	static int
	xfr_serial_means_update(struct auth_xfer* xfr, uint32_t serial)
	{
	if(!xfr->have_zone)
	return 1; /* no zone, anything is better */
	if(xfr->zone_expired)
	return 1; /* expired, the sent serial is better than expired
	data */
	if(compare_serial(xfr->serial, serial) < 0)
	return 1; /* our serial is smaller than the sent serial,
	the data is newer, fetch it */
	return 0;
	}

	/** note notify serial, updates the notify information in the xfr struct */
	static void
	xfr_note_notify_serial(struct auth_xfer* xfr, int has_serial, uint32_t serial)
	{
	if(xfr->notify_received && xfr->notify_has_serial && has_serial) {
	/* see if this serial is newer */
	if(compare_serial(xfr->notify_serial, serial) < 0)
	xfr->notify_serial = serial;
	} else if(xfr->notify_received && xfr->notify_has_serial &&
	!has_serial) {
	/* remove serial, we have notify without serial */
	xfr->notify_has_serial = 0;
	xfr->notify_serial = 0;
	} else if(xfr->notify_received && !xfr->notify_has_serial) {
	/* we already have notify without serial, keep it
	* that way; no serial check when current operation
	* is done */
	} else {
	xfr->notify_received = 1;
	xfr->notify_has_serial = has_serial;
	xfr->notify_serial = serial;
	}
	}

	/** process a notify serial, start new probe or note serial. xfr is locked */
	static void
	xfr_process_notify(struct auth_xfer* xfr, struct module_env* env,
	int has_serial, uint32_t serial, struct auth_master* fromhost)
	{
	/* if the serial of notify is older than we have, don't fetch
	* a zone, we already have it */
	if(has_serial && !xfr_serial_means_update(xfr, serial)) {
	lock_basic_unlock(&xfr->lock);
	return;
	}
	/* start new probe with this addr src, or note serial */
	if(!xfr_start_probe(xfr, env, fromhost)) {
	/* not started because already in progress, note the serial */
	xfr_note_notify_serial(xfr, has_serial, serial);
	lock_basic_unlock(&xfr->lock);
	}
	/* successful end of start_probe unlocked xfr->lock */
	}

	int auth_zones_notify(struct auth_zones* az, struct module_env* env,
	uint8_t* nm, size_t nmlen, uint16_t dclass,
	struct sockaddr_storage* addr, socklen_t addrlen, int has_serial,
	uint32_t serial, int* refused)
	{
	struct auth_xfer* xfr;
	struct auth_master* fromhost = NULL;
	/* see which zone this is */
	lock_rw_rdlock(&az->lock);
	xfr = auth_xfer_find(az, nm, nmlen, dclass);
	if(!xfr) {
	lock_rw_unlock(&az->lock);
	/* no such zone, refuse the notify */
	*refused = 1;
	return 0;
	}
	lock_basic_lock(&xfr->lock);
	lock_rw_unlock(&az->lock);

	/* check access list for notifies */
	if(!az_xfr_allowed_notify(xfr, addr, addrlen, &fromhost)) {
	lock_basic_unlock(&xfr->lock);
	/* notify not allowed, refuse the notify */
	*refused = 1;
	return 0;
	}

	/* process the notify */
	xfr_process_notify(xfr, env, has_serial, serial, fromhost);
	return 1;
	}

	int auth_zones_startprobesequence(struct auth_zones* az,
	struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t dclass)
	{
	struct auth_xfer* xfr;
	lock_rw_rdlock(&az->lock);
	xfr = auth_xfer_find(az, nm, nmlen, dclass);
	if(!xfr) {
	lock_rw_unlock(&az->lock);
	return 0;
	}
	lock_basic_lock(&xfr->lock);
	lock_rw_unlock(&az->lock);

	xfr_process_notify(xfr, env, 0, 0, NULL);
	return 1;
	}

	/** set a zone expired */
	static void
	auth_xfer_set_expired(struct auth_xfer* xfr, struct module_env* env,
	int expired)
	{
	struct auth_zone* z;

	/* expire xfr */
	lock_basic_lock(&xfr->lock);
	xfr->zone_expired = expired;
	lock_basic_unlock(&xfr->lock);

	/* find auth_zone */
	lock_rw_rdlock(&env->auth_zones->lock);
	z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen,
	xfr->dclass);
	if(!z) {
	lock_rw_unlock(&env->auth_zones->lock);
	return;
	}
	lock_rw_wrlock(&z->lock);
	lock_rw_unlock(&env->auth_zones->lock);

	/* expire auth_zone */
	z->zone_expired = expired;
	lock_rw_unlock(&z->lock);
	}

	/** find master (from notify or probe) in list of masters */
	static struct auth_master*
	find_master_by_host(struct auth_master* list, char* host)
	{
	struct auth_master* p;
	for(p=list; p; p=p->next) {
	if(strcmp(p->host, host) == 0)
	return p;
	}
	return NULL;
	}

	/** delete the looked up auth_addrs for all the masters in the list */
	static void
	xfr_masterlist_free_addrs(struct auth_master* list)
	{
	struct auth_master* m;
	for(m=list; m; m=m->next) {
	if(m->list) {
	auth_free_master_addrs(m->list);
	m->list = NULL;
	}
	}
	}

	/** copy a list of auth_addrs */
	static struct auth_addr*
	auth_addr_list_copy(struct auth_addr* source)
	{
	struct auth_addr* list = NULL, *last = NULL;
	struct auth_addr* p;
	for(p=source; p; p=p->next) {
	struct auth_addr* a = (struct auth_addr)memdup(p, sizeof(p));
	if(!a) {
	log_err("malloc failure");
	auth_free_master_addrs(list);
	return NULL;
	}
	a->next = NULL;
	if(last) last->next = a;
	if(!list) list = a;
	last = a;
	}
	return list;
	}

	/** copy a master to a new structure, NULL on alloc failure */
	static struct auth_master*
	auth_master_copy(struct auth_master* o)
	{
	struct auth_master* m;
	if(!o) return NULL;
	m = (struct auth_master)memdup(o, sizeof(o));
	if(!m) {
	log_err("malloc failure");
	return NULL;
	}
	m->next = NULL;
	if(m->host) {
	m->host = strdup(m->host);
	if(!m->host) {
	free(m);
	log_err("malloc failure");
	return NULL;
	}
	}
	if(m->file) {
	m->file = strdup(m->file);
	if(!m->file) {
	free(m->host);
	free(m);
	log_err("malloc failure");
	return NULL;
	}
	}
	if(m->list) {
	m->list = auth_addr_list_copy(m->list);
	if(!m->list) {
	free(m->file);
	free(m->host);
	free(m);
	return NULL;
	}
	}
	return m;
	}

	/** copy the master addresses from the task_probe lookups to the allow_notify
	* list of masters */
	static void
	probe_copy_masters_for_allow_notify(struct auth_xfer* xfr)
	{
	struct auth_master* list = NULL, *last = NULL;
	struct auth_master* p;
	/* build up new list with copies */
	for(p = xfr->task_probe->masters; p; p=p->next) {
	struct auth_master* m = auth_master_copy(p);
	if(!m) {
	auth_free_masters(list);
	/* failed because of malloc failure, use old list */
	return;
	}
	m->next = NULL;
	if(last) last->next = m;
	if(!list) list = m;
	last = m;
	}
	/* success, replace list */
	auth_free_masters(xfr->allow_notify_list);
	xfr->allow_notify_list = list;
	}

	/** start the lookups for task_transfer */
	static void
	xfr_transfer_start_lookups(struct auth_xfer* xfr)
	{
	/* delete all the looked up addresses in the list */
	xfr_masterlist_free_addrs(xfr->task_transfer->masters);

	/* start lookup at the first master */
	xfr->task_transfer->lookup_target = xfr->task_transfer->masters;
	xfr->task_transfer->lookup_aaaa = 0;
	}

	/** move to the next lookup of hostname for task_transfer */
	static void
	xfr_transfer_move_to_next_lookup(struct auth_xfer* xfr, struct module_env* env)
	{
	if(!xfr->task_transfer->lookup_target)
	return; /* already at end of list */
	if(!xfr->task_transfer->lookup_aaaa && env->cfg->do_ip6) {
	/* move to lookup AAAA */
	xfr->task_transfer->lookup_aaaa = 1;
	return;
	}
	xfr->task_transfer->lookup_target =
	xfr->task_transfer->lookup_target->next;
	xfr->task_transfer->lookup_aaaa = 0;
	if(!env->cfg->do_ip4 && xfr->task_transfer->lookup_target!=NULL)
	xfr->task_transfer->lookup_aaaa = 1;
	}

	/** start the lookups for task_probe */
	static void
	xfr_probe_start_lookups(struct auth_xfer* xfr)
	{
	/* delete all the looked up addresses in the list */
	xfr_masterlist_free_addrs(xfr->task_probe->masters);

	/* start lookup at the first master */
	xfr->task_probe->lookup_target = xfr->task_probe->masters;
	xfr->task_probe->lookup_aaaa = 0;
	}

	/** move to the next lookup of hostname for task_probe */
	static void
	xfr_probe_move_to_next_lookup(struct auth_xfer* xfr, struct module_env* env)
	{
	if(!xfr->task_probe->lookup_target)
	return; /* already at end of list */
	if(!xfr->task_probe->lookup_aaaa && env->cfg->do_ip6) {
	/* move to lookup AAAA */
	xfr->task_probe->lookup_aaaa = 1;
	return;
	}
	xfr->task_probe->lookup_target = xfr->task_probe->lookup_target->next;
	xfr->task_probe->lookup_aaaa = 0;
	if(!env->cfg->do_ip4 && xfr->task_probe->lookup_target!=NULL)
	xfr->task_probe->lookup_aaaa = 1;
	}

	/** start the iteration of the task_transfer list of masters */
	static void
	xfr_transfer_start_list(struct auth_xfer* xfr, struct auth_master* spec)
	{
	if(spec) {
	xfr->task_transfer->scan_specific = find_master_by_host(
	xfr->task_transfer->masters, spec->host);
	if(xfr->task_transfer->scan_specific) {
	xfr->task_transfer->scan_target = NULL;
	xfr->task_transfer->scan_addr = NULL;
	if(xfr->task_transfer->scan_specific->list)
	xfr->task_transfer->scan_addr =
	xfr->task_transfer->scan_specific->list;
	return;
	}
	}
	/* no specific (notified) host to scan */
	xfr->task_transfer->scan_specific = NULL;
	xfr->task_transfer->scan_addr = NULL;
	/* pick up first scan target */
	xfr->task_transfer->scan_target = xfr->task_transfer->masters;
	if(xfr->task_transfer->scan_target && xfr->task_transfer->
	scan_target->list)
	xfr->task_transfer->scan_addr =
	xfr->task_transfer->scan_target->list;
	}

	/** start the iteration of the task_probe list of masters */
	static void
	xfr_probe_start_list(struct auth_xfer* xfr, struct auth_master* spec)
	{
	if(spec) {
	xfr->task_probe->scan_specific = find_master_by_host(
	xfr->task_probe->masters, spec->host);
	if(xfr->task_probe->scan_specific) {
	xfr->task_probe->scan_target = NULL;
	xfr->task_probe->scan_addr = NULL;
	if(xfr->task_probe->scan_specific->list)
	xfr->task_probe->scan_addr =
	xfr->task_probe->scan_specific->list;
	return;
	}
	}
	/* no specific (notified) host to scan */
	xfr->task_probe->scan_specific = NULL;
	xfr->task_probe->scan_addr = NULL;
	/* pick up first scan target */
	xfr->task_probe->scan_target = xfr->task_probe->masters;
	if(xfr->task_probe->scan_target && xfr->task_probe->scan_target->list)
	xfr->task_probe->scan_addr =
	xfr->task_probe->scan_target->list;
	}

	/** pick up the master that is being scanned right now, task_transfer */
	static struct auth_master*
	xfr_transfer_current_master(struct auth_xfer* xfr)
	{
	if(xfr->task_transfer->scan_specific)
	return xfr->task_transfer->scan_specific;
	return xfr->task_transfer->scan_target;
	}

	/** pick up the master that is being scanned right now, task_probe */
	static struct auth_master*
	xfr_probe_current_master(struct auth_xfer* xfr)
	{
	if(xfr->task_probe->scan_specific)
	return xfr->task_probe->scan_specific;
	return xfr->task_probe->scan_target;
	}

	/** true if at end of list, task_transfer */
	static int
	xfr_transfer_end_of_list(struct auth_xfer* xfr)
	{
	return !xfr->task_transfer->scan_specific &&
	!xfr->task_transfer->scan_target;
	}

	/** true if at end of list, task_probe */
	static int
	xfr_probe_end_of_list(struct auth_xfer* xfr)
	{
	return !xfr->task_probe->scan_specific && !xfr->task_probe->scan_target;
	}

	/** move to next master in list, task_transfer */
	static void
	xfr_transfer_nextmaster(struct auth_xfer* xfr)
	{
	if(!xfr->task_transfer->scan_specific &&
	!xfr->task_transfer->scan_target)
	return;
	if(xfr->task_transfer->scan_addr) {
	xfr->task_transfer->scan_addr =
	xfr->task_transfer->scan_addr->next;
	if(xfr->task_transfer->scan_addr)
	return;
	}
	if(xfr->task_transfer->scan_specific) {
	xfr->task_transfer->scan_specific = NULL;
	xfr->task_transfer->scan_target = xfr->task_transfer->masters;
	if(xfr->task_transfer->scan_target && xfr->task_transfer->
	scan_target->list)
	xfr->task_transfer->scan_addr =
	xfr->task_transfer->scan_target->list;
	return;
	}
	if(!xfr->task_transfer->scan_target)
	return;
	xfr->task_transfer->scan_target = xfr->task_transfer->scan_target->next;
	if(xfr->task_transfer->scan_target && xfr->task_transfer->
	scan_target->list)
	xfr->task_transfer->scan_addr =
	xfr->task_transfer->scan_target->list;
	return;
	}

	/** move to next master in list, task_probe */
	static void
	xfr_probe_nextmaster(struct auth_xfer* xfr)
	{
	if(!xfr->task_probe->scan_specific && !xfr->task_probe->scan_target)
	return;
	if(xfr->task_probe->scan_addr) {
	xfr->task_probe->scan_addr = xfr->task_probe->scan_addr->next;
	if(xfr->task_probe->scan_addr)
	return;
	}
	if(xfr->task_probe->scan_specific) {
	xfr->task_probe->scan_specific = NULL;
	xfr->task_probe->scan_target = xfr->task_probe->masters;
	if(xfr->task_probe->scan_target && xfr->task_probe->
	scan_target->list)
	xfr->task_probe->scan_addr =
	xfr->task_probe->scan_target->list;
	return;
	}
	if(!xfr->task_probe->scan_target)
	return;
	xfr->task_probe->scan_target = xfr->task_probe->scan_target->next;
	if(xfr->task_probe->scan_target && xfr->task_probe->
	scan_target->list)
	xfr->task_probe->scan_addr =
	xfr->task_probe->scan_target->list;
	return;
	}

	/** create SOA probe packet for xfr */
	static void
	xfr_create_soa_probe_packet(struct auth_xfer* xfr, sldns_buffer* buf,
	uint16_t id)
	{
	struct query_info qinfo;

	memset(&qinfo, 0, sizeof(qinfo));
	qinfo.qname = xfr->name;
	qinfo.qname_len = xfr->namelen;
	qinfo.qtype = LDNS_RR_TYPE_SOA;
	qinfo.qclass = xfr->dclass;
	qinfo_query_encode(buf, &qinfo);
	sldns_buffer_write_u16_at(buf, 0, id);
	}

	/** create IXFR/AXFR packet for xfr */
	static void
	xfr_create_ixfr_packet(struct auth_xfer* xfr, sldns_buffer* buf, uint16_t id,
	struct auth_master* master)
	{
	struct query_info qinfo;
	uint32_t serial;
	int have_zone;
	have_zone = xfr->have_zone;
	serial = xfr->serial;

	memset(&qinfo, 0, sizeof(qinfo));
	qinfo.qname = xfr->name;
	qinfo.qname_len = xfr->namelen;
	xfr->task_transfer->got_xfr_serial = 0;
	xfr->task_transfer->rr_scan_num = 0;
	xfr->task_transfer->incoming_xfr_serial = 0;
	xfr->task_transfer->on_ixfr_is_axfr = 0;
	xfr->task_transfer->on_ixfr = 1;
	qinfo.qtype = LDNS_RR_TYPE_IXFR;
	if(!have_zone \|\| xfr->task_transfer->ixfr_fail \|\| !master->ixfr) {
	qinfo.qtype = LDNS_RR_TYPE_AXFR;
	xfr->task_transfer->ixfr_fail = 0;
	xfr->task_transfer->on_ixfr = 0;
	}

	qinfo.qclass = xfr->dclass;
	qinfo_query_encode(buf, &qinfo);
	sldns_buffer_write_u16_at(buf, 0, id);

	/* append serial for IXFR */
	if(qinfo.qtype == LDNS_RR_TYPE_IXFR) {
	size_t end = sldns_buffer_limit(buf);
	sldns_buffer_clear(buf);
	sldns_buffer_set_position(buf, end);
	/* auth section count 1 */
	sldns_buffer_write_u16_at(buf, LDNS_NSCOUNT_OFF, 1);
	/* write SOA */
	sldns_buffer_write_u8(buf, 0xC0); /* compressed ptr to qname */
	sldns_buffer_write_u8(buf, 0x0C);
	sldns_buffer_write_u16(buf, LDNS_RR_TYPE_SOA);
	sldns_buffer_write_u16(buf, qinfo.qclass);
	sldns_buffer_write_u32(buf, 0); /* ttl */
	sldns_buffer_write_u16(buf, 22); /* rdata length */
	sldns_buffer_write_u8(buf, 0); /* . */
	sldns_buffer_write_u8(buf, 0); /* . */
	sldns_buffer_write_u32(buf, serial); /* serial */
	sldns_buffer_write_u32(buf, 0); /* refresh */
	sldns_buffer_write_u32(buf, 0); /* retry */
	sldns_buffer_write_u32(buf, 0); /* expire */
	sldns_buffer_write_u32(buf, 0); /* minimum */
	sldns_buffer_flip(buf);
	}
	}

	/** check if returned packet is OK */
	static int
	check_packet_ok(sldns_buffer* pkt, uint16_t qtype, struct auth_xfer* xfr,
	uint32_t* serial)
	{
	/* parse to see if packet worked, valid reply */

	/* check serial number of SOA */
	if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE)
	return 0;

	/* check ID */
	if(LDNS_ID_WIRE(sldns_buffer_begin(pkt)) != xfr->task_probe->id)
	return 0;

	/* check flag bits and rcode */
	if(!LDNS_QR_WIRE(sldns_buffer_begin(pkt)))
	return 0;
	if(LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_QUERY)
	return 0;
	if(LDNS_RCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_RCODE_NOERROR)
	return 0;

	/* check qname */
	if(LDNS_QDCOUNT(sldns_buffer_begin(pkt)) != 1)
	return 0;
	sldns_buffer_skip(pkt, LDNS_HEADER_SIZE);
	if(sldns_buffer_remaining(pkt) < xfr->namelen)
	return 0;
	if(query_dname_compare(sldns_buffer_current(pkt), xfr->name) != 0)
	return 0;
	sldns_buffer_skip(pkt, (ssize_t)xfr->namelen);

	/* check qtype, qclass */
	if(sldns_buffer_remaining(pkt) < 4)
	return 0;
	if(sldns_buffer_read_u16(pkt) != qtype)
	return 0;
	if(sldns_buffer_read_u16(pkt) != xfr->dclass)
	return 0;

	if(serial) {
	uint16_t rdlen;
	/* read serial number, from answer section SOA */
	if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) == 0)
	return 0;
	/* read from first record SOA record */
	if(sldns_buffer_remaining(pkt) < 1)
	return 0;
	if(dname_pkt_compare(pkt, sldns_buffer_current(pkt),
	xfr->name) != 0)
	return 0;
	if(!pkt_dname_len(pkt))
	return 0;
	/* type, class, ttl, rdatalen */
	if(sldns_buffer_remaining(pkt) < 4+4+2)
	return 0;
	if(sldns_buffer_read_u16(pkt) != qtype)
	return 0;
	if(sldns_buffer_read_u16(pkt) != xfr->dclass)
	return 0;
	sldns_buffer_skip(pkt, 4); /* ttl */
	rdlen = sldns_buffer_read_u16(pkt);
	if(sldns_buffer_remaining(pkt) < rdlen)
	return 0;
	if(sldns_buffer_remaining(pkt) < 1)
	return 0;
	if(!pkt_dname_len(pkt)) /* soa name */
	return 0;
	if(sldns_buffer_remaining(pkt) < 1)
	return 0;
	if(!pkt_dname_len(pkt)) /* soa name */
	return 0;
	if(sldns_buffer_remaining(pkt) < 20)
	return 0;
	*serial = sldns_buffer_read_u32(pkt);
	}
	return 1;
	}

	/** read one line from chunks into buffer at current position */
	static int
	chunkline_get_line(struct auth_chunk** chunk, size_t* chunk_pos,
	sldns_buffer* buf)
	{
	int readsome = 0;
	while(*chunk) {
	/* more text in this chunk? */
	if(chunk_pos < (chunk)->len) {
	readsome = 1;
	while(chunk_pos < (chunk)->len) {
	char c = (char)((chunk)->data[chunk_pos]);
	(*chunk_pos)++;
	if(sldns_buffer_remaining(buf) < 2) {
	/* buffer too short */
	verbose(VERB_ALGO, "http chunkline, "
	"line too long");
	return 0;
	}
	sldns_buffer_write_u8(buf, (uint8_t)c);
	if(c == '\n') {
	/* we are done */
	return 1;
	}
	}
	}
	/* move to next chunk */
	chunk = (chunk)->next;
	*chunk_pos = 0;
	}
	/* no more text */
	if(readsome) return 1;
	return 0;
	}

	/** count number of open and closed parenthesis in a chunkline */
	static int
	chunkline_count_parens(sldns_buffer* buf, size_t start)
	{
	size_t end = sldns_buffer_position(buf);
	size_t i;
	int count = 0;
	int squote = 0, dquote = 0;
	for(i=start; i<end; i++) {
	char c = (char)sldns_buffer_read_u8_at(buf, i);
	if(squote && c != '\'') continue;
	if(dquote && c != '"') continue;
	if(c == '"')
	dquote = !dquote; /* skip quoted part */
	else if(c == '\'')
	squote = !squote; /* skip quoted part */
	else if(c == '(')
	count ++;
	else if(c == ')')
	count --;
	else if(c == ';') {
	/* rest is a comment */
	return count;
	}
	}
	return count;
	}

	/** remove trailing ;... comment from a line in the chunkline buffer */
	static void
	chunkline_remove_trailcomment(sldns_buffer* buf, size_t start)
	{
	size_t end = sldns_buffer_position(buf);
	size_t i;
	int squote = 0, dquote = 0;
	for(i=start; i<end; i++) {
	char c = (char)sldns_buffer_read_u8_at(buf, i);
	if(squote && c != '\'') continue;
	if(dquote && c != '"') continue;
	if(c == '"')
	dquote = !dquote; /* skip quoted part */
	else if(c == '\'')
	squote = !squote; /* skip quoted part */
	else if(c == ';') {
	/* rest is a comment */
	sldns_buffer_set_position(buf, i);
	return;
	}
	}
	/* nothing to remove */
	}

	/** see if a chunkline is a comment line (or empty line) */
	static int
	chunkline_is_comment_line_or_empty(sldns_buffer* buf)
	{
	size_t i, end = sldns_buffer_limit(buf);
	for(i=0; i<end; i++) {
	char c = (char)sldns_buffer_read_u8_at(buf, i);
	if(c == ';')
	return 1; /* comment */
	else if(c != ' ' && c != '\t' && c != '\r' && c != '\n')
	return 0; /* not a comment */
	}
	return 1; /* empty */
	}

	/** find a line with ( ) collated */
	static int
	chunkline_get_line_collated(struct auth_chunk** chunk, size_t* chunk_pos,
	sldns_buffer* buf)
	{
	size_t pos;
	int parens = 0;
	sldns_buffer_clear(buf);
	pos = sldns_buffer_position(buf);
	if(!chunkline_get_line(chunk, chunk_pos, buf)) {
	if(sldns_buffer_position(buf) < sldns_buffer_limit(buf))
	sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0);
	else sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf)-1, 0);
	sldns_buffer_flip(buf);
	return 0;
	}
	parens += chunkline_count_parens(buf, pos);
	while(parens > 0) {
	chunkline_remove_trailcomment(buf, pos);
	pos = sldns_buffer_position(buf);
	if(!chunkline_get_line(chunk, chunk_pos, buf)) {
	if(sldns_buffer_position(buf) < sldns_buffer_limit(buf))
	sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0);
	else sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf)-1, 0);
	sldns_buffer_flip(buf);
	return 0;
	}
	parens += chunkline_count_parens(buf, pos);
	}

	if(sldns_buffer_remaining(buf) < 1) {
	verbose(VERB_ALGO, "http chunkline: "
	"line too long");
	return 0;
	}
	sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0);
	sldns_buffer_flip(buf);
	return 1;
	}

	/** process $ORIGIN for http */
	static int
	http_parse_origin(sldns_buffer* buf, struct sldns_file_parse_state* pstate)
	{
	char* line = (char*)sldns_buffer_begin(buf);
	if(strncmp(line, "$ORIGIN", 7) == 0 &&
	isspace((unsigned char)line[7])) {
	int s;
	pstate->origin_len = sizeof(pstate->origin);
	s = sldns_str2wire_dname_buf(sldns_strip_ws(line+8),
	pstate->origin, &pstate->origin_len);
	if(s) pstate->origin_len = 0;
	return 1;
	}
	return 0;
	}

	/** process $TTL for http */
	static int
	http_parse_ttl(sldns_buffer* buf, struct sldns_file_parse_state* pstate)
	{
	char* line = (char*)sldns_buffer_begin(buf);
	if(strncmp(line, "$TTL", 4) == 0 &&
	isspace((unsigned char)line[4])) {
	const char* end = NULL;
	pstate->default_ttl = sldns_str2period(
	sldns_strip_ws(line+5), &end);
	return 1;
	}
	return 0;
	}

	/** find noncomment RR line in chunks, collates lines if ( ) format */
	static int
	chunkline_non_comment_RR(struct auth_chunk** chunk, size_t* chunk_pos,
	sldns_buffer* buf, struct sldns_file_parse_state* pstate)
	{
	while(chunkline_get_line_collated(chunk, chunk_pos, buf)) {
	if(chunkline_is_comment_line_or_empty(buf)) {
	/* a comment, go to next line */
	continue;
	}
	if(http_parse_origin(buf, pstate)) {
	continue; /* $ORIGIN has been handled */
	}
	if(http_parse_ttl(buf, pstate)) {
	continue; /* $TTL has been handled */
	}
	return 1;
	}
	/* no noncomments, fail */
	return 0;
	}

	/** check syntax of chunklist zonefile, parse first RR, return false on
	* failure and return a string in the scratch buffer (first RR string)
	* on failure. */
	static int
	http_zonefile_syntax_check(struct auth_xfer* xfr, sldns_buffer* buf)
	{
	uint8_t rr[LDNS_RR_BUF_SIZE];
	size_t rr_len, dname_len = 0;
	struct sldns_file_parse_state pstate;
	struct auth_chunk* chunk;
	size_t chunk_pos;
	int e;
	memset(&pstate, 0, sizeof(pstate));
	pstate.default_ttl = 3600;
	if(xfr->namelen < sizeof(pstate.origin)) {
	pstate.origin_len = xfr->namelen;
	memmove(pstate.origin, xfr->name, xfr->namelen);
	}
	chunk = xfr->task_transfer->chunks_first;
	chunk_pos = 0;
	if(!chunkline_non_comment_RR(&chunk, &chunk_pos, buf, &pstate)) {
	return 0;
	}
	rr_len = sizeof(rr);
	e=sldns_str2wire_rr_buf((char*)sldns_buffer_begin(buf), rr, &rr_len,
	&dname_len, pstate.default_ttl,
	pstate.origin_len?pstate.origin:NULL, pstate.origin_len,
	pstate.prev_rr_len?pstate.prev_rr:NULL, pstate.prev_rr_len);
	if(e != 0) {
	log_err("parse failure on first RR[%d]: %s",
	LDNS_WIREPARSE_OFFSET(e),
	sldns_get_errorstr_parse(LDNS_WIREPARSE_ERROR(e)));
	return 0;
	}
	/* check that class is correct */
	if(sldns_wirerr_get_class(rr, rr_len, dname_len) != xfr->dclass) {
	log_err("parse failure: first record in downloaded zonefile "
	"from wrong RR class");
	return 0;
	}
	return 1;
	}

	/** sum sizes of chunklist */
	static size_t
	chunklist_sum(struct auth_chunk* list)
	{
	struct auth_chunk* p;
	size_t s = 0;
	for(p=list; p; p=p->next) {
	s += p->len;
	}
	return s;
	}

	/** remove newlines from collated line */
	static void
	chunkline_newline_removal(sldns_buffer* buf)
	{
	size_t i, end=sldns_buffer_limit(buf);
	for(i=0; i<end; i++) {
	char c = (char)sldns_buffer_read_u8_at(buf, i);
	if(c == '\n' && i==end-1) {
	sldns_buffer_write_u8_at(buf, i, 0);
	sldns_buffer_set_limit(buf, end-1);
	return;
	}
	if(c == '\n')
	sldns_buffer_write_u8_at(buf, i, (uint8_t)' ');
	}
	}

	/** for http download, parse and add RR to zone */
	static int
	http_parse_add_rr(struct auth_xfer* xfr, struct auth_zone* z,
	sldns_buffer* buf, struct sldns_file_parse_state* pstate)
	{
	uint8_t rr[LDNS_RR_BUF_SIZE];
	size_t rr_len, dname_len = 0;
	int e;
	char* line = (char*)sldns_buffer_begin(buf);
	rr_len = sizeof(rr);
	e = sldns_str2wire_rr_buf(line, rr, &rr_len, &dname_len,
	pstate->default_ttl,
	pstate->origin_len?pstate->origin:NULL, pstate->origin_len,
	pstate->prev_rr_len?pstate->prev_rr:NULL, pstate->prev_rr_len);
	if(e != 0) {
	log_err("%s/%s parse failure RR[%d]: %s in '%s'",
	xfr->task_transfer->master->host,
	xfr->task_transfer->master->file,
	LDNS_WIREPARSE_OFFSET(e),
	sldns_get_errorstr_parse(LDNS_WIREPARSE_ERROR(e)),
	line);
	return 0;
	}
	if(rr_len == 0)
	return 1; /* empty line or so */

	/* set prev */
	if(dname_len < sizeof(pstate->prev_rr)) {
	memmove(pstate->prev_rr, rr, dname_len);
	pstate->prev_rr_len = dname_len;
	}

	return az_insert_rr(z, rr, rr_len, dname_len, NULL);
	}

	/** RR list iterator, returns RRs from answer section one by one from the
	* dns packets in the chunklist */
	static void
	chunk_rrlist_start(struct auth_xfer* xfr, struct auth_chunk** rr_chunk,
	int* rr_num, size_t* rr_pos)
	{
	*rr_chunk = xfr->task_transfer->chunks_first;
	*rr_num = 0;
	*rr_pos = 0;
	}

	/** RR list iterator, see if we are at the end of the list */
	static int
	chunk_rrlist_end(struct auth_chunk* rr_chunk, int rr_num)
	{
	while(rr_chunk) {
	if(rr_chunk->len < LDNS_HEADER_SIZE)
	return 1;
	if(rr_num < (int)LDNS_ANCOUNT(rr_chunk->data))
	return 0;
	/* no more RRs in this chunk */
	/* continue with next chunk, see if it has RRs */
	rr_chunk = rr_chunk->next;
	rr_num = 0;
	}
	return 1;
	}

	/** RR list iterator, move to next RR */
	static void
	chunk_rrlist_gonext(struct auth_chunk** rr_chunk, int* rr_num,
	size_t* rr_pos, size_t rr_nextpos)
	{
	/* already at end of chunks? */
	if(!*rr_chunk)
	return;
	/* move within this chunk */
	if((*rr_chunk)->len >= LDNS_HEADER_SIZE &&
	(rr_num)+1 < (int)LDNS_ANCOUNT((rr_chunk)->data)) {
	(*rr_num) += 1;
	*rr_pos = rr_nextpos;
	return;
	}
	/* no more RRs in this chunk */
	/* continue with next chunk, see if it has RRs */
	if(*rr_chunk)
	rr_chunk = (rr_chunk)->next;
	while(*rr_chunk) {
	*rr_num = 0;
	*rr_pos = 0;
	if((*rr_chunk)->len >= LDNS_HEADER_SIZE &&
	LDNS_ANCOUNT((*rr_chunk)->data) > 0) {
	return;
	}
	rr_chunk = (rr_chunk)->next;
	}
	}

	/** RR iterator, get current RR information, false on parse error */
	static int
	chunk_rrlist_get_current(struct auth_chunk* rr_chunk, int rr_num,
	size_t rr_pos, uint8_t** rr_dname, uint16_t* rr_type,
	uint16_t* rr_class, uint32_t* rr_ttl, uint16_t* rr_rdlen,
	uint8_t** rr_rdata, size_t* rr_nextpos)
	{
	sldns_buffer pkt;
	/* integrity checks on position */
	if(!rr_chunk) return 0;
	if(rr_chunk->len < LDNS_HEADER_SIZE) return 0;
	if(rr_num >= (int)LDNS_ANCOUNT(rr_chunk->data)) return 0;
	if(rr_pos >= rr_chunk->len) return 0;

	/* fetch rr information */
	sldns_buffer_init_frm_data(&pkt, rr_chunk->data, rr_chunk->len);
	if(rr_pos == 0) {
	size_t i;
	/* skip question section */
	sldns_buffer_set_position(&pkt, LDNS_HEADER_SIZE);
	for(i=0; i<LDNS_QDCOUNT(rr_chunk->data); i++) {
	if(pkt_dname_len(&pkt) == 0) return 0;
	if(sldns_buffer_remaining(&pkt) < 4) return 0;
	sldns_buffer_skip(&pkt, 4); /* type and class */
	}
	} else {
	sldns_buffer_set_position(&pkt, rr_pos);
	}
	*rr_dname = sldns_buffer_current(&pkt);
	if(pkt_dname_len(&pkt) == 0) return 0;
	if(sldns_buffer_remaining(&pkt) < 10) return 0;
	*rr_type = sldns_buffer_read_u16(&pkt);
	*rr_class = sldns_buffer_read_u16(&pkt);
	*rr_ttl = sldns_buffer_read_u32(&pkt);
	*rr_rdlen = sldns_buffer_read_u16(&pkt);
	if(sldns_buffer_remaining(&pkt) < (*rr_rdlen)) return 0;
	*rr_rdata = sldns_buffer_current(&pkt);
	sldns_buffer_skip(&pkt, (ssize_t)(*rr_rdlen));
	*rr_nextpos = sldns_buffer_position(&pkt);
	return 1;
	}

	/** print log message where we are in parsing the zone transfer */
	static void
	log_rrlist_position(const char* label, struct auth_chunk* rr_chunk,
	uint8_t* rr_dname, uint16_t rr_type, size_t rr_counter)
	{
	sldns_buffer pkt;
	size_t dlen;
	uint8_t buf[256];
	char str[256];
	char typestr[32];
	sldns_buffer_init_frm_data(&pkt, rr_chunk->data, rr_chunk->len);
	sldns_buffer_set_position(&pkt, (size_t)(rr_dname -
	sldns_buffer_begin(&pkt)));
	if((dlen=pkt_dname_len(&pkt)) == 0) return;
	if(dlen >= sizeof(buf)) return;
	dname_pkt_copy(&pkt, buf, rr_dname);
	dname_str(buf, str);
	(void)sldns_wire2str_type_buf(rr_type, typestr, sizeof(typestr));
	verbose(VERB_ALGO, "%s at[%d] %s %s", label, (int)rr_counter,
	str, typestr);
	}

	/** check that start serial is OK for ixfr. we are at rr_counter == 0,
	* and we are going to check rr_counter == 1 (has to be type SOA) serial */
	static int
	ixfr_start_serial(struct auth_chunk* rr_chunk, int rr_num, size_t rr_pos,
	uint8_t* rr_dname, uint16_t rr_type, uint16_t rr_class,
	uint32_t rr_ttl, uint16_t rr_rdlen, uint8_t* rr_rdata,
	size_t rr_nextpos, uint32_t transfer_serial, uint32_t xfr_serial)
	{
	uint32_t startserial;
	/* move forward on RR */
	chunk_rrlist_gonext(&rr_chunk, &rr_num, &rr_pos, rr_nextpos);
	if(chunk_rrlist_end(rr_chunk, rr_num)) {
	/* no second SOA */
	verbose(VERB_OPS, "IXFR has no second SOA record");
	return 0;
	}
	if(!chunk_rrlist_get_current(rr_chunk, rr_num, rr_pos,
	&rr_dname, &rr_type, &rr_class, &rr_ttl, &rr_rdlen,
	&rr_rdata, &rr_nextpos)) {
	verbose(VERB_OPS, "IXFR cannot parse second SOA record");
	/* failed to parse RR */
	return 0;
	}
	if(rr_type != LDNS_RR_TYPE_SOA) {
	verbose(VERB_OPS, "IXFR second record is not type SOA");
	return 0;
	}
	if(rr_rdlen < 22) {
	verbose(VERB_OPS, "IXFR, second SOA has short rdlength");
	return 0; /* bad SOA rdlen */
	}
	startserial = sldns_read_uint32(rr_rdata+rr_rdlen-20);
	if(startserial == transfer_serial) {
	/* empty AXFR, not an IXFR */
	verbose(VERB_OPS, "IXFR second serial same as first");
	return 0;
	}
	if(startserial != xfr_serial) {
	/* wrong start serial, it does not match the serial in
	* memory */
	verbose(VERB_OPS, "IXFR is from serial %u to %u but %u "
	"in memory, rejecting the zone transfer",
	(unsigned)startserial, (unsigned)transfer_serial,
	(unsigned)xfr_serial);
	return 0;
	}
	/* everything OK in second SOA serial */
	return 1;
	}

	/** apply IXFR to zone in memory. z is locked. false on failure(mallocfail) */
	static int
	apply_ixfr(struct auth_xfer* xfr, struct auth_zone* z,
	struct sldns_buffer* scratch_buffer)
	{
	struct auth_chunk* rr_chunk;
	int rr_num;
	size_t rr_pos;
	uint8_t* rr_dname, *rr_rdata;
	uint16_t rr_type, rr_class, rr_rdlen;
	uint32_t rr_ttl;
	size_t rr_nextpos;
	int have_transfer_serial = 0;
	uint32_t transfer_serial = 0;
	size_t rr_counter = 0;
	int delmode = 0;
	int softfail = 0;

	/* start RR iterator over chunklist of packets */
	chunk_rrlist_start(xfr, &rr_chunk, &rr_num, &rr_pos);
	while(!chunk_rrlist_end(rr_chunk, rr_num)) {
	if(!chunk_rrlist_get_current(rr_chunk, rr_num, rr_pos,
	&rr_dname, &rr_type, &rr_class, &rr_ttl, &rr_rdlen,
	&rr_rdata, &rr_nextpos)) {
	/* failed to parse RR */
	return 0;
	}
	if(verbosity>=7) log_rrlist_position("apply ixfr",
	rr_chunk, rr_dname, rr_type, rr_counter);
	/* twiddle add/del mode and check for start and end */
	if(rr_counter == 0 && rr_type != LDNS_RR_TYPE_SOA)
	return 0;
	if(rr_counter == 1 && rr_type != LDNS_RR_TYPE_SOA) {
	/* this is an AXFR returned from the IXFR master */
	/* but that should already have been detected, by
	* on_ixfr_is_axfr */
	return 0;
	}
	if(rr_type == LDNS_RR_TYPE_SOA) {
	uint32_t serial;
	if(rr_rdlen < 22) return 0; /* bad SOA rdlen */
	serial = sldns_read_uint32(rr_rdata+rr_rdlen-20);
	if(have_transfer_serial == 0) {
	have_transfer_serial = 1;
	transfer_serial = serial;
	delmode = 1; /* gets negated below */
	/* check second RR before going any further */
	if(!ixfr_start_serial(rr_chunk, rr_num, rr_pos,
	rr_dname, rr_type, rr_class, rr_ttl,
	rr_rdlen, rr_rdata, rr_nextpos,
	transfer_serial, xfr->serial)) {
	return 0;
	}
	} else if(transfer_serial == serial) {
	have_transfer_serial++;
	if(rr_counter == 1) {
	/* empty AXFR, with SOA; SOA; */
	/* should have been detected by
	* on_ixfr_is_axfr */
	return 0;
	}
	if(have_transfer_serial == 3) {
	/* see serial three times for end */
	/* eg. IXFR:
	* SOA 3 start
	* SOA 1 second RR, followed by del
	* SOA 2 followed by add
	* SOA 2 followed by del
	* SOA 3 followed by add
	* SOA 3 end */
	/* ended by SOA record */
	xfr->serial = transfer_serial;
	break;
	}
	}
	/* twiddle add/del mode */
	/* switch from delete part to add part and back again
	* just before the soa, it gets deleted and added too
	* this means we switch to delete mode for the final
	* SOA(so skip that one) */
	delmode = !delmode;
	}
	/* process this RR */
	/* if the RR is deleted twice or added twice, then we
	* softfail, and continue with the rest of the IXFR, so
	* that we serve something fairly nice during the refetch */
	if(verbosity>=7) log_rrlist_position((delmode?"del":"add"),
	rr_chunk, rr_dname, rr_type, rr_counter);
	if(delmode) {
	/* delete this RR */
	int nonexist = 0;
	if(!az_remove_rr_decompress(z, rr_chunk->data,
	rr_chunk->len, scratch_buffer, rr_dname,
	rr_type, rr_class, rr_ttl, rr_rdata, rr_rdlen,
	&nonexist)) {
	/* failed, malloc error or so */
	return 0;
	}
	if(nonexist) {
	/* it was removal of a nonexisting RR */
	if(verbosity>=4) log_rrlist_position(
	"IXFR error nonexistent RR",
	rr_chunk, rr_dname, rr_type, rr_counter);
	softfail = 1;
	}
	} else if(rr_counter != 0) {
	/* skip first SOA RR for addition, it is added in
	* the addition part near the end of the ixfr, when
	* that serial is seen the second time. */
	int duplicate = 0;
	/* add this RR */
	if(!az_insert_rr_decompress(z, rr_chunk->data,
	rr_chunk->len, scratch_buffer, rr_dname,
	rr_type, rr_class, rr_ttl, rr_rdata, rr_rdlen,
	&duplicate)) {
	/* failed, malloc error or so */
	return 0;
	}
	if(duplicate) {
	/* it was a duplicate */
	if(verbosity>=4) log_rrlist_position(
	"IXFR error duplicate RR",
	rr_chunk, rr_dname, rr_type, rr_counter);
	softfail = 1;
	}
	}

	rr_counter++;
	chunk_rrlist_gonext(&rr_chunk, &rr_num, &rr_pos, rr_nextpos);
	}
	if(softfail) {
	verbose(VERB_ALGO, "IXFR did not apply cleanly, fetching full zone");
	return 0;
	}
	return 1;
	}

	/** apply AXFR to zone in memory. z is locked. false on failure(mallocfail) */
	static int
	apply_axfr(struct auth_xfer* xfr, struct auth_zone* z,
	struct sldns_buffer* scratch_buffer)
	{
	struct auth_chunk* rr_chunk;
	int rr_num;
	size_t rr_pos;
	uint8_t* rr_dname, *rr_rdata;
	uint16_t rr_type, rr_class, rr_rdlen;
	uint32_t rr_ttl;
	uint32_t serial = 0;
	size_t rr_nextpos;
	size_t rr_counter = 0;
	int have_end_soa = 0;

	/* clear the data tree */
	traverse_postorder(&z->data, auth_data_del, NULL);
	rbtree_init(&z->data, &auth_data_cmp);
	xfr->have_zone = 0;
	xfr->serial = 0;

	/* insert all RRs in to the zone */
	/* insert the SOA only once, skip the last one */
	/* start RR iterator over chunklist of packets */
	chunk_rrlist_start(xfr, &rr_chunk, &rr_num, &rr_pos);
	while(!chunk_rrlist_end(rr_chunk, rr_num)) {
	if(!chunk_rrlist_get_current(rr_chunk, rr_num, rr_pos,
	&rr_dname, &rr_type, &rr_class, &rr_ttl, &rr_rdlen,
	&rr_rdata, &rr_nextpos)) {
	/* failed to parse RR */
	return 0;
	}
	if(verbosity>=7) log_rrlist_position("apply_axfr",
	rr_chunk, rr_dname, rr_type, rr_counter);
	if(rr_type == LDNS_RR_TYPE_SOA) {
	if(rr_counter != 0) {
	/* end of the axfr */
	have_end_soa = 1;
	break;
	}
	if(rr_rdlen < 22) return 0; /* bad SOA rdlen */
	serial = sldns_read_uint32(rr_rdata+rr_rdlen-20);
	}

	/* add this RR */
	if(!az_insert_rr_decompress(z, rr_chunk->data, rr_chunk->len,
	scratch_buffer, rr_dname, rr_type, rr_class, rr_ttl,
	rr_rdata, rr_rdlen, NULL)) {
	/* failed, malloc error or so */
	return 0;
	}

	rr_counter++;
	chunk_rrlist_gonext(&rr_chunk, &rr_num, &rr_pos, rr_nextpos);
	}
	if(!have_end_soa) {
	log_err("no end SOA record for AXFR");
	return 0;
	}

	xfr->serial = serial;
	xfr->have_zone = 1;
	return 1;
	}

	/** apply HTTP to zone in memory. z is locked. false on failure(mallocfail) */
	static int
	apply_http(struct auth_xfer* xfr, struct auth_zone* z,
	struct sldns_buffer* scratch_buffer)
	{
	/* parse data in chunks */
	/* parse RR's and read into memory. ignore $INCLUDE from the
	* downloaded file*/
	struct sldns_file_parse_state pstate;
	struct auth_chunk* chunk;
	size_t chunk_pos;
	memset(&pstate, 0, sizeof(pstate));
	pstate.default_ttl = 3600;
	if(xfr->namelen < sizeof(pstate.origin)) {
	pstate.origin_len = xfr->namelen;
	memmove(pstate.origin, xfr->name, xfr->namelen);
	}

	if(verbosity >= VERB_ALGO)
	verbose(VERB_ALGO, "http download %s of size %d",
	xfr->task_transfer->master->file,
	(int)chunklist_sum(xfr->task_transfer->chunks_first));
	if(xfr->task_transfer->chunks_first && verbosity >= VERB_ALGO) {
	char preview[1024];
	if(xfr->task_transfer->chunks_first->len+1 > sizeof(preview)) {
	memmove(preview, xfr->task_transfer->chunks_first->data,
	sizeof(preview)-1);
	preview[sizeof(preview)-1]=0;
	} else {
	memmove(preview, xfr->task_transfer->chunks_first->data,
	xfr->task_transfer->chunks_first->len);
	preview[xfr->task_transfer->chunks_first->len]=0;
	}
	log_info("auth zone http downloaded content preview: %s",
	preview);
	}

	/* perhaps a little syntax check before we try to apply the data? */
	if(!http_zonefile_syntax_check(xfr, scratch_buffer)) {
	log_err("http download %s/%s does not contain a zonefile, "
	"but got '%s'", xfr->task_transfer->master->host,
	xfr->task_transfer->master->file,
	sldns_buffer_begin(scratch_buffer));
	return 0;
	}

	/* clear the data tree */
	traverse_postorder(&z->data, auth_data_del, NULL);
	rbtree_init(&z->data, &auth_data_cmp);
	xfr->have_zone = 0;
	xfr->serial = 0;

	chunk = xfr->task_transfer->chunks_first;
	chunk_pos = 0;
	pstate.lineno = 0;
	while(chunkline_get_line_collated(&chunk, &chunk_pos, scratch_buffer)) {
	/* process this line */
	pstate.lineno++;
	chunkline_newline_removal(scratch_buffer);
	if(chunkline_is_comment_line_or_empty(scratch_buffer)) {
	continue;
	}
	/* parse line and add RR */
	if(http_parse_origin(scratch_buffer, &pstate)) {
	continue; /* $ORIGIN has been handled */
	}
	if(http_parse_ttl(scratch_buffer, &pstate)) {
	continue; /* $TTL has been handled */
	}
	if(!http_parse_add_rr(xfr, z, scratch_buffer, &pstate)) {
	verbose(VERB_ALGO, "error parsing line [%s:%d] %s",
	xfr->task_transfer->master->file,
	pstate.lineno,
	sldns_buffer_begin(scratch_buffer));
	return 0;
	}
	}
	return 1;
	}

	/** write http chunks to zonefile to create downloaded file */
	static int
	auth_zone_write_chunks(struct auth_xfer* xfr, const char* fname)
	{
	FILE* out;
	struct auth_chunk* p;
	out = fopen(fname, "w");
	if(!out) {
	log_err("could not open %s: %s", fname, strerror(errno));
	return 0;
	}
	for(p = xfr->task_transfer->chunks_first; p ; p = p->next) {
	if(!write_out(out, (char*)p->data, p->len)) {
	log_err("could not write http download to %s", fname);
	fclose(out);
	return 0;
	}
	}
	fclose(out);
	return 1;
	}

	/** write to zonefile after zone has been updated */
	static void
	xfr_write_after_update(struct auth_xfer* xfr, struct module_env* env)
	{
	+ struct config_file* cfg = env->cfg;
	struct auth_zone* z;
	char tmpfile[1024];
	+ char* zfilename;
	lock_basic_unlock(&xfr->lock);

	/* get lock again, so it is a readlock and concurrently queries
	* can be answered */
	lock_rw_rdlock(&env->auth_zones->lock);
	z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen,
	xfr->dclass);
	if(!z) {
	lock_rw_unlock(&env->auth_zones->lock);
	/* the zone is gone, ignore xfr results */
	lock_basic_lock(&xfr->lock);
	return;
	}
	lock_rw_rdlock(&z->lock);
	lock_basic_lock(&xfr->lock);
	lock_rw_unlock(&env->auth_zones->lock);

	- if(z->zonefile == NULL) {
	+ if(z->zonefile == NULL \|\| z->zonefile[0] == 0) {
	lock_rw_unlock(&z->lock);
	/* no write needed, no zonefile set */
	return;
	}
	+ zfilename = z->zonefile;
	+ if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(zfilename,
	+ cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
	+ zfilename += strlen(cfg->chrootdir);

	/* write to tempfile first */
	- if((size_t)strlen(z->zonefile) + 16 > sizeof(tmpfile)) {
	+ if((size_t)strlen(zfilename) + 16 > sizeof(tmpfile)) {
	verbose(VERB_ALGO, "tmpfilename too long, cannot update "
	- " zonefile %s", z->zonefile);
	+ " zonefile %s", zfilename);
	lock_rw_unlock(&z->lock);
	return;
	}
	- snprintf(tmpfile, sizeof(tmpfile), "%s.tmp%u", z->zonefile,
	+ snprintf(tmpfile, sizeof(tmpfile), "%s.tmp%u", zfilename,
	(unsigned)getpid());
	if(xfr->task_transfer->master->http) {
	/* use the stored chunk list to write them */
	if(!auth_zone_write_chunks(xfr, tmpfile)) {
	unlink(tmpfile);
	lock_rw_unlock(&z->lock);
	}
	} else if(!auth_zone_write_file(z, tmpfile)) {
	unlink(tmpfile);
	lock_rw_unlock(&z->lock);
	return;
	}
	- if(rename(tmpfile, z->zonefile) < 0) {
	- log_err("could not rename(%s, %s): %s", tmpfile, z->zonefile,
	+ if(rename(tmpfile, zfilename) < 0) {
	+ log_err("could not rename(%s, %s): %s", tmpfile, zfilename,
	strerror(errno));
	unlink(tmpfile);
	lock_rw_unlock(&z->lock);
	return;
	}
	lock_rw_unlock(&z->lock);
	}

	/** process chunk list and update zone in memory,
	* return false if it did not work */
	static int
	xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env,
	int* ixfr_fail)
	{
	struct auth_zone* z;

	/* obtain locks and structures */
	/* release xfr lock, then, while holding az->lock grab both
	* z->lock and xfr->lock */
	lock_basic_unlock(&xfr->lock);
	lock_rw_rdlock(&env->auth_zones->lock);
	z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen,
	xfr->dclass);
	if(!z) {
	lock_rw_unlock(&env->auth_zones->lock);
	/* the zone is gone, ignore xfr results */
	lock_basic_lock(&xfr->lock);
	return 0;
	}
	lock_rw_wrlock(&z->lock);
	lock_basic_lock(&xfr->lock);
	lock_rw_unlock(&env->auth_zones->lock);

	/* apply data */
	if(xfr->task_transfer->master->http) {
	if(!apply_http(xfr, z, env->scratch_buffer)) {
	lock_rw_unlock(&z->lock);
	verbose(VERB_ALGO, "http from %s: could not store data",
	xfr->task_transfer->master->host);
	return 0;
	}
	} else if(xfr->task_transfer->on_ixfr &&
	!xfr->task_transfer->on_ixfr_is_axfr) {
	if(!apply_ixfr(xfr, z, env->scratch_buffer)) {
	lock_rw_unlock(&z->lock);
	verbose(VERB_ALGO, "xfr from %s: could not store IXFR"
	" data", xfr->task_transfer->master->host);
	*ixfr_fail = 1;
	return 0;
	}
	} else {
	if(!apply_axfr(xfr, z, env->scratch_buffer)) {
	lock_rw_unlock(&z->lock);
	verbose(VERB_ALGO, "xfr from %s: could not store AXFR"
	" data", xfr->task_transfer->master->host);
	return 0;
	}
	}
	xfr->zone_expired = 0;
	z->zone_expired = 0;
	if(!xfr_find_soa(z, xfr)) {
	lock_rw_unlock(&z->lock);
	verbose(VERB_ALGO, "xfr from %s: no SOA in zone after update"
	" (or malformed RR)", xfr->task_transfer->master->host);
	return 0;
	}
	if(xfr->have_zone)
	xfr->lease_time = *env->now;

	/* unlock */
	lock_rw_unlock(&z->lock);

	if(verbosity >= VERB_QUERY && xfr->have_zone) {
	char zname[256];
	dname_str(xfr->name, zname);
	verbose(VERB_QUERY, "auth zone %s updated to serial %u", zname,
	(unsigned)xfr->serial);
	}
	/* see if we need to write to a zonefile */
	xfr_write_after_update(xfr, env);
	return 1;
	}

	/** disown task_transfer. caller must hold xfr.lock */
	static void
	xfr_transfer_disown(struct auth_xfer* xfr)
	{
	+ /* remove timer (from this worker's event base) */
	+ comm_timer_delete(xfr->task_transfer->timer);
	+ xfr->task_transfer->timer = NULL;
	/* remove the commpoint */
	comm_point_delete(xfr->task_transfer->cp);
	xfr->task_transfer->cp = NULL;
	/* we don't own this item anymore */
	xfr->task_transfer->worker = NULL;
	xfr->task_transfer->env = NULL;
	}

	/** lookup a host name for its addresses, if needed */
	static int
	xfr_transfer_lookup_host(struct auth_xfer* xfr, struct module_env* env)
	{
	struct sockaddr_storage addr;
	socklen_t addrlen = 0;
	struct auth_master* master = xfr->task_transfer->lookup_target;
	struct query_info qinfo;
	uint16_t qflags = BIT_RD;
	uint8_t dname[LDNS_MAX_DOMAINLEN+1];
	struct edns_data edns;
	sldns_buffer* buf = env->scratch_buffer;
	if(!master) return 0;
	if(extstrtoaddr(master->host, &addr, &addrlen)) {
	/* not needed, host is in IP addr format */
	return 0;
	}
	if(master->allow_notify)
	return 0; /* allow-notifies are not transferred from, no
	lookup is needed */

	/* use mesh_new_callback to probe for non-addr hosts,
	* and then wait for them to be looked up (in cache, or query) */
	qinfo.qname_len = sizeof(dname);
	if(sldns_str2wire_dname_buf(master->host, dname, &qinfo.qname_len)
	!= 0) {
	log_err("cannot parse host name of master %s", master->host);
	return 0;
	}
	qinfo.qname = dname;
	qinfo.qclass = xfr->dclass;
	qinfo.qtype = LDNS_RR_TYPE_A;
	if(xfr->task_transfer->lookup_aaaa)
	qinfo.qtype = LDNS_RR_TYPE_AAAA;
	qinfo.local_alias = NULL;
	if(verbosity >= VERB_ALGO) {
	- char buf[512];
	+ char buf1[512];
	char buf2[LDNS_MAX_DOMAINLEN+1];
	dname_str(xfr->name, buf2);
	- snprintf(buf, sizeof(buf), "auth zone %s: master lookup"
	+ snprintf(buf1, sizeof(buf1), "auth zone %s: master lookup"
	" for task_transfer", buf2);
	- log_query_info(VERB_ALGO, buf, &qinfo);
	+ log_query_info(VERB_ALGO, buf1, &qinfo);
	}
	edns.edns_present = 1;
	edns.ext_rcode = 0;
	edns.edns_version = 0;
	edns.bits = EDNS_DO;
	edns.opt_list = NULL;
	if(sldns_buffer_capacity(buf) < 65535)
	edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
	else edns.udp_size = 65535;

	/* unlock xfr during mesh_new_callback() because the callback can be
	* called straight away */
	lock_basic_unlock(&xfr->lock);
	if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0,
	&auth_xfer_transfer_lookup_callback, xfr)) {
	lock_basic_lock(&xfr->lock);
	log_err("out of memory lookup up master %s", master->host);
	return 0;
	}
	lock_basic_lock(&xfr->lock);
	return 1;
	}

	/** initiate TCP to the target and fetch zone.
	* returns true if that was successfully started, and timeout setup. */
	static int
	xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env)
	{
	struct sockaddr_storage addr;
	socklen_t addrlen = 0;
	struct auth_master* master = xfr->task_transfer->master;
	+ char *auth_name = NULL;
	+ struct timeval t;
	+ int timeout;
	if(!master) return 0;
	if(master->allow_notify) return 0; /* only for notify */

	/* get master addr */
	if(xfr->task_transfer->scan_addr) {
	addrlen = xfr->task_transfer->scan_addr->addrlen;
	memmove(&addr, &xfr->task_transfer->scan_addr->addr, addrlen);
	} else {
	- if(!extstrtoaddr(master->host, &addr, &addrlen)) {
	+ if(!authextstrtoaddr(master->host, &addr, &addrlen, &auth_name)) {
	/* the ones that are not in addr format are supposed
	* to be looked up. The lookup has failed however,
	* so skip them */
	char zname[255+1];
	dname_str(xfr->name, zname);
	log_err("%s: failed lookup, cannot transfer from master %s",
	zname, master->host);
	return 0;
	}
	}

	/* remove previous TCP connection (if any) */
	if(xfr->task_transfer->cp) {
	comm_point_delete(xfr->task_transfer->cp);
	xfr->task_transfer->cp = NULL;
	}
	+ if(!xfr->task_transfer->timer) {
	+ xfr->task_transfer->timer = comm_timer_create(env->worker_base,
	+ auth_xfer_transfer_timer_callback, xfr);
	+ if(!xfr->task_transfer->timer) {
	+ log_err("malloc failure");
	+ return 0;
	+ }
	+ }
	+ timeout = AUTH_TRANSFER_TIMEOUT;
	+#ifndef S_SPLINT_S
	+ t.tv_sec = timeout/1000;
	+ t.tv_usec = (timeout%1000)*1000;
	+#endif

	if(master->http) {
	/* perform http fetch */
	/* store http port number into sockaddr,
	* unless someone used unbound's host@port notation */
	+ xfr->task_transfer->on_ixfr = 0;
	if(strchr(master->host, '@') == NULL)
	sockaddr_store_port(&addr, addrlen, master->port);
	xfr->task_transfer->cp = outnet_comm_point_for_http(
	env->outnet, auth_xfer_transfer_http_callback, xfr,
	- &addr, addrlen, AUTH_TRANSFER_TIMEOUT, master->ssl,
	- master->host, master->file);
	+ &addr, addrlen, -1, master->ssl, master->host,
	+ master->file);
	if(!xfr->task_transfer->cp) {
	- char zname[255+1];
	+ char zname[255+1], as[256];
	dname_str(xfr->name, zname);
	+ addr_to_str(&addr, addrlen, as, sizeof(as));
	verbose(VERB_ALGO, "cannot create http cp "
	- "connection for %s to %s", zname,
	- master->host);
	+ "connection for %s to %s", zname, as);
	return 0;
	}
	+ comm_timer_set(xfr->task_transfer->timer, &t);
	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1], as[256];
	+ dname_str(xfr->name, zname);
	+ addr_to_str(&addr, addrlen, as, sizeof(as));
	+ verbose(VERB_ALGO, "auth zone %s transfer next HTTP fetch from %s started", zname, as);
	+ }
	return 1;
	}

	/* perform AXFR/IXFR */
	/* set the packet to be written */
	/* create new ID */
	xfr->task_transfer->id = (uint16_t)(ub_random(env->rnd)&0xffff);
	xfr_create_ixfr_packet(xfr, env->scratch_buffer,
	xfr->task_transfer->id, master);

	/* connect on fd */
	xfr->task_transfer->cp = outnet_comm_point_for_tcp(env->outnet,
	auth_xfer_transfer_tcp_callback, xfr, &addr, addrlen,
	- env->scratch_buffer, AUTH_TRANSFER_TIMEOUT);
	+ env->scratch_buffer, -1,
	+ auth_name != NULL, auth_name);
	if(!xfr->task_transfer->cp) {
	- char zname[255+1];
	- dname_str(xfr->name, zname);
	+ char zname[255+1], as[256];
	+ dname_str(xfr->name, zname);
	+ addr_to_str(&addr, addrlen, as, sizeof(as));
	verbose(VERB_ALGO, "cannot create tcp cp connection for "
	- "xfr %s to %s", zname, master->host);
	+ "xfr %s to %s", zname, as);
	return 0;
	}
	+ comm_timer_set(xfr->task_transfer->timer, &t);
	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1], as[256];
	+ dname_str(xfr->name, zname);
	+ addr_to_str(&addr, addrlen, as, sizeof(as));
	+ verbose(VERB_ALGO, "auth zone %s transfer next %s fetch from %s started", zname,
	+ (xfr->task_transfer->on_ixfr?"IXFR":"AXFR"), as);
	+ }
	return 1;
	}

	/** perform next lookup, next transfer TCP, or end and resume wait time task */
	static void
	xfr_transfer_nexttarget_or_end(struct auth_xfer* xfr, struct module_env* env)
	{
	log_assert(xfr->task_transfer->worker == env->worker);

	/* are we performing lookups? */
	while(xfr->task_transfer->lookup_target) {
	if(xfr_transfer_lookup_host(xfr, env)) {
	/* wait for lookup to finish,
	* note that the hostname may be in unbound's cache
	* and we may then get an instant cache response,
	* and that calls the callback just like a full
	* lookup and lookup failures also call callback */
	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1];
	+ dname_str(xfr->name, zname);
	+ verbose(VERB_ALGO, "auth zone %s transfer next target lookup", zname);
	+ }
	lock_basic_unlock(&xfr->lock);
	return;
	}
	xfr_transfer_move_to_next_lookup(xfr, env);
	}

	/* initiate TCP and fetch the zone from the master */
	/* and set timeout on it */
	while(!xfr_transfer_end_of_list(xfr)) {
	xfr->task_transfer->master = xfr_transfer_current_master(xfr);
	if(xfr_transfer_init_fetch(xfr, env)) {
	/* successfully started, wait for callback */
	lock_basic_unlock(&xfr->lock);
	return;
	}
	/* failed to fetch, next master */
	xfr_transfer_nextmaster(xfr);
	}
	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1];
	+ dname_str(xfr->name, zname);
	+ verbose(VERB_ALGO, "auth zone %s transfer failed, wait", zname);
	+ }

	/* we failed to fetch the zone, move to wait task
	* use the shorter retry timeout */
	xfr_transfer_disown(xfr);

	/* pick up the nextprobe task and wait */
	if(xfr->task_nextprobe->worker == NULL)
	xfr_set_timeout(xfr, env, 1, 0);
	lock_basic_unlock(&xfr->lock);
	}

	/** add addrs from A or AAAA rrset to the master */
	static void
	xfr_master_add_addrs(struct auth_master* m, struct ub_packed_rrset_key* rrset,
	uint16_t rrtype)
	{
	size_t i;
	struct packed_rrset_data* data;
	if(!m \|\| !rrset) return;
	if(rrtype != LDNS_RR_TYPE_A && rrtype != LDNS_RR_TYPE_AAAA)
	return;
	data = (struct packed_rrset_data*)rrset->entry.data;
	for(i=0; i<data->count; i++) {
	struct auth_addr* a;
	size_t len = data->rr_len[i] - 2;
	uint8_t* rdata = data->rr_data[i]+2;
	if(rrtype == LDNS_RR_TYPE_A && len != INET_SIZE)
	continue; /* wrong length for A */
	if(rrtype == LDNS_RR_TYPE_AAAA && len != INET6_SIZE)
	continue; /* wrong length for AAAA */

	/* add and alloc it */
	a = (struct auth_addr)calloc(1, sizeof(a));
	if(!a) {
	log_err("out of memory");
	return;
	}
	if(rrtype == LDNS_RR_TYPE_A) {
	struct sockaddr_in* sa;
	a->addrlen = (socklen_t)sizeof(*sa);
	sa = (struct sockaddr_in*)&a->addr;
	sa->sin_family = AF_INET;
	sa->sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
	memmove(&sa->sin_addr, rdata, INET_SIZE);
	} else {
	struct sockaddr_in6* sa;
	a->addrlen = (socklen_t)sizeof(*sa);
	sa = (struct sockaddr_in6*)&a->addr;
	sa->sin6_family = AF_INET6;
	sa->sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
	memmove(&sa->sin6_addr, rdata, INET6_SIZE);
	}
	if(verbosity >= VERB_ALGO) {
	char s[64];
	addr_to_str(&a->addr, a->addrlen, s, sizeof(s));
	verbose(VERB_ALGO, "auth host %s lookup %s",
	m->host, s);
	}
	/* append to list */
	a->next = m->list;
	m->list = a;
	}
	}

	/** callback for task_transfer lookup of host name, of A or AAAA */
	void auth_xfer_transfer_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
	enum sec_status ATTR_UNUSED(sec), char* ATTR_UNUSED(why_bogus),
	int ATTR_UNUSED(was_ratelimited))
	{
	struct auth_xfer* xfr = (struct auth_xfer*)arg;
	struct module_env* env;
	log_assert(xfr->task_transfer);
	lock_basic_lock(&xfr->lock);
	env = xfr->task_transfer->env;
	if(env->outnet->want_to_quit) {
	lock_basic_unlock(&xfr->lock);
	return; /* stop on quit */
	}

	/* process result */
	if(rcode == LDNS_RCODE_NOERROR) {
	uint16_t wanted_qtype = LDNS_RR_TYPE_A;
	struct regional* temp = env->scratch;
	struct query_info rq;
	struct reply_info* rep;
	if(xfr->task_transfer->lookup_aaaa)
	wanted_qtype = LDNS_RR_TYPE_AAAA;
	memset(&rq, 0, sizeof(rq));
	rep = parse_reply_in_temp_region(buf, temp, &rq);
	if(rep && rq.qtype == wanted_qtype &&
	FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR) {
	/* parsed successfully */
	struct ub_packed_rrset_key* answer =
	reply_find_answer_rrset(&rq, rep);
	if(answer) {
	xfr_master_add_addrs(xfr->task_transfer->
	lookup_target, answer, wanted_qtype);
	+ } else {
	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1];
	+ dname_str(xfr->name, zname);
	+ verbose(VERB_ALGO, "auth zone %s host %s type %s transfer lookup has nodata", zname, xfr->task_transfer->lookup_target->host, (xfr->task_transfer->lookup_aaaa?"AAAA":"A"));
	+ }
	}
	+ } else {
	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1];
	+ dname_str(xfr->name, zname);
	+ verbose(VERB_ALGO, "auth zone %s host %s type %s transfer lookup has no answer", zname, xfr->task_transfer->lookup_target->host, (xfr->task_transfer->lookup_aaaa?"AAAA":"A"));
	+ }
	}
	+ } else {
	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1];
	+ dname_str(xfr->name, zname);
	+ verbose(VERB_ALGO, "auth zone %s host %s type %s transfer lookup failed", zname, xfr->task_transfer->lookup_target->host, (xfr->task_transfer->lookup_aaaa?"AAAA":"A"));
	+ }
	}
	if(xfr->task_transfer->lookup_target->list &&
	xfr->task_transfer->lookup_target == xfr_transfer_current_master(xfr))
	xfr->task_transfer->scan_addr = xfr->task_transfer->lookup_target->list;

	/* move to lookup AAAA after A lookup, move to next hostname lookup,
	* or move to fetch the zone, or, if nothing to do, end task_transfer */
	xfr_transfer_move_to_next_lookup(xfr, env);
	xfr_transfer_nexttarget_or_end(xfr, env);
	}

	/** check if xfer (AXFR or IXFR) packet is OK.
	* return false if we lost connection (SERVFAIL, or unreadable).
	* return false if we need to move from IXFR to AXFR, with gonextonfail
	* set to false, so the same master is tried again, but with AXFR.
	* return true if fine to link into data.
	* return true with transferdone=true when the transfer has ended.
	*/
	static int
	check_xfer_packet(sldns_buffer* pkt, struct auth_xfer* xfr,
	int* gonextonfail, int* transferdone)
	{
	uint8_t* wire = sldns_buffer_begin(pkt);
	int i;
	if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) {
	verbose(VERB_ALGO, "xfr to %s failed, packet too small",
	xfr->task_transfer->master->host);
	return 0;
	}
	if(!LDNS_QR_WIRE(wire)) {
	verbose(VERB_ALGO, "xfr to %s failed, packet has no QR flag",
	xfr->task_transfer->master->host);
	return 0;
	}
	if(LDNS_TC_WIRE(wire)) {
	verbose(VERB_ALGO, "xfr to %s failed, packet has TC flag",
	xfr->task_transfer->master->host);
	return 0;
	}
	/* check ID */
	if(LDNS_ID_WIRE(wire) != xfr->task_transfer->id) {
	verbose(VERB_ALGO, "xfr to %s failed, packet wrong ID",
	xfr->task_transfer->master->host);
	return 0;
	}
	if(LDNS_RCODE_WIRE(wire) != LDNS_RCODE_NOERROR) {
	char rcode[32];
	sldns_wire2str_rcode_buf((int)LDNS_RCODE_WIRE(wire), rcode,
	sizeof(rcode));
	/* if we are doing IXFR, check for fallback */
	if(xfr->task_transfer->on_ixfr) {
	if(LDNS_RCODE_WIRE(wire) == LDNS_RCODE_NOTIMPL \|\|
	LDNS_RCODE_WIRE(wire) == LDNS_RCODE_SERVFAIL \|\|
	LDNS_RCODE_WIRE(wire) == LDNS_RCODE_REFUSED \|\|
	LDNS_RCODE_WIRE(wire) == LDNS_RCODE_FORMERR) {
	verbose(VERB_ALGO, "xfr to %s, fallback "
	"from IXFR to AXFR (with rcode %s)",
	xfr->task_transfer->master->host,
	rcode);
	xfr->task_transfer->ixfr_fail = 1;
	*gonextonfail = 0;
	return 0;
	}
	}
	verbose(VERB_ALGO, "xfr to %s failed, packet with rcode %s",
	xfr->task_transfer->master->host, rcode);
	return 0;
	}
	if(LDNS_OPCODE_WIRE(wire) != LDNS_PACKET_QUERY) {
	verbose(VERB_ALGO, "xfr to %s failed, packet with bad opcode",
	xfr->task_transfer->master->host);
	return 0;
	}
	if(LDNS_QDCOUNT(wire) > 1) {
	verbose(VERB_ALGO, "xfr to %s failed, packet has qdcount %d",
	xfr->task_transfer->master->host,
	(int)LDNS_QDCOUNT(wire));
	return 0;
	}

	/* check qname */
	sldns_buffer_set_position(pkt, LDNS_HEADER_SIZE);
	for(i=0; i<(int)LDNS_QDCOUNT(wire); i++) {
	size_t pos = sldns_buffer_position(pkt);
	uint16_t qtype, qclass;
	if(pkt_dname_len(pkt) == 0) {
	verbose(VERB_ALGO, "xfr to %s failed, packet with "
	"malformed dname",
	xfr->task_transfer->master->host);
	return 0;
	}
	if(dname_pkt_compare(pkt, sldns_buffer_at(pkt, pos),
	xfr->name) != 0) {
	verbose(VERB_ALGO, "xfr to %s failed, packet with "
	"wrong qname",
	xfr->task_transfer->master->host);
	return 0;
	}
	if(sldns_buffer_remaining(pkt) < 4) {
	verbose(VERB_ALGO, "xfr to %s failed, packet with "
	"truncated query RR",
	xfr->task_transfer->master->host);
	return 0;
	}
	qtype = sldns_buffer_read_u16(pkt);
	qclass = sldns_buffer_read_u16(pkt);
	if(qclass != xfr->dclass) {
	verbose(VERB_ALGO, "xfr to %s failed, packet with "
	"wrong qclass",
	xfr->task_transfer->master->host);
	return 0;
	}
	if(xfr->task_transfer->on_ixfr) {
	if(qtype != LDNS_RR_TYPE_IXFR) {
	verbose(VERB_ALGO, "xfr to %s failed, packet "
	"with wrong qtype, expected IXFR",
	xfr->task_transfer->master->host);
	return 0;
	}
	} else {
	if(qtype != LDNS_RR_TYPE_AXFR) {
	verbose(VERB_ALGO, "xfr to %s failed, packet "
	"with wrong qtype, expected AXFR",
	xfr->task_transfer->master->host);
	return 0;
	}
	}
	}

	/* check parse of RRs in packet, store first SOA serial
	* to be able to detect last SOA (with that serial) to see if done */
	/* also check for IXFR 'zone up to date' reply */
	for(i=0; i<(int)LDNS_ANCOUNT(wire); i++) {
	size_t pos = sldns_buffer_position(pkt);
	uint16_t tp, rdlen;
	if(pkt_dname_len(pkt) == 0) {
	verbose(VERB_ALGO, "xfr to %s failed, packet with "
	"malformed dname in answer section",
	xfr->task_transfer->master->host);
	return 0;
	}
	if(sldns_buffer_remaining(pkt) < 10) {
	verbose(VERB_ALGO, "xfr to %s failed, packet with "
	"truncated RR",
	xfr->task_transfer->master->host);
	return 0;
	}
	tp = sldns_buffer_read_u16(pkt);
	(void)sldns_buffer_read_u16(pkt); /* class */
	(void)sldns_buffer_read_u32(pkt); /* ttl */
	rdlen = sldns_buffer_read_u16(pkt);
	if(sldns_buffer_remaining(pkt) < rdlen) {
	verbose(VERB_ALGO, "xfr to %s failed, packet with "
	"truncated RR rdata",
	xfr->task_transfer->master->host);
	return 0;
	}

	/* RR parses (haven't checked rdata itself), now look at
	* SOA records to see serial number */
	if(xfr->task_transfer->rr_scan_num == 0 &&
	tp != LDNS_RR_TYPE_SOA) {
	verbose(VERB_ALGO, "xfr to %s failed, packet with "
	"malformed zone transfer, no start SOA",
	xfr->task_transfer->master->host);
	return 0;
	}
	if(xfr->task_transfer->rr_scan_num == 1 &&
	tp != LDNS_RR_TYPE_SOA) {
	/* second RR is not a SOA record, this is not an IXFR
	* the master is replying with an AXFR */
	xfr->task_transfer->on_ixfr_is_axfr = 1;
	}
	if(tp == LDNS_RR_TYPE_SOA) {
	uint32_t serial;
	if(rdlen < 22) {
	verbose(VERB_ALGO, "xfr to %s failed, packet "
	"with SOA with malformed rdata",
	xfr->task_transfer->master->host);
	return 0;
	}
	if(dname_pkt_compare(pkt, sldns_buffer_at(pkt, pos),
	xfr->name) != 0) {
	verbose(VERB_ALGO, "xfr to %s failed, packet "
	"with SOA with wrong dname",
	xfr->task_transfer->master->host);
	return 0;
	}

	/* read serial number of SOA */
	serial = sldns_buffer_read_u32_at(pkt,
	sldns_buffer_position(pkt)+rdlen-20);

	/* check for IXFR 'zone has SOA x' reply */
	if(xfr->task_transfer->on_ixfr &&
	xfr->task_transfer->rr_scan_num == 0 &&
	LDNS_ANCOUNT(wire)==1) {
	verbose(VERB_ALGO, "xfr to %s ended, "
	"IXFR reply that zone has serial %u",
	xfr->task_transfer->master->host,
	(unsigned)serial);
	return 0;
	}

	/* if first SOA, store serial number */
	if(xfr->task_transfer->got_xfr_serial == 0) {
	xfr->task_transfer->got_xfr_serial = 1;
	xfr->task_transfer->incoming_xfr_serial =
	serial;
	verbose(VERB_ALGO, "xfr %s: contains "
	"SOA serial %u",
	xfr->task_transfer->master->host,
	(unsigned)serial);
	/* see if end of AXFR */
	} else if(!xfr->task_transfer->on_ixfr \|\|
	xfr->task_transfer->on_ixfr_is_axfr) {
	/* second SOA with serial is the end
	* for AXFR */
	*transferdone = 1;
	verbose(VERB_ALGO, "xfr %s: last AXFR packet",
	xfr->task_transfer->master->host);
	/* for IXFR, count SOA records with that serial */
	} else if(xfr->task_transfer->incoming_xfr_serial ==
	serial && xfr->task_transfer->got_xfr_serial
	== 1) {
	xfr->task_transfer->got_xfr_serial++;
	/* if not first soa, if serial==firstserial, the
	* third time we are at the end, for IXFR */
	} else if(xfr->task_transfer->incoming_xfr_serial ==
	serial && xfr->task_transfer->got_xfr_serial
	== 2) {
	verbose(VERB_ALGO, "xfr %s: last IXFR packet",
	xfr->task_transfer->master->host);
	*transferdone = 1;
	/* continue parse check, if that succeeds,
	* transfer is done */
	}
	}
	xfr->task_transfer->rr_scan_num++;

	/* skip over RR rdata to go to the next RR */
	sldns_buffer_skip(pkt, (ssize_t)rdlen);
	}

	/* check authority section */
	/* we skip over the RRs checking packet format */
	for(i=0; i<(int)LDNS_NSCOUNT(wire); i++) {
	uint16_t rdlen;
	if(pkt_dname_len(pkt) == 0) {
	verbose(VERB_ALGO, "xfr to %s failed, packet with "
	"malformed dname in authority section",
	xfr->task_transfer->master->host);
	return 0;
	}
	if(sldns_buffer_remaining(pkt) < 10) {
	verbose(VERB_ALGO, "xfr to %s failed, packet with "
	"truncated RR",
	xfr->task_transfer->master->host);
	return 0;
	}
	(void)sldns_buffer_read_u16(pkt); /* type */
	(void)sldns_buffer_read_u16(pkt); /* class */
	(void)sldns_buffer_read_u32(pkt); /* ttl */
	rdlen = sldns_buffer_read_u16(pkt);
	if(sldns_buffer_remaining(pkt) < rdlen) {
	verbose(VERB_ALGO, "xfr to %s failed, packet with "
	"truncated RR rdata",
	xfr->task_transfer->master->host);
	return 0;
	}
	/* skip over RR rdata to go to the next RR */
	sldns_buffer_skip(pkt, (ssize_t)rdlen);
	}

	/* check additional section */
	for(i=0; i<(int)LDNS_ARCOUNT(wire); i++) {
	uint16_t rdlen;
	if(pkt_dname_len(pkt) == 0) {
	verbose(VERB_ALGO, "xfr to %s failed, packet with "
	"malformed dname in additional section",
	xfr->task_transfer->master->host);
	return 0;
	}
	if(sldns_buffer_remaining(pkt) < 10) {
	verbose(VERB_ALGO, "xfr to %s failed, packet with "
	"truncated RR",
	xfr->task_transfer->master->host);
	return 0;
	}
	(void)sldns_buffer_read_u16(pkt); /* type */
	(void)sldns_buffer_read_u16(pkt); /* class */
	(void)sldns_buffer_read_u32(pkt); /* ttl */
	rdlen = sldns_buffer_read_u16(pkt);
	if(sldns_buffer_remaining(pkt) < rdlen) {
	verbose(VERB_ALGO, "xfr to %s failed, packet with "
	"truncated RR rdata",
	xfr->task_transfer->master->host);
	return 0;
	}
	/* skip over RR rdata to go to the next RR */
	sldns_buffer_skip(pkt, (ssize_t)rdlen);
	}

	return 1;
	}

	/** Link the data from this packet into the worklist of transferred data */
	static int
	xfer_link_data(sldns_buffer* pkt, struct auth_xfer* xfr)
	{
	/* alloc it */
	struct auth_chunk* e;
	e = (struct auth_chunk)calloc(1, sizeof(e));
	if(!e) return 0;
	e->next = NULL;
	e->len = sldns_buffer_limit(pkt);
	e->data = memdup(sldns_buffer_begin(pkt), e->len);
	if(!e->data) {
	free(e);
	return 0;
	}

	/* alloc succeeded, link into list */
	if(!xfr->task_transfer->chunks_first)
	xfr->task_transfer->chunks_first = e;
	if(xfr->task_transfer->chunks_last)
	xfr->task_transfer->chunks_last->next = e;
	xfr->task_transfer->chunks_last = e;
	return 1;
	}

	/** task transfer. the list of data is complete. process it and if failed
	* move to next master, if succeeded, end the task transfer */
	static void
	process_list_end_transfer(struct auth_xfer* xfr, struct module_env* env)
	{
	int ixfr_fail = 0;
	if(xfr_process_chunk_list(xfr, env, &ixfr_fail)) {
	/* it worked! */
	auth_chunks_delete(xfr->task_transfer);

	/* we fetched the zone, move to wait task */
	xfr_transfer_disown(xfr);

	if(xfr->notify_received && (!xfr->notify_has_serial \|\|
	(xfr->notify_has_serial &&
	xfr_serial_means_update(xfr, xfr->notify_serial)))) {
	uint32_t sr = xfr->notify_serial;
	int has_sr = xfr->notify_has_serial;
	/* we received a notify while probe/transfer was
	* in progress. start a new probe and transfer */
	xfr->notify_received = 0;
	xfr->notify_has_serial = 0;
	xfr->notify_serial = 0;
	if(!xfr_start_probe(xfr, env, NULL)) {
	/* if we couldn't start it, already in
	* progress; restore notify serial,
	* while xfr still locked */
	xfr->notify_received = 1;
	xfr->notify_has_serial = has_sr;
	xfr->notify_serial = sr;
	lock_basic_unlock(&xfr->lock);
	}
	return;
	} else {
	/* pick up the nextprobe task and wait (normail wait time) */
	if(xfr->task_nextprobe->worker == NULL)
	xfr_set_timeout(xfr, env, 0, 0);
	}
	lock_basic_unlock(&xfr->lock);
	return;
	}
	/* processing failed */
	/* when done, delete data from list */
	auth_chunks_delete(xfr->task_transfer);
	if(ixfr_fail) {
	xfr->task_transfer->ixfr_fail = 1;
	} else {
	xfr_transfer_nextmaster(xfr);
	}
	xfr_transfer_nexttarget_or_end(xfr, env);
	}

	+/** callback for the task_transfer timer */
	+void
	+auth_xfer_transfer_timer_callback(void* arg)
	+{
	+ struct auth_xfer* xfr = (struct auth_xfer*)arg;
	+ struct module_env* env;
	+ int gonextonfail = 1;
	+ log_assert(xfr->task_transfer);
	+ lock_basic_lock(&xfr->lock);
	+ env = xfr->task_transfer->env;
	+ if(env->outnet->want_to_quit) {
	+ lock_basic_unlock(&xfr->lock);
	+ return; /* stop on quit */
	+ }
	+
	+ verbose(VERB_ALGO, "xfr stopped, connection timeout to %s",
	+ xfr->task_transfer->master->host);
	+
	+ /* see if IXFR caused the failure, if so, try AXFR */
	+ if(xfr->task_transfer->on_ixfr) {
	+ xfr->task_transfer->ixfr_possible_timeout_count++;
	+ if(xfr->task_transfer->ixfr_possible_timeout_count >=
	+ NUM_TIMEOUTS_FALLBACK_IXFR) {
	+ verbose(VERB_ALGO, "xfr to %s, fallback "
	+ "from IXFR to AXFR (because of timeouts)",
	+ xfr->task_transfer->master->host);
	+ xfr->task_transfer->ixfr_fail = 1;
	+ gonextonfail = 0;
	+ }
	+ }
	+
	+ /* delete transferred data from list */
	+ auth_chunks_delete(xfr->task_transfer);
	+ comm_point_delete(xfr->task_transfer->cp);
	+ xfr->task_transfer->cp = NULL;
	+ if(gonextonfail)
	+ xfr_transfer_nextmaster(xfr);
	+ xfr_transfer_nexttarget_or_end(xfr, env);
	+}
	+
	/** callback for task_transfer tcp connections */
	int
	auth_xfer_transfer_tcp_callback(struct comm_point* c, void* arg, int err,
	struct comm_reply* ATTR_UNUSED(repinfo))
	{
	struct auth_xfer* xfr = (struct auth_xfer*)arg;
	struct module_env* env;
	int gonextonfail = 1;
	int transferdone = 0;
	log_assert(xfr->task_transfer);
	lock_basic_lock(&xfr->lock);
	env = xfr->task_transfer->env;
	if(env->outnet->want_to_quit) {
	lock_basic_unlock(&xfr->lock);
	return 0; /* stop on quit */
	}
	+ /* stop the timer */
	+ comm_timer_disable(xfr->task_transfer->timer);

	if(err != NETEVENT_NOERROR) {
	/* connection failed, closed, or timeout */
	/* stop this transfer, cleanup
	* and continue task_transfer*/
	verbose(VERB_ALGO, "xfr stopped, connection lost to %s",
	xfr->task_transfer->master->host);
	+
	+ /* see if IXFR caused the failure, if so, try AXFR */
	+ if(xfr->task_transfer->on_ixfr) {
	+ xfr->task_transfer->ixfr_possible_timeout_count++;
	+ if(xfr->task_transfer->ixfr_possible_timeout_count >=
	+ NUM_TIMEOUTS_FALLBACK_IXFR) {
	+ verbose(VERB_ALGO, "xfr to %s, fallback "
	+ "from IXFR to AXFR (because of timeouts)",
	+ xfr->task_transfer->master->host);
	+ xfr->task_transfer->ixfr_fail = 1;
	+ gonextonfail = 0;
	+ }
	+ }
	+
	failed:
	/* delete transferred data from list */
	auth_chunks_delete(xfr->task_transfer);
	comm_point_delete(xfr->task_transfer->cp);
	xfr->task_transfer->cp = NULL;
	- xfr_transfer_nextmaster(xfr);
	+ if(gonextonfail)
	+ xfr_transfer_nextmaster(xfr);
	xfr_transfer_nexttarget_or_end(xfr, env);
	return 0;
	}
	+ /* note that IXFR worked without timeout */
	+ if(xfr->task_transfer->on_ixfr)
	+ xfr->task_transfer->ixfr_possible_timeout_count = 0;

	/* handle returned packet */
	/* if it fails, cleanup and end this transfer */
	/* if it needs to fallback from IXFR to AXFR, do that */
	if(!check_xfer_packet(c->buffer, xfr, &gonextonfail, &transferdone)) {
	goto failed;
	}
	/* if it is good, link it into the list of data */
	/* if the link into list of data fails (malloc fail) cleanup and end */
	if(!xfer_link_data(c->buffer, xfr)) {
	verbose(VERB_ALGO, "xfr stopped to %s, malloc failed",
	xfr->task_transfer->master->host);
	goto failed;
	}
	/* if the transfer is done now, disconnect and process the list */
	if(transferdone) {
	comm_point_delete(xfr->task_transfer->cp);
	xfr->task_transfer->cp = NULL;
	process_list_end_transfer(xfr, env);
	return 0;
	}

	/* if we want to read more messages, setup the commpoint to read
	* a DNS packet, and the timeout */
	lock_basic_unlock(&xfr->lock);
	c->tcp_is_reading = 1;
	sldns_buffer_clear(c->buffer);
	comm_point_start_listening(c, -1, AUTH_TRANSFER_TIMEOUT);
	return 0;
	}

	/** callback for task_transfer http connections */
	int
	auth_xfer_transfer_http_callback(struct comm_point* c, void* arg, int err,
	struct comm_reply* repinfo)
	{
	struct auth_xfer* xfr = (struct auth_xfer*)arg;
	struct module_env* env;
	log_assert(xfr->task_transfer);
	lock_basic_lock(&xfr->lock);
	env = xfr->task_transfer->env;
	if(env->outnet->want_to_quit) {
	lock_basic_unlock(&xfr->lock);
	return 0; /* stop on quit */
	}
	verbose(VERB_ALGO, "auth zone transfer http callback");
	+ /* stop the timer */
	+ comm_timer_disable(xfr->task_transfer->timer);

	if(err != NETEVENT_NOERROR && err != NETEVENT_DONE) {
	/* connection failed, closed, or timeout */
	/* stop this transfer, cleanup
	* and continue task_transfer*/
	verbose(VERB_ALGO, "http stopped, connection lost to %s",
	xfr->task_transfer->master->host);
	failed:
	/* delete transferred data from list */
	auth_chunks_delete(xfr->task_transfer);
	if(repinfo) repinfo->c = NULL; /* signal cp deleted to
	the routine calling this callback */
	comm_point_delete(xfr->task_transfer->cp);
	xfr->task_transfer->cp = NULL;
	xfr_transfer_nextmaster(xfr);
	xfr_transfer_nexttarget_or_end(xfr, env);
	return 0;
	}

	/* if it is good, link it into the list of data */
	/* if the link into list of data fails (malloc fail) cleanup and end */
	if(sldns_buffer_limit(c->buffer) > 0) {
	verbose(VERB_ALGO, "auth zone http queued up %d bytes",
	(int)sldns_buffer_limit(c->buffer));
	if(!xfer_link_data(c->buffer, xfr)) {
	verbose(VERB_ALGO, "http stopped to %s, malloc failed",
	xfr->task_transfer->master->host);
	goto failed;
	}
	}
	/* if the transfer is done now, disconnect and process the list */
	if(err == NETEVENT_DONE) {
	if(repinfo) repinfo->c = NULL; /* signal cp deleted to
	the routine calling this callback */
	comm_point_delete(xfr->task_transfer->cp);
	xfr->task_transfer->cp = NULL;
	process_list_end_transfer(xfr, env);
	return 0;
	}

	/* if we want to read more messages, setup the commpoint to read
	* a DNS packet, and the timeout */
	lock_basic_unlock(&xfr->lock);
	c->tcp_is_reading = 1;
	sldns_buffer_clear(c->buffer);
	comm_point_start_listening(c, -1, AUTH_TRANSFER_TIMEOUT);
	return 0;
	}


	/** start transfer task by this worker , xfr is locked. */
	static void
	xfr_start_transfer(struct auth_xfer* xfr, struct module_env* env,
	struct auth_master* master)
	{
	log_assert(xfr->task_transfer != NULL);
	log_assert(xfr->task_transfer->worker == NULL);
	log_assert(xfr->task_transfer->chunks_first == NULL);
	log_assert(xfr->task_transfer->chunks_last == NULL);
	xfr->task_transfer->worker = env->worker;
	xfr->task_transfer->env = env;

	/* init transfer process */
	/* find that master in the transfer's list of masters? */
	xfr_transfer_start_list(xfr, master);
	/* start lookup for hostnames in transfer master list */
	xfr_transfer_start_lookups(xfr);

	/* initiate TCP, and set timeout on it */
	xfr_transfer_nexttarget_or_end(xfr, env);
	}

	/** disown task_probe. caller must hold xfr.lock */
	static void
	xfr_probe_disown(struct auth_xfer* xfr)
	{
	/* remove timer (from this worker's event base) */
	comm_timer_delete(xfr->task_probe->timer);
	xfr->task_probe->timer = NULL;
	/* remove the commpoint */
	comm_point_delete(xfr->task_probe->cp);
	xfr->task_probe->cp = NULL;
	/* we don't own this item anymore */
	xfr->task_probe->worker = NULL;
	xfr->task_probe->env = NULL;
	}

	/** send the UDP probe to the master, this is part of task_probe */
	static int
	xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
	int timeout)
	{
	struct sockaddr_storage addr;
	socklen_t addrlen = 0;
	struct timeval t;
	/* pick master */
	struct auth_master* master = xfr_probe_current_master(xfr);
	+ char *auth_name = NULL;
	if(!master) return 0;
	if(master->allow_notify) return 0; /* only for notify */
	if(master->http) return 0; /* only masters get SOA UDP probe,
	not urls, if those are in this list */

	/* get master addr */
	if(xfr->task_probe->scan_addr) {
	addrlen = xfr->task_probe->scan_addr->addrlen;
	memmove(&addr, &xfr->task_probe->scan_addr->addr, addrlen);
	} else {
	- if(!extstrtoaddr(master->host, &addr, &addrlen)) {
	+ if(!authextstrtoaddr(master->host, &addr, &addrlen, &auth_name)) {
	/* the ones that are not in addr format are supposed
	* to be looked up. The lookup has failed however,
	* so skip them */
	char zname[255+1];
	dname_str(xfr->name, zname);
	log_err("%s: failed lookup, cannot probe to master %s",
	zname, master->host);
	return 0;
	}
	+ if (auth_name != NULL) {
	+ if (addr.ss_family == AF_INET
	+ && ntohs(((struct sockaddr_in *)&addr)->sin_port)
	+ == env->cfg->ssl_port)
	+ ((struct sockaddr_in *)&addr)->sin_port
	+ = htons(env->cfg->port);
	+ else if (addr.ss_family == AF_INET6
	+ && ntohs(((struct sockaddr_in6 *)&addr)->sin6_port)
	+ == env->cfg->ssl_port)
	+ ((struct sockaddr_in6 *)&addr)->sin6_port
	+ = htons(env->cfg->port);
	+ }
	}

	/* create packet */
	/* create new ID for new probes, but not on timeout retries,
	* this means we'll accept replies to previous retries to same ip */
	if(timeout == AUTH_PROBE_TIMEOUT)
	xfr->task_probe->id = (uint16_t)(ub_random(env->rnd)&0xffff);
	xfr_create_soa_probe_packet(xfr, env->scratch_buffer,
	xfr->task_probe->id);
	+ /* we need to remove the cp if we have a different ip4/ip6 type now */
	+ if(xfr->task_probe->cp &&
	+ ((xfr->task_probe->cp_is_ip6 && !addr_is_ip6(&addr, addrlen)) \|\|
	+ (!xfr->task_probe->cp_is_ip6 && addr_is_ip6(&addr, addrlen)))
	+ ) {
	+ comm_point_delete(xfr->task_probe->cp);
	+ xfr->task_probe->cp = NULL;
	+ }
	if(!xfr->task_probe->cp) {
	+ if(addr_is_ip6(&addr, addrlen))
	+ xfr->task_probe->cp_is_ip6 = 1;
	+ else xfr->task_probe->cp_is_ip6 = 0;
	xfr->task_probe->cp = outnet_comm_point_for_udp(env->outnet,
	auth_xfer_probe_udp_callback, xfr, &addr, addrlen);
	if(!xfr->task_probe->cp) {
	- char zname[255+1];
	+ char zname[255+1], as[256];
	dname_str(xfr->name, zname);
	+ addr_to_str(&addr, addrlen, as, sizeof(as));
	verbose(VERB_ALGO, "cannot create udp cp for "
	- "probe %s to %s", zname, master->host);
	+ "probe %s to %s", zname, as);
	return 0;
	}
	}
	if(!xfr->task_probe->timer) {
	xfr->task_probe->timer = comm_timer_create(env->worker_base,
	auth_xfer_probe_timer_callback, xfr);
	if(!xfr->task_probe->timer) {
	log_err("malloc failure");
	return 0;
	}
	}

	/* send udp packet */
	if(!comm_point_send_udp_msg(xfr->task_probe->cp, env->scratch_buffer,
	(struct sockaddr*)&addr, addrlen)) {
	- char zname[255+1];
	+ char zname[255+1], as[256];
	dname_str(xfr->name, zname);
	+ addr_to_str(&addr, addrlen, as, sizeof(as));
	verbose(VERB_ALGO, "failed to send soa probe for %s to %s",
	- zname, master->host);
	+ zname, as);
	return 0;
	}
	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1], as[256];
	+ dname_str(xfr->name, zname);
	+ addr_to_str(&addr, addrlen, as, sizeof(as));
	+ verbose(VERB_ALGO, "auth zone %s soa probe sent to %s", zname,
	+ as);
	+ }
	xfr->task_probe->timeout = timeout;
	#ifndef S_SPLINT_S
	t.tv_sec = timeout/1000;
	t.tv_usec = (timeout%1000)*1000;
	#endif
	comm_timer_set(xfr->task_probe->timer, &t);

	return 1;
	}

	/** callback for task_probe timer */
	void
	auth_xfer_probe_timer_callback(void* arg)
	{
	struct auth_xfer* xfr = (struct auth_xfer*)arg;
	struct module_env* env;
	log_assert(xfr->task_probe);
	lock_basic_lock(&xfr->lock);
	env = xfr->task_probe->env;
	if(env->outnet->want_to_quit) {
	lock_basic_unlock(&xfr->lock);
	return; /* stop on quit */
	}

	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1];
	+ dname_str(xfr->name, zname);
	+ verbose(VERB_ALGO, "auth zone %s soa probe timeout", zname);
	+ }
	if(xfr->task_probe->timeout <= AUTH_PROBE_TIMEOUT_STOP) {
	/* try again with bigger timeout */
	if(xfr_probe_send_probe(xfr, env, xfr->task_probe->timeout*2)) {
	lock_basic_unlock(&xfr->lock);
	return;
	}
	}
	/* delete commpoint so a new one is created, with a fresh port nr */
	comm_point_delete(xfr->task_probe->cp);
	xfr->task_probe->cp = NULL;

	/* too many timeouts (or fail to send), move to next or end */
	xfr_probe_nextmaster(xfr);
	xfr_probe_send_or_end(xfr, env);
	}

	/** callback for task_probe udp packets */
	int
	auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err,
	struct comm_reply* repinfo)
	{
	struct auth_xfer* xfr = (struct auth_xfer*)arg;
	struct module_env* env;
	log_assert(xfr->task_probe);
	lock_basic_lock(&xfr->lock);
	env = xfr->task_probe->env;
	if(env->outnet->want_to_quit) {
	lock_basic_unlock(&xfr->lock);
	return 0; /* stop on quit */
	}

	/* the comm_point_udp_callback is in a for loop for NUM_UDP_PER_SELECT
	* and we set rep.c=NULL to stop if from looking inside the commpoint*/
	repinfo->c = NULL;
	/* stop the timer */
	comm_timer_disable(xfr->task_probe->timer);

	/* see if we got a packet and what that means */
	if(err == NETEVENT_NOERROR) {
	uint32_t serial = 0;
	if(check_packet_ok(c->buffer, LDNS_RR_TYPE_SOA, xfr,
	&serial)) {
	/* successful lookup */
	if(verbosity >= VERB_ALGO) {
	char buf[256];
	dname_str(xfr->name, buf);
	verbose(VERB_ALGO, "auth zone %s: soa probe "
	"serial is %u", buf, (unsigned)serial);
	}
	/* see if this serial indicates that the zone has
	* to be updated */
	if(xfr_serial_means_update(xfr, serial)) {
	/* if updated, start the transfer task, if needed */
	verbose(VERB_ALGO, "auth_zone updated, start transfer");
	if(xfr->task_transfer->worker == NULL) {
	struct auth_master* master =
	xfr_probe_current_master(xfr);
	/* if we have download URLs use them
	* in preference to this master we
	* just probed the SOA from */
	if(xfr->task_transfer->masters &&
	xfr->task_transfer->masters->http)
	master = NULL;
	xfr_probe_disown(xfr);
	xfr_start_transfer(xfr, env, master);
	return 0;

	}
	/* other tasks are running, we don't do this anymore */
	xfr_probe_disown(xfr);
	lock_basic_unlock(&xfr->lock);
	/* return, we don't sent a reply to this udp packet,
	* and we setup the tasks to do next */
	return 0;
	} else {
	verbose(VERB_ALGO, "auth_zone master reports unchanged soa serial");
	/* we if cannot find updates amongst the
	* masters, this means we then have a new lease
	* on the zone */
	xfr->task_probe->have_new_lease = 1;
	}
	} else {
	if(verbosity >= VERB_ALGO) {
	char buf[256];
	dname_str(xfr->name, buf);
	verbose(VERB_ALGO, "auth zone %s: bad reply to soa probe", buf);
	}
	}
	} else {
	if(verbosity >= VERB_ALGO) {
	char buf[256];
	dname_str(xfr->name, buf);
	verbose(VERB_ALGO, "auth zone %s: soa probe failed", buf);
	}
	}

	/* failed lookup or not an update */
	/* delete commpoint so a new one is created, with a fresh port nr */
	comm_point_delete(xfr->task_probe->cp);
	xfr->task_probe->cp = NULL;

	/* if the result was not a successfull probe, we need
	* to send the next one */
	xfr_probe_nextmaster(xfr);
	xfr_probe_send_or_end(xfr, env);
	return 0;
	}

	/** lookup a host name for its addresses, if needed */
	static int
	xfr_probe_lookup_host(struct auth_xfer* xfr, struct module_env* env)
	{
	struct sockaddr_storage addr;
	socklen_t addrlen = 0;
	struct auth_master* master = xfr->task_probe->lookup_target;
	struct query_info qinfo;
	uint16_t qflags = BIT_RD;
	uint8_t dname[LDNS_MAX_DOMAINLEN+1];
	struct edns_data edns;
	sldns_buffer* buf = env->scratch_buffer;
	if(!master) return 0;
	if(extstrtoaddr(master->host, &addr, &addrlen)) {
	/* not needed, host is in IP addr format */
	return 0;
	}
	if(master->allow_notify && !master->http &&
	strchr(master->host, '/') != NULL &&
	strchr(master->host, '/') == strrchr(master->host, '/')) {
	return 0; /* is IP/prefix format, not something to look up */
	}

	/* use mesh_new_callback to probe for non-addr hosts,
	* and then wait for them to be looked up (in cache, or query) */
	qinfo.qname_len = sizeof(dname);
	if(sldns_str2wire_dname_buf(master->host, dname, &qinfo.qname_len)
	!= 0) {
	log_err("cannot parse host name of master %s", master->host);
	return 0;
	}
	qinfo.qname = dname;
	qinfo.qclass = xfr->dclass;
	qinfo.qtype = LDNS_RR_TYPE_A;
	if(xfr->task_probe->lookup_aaaa)
	qinfo.qtype = LDNS_RR_TYPE_AAAA;
	qinfo.local_alias = NULL;
	if(verbosity >= VERB_ALGO) {
	- char buf[512];
	+ char buf1[512];
	char buf2[LDNS_MAX_DOMAINLEN+1];
	dname_str(xfr->name, buf2);
	- snprintf(buf, sizeof(buf), "auth zone %s: master lookup"
	+ snprintf(buf1, sizeof(buf1), "auth zone %s: master lookup"
	" for task_probe", buf2);
	- log_query_info(VERB_ALGO, buf, &qinfo);
	+ log_query_info(VERB_ALGO, buf1, &qinfo);
	}
	edns.edns_present = 1;
	edns.ext_rcode = 0;
	edns.edns_version = 0;
	edns.bits = EDNS_DO;
	edns.opt_list = NULL;
	if(sldns_buffer_capacity(buf) < 65535)
	edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
	else edns.udp_size = 65535;

	/* unlock xfr during mesh_new_callback() because the callback can be
	* called straight away */
	lock_basic_unlock(&xfr->lock);
	if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0,
	&auth_xfer_probe_lookup_callback, xfr)) {
	lock_basic_lock(&xfr->lock);
	log_err("out of memory lookup up master %s", master->host);
	return 0;
	}
	lock_basic_lock(&xfr->lock);
	return 1;
	}

	/** move to sending the probe packets, next if fails. task_probe */
	static void
	xfr_probe_send_or_end(struct auth_xfer* xfr, struct module_env* env)
	{
	/* are we doing hostname lookups? */
	while(xfr->task_probe->lookup_target) {
	if(xfr_probe_lookup_host(xfr, env)) {
	/* wait for lookup to finish,
	* note that the hostname may be in unbound's cache
	* and we may then get an instant cache response,
	* and that calls the callback just like a full
	* lookup and lookup failures also call callback */
	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1];
	+ dname_str(xfr->name, zname);
	+ verbose(VERB_ALGO, "auth zone %s probe next target lookup", zname);
	+ }
	lock_basic_unlock(&xfr->lock);
	return;
	}
	xfr_probe_move_to_next_lookup(xfr, env);
	}
	/* probe of list has ended. Create or refresh the list of of
	* allow_notify addrs */
	probe_copy_masters_for_allow_notify(xfr);
	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1];
	+ dname_str(xfr->name, zname);
	+ verbose(VERB_ALGO, "auth zone %s probe: notify addrs updated", zname);
	+ }
	if(xfr->task_probe->only_lookup) {
	/* only wanted lookups for copy, stop probe and start wait */
	xfr->task_probe->only_lookup = 0;
	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1];
	+ dname_str(xfr->name, zname);
	+ verbose(VERB_ALGO, "auth zone %s probe: finished only_lookup", zname);
	+ }
	xfr_probe_disown(xfr);
	if(xfr->task_nextprobe->worker == NULL)
	xfr_set_timeout(xfr, env, 0, 0);
	lock_basic_unlock(&xfr->lock);
	return;
	}

	/* send probe packets */
	while(!xfr_probe_end_of_list(xfr)) {
	if(xfr_probe_send_probe(xfr, env, AUTH_PROBE_TIMEOUT)) {
	/* successfully sent probe, wait for callback */
	lock_basic_unlock(&xfr->lock);
	return;
	}
	/* failed to send probe, next master */
	xfr_probe_nextmaster(xfr);
	}

	/* done with probe sequence, wait */
	if(xfr->task_probe->have_new_lease) {
	/* if zone not updated, start the wait timer again */
	- verbose(VERB_ALGO, "auth_zone unchanged, new lease, wait");
	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1];
	+ dname_str(xfr->name, zname);
	+ verbose(VERB_ALGO, "auth_zone %s unchanged, new lease, wait", zname);
	+ }
	xfr_probe_disown(xfr);
	if(xfr->have_zone)
	xfr->lease_time = *env->now;
	if(xfr->task_nextprobe->worker == NULL)
	xfr_set_timeout(xfr, env, 0, 0);
	} else {
	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1];
	+ dname_str(xfr->name, zname);
	+ verbose(VERB_ALGO, "auth zone %s soa probe failed, wait to retry", zname);
	+ }
	/* we failed to send this as well, move to the wait task,
	* use the shorter retry timeout */
	xfr_probe_disown(xfr);
	/* pick up the nextprobe task and wait */
	if(xfr->task_nextprobe->worker == NULL)
	xfr_set_timeout(xfr, env, 1, 0);
	}

	lock_basic_unlock(&xfr->lock);
	}

	/** callback for task_probe lookup of host name, of A or AAAA */
	void auth_xfer_probe_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
	enum sec_status ATTR_UNUSED(sec), char* ATTR_UNUSED(why_bogus),
	int ATTR_UNUSED(was_ratelimited))
	{
	struct auth_xfer* xfr = (struct auth_xfer*)arg;
	struct module_env* env;
	log_assert(xfr->task_probe);
	lock_basic_lock(&xfr->lock);
	env = xfr->task_probe->env;
	if(env->outnet->want_to_quit) {
	lock_basic_unlock(&xfr->lock);
	return; /* stop on quit */
	}

	/* process result */
	if(rcode == LDNS_RCODE_NOERROR) {
	uint16_t wanted_qtype = LDNS_RR_TYPE_A;
	struct regional* temp = env->scratch;
	struct query_info rq;
	struct reply_info* rep;
	if(xfr->task_probe->lookup_aaaa)
	wanted_qtype = LDNS_RR_TYPE_AAAA;
	memset(&rq, 0, sizeof(rq));
	rep = parse_reply_in_temp_region(buf, temp, &rq);
	if(rep && rq.qtype == wanted_qtype &&
	FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR) {
	/* parsed successfully */
	struct ub_packed_rrset_key* answer =
	reply_find_answer_rrset(&rq, rep);
	if(answer) {
	xfr_master_add_addrs(xfr->task_probe->
	lookup_target, answer, wanted_qtype);
	+ } else {
	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1];
	+ dname_str(xfr->name, zname);
	+ verbose(VERB_ALGO, "auth zone %s host %s type %s probe lookup has nodata", zname, xfr->task_probe->lookup_target->host, (xfr->task_probe->lookup_aaaa?"AAAA":"A"));
	+ }
	}
	+ } else {
	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1];
	+ dname_str(xfr->name, zname);
	+ verbose(VERB_ALGO, "auth zone %s host %s type %s probe lookup has no address", zname, xfr->task_probe->lookup_target->host, (xfr->task_probe->lookup_aaaa?"AAAA":"A"));
	+ }
	+ }
	+ } else {
	+ if(verbosity >= VERB_ALGO) {
	+ char zname[255+1];
	+ dname_str(xfr->name, zname);
	+ verbose(VERB_ALGO, "auth zone %s host %s type %s probe lookup failed", zname, xfr->task_probe->lookup_target->host, (xfr->task_probe->lookup_aaaa?"AAAA":"A"));
	}
	}
	if(xfr->task_probe->lookup_target->list &&
	xfr->task_probe->lookup_target == xfr_probe_current_master(xfr))
	xfr->task_probe->scan_addr = xfr->task_probe->lookup_target->list;

	/* move to lookup AAAA after A lookup, move to next hostname lookup,
	* or move to send the probes, or, if nothing to do, end task_probe */
	xfr_probe_move_to_next_lookup(xfr, env);
	xfr_probe_send_or_end(xfr, env);
	}

	/** disown task_nextprobe. caller must hold xfr.lock */
	static void
	xfr_nextprobe_disown(struct auth_xfer* xfr)
	{
	/* delete the timer, because the next worker to pick this up may
	* not have the same event base */
	comm_timer_delete(xfr->task_nextprobe->timer);
	xfr->task_nextprobe->timer = NULL;
	xfr->task_nextprobe->next_probe = 0;
	/* we don't own this item anymore */
	xfr->task_nextprobe->worker = NULL;
	xfr->task_nextprobe->env = NULL;
	}

	/** xfer nextprobe timeout callback, this is part of task_nextprobe */
	void
	auth_xfer_timer(void* arg)
	{
	struct auth_xfer* xfr = (struct auth_xfer*)arg;
	struct module_env* env;
	log_assert(xfr->task_nextprobe);
	lock_basic_lock(&xfr->lock);
	env = xfr->task_nextprobe->env;
	if(env->outnet->want_to_quit) {
	lock_basic_unlock(&xfr->lock);
	return; /* stop on quit */
	}

	/* see if zone has expired, and if so, also set auth_zone expired */
	if(xfr->have_zone && !xfr->zone_expired &&
	*env->now >= xfr->lease_time + xfr->expiry) {
	lock_basic_unlock(&xfr->lock);
	auth_xfer_set_expired(xfr, env, 1);
	lock_basic_lock(&xfr->lock);
	}

	xfr_nextprobe_disown(xfr);

	if(!xfr_start_probe(xfr, env, NULL)) {
	/* not started because already in progress */
	lock_basic_unlock(&xfr->lock);
	}
	}

	/** return true if there are probe (SOA UDP query) targets in the master list*/
	static int
	have_probe_targets(struct auth_master* list)
	{
	struct auth_master* p;
	for(p=list; p; p = p->next) {
	if(!p->allow_notify && p->host)
	return 1;
	}
	return 0;
	}

	/** start task_probe if possible, if no masters for probe start task_transfer
	* returns true if task has been started, and false if the task is already
	* in progress. */
	static int
	xfr_start_probe(struct auth_xfer* xfr, struct module_env* env,
	struct auth_master* spec)
	{
	/* see if we need to start a probe (or maybe it is already in
	* progress (due to notify)) */
	if(xfr->task_probe->worker == NULL) {
	if(!have_probe_targets(xfr->task_probe->masters) &&
	!(xfr->task_probe->only_lookup &&
	xfr->task_probe->masters != NULL)) {
	/* useless to pick up task_probe, no masters to
	* probe. Instead attempt to pick up task transfer */
	if(xfr->task_transfer->worker == NULL) {
	xfr_start_transfer(xfr, env, spec);
	return 1;
	}
	/* task transfer already in progress */
	return 0;
	}

	/* pick up the probe task ourselves */
	xfr->task_probe->worker = env->worker;
	xfr->task_probe->env = env;
	xfr->task_probe->cp = NULL;

	/* start the task */
	/* have not seen a new lease yet, this scan */
	xfr->task_probe->have_new_lease = 0;
	/* if this was a timeout, no specific first master to scan */
	/* otherwise, spec is nonNULL the notified master, scan
	* first and also transfer first from it */
	xfr_probe_start_list(xfr, spec);
	/* setup to start the lookup of hostnames of masters afresh */
	xfr_probe_start_lookups(xfr);
	/* send the probe packet or next send, or end task */
	xfr_probe_send_or_end(xfr, env);
	return 1;
	}
	return 0;
	}

	/** for task_nextprobe.
	* determine next timeout for auth_xfer. Also (re)sets timer.
	* @param xfr: task structure
	* @param env: module environment, with worker and time.
	* @param failure: set true if timer should be set for failure retry.
	* @param lookup_only: only perform lookups when timer done, 0 sec timeout
	*/
	static void
	xfr_set_timeout(struct auth_xfer* xfr, struct module_env* env,
	int failure, int lookup_only)
	{
	struct timeval tv;
	log_assert(xfr->task_nextprobe != NULL);
	log_assert(xfr->task_nextprobe->worker == NULL \|\|
	xfr->task_nextprobe->worker == env->worker);
	/* normally, nextprobe = startoflease + refresh,
	* but if expiry is sooner, use that one.
	* after a failure, use the retry timer instead. */
	xfr->task_nextprobe->next_probe = *env->now;
	if(xfr->lease_time && !failure)
	xfr->task_nextprobe->next_probe = xfr->lease_time;

	if(!failure) {
	xfr->task_nextprobe->backoff = 0;
	} else {
	if(xfr->task_nextprobe->backoff == 0)
	xfr->task_nextprobe->backoff = 3;
	else xfr->task_nextprobe->backoff *= 2;
	if(xfr->task_nextprobe->backoff > AUTH_TRANSFER_MAX_BACKOFF)
	xfr->task_nextprobe->backoff =
	AUTH_TRANSFER_MAX_BACKOFF;
	}

	if(xfr->have_zone) {
	time_t wait = xfr->refresh;
	if(failure) wait = xfr->retry;
	if(xfr->expiry < wait)
	xfr->task_nextprobe->next_probe += xfr->expiry;
	else xfr->task_nextprobe->next_probe += wait;
	if(failure)
	xfr->task_nextprobe->next_probe +=
	xfr->task_nextprobe->backoff;
	/* put the timer exactly on expiry, if possible */
	if(xfr->lease_time && xfr->lease_time+xfr->expiry <
	xfr->task_nextprobe->next_probe &&
	xfr->lease_time+xfr->expiry > *env->now)
	xfr->task_nextprobe->next_probe =
	xfr->lease_time+xfr->expiry;
	} else {
	xfr->task_nextprobe->next_probe +=
	xfr->task_nextprobe->backoff;
	}

	if(!xfr->task_nextprobe->timer) {
	xfr->task_nextprobe->timer = comm_timer_create(
	env->worker_base, auth_xfer_timer, xfr);
	if(!xfr->task_nextprobe->timer) {
	/* failed to malloc memory. likely zone transfer
	* also fails for that. skip the timeout */
	char zname[255+1];
	dname_str(xfr->name, zname);
	log_err("cannot allocate timer, no refresh for %s",
	zname);
	return;
	}
	}
	xfr->task_nextprobe->worker = env->worker;
	xfr->task_nextprobe->env = env;
	if(*(xfr->task_nextprobe->env->now) <= xfr->task_nextprobe->next_probe)
	tv.tv_sec = xfr->task_nextprobe->next_probe -
	*(xfr->task_nextprobe->env->now);
	else tv.tv_sec = 0;
	if(tv.tv_sec != 0 && lookup_only && xfr->task_probe->masters) {
	/* don't lookup_only, if lookup timeout is 0 anyway,
	* or if we don't have masters to lookup */
	tv.tv_sec = 0;
	if(xfr->task_probe && xfr->task_probe->worker == NULL)
	xfr->task_probe->only_lookup = 1;
	}
	if(verbosity >= VERB_ALGO) {
	char zname[255+1];
	dname_str(xfr->name, zname);
	verbose(VERB_ALGO, "auth zone %s timeout in %d seconds",
	zname, (int)tv.tv_sec);
	}
	tv.tv_usec = 0;
	comm_timer_set(xfr->task_nextprobe->timer, &tv);
	}

	/** initial pick up of worker timeouts, ties events to worker event loop */
	void
	auth_xfer_pickup_initial(struct auth_zones* az, struct module_env* env)
	{
	struct auth_xfer* x;
	lock_rw_wrlock(&az->lock);
	RBTREE_FOR(x, struct auth_xfer*, &az->xtree) {
	lock_basic_lock(&x->lock);
	/* set lease_time, because we now have timestamp in env,
	* (not earlier during startup and apply_cfg), and this
	* notes the start time when the data was acquired */
	if(x->have_zone)
	x->lease_time = *env->now;
	if(x->task_nextprobe && x->task_nextprobe->worker == NULL) {
	xfr_set_timeout(x, env, 0, 1);
	}
	lock_basic_unlock(&x->lock);
	}
	lock_rw_unlock(&az->lock);
	}

	void auth_zones_cleanup(struct auth_zones* az)
	{
	struct auth_xfer* x;
	lock_rw_wrlock(&az->lock);
	RBTREE_FOR(x, struct auth_xfer*, &az->xtree) {
	lock_basic_lock(&x->lock);
	if(x->task_nextprobe && x->task_nextprobe->worker != NULL) {
	xfr_nextprobe_disown(x);
	}
	if(x->task_probe && x->task_probe->worker != NULL) {
	xfr_probe_disown(x);
	}
	if(x->task_transfer && x->task_transfer->worker != NULL) {
	auth_chunks_delete(x->task_transfer);
	xfr_transfer_disown(x);
	}
	lock_basic_unlock(&x->lock);
	}
	lock_rw_unlock(&az->lock);
	}

	/**
	* malloc the xfer and tasks
	* @param z: auth_zone with name of zone.
	*/
	static struct auth_xfer*
	auth_xfer_new(struct auth_zone* z)
	{
	struct auth_xfer* xfr;
	xfr = (struct auth_xfer)calloc(1, sizeof(xfr));
	if(!xfr) return NULL;
	xfr->name = memdup(z->name, z->namelen);
	if(!xfr->name) {
	free(xfr);
	return NULL;
	}
	xfr->node.key = xfr;
	xfr->namelen = z->namelen;
	xfr->namelabs = z->namelabs;
	xfr->dclass = z->dclass;

	xfr->task_nextprobe = (struct auth_nextprobe*)calloc(1,
	sizeof(struct auth_nextprobe));
	if(!xfr->task_nextprobe) {
	free(xfr->name);
	free(xfr);
	return NULL;
	}
	xfr->task_probe = (struct auth_probe*)calloc(1,
	sizeof(struct auth_probe));
	if(!xfr->task_probe) {
	free(xfr->task_nextprobe);
	free(xfr->name);
	free(xfr);
	return NULL;
	}
	xfr->task_transfer = (struct auth_transfer*)calloc(1,
	sizeof(struct auth_transfer));
	if(!xfr->task_transfer) {
	free(xfr->task_probe);
	free(xfr->task_nextprobe);
	free(xfr->name);
	free(xfr);
	return NULL;
	}

	lock_basic_init(&xfr->lock);
	lock_protect(&xfr->lock, &xfr->name, sizeof(xfr->name));
	lock_protect(&xfr->lock, &xfr->namelen, sizeof(xfr->namelen));
	lock_protect(&xfr->lock, xfr->name, xfr->namelen);
	lock_protect(&xfr->lock, &xfr->namelabs, sizeof(xfr->namelabs));
	lock_protect(&xfr->lock, &xfr->dclass, sizeof(xfr->dclass));
	lock_protect(&xfr->lock, &xfr->notify_received, sizeof(xfr->notify_received));
	lock_protect(&xfr->lock, &xfr->notify_serial, sizeof(xfr->notify_serial));
	lock_protect(&xfr->lock, &xfr->zone_expired, sizeof(xfr->zone_expired));
	lock_protect(&xfr->lock, &xfr->have_zone, sizeof(xfr->have_zone));
	lock_protect(&xfr->lock, &xfr->serial, sizeof(xfr->serial));
	lock_protect(&xfr->lock, &xfr->retry, sizeof(xfr->retry));
	lock_protect(&xfr->lock, &xfr->refresh, sizeof(xfr->refresh));
	lock_protect(&xfr->lock, &xfr->expiry, sizeof(xfr->expiry));
	lock_protect(&xfr->lock, &xfr->lease_time, sizeof(xfr->lease_time));
	lock_protect(&xfr->lock, &xfr->task_nextprobe->worker,
	sizeof(xfr->task_nextprobe->worker));
	lock_protect(&xfr->lock, &xfr->task_probe->worker,
	sizeof(xfr->task_probe->worker));
	lock_protect(&xfr->lock, &xfr->task_transfer->worker,
	sizeof(xfr->task_transfer->worker));
	lock_basic_lock(&xfr->lock);
	return xfr;
	}

	/** Create auth_xfer structure.
	* This populates the have_zone, soa values, and so on times.
	* and sets the timeout, if a zone transfer is needed a short timeout is set.
	* For that the auth_zone itself must exist (and read in zonefile)
	* returns false on alloc failure. */
	struct auth_xfer*
	auth_xfer_create(struct auth_zones* az, struct auth_zone* z)
	{
	struct auth_xfer* xfr;

	/* malloc it */
	xfr = auth_xfer_new(z);
	if(!xfr) {
	log_err("malloc failure");
	return NULL;
	}
	/* insert in tree */
	(void)rbtree_insert(&az->xtree, &xfr->node);
	return xfr;
	}

	/** create new auth_master structure */
	static struct auth_master*
	auth_master_new(struct auth_master*** list)
	{
	struct auth_master *m;
	m = (struct auth_master)calloc(1, sizeof(m));
	if(!m) {
	log_err("malloc failure");
	return NULL;
	}
	/* set first pointer to m, or next pointer of previous element to m */
	(**list) = m;
	/* store m's next pointer as future point to store at */
	(*list) = &(m->next);
	return m;
	}

	/** dup_prefix : create string from initial part of other string, malloced */
	static char*
	dup_prefix(char* str, size_t num)
	{
	char* result;
	size_t len = strlen(str);
	if(len < num) num = len; /* not more than strlen */
	result = (char*)malloc(num+1);
	if(!result) {
	log_err("malloc failure");
	return result;
	}
	memmove(result, str, num);
	result[num] = 0;
	return result;
	}

	/** dup string and print error on error */
	static char*
	dup_all(char* str)
	{
	char* result = strdup(str);
	if(!result) {
	log_err("malloc failure");
	return NULL;
	}
	return result;
	}

	/** find first of two characters */
	static char*
	str_find_first_of_chars(char* s, char a, char b)
	{
	char* ra = strchr(s, a);
	char* rb = strchr(s, b);
	if(!ra) return rb;
	if(!rb) return ra;
	if(ra < rb) return ra;
	return rb;
	}

	/** parse URL into host and file parts, false on malloc or parse error */
	static int
	parse_url(char* url, char host, char file, int* port, int* ssl)
	{
	char* p = url;
	/* parse http://www.example.com/file.htm
	* or http://127.0.0.1 (index.html)
	* or https://[::1@1234]/a/b/c/d */
	*ssl = 1;
	*port = AUTH_HTTPS_PORT;

	/* parse http:// or https:// */
	if(strncmp(p, "http://", 7) == 0) {
	p += 7;
	*ssl = 0;
	*port = AUTH_HTTP_PORT;
	} else if(strncmp(p, "https://", 8) == 0) {
	p += 8;
	} else if(strstr(p, "://") && strchr(p, '/') > strstr(p, "://") &&
	strchr(p, ':') >= strstr(p, "://")) {
	char* uri = dup_prefix(p, (size_t)(strstr(p, "://")-p));
	log_err("protocol %s:// not supported (for url %s)",
	uri?uri:"", p);
	free(uri);
	return 0;
	}

	/* parse hostname part */
	if(p[0] == '[') {
	char* end = strchr(p, ']');
	p++; /* skip over [ */
	if(end) {
	*host = dup_prefix(p, (size_t)(end-p));
	if(!*host) return 0;
	p = end+1; /* skip over ] */
	} else {
	*host = dup_all(p);
	if(!*host) return 0;
	p = end;
	}
	} else {
	char* end = str_find_first_of_chars(p, ':', '/');
	if(end) {
	*host = dup_prefix(p, (size_t)(end-p));
	if(!*host) return 0;
	} else {
	*host = dup_all(p);
	if(!*host) return 0;
	}
	p = end; /* at next : or / or NULL */
	}

	/* parse port number */
	if(p && p[0] == ':') {
	char* end = NULL;
	*port = strtol(p+1, &end, 10);
	p = end;
	}

	/* parse filename part */
	while(p && *p == '/')
	p++;
	if(!p \|\| p[0] == 0)
	*file = strdup("index.html");
	else *file = strdup(p);
	if(!*file) {
	log_err("malloc failure");
	return 0;
	}
	return 1;
	}

	int
	xfer_set_masters(struct auth_master** list, struct config_auth* c,
	int with_http)
	{
	struct auth_master* m;
	struct config_strlist* p;
	/* list points to the first, or next pointer for the new element */
	while(*list) {
	list = &( (*list)->next );
	}
	if(with_http)
	for(p = c->urls; p; p = p->next) {
	m = auth_master_new(&list);
	m->http = 1;
	if(!parse_url(p->str, &m->host, &m->file, &m->port, &m->ssl))
	return 0;
	}
	for(p = c->masters; p; p = p->next) {
	m = auth_master_new(&list);
	m->ixfr = 1; /* this flag is not configurable */
	m->host = strdup(p->str);
	if(!m->host) {
	log_err("malloc failure");
	return 0;
	}
	}
	for(p = c->allow_notify; p; p = p->next) {
	m = auth_master_new(&list);
	m->allow_notify = 1;
	m->host = strdup(p->str);
	if(!m->host) {
	log_err("malloc failure");
	return 0;
	}
	}
	return 1;
	}

	#define SERIAL_BITS 32
	int
	compare_serial(uint32_t a, uint32_t b)
	{
	const uint32_t cutoff = ((uint32_t) 1 << (SERIAL_BITS - 1));

	if (a == b) {
	return 0;
	} else if ((a < b && b - a < cutoff) \|\| (a > b && a - b > cutoff)) {
	return -1;
	} else {
	return 1;
	}
	}
	Index: head/contrib/unbound/services/authzone.h
	===================================================================
	--- head/contrib/unbound/services/authzone.h (revision 349719)
	+++ head/contrib/unbound/services/authzone.h (revision 349720)
	@@ -1,665 +1,674 @@
	/*
	* services/authzone.h - authoritative zone that is locally hosted.
	*
	* Copyright (c) 2017, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains the functions for an authority zone. This zone
	* is queried by the iterator, just like a stub or forward zone, but then
	* the data is locally held.
	*/

	#ifndef SERVICES_AUTHZONE_H
	#define SERVICES_AUTHZONE_H
	#include "util/rbtree.h"
	#include "util/locks.h"
	#include "services/mesh.h"
	struct ub_packed_rrset_key;
	struct regional;
	struct config_file;
	struct config_auth;
	struct query_info;
	struct dns_msg;
	struct edns_data;
	struct module_env;
	struct worker;
	struct comm_point;
	struct comm_timer;
	struct comm_reply;
	struct auth_rrset;
	struct auth_nextprobe;
	struct auth_probe;
	struct auth_transfer;
	struct auth_master;
	struct auth_chunk;

	/**
	* Authoritative zones, shared.
	*/
	struct auth_zones {
	/** lock on the authzone trees */
	lock_rw_type lock;
	/** rbtree of struct auth_zone */
	rbtree_type ztree;
	/** rbtree of struct auth_xfer */
	rbtree_type xtree;
	/** do we have downstream enabled */
	int have_downstream;
	/** number of queries upstream */
	size_t num_query_up;
	/** number of queries downstream */
	size_t num_query_down;
	};

	/**
	* Auth zone. Authoritative data, that is fetched from instead of sending
	* packets to the internet.
	*/
	struct auth_zone {
	/** rbtree node, key is name and class */
	rbnode_type node;

	/** zone name, in uncompressed wireformat */
	uint8_t* name;
	/** length of zone name */
	size_t namelen;
	/** number of labels in zone name */
	int namelabs;
	/** the class of this zone, in host byteorder.
	* uses 'dclass' to not conflict with c++ keyword class. */
	uint16_t dclass;

	/** lock on the data in the structure
	* For the node, parent, name, namelen, namelabs, dclass, you
	* need to also hold the zones_tree lock to change them (or to
	* delete this zone) */
	lock_rw_type lock;

	/** auth data for this zone
	* rbtree of struct auth_data */
	rbtree_type data;

	/** zonefile name (or NULL for no zonefile) */
	char* zonefile;
	/** fallback to the internet on failure or ttl-expiry of auth zone */
	int fallback_enabled;
	/** the zone has expired (enabled by the xfer worker), fallback
	* happens if that option is enabled. */
	int zone_expired;
	/** zone is a slave zone (it has masters) */
	int zone_is_slave;
	/** for downstream: this zone answers queries towards the downstream
	* clients */
	int for_downstream;
	/** for upstream: this zone answers queries that unbound intends to
	* send upstream. */
	int for_upstream;
	/** zone has been deleted */
	int zone_deleted;
	/** deletelist pointer, unused normally except during delete */
	struct auth_zone* delete_next;
	};

	/**
	* Auth data. One domain name, and the RRs to go with it.
	*/
	struct auth_data {
	/** rbtree node, key is name only */
	rbnode_type node;
	/** domain name */
	uint8_t* name;
	/** length of name */
	size_t namelen;
	/** number of labels in name */
	int namelabs;
	/** the data rrsets, with different types, linked list.
	* if the list if NULL the node would be an empty non-terminal,
	* but in this data structure such nodes that represent an empty
	* non-terminal are not needed; they just don't exist.
	*/
	struct auth_rrset* rrsets;
	};

	/**
	* A auth data RRset
	*/
	struct auth_rrset {
	/** next in list */
	struct auth_rrset* next;
	/** RR type in host byteorder */
	uint16_t type;
	/** RRset data item */
	struct packed_rrset_data* data;
	};

	/**
	* Authoritative zone transfer structure.
	* Create and destroy needs the auth_zones* biglock.
	* The structure consists of different tasks. Each can be unowned (-1) or
	* owner by a worker (worker-num). A worker can pick up a task and then do
	* it. This means the events (timeouts, sockets) are for that worker.
	*
	* (move this to tasks).
	* They don't have locks themselves, the worker (that owns it) uses it,
	* also as part of callbacks, hence it has separate zonename pointers for
	* lookup in the main zonetree. If the zone has no transfers, this
	* structure is not created.
	*/
	struct auth_xfer {
	/** rbtree node, key is name and class */
	rbnode_type node;

	/** lock on this structure, and on the workernum elements of the
	* tasks. First hold the tree-lock in auth_zones, find the auth_xfer,
	* lock this lock. Then a worker can reassign itself to fill up
	* one of the tasks.
	* Once it has the task assigned to it, the worker can access the
	* other elements of the task structure without a lock, because that
	* is necessary for the eventloop and callbacks from that. */
	lock_basic_type lock;

	/** zone name, in uncompressed wireformat */
	uint8_t* name;
	/** length of zone name */
	size_t namelen;
	/** number of labels in zone name */
	int namelabs;
	/** the class of this zone, in host byteorder.
	* uses 'dclass' to not conflict with c++ keyword class. */
	uint16_t dclass;

	/** task to wait for next-probe-timeout,
	* once timeouted, see if a SOA probe is needed, or already
	* in progress */
	struct auth_nextprobe* task_nextprobe;

	/** task for SOA probe. Check if the zone can be updated */
	struct auth_probe* task_probe;

	/** Task for transfer. Transferring and updating the zone. This
	* includes trying (potentially) several upstream masters. Downloading
	* and storing the zone */
	struct auth_transfer* task_transfer;

	/** a notify was received, but a zone transfer or probe was already
	* acted on.
	* However, the zone transfer could signal a newer serial number.
	* The serial number of that notify is saved below. The transfer and
	* probe tasks should check this once done to see if they need to
	* restart the transfer task for the newer notify serial.
	* Hold the lock to access this member (and the serial).
	*/
	int notify_received;
	/** true if the notify_received has a serial number */
	int notify_has_serial;
	/** serial number of the notify */
	uint32_t notify_serial;
	/** the list of masters for checking notifies. This list is
	* empty on start, and a copy of the list from the probe_task when
	* it is done looking them up. */
	struct auth_master* allow_notify_list;

	/* protected by the lock on the structure, information about
	* the loaded authority zone. */
	/** is the zone currently considered expired? after expiry also older
	* serial numbers are allowed (not just newer) */
	int zone_expired;
	/** do we have a zone (if 0, no zone data at all) */
	int have_zone;

	/** current serial (from SOA), if we have no zone, 0 */
	uint32_t serial;
	/** retry time (from SOA), time to wait with next_probe
	* if no master responds */
	time_t retry;
	/** refresh time (from SOA), time to wait with next_probe
	* if everything is fine */
	time_t refresh;
	/** expiry time (from SOA), time until zone data is not considered
	* valid any more, if no master responds within this time, either
	* with the current zone or a new zone. */
	time_t expiry;

	/** zone lease start time (start+expiry is expiration time).
	* this is renewed every SOA probe and transfer. On zone load
	* from zonefile it is also set (with probe set soon to check) */
	time_t lease_time;
	};

	/**
	* The next probe task.
	* This task consists of waiting for the probetimeout. It is a task because
	* it needs an event in the eventtable. Once the timeout has passed, that
	* worker can (potentially) become the auth_probe worker, or if another worker
	* is already doing that, do nothing. Tasks becomes unowned.
	* The probe worker, if it detects nothing has to be done picks up this task,
	* if unowned.
	*/
	struct auth_nextprobe {
	/* Worker pointer. NULL means unowned. */
	struct worker* worker;
	/* module env for this task */
	struct module_env* env;

	/** increasing backoff for failures */
	time_t backoff;
	/** Timeout for next probe (for SOA) */
	time_t next_probe;
	/** timeout callback for next_probe or expiry(if that is sooner).
	* it is on the worker's event_base */
	struct comm_timer* timer;
	};

	/**
	* The probe task.
	* Send a SOA UDP query to see if the zone needs to be updated (or similar,
	* potential, HTTP probe query) and check serial number.
	* If yes, start the auth_transfer task. If no, make sure auth_nextprobe
	* timeout wait task is running.
	* Needs to be a task, because the UDP query needs an event entry.
	* This task could also be started by eg. a NOTIFY being received, even though
	* another worker is performing the nextprobe task (and that worker keeps
	* waiting uninterrupted).
	*/
	struct auth_probe {
	/* Worker pointer. NULL means unowned. */
	struct worker* worker;
	/* module env for this task */
	struct module_env* env;

	/** list of upstream masters for this zone, from config */
	struct auth_master* masters;

	/** for the hostname lookups, which master is current */
	struct auth_master* lookup_target;
	/** are we looking up A or AAAA, first A, then AAAA (if ip6 enabled) */
	int lookup_aaaa;
	/** we only want to do lookups for making config work (for notify),
	* don't proceed with UDP SOA probe queries */
	int only_lookup;
	/** we have seen a new lease this scan, because one of the masters
	* replied with the current SOA serial version */
	int have_new_lease;

	/** once notified, or the timeout has been reached. a scan starts. */
	/** the scan specific target (notify source), or NULL if none */
	struct auth_master* scan_specific;
	/** scan tries all the upstream masters. the scan current target.
	* or NULL if not working on sequential scan */
	struct auth_master* scan_target;
	/** if not NULL, the specific addr for the current master */
	struct auth_addr* scan_addr;

	/** dns id of packet in flight */
	uint16_t id;
	/** the SOA probe udp event.
	* on the workers event base. */
	struct comm_point* cp;
	+ /** is the cp for ip6 or ip4 */
	+ int cp_is_ip6;
	/** timeout for packets.
	* on the workers event base. */
	struct comm_timer* timer;
	/** timeout in msec */
	int timeout;
	};

	/**
	* The transfer task.
	* Once done, make sure the nextprobe waiting task is running, whether done
	* with failure or success. If failure, use shorter timeout for wait time.
	*/
	struct auth_transfer {
	/* Worker pointer. NULL means unowned. */
	struct worker* worker;
	/* module env for this task */
	struct module_env* env;

	/** xfer data that has been transferred, the data is applied
	* once the transfer has completed correctly */
	struct auth_chunk* chunks_first;
	/** last element in chunks list (to append new data at the end) */
	struct auth_chunk* chunks_last;

	/** list of upstream masters for this zone, from config */
	struct auth_master* masters;

	/** for the hostname lookups, which master is current */
	struct auth_master* lookup_target;
	/** are we looking up A or AAAA, first A, then AAAA (if ip6 enabled) */
	int lookup_aaaa;

	/** once notified, or the timeout has been reached. a scan starts. */
	/** the scan specific target (notify source), or NULL if none */
	struct auth_master* scan_specific;
	/** scan tries all the upstream masters. the scan current target.
	* or NULL if not working on sequential scan */
	struct auth_master* scan_target;
	/** what address we are scanning for the master, or NULL if the
	* master is in IP format itself */
	struct auth_addr* scan_addr;
	/** the zone transfer in progress (or NULL if in scan). It is
	* from this master */
	struct auth_master* master;

	/** failed ixfr transfer, retry with axfr (to the current master),
	* the IXFR was 'REFUSED', 'SERVFAIL', 'NOTIMPL' or the contents of
	* the IXFR did not apply cleanly (out of sync, delete of nonexistent
	* data or add of duplicate data). Flag is cleared once the retry
	* with axfr is done. */
	int ixfr_fail;
	+ /** we saw an ixfr-indicating timeout, count of them */
	+ int ixfr_possible_timeout_count;
	/** we are doing IXFR right now */
	int on_ixfr;
	/** did we detect the current AXFR/IXFR serial number yet, 0 not yet,
	* 1 we saw the first, 2 we saw the second, 3 must be last SOA in xfr*/
	int got_xfr_serial;
	/** number of RRs scanned for AXFR/IXFR detection */
	size_t rr_scan_num;
	/** we are doing an IXFR but we detected an AXFR contents */
	int on_ixfr_is_axfr;
	/** the serial number for the current AXFR/IXFR incoming reply,
	* for IXFR, the outermost SOA records serial */
	uint32_t incoming_xfr_serial;

	/** dns id of AXFR query */
	uint16_t id;
	/** the transfer (TCP) to the master.
	* on the workers event base. */
	struct comm_point* cp;
	+ /** timeout for the transfer.
	+ * on the workers event base. */
	+ struct comm_timer* timer;
	};

	/** list of addresses */
	struct auth_addr {
	/** next in list */
	struct auth_addr* next;
	/** IP address */
	struct sockaddr_storage addr;
	/** addr length */
	socklen_t addrlen;
	};

	/** auth zone master upstream, and the config settings for it */
	struct auth_master {
	/** next master in list */
	struct auth_master* next;
	/** master IP address (and port), or hostname, string */
	char* host;
	/** for http, filename */
	char* file;
	/** use HTTP for this master */
	int http;
	/** use IXFR for this master */
	int ixfr;
	/** this is an allow notify member, the master can send notifies
	* to us, but we don't send SOA probes, or zone transfer from it */
	int allow_notify;
	/** use ssl for channel */
	int ssl;
	/** the port number (for urls) */
	int port;
	/** if the host is a hostname, the list of resolved addrs, if any*/
	struct auth_addr* list;
	};

	/** auth zone master zone transfer data chunk */
	struct auth_chunk {
	/** next chunk in list */
	struct auth_chunk* next;
	/** the data from this chunk, this is what was received.
	* for an IXFR that means results from comm_net tcp actions,
	* packets. also for an AXFR. For HTTP a zonefile chunk. */
	uint8_t* data;
	/** length of allocated data */
	size_t len;
	};

	/**
	* Create auth zones structure
	*/
	struct auth_zones* auth_zones_create(void);

	/**
	* Apply configuration to auth zones. Reads zonefiles.
	* @param az: auth zones structure
	* @param cfg: config to apply.
	* @param setup: if true, also sets up values in the auth zones structure
	* @return false on failure.
	*/
	int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg,
	int setup);

	/** initial pick up of worker timeouts, ties events to worker event loop
	* @param az: auth zones structure
	* @param env: worker env, of first worker that receives the events (if any)
	* in its eventloop.
	*/
	void auth_xfer_pickup_initial(struct auth_zones* az, struct module_env* env);

	/**
	* Cleanup auth zones. This removes all events from event bases.
	* Stops the xfr tasks. But leaves zone data.
	* @param az: auth zones structure.
	*/
	void auth_zones_cleanup(struct auth_zones* az);

	/**
	* Delete auth zones structure
	*/
	void auth_zones_delete(struct auth_zones* az);

	/**
	* Write auth zone data to file, in zonefile format.
	*/
	int auth_zone_write_file(struct auth_zone* z, const char* fname);

	/**
	* Use auth zones to lookup the answer to a query.
	* The query is from the iterator. And the auth zones attempts to provide
	* the answer instead of going to the internet.
	*
	* @param az: auth zones structure.
	* @param qinfo: query info to lookup.
	* @param region: region to use to allocate the reply in.
	* @param msg: reply is stored here (if one).
	* @param fallback: if true, fallback to making a query to the internet.
	* @param dp_nm: name of delegation point to look for. This zone is used
	* to answer the query.
	* If the dp_nm is not found, fallback is set to true and false returned.
	* @param dp_nmlen: length of dp_nm.
	* @return 0: failure (an error of some sort, like servfail).
	* if 0 and fallback is true, fallback to the internet.
	* if 0 and fallback is false, like getting servfail.
	* If true, an answer is available.
	*/
	int auth_zones_lookup(struct auth_zones* az, struct query_info* qinfo,
	struct regional* region, struct dns_msg** msg, int* fallback,
	uint8_t* dp_nm, size_t dp_nmlen);

	/**
	* Answer query from auth zone. Create authoritative answer.
	* @param az: auth zones structure.
	* @param env: the module environment.
	* @param qinfo: query info (parsed).
	* @param edns: edns info (parsed).
	* @param buf: buffer with query ID and flags, also for reply.
	* @param repinfo: reply information for a communication point.
	* @param temp: temporary storage region.
	* @return false if not answered
	*/
	int auth_zones_answer(struct auth_zones* az, struct module_env* env,
	struct query_info* qinfo, struct edns_data* edns,
	struct comm_reply* repinfo, struct sldns_buffer* buf, struct regional* temp);

	/**
	* Find the auth zone that is above the given qname.
	* Return NULL when there is no auth_zone above the give name, otherwise
	* returns the closest auth_zone above the qname that pertains to it.
	* @param az: auth zones structure.
	* @param name: query to look up for.
	* @param name_len: length of name.
	* @param dclass: class of zone to find.
	* @return NULL or auth_zone that pertains to the query.
	*/
	struct auth_zone* auth_zones_find_zone(struct auth_zones* az,
	uint8_t* name, size_t name_len, uint16_t dclass);

	/** find an auth zone by name (exact match by name or NULL returned) */
	struct auth_zone* auth_zone_find(struct auth_zones* az, uint8_t* nm,
	size_t nmlen, uint16_t dclass);

	/** find an xfer zone by name (exact match by name or NULL returned) */
	struct auth_xfer* auth_xfer_find(struct auth_zones* az, uint8_t* nm,
	size_t nmlen, uint16_t dclass);

	/** create an auth zone. returns wrlocked zone. caller must have wrlock
	* on az. returns NULL on malloc failure */
	struct auth_zone* auth_zone_create(struct auth_zones* az, uint8_t* nm,
	size_t nmlen, uint16_t dclass);

	/** set auth zone zonefile string. caller must have lock on zone */
	int auth_zone_set_zonefile(struct auth_zone* z, char* zonefile);

	/** set auth zone fallback. caller must have lock on zone.
	* fallbackstr is "yes" or "no". false on parse failure. */
	int auth_zone_set_fallback(struct auth_zone* z, char* fallbackstr);

	/** see if the auth zone for the name can fallback
	* @param az: auth zones
	* @param nm: name of delegation point.
	* @param nmlen: length of nm.
	* @param dclass: class of zone to look for.
	* @return true if fallback_enabled is true. false if not.
	* if the zone does not exist, fallback is true (more lenient)
	* also true if zone does not do upstream requests.
	*/
	int auth_zones_can_fallback(struct auth_zones* az, uint8_t* nm, size_t nmlen,
	uint16_t dclass);

	/** process notify for auth zones.
	* first checks the access list. Then processes the notify. This starts
	* the probe sequence or it notes the serial number (if any)
	* @param az: auth zones structure.
	* @param env: module env of the worker that is handling the notify. it will
	* pick up the task probe (or transfer), unless already in progress by
	* another worker.
	* @param nm: name of the zone. Uncompressed. from query.
	* @param nmlen: length of name.
	* @param dclass: class of zone.
	* @param addr: source address of notify
	* @param addrlen: length of addr.
	* @param has_serial: if true, the notify has a serial attached.
	* @param serial: the serial number, if has_serial is true.
	* @param refused: is set to true on failure to note refused access.
	* @return fail on failures (refused is false) and when access is
	* denied (refused is true). True when processed.
	*/
	int auth_zones_notify(struct auth_zones* az, struct module_env* env,
	uint8_t* nm, size_t nmlen, uint16_t dclass,
	struct sockaddr_storage* addr, socklen_t addrlen, int has_serial,
	uint32_t serial, int* refused);

	/** process notify packet and read serial number from SOA.
	* returns 0 if no soa record in the notify */
	int auth_zone_parse_notify_serial(struct sldns_buffer* pkt, uint32_t *serial);

	/** for the zone and if not already going, starts the probe sequence.
	* false if zone cannot be found. This is like a notify arrived and was
	* accepted for that zone. */
	int auth_zones_startprobesequence(struct auth_zones* az,
	struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t dclass);

	/** read auth zone from zonefile. caller must lock zone. false on failure */
	-int auth_zone_read_zonefile(struct auth_zone* z);
	+int auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg);

	/** find serial number of zone or false if none (no SOA record) */
	int auth_zone_get_serial(struct auth_zone* z, uint32_t* serial);

	/** compare auth_zones for sorted rbtree */
	int auth_zone_cmp(const void* z1, const void* z2);

	/** compare auth_data for sorted rbtree */
	int auth_data_cmp(const void* z1, const void* z2);

	/** compare auth_xfer for sorted rbtree */
	int auth_xfer_cmp(const void* z1, const void* z2);

	/** Create auth_xfer structure.
	* Caller must have wrlock on az. Returns locked xfer zone.
	* @param az: zones structure.
	* @param z: zone with name and class
	* @return xfer zone or NULL
	*/
	struct auth_xfer* auth_xfer_create(struct auth_zones* az, struct auth_zone* z);

	/**
	* Set masters in auth xfer structure from config.
	* @param list: pointer to start of list. The malloced list is returned here.
	* @param c: the config items to copy over.
	* @param with_http: if true, http urls are also included, before the masters.
	* @return false on failure.
	*/
	int xfer_set_masters(struct auth_master** list, struct config_auth* c,
	int with_http);

	/** xfer nextprobe timeout callback, this is part of task_nextprobe */
	void auth_xfer_timer(void* arg);

	/** callback for commpoint udp replies to task_probe */
	int auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err,
	struct comm_reply* repinfo);
	/** callback for task_transfer tcp connections */
	int auth_xfer_transfer_tcp_callback(struct comm_point* c, void* arg, int err,
	struct comm_reply* repinfo);
	/** callback for task_transfer http connections */
	int auth_xfer_transfer_http_callback(struct comm_point* c, void* arg, int err,
	struct comm_reply* repinfo);
	/** xfer probe timeout callback, part of task_probe */
	void auth_xfer_probe_timer_callback(void* arg);
	+/** xfer transfer timeout callback, part of task_transfer */
	+void auth_xfer_transfer_timer_callback(void* arg);
	/** mesh callback for task_probe on lookup of host names */
	void auth_xfer_probe_lookup_callback(void* arg, int rcode,
	struct sldns_buffer* buf, enum sec_status sec, char* why_bogus,
	int was_ratelimited);
	/** mesh callback for task_transfer on lookup of host names */
	void auth_xfer_transfer_lookup_callback(void* arg, int rcode,
	struct sldns_buffer* buf, enum sec_status sec, char* why_bogus,
	int was_ratelimited);

	/*
	* Compares two 32-bit serial numbers as defined in RFC1982. Returns
	* <0 if a < b, 0 if a == b, and >0 if a > b. The result is undefined
	* if a != b but neither is greater or smaller (see RFC1982 section
	* 3.2.).
	*/
	int compare_serial(uint32_t a, uint32_t b);

	#endif /* SERVICES_AUTHZONE_H */
	Index: head/contrib/unbound/services/cache/dns.c
	===================================================================
	--- head/contrib/unbound/services/cache/dns.c (revision 349719)
	+++ head/contrib/unbound/services/cache/dns.c (revision 349720)
	@@ -1,1000 +1,1017 @@
	/*
	* services/cache/dns.c - Cache services for DNS using msg and rrset caches.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains the DNS cache.
	*/
	#include "config.h"
	#include "iterator/iter_delegpt.h"
	+#include "iterator/iter_utils.h"
	#include "validator/val_nsec.h"
	#include "validator/val_utils.h"
	#include "services/cache/dns.h"
	#include "services/cache/rrset.h"
	#include "util/data/msgreply.h"
	#include "util/data/packed_rrset.h"
	#include "util/data/dname.h"
	#include "util/module.h"
	#include "util/net_help.h"
	#include "util/regional.h"
	#include "util/config_file.h"
	#include "sldns/sbuffer.h"

	/** store rrsets in the rrset cache.
	* @param env: module environment with caches.
	* @param rep: contains list of rrsets to store.
	* @param now: current time.
	* @param leeway: during prefetch how much leeway to update TTLs.
	* This makes rrsets (other than type NS) timeout sooner so they get
	* updated with a new full TTL.
	* Type NS does not get this, because it must not be refreshed from the
	* child domain, but keep counting down properly.
	* @param pside: if from parentside discovered NS, so that its NS is okay
	* in a prefetch situation to be updated (without becoming sticky).
	* @param qrep: update rrsets here if cache is better
	* @param region: for qrep allocs.
	*/
	static void
	store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
	time_t leeway, int pside, struct reply_info* qrep,
	struct regional* region)
	{
	size_t i;
	/* see if rrset already exists in cache, if not insert it. */
	for(i=0; i<rep->rrset_count; i++) {
	rep->ref[i].key = rep->rrsets[i];
	rep->ref[i].id = rep->rrsets[i]->id;
	/* update ref if it was in the cache */
	switch(rrset_cache_update(env->rrset_cache, &rep->ref[i],
	env->alloc, now + ((ntohs(rep->ref[i].key->rk.type)==
	LDNS_RR_TYPE_NS && !pside)?0:leeway))) {
	case 0: /* ref unchanged, item inserted */
	break;
	case 2: /* ref updated, cache is superior */
	if(region) {
	struct ub_packed_rrset_key* ck;
	lock_rw_rdlock(&rep->ref[i].key->entry.lock);
	/* if deleted rrset, do not copy it */
	if(rep->ref[i].key->id == 0)
	ck = NULL;
	else ck = packed_rrset_copy_region(
	rep->ref[i].key, region, now);
	lock_rw_unlock(&rep->ref[i].key->entry.lock);
	if(ck) {
	/* use cached copy if memory allows */
	qrep->rrsets[i] = ck;
	}
	}
	/* no break: also copy key item */
	/* the line below is matched by gcc regex and silences
	* the fallthrough warning */
	/* fallthrough */
	case 1: /* ref updated, item inserted */
	rep->rrsets[i] = rep->ref[i].key;
	}
	}
	}

	/** delete message from message cache */
	void
	msg_cache_remove(struct module_env* env, uint8_t* qname, size_t qnamelen,
	uint16_t qtype, uint16_t qclass, uint16_t flags)
	{
	struct query_info k;
	hashvalue_type h;

	k.qname = qname;
	k.qname_len = qnamelen;
	k.qtype = qtype;
	k.qclass = qclass;
	k.local_alias = NULL;
	h = query_info_hash(&k, flags);
	slabhash_remove(env->msg_cache, h, &k);
	}

	/** remove servfail msg cache entry */
	static void
	msg_del_servfail(struct module_env* env, struct query_info* qinfo,
	uint32_t flags)
	{
	struct msgreply_entry* e;
	/* see if the entry is servfail, and then remove it, so that
	* lookups move from the cacheresponse stage to the recursionresponse
	* stage */
	e = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len,
	qinfo->qtype, qinfo->qclass, flags, 0, 0);
	if(!e) return;
	/* we don't check for the ttl here, also expired servfail entries
	* are removed. If the user uses serve-expired, they would still be
	* used to answer from cache */
	if(FLAGS_GET_RCODE(((struct reply_info*)e->entry.data)->flags)
	!= LDNS_RCODE_SERVFAIL) {
	lock_rw_unlock(&e->entry.lock);
	return;
	}
	lock_rw_unlock(&e->entry.lock);
	msg_cache_remove(env, qinfo->qname, qinfo->qname_len, qinfo->qtype,
	qinfo->qclass, flags);
	}

	void
	dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
	hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside,
	struct reply_info* qrep, uint32_t flags, struct regional* region)
	{
	struct msgreply_entry* e;
	time_t ttl = rep->ttl;
	size_t i;

	/* store RRsets */
	for(i=0; i<rep->rrset_count; i++) {
	rep->ref[i].key = rep->rrsets[i];
	rep->ref[i].id = rep->rrsets[i]->id;
	}

	/* there was a reply_info_sortref(rep) here but it seems to be
	* unnecessary, because the cache gets locked per rrset. */
	reply_info_set_ttls(rep, *env->now);
	store_rrsets(env, rep, *env->now, leeway, pside, qrep, region);
	if(ttl == 0 && !(flags & DNSCACHE_STORE_ZEROTTL)) {
	/* we do not store the message, but we did store the RRs,
	* which could be useful for delegation information */
	verbose(VERB_ALGO, "TTL 0: dropped msg from cache");
	free(rep);
	/* if the message is SERVFAIL in cache, remove that SERVFAIL,
	* so that the TTL 0 response can be returned for future
	* responses (i.e. don't get answered by the servfail from
	* cache, but instead go to recursion to get this TTL0
	* response). */
	msg_del_servfail(env, qinfo, flags);
	return;
	}

	/* store msg in the cache */
	reply_info_sortref(rep);
	if(!(e = query_info_entrysetup(qinfo, rep, hash))) {
	log_err("store_msg: malloc failed");
	return;
	}
	slabhash_insert(env->msg_cache, hash, &e->entry, rep, env->alloc);
	}

	/** find closest NS or DNAME and returns the rrset (locked) */
	static struct ub_packed_rrset_key*
	find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
	uint16_t qclass, time_t now, uint16_t searchtype, int stripfront)
	{
	struct ub_packed_rrset_key *rrset;
	uint8_t lablen;

	if(stripfront) {
	/* strip off so that DNAMEs have strict subdomain match */
	lablen = *qname;
	qname += lablen + 1;
	qnamelen -= lablen + 1;
	}

	/* snip off front part of qname until the type is found */
	while(qnamelen > 0) {
	if((rrset = rrset_cache_lookup(env->rrset_cache, qname,
	qnamelen, searchtype, qclass, 0, now, 0)))
	return rrset;

	/* snip off front label */
	lablen = *qname;
	qname += lablen + 1;
	qnamelen -= lablen + 1;
	}
	return NULL;
	}

	/** add addr to additional section */
	static void
	addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region,
	struct dns_msg* msg, time_t now)
	{
	if((msg->rep->rrsets[msg->rep->rrset_count] =
	packed_rrset_copy_region(rrset, region, now))) {
	msg->rep->ar_numrrsets++;
	msg->rep->rrset_count++;
	}
	}

	/** lookup message in message cache */
	struct msgreply_entry*
	msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen,
	uint16_t qtype, uint16_t qclass, uint16_t flags, time_t now, int wr)
	{
	struct lruhash_entry* e;
	struct query_info k;
	hashvalue_type h;

	k.qname = qname;
	k.qname_len = qnamelen;
	k.qtype = qtype;
	k.qclass = qclass;
	k.local_alias = NULL;
	h = query_info_hash(&k, flags);
	e = slabhash_lookup(env->msg_cache, h, &k, wr);

	if(!e) return NULL;
	if( now > ((struct reply_info*)e->data)->ttl ) {
	lock_rw_unlock(&e->lock);
	return NULL;
	}
	return (struct msgreply_entry*)e->key;
	}

	/** find and add A and AAAA records for nameservers in delegpt */
	static int
	find_add_addrs(struct module_env* env, uint16_t qclass,
	struct regional* region, struct delegpt* dp, time_t now,
	struct dns_msg** msg)
	{
	struct delegpt_ns* ns;
	struct msgreply_entry* neg;
	struct ub_packed_rrset_key* akey;
	for(ns = dp->nslist; ns; ns = ns->next) {
	akey = rrset_cache_lookup(env->rrset_cache, ns->name,
	ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
	if(akey) {
	if(!delegpt_add_rrset_A(dp, region, akey, 0)) {
	lock_rw_unlock(&akey->entry.lock);
	return 0;
	}
	if(msg)
	addr_to_additional(akey, region, *msg, now);
	lock_rw_unlock(&akey->entry.lock);
	} else {
	/* BIT_CD on false because delegpt lookup does
	* not use dns64 translation */
	neg = msg_cache_lookup(env, ns->name, ns->namelen,
	LDNS_RR_TYPE_A, qclass, 0, now, 0);
	if(neg) {
	delegpt_add_neg_msg(dp, neg);
	lock_rw_unlock(&neg->entry.lock);
	}
	}
	akey = rrset_cache_lookup(env->rrset_cache, ns->name,
	ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
	if(akey) {
	if(!delegpt_add_rrset_AAAA(dp, region, akey, 0)) {
	lock_rw_unlock(&akey->entry.lock);
	return 0;
	}
	if(msg)
	addr_to_additional(akey, region, *msg, now);
	lock_rw_unlock(&akey->entry.lock);
	} else {
	/* BIT_CD on false because delegpt lookup does
	* not use dns64 translation */
	neg = msg_cache_lookup(env, ns->name, ns->namelen,
	LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
	if(neg) {
	delegpt_add_neg_msg(dp, neg);
	lock_rw_unlock(&neg->entry.lock);
	}
	}
	}
	return 1;
	}

	/** find and add A and AAAA records for missing nameservers in delegpt */
	int
	cache_fill_missing(struct module_env* env, uint16_t qclass,
	struct regional* region, struct delegpt* dp)
	{
	struct delegpt_ns* ns;
	struct msgreply_entry* neg;
	struct ub_packed_rrset_key* akey;
	time_t now = *env->now;
	for(ns = dp->nslist; ns; ns = ns->next) {
	akey = rrset_cache_lookup(env->rrset_cache, ns->name,
	ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
	if(akey) {
	if(!delegpt_add_rrset_A(dp, region, akey, ns->lame)) {
	lock_rw_unlock(&akey->entry.lock);
	return 0;
	}
	log_nametypeclass(VERB_ALGO, "found in cache",
	ns->name, LDNS_RR_TYPE_A, qclass);
	lock_rw_unlock(&akey->entry.lock);
	} else {
	/* BIT_CD on false because delegpt lookup does
	* not use dns64 translation */
	neg = msg_cache_lookup(env, ns->name, ns->namelen,
	LDNS_RR_TYPE_A, qclass, 0, now, 0);
	if(neg) {
	delegpt_add_neg_msg(dp, neg);
	lock_rw_unlock(&neg->entry.lock);
	}
	}
	akey = rrset_cache_lookup(env->rrset_cache, ns->name,
	ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
	if(akey) {
	if(!delegpt_add_rrset_AAAA(dp, region, akey, ns->lame)) {
	lock_rw_unlock(&akey->entry.lock);
	return 0;
	}
	log_nametypeclass(VERB_ALGO, "found in cache",
	ns->name, LDNS_RR_TYPE_AAAA, qclass);
	lock_rw_unlock(&akey->entry.lock);
	} else {
	/* BIT_CD on false because delegpt lookup does
	* not use dns64 translation */
	neg = msg_cache_lookup(env, ns->name, ns->namelen,
	LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
	if(neg) {
	delegpt_add_neg_msg(dp, neg);
	lock_rw_unlock(&neg->entry.lock);
	}
	}
	}
	return 1;
	}

	/** find and add DS or NSEC to delegation msg */
	static void
	find_add_ds(struct module_env* env, struct regional* region,
	struct dns_msg* msg, struct delegpt* dp, time_t now)
	{
	/* Lookup the DS or NSEC at the delegation point. */
	struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
	env->rrset_cache, dp->name, dp->namelen, LDNS_RR_TYPE_DS,
	msg->qinfo.qclass, 0, now, 0);
	if(!rrset) {
	/* NOTE: this won't work for alternate NSEC schemes
	* (opt-in, NSEC3) */
	rrset = rrset_cache_lookup(env->rrset_cache, dp->name,
	dp->namelen, LDNS_RR_TYPE_NSEC, msg->qinfo.qclass,
	0, now, 0);
	/* Note: the PACKED_RRSET_NSEC_AT_APEX flag is not used.
	* since this is a referral, we need the NSEC at the parent
	* side of the zone cut, not the NSEC at apex side. */
	if(rrset && nsec_has_type(rrset, LDNS_RR_TYPE_DS)) {
	lock_rw_unlock(&rrset->entry.lock);
	rrset = NULL; /* discard wrong NSEC */
	}
	}
	if(rrset) {
	/* add it to auth section. This is the second rrset. */
	if((msg->rep->rrsets[msg->rep->rrset_count] =
	packed_rrset_copy_region(rrset, region, now))) {
	msg->rep->ns_numrrsets++;
	msg->rep->rrset_count++;
	}
	lock_rw_unlock(&rrset->entry.lock);
	}
	}

	struct dns_msg*
	dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
	uint16_t qclass, struct regional* region, size_t capacity)
	{
	struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
	sizeof(struct dns_msg));
	if(!msg)
	return NULL;
	msg->qinfo.qname = regional_alloc_init(region, qname, qnamelen);
	if(!msg->qinfo.qname)
	return NULL;
	msg->qinfo.qname_len = qnamelen;
	msg->qinfo.qtype = qtype;
	msg->qinfo.qclass = qclass;
	msg->qinfo.local_alias = NULL;
	/* non-packed reply_info, because it needs to grow the array */
	msg->rep = (struct reply_info*)regional_alloc_zero(region,
	sizeof(struct reply_info)-sizeof(struct rrset_ref));
	if(!msg->rep)
	return NULL;
	if(capacity > RR_COUNT_MAX)
	return NULL; /* integer overflow protection */
	msg->rep->flags = BIT_QR; /* with QR, no AA */
	msg->rep->qdcount = 1;
	msg->rep->rrsets = (struct ub_packed_rrset_key**)
	regional_alloc(region,
	capacitysizeof(struct ub_packed_rrset_key));
	if(!msg->rep->rrsets)
	return NULL;
	return msg;
	}

	int
	dns_msg_authadd(struct dns_msg* msg, struct regional* region,
	struct ub_packed_rrset_key* rrset, time_t now)
	{
	if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
	packed_rrset_copy_region(rrset, region, now)))
	return 0;
	msg->rep->ns_numrrsets++;
	return 1;
	}

	int
	dns_msg_ansadd(struct dns_msg* msg, struct regional* region,
	struct ub_packed_rrset_key* rrset, time_t now)
	{
	if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
	packed_rrset_copy_region(rrset, region, now)))
	return 0;
	msg->rep->an_numrrsets++;
	return 1;
	}

	struct delegpt*
	dns_cache_find_delegation(struct module_env* env, uint8_t* qname,
	size_t qnamelen, uint16_t qtype, uint16_t qclass,
	struct regional* region, struct dns_msg** msg, time_t now)
	{
	/* try to find closest NS rrset */
	struct ub_packed_rrset_key* nskey;
	struct packed_rrset_data* nsdata;
	struct delegpt* dp;

	nskey = find_closest_of_type(env, qname, qnamelen, qclass, now,
	LDNS_RR_TYPE_NS, 0);
	if(!nskey) /* hope the caller has hints to prime or something */
	return NULL;
	nsdata = (struct packed_rrset_data*)nskey->entry.data;
	/* got the NS key, create delegation point */
	dp = delegpt_create(region);
	if(!dp \|\| !delegpt_set_name(dp, region, nskey->rk.dname)) {
	lock_rw_unlock(&nskey->entry.lock);
	log_err("find_delegation: out of memory");
	return NULL;
	}
	/* create referral message */
	if(msg) {
	/* allocate the array to as much as we could need:
	* NS rrset + DS/NSEC rrset +
	* A rrset for every NS RR
	* AAAA rrset for every NS RR
	*/
	*msg = dns_msg_create(qname, qnamelen, qtype, qclass, region,
	2 + nsdata->count*2);
	if(!msg \|\| !dns_msg_authadd(msg, region, nskey, now)) {
	lock_rw_unlock(&nskey->entry.lock);
	log_err("find_delegation: out of memory");
	return NULL;
	}
	}
	if(!delegpt_rrset_add_ns(dp, region, nskey, 0))
	log_err("find_delegation: addns out of memory");
	lock_rw_unlock(&nskey->entry.lock); /* first unlock before next lookup*/
	/* find and add DS/NSEC (if any) */
	if(msg)
	find_add_ds(env, region, *msg, dp, now);
	/* find and add A entries */
	if(!find_add_addrs(env, qclass, region, dp, now, msg))
	log_err("find_delegation: addrs out of memory");
	return dp;
	}

	/** allocate dns_msg from query_info and reply_info */
	static struct dns_msg*
	gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
	{
	struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
	sizeof(struct dns_msg));
	if(!msg)
	return NULL;
	memcpy(&msg->qinfo, q, sizeof(struct query_info));
	msg->qinfo.qname = regional_alloc_init(region, q->qname, q->qname_len);
	if(!msg->qinfo.qname)
	return NULL;
	/* allocate replyinfo struct and rrset key array separately */
	msg->rep = (struct reply_info*)regional_alloc(region,
	sizeof(struct reply_info) - sizeof(struct rrset_ref));
	if(!msg->rep)
	return NULL;
	if(num > RR_COUNT_MAX)
	return NULL; /* integer overflow protection */
	msg->rep->rrsets = (struct ub_packed_rrset_key**)
	regional_alloc(region,
	num * sizeof(struct ub_packed_rrset_key*));
	if(!msg->rep->rrsets)
	return NULL;
	return msg;
	}

	struct dns_msg*
	tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
	struct regional* region, time_t now, struct regional* scratch)
	{
	struct dns_msg* msg;
	size_t i;
	if(now > r->ttl)
	return NULL;
	msg = gen_dns_msg(region, q, r->rrset_count);
	if(!msg)
	return NULL;
	msg->rep->flags = r->flags;
	msg->rep->qdcount = r->qdcount;
	msg->rep->ttl = r->ttl - now;
	if(r->prefetch_ttl > now)
	msg->rep->prefetch_ttl = r->prefetch_ttl - now;
	else msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
	msg->rep->security = r->security;
	msg->rep->an_numrrsets = r->an_numrrsets;
	msg->rep->ns_numrrsets = r->ns_numrrsets;
	msg->rep->ar_numrrsets = r->ar_numrrsets;
	msg->rep->rrset_count = r->rrset_count;
	msg->rep->authoritative = r->authoritative;
	if(!rrset_array_lock(r->ref, r->rrset_count, now))
	return NULL;
	if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons(
	LDNS_RR_TYPE_CNAME) \|\| r->rrsets[0]->rk.type == htons(
	LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(q, r)) {
	/* cname chain is now invalid, reconstruct msg */
	rrset_array_unlock(r->ref, r->rrset_count);
	return NULL;
	}
	if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) {
	/* message rrsets have changed status, revalidate */
	rrset_array_unlock(r->ref, r->rrset_count);
	return NULL;
	}
	for(i=0; i<msg->rep->rrset_count; i++) {
	msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i],
	region, now);
	if(!msg->rep->rrsets[i]) {
	rrset_array_unlock(r->ref, r->rrset_count);
	return NULL;
	}
	}
	if(env)
	rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref,
	r->rrset_count);
	else
	rrset_array_unlock(r->ref, r->rrset_count);
	return msg;
	}

	/** synthesize RRset-only response from cached RRset item */
	static struct dns_msg*
	rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
	time_t now, struct query_info* q)
	{
	struct dns_msg* msg;
	struct packed_rrset_data* d = (struct packed_rrset_data*)
	rrset->entry.data;
	if(now > d->ttl)
	return NULL;
	msg = gen_dns_msg(region, q, 1); /* only the CNAME (or other) RRset */
	if(!msg)
	return NULL;
	msg->rep->flags = BIT_QR; /* reply, no AA, no error */
	msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
	msg->rep->qdcount = 1;
	msg->rep->ttl = d->ttl - now;
	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
	msg->rep->security = sec_status_unchecked;
	msg->rep->an_numrrsets = 1;
	msg->rep->ns_numrrsets = 0;
	msg->rep->ar_numrrsets = 0;
	msg->rep->rrset_count = 1;
	msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
	if(!msg->rep->rrsets[0]) /* copy CNAME */
	return NULL;
	return msg;
	}

	/** synthesize DNAME+CNAME response from cached DNAME item */
	static struct dns_msg*
	synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
	time_t now, struct query_info* q, enum sec_status* sec_status)
	{
	struct dns_msg* msg;
	struct ub_packed_rrset_key* ck;
	struct packed_rrset_data* newd, d = (struct packed_rrset_data)
	rrset->entry.data;
	uint8_t* newname, *dtarg = NULL;
	size_t newlen, dtarglen;
	if(now > d->ttl)
	return NULL;
	/* only allow validated (with DNSSEC) DNAMEs used from cache
	* for insecure DNAMEs, query again. */
	*sec_status = d->security;
	/* return sec status, so the status of the CNAME can be checked
	* by the calling routine. */
	msg = gen_dns_msg(region, q, 2); /* DNAME + CNAME RRset */
	if(!msg)
	return NULL;
	msg->rep->flags = BIT_QR; /* reply, no AA, no error */
	msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
	msg->rep->qdcount = 1;
	msg->rep->ttl = d->ttl - now;
	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
	msg->rep->security = sec_status_unchecked;
	msg->rep->an_numrrsets = 1;
	msg->rep->ns_numrrsets = 0;
	msg->rep->ar_numrrsets = 0;
	msg->rep->rrset_count = 1;
	msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
	if(!msg->rep->rrsets[0]) /* copy DNAME */
	return NULL;
	/* synth CNAME rrset */
	get_cname_target(rrset, &dtarg, &dtarglen);
	if(!dtarg)
	return NULL;
	newlen = q->qname_len + dtarglen - rrset->rk.dname_len;
	if(newlen > LDNS_MAX_DOMAINLEN) {
	msg->rep->flags \|= LDNS_RCODE_YXDOMAIN;
	return msg;
	}
	newname = (uint8_t*)regional_alloc(region, newlen);
	if(!newname)
	return NULL;
	/* new name is concatenation of qname front (without DNAME owner)
	* and DNAME target name */
	memcpy(newname, q->qname, q->qname_len-rrset->rk.dname_len);
	memmove(newname+(q->qname_len-rrset->rk.dname_len), dtarg, dtarglen);
	/* create rest of CNAME rrset */
	ck = (struct ub_packed_rrset_key*)regional_alloc(region,
	sizeof(struct ub_packed_rrset_key));
	if(!ck)
	return NULL;
	memset(&ck->entry, 0, sizeof(ck->entry));
	msg->rep->rrsets[1] = ck;
	ck->entry.key = ck;
	ck->rk.type = htons(LDNS_RR_TYPE_CNAME);
	ck->rk.rrset_class = rrset->rk.rrset_class;
	ck->rk.flags = 0;
	ck->rk.dname = regional_alloc_init(region, q->qname, q->qname_len);
	if(!ck->rk.dname)
	return NULL;
	ck->rk.dname_len = q->qname_len;
	ck->entry.hash = rrset_key_hash(&ck->rk);
	newd = (struct packed_rrset_data*)regional_alloc_zero(region,
	sizeof(struct packed_rrset_data) + sizeof(size_t) +
	sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t)
	+ newlen);
	if(!newd)
	return NULL;
	ck->entry.data = newd;
	newd->ttl = 0; /* 0 for synthesized CNAME TTL */
	newd->count = 1;
	newd->rrsig_count = 0;
	newd->trust = rrset_trust_ans_noAA;
	newd->rr_len = (size_t)((uint8_t)newd +
	sizeof(struct packed_rrset_data));
	newd->rr_len[0] = newlen + sizeof(uint16_t);
	packed_rrset_ptr_fixup(newd);
	newd->rr_ttl[0] = newd->ttl;
	msg->rep->ttl = newd->ttl;
	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(newd->ttl);
	msg->rep->serve_expired_ttl = newd->ttl + SERVE_EXPIRED_TTL;
	sldns_write_uint16(newd->rr_data[0], newlen);
	memmove(newd->rr_data[0] + sizeof(uint16_t), newname, newlen);
	msg->rep->an_numrrsets ++;
	msg->rep->rrset_count ++;
	return msg;
	}

	/** Fill TYPE_ANY response with some data from cache */
	static struct dns_msg*
	fill_any(struct module_env* env,
	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
	struct regional* region)
	{
	time_t now = *env->now;
	struct dns_msg* msg = NULL;
	uint16_t lookup[] = {LDNS_RR_TYPE_A, LDNS_RR_TYPE_AAAA,
	LDNS_RR_TYPE_MX, LDNS_RR_TYPE_SOA, LDNS_RR_TYPE_NS,
	LDNS_RR_TYPE_DNAME, 0};
	int i, num=6; /* number of RR types to look up */
	log_assert(lookup[num] == 0);

	+ if(env->cfg->deny_any) {
	+ /* return empty message */
	+ msg = dns_msg_create(qname, qnamelen, qtype, qclass,
	+ region, 0);
	+ if(!msg) {
	+ return NULL;
	+ }
	+ /* set NOTIMPL for RFC 8482 */
	+ msg->rep->flags \|= LDNS_RCODE_NOTIMPL;
	+ msg->rep->security = sec_status_indeterminate;
	+ return msg;
	+ }
	+
	for(i=0; i<num; i++) {
	/* look up this RR for inclusion in type ANY response */
	struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
	env->rrset_cache, qname, qnamelen, lookup[i],
	qclass, 0, now, 0);
	struct packed_rrset_data *d;
	if(!rrset)
	continue;

	/* only if rrset from answer section */
	d = (struct packed_rrset_data*)rrset->entry.data;
	if(d->trust == rrset_trust_add_noAA \|\|
	d->trust == rrset_trust_auth_noAA \|\|
	d->trust == rrset_trust_add_AA \|\|
	d->trust == rrset_trust_auth_AA) {
	lock_rw_unlock(&rrset->entry.lock);
	continue;
	}

	/* create msg if none */
	if(!msg) {
	msg = dns_msg_create(qname, qnamelen, qtype, qclass,
	region, (size_t)(num-i));
	if(!msg) {
	lock_rw_unlock(&rrset->entry.lock);
	return NULL;
	}
	}

	/* add RRset to response */
	if(!dns_msg_ansadd(msg, region, rrset, now)) {
	lock_rw_unlock(&rrset->entry.lock);
	return NULL;
	}
	lock_rw_unlock(&rrset->entry.lock);
	}
	return msg;
	}

	struct dns_msg*
	dns_cache_lookup(struct module_env* env,
	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
	uint16_t flags, struct regional* region, struct regional* scratch,
	int no_partial)
	{
	struct lruhash_entry* e;
	struct query_info k;
	hashvalue_type h;
	time_t now = *env->now;
	struct ub_packed_rrset_key* rrset;

	/* lookup first, this has both NXdomains and ANSWER responses */
	k.qname = qname;
	k.qname_len = qnamelen;
	k.qtype = qtype;
	k.qclass = qclass;
	k.local_alias = NULL;
	h = query_info_hash(&k, flags);
	e = slabhash_lookup(env->msg_cache, h, &k, 0);
	if(e) {
	struct msgreply_entry* key = (struct msgreply_entry*)e->key;
	struct reply_info* data = (struct reply_info*)e->data;
	struct dns_msg* msg = tomsg(env, &key->key, data, region, now,
	scratch);
	if(msg) {
	lock_rw_unlock(&e->lock);
	return msg;
	}
	/* could be msg==NULL; due to TTL or not all rrsets available */
	lock_rw_unlock(&e->lock);
	}

	/* see if a DNAME exists. Checked for first, to enforce that DNAMEs
	* are more important, the CNAME is resynthesized and thus
	* consistent with the DNAME */
	if(!no_partial &&
	(rrset=find_closest_of_type(env, qname, qnamelen, qclass, now,
	LDNS_RR_TYPE_DNAME, 1))) {
	/* synthesize a DNAME+CNAME message based on this */
	enum sec_status sec_status = sec_status_unchecked;
	struct dns_msg* msg = synth_dname_msg(rrset, region, now, &k,
	&sec_status);
	if(msg) {
	struct ub_packed_rrset_key* cname_rrset;
	lock_rw_unlock(&rrset->entry.lock);
	/* now, after unlocking the DNAME rrset lock,
	* check the sec_status, and see if we need to look
	* up the CNAME record associated before it can
	* be used */
	/* normally, only secure DNAMEs allowed from cache*/
	if(sec_status == sec_status_secure)
	return msg;
	/* but if we have a CNAME cached with this name, then we
	* have previously already allowed this name to pass.
	* the next cache lookup is going to fetch that CNAME itself,
	* but it is better to have the (unsigned)DNAME + CNAME in
	* that case */
	cname_rrset = rrset_cache_lookup(
	env->rrset_cache, qname, qnamelen,
	LDNS_RR_TYPE_CNAME, qclass, 0, now, 0);
	if(cname_rrset) {
	/* CNAME already synthesized by
	* synth_dname_msg routine, so we can
	* straight up return the msg */
	lock_rw_unlock(&cname_rrset->entry.lock);
	return msg;
	}
	} else {
	lock_rw_unlock(&rrset->entry.lock);
	}
	}

	/* see if we have CNAME for this domain,
	* but not for DS records (which are part of the parent) */
	if(!no_partial && qtype != LDNS_RR_TYPE_DS &&
	(rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
	LDNS_RR_TYPE_CNAME, qclass, 0, now, 0))) {
	uint8_t* wc = NULL;
	size_t wl;
	/* if the rrset is not a wildcard expansion, with wcname */
	/* because, if we return that CNAME rrset on its own, it is
	* missing the NSEC or NSEC3 proof */
	if(!(val_rrset_wildcard(rrset, &wc, &wl) && wc != NULL)) {
	struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
	if(msg) {
	lock_rw_unlock(&rrset->entry.lock);
	return msg;
	}
	}
	lock_rw_unlock(&rrset->entry.lock);
	}

	/* construct DS, DNSKEY, DLV messages from rrset cache. */
	if((qtype == LDNS_RR_TYPE_DS \|\| qtype == LDNS_RR_TYPE_DNSKEY \|\|
	qtype == LDNS_RR_TYPE_DLV) &&
	(rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
	qtype, qclass, 0, now, 0))) {
	/* if the rrset is from the additional section, and the
	* signatures have fallen off, then do not synthesize a msg
	* instead, allow a full query for signed results to happen.
	* Forego all rrset data from additional section, because
	* some signatures may not be present and cause validation
	* failure.
	*/
	struct packed_rrset_data d = (struct packed_rrset_data)
	rrset->entry.data;
	if(d->trust != rrset_trust_add_noAA &&
	d->trust != rrset_trust_add_AA &&
	(qtype == LDNS_RR_TYPE_DS \|\|
	(d->trust != rrset_trust_auth_noAA
	&& d->trust != rrset_trust_auth_AA) )) {
	struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
	if(msg) {
	lock_rw_unlock(&rrset->entry.lock);
	return msg;
	}
	}
	lock_rw_unlock(&rrset->entry.lock);
	}

	/* stop downwards cache search on NXDOMAIN.
	* Empty nonterminals are NOERROR, so an NXDOMAIN for foo
	* means bla.foo also does not exist. The DNSSEC proofs are
	* the same. We search upwards for NXDOMAINs. */
	if(env->cfg->harden_below_nxdomain)
	while(!dname_is_root(k.qname)) {
	dname_remove_label(&k.qname, &k.qname_len);
	h = query_info_hash(&k, flags);
	e = slabhash_lookup(env->msg_cache, h, &k, 0);
	if(!e && k.qtype != LDNS_RR_TYPE_A &&
	env->cfg->qname_minimisation) {
	k.qtype = LDNS_RR_TYPE_A;
	h = query_info_hash(&k, flags);
	e = slabhash_lookup(env->msg_cache, h, &k, 0);
	}
	if(e) {
	struct reply_info* data = (struct reply_info*)e->data;
	struct dns_msg* msg;
	if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN
	&& data->security == sec_status_secure
	+ && (data->an_numrrsets == 0 \|\|
	+ ntohs(data->rrsets[0]->rk.type) != LDNS_RR_TYPE_CNAME)
	&& (msg=tomsg(env, &k, data, region, now, scratch))){
	lock_rw_unlock(&e->lock);
	msg->qinfo.qname=qname;
	msg->qinfo.qname_len=qnamelen;
	/* check that DNSSEC really works out */
	msg->rep->security = sec_status_unchecked;
	+ iter_scrub_nxdomain(msg);
	return msg;
	}
	lock_rw_unlock(&e->lock);
	}
	k.qtype = qtype;
	}

	/* fill common RR types for ANY response to avoid requery */
	if(qtype == LDNS_RR_TYPE_ANY) {
	return fill_any(env, qname, qnamelen, qtype, qclass, region);
	}

	return NULL;
	}

	int
	dns_cache_store(struct module_env* env, struct query_info* msgqinf,
	struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
	struct regional* region, uint32_t flags)
	{
	struct reply_info* rep = NULL;
	/* alloc, malloc properly (not in region, like msg is) */
	rep = reply_info_copy(msgrep, env->alloc, NULL);
	if(!rep)
	return 0;
	/* ttl must be relative ;i.e. 0..86400 not time(0)+86400.
	* the env->now is added to message and RRsets in this routine. */
	/* the leeway is used to invalidate other rrsets earlier */

	if(is_referral) {
	/* store rrsets */
	struct rrset_ref ref;
	size_t i;
	for(i=0; i<rep->rrset_count; i++) {
	packed_rrset_ttl_add((struct packed_rrset_data*)
	rep->rrsets[i]->entry.data, *env->now);
	ref.key = rep->rrsets[i];
	ref.id = rep->rrsets[i]->id;
	/ignore ret: it was in the cache, ref updated /
	/* no leeway for typeNS */
	(void)rrset_cache_update(env->rrset_cache, &ref,
	env->alloc, *env->now +
	((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS
	&& !pside) ? 0:leeway));
	}
	free(rep);
	return 1;
	} else {
	/* store msg, and rrsets */
	struct query_info qinf;
	hashvalue_type h;

	qinf = *msgqinf;
	qinf.qname = memdup(msgqinf->qname, msgqinf->qname_len);
	if(!qinf.qname) {
	reply_info_parsedelete(rep, env->alloc);
	return 0;
	}
	/* fixup flags to be sensible for a reply based on the cache */
	/* this module means that RA is available. It is an answer QR.
	* Not AA from cache. Not CD in cache (depends on client bit). */
	rep->flags \|= (BIT_RA \| BIT_QR);
	rep->flags &= ~(BIT_AA \| BIT_CD);
	h = query_info_hash(&qinf, (uint16_t)flags);
	dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep,
	flags, region);
	/* qname is used inside query_info_entrysetup, and set to
	* NULL. If it has not been used, free it. free(0) is safe. */
	free(qinf.qname);
	}
	return 1;
	}

	int
	dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo,
	time_t adjust, uint16_t flags)
	{
	struct msgreply_entry* msg;
	msg = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len,
	qinfo->qtype, qinfo->qclass, flags, *env->now, 1);
	if(msg) {
	struct reply_info* rep = (struct reply_info*)msg->entry.data;
	if(rep) {
	rep->prefetch_ttl += adjust;
	lock_rw_unlock(&msg->entry.lock);
	return 1;
	}
	lock_rw_unlock(&msg->entry.lock);
	}
	return 0;
	}
	Index: head/contrib/unbound/services/cache/infra.c
	===================================================================
	--- head/contrib/unbound/services/cache/infra.c (revision 349719)
	+++ head/contrib/unbound/services/cache/infra.c (revision 349720)
	@@ -1,1025 +1,1055 @@
	/*
	* services/cache/infra.c - infrastructure cache, server rtt and capabilities
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains the infrastructure cache.
	*/
	#include "config.h"
	#include "sldns/rrdef.h"
	#include "sldns/str2wire.h"
	+#include "sldns/sbuffer.h"
	+#include "sldns/wire2str.h"
	#include "services/cache/infra.h"
	#include "util/storage/slabhash.h"
	#include "util/storage/lookup3.h"
	#include "util/data/dname.h"
	#include "util/log.h"
	#include "util/net_help.h"
	#include "util/config_file.h"
	#include "iterator/iterator.h"

	/** Timeout when only a single probe query per IP is allowed. */
	#define PROBE_MAXRTO 12000 /* in msec */

	/** number of timeouts for a type when the domain can be blocked ;
	* even if another type has completely rtt maxed it, the different type
	* can do this number of packets (until those all timeout too) */
	#define TIMEOUT_COUNT_MAX 3

	/** ratelimit value for delegation point */
	int infra_dp_ratelimit = 0;

	/** ratelimit value for client ip addresses,
	* in queries per second. */
	int infra_ip_ratelimit = 0;

	size_t
	infra_sizefunc(void* k, void* ATTR_UNUSED(d))
	{
	struct infra_key* key = (struct infra_key*)k;
	return sizeof(*key) + sizeof(struct infra_data) + key->namelen
	+ lock_get_mem(&key->entry.lock);
	}

	int
	infra_compfunc(void* key1, void* key2)
	{
	struct infra_key* k1 = (struct infra_key*)key1;
	struct infra_key* k2 = (struct infra_key*)key2;
	int r = sockaddr_cmp(&k1->addr, k1->addrlen, &k2->addr, k2->addrlen);
	if(r != 0)
	return r;
	if(k1->namelen != k2->namelen) {
	if(k1->namelen < k2->namelen)
	return -1;
	return 1;
	}
	return query_dname_compare(k1->zonename, k2->zonename);
	}

	void
	infra_delkeyfunc(void* k, void* ATTR_UNUSED(arg))
	{
	struct infra_key* key = (struct infra_key*)k;
	if(!key)
	return;
	lock_rw_destroy(&key->entry.lock);
	free(key->zonename);
	free(key);
	}

	void
	infra_deldatafunc(void* d, void* ATTR_UNUSED(arg))
	{
	struct infra_data* data = (struct infra_data*)d;
	free(data);
	}

	size_t
	rate_sizefunc(void* k, void* ATTR_UNUSED(d))
	{
	struct rate_key* key = (struct rate_key*)k;
	return sizeof(*key) + sizeof(struct rate_data) + key->namelen
	+ lock_get_mem(&key->entry.lock);
	}

	int
	rate_compfunc(void* key1, void* key2)
	{
	struct rate_key* k1 = (struct rate_key*)key1;
	struct rate_key* k2 = (struct rate_key*)key2;
	if(k1->namelen != k2->namelen) {
	if(k1->namelen < k2->namelen)
	return -1;
	return 1;
	}
	return query_dname_compare(k1->name, k2->name);
	}

	void
	rate_delkeyfunc(void* k, void* ATTR_UNUSED(arg))
	{
	struct rate_key* key = (struct rate_key*)k;
	if(!key)
	return;
	lock_rw_destroy(&key->entry.lock);
	free(key->name);
	free(key);
	}

	void
	rate_deldatafunc(void* d, void* ATTR_UNUSED(arg))
	{
	struct rate_data* data = (struct rate_data*)d;
	free(data);
	}

	/** find or create element in domainlimit tree */
	static struct domain_limit_data* domain_limit_findcreate(
	struct infra_cache* infra, char* name)
	{
	uint8_t* nm;
	int labs;
	size_t nmlen;
	struct domain_limit_data* d;

	/* parse name */
	nm = sldns_str2wire_dname(name, &nmlen);
	if(!nm) {
	log_err("could not parse %s", name);
	return NULL;
	}
	labs = dname_count_labels(nm);

	/* can we find it? */
	d = (struct domain_limit_data*)name_tree_find(&infra->domain_limits,
	nm, nmlen, labs, LDNS_RR_CLASS_IN);
	if(d) {
	free(nm);
	return d;
	}

	/* create it */
	d = (struct domain_limit_data)calloc(1, sizeof(d));
	if(!d) {
	free(nm);
	return NULL;
	}
	d->node.node.key = &d->node;
	d->node.name = nm;
	d->node.len = nmlen;
	d->node.labs = labs;
	d->node.dclass = LDNS_RR_CLASS_IN;
	d->lim = -1;
	d->below = -1;
	if(!name_tree_insert(&infra->domain_limits, &d->node, nm, nmlen,
	labs, LDNS_RR_CLASS_IN)) {
	log_err("duplicate element in domainlimit tree");
	free(nm);
	free(d);
	return NULL;
	}
	return d;
	}

	/** insert rate limit configuration into lookup tree */
	static int infra_ratelimit_cfg_insert(struct infra_cache* infra,
	struct config_file* cfg)
	{
	struct config_str2list* p;
	struct domain_limit_data* d;
	for(p = cfg->ratelimit_for_domain; p; p = p->next) {
	d = domain_limit_findcreate(infra, p->str);
	if(!d)
	return 0;
	d->lim = atoi(p->str2);
	}
	for(p = cfg->ratelimit_below_domain; p; p = p->next) {
	d = domain_limit_findcreate(infra, p->str);
	if(!d)
	return 0;
	d->below = atoi(p->str2);
	}
	return 1;
	}

	/** setup domain limits tree (0 on failure) */
	static int
	setup_domain_limits(struct infra_cache* infra, struct config_file* cfg)
	{
	name_tree_init(&infra->domain_limits);
	if(!infra_ratelimit_cfg_insert(infra, cfg)) {
	return 0;
	}
	name_tree_init_parents(&infra->domain_limits);
	return 1;
	}

	struct infra_cache*
	infra_create(struct config_file* cfg)
	{
	struct infra_cache* infra = (struct infra_cache*)calloc(1,
	sizeof(struct infra_cache));
	size_t maxmem = cfg->infra_cache_numhosts * (sizeof(struct infra_key)+
	sizeof(struct infra_data)+INFRA_BYTES_NAME);
	infra->hosts = slabhash_create(cfg->infra_cache_slabs,
	INFRA_HOST_STARTSIZE, maxmem, &infra_sizefunc, &infra_compfunc,
	&infra_delkeyfunc, &infra_deldatafunc, NULL);
	if(!infra->hosts) {
	free(infra);
	return NULL;
	}
	infra->host_ttl = cfg->host_ttl;
	infra_dp_ratelimit = cfg->ratelimit;
	infra->domain_rates = slabhash_create(cfg->ratelimit_slabs,
	INFRA_HOST_STARTSIZE, cfg->ratelimit_size,
	&rate_sizefunc, &rate_compfunc, &rate_delkeyfunc,
	&rate_deldatafunc, NULL);
	if(!infra->domain_rates) {
	infra_delete(infra);
	return NULL;
	}
	/* insert config data into ratelimits */
	if(!setup_domain_limits(infra, cfg)) {
	infra_delete(infra);
	return NULL;
	}
	infra_ip_ratelimit = cfg->ip_ratelimit;
	infra->client_ip_rates = slabhash_create(cfg->ip_ratelimit_slabs,
	INFRA_HOST_STARTSIZE, cfg->ip_ratelimit_size, &ip_rate_sizefunc,
	&ip_rate_compfunc, &ip_rate_delkeyfunc, &ip_rate_deldatafunc, NULL);
	if(!infra->client_ip_rates) {
	infra_delete(infra);
	return NULL;
	}
	return infra;
	}

	/** delete domain_limit entries */
	static void domain_limit_free(rbnode_type* n, void* ATTR_UNUSED(arg))
	{
	if(n) {
	free(((struct domain_limit_data*)n)->node.name);
	free(n);
	}
	}

	void
	infra_delete(struct infra_cache* infra)
	{
	if(!infra)
	return;
	slabhash_delete(infra->hosts);
	slabhash_delete(infra->domain_rates);
	traverse_postorder(&infra->domain_limits, domain_limit_free, NULL);
	slabhash_delete(infra->client_ip_rates);
	free(infra);
	}

	struct infra_cache*
	infra_adjust(struct infra_cache* infra, struct config_file* cfg)
	{
	size_t maxmem;
	if(!infra)
	return infra_create(cfg);
	infra->host_ttl = cfg->host_ttl;
	infra_dp_ratelimit = cfg->ratelimit;
	infra_ip_ratelimit = cfg->ip_ratelimit;
	maxmem = cfg->infra_cache_numhosts * (sizeof(struct infra_key)+
	sizeof(struct infra_data)+INFRA_BYTES_NAME);
	/* divide cachesize by slabs and multiply by slabs, because if the
	* cachesize is not an even multiple of slabs, that is the resulting
	* size of the slabhash */
	if(!slabhash_is_size(infra->hosts, maxmem, cfg->infra_cache_slabs) \|\|
	!slabhash_is_size(infra->domain_rates, cfg->ratelimit_size,
	cfg->ratelimit_slabs) \|\|
	!slabhash_is_size(infra->client_ip_rates, cfg->ip_ratelimit_size,
	cfg->ip_ratelimit_slabs)) {
	infra_delete(infra);
	infra = infra_create(cfg);
	} else {
	/* reapply domain limits */
	traverse_postorder(&infra->domain_limits, domain_limit_free,
	NULL);
	if(!setup_domain_limits(infra, cfg)) {
	infra_delete(infra);
	return NULL;
	}
	}
	return infra;
	}

	/** calculate the hash value for a host key
	* set use_port to a non-0 number to use the port in
	* the hash calculation; 0 to ignore the port.*/
	static hashvalue_type
	hash_addr(struct sockaddr_storage* addr, socklen_t addrlen,
	int use_port)
	{
	hashvalue_type h = 0xab;
	/* select the pieces to hash, some OS have changing data inside */
	if(addr_is_ip6(addr, addrlen)) {
	struct sockaddr_in6* in6 = (struct sockaddr_in6*)addr;
	h = hashlittle(&in6->sin6_family, sizeof(in6->sin6_family), h);
	if(use_port){
	h = hashlittle(&in6->sin6_port, sizeof(in6->sin6_port), h);
	}
	h = hashlittle(&in6->sin6_addr, INET6_SIZE, h);
	} else {
	struct sockaddr_in* in = (struct sockaddr_in*)addr;
	h = hashlittle(&in->sin_family, sizeof(in->sin_family), h);
	if(use_port){
	h = hashlittle(&in->sin_port, sizeof(in->sin_port), h);
	}
	h = hashlittle(&in->sin_addr, INET_SIZE, h);
	}
	return h;
	}

	/** calculate infra hash for a key */
	static hashvalue_type
	hash_infra(struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* name)
	{
	return dname_query_hash(name, hash_addr(addr, addrlen, 1));
	}

	/** lookup version that does not check host ttl (you check it) */
	struct lruhash_entry*
	infra_lookup_nottl(struct infra_cache* infra, struct sockaddr_storage* addr,
	socklen_t addrlen, uint8_t* name, size_t namelen, int wr)
	{
	struct infra_key k;
	k.addrlen = addrlen;
	memcpy(&k.addr, addr, addrlen);
	k.namelen = namelen;
	k.zonename = name;
	k.entry.hash = hash_infra(addr, addrlen, name);
	k.entry.key = (void*)&k;
	k.entry.data = NULL;
	return slabhash_lookup(infra->hosts, k.entry.hash, &k, wr);
	}

	/** init the data elements */
	static void
	data_entry_init(struct infra_cache* infra, struct lruhash_entry* e,
	time_t timenow)
	{
	struct infra_data* data = (struct infra_data*)e->data;
	data->ttl = timenow + infra->host_ttl;
	rtt_init(&data->rtt);
	data->edns_version = 0;
	data->edns_lame_known = 0;
	data->probedelay = 0;
	data->isdnsseclame = 0;
	data->rec_lame = 0;
	data->lame_type_A = 0;
	data->lame_other = 0;
	data->timeout_A = 0;
	data->timeout_AAAA = 0;
	data->timeout_other = 0;
	}

	/**
	* Create and init a new entry for a host
	* @param infra: infra structure with config parameters.
	* @param addr: host address.
	* @param addrlen: length of addr.
	* @param name: name of zone
	* @param namelen: length of name.
	* @param tm: time now.
	* @return: the new entry or NULL on malloc failure.
	*/
	static struct lruhash_entry*
	new_entry(struct infra_cache* infra, struct sockaddr_storage* addr,
	socklen_t addrlen, uint8_t* name, size_t namelen, time_t tm)
	{
	struct infra_data* data;
	struct infra_key* key = (struct infra_key)malloc(sizeof(key));
	if(!key)
	return NULL;
	data = (struct infra_data*)malloc(sizeof(struct infra_data));
	if(!data) {
	free(key);
	return NULL;
	}
	key->zonename = memdup(name, namelen);
	if(!key->zonename) {
	free(key);
	free(data);
	return NULL;
	}
	key->namelen = namelen;
	lock_rw_init(&key->entry.lock);
	key->entry.hash = hash_infra(addr, addrlen, name);
	key->entry.key = (void*)key;
	key->entry.data = (void*)data;
	key->addrlen = addrlen;
	memcpy(&key->addr, addr, addrlen);
	data_entry_init(infra, &key->entry, tm);
	return &key->entry;
	}

	int
	infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
	socklen_t addrlen, uint8_t* nm, size_t nmlen, time_t timenow,
	int* edns_vs, uint8_t* edns_lame_known, int* to)
	{
	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
	nm, nmlen, 0);
	struct infra_data* data;
	int wr = 0;
	if(e && ((struct infra_data*)e->data)->ttl < timenow) {
	/* it expired, try to reuse existing entry */
	int old = ((struct infra_data*)e->data)->rtt.rto;
	uint8_t tA = ((struct infra_data*)e->data)->timeout_A;
	uint8_t tAAAA = ((struct infra_data*)e->data)->timeout_AAAA;
	uint8_t tother = ((struct infra_data*)e->data)->timeout_other;
	lock_rw_unlock(&e->lock);
	e = infra_lookup_nottl(infra, addr, addrlen, nm, nmlen, 1);
	if(e) {
	/* if its still there we have a writelock, init */
	/* re-initialise */
	/* do not touch lameness, it may be valid still */
	data_entry_init(infra, e, timenow);
	wr = 1;
	/* TOP_TIMEOUT remains on reuse */
	if(old >= USEFUL_SERVER_TOP_TIMEOUT) {
	((struct infra_data*)e->data)->rtt.rto
	= USEFUL_SERVER_TOP_TIMEOUT;
	((struct infra_data*)e->data)->timeout_A = tA;
	((struct infra_data*)e->data)->timeout_AAAA = tAAAA;
	((struct infra_data*)e->data)->timeout_other = tother;
	}
	}
	}
	if(!e) {
	/* insert new entry */
	if(!(e = new_entry(infra, addr, addrlen, nm, nmlen, timenow)))
	return 0;
	data = (struct infra_data*)e->data;
	*edns_vs = data->edns_version;
	*edns_lame_known = data->edns_lame_known;
	*to = rtt_timeout(&data->rtt);
	slabhash_insert(infra->hosts, e->hash, e, data, NULL);
	return 1;
	}
	/* use existing entry */
	data = (struct infra_data*)e->data;
	*edns_vs = data->edns_version;
	*edns_lame_known = data->edns_lame_known;
	*to = rtt_timeout(&data->rtt);
	if(to >= PROBE_MAXRTO && rtt_notimeout(&data->rtt)4 <= *to) {
	/* delay other queries, this is the probe query */
	if(!wr) {
	lock_rw_unlock(&e->lock);
	e = infra_lookup_nottl(infra, addr,addrlen,nm,nmlen, 1);
	if(!e) { /* flushed from cache real fast, no use to
	allocate just for the probedelay */
	return 1;
	}
	data = (struct infra_data*)e->data;
	}
	/* add 999 to round up the timeout value from msec to sec,
	* then add a whole second so it is certain that this probe
	* has timed out before the next is allowed */
	data->probedelay = timenow + ((*to)+1999)/1000;
	}
	lock_rw_unlock(&e->lock);
	return 1;
	}

	int
	infra_set_lame(struct infra_cache* infra, struct sockaddr_storage* addr,
	socklen_t addrlen, uint8_t* nm, size_t nmlen, time_t timenow,
	int dnsseclame, int reclame, uint16_t qtype)
	{
	struct infra_data* data;
	struct lruhash_entry* e;
	int needtoinsert = 0;
	e = infra_lookup_nottl(infra, addr, addrlen, nm, nmlen, 1);
	if(!e) {
	/* insert it */
	if(!(e = new_entry(infra, addr, addrlen, nm, nmlen, timenow))) {
	log_err("set_lame: malloc failure");
	return 0;
	}
	needtoinsert = 1;
	} else if( ((struct infra_data*)e->data)->ttl < timenow) {
	/* expired, reuse existing entry */
	data_entry_init(infra, e, timenow);
	}
	/* got an entry, now set the zone lame */
	data = (struct infra_data*)e->data;
	/* merge data (if any) */
	if(dnsseclame)
	data->isdnsseclame = 1;
	if(reclame)
	data->rec_lame = 1;
	if(!dnsseclame && !reclame && qtype == LDNS_RR_TYPE_A)
	data->lame_type_A = 1;
	if(!dnsseclame && !reclame && qtype != LDNS_RR_TYPE_A)
	data->lame_other = 1;
	/* done */
	if(needtoinsert)
	slabhash_insert(infra->hosts, e->hash, e, e->data, NULL);
	else { lock_rw_unlock(&e->lock); }
	return 1;
	}

	void
	infra_update_tcp_works(struct infra_cache* infra,
	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* nm,
	size_t nmlen)
	{
	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
	nm, nmlen, 1);
	struct infra_data* data;
	if(!e)
	return; /* doesn't exist */
	data = (struct infra_data*)e->data;
	if(data->rtt.rto >= RTT_MAX_TIMEOUT)
	/* do not disqualify this server altogether, it is better
	* than nothing */
	data->rtt.rto = RTT_MAX_TIMEOUT-1000;
	lock_rw_unlock(&e->lock);
	}

	int
	infra_rtt_update(struct infra_cache* infra, struct sockaddr_storage* addr,
	socklen_t addrlen, uint8_t* nm, size_t nmlen, int qtype,
	int roundtrip, int orig_rtt, time_t timenow)
	{
	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
	nm, nmlen, 1);
	struct infra_data* data;
	int needtoinsert = 0;
	int rto = 1;
	if(!e) {
	if(!(e = new_entry(infra, addr, addrlen, nm, nmlen, timenow)))
	return 0;
	needtoinsert = 1;
	} else if(((struct infra_data*)e->data)->ttl < timenow) {
	data_entry_init(infra, e, timenow);
	}
	/* have an entry, update the rtt */
	data = (struct infra_data*)e->data;
	if(roundtrip == -1) {
	rtt_lost(&data->rtt, orig_rtt);
	if(qtype == LDNS_RR_TYPE_A) {
	if(data->timeout_A < TIMEOUT_COUNT_MAX)
	data->timeout_A++;
	} else if(qtype == LDNS_RR_TYPE_AAAA) {
	if(data->timeout_AAAA < TIMEOUT_COUNT_MAX)
	data->timeout_AAAA++;
	} else {
	if(data->timeout_other < TIMEOUT_COUNT_MAX)
	data->timeout_other++;
	}
	} else {
	/* if we got a reply, but the old timeout was above server
	* selection height, delete the timeout so the server is
	* fully available again */
	if(rtt_unclamped(&data->rtt) >= USEFUL_SERVER_TOP_TIMEOUT)
	rtt_init(&data->rtt);
	rtt_update(&data->rtt, roundtrip);
	data->probedelay = 0;
	if(qtype == LDNS_RR_TYPE_A)
	data->timeout_A = 0;
	else if(qtype == LDNS_RR_TYPE_AAAA)
	data->timeout_AAAA = 0;
	else data->timeout_other = 0;
	}
	if(data->rtt.rto > 0)
	rto = data->rtt.rto;

	if(needtoinsert)
	slabhash_insert(infra->hosts, e->hash, e, e->data, NULL);
	else { lock_rw_unlock(&e->lock); }
	return rto;
	}

	long long infra_get_host_rto(struct infra_cache* infra,
	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* nm,
	size_t nmlen, struct rtt_info* rtt, int* delay, time_t timenow,
	int* tA, int* tAAAA, int* tother)
	{
	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
	nm, nmlen, 0);
	struct infra_data* data;
	long long ttl = -2;
	if(!e) return -1;
	data = (struct infra_data*)e->data;
	if(data->ttl >= timenow) {
	ttl = (long long)(data->ttl - timenow);
	memmove(rtt, &data->rtt, sizeof(*rtt));
	if(timenow < data->probedelay)
	*delay = (int)(data->probedelay - timenow);
	else *delay = 0;
	}
	*tA = (int)data->timeout_A;
	*tAAAA = (int)data->timeout_AAAA;
	*tother = (int)data->timeout_other;
	lock_rw_unlock(&e->lock);
	return ttl;
	}

	int
	infra_edns_update(struct infra_cache* infra, struct sockaddr_storage* addr,
	socklen_t addrlen, uint8_t* nm, size_t nmlen, int edns_version,
	time_t timenow)
	{
	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
	nm, nmlen, 1);
	struct infra_data* data;
	int needtoinsert = 0;
	if(!e) {
	if(!(e = new_entry(infra, addr, addrlen, nm, nmlen, timenow)))
	return 0;
	needtoinsert = 1;
	} else if(((struct infra_data*)e->data)->ttl < timenow) {
	data_entry_init(infra, e, timenow);
	}
	/* have an entry, update the rtt, and the ttl */
	data = (struct infra_data*)e->data;
	/* do not update if noEDNS and stored is yesEDNS */
	if(!(edns_version == -1 && (data->edns_version != -1 &&
	data->edns_lame_known))) {
	data->edns_version = edns_version;
	data->edns_lame_known = 1;
	}

	if(needtoinsert)
	slabhash_insert(infra->hosts, e->hash, e, e->data, NULL);
	else { lock_rw_unlock(&e->lock); }
	return 1;
	}

	int
	infra_get_lame_rtt(struct infra_cache* infra,
	struct sockaddr_storage* addr, socklen_t addrlen,
	uint8_t* name, size_t namelen, uint16_t qtype,
	int* lame, int* dnsseclame, int* reclame, int* rtt, time_t timenow)
	{
	struct infra_data* host;
	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
	name, namelen, 0);
	if(!e)
	return 0;
	host = (struct infra_data*)e->data;
	*rtt = rtt_unclamped(&host->rtt);
	if(host->rtt.rto >= PROBE_MAXRTO && timenow < host->probedelay
	&& rtt_notimeout(&host->rtt)*4 <= host->rtt.rto) {
	/* single probe for this domain, and we are not probing */
	/* unless the query type allows a probe to happen */
	if(qtype == LDNS_RR_TYPE_A) {
	if(host->timeout_A >= TIMEOUT_COUNT_MAX)
	*rtt = USEFUL_SERVER_TOP_TIMEOUT;
	else *rtt = USEFUL_SERVER_TOP_TIMEOUT-1000;
	} else if(qtype == LDNS_RR_TYPE_AAAA) {
	if(host->timeout_AAAA >= TIMEOUT_COUNT_MAX)
	*rtt = USEFUL_SERVER_TOP_TIMEOUT;
	else *rtt = USEFUL_SERVER_TOP_TIMEOUT-1000;
	} else {
	if(host->timeout_other >= TIMEOUT_COUNT_MAX)
	*rtt = USEFUL_SERVER_TOP_TIMEOUT;
	else *rtt = USEFUL_SERVER_TOP_TIMEOUT-1000;
	}
	}
	if(timenow > host->ttl) {
	/* expired entry */
	/* see if this can be a re-probe of an unresponsive server */
	/* minus 1000 because that is outside of the RTTBAND, so
	* blacklisted servers stay blacklisted if this is chosen */
	if(host->rtt.rto >= USEFUL_SERVER_TOP_TIMEOUT) {
	lock_rw_unlock(&e->lock);
	*rtt = USEFUL_SERVER_TOP_TIMEOUT-1000;
	*lame = 0;
	*dnsseclame = 0;
	*reclame = 0;
	return 1;
	}
	lock_rw_unlock(&e->lock);
	return 0;
	}
	/* check lameness first */
	if(host->lame_type_A && qtype == LDNS_RR_TYPE_A) {
	lock_rw_unlock(&e->lock);
	*lame = 1;
	*dnsseclame = 0;
	*reclame = 0;
	return 1;
	} else if(host->lame_other && qtype != LDNS_RR_TYPE_A) {
	lock_rw_unlock(&e->lock);
	*lame = 1;
	*dnsseclame = 0;
	*reclame = 0;
	return 1;
	} else if(host->isdnsseclame) {
	lock_rw_unlock(&e->lock);
	*lame = 0;
	*dnsseclame = 1;
	*reclame = 0;
	return 1;
	} else if(host->rec_lame) {
	lock_rw_unlock(&e->lock);
	*lame = 0;
	*dnsseclame = 0;
	*reclame = 1;
	return 1;
	}
	/* no lameness for this type of query */
	lock_rw_unlock(&e->lock);
	*lame = 0;
	*dnsseclame = 0;
	*reclame = 0;
	return 1;
	}

	int infra_find_ratelimit(struct infra_cache* infra, uint8_t* name,
	size_t namelen)
	{
	int labs = dname_count_labels(name);
	struct domain_limit_data* d = (struct domain_limit_data*)
	name_tree_lookup(&infra->domain_limits, name, namelen, labs,
	LDNS_RR_CLASS_IN);
	if(!d) return infra_dp_ratelimit;

	if(d->node.labs == labs && d->lim != -1)
	return d->lim; /* exact match */

	/* find 'below match' */
	if(d->node.labs == labs)
	d = (struct domain_limit_data*)d->node.parent;
	while(d) {
	if(d->below != -1)
	return d->below;
	d = (struct domain_limit_data*)d->node.parent;
	}
	return infra_dp_ratelimit;
	}

	size_t ip_rate_sizefunc(void* k, void* ATTR_UNUSED(d))
	{
	struct ip_rate_key* key = (struct ip_rate_key*)k;
	return sizeof(*key) + sizeof(struct ip_rate_data)
	+ lock_get_mem(&key->entry.lock);
	}

	int ip_rate_compfunc(void* key1, void* key2)
	{
	struct ip_rate_key* k1 = (struct ip_rate_key*)key1;
	struct ip_rate_key* k2 = (struct ip_rate_key*)key2;
	return sockaddr_cmp_addr(&k1->addr, k1->addrlen,
	&k2->addr, k2->addrlen);
	}

	void ip_rate_delkeyfunc(void* k, void* ATTR_UNUSED(arg))
	{
	struct ip_rate_key* key = (struct ip_rate_key*)k;
	if(!key)
	return;
	lock_rw_destroy(&key->entry.lock);
	free(key);
	}

	/** find data item in array, for write access, caller unlocks */
	static struct lruhash_entry* infra_find_ratedata(struct infra_cache* infra,
	uint8_t* name, size_t namelen, int wr)
	{
	struct rate_key key;
	hashvalue_type h = dname_query_hash(name, 0xab);
	memset(&key, 0, sizeof(key));
	key.name = name;
	key.namelen = namelen;
	key.entry.hash = h;
	return slabhash_lookup(infra->domain_rates, h, &key, wr);
	}

	/** find data item in array for ip addresses */
	static struct lruhash_entry* infra_find_ip_ratedata(struct infra_cache* infra,
	struct comm_reply* repinfo, int wr)
	{
	struct ip_rate_key key;
	hashvalue_type h = hash_addr(&(repinfo->addr),
	repinfo->addrlen, 0);
	memset(&key, 0, sizeof(key));
	key.addr = repinfo->addr;
	key.addrlen = repinfo->addrlen;
	key.entry.hash = h;
	return slabhash_lookup(infra->client_ip_rates, h, &key, wr);
	}

	/** create rate data item for name, number 1 in now */
	static void infra_create_ratedata(struct infra_cache* infra,
	uint8_t* name, size_t namelen, time_t timenow)
	{
	hashvalue_type h = dname_query_hash(name, 0xab);
	struct rate_key* k = (struct rate_key)calloc(1, sizeof(k));
	struct rate_data* d = (struct rate_data)calloc(1, sizeof(d));
	if(!k \|\| !d) {
	free(k);
	free(d);
	return; /* alloc failure */
	}
	k->namelen = namelen;
	k->name = memdup(name, namelen);
	if(!k->name) {
	free(k);
	free(d);
	return; /* alloc failure */
	}
	lock_rw_init(&k->entry.lock);
	k->entry.hash = h;
	k->entry.key = k;
	k->entry.data = d;
	d->qps[0] = 1;
	d->timestamp[0] = timenow;
	slabhash_insert(infra->domain_rates, h, &k->entry, d, NULL);
	}

	/** create rate data item for ip address */
	static void infra_ip_create_ratedata(struct infra_cache* infra,
	struct comm_reply* repinfo, time_t timenow)
	{
	hashvalue_type h = hash_addr(&(repinfo->addr),
	repinfo->addrlen, 0);
	struct ip_rate_key* k = (struct ip_rate_key)calloc(1, sizeof(k));
	struct ip_rate_data* d = (struct ip_rate_data)calloc(1, sizeof(d));
	if(!k \|\| !d) {
	free(k);
	free(d);
	return; /* alloc failure */
	}
	k->addr = repinfo->addr;
	k->addrlen = repinfo->addrlen;
	lock_rw_init(&k->entry.lock);
	k->entry.hash = h;
	k->entry.key = k;
	k->entry.data = d;
	d->qps[0] = 1;
	d->timestamp[0] = timenow;
	slabhash_insert(infra->client_ip_rates, h, &k->entry, d, NULL);
	}

	/** find the second and return its rate counter, if none, remove oldest */
	static int* infra_rate_find_second(void* data, time_t t)
	{
	struct rate_data* d = (struct rate_data*)data;
	int i, oldest;
	for(i=0; i<RATE_WINDOW; i++) {
	if(d->timestamp[i] == t)
	return &(d->qps[i]);
	}
	/* remove oldest timestamp, and insert it at t with 0 qps */
	oldest = 0;
	for(i=0; i<RATE_WINDOW; i++) {
	if(d->timestamp[i] < d->timestamp[oldest])
	oldest = i;
	}
	d->timestamp[oldest] = t;
	d->qps[oldest] = 0;
	return &(d->qps[oldest]);
	}

	int infra_rate_max(void* data, time_t now)
	{
	struct rate_data* d = (struct rate_data*)data;
	int i, max = 0;
	for(i=0; i<RATE_WINDOW; i++) {
	if(now-d->timestamp[i] <= RATE_WINDOW) {
	if(d->qps[i] > max)
	max = d->qps[i];
	}
	}
	return max;
	}

	int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name,
	- size_t namelen, time_t timenow)
	+ size_t namelen, time_t timenow, struct query_info* qinfo,
	+ struct comm_reply* replylist)
	{
	int lim, max;
	struct lruhash_entry* entry;

	if(!infra_dp_ratelimit)
	return 1; /* not enabled */

	/* find ratelimit */
	lim = infra_find_ratelimit(infra, name, namelen);
	if(!lim)
	return 1; /* disabled for this domain */

	/* find or insert ratedata */
	entry = infra_find_ratedata(infra, name, namelen, 1);
	if(entry) {
	int premax = infra_rate_max(entry->data, timenow);
	int* cur = infra_rate_find_second(entry->data, timenow);
	(*cur)++;
	max = infra_rate_max(entry->data, timenow);
	lock_rw_unlock(&entry->lock);

	if(premax < lim && max >= lim) {
	- char buf[257];
	+ char buf[257], qnm[257], ts[12], cs[12], ip[128];
	dname_str(name, buf);
	- verbose(VERB_OPS, "ratelimit exceeded %s %d", buf, lim);
	+ dname_str(qinfo->qname, qnm);
	+ sldns_wire2str_type_buf(qinfo->qtype, ts, sizeof(ts));
	+ sldns_wire2str_class_buf(qinfo->qclass, cs, sizeof(cs));
	+ ip[0]=0;
	+ if(replylist) {
	+ addr_to_str((struct sockaddr_storage *)&replylist->addr,
	+ replylist->addrlen, ip, sizeof(ip));
	+ verbose(VERB_OPS, "ratelimit exceeded %s %d query %s %s %s from %s", buf, lim, qnm, cs, ts, ip);
	+ } else {
	+ verbose(VERB_OPS, "ratelimit exceeded %s %d query %s %s %s", buf, lim, qnm, cs, ts);
	+ }
	}
	return (max < lim);
	}

	/* create */
	infra_create_ratedata(infra, name, namelen, timenow);
	return (1 < lim);
	}

	void infra_ratelimit_dec(struct infra_cache* infra, uint8_t* name,
	size_t namelen, time_t timenow)
	{
	struct lruhash_entry* entry;
	int* cur;
	if(!infra_dp_ratelimit)
	return; /* not enabled */
	entry = infra_find_ratedata(infra, name, namelen, 1);
	if(!entry) return; /* not cached */
	cur = infra_rate_find_second(entry->data, timenow);
	if((*cur) > 0)
	(*cur)--;
	lock_rw_unlock(&entry->lock);
	}

	int infra_ratelimit_exceeded(struct infra_cache* infra, uint8_t* name,
	size_t namelen, time_t timenow)
	{
	struct lruhash_entry* entry;
	int lim, max;
	if(!infra_dp_ratelimit)
	return 0; /* not enabled */

	/* find ratelimit */
	lim = infra_find_ratelimit(infra, name, namelen);
	if(!lim)
	return 0; /* disabled for this domain */

	/* find current rate */
	entry = infra_find_ratedata(infra, name, namelen, 0);
	if(!entry)
	return 0; /* not cached */
	max = infra_rate_max(entry->data, timenow);
	lock_rw_unlock(&entry->lock);

	return (max >= lim);
	}

	size_t
	infra_get_mem(struct infra_cache* infra)
	{
	size_t s = sizeof(*infra) + slabhash_get_mem(infra->hosts);
	if(infra->domain_rates) s += slabhash_get_mem(infra->domain_rates);
	if(infra->client_ip_rates) s += slabhash_get_mem(infra->client_ip_rates);
	/* ignore domain_limits because walk through tree is big */
	return s;
	}

	int infra_ip_ratelimit_inc(struct infra_cache* infra,
	- struct comm_reply* repinfo, time_t timenow)
	+ struct comm_reply* repinfo, time_t timenow, struct sldns_buffer* buffer)
	{
	int max;
	struct lruhash_entry* entry;

	/* not enabled */
	if(!infra_ip_ratelimit) {
	return 1;
	}
	/* find or insert ratedata */
	entry = infra_find_ip_ratedata(infra, repinfo, 1);
	if(entry) {
	int premax = infra_rate_max(entry->data, timenow);
	int* cur = infra_rate_find_second(entry->data, timenow);
	(*cur)++;
	max = infra_rate_max(entry->data, timenow);
	lock_rw_unlock(&entry->lock);

	if(premax < infra_ip_ratelimit && max >= infra_ip_ratelimit) {
	- char client_ip[128];
	+ char client_ip[128], qnm[LDNS_MAX_DOMAINLEN+1+12+12];
	addr_to_str((struct sockaddr_storage *)&repinfo->addr,
	repinfo->addrlen, client_ip, sizeof(client_ip));
	- verbose(VERB_OPS, "ip_ratelimit exceeded %s %d",
	- client_ip, infra_ip_ratelimit);
	+ qnm[0]=0;
	+ if(sldns_buffer_limit(buffer)>LDNS_HEADER_SIZE &&
	+ LDNS_QDCOUNT(sldns_buffer_begin(buffer))!=0) {
	+ (void)sldns_wire2str_rrquestion_buf(
	+ sldns_buffer_at(buffer, LDNS_HEADER_SIZE),
	+ sldns_buffer_limit(buffer)-LDNS_HEADER_SIZE,
	+ qnm, sizeof(qnm));
	+ if(strlen(qnm)>0 && qnm[strlen(qnm)-1]=='\n')
	+ qnm[strlen(qnm)-1] = 0; /remove newline/
	+ if(strchr(qnm, '\t'))
	+ *strchr(qnm, '\t') = ' ';
	+ if(strchr(qnm, '\t'))
	+ *strchr(qnm, '\t') = ' ';
	+ verbose(VERB_OPS, "ip_ratelimit exceeded %s %d %s",
	+ client_ip, infra_ip_ratelimit, qnm);
	+ } else {
	+ verbose(VERB_OPS, "ip_ratelimit exceeded %s %d (no query name)",
	+ client_ip, infra_ip_ratelimit);
	+ }
	}
	return (max <= infra_ip_ratelimit);
	}

	/* create */
	infra_ip_create_ratedata(infra, repinfo, timenow);
	return 1;
	}
	Index: head/contrib/unbound/services/cache/infra.h
	===================================================================
	--- head/contrib/unbound/services/cache/infra.h (revision 349719)
	+++ head/contrib/unbound/services/cache/infra.h (revision 349720)
	@@ -1,462 +1,467 @@
	/*
	* services/cache/infra.h - infrastructure cache, server rtt and capabilities
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains the infrastructure cache, as well as rate limiting.
	* Note that there are two sorts of rate-limiting here:
	* - Pre-cache, per-query rate limiting (query ratelimits)
	* - Post-cache, per-domain name rate limiting (infra-ratelimits)
	*/

	#ifndef SERVICES_CACHE_INFRA_H
	#define SERVICES_CACHE_INFRA_H
	#include "util/storage/lruhash.h"
	#include "util/storage/dnstree.h"
	#include "util/rtt.h"
	#include "util/netevent.h"
	#include "util/data/msgreply.h"
	struct slabhash;
	struct config_file;

	/**
	* Host information kept for every server, per zone.
	*/
	struct infra_key {
	/** the host address. */
	struct sockaddr_storage addr;
	/** length of addr. */
	socklen_t addrlen;
	/** zone name in wireformat */
	uint8_t* zonename;
	/** length of zonename */
	size_t namelen;
	/** hash table entry, data of type infra_data. */
	struct lruhash_entry entry;
	};

	/**
	* Host information encompasses host capabilities and retransmission timeouts.
	* And lameness information (notAuthoritative, noEDNS, Recursive)
	*/
	struct infra_data {
	/** TTL value for this entry. absolute time. */
	time_t ttl;

	/** time in seconds (absolute) when probing re-commences, 0 disabled */
	time_t probedelay;
	/** round trip times for timeout calculation */
	struct rtt_info rtt;

	/** edns version that the host supports, -1 means no EDNS */
	int edns_version;
	/** if the EDNS lameness is already known or not.
	* EDNS lame is when EDNS queries or replies are dropped,
	* and cause a timeout */
	uint8_t edns_lame_known;

	/** is the host lame (does not serve the zone authoritatively),
	* or is the host dnssec lame (does not serve DNSSEC data) */
	uint8_t isdnsseclame;
	/** is the host recursion lame (not AA, but RA) */
	uint8_t rec_lame;
	/** the host is lame (not authoritative) for A records */
	uint8_t lame_type_A;
	/** the host is lame (not authoritative) for other query types */
	uint8_t lame_other;

	/** timeouts counter for type A */
	uint8_t timeout_A;
	/** timeouts counter for type AAAA */
	uint8_t timeout_AAAA;
	/** timeouts counter for others */
	uint8_t timeout_other;
	};

	/**
	* Infra cache
	*/
	struct infra_cache {
	/** The hash table with hosts */
	struct slabhash* hosts;
	/** TTL value for host information, in seconds */
	int host_ttl;
	/** hash table with query rates per name: rate_key, rate_data */
	struct slabhash* domain_rates;
	/** ratelimit settings for domains, struct domain_limit_data */
	rbtree_type domain_limits;
	/** hash table with query rates per client ip: ip_rate_key, ip_rate_data */
	struct slabhash* client_ip_rates;
	};

	/** ratelimit, unless overridden by domain_limits, 0 is off */
	extern int infra_dp_ratelimit;

	/**
	* ratelimit settings for domains
	*/
	struct domain_limit_data {
	/** key for rbtree, must be first in struct, name of domain */
	struct name_tree_node node;
	/** ratelimit for exact match with this name, -1 if not set */
	int lim;
	/** ratelimit for names below this name, -1 if not set */
	int below;
	};

	/**
	* key for ratelimit lookups, a domain name
	*/
	struct rate_key {
	/** lruhash key entry */
	struct lruhash_entry entry;
	/** domain name in uncompressed wireformat */
	uint8_t* name;
	/** length of name */
	size_t namelen;
	};

	/** ip ratelimit, 0 is off */
	extern int infra_ip_ratelimit;

	/**
	* key for ip_ratelimit lookups, a source IP.
	*/
	struct ip_rate_key {
	/** lruhash key entry */
	struct lruhash_entry entry;
	/** client ip information */
	struct sockaddr_storage addr;
	/** length of address */
	socklen_t addrlen;
	};

	/** number of seconds to track qps rate */
	#define RATE_WINDOW 2

	/**
	* Data for ratelimits per domain name
	* It is incremented when a non-cache-lookup happens for that domain name.
	* The name is the delegation point we have for the name.
	* If a new delegation point is found (a referral reply), the previous
	* delegation point is decremented, and the new one is charged with the query.
	*/
	struct rate_data {
	/** queries counted, for that second. 0 if not in use. */
	int qps[RATE_WINDOW];
	/** what the timestamp is of the qps array members, counter is
	* valid for that timestamp. Usually now and now-1. */
	time_t timestamp[RATE_WINDOW];
	};

	#define ip_rate_data rate_data

	/** infra host cache default hash lookup size */
	#define INFRA_HOST_STARTSIZE 32
	/** bytes per zonename reserved in the hostcache, dnamelen(zonename.com.) */
	#define INFRA_BYTES_NAME 14

	/**
	* Create infra cache.
	* @param cfg: config parameters or NULL for defaults.
	* @return: new infra cache, or NULL.
	*/
	struct infra_cache* infra_create(struct config_file* cfg);

	/**
	* Delete infra cache.
	* @param infra: infrastructure cache to delete.
	*/
	void infra_delete(struct infra_cache* infra);

	/**
	* Adjust infra cache to use updated configuration settings.
	* This may clean the cache. Operates a bit like realloc.
	* There may be no threading or use by other threads.
	* @param infra: existing cache. If NULL a new infra cache is returned.
	* @param cfg: config options.
	* @return the new infra cache pointer or NULL on error.
	*/
	struct infra_cache* infra_adjust(struct infra_cache* infra,
	struct config_file* cfg);

	/**
	* Plain find infra data function (used by the the other functions)
	* @param infra: infrastructure cache.
	* @param addr: host address.
	* @param addrlen: length of addr.
	* @param name: domain name of zone.
	* @param namelen: length of domain name.
	* @param wr: if true, writelock, else readlock.
	* @return the entry, could be expired (this is not checked) or NULL.
	*/
	struct lruhash_entry* infra_lookup_nottl(struct infra_cache* infra,
	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* name,
	size_t namelen, int wr);

	/**
	* Find host information to send a packet. Creates new entry if not found.
	* Lameness is empty. EDNS is 0 (try with first), and rtt is returned for
	* the first message to it.
	* Use this to send a packet only, because it also locks out others when
	* probing is restricted.
	* @param infra: infrastructure cache.
	* @param addr: host address.
	* @param addrlen: length of addr.
	* @param name: domain name of zone.
	* @param namelen: length of domain name.
	* @param timenow: what time it is now.
	* @param edns_vs: edns version it supports, is returned.
	* @param edns_lame_known: if EDNS lame (EDNS is dropped in transit) has
	* already been probed, is returned.
	* @param to: timeout to use, is returned.
	* @return: 0 on error.
	*/
	int infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
	socklen_t addrlen, uint8_t* name, size_t namelen,
	time_t timenow, int* edns_vs, uint8_t* edns_lame_known, int* to);

	/**
	* Set a host to be lame for the given zone.
	* @param infra: infrastructure cache.
	* @param addr: host address.
	* @param addrlen: length of addr.
	* @param name: domain name of zone apex.
	* @param namelen: length of domain name.
	* @param timenow: what time it is now.
	* @param dnsseclame: if true the host is set dnssec lame.
	* if false, the host is marked lame (not serving the zone).
	* @param reclame: if true host is a recursor not AA server.
	* if false, dnsseclame or marked lame.
	* @param qtype: the query type for which it is lame.
	* @return: 0 on error.
	*/
	int infra_set_lame(struct infra_cache* infra,
	struct sockaddr_storage* addr, socklen_t addrlen,
	uint8_t* name, size_t namelen, time_t timenow, int dnsseclame,
	int reclame, uint16_t qtype);

	/**
	* Update rtt information for the host.
	* @param infra: infrastructure cache.
	* @param addr: host address.
	* @param addrlen: length of addr.
	* @param name: zone name
	* @param namelen: zone name length
	* @param qtype: query type.
	* @param roundtrip: estimate of roundtrip time in milliseconds or -1 for
	* timeout.
	* @param orig_rtt: original rtt for the query that timed out (roundtrip==-1).
	* ignored if roundtrip != -1.
	* @param timenow: what time it is now.
	* @return: 0 on error. new rto otherwise.
	*/
	int infra_rtt_update(struct infra_cache* infra, struct sockaddr_storage* addr,
	socklen_t addrlen, uint8_t* name, size_t namelen, int qtype,
	int roundtrip, int orig_rtt, time_t timenow);

	/**
	* Update information for the host, store that a TCP transaction works.
	* @param infra: infrastructure cache.
	* @param addr: host address.
	* @param addrlen: length of addr.
	* @param name: name of zone
	* @param namelen: length of name
	*/
	void infra_update_tcp_works(struct infra_cache* infra,
	struct sockaddr_storage* addr, socklen_t addrlen,
	uint8_t* name, size_t namelen);

	/**
	* Update edns information for the host.
	* @param infra: infrastructure cache.
	* @param addr: host address.
	* @param addrlen: length of addr.
	* @param name: name of zone
	* @param namelen: length of name
	* @param edns_version: the version that it publishes.
	* If it is known to support EDNS then no-EDNS is not stored over it.
	* @param timenow: what time it is now.
	* @return: 0 on error.
	*/
	int infra_edns_update(struct infra_cache* infra,
	struct sockaddr_storage* addr, socklen_t addrlen,
	uint8_t* name, size_t namelen, int edns_version, time_t timenow);

	/**
	* Get Lameness information and average RTT if host is in the cache.
	* This information is to be used for server selection.
	* @param infra: infrastructure cache.
	* @param addr: host address.
	* @param addrlen: length of addr.
	* @param name: zone name.
	* @param namelen: zone name length.
	* @param qtype: the query to be made.
	* @param lame: if function returns true, this returns lameness of the zone.
	* @param dnsseclame: if function returns true, this returns if the zone
	* is dnssec-lame.
	* @param reclame: if function returns true, this is if it is recursion lame.
	* @param rtt: if function returns true, this returns avg rtt of the server.
	* The rtt value is unclamped and reflects recent timeouts.
	* @param timenow: what time it is now.
	* @return if found in cache, or false if not (or TTL bad).
	*/
	int infra_get_lame_rtt(struct infra_cache* infra,
	struct sockaddr_storage* addr, socklen_t addrlen,
	uint8_t* name, size_t namelen, uint16_t qtype,
	int* lame, int* dnsseclame, int* reclame, int* rtt, time_t timenow);

	/**
	* Get additional (debug) info on timing.
	* @param infra: infra cache.
	* @param addr: host address.
	* @param addrlen: length of addr.
	* @param name: zone name
	* @param namelen: zone name length
	* @param rtt: the rtt_info is copied into here (caller alloced return struct).
	* @param delay: probe delay (if any).
	* @param timenow: what time it is now.
	* @param tA: timeout counter on type A.
	* @param tAAAA: timeout counter on type AAAA.
	* @param tother: timeout counter on type other.
	* @return TTL the infra host element is valid for. If -1: not found in cache.
	* TTL -2: found but expired.
	*/
	long long infra_get_host_rto(struct infra_cache* infra,
	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* name,
	size_t namelen, struct rtt_info* rtt, int* delay, time_t timenow,
	int* tA, int* tAAAA, int* tother);

	/**
	* Increment the query rate counter for a delegation point.
	* @param infra: infra cache.
	* @param name: zone name
	* @param namelen: zone name length
	* @param timenow: what time it is now.
	+ * @param qinfo: for logging, query name.
	+ * @param replylist: for logging, querier's address (if any).
	* @return 1 if it could be incremented. 0 if the increment overshot the
	* ratelimit or if in the previous second the ratelimit was exceeded.
	* Failures like alloc failures are not returned (probably as 1).
	*/
	int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name,
	- size_t namelen, time_t timenow);
	+ size_t namelen, time_t timenow, struct query_info* qinfo,
	+ struct comm_reply* replylist);

	/**
	* Decrement the query rate counter for a delegation point.
	* Because the reply received for the delegation point was pleasant,
	* we do not charge this delegation point with it (i.e. it was a referral).
	* Should call it with same second as when inc() was called.
	* @param infra: infra cache.
	* @param name: zone name
	* @param namelen: zone name length
	* @param timenow: what time it is now.
	*/
	void infra_ratelimit_dec(struct infra_cache* infra, uint8_t* name,
	size_t namelen, time_t timenow);

	/**
	* See if the query rate counter for a delegation point is exceeded.
	* So, no queries are going to be allowed.
	* @param infra: infra cache.
	* @param name: zone name
	* @param namelen: zone name length
	* @param timenow: what time it is now.
	* @return true if exceeded.
	*/
	int infra_ratelimit_exceeded(struct infra_cache* infra, uint8_t* name,
	size_t namelen, time_t timenow);

	/** find the maximum rate stored, not too old. 0 if no information. */
	int infra_rate_max(void* data, time_t now);

	/** find the ratelimit in qps for a domain. 0 if no limit for domain. */
	int infra_find_ratelimit(struct infra_cache* infra, uint8_t* name,
	size_t namelen);

	/** Update query ratelimit hash and decide
	* whether or not a query should be dropped.
	* @param infra: infra cache
	* @param repinfo: information about client
	* @param timenow: what time it is now.
	+ * @param buffer: with query for logging.
	* @return 1 if it could be incremented. 0 if the increment overshot the
	* ratelimit and the query should be dropped. */
	int infra_ip_ratelimit_inc(struct infra_cache* infra,
	- struct comm_reply* repinfo, time_t timenow);
	+ struct comm_reply* repinfo, time_t timenow,
	+ struct sldns_buffer* buffer);

	/**
	* Get memory used by the infra cache.
	* @param infra: infrastructure cache.
	* @return memory in use in bytes.
	*/
	size_t infra_get_mem(struct infra_cache* infra);

	/** calculate size for the hashtable, does not count size of lameness,
	* so the hashtable is a fixed number of items */
	size_t infra_sizefunc(void* k, void* d);

	/** compare two addresses, returns -1, 0, or +1 */
	int infra_compfunc(void* key1, void* key2);

	/** delete key, and destroy the lock */
	void infra_delkeyfunc(void* k, void* arg);

	/** delete data and destroy the lameness hashtable */
	void infra_deldatafunc(void* d, void* arg);

	/** calculate size for the hashtable */
	size_t rate_sizefunc(void* k, void* d);

	/** compare two names, returns -1, 0, or +1 */
	int rate_compfunc(void* key1, void* key2);

	/** delete key, and destroy the lock */
	void rate_delkeyfunc(void* k, void* arg);

	/** delete data */
	void rate_deldatafunc(void* d, void* arg);

	/* calculate size for the client ip hashtable */
	size_t ip_rate_sizefunc(void* k, void* d);

	/* compare two addresses */
	int ip_rate_compfunc(void* key1, void* key2);

	/* delete key, and destroy the lock */
	void ip_rate_delkeyfunc(void* d, void* arg);

	/* delete data */
	#define ip_rate_deldatafunc rate_deldatafunc

	#endif /* SERVICES_CACHE_INFRA_H */
	Index: head/contrib/unbound/services/listen_dnsport.c
	===================================================================
	--- head/contrib/unbound/services/listen_dnsport.c (revision 349719)
	+++ head/contrib/unbound/services/listen_dnsport.c (revision 349720)
	@@ -1,1481 +1,1908 @@
	/*
	* services/listen_dnsport.c - listen on port 53 for incoming DNS queries.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file has functions to get queries from clients.
	*/
	#include "config.h"
	#ifdef HAVE_SYS_TYPES_H
	# include <sys/types.h>
	#endif
	#include <sys/time.h>
	#ifdef USE_TCP_FASTOPEN
	#include <netinet/tcp.h>
	#endif
	#include "services/listen_dnsport.h"
	#include "services/outside_network.h"
	#include "util/netevent.h"
	#include "util/log.h"
	#include "util/config_file.h"
	#include "util/net_help.h"
	#include "sldns/sbuffer.h"
	+#include "services/mesh.h"
	+#include "util/fptr_wlist.h"
	+#include "util/locks.h"

	#ifdef HAVE_NETDB_H
	#include <netdb.h>
	#endif
	#include <fcntl.h>

	#ifdef HAVE_SYS_UN_H
	#include <sys/un.h>
	#endif

	#ifdef HAVE_SYSTEMD
	#include <systemd/sd-daemon.h>
	#endif

	/** number of queued TCP connections for listen() */
	#define TCP_BACKLOG 256

	+/** number of simultaneous requests a client can have */
	+#define TCP_MAX_REQ_SIMULTANEOUS 32
	+
	+#ifndef THREADS_DISABLED
	+/** lock on the counter of stream buffer memory */
	+static lock_basic_type stream_wait_count_lock;
	+#endif
	+/** size (in bytes) of stream wait buffers */
	+static size_t stream_wait_count = 0;
	+/** is the lock initialised for stream wait buffers */
	+static int stream_wait_lock_inited = 0;
	+
	/**
	* Debug print of the getaddrinfo returned address.
	* @param addr: the address returned.
	*/
	static void
	verbose_print_addr(struct addrinfo *addr)
	{
	if(verbosity >= VERB_ALGO) {
	char buf[100];
	void* sinaddr = &((struct sockaddr_in*)addr->ai_addr)->sin_addr;
	#ifdef INET6
	if(addr->ai_family == AF_INET6)
	sinaddr = &((struct sockaddr_in6*)addr->ai_addr)->
	sin6_addr;
	#endif /* INET6 */
	if(inet_ntop(addr->ai_family, sinaddr, buf,
	(socklen_t)sizeof(buf)) == 0) {
	(void)strlcpy(buf, "(null)", sizeof(buf));
	}
	buf[sizeof(buf)-1] = 0;
	verbose(VERB_ALGO, "creating %s%s socket %s %d",
	addr->ai_socktype==SOCK_DGRAM?"udp":
	addr->ai_socktype==SOCK_STREAM?"tcp":"otherproto",
	addr->ai_family==AF_INET?"4":
	addr->ai_family==AF_INET6?"6":
	"_otherfam", buf,
	ntohs(((struct sockaddr_in*)addr->ai_addr)->sin_port));
	}
	}

	#ifdef HAVE_SYSTEMD
	static int
	systemd_get_activated(int family, int socktype, int listen,
	struct sockaddr *addr, socklen_t addrlen,
	const char *path)
	{
	int i = 0;
	int r = 0;
	int s = -1;
	const char* listen_pid, *listen_fds;

	/* We should use "listen" option only for stream protocols. For UDP it should be -1 */

	if((r = sd_booted()) < 1) {
	if(r == 0)
	log_warn("systemd is not running");
	else
	log_err("systemd sd_booted(): %s", strerror(-r));
	return -1;
	}

	listen_pid = getenv("LISTEN_PID");
	listen_fds = getenv("LISTEN_FDS");

	if (!listen_pid) {
	log_warn("Systemd mandatory ENV variable is not defined: LISTEN_PID");
	return -1;
	}

	if (!listen_fds) {
	log_warn("Systemd mandatory ENV variable is not defined: LISTEN_FDS");
	return -1;
	}

	if((r = sd_listen_fds(0)) < 1) {
	if(r == 0)
	log_warn("systemd: did not return socket, check unit configuration");
	else
	log_err("systemd sd_listen_fds(): %s", strerror(-r));
	return -1;
	}

	for(i = 0; i < r; i++) {
	if(sd_is_socket(SD_LISTEN_FDS_START + i, family, socktype, listen)) {
	s = SD_LISTEN_FDS_START + i;
	break;
	}
	}
	if (s == -1) {
	if (addr)
	log_err_addr("systemd sd_listen_fds()",
	"no such socket",
	(struct sockaddr_storage *)addr, addrlen);
	else
	log_err("systemd sd_listen_fds(): %s", path);
	}
	return s;
	}
	#endif

	int
	create_udp_sock(int family, int socktype, struct sockaddr* addr,
	socklen_t addrlen, int v6only, int* inuse, int* noproto,
	int rcv, int snd, int listen, int* reuseport, int transparent,
	int freebind, int use_systemd)
	{
	int s;
	#if defined(SO_REUSEADDR) \|\| defined(SO_REUSEPORT) \|\| defined(IPV6_USE_MIN_MTU) \|\| defined(IP_TRANSPARENT) \|\| defined(IP_BINDANY) \|\| defined(IP_FREEBIND) \|\| defined (SO_BINDANY)
	int on=1;
	#endif
	#ifdef IPV6_MTU
	int mtu = IPV6_MIN_MTU;
	#endif
	#if !defined(SO_RCVBUFFORCE) && !defined(SO_RCVBUF)
	(void)rcv;
	#endif
	#if !defined(SO_SNDBUFFORCE) && !defined(SO_SNDBUF)
	(void)snd;
	#endif
	#ifndef IPV6_V6ONLY
	(void)v6only;
	#endif
	#if !defined(IP_TRANSPARENT) && !defined(IP_BINDANY) && !defined(SO_BINDANY)
	(void)transparent;
	#endif
	#if !defined(IP_FREEBIND)
	(void)freebind;
	#endif
	#ifdef HAVE_SYSTEMD
	int got_fd_from_systemd = 0;

	if (!use_systemd
	\|\| (use_systemd
	&& (s = systemd_get_activated(family, socktype, -1, addr,
	addrlen, NULL)) == -1)) {
	#else
	(void)use_systemd;
	#endif
	if((s = socket(family, socktype, 0)) == -1) {
	*inuse = 0;
	#ifndef USE_WINSOCK
	if(errno == EAFNOSUPPORT \|\| errno == EPROTONOSUPPORT) {
	*noproto = 1;
	return -1;
	}
	log_err("can't create socket: %s", strerror(errno));
	#else
	if(WSAGetLastError() == WSAEAFNOSUPPORT \|\|
	WSAGetLastError() == WSAEPROTONOSUPPORT) {
	*noproto = 1;
	return -1;
	}
	log_err("can't create socket: %s",
	wsa_strerror(WSAGetLastError()));
	#endif
	*noproto = 0;
	return -1;
	}
	#ifdef HAVE_SYSTEMD
	} else {
	got_fd_from_systemd = 1;
	}
	#endif
	if(listen) {
	#ifdef SO_REUSEADDR
	if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on,
	(socklen_t)sizeof(on)) < 0) {
	#ifndef USE_WINSOCK
	log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
	strerror(errno));
	if(errno != ENOSYS) {
	close(s);
	*noproto = 0;
	*inuse = 0;
	return -1;
	}
	#else
	log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
	wsa_strerror(WSAGetLastError()));
	closesocket(s);
	*noproto = 0;
	*inuse = 0;
	return -1;
	#endif
	}
	#endif /* SO_REUSEADDR */
	#ifdef SO_REUSEPORT
	+# ifdef SO_REUSEPORT_LB
	+ /* on FreeBSD 12 we have SO_REUSEPORT_LB that does loadbalance
	+ * like SO_REUSEPORT on Linux. This is what the users want
	+ * with the config option in unbound.conf; if we actually
	+ * need local address and port reuse they'll also need to
	+ * have SO_REUSEPORT set for them, assume it was _LB they want.
	+ */
	+ if (reuseport && *reuseport &&
	+ setsockopt(s, SOL_SOCKET, SO_REUSEPORT_LB, (void*)&on,
	+ (socklen_t)sizeof(on)) < 0) {
	+#ifdef ENOPROTOOPT
	+ if(errno != ENOPROTOOPT \|\| verbosity >= 3)
	+ log_warn("setsockopt(.. SO_REUSEPORT_LB ..) failed: %s",
	+ strerror(errno));
	+#endif
	+ /* this option is not essential, we can continue */
	+ *reuseport = 0;
	+ }
	+# else /* no SO_REUSEPORT_LB */
	+
	/* try to set SO_REUSEPORT so that incoming
	* queries are distributed evenly among the receiving threads.
	* Each thread must have its own socket bound to the same port,
	* with SO_REUSEPORT set on each socket.
	*/
	if (reuseport && *reuseport &&
	setsockopt(s, SOL_SOCKET, SO_REUSEPORT, (void*)&on,
	(socklen_t)sizeof(on)) < 0) {
	#ifdef ENOPROTOOPT
	if(errno != ENOPROTOOPT \|\| verbosity >= 3)
	log_warn("setsockopt(.. SO_REUSEPORT ..) failed: %s",
	strerror(errno));
	#endif
	/* this option is not essential, we can continue */
	*reuseport = 0;
	}
	+# endif /* SO_REUSEPORT_LB */
	#else
	(void)reuseport;
	#endif /* defined(SO_REUSEPORT) */
	#ifdef IP_TRANSPARENT
	if (transparent &&
	setsockopt(s, IPPROTO_IP, IP_TRANSPARENT, (void*)&on,
	(socklen_t)sizeof(on)) < 0) {
	log_warn("setsockopt(.. IP_TRANSPARENT ..) failed: %s",
	strerror(errno));
	}
	#elif defined(IP_BINDANY)
	if (transparent &&
	setsockopt(s, (family==AF_INET6? IPPROTO_IPV6:IPPROTO_IP),
	(family == AF_INET6? IPV6_BINDANY:IP_BINDANY),
	(void*)&on, (socklen_t)sizeof(on)) < 0) {
	log_warn("setsockopt(.. IP%s_BINDANY ..) failed: %s",
	(family==AF_INET6?"V6":""), strerror(errno));
	}
	#elif defined(SO_BINDANY)
	if (transparent &&
	setsockopt(s, SOL_SOCKET, SO_BINDANY, (void*)&on,
	(socklen_t)sizeof(on)) < 0) {
	log_warn("setsockopt(.. SO_BINDANY ..) failed: %s",
	strerror(errno));
	}
	#endif /* IP_TRANSPARENT \|\| IP_BINDANY \|\| SO_BINDANY */
	}
	#ifdef IP_FREEBIND
	if(freebind &&
	setsockopt(s, IPPROTO_IP, IP_FREEBIND, (void*)&on,
	(socklen_t)sizeof(on)) < 0) {
	log_warn("setsockopt(.. IP_FREEBIND ..) failed: %s",
	strerror(errno));
	}
	#endif /* IP_FREEBIND */
	if(rcv) {
	#ifdef SO_RCVBUF
	int got;
	socklen_t slen = (socklen_t)sizeof(got);
	# ifdef SO_RCVBUFFORCE
	/* Linux specific: try to use root permission to override
	* system limits on rcvbuf. The limit is stored in
	* /proc/sys/net/core/rmem_max or sysctl net.core.rmem_max */
	if(setsockopt(s, SOL_SOCKET, SO_RCVBUFFORCE, (void*)&rcv,
	(socklen_t)sizeof(rcv)) < 0) {
	if(errno != EPERM) {
	# ifndef USE_WINSOCK
	log_err("setsockopt(..., SO_RCVBUFFORCE, "
	"...) failed: %s", strerror(errno));
	close(s);
	# else
	log_err("setsockopt(..., SO_RCVBUFFORCE, "
	"...) failed: %s",
	wsa_strerror(WSAGetLastError()));
	closesocket(s);
	# endif
	*noproto = 0;
	*inuse = 0;
	return -1;
	}
	# endif /* SO_RCVBUFFORCE */
	if(setsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&rcv,
	(socklen_t)sizeof(rcv)) < 0) {
	# ifndef USE_WINSOCK
	log_err("setsockopt(..., SO_RCVBUF, "
	"...) failed: %s", strerror(errno));
	close(s);
	# else
	log_err("setsockopt(..., SO_RCVBUF, "
	"...) failed: %s",
	wsa_strerror(WSAGetLastError()));
	closesocket(s);
	# endif
	*noproto = 0;
	*inuse = 0;
	return -1;
	}
	/* check if we got the right thing or if system
	* reduced to some system max. Warn if so */
	if(getsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&got,
	&slen) >= 0 && got < rcv/2) {
	log_warn("so-rcvbuf %u was not granted. "
	"Got %u. To fix: start with "
	"root permissions(linux) or sysctl "
	"bigger net.core.rmem_max(linux) or "
	"kern.ipc.maxsockbuf(bsd) values.",
	(unsigned)rcv, (unsigned)got);
	}
	# ifdef SO_RCVBUFFORCE
	}
	# endif
	#endif /* SO_RCVBUF */
	}
	/* first do RCVBUF as the receive buffer is more important */
	if(snd) {
	#ifdef SO_SNDBUF
	int got;
	socklen_t slen = (socklen_t)sizeof(got);
	# ifdef SO_SNDBUFFORCE
	/* Linux specific: try to use root permission to override
	* system limits on sndbuf. The limit is stored in
	* /proc/sys/net/core/wmem_max or sysctl net.core.wmem_max */
	if(setsockopt(s, SOL_SOCKET, SO_SNDBUFFORCE, (void*)&snd,
	(socklen_t)sizeof(snd)) < 0) {
	if(errno != EPERM) {
	# ifndef USE_WINSOCK
	log_err("setsockopt(..., SO_SNDBUFFORCE, "
	"...) failed: %s", strerror(errno));
	close(s);
	# else
	log_err("setsockopt(..., SO_SNDBUFFORCE, "
	"...) failed: %s",
	wsa_strerror(WSAGetLastError()));
	closesocket(s);
	# endif
	*noproto = 0;
	*inuse = 0;
	return -1;
	}
	# endif /* SO_SNDBUFFORCE */
	if(setsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&snd,
	(socklen_t)sizeof(snd)) < 0) {
	# ifndef USE_WINSOCK
	log_err("setsockopt(..., SO_SNDBUF, "
	"...) failed: %s", strerror(errno));
	close(s);
	# else
	log_err("setsockopt(..., SO_SNDBUF, "
	"...) failed: %s",
	wsa_strerror(WSAGetLastError()));
	closesocket(s);
	# endif
	*noproto = 0;
	*inuse = 0;
	return -1;
	}
	/* check if we got the right thing or if system
	* reduced to some system max. Warn if so */
	if(getsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&got,
	&slen) >= 0 && got < snd/2) {
	log_warn("so-sndbuf %u was not granted. "
	"Got %u. To fix: start with "
	"root permissions(linux) or sysctl "
	"bigger net.core.wmem_max(linux) or "
	"kern.ipc.maxsockbuf(bsd) values.",
	(unsigned)snd, (unsigned)got);
	}
	# ifdef SO_SNDBUFFORCE
	}
	# endif
	#endif /* SO_SNDBUF */
	}
	if(family == AF_INET6) {
	# if defined(IPV6_V6ONLY)
	if(v6only) {
	int val=(v6only==2)?0:1;
	if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY,
	(void*)&val, (socklen_t)sizeof(val)) < 0) {
	#ifndef USE_WINSOCK
	log_err("setsockopt(..., IPV6_V6ONLY"
	", ...) failed: %s", strerror(errno));
	close(s);
	#else
	log_err("setsockopt(..., IPV6_V6ONLY"
	", ...) failed: %s",
	wsa_strerror(WSAGetLastError()));
	closesocket(s);
	#endif
	*noproto = 0;
	*inuse = 0;
	return -1;
	}
	}
	# endif
	# if defined(IPV6_USE_MIN_MTU)
	/*
	* There is no fragmentation of IPv6 datagrams
	* during forwarding in the network. Therefore
	* we do not send UDP datagrams larger than
	* the minimum IPv6 MTU of 1280 octets. The
	* EDNS0 message length can be larger if the
	* network stack supports IPV6_USE_MIN_MTU.
	*/
	if (setsockopt(s, IPPROTO_IPV6, IPV6_USE_MIN_MTU,
	(void*)&on, (socklen_t)sizeof(on)) < 0) {
	# ifndef USE_WINSOCK
	log_err("setsockopt(..., IPV6_USE_MIN_MTU, "
	"...) failed: %s", strerror(errno));
	close(s);
	# else
	log_err("setsockopt(..., IPV6_USE_MIN_MTU, "
	"...) failed: %s",
	wsa_strerror(WSAGetLastError()));
	closesocket(s);
	# endif
	*noproto = 0;
	*inuse = 0;
	return -1;
	}
	# elif defined(IPV6_MTU)
	/*
	* On Linux, to send no larger than 1280, the PMTUD is
	* disabled by default for datagrams anyway, so we set
	* the MTU to use.
	*/
	if (setsockopt(s, IPPROTO_IPV6, IPV6_MTU,
	(void*)&mtu, (socklen_t)sizeof(mtu)) < 0) {
	# ifndef USE_WINSOCK
	log_err("setsockopt(..., IPV6_MTU, ...) failed: %s",
	strerror(errno));
	close(s);
	# else
	log_err("setsockopt(..., IPV6_MTU, ...) failed: %s",
	wsa_strerror(WSAGetLastError()));
	closesocket(s);
	# endif
	*noproto = 0;
	*inuse = 0;
	return -1;
	}
	# endif /* IPv6 MTU */
	} else if(family == AF_INET) {
	# if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
	/* linux 3.15 has IP_PMTUDISC_OMIT, Hannes Frederic Sowa made it so that
	* PMTU information is not accepted, but fragmentation is allowed
	* if and only if the packet size exceeds the outgoing interface MTU
	* (and also uses the interface mtu to determine the size of the packets).
	* So there won't be any EMSGSIZE error. Against DNS fragmentation attacks.
	* FreeBSD already has same semantics without setting the option. */
	int omit_set = 0;
	int action;
	# if defined(IP_PMTUDISC_OMIT)
	action = IP_PMTUDISC_OMIT;
	if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER,
	&action, (socklen_t)sizeof(action)) < 0) {

	if (errno != EINVAL) {
	log_err("setsockopt(..., IP_MTU_DISCOVER, IP_PMTUDISC_OMIT...) failed: %s",
	strerror(errno));

	# ifndef USE_WINSOCK
	close(s);
	# else
	closesocket(s);
	# endif
	*noproto = 0;
	*inuse = 0;
	return -1;
	}
	}
	else
	{
	omit_set = 1;
	}
	# endif
	if (omit_set == 0) {
	action = IP_PMTUDISC_DONT;
	if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER,
	&action, (socklen_t)sizeof(action)) < 0) {
	log_err("setsockopt(..., IP_MTU_DISCOVER, IP_PMTUDISC_DONT...) failed: %s",
	strerror(errno));
	# ifndef USE_WINSOCK
	close(s);
	# else
	closesocket(s);
	# endif
	*noproto = 0;
	*inuse = 0;
	return -1;
	}
	}
	# elif defined(IP_DONTFRAG)
	int off = 0;
	if (setsockopt(s, IPPROTO_IP, IP_DONTFRAG,
	&off, (socklen_t)sizeof(off)) < 0) {
	log_err("setsockopt(..., IP_DONTFRAG, ...) failed: %s",
	strerror(errno));
	# ifndef USE_WINSOCK
	close(s);
	# else
	closesocket(s);
	# endif
	*noproto = 0;
	*inuse = 0;
	return -1;
	}
	# endif /* IPv4 MTU */
	}
	if(
	#ifdef HAVE_SYSTEMD
	!got_fd_from_systemd &&
	#endif
	bind(s, (struct sockaddr*)addr, addrlen) != 0) {
	*noproto = 0;
	*inuse = 0;
	#ifndef USE_WINSOCK
	#ifdef EADDRINUSE
	*inuse = (errno == EADDRINUSE);
	/* detect freebsd jail with no ipv6 permission */
	if(family==AF_INET6 && errno==EINVAL)
	*noproto = 1;
	else if(errno != EADDRINUSE &&
	- !(errno == EACCES && verbosity < 4 && !listen)) {
	+ !(errno == EACCES && verbosity < 4 && !listen)
	+#ifdef EADDRNOTAVAIL
	+ && !(errno == EADDRNOTAVAIL && verbosity < 4 && !listen)
	+#endif
	+ ) {
	log_err_addr("can't bind socket", strerror(errno),
	(struct sockaddr_storage*)addr, addrlen);
	}
	#endif /* EADDRINUSE */
	close(s);
	#else /* USE_WINSOCK */
	if(WSAGetLastError() != WSAEADDRINUSE &&
	WSAGetLastError() != WSAEADDRNOTAVAIL &&
	!(WSAGetLastError() == WSAEACCES && verbosity < 4 && !listen)) {
	log_err_addr("can't bind socket",
	wsa_strerror(WSAGetLastError()),
	(struct sockaddr_storage*)addr, addrlen);
	}
	closesocket(s);
	#endif /* USE_WINSOCK */
	return -1;
	}
	if(!fd_set_nonblock(s)) {
	*noproto = 0;
	*inuse = 0;
	#ifndef USE_WINSOCK
	close(s);
	#else
	closesocket(s);
	#endif
	return -1;
	}
	return s;
	}

	int
	create_tcp_accept_sock(struct addrinfo addr, int v6only, int noproto,
	int* reuseport, int transparent, int mss, int freebind, int use_systemd)
	{
	int s;
	#if defined(SO_REUSEADDR) \|\| defined(SO_REUSEPORT) \|\| defined(IPV6_V6ONLY) \|\| defined(IP_TRANSPARENT) \|\| defined(IP_BINDANY) \|\| defined(IP_FREEBIND) \|\| defined(SO_BINDANY)
	int on = 1;
	#endif
	#ifdef HAVE_SYSTEMD
	int got_fd_from_systemd = 0;
	#endif
	#ifdef USE_TCP_FASTOPEN
	int qlen;
	#endif
	#if !defined(IP_TRANSPARENT) && !defined(IP_BINDANY) && !defined(SO_BINDANY)
	(void)transparent;
	#endif
	#if !defined(IP_FREEBIND)
	(void)freebind;
	#endif
	verbose_print_addr(addr);
	*noproto = 0;
	#ifdef HAVE_SYSTEMD
	if (!use_systemd \|\|
	(use_systemd
	&& (s = systemd_get_activated(addr->ai_family, addr->ai_socktype, 1,
	addr->ai_addr, addr->ai_addrlen,
	NULL)) == -1)) {
	#else
	(void)use_systemd;
	#endif
	if((s = socket(addr->ai_family, addr->ai_socktype, 0)) == -1) {
	#ifndef USE_WINSOCK
	if(errno == EAFNOSUPPORT \|\| errno == EPROTONOSUPPORT) {
	*noproto = 1;
	return -1;
	}
	log_err("can't create socket: %s", strerror(errno));
	#else
	if(WSAGetLastError() == WSAEAFNOSUPPORT \|\|
	WSAGetLastError() == WSAEPROTONOSUPPORT) {
	*noproto = 1;
	return -1;
	}
	log_err("can't create socket: %s",
	wsa_strerror(WSAGetLastError()));
	#endif
	return -1;
	}
	if (mss > 0) {
	#if defined(IPPROTO_TCP) && defined(TCP_MAXSEG)
	if(setsockopt(s, IPPROTO_TCP, TCP_MAXSEG, (void*)&mss,
	(socklen_t)sizeof(mss)) < 0) {
	#ifndef USE_WINSOCK
	log_err(" setsockopt(.. TCP_MAXSEG ..) failed: %s",
	strerror(errno));
	#else
	log_err(" setsockopt(.. TCP_MAXSEG ..) failed: %s",
	wsa_strerror(WSAGetLastError()));
	#endif
	} else {
	verbose(VERB_ALGO,
	" tcp socket mss set to %d", mss);
	}
	#else
	log_warn(" setsockopt(TCP_MAXSEG) unsupported");
	#endif /* defined(IPPROTO_TCP) && defined(TCP_MAXSEG) */
	}
	#ifdef HAVE_SYSTEMD
	} else {
	got_fd_from_systemd = 1;
	}
	#endif
	#ifdef SO_REUSEADDR
	if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on,
	(socklen_t)sizeof(on)) < 0) {
	#ifndef USE_WINSOCK
	log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
	strerror(errno));
	close(s);
	#else
	log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
	wsa_strerror(WSAGetLastError()));
	closesocket(s);
	#endif
	return -1;
	}
	#endif /* SO_REUSEADDR */
	#ifdef IP_FREEBIND
	if (freebind && setsockopt(s, IPPROTO_IP, IP_FREEBIND, (void*)&on,
	(socklen_t)sizeof(on)) < 0) {
	log_warn("setsockopt(.. IP_FREEBIND ..) failed: %s",
	strerror(errno));
	}
	#endif /* IP_FREEBIND */
	#ifdef SO_REUSEPORT
	/* try to set SO_REUSEPORT so that incoming
	* connections are distributed evenly among the receiving threads.
	* Each thread must have its own socket bound to the same port,
	* with SO_REUSEPORT set on each socket.
	*/
	if (reuseport && *reuseport &&
	setsockopt(s, SOL_SOCKET, SO_REUSEPORT, (void*)&on,
	(socklen_t)sizeof(on)) < 0) {
	#ifdef ENOPROTOOPT
	if(errno != ENOPROTOOPT \|\| verbosity >= 3)
	log_warn("setsockopt(.. SO_REUSEPORT ..) failed: %s",
	strerror(errno));
	#endif
	/* this option is not essential, we can continue */
	*reuseport = 0;
	}
	#else
	(void)reuseport;
	#endif /* defined(SO_REUSEPORT) */
	#if defined(IPV6_V6ONLY)
	if(addr->ai_family == AF_INET6 && v6only) {
	if(setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY,
	(void*)&on, (socklen_t)sizeof(on)) < 0) {
	#ifndef USE_WINSOCK
	log_err("setsockopt(..., IPV6_V6ONLY, ...) failed: %s",
	strerror(errno));
	close(s);
	#else
	log_err("setsockopt(..., IPV6_V6ONLY, ...) failed: %s",
	wsa_strerror(WSAGetLastError()));
	closesocket(s);
	#endif
	return -1;
	}
	}
	#else
	(void)v6only;
	#endif /* IPV6_V6ONLY */
	#ifdef IP_TRANSPARENT
	if (transparent &&
	setsockopt(s, IPPROTO_IP, IP_TRANSPARENT, (void*)&on,
	(socklen_t)sizeof(on)) < 0) {
	log_warn("setsockopt(.. IP_TRANSPARENT ..) failed: %s",
	strerror(errno));
	}
	#elif defined(IP_BINDANY)
	if (transparent &&
	setsockopt(s, (addr->ai_family==AF_INET6? IPPROTO_IPV6:IPPROTO_IP),
	(addr->ai_family == AF_INET6? IPV6_BINDANY:IP_BINDANY),
	(void*)&on, (socklen_t)sizeof(on)) < 0) {
	log_warn("setsockopt(.. IP%s_BINDANY ..) failed: %s",
	(addr->ai_family==AF_INET6?"V6":""), strerror(errno));
	}
	#elif defined(SO_BINDANY)
	if (transparent &&
	setsockopt(s, SOL_SOCKET, SO_BINDANY, (void*)&on, (socklen_t)
	sizeof(on)) < 0) {
	log_warn("setsockopt(.. SO_BINDANY ..) failed: %s",
	strerror(errno));
	}
	#endif /* IP_TRANSPARENT \|\| IP_BINDANY \|\| SO_BINDANY */
	if(
	#ifdef HAVE_SYSTEMD
	!got_fd_from_systemd &&
	#endif
	bind(s, addr->ai_addr, addr->ai_addrlen) != 0) {
	#ifndef USE_WINSOCK
	/* detect freebsd jail with no ipv6 permission */
	if(addr->ai_family==AF_INET6 && errno==EINVAL)
	*noproto = 1;
	else {
	log_err_addr("can't bind socket", strerror(errno),
	(struct sockaddr_storage*)addr->ai_addr,
	addr->ai_addrlen);
	}
	close(s);
	#else
	log_err_addr("can't bind socket",
	wsa_strerror(WSAGetLastError()),
	(struct sockaddr_storage*)addr->ai_addr,
	addr->ai_addrlen);
	closesocket(s);
	#endif
	return -1;
	}
	if(!fd_set_nonblock(s)) {
	#ifndef USE_WINSOCK
	close(s);
	#else
	closesocket(s);
	#endif
	return -1;
	}
	if(listen(s, TCP_BACKLOG) == -1) {
	#ifndef USE_WINSOCK
	log_err("can't listen: %s", strerror(errno));
	close(s);
	#else
	log_err("can't listen: %s", wsa_strerror(WSAGetLastError()));
	closesocket(s);
	#endif
	return -1;
	}
	#ifdef USE_TCP_FASTOPEN
	/* qlen specifies how many outstanding TFO requests to allow. Limit is a defense
	against IP spoofing attacks as suggested in RFC7413 */
	#ifdef __APPLE__
	/* OS X implementation only supports qlen of 1 via this call. Actual
	value is configured by the net.inet.tcp.fastopen_backlog kernel parm. */
	qlen = 1;
	#else
	/* 5 is recommended on linux */
	qlen = 5;
	#endif
	if ((setsockopt(s, IPPROTO_TCP, TCP_FASTOPEN, &qlen,
	sizeof(qlen))) == -1 ) {
	#ifdef ENOPROTOOPT
	/* squelch ENOPROTOOPT: freebsd server mode with kernel support
	disabled, except when verbosity enabled for debugging */
	- if(errno != ENOPROTOOPT \|\| verbosity >= 3)
	+ if(errno != ENOPROTOOPT \|\| verbosity >= 3) {
	#endif
	- log_err("Setting TCP Fast Open as server failed: %s", strerror(errno));
	+ if(errno == EPERM) {
	+ log_warn("Setting TCP Fast Open as server failed: %s ; this could likely be because sysctl net.inet.tcp.fastopen.enabled, net.inet.tcp.fastopen.server_enable, or net.ipv4.tcp_fastopen is disabled", strerror(errno));
	+ } else {
	+ log_err("Setting TCP Fast Open as server failed: %s", strerror(errno));
	+ }
	+#ifdef ENOPROTOOPT
	+ }
	+#endif
	}
	#endif
	return s;
	}

	int
	create_local_accept_sock(const char path, int noproto, int use_systemd)
	{
	#ifdef HAVE_SYSTEMD
	int ret;

	if (use_systemd && (ret = systemd_get_activated(AF_LOCAL, SOCK_STREAM, 1, NULL, 0, path)) != -1)
	return ret;
	else {
	#endif
	#ifdef HAVE_SYS_UN_H
	int s;
	struct sockaddr_un usock;
	#ifndef HAVE_SYSTEMD
	(void)use_systemd;
	#endif

	verbose(VERB_ALGO, "creating unix socket %s", path);
	#ifdef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
	/* this member exists on BSDs, not Linux */
	usock.sun_len = (unsigned)sizeof(usock);
	#endif
	usock.sun_family = AF_LOCAL;
	/* length is 92-108, 104 on FreeBSD */
	(void)strlcpy(usock.sun_path, path, sizeof(usock.sun_path));

	if ((s = socket(AF_LOCAL, SOCK_STREAM, 0)) == -1) {
	log_err("Cannot create local socket %s (%s)",
	path, strerror(errno));
	return -1;
	}

	if (unlink(path) && errno != ENOENT) {
	/* The socket already exists and cannot be removed */
	log_err("Cannot remove old local socket %s (%s)",
	path, strerror(errno));
	goto err;
	}

	if (bind(s, (struct sockaddr *)&usock,
	(socklen_t)sizeof(struct sockaddr_un)) == -1) {
	log_err("Cannot bind local socket %s (%s)",
	path, strerror(errno));
	goto err;
	}

	if (!fd_set_nonblock(s)) {
	log_err("Cannot set non-blocking mode");
	goto err;
	}

	if (listen(s, TCP_BACKLOG) == -1) {
	log_err("can't listen: %s", strerror(errno));
	goto err;
	}

	(void)noproto; /unused/
	return s;

	err:
	#ifndef USE_WINSOCK
	close(s);
	#else
	closesocket(s);
	#endif
	return -1;

	#ifdef HAVE_SYSTEMD
	}
	#endif
	#else
	(void)use_systemd;
	(void)path;
	log_err("Local sockets are not supported");
	*noproto = 1;
	return -1;
	#endif
	}


	/**
	* Create socket from getaddrinfo results
	*/
	static int
	make_sock(int stype, const char* ifname, const char* port,
	struct addrinfo hints, int v6only, int noip6, size_t rcv, size_t snd,
	int* reuseport, int transparent, int tcp_mss, int freebind, int use_systemd)
	{
	struct addrinfo *res = NULL;
	int r, s, inuse, noproto;
	hints->ai_socktype = stype;
	*noip6 = 0;
	if((r=getaddrinfo(ifname, port, hints, &res)) != 0 \|\| !res) {
	#ifdef USE_WINSOCK
	if(r == EAI_NONAME && hints->ai_family == AF_INET6){
	noip6 = 1; / 'Host not found' for IP6 on winXP */
	return -1;
	}
	#endif
	log_err("node %s:%s getaddrinfo: %s %s",
	ifname?ifname:"default", port, gai_strerror(r),
	#ifdef EAI_SYSTEM
	r==EAI_SYSTEM?(char*)strerror(errno):""
	#else
	""
	#endif
	);
	return -1;
	}
	if(stype == SOCK_DGRAM) {
	verbose_print_addr(res);
	s = create_udp_sock(res->ai_family, res->ai_socktype,
	(struct sockaddr*)res->ai_addr, res->ai_addrlen,
	v6only, &inuse, &noproto, (int)rcv, (int)snd, 1,
	reuseport, transparent, freebind, use_systemd);
	if(s == -1 && inuse) {
	log_err("bind: address already in use");
	} else if(s == -1 && noproto && hints->ai_family == AF_INET6){
	*noip6 = 1;
	}
	} else {
	s = create_tcp_accept_sock(res, v6only, &noproto, reuseport,
	transparent, tcp_mss, freebind, use_systemd);
	if(s == -1 && noproto && hints->ai_family == AF_INET6){
	*noip6 = 1;
	}
	}
	freeaddrinfo(res);
	return s;
	}

	/** make socket and first see if ifname contains port override info */
	static int
	make_sock_port(int stype, const char* ifname, const char* port,
	struct addrinfo hints, int v6only, int noip6, size_t rcv, size_t snd,
	int* reuseport, int transparent, int tcp_mss, int freebind, int use_systemd)
	{
	char* s = strchr(ifname, '@');
	if(s) {
	/* override port with ifspec@port */
	char p[16];
	char newif[128];
	if((size_t)(s-ifname) >= sizeof(newif)) {
	log_err("ifname too long: %s", ifname);
	*noip6 = 0;
	return -1;
	}
	if(strlen(s+1) >= sizeof(p)) {
	log_err("portnumber too long: %s", ifname);
	*noip6 = 0;
	return -1;
	}
	(void)strlcpy(newif, ifname, sizeof(newif));
	newif[s-ifname] = 0;
	(void)strlcpy(p, s+1, sizeof(p));
	p[strlen(s+1)]=0;
	return make_sock(stype, newif, p, hints, v6only, noip6,
	rcv, snd, reuseport, transparent, tcp_mss, freebind, use_systemd);
	}
	return make_sock(stype, ifname, port, hints, v6only, noip6, rcv, snd,
	reuseport, transparent, tcp_mss, freebind, use_systemd);
	}

	/**
	* Add port to open ports list.
	* @param list: list head. changed.
	* @param s: fd.
	* @param ftype: if fd is UDP.
	* @return false on failure. list in unchanged then.
	*/
	static int
	port_insert(struct listen_port** list, int s, enum listen_type ftype)
	{
	struct listen_port* item = (struct listen_port*)malloc(
	sizeof(struct listen_port));
	if(!item)
	return 0;
	item->next = *list;
	item->fd = s;
	item->ftype = ftype;
	*list = item;
	return 1;
	}

	/** set fd to receive source address packet info */
	static int
	set_recvpktinfo(int s, int family)
	{
	#if defined(IPV6_RECVPKTINFO) \|\| defined(IPV6_PKTINFO) \|\| (defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)) \|\| defined(IP_PKTINFO)
	int on = 1;
	#else
	(void)s;
	#endif
	if(family == AF_INET6) {
	# ifdef IPV6_RECVPKTINFO
	if(setsockopt(s, IPPROTO_IPV6, IPV6_RECVPKTINFO,
	(void*)&on, (socklen_t)sizeof(on)) < 0) {
	log_err("setsockopt(..., IPV6_RECVPKTINFO, ...) failed: %s",
	strerror(errno));
	return 0;
	}
	# elif defined(IPV6_PKTINFO)
	if(setsockopt(s, IPPROTO_IPV6, IPV6_PKTINFO,
	(void*)&on, (socklen_t)sizeof(on)) < 0) {
	log_err("setsockopt(..., IPV6_PKTINFO, ...) failed: %s",
	strerror(errno));
	return 0;
	}
	# else
	log_err("no IPV6_RECVPKTINFO and no IPV6_PKTINFO option, please "
	"disable interface-automatic or do-ip6 in config");
	return 0;
	# endif /* defined IPV6_RECVPKTINFO */

	} else if(family == AF_INET) {
	# ifdef IP_PKTINFO
	if(setsockopt(s, IPPROTO_IP, IP_PKTINFO,
	(void*)&on, (socklen_t)sizeof(on)) < 0) {
	log_err("setsockopt(..., IP_PKTINFO, ...) failed: %s",
	strerror(errno));
	return 0;
	}
	# elif defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)
	if(setsockopt(s, IPPROTO_IP, IP_RECVDSTADDR,
	(void*)&on, (socklen_t)sizeof(on)) < 0) {
	log_err("setsockopt(..., IP_RECVDSTADDR, ...) failed: %s",
	strerror(errno));
	return 0;
	}
	# else
	log_err("no IP_SENDSRCADDR or IP_PKTINFO option, please disable "
	"interface-automatic or do-ip4 in config");
	return 0;
	# endif /* IP_PKTINFO */

	}
	return 1;
	}

	/** see if interface is ssl, its port number == the ssl port number */
	static int
	if_is_ssl(const char* ifname, const char* port, int ssl_port,
	struct config_strlist* tls_additional_port)
	{
	struct config_strlist* s;
	char* p = strchr(ifname, '@');
	if(!p && atoi(port) == ssl_port)
	return 1;
	if(p && atoi(p+1) == ssl_port)
	return 1;
	for(s = tls_additional_port; s; s = s->next) {
	if(p && atoi(p+1) == atoi(s->str))
	return 1;
	if(!p && atoi(port) == atoi(s->str))
	return 1;
	}
	return 0;
	}

	/**
	* Helper for ports_open. Creates one interface (or NULL for default).
	* @param ifname: The interface ip address.
	* @param do_auto: use automatic interface detection.
	* If enabled, then ifname must be the wildcard name.
	* @param do_udp: if udp should be used.
	* @param do_tcp: if udp should be used.
	* @param hints: for getaddrinfo. family and flags have to be set by caller.
	* @param port: Port number to use (as string).
	* @param list: list of open ports, appended to, changed to point to list head.
	* @param rcv: receive buffer size for UDP
	* @param snd: send buffer size for UDP
	* @param ssl_port: ssl service port number
	* @param tls_additional_port: list of additional ssl service port numbers.
	* @param reuseport: try to set SO_REUSEPORT if nonNULL and true.
	* set to false on exit if reuseport failed due to no kernel support.
	* @param transparent: set IP_TRANSPARENT socket option.
	* @param tcp_mss: maximum segment size of tcp socket. default if zero.
	* @param freebind: set IP_FREEBIND socket option.
	* @param use_systemd: if true, fetch sockets from systemd.
	* @param dnscrypt_port: dnscrypt service port number
	* @return: returns false on error.
	*/
	static int
	ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
	struct addrinfo hints, const char port, struct listen_port** list,
	size_t rcv, size_t snd, int ssl_port,
	struct config_strlist* tls_additional_port, int* reuseport,
	int transparent, int tcp_mss, int freebind, int use_systemd,
	int dnscrypt_port)
	{
	int s, noip6=0;
	#ifdef USE_DNSCRYPT
	int is_dnscrypt = ((strchr(ifname, '@') &&
	atoi(strchr(ifname, '@')+1) == dnscrypt_port) \|\|
	(!strchr(ifname, '@') && atoi(port) == dnscrypt_port));
	#else
	int is_dnscrypt = 0;
	(void)dnscrypt_port;
	#endif

	if(!do_udp && !do_tcp)
	return 0;
	if(do_auto) {
	if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1,
	&noip6, rcv, snd, reuseport, transparent,
	tcp_mss, freebind, use_systemd)) == -1) {
	if(noip6) {
	log_warn("IPv6 protocol not available");
	return 1;
	}
	return 0;
	}
	/* getting source addr packet info is highly non-portable */
	if(!set_recvpktinfo(s, hints->ai_family)) {
	#ifndef USE_WINSOCK
	close(s);
	#else
	closesocket(s);
	#endif
	return 0;
	}
	if(!port_insert(list, s,
	is_dnscrypt?listen_type_udpancil_dnscrypt:listen_type_udpancil)) {
	#ifndef USE_WINSOCK
	close(s);
	#else
	closesocket(s);
	#endif
	return 0;
	}
	} else if(do_udp) {
	/* regular udp socket */
	if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1,
	&noip6, rcv, snd, reuseport, transparent,
	tcp_mss, freebind, use_systemd)) == -1) {
	if(noip6) {
	log_warn("IPv6 protocol not available");
	return 1;
	}
	return 0;
	}
	if(!port_insert(list, s,
	is_dnscrypt?listen_type_udp_dnscrypt:listen_type_udp)) {
	#ifndef USE_WINSOCK
	close(s);
	#else
	closesocket(s);
	#endif
	return 0;
	}
	}
	if(do_tcp) {
	int is_ssl = if_is_ssl(ifname, port, ssl_port,
	tls_additional_port);
	if((s = make_sock_port(SOCK_STREAM, ifname, port, hints, 1,
	&noip6, 0, 0, reuseport, transparent, tcp_mss,
	freebind, use_systemd)) == -1) {
	if(noip6) {
	/log_warn("IPv6 protocol not available");/
	return 1;
	}
	return 0;
	}
	if(is_ssl)
	verbose(VERB_ALGO, "setup TCP for SSL service");
	if(!port_insert(list, s, is_ssl?listen_type_ssl:
	(is_dnscrypt?listen_type_tcp_dnscrypt:listen_type_tcp))) {
	#ifndef USE_WINSOCK
	close(s);
	#else
	closesocket(s);
	#endif
	return 0;
	}
	}
	return 1;
	}

	/**
	* Add items to commpoint list in front.
	* @param c: commpoint to add.
	* @param front: listen struct.
	* @return: false on failure.
	*/
	static int
	listen_cp_insert(struct comm_point* c, struct listen_dnsport* front)
	{
	struct listen_list* item = (struct listen_list*)malloc(
	sizeof(struct listen_list));
	if(!item)
	return 0;
	item->com = c;
	item->next = front->cps;
	front->cps = item;
	return 1;
	}

	struct listen_dnsport*
	listen_create(struct comm_base* base, struct listen_port* ports,
	size_t bufsize, int tcp_accept_count, int tcp_idle_timeout,
	struct tcl_list* tcp_conn_limit, void* sslctx,
	struct dt_env* dtenv, comm_point_callback_type* cb, void *cb_arg)
	{
	struct listen_dnsport* front = (struct listen_dnsport*)
	malloc(sizeof(struct listen_dnsport));
	if(!front)
	return NULL;
	front->cps = NULL;
	front->udp_buff = sldns_buffer_new(bufsize);
	#ifdef USE_DNSCRYPT
	front->dnscrypt_udp_buff = NULL;
	#endif
	if(!front->udp_buff) {
	free(front);
	return NULL;
	}
	+ if(!stream_wait_lock_inited) {
	+ lock_basic_init(&stream_wait_count_lock);
	+ stream_wait_lock_inited = 1;
	+ }

	/* create comm points as needed */
	while(ports) {
	struct comm_point* cp = NULL;
	if(ports->ftype == listen_type_udp \|\|
	ports->ftype == listen_type_udp_dnscrypt)
	cp = comm_point_create_udp(base, ports->fd,
	front->udp_buff, cb, cb_arg);
	else if(ports->ftype == listen_type_tcp \|\|
	ports->ftype == listen_type_tcp_dnscrypt)
	cp = comm_point_create_tcp(base, ports->fd,
	tcp_accept_count, tcp_idle_timeout,
	- tcp_conn_limit, bufsize, cb, cb_arg);
	+ tcp_conn_limit, bufsize, front->udp_buff,
	+ cb, cb_arg);
	else if(ports->ftype == listen_type_ssl) {
	cp = comm_point_create_tcp(base, ports->fd,
	tcp_accept_count, tcp_idle_timeout,
	- tcp_conn_limit, bufsize, cb, cb_arg);
	+ tcp_conn_limit, bufsize, front->udp_buff,
	+ cb, cb_arg);
	cp->ssl = sslctx;
	} else if(ports->ftype == listen_type_udpancil \|\|
	ports->ftype == listen_type_udpancil_dnscrypt)
	cp = comm_point_create_udp_ancil(base, ports->fd,
	front->udp_buff, cb, cb_arg);
	if(!cp) {
	log_err("can't create commpoint");
	listen_delete(front);
	return NULL;
	}
	cp->dtenv = dtenv;
	cp->do_not_close = 1;
	#ifdef USE_DNSCRYPT
	if (ports->ftype == listen_type_udp_dnscrypt \|\|
	ports->ftype == listen_type_tcp_dnscrypt \|\|
	ports->ftype == listen_type_udpancil_dnscrypt) {
	cp->dnscrypt = 1;
	cp->dnscrypt_buffer = sldns_buffer_new(bufsize);
	if(!cp->dnscrypt_buffer) {
	log_err("can't alloc dnscrypt_buffer");
	comm_point_delete(cp);
	listen_delete(front);
	return NULL;
	}
	front->dnscrypt_udp_buff = cp->dnscrypt_buffer;
	}
	#endif
	if(!listen_cp_insert(cp, front)) {
	log_err("malloc failed");
	comm_point_delete(cp);
	listen_delete(front);
	return NULL;
	}
	ports = ports->next;
	}
	if(!front->cps) {
	log_err("Could not open sockets to accept queries.");
	listen_delete(front);
	return NULL;
	}

	return front;
	}

	void
	listen_list_delete(struct listen_list* list)
	{
	struct listen_list p = list, pn;
	while(p) {
	pn = p->next;
	comm_point_delete(p->com);
	free(p);
	p = pn;
	}
	}

	void
	listen_delete(struct listen_dnsport* front)
	{
	if(!front)
	return;
	listen_list_delete(front->cps);
	#ifdef USE_DNSCRYPT
	if(front->dnscrypt_udp_buff &&
	front->udp_buff != front->dnscrypt_udp_buff) {
	sldns_buffer_free(front->dnscrypt_udp_buff);
	}
	#endif
	sldns_buffer_free(front->udp_buff);
	free(front);
	+ if(stream_wait_lock_inited) {
	+ stream_wait_lock_inited = 0;
	+ lock_basic_destroy(&stream_wait_count_lock);
	+ }
	}

	struct listen_port*
	listening_ports_open(struct config_file* cfg, int* reuseport)
	{
	struct listen_port* list = NULL;
	struct addrinfo hints;
	int i, do_ip4, do_ip6;
	int do_tcp, do_auto;
	char portbuf[32];
	snprintf(portbuf, sizeof(portbuf), "%d", cfg->port);
	do_ip4 = cfg->do_ip4;
	do_ip6 = cfg->do_ip6;
	do_tcp = cfg->do_tcp;
	do_auto = cfg->if_automatic && cfg->do_udp;
	if(cfg->incoming_num_tcp == 0)
	do_tcp = 0;

	/* getaddrinfo */
	memset(&hints, 0, sizeof(hints));
	hints.ai_flags = AI_PASSIVE;
	/* no name lookups on our listening ports */
	if(cfg->num_ifs > 0)
	hints.ai_flags \|= AI_NUMERICHOST;
	hints.ai_family = AF_UNSPEC;
	#ifndef INET6
	do_ip6 = 0;
	#endif
	if(!do_ip4 && !do_ip6) {
	return NULL;
	}
	/* create ip4 and ip6 ports so that return addresses are nice. */
	if(do_auto \|\| cfg->num_ifs == 0) {
	if(do_ip6) {
	hints.ai_family = AF_INET6;
	if(!ports_create_if(do_auto?"::0":"::1",
	do_auto, cfg->do_udp, do_tcp,
	&hints, portbuf, &list,
	cfg->so_rcvbuf, cfg->so_sndbuf,
	cfg->ssl_port, cfg->tls_additional_port,
	reuseport, cfg->ip_transparent,
	cfg->tcp_mss, cfg->ip_freebind, cfg->use_systemd,
	cfg->dnscrypt_port)) {
	listening_ports_free(list);
	return NULL;
	}
	}
	if(do_ip4) {
	hints.ai_family = AF_INET;
	if(!ports_create_if(do_auto?"0.0.0.0":"127.0.0.1",
	do_auto, cfg->do_udp, do_tcp,
	&hints, portbuf, &list,
	cfg->so_rcvbuf, cfg->so_sndbuf,
	cfg->ssl_port, cfg->tls_additional_port,
	reuseport, cfg->ip_transparent,
	cfg->tcp_mss, cfg->ip_freebind, cfg->use_systemd,
	cfg->dnscrypt_port)) {
	listening_ports_free(list);
	return NULL;
	}
	}
	} else for(i = 0; i<cfg->num_ifs; i++) {
	if(str_is_ip6(cfg->ifs[i])) {
	if(!do_ip6)
	continue;
	hints.ai_family = AF_INET6;
	if(!ports_create_if(cfg->ifs[i], 0, cfg->do_udp,
	do_tcp, &hints, portbuf, &list,
	cfg->so_rcvbuf, cfg->so_sndbuf,
	cfg->ssl_port, cfg->tls_additional_port,
	reuseport, cfg->ip_transparent,
	cfg->tcp_mss, cfg->ip_freebind, cfg->use_systemd,
	cfg->dnscrypt_port)) {
	listening_ports_free(list);
	return NULL;
	}
	} else {
	if(!do_ip4)
	continue;
	hints.ai_family = AF_INET;
	if(!ports_create_if(cfg->ifs[i], 0, cfg->do_udp,
	do_tcp, &hints, portbuf, &list,
	cfg->so_rcvbuf, cfg->so_sndbuf,
	cfg->ssl_port, cfg->tls_additional_port,
	reuseport, cfg->ip_transparent,
	cfg->tcp_mss, cfg->ip_freebind, cfg->use_systemd,
	cfg->dnscrypt_port)) {
	listening_ports_free(list);
	return NULL;
	}
	}
	}
	return list;
	}

	void listening_ports_free(struct listen_port* list)
	{
	struct listen_port* nx;
	while(list) {
	nx = list->next;
	if(list->fd != -1) {
	#ifndef USE_WINSOCK
	close(list->fd);
	#else
	closesocket(list->fd);
	#endif
	}
	free(list);
	list = nx;
	}
	}

	size_t listen_get_mem(struct listen_dnsport* listen)
	{
	struct listen_list* p;
	size_t s = sizeof(listen) + sizeof(listen->base) +
	sizeof(*listen->udp_buff) +
	sldns_buffer_capacity(listen->udp_buff);
	#ifdef USE_DNSCRYPT
	s += sizeof(*listen->dnscrypt_udp_buff);
	if(listen->udp_buff != listen->dnscrypt_udp_buff){
	s += sldns_buffer_capacity(listen->dnscrypt_udp_buff);
	}
	#endif
	for(p = listen->cps; p; p = p->next) {
	s += sizeof(*p);
	s += comm_point_get_mem(p->com);
	}
	return s;
	}

	void listen_stop_accept(struct listen_dnsport* listen)
	{
	/* do not stop the ones that have no tcp_free list
	* (they have already stopped listening) */
	struct listen_list* p;
	for(p=listen->cps; p; p=p->next) {
	if(p->com->type == comm_tcp_accept &&
	p->com->tcp_free != NULL) {
	comm_point_stop_listening(p->com);
	}
	}
	}

	void listen_start_accept(struct listen_dnsport* listen)
	{
	/* do not start the ones that have no tcp_free list, it is no
	* use to listen to them because they have no free tcp handlers */
	struct listen_list* p;
	for(p=listen->cps; p; p=p->next) {
	if(p->com->type == comm_tcp_accept &&
	p->com->tcp_free != NULL) {
	comm_point_start_listening(p->com, -1, -1);
	}
	}
	}

	+struct tcp_req_info*
	+tcp_req_info_create(struct sldns_buffer* spoolbuf)
	+{
	+ struct tcp_req_info* req = (struct tcp_req_info)malloc(sizeof(req));
	+ if(!req) {
	+ log_err("malloc failure for new stream outoforder processing structure");
	+ return NULL;
	+ }
	+ memset(req, 0, sizeof(*req));
	+ req->spool_buffer = spoolbuf;
	+ return req;
	+}
	+
	+void
	+tcp_req_info_delete(struct tcp_req_info* req)
	+{
	+ if(!req) return;
	+ tcp_req_info_clear(req);
	+ /* cp is pointer back to commpoint that owns this struct and
	+ * called delete on us */
	+ /* spool_buffer is shared udp buffer, not deleted here */
	+ free(req);
	+}
	+
	+void tcp_req_info_clear(struct tcp_req_info* req)
	+{
	+ struct tcp_req_open_item* open, *nopen;
	+ struct tcp_req_done_item* item, *nitem;
	+ if(!req) return;
	+
	+ /* free outstanding request mesh reply entries */
	+ open = req->open_req_list;
	+ while(open) {
	+ nopen = open->next;
	+ mesh_state_remove_reply(open->mesh, open->mesh_state, req->cp);
	+ free(open);
	+ open = nopen;
	+ }
	+ req->open_req_list = NULL;
	+ req->num_open_req = 0;
	+
	+ /* free pending writable result packets */
	+ item = req->done_req_list;
	+ while(item) {
	+ nitem = item->next;
	+ lock_basic_lock(&stream_wait_count_lock);
	+ stream_wait_count -= (sizeof(struct tcp_req_done_item)
	+ +item->len);
	+ lock_basic_unlock(&stream_wait_count_lock);
	+ free(item->buf);
	+ free(item);
	+ item = nitem;
	+ }
	+ req->done_req_list = NULL;
	+ req->num_done_req = 0;
	+ req->read_is_closed = 0;
	+}
	+
	+void
	+tcp_req_info_remove_mesh_state(struct tcp_req_info* req, struct mesh_state* m)
	+{
	+ struct tcp_req_open_item* open, *prev = NULL;
	+ if(!req \|\| !m) return;
	+ open = req->open_req_list;
	+ while(open) {
	+ if(open->mesh_state == m) {
	+ struct tcp_req_open_item* next;
	+ if(prev) prev->next = open->next;
	+ else req->open_req_list = open->next;
	+ /* caller has to manage the mesh state reply entry */
	+ next = open->next;
	+ free(open);
	+ req->num_open_req --;
	+
	+ /* prev = prev; */
	+ open = next;
	+ continue;
	+ }
	+ prev = open;
	+ open = open->next;
	+ }
	+}
	+
	+/** setup listening for read or write */
	+static void
	+tcp_req_info_setup_listen(struct tcp_req_info* req)
	+{
	+ int wr = 0;
	+ int rd = 0;
	+
	+ if(req->cp->tcp_byte_count != 0) {
	+ /* cannot change, halfway through */
	+ return;
	+ }
	+
	+ if(!req->cp->tcp_is_reading)
	+ wr = 1;
	+ if(req->num_open_req + req->num_done_req < TCP_MAX_REQ_SIMULTANEOUS &&
	+ !req->read_is_closed)
	+ rd = 1;
	+
	+ if(wr) {
	+ req->cp->tcp_is_reading = 0;
	+ comm_point_stop_listening(req->cp);
	+ comm_point_start_listening(req->cp, -1,
	+ req->cp->tcp_timeout_msec);
	+ } else if(rd) {
	+ req->cp->tcp_is_reading = 1;
	+ comm_point_stop_listening(req->cp);
	+ comm_point_start_listening(req->cp, -1,
	+ req->cp->tcp_timeout_msec);
	+ /* and also read it (from SSL stack buffers), so
	+ * no event read event is expected since the remainder of
	+ * the TLS frame is sitting in the buffers. */
	+ req->read_again = 1;
	+ } else {
	+ comm_point_stop_listening(req->cp);
	+ comm_point_start_listening(req->cp, -1,
	+ req->cp->tcp_timeout_msec);
	+ comm_point_listen_for_rw(req->cp, 0, 0);
	+ }
	+}
	+
	+/** remove first item from list of pending results */
	+static struct tcp_req_done_item*
	+tcp_req_info_pop_done(struct tcp_req_info* req)
	+{
	+ struct tcp_req_done_item* item;
	+ log_assert(req->num_done_req > 0 && req->done_req_list);
	+ item = req->done_req_list;
	+ lock_basic_lock(&stream_wait_count_lock);
	+ stream_wait_count -= (sizeof(struct tcp_req_done_item)+item->len);
	+ lock_basic_unlock(&stream_wait_count_lock);
	+ req->done_req_list = req->done_req_list->next;
	+ req->num_done_req --;
	+ return item;
	+}
	+
	+/** Send given buffer and setup to write */
	+static void
	+tcp_req_info_start_write_buf(struct tcp_req_info* req, uint8_t* buf,
	+ size_t len)
	+{
	+ sldns_buffer_clear(req->cp->buffer);
	+ sldns_buffer_write(req->cp->buffer, buf, len);
	+ sldns_buffer_flip(req->cp->buffer);
	+
	+ req->cp->tcp_is_reading = 0; /* we are now writing */
	+}
	+
	+/** pick up the next result and start writing it to the channel */
	+static void
	+tcp_req_pickup_next_result(struct tcp_req_info* req)
	+{
	+ if(req->num_done_req > 0) {
	+ /* unlist the done item from the list of pending results */
	+ struct tcp_req_done_item* item = tcp_req_info_pop_done(req);
	+ tcp_req_info_start_write_buf(req, item->buf, item->len);
	+ free(item->buf);
	+ free(item);
	+ }
	+}
	+
	+/** the read channel has closed */
	+int
	+tcp_req_info_handle_read_close(struct tcp_req_info* req)
	+{
	+ verbose(VERB_ALGO, "tcp channel read side closed %d", req->cp->fd);
	+ /* reset byte count for (potential) partial read */
	+ req->cp->tcp_byte_count = 0;
	+ /* if we still have results to write, pick up next and write it */
	+ if(req->num_done_req != 0) {
	+ tcp_req_pickup_next_result(req);
	+ tcp_req_info_setup_listen(req);
	+ return 1;
	+ }
	+ /* if nothing to do, this closes the connection */
	+ if(req->num_open_req == 0 && req->num_done_req == 0)
	+ return 0;
	+ /* otherwise, we must be waiting for dns resolve, wait with timeout */
	+ req->read_is_closed = 1;
	+ tcp_req_info_setup_listen(req);
	+ return 1;
	+}
	+
	+void
	+tcp_req_info_handle_writedone(struct tcp_req_info* req)
	+{
	+ /* back to reading state, we finished this write event */
	+ sldns_buffer_clear(req->cp->buffer);
	+ if(req->num_done_req == 0 && req->read_is_closed) {
	+ /* no more to write and nothing to read, close it */
	+ comm_point_drop_reply(&req->cp->repinfo);
	+ return;
	+ }
	+ req->cp->tcp_is_reading = 1;
	+ /* see if another result needs writing */
	+ tcp_req_pickup_next_result(req);
	+
	+ /* see if there is more to write, if not stop_listening for writing */
	+ /* see if new requests are allowed, if so, start_listening
	+ * for reading */
	+ tcp_req_info_setup_listen(req);
	+}
	+
	+void
	+tcp_req_info_handle_readdone(struct tcp_req_info* req)
	+{
	+ struct comm_point* c = req->cp;
	+
	+ /* we want to read up several requests, unless there are
	+ * pending answers */
	+
	+ req->is_drop = 0;
	+ req->is_reply = 0;
	+ req->in_worker_handle = 1;
	+ sldns_buffer_set_limit(req->spool_buffer, 0);
	+ /* handle the current request */
	+ /* this calls the worker handle request routine that could give
	+ * a cache response, or localdata response, or drop the reply,
	+ * or schedule a mesh entry for later */
	+ fptr_ok(fptr_whitelist_comm_point(c->callback));
	+ if( (*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, &c->repinfo) ) {
	+ req->in_worker_handle = 0;
	+ /* there is an answer, put it up. It is already in the
	+ * c->buffer, just send it. */
	+ /* since we were just reading a query, the channel is
	+ * clear to write to */
	+ send_it:
	+ c->tcp_is_reading = 0;
	+ comm_point_stop_listening(c);
	+ comm_point_start_listening(c, -1, c->tcp_timeout_msec);
	+ return;
	+ }
	+ req->in_worker_handle = 0;
	+ /* it should be waiting in the mesh for recursion.
	+ * If mesh failed to add a new entry and called commpoint_drop_reply.
	+ * Then the mesh state has been cleared. */
	+ if(req->is_drop) {
	+ /* the reply has been dropped, stream has been closed. */
	+ return;
	+ }
	+ /* If mesh failed(mallocfail) and called commpoint_send_reply with
	+ * something like servfail then we pick up that reply below. */
	+ if(req->is_reply) {
	+ goto send_it;
	+ }
	+
	+ sldns_buffer_clear(c->buffer);
	+ /* if pending answers, pick up an answer and start sending it */
	+ tcp_req_pickup_next_result(req);
	+
	+ /* if answers pending, start sending answers */
	+ /* read more requests if we can have more requests */
	+ tcp_req_info_setup_listen(req);
	+}
	+
	+int
	+tcp_req_info_add_meshstate(struct tcp_req_info* req,
	+ struct mesh_area* mesh, struct mesh_state* m)
	+{
	+ struct tcp_req_open_item* item;
	+ log_assert(req && mesh && m);
	+ item = (struct tcp_req_open_item)malloc(sizeof(item));
	+ if(!item) return 0;
	+ item->next = req->open_req_list;
	+ item->mesh = mesh;
	+ item->mesh_state = m;
	+ req->open_req_list = item;
	+ req->num_open_req++;
	+ return 1;
	+}
	+
	+/** Add a result to the result list. At the end. */
	+static int
	+tcp_req_info_add_result(struct tcp_req_info* req, uint8_t* buf, size_t len)
	+{
	+ struct tcp_req_done_item* last = NULL;
	+ struct tcp_req_done_item* item;
	+ size_t space;
	+
	+ /* see if we have space */
	+ space = sizeof(struct tcp_req_done_item) + len;
	+ lock_basic_lock(&stream_wait_count_lock);
	+ if(stream_wait_count + space > stream_wait_max) {
	+ lock_basic_unlock(&stream_wait_count_lock);
	+ verbose(VERB_ALGO, "drop stream reply, no space left, in stream-wait-size");
	+ return 0;
	+ }
	+ stream_wait_count += space;
	+ lock_basic_unlock(&stream_wait_count_lock);
	+
	+ /* find last element */
	+ last = req->done_req_list;
	+ while(last && last->next)
	+ last = last->next;
	+
	+ /* create new element */
	+ item = (struct tcp_req_done_item)malloc(sizeof(item));
	+ if(!item) {
	+ log_err("malloc failure, for stream result list");
	+ return 0;
	+ }
	+ item->next = NULL;
	+ item->len = len;
	+ item->buf = memdup(buf, len);
	+ if(!item->buf) {
	+ free(item);
	+ log_err("malloc failure, adding reply to stream result list");
	+ return 0;
	+ }
	+
	+ /* link in */
	+ if(last) last->next = item;
	+ else req->done_req_list = item;
	+ req->num_done_req++;
	+ return 1;
	+}
	+
	+void
	+tcp_req_info_send_reply(struct tcp_req_info* req)
	+{
	+ if(req->in_worker_handle) {
	+ /* reply from mesh is in the spool_buffer */
	+ /* copy now, so that the spool buffer is free for other tasks
	+ * before the callback is done */
	+ sldns_buffer_clear(req->cp->buffer);
	+ sldns_buffer_write(req->cp->buffer,
	+ sldns_buffer_begin(req->spool_buffer),
	+ sldns_buffer_limit(req->spool_buffer));
	+ sldns_buffer_flip(req->cp->buffer);
	+ req->is_reply = 1;
	+ return;
	+ }
	+ /* now that the query has been handled, that mesh_reply entry
	+ * should be removed, from the tcp_req_info list,
	+ * the mesh state cleanup removes then with region_cleanup and
	+ * replies_sent true. */
	+ /* see if we can send it straight away (we are not doing
	+ * anything else). If so, copy to buffer and start */
	+ if(req->cp->tcp_is_reading && req->cp->tcp_byte_count == 0) {
	+ /* buffer is free, and was ready to read new query into,
	+ * but we are now going to use it to send this answer */
	+ tcp_req_info_start_write_buf(req,
	+ sldns_buffer_begin(req->spool_buffer),
	+ sldns_buffer_limit(req->spool_buffer));
	+ /* switch to listen to write events */
	+ comm_point_stop_listening(req->cp);
	+ comm_point_start_listening(req->cp, -1,
	+ req->cp->tcp_timeout_msec);
	+ return;
	+ }
	+ /* queue up the answer behind the others already pending */
	+ if(!tcp_req_info_add_result(req, sldns_buffer_begin(req->spool_buffer),
	+ sldns_buffer_limit(req->spool_buffer))) {
	+ /* drop the connection, we are out of resources */
	+ comm_point_drop_reply(&req->cp->repinfo);
	+ }
	+}
	+
	+size_t tcp_req_info_get_stream_buffer_size(void)
	+{
	+ size_t s;
	+ if(!stream_wait_lock_inited)
	+ return stream_wait_count;
	+ lock_basic_lock(&stream_wait_count_lock);
	+ s = stream_wait_count;
	+ lock_basic_unlock(&stream_wait_count_lock);
	+ return s;
	+}
	Index: head/contrib/unbound/services/listen_dnsport.h
	===================================================================
	--- head/contrib/unbound/services/listen_dnsport.h (revision 349719)
	+++ head/contrib/unbound/services/listen_dnsport.h (revision 349720)
	@@ -1,240 +1,370 @@
	/*
	* services/listen_dnsport.h - listen on port 53 for incoming DNS queries.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file has functions to get queries from clients.
	*/

	#ifndef LISTEN_DNSPORT_H
	#define LISTEN_DNSPORT_H

	#include "util/netevent.h"
	struct listen_list;
	struct config_file;
	struct addrinfo;
	struct sldns_buffer;
	struct tcl_list;

	/**
	* Listening for queries structure.
	* Contains list of query-listen sockets.
	*/
	struct listen_dnsport {
	/** Base for select calls */
	struct comm_base* base;

	/** buffer shared by UDP connections, since there is only one
	datagram at any time. */
	struct sldns_buffer* udp_buff;
	#ifdef USE_DNSCRYPT
	struct sldns_buffer* dnscrypt_udp_buff;
	#endif
	/** list of comm points used to get incoming events */
	struct listen_list* cps;
	};

	/**
	* Single linked list to store event points.
	*/
	struct listen_list {
	/** next in list */
	struct listen_list* next;
	/** event info */
	struct comm_point* com;
	};

	/**
	* type of ports
	*/
	enum listen_type {
	/** udp type */
	listen_type_udp,
	/** tcp type */
	listen_type_tcp,
	/** udp ipv6 (v4mapped) for use with ancillary data */
	listen_type_udpancil,
	/** ssl over tcp type */
	listen_type_ssl,
	/** udp type + dnscrypt*/
	listen_type_udp_dnscrypt,
	/** tcp type + dnscrypt */
	listen_type_tcp_dnscrypt,
	/** udp ipv6 (v4mapped) for use with ancillary data + dnscrypt*/
	listen_type_udpancil_dnscrypt

	};

	/**
	* Single linked list to store shared ports that have been
	* opened for use by all threads.
	*/
	struct listen_port {
	/** next in list */
	struct listen_port* next;
	/** file descriptor, open and ready for use */
	int fd;
	/** type of file descriptor, udp or tcp */
	enum listen_type ftype;
	};

	/**
	* Create shared listening ports
	* Getaddrinfo, create socket, bind and listen to zero or more
	* interfaces for IP4 and/or IP6, for UDP and/or TCP.
	* On the given port number. It creates the sockets.
	* @param cfg: settings on what ports to open.
	* @param reuseport: set to true if you want reuseport, or NULL to not have it,
	* set to false on exit if reuseport failed to apply (because of no
	* kernel support).
	* @return: linked list of ports or NULL on error.
	*/
	struct listen_port* listening_ports_open(struct config_file* cfg,
	int* reuseport);

	/**
	* Close and delete the (list of) listening ports.
	*/
	void listening_ports_free(struct listen_port* list);

	/**
	* Create commpoints with for this thread for the shared ports.
	* @param base: the comm_base that provides event functionality.
	* for default all ifs.
	* @param ports: the list of shared ports.
	* @param bufsize: size of datagram buffer.
	* @param tcp_accept_count: max number of simultaneous TCP connections
	* from clients.
	* @param tcp_idle_timeout: idle timeout for TCP connections in msec.
	* @param tcp_conn_limit: TCP connection limit info.
	* @param sslctx: nonNULL if ssl context.
	* @param dtenv: nonNULL if dnstap enabled.
	* @param cb: callback function when a request arrives. It is passed
	* the packet and user argument. Return true to send a reply.
	* @param cb_arg: user data argument for callback function.
	* @return: the malloced listening structure, ready for use. NULL on error.
	*/
	struct listen_dnsport* listen_create(struct comm_base* base,
	struct listen_port* ports, size_t bufsize,
	int tcp_accept_count, int tcp_idle_timeout,
	struct tcl_list* tcp_conn_limit, void* sslctx,
	struct dt_env dtenv, comm_point_callback_type cb, void* cb_arg);

	/**
	* delete the listening structure
	* @param listen: listening structure.
	*/
	void listen_delete(struct listen_dnsport* listen);

	/**
	* delete listen_list of commpoints. Calls commpointdelete() on items.
	* This may close the fds or not depending on flags.
	* @param list: to delete.
	*/
	void listen_list_delete(struct listen_list* list);

	/**
	* get memory size used by the listening structs
	* @param listen: listening structure.
	* @return: size in bytes.
	*/
	size_t listen_get_mem(struct listen_dnsport* listen);

	/**
	* stop accept handlers for TCP (until enabled again)
	* @param listen: listening structure.
	*/
	void listen_stop_accept(struct listen_dnsport* listen);

	/**
	* start accept handlers for TCP (was stopped before)
	* @param listen: listening structure.
	*/
	void listen_start_accept(struct listen_dnsport* listen);

	/**
	* Create and bind nonblocking UDP socket
	* @param family: for socket call.
	* @param socktype: for socket call.
	* @param addr: for bind call.
	* @param addrlen: for bind call.
	* @param v6only: if enabled, IP6 sockets get IP6ONLY option set.
	* if enabled with value 2 IP6ONLY option is disabled.
	* @param inuse: on error, this is set true if the port was in use.
	* @param noproto: on error, this is set true if cause is that the
	IPv6 proto (family) is not available.
	* @param rcv: set size on rcvbuf with socket option, if 0 it is not set.
	* @param snd: set size on sndbuf with socket option, if 0 it is not set.
	* @param listen: if true, this is a listening UDP port, eg port 53, and
	* set SO_REUSEADDR on it.
	* @param reuseport: if nonNULL and true, try to set SO_REUSEPORT on
	* listening UDP port. Set to false on return if it failed to do so.
	* @param transparent: set IP_TRANSPARENT socket option.
	* @param freebind: set IP_FREEBIND socket option.
	* @param use_systemd: if true, fetch sockets from systemd.
	* @return: the socket. -1 on error.
	*/
	int create_udp_sock(int family, int socktype, struct sockaddr* addr,
	socklen_t addrlen, int v6only, int* inuse, int* noproto, int rcv,
	int snd, int listen, int* reuseport, int transparent, int freebind, int use_systemd);

	/**
	* Create and bind TCP listening socket
	* @param addr: address info ready to make socket.
	* @param v6only: enable ip6 only flag on ip6 sockets.
	* @param noproto: if error caused by lack of protocol support.
	* @param reuseport: if nonNULL and true, try to set SO_REUSEPORT on
	* listening UDP port. Set to false on return if it failed to do so.
	* @param transparent: set IP_TRANSPARENT socket option.
	* @param mss: maximum segment size of the socket. if zero, leaves the default.
	* @param freebind: set IP_FREEBIND socket option.
	* @param use_systemd: if true, fetch sockets from systemd.
	* @return: the socket. -1 on error.
	*/
	int create_tcp_accept_sock(struct addrinfo addr, int v6only, int noproto,
	int* reuseport, int transparent, int mss, int freebind, int use_systemd);

	/**
	* Create and bind local listening socket
	* @param path: path to the socket.
	* @param noproto: on error, this is set true if cause is that local sockets
	* are not supported.
	* @param use_systemd: if true, fetch sockets from systemd.
	* @return: the socket. -1 on error.
	*/
	int create_local_accept_sock(const char* path, int* noproto, int use_systemd);

	+/**
	+ * TCP request info. List of requests outstanding on the channel, that
	+ * are asked for but not yet answered back.
	+ */
	+struct tcp_req_info {
	+ /** the TCP comm point for this. Its buffer is used for read/write */
	+ struct comm_point* cp;
	+ /** the buffer to use to spool reply from mesh into,
	+ * it can then be copied to the result list and written.
	+ * it is a pointer to the shared udp buffer. */
	+ struct sldns_buffer* spool_buffer;
	+ /** are we in worker_handle function call (for recursion callback)*/
	+ int in_worker_handle;
	+ /** is the comm point dropped (by worker handle).
	+ * That means we have to disconnect the channel. */
	+ int is_drop;
	+ /** is the comm point set to send_reply (by mesh new client in worker
	+ * handle), if so answer is available in c.buffer */
	+ int is_reply;
	+ /** read channel has closed, just write pending results */
	+ int read_is_closed;
	+ /** read again */
	+ int read_again;
	+ /** number of outstanding requests */
	+ int num_open_req;
	+ /** list of outstanding requests */
	+ struct tcp_req_open_item* open_req_list;
	+ /** number of pending writeable results */
	+ int num_done_req;
	+ /** list of pending writable result packets, malloced one at a time */
	+ struct tcp_req_done_item* done_req_list;
	+};
	+
	+/**
	+ * List of open items in TCP channel
	+ */
	+struct tcp_req_open_item {
	+ /** next in list */
	+ struct tcp_req_open_item* next;
	+ /** the mesh area of the mesh_state */
	+ struct mesh_area* mesh;
	+ /** the mesh state */
	+ struct mesh_state* mesh_state;
	+};
	+
	+/**
	+ * List of done items in TCP channel
	+ */
	+struct tcp_req_done_item {
	+ /** next in list */
	+ struct tcp_req_done_item* next;
	+ /** the buffer with packet contents */
	+ uint8_t* buf;
	+ /** length of the buffer */
	+ size_t len;
	+};
	+
	+/**
	+ * Create tcp request info structure that keeps track of open
	+ * requests on the TCP channel that are resolved at the same time,
	+ * and the pending results that have to get written back to that client.
	+ * @param spoolbuf: shared buffer
	+ * @return new structure or NULL on alloc failure.
	+ */
	+struct tcp_req_info* tcp_req_info_create(struct sldns_buffer* spoolbuf);
	+
	+/**
	+ * Delete tcp request structure. Called by owning commpoint.
	+ * Removes mesh entry references and stored results from the lists.
	+ * @param req: the tcp request info
	+ */
	+void tcp_req_info_delete(struct tcp_req_info* req);
	+
	+/**
	+ * Clear tcp request structure. Removes list entries, sets it up ready
	+ * for the next connection.
	+ * @param req: tcp request info structure.
	+ */
	+void tcp_req_info_clear(struct tcp_req_info* req);
	+
	+/**
	+ * Remove mesh state entry from list in tcp_req_info.
	+ * caller has to manage the mesh state reply entry in the mesh state.
	+ * @param req: the tcp req info that has the entry removed from the list.
	+ * @param m: the state removed from the list.
	+ */
	+void tcp_req_info_remove_mesh_state(struct tcp_req_info* req,
	+ struct mesh_state* m);
	+
	+/**
	+ * Handle write done of the last result packet
	+ * @param req: the tcp req info.
	+ */
	+void tcp_req_info_handle_writedone(struct tcp_req_info* req);
	+
	+/**
	+ * Handle read done of a new request from the client
	+ * @param req: the tcp req info.
	+ */
	+void tcp_req_info_handle_readdone(struct tcp_req_info* req);
	+
	+/**
	+ * Add mesh state to the tcp req list of open requests.
	+ * So the comm_reply can be removed off the mesh reply list when
	+ * the tcp channel has to be closed (for other reasons then that that
	+ * request was done, eg. channel closed by client or some format error).
	+ * @param req: tcp req info structure. It keeps track of the simultaneous
	+ * requests and results on a tcp (or TLS) channel.
	+ * @param mesh: mesh area for the state.
	+ * @param m: mesh state to add.
	+ * @return 0 on failure (malloc failure).
	+ */
	+int tcp_req_info_add_meshstate(struct tcp_req_info* req,
	+ struct mesh_area* mesh, struct mesh_state* m);
	+
	+/**
	+ * Send reply on tcp simultaneous answer channel. May queue it up.
	+ * @param req: request info structure.
	+ */
	+void tcp_req_info_send_reply(struct tcp_req_info* req);
	+
	+/** the read channel has closed
	+ * @param req: request. remaining queries are looked up and answered.
	+ * @return zero if nothing to do, just close the tcp.
	+ */
	+int tcp_req_info_handle_read_close(struct tcp_req_info* req);
	+
	+/** get the size of currently used tcp stream wait buffers (in bytes) */
	+size_t tcp_req_info_get_stream_buffer_size(void);
	+
	#endif /* LISTEN_DNSPORT_H */
	Index: head/contrib/unbound/services/localzone.c
	===================================================================
	--- head/contrib/unbound/services/localzone.c (revision 349719)
	+++ head/contrib/unbound/services/localzone.c (revision 349720)
	@@ -1,1901 +1,1913 @@
	/*
	* services/localzone.c - local zones authority service.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains functions to enable local zone authority service.
	*/
	#include "config.h"
	#include "services/localzone.h"
	#include "sldns/str2wire.h"
	#include "sldns/sbuffer.h"
	#include "util/regional.h"
	#include "util/config_file.h"
	#include "util/data/dname.h"
	#include "util/data/packed_rrset.h"
	#include "util/data/msgencode.h"
	#include "util/net_help.h"
	#include "util/netevent.h"
	#include "util/data/msgreply.h"
	#include "util/data/msgparse.h"
	#include "util/as112.h"

	/* maximum RRs in an RRset, to cap possible 'endless' list RRs.
	* with 16 bytes for an A record, a 64K packet has about 4000 max */
	#define LOCALZONE_RRSET_COUNT_MAX 4096

	struct local_zones*
	local_zones_create(void)
	{
	struct local_zones* zones = (struct local_zones*)calloc(1,
	sizeof(*zones));
	if(!zones)
	return NULL;
	rbtree_init(&zones->ztree, &local_zone_cmp);
	lock_rw_init(&zones->lock);
	lock_protect(&zones->lock, &zones->ztree, sizeof(zones->ztree));
	/* also lock protects the rbnode's in struct local_zone */
	return zones;
	}

	/** helper traverse to delete zones */
	static void
	lzdel(rbnode_type* n, void* ATTR_UNUSED(arg))
	{
	struct local_zone* z = (struct local_zone*)n->key;
	local_zone_delete(z);
	}

	void
	local_zones_delete(struct local_zones* zones)
	{
	if(!zones)
	return;
	lock_rw_destroy(&zones->lock);
	/* walk through zones and delete them all */
	traverse_postorder(&zones->ztree, lzdel, NULL);
	free(zones);
	}

	void
	local_zone_delete(struct local_zone* z)
	{
	if(!z)
	return;
	lock_rw_destroy(&z->lock);
	regional_destroy(z->region);
	free(z->name);
	free(z->taglist);
	free(z);
	}

	int
	local_zone_cmp(const void* z1, const void* z2)
	{
	/* first sort on class, so that hierarchy can be maintained within
	* a class */
	struct local_zone* a = (struct local_zone*)z1;
	struct local_zone* b = (struct local_zone*)z2;
	int m;
	if(a->dclass != b->dclass) {
	if(a->dclass < b->dclass)
	return -1;
	return 1;
	}
	return dname_lab_cmp(a->name, a->namelabs, b->name, b->namelabs, &m);
	}

	int
	local_data_cmp(const void* d1, const void* d2)
	{
	struct local_data* a = (struct local_data*)d1;
	struct local_data* b = (struct local_data*)d2;
	int m;
	return dname_canon_lab_cmp(a->name, a->namelabs, b->name,
	b->namelabs, &m);
	}

	/* form wireformat from text format domain name */
	int
	parse_dname(const char* str, uint8_t** res, size_t* len, int* labs)
	{
	*res = sldns_str2wire_dname(str, len);
	*labs = 0;
	if(!*res) {
	log_err("cannot parse name %s", str);
	return 0;
	}
	labs = dname_count_size_labels(res, len);
	return 1;
	}

	/** create a new localzone */
	static struct local_zone*
	local_zone_create(uint8_t* nm, size_t len, int labs,
	enum localzone_type t, uint16_t dclass)
	{
	struct local_zone* z = (struct local_zone)calloc(1, sizeof(z));
	if(!z) {
	return NULL;
	}
	z->node.key = z;
	z->dclass = dclass;
	z->type = t;
	z->name = nm;
	z->namelen = len;
	z->namelabs = labs;
	lock_rw_init(&z->lock);
	z->region = regional_create_custom(sizeof(struct regional));
	if(!z->region) {
	free(z);
	return NULL;
	}
	rbtree_init(&z->data, &local_data_cmp);
	lock_protect(&z->lock, &z->parent, sizeof(*z)-sizeof(rbnode_type));
	/* also the zones->lock protects node, parent, name, class /
	return z;
	}

	/** enter a new zone with allocated dname returns with WRlock */
	static struct local_zone*
	lz_enter_zone_dname(struct local_zones* zones, uint8_t* nm, size_t len,
	int labs, enum localzone_type t, uint16_t c)
	{
	struct local_zone* z = local_zone_create(nm, len, labs, t, c);
	if(!z) {
	free(nm);
	log_err("out of memory");
	return NULL;
	}

	/* add to rbtree */
	lock_rw_wrlock(&zones->lock);
	lock_rw_wrlock(&z->lock);
	if(!rbtree_insert(&zones->ztree, &z->node)) {
	struct local_zone* oldz;
	char str[256];
	dname_str(nm, str);
	log_warn("duplicate local-zone %s", str);
	lock_rw_unlock(&z->lock);
	/* save zone name locally before deallocation,
	* otherwise, nm is gone if we zone_delete now. */
	oldz = z;
	/* find the correct zone, so not an error for duplicate */
	z = local_zones_find(zones, nm, len, labs, c);
	lock_rw_wrlock(&z->lock);
	lock_rw_unlock(&zones->lock);
	local_zone_delete(oldz);
	return z;
	}
	lock_rw_unlock(&zones->lock);
	return z;
	}

	/** enter a new zone */
	static struct local_zone*
	lz_enter_zone(struct local_zones* zones, const char* name, const char* type,
	uint16_t dclass)
	{
	struct local_zone* z;
	enum localzone_type t;
	uint8_t* nm;
	size_t len;
	int labs;
	if(!parse_dname(name, &nm, &len, &labs)) {
	log_err("bad zone name %s %s", name, type);
	return NULL;
	}
	if(!local_zone_str2type(type, &t)) {
	log_err("bad lz_enter_zone type %s %s", name, type);
	free(nm);
	return NULL;
	}
	if(!(z=lz_enter_zone_dname(zones, nm, len, labs, t, dclass))) {
	log_err("could not enter zone %s %s", name, type);
	return NULL;
	}
	return z;
	}

	int
	rrstr_get_rr_content(const char* str, uint8_t** nm, uint16_t* type,
	uint16_t* dclass, time_t* ttl, uint8_t* rr, size_t len,
	uint8_t** rdata, size_t* rdata_len)
	{
	size_t dname_len = 0;
	int e = sldns_str2wire_rr_buf(str, rr, &len, &dname_len, 3600,
	NULL, 0, NULL, 0);
	if(e) {
	log_err("error parsing local-data at %d: '%s': %s",
	LDNS_WIREPARSE_OFFSET(e), str,
	sldns_get_errorstr_parse(e));
	return 0;
	}
	*nm = memdup(rr, dname_len);
	if(!*nm) {
	log_err("out of memory");
	return 0;
	}
	*dclass = sldns_wirerr_get_class(rr, len, dname_len);
	*type = sldns_wirerr_get_type(rr, len, dname_len);
	*ttl = (time_t)sldns_wirerr_get_ttl(rr, len, dname_len);
	*rdata = sldns_wirerr_get_rdatawl(rr, len, dname_len);
	*rdata_len = sldns_wirerr_get_rdatalen(rr, len, dname_len)+2;
	return 1;
	}

	/** return name and class of rr; parses string */
	static int
	get_rr_nameclass(const char* str, uint8_t** nm, uint16_t* dclass,
	uint16_t* dtype)
	{
	uint8_t rr[LDNS_RR_BUF_SIZE];
	size_t len = sizeof(rr), dname_len = 0;
	int s = sldns_str2wire_rr_buf(str, rr, &len, &dname_len, 3600,
	NULL, 0, NULL, 0);
	if(s != 0) {
	log_err("error parsing local-data at %d '%s': %s",
	LDNS_WIREPARSE_OFFSET(s), str,
	sldns_get_errorstr_parse(s));
	return 0;
	}
	*nm = memdup(rr, dname_len);
	*dclass = sldns_wirerr_get_class(rr, len, dname_len);
	*dtype = sldns_wirerr_get_type(rr, len, dname_len);
	if(!*nm) {
	log_err("out of memory");
	return 0;
	}
	return 1;
	}

	/**
	* Find an rrset in local data structure.
	* @param data: local data domain name structure.
	* @param type: type to look for (host order).
	* @param alias_ok: 1 if matching a non-exact, alias type such as CNAME is
	* allowed. otherwise 0.
	* @return rrset pointer or NULL if not found.
	*/
	static struct local_rrset*
	local_data_find_type(struct local_data* data, uint16_t type, int alias_ok)
	{
	struct local_rrset* p;
	type = htons(type);
	for(p = data->rrsets; p; p = p->next) {
	if(p->rrset->rk.type == type)
	return p;
	if(alias_ok && p->rrset->rk.type == htons(LDNS_RR_TYPE_CNAME))
	return p;
	}
	return NULL;
	}

	/** check for RR duplicates */
	static int
	rr_is_duplicate(struct packed_rrset_data* pd, uint8_t* rdata, size_t rdata_len)
	{
	size_t i;
	for(i=0; i<pd->count; i++) {
	if(pd->rr_len[i] == rdata_len &&
	memcmp(pd->rr_data[i], rdata, rdata_len) == 0)
	return 1;
	}
	return 0;
	}

	/** new local_rrset */
	static struct local_rrset*
	new_local_rrset(struct regional* region, struct local_data* node,
	uint16_t rrtype, uint16_t rrclass)
	{
	struct packed_rrset_data* pd;
	struct local_rrset* rrset = (struct local_rrset*)
	regional_alloc_zero(region, sizeof(*rrset));
	if(!rrset) {
	log_err("out of memory");
	return NULL;
	}
	rrset->next = node->rrsets;
	node->rrsets = rrset;
	rrset->rrset = (struct ub_packed_rrset_key*)
	regional_alloc_zero(region, sizeof(*rrset->rrset));
	if(!rrset->rrset) {
	log_err("out of memory");
	return NULL;
	}
	rrset->rrset->entry.key = rrset->rrset;
	pd = (struct packed_rrset_data*)regional_alloc_zero(region,
	sizeof(*pd));
	if(!pd) {
	log_err("out of memory");
	return NULL;
	}
	pd->trust = rrset_trust_prim_noglue;
	pd->security = sec_status_insecure;
	rrset->rrset->entry.data = pd;
	rrset->rrset->rk.dname = node->name;
	rrset->rrset->rk.dname_len = node->namelen;
	rrset->rrset->rk.type = htons(rrtype);
	rrset->rrset->rk.rrset_class = htons(rrclass);
	return rrset;
	}

	/** insert RR into RRset data structure; Wastes a couple of bytes */
	int
	rrset_insert_rr(struct regional* region, struct packed_rrset_data* pd,
	uint8_t* rdata, size_t rdata_len, time_t ttl, const char* rrstr)
	{
	size_t* oldlen = pd->rr_len;
	time_t* oldttl = pd->rr_ttl;
	uint8_t** olddata = pd->rr_data;

	/* add RR to rrset */
	if(pd->count > LOCALZONE_RRSET_COUNT_MAX) {
	log_warn("RRset '%s' has more than %d records, record ignored",
	rrstr, LOCALZONE_RRSET_COUNT_MAX);
	return 1;
	}
	pd->count++;
	pd->rr_len = regional_alloc(region, sizeof(pd->rr_len)pd->count);
	pd->rr_ttl = regional_alloc(region, sizeof(pd->rr_ttl)pd->count);
	pd->rr_data = regional_alloc(region, sizeof(pd->rr_data)pd->count);
	if(!pd->rr_len \|\| !pd->rr_ttl \|\| !pd->rr_data) {
	log_err("out of memory");
	return 0;
	}
	if(pd->count > 1) {
	memcpy(pd->rr_len+1, oldlen,
	sizeof(pd->rr_len)(pd->count-1));
	memcpy(pd->rr_ttl+1, oldttl,
	sizeof(pd->rr_ttl)(pd->count-1));
	memcpy(pd->rr_data+1, olddata,
	sizeof(pd->rr_data)(pd->count-1));
	}
	pd->rr_len[0] = rdata_len;
	pd->rr_ttl[0] = ttl;
	pd->rr_data[0] = regional_alloc_init(region, rdata, rdata_len);
	if(!pd->rr_data[0]) {
	log_err("out of memory");
	return 0;
	}
	return 1;
	}

	/** find a data node by exact name */
	static struct local_data*
	lz_find_node(struct local_zone* z, uint8_t* nm, size_t nmlen, int nmlabs)
	{
	struct local_data key;
	key.node.key = &key;
	key.name = nm;
	key.namelen = nmlen;
	key.namelabs = nmlabs;
	return (struct local_data*)rbtree_search(&z->data, &key.node);
	}

	/** find a node, create it if not and all its empty nonterminal parents */
	static int
	lz_find_create_node(struct local_zone* z, uint8_t* nm, size_t nmlen,
	int nmlabs, struct local_data** res)
	{
	struct local_data* ld = lz_find_node(z, nm, nmlen, nmlabs);
	if(!ld) {
	/* create a domain name to store rr. */
	ld = (struct local_data*)regional_alloc_zero(z->region,
	sizeof(*ld));
	if(!ld) {
	log_err("out of memory adding local data");
	return 0;
	}
	ld->node.key = ld;
	ld->name = regional_alloc_init(z->region, nm, nmlen);
	if(!ld->name) {
	log_err("out of memory");
	return 0;
	}
	ld->namelen = nmlen;
	ld->namelabs = nmlabs;
	if(!rbtree_insert(&z->data, &ld->node)) {
	log_assert(0); /* duplicate name */
	}
	/* see if empty nonterminals need to be created */
	if(nmlabs > z->namelabs) {
	dname_remove_label(&nm, &nmlen);
	if(!lz_find_create_node(z, nm, nmlen, nmlabs-1, res))
	return 0;
	}
	}
	*res = ld;
	return 1;
	}

	/** enter data RR into auth zone */
	static int
	lz_enter_rr_into_zone(struct local_zone* z, const char* rrstr)
	{
	uint8_t* nm;
	size_t nmlen;
	int nmlabs;
	struct local_data* node;
	struct local_rrset* rrset;
	struct packed_rrset_data* pd;
	uint16_t rrtype = 0, rrclass = 0;
	time_t ttl = 0;
	uint8_t rr[LDNS_RR_BUF_SIZE];
	uint8_t* rdata;
	size_t rdata_len;
	if(!rrstr_get_rr_content(rrstr, &nm, &rrtype, &rrclass, &ttl, rr,
	sizeof(rr), &rdata, &rdata_len)) {
	log_err("bad local-data: %s", rrstr);
	return 0;
	}
	log_assert(z->dclass == rrclass);
	- if(z->type == local_zone_redirect &&
	+ if((z->type == local_zone_redirect \|\|
	+ z->type == local_zone_inform_redirect) &&
	query_dname_compare(z->name, nm) != 0) {
	log_err("local-data in redirect zone must reside at top of zone"
	", not at %s", rrstr);
	free(nm);
	return 0;
	}
	nmlabs = dname_count_size_labels(nm, &nmlen);
	if(!lz_find_create_node(z, nm, nmlen, nmlabs, &node)) {
	free(nm);
	return 0;
	}
	log_assert(node);
	free(nm);

	/* Reject it if we would end up having CNAME and other data (including
	* another CNAME) for a redirect zone. */
	- if(z->type == local_zone_redirect && node->rrsets) {
	+ if((z->type == local_zone_redirect \|\|
	+ z->type == local_zone_inform_redirect) && node->rrsets) {
	const char* othertype = NULL;
	if (rrtype == LDNS_RR_TYPE_CNAME)
	othertype = "other";
	else if (node->rrsets->rrset->rk.type ==
	htons(LDNS_RR_TYPE_CNAME)) {
	othertype = "CNAME";
	}
	if(othertype) {
	log_err("local-data '%s' in redirect zone must not "
	"coexist with %s local-data", rrstr, othertype);
	return 0;
	}
	}
	rrset = local_data_find_type(node, rrtype, 0);
	if(!rrset) {
	rrset = new_local_rrset(z->region, node, rrtype, rrclass);
	if(!rrset)
	return 0;
	if(query_dname_compare(node->name, z->name) == 0) {
	if(rrtype == LDNS_RR_TYPE_NSEC)
	rrset->rrset->rk.flags = PACKED_RRSET_NSEC_AT_APEX;
	if(rrtype == LDNS_RR_TYPE_SOA)
	z->soa = rrset->rrset;
	}
	}
	pd = (struct packed_rrset_data*)rrset->rrset->entry.data;
	log_assert(rrset && pd);

	/* check for duplicate RR */
	if(rr_is_duplicate(pd, rdata, rdata_len)) {
	verbose(VERB_ALGO, "ignoring duplicate RR: %s", rrstr);
	return 1;
	}
	return rrset_insert_rr(z->region, pd, rdata, rdata_len, ttl, rrstr);
	}

	/** enter a data RR into auth data; a zone for it must exist */
	static int
	lz_enter_rr_str(struct local_zones* zones, const char* rr)
	{
	uint8_t* rr_name;
	uint16_t rr_class, rr_type;
	size_t len;
	int labs;
	struct local_zone* z;
	int r;
	if(!get_rr_nameclass(rr, &rr_name, &rr_class, &rr_type)) {
	log_err("bad rr %s", rr);
	return 0;
	}
	labs = dname_count_size_labels(rr_name, &len);
	lock_rw_rdlock(&zones->lock);
	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type);
	if(!z) {
	lock_rw_unlock(&zones->lock);
	fatal_exit("internal error: no zone for rr %s", rr);
	}
	lock_rw_wrlock(&z->lock);
	lock_rw_unlock(&zones->lock);
	free(rr_name);
	r = lz_enter_rr_into_zone(z, rr);
	lock_rw_unlock(&z->lock);
	return r;
	}

	/** enter tagstring into zone */
	static int
	lz_enter_zone_tag(struct local_zones* zones, char* zname, uint8_t* list,
	size_t len, uint16_t rr_class)
	{
	uint8_t dname[LDNS_MAX_DOMAINLEN+1];
	size_t dname_len = sizeof(dname);
	int dname_labs, r = 0;
	struct local_zone* z;

	if(sldns_str2wire_dname_buf(zname, dname, &dname_len) != 0) {
	log_err("cannot parse zone name in local-zone-tag: %s", zname);
	return 0;
	}
	dname_labs = dname_count_labels(dname);

	lock_rw_rdlock(&zones->lock);
	z = local_zones_find(zones, dname, dname_len, dname_labs, rr_class);
	if(!z) {
	lock_rw_unlock(&zones->lock);
	log_err("no local-zone for tag %s", zname);
	return 0;
	}
	lock_rw_wrlock(&z->lock);
	lock_rw_unlock(&zones->lock);
	free(z->taglist);
	z->taglist = memdup(list, len);
	z->taglen = len;
	if(z->taglist)
	r = 1;
	lock_rw_unlock(&z->lock);
	return r;
	}

	/** enter override into zone */
	static int
	lz_enter_override(struct local_zones* zones, char* zname, char* netblock,
	char* type, uint16_t rr_class)
	{
	uint8_t dname[LDNS_MAX_DOMAINLEN+1];
	size_t dname_len = sizeof(dname);
	int dname_labs;
	struct sockaddr_storage addr;
	int net;
	socklen_t addrlen;
	struct local_zone* z;
	enum localzone_type t;

	/* parse zone name */
	if(sldns_str2wire_dname_buf(zname, dname, &dname_len) != 0) {
	log_err("cannot parse zone name in local-zone-override: %s %s",
	zname, netblock);
	return 0;
	}
	dname_labs = dname_count_labels(dname);

	/* parse netblock */
	if(!netblockstrtoaddr(netblock, UNBOUND_DNS_PORT, &addr, &addrlen,
	&net)) {
	log_err("cannot parse netblock in local-zone-override: %s %s",
	zname, netblock);
	return 0;
	}

	/* parse zone type */
	if(!local_zone_str2type(type, &t)) {
	log_err("cannot parse type in local-zone-override: %s %s %s",
	zname, netblock, type);
	return 0;
	}

	/* find localzone entry */
	lock_rw_rdlock(&zones->lock);
	z = local_zones_find(zones, dname, dname_len, dname_labs, rr_class);
	if(!z) {
	lock_rw_unlock(&zones->lock);
	log_err("no local-zone for local-zone-override %s", zname);
	return 0;
	}
	lock_rw_wrlock(&z->lock);
	lock_rw_unlock(&zones->lock);

	/* create netblock addr_tree if not present yet */
	if(!z->override_tree) {
	z->override_tree = (struct rbtree_type*)regional_alloc_zero(
	z->region, sizeof(*z->override_tree));
	if(!z->override_tree) {
	lock_rw_unlock(&z->lock);
	log_err("out of memory");
	return 0;
	}
	addr_tree_init(z->override_tree);
	}
	/* add new elem to tree */
	if(z->override_tree) {
	struct local_zone_override* n;
	n = (struct local_zone_override*)regional_alloc_zero(
	z->region, sizeof(*n));
	if(!n) {
	lock_rw_unlock(&z->lock);
	log_err("out of memory");
	return 0;
	}
	n->type = t;
	if(!addr_tree_insert(z->override_tree,
	(struct addr_tree_node*)n, &addr, addrlen, net)) {
	lock_rw_unlock(&z->lock);
	log_err("duplicate local-zone-override %s %s",
	zname, netblock);
	return 1;
	}
	}

	lock_rw_unlock(&z->lock);
	return 1;
	}

	/** parse local-zone: statements */
	static int
	lz_enter_zones(struct local_zones* zones, struct config_file* cfg)
	{
	struct config_str2list* p;
	struct local_zone* z;
	for(p = cfg->local_zones; p; p = p->next) {
	if(!(z=lz_enter_zone(zones, p->str, p->str2,
	LDNS_RR_CLASS_IN)))
	return 0;
	lock_rw_unlock(&z->lock);
	}
	return 1;
	}

	/** lookup a zone in rbtree; exact match only; SLOW due to parse */
	static int
	lz_exists(struct local_zones* zones, const char* name)
	{
	struct local_zone z;
	z.node.key = &z;
	z.dclass = LDNS_RR_CLASS_IN;
	if(!parse_dname(name, &z.name, &z.namelen, &z.namelabs)) {
	log_err("bad name %s", name);
	return 0;
	}
	lock_rw_rdlock(&zones->lock);
	if(rbtree_search(&zones->ztree, &z.node)) {
	lock_rw_unlock(&zones->lock);
	free(z.name);
	return 1;
	}
	lock_rw_unlock(&zones->lock);
	free(z.name);
	return 0;
	}

	/** lookup a zone in cfg->nodefault list */
	static int
	lz_nodefault(struct config_file* cfg, const char* name)
	{
	struct config_strlist* p;
	size_t len = strlen(name);
	if(len == 0) return 0;
	if(name[len-1] == '.') len--;

	for(p = cfg->local_zones_nodefault; p; p = p->next) {
	/* compare zone name, lowercase, compare without ending . */
	if(strncasecmp(p->str, name, len) == 0 &&
	(strlen(p->str) == len \|\| (strlen(p->str)==len+1 &&
	p->str[len] == '.')))
	return 1;
	}
	return 0;
	}

	/** enter (AS112) empty default zone */
	static int
	add_empty_default(struct local_zones* zones, struct config_file* cfg,
	const char* name)
	{
	struct local_zone* z;
	char str[1024]; /* known long enough */
	if(lz_exists(zones, name) \|\| lz_nodefault(cfg, name))
	return 1; /* do not enter default content */
	if(!(z=lz_enter_zone(zones, name, "static", LDNS_RR_CLASS_IN)))
	return 0;
	snprintf(str, sizeof(str), "%s 10800 IN SOA localhost. "
	"nobody.invalid. 1 3600 1200 604800 10800", name);
	if(!lz_enter_rr_into_zone(z, str)) {
	lock_rw_unlock(&z->lock);
	return 0;
	}
	snprintf(str, sizeof(str), "%s 10800 IN NS localhost. ", name);
	if(!lz_enter_rr_into_zone(z, str)) {
	lock_rw_unlock(&z->lock);
	return 0;
	}
	lock_rw_unlock(&z->lock);
	return 1;
	}

	/** enter default zones */
	int local_zone_enter_defaults(struct local_zones* zones, struct config_file* cfg)
	{
	struct local_zone* z;
	const char** zstr;

	/* Do not add any default */
	if(cfg->local_zones_disable_default)
	return 1;

	/* this list of zones is from RFC 6303 and RFC 7686 */

	/* block localhost level zones first, then onion and later the LAN zones */

	/* localhost. zone */
	if(!lz_exists(zones, "localhost.") &&
	!lz_nodefault(cfg, "localhost.")) {
	if(!(z=lz_enter_zone(zones, "localhost.", "redirect",
	LDNS_RR_CLASS_IN)) \|\|
	!lz_enter_rr_into_zone(z,
	"localhost. 10800 IN NS localhost.") \|\|
	!lz_enter_rr_into_zone(z,
	"localhost. 10800 IN SOA localhost. nobody.invalid. "
	"1 3600 1200 604800 10800") \|\|
	!lz_enter_rr_into_zone(z,
	"localhost. 10800 IN A 127.0.0.1") \|\|
	!lz_enter_rr_into_zone(z,
	"localhost. 10800 IN AAAA ::1")) {
	log_err("out of memory adding default zone");
	if(z) { lock_rw_unlock(&z->lock); }
	return 0;
	}
	lock_rw_unlock(&z->lock);
	}
	/* reverse ip4 zone */
	if(!lz_exists(zones, "127.in-addr.arpa.") &&
	!lz_nodefault(cfg, "127.in-addr.arpa.")) {
	if(!(z=lz_enter_zone(zones, "127.in-addr.arpa.", "static",
	LDNS_RR_CLASS_IN)) \|\|
	!lz_enter_rr_into_zone(z,
	"127.in-addr.arpa. 10800 IN NS localhost.") \|\|
	!lz_enter_rr_into_zone(z,
	"127.in-addr.arpa. 10800 IN SOA localhost. "
	"nobody.invalid. 1 3600 1200 604800 10800") \|\|
	!lz_enter_rr_into_zone(z,
	"1.0.0.127.in-addr.arpa. 10800 IN PTR localhost.")) {
	log_err("out of memory adding default zone");
	if(z) { lock_rw_unlock(&z->lock); }
	return 0;
	}
	lock_rw_unlock(&z->lock);
	}
	/* reverse ip6 zone */
	if(!lz_exists(zones, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.") &&
	!lz_nodefault(cfg, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.")) {
	if(!(z=lz_enter_zone(zones, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.", "static",
	LDNS_RR_CLASS_IN)) \|\|
	!lz_enter_rr_into_zone(z,
	"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN NS localhost.") \|\|
	!lz_enter_rr_into_zone(z,
	"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN SOA localhost. "
	"nobody.invalid. 1 3600 1200 604800 10800") \|\|
	!lz_enter_rr_into_zone(z,
	"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN PTR localhost.")) {
	log_err("out of memory adding default zone");
	if(z) { lock_rw_unlock(&z->lock); }
	return 0;
	}
	lock_rw_unlock(&z->lock);
	}
	/* onion. zone (RFC 7686) */
	if(!add_empty_default(zones, cfg, "onion.")) {
	log_err("out of memory adding default zone");
	return 0;
	}
	/* test. zone (RFC 7686) */
	if(!add_empty_default(zones, cfg, "test.")) {
	log_err("out of memory adding default zone");
	return 0;
	}
	/* invalid. zone (RFC 7686) */
	if(!add_empty_default(zones, cfg, "invalid.")) {
	log_err("out of memory adding default zone");
	return 0;
	}
	/* block AS112 zones, unless asked not to */
	if(!cfg->unblock_lan_zones) {
	for(zstr = as112_zones; *zstr; zstr++) {
	if(!add_empty_default(zones, cfg, *zstr)) {
	log_err("out of memory adding default zone");
	return 0;
	}
	}
	}
	return 1;
	}

	/** parse local-zone-override: statements */
	static int
	lz_enter_overrides(struct local_zones* zones, struct config_file* cfg)
	{
	struct config_str3list* p;
	for(p = cfg->local_zone_overrides; p; p = p->next) {
	if(!lz_enter_override(zones, p->str, p->str2, p->str3,
	LDNS_RR_CLASS_IN))
	return 0;
	}
	return 1;
	}

	/** setup parent pointers, so that a lookup can be done for closest match */
	static void
	init_parents(struct local_zones* zones)
	{
	struct local_zone* node, prev = NULL, p;
	int m;
	lock_rw_wrlock(&zones->lock);
	RBTREE_FOR(node, struct local_zone*, &zones->ztree) {
	lock_rw_wrlock(&node->lock);
	node->parent = NULL;
	if(!prev \|\| prev->dclass != node->dclass) {
	prev = node;
	lock_rw_unlock(&node->lock);
	continue;
	}
	(void)dname_lab_cmp(prev->name, prev->namelabs, node->name,
	node->namelabs, &m); /* we know prev is smaller */
	/* sort order like: . com. bla.com. zwb.com. net. */
	/* find the previous, or parent-parent-parent */
	for(p = prev; p; p = p->parent)
	/* looking for name with few labels, a parent */
	if(p->namelabs <= m) {
	/* ==: since prev matched m, this is closest*/
	/* <: prev matches more, but is not a parent,
	* this one is a (grand)parent */
	node->parent = p;
	break;
	}
	prev = node;

	if(node->override_tree)
	addr_tree_init_parents(node->override_tree);
	lock_rw_unlock(&node->lock);
	}
	lock_rw_unlock(&zones->lock);
	}

	/** enter implicit transparent zone for local-data: without local-zone: */
	static int
	lz_setup_implicit(struct local_zones* zones, struct config_file* cfg)
	{
	/* walk over all items that have no parent zone and find
	* the name that covers them all (could be the root) and
	* add that as a transparent zone */
	struct config_strlist* p;
	int have_name = 0;
	int have_other_classes = 0;
	uint16_t dclass = 0;
	uint8_t* nm = 0;
	size_t nmlen = 0;
	int nmlabs = 0;
	int match = 0; /* number of labels match count */

	init_parents(zones); /* to enable local_zones_lookup() */
	for(p = cfg->local_data; p; p = p->next) {
	uint8_t* rr_name;
	uint16_t rr_class, rr_type;
	size_t len;
	int labs;
	if(!get_rr_nameclass(p->str, &rr_name, &rr_class, &rr_type)) {
	log_err("Bad local-data RR %s", p->str);
	return 0;
	}
	labs = dname_count_size_labels(rr_name, &len);
	lock_rw_rdlock(&zones->lock);
	if(!local_zones_lookup(zones, rr_name, len, labs, rr_class,
	rr_type)) {
	if(!have_name) {
	dclass = rr_class;
	nm = rr_name;
	nmlen = len;
	nmlabs = labs;
	match = labs;
	have_name = 1;
	} else {
	int m;
	if(rr_class != dclass) {
	/* process other classes later */
	free(rr_name);
	have_other_classes = 1;
	lock_rw_unlock(&zones->lock);
	continue;
	}
	/* find smallest shared topdomain */
	(void)dname_lab_cmp(nm, nmlabs,
	rr_name, labs, &m);
	free(rr_name);
	if(m < match)
	match = m;
	}
	} else free(rr_name);
	lock_rw_unlock(&zones->lock);
	}
	if(have_name) {
	uint8_t* n2;
	struct local_zone* z;
	/* allocate zone of smallest shared topdomain to contain em */
	n2 = nm;
	dname_remove_labels(&n2, &nmlen, nmlabs - match);
	n2 = memdup(n2, nmlen);
	free(nm);
	if(!n2) {
	log_err("out of memory");
	return 0;
	}
	log_nametypeclass(VERB_ALGO, "implicit transparent local-zone",
	n2, 0, dclass);
	if(!(z=lz_enter_zone_dname(zones, n2, nmlen, match,
	local_zone_transparent, dclass))) {
	return 0;
	}
	lock_rw_unlock(&z->lock);
	}
	if(have_other_classes) {
	/* restart to setup other class */
	return lz_setup_implicit(zones, cfg);
	}
	return 1;
	}

	/** enter local-zone-tag info */
	static int
	lz_enter_zone_tags(struct local_zones* zones, struct config_file* cfg)
	{
	struct config_strbytelist* p;
	int c = 0;
	for(p = cfg->local_zone_tags; p; p = p->next) {
	if(!lz_enter_zone_tag(zones, p->str, p->str2, p->str2len,
	LDNS_RR_CLASS_IN))
	return 0;
	c++;
	}
	if(c) verbose(VERB_ALGO, "applied tags to %d local zones", c);
	return 1;
	}

	/** enter auth data */
	static int
	lz_enter_data(struct local_zones* zones, struct config_file* cfg)
	{
	struct config_strlist* p;
	for(p = cfg->local_data; p; p = p->next) {
	if(!lz_enter_rr_str(zones, p->str))
	return 0;
	}
	return 1;
	}

	/** free memory from config */
	static void
	lz_freeup_cfg(struct config_file* cfg)
	{
	config_deldblstrlist(cfg->local_zones);
	cfg->local_zones = NULL;
	config_delstrlist(cfg->local_zones_nodefault);
	cfg->local_zones_nodefault = NULL;
	config_delstrlist(cfg->local_data);
	cfg->local_data = NULL;
	}

	int
	local_zones_apply_cfg(struct local_zones* zones, struct config_file* cfg)
	{
	/* create zones from zone statements. */
	if(!lz_enter_zones(zones, cfg)) {
	return 0;
	}
	/* apply default zones+content (unless disabled, or overridden) */
	if(!local_zone_enter_defaults(zones, cfg)) {
	return 0;
	}
	/* enter local zone overrides */
	if(!lz_enter_overrides(zones, cfg)) {
	return 0;
	}
	/* create implicit transparent zone from data. */
	if(!lz_setup_implicit(zones, cfg)) {
	return 0;
	}

	/* setup parent ptrs for lookup during data entry */
	init_parents(zones);
	/* insert local zone tags */
	if(!lz_enter_zone_tags(zones, cfg)) {
	return 0;
	}
	/* insert local data */
	if(!lz_enter_data(zones, cfg)) {
	return 0;
	}
	/* freeup memory from cfg struct. */
	lz_freeup_cfg(cfg);
	return 1;
	}

	struct local_zone*
	local_zones_lookup(struct local_zones* zones,
	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype)
	{
	return local_zones_tags_lookup(zones, name, len, labs,
	dclass, dtype, NULL, 0, 1);
	}

	struct local_zone*
	local_zones_tags_lookup(struct local_zones* zones,
	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
	uint8_t* taglist, size_t taglen, int ignoretags)
	{
	rbnode_type* res = NULL;
	struct local_zone *result;
	struct local_zone key;
	int m;
	/* for type DS use a zone higher when on a zonecut */
	if(dtype == LDNS_RR_TYPE_DS && !dname_is_root(name)) {
	dname_remove_label(&name, &len);
	labs--;
	}
	key.node.key = &key;
	key.dclass = dclass;
	key.name = name;
	key.namelen = len;
	key.namelabs = labs;
	rbtree_find_less_equal(&zones->ztree, &key, &res);
	result = (struct local_zone*)res;
	/* exact or smaller element (or no element) */
	if(!result \|\| result->dclass != dclass)
	return NULL;
	/* count number of labels matched */
	(void)dname_lab_cmp(result->name, result->namelabs, key.name,
	key.namelabs, &m);
	while(result) { /* go up until qname is zone or subdomain of zone */
	if(result->namelabs <= m)
	if(ignoretags \|\| !result->taglist \|\|
	taglist_intersect(result->taglist,
	result->taglen, taglist, taglen))
	break;
	result = result->parent;
	}
	return result;
	}

	struct local_zone*
	local_zones_find(struct local_zones* zones,
	uint8_t* name, size_t len, int labs, uint16_t dclass)
	{
	struct local_zone key;
	key.node.key = &key;
	key.dclass = dclass;
	key.name = name;
	key.namelen = len;
	key.namelabs = labs;
	/* exact */
	return (struct local_zone*)rbtree_search(&zones->ztree, &key);
	}

	/** print all RRsets in local zone */
	static void
	local_zone_out(struct local_zone* z)
	{
	struct local_data* d;
	struct local_rrset* p;
	RBTREE_FOR(d, struct local_data*, &z->data) {
	for(p = d->rrsets; p; p = p->next) {
	log_nametypeclass(0, "rrset", d->name,
	ntohs(p->rrset->rk.type),
	ntohs(p->rrset->rk.rrset_class));
	}
	}
	}

	void local_zones_print(struct local_zones* zones)
	{
	struct local_zone* z;
	lock_rw_rdlock(&zones->lock);
	log_info("number of auth zones %u", (unsigned)zones->ztree.count);
	RBTREE_FOR(z, struct local_zone*, &zones->ztree) {
	char buf[64];
	lock_rw_rdlock(&z->lock);
	snprintf(buf, sizeof(buf), "%s zone",
	local_zone_type2str(z->type));
	log_nametypeclass(0, buf, z->name, 0, z->dclass);
	local_zone_out(z);
	lock_rw_unlock(&z->lock);
	}
	lock_rw_unlock(&zones->lock);
	}

	/** encode answer consisting of 1 rrset */
	static int
	local_encode(struct query_info* qinfo, struct module_env* env,
	struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf,
	struct regional* temp, struct ub_packed_rrset_key* rrset, int ansec,
	int rcode)
	{
	struct reply_info rep;
	uint16_t udpsize;
	/* make answer with time=0 for fixed TTL values */
	memset(&rep, 0, sizeof(rep));
	rep.flags = (uint16_t)((BIT_QR \| BIT_AA \| BIT_RA) \| rcode);
	rep.qdcount = 1;
	if(ansec)
	rep.an_numrrsets = 1;
	else rep.ns_numrrsets = 1;
	rep.rrset_count = 1;
	rep.rrsets = &rrset;
	udpsize = edns->udp_size;
	edns->edns_version = EDNS_ADVERTISED_VERSION;
	edns->udp_size = EDNS_ADVERTISED_SIZE;
	edns->ext_rcode = 0;
	edns->bits &= EDNS_DO;
	if(!inplace_cb_reply_local_call(env, qinfo, NULL, &rep, rcode, edns,
	repinfo, temp) \|\| !reply_info_answer_encode(qinfo, &rep,
	(uint16_t)sldns_buffer_begin(buf), sldns_buffer_read_u16_at(buf, 2),
	buf, 0, 0, temp, udpsize, edns, (int)(edns->bits&EDNS_DO), 0)) {
	error_encode(buf, (LDNS_RCODE_SERVFAIL\|BIT_AA), qinfo,
	(uint16_t)sldns_buffer_begin(buf),
	sldns_buffer_read_u16_at(buf, 2), edns);
	}
	return 1;
	}

	/** encode local error answer */
	static void
	local_error_encode(struct query_info* qinfo, struct module_env* env,
	struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf,
	struct regional* temp, int rcode, int r)
	{
	edns->edns_version = EDNS_ADVERTISED_VERSION;
	edns->udp_size = EDNS_ADVERTISED_SIZE;
	edns->ext_rcode = 0;
	edns->bits &= EDNS_DO;

	if(!inplace_cb_reply_local_call(env, qinfo, NULL, NULL,
	rcode, edns, repinfo, temp))
	edns->opt_list = NULL;
	error_encode(buf, r, qinfo, (uint16_t)sldns_buffer_begin(buf),
	sldns_buffer_read_u16_at(buf, 2), edns);
	}

	/** find local data tag string match for the given type in the list */
	int
	local_data_find_tag_datas(const struct query_info* qinfo,
	struct config_strlist* list, struct ub_packed_rrset_key* r,
	struct regional* temp)
	{
	struct config_strlist* p;
	char buf[65536];
	uint8_t rr[LDNS_RR_BUF_SIZE];
	size_t len;
	int res;
	struct packed_rrset_data* d;
	for(p=list; p; p=p->next) {
	uint16_t rdr_type;

	len = sizeof(rr);
	/* does this element match the type? */
	snprintf(buf, sizeof(buf), ". %s", p->str);
	res = sldns_str2wire_rr_buf(buf, rr, &len, NULL, 3600,
	NULL, 0, NULL, 0);
	if(res != 0)
	/* parse errors are already checked before, in
	* acllist check_data, skip this for robustness */
	continue;
	if(len < 1 /* . / + 8 / typeclassttl/ + 2 /rdatalen*/)
	continue;
	rdr_type = sldns_wirerr_get_type(rr, len, 1);
	if(rdr_type != qinfo->qtype && rdr_type != LDNS_RR_TYPE_CNAME)
	continue;

	/* do we have entries already? if not setup key */
	if(r->rk.dname == NULL) {
	r->entry.key = r;
	r->rk.dname = qinfo->qname;
	r->rk.dname_len = qinfo->qname_len;
	r->rk.type = htons(rdr_type);
	r->rk.rrset_class = htons(qinfo->qclass);
	r->rk.flags = 0;
	d = (struct packed_rrset_data*)regional_alloc_zero(
	temp, sizeof(struct packed_rrset_data)
	+ sizeof(size_t) + sizeof(uint8_t*) +
	sizeof(time_t));
	if(!d) return 0; /* out of memory */
	r->entry.data = d;
	d->ttl = sldns_wirerr_get_ttl(rr, len, 1);
	d->rr_len = (size_t)((uint8_t)d +
	sizeof(struct packed_rrset_data));
	d->rr_data = (uint8_t**)&(d->rr_len[1]);
	d->rr_ttl = (time_t*)&(d->rr_data[1]);
	}
	d = (struct packed_rrset_data*)r->entry.data;
	/* add entry to the data */
	if(d->count != 0) {
	size_t* oldlen = d->rr_len;
	uint8_t** olddata = d->rr_data;
	time_t* oldttl = d->rr_ttl;
	/* increase arrays for lookup */
	/* this is of course slow for very many records,
	* but most redirects are expected with few records */
	d->rr_len = (size_t*)regional_alloc_zero(temp,
	(d->count+1)*sizeof(size_t));
	d->rr_data = (uint8_t**)regional_alloc_zero(temp,
	(d->count+1)sizeof(uint8_t));
	d->rr_ttl = (time_t*)regional_alloc_zero(temp,
	(d->count+1)*sizeof(time_t));
	if(!d->rr_len \|\| !d->rr_data \|\| !d->rr_ttl)
	return 0; /* out of memory */
	/* first one was allocated after struct d, but new
	* ones get their own array increment alloc, so
	* copy old content */
	memmove(d->rr_len, oldlen, d->count*sizeof(size_t));
	memmove(d->rr_data, olddata, d->countsizeof(uint8_t));
	memmove(d->rr_ttl, oldttl, d->count*sizeof(time_t));
	}

	d->rr_len[d->count] = sldns_wirerr_get_rdatalen(rr, len, 1)+2;
	d->rr_ttl[d->count] = sldns_wirerr_get_ttl(rr, len, 1);
	d->rr_data[d->count] = regional_alloc_init(temp,
	sldns_wirerr_get_rdatawl(rr, len, 1),
	d->rr_len[d->count]);
	if(!d->rr_data[d->count])
	return 0; /* out of memory */
	d->count++;
	}
	if(r->rk.dname)
	return 1;
	return 0;
	}

	static int
	find_tag_datas(struct query_info* qinfo, struct config_strlist* list,
	struct ub_packed_rrset_key* r, struct regional* temp)
	{
	int result = local_data_find_tag_datas(qinfo, list, r, temp);

	/* If we've found a non-exact alias type of local data, make a shallow
	* copy of the RRset and remember it in qinfo to complete the alias
	* chain later. */
	if(result && qinfo->qtype != LDNS_RR_TYPE_CNAME &&
	r->rk.type == htons(LDNS_RR_TYPE_CNAME)) {
	qinfo->local_alias =
	regional_alloc_zero(temp, sizeof(struct local_rrset));
	if(!qinfo->local_alias)
	return 0; /* out of memory */
	qinfo->local_alias->rrset =
	regional_alloc_init(temp, r, sizeof(*r));
	if(!qinfo->local_alias->rrset)
	return 0; /* out of memory */
	}
	return result;
	}

	/** answer local data match */
	static int
	local_data_answer(struct local_zone* z, struct module_env* env,
	struct query_info* qinfo, struct edns_data* edns,
	struct comm_reply* repinfo, sldns_buffer* buf,
	struct regional* temp, int labs, struct local_data** ldp,
	enum localzone_type lz_type, int tag, struct config_strlist** tag_datas,
	size_t tag_datas_size, char** tagname, int num_tags)
	{
	struct local_data key;
	struct local_data* ld;
	struct local_rrset* lr;
	key.node.key = &key;
	key.name = qinfo->qname;
	key.namelen = qinfo->qname_len;
	key.namelabs = labs;
	- if(lz_type == local_zone_redirect) {
	+ if(lz_type == local_zone_redirect \|\|
	+ lz_type == local_zone_inform_redirect) {
	key.name = z->name;
	key.namelen = z->namelen;
	key.namelabs = z->namelabs;
	if(tag != -1 && (size_t)tag<tag_datas_size && tag_datas[tag]) {
	struct ub_packed_rrset_key r;
	memset(&r, 0, sizeof(r));
	if(find_tag_datas(qinfo, tag_datas[tag], &r, temp)) {
	verbose(VERB_ALGO, "redirect with tag data [%d] %s",
	tag, (tag<num_tags?tagname[tag]:"null"));

	/* If we found a matching alias, we should
	* use it as part of the answer, but we can't
	* encode it until we complete the alias
	* chain. */
	if(qinfo->local_alias)
	return 1;
	return local_encode(qinfo, env, edns, repinfo, buf, temp,
	&r, 1, LDNS_RCODE_NOERROR);
	}
	}
	}
	ld = (struct local_data*)rbtree_search(&z->data, &key.node);
	*ldp = ld;
	if(!ld) {
	return 0;
	}
	lr = local_data_find_type(ld, qinfo->qtype, 1);
	if(!lr)
	return 0;

	/* Special case for alias matching. See local_data_answer(). */
	- if(lz_type == local_zone_redirect &&
	+ if((lz_type == local_zone_redirect \|\|
	+ lz_type == local_zone_inform_redirect) &&
	qinfo->qtype != LDNS_RR_TYPE_CNAME &&
	lr->rrset->rk.type == htons(LDNS_RR_TYPE_CNAME)) {
	qinfo->local_alias =
	regional_alloc_zero(temp, sizeof(struct local_rrset));
	if(!qinfo->local_alias)
	return 0; /* out of memory */
	qinfo->local_alias->rrset =
	regional_alloc_init(temp, lr->rrset, sizeof(*lr->rrset));
	if(!qinfo->local_alias->rrset)
	return 0; /* out of memory */
	qinfo->local_alias->rrset->rk.dname = qinfo->qname;
	qinfo->local_alias->rrset->rk.dname_len = qinfo->qname_len;
	return 1;
	}
	- if(lz_type == local_zone_redirect) {
	+ if(lz_type == local_zone_redirect \|\|
	+ lz_type == local_zone_inform_redirect) {
	/* convert rrset name to query name; like a wildcard */
	struct ub_packed_rrset_key r = *lr->rrset;
	r.rk.dname = qinfo->qname;
	r.rk.dname_len = qinfo->qname_len;
	return local_encode(qinfo, env, edns, repinfo, buf, temp, &r, 1,
	LDNS_RCODE_NOERROR);
	}
	return local_encode(qinfo, env, edns, repinfo, buf, temp, lr->rrset, 1,
	LDNS_RCODE_NOERROR);
	}

	/**
	* See if the local zone does not cover the name, eg. the name is not
	* in the zone and the zone is transparent */
	static int
	local_zone_does_not_cover(struct local_zone* z, struct query_info* qinfo,
	int labs)
	{
	struct local_data key;
	struct local_data* ld = NULL;
	struct local_rrset* lr = NULL;
	if(z->type == local_zone_always_transparent)
	return 1;
	if(z->type != local_zone_transparent
	&& z->type != local_zone_typetransparent
	&& z->type != local_zone_inform)
	return 0;
	key.node.key = &key;
	key.name = qinfo->qname;
	key.namelen = qinfo->qname_len;
	key.namelabs = labs;
	ld = (struct local_data*)rbtree_search(&z->data, &key.node);
	if(z->type == local_zone_transparent \|\| z->type == local_zone_inform)
	return (ld == NULL);
	if(ld)
	lr = local_data_find_type(ld, qinfo->qtype, 1);
	/* local_zone_typetransparent */
	return (lr == NULL);
	}

	/**
	* Answer in case where no exact match is found.
	* @param z: zone for query.
	* @param env: module environment.
	* @param qinfo: query.
	* @param edns: edns from query.
	* @param repinfo: source address for checks. may be NULL.
	* @param buf: buffer for answer.
	* @param temp: temp region for encoding.
	* @param ld: local data, if NULL, no such name exists in localdata.
	* @param lz_type: type of the local zone.
	* @return 1 if a reply is to be sent, 0 if not.
	*/
	static int
	lz_zone_answer(struct local_zone* z, struct module_env* env,
	struct query_info* qinfo, struct edns_data* edns,
	struct comm_reply* repinfo, sldns_buffer* buf, struct regional* temp,
	struct local_data* ld, enum localzone_type lz_type)
	{
	if(lz_type == local_zone_deny \|\| lz_type == local_zone_inform_deny) {
	/** no reply at all, signal caller by clearing buffer. */
	sldns_buffer_clear(buf);
	sldns_buffer_flip(buf);
	return 1;
	} else if(lz_type == local_zone_refuse
	\|\| lz_type == local_zone_always_refuse) {
	local_error_encode(qinfo, env, edns, repinfo, buf, temp,
	LDNS_RCODE_REFUSED, (LDNS_RCODE_REFUSED\|BIT_AA));
	return 1;
	} else if(lz_type == local_zone_static \|\|
	lz_type == local_zone_redirect \|\|
	+ lz_type == local_zone_inform_redirect \|\|
	lz_type == local_zone_always_nxdomain) {
	/* for static, reply nodata or nxdomain
	* for redirect, reply nodata */
	/* no additional section processing,
	* cname, dname or wildcard processing,
	* or using closest match for NSEC.
	* or using closest match for returning delegation downwards
	*/
	- int rcode = (ld \|\| lz_type == local_zone_redirect)?
	+ int rcode = (ld \|\| lz_type == local_zone_redirect \|\|
	+ lz_type == local_zone_inform_redirect)?
	LDNS_RCODE_NOERROR:LDNS_RCODE_NXDOMAIN;
	if(z->soa)
	return local_encode(qinfo, env, edns, repinfo, buf, temp,
	z->soa, 0, rcode);
	local_error_encode(qinfo, env, edns, repinfo, buf, temp, rcode,
	(rcode\|BIT_AA));
	return 1;
	} else if(lz_type == local_zone_typetransparent
	\|\| lz_type == local_zone_always_transparent) {
	/* no NODATA or NXDOMAINS for this zone type */
	return 0;
	}
	/* else lz_type == local_zone_transparent */

	/* if the zone is transparent and the name exists, but the type
	* does not, then we should make this noerror/nodata */
	if(ld && ld->rrsets) {
	int rcode = LDNS_RCODE_NOERROR;
	if(z->soa)
	return local_encode(qinfo, env, edns, repinfo, buf, temp,
	z->soa, 0, rcode);
	local_error_encode(qinfo, env, edns, repinfo, buf, temp, rcode,
	(rcode\|BIT_AA));
	return 1;
	}

	/* stop here, and resolve further on */
	return 0;
	}

	/** print log information for an inform zone query */
	static void
	lz_inform_print(struct local_zone* z, struct query_info* qinfo,
	struct comm_reply* repinfo)
	{
	char ip[128], txt[512];
	char zname[LDNS_MAX_DOMAINLEN+1];
	uint16_t port = ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port);
	dname_str(z->name, zname);
	addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip));
	snprintf(txt, sizeof(txt), "%s %s %s@%u", zname, local_zone_type2str(z->type), ip,
	(unsigned)port);
	log_nametypeclass(0, txt, qinfo->qname, qinfo->qtype, qinfo->qclass);
	}

	static enum localzone_type
	lz_type(uint8_t taglist, size_t taglen, uint8_t taglist2, size_t taglen2,
	uint8_t *tagactions, size_t tagactionssize, enum localzone_type lzt,
	struct comm_reply* repinfo, struct rbtree_type* override_tree,
	int* tag, char** tagname, int num_tags)
	{
	struct local_zone_override* lzo;
	if(repinfo && override_tree) {
	lzo = (struct local_zone_override*)addr_tree_lookup(
	override_tree, &repinfo->addr, repinfo->addrlen);
	if(lzo && lzo->type) {
	verbose(VERB_ALGO, "local zone override to type %s",
	local_zone_type2str(lzo->type));
	return lzo->type;
	}
	}
	if(!taglist \|\| !taglist2)
	return lzt;
	return local_data_find_tag_action(taglist, taglen, taglist2, taglen2,
	tagactions, tagactionssize, lzt, tag, tagname, num_tags);
	}

	enum localzone_type
	local_data_find_tag_action(const uint8_t* taglist, size_t taglen,
	const uint8_t* taglist2, size_t taglen2, const uint8_t* tagactions,
	size_t tagactionssize, enum localzone_type lzt, int* tag,
	char* const* tagname, int num_tags)
	{
	size_t i, j;
	uint8_t tagmatch;

	for(i=0; i<taglen && i<taglen2; i++) {
	tagmatch = (taglist[i] & taglist2[i]);
	for(j=0; j<8 && tagmatch>0; j++) {
	if((tagmatch & 0x1)) {
	tag = (int)(i8+j);
	verbose(VERB_ALGO, "matched tag [%d] %s",
	tag, (tag<num_tags?tagname[*tag]:"null"));
	/* does this tag have a tag action? */
	if(i*8+j < tagactionssize && tagactions
	&& tagactions[i*8+j] != 0) {
	verbose(VERB_ALGO, "tag action [%d] %s to type %s",
	tag, (tag<num_tags?tagname[*tag]:"null"),
	local_zone_type2str(
	(enum localzone_type)
	tagactions[i*8+j]));
	return (enum localzone_type)tagactions[i*8+j];
	}
	return lzt;
	}
	tagmatch >>= 1;
	}
	}
	return lzt;
	}

	int
	local_zones_answer(struct local_zones* zones, struct module_env* env,
	struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf,
	struct regional* temp, struct comm_reply* repinfo, uint8_t* taglist,
	size_t taglen, uint8_t* tagactions, size_t tagactionssize,
	struct config_strlist** tag_datas, size_t tag_datas_size,
	char** tagname, int num_tags, struct view* view)
	{
	/* see if query is covered by a zone,
	* if so: - try to match (exact) local data
	* - look at zone type for negative response. */
	int labs = dname_count_labels(qinfo->qname);
	struct local_data* ld = NULL;
	struct local_zone* z = NULL;
	enum localzone_type lzt = local_zone_transparent;
	int r, tag = -1;

	if(view) {
	lock_rw_rdlock(&view->lock);
	if(view->local_zones &&
	(z = local_zones_lookup(view->local_zones,
	qinfo->qname, qinfo->qname_len, labs,
	qinfo->qclass, qinfo->qtype))) {
	lock_rw_rdlock(&z->lock);
	lzt = z->type;
	}
	if(lzt == local_zone_noview) {
	lock_rw_unlock(&z->lock);
	z = NULL;
	}
	if(z && (lzt == local_zone_transparent \|\|
	lzt == local_zone_typetransparent \|\|
	lzt == local_zone_inform \|\|
	lzt == local_zone_always_transparent) &&
	local_zone_does_not_cover(z, qinfo, labs)) {
	lock_rw_unlock(&z->lock);
	z = NULL;
	}
	if(view->local_zones && !z && !view->isfirst){
	lock_rw_unlock(&view->lock);
	return 0;
	}
	if(z && verbosity >= VERB_ALGO) {
	char zname[255+1];
	dname_str(z->name, zname);
	verbose(VERB_ALGO, "using localzone %s %s from view %s",
	zname, local_zone_type2str(lzt), view->name);
	}
	lock_rw_unlock(&view->lock);
	}
	if(!z) {
	/* try global local_zones tree */
	lock_rw_rdlock(&zones->lock);
	if(!(z = local_zones_tags_lookup(zones, qinfo->qname,
	qinfo->qname_len, labs, qinfo->qclass, qinfo->qtype,
	taglist, taglen, 0))) {
	lock_rw_unlock(&zones->lock);
	return 0;
	}
	lock_rw_rdlock(&z->lock);
	lzt = lz_type(taglist, taglen, z->taglist, z->taglen,
	tagactions, tagactionssize, z->type, repinfo,
	z->override_tree, &tag, tagname, num_tags);
	lock_rw_unlock(&zones->lock);
	if(z && verbosity >= VERB_ALGO) {
	char zname[255+1];
	dname_str(z->name, zname);
	verbose(VERB_ALGO, "using localzone %s %s", zname,
	local_zone_type2str(lzt));
	}
	}
	if((env->cfg->log_local_actions \|\|
	- lzt == local_zone_inform \|\| lzt == local_zone_inform_deny)
	+ lzt == local_zone_inform \|\|
	+ lzt == local_zone_inform_deny \|\|
	+ lzt == local_zone_inform_redirect)
	&& repinfo)
	lz_inform_print(z, qinfo, repinfo);

	if(lzt != local_zone_always_refuse
	&& lzt != local_zone_always_transparent
	&& lzt != local_zone_always_nxdomain
	&& local_data_answer(z, env, qinfo, edns, repinfo, buf, temp, labs,
	&ld, lzt, tag, tag_datas, tag_datas_size, tagname, num_tags)) {
	lock_rw_unlock(&z->lock);
	/* We should tell the caller that encode is deferred if we found
	* a local alias. */
	return !qinfo->local_alias;
	}
	r = lz_zone_answer(z, env, qinfo, edns, repinfo, buf, temp, ld, lzt);
	lock_rw_unlock(&z->lock);
	return r && !qinfo->local_alias; /* see above */
	}

	const char* local_zone_type2str(enum localzone_type t)
	{
	switch(t) {
	case local_zone_unset: return "unset";
	case local_zone_deny: return "deny";
	case local_zone_refuse: return "refuse";
	case local_zone_redirect: return "redirect";
	case local_zone_transparent: return "transparent";
	case local_zone_typetransparent: return "typetransparent";
	case local_zone_static: return "static";
	case local_zone_nodefault: return "nodefault";
	case local_zone_inform: return "inform";
	case local_zone_inform_deny: return "inform_deny";
	+ case local_zone_inform_redirect: return "inform_redirect";
	case local_zone_always_transparent: return "always_transparent";
	case local_zone_always_refuse: return "always_refuse";
	case local_zone_always_nxdomain: return "always_nxdomain";
	case local_zone_noview: return "noview";
	}
	return "badtyped";
	}

	int local_zone_str2type(const char* type, enum localzone_type* t)
	{
	if(strcmp(type, "deny") == 0)
	*t = local_zone_deny;
	else if(strcmp(type, "refuse") == 0)
	*t = local_zone_refuse;
	else if(strcmp(type, "static") == 0)
	*t = local_zone_static;
	else if(strcmp(type, "transparent") == 0)
	*t = local_zone_transparent;
	else if(strcmp(type, "typetransparent") == 0)
	*t = local_zone_typetransparent;
	else if(strcmp(type, "redirect") == 0)
	*t = local_zone_redirect;
	else if(strcmp(type, "inform") == 0)
	*t = local_zone_inform;
	else if(strcmp(type, "inform_deny") == 0)
	*t = local_zone_inform_deny;
	+ else if(strcmp(type, "inform_redirect") == 0)
	+ *t = local_zone_inform_redirect;
	else if(strcmp(type, "always_transparent") == 0)
	*t = local_zone_always_transparent;
	else if(strcmp(type, "always_refuse") == 0)
	*t = local_zone_always_refuse;
	else if(strcmp(type, "always_nxdomain") == 0)
	*t = local_zone_always_nxdomain;
	else if(strcmp(type, "noview") == 0)
	*t = local_zone_noview;
	else if(strcmp(type, "nodefault") == 0)
	*t = local_zone_nodefault;
	else return 0;
	return 1;
	}

	/** iterate over the kiddies of the given name and set their parent ptr */
	static void
	set_kiddo_parents(struct local_zone* z, struct local_zone* match,
	struct local_zone* newp)
	{
	/* both zones and z are locked already */
	/* in the sorted rbtree, the kiddies of z are located after z */
	/* z must be present in the tree */
	struct local_zone* p = z;
	p = (struct local_zone*)rbtree_next(&p->node);
	while(p!=(struct local_zone*)RBTREE_NULL &&
	p->dclass == z->dclass && dname_strict_subdomain(p->name,
	p->namelabs, z->name, z->namelabs)) {
	/* update parent ptr */
	/* only when matches with existing parent pointer, so that
	* deeper child structures are not touched, i.e.
	* update of x, and a.x, b.x, f.b.x, g.b.x, c.x, y
	* gets to update a.x, b.x and c.x */
	lock_rw_wrlock(&p->lock);
	if(p->parent == match)
	p->parent = newp;
	lock_rw_unlock(&p->lock);
	p = (struct local_zone*)rbtree_next(&p->node);
	}
	}

	struct local_zone* local_zones_add_zone(struct local_zones* zones,
	uint8_t* name, size_t len, int labs, uint16_t dclass,
	enum localzone_type tp)
	{
	/* create */
	struct local_zone* z = local_zone_create(name, len, labs, tp, dclass);
	if(!z) {
	free(name);
	return NULL;
	}
	lock_rw_wrlock(&z->lock);

	/* find the closest parent */
	z->parent = local_zones_find(zones, name, len, labs, dclass);

	/* insert into the tree */
	if(!rbtree_insert(&zones->ztree, &z->node)) {
	/* duplicate entry! */
	lock_rw_unlock(&z->lock);
	local_zone_delete(z);
	log_err("internal: duplicate entry in local_zones_add_zone");
	return NULL;
	}

	/* set parent pointers right */
	set_kiddo_parents(z, z->parent, z);

	lock_rw_unlock(&z->lock);
	return z;
	}

	void local_zones_del_zone(struct local_zones* zones, struct local_zone* z)
	{
	/* fix up parents in tree */
	lock_rw_wrlock(&z->lock);
	set_kiddo_parents(z, z, z->parent);

	/* remove from tree */
	(void)rbtree_delete(&zones->ztree, z);

	/* delete the zone */
	lock_rw_unlock(&z->lock);
	local_zone_delete(z);
	}

	int
	local_zones_add_RR(struct local_zones* zones, const char* rr)
	{
	uint8_t* rr_name;
	uint16_t rr_class, rr_type;
	size_t len;
	int labs;
	struct local_zone* z;
	int r;
	if(!get_rr_nameclass(rr, &rr_name, &rr_class, &rr_type)) {
	return 0;
	}
	labs = dname_count_size_labels(rr_name, &len);
	/* could first try readlock then get writelock if zone does not exist,
	* but we do not add enough RRs (from multiple threads) to optimize */
	lock_rw_wrlock(&zones->lock);
	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type);
	if(!z) {
	z = local_zones_add_zone(zones, rr_name, len, labs, rr_class,
	local_zone_transparent);
	if(!z) {
	lock_rw_unlock(&zones->lock);
	return 0;
	}
	} else {
	free(rr_name);
	}
	lock_rw_wrlock(&z->lock);
	lock_rw_unlock(&zones->lock);
	r = lz_enter_rr_into_zone(z, rr);
	lock_rw_unlock(&z->lock);
	return r;
	}

	/** returns true if the node is terminal so no deeper domain names exist */
	static int
	is_terminal(struct local_data* d)
	{
	/* for empty nonterminals, the deeper domain names are sorted
	* right after them, so simply check the next name in the tree
	*/
	struct local_data* n = (struct local_data*)rbtree_next(&d->node);
	if(n == (struct local_data*)RBTREE_NULL)
	return 1; /* last in tree, no deeper node */
	if(dname_strict_subdomain(n->name, n->namelabs, d->name, d->namelabs))
	return 0; /* there is a deeper node */
	return 1;
	}

	/** delete empty terminals from tree when final data is deleted */
	static void
	del_empty_term(struct local_zone* z, struct local_data* d,
	uint8_t* name, size_t len, int labs)
	{
	while(d && d->rrsets == NULL && is_terminal(d)) {
	/* is this empty nonterminal? delete */
	/* note, no memory recycling in zone region */
	(void)rbtree_delete(&z->data, d);

	/* go up and to the next label */
	if(dname_is_root(name))
	return;
	dname_remove_label(&name, &len);
	labs--;
	d = lz_find_node(z, name, len, labs);
	}
	}

	/** find and remove type from list in domain struct */
	static void
	del_local_rrset(struct local_data* d, uint16_t dtype)
	{
	struct local_rrset* prev=NULL, *p=d->rrsets;
	while(p && ntohs(p->rrset->rk.type) != dtype) {
	prev = p;
	p = p->next;
	}
	if(!p)
	return; /* rrset type not found */
	/* unlink it */
	if(prev) prev->next = p->next;
	else d->rrsets = p->next;
	/* no memory recycling for zone deletions ... */
	}

	void local_zones_del_data(struct local_zones* zones,
	uint8_t* name, size_t len, int labs, uint16_t dclass)
	{
	/* find zone */
	struct local_zone* z;
	struct local_data* d;

	/* remove DS */
	lock_rw_rdlock(&zones->lock);
	z = local_zones_lookup(zones, name, len, labs, dclass, LDNS_RR_TYPE_DS);
	if(z) {
	lock_rw_wrlock(&z->lock);
	d = lz_find_node(z, name, len, labs);
	if(d) {
	del_local_rrset(d, LDNS_RR_TYPE_DS);
	del_empty_term(z, d, name, len, labs);
	}
	lock_rw_unlock(&z->lock);
	}
	lock_rw_unlock(&zones->lock);

	/* remove other types */
	lock_rw_rdlock(&zones->lock);
	z = local_zones_lookup(zones, name, len, labs, dclass, 0);
	if(!z) {
	/* no such zone, we're done */
	lock_rw_unlock(&zones->lock);
	return;
	}
	lock_rw_wrlock(&z->lock);
	lock_rw_unlock(&zones->lock);

	/* find the domain */
	d = lz_find_node(z, name, len, labs);
	if(d) {
	/* no memory recycling for zone deletions ... */
	d->rrsets = NULL;
	/* did we delete the soa record ? */
	if(query_dname_compare(d->name, z->name) == 0)
	z->soa = NULL;

	/* cleanup the empty nonterminals for this name */
	del_empty_term(z, d, name, len, labs);
	}

	lock_rw_unlock(&z->lock);
	}
	Index: head/contrib/unbound/services/localzone.h
	===================================================================
	--- head/contrib/unbound/services/localzone.h (revision 349719)
	+++ head/contrib/unbound/services/localzone.h (revision 349720)
	@@ -1,514 +1,518 @@
	/*
	* services/localzone.h - local zones authority service.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains functions to enable local zone authority service.
	*/

	#ifndef SERVICES_LOCALZONE_H
	#define SERVICES_LOCALZONE_H
	#include "util/rbtree.h"
	#include "util/locks.h"
	#include "util/storage/dnstree.h"
	#include "util/module.h"
	#include "services/view.h"
	struct packed_rrset_data;
	struct ub_packed_rrset_key;
	struct regional;
	struct config_file;
	struct edns_data;
	struct query_info;
	struct sldns_buffer;
	struct comm_reply;
	struct config_strlist;

	/**
	* Local zone type
	* This type determines processing for queries that did not match
	* local-data directly.
	*/
	enum localzone_type {
	/** unset type, used for unset tag_action elements */
	local_zone_unset = 0,
	/** drop query */
	local_zone_deny,
	/** answer with error */
	local_zone_refuse,
	/** answer nxdomain or nodata */
	local_zone_static,
	/** resolve normally */
	local_zone_transparent,
	/** do not block types at localdata names */
	local_zone_typetransparent,
	/** answer with data at zone apex */
	local_zone_redirect,
	/** remove default AS112 blocking contents for zone
	* nodefault is used in config not during service. */
	local_zone_nodefault,
	/** log client address, but no block (transparent) */
	local_zone_inform,
	/** log client address, and block (drop) */
	local_zone_inform_deny,
	+ /** log client address, and direct */
	+ local_zone_inform_redirect,
	/** resolve normally, even when there is local data */
	local_zone_always_transparent,
	/** answer with error, even when there is local data */
	local_zone_always_refuse,
	/** answer with nxdomain, even when there is local data */
	local_zone_always_nxdomain,
	/** answer not from the view, but global or no-answer */
	local_zone_noview
	};

	/**
	* Authoritative local zones storage, shared.
	*/
	struct local_zones {
	/** lock on the localzone tree */
	lock_rw_type lock;
	/** rbtree of struct local_zone */
	rbtree_type ztree;
	};

	/**
	* Local zone. A locally served authoritative zone.
	*/
	struct local_zone {
	/** rbtree node, key is name and class */
	rbnode_type node;
	/** parent zone, if any. */
	struct local_zone* parent;

	/** zone name, in uncompressed wireformat */
	uint8_t* name;
	/** length of zone name */
	size_t namelen;
	/** number of labels in zone name */
	int namelabs;
	/** the class of this zone.
	* uses 'dclass' to not conflict with c++ keyword class. */
	uint16_t dclass;

	/** lock on the data in the structure
	* For the node, parent, name, namelen, namelabs, dclass, you
	* need to also hold the zones_tree lock to change them (or to
	* delete this zone) */
	lock_rw_type lock;

	/** how to process zone */
	enum localzone_type type;
	/** tag bitlist */
	uint8_t* taglist;
	/** length of the taglist (in bytes) */
	size_t taglen;
	/** netblock addr_tree with struct local_zone_override information
	* or NULL if there are no override elements */
	struct rbtree_type* override_tree;

	/** in this region the zone's data is allocated.
	* the struct local_zone itself is malloced. */
	struct regional* region;
	/** local data for this zone
	* rbtree of struct local_data */
	rbtree_type data;
	/** if data contains zone apex SOA data, this is a ptr to it. */
	struct ub_packed_rrset_key* soa;
	};

	/**
	* Local data. One domain name, and the RRs to go with it.
	*/
	struct local_data {
	/** rbtree node, key is name only */
	rbnode_type node;
	/** domain name */
	uint8_t* name;
	/** length of name */
	size_t namelen;
	/** number of labels in name */
	int namelabs;
	/** the data rrsets, with different types, linked list.
	* If this list is NULL, the node is an empty non-terminal. */
	struct local_rrset* rrsets;
	};

	/**
	* A local data RRset
	*/
	struct local_rrset {
	/** next in list */
	struct local_rrset* next;
	/** RRset data item */
	struct ub_packed_rrset_key* rrset;
	};

	/**
	* Local zone override information
	*/
	struct local_zone_override {
	/** node in addrtree */
	struct addr_tree_node node;
	/** override for local zone type */
	enum localzone_type type;
	};

	/**
	* Create local zones storage
	* @return new struct or NULL on error.
	*/
	struct local_zones* local_zones_create(void);

	/**
	* Delete local zones storage
	* @param zones: to delete.
	*/
	void local_zones_delete(struct local_zones* zones);

	/**
	* Apply config settings; setup the local authoritative data.
	* Takes care of locking.
	* @param zones: is set up.
	* @param cfg: config data.
	* @return false on error.
	*/
	int local_zones_apply_cfg(struct local_zones* zones, struct config_file* cfg);

	/**
	* Compare two local_zone entries in rbtree. Sort hierarchical but not
	* canonical
	* @param z1: zone 1
	* @param z2: zone 2
	* @return: -1, 0, +1 comparison value.
	*/
	int local_zone_cmp(const void* z1, const void* z2);

	/**
	* Compare two local_data entries in rbtree. Sort canonical.
	* @param d1: data 1
	* @param d2: data 2
	* @return: -1, 0, +1 comparison value.
	*/
	int local_data_cmp(const void* d1, const void* d2);

	/**
	* Delete one zone
	* @param z: to delete.
	*/
	void local_zone_delete(struct local_zone* z);

	/**
	* Lookup zone that contains the given name, class and taglist.
	* User must lock the tree or result zone.
	* @param zones: the zones tree
	* @param name: dname to lookup
	* @param len: length of name.
	* @param labs: labelcount of name.
	* @param dclass: class to lookup.
	* @param dtype: type to lookup, if type DS a zone higher is used for zonecuts.
	* @param taglist: taglist to lookup.
	* @param taglen: lenth of taglist.
	* @param ignoretags: lookup zone by name and class, regardless the
	* local-zone's tags.
	* @return closest local_zone or NULL if no covering zone is found.
	*/
	struct local_zone* local_zones_tags_lookup(struct local_zones* zones,
	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
	uint8_t* taglist, size_t taglen, int ignoretags);

	/**
	* Lookup zone that contains the given name, class.
	* User must lock the tree or result zone.
	* @param zones: the zones tree
	* @param name: dname to lookup
	* @param len: length of name.
	* @param labs: labelcount of name.
	* @param dclass: class to lookup.
	* @param dtype: type of the record, if type DS then a zone higher up is found
	* pass 0 to just plain find a zone for a name.
	* @return closest local_zone or NULL if no covering zone is found.
	*/
	struct local_zone* local_zones_lookup(struct local_zones* zones,
	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype);

	/**
	* Debug helper. Print all zones
	* Takes care of locking.
	* @param zones: the zones tree
	*/
	void local_zones_print(struct local_zones* zones);

	/**
	* Answer authoritatively for local zones.
	* Takes care of locking.
	* @param zones: the stored zones (shared, read only).
	* @param env: the module environment.
	* @param qinfo: query info (parsed).
	* @param edns: edns info (parsed).
	* @param buf: buffer with query ID and flags, also for reply.
	* @param temp: temporary storage region.
	* @param repinfo: source address for checks. may be NULL.
	* @param taglist: taglist for checks. May be NULL.
	* @param taglen: length of the taglist.
	* @param tagactions: local zone actions for tags. May be NULL.
	* @param tagactionssize: length of the tagactions.
	* @param tag_datas: array per tag of strlist with rdata strings. or NULL.
	* @param tag_datas_size: size of tag_datas array.
	* @param tagname: array of tag name strings (for debug output).
	* @param num_tags: number of items in tagname array.
	* @param view: answer using this view. May be NULL.
	* @return true if answer is in buffer. false if query is not answered
	* by authority data. If the reply should be dropped altogether, the return
	* value is true, but the buffer is cleared (empty).
	* It can also return true if a non-exact alias answer is found. In this
	* case qinfo->local_alias points to the corresponding alias RRset but the
	* answer is NOT encoded in buffer. It's the caller's responsibility to
	* complete the alias chain (if needed) and encode the final set of answer.
	* Data pointed to by qinfo->local_alias is allocated in 'temp' or refers to
	* configuration data. So the caller will need to make a deep copy of it
	* if it needs to keep it beyond the lifetime of 'temp' or a dynamic update
	* to local zone data.
	*/
	int local_zones_answer(struct local_zones* zones, struct module_env* env,
	struct query_info* qinfo, struct edns_data* edns, struct sldns_buffer* buf,
	struct regional* temp, struct comm_reply* repinfo, uint8_t* taglist,
	size_t taglen, uint8_t* tagactions, size_t tagactionssize,
	struct config_strlist** tag_datas, size_t tag_datas_size,
	char** tagname, int num_tags, struct view* view);

	/**
	* Parse the string into localzone type.
	*
	* @param str: string to parse
	* @param t: local zone type returned here.
	* @return 0 on parse error.
	*/
	int local_zone_str2type(const char* str, enum localzone_type* t);

	/**
	* Print localzone type to a string. Pointer to a constant string.
	*
	* @param t: local zone type.
	* @return constant string that describes type.
	*/
	const char* local_zone_type2str(enum localzone_type t);

	/**
	* Find zone that with exactly given name, class.
	* User must lock the tree or result zone.
	* @param zones: the zones tree
	* @param name: dname to lookup
	* @param len: length of name.
	* @param labs: labelcount of name.
	* @param dclass: class to lookup.
	* @return the exact local_zone or NULL.
	*/
	struct local_zone* local_zones_find(struct local_zones* zones,
	uint8_t* name, size_t len, int labs, uint16_t dclass);

	/**
	* Add a new zone. Caller must hold the zones lock.
	* Adjusts the other zones as well (parent pointers) after insertion.
	* The zone must NOT exist (returns NULL and logs error).
	* @param zones: the zones tree
	* @param name: dname to add
	* @param len: length of name.
	* @param labs: labelcount of name.
	* @param dclass: class to add.
	* @param tp: type.
	* @return local_zone or NULL on error, caller must printout memory error.
	*/
	struct local_zone* local_zones_add_zone(struct local_zones* zones,
	uint8_t* name, size_t len, int labs, uint16_t dclass,
	enum localzone_type tp);

	/**
	* Delete a zone. Caller must hold the zones lock.
	* Adjusts the other zones as well (parent pointers) after insertion.
	* @param zones: the zones tree
	* @param zone: the zone to delete from tree. Also deletes zone from memory.
	*/
	void local_zones_del_zone(struct local_zones* zones, struct local_zone* zone);

	/**
	* Add RR data into the localzone data.
	* Looks up the zone, if no covering zone, a transparent zone with the
	* name of the RR is created.
	* @param zones: the zones tree. Not locked by caller.
	* @param rr: string with on RR.
	* @return false on failure.
	*/
	int local_zones_add_RR(struct local_zones* zones, const char* rr);

	/**
	* Remove data from domain name in the tree.
	* All types are removed. No effect if zone or name does not exist.
	* @param zones: zones tree.
	* @param name: dname to remove
	* @param len: length of name.
	* @param labs: labelcount of name.
	* @param dclass: class to remove.
	*/
	void local_zones_del_data(struct local_zones* zones,
	uint8_t* name, size_t len, int labs, uint16_t dclass);


	/**
	* Form wireformat from text format domain name.
	* @param str: the domain name in text "www.example.com"
	* @param res: resulting wireformat is stored here with malloc.
	* @param len: length of resulting wireformat.
	* @param labs: number of labels in resulting wireformat.
	* @return false on error, syntax or memory. Also logged.
	*/
	int parse_dname(const char* str, uint8_t** res, size_t* len, int* labs);

	/**
	* Find local data tag string match for the given type (in qinfo) in the list.
	* If found, 'r' will be filled with corresponding rrset information.
	* @param qinfo: contains name, type, and class for the data
	* @param list: stores local tag data to be searched
	* @param r: rrset key to be filled for matched data
	* @param temp: region to allocate rrset in 'r'
	* @return 1 if a match is found and rrset is built; otherwise 0 including
	* errors.
	*/
	int local_data_find_tag_datas(const struct query_info* qinfo,
	struct config_strlist* list, struct ub_packed_rrset_key* r,
	struct regional* temp);

	/**
	* See if two sets of tag lists (in the form of bitmap) have the same tag that
	* has an action. If so, '*tag' will be set to the found tag index, and the
	* corresponding action will be returned in the form of local zone type.
	* Otherwise the passed type (lzt) will be returned as the default action.
	* Pointers except tagactions must not be NULL.
	* @param taglist: 1st list of tags
	* @param taglen: size of taglist in bytes
	* @param taglist2: 2nd list of tags
	* @param taglen2: size of taglist2 in bytes
	* @param tagactions: local data actions for tags. May be NULL.
	* @param tagactionssize: length of the tagactions.
	* @param lzt: default action (local zone type) if no tag action is found.
	* @param tag: see above.
	* @param tagname: array of tag name strings (for debug output).
	* @param num_tags: number of items in tagname array.
	* @return found tag action or the default action.
	*/
	enum localzone_type local_data_find_tag_action(const uint8_t* taglist,
	size_t taglen, const uint8_t* taglist2, size_t taglen2,
	const uint8_t* tagactions, size_t tagactionssize,
	enum localzone_type lzt, int* tag, char* const* tagname, int num_tags);

	/**
	* Enter defaults to local zone.
	* @param zones: to add defaults to
	* @param cfg: containing list of zones to exclude from default set.
	* @return 1 on success; 0 otherwise.
	*/
	int local_zone_enter_defaults(struct local_zones* zones,
	struct config_file* cfg);

	/**
	* Parses resource record string into wire format, also returning its field values.
	* @param str: input resource record
	* @param nm: domain name field
	* @param type: record type field
	* @param dclass: record class field
	* @param ttl: ttl field
	* @param rr: buffer for the parsed rr in wire format
	* @param len: buffer length
	* @param rdata: rdata field
	* @param rdata_len: rdata field length
	* @return 1 on success; 0 otherwise.
	*/
	int rrstr_get_rr_content(const char* str, uint8_t** nm, uint16_t* type,
	uint16_t* dclass, time_t* ttl, uint8_t* rr, size_t len,
	uint8_t** rdata, size_t* rdata_len);

	/**
	* Insert specified rdata into the specified resource record.
	* @param region: allocator
	* @param pd: data portion of the destination resource record
	* @param rdata: source rdata
	* @param rdata_len: source rdata length
	* @param ttl: time to live
	* @param rrstr: resource record in text form (for logging)
	* @return 1 on success; 0 otherwise.
	*/
	int rrset_insert_rr(struct regional* region, struct packed_rrset_data* pd,
	uint8_t* rdata, size_t rdata_len, time_t ttl, const char* rrstr);

	/**
	* Valid response ip actions for the IP-response-driven-action feature;
	* defined here instead of in the respip module to enable sharing of enum
	* values with the localzone_type enum.
	* Note that these values except 'none' are the same as localzone types of
	* the 'same semantics'. It's intentional as we use these values via
	* access-control-tags, which can be shared for both response ip actions and
	* local zones.
	*/
	enum respip_action {
	/** no respip action */
	respip_none = local_zone_unset,
	/** don't answer */
	respip_deny = local_zone_deny,
	/** redirect as per provided data */
	respip_redirect = local_zone_redirect,
	/** log query source and answer query */
	respip_inform = local_zone_inform,
	/** log query source and don't answer query */
	respip_inform_deny = local_zone_inform_deny,
	+ /** log query source and redirect */
	+ respip_inform_redirect = local_zone_inform_redirect,
	/** resolve normally, even when there is response-ip data */
	respip_always_transparent = local_zone_always_transparent,
	/** answer with 'refused' response */
	respip_always_refuse = local_zone_always_refuse,
	/** answer with 'no such domain' response */
	respip_always_nxdomain = local_zone_always_nxdomain,

	/* The rest of the values are only possible as
	* access-control-tag-action */

	/** serves response data (if any), else, drops queries. */
	respip_refuse = local_zone_refuse,
	/** serves response data, else, nodata answer. */
	respip_static = local_zone_static,
	/** gives response data (if any), else nodata answer. */
	respip_transparent = local_zone_transparent,
	/** gives response data (if any), else nodata answer. */
	respip_typetransparent = local_zone_typetransparent,
	};

	#endif /* SERVICES_LOCALZONE_H */
	Index: head/contrib/unbound/services/mesh.c
	===================================================================
	--- head/contrib/unbound/services/mesh.c (revision 349719)
	+++ head/contrib/unbound/services/mesh.c (revision 349720)
	@@ -1,1615 +1,1668 @@
	/*
	* services/mesh.c - deal with mesh of query states and handle events for that.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains functions to assist in dealing with a mesh of
	* query states. This mesh is supposed to be thread-specific.
	* It consists of query states (per qname, qtype, qclass) and connections
	* between query states and the super and subquery states, and replies to
	* send back to clients.
	*/
	#include "config.h"
	#include "services/mesh.h"
	#include "services/outbound_list.h"
	#include "services/cache/dns.h"
	#include "util/log.h"
	#include "util/net_help.h"
	#include "util/module.h"
	#include "util/regional.h"
	#include "util/data/msgencode.h"
	#include "util/timehist.h"
	#include "util/fptr_wlist.h"
	#include "util/alloc.h"
	#include "util/config_file.h"
	#include "util/edns.h"
	#include "sldns/sbuffer.h"
	#include "sldns/wire2str.h"
	#include "services/localzone.h"
	#include "util/data/dname.h"
	#include "respip/respip.h"
	+#include "services/listen_dnsport.h"

	/** subtract timers and the values do not overflow or become negative */
	static void
	timeval_subtract(struct timeval* d, const struct timeval* end, const struct timeval* start)
	{
	#ifndef S_SPLINT_S
	time_t end_usec = end->tv_usec;
	d->tv_sec = end->tv_sec - start->tv_sec;
	if(end_usec < start->tv_usec) {
	end_usec += 1000000;
	d->tv_sec--;
	}
	d->tv_usec = end_usec - start->tv_usec;
	#endif
	}

	/** add timers and the values do not overflow or become negative */
	static void
	timeval_add(struct timeval* d, const struct timeval* add)
	{
	#ifndef S_SPLINT_S
	d->tv_sec += add->tv_sec;
	d->tv_usec += add->tv_usec;
	if(d->tv_usec > 1000000 ) {
	d->tv_usec -= 1000000;
	d->tv_sec++;
	}
	#endif
	}

	/** divide sum of timers to get average */
	static void
	timeval_divide(struct timeval* avg, const struct timeval* sum, size_t d)
	{
	#ifndef S_SPLINT_S
	size_t leftover;
	if(d == 0) {
	avg->tv_sec = 0;
	avg->tv_usec = 0;
	return;
	}
	avg->tv_sec = sum->tv_sec / d;
	avg->tv_usec = sum->tv_usec / d;
	/* handle fraction from seconds divide */
	leftover = sum->tv_sec - avg->tv_sec*d;
	avg->tv_usec += (leftover*1000000)/d;
	#endif
	}

	/** histogram compare of time values */
	static int
	timeval_smaller(const struct timeval* x, const struct timeval* y)
	{
	#ifndef S_SPLINT_S
	if(x->tv_sec < y->tv_sec)
	return 1;
	else if(x->tv_sec == y->tv_sec) {
	if(x->tv_usec <= y->tv_usec)
	return 1;
	else return 0;
	}
	else return 0;
	#endif
	}

	/*
	* Compare two response-ip client info entries for the purpose of mesh state
	* compare. It returns 0 if ci_a and ci_b are considered equal; otherwise
	* 1 or -1 (they mean 'ci_a is larger/smaller than ci_b', respectively, but
	* in practice it should be only used to mean they are different).
	* We cannot share the mesh state for two queries if different response-ip
	* actions can apply in the end, even if those queries are otherwise identical.
	* For this purpose we compare tag lists and tag action lists; they should be
	* identical to share the same state.
	* For tag data, we don't look into the data content, as it can be
	* expensive; unless tag data are not defined for both or they point to the
	* exact same data in memory (i.e., they come from the same ACL entry), we
	* consider these data different.
	* Likewise, if the client info is associated with views, we don't look into
	* the views. They are considered different unless they are exactly the same
	* even if the views only differ in the names.
	*/
	static int
	client_info_compare(const struct respip_client_info* ci_a,
	const struct respip_client_info* ci_b)
	{
	int cmp;

	if(!ci_a && !ci_b)
	return 0;
	if(ci_a && !ci_b)
	return -1;
	if(!ci_a && ci_b)
	return 1;
	if(ci_a->taglen != ci_b->taglen)
	return (ci_a->taglen < ci_b->taglen) ? -1 : 1;
	cmp = memcmp(ci_a->taglist, ci_b->taglist, ci_a->taglen);
	if(cmp != 0)
	return cmp;
	if(ci_a->tag_actions_size != ci_b->tag_actions_size)
	return (ci_a->tag_actions_size < ci_b->tag_actions_size) ?
	-1 : 1;
	cmp = memcmp(ci_a->tag_actions, ci_b->tag_actions,
	ci_a->tag_actions_size);
	if(cmp != 0)
	return cmp;
	if(ci_a->tag_datas != ci_b->tag_datas)
	return ci_a->tag_datas < ci_b->tag_datas ? -1 : 1;
	if(ci_a->view != ci_b->view)
	return ci_a->view < ci_b->view ? -1 : 1;
	/* For the unbound daemon these should be non-NULL and identical,
	* but we check that just in case. */
	if(ci_a->respip_set != ci_b->respip_set)
	return ci_a->respip_set < ci_b->respip_set ? -1 : 1;
	return 0;
	}

	int
	mesh_state_compare(const void* ap, const void* bp)
	{
	struct mesh_state* a = (struct mesh_state*)ap;
	struct mesh_state* b = (struct mesh_state*)bp;
	int cmp;

	if(a->unique < b->unique)
	return -1;
	if(a->unique > b->unique)
	return 1;

	if(a->s.is_priming && !b->s.is_priming)
	return -1;
	if(!a->s.is_priming && b->s.is_priming)
	return 1;

	if(a->s.is_valrec && !b->s.is_valrec)
	return -1;
	if(!a->s.is_valrec && b->s.is_valrec)
	return 1;

	if((a->s.query_flags&BIT_RD) && !(b->s.query_flags&BIT_RD))
	return -1;
	if(!(a->s.query_flags&BIT_RD) && (b->s.query_flags&BIT_RD))
	return 1;

	if((a->s.query_flags&BIT_CD) && !(b->s.query_flags&BIT_CD))
	return -1;
	if(!(a->s.query_flags&BIT_CD) && (b->s.query_flags&BIT_CD))
	return 1;

	cmp = query_info_compare(&a->s.qinfo, &b->s.qinfo);
	if(cmp != 0)
	return cmp;
	return client_info_compare(a->s.client_info, b->s.client_info);
	}

	int
	mesh_state_ref_compare(const void* ap, const void* bp)
	{
	struct mesh_state_ref* a = (struct mesh_state_ref*)ap;
	struct mesh_state_ref* b = (struct mesh_state_ref*)bp;
	return mesh_state_compare(a->s, b->s);
	}

	struct mesh_area*
	mesh_create(struct module_stack* stack, struct module_env* env)
	{
	struct mesh_area* mesh = calloc(1, sizeof(struct mesh_area));
	if(!mesh) {
	log_err("mesh area alloc: out of memory");
	return NULL;
	}
	mesh->histogram = timehist_setup();
	mesh->qbuf_bak = sldns_buffer_new(env->cfg->msg_buffer_size);
	if(!mesh->histogram \|\| !mesh->qbuf_bak) {
	free(mesh);
	log_err("mesh area alloc: out of memory");
	return NULL;
	}
	mesh->mods = *stack;
	mesh->env = env;
	rbtree_init(&mesh->run, &mesh_state_compare);
	rbtree_init(&mesh->all, &mesh_state_compare);
	mesh->num_reply_addrs = 0;
	mesh->num_reply_states = 0;
	mesh->num_detached_states = 0;
	mesh->num_forever_states = 0;
	mesh->stats_jostled = 0;
	mesh->stats_dropped = 0;
	mesh->max_reply_states = env->cfg->num_queries_per_thread;
	mesh->max_forever_states = (mesh->max_reply_states+1)/2;
	#ifndef S_SPLINT_S
	mesh->jostle_max.tv_sec = (time_t)(env->cfg->jostle_time / 1000);
	mesh->jostle_max.tv_usec = (time_t)((env->cfg->jostle_time % 1000)
	*1000);
	#endif
	return mesh;
	}

	/** help mesh delete delete mesh states */
	static void
	mesh_delete_helper(rbnode_type* n)
	{
	struct mesh_state* mstate = (struct mesh_state*)n->key;
	/* perform a full delete, not only 'cleanup' routine,
	* because other callbacks expect a clean state in the mesh.
	* For 're-entrant' calls */
	mesh_state_delete(&mstate->s);
	/* but because these delete the items from the tree, postorder
	* traversal and rbtree rebalancing do not work together */
	}

	void
	mesh_delete(struct mesh_area* mesh)
	{
	if(!mesh)
	return;
	/* free all query states */
	while(mesh->all.count)
	mesh_delete_helper(mesh->all.root);
	timehist_delete(mesh->histogram);
	sldns_buffer_free(mesh->qbuf_bak);
	free(mesh);
	}

	void
	mesh_delete_all(struct mesh_area* mesh)
	{
	/* free all query states */
	while(mesh->all.count)
	mesh_delete_helper(mesh->all.root);
	mesh->stats_dropped += mesh->num_reply_addrs;
	/* clear mesh area references */
	rbtree_init(&mesh->run, &mesh_state_compare);
	rbtree_init(&mesh->all, &mesh_state_compare);
	mesh->num_reply_addrs = 0;
	mesh->num_reply_states = 0;
	mesh->num_detached_states = 0;
	mesh->num_forever_states = 0;
	mesh->forever_first = NULL;
	mesh->forever_last = NULL;
	mesh->jostle_first = NULL;
	mesh->jostle_last = NULL;
	}

	int mesh_make_new_space(struct mesh_area* mesh, sldns_buffer* qbuf)
	{
	struct mesh_state* m = mesh->jostle_first;
	/* free space is available */
	if(mesh->num_reply_states < mesh->max_reply_states)
	return 1;
	/* try to kick out a jostle-list item */
	if(m && m->reply_list && m->list_select == mesh_jostle_list) {
	/* how old is it? */
	struct timeval age;
	timeval_subtract(&age, mesh->env->now_tv,
	&m->reply_list->start_time);
	if(timeval_smaller(&mesh->jostle_max, &age)) {
	/* its a goner */
	log_nametypeclass(VERB_ALGO, "query jostled out to "
	"make space for a new one",
	m->s.qinfo.qname, m->s.qinfo.qtype,
	m->s.qinfo.qclass);
	/* backup the query */
	if(qbuf) sldns_buffer_copy(mesh->qbuf_bak, qbuf);
	/* notify supers */
	if(m->super_set.count > 0) {
	verbose(VERB_ALGO, "notify supers of failure");
	m->s.return_msg = NULL;
	m->s.return_rcode = LDNS_RCODE_SERVFAIL;
	mesh_walk_supers(mesh, m);
	}
	mesh->stats_jostled ++;
	mesh_state_delete(&m->s);
	/* restore the query - note that the qinfo ptr to
	* the querybuffer is then correct again. */
	if(qbuf) sldns_buffer_copy(qbuf, mesh->qbuf_bak);
	return 1;
	}
	}
	/* no space for new item */
	return 0;
	}

	void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
	struct respip_client_info* cinfo, uint16_t qflags,
	struct edns_data* edns, struct comm_reply* rep, uint16_t qid)
	{
	struct mesh_state* s = NULL;
	int unique = unique_mesh_state(edns->opt_list, mesh->env);
	int was_detached = 0;
	int was_noreply = 0;
	int added = 0;
	+ struct sldns_buffer* r_buffer = rep->c->buffer;
	+ if(rep->c->tcp_req_info) {
	+ r_buffer = rep->c->tcp_req_info->spool_buffer;
	+ }
	if(!unique)
	s = mesh_area_find(mesh, cinfo, qinfo, qflags&(BIT_RD\|BIT_CD), 0, 0);
	/* does this create a new reply state? */
	if(!s \|\| s->list_select == mesh_no_list) {
	if(!mesh_make_new_space(mesh, rep->c->buffer)) {
	verbose(VERB_ALGO, "Too many queries. dropping "
	"incoming query.");
	comm_point_drop_reply(rep);
	mesh->stats_dropped ++;
	return;
	}
	/* for this new reply state, the reply address is free,
	* so the limit of reply addresses does not stop reply states*/
	} else {
	/* protect our memory usage from storing reply addresses */
	if(mesh->num_reply_addrs > mesh->max_reply_states*16) {
	verbose(VERB_ALGO, "Too many requests queued. "
	"dropping incoming query.");
	mesh->stats_dropped++;
	comm_point_drop_reply(rep);
	return;
	}
	}
	/* see if it already exists, if not, create one */
	if(!s) {
	#ifdef UNBOUND_DEBUG
	struct rbnode_type* n;
	#endif
	s = mesh_state_create(mesh->env, qinfo, cinfo,
	qflags&(BIT_RD\|BIT_CD), 0, 0);
	if(!s) {
	log_err("mesh_state_create: out of memory; SERVFAIL");
	if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL, NULL,
	LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch))
	edns->opt_list = NULL;
	- error_encode(rep->c->buffer, LDNS_RCODE_SERVFAIL,
	+ error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
	qinfo, qid, qflags, edns);
	comm_point_send_reply(rep);
	return;
	}
	if(unique)
	mesh_state_make_unique(s);
	/* copy the edns options we got from the front */
	if(edns->opt_list) {
	s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list,
	s->s.region);
	if(!s->s.edns_opts_front_in) {
	log_err("mesh_state_create: out of memory; SERVFAIL");
	if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL,
	NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch))
	edns->opt_list = NULL;
	- error_encode(rep->c->buffer, LDNS_RCODE_SERVFAIL,
	+ error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
	qinfo, qid, qflags, edns);
	comm_point_send_reply(rep);
	return;
	}
	}

	#ifdef UNBOUND_DEBUG
	n =
	#else
	(void)
	#endif
	rbtree_insert(&mesh->all, &s->node);
	log_assert(n != NULL);
	/* set detached (it is now) */
	mesh->num_detached_states++;
	added = 1;
	}
	if(!s->reply_list && !s->cb_list && s->super_set.count == 0)
	was_detached = 1;
	if(!s->reply_list && !s->cb_list)
	was_noreply = 1;
	/* add reply to s */
	if(!mesh_state_add_reply(s, edns, rep, qid, qflags, qinfo)) {
	log_err("mesh_new_client: out of memory; SERVFAIL");
	+ servfail_mem:
	if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, &s->s,
	NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch))
	edns->opt_list = NULL;
	- error_encode(rep->c->buffer, LDNS_RCODE_SERVFAIL,
	+ error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
	qinfo, qid, qflags, edns);
	comm_point_send_reply(rep);
	if(added)
	mesh_state_delete(&s->s);
	return;
	}
	+ if(rep->c->tcp_req_info) {
	+ if(!tcp_req_info_add_meshstate(rep->c->tcp_req_info, mesh, s)) {
	+ log_err("mesh_new_client: out of memory add tcpreqinfo");
	+ goto servfail_mem;
	+ }
	+ }
	/* update statistics */
	if(was_detached) {
	log_assert(mesh->num_detached_states > 0);
	mesh->num_detached_states--;
	}
	if(was_noreply) {
	mesh->num_reply_states ++;
	}
	mesh->num_reply_addrs++;
	if(s->list_select == mesh_no_list) {
	/* move to either the forever or the jostle_list */
	if(mesh->num_forever_states < mesh->max_forever_states) {
	mesh->num_forever_states ++;
	mesh_list_insert(s, &mesh->forever_first,
	&mesh->forever_last);
	s->list_select = mesh_forever_list;
	} else {
	mesh_list_insert(s, &mesh->jostle_first,
	&mesh->jostle_last);
	s->list_select = mesh_jostle_list;
	}
	}
	if(added)
	mesh_run(mesh, s, module_event_new, NULL);
	}

	int
	mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
	uint16_t qflags, struct edns_data* edns, sldns_buffer* buf,
	uint16_t qid, mesh_cb_func_type cb, void* cb_arg)
	{
	struct mesh_state* s = NULL;
	int unique = unique_mesh_state(edns->opt_list, mesh->env);
	int was_detached = 0;
	int was_noreply = 0;
	int added = 0;
	if(!unique)
	s = mesh_area_find(mesh, NULL, qinfo, qflags&(BIT_RD\|BIT_CD), 0, 0);

	/* there are no limits on the number of callbacks */

	/* see if it already exists, if not, create one */
	if(!s) {
	#ifdef UNBOUND_DEBUG
	struct rbnode_type* n;
	#endif
	s = mesh_state_create(mesh->env, qinfo, NULL,
	qflags&(BIT_RD\|BIT_CD), 0, 0);
	if(!s) {
	return 0;
	}
	if(unique)
	mesh_state_make_unique(s);
	if(edns->opt_list) {
	s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list,
	s->s.region);
	if(!s->s.edns_opts_front_in) {
	return 0;
	}
	}
	#ifdef UNBOUND_DEBUG
	n =
	#else
	(void)
	#endif
	rbtree_insert(&mesh->all, &s->node);
	log_assert(n != NULL);
	/* set detached (it is now) */
	mesh->num_detached_states++;
	added = 1;
	}
	if(!s->reply_list && !s->cb_list && s->super_set.count == 0)
	was_detached = 1;
	if(!s->reply_list && !s->cb_list)
	was_noreply = 1;
	/* add reply to s */
	if(!mesh_state_add_cb(s, edns, buf, cb, cb_arg, qid, qflags)) {
	if(added)
	mesh_state_delete(&s->s);
	return 0;
	}
	/* update statistics */
	if(was_detached) {
	log_assert(mesh->num_detached_states > 0);
	mesh->num_detached_states--;
	}
	if(was_noreply) {
	mesh->num_reply_states ++;
	}
	mesh->num_reply_addrs++;
	if(added)
	mesh_run(mesh, s, module_event_new, NULL);
	return 1;
	}

	static void mesh_schedule_prefetch(struct mesh_area* mesh,
	struct query_info* qinfo, uint16_t qflags, time_t leeway, int run);

	void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
	uint16_t qflags, time_t leeway)
	{
	mesh_schedule_prefetch(mesh, qinfo, qflags, leeway, 1);
	}

	/* Internal backend routine of mesh_new_prefetch(). It takes one additional
	* parameter, 'run', which controls whether to run the prefetch state
	* immediately. When this function is called internally 'run' could be
	* 0 (false), in which case the new state is only made runnable so it
	* will not be run recursively on top of the current state. */
	static void mesh_schedule_prefetch(struct mesh_area* mesh,
	struct query_info* qinfo, uint16_t qflags, time_t leeway, int run)
	{
	struct mesh_state* s = mesh_area_find(mesh, NULL, qinfo,
	qflags&(BIT_RD\|BIT_CD), 0, 0);
	#ifdef UNBOUND_DEBUG
	struct rbnode_type* n;
	#endif
	/* already exists, and for a different purpose perhaps.
	* if mesh_no_list, keep it that way. */
	if(s) {
	/* make it ignore the cache from now on */
	if(!s->s.blacklist)
	sock_list_insert(&s->s.blacklist, NULL, 0, s->s.region);
	if(s->s.prefetch_leeway < leeway)
	s->s.prefetch_leeway = leeway;
	return;
	}
	if(!mesh_make_new_space(mesh, NULL)) {
	verbose(VERB_ALGO, "Too many queries. dropped prefetch.");
	mesh->stats_dropped ++;
	return;
	}

	s = mesh_state_create(mesh->env, qinfo, NULL,
	qflags&(BIT_RD\|BIT_CD), 0, 0);
	if(!s) {
	log_err("prefetch mesh_state_create: out of memory");
	return;
	}
	#ifdef UNBOUND_DEBUG
	n =
	#else
	(void)
	#endif
	rbtree_insert(&mesh->all, &s->node);
	log_assert(n != NULL);
	/* set detached (it is now) */
	mesh->num_detached_states++;
	/* make it ignore the cache */
	sock_list_insert(&s->s.blacklist, NULL, 0, s->s.region);
	s->s.prefetch_leeway = leeway;

	if(s->list_select == mesh_no_list) {
	/* move to either the forever or the jostle_list */
	if(mesh->num_forever_states < mesh->max_forever_states) {
	mesh->num_forever_states ++;
	mesh_list_insert(s, &mesh->forever_first,
	&mesh->forever_last);
	s->list_select = mesh_forever_list;
	} else {
	mesh_list_insert(s, &mesh->jostle_first,
	&mesh->jostle_last);
	s->list_select = mesh_jostle_list;
	}
	}

	if(!run) {
	#ifdef UNBOUND_DEBUG
	n =
	#else
	(void)
	#endif
	rbtree_insert(&mesh->run, &s->run_node);
	log_assert(n != NULL);
	return;
	}

	mesh_run(mesh, s, module_event_new, NULL);
	}

	void mesh_report_reply(struct mesh_area* mesh, struct outbound_entry* e,
	struct comm_reply* reply, int what)
	{
	enum module_ev event = module_event_reply;
	e->qstate->reply = reply;
	if(what != NETEVENT_NOERROR) {
	event = module_event_noreply;
	if(what == NETEVENT_CAPSFAIL)
	event = module_event_capsfail;
	}
	mesh_run(mesh, e->qstate->mesh_info, event, e);
	}

	struct mesh_state*
	mesh_state_create(struct module_env* env, struct query_info* qinfo,
	struct respip_client_info* cinfo, uint16_t qflags, int prime,
	int valrec)
	{
	struct regional* region = alloc_reg_obtain(env->alloc);
	struct mesh_state* mstate;
	int i;
	if(!region)
	return NULL;
	mstate = (struct mesh_state*)regional_alloc(region,
	sizeof(struct mesh_state));
	if(!mstate) {
	alloc_reg_release(env->alloc, region);
	return NULL;
	}
	memset(mstate, 0, sizeof(*mstate));
	mstate->node = *RBTREE_NULL;
	mstate->run_node = *RBTREE_NULL;
	mstate->node.key = mstate;
	mstate->run_node.key = mstate;
	mstate->reply_list = NULL;
	mstate->list_select = mesh_no_list;
	mstate->replies_sent = 0;
	rbtree_init(&mstate->super_set, &mesh_state_ref_compare);
	rbtree_init(&mstate->sub_set, &mesh_state_ref_compare);
	mstate->num_activated = 0;
	mstate->unique = NULL;
	/* init module qstate */
	mstate->s.qinfo.qtype = qinfo->qtype;
	mstate->s.qinfo.qclass = qinfo->qclass;
	mstate->s.qinfo.local_alias = NULL;
	mstate->s.qinfo.qname_len = qinfo->qname_len;
	mstate->s.qinfo.qname = regional_alloc_init(region, qinfo->qname,
	qinfo->qname_len);
	if(!mstate->s.qinfo.qname) {
	alloc_reg_release(env->alloc, region);
	return NULL;
	}
	if(cinfo) {
	mstate->s.client_info = regional_alloc_init(region, cinfo,
	sizeof(*cinfo));
	if(!mstate->s.client_info) {
	alloc_reg_release(env->alloc, region);
	return NULL;
	}
	}
	/* remove all weird bits from qflags */
	mstate->s.query_flags = (qflags & (BIT_RD\|BIT_CD));
	mstate->s.is_priming = prime;
	mstate->s.is_valrec = valrec;
	mstate->s.reply = NULL;
	mstate->s.region = region;
	mstate->s.curmod = 0;
	mstate->s.return_msg = 0;
	mstate->s.return_rcode = LDNS_RCODE_NOERROR;
	mstate->s.env = env;
	mstate->s.mesh_info = mstate;
	mstate->s.prefetch_leeway = 0;
	mstate->s.no_cache_lookup = 0;
	mstate->s.no_cache_store = 0;
	mstate->s.need_refetch = 0;
	mstate->s.was_ratelimited = 0;

	/* init modules */
	for(i=0; i<env->mesh->mods.num; i++) {
	mstate->s.minfo[i] = NULL;
	mstate->s.ext_state[i] = module_state_initial;
	}
	/* init edns option lists */
	mstate->s.edns_opts_front_in = NULL;
	mstate->s.edns_opts_back_out = NULL;
	mstate->s.edns_opts_back_in = NULL;
	mstate->s.edns_opts_front_out = NULL;

	return mstate;
	}

	int
	mesh_state_is_unique(struct mesh_state* mstate)
	{
	return mstate->unique != NULL;
	}

	void
	mesh_state_make_unique(struct mesh_state* mstate)
	{
	mstate->unique = mstate;
	}

	void
	mesh_state_cleanup(struct mesh_state* mstate)
	{
	struct mesh_area* mesh;
	int i;
	if(!mstate)
	return;
	mesh = mstate->s.env->mesh;
	/* drop unsent replies */
	if(!mstate->replies_sent) {
	- struct mesh_reply* rep;
	+ struct mesh_reply* rep = mstate->reply_list;
	struct mesh_cb* cb;
	- for(rep=mstate->reply_list; rep; rep=rep->next) {
	+ /* in tcp_req_info, the mstates linked are removed, but
	+ * the reply_list is now NULL, so the remove-from-empty-list
	+ * takes no time and also it does not do the mesh accounting */
	+ mstate->reply_list = NULL;
	+ for(; rep; rep=rep->next) {
	comm_point_drop_reply(&rep->query_reply);
	mesh->num_reply_addrs--;
	}
	while((cb = mstate->cb_list)!=NULL) {
	mstate->cb_list = cb->next;
	fptr_ok(fptr_whitelist_mesh_cb(cb->cb));
	(*cb->cb)(cb->cb_arg, LDNS_RCODE_SERVFAIL, NULL,
	sec_status_unchecked, NULL, 0);
	mesh->num_reply_addrs--;
	}
	}

	/* de-init modules */
	for(i=0; i<mesh->mods.num; i++) {
	fptr_ok(fptr_whitelist_mod_clear(mesh->mods.mod[i]->clear));
	(*mesh->mods.mod[i]->clear)(&mstate->s, i);
	mstate->s.minfo[i] = NULL;
	mstate->s.ext_state[i] = module_finished;
	}
	alloc_reg_release(mstate->s.env->alloc, mstate->s.region);
	}

	void
	mesh_state_delete(struct module_qstate* qstate)
	{
	struct mesh_area* mesh;
	struct mesh_state_ref* super, ref;
	struct mesh_state* mstate;
	if(!qstate)
	return;
	mstate = qstate->mesh_info;
	mesh = mstate->s.env->mesh;
	mesh_detach_subs(&mstate->s);
	if(mstate->list_select == mesh_forever_list) {
	mesh->num_forever_states --;
	mesh_list_remove(mstate, &mesh->forever_first,
	&mesh->forever_last);
	} else if(mstate->list_select == mesh_jostle_list) {
	mesh_list_remove(mstate, &mesh->jostle_first,
	&mesh->jostle_last);
	}
	if(!mstate->reply_list && !mstate->cb_list
	&& mstate->super_set.count == 0) {
	log_assert(mesh->num_detached_states > 0);
	mesh->num_detached_states--;
	}
	if(mstate->reply_list \|\| mstate->cb_list) {
	log_assert(mesh->num_reply_states > 0);
	mesh->num_reply_states--;
	}
	ref.node.key = &ref;
	ref.s = mstate;
	RBTREE_FOR(super, struct mesh_state_ref*, &mstate->super_set) {
	(void)rbtree_delete(&super->s->sub_set, &ref);
	}
	(void)rbtree_delete(&mesh->run, mstate);
	(void)rbtree_delete(&mesh->all, mstate);
	mesh_state_cleanup(mstate);
	}

	/** helper recursive rbtree find routine */
	static int
	find_in_subsub(struct mesh_state* m, struct mesh_state* tofind, size_t *c)
	{
	struct mesh_state_ref* r;
	if((*c)++ > MESH_MAX_SUBSUB)
	return 1;
	RBTREE_FOR(r, struct mesh_state_ref*, &m->sub_set) {
	if(r->s == tofind \|\| find_in_subsub(r->s, tofind, c))
	return 1;
	}
	return 0;
	}

	/** find cycle for already looked up mesh_state */
	static int
	mesh_detect_cycle_found(struct module_qstate* qstate, struct mesh_state* dep_m)
	{
	struct mesh_state* cyc_m = qstate->mesh_info;
	size_t counter = 0;
	if(!dep_m)
	return 0;
	if(dep_m == cyc_m \|\| find_in_subsub(dep_m, cyc_m, &counter)) {
	if(counter > MESH_MAX_SUBSUB)
	return 2;
	return 1;
	}
	return 0;
	}

	void mesh_detach_subs(struct module_qstate* qstate)
	{
	struct mesh_area* mesh = qstate->env->mesh;
	struct mesh_state_ref* ref, lookup;
	#ifdef UNBOUND_DEBUG
	struct rbnode_type* n;
	#endif
	lookup.node.key = &lookup;
	lookup.s = qstate->mesh_info;
	RBTREE_FOR(ref, struct mesh_state_ref*, &qstate->mesh_info->sub_set) {
	#ifdef UNBOUND_DEBUG
	n =
	#else
	(void)
	#endif
	rbtree_delete(&ref->s->super_set, &lookup);
	log_assert(n != NULL); /* must have been present */
	if(!ref->s->reply_list && !ref->s->cb_list
	&& ref->s->super_set.count == 0) {
	mesh->num_detached_states++;
	log_assert(mesh->num_detached_states +
	mesh->num_reply_states <= mesh->all.count);
	}
	}
	rbtree_init(&qstate->mesh_info->sub_set, &mesh_state_ref_compare);
	}

	int mesh_add_sub(struct module_qstate* qstate, struct query_info* qinfo,
	uint16_t qflags, int prime, int valrec, struct module_qstate** newq,
	struct mesh_state** sub)
	{
	/* find it, if not, create it */
	struct mesh_area* mesh = qstate->env->mesh;
	*sub = mesh_area_find(mesh, NULL, qinfo, qflags,
	prime, valrec);
	if(mesh_detect_cycle_found(qstate, *sub)) {
	verbose(VERB_ALGO, "attach failed, cycle detected");
	return 0;
	}
	if(!*sub) {
	#ifdef UNBOUND_DEBUG
	struct rbnode_type* n;
	#endif
	/* create a new one */
	*sub = mesh_state_create(qstate->env, qinfo, NULL, qflags, prime,
	valrec);
	if(!*sub) {
	log_err("mesh_attach_sub: out of memory");
	return 0;
	}
	#ifdef UNBOUND_DEBUG
	n =
	#else
	(void)
	#endif
	rbtree_insert(&mesh->all, &(*sub)->node);
	log_assert(n != NULL);
	/* set detached (it is now) */
	mesh->num_detached_states++;
	/* set new query state to run */
	#ifdef UNBOUND_DEBUG
	n =
	#else
	(void)
	#endif
	rbtree_insert(&mesh->run, &(*sub)->run_node);
	log_assert(n != NULL);
	newq = &(sub)->s;
	} else
	*newq = NULL;
	return 1;
	}

	int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
	uint16_t qflags, int prime, int valrec, struct module_qstate** newq)
	{
	struct mesh_area* mesh = qstate->env->mesh;
	struct mesh_state* sub = NULL;
	int was_detached;
	if(!mesh_add_sub(qstate, qinfo, qflags, prime, valrec, newq, &sub))
	return 0;
	was_detached = (sub->super_set.count == 0);
	if(!mesh_state_attachment(qstate->mesh_info, sub))
	return 0;
	/* if it was a duplicate attachment, the count was not zero before */
	if(!sub->reply_list && !sub->cb_list && was_detached &&
	sub->super_set.count == 1) {
	/* it used to be detached, before this one got added */
	log_assert(mesh->num_detached_states > 0);
	mesh->num_detached_states--;
	}
	/* newq will be run when inited after the current module stops /
	return 1;
	}

	int mesh_state_attachment(struct mesh_state* super, struct mesh_state* sub)
	{
	#ifdef UNBOUND_DEBUG
	struct rbnode_type* n;
	#endif
	struct mesh_state_ref* subref; /* points to sub, inserted in super */
	struct mesh_state_ref* superref; /* points to super, inserted in sub */
	if( !(subref = regional_alloc(super->s.region,
	sizeof(struct mesh_state_ref))) \|\|
	!(superref = regional_alloc(sub->s.region,
	sizeof(struct mesh_state_ref))) ) {
	log_err("mesh_state_attachment: out of memory");
	return 0;
	}
	superref->node.key = superref;
	superref->s = super;
	subref->node.key = subref;
	subref->s = sub;
	if(!rbtree_insert(&sub->super_set, &superref->node)) {
	/* this should not happen, iterator and validator do not
	* attach subqueries that are identical. */
	/* already attached, we are done, nothing todo.
	* since superref and subref already allocated in region,
	* we cannot free them */
	return 1;
	}
	#ifdef UNBOUND_DEBUG
	n =
	#else
	(void)
	#endif
	rbtree_insert(&super->sub_set, &subref->node);
	log_assert(n != NULL); /* we checked above if statement, the reverse
	administration should not fail now, unless they are out of sync */
	return 1;
	}

	/**
	* callback results to mesh cb entry
	* @param m: mesh state to send it for.
	* @param rcode: if not 0, error code.
	* @param rep: reply to send (or NULL if rcode is set).
	* @param r: callback entry
	*/
	static void
	mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
	struct mesh_cb* r)
	{
	int secure;
	char* reason = NULL;
	int was_ratelimited = m->s.was_ratelimited;
	/* bogus messages are not made into servfail, sec_status passed
	* to the callback function */
	if(rep && rep->security == sec_status_secure)
	secure = 1;
	else secure = 0;
	if(!rep && rcode == LDNS_RCODE_NOERROR)
	rcode = LDNS_RCODE_SERVFAIL;
	if(!rcode && (rep->security == sec_status_bogus \|\|
	rep->security == sec_status_secure_sentinel_fail)) {
	if(!(reason = errinf_to_str_bogus(&m->s)))
	rcode = LDNS_RCODE_SERVFAIL;
	}
	/* send the reply */
	if(rcode) {
	if(rcode == LDNS_RCODE_SERVFAIL) {
	if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
	rep, rcode, &r->edns, NULL, m->s.region))
	r->edns.opt_list = NULL;
	} else {
	if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode,
	&r->edns, NULL, m->s.region))
	r->edns.opt_list = NULL;
	}
	fptr_ok(fptr_whitelist_mesh_cb(r->cb));
	(*r->cb)(r->cb_arg, rcode, r->buf, sec_status_unchecked, NULL,
	was_ratelimited);
	} else {
	size_t udp_size = r->edns.udp_size;
	sldns_buffer_clear(r->buf);
	r->edns.edns_version = EDNS_ADVERTISED_VERSION;
	r->edns.udp_size = EDNS_ADVERTISED_SIZE;
	r->edns.ext_rcode = 0;
	r->edns.bits &= EDNS_DO;

	if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep,
	LDNS_RCODE_NOERROR, &r->edns, NULL, m->s.region) \|\|
	!reply_info_answer_encode(&m->s.qinfo, rep, r->qid,
	r->qflags, r->buf, 0, 1,
	m->s.env->scratch, udp_size, &r->edns,
	(int)(r->edns.bits & EDNS_DO), secure))
	{
	fptr_ok(fptr_whitelist_mesh_cb(r->cb));
	(*r->cb)(r->cb_arg, LDNS_RCODE_SERVFAIL, r->buf,
	sec_status_unchecked, NULL, 0);
	} else {
	fptr_ok(fptr_whitelist_mesh_cb(r->cb));
	(*r->cb)(r->cb_arg, LDNS_RCODE_NOERROR, r->buf,
	rep->security, reason, was_ratelimited);
	}
	}
	free(reason);
	m->s.env->mesh->num_reply_addrs--;
	}

	/**
	* Send reply to mesh reply entry
	* @param m: mesh state to send it for.
	* @param rcode: if not 0, error code.
	* @param rep: reply to send (or NULL if rcode is set).
	* @param r: reply entry
	+ * @param r_buffer: buffer to use for reply entry.
	* @param prev: previous reply, already has its answer encoded in buffer.
	+ * @param prev_buffer: buffer for previous reply.
	*/
	static void
	mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
	- struct mesh_reply* r, struct mesh_reply* prev)
	+ struct mesh_reply* r, struct sldns_buffer* r_buffer,
	+ struct mesh_reply* prev, struct sldns_buffer* prev_buffer)
	{
	struct timeval end_time;
	struct timeval duration;
	int secure;
	/* Copy the client's EDNS for later restore, to make sure the edns
	* compare is with the correct edns options. */
	struct edns_data edns_bak = r->edns;
	/* examine security status */
	if(m->s.env->need_to_validate && (!(r->qflags&BIT_CD) \|\|
	m->s.env->cfg->ignore_cd) && rep &&
	(rep->security <= sec_status_bogus \|\|
	rep->security == sec_status_secure_sentinel_fail)) {
	rcode = LDNS_RCODE_SERVFAIL;
	if(m->s.env->cfg->stat_extended)
	m->s.env->mesh->ans_bogus++;
	}
	if(rep && rep->security == sec_status_secure)
	secure = 1;
	else secure = 0;
	if(!rep && rcode == LDNS_RCODE_NOERROR)
	rcode = LDNS_RCODE_SERVFAIL;
	/* send the reply */
	/* We don't reuse the encoded answer if either the previous or current
	* response has a local alias. We could compare the alias records
	* and still reuse the previous answer if they are the same, but that
	* would be complicated and error prone for the relatively minor case.
	* So we err on the side of safety. */
	- if(prev && prev->qflags == r->qflags &&
	+ if(prev && prev_buffer && prev->qflags == r->qflags &&
	!prev->local_alias && !r->local_alias &&
	prev->edns.edns_present == r->edns.edns_present &&
	prev->edns.bits == r->edns.bits &&
	prev->edns.udp_size == r->edns.udp_size &&
	edns_opt_list_compare(prev->edns.opt_list, r->edns.opt_list)
	== 0) {
	/* if the previous reply is identical to this one, fix ID */
	- if(prev->query_reply.c->buffer != r->query_reply.c->buffer)
	- sldns_buffer_copy(r->query_reply.c->buffer,
	- prev->query_reply.c->buffer);
	- sldns_buffer_write_at(r->query_reply.c->buffer, 0,
	- &r->qid, sizeof(uint16_t));
	- sldns_buffer_write_at(r->query_reply.c->buffer, 12,
	- r->qname, m->s.qinfo.qname_len);
	+ if(prev_buffer != r_buffer)
	+ sldns_buffer_copy(r_buffer, prev_buffer);
	+ sldns_buffer_write_at(r_buffer, 0, &r->qid, sizeof(uint16_t));
	+ sldns_buffer_write_at(r_buffer, 12, r->qname,
	+ m->s.qinfo.qname_len);
	comm_point_send_reply(&r->query_reply);
	} else if(rcode) {
	m->s.qinfo.qname = r->qname;
	m->s.qinfo.local_alias = r->local_alias;
	if(rcode == LDNS_RCODE_SERVFAIL) {
	if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
	rep, rcode, &r->edns, NULL, m->s.region))
	r->edns.opt_list = NULL;
	} else {
	if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode,
	&r->edns, NULL, m->s.region))
	r->edns.opt_list = NULL;
	}
	- error_encode(r->query_reply.c->buffer, rcode, &m->s.qinfo,
	- r->qid, r->qflags, &r->edns);
	+ error_encode(r_buffer, rcode, &m->s.qinfo, r->qid,
	+ r->qflags, &r->edns);
	comm_point_send_reply(&r->query_reply);
	} else {
	size_t udp_size = r->edns.udp_size;
	r->edns.edns_version = EDNS_ADVERTISED_VERSION;
	r->edns.udp_size = EDNS_ADVERTISED_SIZE;
	r->edns.ext_rcode = 0;
	r->edns.bits &= EDNS_DO;
	m->s.qinfo.qname = r->qname;
	m->s.qinfo.local_alias = r->local_alias;
	if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep,
	LDNS_RCODE_NOERROR, &r->edns, NULL, m->s.region) \|\|
	!apply_edns_options(&r->edns, &edns_bak,
	m->s.env->cfg, r->query_reply.c,
	m->s.region) \|\|
	!reply_info_answer_encode(&m->s.qinfo, rep, r->qid,
	- r->qflags, r->query_reply.c->buffer, 0, 1,
	- m->s.env->scratch, udp_size, &r->edns,
	- (int)(r->edns.bits & EDNS_DO), secure))
	+ r->qflags, r_buffer, 0, 1, m->s.env->scratch,
	+ udp_size, &r->edns, (int)(r->edns.bits & EDNS_DO),
	+ secure))
	{
	if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
	rep, LDNS_RCODE_SERVFAIL, &r->edns, NULL, m->s.region))
	r->edns.opt_list = NULL;
	- error_encode(r->query_reply.c->buffer,
	- LDNS_RCODE_SERVFAIL, &m->s.qinfo, r->qid,
	- r->qflags, &r->edns);
	+ error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
	+ &m->s.qinfo, r->qid, r->qflags, &r->edns);
	}
	r->edns = edns_bak;
	comm_point_send_reply(&r->query_reply);
	}
	/* account */
	m->s.env->mesh->num_reply_addrs--;
	end_time = *m->s.env->now_tv;
	timeval_subtract(&duration, &end_time, &r->start_time);
	verbose(VERB_ALGO, "query took " ARG_LL "d.%6.6d sec",
	(long long)duration.tv_sec, (int)duration.tv_usec);
	m->s.env->mesh->replies_sent++;
	timeval_add(&m->s.env->mesh->replies_sum_wait, &duration);
	timehist_insert(m->s.env->mesh->histogram, &duration);
	if(m->s.env->cfg->stat_extended) {
	- uint16_t rc = FLAGS_GET_RCODE(sldns_buffer_read_u16_at(r->
	- query_reply.c->buffer, 2));
	+ uint16_t rc = FLAGS_GET_RCODE(sldns_buffer_read_u16_at(
	+ r_buffer, 2));
	if(secure) m->s.env->mesh->ans_secure++;
	m->s.env->mesh->ans_rcode[ rc ] ++;
	- if(rc == 0 && LDNS_ANCOUNT(sldns_buffer_begin(r->
	- query_reply.c->buffer)) == 0)
	+ if(rc == 0 && LDNS_ANCOUNT(sldns_buffer_begin(r_buffer)) == 0)
	m->s.env->mesh->ans_nodata++;
	}
	/* Log reply sent */
	if(m->s.env->cfg->log_replies) {
	log_reply_info(0, &m->s.qinfo, &r->query_reply.addr,
	- r->query_reply.addrlen, duration, 0,
	- r->query_reply.c->buffer);
	+ r->query_reply.addrlen, duration, 0, r_buffer);
	}
	}

	void mesh_query_done(struct mesh_state* mstate)
	{
	struct mesh_reply* r;
	struct mesh_reply* prev = NULL;
	+ struct sldns_buffer* prev_buffer = NULL;
	struct mesh_cb* c;
	struct reply_info* rep = (mstate->s.return_msg?
	mstate->s.return_msg->rep:NULL);
	if((mstate->s.return_rcode == LDNS_RCODE_SERVFAIL \|\|
	(rep && FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_SERVFAIL))
	&& mstate->s.env->cfg->log_servfail
	&& !mstate->s.env->cfg->val_log_squelch) {
	char* err = errinf_to_str_servfail(&mstate->s);
	if(err)
	log_err("%s", err);
	free(err);
	}
	for(r = mstate->reply_list; r; r = r->next) {
	/* if a response-ip address block has been stored the
	* information should be logged for each client. */
	if(mstate->s.respip_action_info &&
	mstate->s.respip_action_info->addrinfo) {
	respip_inform_print(mstate->s.respip_action_info->addrinfo,
	r->qname, mstate->s.qinfo.qtype,
	mstate->s.qinfo.qclass, r->local_alias,
	&r->query_reply);
	}

	/* if this query is determined to be dropped during the
	* mesh processing, this is the point to take that action. */
	if(mstate->s.is_drop)
	comm_point_drop_reply(&r->query_reply);
	else {
	+ struct sldns_buffer* r_buffer = r->query_reply.c->buffer;
	+ if(r->query_reply.c->tcp_req_info) {
	+ r_buffer = r->query_reply.c->tcp_req_info->spool_buffer;
	+ prev_buffer = NULL;
	+ }
	mesh_send_reply(mstate, mstate->s.return_rcode, rep,
	- r, prev);
	+ r, r_buffer, prev, prev_buffer);
	+ if(r->query_reply.c->tcp_req_info) {
	+ tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);
	+ r_buffer = NULL;
	+ }
	prev = r;
	+ prev_buffer = r_buffer;
	}
	}
	mstate->replies_sent = 1;
	while((c = mstate->cb_list) != NULL) {
	/* take this cb off the list; so that the list can be
	* changed, eg. by adds from the callback routine */
	if(!mstate->reply_list && mstate->cb_list && !c->next) {
	/* was a reply state, not anymore */
	mstate->s.env->mesh->num_reply_states--;
	}
	mstate->cb_list = c->next;
	if(!mstate->reply_list && !mstate->cb_list &&
	mstate->super_set.count == 0)
	mstate->s.env->mesh->num_detached_states++;
	mesh_do_callback(mstate, mstate->s.return_rcode, rep, c);
	}
	}

	void mesh_walk_supers(struct mesh_area* mesh, struct mesh_state* mstate)
	{
	struct mesh_state_ref* ref;
	RBTREE_FOR(ref, struct mesh_state_ref*, &mstate->super_set)
	{
	/* make super runnable */
	(void)rbtree_insert(&mesh->run, &ref->s->run_node);
	/* callback the function to inform super of result */
	fptr_ok(fptr_whitelist_mod_inform_super(
	mesh->mods.mod[ref->s->s.curmod]->inform_super));
	(*mesh->mods.mod[ref->s->s.curmod]->inform_super)(&mstate->s,
	ref->s->s.curmod, &ref->s->s);
	/* copy state that is always relevant to super */
	copy_state_to_super(&mstate->s, ref->s->s.curmod, &ref->s->s);
	}
	}

	struct mesh_state* mesh_area_find(struct mesh_area* mesh,
	struct respip_client_info* cinfo, struct query_info* qinfo,
	uint16_t qflags, int prime, int valrec)
	{
	struct mesh_state key;
	struct mesh_state* result;

	key.node.key = &key;
	key.s.is_priming = prime;
	key.s.is_valrec = valrec;
	key.s.qinfo = *qinfo;
	key.s.query_flags = qflags;
	/* We are searching for a similar mesh state when we DO want to
	* aggregate the state. Thus unique is set to NULL. (default when we
	* desire aggregation).*/
	key.unique = NULL;
	key.s.client_info = cinfo;

	result = (struct mesh_state*)rbtree_search(&mesh->all, &key);
	return result;
	}

	int mesh_state_add_cb(struct mesh_state* s, struct edns_data* edns,
	sldns_buffer* buf, mesh_cb_func_type cb, void* cb_arg,
	uint16_t qid, uint16_t qflags)
	{
	struct mesh_cb* r = regional_alloc(s->s.region,
	sizeof(struct mesh_cb));
	if(!r)
	return 0;
	r->buf = buf;
	log_assert(fptr_whitelist_mesh_cb(cb)); /* early failure ifmissing*/
	r->cb = cb;
	r->cb_arg = cb_arg;
	r->edns = *edns;
	if(edns->opt_list) {
	r->edns.opt_list = edns_opt_copy_region(edns->opt_list,
	s->s.region);
	if(!r->edns.opt_list)
	return 0;
	}
	r->qid = qid;
	r->qflags = qflags;
	r->next = s->cb_list;
	s->cb_list = r;
	return 1;

	}

	int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
	struct comm_reply* rep, uint16_t qid, uint16_t qflags,
	const struct query_info* qinfo)
	{
	struct mesh_reply* r = regional_alloc(s->s.region,
	sizeof(struct mesh_reply));
	if(!r)
	return 0;
	r->query_reply = *rep;
	r->edns = *edns;
	if(edns->opt_list) {
	r->edns.opt_list = edns_opt_copy_region(edns->opt_list,
	s->s.region);
	if(!r->edns.opt_list)
	return 0;
	}
	r->qid = qid;
	r->qflags = qflags;
	r->start_time = *s->s.env->now_tv;
	r->next = s->reply_list;
	r->qname = regional_alloc_init(s->s.region, qinfo->qname,
	s->s.qinfo.qname_len);
	if(!r->qname)
	return 0;

	/* Data related to local alias stored in 'qinfo' (if any) is ephemeral
	* and can be different for different original queries (even if the
	* replaced query name is the same). So we need to make a deep copy
	* and store the copy for each reply info. */
	if(qinfo->local_alias) {
	struct packed_rrset_data* d;
	struct packed_rrset_data* dsrc;
	r->local_alias = regional_alloc_zero(s->s.region,
	sizeof(*qinfo->local_alias));
	if(!r->local_alias)
	return 0;
	r->local_alias->rrset = regional_alloc_init(s->s.region,
	qinfo->local_alias->rrset,
	sizeof(*qinfo->local_alias->rrset));
	if(!r->local_alias->rrset)
	return 0;
	dsrc = qinfo->local_alias->rrset->entry.data;

	/* In the current implementation, a local alias must be
	* a single CNAME RR (see worker_handle_request()). */
	log_assert(!qinfo->local_alias->next && dsrc->count == 1 &&
	qinfo->local_alias->rrset->rk.type ==
	htons(LDNS_RR_TYPE_CNAME));
	/* Technically, we should make a local copy for the owner
	* name of the RRset, but in the case of the first (and
	* currently only) local alias RRset, the owner name should
	* point to the qname of the corresponding query, which should
	* be valid throughout the lifetime of this mesh_reply. So
	* we can skip copying. */
	log_assert(qinfo->local_alias->rrset->rk.dname ==
	sldns_buffer_at(rep->c->buffer, LDNS_HEADER_SIZE));

	- d = regional_alloc_init(s->s.region, dsrc,
	- sizeof(struct packed_rrset_data)
	- + sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t));
	+ /* the rrset is not packed, like in the cache, but it is
	+ * individualy allocated with an allocator from localzone. */
	+ d = regional_alloc_zero(s->s.region, sizeof(*d));
	if(!d)
	return 0;
	r->local_alias->rrset->entry.data = d;
	- d->rr_len = (size_t)((uint8_t)d +
	- sizeof(struct packed_rrset_data));
	- d->rr_data = (uint8_t**)&(d->rr_len[1]);
	- d->rr_ttl = (time_t*)&(d->rr_data[1]);
	- d->rr_len[0] = dsrc->rr_len[0];
	- d->rr_ttl[0] = dsrc->rr_ttl[0];
	- d->rr_data[0] = regional_alloc_init(s->s.region,
	- dsrc->rr_data[0], d->rr_len[0]);
	- if(!d->rr_data[0])
	+ if(!rrset_insert_rr(s->s.region, d, dsrc->rr_data[0],
	+ dsrc->rr_len[0], dsrc->rr_ttl[0], "CNAME local alias"))
	return 0;
	} else
	r->local_alias = NULL;

	s->reply_list = r;
	return 1;
	}

	/* Extract the query info and flags from 'mstate' into 'qinfop' and 'qflags'.
	* Since this is only used for internal refetch of otherwise-expired answer,
	* we simply ignore the rare failure mode when memory allocation fails. */
	static void
	mesh_copy_qinfo(struct mesh_state* mstate, struct query_info** qinfop,
	uint16_t* qflags)
	{
	struct regional* region = mstate->s.env->scratch;
	struct query_info* qinfo;

	qinfo = regional_alloc_init(region, &mstate->s.qinfo, sizeof(*qinfo));
	if(!qinfo)
	return;
	qinfo->qname = regional_alloc_init(region, qinfo->qname,
	qinfo->qname_len);
	if(!qinfo->qname)
	return;
	*qinfop = qinfo;
	*qflags = mstate->s.query_flags;
	}

	/**
	* Continue processing the mesh state at another module.
	* Handles module to modules transfer of control.
	* Handles module finished.
	* @param mesh: the mesh area.
	* @param mstate: currently active mesh state.
	* Deleted if finished, calls _done and _supers to
	* send replies to clients and inform other mesh states.
	* This in turn may create additional runnable mesh states.
	* @param s: state at which the current module exited.
	* @param ev: the event sent to the module.
	* returned is the event to send to the next module.
	* @return true if continue processing at the new module.
	* false if not continued processing is needed.
	*/
	static int
	mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate,
	enum module_ext_state s, enum module_ev* ev)
	{
	mstate->num_activated++;
	if(mstate->num_activated > MESH_MAX_ACTIVATION) {
	/* module is looping. Stop it. */
	log_err("internal error: looping module (%s) stopped",
	mesh->mods.mod[mstate->s.curmod]->name);
	- log_query_info(VERB_QUERY, "pass error for qstate",
	+ log_query_info(0, "pass error for qstate",
	&mstate->s.qinfo);
	s = module_error;
	}
	if(s == module_wait_module \|\| s == module_restart_next) {
	/* start next module */
	mstate->s.curmod++;
	if(mesh->mods.num == mstate->s.curmod) {
	log_err("Cannot pass to next module; at last module");
	log_query_info(VERB_QUERY, "pass error for qstate",
	&mstate->s.qinfo);
	mstate->s.curmod--;
	return mesh_continue(mesh, mstate, module_error, ev);
	}
	if(s == module_restart_next) {
	int curmod = mstate->s.curmod;
	for(; mstate->s.curmod < mesh->mods.num;
	mstate->s.curmod++) {
	fptr_ok(fptr_whitelist_mod_clear(
	mesh->mods.mod[mstate->s.curmod]->clear));
	(*mesh->mods.mod[mstate->s.curmod]->clear)
	(&mstate->s, mstate->s.curmod);
	mstate->s.minfo[mstate->s.curmod] = NULL;
	}
	mstate->s.curmod = curmod;
	}
	*ev = module_event_pass;
	return 1;
	}
	if(s == module_wait_subquery && mstate->sub_set.count == 0) {
	log_err("module cannot wait for subquery, subquery list empty");
	log_query_info(VERB_QUERY, "pass error for qstate",
	&mstate->s.qinfo);
	s = module_error;
	}
	if(s == module_error && mstate->s.return_rcode == LDNS_RCODE_NOERROR) {
	/* error is bad, handle pass back up below */
	mstate->s.return_rcode = LDNS_RCODE_SERVFAIL;
	}
	if(s == module_error) {
	mesh_query_done(mstate);
	mesh_walk_supers(mesh, mstate);
	mesh_state_delete(&mstate->s);
	return 0;
	}
	if(s == module_finished) {
	if(mstate->s.curmod == 0) {
	struct query_info* qinfo = NULL;
	uint16_t qflags;

	mesh_query_done(mstate);
	mesh_walk_supers(mesh, mstate);

	/* If the answer to the query needs to be refetched
	* from an external DNS server, we'll need to schedule
	* a prefetch after removing the current state, so
	* we need to make a copy of the query info here. */
	if(mstate->s.need_refetch)
	mesh_copy_qinfo(mstate, &qinfo, &qflags);

	mesh_state_delete(&mstate->s);
	if(qinfo) {
	mesh_schedule_prefetch(mesh, qinfo, qflags,
	0, 1);
	}
	return 0;
	}
	/* pass along the locus of control */
	mstate->s.curmod --;
	*ev = module_event_moddone;
	return 1;
	}
	return 0;
	}

	void mesh_run(struct mesh_area* mesh, struct mesh_state* mstate,
	enum module_ev ev, struct outbound_entry* e)
	{
	enum module_ext_state s;
	verbose(VERB_ALGO, "mesh_run: start");
	while(mstate) {
	/* run the module */
	fptr_ok(fptr_whitelist_mod_operate(
	mesh->mods.mod[mstate->s.curmod]->operate));
	(*mesh->mods.mod[mstate->s.curmod]->operate)
	(&mstate->s, ev, mstate->s.curmod, e);

	/* examine results */
	mstate->s.reply = NULL;
	regional_free_all(mstate->s.env->scratch);
	s = mstate->s.ext_state[mstate->s.curmod];
	verbose(VERB_ALGO, "mesh_run: %s module exit state is %s",
	mesh->mods.mod[mstate->s.curmod]->name, strextstate(s));
	e = NULL;
	if(mesh_continue(mesh, mstate, s, &ev))
	continue;

	/* run more modules */
	ev = module_event_pass;
	if(mesh->run.count > 0) {
	/* pop random element off the runnable tree */
	mstate = (struct mesh_state*)mesh->run.root->key;
	(void)rbtree_delete(&mesh->run, mstate);
	} else mstate = NULL;
	}
	if(verbosity >= VERB_ALGO) {
	mesh_stats(mesh, "mesh_run: end");
	mesh_log_list(mesh);
	}
	}

	void
	mesh_log_list(struct mesh_area* mesh)
	{
	char buf[30];
	struct mesh_state* m;
	int num = 0;
	RBTREE_FOR(m, struct mesh_state*, &mesh->all) {
	snprintf(buf, sizeof(buf), "%d%s%s%s%s%s%s mod%d %s%s",
	num++, (m->s.is_priming)?"p":"", /* prime */
	(m->s.is_valrec)?"v":"", /* prime */
	(m->s.query_flags&BIT_RD)?"RD":"",
	(m->s.query_flags&BIT_CD)?"CD":"",
	(m->super_set.count==0)?"d":"", /* detached */
	(m->sub_set.count!=0)?"c":"", /* children */
	m->s.curmod, (m->reply_list)?"rep":"", /hasreply/
	(m->cb_list)?"cb":"" /* callbacks */
	);
	log_query_info(VERB_ALGO, buf, &m->s.qinfo);
	}
	}

	void
	mesh_stats(struct mesh_area* mesh, const char* str)
	{
	verbose(VERB_DETAIL, "%s %u recursion states (%u with reply, "
	"%u detached), %u waiting replies, %u recursion replies "
	"sent, %d replies dropped, %d states jostled out",
	str, (unsigned)mesh->all.count,
	(unsigned)mesh->num_reply_states,
	(unsigned)mesh->num_detached_states,
	(unsigned)mesh->num_reply_addrs,
	(unsigned)mesh->replies_sent,
	(unsigned)mesh->stats_dropped,
	(unsigned)mesh->stats_jostled);
	if(mesh->replies_sent > 0) {
	struct timeval avg;
	timeval_divide(&avg, &mesh->replies_sum_wait,
	mesh->replies_sent);
	log_info("average recursion processing time "
	ARG_LL "d.%6.6d sec",
	(long long)avg.tv_sec, (int)avg.tv_usec);
	log_info("histogram of recursion processing times");
	timehist_log(mesh->histogram, "recursions");
	}
	}

	void
	mesh_stats_clear(struct mesh_area* mesh)
	{
	if(!mesh)
	return;
	mesh->replies_sent = 0;
	mesh->replies_sum_wait.tv_sec = 0;
	mesh->replies_sum_wait.tv_usec = 0;
	mesh->stats_jostled = 0;
	mesh->stats_dropped = 0;
	timehist_clear(mesh->histogram);
	mesh->ans_secure = 0;
	mesh->ans_bogus = 0;
	memset(&mesh->ans_rcode[0], 0, sizeof(size_t)*16);
	mesh->ans_nodata = 0;
	}

	size_t
	mesh_get_mem(struct mesh_area* mesh)
	{
	struct mesh_state* m;
	size_t s = sizeof(*mesh) + sizeof(struct timehist) +
	sizeof(struct th_buck)*mesh->histogram->num +
	sizeof(sldns_buffer) + sldns_buffer_capacity(mesh->qbuf_bak);
	RBTREE_FOR(m, struct mesh_state*, &mesh->all) {
	/* all, including m itself allocated in qstate region */
	s += regional_get_mem(m->s.region);
	}
	return s;
	}

	int
	mesh_detect_cycle(struct module_qstate* qstate, struct query_info* qinfo,
	uint16_t flags, int prime, int valrec)
	{
	struct mesh_area* mesh = qstate->env->mesh;
	struct mesh_state* dep_m = NULL;
	if(!mesh_state_is_unique(qstate->mesh_info))
	dep_m = mesh_area_find(mesh, NULL, qinfo, flags, prime, valrec);
	return mesh_detect_cycle_found(qstate, dep_m);
	}

	void mesh_list_insert(struct mesh_state* m, struct mesh_state** fp,
	struct mesh_state** lp)
	{
	/* insert as last element */
	m->prev = *lp;
	m->next = NULL;
	if(*lp)
	(*lp)->next = m;
	else *fp = m;
	*lp = m;
	}

	void mesh_list_remove(struct mesh_state* m, struct mesh_state** fp,
	struct mesh_state** lp)
	{
	if(m->next)
	m->next->prev = m->prev;
	else *lp = m->prev;
	if(m->prev)
	m->prev->next = m->next;
	else *fp = m->next;
	+}
	+
	+void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
	+ struct comm_point* cp)
	+{
	+ struct mesh_reply* n, *prev = NULL;
	+ n = m->reply_list;
	+ /* when in mesh_cleanup, it sets the reply_list to NULL, so that
	+ * there is no accounting twice */
	+ if(!n) return; /* nothing to remove, also no accounting needed */
	+ while(n) {
	+ if(n->query_reply.c == cp) {
	+ /* unlink it */
	+ if(prev) prev->next = n->next;
	+ else m->reply_list = n->next;
	+ /* delete it, but allocated in m region */
	+ mesh->num_reply_addrs--;
	+
	+ /* prev = prev; */
	+ n = n->next;
	+ continue;
	+ }
	+ prev = n;
	+ n = n->next;
	+ }
	+ /* it was not detached (because it had a reply list), could be now */
	+ if(!m->reply_list && !m->cb_list
	+ && m->super_set.count == 0) {
	+ mesh->num_detached_states++;
	+ }
	+ /* if not replies any more in mstate, it is no longer a reply_state */
	+ if(!m->reply_list && !m->cb_list) {
	+ log_assert(mesh->num_reply_states > 0);
	+ mesh->num_reply_states--;
	+ }
	}
	Index: head/contrib/unbound/services/mesh.h
	===================================================================
	--- head/contrib/unbound/services/mesh.h (revision 349719)
	+++ head/contrib/unbound/services/mesh.h (revision 349720)
	@@ -1,636 +1,646 @@
	/*
	* services/mesh.h - deal with mesh of query states and handle events for that.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains functions to assist in dealing with a mesh of
	* query states. This mesh is supposed to be thread-specific.
	* It consists of query states (per qname, qtype, qclass) and connections
	* between query states and the super and subquery states, and replies to
	* send back to clients.
	*/

	#ifndef SERVICES_MESH_H
	#define SERVICES_MESH_H

	#include "util/rbtree.h"
	#include "util/netevent.h"
	#include "util/data/msgparse.h"
	#include "util/module.h"
	#include "services/modstack.h"
	struct sldns_buffer;
	struct mesh_state;
	struct mesh_reply;
	struct mesh_cb;
	struct query_info;
	struct reply_info;
	struct outbound_entry;
	struct timehist;
	struct respip_client_info;

	/**
	* Maximum number of mesh state activations. Any more is likely an
	* infinite loop in the module. It is then terminated.
	*/
	-#define MESH_MAX_ACTIVATION 3000
	+#define MESH_MAX_ACTIVATION 10000

	/**
	* Max number of references-to-references-to-references.. search size.
	* Any more is treated like 'too large', and the creation of a new
	* dependency is failed (so that no loops can be created).
	*/
	#define MESH_MAX_SUBSUB 1024

	/**
	* Mesh of query states
	*/
	struct mesh_area {
	/** active module stack */
	struct module_stack mods;
	/** environment for new states */
	struct module_env* env;

	/** set of runnable queries (mesh_state.run_node) */
	rbtree_type run;
	/** rbtree of all current queries (mesh_state.node)*/
	rbtree_type all;

	/** count of the total number of mesh_reply entries */
	size_t num_reply_addrs;
	/** count of the number of mesh_states that have mesh_replies
	* Because a state can send results to multiple reply addresses,
	* this number must be equal or lower than num_reply_addrs. */
	size_t num_reply_states;
	/** number of mesh_states that have no mesh_replies, and also
	* an empty set of super-states, thus are 'toplevel' or detached
	* internal opportunistic queries */
	size_t num_detached_states;
	/** number of reply states in the forever list */
	size_t num_forever_states;

	/** max total number of reply states to have */
	size_t max_reply_states;
	/** max forever number of reply states to have */
	size_t max_forever_states;

	/** stats, cumulative number of reply states jostled out */
	size_t stats_jostled;
	/** stats, cumulative number of incoming client msgs dropped */
	size_t stats_dropped;
	/** number of replies sent */
	size_t replies_sent;
	/** sum of waiting times for the replies */
	struct timeval replies_sum_wait;
	/** histogram of time values */
	struct timehist* histogram;
	/** (extended stats) secure replies */
	size_t ans_secure;
	/** (extended stats) bogus replies */
	size_t ans_bogus;
	/** (extended stats) rcodes in replies */
	size_t ans_rcode[16];
	/** (extended stats) rcode nodata in replies */
	size_t ans_nodata;

	/** backup of query if other operations recurse and need the
	* network buffers */
	struct sldns_buffer* qbuf_bak;

	/** double linked list of the run-to-completion query states.
	* These are query states with a reply */
	struct mesh_state* forever_first;
	/** last entry in run forever list */
	struct mesh_state* forever_last;

	/** double linked list of the query states that can be jostled out
	* by new queries if too old. These are query states with a reply */
	struct mesh_state* jostle_first;
	/** last entry in jostle list - this is the entry that is newest */
	struct mesh_state* jostle_last;
	/** timeout for jostling. if age is lower, it does not get jostled. */
	struct timeval jostle_max;
	};

	/**
	* A mesh query state
	* Unique per qname, qtype, qclass (from the qstate).
	* And RD / CD flag; in case a client turns it off.
	* And priming queries are different from ordinary queries (because of hints).
	*
	* The entire structure is allocated in a region, this region is the qstate
	* region. All parts (rbtree nodes etc) are also allocated in the region.
	*/
	struct mesh_state {
	/** node in mesh_area all tree, key is this struct. Must be first. */
	rbnode_type node;
	/** node in mesh_area runnable tree, key is this struct */
	rbnode_type run_node;
	/** the query state. Note that the qinfo and query_flags
	* may not change. */
	struct module_qstate s;
	/** the list of replies to clients for the results */
	struct mesh_reply* reply_list;
	/** the list of callbacks for the results */
	struct mesh_cb* cb_list;
	/** set of superstates (that want this state's result)
	* contains struct mesh_state_ref* */
	rbtree_type super_set;
	/** set of substates (that this state needs to continue)
	* contains struct mesh_state_ref* */
	rbtree_type sub_set;
	/** number of activations for the mesh state */
	size_t num_activated;

	/** previous in linked list for reply states */
	struct mesh_state* prev;
	/** next in linked list for reply states */
	struct mesh_state* next;
	/** if this state is in the forever list, jostle list, or neither */
	enum mesh_list_select { mesh_no_list, mesh_forever_list,
	mesh_jostle_list } list_select;
	/** pointer to this state for uniqueness or NULL */
	struct mesh_state* unique;

	/** true if replies have been sent out (at end for alignment) */
	uint8_t replies_sent;
	};

	/**
	* Rbtree reference to a mesh_state.
	* Used in super_set and sub_set.
	*/
	struct mesh_state_ref {
	/** node in rbtree for set, key is this structure */
	rbnode_type node;
	/** the mesh state */
	struct mesh_state* s;
	};

	/**
	* Reply to a client
	*/
	struct mesh_reply {
	/** next in reply list */
	struct mesh_reply* next;
	/** the query reply destination, packet buffer and where to send. */
	struct comm_reply query_reply;
	/** edns data from query */
	struct edns_data edns;
	/** the time when request was entered */
	struct timeval start_time;
	/** id of query, in network byteorder. */
	uint16_t qid;
	/** flags of query, for reply flags */
	uint16_t qflags;
	/** qname from this query. len same as mesh qinfo. */
	uint8_t* qname;
	/** same as that in query_info. */
	struct local_rrset* local_alias;
	};

	/**
	* Mesh result callback func.
	* called as func(cb_arg, rcode, buffer_with_reply, security, why_bogus,
	* was_ratelimited);
	*/
	typedef void (mesh_cb_func_type)(void cb_arg, int rcode, struct sldns_buffer*,
	enum sec_status, char* why_bogus, int was_ratelimited);

	/**
	* Callback to result routine
	*/
	struct mesh_cb {
	/** next in list */
	struct mesh_cb* next;
	/** edns data from query */
	struct edns_data edns;
	/** id of query, in network byteorder. */
	uint16_t qid;
	/** flags of query, for reply flags */
	uint16_t qflags;
	/** buffer for reply */
	struct sldns_buffer* buf;
	/** callback routine for results. if rcode != 0 buf has message.
	* called as cb(cb_arg, rcode, buf, sec_state, why_bogus, was_ratelimited);
	*/
	mesh_cb_func_type cb;
	/** user arg for callback */
	void* cb_arg;
	};

	/* ------------------- Functions for worker -------------------- */

	/**
	* Allocate mesh, to empty.
	* @param stack: module stack to activate, copied (as readonly reference).
	* @param env: environment for new queries.
	* @return mesh: the new mesh or NULL on error.
	*/
	struct mesh_area* mesh_create(struct module_stack* stack,
	struct module_env* env);

	/**
	* Delete mesh, and all query states and replies in it.
	* @param mesh: the mesh to delete.
	*/
	void mesh_delete(struct mesh_area* mesh);

	/**
	* New query incoming from clients. Create new query state if needed, and
	* add mesh_reply to it. Returns error to client on malloc failures.
	* Will run the mesh area queries to process if a new query state is created.
	*
	* @param mesh: the mesh.
	* @param qinfo: query from client.
	* @param cinfo: additional information associated with the query client.
	* 'cinfo' itself is ephemeral but data pointed to by its members
	* can be assumed to be valid and unchanged until the query processing is
	* completed.
	* @param qflags: flags from client query.
	* @param edns: edns data from client query.
	* @param rep: where to reply to.
	* @param qid: query id to reply with.
	*/
	void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
	struct respip_client_info* cinfo, uint16_t qflags,
	struct edns_data* edns, struct comm_reply* rep, uint16_t qid);

	/**
	* New query with callback. Create new query state if needed, and
	* add mesh_cb to it.
	* Will run the mesh area queries to process if a new query state is created.
	*
	* @param mesh: the mesh.
	* @param qinfo: query from client.
	* @param qflags: flags from client query.
	* @param edns: edns data from client query.
	* @param buf: buffer for reply contents.
	* @param qid: query id to reply with.
	* @param cb: callback function.
	* @param cb_arg: callback user arg.
	* @return 0 on error.
	*/
	int mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
	uint16_t qflags, struct edns_data* edns, struct sldns_buffer* buf,
	uint16_t qid, mesh_cb_func_type cb, void* cb_arg);

	/**
	* New prefetch message. Create new query state if needed.
	* Will run the mesh area queries to process if a new query state is created.
	*
	* @param mesh: the mesh.
	* @param qinfo: query from client.
	* @param qflags: flags from client query.
	* @param leeway: TTL leeway what to expire earlier for this update.
	*/
	void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
	uint16_t qflags, time_t leeway);

	/**
	* Handle new event from the wire. A serviced query has returned.
	* The query state will be made runnable, and the mesh_area will process
	* query states until processing is complete.
	*
	* @param mesh: the query mesh.
	* @param e: outbound entry, with query state to run and reply pointer.
	* @param reply: the comm point reply info.
	* @param what: NETEVENT_* error code (if not 0, what is wrong, TIMEOUT).
	*/
	void mesh_report_reply(struct mesh_area* mesh, struct outbound_entry* e,
	struct comm_reply* reply, int what);

	/* ------------------- Functions for module environment --------------- */

	/**
	* Detach-subqueries.
	* Remove all sub-query references from this query state.
	* Keeps super-references of those sub-queries correct.
	* Updates stat items in mesh_area structure.
	* @param qstate: used to find mesh state.
	*/
	void mesh_detach_subs(struct module_qstate* qstate);

	/**
	* Attach subquery.
	* Creates it if it does not exist already.
	* Keeps sub and super references correct.
	* Performs a cycle detection - for double check - and fails if there is one.
	* Also fails if the sub-sub-references become too large.
	* Updates stat items in mesh_area structure.
	* Pass if it is priming query or not.
	* return:
	* o if error (malloc) happened.
	* o need to initialise the new state (module init; it is a new state).
	* so that the next run of the query with this module is successful.
	* o no init needed, attachment successful.
	*
	* @param qstate: the state to find mesh state, and that wants to receive
	* the results from the new subquery.
	* @param qinfo: what to query for (copied).
	* @param qflags: what flags to use (RD / CD flag or not).
	* @param prime: if it is a (stub) priming query.
	* @param valrec: if it is a validation recursion query (lookup of key, DS).
	* @param newq: If the new subquery needs initialisation, it is returned,
	* otherwise NULL is returned.
	* @return: false on error, true if success (and init may be needed).
	*/
	int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
	uint16_t qflags, int prime, int valrec, struct module_qstate** newq);

	/**
	* Add detached query.
	* Creates it if it does not exist already.
	* Does not make super/sub references.
	* Performs a cycle detection - for double check - and fails if there is one.
	* Updates stat items in mesh_area structure.
	* Pass if it is priming query or not.
	* return:
	* o if error (malloc) happened.
	* o need to initialise the new state (module init; it is a new state).
	* so that the next run of the query with this module is successful.
	* o no init needed, attachment successful.
	* o added subquery, created if it did not exist already.
	*
	* @param qstate: the state to find mesh state, and that wants to receive
	* the results from the new subquery.
	* @param qinfo: what to query for (copied).
	* @param qflags: what flags to use (RD / CD flag or not).
	* @param prime: if it is a (stub) priming query.
	* @param valrec: if it is a validation recursion query (lookup of key, DS).
	* @param newq: If the new subquery needs initialisation, it is returned,
	* otherwise NULL is returned.
	* @param sub: The added mesh state, created if it did not exist already.
	* @return: false on error, true if success (and init may be needed).
	*/
	int mesh_add_sub(struct module_qstate* qstate, struct query_info* qinfo,
	uint16_t qflags, int prime, int valrec, struct module_qstate** newq,
	struct mesh_state** sub);

	/**
	* Query state is done, send messages to reply entries.
	* Encode messages using reply entry values and the querystate (with original
	* qinfo), using given reply_info.
	* Pass errcode != 0 if an error reply is needed.
	* If no reply entries, nothing is done.
	* Must be called before a module can module_finished or return module_error.
	* The module must handle the super query states itself as well.
	*
	* @param mstate: mesh state that is done. return_rcode and return_msg
	* are used for replies.
	* return_rcode: if not 0 (NOERROR) an error is sent back (and
	* return_msg is ignored).
	* return_msg: reply to encode and send back to clients.
	*/
	void mesh_query_done(struct mesh_state* mstate);

	/**
	* Call inform_super for the super query states that are interested in the
	* results from this query state. These can then be changed for error
	* or results.
	* Called when a module is module_finished or returns module_error.
	* The super query states become runnable with event module_event_pass,
	* it calls the current module for the super with the inform_super event.
	*
	* @param mesh: mesh area to add newly runnable modules to.
	* @param mstate: the state that has results, used to find mesh state.
	*/
	void mesh_walk_supers(struct mesh_area* mesh, struct mesh_state* mstate);

	/**
	* Delete mesh state, cleanup and also rbtrees and so on.
	* Will detach from all super/subnodes.
	* @param qstate: to remove.
	*/
	void mesh_state_delete(struct module_qstate* qstate);

	/* ------------------- Functions for mesh -------------------- */

	/**
	* Create and initialize a new mesh state and its query state
	* Does not put the mesh state into rbtrees and so on.
	* @param env: module environment to set.
	* @param qinfo: query info that the mesh is for.
	* @param cinfo: control info for the query client (can be NULL).
	* @param qflags: flags for query (RD / CD flag).
	* @param prime: if true, it is a priming query, set is_priming on mesh state.
	* @param valrec: if true, it is a validation recursion query, and sets
	* is_valrec on the mesh state.
	* @return: new mesh state or NULL on allocation error.
	*/
	struct mesh_state* mesh_state_create(struct module_env* env,
	struct query_info* qinfo, struct respip_client_info* cinfo,
	uint16_t qflags, int prime, int valrec);

	/**
	* Check if the mesh state is unique.
	* A unique mesh state uses it's unique member to point to itself, else NULL.
	* @param mstate: mesh state to check.
	* @return true if the mesh state is unique, false otherwise.
	*/
	int mesh_state_is_unique(struct mesh_state* mstate);

	/**
	* Make a mesh state unique.
	* A unique mesh state uses it's unique member to point to itself.
	* @param mstate: mesh state to check.
	*/
	void mesh_state_make_unique(struct mesh_state* mstate);

	/**
	* Cleanup a mesh state and its query state. Does not do rbtree or
	* reference cleanup.
	* @param mstate: mesh state to cleanup. Its pointer may no longer be used
	* afterwards. Cleanup rbtrees before calling this function.
	*/
	void mesh_state_cleanup(struct mesh_state* mstate);

	/**
	* Delete all mesh states from the mesh.
	* @param mesh: the mesh area to clear
	*/
	void mesh_delete_all(struct mesh_area* mesh);

	/**
	* Find a mesh state in the mesh area. Pass relevant flags.
	*
	* @param mesh: the mesh area to look in.
	* @param cinfo: if non-NULL client specific info that may affect IP-based
	* actions that apply to the query result.
	* @param qinfo: what query
	* @param qflags: if RD / CD bit is set or not.
	* @param prime: if it is a priming query.
	* @param valrec: if it is a validation-recursion query.
	* @return: mesh state or NULL if not found.
	*/
	struct mesh_state* mesh_area_find(struct mesh_area* mesh,
	struct respip_client_info* cinfo, struct query_info* qinfo,
	uint16_t qflags, int prime, int valrec);

	/**
	* Setup attachment super/sub relation between super and sub mesh state.
	* The relation must not be present when calling the function.
	* Does not update stat items in mesh_area.
	* @param super: super state.
	* @param sub: sub state.
	* @return: 0 on alloc error.
	*/
	int mesh_state_attachment(struct mesh_state* super, struct mesh_state* sub);

	/**
	* Create new reply structure and attach it to a mesh state.
	* Does not update stat items in mesh area.
	* @param s: the mesh state.
	* @param edns: edns data for reply (bufsize).
	* @param rep: comm point reply info.
	* @param qid: ID of reply.
	* @param qflags: original query flags.
	* @param qinfo: original query info.
	* @return: 0 on alloc error.
	*/
	int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
	struct comm_reply* rep, uint16_t qid, uint16_t qflags,
	const struct query_info* qinfo);

	/**
	* Create new callback structure and attach it to a mesh state.
	* Does not update stat items in mesh area.
	* @param s: the mesh state.
	* @param edns: edns data for reply (bufsize).
	* @param buf: buffer for reply
	* @param cb: callback to call with results.
	* @param cb_arg: callback user arg.
	* @param qid: ID of reply.
	* @param qflags: original query flags.
	* @return: 0 on alloc error.
	*/
	int mesh_state_add_cb(struct mesh_state* s, struct edns_data* edns,
	struct sldns_buffer* buf, mesh_cb_func_type cb, void* cb_arg,
	uint16_t qid, uint16_t qflags);

	/**
	* Run the mesh. Run all runnable mesh states. Which can create new
	* runnable mesh states. Until completion. Automatically called by
	* mesh_report_reply and mesh_new_client as needed.
	* @param mesh: mesh area.
	* @param mstate: first mesh state to run.
	* @param ev: event the mstate. Others get event_pass.
	* @param e: if a reply, its outbound entry.
	*/
	void mesh_run(struct mesh_area* mesh, struct mesh_state* mstate,
	enum module_ev ev, struct outbound_entry* e);

	/**
	* Print some stats about the mesh to the log.
	* @param mesh: the mesh to print it for.
	* @param str: descriptive string to go with it.
	*/
	void mesh_stats(struct mesh_area* mesh, const char* str);

	/**
	* Clear the stats that the mesh keeps (number of queries serviced)
	* @param mesh: the mesh
	*/
	void mesh_stats_clear(struct mesh_area* mesh);

	/**
	* Print all the states in the mesh to the log.
	* @param mesh: the mesh to print all states of.
	*/
	void mesh_log_list(struct mesh_area* mesh);

	/**
	* Calculate memory size in use by mesh and all queries inside it.
	* @param mesh: the mesh to examine.
	* @return size in bytes.
	*/
	size_t mesh_get_mem(struct mesh_area* mesh);

	/**
	* Find cycle; see if the given mesh is in the targets sub, or sub-sub, ...
	* trees.
	* If the sub-sub structure is too large, it returns 'a cycle'=2.
	* @param qstate: given mesh querystate.
	* @param qinfo: query info for dependency.
	* @param flags: query flags of dependency.
	* @param prime: if dependency is a priming query or not.
	* @param valrec: if it is a validation recursion query (lookup of key, DS).
	* @return true if the name,type,class exists and the given qstate mesh exists
	* as a dependency of that name. Thus if qstate becomes dependent on
	* name,type,class then a cycle is created, this is return value 1.
	* Too large to search is value 2 (also true).
	*/
	int mesh_detect_cycle(struct module_qstate* qstate, struct query_info* qinfo,
	uint16_t flags, int prime, int valrec);

	/** compare two mesh_states */
	int mesh_state_compare(const void* ap, const void* bp);

	/** compare two mesh references */
	int mesh_state_ref_compare(const void* ap, const void* bp);

	/**
	* Make space for another recursion state for a reply in the mesh
	* @param mesh: mesh area
	* @param qbuf: query buffer to save if recursion is invoked to make space.
	* This buffer is necessary, because the following sequence in calls
	* can result in an overwrite of the incoming query:
	* delete_other_mesh_query - iter_clean - serviced_delete - waiting
	* udp query is sent - on error callback - callback sends SERVFAIL reply
	* over the same network channel, and shared UDP buffer is overwritten.
	* You can pass NULL if there is no buffer that must be backed up.
	* @return false if no space is available.
	*/
	int mesh_make_new_space(struct mesh_area* mesh, struct sldns_buffer* qbuf);

	/**
	* Insert mesh state into a double linked list. Inserted at end.
	* @param m: mesh state.
	* @param fp: pointer to the first-elem-pointer of the list.
	* @param lp: pointer to the last-elem-pointer of the list.
	*/
	void mesh_list_insert(struct mesh_state* m, struct mesh_state** fp,
	struct mesh_state** lp);

	/**
	* Remove mesh state from a double linked list. Remove from any position.
	* @param m: mesh state.
	* @param fp: pointer to the first-elem-pointer of the list.
	* @param lp: pointer to the last-elem-pointer of the list.
	*/
	void mesh_list_remove(struct mesh_state* m, struct mesh_state** fp,
	struct mesh_state** lp);
	+
	+/**
	+ * Remove mesh reply entry from the reply entry list. Searches for
	+ * the comm_point pointer.
	+ * @param mesh: to update the counters.
	+ * @param m: the mesh state.
	+ * @param cp: the comm_point to remove from the list.
	+ */
	+void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
	+ struct comm_point* cp);

	#endif /* SERVICES_MESH_H */
	Index: head/contrib/unbound/services/modstack.c
	===================================================================
	--- head/contrib/unbound/services/modstack.c (revision 349719)
	+++ head/contrib/unbound/services/modstack.c (revision 349720)
	@@ -1,257 +1,263 @@
	/*
	* services/modstack.c - stack of modules
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains functions to help maintain a stack of modules.
	*/
	#include "config.h"
	#include <ctype.h>
	#include "services/modstack.h"
	#include "util/module.h"
	#include "util/fptr_wlist.h"
	#include "dns64/dns64.h"
	#include "iterator/iterator.h"
	#include "validator/validator.h"
	#include "respip/respip.h"

	#ifdef WITH_PYTHONMODULE
	#include "pythonmod/pythonmod.h"
	#endif
	#ifdef USE_CACHEDB
	#include "cachedb/cachedb.h"
	#endif
	#ifdef USE_IPSECMOD
	#include "ipsecmod/ipsecmod.h"
	#endif
	#ifdef CLIENT_SUBNET
	#include "edns-subnet/subnetmod.h"
	#endif

	/** count number of modules (words) in the string */
	static int
	count_modules(const char* s)
	{
	int num = 0;
	if(!s)
	return 0;
	while(*s) {
	/* skip whitespace */
	while(s && isspace((unsigned char)s))
	s++;
	if(s && !isspace((unsigned char)s)) {
	/* skip identifier */
	num++;
	while(s && !isspace((unsigned char)s))
	s++;
	}
	}
	return num;
	}

	void
	modstack_init(struct module_stack* stack)
	{
	stack->num = 0;
	stack->mod = NULL;
	}

	int
	modstack_config(struct module_stack* stack, const char* module_conf)
	{
	int i;
	verbose(VERB_QUERY, "module config: \"%s\"", module_conf);
	stack->num = count_modules(module_conf);
	if(stack->num == 0) {
	log_err("error: no modules specified");
	return 0;
	}
	if(stack->num > MAX_MODULE) {
	log_err("error: too many modules (%d max %d)",
	stack->num, MAX_MODULE);
	return 0;
	}
	stack->mod = (struct module_func_block**)calloc((size_t)
	stack->num, sizeof(struct module_func_block*));
	if(!stack->mod) {
	log_err("out of memory");
	return 0;
	}
	for(i=0; i<stack->num; i++) {
	stack->mod[i] = module_factory(&module_conf);
	if(!stack->mod[i]) {
	- log_err("Unknown value for next module: '%s'",
	- module_conf);
	+ char md[256];
	+ snprintf(md, sizeof(md), "%s", module_conf);
	+ if(strchr(md, ' ')) *(strchr(md, ' ')) = 0;
	+ if(strchr(md, '\t')) *(strchr(md, '\t')) = 0;
	+ log_err("Unknown value in module-config, module: '%s'."
	+ " This module is not present (not compiled in),"
	+ " See the list of linked modules with unbound -h",
	+ md);
	return 0;
	}
	}
	return 1;
	}

	/** The list of module names */
	const char**
	module_list_avail(void)
	{
	/* these are the modules available */
	static const char* names[] = {
	"dns64",
	#ifdef WITH_PYTHONMODULE
	"python",
	#endif
	#ifdef USE_CACHEDB
	"cachedb",
	#endif
	#ifdef USE_IPSECMOD
	"ipsecmod",
	#endif
	#ifdef CLIENT_SUBNET
	"subnetcache",
	#endif
	"respip",
	"validator",
	"iterator",
	NULL};
	return names;
	}

	/** func block get function type */
	typedef struct module_func_block* (*fbgetfunctype)(void);

	/** The list of module func blocks */
	static fbgetfunctype*
	module_funcs_avail(void)
	{
	static struct module_func_block* (*fb[])(void) = {
	&dns64_get_funcblock,
	#ifdef WITH_PYTHONMODULE
	&pythonmod_get_funcblock,
	#endif
	#ifdef USE_CACHEDB
	&cachedb_get_funcblock,
	#endif
	#ifdef USE_IPSECMOD
	&ipsecmod_get_funcblock,
	#endif
	#ifdef CLIENT_SUBNET
	&subnetmod_get_funcblock,
	#endif
	&respip_get_funcblock,
	&val_get_funcblock,
	&iter_get_funcblock,
	NULL};
	return fb;
	}

	struct
	module_func_block* module_factory(const char** str)
	{
	int i = 0;
	const char* s = *str;
	const char** names = module_list_avail();
	fbgetfunctype* fb = module_funcs_avail();
	while(s && isspace((unsigned char)s))
	s++;
	while(names[i]) {
	if(strncmp(names[i], s, strlen(names[i])) == 0) {
	s += strlen(names[i]);
	*str = s;
	return (*fb[i])();
	}
	i++;
	}
	return NULL;
	}

	int
	modstack_setup(struct module_stack* stack, const char* module_conf,
	struct module_env* env)
	{
	int i;
	if(stack->num != 0)
	modstack_desetup(stack, env);
	/* fixed setup of the modules */
	if(!modstack_config(stack, module_conf)) {
	return 0;
	}
	env->need_to_validate = 0; /* set by module init below */
	for(i=0; i<stack->num; i++) {
	verbose(VERB_OPS, "init module %d: %s",
	i, stack->mod[i]->name);
	fptr_ok(fptr_whitelist_mod_init(stack->mod[i]->init));
	if(!(*stack->mod[i]->init)(env, i)) {
	log_err("module init for module %s failed",
	stack->mod[i]->name);
	return 0;
	}
	}
	return 1;
	}

	void
	modstack_desetup(struct module_stack* stack, struct module_env* env)
	{
	int i;
	for(i=0; i<stack->num; i++) {
	fptr_ok(fptr_whitelist_mod_deinit(stack->mod[i]->deinit));
	(*stack->mod[i]->deinit)(env, i);
	}
	stack->num = 0;
	free(stack->mod);
	stack->mod = NULL;
	}

	int
	modstack_find(struct module_stack* stack, const char* name)
	{
	int i;
	for(i=0; i<stack->num; i++) {
	if(strcmp(stack->mod[i]->name, name) == 0)
	return i;
	}
	return -1;
	}

	size_t
	mod_get_mem(struct module_env* env, const char* name)
	{
	int m = modstack_find(&env->mesh->mods, name);
	if(m != -1) {
	fptr_ok(fptr_whitelist_mod_get_mem(env->mesh->
	mods.mod[m]->get_mem));
	return (*env->mesh->mods.mod[m]->get_mem)(env, m);
	}
	return 0;
	}
	Index: head/contrib/unbound/services/outside_network.c
	===================================================================
	--- head/contrib/unbound/services/outside_network.c (revision 349719)
	+++ head/contrib/unbound/services/outside_network.c (revision 349720)
	@@ -1,2528 +1,2548 @@
	/*
	* services/outside_network.c - implement sending of queries and wait answer.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file has functions to send queries to authoritative servers and
	* wait for the pending answer events.
	*/
	#include "config.h"
	#include <ctype.h>
	#ifdef HAVE_SYS_TYPES_H
	# include <sys/types.h>
	#endif
	#include <sys/time.h>
	#include "services/outside_network.h"
	#include "services/listen_dnsport.h"
	#include "services/cache/infra.h"
	#include "iterator/iterator.h"
	#include "util/data/msgparse.h"
	#include "util/data/msgreply.h"
	#include "util/data/msgencode.h"
	#include "util/data/dname.h"
	#include "util/netevent.h"
	#include "util/log.h"
	#include "util/net_help.h"
	#include "util/random.h"
	#include "util/fptr_wlist.h"
	#include "sldns/sbuffer.h"
	#include "dnstap/dnstap.h"
	#ifdef HAVE_OPENSSL_SSL_H
	#include <openssl/ssl.h>
	#endif
	+#ifdef HAVE_X509_VERIFY_PARAM_SET1_HOST
	+#include <openssl/x509v3.h>
	+#endif

	#ifdef HAVE_NETDB_H
	#include <netdb.h>
	#endif
	#include <fcntl.h>

	/** number of times to retry making a random ID that is unique. */
	#define MAX_ID_RETRY 1000
	/** number of times to retry finding interface, port that can be opened. */
	#define MAX_PORT_RETRY 10000
	/** number of retries on outgoing UDP queries */
	#define OUTBOUND_UDP_RETRY 1

	/** initiate TCP transaction for serviced query */
	static void serviced_tcp_initiate(struct serviced_query* sq, sldns_buffer* buff);
	/** with a fd available, randomize and send UDP */
	static int randomize_and_send_udp(struct pending* pend, sldns_buffer* packet,
	int timeout);

	/** remove waiting tcp from the outnet waiting list */
	static void waiting_list_remove(struct outside_network* outnet,
	struct waiting_tcp* w);

	int
	pending_cmp(const void* key1, const void* key2)
	{
	struct pending p1 = (struct pending)key1;
	struct pending p2 = (struct pending)key2;
	if(p1->id < p2->id)
	return -1;
	if(p1->id > p2->id)
	return 1;
	log_assert(p1->id == p2->id);
	return sockaddr_cmp(&p1->addr, p1->addrlen, &p2->addr, p2->addrlen);
	}

	int
	serviced_cmp(const void* key1, const void* key2)
	{
	struct serviced_query* q1 = (struct serviced_query*)key1;
	struct serviced_query* q2 = (struct serviced_query*)key2;
	int r;
	if(q1->qbuflen < q2->qbuflen)
	return -1;
	if(q1->qbuflen > q2->qbuflen)
	return 1;
	log_assert(q1->qbuflen == q2->qbuflen);
	log_assert(q1->qbuflen >= 15 /* 10 header, root, type, class */);
	/* alternate casing of qname is still the same query */
	if((r = memcmp(q1->qbuf, q2->qbuf, 10)) != 0)
	return r;
	if((r = memcmp(q1->qbuf+q1->qbuflen-4, q2->qbuf+q2->qbuflen-4, 4)) != 0)
	return r;
	if(q1->dnssec != q2->dnssec) {
	if(q1->dnssec < q2->dnssec)
	return -1;
	return 1;
	}
	if((r = query_dname_compare(q1->qbuf+10, q2->qbuf+10)) != 0)
	return r;
	if((r = edns_opt_list_compare(q1->opt_list, q2->opt_list)) != 0)
	return r;
	return sockaddr_cmp(&q1->addr, q1->addrlen, &q2->addr, q2->addrlen);
	}

	/** delete waiting_tcp entry. Does not unlink from waiting list.
	* @param w: to delete.
	*/
	static void
	waiting_tcp_delete(struct waiting_tcp* w)
	{
	if(!w) return;
	if(w->timer)
	comm_timer_delete(w->timer);
	free(w);
	}

	/**
	* Pick random outgoing-interface of that family, and bind it.
	* port set to 0 so OS picks a port number for us.
	* if it is the ANY address, do not bind.
	* @param w: tcp structure with destination address.
	* @param s: socket fd.
	* @return false on error, socket closed.
	*/
	static int
	pick_outgoing_tcp(struct waiting_tcp* w, int s)
	{
	struct port_if* pi = NULL;
	int num;
	#ifdef INET6
	if(addr_is_ip6(&w->addr, w->addrlen))
	num = w->outnet->num_ip6;
	else
	#endif
	num = w->outnet->num_ip4;
	if(num == 0) {
	log_err("no TCP outgoing interfaces of family");
	log_addr(VERB_OPS, "for addr", &w->addr, w->addrlen);
	#ifndef USE_WINSOCK
	close(s);
	#else
	closesocket(s);
	#endif
	return 0;
	}
	#ifdef INET6
	if(addr_is_ip6(&w->addr, w->addrlen))
	pi = &w->outnet->ip6_ifs[ub_random_max(w->outnet->rnd, num)];
	else
	#endif
	pi = &w->outnet->ip4_ifs[ub_random_max(w->outnet->rnd, num)];
	log_assert(pi);
	if(addr_is_any(&pi->addr, pi->addrlen)) {
	/* binding to the ANY interface is for listening sockets */
	return 1;
	}
	/* set port to 0 */
	if(addr_is_ip6(&pi->addr, pi->addrlen))
	((struct sockaddr_in6*)&pi->addr)->sin6_port = 0;
	else ((struct sockaddr_in*)&pi->addr)->sin_port = 0;
	if(bind(s, (struct sockaddr*)&pi->addr, pi->addrlen) != 0) {
	#ifndef USE_WINSOCK
	log_err("outgoing tcp: bind: %s", strerror(errno));
	close(s);
	#else
	log_err("outgoing tcp: bind: %s",
	wsa_strerror(WSAGetLastError()));
	closesocket(s);
	#endif
	return 0;
	}
	log_addr(VERB_ALGO, "tcp bound to src", &pi->addr, pi->addrlen);
	return 1;
	}

	/** get TCP file descriptor for address, returns -1 on failure,
	* tcp_mss is 0 or maxseg size to set for TCP packets. */
	int
	outnet_get_tcp_fd(struct sockaddr_storage* addr, socklen_t addrlen, int tcp_mss)
	{
	int s;
	#ifdef SO_REUSEADDR
	int on = 1;
	#endif
	#ifdef INET6
	if(addr_is_ip6(addr, addrlen))
	s = socket(PF_INET6, SOCK_STREAM, IPPROTO_TCP);
	else
	#endif
	s = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
	if(s == -1) {
	#ifndef USE_WINSOCK
	log_err_addr("outgoing tcp: socket", strerror(errno),
	addr, addrlen);
	#else
	log_err_addr("outgoing tcp: socket",
	wsa_strerror(WSAGetLastError()), addr, addrlen);
	#endif
	return -1;
	}

	#ifdef SO_REUSEADDR
	if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on,
	(socklen_t)sizeof(on)) < 0) {
	verbose(VERB_ALGO, "outgoing tcp:"
	" setsockopt(.. SO_REUSEADDR ..) failed");
	}
	#endif

	if(tcp_mss > 0) {
	#if defined(IPPROTO_TCP) && defined(TCP_MAXSEG)
	if(setsockopt(s, IPPROTO_TCP, TCP_MAXSEG,
	(void*)&tcp_mss, (socklen_t)sizeof(tcp_mss)) < 0) {
	verbose(VERB_ALGO, "outgoing tcp:"
	" setsockopt(.. TCP_MAXSEG ..) failed");
	}
	#else
	verbose(VERB_ALGO, "outgoing tcp:"
	" setsockopt(TCP_MAXSEG) unsupported");
	#endif /* defined(IPPROTO_TCP) && defined(TCP_MAXSEG) */
	}

	return s;
	}

	/** connect tcp connection to addr, 0 on failure */
	int
	outnet_tcp_connect(int s, struct sockaddr_storage* addr, socklen_t addrlen)
	{
	if(connect(s, (struct sockaddr*)addr, addrlen) == -1) {
	#ifndef USE_WINSOCK
	#ifdef EINPROGRESS
	if(errno != EINPROGRESS) {
	#endif
	if(tcp_connect_errno_needs_log(
	(struct sockaddr*)addr, addrlen))
	log_err_addr("outgoing tcp: connect",
	strerror(errno), addr, addrlen);
	close(s);
	return 0;
	#ifdef EINPROGRESS
	}
	#endif
	#else /* USE_WINSOCK */
	if(WSAGetLastError() != WSAEINPROGRESS &&
	WSAGetLastError() != WSAEWOULDBLOCK) {
	closesocket(s);
	return 0;
	}
	#endif
	}
	return 1;
	}

	/** use next free buffer to service a tcp query */
	static int
	outnet_tcp_take_into_use(struct waiting_tcp* w, uint8_t* pkt, size_t pkt_len)
	{
	struct pending_tcp* pend = w->outnet->tcp_free;
	int s;
	log_assert(pend);
	log_assert(pkt);
	log_assert(w->addrlen > 0);
	/* open socket */
	s = outnet_get_tcp_fd(&w->addr, w->addrlen, w->outnet->tcp_mss);

	if(!pick_outgoing_tcp(w, s))
	return 0;

	fd_set_nonblock(s);
	#ifdef USE_OSX_MSG_FASTOPEN
	/* API for fast open is different here. We use a connectx() function and
	then writes can happen as normal even using SSL.*/
	/* connectx requires that the len be set in the sockaddr struct*/
	struct sockaddr_in addr_in = (struct sockaddr_in )&w->addr;
	addr_in->sin_len = w->addrlen;
	sa_endpoints_t endpoints;
	endpoints.sae_srcif = 0;
	endpoints.sae_srcaddr = NULL;
	endpoints.sae_srcaddrlen = 0;
	endpoints.sae_dstaddr = (struct sockaddr *)&w->addr;
	endpoints.sae_dstaddrlen = w->addrlen;
	if (connectx(s, &endpoints, SAE_ASSOCID_ANY,
	CONNECT_DATA_IDEMPOTENT \| CONNECT_RESUME_ON_READ_WRITE,
	NULL, 0, NULL, NULL) == -1) {
	/* if fails, failover to connect for OSX 10.10 */
	#ifdef EINPROGRESS
	if(errno != EINPROGRESS) {
	#else
	if(1) {
	#endif
	if(connect(s, (struct sockaddr*)&w->addr, w->addrlen) == -1) {
	#else /* USE_OSX_MSG_FASTOPEN*/
	#ifdef USE_MSG_FASTOPEN
	pend->c->tcp_do_fastopen = 1;
	/* Only do TFO for TCP in which case no connect() is required here.
	Don't combine client TFO with SSL, since OpenSSL can't
	currently support doing a handshake on fd that already isn't connected*/
	if (w->outnet->sslctx && w->ssl_upstream) {
	if(connect(s, (struct sockaddr*)&w->addr, w->addrlen) == -1) {
	#else /* USE_MSG_FASTOPEN*/
	if(connect(s, (struct sockaddr*)&w->addr, w->addrlen) == -1) {
	#endif /* USE_MSG_FASTOPEN*/
	#endif /* USE_OSX_MSG_FASTOPEN*/
	#ifndef USE_WINSOCK
	#ifdef EINPROGRESS
	if(errno != EINPROGRESS) {
	#else
	if(1) {
	#endif
	if(tcp_connect_errno_needs_log(
	(struct sockaddr*)&w->addr, w->addrlen))
	log_err_addr("outgoing tcp: connect",
	strerror(errno), &w->addr, w->addrlen);
	close(s);
	#else /* USE_WINSOCK */
	if(WSAGetLastError() != WSAEINPROGRESS &&
	WSAGetLastError() != WSAEWOULDBLOCK) {
	closesocket(s);
	#endif
	return 0;
	}
	}
	#ifdef USE_MSG_FASTOPEN
	}
	#endif /* USE_MSG_FASTOPEN */
	#ifdef USE_OSX_MSG_FASTOPEN
	}
	}
	#endif /* USE_OSX_MSG_FASTOPEN */
	if(w->outnet->sslctx && w->ssl_upstream) {
	pend->c->ssl = outgoing_ssl_fd(w->outnet->sslctx, s);
	if(!pend->c->ssl) {
	pend->c->fd = s;
	comm_point_close(pend->c);
	return 0;
	}
	+ verbose(VERB_ALGO, "the query is using TLS encryption, for %s",
	+ (w->tls_auth_name?w->tls_auth_name:"an unauthenticated connection"));
	#ifdef USE_WINSOCK
	comm_point_tcp_win_bio_cb(pend->c, pend->c->ssl);
	#endif
	pend->c->ssl_shake_state = comm_ssl_shake_write;
	if(w->tls_auth_name) {
	#ifdef HAVE_SSL
	(void)SSL_set_tlsext_host_name(pend->c->ssl, w->tls_auth_name);
	#endif
	}
	#ifdef HAVE_SSL_SET1_HOST
	if(w->tls_auth_name) {
	SSL_set_verify(pend->c->ssl, SSL_VERIFY_PEER, NULL);
	/* setting the hostname makes openssl verify the
	* host name in the x509 certificate in the
	* SSL connection*/
	if(!SSL_set1_host(pend->c->ssl, w->tls_auth_name)) {
	log_err("SSL_set1_host failed");
	pend->c->fd = s;
	SSL_free(pend->c->ssl);
	pend->c->ssl = NULL;
	comm_point_close(pend->c);
	return 0;
	}
	}
	+#elif defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
	+ /* openssl 1.0.2 has this function that can be used for
	+ * set1_host like verification */
	+ if(w->tls_auth_name) {
	+ X509_VERIFY_PARAM* param = SSL_get0_param(pend->c->ssl);
	+ X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
	+ if(!X509_VERIFY_PARAM_set1_host(param, w->tls_auth_name, strlen(w->tls_auth_name))) {
	+ log_err("X509_VERIFY_PARAM_set1_host failed");
	+ pend->c->fd = s;
	+ SSL_free(pend->c->ssl);
	+ pend->c->ssl = NULL;
	+ comm_point_close(pend->c);
	+ return 0;
	+ }
	+ SSL_set_verify(pend->c->ssl, SSL_VERIFY_PEER, NULL);
	+ }
	+#else
	+ verbose(VERB_ALGO, "the query has an auth_name, but libssl has no call to perform TLS authentication");
	#endif /* HAVE_SSL_SET1_HOST */
	}
	w->pkt = NULL;
	w->next_waiting = (void*)pend;
	pend->id = LDNS_ID_WIRE(pkt);
	w->outnet->num_tcp_outgoing++;
	w->outnet->tcp_free = pend->next_free;
	pend->next_free = NULL;
	pend->query = w;
	pend->c->repinfo.addrlen = w->addrlen;
	memcpy(&pend->c->repinfo.addr, &w->addr, w->addrlen);
	sldns_buffer_clear(pend->c->buffer);
	sldns_buffer_write(pend->c->buffer, pkt, pkt_len);
	sldns_buffer_flip(pend->c->buffer);
	pend->c->tcp_is_reading = 0;
	pend->c->tcp_byte_count = 0;
	comm_point_start_listening(pend->c, s, -1);
	return 1;
	}

	/** see if buffers can be used to service TCP queries */
	static void
	use_free_buffer(struct outside_network* outnet)
	{
	struct waiting_tcp* w;
	while(outnet->tcp_free && outnet->tcp_wait_first
	&& !outnet->want_to_quit) {
	w = outnet->tcp_wait_first;
	outnet->tcp_wait_first = w->next_waiting;
	if(outnet->tcp_wait_last == w)
	outnet->tcp_wait_last = NULL;
	if(!outnet_tcp_take_into_use(w, w->pkt, w->pkt_len)) {
	comm_point_callback_type* cb = w->cb;
	void* cb_arg = w->cb_arg;
	waiting_tcp_delete(w);
	fptr_ok(fptr_whitelist_pending_tcp(cb));
	(void)(*cb)(NULL, cb_arg, NETEVENT_CLOSED, NULL);
	}
	}
	}

	/** decommission a tcp buffer, closes commpoint and frees waiting_tcp entry */
	static void
	decommission_pending_tcp(struct outside_network* outnet,
	struct pending_tcp* pend)
	{
	if(pend->c->ssl) {
	#ifdef HAVE_SSL
	SSL_shutdown(pend->c->ssl);
	SSL_free(pend->c->ssl);
	pend->c->ssl = NULL;
	#endif
	}
	comm_point_close(pend->c);
	pend->next_free = outnet->tcp_free;
	outnet->tcp_free = pend;
	waiting_tcp_delete(pend->query);
	pend->query = NULL;
	use_free_buffer(outnet);
	}

	int
	outnet_tcp_cb(struct comm_point* c, void* arg, int error,
	struct comm_reply *reply_info)
	{
	struct pending_tcp* pend = (struct pending_tcp*)arg;
	struct outside_network* outnet = pend->query->outnet;
	verbose(VERB_ALGO, "outnettcp cb");
	if(error != NETEVENT_NOERROR) {
	verbose(VERB_QUERY, "outnettcp got tcp error %d", error);
	/* pass error below and exit */
	} else {
	/* check ID */
	if(sldns_buffer_limit(c->buffer) < sizeof(uint16_t) \|\|
	LDNS_ID_WIRE(sldns_buffer_begin(c->buffer))!=pend->id) {
	log_addr(VERB_QUERY,
	"outnettcp: bad ID in reply, from:",
	&pend->query->addr, pend->query->addrlen);
	error = NETEVENT_CLOSED;
	}
	}
	fptr_ok(fptr_whitelist_pending_tcp(pend->query->cb));
	(void)(*pend->query->cb)(c, pend->query->cb_arg, error, reply_info);
	decommission_pending_tcp(outnet, pend);
	return 0;
	}

	/** lower use count on pc, see if it can be closed */
	static void
	portcomm_loweruse(struct outside_network* outnet, struct port_comm* pc)
	{
	struct port_if* pif;
	pc->num_outstanding--;
	if(pc->num_outstanding > 0) {
	return;
	}
	/* close it and replace in unused list */
	verbose(VERB_ALGO, "close of port %d", pc->number);
	comm_point_close(pc->cp);
	pif = pc->pif;
	log_assert(pif->inuse > 0);
	pif->avail_ports[pif->avail_total - pif->inuse] = pc->number;
	pif->inuse--;
	pif->out[pc->index] = pif->out[pif->inuse];
	pif->out[pc->index]->index = pc->index;
	pc->next = outnet->unused_fds;
	outnet->unused_fds = pc;
	}

	/** try to send waiting UDP queries */
	static void
	outnet_send_wait_udp(struct outside_network* outnet)
	{
	struct pending* pend;
	/* process waiting queries */
	while(outnet->udp_wait_first && outnet->unused_fds
	&& !outnet->want_to_quit) {
	pend = outnet->udp_wait_first;
	outnet->udp_wait_first = pend->next_waiting;
	if(!pend->next_waiting) outnet->udp_wait_last = NULL;
	sldns_buffer_clear(outnet->udp_buff);
	sldns_buffer_write(outnet->udp_buff, pend->pkt, pend->pkt_len);
	sldns_buffer_flip(outnet->udp_buff);
	free(pend->pkt); /* freeing now makes get_mem correct */
	pend->pkt = NULL;
	pend->pkt_len = 0;
	if(!randomize_and_send_udp(pend, outnet->udp_buff,
	pend->timeout)) {
	/* callback error on pending */
	if(pend->cb) {
	fptr_ok(fptr_whitelist_pending_udp(pend->cb));
	(void)(*pend->cb)(outnet->unused_fds->cp, pend->cb_arg,
	NETEVENT_CLOSED, NULL);
	}
	pending_delete(outnet, pend);
	}
	}
	}

	int
	outnet_udp_cb(struct comm_point* c, void* arg, int error,
	struct comm_reply *reply_info)
	{
	struct outside_network* outnet = (struct outside_network*)arg;
	struct pending key;
	struct pending* p;
	verbose(VERB_ALGO, "answer cb");

	if(error != NETEVENT_NOERROR) {
	verbose(VERB_QUERY, "outnetudp got udp error %d", error);
	return 0;
	}
	if(sldns_buffer_limit(c->buffer) < LDNS_HEADER_SIZE) {
	verbose(VERB_QUERY, "outnetudp udp too short");
	return 0;
	}
	log_assert(reply_info);

	/* setup lookup key */
	key.id = (unsigned)LDNS_ID_WIRE(sldns_buffer_begin(c->buffer));
	memcpy(&key.addr, &reply_info->addr, reply_info->addrlen);
	key.addrlen = reply_info->addrlen;
	verbose(VERB_ALGO, "Incoming reply id = %4.4x", key.id);
	log_addr(VERB_ALGO, "Incoming reply addr =",
	&reply_info->addr, reply_info->addrlen);

	/* find it, see if this thing is a valid query response */
	verbose(VERB_ALGO, "lookup size is %d entries", (int)outnet->pending->count);
	p = (struct pending*)rbtree_search(outnet->pending, &key);
	if(!p) {
	verbose(VERB_QUERY, "received unwanted or unsolicited udp reply dropped.");
	log_buf(VERB_ALGO, "dropped message", c->buffer);
	outnet->unwanted_replies++;
	if(outnet->unwanted_threshold && ++outnet->unwanted_total
	>= outnet->unwanted_threshold) {
	log_warn("unwanted reply total reached threshold (%u)"
	" you may be under attack."
	" defensive action: clearing the cache",
	(unsigned)outnet->unwanted_threshold);
	fptr_ok(fptr_whitelist_alloc_cleanup(
	outnet->unwanted_action));
	(*outnet->unwanted_action)(outnet->unwanted_param);
	outnet->unwanted_total = 0;
	}
	return 0;
	}

	verbose(VERB_ALGO, "received udp reply.");
	log_buf(VERB_ALGO, "udp message", c->buffer);
	if(p->pc->cp != c) {
	verbose(VERB_QUERY, "received reply id,addr on wrong port. "
	"dropped.");
	outnet->unwanted_replies++;
	if(outnet->unwanted_threshold && ++outnet->unwanted_total
	>= outnet->unwanted_threshold) {
	log_warn("unwanted reply total reached threshold (%u)"
	" you may be under attack."
	" defensive action: clearing the cache",
	(unsigned)outnet->unwanted_threshold);
	fptr_ok(fptr_whitelist_alloc_cleanup(
	outnet->unwanted_action));
	(*outnet->unwanted_action)(outnet->unwanted_param);
	outnet->unwanted_total = 0;
	}
	return 0;
	}
	comm_timer_disable(p->timer);
	verbose(VERB_ALGO, "outnet handle udp reply");
	/* delete from tree first in case callback creates a retry */
	(void)rbtree_delete(outnet->pending, p->node.key);
	if(p->cb) {
	fptr_ok(fptr_whitelist_pending_udp(p->cb));
	(void)(*p->cb)(p->pc->cp, p->cb_arg, NETEVENT_NOERROR, reply_info);
	}
	portcomm_loweruse(outnet, p->pc);
	pending_delete(NULL, p);
	outnet_send_wait_udp(outnet);
	return 0;
	}

	/** calculate number of ip4 and ip6 interfaces*/
	static void
	calc_num46(char** ifs, int num_ifs, int do_ip4, int do_ip6,
	int* num_ip4, int* num_ip6)
	{
	int i;
	*num_ip4 = 0;
	*num_ip6 = 0;
	if(num_ifs <= 0) {
	if(do_ip4)
	*num_ip4 = 1;
	if(do_ip6)
	*num_ip6 = 1;
	return;
	}
	for(i=0; i<num_ifs; i++)
	{
	if(str_is_ip6(ifs[i])) {
	if(do_ip6)
	(*num_ip6)++;
	} else {
	if(do_ip4)
	(*num_ip4)++;
	}
	}

	}

	void
	pending_udp_timer_delay_cb(void* arg)
	{
	struct pending* p = (struct pending*)arg;
	struct outside_network* outnet = p->outnet;
	verbose(VERB_ALGO, "timeout udp with delay");
	portcomm_loweruse(outnet, p->pc);
	pending_delete(outnet, p);
	outnet_send_wait_udp(outnet);
	}

	void
	pending_udp_timer_cb(void *arg)
	{
	struct pending* p = (struct pending*)arg;
	struct outside_network* outnet = p->outnet;
	/* it timed out */
	verbose(VERB_ALGO, "timeout udp");
	if(p->cb) {
	fptr_ok(fptr_whitelist_pending_udp(p->cb));
	(void)(*p->cb)(p->pc->cp, p->cb_arg, NETEVENT_TIMEOUT, NULL);
	}
	/* if delayclose, keep port open for a longer time.
	* But if the udpwaitlist exists, then we are struggling to
	* keep up with demand for sockets, so do not wait, but service
	* the customer (customer service more important than portICMPs) */
	if(outnet->delayclose && !outnet->udp_wait_first) {
	p->cb = NULL;
	p->timer->callback = &pending_udp_timer_delay_cb;
	comm_timer_set(p->timer, &outnet->delay_tv);
	return;
	}
	portcomm_loweruse(outnet, p->pc);
	pending_delete(outnet, p);
	outnet_send_wait_udp(outnet);
	}

	/** create pending_tcp buffers */
	static int
	create_pending_tcp(struct outside_network* outnet, size_t bufsize)
	{
	size_t i;
	if(outnet->num_tcp == 0)
	return 1; /* no tcp needed, nothing to do */
	if(!(outnet->tcp_conns = (struct pending_tcp **)calloc(
	outnet->num_tcp, sizeof(struct pending_tcp*))))
	return 0;
	for(i=0; i<outnet->num_tcp; i++) {
	if(!(outnet->tcp_conns[i] = (struct pending_tcp*)calloc(1,
	sizeof(struct pending_tcp))))
	return 0;
	outnet->tcp_conns[i]->next_free = outnet->tcp_free;
	outnet->tcp_free = outnet->tcp_conns[i];
	outnet->tcp_conns[i]->c = comm_point_create_tcp_out(
	outnet->base, bufsize, outnet_tcp_cb,
	outnet->tcp_conns[i]);
	if(!outnet->tcp_conns[i]->c)
	return 0;
	}
	return 1;
	}

	/** setup an outgoing interface, ready address */
	static int setup_if(struct port_if* pif, const char* addrstr,
	int* avail, int numavail, size_t numfd)
	{
	pif->avail_total = numavail;
	pif->avail_ports = (int)memdup(avail, (size_t)numavailsizeof(int));
	if(!pif->avail_ports)
	return 0;
	if(!ipstrtoaddr(addrstr, UNBOUND_DNS_PORT, &pif->addr, &pif->addrlen) &&
	!netblockstrtoaddr(addrstr, UNBOUND_DNS_PORT,
	&pif->addr, &pif->addrlen, &pif->pfxlen))
	return 0;
	pif->maxout = (int)numfd;
	pif->inuse = 0;
	pif->out = (struct port_comm**)calloc(numfd,
	sizeof(struct port_comm*));
	if(!pif->out)
	return 0;
	return 1;
	}

	struct outside_network*
	outside_network_create(struct comm_base *base, size_t bufsize,
	size_t num_ports, char** ifs, int num_ifs, int do_ip4,
	int do_ip6, size_t num_tcp, struct infra_cache* infra,
	struct ub_randstate* rnd, int use_caps_for_id, int* availports,
	int numavailports, size_t unwanted_threshold, int tcp_mss,
	void (unwanted_action)(void), void* unwanted_param, int do_udp,
	void* sslctx, int delayclose, struct dt_env* dtenv)
	{
	struct outside_network* outnet = (struct outside_network*)
	calloc(1, sizeof(struct outside_network));
	size_t k;
	if(!outnet) {
	log_err("malloc failed");
	return NULL;
	}
	comm_base_timept(base, &outnet->now_secs, &outnet->now_tv);
	outnet->base = base;
	outnet->num_tcp = num_tcp;
	outnet->num_tcp_outgoing = 0;
	outnet->infra = infra;
	outnet->rnd = rnd;
	outnet->sslctx = sslctx;
	#ifdef USE_DNSTAP
	outnet->dtenv = dtenv;
	#else
	(void)dtenv;
	#endif
	outnet->svcd_overhead = 0;
	outnet->want_to_quit = 0;
	outnet->unwanted_threshold = unwanted_threshold;
	outnet->unwanted_action = unwanted_action;
	outnet->unwanted_param = unwanted_param;
	outnet->use_caps_for_id = use_caps_for_id;
	outnet->do_udp = do_udp;
	outnet->tcp_mss = tcp_mss;
	#ifndef S_SPLINT_S
	if(delayclose) {
	outnet->delayclose = 1;
	outnet->delay_tv.tv_sec = delayclose/1000;
	outnet->delay_tv.tv_usec = (delayclose%1000)*1000;
	}
	#endif
	- if(numavailports == 0) {
	+ if(numavailports == 0 \|\| num_ports == 0) {
	log_err("no outgoing ports available");
	outside_network_delete(outnet);
	return NULL;
	}
	#ifndef INET6
	do_ip6 = 0;
	#endif
	calc_num46(ifs, num_ifs, do_ip4, do_ip6,
	&outnet->num_ip4, &outnet->num_ip6);
	if(outnet->num_ip4 != 0) {
	if(!(outnet->ip4_ifs = (struct port_if*)calloc(
	(size_t)outnet->num_ip4, sizeof(struct port_if)))) {
	log_err("malloc failed");
	outside_network_delete(outnet);
	return NULL;
	}
	}
	if(outnet->num_ip6 != 0) {
	if(!(outnet->ip6_ifs = (struct port_if*)calloc(
	(size_t)outnet->num_ip6, sizeof(struct port_if)))) {
	log_err("malloc failed");
	outside_network_delete(outnet);
	return NULL;
	}
	}
	if( !(outnet->udp_buff = sldns_buffer_new(bufsize)) \|\|
	!(outnet->pending = rbtree_create(pending_cmp)) \|\|
	!(outnet->serviced = rbtree_create(serviced_cmp)) \|\|
	!create_pending_tcp(outnet, bufsize)) {
	log_err("malloc failed");
	outside_network_delete(outnet);
	return NULL;
	}

	/* allocate commpoints */
	for(k=0; k<num_ports; k++) {
	struct port_comm* pc;
	pc = (struct port_comm)calloc(1, sizeof(pc));
	if(!pc) {
	log_err("malloc failed");
	outside_network_delete(outnet);
	return NULL;
	}
	pc->cp = comm_point_create_udp(outnet->base, -1,
	outnet->udp_buff, outnet_udp_cb, outnet);
	if(!pc->cp) {
	log_err("malloc failed");
	free(pc);
	outside_network_delete(outnet);
	return NULL;
	}
	pc->next = outnet->unused_fds;
	outnet->unused_fds = pc;
	}

	/* allocate interfaces */
	if(num_ifs == 0) {
	if(do_ip4 && !setup_if(&outnet->ip4_ifs[0], "0.0.0.0",
	availports, numavailports, num_ports)) {
	log_err("malloc failed");
	outside_network_delete(outnet);
	return NULL;
	}
	if(do_ip6 && !setup_if(&outnet->ip6_ifs[0], "::",
	availports, numavailports, num_ports)) {
	log_err("malloc failed");
	outside_network_delete(outnet);
	return NULL;
	}
	} else {
	size_t done_4 = 0, done_6 = 0;
	int i;
	for(i=0; i<num_ifs; i++) {
	if(str_is_ip6(ifs[i]) && do_ip6) {
	if(!setup_if(&outnet->ip6_ifs[done_6], ifs[i],
	availports, numavailports, num_ports)){
	log_err("malloc failed");
	outside_network_delete(outnet);
	return NULL;
	}
	done_6++;
	}
	if(!str_is_ip6(ifs[i]) && do_ip4) {
	if(!setup_if(&outnet->ip4_ifs[done_4], ifs[i],
	availports, numavailports, num_ports)){
	log_err("malloc failed");
	outside_network_delete(outnet);
	return NULL;
	}
	done_4++;
	}
	}
	}
	return outnet;
	}

	/** helper pending delete */
	static void
	pending_node_del(rbnode_type* node, void* arg)
	{
	struct pending* pend = (struct pending*)node;
	struct outside_network* outnet = (struct outside_network*)arg;
	pending_delete(outnet, pend);
	}

	/** helper serviced delete */
	static void
	serviced_node_del(rbnode_type* node, void* ATTR_UNUSED(arg))
	{
	struct serviced_query* sq = (struct serviced_query*)node;
	struct service_callback* p = sq->cblist, *np;
	free(sq->qbuf);
	free(sq->zone);
	free(sq->tls_auth_name);
	edns_opt_list_free(sq->opt_list);
	while(p) {
	np = p->next;
	free(p);
	p = np;
	}
	free(sq);
	}

	void
	outside_network_quit_prepare(struct outside_network* outnet)
	{
	if(!outnet)
	return;
	/* prevent queued items from being sent */
	outnet->want_to_quit = 1;
	}

	void
	outside_network_delete(struct outside_network* outnet)
	{
	if(!outnet)
	return;
	outnet->want_to_quit = 1;
	/* check every element, since we can be called on malloc error */
	if(outnet->pending) {
	/* free pending elements, but do no unlink from tree. */
	traverse_postorder(outnet->pending, pending_node_del, NULL);
	free(outnet->pending);
	}
	if(outnet->serviced) {
	traverse_postorder(outnet->serviced, serviced_node_del, NULL);
	free(outnet->serviced);
	}
	if(outnet->udp_buff)
	sldns_buffer_free(outnet->udp_buff);
	if(outnet->unused_fds) {
	struct port_comm* p = outnet->unused_fds, *np;
	while(p) {
	np = p->next;
	comm_point_delete(p->cp);
	free(p);
	p = np;
	}
	outnet->unused_fds = NULL;
	}
	if(outnet->ip4_ifs) {
	int i, k;
	for(i=0; i<outnet->num_ip4; i++) {
	for(k=0; k<outnet->ip4_ifs[i].inuse; k++) {
	struct port_comm* pc = outnet->ip4_ifs[i].
	out[k];
	comm_point_delete(pc->cp);
	free(pc);
	}
	free(outnet->ip4_ifs[i].avail_ports);
	free(outnet->ip4_ifs[i].out);
	}
	free(outnet->ip4_ifs);
	}
	if(outnet->ip6_ifs) {
	int i, k;
	for(i=0; i<outnet->num_ip6; i++) {
	for(k=0; k<outnet->ip6_ifs[i].inuse; k++) {
	struct port_comm* pc = outnet->ip6_ifs[i].
	out[k];
	comm_point_delete(pc->cp);
	free(pc);
	}
	free(outnet->ip6_ifs[i].avail_ports);
	free(outnet->ip6_ifs[i].out);
	}
	free(outnet->ip6_ifs);
	}
	if(outnet->tcp_conns) {
	size_t i;
	for(i=0; i<outnet->num_tcp; i++)
	if(outnet->tcp_conns[i]) {
	comm_point_delete(outnet->tcp_conns[i]->c);
	waiting_tcp_delete(outnet->tcp_conns[i]->query);
	free(outnet->tcp_conns[i]);
	}
	free(outnet->tcp_conns);
	}
	if(outnet->tcp_wait_first) {
	struct waiting_tcp* p = outnet->tcp_wait_first, *np;
	while(p) {
	np = p->next_waiting;
	waiting_tcp_delete(p);
	p = np;
	}
	}
	if(outnet->udp_wait_first) {
	struct pending* p = outnet->udp_wait_first, *np;
	while(p) {
	np = p->next_waiting;
	pending_delete(NULL, p);
	p = np;
	}
	}
	free(outnet);
	}

	void
	pending_delete(struct outside_network* outnet, struct pending* p)
	{
	if(!p)
	return;
	if(outnet && outnet->udp_wait_first &&
	(p->next_waiting \|\| p == outnet->udp_wait_last) ) {
	/* delete from waiting list, if it is in the waiting list */
	struct pending* prev = NULL, *x = outnet->udp_wait_first;
	while(x && x != p) {
	prev = x;
	x = x->next_waiting;
	}
	if(x) {
	log_assert(x == p);
	if(prev)
	prev->next_waiting = p->next_waiting;
	else outnet->udp_wait_first = p->next_waiting;
	if(outnet->udp_wait_last == p)
	outnet->udp_wait_last = prev;
	}
	}
	if(outnet) {
	(void)rbtree_delete(outnet->pending, p->node.key);
	}
	if(p->timer)
	comm_timer_delete(p->timer);
	free(p->pkt);
	free(p);
	}

	static void
	sai6_putrandom(struct sockaddr_in6 sa, int pfxlen, struct ub_randstate rnd)
	{
	int i, last;
	if(!(pfxlen > 0 && pfxlen < 128))
	return;
	for(i = 0; i < (128 - pfxlen) / 8; i++) {
	sa->sin6_addr.s6_addr[15-i] = (uint8_t)ub_random_max(rnd, 256);
	}
	last = pfxlen & 7;
	if(last != 0) {
	sa->sin6_addr.s6_addr[15-i] \|=
	((0xFF >> last) & ub_random_max(rnd, 256));
	}
	}

	/**
	* Try to open a UDP socket for outgoing communication.
	* Sets sockets options as needed.
	* @param addr: socket address.
	* @param addrlen: length of address.
	* @param pfxlen: length of network prefix (for address randomisation).
	* @param port: port override for addr.
	* @param inuse: if -1 is returned, this bool means the port was in use.
	* @param rnd: random state (for address randomisation).
	* @return fd or -1
	*/
	static int
	udp_sockport(struct sockaddr_storage* addr, socklen_t addrlen, int pfxlen,
	int port, int* inuse, struct ub_randstate* rnd)
	{
	int fd, noproto;
	if(addr_is_ip6(addr, addrlen)) {
	int freebind = 0;
	struct sockaddr_in6 sa = (struct sockaddr_in6)addr;
	sa.sin6_port = (in_port_t)htons((uint16_t)port);
	sa.sin6_flowinfo = 0;
	sa.sin6_scope_id = 0;
	if(pfxlen != 0) {
	freebind = 1;
	sai6_putrandom(&sa, pfxlen, rnd);
	}
	fd = create_udp_sock(AF_INET6, SOCK_DGRAM,
	(struct sockaddr*)&sa, addrlen, 1, inuse, &noproto,
	0, 0, 0, NULL, 0, freebind, 0);
	} else {
	struct sockaddr_in* sa = (struct sockaddr_in*)addr;
	sa->sin_port = (in_port_t)htons((uint16_t)port);
	fd = create_udp_sock(AF_INET, SOCK_DGRAM,
	(struct sockaddr*)addr, addrlen, 1, inuse, &noproto,
	0, 0, 0, NULL, 0, 0, 0);
	}
	return fd;
	}

	/** Select random ID */
	static int
	select_id(struct outside_network* outnet, struct pending* pend,
	sldns_buffer* packet)
	{
	int id_tries = 0;
	pend->id = ((unsigned)ub_random(outnet->rnd)>>8) & 0xffff;
	LDNS_ID_SET(sldns_buffer_begin(packet), pend->id);

	/* insert in tree */
	pend->node.key = pend;
	while(!rbtree_insert(outnet->pending, &pend->node)) {
	/* change ID to avoid collision */
	pend->id = ((unsigned)ub_random(outnet->rnd)>>8) & 0xffff;
	LDNS_ID_SET(sldns_buffer_begin(packet), pend->id);
	id_tries++;
	if(id_tries == MAX_ID_RETRY) {
	pend->id=99999; /* non existant ID */
	log_err("failed to generate unique ID, drop msg");
	return 0;
	}
	}
	verbose(VERB_ALGO, "inserted new pending reply id=%4.4x", pend->id);
	return 1;
	}

	/** Select random interface and port */
	static int
	select_ifport(struct outside_network* outnet, struct pending* pend,
	int num_if, struct port_if* ifs)
	{
	int my_if, my_port, fd, portno, inuse, tries=0;
	struct port_if* pif;
	/* randomly select interface and port */
	if(num_if == 0) {
	verbose(VERB_QUERY, "Need to send query but have no "
	"outgoing interfaces of that family");
	return 0;
	}
	log_assert(outnet->unused_fds);
	tries = 0;
	while(1) {
	my_if = ub_random_max(outnet->rnd, num_if);
	pif = &ifs[my_if];
	my_port = ub_random_max(outnet->rnd, pif->avail_total);
	if(my_port < pif->inuse) {
	/* port already open */
	pend->pc = pif->out[my_port];
	verbose(VERB_ALGO, "using UDP if=%d port=%d",
	my_if, pend->pc->number);
	break;
	}
	/* try to open new port, if fails, loop to try again */
	log_assert(pif->inuse < pif->maxout);
	portno = pif->avail_ports[my_port - pif->inuse];
	fd = udp_sockport(&pif->addr, pif->addrlen, pif->pfxlen,
	portno, &inuse, outnet->rnd);
	if(fd == -1 && !inuse) {
	/* nonrecoverable error making socket */
	return 0;
	}
	if(fd != -1) {
	verbose(VERB_ALGO, "opened UDP if=%d port=%d",
	my_if, portno);
	/* grab fd */
	pend->pc = outnet->unused_fds;
	outnet->unused_fds = pend->pc->next;

	/* setup portcomm */
	pend->pc->next = NULL;
	pend->pc->number = portno;
	pend->pc->pif = pif;
	pend->pc->index = pif->inuse;
	pend->pc->num_outstanding = 0;
	comm_point_start_listening(pend->pc->cp, fd, -1);

	/* grab port in interface */
	pif->out[pif->inuse] = pend->pc;
	pif->avail_ports[my_port - pif->inuse] =
	pif->avail_ports[pif->avail_total-pif->inuse-1];
	pif->inuse++;
	break;
	}
	/* failed, already in use */
	verbose(VERB_QUERY, "port %d in use, trying another", portno);
	tries++;
	if(tries == MAX_PORT_RETRY) {
	log_err("failed to find an open port, drop msg");
	return 0;
	}
	}
	log_assert(pend->pc);
	pend->pc->num_outstanding++;

	return 1;
	}

	static int
	randomize_and_send_udp(struct pending* pend, sldns_buffer* packet, int timeout)
	{
	struct timeval tv;
	struct outside_network* outnet = pend->sq->outnet;

	/* select id */
	if(!select_id(outnet, pend, packet)) {
	return 0;
	}

	/* select src_if, port */
	if(addr_is_ip6(&pend->addr, pend->addrlen)) {
	if(!select_ifport(outnet, pend,
	outnet->num_ip6, outnet->ip6_ifs))
	return 0;
	} else {
	if(!select_ifport(outnet, pend,
	outnet->num_ip4, outnet->ip4_ifs))
	return 0;
	}
	log_assert(pend->pc && pend->pc->cp);

	/* send it over the commlink */
	if(!comm_point_send_udp_msg(pend->pc->cp, packet,
	(struct sockaddr*)&pend->addr, pend->addrlen)) {
	portcomm_loweruse(outnet, pend->pc);
	return 0;
	}

	/* system calls to set timeout after sending UDP to make roundtrip
	smaller. */
	#ifndef S_SPLINT_S
	tv.tv_sec = timeout/1000;
	tv.tv_usec = (timeout%1000)*1000;
	#endif
	comm_timer_set(pend->timer, &tv);

	#ifdef USE_DNSTAP
	if(outnet->dtenv &&
	(outnet->dtenv->log_resolver_query_messages \|\|
	outnet->dtenv->log_forwarder_query_messages))
	dt_msg_send_outside_query(outnet->dtenv, &pend->addr, comm_udp,
	pend->sq->zone, pend->sq->zonelen, packet);
	#endif
	return 1;
	}

	struct pending*
	pending_udp_query(struct serviced_query* sq, struct sldns_buffer* packet,
	int timeout, comm_point_callback_type* cb, void* cb_arg)
	{
	struct pending* pend = (struct pending)calloc(1, sizeof(pend));
	if(!pend) return NULL;
	pend->outnet = sq->outnet;
	pend->sq = sq;
	pend->addrlen = sq->addrlen;
	memmove(&pend->addr, &sq->addr, sq->addrlen);
	pend->cb = cb;
	pend->cb_arg = cb_arg;
	pend->node.key = pend;
	pend->timer = comm_timer_create(sq->outnet->base, pending_udp_timer_cb,
	pend);
	if(!pend->timer) {
	free(pend);
	return NULL;
	}

	if(sq->outnet->unused_fds == NULL) {
	/* no unused fd, cannot create a new port (randomly) */
	verbose(VERB_ALGO, "no fds available, udp query waiting");
	pend->timeout = timeout;
	pend->pkt_len = sldns_buffer_limit(packet);
	pend->pkt = (uint8_t*)memdup(sldns_buffer_begin(packet),
	pend->pkt_len);
	if(!pend->pkt) {
	comm_timer_delete(pend->timer);
	free(pend);
	return NULL;
	}
	/* put at end of waiting list */
	if(sq->outnet->udp_wait_last)
	sq->outnet->udp_wait_last->next_waiting = pend;
	else
	sq->outnet->udp_wait_first = pend;
	sq->outnet->udp_wait_last = pend;
	return pend;
	}
	if(!randomize_and_send_udp(pend, packet, timeout)) {
	pending_delete(sq->outnet, pend);
	return NULL;
	}
	return pend;
	}

	void
	outnet_tcptimer(void* arg)
	{
	struct waiting_tcp* w = (struct waiting_tcp*)arg;
	struct outside_network* outnet = w->outnet;
	comm_point_callback_type* cb;
	void* cb_arg;
	if(w->pkt) {
	/* it is on the waiting list */
	waiting_list_remove(outnet, w);
	} else {
	/* it was in use */
	struct pending_tcp* pend=(struct pending_tcp*)w->next_waiting;
	if(pend->c->ssl) {
	#ifdef HAVE_SSL
	SSL_shutdown(pend->c->ssl);
	SSL_free(pend->c->ssl);
	pend->c->ssl = NULL;
	#endif
	}
	comm_point_close(pend->c);
	pend->query = NULL;
	pend->next_free = outnet->tcp_free;
	outnet->tcp_free = pend;
	}
	cb = w->cb;
	cb_arg = w->cb_arg;
	waiting_tcp_delete(w);
	fptr_ok(fptr_whitelist_pending_tcp(cb));
	(void)(*cb)(NULL, cb_arg, NETEVENT_TIMEOUT, NULL);
	use_free_buffer(outnet);
	}

	struct waiting_tcp*
	pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet,
	int timeout, comm_point_callback_type* callback, void* callback_arg)
	{
	struct pending_tcp* pend = sq->outnet->tcp_free;
	struct waiting_tcp* w;
	struct timeval tv;
	uint16_t id;
	/* if no buffer is free allocate space to store query */
	w = (struct waiting_tcp*)malloc(sizeof(struct waiting_tcp)
	+ (pend?0:sldns_buffer_limit(packet)));
	if(!w) {
	return NULL;
	}
	if(!(w->timer = comm_timer_create(sq->outnet->base, outnet_tcptimer, w))) {
	free(w);
	return NULL;
	}
	w->pkt = NULL;
	w->pkt_len = 0;
	id = ((unsigned)ub_random(sq->outnet->rnd)>>8) & 0xffff;
	LDNS_ID_SET(sldns_buffer_begin(packet), id);
	memcpy(&w->addr, &sq->addr, sq->addrlen);
	w->addrlen = sq->addrlen;
	w->outnet = sq->outnet;
	w->cb = callback;
	w->cb_arg = callback_arg;
	w->ssl_upstream = sq->ssl_upstream;
	w->tls_auth_name = sq->tls_auth_name;
	#ifndef S_SPLINT_S
	tv.tv_sec = timeout/1000;
	tv.tv_usec = (timeout%1000)*1000;
	#endif
	comm_timer_set(w->timer, &tv);
	if(pend) {
	/* we have a buffer available right now */
	if(!outnet_tcp_take_into_use(w, sldns_buffer_begin(packet),
	sldns_buffer_limit(packet))) {
	waiting_tcp_delete(w);
	return NULL;
	}
	#ifdef USE_DNSTAP
	if(sq->outnet->dtenv &&
	(sq->outnet->dtenv->log_resolver_query_messages \|\|
	sq->outnet->dtenv->log_forwarder_query_messages))
	dt_msg_send_outside_query(sq->outnet->dtenv, &sq->addr,
	comm_tcp, sq->zone, sq->zonelen, packet);
	#endif
	} else {
	/* queue up */
	w->pkt = (uint8_t*)w + sizeof(struct waiting_tcp);
	w->pkt_len = sldns_buffer_limit(packet);
	memmove(w->pkt, sldns_buffer_begin(packet), w->pkt_len);
	w->next_waiting = NULL;
	if(sq->outnet->tcp_wait_last)
	sq->outnet->tcp_wait_last->next_waiting = w;
	else sq->outnet->tcp_wait_first = w;
	sq->outnet->tcp_wait_last = w;
	}
	return w;
	}

	/** create query for serviced queries */
	static void
	serviced_gen_query(sldns_buffer* buff, uint8_t* qname, size_t qnamelen,
	uint16_t qtype, uint16_t qclass, uint16_t flags)
	{
	sldns_buffer_clear(buff);
	/* skip id */
	sldns_buffer_write_u16(buff, flags);
	sldns_buffer_write_u16(buff, 1); /* qdcount */
	sldns_buffer_write_u16(buff, 0); /* ancount */
	sldns_buffer_write_u16(buff, 0); /* nscount */
	sldns_buffer_write_u16(buff, 0); /* arcount */
	sldns_buffer_write(buff, qname, qnamelen);
	sldns_buffer_write_u16(buff, qtype);
	sldns_buffer_write_u16(buff, qclass);
	sldns_buffer_flip(buff);
	}

	/** lookup serviced query in serviced query rbtree */
	static struct serviced_query*
	lookup_serviced(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
	struct sockaddr_storage* addr, socklen_t addrlen,
	struct edns_option* opt_list)
	{
	struct serviced_query key;
	key.node.key = &key;
	key.qbuf = sldns_buffer_begin(buff);
	key.qbuflen = sldns_buffer_limit(buff);
	key.dnssec = dnssec;
	memcpy(&key.addr, addr, addrlen);
	key.addrlen = addrlen;
	key.outnet = outnet;
	key.opt_list = opt_list;
	return (struct serviced_query*)rbtree_search(outnet->serviced, &key);
	}

	/** Create new serviced entry */
	static struct serviced_query*
	serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
	int want_dnssec, int nocaps, int tcp_upstream, int ssl_upstream,
	char* tls_auth_name, struct sockaddr_storage* addr, socklen_t addrlen,
	uint8_t* zone, size_t zonelen, int qtype, struct edns_option* opt_list)
	{
	struct serviced_query* sq = (struct serviced_query)malloc(sizeof(sq));
	#ifdef UNBOUND_DEBUG
	rbnode_type* ins;
	#endif
	if(!sq)
	return NULL;
	sq->node.key = sq;
	sq->qbuf = memdup(sldns_buffer_begin(buff), sldns_buffer_limit(buff));
	if(!sq->qbuf) {
	free(sq);
	return NULL;
	}
	sq->qbuflen = sldns_buffer_limit(buff);
	sq->zone = memdup(zone, zonelen);
	if(!sq->zone) {
	free(sq->qbuf);
	free(sq);
	return NULL;
	}
	sq->zonelen = zonelen;
	sq->qtype = qtype;
	sq->dnssec = dnssec;
	sq->want_dnssec = want_dnssec;
	sq->nocaps = nocaps;
	sq->tcp_upstream = tcp_upstream;
	sq->ssl_upstream = ssl_upstream;
	if(tls_auth_name) {
	sq->tls_auth_name = strdup(tls_auth_name);
	if(!sq->tls_auth_name) {
	free(sq->zone);
	free(sq->qbuf);
	free(sq);
	return NULL;
	}
	} else {
	sq->tls_auth_name = NULL;
	}
	memcpy(&sq->addr, addr, addrlen);
	sq->addrlen = addrlen;
	sq->opt_list = NULL;
	if(opt_list) {
	sq->opt_list = edns_opt_copy_alloc(opt_list);
	if(!sq->opt_list) {
	free(sq->tls_auth_name);
	free(sq->zone);
	free(sq->qbuf);
	free(sq);
	return NULL;
	}
	}
	sq->outnet = outnet;
	sq->cblist = NULL;
	sq->pending = NULL;
	sq->status = serviced_initial;
	sq->retry = 0;
	sq->to_be_deleted = 0;
	#ifdef UNBOUND_DEBUG
	ins =
	#else
	(void)
	#endif
	rbtree_insert(outnet->serviced, &sq->node);
	log_assert(ins != NULL); /* must not be already present */
	return sq;
	}

	/** remove waiting tcp from the outnet waiting list */
	static void
	waiting_list_remove(struct outside_network* outnet, struct waiting_tcp* w)
	{
	struct waiting_tcp* p = outnet->tcp_wait_first, *prev = NULL;
	while(p) {
	if(p == w) {
	/* remove w */
	if(prev)
	prev->next_waiting = w->next_waiting;
	else outnet->tcp_wait_first = w->next_waiting;
	if(outnet->tcp_wait_last == w)
	outnet->tcp_wait_last = prev;
	return;
	}
	prev = p;
	p = p->next_waiting;
	}
	}

	/** cleanup serviced query entry */
	static void
	serviced_delete(struct serviced_query* sq)
	{
	if(sq->pending) {
	/* clear up the pending query */
	if(sq->status == serviced_query_UDP_EDNS \|\|
	sq->status == serviced_query_UDP \|\|
	- sq->status == serviced_query_PROBE_EDNS \|\|
	sq->status == serviced_query_UDP_EDNS_FRAG \|\|
	sq->status == serviced_query_UDP_EDNS_fallback) {
	struct pending* p = (struct pending*)sq->pending;
	if(p->pc)
	portcomm_loweruse(sq->outnet, p->pc);
	pending_delete(sq->outnet, p);
	/* this call can cause reentrant calls back into the
	* mesh */
	outnet_send_wait_udp(sq->outnet);
	} else {
	struct waiting_tcp* p = (struct waiting_tcp*)
	sq->pending;
	if(p->pkt == NULL) {
	decommission_pending_tcp(sq->outnet,
	(struct pending_tcp*)p->next_waiting);
	} else {
	waiting_list_remove(sq->outnet, p);
	waiting_tcp_delete(p);
	}
	}
	}
	/* does not delete from tree, caller has to do that */
	serviced_node_del(&sq->node, NULL);
	}

	/** perturb a dname capitalization randomly */
	static void
	serviced_perturb_qname(struct ub_randstate* rnd, uint8_t* qbuf, size_t len)
	{
	uint8_t lablen;
	uint8_t* d = qbuf + 10;
	long int random = 0;
	int bits = 0;
	log_assert(len >= 10 + 5 /* offset qname, root, qtype, qclass */);
	(void)len;
	lablen = *d++;
	while(lablen) {
	while(lablen--) {
	/* only perturb A-Z, a-z */
	if(isalpha((unsigned char)*d)) {
	/* get a random bit */
	if(bits == 0) {
	random = ub_random(rnd);
	bits = 30;
	}
	if(random & 0x1) {
	d = (uint8_t)toupper((unsigned char)d);
	} else {
	d = (uint8_t)tolower((unsigned char)d);
	}
	random >>= 1;
	bits--;
	}
	d++;
	}
	lablen = *d++;
	}
	if(verbosity >= VERB_ALGO) {
	char buf[LDNS_MAX_DOMAINLEN+1];
	dname_str(qbuf+10, buf);
	verbose(VERB_ALGO, "qname perturbed to %s", buf);
	}
	}

	/** put serviced query into a buffer */
	static void
	serviced_encode(struct serviced_query* sq, sldns_buffer* buff, int with_edns)
	{
	/* if we are using 0x20 bits for ID randomness, perturb them */
	if(sq->outnet->use_caps_for_id && !sq->nocaps) {
	serviced_perturb_qname(sq->outnet->rnd, sq->qbuf, sq->qbuflen);
	}
	/* generate query */
	sldns_buffer_clear(buff);
	sldns_buffer_write_u16(buff, 0); /* id placeholder */
	sldns_buffer_write(buff, sq->qbuf, sq->qbuflen);
	sldns_buffer_flip(buff);
	if(with_edns) {
	/* add edns section */
	struct edns_data edns;
	edns.edns_present = 1;
	edns.ext_rcode = 0;
	edns.edns_version = EDNS_ADVERTISED_VERSION;
	edns.opt_list = sq->opt_list;
	if(sq->status == serviced_query_UDP_EDNS_FRAG) {
	if(addr_is_ip6(&sq->addr, sq->addrlen)) {
	if(EDNS_FRAG_SIZE_IP6 < EDNS_ADVERTISED_SIZE)
	edns.udp_size = EDNS_FRAG_SIZE_IP6;
	else edns.udp_size = EDNS_ADVERTISED_SIZE;
	} else {
	if(EDNS_FRAG_SIZE_IP4 < EDNS_ADVERTISED_SIZE)
	edns.udp_size = EDNS_FRAG_SIZE_IP4;
	else edns.udp_size = EDNS_ADVERTISED_SIZE;
	}
	} else {
	edns.udp_size = EDNS_ADVERTISED_SIZE;
	}
	edns.bits = 0;
	if(sq->dnssec & EDNS_DO)
	edns.bits = EDNS_DO;
	if(sq->dnssec & BIT_CD)
	LDNS_CD_SET(sldns_buffer_begin(buff));
	attach_edns_record(buff, &edns);
	}
	}

	/**
	* Perform serviced query UDP sending operation.
	* Sends UDP with EDNS, unless infra host marked non EDNS.
	* @param sq: query to send.
	* @param buff: buffer scratch space.
	* @return 0 on error.
	*/
	static int
	serviced_udp_send(struct serviced_query* sq, sldns_buffer* buff)
	{
	int rtt, vs;
	uint8_t edns_lame_known;
	time_t now = *sq->outnet->now_secs;

	if(!infra_host(sq->outnet->infra, &sq->addr, sq->addrlen, sq->zone,
	sq->zonelen, now, &vs, &edns_lame_known, &rtt))
	return 0;
	sq->last_rtt = rtt;
	verbose(VERB_ALGO, "EDNS lookup known=%d vs=%d", edns_lame_known, vs);
	if(sq->status == serviced_initial) {
	- if(edns_lame_known == 0 && rtt > 5000 && rtt < 10001) {
	- /* perform EDNS lame probe - check if server is
	- * EDNS lame (EDNS queries to it are dropped) */
	- verbose(VERB_ALGO, "serviced query: send probe to see "
	- " if use of EDNS causes timeouts");
	- /* even 700 msec may be too small */
	- rtt = 1000;
	- sq->status = serviced_query_PROBE_EDNS;
	- } else if(vs != -1) {
	+ if(vs != -1) {
	sq->status = serviced_query_UDP_EDNS;
	} else {
	sq->status = serviced_query_UDP;
	}
	}
	serviced_encode(sq, buff, (sq->status == serviced_query_UDP_EDNS) \|\|
	(sq->status == serviced_query_UDP_EDNS_FRAG));
	sq->last_sent_time = *sq->outnet->now_tv;
	sq->edns_lame_known = (int)edns_lame_known;
	verbose(VERB_ALGO, "serviced query UDP timeout=%d msec", rtt);
	sq->pending = pending_udp_query(sq, buff, rtt,
	serviced_udp_callback, sq);
	if(!sq->pending)
	return 0;
	return 1;
	}

	/** check that perturbed qname is identical */
	static int
	serviced_check_qname(sldns_buffer* pkt, uint8_t* qbuf, size_t qbuflen)
	{
	uint8_t* d1 = sldns_buffer_begin(pkt)+12;
	uint8_t* d2 = qbuf+10;
	uint8_t len1, len2;
	int count = 0;
	if(sldns_buffer_limit(pkt) < 12+1+4) /* packet too small for qname */
	return 0;
	log_assert(qbuflen >= 15 /* 10 header, root, type, class */);
	len1 = *d1++;
	len2 = *d2++;
	while(len1 != 0 \|\| len2 != 0) {
	if(LABEL_IS_PTR(len1)) {
	/* check if we can read d1 with compression ptr rest /
	if(d1 >= sldns_buffer_at(pkt, sldns_buffer_limit(pkt)))
	return 0;
	d1 = sldns_buffer_begin(pkt)+PTR_OFFSET(len1, *d1);
	/* check if we can read the destination d1 /
	if(d1 >= sldns_buffer_at(pkt, sldns_buffer_limit(pkt)))
	return 0;
	len1 = *d1++;
	if(count++ > MAX_COMPRESS_PTRS)
	return 0;
	continue;
	}
	if(d2 > qbuf+qbuflen)
	return 0;
	if(len1 != len2)
	return 0;
	if(len1 > LDNS_MAX_LABELLEN)
	return 0;
	/* check len1 + 1(next length) are okay to read */
	if(d1+len1 >= sldns_buffer_at(pkt, sldns_buffer_limit(pkt)))
	return 0;
	log_assert(len1 <= LDNS_MAX_LABELLEN);
	log_assert(len2 <= LDNS_MAX_LABELLEN);
	log_assert(len1 == len2 && len1 != 0);
	/* compare the labels - bitwise identical */
	if(memcmp(d1, d2, len1) != 0)
	return 0;
	d1 += len1;
	d2 += len2;
	len1 = *d1++;
	len2 = *d2++;
	}
	return 1;
	}

	/** call the callbacks for a serviced query */
	static void
	serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c,
	struct comm_reply* rep)
	{
	struct service_callback* p;
	int dobackup = (sq->cblist && sq->cblist->next); /* >1 cb*/
	uint8_t *backup_p = NULL;
	size_t backlen = 0;
	#ifdef UNBOUND_DEBUG
	rbnode_type* rem =
	#else
	(void)
	#endif
	/* remove from tree, and schedule for deletion, so that callbacks
	* can safely deregister themselves and even create new serviced
	* queries that are identical to this one. */
	rbtree_delete(sq->outnet->serviced, sq);
	log_assert(rem); /* should have been present */
	sq->to_be_deleted = 1;
	verbose(VERB_ALGO, "svcd callbacks start");
	if(sq->outnet->use_caps_for_id && error == NETEVENT_NOERROR && c &&
	!sq->nocaps && sq->qtype != LDNS_RR_TYPE_PTR) {
	/* for type PTR do not check perturbed name in answer,
	* compatibility with cisco dns guard boxes that mess up
	* reverse queries 0x20 contents */
	/* noerror and nxdomain must have a qname in reply */
	if(sldns_buffer_read_u16_at(c->buffer, 4) == 0 &&
	(LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer))
	== LDNS_RCODE_NOERROR \|\|
	LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer))
	== LDNS_RCODE_NXDOMAIN)) {
	verbose(VERB_DETAIL, "no qname in reply to check 0x20ID");
	log_addr(VERB_DETAIL, "from server",
	&sq->addr, sq->addrlen);
	log_buf(VERB_DETAIL, "for packet", c->buffer);
	error = NETEVENT_CLOSED;
	c = NULL;
	} else if(sldns_buffer_read_u16_at(c->buffer, 4) > 0 &&
	!serviced_check_qname(c->buffer, sq->qbuf,
	sq->qbuflen)) {
	verbose(VERB_DETAIL, "wrong 0x20-ID in reply qname");
	log_addr(VERB_DETAIL, "from server",
	&sq->addr, sq->addrlen);
	log_buf(VERB_DETAIL, "for packet", c->buffer);
	error = NETEVENT_CAPSFAIL;
	/* and cleanup too */
	pkt_dname_tolower(c->buffer,
	sldns_buffer_at(c->buffer, 12));
	} else {
	verbose(VERB_ALGO, "good 0x20-ID in reply qname");
	/* cleanup caps, prettier cache contents. */
	pkt_dname_tolower(c->buffer,
	sldns_buffer_at(c->buffer, 12));
	}
	}
	if(dobackup && c) {
	/* make a backup of the query, since the querystate processing
	* may send outgoing queries that overwrite the buffer.
	* use secondary buffer to store the query.
	* This is a data copy, but faster than packet to server */
	backlen = sldns_buffer_limit(c->buffer);
	backup_p = memdup(sldns_buffer_begin(c->buffer), backlen);
	if(!backup_p) {
	log_err("malloc failure in serviced query callbacks");
	error = NETEVENT_CLOSED;
	c = NULL;
	}
	sq->outnet->svcd_overhead = backlen;
	}
	/* test the actual sq->cblist, because the next elem could be deleted*/
	while((p=sq->cblist) != NULL) {
	sq->cblist = p->next; /* remove this element */
	if(dobackup && c) {
	sldns_buffer_clear(c->buffer);
	sldns_buffer_write(c->buffer, backup_p, backlen);
	sldns_buffer_flip(c->buffer);
	}
	fptr_ok(fptr_whitelist_serviced_query(p->cb));
	(void)(*p->cb)(c, p->cb_arg, error, rep);
	free(p);
	}
	if(backup_p) {
	free(backup_p);
	sq->outnet->svcd_overhead = 0;
	}
	verbose(VERB_ALGO, "svcd callbacks end");
	log_assert(sq->cblist == NULL);
	serviced_delete(sq);
	}

	int
	serviced_tcp_callback(struct comm_point* c, void* arg, int error,
	struct comm_reply* rep)
	{
	struct serviced_query* sq = (struct serviced_query*)arg;
	struct comm_reply r2;
	sq->pending = NULL; /* removed after this callback */
	if(error != NETEVENT_NOERROR)
	log_addr(VERB_QUERY, "tcp error for address",
	&sq->addr, sq->addrlen);
	if(error==NETEVENT_NOERROR)
	infra_update_tcp_works(sq->outnet->infra, &sq->addr,
	sq->addrlen, sq->zone, sq->zonelen);
	#ifdef USE_DNSTAP
	if(error==NETEVENT_NOERROR && sq->outnet->dtenv &&
	(sq->outnet->dtenv->log_resolver_response_messages \|\|
	sq->outnet->dtenv->log_forwarder_response_messages))
	dt_msg_send_outside_response(sq->outnet->dtenv, &sq->addr,
	c->type, sq->zone, sq->zonelen, sq->qbuf, sq->qbuflen,
	&sq->last_sent_time, sq->outnet->now_tv, c->buffer);
	#endif
	if(error==NETEVENT_NOERROR && sq->status == serviced_query_TCP_EDNS &&
	(LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer)) ==
	LDNS_RCODE_FORMERR \|\| LDNS_RCODE_WIRE(sldns_buffer_begin(
	c->buffer)) == LDNS_RCODE_NOTIMPL) ) {
	/* attempt to fallback to nonEDNS */
	sq->status = serviced_query_TCP_EDNS_fallback;
	serviced_tcp_initiate(sq, c->buffer);
	return 0;
	} else if(error==NETEVENT_NOERROR &&
	sq->status == serviced_query_TCP_EDNS_fallback &&
	(LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer)) ==
	LDNS_RCODE_NOERROR \|\| LDNS_RCODE_WIRE(
	sldns_buffer_begin(c->buffer)) == LDNS_RCODE_NXDOMAIN
	\|\| LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer))
	== LDNS_RCODE_YXDOMAIN)) {
	/* the fallback produced a result that looks promising, note
	* that this server should be approached without EDNS */
	/* only store noEDNS in cache if domain is noDNSSEC */
	if(!sq->want_dnssec)
	if(!infra_edns_update(sq->outnet->infra, &sq->addr,
	sq->addrlen, sq->zone, sq->zonelen, -1,
	*sq->outnet->now_secs))
	log_err("Out of memory caching no edns for host");
	sq->status = serviced_query_TCP;
	}
	if(sq->tcp_upstream \|\| sq->ssl_upstream) {
	struct timeval now = *sq->outnet->now_tv;
	if(error!=NETEVENT_NOERROR) {
	if(!infra_rtt_update(sq->outnet->infra, &sq->addr,
	sq->addrlen, sq->zone, sq->zonelen, sq->qtype,
	-1, sq->last_rtt, (time_t)now.tv_sec))
	log_err("out of memory in TCP exponential backoff.");
	} else if(now.tv_sec > sq->last_sent_time.tv_sec \|\|
	(now.tv_sec == sq->last_sent_time.tv_sec &&
	now.tv_usec > sq->last_sent_time.tv_usec)) {
	/* convert from microseconds to milliseconds */
	int roundtime = ((int)(now.tv_sec - sq->last_sent_time.tv_sec))*1000
	+ ((int)now.tv_usec - (int)sq->last_sent_time.tv_usec)/1000;
	verbose(VERB_ALGO, "measured TCP-time at %d msec", roundtime);
	log_assert(roundtime >= 0);
	/* only store if less then AUTH_TIMEOUT seconds, it could be
	* huge due to system-hibernated and we woke up */
	if(roundtime < 60000) {
	if(!infra_rtt_update(sq->outnet->infra, &sq->addr,
	sq->addrlen, sq->zone, sq->zonelen, sq->qtype,
	roundtime, sq->last_rtt, (time_t)now.tv_sec))
	log_err("out of memory noting rtt.");
	}
	}
	}
	/* insert address into reply info */
	if(!rep) {
	/* create one if there isn't (on errors) */
	rep = &r2;
	r2.c = c;
	}
	memcpy(&rep->addr, &sq->addr, sq->addrlen);
	rep->addrlen = sq->addrlen;
	serviced_callbacks(sq, error, c, rep);
	return 0;
	}

	static void
	serviced_tcp_initiate(struct serviced_query* sq, sldns_buffer* buff)
	{
	verbose(VERB_ALGO, "initiate TCP query %s",
	sq->status==serviced_query_TCP_EDNS?"EDNS":"");
	serviced_encode(sq, buff, sq->status == serviced_query_TCP_EDNS);
	sq->last_sent_time = *sq->outnet->now_tv;
	sq->pending = pending_tcp_query(sq, buff, TCP_AUTH_QUERY_TIMEOUT,
	serviced_tcp_callback, sq);
	if(!sq->pending) {
	/* delete from tree so that a retry by above layer does not
	* clash with this entry */
	- log_err("serviced_tcp_initiate: failed to send tcp query");
	+ verbose(VERB_ALGO, "serviced_tcp_initiate: failed to send tcp query");
	serviced_callbacks(sq, NETEVENT_CLOSED, NULL, NULL);
	}
	}

	/** Send serviced query over TCP return false on initial failure */
	static int
	serviced_tcp_send(struct serviced_query* sq, sldns_buffer* buff)
	{
	int vs, rtt, timeout;
	uint8_t edns_lame_known;
	if(!infra_host(sq->outnet->infra, &sq->addr, sq->addrlen, sq->zone,
	sq->zonelen, *sq->outnet->now_secs, &vs, &edns_lame_known,
	&rtt))
	return 0;
	sq->last_rtt = rtt;
	if(vs != -1)
	sq->status = serviced_query_TCP_EDNS;
	else sq->status = serviced_query_TCP;
	serviced_encode(sq, buff, sq->status == serviced_query_TCP_EDNS);
	sq->last_sent_time = *sq->outnet->now_tv;
	if(sq->tcp_upstream \|\| sq->ssl_upstream) {
	timeout = rtt;
	if(rtt >= UNKNOWN_SERVER_NICENESS && rtt < TCP_AUTH_QUERY_TIMEOUT)
	timeout = TCP_AUTH_QUERY_TIMEOUT;
	} else {
	timeout = TCP_AUTH_QUERY_TIMEOUT;
	}
	sq->pending = pending_tcp_query(sq, buff, timeout,
	serviced_tcp_callback, sq);
	return sq->pending != NULL;
	}

	/* see if packet is edns malformed; got zeroes at start.
	* This is from servers that return malformed packets to EDNS0 queries,
	* but they return good packets for nonEDNS0 queries.
	* We try to detect their output; without resorting to a full parse or
	* check for too many bytes after the end of the packet. */
	static int
	packet_edns_malformed(struct sldns_buffer* buf, int qtype)
	{
	size_t len;
	if(sldns_buffer_limit(buf) < LDNS_HEADER_SIZE)
	return 1; /* malformed */
	/* they have NOERROR rcode, 1 answer. */
	if(LDNS_RCODE_WIRE(sldns_buffer_begin(buf)) != LDNS_RCODE_NOERROR)
	return 0;
	/* one query (to skip) and answer records */
	if(LDNS_QDCOUNT(sldns_buffer_begin(buf)) != 1 \|\|
	LDNS_ANCOUNT(sldns_buffer_begin(buf)) == 0)
	return 0;
	/* skip qname */
	len = dname_valid(sldns_buffer_at(buf, LDNS_HEADER_SIZE),
	sldns_buffer_limit(buf)-LDNS_HEADER_SIZE);
	if(len == 0)
	return 0;
	if(len == 1 && qtype == 0)
	return 0; /* we asked for '.' and type 0 */
	/* and then 4 bytes (type and class of query) */
	if(sldns_buffer_limit(buf) < LDNS_HEADER_SIZE + len + 4 + 3)
	return 0;

	/* and start with 11 zeroes as the answer RR */
	/* so check the qtype of the answer record, qname=0, type=0 */
	if(sldns_buffer_at(buf, LDNS_HEADER_SIZE+len+4)[0] == 0 &&
	sldns_buffer_at(buf, LDNS_HEADER_SIZE+len+4)[1] == 0 &&
	sldns_buffer_at(buf, LDNS_HEADER_SIZE+len+4)[2] == 0)
	return 1;
	return 0;
	}

	int
	serviced_udp_callback(struct comm_point* c, void* arg, int error,
	struct comm_reply* rep)
	{
	struct serviced_query* sq = (struct serviced_query*)arg;
	struct outside_network* outnet = sq->outnet;
	struct timeval now = *sq->outnet->now_tv;
	- int fallback_tcp = 0;

	sq->pending = NULL; /* removed after callback */
	if(error == NETEVENT_TIMEOUT) {
	int rto = 0;
	- if(sq->status == serviced_query_PROBE_EDNS) {
	- /* non-EDNS probe failed; we do not know its status,
	- * keep trying with EDNS, timeout may not be caused
	- * by EDNS. */
	- sq->status = serviced_query_UDP_EDNS;
	- }
	if(sq->status == serviced_query_UDP_EDNS && sq->last_rtt < 5000) {
	/* fallback to 1480/1280 */
	sq->status = serviced_query_UDP_EDNS_FRAG;
	log_name_addr(VERB_ALGO, "try edns1xx0", sq->qbuf+10,
	&sq->addr, sq->addrlen);
	if(!serviced_udp_send(sq, c->buffer)) {
	serviced_callbacks(sq, NETEVENT_CLOSED, c, rep);
	}
	return 0;
	}
	if(sq->status == serviced_query_UDP_EDNS_FRAG) {
	/* fragmentation size did not fix it */
	sq->status = serviced_query_UDP_EDNS;
	}
	sq->retry++;
	if(!(rto=infra_rtt_update(outnet->infra, &sq->addr, sq->addrlen,
	sq->zone, sq->zonelen, sq->qtype, -1, sq->last_rtt,
	(time_t)now.tv_sec)))
	log_err("out of memory in UDP exponential backoff");
	if(sq->retry < OUTBOUND_UDP_RETRY) {
	log_name_addr(VERB_ALGO, "retry query", sq->qbuf+10,
	&sq->addr, sq->addrlen);
	if(!serviced_udp_send(sq, c->buffer)) {
	serviced_callbacks(sq, NETEVENT_CLOSED, c, rep);
	}
	return 0;
	}
	- if(rto >= RTT_MAX_TIMEOUT) {
	- /* fallback_tcp = 1; */
	- /* UDP does not work, fallback to TCP below */
	- } else {
	- serviced_callbacks(sq, NETEVENT_TIMEOUT, c, rep);
	- return 0;
	- }
	- } else if(error != NETEVENT_NOERROR) {
	+ }
	+ if(error != NETEVENT_NOERROR) {
	/* udp returns error (due to no ID or interface available) */
	serviced_callbacks(sq, error, c, rep);
	return 0;
	}
	#ifdef USE_DNSTAP
	if(error == NETEVENT_NOERROR && outnet->dtenv &&
	(outnet->dtenv->log_resolver_response_messages \|\|
	outnet->dtenv->log_forwarder_response_messages))
	dt_msg_send_outside_response(outnet->dtenv, &sq->addr, c->type,
	sq->zone, sq->zonelen, sq->qbuf, sq->qbuflen,
	&sq->last_sent_time, sq->outnet->now_tv, c->buffer);
	#endif
	- if(!fallback_tcp) {
	- if( (sq->status == serviced_query_UDP_EDNS
	- \|\|sq->status == serviced_query_UDP_EDNS_FRAG)
	+ if( (sq->status == serviced_query_UDP_EDNS
	+ \|\|sq->status == serviced_query_UDP_EDNS_FRAG)
	&& (LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer))
	== LDNS_RCODE_FORMERR \|\| LDNS_RCODE_WIRE(
	sldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOTIMPL
	\|\| packet_edns_malformed(c->buffer, sq->qtype)
	)) {
	/* try to get an answer by falling back without EDNS */
	verbose(VERB_ALGO, "serviced query: attempt without EDNS");
	sq->status = serviced_query_UDP_EDNS_fallback;
	sq->retry = 0;
	if(!serviced_udp_send(sq, c->buffer)) {
	serviced_callbacks(sq, NETEVENT_CLOSED, c, rep);
	}
	return 0;
	- } else if(sq->status == serviced_query_PROBE_EDNS) {
	- /* probe without EDNS succeeds, so we conclude that this
	- * host likely has EDNS packets dropped */
	- log_addr(VERB_DETAIL, "timeouts, concluded that connection to "
	- "host drops EDNS packets", &sq->addr, sq->addrlen);
	- /* only store noEDNS in cache if domain is noDNSSEC */
	- if(!sq->want_dnssec)
	- if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
	- sq->zone, sq->zonelen, -1, (time_t)now.tv_sec)) {
	- log_err("Out of memory caching no edns for host");
	- }
	- sq->status = serviced_query_UDP;
	- } else if(sq->status == serviced_query_UDP_EDNS &&
	+ } else if(sq->status == serviced_query_UDP_EDNS &&
	!sq->edns_lame_known) {
	/* now we know that edns queries received answers store that */
	log_addr(VERB_ALGO, "serviced query: EDNS works for",
	&sq->addr, sq->addrlen);
	if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
	sq->zone, sq->zonelen, 0, (time_t)now.tv_sec)) {
	log_err("Out of memory caching edns works");
	}
	sq->edns_lame_known = 1;
	- } else if(sq->status == serviced_query_UDP_EDNS_fallback &&
	+ } else if(sq->status == serviced_query_UDP_EDNS_fallback &&
	!sq->edns_lame_known && (LDNS_RCODE_WIRE(
	sldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOERROR \|\|
	LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer)) ==
	LDNS_RCODE_NXDOMAIN \|\| LDNS_RCODE_WIRE(sldns_buffer_begin(
	c->buffer)) == LDNS_RCODE_YXDOMAIN)) {
	/* the fallback produced a result that looks promising, note
	* that this server should be approached without EDNS */
	/* only store noEDNS in cache if domain is noDNSSEC */
	if(!sq->want_dnssec) {
	log_addr(VERB_ALGO, "serviced query: EDNS fails for",
	&sq->addr, sq->addrlen);
	if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
	sq->zone, sq->zonelen, -1, (time_t)now.tv_sec)) {
	log_err("Out of memory caching no edns for host");
	}
	} else {
	log_addr(VERB_ALGO, "serviced query: EDNS fails, but "
	- "not stored because need DNSSEC for", &sq->addr,
	+ "not stored because need DNSSEC for", &sq->addr,
	sq->addrlen);
	}
	sq->status = serviced_query_UDP;
	- }
	- if(now.tv_sec > sq->last_sent_time.tv_sec \|\|
	+ }
	+ if(now.tv_sec > sq->last_sent_time.tv_sec \|\|
	(now.tv_sec == sq->last_sent_time.tv_sec &&
	now.tv_usec > sq->last_sent_time.tv_usec)) {
	/* convert from microseconds to milliseconds */
	int roundtime = ((int)(now.tv_sec - sq->last_sent_time.tv_sec))*1000
	+ ((int)now.tv_usec - (int)sq->last_sent_time.tv_usec)/1000;
	verbose(VERB_ALGO, "measured roundtrip at %d msec", roundtime);
	log_assert(roundtime >= 0);
	/* in case the system hibernated, do not enter a huge value,
	* above this value gives trouble with server selection */
	if(roundtime < 60000) {
	if(!infra_rtt_update(outnet->infra, &sq->addr, sq->addrlen,
	sq->zone, sq->zonelen, sq->qtype, roundtime,
	sq->last_rtt, (time_t)now.tv_sec))
	log_err("out of memory noting rtt.");
	}
	- }
	- } /* end of if_!fallback_tcp */
	+ }
	/* perform TC flag check and TCP fallback after updating our
	* cache entries for EDNS status and RTT times */
	- if(LDNS_TC_WIRE(sldns_buffer_begin(c->buffer)) \|\| fallback_tcp) {
	+ if(LDNS_TC_WIRE(sldns_buffer_begin(c->buffer))) {
	/* fallback to TCP */
	/* this discards partial UDP contents */
	if(sq->status == serviced_query_UDP_EDNS \|\|
	sq->status == serviced_query_UDP_EDNS_FRAG \|\|
	sq->status == serviced_query_UDP_EDNS_fallback)
	/* if we have unfinished EDNS_fallback, start again */
	sq->status = serviced_query_TCP_EDNS;
	else sq->status = serviced_query_TCP;
	serviced_tcp_initiate(sq, c->buffer);
	return 0;
	}
	/* yay! an answer */
	serviced_callbacks(sq, error, c, rep);
	return 0;
	}

	struct serviced_query*
	outnet_serviced_query(struct outside_network* outnet,
	struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec,
	int nocaps, int tcp_upstream, int ssl_upstream, char* tls_auth_name,
	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
	size_t zonelen, struct module_qstate* qstate,
	comm_point_callback_type* callback, void* callback_arg, sldns_buffer* buff,
	struct module_env* env)
	{
	struct serviced_query* sq;
	struct service_callback* cb;
	if(!inplace_cb_query_call(env, qinfo, flags, addr, addrlen, zone, zonelen,
	qstate, qstate->region))
	return NULL;
	serviced_gen_query(buff, qinfo->qname, qinfo->qname_len, qinfo->qtype,
	qinfo->qclass, flags);
	sq = lookup_serviced(outnet, buff, dnssec, addr, addrlen,
	qstate->edns_opts_back_out);
	/* duplicate entries are included in the callback list, because
	* there is a counterpart registration by our caller that needs to
	* be doubly-removed (with callbacks perhaps). */
	if(!(cb = (struct service_callback)malloc(sizeof(cb))))
	return NULL;
	if(!sq) {
	/* make new serviced query entry */
	sq = serviced_create(outnet, buff, dnssec, want_dnssec, nocaps,
	tcp_upstream, ssl_upstream, tls_auth_name, addr,
	addrlen, zone, zonelen, (int)qinfo->qtype,
	qstate->edns_opts_back_out);
	if(!sq) {
	free(cb);
	return NULL;
	}
	/* perform first network action */
	if(outnet->do_udp && !(tcp_upstream \|\| ssl_upstream)) {
	if(!serviced_udp_send(sq, buff)) {
	(void)rbtree_delete(outnet->serviced, sq);
	free(sq->qbuf);
	free(sq->zone);
	free(sq);
	free(cb);
	return NULL;
	}
	} else {
	if(!serviced_tcp_send(sq, buff)) {
	(void)rbtree_delete(outnet->serviced, sq);
	free(sq->qbuf);
	free(sq->zone);
	free(sq);
	free(cb);
	return NULL;
	}
	}
	}
	/* add callback to list of callbacks */
	cb->cb = callback;
	cb->cb_arg = callback_arg;
	cb->next = sq->cblist;
	sq->cblist = cb;
	return sq;
	}

	/** remove callback from list */
	static void
	callback_list_remove(struct serviced_query* sq, void* cb_arg)
	{
	struct service_callback** pp = &sq->cblist;
	while(*pp) {
	if((*pp)->cb_arg == cb_arg) {
	struct service_callback* del = *pp;
	*pp = del->next;
	free(del);
	return;
	}
	pp = &(*pp)->next;
	}
	}

	void outnet_serviced_query_stop(struct serviced_query* sq, void* cb_arg)
	{
	if(!sq)
	return;
	callback_list_remove(sq, cb_arg);
	/* if callbacks() routine scheduled deletion, let it do that */
	if(!sq->cblist && !sq->to_be_deleted) {
	(void)rbtree_delete(sq->outnet->serviced, sq);
	serviced_delete(sq);
	}
	}

	/** create fd to send to this destination */
	static int
	fd_for_dest(struct outside_network* outnet, struct sockaddr_storage* to_addr,
	socklen_t to_addrlen)
	{
	struct sockaddr_storage* addr;
	socklen_t addrlen;
	int i, try, pnum;
	struct port_if* pif;

	/* create fd */
	for(try = 0; try<1000; try++) {
	int port = 0;
	int freebind = 0;
	int noproto = 0;
	int inuse = 0;
	int fd = -1;

	/* select interface */
	if(addr_is_ip6(to_addr, to_addrlen)) {
	if(outnet->num_ip6 == 0) {
	char to[64];
	addr_to_str(to_addr, to_addrlen, to, sizeof(to));
	verbose(VERB_QUERY, "need ipv6 to send, but no ipv6 outgoing interfaces, for %s", to);
	return -1;
	}
	i = ub_random_max(outnet->rnd, outnet->num_ip6);
	pif = &outnet->ip6_ifs[i];
	} else {
	if(outnet->num_ip4 == 0) {
	char to[64];
	addr_to_str(to_addr, to_addrlen, to, sizeof(to));
	verbose(VERB_QUERY, "need ipv4 to send, but no ipv4 outgoing interfaces, for %s", to);
	return -1;
	}
	i = ub_random_max(outnet->rnd, outnet->num_ip4);
	pif = &outnet->ip4_ifs[i];
	}
	addr = &pif->addr;
	addrlen = pif->addrlen;
	pnum = ub_random_max(outnet->rnd, pif->avail_total);
	if(pnum < pif->inuse) {
	/* port already open */
	port = pif->out[pnum]->number;
	} else {
	/* unused ports in start part of array */
	port = pif->avail_ports[pnum - pif->inuse];
	}

	if(addr_is_ip6(to_addr, to_addrlen)) {
	struct sockaddr_in6 sa = (struct sockaddr_in6)addr;
	sa.sin6_port = (in_port_t)htons((uint16_t)port);
	fd = create_udp_sock(AF_INET6, SOCK_DGRAM,
	(struct sockaddr*)&sa, addrlen, 1, &inuse, &noproto,
	0, 0, 0, NULL, 0, freebind, 0);
	} else {
	struct sockaddr_in* sa = (struct sockaddr_in*)addr;
	sa->sin_port = (in_port_t)htons((uint16_t)port);
	fd = create_udp_sock(AF_INET, SOCK_DGRAM,
	(struct sockaddr*)addr, addrlen, 1, &inuse, &noproto,
	0, 0, 0, NULL, 0, freebind, 0);
	}
	if(fd != -1) {
	return fd;
	}
	if(!inuse) {
	return -1;
	}
	}
	/* too many tries */
	log_err("cannot send probe, ports are in use");
	return -1;
	}

	struct comm_point*
	outnet_comm_point_for_udp(struct outside_network* outnet,
	comm_point_callback_type* cb, void* cb_arg,
	struct sockaddr_storage* to_addr, socklen_t to_addrlen)
	{
	struct comm_point* cp;
	int fd = fd_for_dest(outnet, to_addr, to_addrlen);
	if(fd == -1) {
	return NULL;
	}
	cp = comm_point_create_udp(outnet->base, fd, outnet->udp_buff,
	cb, cb_arg);
	if(!cp) {
	log_err("malloc failure");
	close(fd);
	return NULL;
	}
	return cp;
	}

	+/** setup SSL for comm point */
	+static int
	+setup_comm_ssl(struct comm_point* cp, struct outside_network* outnet,
	+ int fd, char* host)
	+{
	+ cp->ssl = outgoing_ssl_fd(outnet->sslctx, fd);
	+ if(!cp->ssl) {
	+ log_err("cannot create SSL object");
	+ return 0;
	+ }
	+#ifdef USE_WINSOCK
	+ comm_point_tcp_win_bio_cb(cp, cp->ssl);
	+#endif
	+ cp->ssl_shake_state = comm_ssl_shake_write;
	+ /* https verification */
	+#ifdef HAVE_SSL_SET1_HOST
	+ if((SSL_CTX_get_verify_mode(outnet->sslctx)&SSL_VERIFY_PEER)) {
	+ /* because we set SSL_VERIFY_PEER, in netevent in
	+ * ssl_handshake, it'll check if the certificate
	+ * verification has succeeded */
	+ /* SSL_VERIFY_PEER is set on the sslctx */
	+ /* and the certificates to verify with are loaded into
	+ * it with SSL_load_verify_locations or
	+ * SSL_CTX_set_default_verify_paths */
	+ /* setting the hostname makes openssl verify the
	+ * host name in the x509 certificate in the
	+ * SSL connection*/
	+ if(!SSL_set1_host(cp->ssl, host)) {
	+ log_err("SSL_set1_host failed");
	+ return 0;
	+ }
	+ }
	+#elif defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
	+ /* openssl 1.0.2 has this function that can be used for
	+ * set1_host like verification */
	+ if((SSL_CTX_get_verify_mode(outnet->sslctx)&SSL_VERIFY_PEER)) {
	+ X509_VERIFY_PARAM* param = SSL_get0_param(cp->ssl);
	+ X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
	+ if(!X509_VERIFY_PARAM_set1_host(param, host, strlen(host))) {
	+ log_err("X509_VERIFY_PARAM_set1_host failed");
	+ return 0;
	+ }
	+ }
	+#else
	+ (void)host;
	+#endif /* HAVE_SSL_SET1_HOST */
	+ return 1;
	+}
	+
	struct comm_point*
	outnet_comm_point_for_tcp(struct outside_network* outnet,
	comm_point_callback_type* cb, void* cb_arg,
	struct sockaddr_storage* to_addr, socklen_t to_addrlen,
	- sldns_buffer* query, int timeout)
	+ sldns_buffer* query, int timeout, int ssl, char* host)
	{
	struct comm_point* cp;
	int fd = outnet_get_tcp_fd(to_addr, to_addrlen, outnet->tcp_mss);
	if(fd == -1) {
	return 0;
	}
	fd_set_nonblock(fd);
	if(!outnet_tcp_connect(fd, to_addr, to_addrlen)) {
	/* outnet_tcp_connect has closed fd on error for us */
	return 0;
	}
	cp = comm_point_create_tcp_out(outnet->base, 65552, cb, cb_arg);
	if(!cp) {
	log_err("malloc failure");
	close(fd);
	return 0;
	}
	cp->repinfo.addrlen = to_addrlen;
	memcpy(&cp->repinfo.addr, to_addr, to_addrlen);
	+
	+ /* setup for SSL (if needed) */
	+ if(ssl) {
	+ if(!setup_comm_ssl(cp, outnet, fd, host)) {
	+ log_err("cannot setup XoT");
	+ comm_point_delete(cp);
	+ return NULL;
	+ }
	+ }
	+
	/* set timeout on TCP connection */
	comm_point_start_listening(cp, fd, timeout);
	/* copy scratch buffer to cp->buffer */
	sldns_buffer_copy(cp->buffer, query);
	return cp;
	}

	/** setup http request headers in buffer for sending query to destination */
	static int
	setup_http_request(sldns_buffer* buf, char* host, char* path)
	{
	sldns_buffer_clear(buf);
	sldns_buffer_printf(buf, "GET /%s HTTP/1.1\r\n", path);
	sldns_buffer_printf(buf, "Host: %s\r\n", host);
	sldns_buffer_printf(buf, "User-Agent: unbound/%s\r\n",
	PACKAGE_VERSION);
	/* We do not really do multiple queries per connection,
	* but this header setting is also not needed.
	* sldns_buffer_printf(buf, "Connection: close\r\n") */
	sldns_buffer_printf(buf, "\r\n");
	if(sldns_buffer_position(buf)+10 > sldns_buffer_capacity(buf))
	return 0; /* somehow buffer too short, but it is about 60K
	and the request is only a couple bytes long. */
	sldns_buffer_flip(buf);
	return 1;
	}

	struct comm_point*
	outnet_comm_point_for_http(struct outside_network* outnet,
	comm_point_callback_type* cb, void* cb_arg,
	struct sockaddr_storage* to_addr, socklen_t to_addrlen, int timeout,
	int ssl, char* host, char* path)
	{
	/* cp calls cb with err=NETEVENT_DONE when transfer is done */
	struct comm_point* cp;
	int fd = outnet_get_tcp_fd(to_addr, to_addrlen, outnet->tcp_mss);
	if(fd == -1) {
	return 0;
	}
	fd_set_nonblock(fd);
	if(!outnet_tcp_connect(fd, to_addr, to_addrlen)) {
	/* outnet_tcp_connect has closed fd on error for us */
	return 0;
	}
	cp = comm_point_create_http_out(outnet->base, 65552, cb, cb_arg,
	outnet->udp_buff);
	if(!cp) {
	log_err("malloc failure");
	close(fd);
	return 0;
	}
	cp->repinfo.addrlen = to_addrlen;
	memcpy(&cp->repinfo.addr, to_addr, to_addrlen);

	/* setup for SSL (if needed) */
	if(ssl) {
	- cp->ssl = outgoing_ssl_fd(outnet->sslctx, fd);
	- if(!cp->ssl) {
	+ if(!setup_comm_ssl(cp, outnet, fd, host)) {
	log_err("cannot setup https");
	comm_point_delete(cp);
	return NULL;
	}
	-#ifdef USE_WINSOCK
	- comm_point_tcp_win_bio_cb(cp, cp->ssl);
	-#endif
	- cp->ssl_shake_state = comm_ssl_shake_write;
	- /* https verification */
	-#ifdef HAVE_SSL_SET1_HOST
	- if((SSL_CTX_get_verify_mode(outnet->sslctx)&SSL_VERIFY_PEER)) {
	- /* because we set SSL_VERIFY_PEER, in netevent in
	- * ssl_handshake, it'll check if the certificate
	- * verification has succeeded */
	- /* SSL_VERIFY_PEER is set on the sslctx */
	- /* and the certificates to verify with are loaded into
	- * it with SSL_load_verify_locations or
	- * SSL_CTX_set_default_verify_paths */
	- /* setting the hostname makes openssl verify the
	- * host name in the x509 certificate in the
	- * SSL connection*/
	- if(!SSL_set1_host(cp->ssl, host)) {
	- log_err("SSL_set1_host failed");
	- comm_point_delete(cp);
	- return NULL;
	- }
	- }
	-#endif /* HAVE_SSL_SET1_HOST */
	}

	/* set timeout on TCP connection */
	comm_point_start_listening(cp, fd, timeout);

	/* setup http request in cp->buffer */
	if(!setup_http_request(cp->buffer, host, path)) {
	log_err("error setting up http request");
	comm_point_delete(cp);
	return NULL;
	}
	return cp;
	}

	/** get memory used by waiting tcp entry (in use or not) */
	static size_t
	waiting_tcp_get_mem(struct waiting_tcp* w)
	{
	size_t s;
	if(!w) return 0;
	s = sizeof(*w) + w->pkt_len;
	if(w->timer)
	s += comm_timer_get_mem(w->timer);
	return s;
	}

	/** get memory used by port if */
	static size_t
	if_get_mem(struct port_if* pif)
	{
	size_t s;
	int i;
	s = sizeof(pif) + sizeof(int)pif->avail_total +
	sizeof(struct port_comm)pif->maxout;
	for(i=0; i<pif->inuse; i++)
	s += sizeof(*pif->out[i]) +
	comm_point_get_mem(pif->out[i]->cp);
	return s;
	}

	/** get memory used by waiting udp */
	static size_t
	waiting_udp_get_mem(struct pending* w)
	{
	size_t s;
	s = sizeof(*w) + comm_timer_get_mem(w->timer) + w->pkt_len;
	return s;
	}

	size_t outnet_get_mem(struct outside_network* outnet)
	{
	size_t i;
	int k;
	struct waiting_tcp* w;
	struct pending* u;
	struct serviced_query* sq;
	struct service_callback* sb;
	struct port_comm* pc;
	size_t s = sizeof(outnet) + sizeof(outnet->base) +
	sizeof(*outnet->udp_buff) +
	sldns_buffer_capacity(outnet->udp_buff);
	/* second buffer is not ours */
	for(pc = outnet->unused_fds; pc; pc = pc->next) {
	s += sizeof(*pc) + comm_point_get_mem(pc->cp);
	}
	for(k=0; k<outnet->num_ip4; k++)
	s += if_get_mem(&outnet->ip4_ifs[k]);
	for(k=0; k<outnet->num_ip6; k++)
	s += if_get_mem(&outnet->ip6_ifs[k]);
	for(u=outnet->udp_wait_first; u; u=u->next_waiting)
	s += waiting_udp_get_mem(u);

	s += sizeof(struct pending_tcp)outnet->num_tcp;
	for(i=0; i<outnet->num_tcp; i++) {
	s += sizeof(struct pending_tcp);
	s += comm_point_get_mem(outnet->tcp_conns[i]->c);
	if(outnet->tcp_conns[i]->query)
	s += waiting_tcp_get_mem(outnet->tcp_conns[i]->query);
	}
	for(w=outnet->tcp_wait_first; w; w = w->next_waiting)
	s += waiting_tcp_get_mem(w);
	s += sizeof(*outnet->pending);
	s += (sizeof(struct pending) + comm_timer_get_mem(NULL)) *
	outnet->pending->count;
	s += sizeof(*outnet->serviced);
	s += outnet->svcd_overhead;
	RBTREE_FOR(sq, struct serviced_query*, outnet->serviced) {
	s += sizeof(*sq) + sq->qbuflen;
	for(sb = sq->cblist; sb; sb = sb->next)
	s += sizeof(*sb);
	}
	return s;
	}

	size_t
	serviced_get_mem(struct serviced_query* sq)
	{
	struct service_callback* sb;
	size_t s;
	s = sizeof(*sq) + sq->qbuflen;
	for(sb = sq->cblist; sb; sb = sb->next)
	s += sizeof(*sb);
	if(sq->status == serviced_query_UDP_EDNS \|\|
	sq->status == serviced_query_UDP \|\|
	- sq->status == serviced_query_PROBE_EDNS \|\|
	sq->status == serviced_query_UDP_EDNS_FRAG \|\|
	sq->status == serviced_query_UDP_EDNS_fallback) {
	s += sizeof(struct pending);
	s += comm_timer_get_mem(NULL);
	} else {
	/* does not have size of the pkt pointer */
	/* always has a timer except on malloc failures */

	/* these sizes are part of the main outside network mem */
	/*
	s += sizeof(struct waiting_tcp);
	s += comm_timer_get_mem(NULL);
	*/
	}
	return s;
	}

	Index: head/contrib/unbound/services/outside_network.h
	===================================================================
	--- head/contrib/unbound/services/outside_network.h (revision 349719)
	+++ head/contrib/unbound/services/outside_network.h (revision 349720)
	@@ -1,638 +1,638 @@
	/*
	* services/outside_network.h - listen to answers from the network
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file has functions to send queries to authoritative servers,
	* and wait for the pending answer, with timeouts.
	*/

	#ifndef OUTSIDE_NETWORK_H
	#define OUTSIDE_NETWORK_H

	#include "util/rbtree.h"
	#include "util/netevent.h"
	#include "dnstap/dnstap_config.h"
	struct pending;
	struct pending_timeout;
	struct ub_randstate;
	struct pending_tcp;
	struct waiting_tcp;
	struct waiting_udp;
	struct infra_cache;
	struct port_comm;
	struct port_if;
	struct sldns_buffer;
	struct serviced_query;
	struct dt_env;
	struct edns_option;
	struct module_env;
	struct module_qstate;
	struct query_info;

	/**
	* Send queries to outside servers and wait for answers from servers.
	* Contains answer-listen sockets.
	*/
	struct outside_network {
	/** Base for select calls */
	struct comm_base* base;
	/** pointer to time in seconds */
	time_t* now_secs;
	/** pointer to time in microseconds */
	struct timeval* now_tv;

	/** buffer shared by UDP connections, since there is only one
	datagram at any time. */
	struct sldns_buffer* udp_buff;
	/** serviced_callbacks malloc overhead when processing multiple
	* identical serviced queries to the same server. */
	size_t svcd_overhead;
	/** use x20 bits to encode additional ID random bits */
	int use_caps_for_id;
	/** outside network wants to quit. Stop queued msgs from sent. */
	int want_to_quit;

	/** number of unwanted replies received (for statistics) */
	size_t unwanted_replies;
	/** cumulative total of unwanted replies (for defense) */
	size_t unwanted_total;
	/** threshold when to take defensive action. If 0 then never. */
	size_t unwanted_threshold;
	/** what action to take, called when defensive action is needed */
	void (unwanted_action)(void);
	/** user param for action */
	void* unwanted_param;

	/** linked list of available commpoints, unused file descriptors,
	* for use as outgoing UDP ports. cp.fd=-1 in them. */
	struct port_comm* unused_fds;
	/** if udp is done */
	int do_udp;
	/** if udp is delay-closed (delayed answers do not meet closed port)*/
	int delayclose;
	/** timeout for delayclose */
	struct timeval delay_tv;

	/** array of outgoing IP4 interfaces */
	struct port_if* ip4_ifs;
	/** number of outgoing IP4 interfaces */
	int num_ip4;

	/** array of outgoing IP6 interfaces */
	struct port_if* ip6_ifs;
	/** number of outgoing IP6 interfaces */
	int num_ip6;

	/** pending udp queries waiting to be sent out, waiting for fd */
	struct pending* udp_wait_first;
	/** last pending udp query in list */
	struct pending* udp_wait_last;

	/** pending udp answers. sorted by id, addr */
	rbtree_type* pending;
	/** serviced queries, sorted by qbuf, addr, dnssec */
	rbtree_type* serviced;
	/** host cache, pointer but not owned by outnet. */
	struct infra_cache* infra;
	/** where to get random numbers */
	struct ub_randstate* rnd;
	/** ssl context to create ssl wrapped TCP with DNS connections */
	void* sslctx;
	#ifdef USE_DNSTAP
	/** dnstap environment */
	struct dt_env* dtenv;
	#endif
	/** maximum segment size of tcp socket */
	int tcp_mss;

	/**
	* Array of tcp pending used for outgoing TCP connections.
	* Each can be used to establish a TCP connection with a server.
	* The file descriptors are -1 if they are free, and need to be
	* opened for the tcp connection. Can be used for ip4 and ip6.
	*/
	struct pending_tcp **tcp_conns;
	/** number of tcp communication points. */
	size_t num_tcp;
	/** number of tcp communication points in use. */
	size_t num_tcp_outgoing;
	/** list of tcp comm points that are free for use */
	struct pending_tcp* tcp_free;
	/** list of tcp queries waiting for a buffer */
	struct waiting_tcp* tcp_wait_first;
	/** last of waiting query list */
	struct waiting_tcp* tcp_wait_last;
	};

	/**
	* Outgoing interface. Ports available and currently used are tracked
	* per interface
	*/
	struct port_if {
	/** address ready to allocate new socket (except port no). */
	struct sockaddr_storage addr;
	/** length of addr field */
	socklen_t addrlen;

	/** prefix length of network address (in bits), for randomisation.
	* if 0, no randomisation. */
	int pfxlen;

	/** the available ports array. These are unused.
	* Only the first total-inuse part is filled. */
	int* avail_ports;
	/** the total number of available ports (size of the array) */
	int avail_total;

	/** array of the commpoints currently in use.
	* allocated for max number of fds, first part in use. */
	struct port_comm** out;
	/** max number of fds, size of out array */
	int maxout;
	/** number of commpoints (and thus also ports) in use */
	int inuse;
	};

	/**
	* Outgoing commpoint for UDP port.
	*/
	struct port_comm {
	/** next in free list */
	struct port_comm* next;
	/** which port number (when in use) */
	int number;
	/** interface it is used in */
	struct port_if* pif;
	/** index in the out array of the interface */
	int index;
	/** number of outstanding queries on this port */
	int num_outstanding;
	/** UDP commpoint, fd=-1 if not in use */
	struct comm_point* cp;
	};

	/**
	* A query that has an answer pending for it.
	*/
	struct pending {
	/** redblacktree entry, key is the pending struct(id, addr). */
	rbnode_type node;
	/** the ID for the query. int so that a value out of range can
	* be used to signify a pending that is for certain not present in
	* the rbtree. (and for which deletion is safe). */
	unsigned int id;
	/** remote address. */
	struct sockaddr_storage addr;
	/** length of addr field in use. */
	socklen_t addrlen;
	/** comm point it was sent on (and reply must come back on). */
	struct port_comm* pc;
	/** timeout event */
	struct comm_timer* timer;
	/** callback for the timeout, error or reply to the message */
	comm_point_callback_type* cb;
	/** callback user argument */
	void* cb_arg;
	/** the outside network it is part of */
	struct outside_network* outnet;
	/** the corresponding serviced_query */
	struct serviced_query* sq;

	/---- filled if udp pending is waiting -----/
	/** next in waiting list. */
	struct pending* next_waiting;
	/** timeout in msec */
	int timeout;
	/** The query itself, the query packet to send. */
	uint8_t* pkt;
	/** length of query packet. */
	size_t pkt_len;
	};

	/**
	* Pending TCP query to server.
	*/
	struct pending_tcp {
	/** next in list of free tcp comm points, or NULL. */
	struct pending_tcp* next_free;
	/** the ID for the query; checked in reply */
	uint16_t id;
	/** tcp comm point it was sent on (and reply must come back on). */
	struct comm_point* c;
	/** the query being serviced, NULL if the pending_tcp is unused. */
	struct waiting_tcp* query;
	};

	/**
	* Query waiting for TCP buffer.
	*/
	struct waiting_tcp {
	/**
	* next in waiting list.
	* if pkt==0, this points to the pending_tcp structure.
	*/
	struct waiting_tcp* next_waiting;
	/** timeout event; timer keeps running whether the query is
	* waiting for a buffer or the tcp reply is pending */
	struct comm_timer* timer;
	/** the outside network it is part of */
	struct outside_network* outnet;
	/** remote address. */
	struct sockaddr_storage addr;
	/** length of addr field in use. */
	socklen_t addrlen;
	/**
	* The query itself, the query packet to send.
	* allocated after the waiting_tcp structure.
	* set to NULL when the query is serviced and it part of pending_tcp.
	* if this is NULL, the next_waiting points to the pending_tcp.
	*/
	uint8_t* pkt;
	/** length of query packet. */
	size_t pkt_len;
	/** callback for the timeout, error or reply to the message */
	comm_point_callback_type* cb;
	/** callback user argument */
	void* cb_arg;
	/** if it uses ssl upstream */
	int ssl_upstream;
	/** ref to the tls_auth_name from the serviced_query */
	char* tls_auth_name;
	};

	/**
	* Callback to party interested in serviced query results.
	*/
	struct service_callback {
	/** next in callback list */
	struct service_callback* next;
	/** callback function */
	comm_point_callback_type* cb;
	/** user argument for callback function */
	void* cb_arg;
	};

	/** fallback size for fragmentation for EDNS in IPv4 */
	#define EDNS_FRAG_SIZE_IP4 1472
	/** fallback size for EDNS in IPv6, fits one fragment with ip6-tunnel-ids */
	#define EDNS_FRAG_SIZE_IP6 1232

	/**
	* Query service record.
	* Contains query and destination. UDP, TCP, EDNS are all tried.
	* complete with retries and timeouts. A number of interested parties can
	* receive a callback.
	*/
	struct serviced_query {
	/** The rbtree node, key is this record */
	rbnode_type node;
	/** The query that needs to be answered. Starts with flags u16,
	* then qdcount, ..., including qname, qtype, qclass. Does not include
	* EDNS record. */
	uint8_t* qbuf;
	/** length of qbuf. */
	size_t qbuflen;
	/** If an EDNS section is included, the DO/CD bit will be turned on. */
	int dnssec;
	/** We want signatures, or else the answer is likely useless */
	int want_dnssec;
	/** ignore capsforid */
	int nocaps;
	/** tcp upstream used, use tcp, or ssl_upstream for SSL */
	int tcp_upstream, ssl_upstream;
	/** the name of the tls authentication name, eg. 'ns.example.com'
	* or NULL */
	char* tls_auth_name;
	/** where to send it */
	struct sockaddr_storage addr;
	/** length of addr field in use. */
	socklen_t addrlen;
	/** zone name, uncompressed domain name in wireformat */
	uint8_t* zone;
	/** length of zone name */
	size_t zonelen;
	/** qtype */
	int qtype;
	/** current status */
	enum serviced_query_status {
	/** initial status */
	serviced_initial,
	/** UDP with EDNS sent */
	serviced_query_UDP_EDNS,
	/** UDP without EDNS sent */
	serviced_query_UDP,
	/** TCP with EDNS sent */
	serviced_query_TCP_EDNS,
	/** TCP without EDNS sent */
	serviced_query_TCP,
	- /** probe to test EDNS lameness (EDNS is dropped) */
	- serviced_query_PROBE_EDNS,
	/** probe to test noEDNS0 (EDNS gives FORMERRorNOTIMP) */
	serviced_query_UDP_EDNS_fallback,
	/** probe to test TCP noEDNS0 (EDNS gives FORMERRorNOTIMP) */
	serviced_query_TCP_EDNS_fallback,
	/** send UDP query with EDNS1480 (or 1280) */
	serviced_query_UDP_EDNS_FRAG
	}
	/** variable with current status */
	status;
	/** true if serviced_query is scheduled for deletion already */
	int to_be_deleted;
	/** number of UDP retries */
	int retry;
	/** time last UDP was sent */
	struct timeval last_sent_time;
	/** rtt of last message */
	int last_rtt;
	/** do we know edns probe status already, for UDP_EDNS queries */
	int edns_lame_known;
	/** edns options to use for sending upstream packet */
	struct edns_option* opt_list;
	/** outside network this is part of */
	struct outside_network* outnet;
	/** list of interested parties that need callback on results. */
	struct service_callback* cblist;
	/** the UDP or TCP query that is pending, see status which */
	void* pending;
	};

	/**
	* Create outside_network structure with N udp ports.
	* @param base: the communication base to use for event handling.
	* @param bufsize: size for network buffers.
	* @param num_ports: number of udp ports to open per interface.
	* @param ifs: interface names (or NULL for default interface).
	* These interfaces must be able to access all authoritative servers.
	* @param num_ifs: number of names in array ifs.
	* @param do_ip4: service IP4.
	* @param do_ip6: service IP6.
	* @param num_tcp: number of outgoing tcp buffers to preallocate.
	* @param infra: pointer to infra cached used for serviced queries.
	* @param rnd: stored to create random numbers for serviced queries.
	* @param use_caps_for_id: enable to use 0x20 bits to encode id randomness.
	* @param availports: array of available ports.
	* @param numavailports: number of available ports in array.
	* @param unwanted_threshold: when to take defensive action.
	* @param unwanted_action: the action to take.
	* @param unwanted_param: user parameter to action.
	* @param tcp_mss: maximum segment size of tcp socket.
	* @param do_udp: if udp is done.
	* @param sslctx: context to create outgoing connections with (if enabled).
	* @param delayclose: if not 0, udp sockets are delayed before timeout closure.
	* msec to wait on timeouted udp sockets.
	* @param dtenv: environment to send dnstap events with (if enabled).
	* @return: the new structure (with no pending answers) or NULL on error.
	*/
	struct outside_network* outside_network_create(struct comm_base* base,
	size_t bufsize, size_t num_ports, char** ifs, int num_ifs,
	int do_ip4, int do_ip6, size_t num_tcp, struct infra_cache* infra,
	struct ub_randstate* rnd, int use_caps_for_id, int* availports,
	int numavailports, size_t unwanted_threshold, int tcp_mss,
	void (unwanted_action)(void), void* unwanted_param, int do_udp,
	void* sslctx, int delayclose, struct dt_env *dtenv);

	/**
	* Delete outside_network structure.
	* @param outnet: object to delete.
	*/
	void outside_network_delete(struct outside_network* outnet);

	/**
	* Prepare for quit. Sends no more queries, even if queued up.
	* @param outnet: object to prepare for removal
	*/
	void outside_network_quit_prepare(struct outside_network* outnet);

	/**
	* Send UDP query, create pending answer.
	* Changes the ID for the query to be random and unique for that destination.
	* @param sq: serviced query.
	* @param packet: wireformat query to send to destination.
	* @param timeout: in milliseconds from now.
	* @param callback: function to call on error, timeout or reply.
	* @param callback_arg: user argument for callback function.
	* @return: NULL on error for malloc or socket. Else the pending query object.
	*/
	struct pending* pending_udp_query(struct serviced_query* sq,
	struct sldns_buffer* packet, int timeout, comm_point_callback_type* callback,
	void* callback_arg);

	/**
	* Send TCP query. May wait for TCP buffer. Selects ID to be random, and
	* checks id.
	* @param sq: serviced query.
	* @param packet: wireformat query to send to destination. copied from.
	* @param timeout: in milliseconds from now.
	* Timer starts running now. Timer may expire if all buffers are used,
	* without any query been sent to the server yet.
	* @param callback: function to call on error, timeout or reply.
	* @param callback_arg: user argument for callback function.
	* @return: false on error for malloc or socket. Else the pending TCP object.
	*/
	struct waiting_tcp* pending_tcp_query(struct serviced_query* sq,
	struct sldns_buffer* packet, int timeout, comm_point_callback_type* callback,
	void* callback_arg);

	/**
	* Delete pending answer.
	* @param outnet: outside network the pending query is part of.
	* Internal feature: if outnet is NULL, p is not unlinked from rbtree.
	* @param p: deleted
	*/
	void pending_delete(struct outside_network* outnet, struct pending* p);

	/**
	* Perform a serviced query to the authoritative servers.
	* Duplicate efforts are detected, and EDNS, TCP and UDP retry is performed.
	* @param outnet: outside network, with rbtree of serviced queries.
	* @param qinfo: query info.
	* @param flags: flags u16 (host format), includes opcode, CD bit.
	* @param dnssec: if set, DO bit is set in EDNS queries.
	* If the value includes BIT_CD, CD bit is set when in EDNS queries.
	* If the value includes BIT_DO, DO bit is set when in EDNS queries.
	* @param want_dnssec: signatures are needed, without EDNS the answer is
	* likely to be useless.
	* @param nocaps: ignore use_caps_for_id and use unperturbed qname.
	* @param tcp_upstream: use TCP for upstream queries.
	* @param ssl_upstream: use SSL for upstream queries.
	* @param tls_auth_name: when ssl_upstream is true, use this name to check
	* the server's peer certificate.
	* @param addr: to which server to send the query.
	* @param addrlen: length of addr.
	* @param zone: name of the zone of the delegation point. wireformat dname.
	This is the delegation point name for which the server is deemed
	authoritative.
	* @param zonelen: length of zone.
	* @param qstate: module qstate. Mainly for inspecting the available
	* edns_opts_lists.
	* @param callback: callback function.
	* @param callback_arg: user argument to callback function.
	* @param buff: scratch buffer to create query contents in. Empty on exit.
	* @param env: the module environment.
	* @return 0 on error, or pointer to serviced query that is used to answer
	* this serviced query may be shared with other callbacks as well.
	*/
	struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
	struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec,
	int nocaps, int tcp_upstream, int ssl_upstream, char* tls_auth_name,
	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
	size_t zonelen, struct module_qstate* qstate,
	comm_point_callback_type* callback, void* callback_arg,
	struct sldns_buffer* buff, struct module_env* env);

	/**
	* Remove service query callback.
	* If that leads to zero callbacks, the query is completely cancelled.
	* @param sq: serviced query to adjust.
	* @param cb_arg: callback argument of callback that needs removal.
	* same as the callback_arg to outnet_serviced_query().
	*/
	void outnet_serviced_query_stop(struct serviced_query* sq, void* cb_arg);

	/**
	* Get memory size in use by outside network.
	* Counts buffers and outstanding query (serviced queries) malloced data.
	* @param outnet: outside network structure.
	* @return size in bytes.
	*/
	size_t outnet_get_mem(struct outside_network* outnet);

	/**
	* Get memory size in use by serviced query while it is servicing callbacks.
	* This takes into account the pre-deleted status of it; it will be deleted
	* when the callbacks are done.
	* @param sq: serviced query.
	* @return size in bytes.
	*/
	size_t serviced_get_mem(struct serviced_query* sq);

	/** get TCP file descriptor for address, returns -1 on failure,
	* tcp_mss is 0 or maxseg size to set for TCP packets. */
	int outnet_get_tcp_fd(struct sockaddr_storage* addr, socklen_t addrlen, int tcp_mss);

	/**
	* Create udp commpoint suitable for sending packets to the destination.
	* @param outnet: outside_network with the comm_base it is attached to,
	* with the outgoing interfaces chosen from, and rnd gen for random.
	* @param cb: callback function for the commpoint.
	* @param cb_arg: callback argument for cb.
	* @param to_addr: intended destination.
	* @param to_addrlen: length of to_addr.
	* @return commpoint that you can comm_point_send_udp_msg with, or NULL.
	*/
	struct comm_point* outnet_comm_point_for_udp(struct outside_network* outnet,
	comm_point_callback_type* cb, void* cb_arg,
	struct sockaddr_storage* to_addr, socklen_t to_addrlen);

	/**
	* Create tcp commpoint suitable for communication to the destination.
	* It also performs connect() to the to_addr.
	* @param outnet: outside_network with the comm_base it is attached to,
	* and the tcp_mss.
	* @param cb: callback function for the commpoint.
	* @param cb_arg: callback argument for cb.
	* @param to_addr: intended destination.
	* @param to_addrlen: length of to_addr.
	* @param query: initial packet to send writing, in buffer. It is copied
	* to the commpoint buffer that is created.
	* @param timeout: timeout for the TCP connection.
	* timeout in milliseconds, or -1 for no (change to the) timeout.
	* So seconds*1000.
	+ * @param ssl: set to true for TLS.
	+ * @param host: hostname for host name verification of TLS (or NULL if no TLS).
	* @return tcp_out commpoint, or NULL.
	*/
	struct comm_point* outnet_comm_point_for_tcp(struct outside_network* outnet,
	comm_point_callback_type* cb, void* cb_arg,
	struct sockaddr_storage* to_addr, socklen_t to_addrlen,
	- struct sldns_buffer* query, int timeout);
	+ struct sldns_buffer* query, int timeout, int ssl, char* host);

	/**
	* Create http commpoint suitable for communication to the destination.
	* Creates the http request buffer. It also performs connect() to the to_addr.
	* @param outnet: outside_network with the comm_base it is attached to,
	* and the tcp_mss.
	* @param cb: callback function for the commpoint.
	* @param cb_arg: callback argument for cb.
	* @param to_addr: intended destination.
	* @param to_addrlen: length of to_addr.
	* @param timeout: timeout for the TCP connection.
	* timeout in milliseconds, or -1 for no (change to the) timeout.
	* So seconds*1000.
	* @param ssl: set to true for https.
	* @param host: hostname to use for the destination. part of http request.
	* @param path: pathname to lookup, eg. name of the file on the destination.
	* @return http_out commpoint, or NULL.
	*/
	struct comm_point* outnet_comm_point_for_http(struct outside_network* outnet,
	comm_point_callback_type* cb, void* cb_arg,
	struct sockaddr_storage* to_addr, socklen_t to_addrlen, int timeout,
	int ssl, char* host, char* path);

	/** connect tcp connection to addr, 0 on failure */
	int outnet_tcp_connect(int s, struct sockaddr_storage* addr, socklen_t addrlen);

	/** callback for incoming udp answers from the network */
	int outnet_udp_cb(struct comm_point* c, void* arg, int error,
	struct comm_reply *reply_info);

	/** callback for pending tcp connections */
	int outnet_tcp_cb(struct comm_point* c, void* arg, int error,
	struct comm_reply *reply_info);

	/** callback for udp timeout */
	void pending_udp_timer_cb(void *arg);

	/** callback for udp delay for timeout */
	void pending_udp_timer_delay_cb(void *arg);

	/** callback for outgoing TCP timer event */
	void outnet_tcptimer(void* arg);

	/** callback for serviced query UDP answers */
	int serviced_udp_callback(struct comm_point* c, void* arg, int error,
	struct comm_reply* rep);

	/** TCP reply or error callback for serviced queries */
	int serviced_tcp_callback(struct comm_point* c, void* arg, int error,
	struct comm_reply* rep);

	/** compare function of pending rbtree */
	int pending_cmp(const void* key1, const void* key2);

	/** compare function of serviced query rbtree */
	int serviced_cmp(const void* key1, const void* key2);

	#endif /* OUTSIDE_NETWORK_H */
	Index: head/contrib/unbound/sldns/wire2str.c
	===================================================================
	--- head/contrib/unbound/sldns/wire2str.c (revision 349719)
	+++ head/contrib/unbound/sldns/wire2str.c (revision 349720)
	@@ -1,2067 +1,2067 @@
	/*
	* wire2str.c
	*
	* conversion routines from the wire format
	* to the presentation format (strings)
	*
	* (c) NLnet Labs, 2004-2006
	*
	* See the file LICENSE for the license
	*/
	/**
	* \file
	*
	* Contains functions to translate the wireformat to text
	* representation, as well as functions to print them.
	*/
	#include "config.h"
	#include "sldns/wire2str.h"
	#include "sldns/str2wire.h"
	#include "sldns/rrdef.h"
	#include "sldns/pkthdr.h"
	#include "sldns/parseutil.h"
	#include "sldns/sbuffer.h"
	#include "sldns/keyraw.h"
	#ifdef HAVE_TIME_H
	#include <time.h>
	#endif
	#include <sys/time.h>
	#include <stdarg.h>
	#include <ctype.h>
	#ifdef HAVE_NETDB_H
	#include <netdb.h>
	#endif

	/* lookup tables for standard DNS stuff */
	/* Taken from RFC 2535, section 7. */
	static sldns_lookup_table sldns_algorithms_data[] = {
	{ LDNS_RSAMD5, "RSAMD5" },
	{ LDNS_DH, "DH" },
	{ LDNS_DSA, "DSA" },
	{ LDNS_ECC, "ECC" },
	{ LDNS_RSASHA1, "RSASHA1" },
	{ LDNS_DSA_NSEC3, "DSA-NSEC3-SHA1" },
	{ LDNS_RSASHA1_NSEC3, "RSASHA1-NSEC3-SHA1" },
	{ LDNS_RSASHA256, "RSASHA256"},
	{ LDNS_RSASHA512, "RSASHA512"},
	{ LDNS_ECC_GOST, "ECC-GOST"},
	{ LDNS_ECDSAP256SHA256, "ECDSAP256SHA256"},
	{ LDNS_ECDSAP384SHA384, "ECDSAP384SHA384"},
	{ LDNS_ED25519, "ED25519"},
	{ LDNS_ED448, "ED448"},
	{ LDNS_INDIRECT, "INDIRECT" },
	{ LDNS_PRIVATEDNS, "PRIVATEDNS" },
	{ LDNS_PRIVATEOID, "PRIVATEOID" },
	{ 0, NULL }
	};
	sldns_lookup_table* sldns_algorithms = sldns_algorithms_data;

	/* hash algorithms in DS record */
	static sldns_lookup_table sldns_hashes_data[] = {
	{ LDNS_SHA1, "SHA1" },
	{ LDNS_SHA256, "SHA256" },
	{ LDNS_HASH_GOST, "HASH-GOST" },
	{ LDNS_SHA384, "SHA384" },
	{ 0, NULL }
	};
	sldns_lookup_table* sldns_hashes = sldns_hashes_data;

	/* Taken from RFC 4398 */
	static sldns_lookup_table sldns_cert_algorithms_data[] = {
	{ LDNS_CERT_PKIX, "PKIX" },
	{ LDNS_CERT_SPKI, "SPKI" },
	{ LDNS_CERT_PGP, "PGP" },
	{ LDNS_CERT_IPKIX, "IPKIX" },
	{ LDNS_CERT_ISPKI, "ISPKI" },
	{ LDNS_CERT_IPGP, "IPGP" },
	{ LDNS_CERT_ACPKIX, "ACPKIX" },
	{ LDNS_CERT_IACPKIX, "IACPKIX" },
	{ LDNS_CERT_URI, "URI" },
	{ LDNS_CERT_OID, "OID" },
	{ 0, NULL }
	};
	sldns_lookup_table* sldns_cert_algorithms = sldns_cert_algorithms_data;

	/* if these are used elsewhere */
	static sldns_lookup_table sldns_rcodes_data[] = {
	{ LDNS_RCODE_NOERROR, "NOERROR" },
	{ LDNS_RCODE_FORMERR, "FORMERR" },
	{ LDNS_RCODE_SERVFAIL, "SERVFAIL" },
	{ LDNS_RCODE_NXDOMAIN, "NXDOMAIN" },
	{ LDNS_RCODE_NOTIMPL, "NOTIMPL" },
	{ LDNS_RCODE_REFUSED, "REFUSED" },
	{ LDNS_RCODE_YXDOMAIN, "YXDOMAIN" },
	{ LDNS_RCODE_YXRRSET, "YXRRSET" },
	{ LDNS_RCODE_NXRRSET, "NXRRSET" },
	{ LDNS_RCODE_NOTAUTH, "NOTAUTH" },
	{ LDNS_RCODE_NOTZONE, "NOTZONE" },
	{ 0, NULL }
	};
	sldns_lookup_table* sldns_rcodes = sldns_rcodes_data;

	static sldns_lookup_table sldns_opcodes_data[] = {
	{ LDNS_PACKET_QUERY, "QUERY" },
	{ LDNS_PACKET_IQUERY, "IQUERY" },
	{ LDNS_PACKET_STATUS, "STATUS" },
	{ LDNS_PACKET_NOTIFY, "NOTIFY" },
	{ LDNS_PACKET_UPDATE, "UPDATE" },
	{ 0, NULL }
	};
	sldns_lookup_table* sldns_opcodes = sldns_opcodes_data;

	static sldns_lookup_table sldns_wireparse_errors_data[] = {
	{ LDNS_WIREPARSE_ERR_OK, "no parse error" },
	{ LDNS_WIREPARSE_ERR_GENERAL, "parse error" },
	{ LDNS_WIREPARSE_ERR_DOMAINNAME_OVERFLOW, "Domainname length overflow" },
	{ LDNS_WIREPARSE_ERR_DOMAINNAME_UNDERFLOW, "Domainname length underflow (zero length)" },
	{ LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL, "buffer too small" },
	{ LDNS_WIREPARSE_ERR_LABEL_OVERFLOW, "Label length overflow" },
	{ LDNS_WIREPARSE_ERR_EMPTY_LABEL, "Empty label" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_BAD_ESCAPE, "Syntax error, bad escape sequence" },
	{ LDNS_WIREPARSE_ERR_SYNTAX, "Syntax error, could not parse the RR" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_TTL, "Syntax error, could not parse the RR's TTL" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_TYPE, "Syntax error, could not parse the RR's type" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_CLASS, "Syntax error, could not parse the RR's class" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_RDATA, "Syntax error, could not parse the RR's rdata" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_MISSING_VALUE, "Syntax error, value expected" },
	{ LDNS_WIREPARSE_ERR_INVALID_STR, "Conversion error, string expected" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_B64, "Conversion error, b64 encoding expected" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_B32_EXT, "Conversion error, b32 ext encoding expected" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_HEX, "Conversion error, hex encoding expected" },
	{ LDNS_WIREPARSE_ERR_CERT_BAD_ALGORITHM, "Bad algorithm type for CERT record" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_TIME, "Conversion error, time encoding expected" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_PERIOD, "Conversion error, time period encoding expected" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_ILNP64, "Conversion error, 4 colon separated hex numbers expected" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_EUI48,
	"Conversion error, 6 two character hex numbers "
	"separated by dashes expected (i.e. xx-xx-xx-xx-xx-xx" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_EUI64,
	"Conversion error, 8 two character hex numbers "
	"separated by dashes expected (i.e. xx-xx-xx-xx-xx-xx-xx-xx" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_TAG,
	"Conversion error, a non-zero sequence of US-ASCII letters "
	"and numbers in lower case expected" },
	{ LDNS_WIREPARSE_ERR_NOT_IMPL, "not implemented" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_INT, "Conversion error, integer expected" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_IP4, "Conversion error, ip4 addr expected" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_IP6, "Conversion error, ip6 addr expected" },
	{ LDNS_WIREPARSE_ERR_SYNTAX_INTEGER_OVERFLOW, "Syntax error, integer overflow" },
	{ LDNS_WIREPARSE_ERR_INCLUDE, "$INCLUDE directive was seen in the zone" },
	{ LDNS_WIREPARSE_ERR_PARENTHESIS, "Parse error, parenthesis mismatch" },
	{ 0, NULL }
	};
	sldns_lookup_table* sldns_wireparse_errors = sldns_wireparse_errors_data;

	static sldns_lookup_table sldns_edns_flags_data[] = {
	{ 3600, "do"},
	{ 0, NULL}
	};
	sldns_lookup_table* sldns_edns_flags = sldns_edns_flags_data;

	static sldns_lookup_table sldns_edns_options_data[] = {
	{ 1, "LLQ" },
	{ 2, "UL" },
	{ 3, "NSID" },
	/* 4 draft-cheshire-edns0-owner-option */
	{ 5, "DAU" },
	{ 6, "DHU" },
	{ 7, "N3U" },
	{ 8, "edns-client-subnet" },
	{ 11, "edns-tcp-keepalive"},
	{ 12, "Padding" },
	{ 0, NULL}
	};
	sldns_lookup_table* sldns_edns_options = sldns_edns_options_data;

	static sldns_lookup_table sldns_tsig_errors_data[] = {
	{ LDNS_TSIG_ERROR_NOERROR, "NOERROR" },
	{ LDNS_RCODE_FORMERR, "FORMERR" },
	{ LDNS_RCODE_SERVFAIL, "SERVFAIL" },
	{ LDNS_RCODE_NXDOMAIN, "NXDOMAIN" },
	{ LDNS_RCODE_NOTIMPL, "NOTIMPL" },
	{ LDNS_RCODE_REFUSED, "REFUSED" },
	{ LDNS_RCODE_YXDOMAIN, "YXDOMAIN" },
	{ LDNS_RCODE_YXRRSET, "YXRRSET" },
	{ LDNS_RCODE_NXRRSET, "NXRRSET" },
	{ LDNS_RCODE_NOTAUTH, "NOTAUTH" },
	{ LDNS_RCODE_NOTZONE, "NOTZONE" },
	{ LDNS_TSIG_ERROR_BADSIG, "BADSIG" },
	{ LDNS_TSIG_ERROR_BADKEY, "BADKEY" },
	{ LDNS_TSIG_ERROR_BADTIME, "BADTIME" },
	{ LDNS_TSIG_ERROR_BADMODE, "BADMODE" },
	{ LDNS_TSIG_ERROR_BADNAME, "BADNAME" },
	{ LDNS_TSIG_ERROR_BADALG, "BADALG" },
	{ 0, NULL }
	};
	sldns_lookup_table* sldns_tsig_errors = sldns_tsig_errors_data;

	char* sldns_wire2str_pkt(uint8_t* data, size_t len)
	{
	size_t slen = (size_t)sldns_wire2str_pkt_buf(data, len, NULL, 0);
	char* result = (char*)malloc(slen+1);
	if(!result) return NULL;
	sldns_wire2str_pkt_buf(data, len, result, slen+1);
	return result;
	}

	char* sldns_wire2str_rr(uint8_t* rr, size_t len)
	{
	size_t slen = (size_t)sldns_wire2str_rr_buf(rr, len, NULL, 0);
	char* result = (char*)malloc(slen+1);
	if(!result) return NULL;
	sldns_wire2str_rr_buf(rr, len, result, slen+1);
	return result;
	}

	char* sldns_wire2str_type(uint16_t rrtype)
	{
	char buf[16];
	sldns_wire2str_type_buf(rrtype, buf, sizeof(buf));
	return strdup(buf);
	}

	char* sldns_wire2str_class(uint16_t rrclass)
	{
	char buf[16];
	sldns_wire2str_class_buf(rrclass, buf, sizeof(buf));
	return strdup(buf);
	}

	char* sldns_wire2str_dname(uint8_t* dname, size_t dname_len)
	{
	size_t slen=(size_t)sldns_wire2str_dname_buf(dname, dname_len, NULL, 0);
	char* result = (char*)malloc(slen+1);
	if(!result) return NULL;
	sldns_wire2str_dname_buf(dname, dname_len, result, slen+1);
	return result;
	}

	char* sldns_wire2str_rcode(int rcode)
	{
	char buf[16];
	sldns_wire2str_rcode_buf(rcode, buf, sizeof(buf));
	return strdup(buf);
	}

	int sldns_wire2str_pkt_buf(uint8_t* d, size_t dlen, char* s, size_t slen)
	{
	/* use arguments as temporary variables */
	return sldns_wire2str_pkt_scan(&d, &dlen, &s, &slen);
	}

	int sldns_wire2str_rr_buf(uint8_t* d, size_t dlen, char* s, size_t slen)
	{
	/* use arguments as temporary variables */
	return sldns_wire2str_rr_scan(&d, &dlen, &s, &slen, NULL, 0);
	}

	int sldns_wire2str_rrquestion_buf(uint8_t* d, size_t dlen, char* s, size_t slen)
	{
	/* use arguments as temporary variables */
	return sldns_wire2str_rrquestion_scan(&d, &dlen, &s, &slen, NULL, 0);
	}

	int sldns_wire2str_rdata_buf(uint8_t* rdata, size_t rdata_len, char* str,
	size_t str_len, uint16_t rrtype)
	{
	/* use arguments as temporary variables */
	return sldns_wire2str_rdata_scan(&rdata, &rdata_len, &str, &str_len,
	rrtype, NULL, 0);
	}

	int sldns_wire2str_rr_unknown_buf(uint8_t* d, size_t dlen, char* s, size_t slen)
	{
	/* use arguments as temporary variables */
	return sldns_wire2str_rr_unknown_scan(&d, &dlen, &s, &slen, NULL, 0);
	}

	int sldns_wire2str_rr_comment_buf(uint8_t* rr, size_t rrlen, size_t dname_len,
	char* s, size_t slen)
	{
	uint16_t rrtype = sldns_wirerr_get_type(rr, rrlen, dname_len);
	return sldns_wire2str_rr_comment_print(&s, &slen, rr, rrlen, dname_len,
	rrtype);
	}

	int sldns_wire2str_type_buf(uint16_t rrtype, char* s, size_t slen)
	{
	/* use arguments as temporary variables */
	return sldns_wire2str_type_print(&s, &slen, rrtype);
	}

	int sldns_wire2str_class_buf(uint16_t rrclass, char* s, size_t slen)
	{
	/* use arguments as temporary variables */
	return sldns_wire2str_class_print(&s, &slen, rrclass);
	}

	int sldns_wire2str_rcode_buf(int rcode, char* s, size_t slen)
	{
	/* use arguments as temporary variables */
	return sldns_wire2str_rcode_print(&s, &slen, rcode);
	}

	int sldns_wire2str_opcode_buf(int opcode, char* s, size_t slen)
	{
	/* use arguments as temporary variables */
	return sldns_wire2str_opcode_print(&s, &slen, opcode);
	}

	int sldns_wire2str_dname_buf(uint8_t* d, size_t dlen, char* s, size_t slen)
	{
	/* use arguments as temporary variables */
	return sldns_wire2str_dname_scan(&d, &dlen, &s, &slen, NULL, 0);
	}

	int sldns_str_vprint(char** str, size_t* slen, const char* format, va_list args)
	{
	int w = vsnprintf(str, slen, format, args);
	if(w < 0) {
	/* error in printout */
	return 0;
	} else if((size_t)w >= *slen) {
	str = NULL; / we do not want str to point outside of buffer*/
	*slen = 0;
	} else {
	*str += w;
	*slen -= w;
	}
	return w;
	}

	int sldns_str_print(char** str, size_t* slen, const char* format, ...)
	{
	int w;
	va_list args;
	va_start(args, format);
	w = sldns_str_vprint(str, slen, format, args);
	va_end(args);
	return w;
	}

	/** print hex format into text buffer for specified length */
	static int print_hex_buf(char** s, size_t* slen, uint8_t* buf, size_t len)
	{
	const char* hex = "0123456789ABCDEF";
	size_t i;
	for(i=0; i<len; i++) {
	(void)sldns_str_print(s, slen, "%c%c", hex[(buf[i]&0xf0)>>4],
	hex[buf[i]&0x0f]);
	}
	return (int)len*2;
	}

	/** print remainder of buffer in hex format with prefixed text */
	static int print_remainder_hex(const char* pref, uint8_t** d, size_t* dlen,
	char** s, size_t* slen)
	{
	int w = 0;
	w += sldns_str_print(s, slen, "%s", pref);
	w += print_hex_buf(s, slen, d, dlen);
	d += dlen;
	*dlen = 0;
	return w;
	}

	int sldns_wire2str_pkt_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen)
	{
	int w = 0;
	unsigned qdcount, ancount, nscount, arcount, i;
	uint8_t* pkt = *d;
	size_t pktlen = *dlen;
	if(*dlen >= LDNS_HEADER_SIZE) {
	qdcount = (unsigned)LDNS_QDCOUNT(*d);
	ancount = (unsigned)LDNS_ANCOUNT(*d);
	nscount = (unsigned)LDNS_NSCOUNT(*d);
	arcount = (unsigned)LDNS_ARCOUNT(*d);
	} else {
	qdcount = ancount = nscount = arcount = 0;
	}
	w += sldns_wire2str_header_scan(d, dlen, s, slen);
	w += sldns_str_print(s, slen, "\n");
	w += sldns_str_print(s, slen, ";; QUESTION SECTION:\n");
	for(i=0; i<qdcount; i++) {
	w += sldns_wire2str_rrquestion_scan(d, dlen, s, slen,
	pkt, pktlen);
	if(!*dlen) break;
	}
	w += sldns_str_print(s, slen, "\n");
	w += sldns_str_print(s, slen, ";; ANSWER SECTION:\n");
	for(i=0; i<ancount; i++) {
	w += sldns_wire2str_rr_scan(d, dlen, s, slen, pkt, pktlen);
	if(!*dlen) break;
	}
	w += sldns_str_print(s, slen, "\n");
	w += sldns_str_print(s, slen, ";; AUTHORITY SECTION:\n");
	for(i=0; i<nscount; i++) {
	w += sldns_wire2str_rr_scan(d, dlen, s, slen, pkt, pktlen);
	if(!*dlen) break;
	}
	w += sldns_str_print(s, slen, "\n");
	w += sldns_str_print(s, slen, ";; ADDITIONAL SECTION:\n");
	for(i=0; i<arcount; i++) {
	w += sldns_wire2str_rr_scan(d, dlen, s, slen, pkt, pktlen);
	if(!*dlen) break;
	}
	/* other fields: WHEN(time), SERVER(IP) not available here. */
	w += sldns_str_print(s, slen, ";; MSG SIZE rcvd: %d\n", (int)pktlen);
	if(*dlen > 0) {
	w += print_remainder_hex(";; trailing garbage 0x",
	d, dlen, s, slen);
	w += sldns_str_print(s, slen, "\n");
	}
	return w;
	}

	/** scan type, class and ttl and printout, for rr */
	static int sldns_rr_tcttl_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	int w = 0;
	uint16_t t, c;
	uint32_t ttl;
	if(*dl < 8) {
	if(*dl < 4)
	return w + print_remainder_hex("; Error malformed 0x",
	d, dl, s, sl);
	/* these print values or 0x.. if none left */
	t = sldns_read_uint16(*d);
	c = sldns_read_uint16((*d)+2);
	(*d)+=4;
	(*dl)-=4;
	w += sldns_wire2str_class_print(s, sl, c);
	w += sldns_str_print(s, sl, "\t");
	w += sldns_wire2str_type_print(s, sl, t);
	if(*dl == 0)
	return w + sldns_str_print(s, sl, "; Error no ttl");
	return w + print_remainder_hex(
	"; Error malformed ttl 0x", d, dl, s, sl);
	}
	t = sldns_read_uint16(*d);
	c = sldns_read_uint16((*d)+2);
	ttl = sldns_read_uint32((*d)+4);
	(*d)+=8;
	(*dl)-=8;
	w += sldns_str_print(s, sl, "%lu\t", (unsigned long)ttl);
	w += sldns_wire2str_class_print(s, sl, c);
	w += sldns_str_print(s, sl, "\t");
	w += sldns_wire2str_type_print(s, sl, t);
	return w;
	}

	int sldns_wire2str_rr_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen,
	uint8_t* pkt, size_t pktlen)
	{
	int w = 0;
	uint8_t* rr = *d;
	size_t rrlen = *dlen, dname_off, rdlen, ordlen;
	uint16_t rrtype = 0;

	if(dlen >= 3 && (d)[0]==0 &&
	sldns_read_uint16((*d)+1)==LDNS_RR_TYPE_OPT) {
	/* perform EDNS OPT processing */
	return sldns_wire2str_edns_scan(d, dlen, s, slen, pkt, pktlen);
	}

	/* try to scan the rdata with pretty-printing, but if that fails, then
	* scan the rdata as an unknown RR type */
	w += sldns_wire2str_dname_scan(d, dlen, s, slen, pkt, pktlen);
	w += sldns_str_print(s, slen, "\t");
	dname_off = rrlen-(*dlen);
	if(*dlen == 4) {
	/* like a question-RR */
	uint16_t t = sldns_read_uint16(*d);
	uint16_t c = sldns_read_uint16((*d)+2);
	(*d)+=4;
	(*dlen)-=4;
	w += sldns_wire2str_class_print(s, slen, c);
	w += sldns_str_print(s, slen, "\t");
	w += sldns_wire2str_type_print(s, slen, t);
	w += sldns_str_print(s, slen, " ; Error no ttl,rdata\n");
	return w;
	}
	if(*dlen < 8) {
	if(*dlen == 0)
	return w + sldns_str_print(s, slen, ";Error missing RR\n");
	w += print_remainder_hex(";Error partial RR 0x", d, dlen, s, slen);
	return w + sldns_str_print(s, slen, "\n");
	}
	rrtype = sldns_read_uint16(*d);
	w += sldns_rr_tcttl_scan(d, dlen, s, slen);
	w += sldns_str_print(s, slen, "\t");

	/* rdata */
	if(*dlen < 2) {
	if(*dlen == 0)
	return w + sldns_str_print(s, slen, ";Error missing rdatalen\n");
	w += print_remainder_hex(";Error missing rdatalen 0x",
	d, dlen, s, slen);
	return w + sldns_str_print(s, slen, "\n");
	}
	rdlen = sldns_read_uint16(*d);
	ordlen = rdlen;
	(*d)+=2;
	(*dlen)-=2;
	if(*dlen < rdlen) {
	w += sldns_str_print(s, slen, "\\# %u ", (unsigned)rdlen);
	if(*dlen == 0)
	return w + sldns_str_print(s, slen, ";Error missing rdata\n");
	w += print_remainder_hex(";Error partial rdata 0x", d, dlen, s, slen);
	return w + sldns_str_print(s, slen, "\n");
	}
	w += sldns_wire2str_rdata_scan(d, &rdlen, s, slen, rrtype, pkt, pktlen);
	(*dlen) -= (ordlen-rdlen);

	/* default comment */
	w += sldns_wire2str_rr_comment_print(s, slen, rr, rrlen, dname_off,
	rrtype);
	w += sldns_str_print(s, slen, "\n");
	return w;
	}

	int sldns_wire2str_rrquestion_scan(uint8_t** d, size_t* dlen, char** s,
	size_t* slen, uint8_t* pkt, size_t pktlen)
	{
	int w = 0;
	uint16_t t, c;
	w += sldns_wire2str_dname_scan(d, dlen, s, slen, pkt, pktlen);
	w += sldns_str_print(s, slen, "\t");
	if(*dlen < 4) {
	if(*dlen == 0)
	return w + sldns_str_print(s, slen, "Error malformed\n");
	w += print_remainder_hex("Error malformed 0x", d, dlen, s, slen);
	return w + sldns_str_print(s, slen, "\n");
	}
	t = sldns_read_uint16(*d);
	c = sldns_read_uint16((*d)+2);
	(*d)+=4;
	(*dlen)-=4;
	w += sldns_wire2str_class_print(s, slen, c);
	w += sldns_str_print(s, slen, "\t");
	w += sldns_wire2str_type_print(s, slen, t);
	w += sldns_str_print(s, slen, "\n");
	return w;
	}

	int sldns_wire2str_rr_unknown_scan(uint8_t** d, size_t* dlen, char** s,
	size_t* slen, uint8_t* pkt, size_t pktlen)
	{
	size_t rdlen, ordlen;
	int w = 0;
	w += sldns_wire2str_dname_scan(d, dlen, s, slen, pkt, pktlen);
	w += sldns_str_print(s, slen, "\t");
	w += sldns_rr_tcttl_scan(d, dlen, s, slen);
	w += sldns_str_print(s, slen, "\t");
	if(*dlen < 2) {
	if(*dlen == 0)
	return w + sldns_str_print(s, slen, ";Error missing rdatalen\n");
	w += print_remainder_hex(";Error missing rdatalen 0x",
	d, dlen, s, slen);
	return w + sldns_str_print(s, slen, "\n");
	}
	rdlen = sldns_read_uint16(*d);
	ordlen = rdlen;
	(*d) += 2;
	(*dlen) -= 2;
	if(*dlen < rdlen) {
	w += sldns_str_print(s, slen, "\\# %u ", (unsigned)rdlen);
	if(*dlen == 0)
	return w + sldns_str_print(s, slen, ";Error missing rdata\n");
	w += print_remainder_hex(";Error partial rdata 0x", d, dlen, s, slen);
	return w + sldns_str_print(s, slen, "\n");
	}
	w += sldns_wire2str_rdata_unknown_scan(d, &rdlen, s, slen);
	(*dlen) -= (ordlen-rdlen);
	w += sldns_str_print(s, slen, "\n");
	return w;
	}

	/** print rr comment for type DNSKEY */
	static int rr_comment_dnskey(char** s, size_t* slen, uint8_t* rr,
	size_t rrlen, size_t dname_off)
	{
	size_t rdlen;
	uint8_t* rdata;
	int flags, w = 0;
	if(rrlen < dname_off + 10) return 0;
	rdlen = sldns_read_uint16(rr+dname_off+8);
	if(rrlen < dname_off + 10 + rdlen) return 0;
	rdata = rr + dname_off + 10;
	flags = (int)sldns_read_uint16(rdata);
	w += sldns_str_print(s, slen, " ;{");

	/* id */
	w += sldns_str_print(s, slen, "id = %u",
	sldns_calc_keytag_raw(rdata, rdlen));

	/* flags */
	if((flags&LDNS_KEY_ZONE_KEY)) {
	if((flags&LDNS_KEY_SEP_KEY))
	w += sldns_str_print(s, slen, " (ksk)");
	else w += sldns_str_print(s, slen, " (zsk)");
	}

	/* keysize */
	if(rdlen > 4) {
	w += sldns_str_print(s, slen, ", ");
	w += sldns_str_print(s, slen, "size = %db",
	(int)sldns_rr_dnskey_key_size_raw(
	(unsigned char*)rdata+4, rdlen-4, (int)(rdata[3])));
	}

	w += sldns_str_print(s, slen, "}");
	return w;
	}

	/** print rr comment for type RRSIG */
	static int rr_comment_rrsig(char** s, size_t* slen, uint8_t* rr,
	size_t rrlen, size_t dname_off)
	{
	size_t rdlen;
	uint8_t* rdata;
	if(rrlen < dname_off + 10) return 0;
	rdlen = sldns_read_uint16(rr+dname_off+8);
	if(rrlen < dname_off + 10 + rdlen) return 0;
	rdata = rr + dname_off + 10;
	if(rdlen < 18) return 0;
	return sldns_str_print(s, slen, " ;{id = %d}",
	(int)sldns_read_uint16(rdata+16));
	}

	/** print rr comment for type NSEC3 */
	static int rr_comment_nsec3(char** s, size_t* slen, uint8_t* rr,
	size_t rrlen, size_t dname_off)
	{
	size_t rdlen;
	uint8_t* rdata;
	int w = 0;
	if(rrlen < dname_off + 10) return 0;
	rdlen = sldns_read_uint16(rr+dname_off+8);
	if(rrlen < dname_off + 10 + rdlen) return 0;
	rdata = rr + dname_off + 10;
	if(rdlen < 2) return 0;
	if((rdata[1] & LDNS_NSEC3_VARS_OPTOUT_MASK))
	w += sldns_str_print(s, slen, " ;{flags: optout}");
	return w;
	}

	int sldns_wire2str_rr_comment_print(char** s, size_t* slen, uint8_t* rr,
	size_t rrlen, size_t dname_off, uint16_t rrtype)
	{
	if(rrtype == LDNS_RR_TYPE_DNSKEY) {
	return rr_comment_dnskey(s, slen, rr, rrlen, dname_off);
	} else if(rrtype == LDNS_RR_TYPE_RRSIG) {
	return rr_comment_rrsig(s, slen, rr, rrlen, dname_off);
	} else if(rrtype == LDNS_RR_TYPE_NSEC3) {
	return rr_comment_nsec3(s, slen, rr, rrlen, dname_off);
	}
	return 0;
	}

	int sldns_wire2str_header_scan(uint8_t** d, size_t* dlen, char** s,
	size_t* slen)
	{
	int w = 0;
	int opcode, rcode;
	w += sldns_str_print(s, slen, ";; ->>HEADER<<- ");
	if(*dlen == 0)
	return w+sldns_str_print(s, slen, "Error empty packet");
	if(*dlen < 4)
	return w+print_remainder_hex("Error header too short 0x", d, dlen, s, slen);
	opcode = (int)LDNS_OPCODE_WIRE(*d);
	rcode = (int)LDNS_RCODE_WIRE(*d);
	w += sldns_str_print(s, slen, "opcode: ");
	w += sldns_wire2str_opcode_print(s, slen, opcode);
	w += sldns_str_print(s, slen, ", ");
	w += sldns_str_print(s, slen, "rcode: ");
	w += sldns_wire2str_rcode_print(s, slen, rcode);
	w += sldns_str_print(s, slen, ", ");
	w += sldns_str_print(s, slen, "id: %d\n", (int)LDNS_ID_WIRE(*d));
	w += sldns_str_print(s, slen, ";; flags:");
	if(LDNS_QR_WIRE(*d)) w += sldns_str_print(s, slen, " qr");
	if(LDNS_AA_WIRE(*d)) w += sldns_str_print(s, slen, " aa");
	if(LDNS_TC_WIRE(*d)) w += sldns_str_print(s, slen, " tc");
	if(LDNS_RD_WIRE(*d)) w += sldns_str_print(s, slen, " rd");
	if(LDNS_CD_WIRE(*d)) w += sldns_str_print(s, slen, " cd");
	if(LDNS_RA_WIRE(*d)) w += sldns_str_print(s, slen, " ra");
	if(LDNS_AD_WIRE(*d)) w += sldns_str_print(s, slen, " ad");
	if(LDNS_Z_WIRE(*d)) w += sldns_str_print(s, slen, " z");
	w += sldns_str_print(s, slen, " ; ");
	if(*dlen < LDNS_HEADER_SIZE)
	return w+print_remainder_hex("Error header too short 0x", d, dlen, s, slen);
	w += sldns_str_print(s, slen, "QUERY: %d, ", (int)LDNS_QDCOUNT(*d));
	w += sldns_str_print(s, slen, "ANSWER: %d, ", (int)LDNS_ANCOUNT(*d));
	w += sldns_str_print(s, slen, "AUTHORITY: %d, ", (int)LDNS_NSCOUNT(*d));
	w += sldns_str_print(s, slen, "ADDITIONAL: %d ", (int)LDNS_ARCOUNT(*d));
	*d += LDNS_HEADER_SIZE;
	*dlen -= LDNS_HEADER_SIZE;
	return w;
	}

	int sldns_wire2str_rdata_scan(uint8_t** d, size_t* dlen, char** s,
	size_t* slen, uint16_t rrtype, uint8_t* pkt, size_t pktlen)
	{
	/* try to prettyprint, but if that fails, use unknown format */
	uint8_t* origd = *d;
	char* origs = *s;
	size_t origdlen = dlen, origslen = slen;
	size_t r_cnt, r_max;
	sldns_rdf_type rdftype;
	int w = 0, n;

	const sldns_rr_descriptor *desc = sldns_rr_descript(rrtype);
	if(!desc) /* unknown format */
	return sldns_wire2str_rdata_unknown_scan(d, dlen, s, slen);
	/* dlen equals the rdatalen for the rdata */

	r_max = sldns_rr_descriptor_maximum(desc);
	for(r_cnt=0; r_cnt < r_max; r_cnt++) {
	if(*dlen == 0) {
	if(r_cnt < sldns_rr_descriptor_minimum(desc))
	goto failed;
	break; /* nothing more to print */
	}
	rdftype = sldns_rr_descriptor_field_type(desc, r_cnt);
	if(r_cnt != 0)
	w += sldns_str_print(s, slen, " ");
	n = sldns_wire2str_rdf_scan(d, dlen, s, slen, rdftype,
	pkt, pktlen);
	if(n == -1) {
	failed:
	/* failed, use unknown format */
	d = origd; s = origs;
	dlen = origdlen; slen = origslen;
	return sldns_wire2str_rdata_unknown_scan(d, dlen,
	s, slen);
	}
	w += n;
	}
	if(*dlen != 0) {
	goto failed;
	}
	return w;
	}

	int sldns_wire2str_rdata_unknown_scan(uint8_t** d, size_t* dlen, char** s,
	size_t* slen)
	{
	int w = 0;

	/* print length */
	w += sldns_str_print(s, slen, "\\# %u", (unsigned)*dlen);

	/* print rdlen in hex */
	if(*dlen != 0)
	w += sldns_str_print(s, slen, " ");
	w += print_hex_buf(s, slen, d, dlen);
	(d) += dlen;
	(*dlen) = 0;
	return w;
	}

	/** print and escape one character for a domain dname */
	static int dname_char_print(char** s, size_t* slen, uint8_t c)
	{
	if(c == '.' \|\| c == ';' \|\| c == '(' \|\| c == ')' \|\| c == '\\')
	return sldns_str_print(s, slen, "\\%c", c);
	else if(!(isascii((unsigned char)c) && isgraph((unsigned char)c)))
	return sldns_str_print(s, slen, "\\%03u", (unsigned)c);
	/* plain printout */
	if(*slen) {
	**s = (char)c;
	(*s)++;
	(*slen)--;
	}
	return 1;
	}

	int sldns_wire2str_dname_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen,
	uint8_t* pkt, size_t pktlen)
	{
	int w = 0;
	/* spool labels onto the string, use compression if its there */
	uint8_t* pos = *d;
	unsigned i, counter=0;
	const unsigned maxcompr = 1000; /* loop detection, max compr ptrs */
	int in_buf = 1;
	if(*dlen == 0) return sldns_str_print(s, slen, "ErrorMissingDname");
	if(*pos == 0) {
	(*d)++;
	(*dlen)--;
	return sldns_str_print(s, slen, ".");
	}
	while(*pos) {
	/* read label length */
	uint8_t labellen = *pos++;
	if(in_buf) { (d)++; (dlen)--; }

	/* find out what sort of label we have */
	if((labellen&0xc0) == 0xc0) {
	/* compressed */
	uint16_t target = 0;
	if(in_buf && *dlen == 0)
	return w + sldns_str_print(s, slen,
	"ErrorPartialDname");
	else if(!in_buf && pos+1 > pkt+pktlen)
	return w + sldns_str_print(s, slen,
	"ErrorPartialDname");
	target = ((labellen&0x3f)<<8) \| *pos;
	if(in_buf) { (d)++; (dlen)--; }
	/* move to target, if possible */
	if(!pkt \|\| target >= pktlen)
	return w + sldns_str_print(s, slen,
	"ErrorComprPtrOutOfBounds");
	if(counter++ > maxcompr)
	return w + sldns_str_print(s, slen,
	"ErrorComprPtrLooped");
	in_buf = 0;
	pos = pkt+target;
	continue;
	} else if((labellen&0xc0)) {
	/* notimpl label type */
	w += sldns_str_print(s, slen,
	"ErrorLABELTYPE%xIsUnknown",
	(int)(labellen&0xc0));
	return w;
	}

	/* spool label characters, end with '.' */
	if(in_buf && *dlen < (size_t)labellen)
	labellen = (uint8_t)*dlen;
	else if(!in_buf && pos+(size_t)labellen > pkt+pktlen)
	labellen = (uint8_t)(pkt + pktlen - pos);
	for(i=0; i<(unsigned)labellen; i++) {
	w += dname_char_print(s, slen, *pos++);
	}
	if(in_buf) {
	(*d) += labellen;
	(*dlen) -= labellen;
	if(*dlen == 0) break;
	}
	w += sldns_str_print(s, slen, ".");
	}
	/* skip over final root label */
	if(in_buf && dlen > 0) { (d)++; (*dlen)--; }
	/* in case we printed no labels, terminate dname */
	if(w == 0) w += sldns_str_print(s, slen, ".");
	return w;
	}

	int sldns_wire2str_opcode_print(char** s, size_t* slen, int opcode)
	{
	sldns_lookup_table *lt = sldns_lookup_by_id(sldns_opcodes, opcode);
	if (lt && lt->name) {
	return sldns_str_print(s, slen, "%s", lt->name);
	}
	return sldns_str_print(s, slen, "OPCODE%u", (unsigned)opcode);
	}

	int sldns_wire2str_rcode_print(char** s, size_t* slen, int rcode)
	{
	sldns_lookup_table *lt = sldns_lookup_by_id(sldns_rcodes, rcode);
	if (lt && lt->name) {
	return sldns_str_print(s, slen, "%s", lt->name);
	}
	return sldns_str_print(s, slen, "RCODE%u", (unsigned)rcode);
	}

	int sldns_wire2str_class_print(char** s, size_t* slen, uint16_t rrclass)
	{
	sldns_lookup_table *lt = sldns_lookup_by_id(sldns_rr_classes,
	(int)rrclass);
	if (lt && lt->name) {
	return sldns_str_print(s, slen, "%s", lt->name);
	}
	return sldns_str_print(s, slen, "CLASS%u", (unsigned)rrclass);
	}

	int sldns_wire2str_type_print(char** s, size_t* slen, uint16_t rrtype)
	{
	const sldns_rr_descriptor *descriptor = sldns_rr_descript(rrtype);
	if (descriptor && descriptor->_name) {
	return sldns_str_print(s, slen, "%s", descriptor->_name);
	}
	return sldns_str_print(s, slen, "TYPE%u", (unsigned)rrtype);
	}

	int sldns_wire2str_edns_option_code_print(char** s, size_t* slen,
	uint16_t opcode)
	{
	sldns_lookup_table *lt = sldns_lookup_by_id(sldns_edns_options,
	(int)opcode);
	if (lt && lt->name) {
	return sldns_str_print(s, slen, "%s", lt->name);
	}
	return sldns_str_print(s, slen, "OPT%u", (unsigned)opcode);
	}

	int sldns_wire2str_class_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen)
	{
	uint16_t c;
	if(*dlen == 0) return 0;
	if(*dlen < 2) return print_remainder_hex("Error malformed 0x", d, dlen, s, slen);
	c = sldns_read_uint16(*d);
	(*d)+=2;
	(*dlen)-=2;
	return sldns_wire2str_class_print(s, slen, c);
	}

	int sldns_wire2str_type_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen)
	{
	uint16_t t;
	if(*dlen == 0) return 0;
	if(*dlen < 2) return print_remainder_hex("Error malformed 0x", d, dlen, s, slen);
	t = sldns_read_uint16(*d);
	(*d)+=2;
	(*dlen)-=2;
	return sldns_wire2str_type_print(s, slen, t);
	}

	int sldns_wire2str_ttl_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen)
	{
	uint32_t ttl;
	if(*dlen == 0) return 0;
	if(*dlen < 4) return print_remainder_hex("Error malformed 0x", d, dlen, s, slen);
	ttl = sldns_read_uint32(*d);
	(*d)+=4;
	(*dlen)-=4;
	return sldns_str_print(s, slen, "%u", (unsigned)ttl);
	}

	int sldns_wire2str_rdf_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen,
	int rdftype, uint8_t* pkt, size_t pktlen)
	{
	if(*dlen == 0) return 0;
	switch(rdftype) {
	case LDNS_RDF_TYPE_NONE:
	return 0;
	case LDNS_RDF_TYPE_DNAME:
	return sldns_wire2str_dname_scan(d, dlen, s, slen, pkt, pktlen);
	case LDNS_RDF_TYPE_INT8:
	return sldns_wire2str_int8_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_INT16:
	return sldns_wire2str_int16_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_INT32:
	return sldns_wire2str_int32_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_PERIOD:
	return sldns_wire2str_period_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_TSIGTIME:
	return sldns_wire2str_tsigtime_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_A:
	return sldns_wire2str_a_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_AAAA:
	return sldns_wire2str_aaaa_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_STR:
	return sldns_wire2str_str_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_APL:
	return sldns_wire2str_apl_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_B32_EXT:
	return sldns_wire2str_b32_ext_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_B64:
	return sldns_wire2str_b64_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_HEX:
	return sldns_wire2str_hex_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_NSEC:
	return sldns_wire2str_nsec_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_NSEC3_SALT:
	return sldns_wire2str_nsec3_salt_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_TYPE:
	return sldns_wire2str_type_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_CLASS:
	return sldns_wire2str_class_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_CERT_ALG:
	return sldns_wire2str_cert_alg_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_ALG:
	return sldns_wire2str_alg_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_UNKNOWN:
	return sldns_wire2str_unknown_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_TIME:
	return sldns_wire2str_time_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_LOC:
	return sldns_wire2str_loc_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_WKS:
	case LDNS_RDF_TYPE_SERVICE:
	return sldns_wire2str_wks_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_NSAP:
	return sldns_wire2str_nsap_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_ATMA:
	return sldns_wire2str_atma_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_IPSECKEY:
	return sldns_wire2str_ipseckey_scan(d, dlen, s, slen, pkt,
	pktlen);
	case LDNS_RDF_TYPE_HIP:
	return sldns_wire2str_hip_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_INT16_DATA:
	return sldns_wire2str_int16_data_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_NSEC3_NEXT_OWNER:
	return sldns_wire2str_b32_ext_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_ILNP64:
	return sldns_wire2str_ilnp64_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_EUI48:
	return sldns_wire2str_eui48_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_EUI64:
	return sldns_wire2str_eui64_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_TAG:
	return sldns_wire2str_tag_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_LONG_STR:
	return sldns_wire2str_long_str_scan(d, dlen, s, slen);
	case LDNS_RDF_TYPE_TSIGERROR:
	return sldns_wire2str_tsigerror_scan(d, dlen, s, slen);
	}
	/* unknown rdf type */
	return -1;
	}

	int sldns_wire2str_int8_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	int w;
	if(*dl < 1) return -1;
	w = sldns_str_print(s, sl, "%u", (unsigned)**d);
	(*d)++;
	(*dl)--;
	return w;
	}

	int sldns_wire2str_int16_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	int w;
	if(*dl < 2) return -1;
	w = sldns_str_print(s, sl, "%lu", (unsigned long)sldns_read_uint16(*d));
	(*d)+=2;
	(*dl)-=2;
	return w;
	}

	int sldns_wire2str_int32_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	int w;
	if(*dl < 4) return -1;
	w = sldns_str_print(s, sl, "%lu", (unsigned long)sldns_read_uint32(*d));
	(*d)+=4;
	(*dl)-=4;
	return w;
	}

	int sldns_wire2str_period_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	int w;
	if(*dl < 4) return -1;
	w = sldns_str_print(s, sl, "%u", (unsigned)sldns_read_uint32(*d));
	(*d)+=4;
	(*dl)-=4;
	return w;
	}

	int sldns_wire2str_tsigtime_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	/* tsigtime is 48 bits network order unsigned integer */
	int w;
	uint64_t tsigtime = 0;
	uint64_t d0, d1, d2, d3, d4, d5;
	if(*dl < 6) return -1;
	d0 = (d)[0]; / cast to uint64 for shift operations */
	d1 = (*d)[1];
	d2 = (*d)[2];
	d3 = (*d)[3];
	d4 = (*d)[4];
	d5 = (*d)[5];
	tsigtime = (d0<<40) \| (d1<<32) \| (d2<<24) \| (d3<<16) \| (d4<<8) \| d5;
	#ifndef USE_WINSOCK
	w = sldns_str_print(s, sl, "%llu", (long long)tsigtime);
	#else
	w = sldns_str_print(s, sl, "%I64u", (long long)tsigtime);
	#endif
	(*d)+=6;
	(*dl)-=6;
	return w;
	}

	int sldns_wire2str_a_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	char buf[32];
	int w;
	if(*dl < 4) return -1;
	if(!inet_ntop(AF_INET, *d, buf, (socklen_t)sizeof(buf)))
	return -1;
	w = sldns_str_print(s, sl, "%s", buf);
	(*d)+=4;
	(*dl)-=4;
	return w;
	}

	int sldns_wire2str_aaaa_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	#ifdef AF_INET6
	char buf[64];
	int w;
	if(*dl < 16) return -1;
	if(!inet_ntop(AF_INET6, *d, buf, (socklen_t)sizeof(buf)))
	return -1;
	w = sldns_str_print(s, sl, "%s", buf);
	(*d)+=16;
	(*dl)-=16;
	return w;
	#else
	return -1;
	#endif
	}

	/** printout escaped TYPE_STR character */
	static int str_char_print(char** s, size_t* sl, uint8_t c)
	{
	if(isprint((unsigned char)c) \|\| c == '\t') {
	if(c == '\"' \|\| c == '\\')
	return sldns_str_print(s, sl, "\\%c", c);
	if(*sl) {
	**s = (char)c;
	(*s)++;
	(*sl)--;
	}
	return 1;
	}
	return sldns_str_print(s, sl, "\\%03u", (unsigned)c);
	}

	int sldns_wire2str_str_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	int w = 0;
	size_t i, len;
	if(*dl < 1) return -1;
	len = **d;
	if(*dl < 1+len) return -1;
	(*d)++;
	(*dl)--;
	w += sldns_str_print(s, sl, "\"");
	for(i=0; i<len; i++)
	w += str_char_print(s, sl, (*d)[i]);
	w += sldns_str_print(s, sl, "\"");
	(*d)+=len;
	(*dl)-=len;
	return w;
	}

	int sldns_wire2str_apl_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	int i, w = 0;
	uint16_t family;
	uint8_t negation, prefix, adflength;
	if(*dl < 4) return -1;
	family = sldns_read_uint16(*d);
	prefix = (*d)[2];
	negation = ((*d)[3] & LDNS_APL_NEGATION);
	adflength = ((*d)[3] & LDNS_APL_MASK);
	if(*dl < 4+(size_t)adflength) return -1;
	if(family != LDNS_APL_IP4 && family != LDNS_APL_IP6)
	return -1; /* unknown address family */
	if(negation)
	w += sldns_str_print(s, sl, "!");
	w += sldns_str_print(s, sl, "%u:", (unsigned)family);
	if(family == LDNS_APL_IP4) {
	/* check if prefix <32 ? */
	/* address is variable length 0 - 4 */
	for(i=0; i<4; i++) {
	if(i > 0)
	w += sldns_str_print(s, sl, ".");
	if(i < (int)adflength)
	w += sldns_str_print(s, sl, "%d", (*d)[4+i]);
	else w += sldns_str_print(s, sl, "0");
	}
	} else if(family == LDNS_APL_IP6) {
	/* check if prefix <128 ? */
	/* address is variable length 0 - 16 */
	for(i=0; i<16; i++) {
	if(i%2 == 0 && i>0)
	w += sldns_str_print(s, sl, ":");
	if(i < (int)adflength)
	w += sldns_str_print(s, sl, "%02x", (*d)[4+i]);
	else w += sldns_str_print(s, sl, "00");
	}
	}
	w += sldns_str_print(s, sl, "/%u", (unsigned)prefix);
	(*d) += 4+adflength;
	(*dl) -= 4+adflength;
	return w;
	}

	int sldns_wire2str_b32_ext_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	size_t datalen;
	size_t sz;
	if(*dl < 1) return -1;
	datalen = (*d)[0];
	if(*dl < 1+datalen) return -1;
	sz = sldns_b32_ntop_calculate_size(datalen);
	if(*sl < sz+1) {
	(*d) += datalen+1;
	(*dl) -= (datalen+1);
	return (int)sz; /* out of space really, but would need buffer
	in order to truncate the output */
	}
	sldns_b32_ntop_extended_hex((d)+1, datalen, s, *sl);
	(*d) += datalen+1;
	(*dl) -= (datalen+1);
	(*s) += sz;
	(*sl) -= sz;
	return (int)sz;
	}

	/** scan number of bytes from wire into b64 presentation format */
	static int sldns_wire2str_b64_scan_num(uint8_t** d, size_t* dl, char** s,
	size_t* sl, size_t num)
	{
	/* b64_ntop_calculate size includes null at the end */
	size_t sz = sldns_b64_ntop_calculate_size(num)-1;
	if(*sl < sz+1) {
	(*d) += num;
	(*dl) -= num;
	return (int)sz; /* out of space really, but would need buffer
	in order to truncate the output */
	}
	sldns_b64_ntop(d, num, s, *sl);
	(*d) += num;
	(*dl) -= num;
	(*s) += sz;
	(*sl) -= sz;
	return (int)sz;
	}

	int sldns_wire2str_b64_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	if(*dl == 0) {
	return sldns_str_print(s, sl, "0");
	}
	return sldns_wire2str_b64_scan_num(d, dl, s, sl, *dl);
	}

	int sldns_wire2str_hex_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	if(*dl == 0) {
	return sldns_str_print(s, sl, "0");
	}
	return print_remainder_hex("", d, dl, s, sl);
	}

	int sldns_wire2str_nsec_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	uint8_t* p = *d;
	size_t pl = *dl;
	unsigned i, bit, window, block_len;
	uint16_t t;
	int w = 0;

	/* check for errors */
	while(pl) {
	if(pl < 2) return -1;
	block_len = (unsigned)p[1];
	if(pl < 2+block_len) return -1;
	p += block_len+2;
	pl -= block_len+2;
	}

	/* do it */
	p = *d;
	pl = *dl;
	while(pl) {
	if(pl < 2) return -1; /* cannot happen */
	window = (unsigned)p[0];
	block_len = (unsigned)p[1];
	if(pl < 2+block_len) return -1; /* cannot happen */
	p += 2;
	for(i=0; i<block_len; i++) {
	if(p[i] == 0) continue;
	/* base type number for this octet */
	t = ((window)<<8) \| (i << 3);
	for(bit=0; bit<8; bit++) {
	if((p[i]&(0x80>>bit))) {
	if(w) w += sldns_str_print(s, sl, " ");
	w += sldns_wire2str_type_print(s, sl,
	t+bit);
	}
	}
	}
	p += block_len;
	pl -= block_len+2;
	}
	(d) += dl;
	(*dl) = 0;
	return w;
	}

	int sldns_wire2str_nsec3_salt_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	size_t salt_len;
	int w;
	if(*dl < 1) return -1;
	salt_len = (size_t)(*d)[0];
	if(*dl < 1+salt_len) return -1;
	(*d)++;
	(*dl)--;
	if(salt_len == 0) {
	return sldns_str_print(s, sl, "-");
	}
	w = print_hex_buf(s, sl, *d, salt_len);
	(*dl)-=salt_len;
	(*d)+=salt_len;
	return w;
	}

	int sldns_wire2str_cert_alg_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	sldns_lookup_table *lt;
	int data, w;
	if(*dl < 2) return -1;
	data = (int)sldns_read_uint16(*d);
	lt = sldns_lookup_by_id(sldns_cert_algorithms, data);
	if(lt && lt->name)
	w = sldns_str_print(s, sl, "%s", lt->name);
	else w = sldns_str_print(s, sl, "%d", data);
	(*dl)-=2;
	(*d)+=2;
	return w;
	}

	int sldns_wire2str_alg_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	/* don't use algorithm mnemonics in the presentation format
	* this kind of got sneaked into the rfc's */
	return sldns_wire2str_int8_scan(d, dl, s, sl);
	}

	int sldns_wire2str_unknown_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	return sldns_wire2str_rdata_unknown_scan(d, dl, s, sl);
	}

	int sldns_wire2str_time_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	/* create a YYYYMMDDHHMMSS string if possible */
	struct tm tm;
	char date_buf[16];
	uint32_t t;
	memset(&tm, 0, sizeof(tm));
	if(*dl < 4) return -1;
	t = sldns_read_uint32(*d);
	date_buf[15]=0;
	if(sldns_serial_arithmetics_gmtime_r(t, time(NULL), &tm) &&
	strftime(date_buf, 15, "%Y%m%d%H%M%S", &tm)) {
	(*d) += 4;
	(*dl) -= 4;
	return sldns_str_print(s, sl, "%s", date_buf);
	}
	return -1;
	}

	static int
	loc_cm_print(char** str, size_t* sl, uint8_t mantissa, uint8_t exponent)
	{
	int w = 0;
	uint8_t i;
	/* is it 0.<two digits> ? */
	if(exponent < 2) {
	if(exponent == 1)
	mantissa *= 10;
	return sldns_str_print(str, sl, "0.%02ld", (long)mantissa);
	}
	/* always <digit><string of zeros> */
	w += sldns_str_print(str, sl, "%d", (int)mantissa);
	for(i=0; i<exponent-2; i++)
	w += sldns_str_print(str, sl, "0");
	return w;
	}

	int sldns_wire2str_loc_scan(uint8_t** d, size_t* dl, char** str, size_t* sl)
	{
	/* we could do checking (ie degrees < 90 etc)? */
	uint8_t version;
	uint8_t size;
	uint8_t horizontal_precision;
	uint8_t vertical_precision;
	uint32_t longitude;
	uint32_t latitude;
	uint32_t altitude;
	char northerness;
	char easterness;
	uint32_t h;
	uint32_t m;
	double s;
	uint32_t equator = (uint32_t)1 << 31; /* 2*31 /
	int w = 0;

	if(*dl < 16) return -1;
	version = (*d)[0];
	if(version != 0)
	return sldns_wire2str_hex_scan(d, dl, str, sl);
	size = (*d)[1];
	horizontal_precision = (*d)[2];
	vertical_precision = (*d)[3];

	latitude = sldns_read_uint32((*d)+4);
	longitude = sldns_read_uint32((*d)+8);
	altitude = sldns_read_uint32((*d)+12);

	if (latitude > equator) {
	northerness = 'N';
	latitude = latitude - equator;
	} else {
	northerness = 'S';
	latitude = equator - latitude;
	}
	h = latitude / (1000 * 60 * 60);
	latitude = latitude % (1000 * 60 * 60);
	m = latitude / (1000 * 60);
	latitude = latitude % (1000 * 60);
	s = (double) latitude / 1000.0;
	w += sldns_str_print(str, sl, "%02u %02u %06.3f %c ",
	h, m, s, northerness);

	if (longitude > equator) {
	easterness = 'E';
	longitude = longitude - equator;
	} else {
	easterness = 'W';
	longitude = equator - longitude;
	}
	h = longitude / (1000 * 60 * 60);
	longitude = longitude % (1000 * 60 * 60);
	m = longitude / (1000 * 60);
	longitude = longitude % (1000 * 60);
	s = (double) longitude / (1000.0);
	w += sldns_str_print(str, sl, "%02u %02u %06.3f %c ",
	h, m, s, easterness);

	s = ((double) altitude) / 100;
	s -= 100000;

	if(altitude%100 != 0)
	w += sldns_str_print(str, sl, "%.2f", s);
	else
	w += sldns_str_print(str, sl, "%.0f", s);

	w += sldns_str_print(str, sl, "m ");

	w += loc_cm_print(str, sl, (size & 0xf0) >> 4, size & 0x0f);
	w += sldns_str_print(str, sl, "m ");

	w += loc_cm_print(str, sl, (horizontal_precision & 0xf0) >> 4,
	horizontal_precision & 0x0f);
	w += sldns_str_print(str, sl, "m ");

	w += loc_cm_print(str, sl, (vertical_precision & 0xf0) >> 4,
	vertical_precision & 0x0f);
	w += sldns_str_print(str, sl, "m");

	(*d)+=16;
	(*dl)-=16;
	return w;
	}

	int sldns_wire2str_wks_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	/* protocol, followed by bitmap of services */
	const char* proto_name = NULL;
	struct protoent *protocol;
	struct servent *service;
	uint8_t protocol_nr;
	int bit, port, w = 0;
	size_t i;
	/* we cannot print with strings because they
	* are not portable, the presentation format may
	* not be able to be read in on another computer. */
	int print_symbols = 0;

	/* protocol */
	if(*dl < 1) return -1;
	protocol_nr = (*d)[0];
	(*d)++;
	(*dl)--;
	protocol = getprotobynumber((int)protocol_nr);
	if(protocol && (protocol->p_name != NULL)) {
	w += sldns_str_print(s, sl, "%s", protocol->p_name);
	proto_name = protocol->p_name;
	} else if(protocol_nr == 6) {
	w += sldns_str_print(s, sl, "tcp");
	} else if(protocol_nr == 17) {
	w += sldns_str_print(s, sl, "udp");
	} else {
	w += sldns_str_print(s, sl, "%u", (unsigned)protocol_nr);
	}

	for(i=0; i<*dl; i++) {
	if((*d)[i] == 0)
	continue;
	for(bit=0; bit<8; bit++) {
	if(!(((*d)[i])&(0x80>>bit)))
	continue;
	port = (int)i*8 + bit;

	if(!print_symbols)
	service = NULL;
	else
	service = getservbyport(
	(int)htons((uint16_t)port), proto_name);
	if(service && service->s_name)
	w += sldns_str_print(s, sl, " %s",
	service->s_name);
	else w += sldns_str_print(s, sl, " %u",
	(unsigned)port);
	}
	}

	#ifdef HAVE_ENDSERVENT
	endservent();
	#endif
	#ifdef HAVE_ENDPROTOENT
	endprotoent();
	#endif
	(d) += dl;
	(*dl) = 0;
	return w;
	}

	int sldns_wire2str_nsap_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	return print_remainder_hex("0x", d, dl, s, sl);
	}

	int sldns_wire2str_atma_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	return print_remainder_hex("", d, dl, s, sl);
	}

	/* internal scan routine that can modify arguments on failure */
	static int sldns_wire2str_ipseckey_scan_internal(uint8_t** d, size_t* dl,
	char** s, size_t* sl, uint8_t* pkt, size_t pktlen)
	{
	/* http://www.ietf.org/internet-drafts/draft-ietf-ipseckey-rr-12.txt*/
	uint8_t precedence, gateway_type, algorithm;
	int w = 0;

	if(*dl < 3) return -1;
	precedence = (*d)[0];
	gateway_type = (*d)[1];
	algorithm = (*d)[2];
	if(gateway_type > 3)
	return -1; /* unknown */
	(*d)+=3;
	(*dl)-=3;
	w += sldns_str_print(s, sl, "%d %d %d ",
	(int)precedence, (int)gateway_type, (int)algorithm);

	switch(gateway_type) {
	case 0: /* no gateway */
	w += sldns_str_print(s, sl, ".");
	break;
	case 1: /* ip4 */
	w += sldns_wire2str_a_scan(d, dl, s, sl);
	break;
	case 2: /* ip6 */
	w += sldns_wire2str_aaaa_scan(d, dl, s, sl);
	break;
	case 3: /* dname */
	w += sldns_wire2str_dname_scan(d, dl, s, sl, pkt, pktlen);
	break;
	default: /* unknown */
	return -1;
	}

	if(*dl < 1)
	return -1;
	w += sldns_str_print(s, sl, " ");
	w += sldns_wire2str_b64_scan_num(d, dl, s, sl, *dl);
	return w;
	}

	int sldns_wire2str_ipseckey_scan(uint8_t** d, size_t* dl, char** s, size_t* sl,
	uint8_t* pkt, size_t pktlen)
	{
	uint8_t* od = *d;
	char* os = *s;
	size_t odl = dl, osl = sl;
	int w=sldns_wire2str_ipseckey_scan_internal(d, dl, s, sl, pkt, pktlen);
	if(w == -1) {
	*d = od;
	*s = os;
	*dl = odl;
	*sl = osl;
	return -1;
	}
	return w;
	}

	int sldns_wire2str_hip_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	int w;
	uint8_t algo, hitlen;
	uint16_t pklen;

	/* read lengths */
	if(*dl < 4)
	return -1;
	hitlen = (*d)[0];
	algo = (*d)[1];
	pklen = sldns_read_uint16((*d)+2);
	if(*dl < (size_t)4 + (size_t)hitlen + (size_t)pklen)
	return -1;

	/* write: algo hit pubkey */
	w = sldns_str_print(s, sl, "%u ", (unsigned)algo);
	w += print_hex_buf(s, sl, (*d)+4, hitlen);
	w += sldns_str_print(s, sl, " ");
	(*d)+=4+hitlen;
	(*dl)-= (4+hitlen);
	w += sldns_wire2str_b64_scan_num(d, dl, s, sl, pklen);
	return w;
	}

	int sldns_wire2str_int16_data_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	int w;
	uint16_t n;
	if(*dl < 2)
	return -1;
	n = sldns_read_uint16(*d);
	if(*dl < 2+(size_t)n)
	return -1;
	(*d)+=2;
	(*dl)-=2;
	if(n == 0) {
	return sldns_str_print(s, sl, "0");
	}
	w = sldns_str_print(s, sl, "%u ", (unsigned)n);
	w += sldns_wire2str_b64_scan_num(d, dl, s, sl, n);
	return w;
	}

	int sldns_wire2str_nsec3_next_owner_scan(uint8_t** d, size_t* dl, char** s,
	size_t* sl)
	{
	return sldns_wire2str_b32_ext_scan(d, dl, s, sl);
	}

	int sldns_wire2str_ilnp64_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	int w;
	if(*dl < 8)
	return -1;
	w = sldns_str_print(s, sl, "%.4x:%.4x:%.4x:%.4x",
	sldns_read_uint16(d), sldns_read_uint16((d)+2),
	sldns_read_uint16((d)+4), sldns_read_uint16((d)+6));
	(*d)+=8;
	(*dl)-=8;
	return w;
	}

	int sldns_wire2str_eui48_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	int w;
	if(*dl < 6)
	return -1;
	w = sldns_str_print(s, sl, "%.2x-%.2x-%.2x-%.2x-%.2x-%.2x",
	(d)[0], (d)[1], (d)[2], (d)[3], (d)[4], (d)[5]);
	(*d)+=6;
	(*dl)-=6;
	return w;
	}

	int sldns_wire2str_eui64_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	int w;
	if(*dl < 8)
	return -1;
	w = sldns_str_print(s, sl, "%.2x-%.2x-%.2x-%.2x-%.2x-%.2x-%.2x-%.2x",
	(d)[0], (d)[1], (d)[2], (d)[3], (d)[4], (d)[5],
	(d)[6], (d)[7]);
	(*d)+=8;
	(*dl)-=8;
	return w;
	}

	int sldns_wire2str_tag_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	size_t i, n;
	int w = 0;
	if(*dl < 1)
	return -1;
	n = (size_t)((*d)[0]);
	if(*dl < 1+n)
	return -1;
	for(i=0; i<n; i++)
	if(!isalnum((unsigned char)(*d)[i+1]))
	return -1;
	for(i=0; i<n; i++)
	w += sldns_str_print(s, sl, "%c", (char)(*d)[i+1]);
	(*d)+=n+1;
	(*dl)-=(n+1);
	return w;
	}

	int sldns_wire2str_long_str_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	size_t i;
	int w = 0;
	w += sldns_str_print(s, sl, "\"");
	for(i=0; i<*dl; i++)
	w += str_char_print(s, sl, (*d)[i]);
	w += sldns_str_print(s, sl, "\"");
	(d)+=dl;
	(*dl)=0;
	return w;
	}

	int sldns_wire2str_tsigerror_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
	{
	sldns_lookup_table *lt;
	int data, w;
	if(*dl < 2) return -1;
	data = (int)sldns_read_uint16(*d);
	lt = sldns_lookup_by_id(sldns_tsig_errors, data);
	if(lt && lt->name)
	w = sldns_str_print(s, sl, "%s", lt->name);
	else w = sldns_str_print(s, sl, "%d", data);
	(*dl)-=2;
	(*d)+=2;
	return w;
	}

	int sldns_wire2str_edns_llq_print(char** s, size_t* sl, uint8_t* data,
	size_t len)
	{
	/* LLQ constants */
	const char* llq_errors[] = {"NO-ERROR", "SERV-FULL", "STATIC",
	"FORMAT-ERR", "NO-SUCH-LLQ", "BAD-VERS", "UNKNOWN_ERR"};
	const unsigned int llq_errors_num = 7;
	const char* llq_opcodes[] = {"LLQ-SETUP", "LLQ-REFRESH", "LLQ-EVENT"};
	const unsigned int llq_opcodes_num = 3;
	uint16_t version, llq_opcode, error_code;
	uint64_t llq_id;
	uint32_t lease_life; /* Requested or granted life of LLQ, in seconds */
	int w = 0;

	/* read the record */
	if(len != 18) {
	w += sldns_str_print(s, sl, "malformed LLQ ");
	w += print_hex_buf(s, sl, data, len);
	return w;
	}
	version = sldns_read_uint16(data);
	llq_opcode = sldns_read_uint16(data+2);
	error_code = sldns_read_uint16(data+4);
	memmove(&llq_id, data+6, sizeof(llq_id));
	lease_life = sldns_read_uint32(data+14);

	/* print it */
	w += sldns_str_print(s, sl, "v%d ", (int)version);
	if(llq_opcode < llq_opcodes_num)
	w += sldns_str_print(s, sl, "%s", llq_opcodes[llq_opcode]);
	else w += sldns_str_print(s, sl, "opcode %d", (int)llq_opcode);
	if(error_code < llq_errors_num)
	w += sldns_str_print(s, sl, " %s", llq_errors[error_code]);
	else w += sldns_str_print(s, sl, " error %d", (int)error_code);
	#ifndef USE_WINSOCK
	w += sldns_str_print(s, sl, " id %llx lease-life %lu",
	(unsigned long long)llq_id, (unsigned long)lease_life);
	#else
	w += sldns_str_print(s, sl, " id %I64x lease-life %lu",
	(unsigned long long)llq_id, (unsigned long)lease_life);
	#endif
	return w;
	}

	int sldns_wire2str_edns_ul_print(char** s, size_t* sl, uint8_t* data,
	size_t len)
	{
	uint32_t lease;
	int w = 0;
	if(len != 4) {
	w += sldns_str_print(s, sl, "malformed UL ");
	w += print_hex_buf(s, sl, data, len);
	return w;
	}
	lease = sldns_read_uint32(data);
	w += sldns_str_print(s, sl, "lease %lu", (unsigned long)lease);
	return w;
	}

	int sldns_wire2str_edns_nsid_print(char** s, size_t* sl, uint8_t* data,
	size_t len)
	{
	int w = 0;
	size_t i, printed=0;
	w += print_hex_buf(s, sl, data, len);
	for(i=0; i<len; i++) {
	if(isprint((unsigned char)data[i]) \|\| data[i] == '\t') {
	if(!printed) {
	w += sldns_str_print(s, sl, " (");
	printed = 1;
	}
	w += sldns_str_print(s, sl, "%c", (char)data[i]);
	}
	}
	if(printed)
	w += sldns_str_print(s, sl, ")");
	return w;
	}

	int sldns_wire2str_edns_dau_print(char** s, size_t* sl, uint8_t* data,
	size_t len)
	{
	sldns_lookup_table *lt;
	size_t i;
	int w = 0;
	for(i=0; i<len; i++) {
	lt = sldns_lookup_by_id(sldns_algorithms, (int)data[i]);
	if(lt && lt->name)
	w += sldns_str_print(s, sl, " %s", lt->name);
	else w += sldns_str_print(s, sl, " %d", (int)data[i]);
	}
	return w;
	}

	int sldns_wire2str_edns_dhu_print(char** s, size_t* sl, uint8_t* data,
	size_t len)
	{
	sldns_lookup_table *lt;
	size_t i;
	int w = 0;
	for(i=0; i<len; i++) {
	lt = sldns_lookup_by_id(sldns_hashes, (int)data[i]);
	if(lt && lt->name)
	w += sldns_str_print(s, sl, " %s", lt->name);
	else w += sldns_str_print(s, sl, " %d", (int)data[i]);
	}
	return w;
	}

	int sldns_wire2str_edns_n3u_print(char** s, size_t* sl, uint8_t* data,
	size_t len)
	{
	size_t i;
	int w = 0;
	for(i=0; i<len; i++) {
	if(data[i] == 1)
	w += sldns_str_print(s, sl, " SHA1");
	else w += sldns_str_print(s, sl, " %d", (int)data[i]);
	}
	return w;
	}

	int sldns_wire2str_edns_subnet_print(char** s, size_t* sl, uint8_t* data,
	size_t len)
	{
	int w = 0;
	uint16_t family;
	uint8_t source, scope;
	if(len < 4) {
	w += sldns_str_print(s, sl, "malformed subnet ");
	w += print_hex_buf(s, sl, data, len);
	return w;
	}
	family = sldns_read_uint16(data);
	source = data[2];
	scope = data[3];
	if(family == 1) {
	/* IP4 */
	char buf[64];
	uint8_t ip4[4];
	memset(ip4, 0, sizeof(ip4));
	if(len-4 > 4) {
	w += sldns_str_print(s, sl, "trailingdata:");
	w += print_hex_buf(s, sl, data+4+4, len-4-4);
	w += sldns_str_print(s, sl, " ");
	len = 4+4;
	}
	memmove(ip4, data+4, len-4);
	if(!inet_ntop(AF_INET, ip4, buf, (socklen_t)sizeof(buf))) {
	w += sldns_str_print(s, sl, "ip4ntoperror ");
	w += print_hex_buf(s, sl, data+4+4, len-4-4);
	} else {
	w += sldns_str_print(s, sl, "%s", buf);
	}
	} else if(family == 2) {
	/* IP6 */
	char buf[64];
	uint8_t ip6[16];
	memset(ip6, 0, sizeof(ip6));
	if(len-4 > 16) {
	w += sldns_str_print(s, sl, "trailingdata:");
	w += print_hex_buf(s, sl, data+4+16, len-4-16);
	w += sldns_str_print(s, sl, " ");
	len = 4+16;
	}
	memmove(ip6, data+4, len-4);
	#ifdef AF_INET6
	if(!inet_ntop(AF_INET6, ip6, buf, (socklen_t)sizeof(buf))) {
	w += sldns_str_print(s, sl, "ip6ntoperror ");
	w += print_hex_buf(s, sl, data+4+4, len-4-4);
	} else {
	w += sldns_str_print(s, sl, "%s", buf);
	}
	#else
	w += print_hex_buf(s, sl, data+4+4, len-4-4);
	#endif
	} else {
	/* unknown */
	w += sldns_str_print(s, sl, "family %d ",
	(int)family);
	w += print_hex_buf(s, sl, data, len);
	}
	w += sldns_str_print(s, sl, "/%d scope /%d", (int)source, (int)scope);
	return w;
	}

	-static int sldns_wire2str_edns_keepalive_print(char** s, size_t* sl, uint8_t* data,
	- size_t len)
	+static int sldns_wire2str_edns_keepalive_print(char** s, size_t* sl,
	+ uint8_t* data, size_t len)
	{
	int w = 0;
	uint16_t timeout;
	if(!(len == 0 \|\| len == 2)) {
	w += sldns_str_print(s, sl, "malformed keepalive ");
	w += print_hex_buf(s, sl, data, len);
	return w;
	}
	if(len == 0 ) {
	w += sldns_str_print(s, sl, "no timeout value (only valid for client option) ");
	} else {
	timeout = sldns_read_uint16(data);
	w += sldns_str_print(s, sl, "timeout value in units of 100ms %u", (int)timeout);
	}
	return w;
	}

	int sldns_wire2str_edns_option_print(char** s, size_t* sl,
	uint16_t option_code, uint8_t* optdata, size_t optlen)
	{
	int w = 0;
	w += sldns_wire2str_edns_option_code_print(s, sl, option_code);
	w += sldns_str_print(s, sl, ": ");
	switch(option_code) {
	case LDNS_EDNS_LLQ:
	w += sldns_wire2str_edns_llq_print(s, sl, optdata, optlen);
	break;
	case LDNS_EDNS_UL:
	w += sldns_wire2str_edns_ul_print(s, sl, optdata, optlen);
	break;
	case LDNS_EDNS_NSID:
	w += sldns_wire2str_edns_nsid_print(s, sl, optdata, optlen);
	break;
	case LDNS_EDNS_DAU:
	w += sldns_wire2str_edns_dau_print(s, sl, optdata, optlen);
	break;
	case LDNS_EDNS_DHU:
	w += sldns_wire2str_edns_dhu_print(s, sl, optdata, optlen);
	break;
	case LDNS_EDNS_N3U:
	w += sldns_wire2str_edns_n3u_print(s, sl, optdata, optlen);
	break;
	case LDNS_EDNS_CLIENT_SUBNET:
	w += sldns_wire2str_edns_subnet_print(s, sl, optdata, optlen);
	break;
	case LDNS_EDNS_KEEPALIVE:
	w += sldns_wire2str_edns_keepalive_print(s, sl, optdata, optlen);
	break;
	case LDNS_EDNS_PADDING:
	w += print_hex_buf(s, sl, optdata, optlen);
	break;
	default:
	/* unknown option code */
	w += print_hex_buf(s, sl, optdata, optlen);
	break;
	}
	return w;
	}

	/** print the edns options to string */
	static int
	print_edns_opts(char** s, size_t* sl, uint8_t* rdata, size_t rdatalen)
	{
	uint16_t option_code, option_len;
	int w = 0;
	while(rdatalen > 0) {
	/* option name */
	if(rdatalen < 4) {
	w += sldns_str_print(s, sl, " ; malformed: ");
	w += print_hex_buf(s, sl, rdata, rdatalen);
	return w;
	}
	option_code = sldns_read_uint16(rdata);
	option_len = sldns_read_uint16(rdata+2);
	rdata += 4;
	rdatalen -= 4;

	/* option value */
	if(rdatalen < (size_t)option_len) {
	w += sldns_str_print(s, sl, " ; malformed ");
	w += sldns_wire2str_edns_option_code_print(s, sl,
	option_code);
	w += sldns_str_print(s, sl, ": ");
	w += print_hex_buf(s, sl, rdata, rdatalen);
	return w;
	}
	w += sldns_str_print(s, sl, " ; ");
	w += sldns_wire2str_edns_option_print(s, sl, option_code,
	rdata, option_len);
	rdata += option_len;
	rdatalen -= option_len;
	}
	return w;
	}

	int sldns_wire2str_edns_scan(uint8_t** data, size_t* data_len, char** str,
	size_t* str_len, uint8_t* pkt, size_t pktlen)
	{
	int w = 0;
	uint8_t ext_rcode, edns_version;
	uint16_t udpsize, edns_bits, rdatalen;
	w += sldns_str_print(str, str_len, "; EDNS:");

	/* some input checks, domain name */
	if(*data_len < 1+10)
	return w + print_remainder_hex("Error malformed 0x",
	data, data_len, str, str_len);
	if(*data[0] != 0) {
	return w + print_remainder_hex("Error nonrootdname 0x",
	data, data_len, str, str_len);
	}
	(*data)++;
	(*data_len)--;

	/* check type and read fixed contents */
	if(sldns_read_uint16((*data)) != LDNS_RR_TYPE_OPT) {
	return w + print_remainder_hex("Error nottypeOPT 0x",
	data, data_len, str, str_len);
	}
	udpsize = sldns_read_uint16((*data)+2);
	ext_rcode = (*data)[4];
	edns_version = (*data)[5];
	edns_bits = sldns_read_uint16((*data)+6);
	rdatalen = sldns_read_uint16((*data)+8);
	(*data)+=10;
	(*data_len)-=10;

	w += sldns_str_print(str, str_len, " version: %u;",
	(unsigned)edns_version);
	w += sldns_str_print(str, str_len, " flags:");
	if((edns_bits & LDNS_EDNS_MASK_DO_BIT))
	w += sldns_str_print(str, str_len, " do");
	/* the extended rcode is the value set, shifted four bits,
	* and or'd with the original rcode */
	if(ext_rcode) {
	int rc = ((int)ext_rcode)<<4;
	if(pkt && pktlen >= LDNS_HEADER_SIZE)
	rc \|= LDNS_RCODE_WIRE(pkt);
	w += sldns_str_print(str, str_len, " ; ext-rcode: %d", rc);
	}
	w += sldns_str_print(str, str_len, " ; udp: %u", (unsigned)udpsize);

	if(rdatalen) {
	if((size_t)*data_len < rdatalen) {
	w += sldns_str_print(str, str_len,
	" ; Error EDNS rdata too short; ");
	rdatalen = (uint16_t)*data_len;
	}
	w += print_edns_opts(str, str_len, *data, rdatalen);
	(*data) += rdatalen;
	(*data_len) -= rdatalen;
	}
	w += sldns_str_print(str, str_len, "\n");
	return w;
	}
	Index: head/contrib/unbound/smallapp/unbound-checkconf.c
	===================================================================
	--- head/contrib/unbound/smallapp/unbound-checkconf.c (revision 349719)
	+++ head/contrib/unbound/smallapp/unbound-checkconf.c (revision 349720)
	@@ -1,743 +1,730 @@
	/*
	* checkconf/unbound-checkconf.c - config file checker for unbound.conf file.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* The config checker checks for syntax and other errors in the unbound.conf
	* file, and can be used to check for errors before the server is started
	* or sigHUPped.
	* Exit status 1 means an error.
	*/

	#include "config.h"
	#include <ctype.h>
	#include "util/log.h"
	#include "util/config_file.h"
	#include "util/module.h"
	#include "util/net_help.h"
	#include "util/regional.h"
	#include "iterator/iterator.h"
	#include "iterator/iter_fwd.h"
	#include "iterator/iter_hints.h"
	#include "validator/validator.h"
	#include "services/localzone.h"
	#include "services/view.h"
	#include "services/authzone.h"
	#include "respip/respip.h"
	#include "sldns/sbuffer.h"
	#ifdef HAVE_GETOPT_H
	#include <getopt.h>
	#endif
	#ifdef HAVE_PWD_H
	#include <pwd.h>
	#endif
	#ifdef HAVE_SYS_STAT_H
	#include <sys/stat.h>
	#endif
	#ifdef HAVE_GLOB_H
	#include <glob.h>
	#endif
	#ifdef WITH_PYTHONMODULE
	#include "pythonmod/pythonmod.h"
	#endif
	#ifdef CLIENT_SUBNET
	#include "edns-subnet/subnet-whitelist.h"
	#endif

	/** Give checkconf usage, and exit (1). */
	static void
	usage(void)
	{
	printf("Usage: local-unbound-checkconf [file]\n");
	printf(" Checks unbound configuration file for errors.\n");
	printf("file if omitted %s is used.\n", CONFIGFILE);
	printf("-o option print value of option to stdout.\n");
	printf("-f output full pathname with chroot applied, eg. with -o pidfile.\n");
	printf("-h show this usage help.\n");
	printf("Version %s\n", PACKAGE_VERSION);
	printf("BSD licensed, see LICENSE in source package for details.\n");
	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
	exit(1);
	}

	/**
	* Print given option to stdout
	* @param cfg: config
	* @param opt: option name without trailing :.
	* This is different from config_set_option.
	* @param final: if final pathname with chroot applied has to be printed.
	*/
	static void
	print_option(struct config_file* cfg, const char* opt, int final)
	{
	if(strcmp(opt, "pidfile") == 0 && final) {
	char *p = fname_after_chroot(cfg->pidfile, cfg, 1);
	if(!p) fatal_exit("out of memory");
	printf("%s\n", p);
	free(p);
	return;
	}
	if(strcmp(opt, "auto-trust-anchor-file") == 0 && final) {
	struct config_strlist* s = cfg->auto_trust_anchor_file_list;
	for(; s; s=s->next) {
	char *p = fname_after_chroot(s->str, cfg, 1);
	if(!p) fatal_exit("out of memory");
	printf("%s\n", p);
	free(p);
	}
	return;
	}
	if(!config_get_option(cfg, opt, config_print_func, stdout))
	fatal_exit("cannot print option '%s'", opt);
	}

	/** check if module works with config */
	static void
	check_mod(struct config_file* cfg, struct module_func_block* fb)
	{
	struct module_env env;
	memset(&env, 0, sizeof(env));
	env.cfg = cfg;
	env.scratch = regional_create();
	env.scratch_buffer = sldns_buffer_new(BUFSIZ);
	if(!env.scratch \|\| !env.scratch_buffer)
	fatal_exit("out of memory");
	if(!edns_known_options_init(&env))
	fatal_exit("out of memory");
	if(!(*fb->init)(&env, 0)) {
	fatal_exit("bad config for %s module", fb->name);
	}
	(*fb->deinit)(&env, 0);
	sldns_buffer_free(env.scratch_buffer);
	regional_destroy(env.scratch);
	edns_known_options_delete(&env);
	}

	/** check localzones */
	static void
	localzonechecks(struct config_file* cfg)
	{
	struct local_zones* zs;
	if(!(zs = local_zones_create()))
	fatal_exit("out of memory");
	if(!local_zones_apply_cfg(zs, cfg))
	fatal_exit("failed local-zone, local-data configuration");
	local_zones_delete(zs);
	}

	/** check view and response-ip configuration */
	static void
	view_and_respipchecks(struct config_file* cfg)
	{
	struct views* views = NULL;
	struct respip_set* respip = NULL;
	int ignored = 0;
	if(!(views = views_create()))
	fatal_exit("Could not create views: out of memory");
	if(!(respip = respip_set_create()))
	fatal_exit("Could not create respip set: out of memory");
	if(!views_apply_cfg(views, cfg))
	fatal_exit("Could not set up views");
	if(!respip_global_apply_cfg(respip, cfg))
	fatal_exit("Could not setup respip set");
	if(!respip_views_apply_cfg(views, cfg, &ignored))
	fatal_exit("Could not setup per-view respip sets");
	views_delete(views);
	respip_set_delete(respip);
	}

	/** emit warnings for IP in hosts */
	static void
	warn_hosts(const char* typ, struct config_stub* list)
	{
	struct sockaddr_storage a;
	socklen_t alen;
	struct config_stub* s;
	struct config_strlist* h;
	for(s=list; s; s=s->next) {
	for(h=s->hosts; h; h=h->next) {
	if(extstrtoaddr(h->str, &a, &alen)) {
	fprintf(stderr, "unbound-checkconf: warning:"
	" %s %s: \"%s\" is an IP%s address, "
	"and when looked up as a host name "
	"during use may not resolve.\n",
	s->name, typ, h->str,
	addr_is_ip6(&a, alen)?"6":"4");
	}
	}
	}
	}

	/** check interface strings */
	static void
	interfacechecks(struct config_file* cfg)
	{
	int d;
	struct sockaddr_storage a;
	socklen_t alen;
	int i, j;
	for(i=0; i<cfg->num_ifs; i++) {
	if(!extstrtoaddr(cfg->ifs[i], &a, &alen)) {
	fatal_exit("cannot parse interface specified as '%s'",
	cfg->ifs[i]);
	}
	for(j=0; j<cfg->num_ifs; j++) {
	if(i!=j && strcmp(cfg->ifs[i], cfg->ifs[j])==0)
	fatal_exit("interface: %s present twice, "
	"cannot bind same ports twice.",
	cfg->ifs[i]);
	}
	}
	for(i=0; i<cfg->num_out_ifs; i++) {
	if(!ipstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, &a, &alen) &&
	!netblockstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, &a, &alen, &d)) {
	fatal_exit("cannot parse outgoing-interface "
	"specified as '%s'", cfg->out_ifs[i]);
	}
	for(j=0; j<cfg->num_out_ifs; j++) {
	if(i!=j && strcmp(cfg->out_ifs[i], cfg->out_ifs[j])==0)
	fatal_exit("outgoing-interface: %s present "
	"twice, cannot bind same ports twice.",
	cfg->out_ifs[i]);
	}
	}
	}

	/** check acl ips */
	static void
	aclchecks(struct config_file* cfg)
	{
	int d;
	struct sockaddr_storage a;
	socklen_t alen;
	struct config_str2list* acl;
	for(acl=cfg->acls; acl; acl = acl->next) {
	if(!netblockstrtoaddr(acl->str, UNBOUND_DNS_PORT, &a, &alen,
	&d)) {
	fatal_exit("cannot parse access control address %s %s",
	acl->str, acl->str2);
	}
	}
	}

	/** check tcp connection limit ips */
	static void
	tcpconnlimitchecks(struct config_file* cfg)
	{
	int d;
	struct sockaddr_storage a;
	socklen_t alen;
	struct config_str2list* tcl;
	for(tcl=cfg->tcp_connection_limits; tcl; tcl = tcl->next) {
	if(!netblockstrtoaddr(tcl->str, UNBOUND_DNS_PORT, &a, &alen,
	&d)) {
	fatal_exit("cannot parse tcp connection limit address %s %s",
	tcl->str, tcl->str2);
	}
	}
	}

	/** true if fname is a file */
	static int
	is_file(const char* fname)
	{
	struct stat buf;
	if(stat(fname, &buf) < 0) {
	if(errno==EACCES) {
	printf("warning: no search permission for one of the directories in path: %s\n", fname);
	return 1;
	}
	perror(fname);
	return 0;
	}
	if(S_ISDIR(buf.st_mode)) {
	printf("%s is not a file\n", fname);
	return 0;
	}
	return 1;
	}

	/** true if fname is a directory */
	static int
	is_dir(const char* fname)
	{
	struct stat buf;
	if(stat(fname, &buf) < 0) {
	if(errno==EACCES) {
	printf("warning: no search permission for one of the directories in path: %s\n", fname);
	return 1;
	}
	perror(fname);
	return 0;
	}
	if(!(S_ISDIR(buf.st_mode))) {
	printf("%s is not a directory\n", fname);
	return 0;
	}
	return 1;
	}

	/** get base dir of a fname */
	static char*
	basedir(char* fname)
	{
	char* rev;
	if(!fname) fatal_exit("out of memory");
	rev = strrchr(fname, '/');
	if(!rev) return NULL;
	if(fname == rev) return NULL;
	rev[0] = 0;
	return fname;
	}

	/** check chroot for a file string */
	static void
	check_chroot_string(const char* desc, char** ss,
	const char* chrootdir, struct config_file* cfg)
	{
	char* str = *ss;
	if(str && str[0]) {
	*ss = fname_after_chroot(str, cfg, 1);
	if(!*ss) fatal_exit("out of memory");
	if(!is_file(*ss)) {
	if(chrootdir && chrootdir[0])
	fatal_exit("%s: \"%s\" does not exist in "
	"chrootdir %s", desc, str, chrootdir);
	else
	fatal_exit("%s: \"%s\" does not exist",
	desc, str);
	}
	/* put in a new full path for continued checking */
	free(str);
	}
	}

	/** check file list, every file must be inside the chroot location */
	static void
	check_chroot_filelist(const char* desc, struct config_strlist* list,
	const char* chrootdir, struct config_file* cfg)
	{
	struct config_strlist* p;
	for(p=list; p; p=p->next) {
	check_chroot_string(desc, &p->str, chrootdir, cfg);
	}
	}

	/** check file list, with wildcard processing */
	static void
	check_chroot_filelist_wild(const char* desc, struct config_strlist* list,
	const char* chrootdir, struct config_file* cfg)
	{
	struct config_strlist* p;
	for(p=list; p; p=p->next) {
	#ifdef HAVE_GLOB
	if(strchr(p->str, '*') \|\| strchr(p->str, '[') \|\|
	strchr(p->str, '?') \|\| strchr(p->str, '{') \|\|
	strchr(p->str, '~')) {
	char* s = p->str;
	/* adjust whole pattern for chroot and check later */
	p->str = fname_after_chroot(p->str, cfg, 1);
	free(s);
	} else
	#endif /* HAVE_GLOB */
	check_chroot_string(desc, &p->str, chrootdir, cfg);
	}
	}

	#ifdef CLIENT_SUBNET
	/** check ECS configuration */
	static void
	ecs_conf_checks(struct config_file* cfg)
	{
	struct ecs_whitelist* whitelist = NULL;
	if(!(whitelist = ecs_whitelist_create()))
	fatal_exit("Could not create ednssubnet whitelist: out of memory");
	if(!ecs_whitelist_apply_cfg(whitelist, cfg))
	fatal_exit("Could not setup ednssubnet whitelist");
	ecs_whitelist_delete(whitelist);
	}
	#endif /* CLIENT_SUBNET */

	/** check that the modules exist, are compiled in */
	static void
	check_modules_exist(const char* module_conf)
	{
	const char** names = module_list_avail();
	const char* s = module_conf;
	while(*s) {
	int i = 0;
	int is_ok = 0;
	while(s && isspace((unsigned char)s))
	s++;
	if(!*s) break;
	while(names[i]) {
	if(strncmp(names[i], s, strlen(names[i])) == 0) {
	is_ok = 1;
	break;
	}
	i++;
	}
	if(is_ok == 0) {
	char n[64];
	size_t j;
	n[0]=0;
	n[sizeof(n)-1]=0;
	for(j=0; j<sizeof(n)-1; j++) {
	if(!s[j] \|\| isspace((unsigned char)s[j])) {
	n[j] = 0;
	break;
	}
	n[j] = s[j];
	}
	fatal_exit("module_conf lists module '%s' but that "
	"module is not available.", n);
	}
	s += strlen(names[i]);
	}
	}

	/** check configuration for errors */
	static void
	-morechecks(struct config_file* cfg, const char* fname)
	+morechecks(struct config_file* cfg)
	{
	warn_hosts("stub-host", cfg->stubs);
	warn_hosts("forward-host", cfg->forwards);
	interfacechecks(cfg);
	aclchecks(cfg);
	tcpconnlimitchecks(cfg);

	if(cfg->verbosity < 0)
	fatal_exit("verbosity value < 0");
	if(cfg->num_threads <= 0 \|\| cfg->num_threads > 10000)
	fatal_exit("num_threads value weird");
	if(!cfg->do_ip4 && !cfg->do_ip6)
	fatal_exit("ip4 and ip6 are both disabled, pointless");
	if(!cfg->do_ip6 && cfg->prefer_ip6)
	fatal_exit("cannot prefer and disable ip6, pointless");
	if(!cfg->do_udp && !cfg->do_tcp)
	fatal_exit("udp and tcp are both disabled, pointless");
	if(cfg->edns_buffer_size > cfg->msg_buffer_size)
	fatal_exit("edns-buffer-size larger than msg-buffer-size, "
	"answers will not fit in processing buffer");
	#ifdef UB_ON_WINDOWS
	w_config_adjust_directory(cfg);
	#endif
	if(cfg->chrootdir && cfg->chrootdir[0] &&
	cfg->chrootdir[strlen(cfg->chrootdir)-1] == '/')
	fatal_exit("chootdir %s has trailing slash '/' please remove.",
	cfg->chrootdir);
	if(cfg->chrootdir && cfg->chrootdir[0] &&
	!is_dir(cfg->chrootdir)) {
	fatal_exit("bad chroot directory");
	}
	- if(cfg->chrootdir && cfg->chrootdir[0]) {
	- char buf[10240];
	- buf[0] = 0;
	- if(fname[0] != '/') {
	- if(getcwd(buf, sizeof(buf)) == NULL)
	- fatal_exit("getcwd: %s", strerror(errno));
	- (void)strlcat(buf, "/", sizeof(buf));
	- }
	- (void)strlcat(buf, fname, sizeof(buf));
	- if(strncmp(buf, cfg->chrootdir, strlen(cfg->chrootdir)) != 0)
	- fatal_exit("config file %s is not inside chroot %s",
	- buf, cfg->chrootdir);
	- }
	if(cfg->directory && cfg->directory[0]) {
	char* ad = fname_after_chroot(cfg->directory, cfg, 0);
	if(!ad) fatal_exit("out of memory");
	if(!is_dir(ad)) fatal_exit("bad chdir directory");
	free(ad);
	}
	if( (cfg->chrootdir && cfg->chrootdir[0]) \|\|
	(cfg->directory && cfg->directory[0])) {
	if(cfg->pidfile && cfg->pidfile[0]) {
	char* ad = (cfg->pidfile[0]=='/')?strdup(cfg->pidfile):
	fname_after_chroot(cfg->pidfile, cfg, 1);
	char* bd = basedir(ad);
	if(bd && !is_dir(bd))
	fatal_exit("pidfile directory does not exist");
	free(ad);
	}
	if(cfg->logfile && cfg->logfile[0]) {
	char* ad = fname_after_chroot(cfg->logfile, cfg, 1);
	char* bd = basedir(ad);
	if(bd && !is_dir(bd))
	fatal_exit("logfile directory does not exist");
	free(ad);
	}
	}

	check_chroot_filelist("file with root-hints",
	cfg->root_hints, cfg->chrootdir, cfg);
	check_chroot_filelist("trust-anchor-file",
	cfg->trust_anchor_file_list, cfg->chrootdir, cfg);
	check_chroot_filelist("auto-trust-anchor-file",
	cfg->auto_trust_anchor_file_list, cfg->chrootdir, cfg);
	check_chroot_filelist_wild("trusted-keys-file",
	cfg->trusted_keys_file_list, cfg->chrootdir, cfg);
	check_chroot_string("dlv-anchor-file", &cfg->dlv_anchor_file,
	cfg->chrootdir, cfg);
	#ifdef USE_IPSECMOD
	if(cfg->ipsecmod_enabled && strstr(cfg->module_conf, "ipsecmod")) {
	/* only check hook if enabled */
	check_chroot_string("ipsecmod-hook", &cfg->ipsecmod_hook,
	cfg->chrootdir, cfg);
	}
	#endif
	/* remove chroot setting so that modules are not stripping pathnames*/
	free(cfg->chrootdir);
	cfg->chrootdir = NULL;

	/* check that the modules listed in module_conf exist */
	check_modules_exist(cfg->module_conf);

	/* There should be no reason for 'respip' module not to work with
	* dns64, but it's not explicitly confirmed, so the combination is
	* excluded below. It's simply unknown yet for the combination of
	* respip and other modules. */
	if(strcmp(cfg->module_conf, "iterator") != 0
	&& strcmp(cfg->module_conf, "validator iterator") != 0
	&& strcmp(cfg->module_conf, "dns64 validator iterator") != 0
	&& strcmp(cfg->module_conf, "dns64 iterator") != 0
	&& strcmp(cfg->module_conf, "respip iterator") != 0
	&& strcmp(cfg->module_conf, "respip validator iterator") != 0
	#ifdef WITH_PYTHONMODULE
	&& strcmp(cfg->module_conf, "python iterator") != 0
	&& strcmp(cfg->module_conf, "python validator iterator") != 0
	&& strcmp(cfg->module_conf, "validator python iterator") != 0
	&& strcmp(cfg->module_conf, "dns64 python iterator") != 0
	&& strcmp(cfg->module_conf, "dns64 python validator iterator") != 0
	&& strcmp(cfg->module_conf, "dns64 validator python iterator") != 0
	&& strcmp(cfg->module_conf, "python dns64 iterator") != 0
	&& strcmp(cfg->module_conf, "python dns64 validator iterator") != 0
	#endif
	#ifdef USE_CACHEDB
	&& strcmp(cfg->module_conf, "validator cachedb iterator") != 0
	&& strcmp(cfg->module_conf, "cachedb iterator") != 0
	&& strcmp(cfg->module_conf, "dns64 validator cachedb iterator") != 0
	&& strcmp(cfg->module_conf, "dns64 cachedb iterator") != 0
	#endif
	#if defined(WITH_PYTHONMODULE) && defined(USE_CACHEDB)
	&& strcmp(cfg->module_conf, "python dns64 cachedb iterator") != 0
	&& strcmp(cfg->module_conf, "python dns64 validator cachedb iterator") != 0
	&& strcmp(cfg->module_conf, "dns64 python cachedb iterator") != 0
	&& strcmp(cfg->module_conf, "dns64 python validator cachedb iterator") != 0
	&& strcmp(cfg->module_conf, "python cachedb iterator") != 0
	&& strcmp(cfg->module_conf, "python validator cachedb iterator") != 0
	&& strcmp(cfg->module_conf, "cachedb python iterator") != 0
	&& strcmp(cfg->module_conf, "validator cachedb python iterator") != 0
	&& strcmp(cfg->module_conf, "validator python cachedb iterator") != 0
	#endif
	#ifdef CLIENT_SUBNET
	&& strcmp(cfg->module_conf, "subnetcache iterator") != 0
	&& strcmp(cfg->module_conf, "subnetcache validator iterator") != 0
	&& strcmp(cfg->module_conf, "dns64 subnetcache iterator") != 0
	&& strcmp(cfg->module_conf, "dns64 subnetcache validator iterator") != 0
	#endif
	#if defined(WITH_PYTHONMODULE) && defined(CLIENT_SUBNET)
	&& strcmp(cfg->module_conf, "python subnetcache iterator") != 0
	&& strcmp(cfg->module_conf, "subnetcache python iterator") != 0
	&& strcmp(cfg->module_conf, "python subnetcache validator iterator") != 0
	&& strcmp(cfg->module_conf, "subnetcache python validator iterator") != 0
	&& strcmp(cfg->module_conf, "subnetcache validator python iterator") != 0
	#endif
	#ifdef USE_IPSECMOD
	&& strcmp(cfg->module_conf, "ipsecmod iterator") != 0
	&& strcmp(cfg->module_conf, "ipsecmod validator iterator") != 0
	#endif
	#if defined(WITH_PYTHONMODULE) && defined(USE_IPSECMOD)
	&& strcmp(cfg->module_conf, "python ipsecmod iterator") != 0
	&& strcmp(cfg->module_conf, "ipsecmod python iterator") != 0
	&& strcmp(cfg->module_conf, "ipsecmod validator iterator") != 0
	&& strcmp(cfg->module_conf, "python ipsecmod validator iterator") != 0
	&& strcmp(cfg->module_conf, "ipsecmod python validator iterator") != 0
	&& strcmp(cfg->module_conf, "ipsecmod validator python iterator") != 0
	#endif
	) {
	fatal_exit("module conf '%s' is not known to work",
	cfg->module_conf);
	}

	#ifdef HAVE_GETPWNAM
	if(cfg->username && cfg->username[0]) {
	if(getpwnam(cfg->username) == NULL)
	fatal_exit("user '%s' does not exist.", cfg->username);
	# ifdef HAVE_ENDPWENT
	endpwent();
	# endif
	}
	#endif
	if(cfg->remote_control_enable && options_remote_is_address(cfg)
	&& cfg->control_use_cert) {
	check_chroot_string("server-key-file", &cfg->server_key_file,
	cfg->chrootdir, cfg);
	check_chroot_string("server-cert-file", &cfg->server_cert_file,
	cfg->chrootdir, cfg);
	if(!is_file(cfg->control_key_file))
	fatal_exit("control-key-file: \"%s\" does not exist",
	cfg->control_key_file);
	if(!is_file(cfg->control_cert_file))
	fatal_exit("control-cert-file: \"%s\" does not exist",
	cfg->control_cert_file);
	}

	localzonechecks(cfg);
	view_and_respipchecks(cfg);
	#ifdef CLIENT_SUBNET
	ecs_conf_checks(cfg);
	#endif
	}

	/** check forwards */
	static void
	check_fwd(struct config_file* cfg)
	{
	struct iter_forwards* fwd = forwards_create();
	if(!fwd \|\| !forwards_apply_cfg(fwd, cfg)) {
	fatal_exit("Could not set forward zones");
	}
	forwards_delete(fwd);
	}

	/** check hints */
	static void
	check_hints(struct config_file* cfg)
	{
	struct iter_hints* hints = hints_create();
	if(!hints \|\| !hints_apply_cfg(hints, cfg)) {
	fatal_exit("Could not set root or stub hints");
	}
	hints_delete(hints);
	}

	/** check auth zones */
	static void
	check_auth(struct config_file* cfg)
	{
	struct auth_zones* az = auth_zones_create();
	if(!az \|\| !auth_zones_apply_cfg(az, cfg, 0)) {
	fatal_exit("Could not setup authority zones");
	}
	auth_zones_delete(az);
	}

	/** check config file */
	static void
	checkconf(const char* cfgfile, const char* opt, int final)
	{
	char oldwd[4096];
	struct config_file* cfg = config_create();
	if(!cfg)
	fatal_exit("out of memory");
	oldwd[0] = 0;
	if(!getcwd(oldwd, sizeof(oldwd))) {
	log_err("cannot getcwd: %s", strerror(errno));
	oldwd[0] = 0;
	}
	if(!config_read(cfg, cfgfile, NULL)) {
	/* config_read prints messages to stderr */
	config_delete(cfg);
	exit(1);
	}
	if(oldwd[0] && chdir(oldwd) == -1)
	log_err("cannot chdir(%s): %s", oldwd, strerror(errno));
	if(opt) {
	print_option(cfg, opt, final);
	config_delete(cfg);
	return;
	}
	- morechecks(cfg, cfgfile);
	+ morechecks(cfg);
	check_mod(cfg, iter_get_funcblock());
	check_mod(cfg, val_get_funcblock());
	#ifdef WITH_PYTHONMODULE
	if(strstr(cfg->module_conf, "python"))
	check_mod(cfg, pythonmod_get_funcblock());
	#endif
	check_fwd(cfg);
	check_hints(cfg);
	check_auth(cfg);
	printf("unbound-checkconf: no errors in %s\n", cfgfile);
	config_delete(cfg);
	}

	/** getopt global, in case header files fail to declare it. */
	extern int optind;
	/** getopt global, in case header files fail to declare it. */
	extern char* optarg;

	/** Main routine for checkconf */
	int main(int argc, char* argv[])
	{
	int c;
	int final = 0;
	const char* f;
	const char* opt = NULL;
	const char* cfgfile = CONFIGFILE;
	log_ident_set("unbound-checkconf");
	log_init(NULL, 0, NULL);
	checklock_start();
	#ifdef USE_WINSOCK
	/* use registry config file in preference to compiletime location */
	if(!(cfgfile=w_lookup_reg_str("Software\\Unbound", "ConfigFile")))
	cfgfile = CONFIGFILE;
	#endif /* USE_WINSOCK */
	/* parse the options */
	while( (c=getopt(argc, argv, "fho:")) != -1) {
	switch(c) {
	case 'f':
	final = 1;
	break;
	case 'o':
	opt = optarg;
	break;
	case '?':
	case 'h':
	default:
	usage();
	}
	}
	argc -= optind;
	argv += optind;
	if(argc != 0 && argc != 1)
	usage();
	if(argc == 1)
	f = argv[0];
	else f = cfgfile;
	checkconf(f, opt, final);
	checklock_stop();
	return 0;
	}
	Index: head/contrib/unbound/smallapp/unbound-control-setup.sh
	===================================================================
	--- head/contrib/unbound/smallapp/unbound-control-setup.sh (revision 349719)
	+++ head/contrib/unbound/smallapp/unbound-control-setup.sh (revision 349720)
	@@ -1,160 +1,160 @@
	#!/bin/sh
	#
	# unbound-control-setup.sh - set up SSL certificates for unbound-control
	#
	# Copyright (c) 2008, NLnet Labs. All rights reserved.
	#
	# This software is open source.
	#
	# Redistribution and use in source and binary forms, with or without
	# modification, are permitted provided that the following conditions
	# are met:
	#
	# Redistributions of source code must retain the above copyright notice,
	# this list of conditions and the following disclaimer.
	#
	# Redistributions in binary form must reproduce the above copyright notice,
	# this list of conditions and the following disclaimer in the documentation
	# and/or other materials provided with the distribution.
	#
	# Neither the name of the NLNET LABS nor the names of its contributors may
	# be used to endorse or promote products derived from this software without
	# specific prior written permission.
	#
	# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	# HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

	# settings:

	# directory for files
	DESTDIR=/var/unbound

	# issuer and subject name for certificates
	SERVERNAME=unbound
	CLIENTNAME=unbound-control

	# validity period for certificates
	DAYS=7200

	# size of keys in bits
	BITS=3072

	# hash algorithm
	HASH=sha256

	# base name for unbound server keys
	SVR_BASE=unbound_server

	# base name for unbound-control keys
	CTL_BASE=unbound_control

	# we want -rw-r----- access (say you run this as root: grp=yes (server), all=no).
	umask 0027

	# end of options

	# functions:
	error ( ) {
	echo "$0 fatal error: $1"
	exit 1
	}

	# check arguments:
	while test $# -ne 0; do
	case $1 in
	-d)
	if test $# -eq 1; then error "need argument for -d"; fi
	DESTDIR="$2"
	shift
	;;
	*)
	echo "unbound-control-setup.sh - setup SSL keys for unbound-control"
	echo " -d dir use directory to store keys and certificates."
	echo " default: $DESTDIR"
	echo "please run this command using the same user id that the "
	echo "unbound daemon uses, it needs read privileges."
	exit 1
	;;
	esac
	shift
	done

	# go!:
	echo "setup in directory $DESTDIR"
	cd "$DESTDIR" \|\| error "could not cd to $DESTDIR"

	# create certificate keys; do not recreate if they already exist.
	if test -f $SVR_BASE.key; then
	echo "$SVR_BASE.key exists"
	else
	echo "generating $SVR_BASE.key"
	openssl genrsa -out $SVR_BASE.key $BITS \|\| error "could not genrsa"
	fi
	if test -f $CTL_BASE.key; then
	echo "$CTL_BASE.key exists"
	else
	echo "generating $CTL_BASE.key"
	openssl genrsa -out $CTL_BASE.key $BITS \|\| error "could not genrsa"
	fi

	# create self-signed cert for server
	echo "[req]" > request.cfg
	echo "default_bits=$BITS" >> request.cfg
	echo "default_md=$HASH" >> request.cfg
	echo "prompt=no" >> request.cfg
	echo "distinguished_name=req_distinguished_name" >> request.cfg
	echo "" >> request.cfg
	echo "[req_distinguished_name]" >> request.cfg
	echo "commonName=$SERVERNAME" >> request.cfg

	test -f request.cfg \|\| error "could not create request.cfg"

	echo "create $SVR_BASE.pem (self signed certificate)"
	openssl req -key $SVR_BASE.key -config request.cfg -new -x509 -days $DAYS -out $SVR_BASE.pem \|\| error "could not create $SVR_BASE.pem"
	# create trusted usage pem
	openssl x509 -in $SVR_BASE.pem -addtrust serverAuth -out $SVR_BASE"_trust.pem"

	# create client request and sign it, piped
	echo "[req]" > request.cfg
	echo "default_bits=$BITS" >> request.cfg
	echo "default_md=$HASH" >> request.cfg
	echo "prompt=no" >> request.cfg
	echo "distinguished_name=req_distinguished_name" >> request.cfg
	echo "" >> request.cfg
	echo "[req_distinguished_name]" >> request.cfg
	echo "commonName=$CLIENTNAME" >> request.cfg

	test -f request.cfg \|\| error "could not create request.cfg"

	echo "create $CTL_BASE.pem (signed client certificate)"
	openssl req -key $CTL_BASE.key -config request.cfg -new \| openssl x509 -req -days $DAYS -CA $SVR_BASE"_trust.pem" -CAkey $SVR_BASE.key -CAcreateserial -$HASH -out $CTL_BASE.pem
	test -f $CTL_BASE.pem \|\| error "could not create $CTL_BASE.pem"
	# create trusted usage pem
	# openssl x509 -in $CTL_BASE.pem -addtrust clientAuth -out $CTL_BASE"_trust.pem"

	# see details with openssl x509 -noout -text < $SVR_BASE.pem
	# echo "create $CTL_BASE""_browser.pfx (web client certificate)"
	# echo "create webbrowser PKCS#12 .PFX certificate file. In Firefox import in:"
	# echo "preferences - advanced - encryption - view certificates - your certs"
	# echo "empty password is used, simply click OK on the password dialog box."
	# openssl pkcs12 -export -in $CTL_BASE"_trust.pem" -inkey $CTL_BASE.key -name "unbound remote control client cert" -out $CTL_BASE"_browser.pfx" -password "pass:" \|\| error "could not create browser certificate"

	-# remove unused permissions
	-chmod o-rw $SVR_BASE.pem $SVR_BASE.key $CTL_BASE.pem $CTL_BASE.key
	+# set desired permissions
	+chmod 0640 $SVR_BASE.pem $SVR_BASE.key $CTL_BASE.pem $CTL_BASE.key

	# remove crap
	rm -f request.cfg
	rm -f $CTL_BASE"_trust.pem" $SVR_BASE"_trust.pem" $SVR_BASE"_trust.srl"

	echo "Setup success. Certificates created. Enable in unbound.conf file to use"

	exit 0
	Index: head/contrib/unbound/smallapp/unbound-control-setup.sh.in
	===================================================================
	--- head/contrib/unbound/smallapp/unbound-control-setup.sh.in (revision 349719)
	+++ head/contrib/unbound/smallapp/unbound-control-setup.sh.in (revision 349720)
	@@ -1,160 +1,160 @@
	#!/bin/sh
	#
	# unbound-control-setup.sh - set up SSL certificates for unbound-control
	#
	# Copyright (c) 2008, NLnet Labs. All rights reserved.
	#
	# This software is open source.
	#
	# Redistribution and use in source and binary forms, with or without
	# modification, are permitted provided that the following conditions
	# are met:
	#
	# Redistributions of source code must retain the above copyright notice,
	# this list of conditions and the following disclaimer.
	#
	# Redistributions in binary form must reproduce the above copyright notice,
	# this list of conditions and the following disclaimer in the documentation
	# and/or other materials provided with the distribution.
	#
	# Neither the name of the NLNET LABS nor the names of its contributors may
	# be used to endorse or promote products derived from this software without
	# specific prior written permission.
	#
	# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	# HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

	# settings:

	# directory for files
	DESTDIR=@ub_conf_dir@

	# issuer and subject name for certificates
	SERVERNAME=unbound
	CLIENTNAME=unbound-control

	# validity period for certificates
	DAYS=7200

	# size of keys in bits
	BITS=3072

	# hash algorithm
	HASH=sha256

	# base name for unbound server keys
	SVR_BASE=unbound_server

	# base name for unbound-control keys
	CTL_BASE=unbound_control

	# we want -rw-r----- access (say you run this as root: grp=yes (server), all=no).
	umask 0027

	# end of options

	# functions:
	error ( ) {
	echo "$0 fatal error: $1"
	exit 1
	}

	# check arguments:
	while test $# -ne 0; do
	case $1 in
	-d)
	if test $# -eq 1; then error "need argument for -d"; fi
	DESTDIR="$2"
	shift
	;;
	*)
	echo "unbound-control-setup.sh - setup SSL keys for unbound-control"
	echo " -d dir use directory to store keys and certificates."
	echo " default: $DESTDIR"
	echo "please run this command using the same user id that the "
	echo "unbound daemon uses, it needs read privileges."
	exit 1
	;;
	esac
	shift
	done

	# go!:
	echo "setup in directory $DESTDIR"
	cd "$DESTDIR" \|\| error "could not cd to $DESTDIR"

	# create certificate keys; do not recreate if they already exist.
	if test -f $SVR_BASE.key; then
	echo "$SVR_BASE.key exists"
	else
	echo "generating $SVR_BASE.key"
	openssl genrsa -out $SVR_BASE.key $BITS \|\| error "could not genrsa"
	fi
	if test -f $CTL_BASE.key; then
	echo "$CTL_BASE.key exists"
	else
	echo "generating $CTL_BASE.key"
	openssl genrsa -out $CTL_BASE.key $BITS \|\| error "could not genrsa"
	fi

	# create self-signed cert for server
	echo "[req]" > request.cfg
	echo "default_bits=$BITS" >> request.cfg
	echo "default_md=$HASH" >> request.cfg
	echo "prompt=no" >> request.cfg
	echo "distinguished_name=req_distinguished_name" >> request.cfg
	echo "" >> request.cfg
	echo "[req_distinguished_name]" >> request.cfg
	echo "commonName=$SERVERNAME" >> request.cfg

	test -f request.cfg \|\| error "could not create request.cfg"

	echo "create $SVR_BASE.pem (self signed certificate)"
	openssl req -key $SVR_BASE.key -config request.cfg -new -x509 -days $DAYS -out $SVR_BASE.pem \|\| error "could not create $SVR_BASE.pem"
	# create trusted usage pem
	openssl x509 -in $SVR_BASE.pem -addtrust serverAuth -out $SVR_BASE"_trust.pem"

	# create client request and sign it, piped
	echo "[req]" > request.cfg
	echo "default_bits=$BITS" >> request.cfg
	echo "default_md=$HASH" >> request.cfg
	echo "prompt=no" >> request.cfg
	echo "distinguished_name=req_distinguished_name" >> request.cfg
	echo "" >> request.cfg
	echo "[req_distinguished_name]" >> request.cfg
	echo "commonName=$CLIENTNAME" >> request.cfg

	test -f request.cfg \|\| error "could not create request.cfg"

	echo "create $CTL_BASE.pem (signed client certificate)"
	openssl req -key $CTL_BASE.key -config request.cfg -new \| openssl x509 -req -days $DAYS -CA $SVR_BASE"_trust.pem" -CAkey $SVR_BASE.key -CAcreateserial -$HASH -out $CTL_BASE.pem
	test -f $CTL_BASE.pem \|\| error "could not create $CTL_BASE.pem"
	# create trusted usage pem
	# openssl x509 -in $CTL_BASE.pem -addtrust clientAuth -out $CTL_BASE"_trust.pem"

	# see details with openssl x509 -noout -text < $SVR_BASE.pem
	# echo "create $CTL_BASE""_browser.pfx (web client certificate)"
	# echo "create webbrowser PKCS#12 .PFX certificate file. In Firefox import in:"
	# echo "preferences - advanced - encryption - view certificates - your certs"
	# echo "empty password is used, simply click OK on the password dialog box."
	# openssl pkcs12 -export -in $CTL_BASE"_trust.pem" -inkey $CTL_BASE.key -name "unbound remote control client cert" -out $CTL_BASE"_browser.pfx" -password "pass:" \|\| error "could not create browser certificate"

	-# remove unused permissions
	-chmod o-rw $SVR_BASE.pem $SVR_BASE.key $CTL_BASE.pem $CTL_BASE.key
	+# set desired permissions
	+chmod 0640 $SVR_BASE.pem $SVR_BASE.key $CTL_BASE.pem $CTL_BASE.key

	# remove crap
	rm -f request.cfg
	rm -f $CTL_BASE"_trust.pem" $SVR_BASE"_trust.pem" $SVR_BASE"_trust.srl"

	echo "Setup success. Certificates created. Enable in unbound.conf file to use"

	exit 0
	Index: head/contrib/unbound/smallapp/unbound-control.c
	===================================================================
	--- head/contrib/unbound/smallapp/unbound-control.c (revision 349719)
	+++ head/contrib/unbound/smallapp/unbound-control.c (revision 349720)
	@@ -1,890 +1,896 @@
	/*
	* checkconf/unbound-control.c - remote control utility for unbound.
	*
	* Copyright (c) 2008, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* The remote control utility contacts the unbound server over ssl and
	* sends the command, receives the answer, and displays the result
	* from the commandline.
	*/

	#include "config.h"
	#ifdef HAVE_GETOPT_H
	#include <getopt.h>
	#endif
	#ifdef HAVE_OPENSSL_SSL_H
	#include <openssl/ssl.h>
	#endif
	#ifdef HAVE_OPENSSL_ERR_H
	#include <openssl/err.h>
	#endif
	#ifdef HAVE_OPENSSL_RAND_H
	#include <openssl/rand.h>
	#endif
	#include "util/log.h"
	#include "util/config_file.h"
	#include "util/locks.h"
	#include "util/net_help.h"
	#include "util/shm_side/shm_main.h"
	#include "daemon/stats.h"
	#include "sldns/wire2str.h"
	#include "sldns/pkthdr.h"

	#ifdef HAVE_SYS_IPC_H
	#include "sys/ipc.h"
	#endif
	#ifdef HAVE_SYS_SHM_H
	#include "sys/shm.h"
	#endif
	#ifdef HAVE_SYS_UN_H
	#include <sys/un.h>
	#endif

	static void usage(void) ATTR_NORETURN;
	static void ssl_err(const char* s) ATTR_NORETURN;
	static void ssl_path_err(const char* s, const char *path) ATTR_NORETURN;

	/** Give unbound-control usage, and exit (1). */
	static void
	usage(void)
	{
	printf("Usage: local-unbound-control [options] command\n");
	printf(" Remote control utility for unbound server.\n");
	printf("Options:\n");
	printf(" -c file config file, default is %s\n", CONFIGFILE);
	printf(" -s ip[@port] server address, if omitted config is used.\n");
	printf(" -q quiet (don't print anything if it works ok).\n");
	printf(" -h show this usage help.\n");
	printf("Commands:\n");
	printf(" start start server; runs unbound(8)\n");
	printf(" stop stops the server\n");
	printf(" reload reloads the server\n");
	printf(" (this flushes data, stats, requestlist)\n");
	printf(" stats print statistics\n");
	printf(" stats_noreset peek at statistics\n");
	#ifdef HAVE_SHMGET
	printf(" stats_shm print statistics using shm\n");
	#endif
	printf(" status display status of server\n");
	printf(" verbosity <number> change logging detail\n");
	printf(" log_reopen close and open the logfile\n");
	printf(" local_zone <name> <type> add new local zone\n");
	printf(" local_zone_remove <name> remove local zone and its contents\n");
	printf(" local_data <RR data...> add local data, for example\n");
	printf(" local_data www.example.com A 192.0.2.1\n");
	printf(" local_data_remove <name> remove local RR data from name\n");
	printf(" local_zones, local_zones_remove, local_datas, local_datas_remove\n");
	printf(" same, but read list from stdin\n");
	printf(" (one entry per line).\n");
	printf(" dump_cache print cache to stdout\n");
	printf(" load_cache load cache from stdin\n");
	printf(" lookup <name> print nameservers for name\n");
	printf(" flush <name> flushes common types for name from cache\n");
	printf(" types: A, AAAA, MX, PTR, NS,\n");
	printf(" SOA, CNAME, DNAME, SRV, NAPTR\n");
	printf(" flush_type <name> <type> flush name, type from cache\n");
	printf(" flush_zone <name> flush everything at or under name\n");
	printf(" from rr and dnssec caches\n");
	printf(" flush_bogus flush all bogus data\n");
	printf(" flush_negative flush all negative data\n");
	printf(" flush_stats flush statistics, make zero\n");
	printf(" flush_requestlist drop queries that are worked on\n");
	printf(" dump_requestlist show what is worked on by first thread\n");
	printf(" flush_infra [all \| ip] remove ping, edns for one IP or all\n");
	printf(" dump_infra show ping and edns entries\n");
	printf(" set_option opt: val set option to value, no reload\n");
	printf(" get_option opt get option value\n");
	printf(" list_stubs list stub-zones and root hints in use\n");
	printf(" list_forwards list forward-zones in use\n");
	printf(" list_insecure list domain-insecure zones\n");
	printf(" list_local_zones list local-zones in use\n");
	printf(" list_local_data list local-data RRs in use\n");
	printf(" insecure_add zone add domain-insecure zone\n");
	printf(" insecure_remove zone remove domain-insecure zone\n");
	printf(" forward_add [+i] zone addr.. add forward-zone with servers\n");
	printf(" forward_remove [+i] zone remove forward zone\n");
	printf(" stub_add [+ip] zone addr.. add stub-zone with servers\n");
	printf(" stub_remove [+i] zone remove stub zone\n");
	printf(" +i also do dnssec insecure point\n");
	printf(" +p set stub to use priming\n");
	printf(" forward [off \| addr ...] without arg show forward setup\n");
	printf(" or off to turn off root forwarding\n");
	printf(" or give list of ip addresses\n");
	printf(" ratelimit_list [+a] list ratelimited domains\n");
	printf(" ip_ratelimit_list [+a] list ratelimited ip addresses\n");
	printf(" +a list all, also not ratelimited\n");
	printf(" list_auth_zones list auth zones\n");
	printf(" auth_zone_reload zone reload auth zone from zonefile\n");
	printf(" auth_zone_transfer zone transfer auth zone from master\n");
	printf(" view_list_local_zones view list local-zones in view\n");
	printf(" view_list_local_data view list local-data RRs in view\n");
	printf(" view_local_zone view name type add local-zone in view\n");
	printf(" view_local_zone_remove view name remove local-zone in view\n");
	printf(" view_local_data view RR... add local-data in view\n");
	+ printf(" view_local_datas view add list of local-data to view\n");
	+ printf(" one entry per line read from stdin\n");
	printf(" view_local_data_remove view name remove local-data in view\n");
	printf("Version %s\n", PACKAGE_VERSION);
	printf("BSD licensed, see LICENSE in source package for details.\n");
	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
	exit(1);
	}

	#ifdef HAVE_SHMGET
	/** what to put on statistics lines between var and value, ": " or "=" */
	#define SQ "="
	/** if true, inhibits a lot of =0 lines from the stats output */
	static const int inhibit_zero = 1;
	/** divide sum of timers to get average */
	static void
	timeval_divide(struct timeval* avg, const struct timeval* sum, long long d)
	{
	#ifndef S_SPLINT_S
	size_t leftover;
	if(d == 0) {
	avg->tv_sec = 0;
	avg->tv_usec = 0;
	return;
	}
	avg->tv_sec = sum->tv_sec / d;
	avg->tv_usec = sum->tv_usec / d;
	/* handle fraction from seconds divide */
	leftover = sum->tv_sec - avg->tv_sec*d;
	avg->tv_usec += (leftover*1000000)/d;
	#endif
	}

	/** print unsigned long stats value */
	#define PR_UL_NM(str, var) printf("%s."str SQ"%lu\n", nm, (unsigned long)(var));
	#define PR_UL(str, var) printf(str SQ"%lu\n", (unsigned long)(var));
	#define PR_UL_SUB(str, nm, var) printf(str".%s"SQ"%lu\n", nm, (unsigned long)(var));
	#define PR_TIMEVAL(str, var) printf(str SQ ARG_LL "d.%6.6d\n", \
	(long long)var.tv_sec, (int)var.tv_usec);
	#define PR_STATSTIME(str, var) printf(str SQ ARG_LL "d.%6.6d\n", \
	(long long)var ## _sec, (int)var ## _usec);
	#define PR_LL(str, var) printf(str SQ ARG_LL"d\n", (long long)(var));

	/** print stat block */
	static void pr_stats(const char* nm, struct ub_stats_info* s)
	{
	struct timeval sumwait, avg;
	PR_UL_NM("num.queries", s->svr.num_queries);
	PR_UL_NM("num.queries_ip_ratelimited",
	s->svr.num_queries_ip_ratelimited);
	PR_UL_NM("num.cachehits",
	s->svr.num_queries - s->svr.num_queries_missed_cache);
	PR_UL_NM("num.cachemiss", s->svr.num_queries_missed_cache);
	PR_UL_NM("num.prefetch", s->svr.num_queries_prefetch);
	PR_UL_NM("num.zero_ttl", s->svr.zero_ttl_responses);
	PR_UL_NM("num.recursivereplies", s->mesh_replies_sent);
	#ifdef USE_DNSCRYPT
	PR_UL_NM("num.dnscrypt.crypted", s->svr.num_query_dnscrypt_crypted);
	PR_UL_NM("num.dnscrypt.cert", s->svr.num_query_dnscrypt_cert);
	PR_UL_NM("num.dnscrypt.cleartext", s->svr.num_query_dnscrypt_cleartext);
	PR_UL_NM("num.dnscrypt.malformed",
	s->svr.num_query_dnscrypt_crypted_malformed);
	#endif /* USE_DNSCRYPT */
	printf("%s.requestlist.avg"SQ"%g\n", nm,
	(s->svr.num_queries_missed_cache+s->svr.num_queries_prefetch)?
	(double)s->svr.sum_query_list_size/
	(double)(s->svr.num_queries_missed_cache+
	s->svr.num_queries_prefetch) : 0.0);
	PR_UL_NM("requestlist.max", s->svr.max_query_list_size);
	PR_UL_NM("requestlist.overwritten", s->mesh_jostled);
	PR_UL_NM("requestlist.exceeded", s->mesh_dropped);
	PR_UL_NM("requestlist.current.all", s->mesh_num_states);
	PR_UL_NM("requestlist.current.user", s->mesh_num_reply_states);
	#ifndef S_SPLINT_S
	sumwait.tv_sec = s->mesh_replies_sum_wait_sec;
	sumwait.tv_usec = s->mesh_replies_sum_wait_usec;
	#endif
	timeval_divide(&avg, &sumwait, s->mesh_replies_sent);
	printf("%s.", nm);
	PR_TIMEVAL("recursion.time.avg", avg);
	printf("%s.recursion.time.median"SQ"%g\n", nm, s->mesh_time_median);
	PR_UL_NM("tcpusage", s->svr.tcp_accept_usage);
	}

	/** print uptime */
	static void print_uptime(struct ub_shm_stat_info* shm_stat)
	{
	PR_STATSTIME("time.now", shm_stat->time.now);
	PR_STATSTIME("time.up", shm_stat->time.up);
	PR_STATSTIME("time.elapsed", shm_stat->time.elapsed);
	}

	/** print memory usage */
	-static void print_mem(struct ub_shm_stat_info* shm_stat)
	+static void print_mem(struct ub_shm_stat_info* shm_stat,
	+ struct ub_stats_info* s)
	{
	PR_LL("mem.cache.rrset", shm_stat->mem.rrset);
	PR_LL("mem.cache.message", shm_stat->mem.msg);
	PR_LL("mem.mod.iterator", shm_stat->mem.iter);
	PR_LL("mem.mod.validator", shm_stat->mem.val);
	PR_LL("mem.mod.respip", shm_stat->mem.respip);
	#ifdef CLIENT_SUBNET
	PR_LL("mem.mod.subnet", shm_stat->mem.subnet);
	#endif
	#ifdef USE_IPSECMOD
	PR_LL("mem.mod.ipsecmod", shm_stat->mem.ipsecmod);
	#endif
	#ifdef USE_DNSCRYPT
	PR_LL("mem.cache.dnscrypt_shared_secret",
	shm_stat->mem.dnscrypt_shared_secret);
	PR_LL("mem.cache.dnscrypt_nonce",
	shm_stat->mem.dnscrypt_nonce);
	#endif
	+ PR_LL("mem.streamwait", s->svr.mem_stream_wait);
	}

	/** print histogram */
	static void print_hist(struct ub_stats_info* s)
	{
	struct timehist* hist;
	size_t i;
	hist = timehist_setup();
	if(!hist)
	fatal_exit("out of memory");
	timehist_import(hist, s->svr.hist, NUM_BUCKETS_HIST);
	for(i=0; i<hist->num; i++) {
	printf("histogram.%6.6d.%6.6d.to.%6.6d.%6.6d=%lu\n",
	(int)hist->buckets[i].lower.tv_sec,
	(int)hist->buckets[i].lower.tv_usec,
	(int)hist->buckets[i].upper.tv_sec,
	(int)hist->buckets[i].upper.tv_usec,
	(unsigned long)hist->buckets[i].count);
	}
	timehist_delete(hist);
	}

	/** print extended */
	static void print_extended(struct ub_stats_info* s)
	{
	int i;
	char nm[16];

	/* TYPE */
	for(i=0; i<UB_STATS_QTYPE_NUM; i++) {
	if(inhibit_zero && s->svr.qtype[i] == 0)
	continue;
	sldns_wire2str_type_buf((uint16_t)i, nm, sizeof(nm));
	PR_UL_SUB("num.query.type", nm, s->svr.qtype[i]);
	}
	if(!inhibit_zero \|\| s->svr.qtype_big) {
	PR_UL("num.query.type.other", s->svr.qtype_big);
	}

	/* CLASS */
	for(i=0; i<UB_STATS_QCLASS_NUM; i++) {
	if(inhibit_zero && s->svr.qclass[i] == 0)
	continue;
	sldns_wire2str_class_buf((uint16_t)i, nm, sizeof(nm));
	PR_UL_SUB("num.query.class", nm, s->svr.qclass[i]);
	}
	if(!inhibit_zero \|\| s->svr.qclass_big) {
	PR_UL("num.query.class.other", s->svr.qclass_big);
	}

	/* OPCODE */
	for(i=0; i<UB_STATS_OPCODE_NUM; i++) {
	if(inhibit_zero && s->svr.qopcode[i] == 0)
	continue;
	sldns_wire2str_opcode_buf(i, nm, sizeof(nm));
	PR_UL_SUB("num.query.opcode", nm, s->svr.qopcode[i]);
	}

	/* transport */
	PR_UL("num.query.tcp", s->svr.qtcp);
	PR_UL("num.query.tcpout", s->svr.qtcp_outgoing);
	PR_UL("num.query.tls", s->svr.qtls);
	+ PR_UL("num.query.tls_resume", s->svr.qtls_resume);
	PR_UL("num.query.ipv6", s->svr.qipv6);

	/* flags */
	PR_UL("num.query.flags.QR", s->svr.qbit_QR);
	PR_UL("num.query.flags.AA", s->svr.qbit_AA);
	PR_UL("num.query.flags.TC", s->svr.qbit_TC);
	PR_UL("num.query.flags.RD", s->svr.qbit_RD);
	PR_UL("num.query.flags.RA", s->svr.qbit_RA);
	PR_UL("num.query.flags.Z", s->svr.qbit_Z);
	PR_UL("num.query.flags.AD", s->svr.qbit_AD);
	PR_UL("num.query.flags.CD", s->svr.qbit_CD);
	PR_UL("num.query.edns.present", s->svr.qEDNS);
	PR_UL("num.query.edns.DO", s->svr.qEDNS_DO);

	/* RCODE */
	for(i=0; i<UB_STATS_RCODE_NUM; i++) {
	/* Always include RCODEs 0-5 */
	if(inhibit_zero && i > LDNS_RCODE_REFUSED && s->svr.ans_rcode[i] == 0)
	continue;
	sldns_wire2str_rcode_buf(i, nm, sizeof(nm));
	PR_UL_SUB("num.answer.rcode", nm, s->svr.ans_rcode[i]);
	}
	if(!inhibit_zero \|\| s->svr.ans_rcode_nodata) {
	PR_UL("num.answer.rcode.nodata", s->svr.ans_rcode_nodata);
	}
	/* iteration */
	PR_UL("num.query.ratelimited", s->svr.queries_ratelimited);
	/* validation */
	PR_UL("num.answer.secure", s->svr.ans_secure);
	PR_UL("num.answer.bogus", s->svr.ans_bogus);
	PR_UL("num.rrset.bogus", s->svr.rrset_bogus);
	PR_UL("num.query.aggressive.NOERROR", s->svr.num_neg_cache_noerror);
	PR_UL("num.query.aggressive.NXDOMAIN", s->svr.num_neg_cache_nxdomain);
	/* threat detection */
	PR_UL("unwanted.queries", s->svr.unwanted_queries);
	PR_UL("unwanted.replies", s->svr.unwanted_replies);
	/* cache counts */
	PR_UL("msg.cache.count", s->svr.msg_cache_count);
	PR_UL("rrset.cache.count", s->svr.rrset_cache_count);
	PR_UL("infra.cache.count", s->svr.infra_cache_count);
	PR_UL("key.cache.count", s->svr.key_cache_count);
	#ifdef USE_DNSCRYPT
	PR_UL("dnscrypt_shared_secret.cache.count",
	s->svr.shared_secret_cache_count);
	PR_UL("num.query.dnscrypt.shared_secret.cachemiss",
	s->svr.num_query_dnscrypt_secret_missed_cache);
	PR_UL("dnscrypt_nonce.cache.count", s->svr.nonce_cache_count);
	PR_UL("num.query.dnscrypt.replay",
	s->svr.num_query_dnscrypt_replay);
	#endif /* USE_DNSCRYPT */
	PR_UL("num.query.authzone.up", s->svr.num_query_authzone_up);
	PR_UL("num.query.authzone.down", s->svr.num_query_authzone_down);
	#ifdef CLIENT_SUBNET
	PR_UL("num.query.subnet", s->svr.num_query_subnet);
	PR_UL("num.query.subnet_cache", s->svr.num_query_subnet_cache);
	#endif
	}

	/** print statistics out of memory structures */
	static void do_stats_shm(struct config_file* cfg, struct ub_stats_info* stats,
	struct ub_shm_stat_info* shm_stat)
	{
	int i;
	char nm[32];
	for(i=0; i<cfg->num_threads; i++) {
	snprintf(nm, sizeof(nm), "thread%d", i);
	pr_stats(nm, &stats[i+1]);
	}
	pr_stats("total", &stats[0]);
	print_uptime(shm_stat);
	if(cfg->stat_extended) {
	- print_mem(shm_stat);
	+ print_mem(shm_stat, &stats[0]);
	print_hist(stats);
	print_extended(stats);
	}
	}
	#endif /* HAVE_SHMGET */

	/** print statistics from shm memory segment */
	static void print_stats_shm(const char* cfgfile)
	{
	#ifdef HAVE_SHMGET
	struct config_file* cfg;
	struct ub_stats_info* stats;
	struct ub_shm_stat_info* shm_stat;
	int id_ctl, id_arr;
	/* read config */
	if(!(cfg = config_create()))
	fatal_exit("out of memory");
	if(!config_read(cfg, cfgfile, NULL))
	fatal_exit("could not read config file");
	/* get shm segments */
	id_ctl = shmget(cfg->shm_key, sizeof(int), SHM_R\|SHM_W);
	if(id_ctl == -1) {
	fatal_exit("shmget(%d): %s", cfg->shm_key, strerror(errno));
	}
	id_arr = shmget(cfg->shm_key+1, sizeof(int), SHM_R\|SHM_W);
	if(id_arr == -1) {
	fatal_exit("shmget(%d): %s", cfg->shm_key+1, strerror(errno));
	}
	shm_stat = (struct ub_shm_stat_info*)shmat(id_ctl, NULL, 0);
	if(shm_stat == (void*)-1) {
	fatal_exit("shmat(%d): %s", id_ctl, strerror(errno));
	}
	stats = (struct ub_stats_info*)shmat(id_arr, NULL, 0);
	if(stats == (void*)-1) {
	fatal_exit("shmat(%d): %s", id_arr, strerror(errno));
	}

	/* print the stats */
	do_stats_shm(cfg, stats, shm_stat);

	/* shutdown */
	shmdt(shm_stat);
	shmdt(stats);
	config_delete(cfg);
	#else
	(void)cfgfile;
	#endif /* HAVE_SHMGET */
	}

	/** exit with ssl error */
	static void ssl_err(const char* s)
	{
	fprintf(stderr, "error: %s\n", s);
	ERR_print_errors_fp(stderr);
	exit(1);
	}

	/** exit with ssl error related to a file path */
	static void ssl_path_err(const char* s, const char *path)
	{
	unsigned long err;
	err = ERR_peek_error();
	if (ERR_GET_LIB(err) == ERR_LIB_SYS &&
	(ERR_GET_FUNC(err) == SYS_F_FOPEN \|\|
	ERR_GET_FUNC(err) == SYS_F_FREAD) ) {
	fprintf(stderr, "error: %s\n%s: %s\n",
	s, path, ERR_reason_error_string(err));
	exit(1);
	} else {
	ssl_err(s);
	}
	}

	/** setup SSL context */
	static SSL_CTX*
	setup_ctx(struct config_file* cfg)
	{
	char* s_cert=NULL, c_key=NULL, c_cert=NULL;
	SSL_CTX* ctx;

	if(!(options_remote_is_address(cfg) && cfg->control_use_cert))
	return NULL;
	s_cert = fname_after_chroot(cfg->server_cert_file, cfg, 1);
	c_key = fname_after_chroot(cfg->control_key_file, cfg, 1);
	c_cert = fname_after_chroot(cfg->control_cert_file, cfg, 1);
	if(!s_cert \|\| !c_key \|\| !c_cert)
	fatal_exit("out of memory");
	ctx = SSL_CTX_new(SSLv23_client_method());
	if(!ctx)
	ssl_err("could not allocate SSL_CTX pointer");
	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)
	!= SSL_OP_NO_SSLv2)
	ssl_err("could not set SSL_OP_NO_SSLv2");
	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)
	!= SSL_OP_NO_SSLv3)
	ssl_err("could not set SSL_OP_NO_SSLv3");
	if(!SSL_CTX_use_certificate_chain_file(ctx,c_cert))
	ssl_path_err("Error setting up SSL_CTX client cert", c_cert);
	if (!SSL_CTX_use_PrivateKey_file(ctx,c_key,SSL_FILETYPE_PEM))
	ssl_path_err("Error setting up SSL_CTX client key", c_key);
	if (!SSL_CTX_check_private_key(ctx))
	ssl_err("Error setting up SSL_CTX client key");
	if (SSL_CTX_load_verify_locations(ctx, s_cert, NULL) != 1)
	ssl_path_err("Error setting up SSL_CTX verify, server cert",
	s_cert);
	SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);

	free(s_cert);
	free(c_key);
	free(c_cert);
	return ctx;
	}

	/** contact the server with TCP connect */
	static int
	contact_server(const char* svr, struct config_file* cfg, int statuscmd)
	{
	struct sockaddr_storage addr;
	socklen_t addrlen;
	int addrfamily = 0, proto = IPPROTO_TCP;
	int fd, useport = 1;
	/* use svr or the first config entry */
	if(!svr) {
	if(cfg->control_ifs.first) {
	svr = cfg->control_ifs.first->str;
	} else if(cfg->do_ip4) {
	svr = "127.0.0.1";
	} else {
	svr = "::1";
	}
	/* config 0 addr (everything), means ask localhost */
	if(strcmp(svr, "0.0.0.0") == 0)
	svr = "127.0.0.1";
	else if(strcmp(svr, "::0") == 0 \|\|
	strcmp(svr, "0::0") == 0 \|\|
	strcmp(svr, "0::") == 0 \|\|
	strcmp(svr, "::") == 0)
	svr = "::1";
	}
	if(strchr(svr, '@')) {
	if(!extstrtoaddr(svr, &addr, &addrlen))
	fatal_exit("could not parse IP@port: %s", svr);
	#ifdef HAVE_SYS_UN_H
	} else if(svr[0] == '/') {
	struct sockaddr_un* usock = (struct sockaddr_un *) &addr;
	usock->sun_family = AF_LOCAL;
	#ifdef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
	usock->sun_len = (unsigned)sizeof(usock);
	#endif
	(void)strlcpy(usock->sun_path, svr, sizeof(usock->sun_path));
	addrlen = (socklen_t)sizeof(struct sockaddr_un);
	addrfamily = AF_LOCAL;
	useport = 0;
	proto = 0;
	#endif
	} else {
	if(!ipstrtoaddr(svr, cfg->control_port, &addr, &addrlen))
	fatal_exit("could not parse IP: %s", svr);
	}

	if(addrfamily == 0)
	addrfamily = addr_is_ip6(&addr, addrlen)?PF_INET6:PF_INET;
	fd = socket(addrfamily, SOCK_STREAM, proto);
	if(fd == -1) {
	#ifndef USE_WINSOCK
	fatal_exit("socket: %s", strerror(errno));
	#else
	fatal_exit("socket: %s", wsa_strerror(WSAGetLastError()));
	#endif
	}
	if(connect(fd, (struct sockaddr*)&addr, addrlen) < 0) {
	#ifndef USE_WINSOCK
	int err = errno;
	if(!useport) log_err("connect: %s for %s", strerror(err), svr);
	else log_err_addr("connect", strerror(err), &addr, addrlen);
	if(err == ECONNREFUSED && statuscmd) {
	printf("unbound is stopped\n");
	exit(3);
	}
	#else
	int wsaerr = WSAGetLastError();
	if(!useport) log_err("connect: %s for %s", wsa_strerror(wsaerr), svr);
	else log_err_addr("connect", wsa_strerror(wsaerr), &addr, addrlen);
	if(wsaerr == WSAECONNREFUSED && statuscmd) {
	printf("unbound is stopped\n");
	exit(3);
	}
	#endif
	exit(1);
	}
	return fd;
	}

	/** setup SSL on the connection */
	static SSL*
	setup_ssl(SSL_CTX* ctx, int fd)
	{
	SSL* ssl;
	X509* x;
	int r;

	if(!ctx) return NULL;
	ssl = SSL_new(ctx);
	if(!ssl)
	ssl_err("could not SSL_new");
	SSL_set_connect_state(ssl);
	(void)SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);
	if(!SSL_set_fd(ssl, fd))
	ssl_err("could not SSL_set_fd");
	while(1) {
	ERR_clear_error();
	if( (r=SSL_do_handshake(ssl)) == 1)
	break;
	r = SSL_get_error(ssl, r);
	if(r != SSL_ERROR_WANT_READ && r != SSL_ERROR_WANT_WRITE)
	ssl_err("SSL handshake failed");
	/* wants to be called again */
	}

	/* check authenticity of server */
	if(SSL_get_verify_result(ssl) != X509_V_OK)
	ssl_err("SSL verification failed");
	x = SSL_get_peer_certificate(ssl);
	if(!x)
	ssl_err("Server presented no peer certificate");
	X509_free(x);

	return ssl;
	}

	/** read from ssl or fd, fatalexit on error, 0 EOF, 1 success */
	static int
	remote_read(SSL* ssl, int fd, char* buf, size_t len)
	{
	if(ssl) {
	int r;
	ERR_clear_error();
	if((r = SSL_read(ssl, buf, (int)len-1)) <= 0) {
	if(SSL_get_error(ssl, r) == SSL_ERROR_ZERO_RETURN) {
	/* EOF */
	return 0;
	}
	ssl_err("could not SSL_read");
	}
	buf[r] = 0;
	} else {
	ssize_t rr = recv(fd, buf, len-1, 0);
	if(rr <= 0) {
	if(rr == 0) {
	/* EOF */
	return 0;
	}
	#ifndef USE_WINSOCK
	fatal_exit("could not recv: %s", strerror(errno));
	#else
	fatal_exit("could not recv: %s", wsa_strerror(WSAGetLastError()));
	#endif
	}
	buf[rr] = 0;
	}
	return 1;
	}

	/** write to ssl or fd, fatalexit on error */
	static void
	remote_write(SSL* ssl, int fd, const char* buf, size_t len)
	{
	if(ssl) {
	if(SSL_write(ssl, buf, (int)len) <= 0)
	ssl_err("could not SSL_write");
	} else {
	if(send(fd, buf, len, 0) < (ssize_t)len) {
	#ifndef USE_WINSOCK
	fatal_exit("could not send: %s", strerror(errno));
	#else
	fatal_exit("could not send: %s", wsa_strerror(WSAGetLastError()));
	#endif
	}
	}
	}

	/** send stdin to server */
	static void
	send_file(SSL* ssl, int fd, FILE* in, char* buf, size_t sz)
	{
	while(fgets(buf, (int)sz, in)) {
	remote_write(ssl, fd, buf, strlen(buf));
	}
	}

	/** send end-of-file marker to server */
	static void
	send_eof(SSL* ssl, int fd)
	{
	char e[] = {0x04, 0x0a};
	remote_write(ssl, fd, e, sizeof(e));
	}

	/** send command and display result */
	static int
	go_cmd(SSL* ssl, int fd, int quiet, int argc, char* argv[])
	{
	char pre[10];
	const char* space=" ";
	const char* newline="\n";
	int was_error = 0, first_line = 1;
	int i;
	char buf[1024];
	snprintf(pre, sizeof(pre), "UBCT%d ", UNBOUND_CONTROL_VERSION);
	remote_write(ssl, fd, pre, strlen(pre));
	for(i=0; i<argc; i++) {
	remote_write(ssl, fd, space, strlen(space));
	remote_write(ssl, fd, argv[i], strlen(argv[i]));
	}
	remote_write(ssl, fd, newline, strlen(newline));

	if(argc == 1 && strcmp(argv[0], "load_cache") == 0) {
	send_file(ssl, fd, stdin, buf, sizeof(buf));
	}
	- else if(argc == 1 && (strcmp(argv[0], "local_zones") == 0 \|\|
	+ else if(argc >= 1 && (strcmp(argv[0], "local_zones") == 0 \|\|
	strcmp(argv[0], "local_zones_remove") == 0 \|\|
	strcmp(argv[0], "local_datas") == 0 \|\|
	+ strcmp(argv[0], "view_local_datas") == 0 \|\|
	strcmp(argv[0], "local_datas_remove") == 0)) {
	send_file(ssl, fd, stdin, buf, sizeof(buf));
	send_eof(ssl, fd);
	}

	while(1) {
	if(remote_read(ssl, fd, buf, sizeof(buf)) == 0) {
	break; /* EOF */
	}
	if(first_line && strncmp(buf, "error", 5) == 0) {
	printf("%s", buf);
	was_error = 1;
	} else if (!quiet)
	printf("%s", buf);

	first_line = 0;
	}
	return was_error;
	}

	/** go ahead and read config, contact server and perform command and display */
	static int
	go(const char* cfgfile, char* svr, int quiet, int argc, char* argv[])
	{
	struct config_file* cfg;
	int fd, ret;
	SSL_CTX* ctx;
	SSL* ssl;

	/* read config */
	if(!(cfg = config_create()))
	fatal_exit("out of memory");
	if(!config_read(cfg, cfgfile, NULL))
	fatal_exit("could not read config file");
	if(!cfg->remote_control_enable)
	log_warn("control-enable is 'no' in the config file.");
	#ifdef UB_ON_WINDOWS
	w_config_adjust_directory(cfg);
	#endif
	ctx = setup_ctx(cfg);

	/* contact server */
	fd = contact_server(svr, cfg, argc>0&&strcmp(argv[0],"status")==0);
	ssl = setup_ssl(ctx, fd);

	/* send command */
	ret = go_cmd(ssl, fd, quiet, argc, argv);

	if(ssl) SSL_free(ssl);
	#ifndef USE_WINSOCK
	close(fd);
	#else
	closesocket(fd);
	#endif
	if(ctx) SSL_CTX_free(ctx);
	config_delete(cfg);
	return ret;
	}

	/** getopt global, in case header files fail to declare it. */
	extern int optind;
	/** getopt global, in case header files fail to declare it. */
	extern char* optarg;

	/** Main routine for unbound-control */
	int main(int argc, char* argv[])
	{
	int c, ret;
	int quiet = 0;
	const char* cfgfile = CONFIGFILE;
	char* svr = NULL;
	#ifdef USE_WINSOCK
	int r;
	WSADATA wsa_data;
	#endif
	#ifdef USE_THREAD_DEBUG
	/* stop the file output from unbound-control, overwrites the servers */
	extern int check_locking_order;
	check_locking_order = 0;
	#endif /* USE_THREAD_DEBUG */
	log_ident_set("unbound-control");
	log_init(NULL, 0, NULL);
	checklock_start();
	#ifdef USE_WINSOCK
	/* use registry config file in preference to compiletime location */
	if(!(cfgfile=w_lookup_reg_str("Software\\Unbound", "ConfigFile")))
	cfgfile = CONFIGFILE;
	#endif
	/* parse the options */
	while( (c=getopt(argc, argv, "c:s:qh")) != -1) {
	switch(c) {
	case 'c':
	cfgfile = optarg;
	break;
	case 's':
	svr = optarg;
	break;
	case 'q':
	quiet = 1;
	break;
	case '?':
	case 'h':
	default:
	usage();
	}
	}
	argc -= optind;
	argv += optind;
	if(argc == 0)
	usage();
	if(argc >= 1 && strcmp(argv[0], "start")==0) {
	if(execlp("unbound", "unbound", "-c", cfgfile,
	(char*)NULL) < 0) {
	fatal_exit("could not exec unbound: %s",
	strerror(errno));
	}
	}
	if(argc >= 1 && strcmp(argv[0], "stats_shm")==0) {
	print_stats_shm(cfgfile);
	return 0;
	}

	#ifdef USE_WINSOCK
	if((r = WSAStartup(MAKEWORD(2,2), &wsa_data)) != 0)
	fatal_exit("WSAStartup failed: %s", wsa_strerror(r));
	#endif

	#ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
	ERR_load_crypto_strings();
	#endif
	#if OPENSSL_VERSION_NUMBER < 0x10100000 \|\| !defined(HAVE_OPENSSL_INIT_SSL)
	ERR_load_SSL_strings();
	#endif
	#if OPENSSL_VERSION_NUMBER < 0x10100000 \|\| !defined(HAVE_OPENSSL_INIT_CRYPTO)
	OpenSSL_add_all_algorithms();
	#else
	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
	\| OPENSSL_INIT_ADD_ALL_DIGESTS
	\| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
	#endif
	#if OPENSSL_VERSION_NUMBER < 0x10100000 \|\| !defined(HAVE_OPENSSL_INIT_SSL)
	(void)SSL_library_init();
	#else
	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
	#endif

	if(!RAND_status()) {
	/* try to seed it */
	unsigned char buf[256];
	unsigned int seed=(unsigned)time(NULL) ^ (unsigned)getpid();
	unsigned int v = seed;
	size_t i;
	for(i=0; i<256/sizeof(v); i++) {
	memmove(buf+i*sizeof(v), &v, sizeof(v));
	v = v*seed + (unsigned int)i;
	}
	RAND_seed(buf, 256);
	log_warn("no entropy, seeding openssl PRNG with time\n");
	}

	ret = go(cfgfile, svr, quiet, argc, argv);

	#ifdef USE_WINSOCK
	WSACleanup();
	#endif
	checklock_stop();
	return ret;
	}
	Index: head/contrib/unbound/util/alloc.c
	===================================================================
	--- head/contrib/unbound/util/alloc.c (revision 349719)
	+++ head/contrib/unbound/util/alloc.c (revision 349720)
	@@ -1,676 +1,682 @@
	/*
	* util/alloc.c - memory allocation service.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains memory allocation functions.
	*/

	#include "config.h"
	#include "util/alloc.h"
	#include "util/regional.h"
	#include "util/data/packed_rrset.h"
	#include "util/fptr_wlist.h"

	/** custom size of cached regional blocks */
	#define ALLOC_REG_SIZE 16384
	/** number of bits for ID part of uint64, rest for number of threads. */
	#define THRNUM_SHIFT 48 /* for 65k threads, 2^48 rrsets per thr. */

	/** setup new special type */
	static void
	alloc_setup_special(alloc_special_type* t)
	{
	memset(t, 0, sizeof(*t));
	lock_rw_init(&t->entry.lock);
	t->entry.key = t;
	}

	/** prealloc some entries in the cache. To minimize contention.
	* Result is 1 lock per alloc_max newly created entries.
	* @param alloc: the structure to fill up.
	*/
	static void
	prealloc_setup(struct alloc_cache* alloc)
	{
	alloc_special_type* p;
	int i;
	for(i=0; i<ALLOC_SPECIAL_MAX; i++) {
	if(!(p = (alloc_special_type*)malloc(
	sizeof(alloc_special_type)))) {
	log_err("prealloc: out of memory");
	return;
	}
	alloc_setup_special(p);
	alloc_set_special_next(p, alloc->quar);
	alloc->quar = p;
	alloc->num_quar++;
	}
	}

	/** prealloc region blocks */
	static void
	prealloc_blocks(struct alloc_cache* alloc, size_t num)
	{
	size_t i;
	struct regional* r;
	for(i=0; i<num; i++) {
	r = regional_create_custom(ALLOC_REG_SIZE);
	if(!r) {
	log_err("prealloc blocks: out of memory");
	return;
	}
	r->next = (char*)alloc->reg_list;
	alloc->reg_list = r;
	alloc->num_reg_blocks ++;
	}
	}

	void
	alloc_init(struct alloc_cache* alloc, struct alloc_cache* super,
	int thread_num)
	{
	memset(alloc, 0, sizeof(*alloc));
	alloc->super = super;
	alloc->thread_num = thread_num;
	alloc->next_id = (uint64_t)thread_num; /* in steps, so that type */
	alloc->next_id <<= THRNUM_SHIFT; /* of _id is used. /
	alloc->last_id = 1; /* so no 64bit constants, */
	alloc->last_id <<= THRNUM_SHIFT; /* or implicit 'int' ops. */
	alloc->last_id -= 1; /* for compiler portability. */
	alloc->last_id \|= alloc->next_id;
	alloc->next_id += 1; /* because id=0 is special. */
	alloc->max_reg_blocks = 100;
	alloc->num_reg_blocks = 0;
	alloc->reg_list = NULL;
	alloc->cleanup = NULL;
	alloc->cleanup_arg = NULL;
	if(alloc->super)
	prealloc_blocks(alloc, alloc->max_reg_blocks);
	if(!alloc->super) {
	lock_quick_init(&alloc->lock);
	lock_protect(&alloc->lock, alloc, sizeof(*alloc));
	}
	}

	/** free the special list */
	static void
	alloc_clear_special_list(struct alloc_cache* alloc)
	{
	alloc_special_type* p, *np;
	/* free */
	p = alloc->quar;
	while(p) {
	np = alloc_special_next(p);
	/* deinit special type */
	lock_rw_destroy(&p->entry.lock);
	free(p);
	p = np;
	}
	}

	void
	alloc_clear_special(struct alloc_cache* alloc)
	{
	if(!alloc->super) {
	lock_quick_lock(&alloc->lock);
	}
	alloc_clear_special_list(alloc);
	alloc->quar = 0;
	alloc->num_quar = 0;
	if(!alloc->super) {
	lock_quick_unlock(&alloc->lock);
	}
	}

	void
	alloc_clear(struct alloc_cache* alloc)
	{
	alloc_special_type* p;
	struct regional* r, *nr;
	if(!alloc)
	return;
	if(!alloc->super) {
	lock_quick_destroy(&alloc->lock);
	}
	if(alloc->super && alloc->quar) {
	/* push entire list into super */
	p = alloc->quar;
	while(alloc_special_next(p)) /* find last */
	p = alloc_special_next(p);
	lock_quick_lock(&alloc->super->lock);
	alloc_set_special_next(p, alloc->super->quar);
	alloc->super->quar = alloc->quar;
	alloc->super->num_quar += alloc->num_quar;
	lock_quick_unlock(&alloc->super->lock);
	} else {
	alloc_clear_special_list(alloc);
	}
	alloc->quar = 0;
	alloc->num_quar = 0;
	r = alloc->reg_list;
	while(r) {
	nr = (struct regional*)r->next;
	free(r);
	r = nr;
	}
	alloc->reg_list = NULL;
	alloc->num_reg_blocks = 0;
	}

	uint64_t
	alloc_get_id(struct alloc_cache* alloc)
	{
	uint64_t id = alloc->next_id++;
	if(id == alloc->last_id) {
	log_warn("rrset alloc: out of 64bit ids. Clearing cache.");
	fptr_ok(fptr_whitelist_alloc_cleanup(alloc->cleanup));
	(*alloc->cleanup)(alloc->cleanup_arg);

	/* start back at first number / / like in alloc_init*/
	alloc->next_id = (uint64_t)alloc->thread_num;
	alloc->next_id <<= THRNUM_SHIFT; /* in steps for comp. */
	alloc->next_id += 1; /* portability. */
	/* and generate new and safe id */
	id = alloc->next_id++;
	}
	return id;
	}

	alloc_special_type*
	alloc_special_obtain(struct alloc_cache* alloc)
	{
	alloc_special_type* p;
	log_assert(alloc);
	/* see if in local cache */
	if(alloc->quar) {
	p = alloc->quar;
	alloc->quar = alloc_special_next(p);
	alloc->num_quar--;
	p->id = alloc_get_id(alloc);
	return p;
	}
	/* see if in global cache */
	if(alloc->super) {
	/* could maybe grab alloc_max/2 entries in one go,
	* but really, isn't that just as fast as this code? */
	lock_quick_lock(&alloc->super->lock);
	if((p = alloc->super->quar)) {
	alloc->super->quar = alloc_special_next(p);
	alloc->super->num_quar--;
	}
	lock_quick_unlock(&alloc->super->lock);
	if(p) {
	p->id = alloc_get_id(alloc);
	return p;
	}
	}
	/* allocate new */
	prealloc_setup(alloc);
	if(!(p = (alloc_special_type*)malloc(sizeof(alloc_special_type)))) {
	log_err("alloc_special_obtain: out of memory");
	return NULL;
	}
	alloc_setup_special(p);
	p->id = alloc_get_id(alloc);
	return p;
	}

	/** push mem and some more items to the super */
	static void
	pushintosuper(struct alloc_cache* alloc, alloc_special_type* mem)
	{
	int i;
	alloc_special_type *p = alloc->quar;
	log_assert(p);
	log_assert(alloc && alloc->super &&
	alloc->num_quar >= ALLOC_SPECIAL_MAX);
	/* push ALLOC_SPECIAL_MAX/2 after mem */
	alloc_set_special_next(mem, alloc->quar);
	for(i=1; i<ALLOC_SPECIAL_MAX/2; i++) {
	p = alloc_special_next(p);
	}
	alloc->quar = alloc_special_next(p);
	alloc->num_quar -= ALLOC_SPECIAL_MAX/2;

	/* dump mem+list into the super quar list */
	lock_quick_lock(&alloc->super->lock);
	alloc_set_special_next(p, alloc->super->quar);
	alloc->super->quar = mem;
	alloc->super->num_quar += ALLOC_SPECIAL_MAX/2 + 1;
	lock_quick_unlock(&alloc->super->lock);
	/* so 1 lock per mem+alloc/2 deletes */
	}

	void
	alloc_special_release(struct alloc_cache* alloc, alloc_special_type* mem)
	{
	log_assert(alloc);
	if(!mem)
	return;
	if(!alloc->super) {
	lock_quick_lock(&alloc->lock); /* superalloc needs locking */
	}

	alloc_special_clean(mem);
	if(alloc->super && alloc->num_quar >= ALLOC_SPECIAL_MAX) {
	/* push it to the super structure */
	pushintosuper(alloc, mem);
	return;
	}

	alloc_set_special_next(mem, alloc->quar);
	alloc->quar = mem;
	alloc->num_quar++;
	if(!alloc->super) {
	lock_quick_unlock(&alloc->lock);
	}
	}

	void
	alloc_stats(struct alloc_cache* alloc)
	{
	log_info("%salloc: %d in cache, %d blocks.", alloc->super?"":"sup",
	(int)alloc->num_quar, (int)alloc->num_reg_blocks);
	}

	size_t alloc_get_mem(struct alloc_cache* alloc)
	{
	alloc_special_type* p;
	size_t s = sizeof(*alloc);
	if(!alloc->super) {
	lock_quick_lock(&alloc->lock); /* superalloc needs locking */
	}
	s += sizeof(alloc_special_type) * alloc->num_quar;
	for(p = alloc->quar; p; p = alloc_special_next(p)) {
	s += lock_get_mem(&p->entry.lock);
	}
	s += alloc->num_reg_blocks * ALLOC_REG_SIZE;
	if(!alloc->super) {
	lock_quick_unlock(&alloc->lock);
	}
	return s;
	}

	struct regional*
	alloc_reg_obtain(struct alloc_cache* alloc)
	{
	if(alloc->num_reg_blocks > 0) {
	struct regional* r = alloc->reg_list;
	alloc->reg_list = (struct regional*)r->next;
	r->next = NULL;
	alloc->num_reg_blocks--;
	return r;
	}
	return regional_create_custom(ALLOC_REG_SIZE);
	}

	void
	alloc_reg_release(struct alloc_cache* alloc, struct regional* r)
	{
	if(alloc->num_reg_blocks >= alloc->max_reg_blocks) {
	regional_destroy(r);
	return;
	}
	if(!r) return;
	regional_free_all(r);
	log_assert(r->next == NULL);
	r->next = (char*)alloc->reg_list;
	alloc->reg_list = r;
	alloc->num_reg_blocks++;
	}

	void
	alloc_set_id_cleanup(struct alloc_cache* alloc, void (cleanup)(void),
	void* arg)
	{
	alloc->cleanup = cleanup;
	alloc->cleanup_arg = arg;
	}

	/** global debug value to keep track of total memory mallocs */
	size_t unbound_mem_alloc = 0;
	/** global debug value to keep track of total memory frees */
	size_t unbound_mem_freed = 0;
	#ifdef UNBOUND_ALLOC_STATS
	/** special value to know if the memory is being tracked */
	uint64_t mem_special = (uint64_t)0xfeed43327766abcdLL;
	#ifdef malloc
	#undef malloc
	#endif
	/** malloc with stats */
	void *unbound_stat_malloc(size_t size)
	{
	void* res;
	if(size == 0) size = 1;
	+ log_assert(size <= SIZE_MAX-16);
	res = malloc(size+16);
	if(!res) return NULL;
	unbound_mem_alloc += size;
	log_info("stat %p=malloc(%u)", res+16, (unsigned)size);
	memcpy(res, &size, sizeof(size));
	memcpy(res+8, &mem_special, sizeof(mem_special));
	return res+16;
	}
	#ifdef calloc
	#undef calloc
	#endif
	#ifndef INT_MAX
	#define INT_MAX (((int)-1)>>1)
	#endif
	/** calloc with stats */
	void *unbound_stat_calloc(size_t nmemb, size_t size)
	{
	size_t s;
	void* res;
	if(nmemb != 0 && INT_MAX/nmemb < size)
	return NULL; /* integer overflow check */
	s = (nmembsize==0)?(size_t)1:nmembsize;
	+ log_assert(s <= SIZE_MAX-16);
	res = calloc(1, s+16);
	if(!res) return NULL;
	log_info("stat %p=calloc(%u, %u)", res+16, (unsigned)nmemb, (unsigned)size);
	unbound_mem_alloc += s;
	memcpy(res, &s, sizeof(s));
	memcpy(res+8, &mem_special, sizeof(mem_special));
	return res+16;
	}
	#ifdef free
	#undef free
	#endif
	/** free with stats */
	void unbound_stat_free(void *ptr)
	{
	size_t s;
	if(!ptr) return;
	if(memcmp(ptr-8, &mem_special, sizeof(mem_special)) != 0) {
	free(ptr);
	return;
	}
	ptr-=16;
	memcpy(&s, ptr, sizeof(s));
	log_info("stat free(%p) size %u", ptr+16, (unsigned)s);
	memset(ptr+8, 0, 8);
	unbound_mem_freed += s;
	free(ptr);
	}
	#ifdef realloc
	#undef realloc
	#endif
	/** realloc with stats */
	void unbound_stat_realloc(void ptr, size_t size)
	{
	size_t cursz;
	void* res;
	if(!ptr) return unbound_stat_malloc(size);
	if(memcmp(ptr-8, &mem_special, sizeof(mem_special)) != 0) {
	return realloc(ptr, size);
	}
	if(size==0) {
	unbound_stat_free(ptr);
	return NULL;
	}
	ptr -= 16;
	memcpy(&cursz, ptr, sizeof(cursz));
	if(cursz == size) {
	/* nothing changes */
	return ptr;
	}
	+ log_assert(size <= SIZE_MAX-16);
	res = malloc(size+16);
	if(!res) return NULL;
	unbound_mem_alloc += size;
	unbound_mem_freed += cursz;
	log_info("stat realloc(%p, %u) from %u", ptr+16, (unsigned)size, (unsigned)cursz);
	if(cursz > size) {
	memcpy(res+16, ptr+16, size);
	} else if(size > cursz) {
	memcpy(res+16, ptr+16, cursz);
	}
	memset(ptr+8, 0, 8);
	free(ptr);
	memcpy(res, &size, sizeof(size));
	memcpy(res+8, &mem_special, sizeof(mem_special));
	return res+16;
	}

	/** log to file where alloc was done */
	void unbound_stat_malloc_log(size_t size, const char file, int line,
	const char* func)
	{
	log_info("%s:%d %s malloc(%u)", file, line, func, (unsigned)size);
	return unbound_stat_malloc(size);
	}

	/** log to file where alloc was done */
	void unbound_stat_calloc_log(size_t nmemb, size_t size, const char file,
	int line, const char* func)
	{
	log_info("%s:%d %s calloc(%u, %u)", file, line, func,
	(unsigned) nmemb, (unsigned)size);
	return unbound_stat_calloc(nmemb, size);
	}

	/** log to file where free was done */
	void unbound_stat_free_log(void ptr, const char file, int line,
	const char* func)
	{
	if(ptr && memcmp(ptr-8, &mem_special, sizeof(mem_special)) == 0) {
	size_t s;
	memcpy(&s, ptr-16, sizeof(s));
	log_info("%s:%d %s free(%p) size %u",
	file, line, func, ptr, (unsigned)s);
	} else
	log_info("%s:%d %s unmatched free(%p)", file, line, func, ptr);
	unbound_stat_free(ptr);
	}

	/** log to file where alloc was done */
	void unbound_stat_realloc_log(void ptr, size_t size, const char* file,
	int line, const char* func)
	{
	log_info("%s:%d %s realloc(%p, %u)", file, line, func,
	ptr, (unsigned)size);
	return unbound_stat_realloc(ptr, size);
	}

	#endif /* UNBOUND_ALLOC_STATS */
	#ifdef UNBOUND_ALLOC_LITE
	#undef malloc
	#undef calloc
	#undef free
	#undef realloc
	/** length of prefix and suffix */
	static size_t lite_pad = 16;
	/** prefix value to check */
	static char* lite_pre = "checkfront123456";
	/** suffix value to check */
	static char* lite_post= "checkafter123456";

	void unbound_stat_malloc_lite(size_t size, const char file, int line,
	const char* func)
	{
	/* [prefix .. len .. actual data .. suffix] */
	- void* res = malloc(size+lite_pad*2+sizeof(size_t));
	+ void* res;
	+ log_assert(size <= SIZE_MAX-(lite_pad*2+sizeof(size_t)));
	+ res = malloc(size+lite_pad*2+sizeof(size_t));
	if(!res) return NULL;
	memmove(res, lite_pre, lite_pad);
	memmove(res+lite_pad, &size, sizeof(size_t));
	memset(res+lite_pad+sizeof(size_t), 0x1a, size); /* init the memory */
	memmove(res+lite_pad+size+sizeof(size_t), lite_post, lite_pad);
	return res+lite_pad+sizeof(size_t);
	}

	void unbound_stat_calloc_lite(size_t nmemb, size_t size, const char file,
	int line, const char* func)
	{
	size_t req;
	void* res;
	if(nmemb != 0 && INT_MAX/nmemb < size)
	return NULL; /* integer overflow check */
	req = nmemb * size;
	+ log_assert(req <= SIZE_MAX-(lite_pad*2+sizeof(size_t)));
	res = malloc(req+lite_pad*2+sizeof(size_t));
	if(!res) return NULL;
	memmove(res, lite_pre, lite_pad);
	memmove(res+lite_pad, &req, sizeof(size_t));
	memset(res+lite_pad+sizeof(size_t), 0, req);
	memmove(res+lite_pad+req+sizeof(size_t), lite_post, lite_pad);
	return res+lite_pad+sizeof(size_t);
	}

	void unbound_stat_free_lite(void ptr, const char file, int line,
	const char* func)
	{
	void* real;
	size_t orig = 0;
	if(!ptr) return;
	real = ptr-lite_pad-sizeof(size_t);
	if(memcmp(real, lite_pre, lite_pad) != 0) {
	log_err("free(): prefix failed %s:%d %s", file, line, func);
	log_hex("prefix here", real, lite_pad);
	log_hex(" should be", lite_pre, lite_pad);
	fatal_exit("alloc assertion failed");
	}
	memmove(&orig, real+lite_pad, sizeof(size_t));
	if(memcmp(real+lite_pad+orig+sizeof(size_t), lite_post, lite_pad)!=0){
	log_err("free(): suffix failed %s:%d %s", file, line, func);
	log_err("alloc size is %d", (int)orig);
	log_hex("suffix here", real+lite_pad+orig+sizeof(size_t),
	lite_pad);
	log_hex(" should be", lite_post, lite_pad);
	fatal_exit("alloc assertion failed");
	}
	memset(real, 0xdd, orig+lite_pad2+sizeof(size_t)); / mark it */
	free(real);
	}

	void unbound_stat_realloc_lite(void ptr, size_t size, const char* file,
	int line, const char* func)
	{
	/* always free and realloc (no growing) */
	void* real, *newa;
	size_t orig = 0;
	if(!ptr) {
	/* like malloc() */
	return unbound_stat_malloc_lite(size, file, line, func);
	}
	if(!size) {
	/* like free() */
	unbound_stat_free_lite(ptr, file, line, func);
	return NULL;
	}
	/* change allocation size and copy */
	real = ptr-lite_pad-sizeof(size_t);
	if(memcmp(real, lite_pre, lite_pad) != 0) {
	log_err("realloc(): prefix failed %s:%d %s", file, line, func);
	log_hex("prefix here", real, lite_pad);
	log_hex(" should be", lite_pre, lite_pad);
	fatal_exit("alloc assertion failed");
	}
	memmove(&orig, real+lite_pad, sizeof(size_t));
	if(memcmp(real+lite_pad+orig+sizeof(size_t), lite_post, lite_pad)!=0){
	log_err("realloc(): suffix failed %s:%d %s", file, line, func);
	log_err("alloc size is %d", (int)orig);
	log_hex("suffix here", real+lite_pad+orig+sizeof(size_t),
	lite_pad);
	log_hex(" should be", lite_post, lite_pad);
	fatal_exit("alloc assertion failed");
	}
	/* new alloc and copy over */
	newa = unbound_stat_malloc_lite(size, file, line, func);
	if(!newa)
	return NULL;
	if(orig < size)
	memmove(newa, ptr, orig);
	else memmove(newa, ptr, size);
	memset(real, 0xdd, orig+lite_pad2+sizeof(size_t)); / mark it */
	free(real);
	return newa;
	}

	char* unbound_strdup_lite(const char* s, const char* file, int line,
	const char* func)
	{
	/* this routine is made to make sure strdup() uses the malloc_lite */
	size_t l = strlen(s)+1;
	char* n = (char*)unbound_stat_malloc_lite(l, file, line, func);
	if(!n) return NULL;
	memmove(n, s, l);
	return n;
	}

	char* unbound_lite_wrapstr(char* s)
	{
	char* n = unbound_strdup_lite(s, __FILE__, __LINE__, __func__);
	free(s);
	return n;
	}

	#undef sldns_pkt2wire
	sldns_status unbound_lite_pkt2wire(uint8_t *dest, const sldns_pkt p,
	size_t *size)
	{
	uint8_t* md = NULL;
	size_t ms = 0;
	sldns_status s = sldns_pkt2wire(&md, p, &ms);
	if(md) {
	*dest = unbound_stat_malloc_lite(ms, __FILE__, __LINE__,
	__func__);
	*size = ms;
	if(!*dest) { free(md); return LDNS_STATUS_MEM_ERR; }
	memcpy(*dest, md, ms);
	free(md);
	} else {
	*dest = NULL;
	*size = 0;
	}
	return s;
	}

	#undef i2d_DSA_SIG
	int unbound_lite_i2d_DSA_SIG(DSA_SIG* dsasig, unsigned char** sig)
	{
	unsigned char* n = NULL;
	int r= i2d_DSA_SIG(dsasig, &n);
	if(n) {
	*sig = unbound_stat_malloc_lite((size_t)r, __FILE__, __LINE__,
	__func__);
	if(!*sig) return -1;
	memcpy(*sig, n, (size_t)r);
	free(n);
	return r;
	}
	*sig = NULL;
	return r;
	}

	#endif /* UNBOUND_ALLOC_LITE */
	Index: head/contrib/unbound/util/config_file.c
	===================================================================
	--- head/contrib/unbound/util/config_file.c (revision 349719)
	+++ head/contrib/unbound/util/config_file.c (revision 349720)
	@@ -1,2348 +1,2383 @@
	/*
	* util/config_file.c - reads and stores the config file for unbound.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains functions for the config file.
	*/

	#include "config.h"
	#include <ctype.h>
	#include <stdarg.h>
	#ifdef HAVE_TIME_H
	#include <time.h>
	#endif
	#include "util/log.h"
	#include "util/configyyrename.h"
	#include "util/config_file.h"
	#include "configparser.h"
	#include "util/net_help.h"
	#include "util/data/msgparse.h"
	#include "util/module.h"
	#include "util/regional.h"
	#include "util/fptr_wlist.h"
	#include "util/data/dname.h"
	#include "util/rtt.h"
	#include "services/cache/infra.h"
	#include "sldns/wire2str.h"
	#include "sldns/parseutil.h"
	+#include "iterator/iterator.h"
	#ifdef HAVE_GLOB_H
	# include <glob.h>
	#endif
	#ifdef CLIENT_SUBNET
	#include "edns-subnet/edns-subnet.h"
	#endif
	#ifdef HAVE_PWD_H
	#include <pwd.h>
	#endif

	/** from cfg username, after daemonize setup performed */
	uid_t cfg_uid = (uid_t)-1;
	/** from cfg username, after daemonize setup performed */
	gid_t cfg_gid = (gid_t)-1;
	/** for debug allow small timeout values for fast rollovers */
	int autr_permit_small_holddown = 0;
	+/** size (in bytes) of stream wait buffers max */
	+size_t stream_wait_max = 4 * 1024 * 1024;

	/** global config during parsing */
	struct config_parser_state* cfg_parser = 0;

	/** init ports possible for use */
	static void init_outgoing_availports(int* array, int num);

	struct config_file*
	config_create(void)
	{
	struct config_file* cfg;
	cfg = (struct config_file*)calloc(1, sizeof(struct config_file));
	if(!cfg)
	return NULL;
	/* the defaults if no config is present */
	cfg->verbosity = 1;
	cfg->stat_interval = 0;
	cfg->stat_cumulative = 0;
	cfg->stat_extended = 0;
	cfg->num_threads = 1;
	cfg->port = UNBOUND_DNS_PORT;
	cfg->do_ip4 = 1;
	cfg->do_ip6 = 1;
	cfg->do_udp = 1;
	cfg->do_tcp = 1;
	cfg->tcp_upstream = 0;
	cfg->udp_upstream_without_downstream = 0;
	cfg->tcp_mss = 0;
	cfg->outgoing_tcp_mss = 0;
	cfg->tcp_idle_timeout = 30 * 1000; /* 30s in millisecs */
	cfg->do_tcp_keepalive = 0;
	cfg->tcp_keepalive_timeout = 120 * 1000; /* 120s in millisecs */
	cfg->ssl_service_key = NULL;
	cfg->ssl_service_pem = NULL;
	cfg->ssl_port = UNBOUND_DNS_OVER_TLS_PORT;
	cfg->ssl_upstream = 0;
	cfg->tls_cert_bundle = NULL;
	cfg->tls_win_cert = 0;
	cfg->use_syslog = 1;
	cfg->log_identity = NULL; /* changed later with argv[0] */
	cfg->log_time_ascii = 0;
	cfg->log_queries = 0;
	cfg->log_replies = 0;
	+ cfg->log_tag_queryreply = 0;
	cfg->log_local_actions = 0;
	cfg->log_servfail = 0;
	#ifndef USE_WINSOCK
	# ifdef USE_MINI_EVENT
	/* select max 1024 sockets */
	cfg->outgoing_num_ports = 960;
	cfg->num_queries_per_thread = 512;
	# else
	/* libevent can use many sockets */
	cfg->outgoing_num_ports = 4096;
	cfg->num_queries_per_thread = 1024;
	# endif
	cfg->outgoing_num_tcp = 10;
	cfg->incoming_num_tcp = 10;
	#else
	cfg->outgoing_num_ports = 48; /* windows is limited in num fds */
	cfg->num_queries_per_thread = 24;
	cfg->outgoing_num_tcp = 2; /* leaves 64-52=12 for: 4if,1stop,thread4 */
	cfg->incoming_num_tcp = 2;
	#endif
	+ cfg->stream_wait_size = 4 * 1024 * 1024;
	cfg->edns_buffer_size = 4096; /* 4k from rfc recommendation */
	cfg->msg_buffer_size = 65552; /* 64 k + a small margin */
	cfg->msg_cache_size = 4 * 1024 * 1024;
	cfg->msg_cache_slabs = 4;
	cfg->jostle_time = 200;
	cfg->rrset_cache_size = 4 * 1024 * 1024;
	cfg->rrset_cache_slabs = 4;
	cfg->host_ttl = 900;
	cfg->bogus_ttl = 60;
	cfg->min_ttl = 0;
	cfg->max_ttl = 3600 * 24;
	cfg->max_negative_ttl = 3600;
	cfg->prefetch = 0;
	cfg->prefetch_key = 0;
	+ cfg->deny_any = 0;
	cfg->infra_cache_slabs = 4;
	cfg->infra_cache_numhosts = 10000;
	cfg->infra_cache_min_rtt = 50;
	cfg->delay_close = 0;
	if(!(cfg->outgoing_avail_ports = (int*)calloc(65536, sizeof(int))))
	goto error_exit;
	init_outgoing_availports(cfg->outgoing_avail_ports, 65536);
	if(!(cfg->username = strdup(UB_USERNAME))) goto error_exit;
	#ifdef HAVE_CHROOT
	if(!(cfg->chrootdir = strdup(CHROOT_DIR))) goto error_exit;
	#endif
	if(!(cfg->directory = strdup(RUN_DIR))) goto error_exit;
	if(!(cfg->logfile = strdup(""))) goto error_exit;
	if(!(cfg->pidfile = strdup(PIDFILE))) goto error_exit;
	if(!(cfg->target_fetch_policy = strdup("3 2 1 0 0"))) goto error_exit;
	- cfg->low_rtt_permil = 0;
	- cfg->low_rtt = 45;
	+ cfg->fast_server_permil = 0;
	+ cfg->fast_server_num = 3;
	cfg->donotqueryaddrs = NULL;
	cfg->donotquery_localhost = 1;
	cfg->root_hints = NULL;
	cfg->use_systemd = 0;
	cfg->do_daemonize = 1;
	cfg->if_automatic = 0;
	cfg->so_rcvbuf = 0;
	cfg->so_sndbuf = 0;
	cfg->so_reuseport = REUSEPORT_DEFAULT;
	cfg->ip_transparent = 0;
	cfg->ip_freebind = 0;
	cfg->num_ifs = 0;
	cfg->ifs = NULL;
	cfg->num_out_ifs = 0;
	cfg->out_ifs = NULL;
	cfg->stubs = NULL;
	cfg->forwards = NULL;
	cfg->auths = NULL;
	#ifdef CLIENT_SUBNET
	cfg->client_subnet = NULL;
	cfg->client_subnet_zone = NULL;
	cfg->client_subnet_opcode = LDNS_EDNS_CLIENT_SUBNET;
	cfg->client_subnet_always_forward = 0;
	cfg->max_client_subnet_ipv4 = 24;
	cfg->max_client_subnet_ipv6 = 56;
	+ cfg->min_client_subnet_ipv4 = 0;
	+ cfg->min_client_subnet_ipv6 = 0;
	+ cfg->max_ecs_tree_size_ipv4 = 100;
	+ cfg->max_ecs_tree_size_ipv6 = 100;
	#endif
	cfg->views = NULL;
	cfg->acls = NULL;
	cfg->tcp_connection_limits = NULL;
	cfg->harden_short_bufsize = 0;
	cfg->harden_large_queries = 0;
	cfg->harden_glue = 1;
	cfg->harden_dnssec_stripped = 1;
	cfg->harden_below_nxdomain = 1;
	cfg->harden_referral_path = 0;
	cfg->harden_algo_downgrade = 0;
	cfg->use_caps_bits_for_id = 0;
	cfg->caps_whitelist = NULL;
	cfg->private_address = NULL;
	cfg->private_domain = NULL;
	cfg->unwanted_threshold = 0;
	cfg->hide_identity = 0;
	cfg->hide_version = 0;
	cfg->hide_trustanchor = 0;
	cfg->identity = NULL;
	cfg->version = NULL;
	cfg->auto_trust_anchor_file_list = NULL;
	cfg->trust_anchor_file_list = NULL;
	cfg->trust_anchor_list = NULL;
	cfg->trusted_keys_file_list = NULL;
	cfg->trust_anchor_signaling = 1;
	cfg->root_key_sentinel = 1;
	cfg->dlv_anchor_file = NULL;
	cfg->dlv_anchor_list = NULL;
	cfg->domain_insecure = NULL;
	cfg->val_date_override = 0;
	cfg->val_sig_skew_min = 3600; /* at least daylight savings trouble */
	cfg->val_sig_skew_max = 86400; /* at most timezone settings trouble */
	cfg->val_clean_additional = 1;
	cfg->val_log_level = 0;
	cfg->val_log_squelch = 0;
	cfg->val_permissive_mode = 0;
	cfg->aggressive_nsec = 0;
	cfg->ignore_cd = 0;
	cfg->serve_expired = 0;
	cfg->serve_expired_ttl = 0;
	cfg->serve_expired_ttl_reset = 0;
	cfg->add_holddown = 30243600;
	cfg->del_holddown = 30243600;
	cfg->keep_missing = 366243600; /* one year plus a little leeway */
	cfg->permit_small_holddown = 0;
	cfg->key_cache_size = 4 * 1024 * 1024;
	cfg->key_cache_slabs = 4;
	cfg->neg_cache_size = 1 * 1024 * 1024;
	cfg->local_zones = NULL;
	cfg->local_zones_nodefault = NULL;
	cfg->local_zones_disable_default = 0;
	cfg->local_data = NULL;
	cfg->local_zone_overrides = NULL;
	cfg->unblock_lan_zones = 0;
	cfg->insecure_lan_zones = 0;
	cfg->python_script = NULL;
	cfg->remote_control_enable = 0;
	cfg->control_ifs.first = NULL;
	cfg->control_ifs.last = NULL;
	cfg->control_port = UNBOUND_CONTROL_PORT;
	cfg->control_use_cert = 1;
	cfg->minimal_responses = 1;
	cfg->rrset_roundrobin = 0;
	+ cfg->unknown_server_time_limit = 376;
	cfg->max_udp_size = 4096;
	if(!(cfg->server_key_file = strdup(RUN_DIR"/unbound_server.key")))
	goto error_exit;
	if(!(cfg->server_cert_file = strdup(RUN_DIR"/unbound_server.pem")))
	goto error_exit;
	if(!(cfg->control_key_file = strdup(RUN_DIR"/unbound_control.key")))
	goto error_exit;
	if(!(cfg->control_cert_file = strdup(RUN_DIR"/unbound_control.pem")))
	goto error_exit;

	#ifdef CLIENT_SUBNET
	if(!(cfg->module_conf = strdup("subnetcache validator iterator"))) goto error_exit;
	#else
	if(!(cfg->module_conf = strdup("validator iterator"))) goto error_exit;
	#endif
	if(!(cfg->val_nsec3_key_iterations =
	strdup("1024 150 2048 500 4096 2500"))) goto error_exit;
	#if defined(DNSTAP_SOCKET_PATH)
	if(!(cfg->dnstap_socket_path = strdup(DNSTAP_SOCKET_PATH)))
	goto error_exit;
	#endif
	cfg->disable_dnssec_lame_check = 0;
	cfg->ip_ratelimit = 0;
	cfg->ratelimit = 0;
	cfg->ip_ratelimit_slabs = 4;
	cfg->ratelimit_slabs = 4;
	cfg->ip_ratelimit_size = 410241024;
	cfg->ratelimit_size = 410241024;
	cfg->ratelimit_for_domain = NULL;
	cfg->ratelimit_below_domain = NULL;
	cfg->ip_ratelimit_factor = 10;
	cfg->ratelimit_factor = 10;
	cfg->qname_minimisation = 1;
	cfg->qname_minimisation_strict = 0;
	cfg->shm_enable = 0;
	cfg->shm_key = 11777;
	cfg->dnscrypt = 0;
	cfg->dnscrypt_port = 0;
	cfg->dnscrypt_provider = NULL;
	cfg->dnscrypt_provider_cert = NULL;
	cfg->dnscrypt_provider_cert_rotated = NULL;
	cfg->dnscrypt_secret_key = NULL;
	cfg->dnscrypt_shared_secret_cache_size = 410241024;
	cfg->dnscrypt_shared_secret_cache_slabs = 4;
	cfg->dnscrypt_nonce_cache_size = 410241024;
	cfg->dnscrypt_nonce_cache_slabs = 4;
	#ifdef USE_IPSECMOD
	cfg->ipsecmod_enabled = 1;
	cfg->ipsecmod_ignore_bogus = 0;
	cfg->ipsecmod_hook = NULL;
	cfg->ipsecmod_max_ttl = 3600;
	cfg->ipsecmod_whitelist = NULL;
	cfg->ipsecmod_strict = 0;
	#endif
	#ifdef USE_CACHEDB
	cfg->cachedb_backend = NULL;
	cfg->cachedb_secret = NULL;
	#endif
	return cfg;
	error_exit:
	config_delete(cfg);
	return NULL;
	}

	struct config_file* config_create_forlib(void)
	{
	struct config_file* cfg = config_create();
	if(!cfg) return NULL;
	/* modifications for library use, less verbose, less memory */
	free(cfg->chrootdir);
	cfg->chrootdir = NULL;
	cfg->verbosity = 0;
	cfg->outgoing_num_ports = 16; /* in library use, this is 'reasonable'
	and probably within the ulimit(maxfds) of the user */
	cfg->outgoing_num_tcp = 2;
	cfg->msg_cache_size = 1024*1024;
	cfg->msg_cache_slabs = 1;
	cfg->rrset_cache_size = 1024*1024;
	cfg->rrset_cache_slabs = 1;
	cfg->infra_cache_slabs = 1;
	cfg->use_syslog = 0;
	cfg->key_cache_size = 1024*1024;
	cfg->key_cache_slabs = 1;
	cfg->neg_cache_size = 100 * 1024;
	cfg->donotquery_localhost = 0; /* allow, so that you can ask a
	forward nameserver running on localhost */
	cfg->val_log_level = 2; /* to fill why_bogus with */
	cfg->val_log_squelch = 1;
	cfg->minimal_responses = 0;
	return cfg;
	}

	/** check that the value passed is >= 0 */
	#define IS_NUMBER_OR_ZERO \
	if(atoi(val) == 0 && strcmp(val, "0") != 0) return 0
	/** check that the value passed is > 0 */
	#define IS_NONZERO_NUMBER \
	if(atoi(val) == 0) return 0
	/** check that the value passed is not 0 and a power of 2 */
	#define IS_POW2_NUMBER \
	if(atoi(val) == 0 \|\| !is_pow2((size_t)atoi(val))) return 0
	/** check that the value passed is yes or no */
	#define IS_YES_OR_NO \
	if(strcmp(val, "yes") != 0 && strcmp(val, "no") != 0) return 0
	/** put integer_or_zero into variable */
	#define S_NUMBER_OR_ZERO(str, var) if(strcmp(opt, str) == 0) \
	{ IS_NUMBER_OR_ZERO; cfg->var = atoi(val); }
	/** put integer_nonzero into variable */
	#define S_NUMBER_NONZERO(str, var) if(strcmp(opt, str) == 0) \
	{ IS_NONZERO_NUMBER; cfg->var = atoi(val); }
	/** put integer_or_zero into unsigned */
	#define S_UNSIGNED_OR_ZERO(str, var) if(strcmp(opt, str) == 0) \
	{ IS_NUMBER_OR_ZERO; cfg->var = (unsigned)atoi(val); }
	/** put integer_or_zero into size_t */
	#define S_SIZET_OR_ZERO(str, var) if(strcmp(opt, str) == 0) \
	{ IS_NUMBER_OR_ZERO; cfg->var = (size_t)atoi(val); }
	/** put integer_nonzero into size_t */
	#define S_SIZET_NONZERO(str, var) if(strcmp(opt, str) == 0) \
	{ IS_NONZERO_NUMBER; cfg->var = (size_t)atoi(val); }
	/** put yesno into variable */
	#define S_YNO(str, var) if(strcmp(opt, str) == 0) \
	{ IS_YES_OR_NO; cfg->var = (strcmp(val, "yes") == 0); }
	/** put memsize into variable */
	#define S_MEMSIZE(str, var) if(strcmp(opt, str)==0) \
	{ return cfg_parse_memsize(val, &cfg->var); }
	/** put pow2 number into variable */
	#define S_POW2(str, var) if(strcmp(opt, str)==0) \
	{ IS_POW2_NUMBER; cfg->var = (size_t)atoi(val); }
	/** put string into variable */
	#define S_STR(str, var) if(strcmp(opt, str)==0) \
	{ free(cfg->var); return (cfg->var = strdup(val)) != NULL; }
	/** put string into strlist */
	#define S_STRLIST(str, var) if(strcmp(opt, str)==0) \
	{ return cfg_strlist_insert(&cfg->var, strdup(val)); }
	/** put string into strlist if not present yet*/
	#define S_STRLIST_UNIQ(str, var) if(strcmp(opt, str)==0) \
	{ if(cfg_strlist_find(cfg->var, val)) { return 0;} \
	return cfg_strlist_insert(&cfg->var, strdup(val)); }
	/** append string to strlist */
	#define S_STRLIST_APPEND(str, var) if(strcmp(opt, str)==0) \
	{ return cfg_strlist_append(&cfg->var, strdup(val)); }

	int config_set_option(struct config_file* cfg, const char* opt,
	const char* val)
	{
	char buf[64];
	if(!opt) return 0;
	if(opt[strlen(opt)-1] != ':' && strlen(opt)+2<sizeof(buf)) {
	snprintf(buf, sizeof(buf), "%s:", opt);
	opt = buf;
	}
	S_NUMBER_OR_ZERO("verbosity:", verbosity)
	else if(strcmp(opt, "statistics-interval:") == 0) {
	if(strcmp(val, "0") == 0 \|\| strcmp(val, "") == 0)
	cfg->stat_interval = 0;
	else if(atoi(val) == 0)
	return 0;
	else cfg->stat_interval = atoi(val);
	} else if(strcmp(opt, "num_threads:") == 0) {
	/* not supported, library must have 1 thread in bgworker */
	return 0;
	} else if(strcmp(opt, "outgoing-port-permit:") == 0) {
	return cfg_mark_ports(val, 1,
	cfg->outgoing_avail_ports, 65536);
	} else if(strcmp(opt, "outgoing-port-avoid:") == 0) {
	return cfg_mark_ports(val, 0,
	cfg->outgoing_avail_ports, 65536);
	} else if(strcmp(opt, "local-zone:") == 0) {
	return cfg_parse_local_zone(cfg, val);
	} else if(strcmp(opt, "val-override-date:") == 0) {
	if(strcmp(val, "") == 0 \|\| strcmp(val, "0") == 0) {
	cfg->val_date_override = 0;
	} else if(strlen(val) == 14) {
	cfg->val_date_override = cfg_convert_timeval(val);
	return cfg->val_date_override != 0;
	} else {
	if(atoi(val) == 0) return 0;
	cfg->val_date_override = (uint32_t)atoi(val);
	}
	} else if(strcmp(opt, "local-data-ptr:") == 0) {
	char* ptr = cfg_ptr_reverse((char*)opt);
	return cfg_strlist_insert(&cfg->local_data, ptr);
	} else if(strcmp(opt, "logfile:") == 0) {
	cfg->use_syslog = 0;
	free(cfg->logfile);
	return (cfg->logfile = strdup(val)) != NULL;
	}
	else if(strcmp(opt, "log-time-ascii:") == 0)
	{ IS_YES_OR_NO; cfg->log_time_ascii = (strcmp(val, "yes") == 0);
	log_set_time_asc(cfg->log_time_ascii); }
	else S_SIZET_NONZERO("max-udp-size:", max_udp_size)
	else S_YNO("use-syslog:", use_syslog)
	else S_STR("log-identity:", log_identity)
	else S_YNO("extended-statistics:", stat_extended)
	else S_YNO("statistics-cumulative:", stat_cumulative)
	else S_YNO("shm-enable:", shm_enable)
	else S_NUMBER_OR_ZERO("shm-key:", shm_key)
	else S_YNO("do-ip4:", do_ip4)
	else S_YNO("do-ip6:", do_ip6)
	else S_YNO("do-udp:", do_udp)
	else S_YNO("do-tcp:", do_tcp)
	else S_YNO("tcp-upstream:", tcp_upstream)
	else S_YNO("udp-upstream-without-downstream:",
	udp_upstream_without_downstream)
	else S_NUMBER_NONZERO("tcp-mss:", tcp_mss)
	else S_NUMBER_NONZERO("outgoing-tcp-mss:", outgoing_tcp_mss)
	else S_NUMBER_NONZERO("tcp-idle-timeout:", tcp_idle_timeout)
	else S_YNO("edns-tcp-keepalive:", do_tcp_keepalive)
	else S_NUMBER_NONZERO("edns-tcp-keepalive-timeout:", tcp_keepalive_timeout)
	else S_YNO("ssl-upstream:", ssl_upstream)
	else S_STR("ssl-service-key:", ssl_service_key)
	else S_STR("ssl-service-pem:", ssl_service_pem)
	else S_NUMBER_NONZERO("ssl-port:", ssl_port)
	else S_STR("tls-cert-bundle:", tls_cert_bundle)
	else S_YNO("tls-win-cert:", tls_win_cert)
	else S_STRLIST("additional-tls-port:", tls_additional_port)
	else S_STRLIST("tls-additional-ports:", tls_additional_port)
	else S_STRLIST("tls-additional-port:", tls_additional_port)
	+ else S_STRLIST_APPEND("tls-session-ticket-keys:", tls_session_ticket_keys)
	+ else S_STR("tls-ciphers:", tls_ciphers)
	+ else S_STR("tls-ciphersuites:", tls_ciphersuites)
	else S_YNO("interface-automatic:", if_automatic)
	else S_YNO("use-systemd:", use_systemd)
	else S_YNO("do-daemonize:", do_daemonize)
	else S_NUMBER_NONZERO("port:", port)
	else S_NUMBER_NONZERO("outgoing-range:", outgoing_num_ports)
	else S_SIZET_OR_ZERO("outgoing-num-tcp:", outgoing_num_tcp)
	else S_SIZET_OR_ZERO("incoming-num-tcp:", incoming_num_tcp)
	+ else S_MEMSIZE("stream-wait-size:", stream_wait_size)
	else S_SIZET_NONZERO("edns-buffer-size:", edns_buffer_size)
	else S_SIZET_NONZERO("msg-buffer-size:", msg_buffer_size)
	else S_MEMSIZE("msg-cache-size:", msg_cache_size)
	else S_POW2("msg-cache-slabs:", msg_cache_slabs)
	else S_SIZET_NONZERO("num-queries-per-thread:",num_queries_per_thread)
	else S_SIZET_OR_ZERO("jostle-timeout:", jostle_time)
	else S_MEMSIZE("so-rcvbuf:", so_rcvbuf)
	else S_MEMSIZE("so-sndbuf:", so_sndbuf)
	else S_YNO("so-reuseport:", so_reuseport)
	else S_YNO("ip-transparent:", ip_transparent)
	else S_YNO("ip-freebind:", ip_freebind)
	else S_MEMSIZE("rrset-cache-size:", rrset_cache_size)
	else S_POW2("rrset-cache-slabs:", rrset_cache_slabs)
	else S_YNO("prefetch:", prefetch)
	else S_YNO("prefetch-key:", prefetch_key)
	+ else S_YNO("deny-any:", deny_any)
	else if(strcmp(opt, "cache-max-ttl:") == 0)
	{ IS_NUMBER_OR_ZERO; cfg->max_ttl = atoi(val); MAX_TTL=(time_t)cfg->max_ttl;}
	else if(strcmp(opt, "cache-max-negative-ttl:") == 0)
	{ IS_NUMBER_OR_ZERO; cfg->max_negative_ttl = atoi(val); MAX_NEG_TTL=(time_t)cfg->max_negative_ttl;}
	else if(strcmp(opt, "cache-min-ttl:") == 0)
	{ IS_NUMBER_OR_ZERO; cfg->min_ttl = atoi(val); MIN_TTL=(time_t)cfg->min_ttl;}
	else if(strcmp(opt, "infra-cache-min-rtt:") == 0) {
	IS_NUMBER_OR_ZERO; cfg->infra_cache_min_rtt = atoi(val);
	RTT_MIN_TIMEOUT=cfg->infra_cache_min_rtt;
	}
	else S_NUMBER_OR_ZERO("infra-host-ttl:", host_ttl)
	else S_POW2("infra-cache-slabs:", infra_cache_slabs)
	else S_SIZET_NONZERO("infra-cache-numhosts:", infra_cache_numhosts)
	else S_NUMBER_OR_ZERO("delay-close:", delay_close)
	else S_STR("chroot:", chrootdir)
	else S_STR("username:", username)
	else S_STR("directory:", directory)
	else S_STR("pidfile:", pidfile)
	else S_YNO("hide-identity:", hide_identity)
	else S_YNO("hide-version:", hide_version)
	else S_YNO("hide-trustanchor:", hide_trustanchor)
	else S_STR("identity:", identity)
	else S_STR("version:", version)
	else S_STRLIST("root-hints:", root_hints)
	else S_STR("target-fetch-policy:", target_fetch_policy)
	else S_YNO("harden-glue:", harden_glue)
	else S_YNO("harden-short-bufsize:", harden_short_bufsize)
	else S_YNO("harden-large-queries:", harden_large_queries)
	else S_YNO("harden-dnssec-stripped:", harden_dnssec_stripped)
	else S_YNO("harden-below-nxdomain:", harden_below_nxdomain)
	else S_YNO("harden-referral-path:", harden_referral_path)
	else S_YNO("harden-algo-downgrade:", harden_algo_downgrade)
	else S_YNO("use-caps-for-id:", use_caps_bits_for_id)
	else S_STRLIST("caps-whitelist:", caps_whitelist)
	else S_SIZET_OR_ZERO("unwanted-reply-threshold:", unwanted_threshold)
	else S_STRLIST("private-address:", private_address)
	else S_STRLIST("private-domain:", private_domain)
	else S_YNO("do-not-query-localhost:", donotquery_localhost)
	else S_STRLIST("do-not-query-address:", donotqueryaddrs)
	else S_STRLIST("auto-trust-anchor-file:", auto_trust_anchor_file_list)
	else S_STRLIST("trust-anchor-file:", trust_anchor_file_list)
	else S_STRLIST("trust-anchor:", trust_anchor_list)
	else S_STRLIST("trusted-keys-file:", trusted_keys_file_list)
	else S_YNO("trust-anchor-signaling:", trust_anchor_signaling)
	else S_YNO("root-key-sentinel:", root_key_sentinel)
	else S_STR("dlv-anchor-file:", dlv_anchor_file)
	else S_STRLIST("dlv-anchor:", dlv_anchor_list)
	else S_STRLIST("domain-insecure:", domain_insecure)
	else S_NUMBER_OR_ZERO("val-bogus-ttl:", bogus_ttl)
	else S_YNO("val-clean-additional:", val_clean_additional)
	else S_NUMBER_OR_ZERO("val-log-level:", val_log_level)
	else S_YNO("val-log-squelch:", val_log_squelch)
	else S_YNO("log-queries:", log_queries)
	else S_YNO("log-replies:", log_replies)
	+ else S_YNO("log-tag-queryreply:", log_tag_queryreply)
	else S_YNO("log-local-actions:", log_local_actions)
	else S_YNO("log-servfail:", log_servfail)
	else S_YNO("val-permissive-mode:", val_permissive_mode)
	else S_YNO("aggressive-nsec:", aggressive_nsec)
	else S_YNO("ignore-cd-flag:", ignore_cd)
	else S_YNO("serve-expired:", serve_expired)
	else if(strcmp(opt, "serve_expired_ttl:") == 0)
	{ IS_NUMBER_OR_ZERO; cfg->serve_expired_ttl = atoi(val); SERVE_EXPIRED_TTL=(time_t)cfg->serve_expired_ttl;}
	else S_YNO("serve-expired-ttl-reset:", serve_expired_ttl_reset)
	else S_STR("val-nsec3-keysize-iterations:", val_nsec3_key_iterations)
	else S_UNSIGNED_OR_ZERO("add-holddown:", add_holddown)
	else S_UNSIGNED_OR_ZERO("del-holddown:", del_holddown)
	else S_UNSIGNED_OR_ZERO("keep-missing:", keep_missing)
	else if(strcmp(opt, "permit-small-holddown:") == 0)
	{ IS_YES_OR_NO; cfg->permit_small_holddown = (strcmp(val, "yes") == 0);
	autr_permit_small_holddown = cfg->permit_small_holddown; }
	else S_MEMSIZE("key-cache-size:", key_cache_size)
	else S_POW2("key-cache-slabs:", key_cache_slabs)
	else S_MEMSIZE("neg-cache-size:", neg_cache_size)
	else S_YNO("minimal-responses:", minimal_responses)
	else S_YNO("rrset-roundrobin:", rrset_roundrobin)
	+ else S_NUMBER_OR_ZERO("unknown-server-time-limit:", unknown_server_time_limit)
	else S_STRLIST("local-data:", local_data)
	else S_YNO("unblock-lan-zones:", unblock_lan_zones)
	else S_YNO("insecure-lan-zones:", insecure_lan_zones)
	else S_YNO("control-enable:", remote_control_enable)
	else S_STRLIST_APPEND("control-interface:", control_ifs)
	else S_NUMBER_NONZERO("control-port:", control_port)
	else S_STR("server-key-file:", server_key_file)
	else S_STR("server-cert-file:", server_cert_file)
	else S_STR("control-key-file:", control_key_file)
	else S_STR("control-cert-file:", control_cert_file)
	else S_STR("module-config:", module_conf)
	else S_STR("python-script:", python_script)
	else S_YNO("disable-dnssec-lame-check:", disable_dnssec_lame_check)
	#ifdef CLIENT_SUBNET
	/* Can't set max subnet prefix here, since that value is used when
	* generating the address tree. */
	/* No client-subnet-always-forward here, module registration depends on
	* this option. */
	#endif
	#ifdef USE_DNSTAP
	else S_YNO("dnstap-enable:", dnstap)
	else S_STR("dnstap-socket-path:", dnstap_socket_path)
	else S_YNO("dnstap-send-identity:", dnstap_send_identity)
	else S_YNO("dnstap-send-version:", dnstap_send_version)
	else S_STR("dnstap-identity:", dnstap_identity)
	else S_STR("dnstap-version:", dnstap_version)
	else S_YNO("dnstap-log-resolver-query-messages:",
	dnstap_log_resolver_query_messages)
	else S_YNO("dnstap-log-resolver-response-messages:",
	dnstap_log_resolver_response_messages)
	else S_YNO("dnstap-log-client-query-messages:",
	dnstap_log_client_query_messages)
	else S_YNO("dnstap-log-client-response-messages:",
	dnstap_log_client_response_messages)
	else S_YNO("dnstap-log-forwarder-query-messages:",
	dnstap_log_forwarder_query_messages)
	else S_YNO("dnstap-log-forwarder-response-messages:",
	dnstap_log_forwarder_response_messages)
	#endif
	#ifdef USE_DNSCRYPT
	else S_YNO("dnscrypt-enable:", dnscrypt)
	else S_NUMBER_NONZERO("dnscrypt-port:", dnscrypt_port)
	else S_STR("dnscrypt-provider:", dnscrypt_provider)
	else S_STRLIST_UNIQ("dnscrypt-provider-cert:", dnscrypt_provider_cert)
	else S_STRLIST("dnscrypt-provider-cert-rotated:", dnscrypt_provider_cert_rotated)
	else S_STRLIST_UNIQ("dnscrypt-secret-key:", dnscrypt_secret_key)
	else S_MEMSIZE("dnscrypt-shared-secret-cache-size:",
	dnscrypt_shared_secret_cache_size)
	else S_POW2("dnscrypt-shared-secret-cache-slabs:",
	dnscrypt_shared_secret_cache_slabs)
	else S_MEMSIZE("dnscrypt-nonce-cache-size:",
	dnscrypt_nonce_cache_size)
	else S_POW2("dnscrypt-nonce-cache-slabs:",
	dnscrypt_nonce_cache_slabs)
	#endif
	else if(strcmp(opt, "ip-ratelimit:") == 0) {
	IS_NUMBER_OR_ZERO; cfg->ip_ratelimit = atoi(val);
	infra_ip_ratelimit=cfg->ip_ratelimit;
	}
	else if(strcmp(opt, "ratelimit:") == 0) {
	IS_NUMBER_OR_ZERO; cfg->ratelimit = atoi(val);
	infra_dp_ratelimit=cfg->ratelimit;
	}
	else S_MEMSIZE("ip-ratelimit-size:", ip_ratelimit_size)
	else S_MEMSIZE("ratelimit-size:", ratelimit_size)
	else S_POW2("ip-ratelimit-slabs:", ip_ratelimit_slabs)
	else S_POW2("ratelimit-slabs:", ratelimit_slabs)
	else S_NUMBER_OR_ZERO("ip-ratelimit-factor:", ip_ratelimit_factor)
	else S_NUMBER_OR_ZERO("ratelimit-factor:", ratelimit_factor)
	- else S_NUMBER_OR_ZERO("low-rtt:", low_rtt)
	- else S_NUMBER_OR_ZERO("low-rtt-pct:", low_rtt_permil)
	- else S_NUMBER_OR_ZERO("low-rtt-permil:", low_rtt_permil)
	+ else S_SIZET_NONZERO("fast-server-num:", fast_server_num)
	+ else S_NUMBER_OR_ZERO("fast-server-permil:", fast_server_permil)
	else S_YNO("qname-minimisation:", qname_minimisation)
	else S_YNO("qname-minimisation-strict:", qname_minimisation_strict)
	#ifdef USE_IPSECMOD
	else S_YNO("ipsecmod-enabled:", ipsecmod_enabled)
	else S_YNO("ipsecmod-ignore-bogus:", ipsecmod_ignore_bogus)
	else if(strcmp(opt, "ipsecmod-max-ttl:") == 0)
	{ IS_NUMBER_OR_ZERO; cfg->ipsecmod_max_ttl = atoi(val); }
	else S_YNO("ipsecmod-strict:", ipsecmod_strict)
	#endif
	else if(strcmp(opt, "define-tag:") ==0) {
	return config_add_tag(cfg, val);
	/* val_sig_skew_min and max are copied into val_env during init,
	* so this does not update val_env with set_option */
	} else if(strcmp(opt, "val-sig-skew-min:") == 0)
	{ IS_NUMBER_OR_ZERO; cfg->val_sig_skew_min = (int32_t)atoi(val); }
	else if(strcmp(opt, "val-sig-skew-max:") == 0)
	{ IS_NUMBER_OR_ZERO; cfg->val_sig_skew_max = (int32_t)atoi(val); }
	else if (strcmp(opt, "outgoing-interface:") == 0) {
	char* d = strdup(val);
	char** oi =
	(char*)reallocarray(NULL, (size_t)cfg->num_out_ifs+1, sizeof(char));
	if(!d \|\| !oi) { free(d); free(oi); return -1; }
	if(cfg->out_ifs && cfg->num_out_ifs) {
	memmove(oi, cfg->out_ifs, cfg->num_out_ifssizeof(char));
	free(cfg->out_ifs);
	}
	oi[cfg->num_out_ifs++] = d;
	cfg->out_ifs = oi;
	} else {
	/* unknown or unsupported (from the set_option interface):
	* interface, outgoing-interface, access-control,
	* stub-zone, name, stub-addr, stub-host, stub-prime
	* forward-first, stub-first, forward-ssl-upstream,
	* stub-ssl-upstream, forward-zone, auth-zone
	* name, forward-addr, forward-host,
	* ratelimit-for-domain, ratelimit-below-domain,
	* local-zone-tag, access-control-view,
	* send-client-subnet, client-subnet-always-forward,
	- * max-client-subnet-ipv4, max-client-subnet-ipv6, ipsecmod_hook,
	+ * max-client-subnet-ipv4, max-client-subnet-ipv6,
	+ * min-client-subnet-ipv4, min-client-subnet-ipv6,
	+ * max-ecs-tree-size-ipv4, max-ecs-tree-size-ipv6, ipsecmod_hook,
	* ipsecmod_whitelist. */
	return 0;
	}
	return 1;
	}

	void config_print_func(char* line, void* arg)
	{
	FILE* f = (FILE*)arg;
	(void)fprintf(f, "%s\n", line);
	}

	/** collate func arg */
	struct config_collate_arg {
	/** list of result items */
	struct config_strlist_head list;
	/** if a malloc error occurred, 0 is OK */
	int status;
	};

	void config_collate_func(char* line, void* arg)
	{
	struct config_collate_arg* m = (struct config_collate_arg*)arg;
	if(m->status)
	return;
	if(!cfg_strlist_append(&m->list, strdup(line)))
	m->status = 1;
	}

	int config_get_option_list(struct config_file* cfg, const char* opt,
	struct config_strlist** list)
	{
	struct config_collate_arg m;
	memset(&m, 0, sizeof(m));
	*list = NULL;
	if(!config_get_option(cfg, opt, config_collate_func, &m))
	return 1;
	if(m.status) {
	config_delstrlist(m.list.first);
	return 2;
	}
	*list = m.list.first;
	return 0;
	}

	int
	config_get_option_collate(struct config_file* cfg, const char* opt, char** str)
	{
	struct config_strlist* list = NULL;
	int r;
	*str = NULL;
	if((r = config_get_option_list(cfg, opt, &list)) != 0)
	return r;
	*str = config_collate_cat(list);
	config_delstrlist(list);
	if(!*str) return 2;
	return 0;
	}

	char*
	config_collate_cat(struct config_strlist* list)
	{
	size_t total = 0, left;
	struct config_strlist* s;
	char r, w;
	if(!list) /* no elements */
	return strdup("");
	if(list->next == NULL) /* one element , no newline at end. */
	return strdup(list->str);
	/* count total length */
	for(s=list; s; s=s->next)
	total += strlen(s->str) + 1; /* len + newline */
	left = total+1; /* one extra for nul at end */
	r = malloc(left);
	if(!r)
	return NULL;
	w = r;
	for(s=list; s; s=s->next) {
	size_t this = strlen(s->str);
	if(this+2 > left) { /* sanity check */
	free(r);
	return NULL;
	}
	snprintf(w, left, "%s\n", s->str);
	this = strlen(w);
	w += this;
	left -= this;
	}
	return r;
	}

	/** compare and print decimal option */
	#define O_DEC(opt, str, var) if(strcmp(opt, str)==0) \
	{snprintf(buf, len, "%d", (int)cfg->var); \
	func(buf, arg);}
	/** compare and print unsigned option */
	#define O_UNS(opt, str, var) if(strcmp(opt, str)==0) \
	{snprintf(buf, len, "%u", (unsigned)cfg->var); \
	func(buf, arg);}
	/** compare and print yesno option */
	#define O_YNO(opt, str, var) if(strcmp(opt, str)==0) \
	{func(cfg->var?"yes":"no", arg);}
	/** compare and print string option */
	#define O_STR(opt, str, var) if(strcmp(opt, str)==0) \
	{func(cfg->var?cfg->var:"", arg);}
	/** compare and print array option */
	#define O_IFC(opt, str, num, arr) if(strcmp(opt, str)==0) \
	{int i; for(i=0; i<cfg->num; i++) func(cfg->arr[i], arg);}
	/** compare and print memorysize option */
	#define O_MEM(opt, str, var) if(strcmp(opt, str)==0) { \
	if(cfg->var > 102410241024) { \
	size_t f=cfg->var/(size_t)1000000, b=cfg->var%(size_t)1000000; \
	snprintf(buf, len, "%u%6.6u", (unsigned)f, (unsigned)b); \
	} else snprintf(buf, len, "%u", (unsigned)cfg->var); \
	func(buf, arg);}
	/** compare and print list option */
	#define O_LST(opt, name, lst) if(strcmp(opt, name)==0) { \
	struct config_strlist* p = cfg->lst; \
	for(p = cfg->lst; p; p = p->next) \
	func(p->str, arg); \
	}
	/** compare and print list option */
	#define O_LS2(opt, name, lst) if(strcmp(opt, name)==0) { \
	struct config_str2list* p = cfg->lst; \
	for(p = cfg->lst; p; p = p->next) { \
	snprintf(buf, len, "%s %s", p->str, p->str2); \
	func(buf, arg); \
	} \
	}
	/** compare and print list option */
	#define O_LS3(opt, name, lst) if(strcmp(opt, name)==0) { \
	struct config_str3list* p = cfg->lst; \
	for(p = cfg->lst; p; p = p->next) { \
	snprintf(buf, len, "%s %s %s", p->str, p->str2, p->str3); \
	func(buf, arg); \
	} \
	}
	/** compare and print taglist option */
	#define O_LTG(opt, name, lst) if(strcmp(opt, name)==0) { \
	char* tmpstr = NULL; \
	struct config_strbytelist *p = cfg->lst; \
	for(p = cfg->lst; p; p = p->next) {\
	tmpstr = config_taglist2str(cfg, p->str2, p->str2len); \
	if(tmpstr) {\
	snprintf(buf, len, "%s %s", p->str, tmpstr); \
	func(buf, arg); \
	free(tmpstr); \
	} \
	} \
	}

	int
	config_get_option(struct config_file* cfg, const char* opt,
	void (func)(char,void), void arg)
	{
	char buf[1024], nopt[64];
	size_t len = sizeof(buf);
	if(!opt) return 0;
	if(opt && opt[strlen(opt)-1] == ':' && strlen(opt)<sizeof(nopt)) {
	memmove(nopt, opt, strlen(opt));
	nopt[strlen(opt)-1] = 0;
	opt = nopt;
	}
	fptr_ok(fptr_whitelist_print_func(func));
	O_DEC(opt, "verbosity", verbosity)
	else O_DEC(opt, "statistics-interval", stat_interval)
	else O_YNO(opt, "statistics-cumulative", stat_cumulative)
	else O_YNO(opt, "extended-statistics", stat_extended)
	else O_YNO(opt, "shm-enable", shm_enable)
	else O_DEC(opt, "shm-key", shm_key)
	else O_YNO(opt, "use-syslog", use_syslog)
	else O_STR(opt, "log-identity", log_identity)
	else O_YNO(opt, "log-time-ascii", log_time_ascii)
	else O_DEC(opt, "num-threads", num_threads)
	else O_IFC(opt, "interface", num_ifs, ifs)
	else O_IFC(opt, "outgoing-interface", num_out_ifs, out_ifs)
	else O_YNO(opt, "interface-automatic", if_automatic)
	else O_DEC(opt, "port", port)
	else O_DEC(opt, "outgoing-range", outgoing_num_ports)
	else O_DEC(opt, "outgoing-num-tcp", outgoing_num_tcp)
	else O_DEC(opt, "incoming-num-tcp", incoming_num_tcp)
	+ else O_MEM(opt, "stream-wait-size", stream_wait_size)
	else O_DEC(opt, "edns-buffer-size", edns_buffer_size)
	else O_DEC(opt, "msg-buffer-size", msg_buffer_size)
	else O_MEM(opt, "msg-cache-size", msg_cache_size)
	else O_DEC(opt, "msg-cache-slabs", msg_cache_slabs)
	else O_DEC(opt, "num-queries-per-thread", num_queries_per_thread)
	else O_UNS(opt, "jostle-timeout", jostle_time)
	else O_MEM(opt, "so-rcvbuf", so_rcvbuf)
	else O_MEM(opt, "so-sndbuf", so_sndbuf)
	else O_YNO(opt, "so-reuseport", so_reuseport)
	else O_YNO(opt, "ip-transparent", ip_transparent)
	else O_YNO(opt, "ip-freebind", ip_freebind)
	else O_MEM(opt, "rrset-cache-size", rrset_cache_size)
	else O_DEC(opt, "rrset-cache-slabs", rrset_cache_slabs)
	else O_YNO(opt, "prefetch-key", prefetch_key)
	else O_YNO(opt, "prefetch", prefetch)
	+ else O_YNO(opt, "deny-any", deny_any)
	else O_DEC(opt, "cache-max-ttl", max_ttl)
	else O_DEC(opt, "cache-max-negative-ttl", max_negative_ttl)
	else O_DEC(opt, "cache-min-ttl", min_ttl)
	else O_DEC(opt, "infra-host-ttl", host_ttl)
	else O_DEC(opt, "infra-cache-slabs", infra_cache_slabs)
	else O_DEC(opt, "infra-cache-min-rtt", infra_cache_min_rtt)
	else O_MEM(opt, "infra-cache-numhosts", infra_cache_numhosts)
	else O_UNS(opt, "delay-close", delay_close)
	else O_YNO(opt, "do-ip4", do_ip4)
	else O_YNO(opt, "do-ip6", do_ip6)
	else O_YNO(opt, "do-udp", do_udp)
	else O_YNO(opt, "do-tcp", do_tcp)
	else O_YNO(opt, "tcp-upstream", tcp_upstream)
	else O_YNO(opt, "udp-upstream-without-downstream", udp_upstream_without_downstream)
	else O_DEC(opt, "tcp-mss", tcp_mss)
	else O_DEC(opt, "outgoing-tcp-mss", outgoing_tcp_mss)
	else O_DEC(opt, "tcp-idle-timeout", tcp_idle_timeout)
	else O_YNO(opt, "edns-tcp-keepalive", do_tcp_keepalive)
	else O_DEC(opt, "edns-tcp-keepalive-timeout", tcp_keepalive_timeout)
	else O_YNO(opt, "ssl-upstream", ssl_upstream)
	else O_STR(opt, "ssl-service-key", ssl_service_key)
	else O_STR(opt, "ssl-service-pem", ssl_service_pem)
	else O_DEC(opt, "ssl-port", ssl_port)
	else O_STR(opt, "tls-cert-bundle", tls_cert_bundle)
	else O_YNO(opt, "tls-win-cert", tls_win_cert)
	else O_LST(opt, "tls-additional-port", tls_additional_port)
	+ else O_LST(opt, "tls-session-ticket-keys", tls_session_ticket_keys.first)
	+ else O_STR(opt, "tls-ciphers", tls_ciphers)
	+ else O_STR(opt, "tls-ciphersuites", tls_ciphersuites)
	else O_YNO(opt, "use-systemd", use_systemd)
	else O_YNO(opt, "do-daemonize", do_daemonize)
	else O_STR(opt, "chroot", chrootdir)
	else O_STR(opt, "username", username)
	else O_STR(opt, "directory", directory)
	else O_STR(opt, "logfile", logfile)
	else O_YNO(opt, "log-queries", log_queries)
	else O_YNO(opt, "log-replies", log_replies)
	+ else O_YNO(opt, "log-tag-queryreply", log_tag_queryreply)
	else O_YNO(opt, "log-local-actions", log_local_actions)
	else O_YNO(opt, "log-servfail", log_servfail)
	else O_STR(opt, "pidfile", pidfile)
	else O_YNO(opt, "hide-identity", hide_identity)
	else O_YNO(opt, "hide-version", hide_version)
	else O_YNO(opt, "hide-trustanchor", hide_trustanchor)
	else O_STR(opt, "identity", identity)
	else O_STR(opt, "version", version)
	else O_STR(opt, "target-fetch-policy", target_fetch_policy)
	else O_YNO(opt, "harden-short-bufsize", harden_short_bufsize)
	else O_YNO(opt, "harden-large-queries", harden_large_queries)
	else O_YNO(opt, "harden-glue", harden_glue)
	else O_YNO(opt, "harden-dnssec-stripped", harden_dnssec_stripped)
	else O_YNO(opt, "harden-below-nxdomain", harden_below_nxdomain)
	else O_YNO(opt, "harden-referral-path", harden_referral_path)
	else O_YNO(opt, "harden-algo-downgrade", harden_algo_downgrade)
	else O_YNO(opt, "use-caps-for-id", use_caps_bits_for_id)
	else O_LST(opt, "caps-whitelist", caps_whitelist)
	else O_DEC(opt, "unwanted-reply-threshold", unwanted_threshold)
	else O_YNO(opt, "do-not-query-localhost", donotquery_localhost)
	else O_STR(opt, "module-config", module_conf)
	else O_STR(opt, "dlv-anchor-file", dlv_anchor_file)
	else O_DEC(opt, "val-bogus-ttl", bogus_ttl)
	else O_YNO(opt, "val-clean-additional", val_clean_additional)
	else O_DEC(opt, "val-log-level", val_log_level)
	else O_YNO(opt, "val-permissive-mode", val_permissive_mode)
	else O_YNO(opt, "aggressive-nsec", aggressive_nsec)
	else O_YNO(opt, "ignore-cd-flag", ignore_cd)
	else O_YNO(opt, "serve-expired", serve_expired)
	else O_DEC(opt, "serve-expired-ttl", serve_expired_ttl)
	else O_YNO(opt, "serve-expired-ttl-reset", serve_expired_ttl_reset)
	else O_STR(opt, "val-nsec3-keysize-iterations",val_nsec3_key_iterations)
	else O_UNS(opt, "add-holddown", add_holddown)
	else O_UNS(opt, "del-holddown", del_holddown)
	else O_UNS(opt, "keep-missing", keep_missing)
	else O_YNO(opt, "permit-small-holddown", permit_small_holddown)
	else O_MEM(opt, "key-cache-size", key_cache_size)
	else O_DEC(opt, "key-cache-slabs", key_cache_slabs)
	else O_MEM(opt, "neg-cache-size", neg_cache_size)
	else O_YNO(opt, "control-enable", remote_control_enable)
	else O_DEC(opt, "control-port", control_port)
	else O_STR(opt, "server-key-file", server_key_file)
	else O_STR(opt, "server-cert-file", server_cert_file)
	else O_STR(opt, "control-key-file", control_key_file)
	else O_STR(opt, "control-cert-file", control_cert_file)
	else O_LST(opt, "root-hints", root_hints)
	else O_LS2(opt, "access-control", acls)
	else O_LS2(opt, "tcp-connection-limit", tcp_connection_limits)
	else O_LST(opt, "do-not-query-address", donotqueryaddrs)
	else O_LST(opt, "private-address", private_address)
	else O_LST(opt, "private-domain", private_domain)
	else O_LST(opt, "auto-trust-anchor-file", auto_trust_anchor_file_list)
	else O_LST(opt, "trust-anchor-file", trust_anchor_file_list)
	else O_LST(opt, "trust-anchor", trust_anchor_list)
	else O_LST(opt, "trusted-keys-file", trusted_keys_file_list)
	else O_YNO(opt, "trust-anchor-signaling", trust_anchor_signaling)
	else O_YNO(opt, "root-key-sentinel", root_key_sentinel)
	else O_LST(opt, "dlv-anchor", dlv_anchor_list)
	else O_LST(opt, "control-interface", control_ifs.first)
	else O_LST(opt, "domain-insecure", domain_insecure)
	else O_UNS(opt, "val-override-date", val_date_override)
	else O_YNO(opt, "minimal-responses", minimal_responses)
	else O_YNO(opt, "rrset-roundrobin", rrset_roundrobin)
	+ else O_DEC(opt, "unknown-server-time-limit", unknown_server_time_limit)
	#ifdef CLIENT_SUBNET
	else O_LST(opt, "send-client-subnet", client_subnet)
	else O_LST(opt, "client-subnet-zone", client_subnet_zone)
	else O_DEC(opt, "max-client-subnet-ipv4", max_client_subnet_ipv4)
	else O_DEC(opt, "max-client-subnet-ipv6", max_client_subnet_ipv6)
	+ else O_DEC(opt, "min-client-subnet-ipv4", min_client_subnet_ipv4)
	+ else O_DEC(opt, "min-client-subnet-ipv6", min_client_subnet_ipv6)
	+ else O_DEC(opt, "max-ecs-tree-size-ipv4", max_ecs_tree_size_ipv4)
	+ else O_DEC(opt, "max-ecs-tree-size-ipv6", max_ecs_tree_size_ipv6)
	else O_YNO(opt, "client-subnet-always-forward:",
	client_subnet_always_forward)
	#endif
	#ifdef USE_DNSTAP
	else O_YNO(opt, "dnstap-enable", dnstap)
	else O_STR(opt, "dnstap-socket-path", dnstap_socket_path)
	else O_YNO(opt, "dnstap-send-identity", dnstap_send_identity)
	else O_YNO(opt, "dnstap-send-version", dnstap_send_version)
	else O_STR(opt, "dnstap-identity", dnstap_identity)
	else O_STR(opt, "dnstap-version", dnstap_version)
	else O_YNO(opt, "dnstap-log-resolver-query-messages",
	dnstap_log_resolver_query_messages)
	else O_YNO(opt, "dnstap-log-resolver-response-messages",
	dnstap_log_resolver_response_messages)
	else O_YNO(opt, "dnstap-log-client-query-messages",
	dnstap_log_client_query_messages)
	else O_YNO(opt, "dnstap-log-client-response-messages",
	dnstap_log_client_response_messages)
	else O_YNO(opt, "dnstap-log-forwarder-query-messages",
	dnstap_log_forwarder_query_messages)
	else O_YNO(opt, "dnstap-log-forwarder-response-messages",
	dnstap_log_forwarder_response_messages)
	#endif
	#ifdef USE_DNSCRYPT
	else O_YNO(opt, "dnscrypt-enable", dnscrypt)
	else O_DEC(opt, "dnscrypt-port", dnscrypt_port)
	else O_STR(opt, "dnscrypt-provider", dnscrypt_provider)
	else O_LST(opt, "dnscrypt-provider-cert", dnscrypt_provider_cert)
	else O_LST(opt, "dnscrypt-provider-cert-rotated", dnscrypt_provider_cert_rotated)
	else O_LST(opt, "dnscrypt-secret-key", dnscrypt_secret_key)
	else O_MEM(opt, "dnscrypt-shared-secret-cache-size",
	dnscrypt_shared_secret_cache_size)
	else O_DEC(opt, "dnscrypt-shared-secret-cache-slabs",
	dnscrypt_shared_secret_cache_slabs)
	else O_MEM(opt, "dnscrypt-nonce-cache-size",
	dnscrypt_nonce_cache_size)
	else O_DEC(opt, "dnscrypt-nonce-cache-slabs",
	dnscrypt_nonce_cache_slabs)
	#endif
	else O_YNO(opt, "unblock-lan-zones", unblock_lan_zones)
	else O_YNO(opt, "insecure-lan-zones", insecure_lan_zones)
	else O_DEC(opt, "max-udp-size", max_udp_size)
	else O_STR(opt, "python-script", python_script)
	else O_YNO(opt, "disable-dnssec-lame-check", disable_dnssec_lame_check)
	else O_DEC(opt, "ip-ratelimit", ip_ratelimit)
	else O_DEC(opt, "ratelimit", ratelimit)
	else O_MEM(opt, "ip-ratelimit-size", ip_ratelimit_size)
	else O_MEM(opt, "ratelimit-size", ratelimit_size)
	else O_DEC(opt, "ip-ratelimit-slabs", ip_ratelimit_slabs)
	else O_DEC(opt, "ratelimit-slabs", ratelimit_slabs)
	else O_LS2(opt, "ratelimit-for-domain", ratelimit_for_domain)
	else O_LS2(opt, "ratelimit-below-domain", ratelimit_below_domain)
	else O_DEC(opt, "ip-ratelimit-factor", ip_ratelimit_factor)
	else O_DEC(opt, "ratelimit-factor", ratelimit_factor)
	- else O_DEC(opt, "low-rtt", low_rtt)
	- else O_DEC(opt, "low-rtt-pct", low_rtt_permil)
	- else O_DEC(opt, "low-rtt-permil", low_rtt_permil)
	+ else O_DEC(opt, "fast-server-num", fast_server_num)
	+ else O_DEC(opt, "fast-server-permil", fast_server_permil)
	else O_DEC(opt, "val-sig-skew-min", val_sig_skew_min)
	else O_DEC(opt, "val-sig-skew-max", val_sig_skew_max)
	else O_YNO(opt, "qname-minimisation", qname_minimisation)
	else O_YNO(opt, "qname-minimisation-strict", qname_minimisation_strict)
	else O_IFC(opt, "define-tag", num_tags, tagname)
	else O_LTG(opt, "local-zone-tag", local_zone_tags)
	else O_LTG(opt, "access-control-tag", acl_tags)
	else O_LTG(opt, "response-ip-tag", respip_tags)
	else O_LS3(opt, "local-zone-override", local_zone_overrides)
	else O_LS3(opt, "access-control-tag-action", acl_tag_actions)
	else O_LS3(opt, "access-control-tag-data", acl_tag_datas)
	else O_LS2(opt, "access-control-view", acl_view)
	#ifdef USE_IPSECMOD
	else O_YNO(opt, "ipsecmod-enabled", ipsecmod_enabled)
	else O_YNO(opt, "ipsecmod-ignore-bogus", ipsecmod_ignore_bogus)
	else O_STR(opt, "ipsecmod-hook", ipsecmod_hook)
	else O_DEC(opt, "ipsecmod-max-ttl", ipsecmod_max_ttl)
	else O_LST(opt, "ipsecmod-whitelist", ipsecmod_whitelist)
	else O_YNO(opt, "ipsecmod-strict", ipsecmod_strict)
	#endif
	#ifdef USE_CACHEDB
	else O_STR(opt, "backend", cachedb_backend)
	else O_STR(opt, "secret-seed", cachedb_secret)
	#endif
	/* not here:
	* outgoing-permit, outgoing-avoid - have list of ports
	* local-zone - zones and nodefault variables
	* local-data - see below
	* local-data-ptr - converted to local-data entries
	* stub-zone, name, stub-addr, stub-host, stub-prime
	* forward-zone, name, forward-addr, forward-host
	*/
	else return 0;
	return 1;
	}

	/** initialize the global cfg_parser object */
	static void
	create_cfg_parser(struct config_file* cfg, char* filename, const char* chroot)
	{
	static struct config_parser_state st;
	cfg_parser = &st;
	cfg_parser->filename = filename;
	cfg_parser->line = 1;
	cfg_parser->errors = 0;
	cfg_parser->cfg = cfg;
	cfg_parser->chroot = chroot;
	init_cfg_parse();
	}

	int
	config_read(struct config_file* cfg, const char* filename, const char* chroot)
	{
	FILE *in;
	char fname = (char)filename;
	#ifdef HAVE_GLOB
	glob_t g;
	size_t i;
	int r, flags;
	#endif
	if(!fname)
	return 1;

	/* check for wildcards */
	#ifdef HAVE_GLOB
	if(!(!strchr(fname, '*') && !strchr(fname, '?') && !strchr(fname, '[') &&
	!strchr(fname, '{') && !strchr(fname, '~'))) {
	verbose(VERB_QUERY, "wildcard found, processing %s", fname);
	flags = 0
	#ifdef GLOB_ERR
	\| GLOB_ERR
	#endif
	#ifdef GLOB_NOSORT
	\| GLOB_NOSORT
	#endif
	#ifdef GLOB_BRACE
	\| GLOB_BRACE
	#endif
	#ifdef GLOB_TILDE
	\| GLOB_TILDE
	#endif
	;
	memset(&g, 0, sizeof(g));
	r = glob(fname, flags, NULL, &g);
	if(r) {
	/* some error */
	globfree(&g);
	if(r == GLOB_NOMATCH) {
	verbose(VERB_QUERY, "include: "
	"no matches for %s", fname);
	return 1;
	} else if(r == GLOB_NOSPACE) {
	log_err("include: %s: "
	"fnametern out of memory", fname);
	} else if(r == GLOB_ABORTED) {
	log_err("wildcard include: %s: expansion "
	"aborted (%s)", fname, strerror(errno));
	} else {
	log_err("wildcard include: %s: expansion "
	"failed (%s)", fname, strerror(errno));
	}
	/* ignore globs that yield no files */
	return 1;
	}
	/* process files found, if any */
	for(i=0; i<(size_t)g.gl_pathc; i++) {
	if(!config_read(cfg, g.gl_pathv[i], chroot)) {
	log_err("error reading wildcard "
	"include: %s", g.gl_pathv[i]);
	globfree(&g);
	return 0;
	}
	}
	globfree(&g);
	return 1;
	}
	#endif /* HAVE_GLOB */

	in = fopen(fname, "r");
	if(!in) {
	log_err("Could not open %s: %s", fname, strerror(errno));
	return 0;
	}
	create_cfg_parser(cfg, fname, chroot);
	ub_c_in = in;
	ub_c_parse();
	fclose(in);

	if(!cfg->dnscrypt) cfg->dnscrypt_port = 0;

	if(cfg_parser->errors != 0) {
	fprintf(stderr, "read %s failed: %d errors in configuration file\n",
	fname, cfg_parser->errors);
	errno=EINVAL;
	return 0;
	}

	return 1;
	}

	struct config_stub* cfg_stub_find(struct config_stub*** pp, const char* nm)
	{
	struct config_stub* p = (pp);
	while(p) {
	if(strcmp(p->name, nm) == 0)
	return p;
	(*pp) = &p->next;
	p = p->next;
	}
	return NULL;
	}

	void
	config_delstrlist(struct config_strlist* p)
	{
	struct config_strlist *np;
	while(p) {
	np = p->next;
	free(p->str);
	free(p);
	p = np;
	}
	}

	void
	config_deldblstrlist(struct config_str2list* p)
	{
	struct config_str2list *np;
	while(p) {
	np = p->next;
	free(p->str);
	free(p->str2);
	free(p);
	p = np;
	}
	}

	void
	config_deltrplstrlist(struct config_str3list* p)
	{
	struct config_str3list *np;
	while(p) {
	np = p->next;
	free(p->str);
	free(p->str2);
	free(p->str3);
	free(p);
	p = np;
	}
	}

	void
	config_delauth(struct config_auth* p)
	{
	if(!p) return;
	free(p->name);
	config_delstrlist(p->masters);
	config_delstrlist(p->urls);
	config_delstrlist(p->allow_notify);
	free(p->zonefile);
	free(p);
	}

	void
	config_delauths(struct config_auth* p)
	{
	struct config_auth* np;
	while(p) {
	np = p->next;
	config_delauth(p);
	p = np;
	}
	}

	void
	config_delstub(struct config_stub* p)
	{
	if(!p) return;
	free(p->name);
	config_delstrlist(p->hosts);
	config_delstrlist(p->addrs);
	free(p);
	}

	void
	config_delstubs(struct config_stub* p)
	{
	struct config_stub* np;
	while(p) {
	np = p->next;
	config_delstub(p);
	p = np;
	}
	}

	void
	config_delview(struct config_view* p)
	{
	if(!p) return;
	free(p->name);
	config_deldblstrlist(p->local_zones);
	config_delstrlist(p->local_zones_nodefault);
	config_delstrlist(p->local_data);
	free(p);
	}

	void
	config_delviews(struct config_view* p)
	{
	struct config_view* np;
	while(p) {
	np = p->next;
	config_delview(p);
	p = np;
	}
	}
	/** delete string array */
	static void
	config_del_strarray(char** array, int num)
	{
	int i;
	if(!array)
	return;
	for(i=0; i<num; i++) {
	free(array[i]);
	}
	free(array);
	}

	void
	config_del_strbytelist(struct config_strbytelist* p)
	{
	struct config_strbytelist* np;
	while(p) {
	np = p->next;
	free(p->str);
	free(p->str2);
	free(p);
	p = np;
	}
	}

	void
	config_delete(struct config_file* cfg)
	{
	if(!cfg) return;
	free(cfg->username);
	free(cfg->chrootdir);
	free(cfg->directory);
	free(cfg->logfile);
	free(cfg->pidfile);
	free(cfg->target_fetch_policy);
	free(cfg->ssl_service_key);
	free(cfg->ssl_service_pem);
	free(cfg->tls_cert_bundle);
	config_delstrlist(cfg->tls_additional_port);
	+ config_delstrlist(cfg->tls_session_ticket_keys.first);
	+ free(cfg->tls_ciphers);
	+ free(cfg->tls_ciphersuites);
	free(cfg->log_identity);
	config_del_strarray(cfg->ifs, cfg->num_ifs);
	config_del_strarray(cfg->out_ifs, cfg->num_out_ifs);
	config_delstubs(cfg->stubs);
	config_delstubs(cfg->forwards);
	config_delauths(cfg->auths);
	config_delviews(cfg->views);
	config_delstrlist(cfg->donotqueryaddrs);
	config_delstrlist(cfg->root_hints);
	#ifdef CLIENT_SUBNET
	config_delstrlist(cfg->client_subnet);
	config_delstrlist(cfg->client_subnet_zone);
	#endif
	free(cfg->identity);
	free(cfg->version);
	free(cfg->module_conf);
	free(cfg->outgoing_avail_ports);
	free(cfg->python_script);
	config_delstrlist(cfg->caps_whitelist);
	config_delstrlist(cfg->private_address);
	config_delstrlist(cfg->private_domain);
	config_delstrlist(cfg->auto_trust_anchor_file_list);
	config_delstrlist(cfg->trust_anchor_file_list);
	config_delstrlist(cfg->trusted_keys_file_list);
	config_delstrlist(cfg->trust_anchor_list);
	config_delstrlist(cfg->domain_insecure);
	free(cfg->dlv_anchor_file);
	config_delstrlist(cfg->dlv_anchor_list);
	config_deldblstrlist(cfg->acls);
	config_deldblstrlist(cfg->tcp_connection_limits);
	free(cfg->val_nsec3_key_iterations);
	config_deldblstrlist(cfg->local_zones);
	config_delstrlist(cfg->local_zones_nodefault);
	config_delstrlist(cfg->local_data);
	config_deltrplstrlist(cfg->local_zone_overrides);
	config_del_strarray(cfg->tagname, cfg->num_tags);
	config_del_strbytelist(cfg->local_zone_tags);
	config_del_strbytelist(cfg->acl_tags);
	config_del_strbytelist(cfg->respip_tags);
	config_deltrplstrlist(cfg->acl_tag_actions);
	config_deltrplstrlist(cfg->acl_tag_datas);
	config_delstrlist(cfg->control_ifs.first);
	free(cfg->server_key_file);
	free(cfg->server_cert_file);
	free(cfg->control_key_file);
	free(cfg->control_cert_file);
	free(cfg->dns64_prefix);
	config_delstrlist(cfg->dns64_ignore_aaaa);
	free(cfg->dnstap_socket_path);
	free(cfg->dnstap_identity);
	free(cfg->dnstap_version);
	config_deldblstrlist(cfg->ratelimit_for_domain);
	config_deldblstrlist(cfg->ratelimit_below_domain);
	#ifdef USE_IPSECMOD
	free(cfg->ipsecmod_hook);
	config_delstrlist(cfg->ipsecmod_whitelist);
	#endif
	#ifdef USE_CACHEDB
	free(cfg->cachedb_backend);
	free(cfg->cachedb_secret);
	#endif
	free(cfg);
	}

	static void
	init_outgoing_availports(int* a, int num)
	{
	/* generated with make iana_update */
	const int iana_assigned[] = {
	#include "util/iana_ports.inc"
	-1 }; /* end marker to put behind trailing comma */

	int i;
	/* do not use <1024, that could be trouble with the system, privs */
	for(i=1024; i<num; i++) {
	a[i] = i;
	}
	/* create empty spot at 49152 to keep ephemeral ports available
	* to other programs */
	for(i=49152; i<49152+256; i++)
	a[i] = 0;
	/* pick out all the IANA assigned ports */
	for(i=0; iana_assigned[i]!=-1; i++) {
	if(iana_assigned[i] < num)
	a[iana_assigned[i]] = 0;
	}
	}

	int
	cfg_mark_ports(const char* str, int allow, int* avail, int num)
	{
	char* mid = strchr(str, '-');
	if(!mid) {
	int port = atoi(str);
	if(port == 0 && strcmp(str, "0") != 0) {
	log_err("cannot parse port number '%s'", str);
	return 0;
	}
	if(port < num)
	avail[port] = (allow?port:0);
	} else {
	int i, low, high = atoi(mid+1);
	char buf[16];
	if(high == 0 && strcmp(mid+1, "0") != 0) {
	log_err("cannot parse port number '%s'", mid+1);
	return 0;
	}
	if( (int)(mid-str)+1 >= (int)sizeof(buf) ) {
	log_err("cannot parse port number '%s'", str);
	return 0;
	}
	if(mid > str)
	memcpy(buf, str, (size_t)(mid-str));
	buf[mid-str] = 0;
	low = atoi(buf);
	if(low == 0 && strcmp(buf, "0") != 0) {
	log_err("cannot parse port number '%s'", buf);
	return 0;
	}
	for(i=low; i<=high; i++) {
	if(i < num)
	avail[i] = (allow?i:0);
	}
	return 1;
	}
	return 1;
	}

	int
	cfg_scan_ports(int* avail, int num)
	{
	int i;
	int count = 0;
	for(i=0; i<num; i++) {
	if(avail[i])
	count++;
	}
	return count;
	}

	int cfg_condense_ports(struct config_file* cfg, int** avail)
	{
	int num = cfg_scan_ports(cfg->outgoing_avail_ports, 65536);
	int i, at = 0;
	*avail = NULL;
	if(num == 0)
	return 0;
	avail = (int)reallocarray(NULL, (size_t)num, sizeof(int));
	if(!*avail)
	return 0;
	for(i=0; i<65536; i++) {
	if(cfg->outgoing_avail_ports[i])
	(*avail)[at++] = cfg->outgoing_avail_ports[i];
	}
	log_assert(at == num);
	return num;
	}

	/** print error with file and line number */
	static void ub_c_error_va_list(const char *fmt, va_list args)
	{
	cfg_parser->errors++;
	fprintf(stderr, "%s:%d: error: ", cfg_parser->filename,
	cfg_parser->line);
	vfprintf(stderr, fmt, args);
	fprintf(stderr, "\n");
	}

	/** print error with file and line number */
	void ub_c_error_msg(const char* fmt, ...)
	{
	va_list args;
	va_start(args, fmt);
	ub_c_error_va_list(fmt, args);
	va_end(args);
	}

	void ub_c_error(const char *str)
	{
	cfg_parser->errors++;
	fprintf(stderr, "%s:%d: error: %s\n", cfg_parser->filename,
	cfg_parser->line, str);
	}

	int ub_c_wrap(void)
	{
	return 1;
	}

	int cfg_strlist_append(struct config_strlist_head* list, char* item)
	{
	struct config_strlist *s;
	if(!item \|\| !list) {
	free(item);
	return 0;
	}
	s = (struct config_strlist*)calloc(1, sizeof(struct config_strlist));
	if(!s) {
	free(item);
	return 0;
	}
	s->str = item;
	s->next = NULL;
	if(list->last)
	list->last->next = s;
	else
	list->first = s;
	list->last = s;
	return 1;
	}

	int
	cfg_region_strlist_insert(struct regional* region,
	struct config_strlist** head, char* item)
	{
	struct config_strlist *s;
	if(!item \|\| !head)
	return 0;
	s = (struct config_strlist*)regional_alloc_zero(region,
	sizeof(struct config_strlist));
	if(!s)
	return 0;
	s->str = item;
	s->next = *head;
	*head = s;
	return 1;
	}

	struct config_strlist*
	cfg_strlist_find(struct config_strlist* head, const char *item)
	{
	struct config_strlist *s = head;
	if(!head){
	return NULL;
	}
	while(s) {
	if(strcmp(s->str, item) == 0) {
	return s;
	}
	s = s->next;
	}
	return NULL;
	}

	int
	cfg_strlist_insert(struct config_strlist** head, char* item)
	{
	struct config_strlist *s;
	if(!item \|\| !head) {
	free(item);
	return 0;
	}
	s = (struct config_strlist*)calloc(1, sizeof(struct config_strlist));
	if(!s) {
	free(item);
	return 0;
	}
	s->str = item;
	s->next = *head;
	*head = s;
	return 1;
	}

	int
	cfg_str2list_insert(struct config_str2list** head, char* item, char* i2)
	{
	struct config_str2list *s;
	if(!item \|\| !i2 \|\| !head) {
	free(item);
	free(i2);
	return 0;
	}
	s = (struct config_str2list*)calloc(1, sizeof(struct config_str2list));
	if(!s) {
	free(item);
	free(i2);
	return 0;
	}
	s->str = item;
	s->str2 = i2;
	s->next = *head;
	*head = s;
	return 1;
	}

	int
	cfg_str3list_insert(struct config_str3list** head, char* item, char* i2,
	char* i3)
	{
	struct config_str3list *s;
	if(!item \|\| !i2 \|\| !i3 \|\| !head)
	return 0;
	s = (struct config_str3list*)calloc(1, sizeof(struct config_str3list));
	if(!s)
	return 0;
	s->str = item;
	s->str2 = i2;
	s->str3 = i3;
	s->next = *head;
	*head = s;
	return 1;
	}

	int
	cfg_strbytelist_insert(struct config_strbytelist** head, char* item,
	uint8_t* i2, size_t i2len)
	{
	struct config_strbytelist* s;
	if(!item \|\| !i2 \|\| !head)
	return 0;
	s = (struct config_strbytelist)calloc(1, sizeof(s));
	if(!s)
	return 0;
	s->str = item;
	s->str2 = i2;
	s->str2len = i2len;
	s->next = *head;
	*head = s;
	return 1;
	}

	time_t
	cfg_convert_timeval(const char* str)
	{
	time_t t;
	struct tm tm;
	memset(&tm, 0, sizeof(tm));
	if(strlen(str) < 14)
	return 0;
	if(sscanf(str, "%4d%2d%2d%2d%2d%2d", &tm.tm_year, &tm.tm_mon,
	&tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6)
	return 0;
	tm.tm_year -= 1900;
	tm.tm_mon--;
	/* Check values */
	if (tm.tm_year < 70) return 0;
	if (tm.tm_mon < 0 \|\| tm.tm_mon > 11) return 0;
	if (tm.tm_mday < 1 \|\| tm.tm_mday > 31) return 0;
	if (tm.tm_hour < 0 \|\| tm.tm_hour > 23) return 0;
	if (tm.tm_min < 0 \|\| tm.tm_min > 59) return 0;
	if (tm.tm_sec < 0 \|\| tm.tm_sec > 59) return 0;
	/* call ldns conversion function */
	t = sldns_mktime_from_utc(&tm);
	return t;
	}

	int
	cfg_count_numbers(const char* s)
	{
	/* format ::= (sp num)+ sp */
	/* num ::= [-](0-9)+ */
	/* sp ::= (space\|tab)* */
	int num = 0;
	while(*s) {
	while(s && isspace((unsigned char)s))
	s++;
	if(!s) / end of string */
	break;
	if(*s == '-')
	s++;
	if(!s) / only - not allowed */
	return 0;
	if(!isdigit((unsigned char)s)) / bad character */
	return 0;
	while(s && isdigit((unsigned char)s))
	s++;
	num++;
	}
	return num;
	}

	/** all digit number */
	static int isalldigit(const char* str, size_t l)
	{
	size_t i;
	for(i=0; i<l; i++)
	if(!isdigit((unsigned char)str[i]))
	return 0;
	return 1;
	}

	int
	cfg_parse_memsize(const char* str, size_t* res)
	{
	size_t len;
	size_t mult = 1;
	if(!str \|\| (len=(size_t)strlen(str)) == 0) {
	log_err("not a size: '%s'", str);
	return 0;
	}
	if(isalldigit(str, len)) {
	*res = (size_t)atol(str);
	return 1;
	}
	/* check appended num */
	while(len>0 && str[len-1]==' ')
	len--;
	if(len > 1 && str[len-1] == 'b')
	len--;
	else if(len > 1 && str[len-1] == 'B')
	len--;

	if(len > 1 && tolower((unsigned char)str[len-1]) == 'g')
	mult = 102410241024;
	else if(len > 1 && tolower((unsigned char)str[len-1]) == 'm')
	mult = 1024*1024;
	else if(len > 1 && tolower((unsigned char)str[len-1]) == 'k')
	mult = 1024;
	else if(len > 0 && isdigit((unsigned char)str[len-1]))
	mult = 1;
	else {
	log_err("unknown size specifier: '%s'", str);
	return 0;
	}
	while(len>1 && str[len-2]==' ')
	len--;

	if(!isalldigit(str, len-1)) {
	log_err("unknown size specifier: '%s'", str);
	return 0;
	}
	res = ((size_t)atol(str)) mult;
	return 1;
	}

	int
	find_tag_id(struct config_file* cfg, const char* tag)
	{
	int i;
	for(i=0; i<cfg->num_tags; i++) {
	if(strcmp(cfg->tagname[i], tag) == 0)
	return i;
	}
	return -1;
	}

	int
	config_add_tag(struct config_file* cfg, const char* tag)
	{
	char** newarray;
	char* newtag;
	if(find_tag_id(cfg, tag) != -1)
	return 1; /* nothing to do */
	newarray = (char*)malloc(sizeof(char)*(cfg->num_tags+1));
	if(!newarray)
	return 0;
	newtag = strdup(tag);
	if(!newtag) {
	free(newarray);
	return 0;
	}
	if(cfg->tagname) {
	memcpy(newarray, cfg->tagname, sizeof(char)cfg->num_tags);
	free(cfg->tagname);
	}
	newarray[cfg->num_tags++] = newtag;
	cfg->tagname = newarray;
	return 1;
	}

	/** set a bit in a bit array */
	static void
	cfg_set_bit(uint8_t* bitlist, size_t len, int id)
	{
	int pos = id/8;
	log_assert((size_t)pos < len);
	(void)len;
	bitlist[pos] \|= 1<<(id%8);
	}

	uint8_t* config_parse_taglist(struct config_file* cfg, char* str,
	size_t* listlen)
	{
	uint8_t* taglist = NULL;
	size_t len = 0;
	char* p, *s;

	/* allocate */
	if(cfg->num_tags == 0) {
	log_err("parse taglist, but no tags defined");
	return 0;
	}
	len = (size_t)(cfg->num_tags+7)/8;
	taglist = calloc(1, len);
	if(!taglist) {
	log_err("out of memory");
	return 0;
	}

	/* parse */
	s = str;
	while((p=strsep(&s, " \t\n")) != NULL) {
	if(*p) {
	int id = find_tag_id(cfg, p);
	/* set this bit in the bitlist */
	if(id == -1) {
	log_err("unknown tag: %s", p);
	free(taglist);
	return 0;
	}
	cfg_set_bit(taglist, len, id);
	}
	}

	*listlen = len;
	return taglist;
	}

	char* config_taglist2str(struct config_file* cfg, uint8_t* taglist,
	size_t taglen)
	{
	char buf[10240];
	size_t i, j, len = 0;
	buf[0] = 0;
	for(i=0; i<taglen; i++) {
	if(taglist[i] == 0)
	continue;
	for(j=0; j<8; j++) {
	if((taglist[i] & (1<<j)) != 0) {
	size_t id = i*8 + j;
	snprintf(buf+len, sizeof(buf)-len, "%s%s",
	(len==0?"":" "), cfg->tagname[id]);
	len += strlen(buf+len);
	}
	}
	}
	return strdup(buf);
	}

	int taglist_intersect(uint8_t* list1, size_t list1len, uint8_t* list2,
	size_t list2len)
	{
	size_t i;
	if(!list1 \|\| !list2)
	return 0;
	for(i=0; i<list1len && i<list2len; i++) {
	if((list1[i] & list2[i]) != 0)
	return 1;
	}
	return 0;
	}

	void
	config_apply(struct config_file* config)
	{
	MAX_TTL = (time_t)config->max_ttl;
	MIN_TTL = (time_t)config->min_ttl;
	SERVE_EXPIRED_TTL = (time_t)config->serve_expired_ttl;
	MAX_NEG_TTL = (time_t)config->max_negative_ttl;
	RTT_MIN_TIMEOUT = config->infra_cache_min_rtt;
	EDNS_ADVERTISED_SIZE = (uint16_t)config->edns_buffer_size;
	MINIMAL_RESPONSES = config->minimal_responses;
	RRSET_ROUNDROBIN = config->rrset_roundrobin;
	+ LOG_TAG_QUERYREPLY = config->log_tag_queryreply;
	+ UNKNOWN_SERVER_NICENESS = config->unknown_server_time_limit;
	log_set_time_asc(config->log_time_ascii);
	autr_permit_small_holddown = config->permit_small_holddown;
	+ stream_wait_max = config->stream_wait_size;
	}

	void config_lookup_uid(struct config_file* cfg)
	{
	#ifdef HAVE_GETPWNAM
	/* translate username into uid and gid */
	if(cfg->username && cfg->username[0]) {
	struct passwd *pwd;
	if((pwd = getpwnam(cfg->username)) != NULL) {
	cfg_uid = pwd->pw_uid;
	cfg_gid = pwd->pw_gid;
	}
	}
	#else
	(void)cfg;
	#endif
	}

	/**
	* Calculate string length of full pathname in original filesys
	* @param fname: the path name to convert.
	* Must not be null or empty.
	* @param cfg: config struct for chroot and chdir (if set).
	* @param use_chdir: if false, only chroot is applied.
	* @return length of string.
	* remember to allocate one more for 0 at end in mallocs.
	*/
	static size_t
	strlen_after_chroot(const char* fname, struct config_file* cfg, int use_chdir)
	{
	size_t len = 0;
	int slashit = 0;
	if(cfg->chrootdir && cfg->chrootdir[0] &&
	strncmp(cfg->chrootdir, fname, strlen(cfg->chrootdir)) == 0) {
	/* already full pathname, return it */
	return strlen(fname);
	}
	/* chroot */
	if(cfg->chrootdir && cfg->chrootdir[0]) {
	/* start with chrootdir */
	len += strlen(cfg->chrootdir);
	slashit = 1;
	}
	/* chdir */
	#ifdef UB_ON_WINDOWS
	if(fname[0] != 0 && fname[1] == ':') {
	/* full path, no chdir */
	} else
	#endif
	if(fname[0] == '/' \|\| !use_chdir) {
	/* full path, no chdir */
	} else if(cfg->directory && cfg->directory[0]) {
	/* prepend chdir */
	if(slashit && cfg->directory[0] != '/')
	len++;
	if(cfg->chrootdir && cfg->chrootdir[0] &&
	strncmp(cfg->chrootdir, cfg->directory,
	strlen(cfg->chrootdir)) == 0)
	len += strlen(cfg->directory)-strlen(cfg->chrootdir);
	else len += strlen(cfg->directory);
	slashit = 1;
	}
	/* fname */
	if(slashit && fname[0] != '/')
	len++;
	len += strlen(fname);
	return len;
	}

	char*
	fname_after_chroot(const char* fname, struct config_file* cfg, int use_chdir)
	{
	size_t len = strlen_after_chroot(fname, cfg, use_chdir)+1;
	int slashit = 0;
	char* buf = (char*)malloc(len);
	if(!buf)
	return NULL;
	buf[0] = 0;
	/* is fname already in chroot ? */
	if(cfg->chrootdir && cfg->chrootdir[0] &&
	strncmp(cfg->chrootdir, fname, strlen(cfg->chrootdir)) == 0) {
	/* already full pathname, return it */
	(void)strlcpy(buf, fname, len);
	buf[len-1] = 0;
	return buf;
	}
	/* chroot */
	if(cfg->chrootdir && cfg->chrootdir[0]) {
	/* start with chrootdir */
	(void)strlcpy(buf, cfg->chrootdir, len);
	slashit = 1;
	}
	#ifdef UB_ON_WINDOWS
	if(fname[0] != 0 && fname[1] == ':') {
	/* full path, no chdir */
	} else
	#endif
	/* chdir */
	if(fname[0] == '/' \|\| !use_chdir) {
	/* full path, no chdir */
	} else if(cfg->directory && cfg->directory[0]) {
	/* prepend chdir */
	if(slashit && cfg->directory[0] != '/')
	(void)strlcat(buf, "/", len);
	/* is the directory already in the chroot? */
	if(cfg->chrootdir && cfg->chrootdir[0] &&
	strncmp(cfg->chrootdir, cfg->directory,
	strlen(cfg->chrootdir)) == 0)
	(void)strlcat(buf, cfg->directory+strlen(cfg->chrootdir),
	len);
	else (void)strlcat(buf, cfg->directory, len);
	slashit = 1;
	}
	/* fname */
	if(slashit && fname[0] != '/')
	(void)strlcat(buf, "/", len);
	(void)strlcat(buf, fname, len);
	buf[len-1] = 0;
	return buf;
	}

	/** return next space character in string */
	static char* next_space_pos(const char* str)
	{
	char* sp = strchr(str, ' ');
	char* tab = strchr(str, '\t');
	if(!tab && !sp)
	return NULL;
	if(!sp) return tab;
	if(!tab) return sp;
	return (sp<tab)?sp:tab;
	}

	/** return last space character in string */
	static char* last_space_pos(const char* str)
	{
	char* sp = strrchr(str, ' ');
	char* tab = strrchr(str, '\t');
	if(!tab && !sp)
	return NULL;
	if(!sp) return tab;
	if(!tab) return sp;
	return (sp>tab)?sp:tab;
	}

	int
	cfg_parse_local_zone(struct config_file* cfg, const char* val)
	{
	const char type, name_end, *name;
	char buf[256];

	/* parse it as: [zone_name] [between stuff] [zone_type] */
	name = val;
	while(name && isspace((unsigned char)name))
	name++;
	if(!*name) {
	log_err("syntax error: too short: %s", val);
	return 0;
	}
	name_end = next_space_pos(name);
	if(!name_end \|\| !*name_end) {
	log_err("syntax error: expected zone type: %s", val);
	return 0;
	}
	if (name_end - name > 255) {
	log_err("syntax error: bad zone name: %s", val);
	return 0;
	}
	(void)strlcpy(buf, name, sizeof(buf));
	buf[name_end-name] = '\0';

	type = last_space_pos(name_end);
	while(type && type && isspace((unsigned char)type))
	type++;
	if(!type \|\| !*type) {
	log_err("syntax error: expected zone type: %s", val);
	return 0;
	}

	if(strcmp(type, "nodefault")==0) {
	return cfg_strlist_insert(&cfg->local_zones_nodefault,
	strdup(name));
	} else {
	return cfg_str2list_insert(&cfg->local_zones, strdup(buf),
	strdup(type));
	}
	}

	char* cfg_ptr_reverse(char* str)
	{
	char* ip, *ip_end;
	char* name;
	char* result;
	char buf[1024];
	struct sockaddr_storage addr;
	socklen_t addrlen;

	/* parse it as: [IP] [between stuff] [name] */
	ip = str;
	while(ip && isspace((unsigned char)ip))
	ip++;
	if(!*ip) {
	log_err("syntax error: too short: %s", str);
	return NULL;
	}
	ip_end = next_space_pos(ip);
	if(!ip_end \|\| !*ip_end) {
	log_err("syntax error: expected name: %s", str);
	return NULL;
	}

	name = last_space_pos(ip_end);
	if(!name \|\| !*name) {
	log_err("syntax error: expected name: %s", str);
	return NULL;
	}

	sscanf(ip, "%100s", buf);
	buf[sizeof(buf)-1]=0;

	if(!ipstrtoaddr(buf, UNBOUND_DNS_PORT, &addr, &addrlen)) {
	log_err("syntax error: cannot parse address: %s", str);
	return NULL;
	}

	/* reverse IPv4:
	* ddd.ddd.ddd.ddd.in-addr-arpa.
	* IPv6: (h.){32}.ip6.arpa. */

	if(addr_is_ip6(&addr, addrlen)) {
	uint8_t ad[16];
	const char* hex = "0123456789abcdef";
	char *p = buf;
	int i;
	memmove(ad, &((struct sockaddr_in6*)&addr)->sin6_addr,
	sizeof(ad));
	for(i=15; i>=0; i--) {
	uint8_t b = ad[i];
	*p++ = hex[ (b&0x0f) ];
	*p++ = '.';
	*p++ = hex[ (b&0xf0) >> 4 ];
	*p++ = '.';
	}
	snprintf(buf+164, sizeof(buf)-164, "ip6.arpa. ");
	} else {
	uint8_t ad[4];
	memmove(ad, &((struct sockaddr_in*)&addr)->sin_addr,
	sizeof(ad));
	snprintf(buf, sizeof(buf), "%u.%u.%u.%u.in-addr.arpa. ",
	(unsigned)ad[3], (unsigned)ad[2],
	(unsigned)ad[1], (unsigned)ad[0]);
	}

	/* printed the reverse address, now the between goop and name on end */
	while(ip_end && isspace((unsigned char)ip_end))
	ip_end++;
	if(name>ip_end) {
	snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), "%.*s",
	(int)(name-ip_end), ip_end);
	}
	snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), " PTR %s", name);

	result = strdup(buf);
	if(!result) {
	log_err("out of memory parsing %s", str);
	return NULL;
	}
	return result;
	}

	#ifdef UB_ON_WINDOWS
	char*
	w_lookup_reg_str(const char* key, const char* name)
	{
	HKEY hk = NULL;
	DWORD type = 0;
	BYTE buf[1024];
	DWORD len = (DWORD)sizeof(buf);
	LONG ret;
	char* result = NULL;
	ret = RegOpenKeyEx(HKEY_LOCAL_MACHINE, key, 0, KEY_READ, &hk);
	if(ret == ERROR_FILE_NOT_FOUND)
	return NULL; /* key does not exist */
	else if(ret != ERROR_SUCCESS) {
	log_err("RegOpenKeyEx failed");
	return NULL;
	}
	ret = RegQueryValueEx(hk, (LPCTSTR)name, 0, &type, buf, &len);
	if(RegCloseKey(hk))
	log_err("RegCloseKey");
	if(ret == ERROR_FILE_NOT_FOUND)
	return NULL; /* name does not exist */
	else if(ret != ERROR_SUCCESS) {
	log_err("RegQueryValueEx failed");
	return NULL;
	}
	if(type == REG_SZ \|\| type == REG_MULTI_SZ \|\| type == REG_EXPAND_SZ) {
	buf[sizeof(buf)-1] = 0;
	buf[sizeof(buf)-2] = 0; /* for multi_sz */
	result = strdup((char*)buf);
	if(!result) log_err("out of memory");
	}
	return result;
	}

	void w_config_adjust_directory(struct config_file* cfg)
	{
	if(cfg->directory && cfg->directory[0]) {
	TCHAR dirbuf[2*MAX_PATH+4];
	if(strcmp(cfg->directory, "%EXECUTABLE%") == 0) {
	/* get executable path, and if that contains
	* directories, snip off the filename part */
	dirbuf[0] = 0;
	if(!GetModuleFileName(NULL, dirbuf, MAX_PATH))
	log_err("could not GetModuleFileName");
	if(strrchr(dirbuf, '\\')) {
	(strrchr(dirbuf, '\\'))[0] = 0;
	} else log_err("GetModuleFileName had no path");
	if(dirbuf[0]) {
	/* adjust directory for later lookups to work*/
	free(cfg->directory);
	cfg->directory = memdup(dirbuf, strlen(dirbuf)+1);
	}
	}
	}
	}
	#endif /* UB_ON_WINDOWS */

	void errinf(struct module_qstate* qstate, const char* str)
	{
	struct config_strlist* p;
	if((qstate->env->cfg->val_log_level < 2 && !qstate->env->cfg->log_servfail) \|\| !str)
	return;
	p = (struct config_strlist)regional_alloc(qstate->region, sizeof(p));
	if(!p) {
	log_err("malloc failure in validator-error-info string");
	return;
	}
	p->next = NULL;
	p->str = regional_strdup(qstate->region, str);
	if(!p->str) {
	log_err("malloc failure in validator-error-info string");
	return;
	}
	/* add at end */
	if(qstate->errinf) {
	struct config_strlist* q = qstate->errinf;
	while(q->next)
	q = q->next;
	q->next = p;
	} else qstate->errinf = p;
	}

	void errinf_origin(struct module_qstate* qstate, struct sock_list *origin)
	{
	struct sock_list* p;
	if(qstate->env->cfg->val_log_level < 2 && !qstate->env->cfg->log_servfail)
	return;
	for(p=origin; p; p=p->next) {
	char buf[256];
	if(p == origin)
	snprintf(buf, sizeof(buf), "from ");
	else snprintf(buf, sizeof(buf), "and ");
	if(p->len == 0)
	snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf),
	"cache");
	else
	addr_to_str(&p->addr, p->len, buf+strlen(buf),
	sizeof(buf)-strlen(buf));
	errinf(qstate, buf);
	}
	}

	char* errinf_to_str_bogus(struct module_qstate* qstate)
	{
	char buf[20480];
	char* p = buf;
	size_t left = sizeof(buf);
	struct config_strlist* s;
	char dname[LDNS_MAX_DOMAINLEN+1];
	char t[16], c[16];
	sldns_wire2str_type_buf(qstate->qinfo.qtype, t, sizeof(t));
	sldns_wire2str_class_buf(qstate->qinfo.qclass, c, sizeof(c));
	dname_str(qstate->qinfo.qname, dname);
	snprintf(p, left, "validation failure <%s %s %s>:", dname, t, c);
	left -= strlen(p); p += strlen(p);
	if(!qstate->errinf)
	snprintf(p, left, " misc failure");
	else for(s=qstate->errinf; s; s=s->next) {
	snprintf(p, left, " %s", s->str);
	left -= strlen(p); p += strlen(p);
	}
	p = strdup(buf);
	if(!p)
	log_err("malloc failure in errinf_to_str");
	return p;
	}

	char* errinf_to_str_servfail(struct module_qstate* qstate)
	{
	char buf[20480];
	char* p = buf;
	size_t left = sizeof(buf);
	struct config_strlist* s;
	char dname[LDNS_MAX_DOMAINLEN+1];
	char t[16], c[16];
	sldns_wire2str_type_buf(qstate->qinfo.qtype, t, sizeof(t));
	sldns_wire2str_class_buf(qstate->qinfo.qclass, c, sizeof(c));
	dname_str(qstate->qinfo.qname, dname);
	snprintf(p, left, "SERVFAIL <%s %s %s>:", dname, t, c);
	left -= strlen(p); p += strlen(p);
	if(!qstate->errinf)
	snprintf(p, left, " misc failure");
	else for(s=qstate->errinf; s; s=s->next) {
	snprintf(p, left, " %s", s->str);
	left -= strlen(p); p += strlen(p);
	}
	p = strdup(buf);
	if(!p)
	log_err("malloc failure in errinf_to_str");
	return p;
	}

	void errinf_rrset(struct module_qstate* qstate, struct ub_packed_rrset_key *rr)
	{
	char buf[1024];
	char dname[LDNS_MAX_DOMAINLEN+1];
	char t[16], c[16];
	if((qstate->env->cfg->val_log_level < 2 && !qstate->env->cfg->log_servfail) \|\| !rr)
	return;
	sldns_wire2str_type_buf(ntohs(rr->rk.type), t, sizeof(t));
	sldns_wire2str_class_buf(ntohs(rr->rk.rrset_class), c, sizeof(c));
	dname_str(rr->rk.dname, dname);
	snprintf(buf, sizeof(buf), "for <%s %s %s>", dname, t, c);
	errinf(qstate, buf);
	}

	void errinf_dname(struct module_qstate* qstate, const char* str, uint8_t* dname)
	{
	char b[1024];
	char buf[LDNS_MAX_DOMAINLEN+1];
	if((qstate->env->cfg->val_log_level < 2 && !qstate->env->cfg->log_servfail) \|\| !str \|\| !dname)
	return;
	dname_str(dname, buf);
	snprintf(b, sizeof(b), "%s %s", str, buf);
	errinf(qstate, b);
	}

	int options_remote_is_address(struct config_file* cfg)
	{
	if(!cfg->remote_control_enable) return 0;
	if(!cfg->control_ifs.first) return 1;
	if(!cfg->control_ifs.first->str) return 1;
	if(cfg->control_ifs.first->str[0] == 0) return 1;
	return (cfg->control_ifs.first->str[0] != '/');
	}
	Index: head/contrib/unbound/util/config_file.h
	===================================================================
	--- head/contrib/unbound/util/config_file.h (revision 349719)
	+++ head/contrib/unbound/util/config_file.h (revision 349720)
	@@ -1,1159 +1,1183 @@
	/*
	* util/config_file.h - reads and stores the config file for unbound.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains functions for the config file.
	*/

	#ifndef UTIL_CONFIG_FILE_H
	#define UTIL_CONFIG_FILE_H
	struct config_stub;
	struct config_auth;
	struct config_view;
	struct config_strlist;
	struct config_str2list;
	struct config_str3list;
	struct config_strbytelist;
	struct module_qstate;
	struct sock_list;
	struct ub_packed_rrset_key;
	struct regional;

	/** List head for strlist processing, used for append operation. */
	struct config_strlist_head {
	/** first in list of text items */
	struct config_strlist* first;
	/** last in list of text items */
	struct config_strlist* last;
	};

	/**
	* The configuration options.
	* Strings are malloced.
	*/
	struct config_file {
	/** verbosity level as specified in the config file */
	int verbosity;

	/** statistics interval (in seconds) */
	int stat_interval;
	/** if false, statistics values are reset after printing them */
	int stat_cumulative;
	/** if true, the statistics are kept in greater detail */
	int stat_extended;

	/** number of threads to create */
	int num_threads;

	/** port on which queries are answered. */
	int port;
	/** do ip4 query support. */
	int do_ip4;
	/** do ip6 query support. */
	int do_ip6;
	/** prefer ip6 upstream queries. */
	int prefer_ip6;
	/** do udp query support. */
	int do_udp;
	/** do tcp query support. */
	int do_tcp;
	/** tcp upstream queries (no UDP upstream queries) */
	int tcp_upstream;
	/** udp upstream enabled when no UDP downstream is enabled (do_udp no)*/
	int udp_upstream_without_downstream;
	/** maximum segment size of tcp socket which queries are answered */
	int tcp_mss;
	/** maximum segment size of tcp socket for outgoing queries */
	int outgoing_tcp_mss;
	/** tcp idle timeout, in msec */
	int tcp_idle_timeout;
	/** do edns tcp keepalive */
	int do_tcp_keepalive;
	/** tcp keepalive timeout, in msec */
	int tcp_keepalive_timeout;

	/** private key file for dnstcp-ssl service (enabled if not NULL) */
	char* ssl_service_key;
	/** public key file for dnstcp-ssl service */
	char* ssl_service_pem;
	/** port on which to provide ssl service */
	int ssl_port;
	/** if outgoing tcp connections use SSL */
	int ssl_upstream;
	/** cert bundle for outgoing connections */
	char* tls_cert_bundle;
	/** should the system certificate store get added to the cert bundle */
	int tls_win_cert;
	/** additional tls ports */
	struct config_strlist* tls_additional_port;
	+ /** secret key used to encrypt and decrypt TLS session ticket */
	+ struct config_strlist_head tls_session_ticket_keys;
	+ /** TLS ciphers */
	+ char* tls_ciphers;
	+ /** TLS chiphersuites (TLSv1.3) */
	+ char* tls_ciphersuites;

	/** outgoing port range number of ports (per thread) */
	int outgoing_num_ports;
	/** number of outgoing tcp buffers per (per thread) */
	size_t outgoing_num_tcp;
	/** number of incoming tcp buffers per (per thread) */
	size_t incoming_num_tcp;
	/** allowed udp port numbers, array with 0 if not allowed */
	int* outgoing_avail_ports;

	/** EDNS buffer size to use */
	size_t edns_buffer_size;
	+ /** size of the stream wait buffers, max */
	+ size_t stream_wait_size;
	/** number of bytes buffer size for DNS messages */
	size_t msg_buffer_size;
	/** size of the message cache */
	size_t msg_cache_size;
	/** slabs in the message cache. */
	size_t msg_cache_slabs;
	/** number of queries every thread can service */
	size_t num_queries_per_thread;
	/** number of msec to wait before items can be jostled out */
	size_t jostle_time;
	/** size of the rrset cache */
	size_t rrset_cache_size;
	/** slabs in the rrset cache */
	size_t rrset_cache_slabs;
	/** host cache ttl in seconds */
	int host_ttl;
	/** number of slabs in the infra host cache */
	size_t infra_cache_slabs;
	/** max number of hosts in the infra cache */
	size_t infra_cache_numhosts;
	/** min value for infra cache rtt */
	int infra_cache_min_rtt;
	/** delay close of udp-timeouted ports, if 0 no delayclose. in msec */
	int delay_close;

	/** the target fetch policy for the iterator */
	char* target_fetch_policy;
	- /** percent10, how many times in 1000 to pick low rtt destinations /
	- int low_rtt_permil;
	- /** what time in msec is a low rtt destination */
	- int low_rtt;
	+ /** percent*10, how many times in 1000 to pick from the fastest
	+ * destinations */
	+ int fast_server_permil;
	+ /** number of fastest server to select from */
	+ size_t fast_server_num;

	/** automatic interface for incoming messages. Uses ipv6 remapping,
	* and recvmsg/sendmsg ancillary data to detect interfaces, boolean */
	int if_automatic;
	/** SO_RCVBUF size to set on port 53 UDP socket */
	size_t so_rcvbuf;
	/** SO_SNDBUF size to set on port 53 UDP socket */
	size_t so_sndbuf;
	/** SO_REUSEPORT requested on port 53 sockets */
	int so_reuseport;
	/** IP_TRANSPARENT socket option requested on port 53 sockets */
	int ip_transparent;
	/** IP_FREEBIND socket option request on port 53 sockets */
	int ip_freebind;

	/** number of interfaces to open. If 0 default all interfaces. */
	int num_ifs;
	/** interface description strings (IP addresses) */
	char **ifs;

	/** number of outgoing interfaces to open.
	* If 0 default all interfaces. */
	int num_out_ifs;
	/** outgoing interface description strings (IP addresses) */
	char **out_ifs;

	/** the root hints */
	struct config_strlist* root_hints;
	/** the stub definitions, linked list */
	struct config_stub* stubs;
	/** the forward zone definitions, linked list */
	struct config_stub* forwards;
	/** the auth zone definitions, linked list */
	struct config_auth* auths;
	/** the views definitions, linked list */
	struct config_view* views;
	/** list of donotquery addresses, linked list */
	struct config_strlist* donotqueryaddrs;
	#ifdef CLIENT_SUBNET
	/** list of servers we send edns-client-subnet option to and
	* accept option from, linked list */
	struct config_strlist* client_subnet;
	/** list of zones we send edns-client-subnet option for */
	struct config_strlist* client_subnet_zone;
	/** opcode assigned by IANA for edns0-client-subnet option */
	uint16_t client_subnet_opcode;
	/** Do not check whitelist if incoming query contains an ECS record */
	int client_subnet_always_forward;
	/** Subnet length we are willing to give up privacy for */
	uint8_t max_client_subnet_ipv4;
	uint8_t max_client_subnet_ipv6;
	+ /** Minimum subnet length we are willing to answer */
	+ uint8_t min_client_subnet_ipv4;
	+ uint8_t min_client_subnet_ipv6;
	+ /** Max number of nodes in the ECS radix tree */
	+ uint32_t max_ecs_tree_size_ipv4;
	+ uint32_t max_ecs_tree_size_ipv6;
	#endif
	/** list of access control entries, linked list */
	struct config_str2list* acls;
	/** use default localhost donotqueryaddr entries */
	int donotquery_localhost;

	/** list of tcp connection limitss, linked list */
	struct config_str2list* tcp_connection_limits;

	/** harden against very small edns buffer sizes */
	int harden_short_bufsize;
	/** harden against very large query sizes */
	int harden_large_queries;
	/** harden against spoofed glue (out of zone data) */
	int harden_glue;
	/** harden against receiving no DNSSEC data for trust anchor */
	int harden_dnssec_stripped;
	/** harden against queries that fall under known nxdomain names */
	int harden_below_nxdomain;
	/** harden the referral path, query for NS,A,AAAA and validate */
	int harden_referral_path;
	/** harden against algorithm downgrade */
	int harden_algo_downgrade;
	/** use 0x20 bits in query as random ID bits */
	int use_caps_bits_for_id;
	/** 0x20 whitelist, domains that do not use capsforid */
	struct config_strlist* caps_whitelist;
	/** strip away these private addrs from answers, no DNS Rebinding */
	struct config_strlist* private_address;
	/** allow domain (and subdomains) to use private address space */
	struct config_strlist* private_domain;
	/** what threshold for unwanted action. */
	size_t unwanted_threshold;
	/** the number of seconds maximal TTL used for RRsets and messages */
	int max_ttl;
	/** the number of seconds minimum TTL used for RRsets and messages */
	int min_ttl;
	/** the number of seconds maximal negative TTL for SOA in auth */
	int max_negative_ttl;
	/** if prefetching of messages should be performed. */
	int prefetch;
	/** if prefetching of DNSKEYs should be performed. */
	int prefetch_key;
	+ /** deny queries of type ANY with an empty answer */
	+ int deny_any;

	/** chrootdir, if not "" or chroot will be done */
	char* chrootdir;
	/** username to change to, if not "". */
	char* username;
	/** working directory */
	char* directory;
	/** filename to log to. */
	char* logfile;
	/** pidfile to write pid to. */
	char* pidfile;

	/** should log messages be sent to syslogd */
	int use_syslog;
	/** log timestamp in ascii UTC */
	int log_time_ascii;
	/** log queries with one line per query */
	int log_queries;
	/** log replies with one line per reply */
	int log_replies;
	+ /** tag log_queries and log_replies for filtering */
	+ int log_tag_queryreply;
	/ log every local-zone hit /
	int log_local_actions;
	/** log servfails with a reason */
	int log_servfail;
	/** log identity to report */
	char* log_identity;

	/** do not report identity (id.server, hostname.bind) */
	int hide_identity;
	/** do not report version (version.server, version.bind) */
	int hide_version;
	/** do not report trustanchor (trustanchor.unbound) */
	int hide_trustanchor;
	/** identity, hostname is returned if "". */
	char* identity;
	/** version, package version returned if "". */
	char* version;

	/** the module configuration string */
	char* module_conf;

	/** files with trusted DS and DNSKEYs in zonefile format, list */
	struct config_strlist* trust_anchor_file_list;
	/** list of trustanchor keys, linked list */
	struct config_strlist* trust_anchor_list;
	/** files with 5011 autotrust tracked keys */
	struct config_strlist* auto_trust_anchor_file_list;
	/** files with trusted DNSKEYs in named.conf format, list */
	struct config_strlist* trusted_keys_file_list;
	/** DLV anchor file */
	char* dlv_anchor_file;
	/** DLV anchor inline */
	struct config_strlist* dlv_anchor_list;
	/** insecure domain list */
	struct config_strlist* domain_insecure;
	/** send key tag query */
	int trust_anchor_signaling;
	/** enable root key sentinel */
	int root_key_sentinel;

	/** if not 0, this value is the validation date for RRSIGs */
	int32_t val_date_override;
	/** the minimum for signature clock skew */
	int32_t val_sig_skew_min;
	/** the maximum for signature clock skew */
	int32_t val_sig_skew_max;
	/** this value sets the number of seconds before revalidating bogus */
	int bogus_ttl;
	/** should validator clean additional section for secure msgs */
	int val_clean_additional;
	/** log bogus messages by the validator */
	int val_log_level;
	/** squelch val_log_level to log - this is library goes to callback */
	int val_log_squelch;
	/** should validator allow bogus messages to go through */
	int val_permissive_mode;
	/** use cached NSEC records to synthesise (negative) answers */
	int aggressive_nsec;
	/** ignore the CD flag in incoming queries and refuse them bogus data */
	int ignore_cd;
	/** serve expired entries and prefetch them */
	int serve_expired;
	/** serve expired entries until TTL after expiration */
	int serve_expired_ttl;
	/** reset serve expired TTL after failed update attempt */
	int serve_expired_ttl_reset;
	/** nsec3 maximum iterations per key size, string */
	char* val_nsec3_key_iterations;
	/** autotrust add holddown time, in seconds */
	unsigned int add_holddown;
	/** autotrust del holddown time, in seconds */
	unsigned int del_holddown;
	/** autotrust keep_missing time, in seconds. 0 is forever. */
	unsigned int keep_missing;
	/** permit small holddown values, allowing 5011 rollover very fast */
	int permit_small_holddown;

	/** size of the key cache */
	size_t key_cache_size;
	/** slabs in the key cache. */
	size_t key_cache_slabs;
	/** size of the neg cache */
	size_t neg_cache_size;

	/** local zones config */
	struct config_str2list* local_zones;
	/** local zones nodefault list */
	struct config_strlist* local_zones_nodefault;
	/** do not add any default local zone */
	int local_zones_disable_default;
	/** local data RRs configured */
	struct config_strlist* local_data;
	/** local zone override types per netblock */
	struct config_str3list* local_zone_overrides;
	/** unblock lan zones (reverse lookups for AS112 zones) */
	int unblock_lan_zones;
	/** insecure lan zones (don't validate AS112 zones) */
	int insecure_lan_zones;
	/** list of zonename, tagbitlist */
	struct config_strbytelist* local_zone_tags;
	/** list of aclname, tagbitlist */
	struct config_strbytelist* acl_tags;
	/** list of aclname, tagname, localzonetype */
	struct config_str3list* acl_tag_actions;
	/** list of aclname, tagname, redirectdata */
	struct config_str3list* acl_tag_datas;
	/** list of aclname, view*/
	struct config_str2list* acl_view;
	/** list of IP-netblock, tagbitlist */
	struct config_strbytelist* respip_tags;
	/** list of response-driven access control entries, linked list */
	struct config_str2list* respip_actions;
	/** RRs configured for response-driven access controls */
	struct config_str2list* respip_data;
	/** tag list, array with tagname[i] is malloced string */
	char** tagname;
	/** number of items in the taglist */
	int num_tags;

	/** remote control section. enable toggle. */
	int remote_control_enable;
	/** the interfaces the remote control should listen on */
	struct config_strlist_head control_ifs;
	/** if the use-cert option is set */
	int control_use_cert;
	/** port number for the control port */
	int control_port;
	/** private key file for server */
	char* server_key_file;
	/** certificate file for server */
	char* server_cert_file;
	/** private key file for unbound-control */
	char* control_key_file;
	/** certificate file for unbound-control */
	char* control_cert_file;

	/** Python script file */
	char* python_script;

	/** Use systemd socket activation. */
	int use_systemd;

	/** daemonize, i.e. fork into the background. */
	int do_daemonize;

	/* minimal response when positive answer */
	int minimal_responses;

	/* RRSet roundrobin */
	int rrset_roundrobin;

	+ /* wait time for unknown server in msec */
	+ int unknown_server_time_limit;
	+
	/* maximum UDP response size */
	size_t max_udp_size;

	/* DNS64 prefix */
	char* dns64_prefix;

	/* Synthetize all AAAA record despite the presence of an authoritative one */
	int dns64_synthall;
	/** ignore AAAAs for these domain names and use A record anyway */
	struct config_strlist* dns64_ignore_aaaa;

	/** true to enable dnstap support */
	int dnstap;
	/** dnstap socket path */
	char* dnstap_socket_path;
	/** true to send "identity" via dnstap */
	int dnstap_send_identity;
	/** true to send "version" via dnstap */
	int dnstap_send_version;
	/** dnstap "identity", hostname is used if "". */
	char* dnstap_identity;
	/** dnstap "version", package version is used if "". */
	char* dnstap_version;

	/** true to log dnstap RESOLVER_QUERY message events */
	int dnstap_log_resolver_query_messages;
	/** true to log dnstap RESOLVER_RESPONSE message events */
	int dnstap_log_resolver_response_messages;
	/** true to log dnstap CLIENT_QUERY message events */
	int dnstap_log_client_query_messages;
	/** true to log dnstap CLIENT_RESPONSE message events */
	int dnstap_log_client_response_messages;
	/** true to log dnstap FORWARDER_QUERY message events */
	int dnstap_log_forwarder_query_messages;
	/** true to log dnstap FORWARDER_RESPONSE message events */
	int dnstap_log_forwarder_response_messages;

	/** true to disable DNSSEC lameness check in iterator */
	int disable_dnssec_lame_check;

	/** ratelimit for ip addresses. 0 is off, otherwise qps (unless overridden) */
	int ip_ratelimit;
	/** number of slabs for ip_ratelimit cache */
	size_t ip_ratelimit_slabs;
	/** memory size in bytes for ip_ratelimit cache */
	size_t ip_ratelimit_size;
	/** ip_ratelimit factor, 0 blocks all, 10 allows 1/10 of traffic */
	int ip_ratelimit_factor;

	/** ratelimit for domains. 0 is off, otherwise qps (unless overridden) */
	int ratelimit;
	/** number of slabs for ratelimit cache */
	size_t ratelimit_slabs;
	/** memory size in bytes for ratelimit cache */
	size_t ratelimit_size;
	/** ratelimits for domain (exact match) */
	struct config_str2list* ratelimit_for_domain;
	/** ratelimits below domain */
	struct config_str2list* ratelimit_below_domain;
	/** ratelimit factor, 0 blocks all, 10 allows 1/10 of traffic */
	int ratelimit_factor;
	/** minimise outgoing QNAME and hide original QTYPE if possible */
	int qname_minimisation;
	/** minimise QNAME in strict mode, minimise according to RFC.
	* Do not apply fallback */
	int qname_minimisation_strict;
	/** SHM data - true if shm is enabled */
	int shm_enable;
	/** SHM data - key for the shm */
	int shm_key;

	/** DNSCrypt */
	/** true to enable dnscrypt */
	int dnscrypt;
	/** port on which to provide dnscrypt service */
	int dnscrypt_port;
	/** provider name 2.dnscrypt-cert.example.com */
	char* dnscrypt_provider;
	/** dnscrypt secret keys 1.key */
	struct config_strlist* dnscrypt_secret_key;
	/** dnscrypt provider certs 1.cert */
	struct config_strlist* dnscrypt_provider_cert;
	/** dnscrypt provider certs 1.cert which have been rotated and should not be
	* advertised through DNS's providername TXT record but are required to be
	* able to handle existing traffic using the old cert. */
	struct config_strlist* dnscrypt_provider_cert_rotated;
	/** memory size in bytes for dnscrypt shared secrets cache */
	size_t dnscrypt_shared_secret_cache_size;
	/** number of slabs for dnscrypt shared secrets cache */
	size_t dnscrypt_shared_secret_cache_slabs;
	/** memory size in bytes for dnscrypt nonces cache */
	size_t dnscrypt_nonce_cache_size;
	/** number of slabs for dnscrypt nonces cache */
	size_t dnscrypt_nonce_cache_slabs;
	/** IPsec module */
	#ifdef USE_IPSECMOD
	/** false to bypass the IPsec module */
	int ipsecmod_enabled;
	/** whitelisted domains for ipsecmod */
	struct config_strlist* ipsecmod_whitelist;
	/** path to external hook */
	char* ipsecmod_hook;
	/** true to proceed even with a bogus IPSECKEY */
	int ipsecmod_ignore_bogus;
	/** max TTL for the A/AAAA records that call the hook */
	int ipsecmod_max_ttl;
	/** false to proceed even when ipsecmod_hook fails */
	int ipsecmod_strict;
	#endif

	/* cachedb module */
	#ifdef USE_CACHEDB
	/** backend DB name */
	char* cachedb_backend;
	/** secret seed for hash key calculation */
	char* cachedb_secret;
	#ifdef USE_REDIS
	/** redis server's IP address or host name */
	char* redis_server_host;
	/** redis server's TCP port */
	int redis_server_port;
	/** timeout (in ms) for communication with the redis server */
	int redis_timeout;
	#endif
	#endif
	};

	/** from cfg username, after daemonize setup performed */
	extern uid_t cfg_uid;
	/** from cfg username, after daemonize setup performed */
	extern gid_t cfg_gid;
	/** debug and enable small timeouts */
	extern int autr_permit_small_holddown;
	+/** size (in bytes) of stream wait buffers max */
	+extern size_t stream_wait_max;

	/**
	* Stub config options
	*/
	struct config_stub {
	/** next in list */
	struct config_stub* next;
	/** domain name (in text) of the stub apex domain */
	char* name;
	/** list of stub nameserver hosts (domain name) */
	struct config_strlist* hosts;
	/** list of stub nameserver addresses (IP address) */
	struct config_strlist* addrs;
	/** if stub-prime is set */
	int isprime;
	/** if forward-first is set (failover to without if fails) */
	int isfirst;
	/** use SSL for queries to this stub */
	int ssl_upstream;
	/*** no cache */
	int no_cache;
	};

	/**
	* Auth config options
	*/
	struct config_auth {
	/** next in list */
	struct config_auth* next;
	/** domain name (in text) of the auth apex domain */
	char* name;
	/** list of masters */
	struct config_strlist* masters;
	/** list of urls */
	struct config_strlist* urls;
	/** list of allow-notify */
	struct config_strlist* allow_notify;
	/** zonefile (or NULL) */
	char* zonefile;
	/** provide downstream answers */
	int for_downstream;
	/** provide upstream answers */
	int for_upstream;
	/** fallback to recursion to authorities if zone expired and other
	* reasons perhaps (like, query bogus) */
	int fallback_enabled;
	};

	/**
	* View config options
	*/
	struct config_view {
	/** next in list */
	struct config_view* next;
	/** view name */
	char* name;
	/** local zones */
	struct config_str2list* local_zones;
	/** local data RRs */
	struct config_strlist* local_data;
	/** local zones nodefault list */
	struct config_strlist* local_zones_nodefault;
	/** Fallback to global local_zones when there is no match in the view
	* view specific tree. 1 for yes, 0 for no */
	int isfirst;
	/** predefined actions for particular IP address responses */
	struct config_str2list* respip_actions;
	/** data complementing the 'redirect' response IP actions */
	struct config_str2list* respip_data;
	};

	/**
	* List of strings for config options
	*/
	struct config_strlist {
	/** next item in list */
	struct config_strlist* next;
	/** config option string */
	char* str;
	};

	/**
	* List of two strings for config options
	*/
	struct config_str2list {
	/** next item in list */
	struct config_str2list* next;
	/** first string */
	char* str;
	/** second string */
	char* str2;
	};

	/**
	* List of three strings for config options
	*/
	struct config_str3list {
	/** next item in list */
	struct config_str3list* next;
	/** first string */
	char* str;
	/** second string */
	char* str2;
	/** third string */
	char* str3;
	};


	/**
	* List of string, bytestring for config options
	*/
	struct config_strbytelist {
	/** next item in list */
	struct config_strbytelist* next;
	/** first string */
	char* str;
	/** second bytestring */
	uint8_t* str2;
	size_t str2len;
	};

	/**
	* Create config file structure. Filled with default values.
	* @return: the new structure or NULL on memory error.
	*/
	struct config_file* config_create(void);

	/**
	* Create config file structure for library use. Filled with default values.
	* @return: the new structure or NULL on memory error.
	*/
	struct config_file* config_create_forlib(void);

	/**
	* Read the config file from the specified filename.
	* @param config: where options are stored into, must be freshly created.
	* @param filename: name of configfile. If NULL nothing is done.
	* @param chroot: if not NULL, the chroot dir currently in use (for include).
	* @return: false on error. In that case errno is set, ENOENT means
	* file not found.
	*/
	int config_read(struct config_file* config, const char* filename,
	const char* chroot);

	/**
	* Destroy the config file structure.
	* @param config: to delete.
	*/
	void config_delete(struct config_file* config);

	/**
	* Apply config to global constants; this routine is called in single thread.
	* @param config: to apply. Side effect: global constants change.
	*/
	void config_apply(struct config_file* config);

	/**
	* Find username, sets cfg_uid and cfg_gid.
	* @param config: the config structure.
	*/
	void config_lookup_uid(struct config_file* config);

	/**
	* Set the given keyword to the given value.
	* @param config: where to store config
	* @param option: option name, including the ':' character.
	* @param value: value, this string is copied if needed, or parsed.
	* The caller owns the value string.
	* @return 0 on error (malloc or syntax error).
	*/
	int config_set_option(struct config_file* config, const char* option,
	const char* value);

	/**
	* Call print routine for the given option.
	* @param cfg: config.
	* @param opt: option name without trailing :.
	* This is different from config_set_option.
	* @param func: print func, called as (str, arg) for every data element.
	* @param arg: user argument for print func.
	* @return false if the option name is not supported (syntax error).
	*/
	int config_get_option(struct config_file* cfg, const char* opt,
	void (func)(char,void), void arg);

	/**
	* Get an option and return strlist
	* @param cfg: config file
	* @param opt: option name.
	* @param list: list is returned here. malloced, caller must free it.
	* @return 0=OK, 1=syntax error, 2=malloc failed.
	*/
	int config_get_option_list(struct config_file* cfg, const char* opt,
	struct config_strlist** list);

	/**
	* Get an option and collate results into string
	* @param cfg: config file
	* @param opt: option name.
	* @param str: string. malloced, caller must free it.
	* @return 0=OK, 1=syntax error, 2=malloc failed.
	*/
	int config_get_option_collate(struct config_file* cfg, const char* opt,
	char** str);

	/**
	* function to print to a file, use as func with config_get_option.
	* @param line: text to print. \n appended.
	* @param arg: pass a FILE*, like stdout.
	*/
	void config_print_func(char* line, void* arg);

	/**
	* function to collate the text strings into a strlist_head.
	* @param line: text to append.
	* @param arg: pass a strlist_head structure. zeroed on start.
	*/
	void config_collate_func(char* line, void* arg);

	/**
	* take a strlist_head list and return a malloc string. separated with newline.
	* @param list: strlist first to collate. zeroes return "".
	* @return NULL on malloc failure. Or if malloc failure happened in strlist.
	*/
	char* config_collate_cat(struct config_strlist* list);

	/**
	* Append text at end of list.
	* @param list: list head. zeroed at start.
	* @param item: new item. malloced by caller. if NULL the insertion fails.
	* @return true on success.
	* on fail the item is free()ed.
	*/
	int cfg_strlist_append(struct config_strlist_head* list, char* item);

	/**
	* Find string in strlist.
	* @param head: pointer to strlist head variable.
	* @param item: the item to search for.
	* @return: the element in the list when found, NULL otherwise.
	*/
	struct config_strlist* cfg_strlist_find(struct config_strlist* head,
	const char* item);

	/**
	* Insert string into strlist.
	* @param head: pointer to strlist head variable.
	* @param item: new item. malloced by caller. If NULL the insertion fails.
	* @return: true on success.
	* on fail, the item is free()d.
	*/
	int cfg_strlist_insert(struct config_strlist** head, char* item);

	/** insert with region for allocation. */
	int cfg_region_strlist_insert(struct regional* region,
	struct config_strlist** head, char* item);

	/**
	* Insert string into str2list.
	* @param head: pointer to str2list head variable.
	* @param item: new item. malloced by caller. If NULL the insertion fails.
	* @param i2: 2nd string, malloced by caller. If NULL the insertion fails.
	* @return: true on success.
	* on fail, the item and i2 are free()d.
	*/
	int cfg_str2list_insert(struct config_str2list** head, char* item, char* i2);

	/**
	* Insert string into str3list.
	* @param head: pointer to str3list head variable.
	* @param item: new item. malloced by caller. If NULL the insertion fails.
	* @param i2: 2nd string, malloced by caller. If NULL the insertion fails.
	* @param i3: 3rd string, malloced by caller. If NULL the insertion fails.
	* @return: true on success.
	*/
	int cfg_str3list_insert(struct config_str3list** head, char* item, char* i2,
	char* i3);

	/**
	* Insert string into strbytelist.
	* @param head: pointer to strbytelist head variable.
	* @param item: new item. malloced by caller. If NULL the insertion fails.
	* @param i2: 2nd string, malloced by caller. If NULL the insertion fails.
	* @param i2len: length of the i2 bytestring.
	* @return: true on success.
	*/
	int cfg_strbytelist_insert(struct config_strbytelist** head, char* item,
	uint8_t* i2, size_t i2len);

	/**
	* Find stub in config list, also returns prevptr (for deletion).
	* @param pp: call routine with pointer to a pointer to the start of the list,
	* if the stub is found, on exit, the value contains a pointer to the
	* next pointer that points to the found element (or to the list start
	* pointer if it is the first element).
	* @param nm: name of stub to find.
	* @return: pointer to config_stub if found, or NULL if not found.
	*/
	struct config_stub* cfg_stub_find(struct config_stub*** pp, const char* nm);

	/**
	* Delete items in config string list.
	* @param list: list.
	*/
	void config_delstrlist(struct config_strlist* list);

	/**
	* Delete items in config double string list.
	* @param list: list.
	*/
	void config_deldblstrlist(struct config_str2list* list);

	/**
	* Delete items in config triple string list.
	* @param list: list.
	*/
	void config_deltrplstrlist(struct config_str3list* list);

	/** delete stringbytelist */
	void config_del_strbytelist(struct config_strbytelist* list);

	/**
	* Delete a stub item
	* @param p: stub item
	*/
	void config_delstub(struct config_stub* p);

	/**
	* Delete items in config stub list.
	* @param list: list.
	*/
	void config_delstubs(struct config_stub* list);

	/**
	* Delete an auth item
	* @param p: auth item
	*/
	void config_delauth(struct config_auth* p);

	/**
	* Delete items in config auth list.
	* @param list: list.
	*/
	void config_delauths(struct config_auth* list);

	/**
	* Delete a view item
	* @param p: view item
	*/
	void config_delview(struct config_view* p);

	/**
	* Delete items in config view list.
	* @param list: list.
	*/
	void config_delviews(struct config_view* list);

	/** check if config for remote control turns on IP-address interface
	* with certificates or a named pipe without certificates. */
	int options_remote_is_address(struct config_file* cfg);

	/**
	* Convert 14digit to time value
	* @param str: string of 14 digits
	* @return time value or 0 for error.
	*/
	time_t cfg_convert_timeval(const char* str);

	/**
	* Count number of values in the string.
	* format ::= (sp num)+ sp
	* num ::= [-](0-9)+
	* sp ::= (space\|tab)*
	*
	* @param str: string
	* @return: 0 on parse error, or empty string, else
	* number of integer values in the string.
	*/
	int cfg_count_numbers(const char* str);

	/**
	* Convert a 'nice' memory or file size into a bytecount
	* From '100k' to 102400. and so on. Understands kKmMgG.
	* k=1024, m=10241024, g=10241024*1024.
	* @param str: string
	* @param res: result is stored here, size in bytes.
	* @return: true if parsed correctly, or 0 on a parse error (and an error
	* is logged).
	*/
	int cfg_parse_memsize(const char* str, size_t* res);

	/**
	* Add a tag name to the config. It is added at the end with a new ID value.
	* @param cfg: the config structure.
	* @param tag: string (which is copied) with the name.
	* @return: false on alloc failure.
	*/
	int config_add_tag(struct config_file* cfg, const char* tag);

	/**
	* Find tag ID in the tag list.
	* @param cfg: the config structure.
	* @param tag: string with tag name to search for.
	* @return: 0..(num_tags-1) with tag ID, or -1 if tagname is not found.
	*/
	int find_tag_id(struct config_file* cfg, const char* tag);

	/**
	* parse taglist from string into bytestring with bitlist.
	* @param cfg: the config structure (with tagnames)
	* @param str: the string to parse. Parse puts 0 bytes in string.
	* @param listlen: returns length of in bytes.
	* @return malloced bytes with a bitlist of the tags. or NULL on parse error
	* or malloc failure.
	*/
	uint8_t* config_parse_taglist(struct config_file* cfg, char* str,
	size_t* listlen);

	/**
	* convert tag bitlist to a malloced string with tag names. For debug output.
	* @param cfg: the config structure (with tagnames)
	* @param taglist: the tag bitlist.
	* @param len: length of the tag bitlist.
	* @return malloced string or NULL.
	*/
	char* config_taglist2str(struct config_file* cfg, uint8_t* taglist,
	size_t len);

	/**
	* see if two taglists intersect (have tags in common).
	* @param list1: first tag bitlist.
	* @param list1len: length in bytes of first list.
	* @param list2: second tag bitlist.
	* @param list2len: length in bytes of second list.
	* @return true if there are tags in common, 0 if not.
	*/
	int taglist_intersect(uint8_t* list1, size_t list1len, uint8_t* list2,
	size_t list2len);

	/**
	* Parse local-zone directive into two strings and register it in the config.
	* @param cfg: to put it in.
	* @param val: argument strings to local-zone, "example.com nodefault".
	* @return: false on failure
	*/
	int cfg_parse_local_zone(struct config_file* cfg, const char* val);

	/**
	* Mark "number" or "low-high" as available or not in ports array.
	* @param str: string in input
	* @param allow: give true if this range is permitted.
	* @param avail: the array from cfg.
	* @param num: size of the array (65536).
	* @return: true if parsed correctly, or 0 on a parse error (and an error
	* is logged).
	*/
	int cfg_mark_ports(const char* str, int allow, int* avail, int num);

	/**
	* Get a condensed list of ports returned. allocated.
	* @param cfg: config file.
	* @param avail: the available ports array is returned here.
	* @return: number of ports in array or 0 on error.
	*/
	int cfg_condense_ports(struct config_file* cfg, int** avail);

	/**
	* Scan ports available
	* @param avail: the array from cfg.
	* @param num: size of the array (65536).
	* @return the number of ports available for use.
	*/
	int cfg_scan_ports(int* avail, int num);

	/**
	* Convert a filename to full pathname in original filesys
	* @param fname: the path name to convert.
	* Must not be null or empty.
	* @param cfg: config struct for chroot and chdir (if set).
	* @param use_chdir: if false, only chroot is applied.
	* @return pointer to malloced buffer which is: [chroot][chdir]fname
	* or NULL on malloc failure.
	*/
	char* fname_after_chroot(const char* fname, struct config_file* cfg,
	int use_chdir);

	/**
	* Convert a ptr shorthand into a full reverse-notation PTR record.
	* @param str: input string, "IP name"
	* @return: malloced string "reversed-ip-name PTR name"
	*/
	char* cfg_ptr_reverse(char* str);

	/**
	* Append text to the error info for validation.
	* @param qstate: query state.
	* @param str: copied into query region and appended.
	* Failures to allocate are logged.
	*/
	void errinf(struct module_qstate* qstate, const char* str);

	/**
	* Append text to error info: from 1.2.3.4
	* @param qstate: query state.
	* @param origin: sock list with origin of trouble.
	* Every element added.
	* If NULL: nothing is added.
	* if 0len element: 'from cache' is added.
	*/
	void errinf_origin(struct module_qstate* qstate, struct sock_list *origin);

	/**
	* Append text to error info: for RRset name type class
	* @param qstate: query state.
	* @param rr: rrset_key.
	*/
	void errinf_rrset(struct module_qstate* qstate, struct ub_packed_rrset_key *rr);

	/**
	* Append text to error info: str dname
	* @param qstate: query state.
	* @param str: explanation string
	* @param dname: the dname.
	*/
	void errinf_dname(struct module_qstate* qstate, const char* str,
	uint8_t* dname);

	/**
	* Create error info in string. For validation failures.
	* @param qstate: query state.
	* @return string or NULL on malloc failure (already logged).
	* This string is malloced and has to be freed by caller.
	*/
	char* errinf_to_str_bogus(struct module_qstate* qstate);

	/**
	* Create error info in string. For other servfails.
	* @param qstate: query state.
	* @return string or NULL on malloc failure (already logged).
	* This string is malloced and has to be freed by caller.
	*/
	char* errinf_to_str_servfail(struct module_qstate* qstate);

	/**
	* Used during options parsing
	*/
	struct config_parser_state {
	/** name of file being parser */
	char* filename;
	/** line number in the file, starts at 1 */
	int line;
	/** number of errors encountered */
	int errors;
	/** the result of parsing is stored here. */
	struct config_file* cfg;
	/** the current chroot dir (or NULL if none) */
	const char* chroot;
	};

	/** global config parser object used during config parsing */
	extern struct config_parser_state* cfg_parser;
	/** init lex state */
	void init_cfg_parse(void);
	/** lex in file */
	extern FILE* ub_c_in;
	/** lex out file */
	extern FILE* ub_c_out;
	/** the yacc lex generated parse function */
	int ub_c_parse(void);
	/** the lexer function */
	int ub_c_lex(void);
	/** wrap function */
	int ub_c_wrap(void);
	/** parsing helpers: print error with file and line numbers */
	void ub_c_error(const char* msg);
	/** parsing helpers: print error with file and line numbers */
	void ub_c_error_msg(const char* fmt, ...) ATTR_FORMAT(printf, 1, 2);

	#ifdef UB_ON_WINDOWS
	/**
	* Obtain registry string (if it exists).
	* @param key: key string
	* @param name: name of value to fetch.
	* @return malloced string with the result or NULL if it did not
	* exist on an error (logged with log_err) was encountered.
	*/
	char* w_lookup_reg_str(const char* key, const char* name);

	/** Modify directory in options for module file name */
	void w_config_adjust_directory(struct config_file* cfg);
	#endif /* UB_ON_WINDOWS */

	/** debug option for unit tests. */
	extern int fake_dsa, fake_sha1;

	#endif /* UTIL_CONFIG_FILE_H */
	Index: head/contrib/unbound/util/configlexer.lex
	===================================================================
	--- head/contrib/unbound/util/configlexer.lex (revision 349719)
	+++ head/contrib/unbound/util/configlexer.lex (revision 349720)
	@@ -1,572 +1,584 @@
	%{
	/*
	* configlexer.lex - lexical analyzer for unbound config file
	*
	* Copyright (c) 2001-2006, NLnet Labs. All rights reserved
	*
	* See LICENSE for the license.
	*
	*/
	#include "config.h"

	/* because flex keeps having sign-unsigned compare problems that are unfixed*/
	#if defined(__clang__)\|\|(defined(__GNUC__)&&((__GNUC__ >4)\|\|(defined(__GNUC_MINOR__)&&(__GNUC__ ==4)&&(__GNUC_MINOR__ >=2))))
	#pragma GCC diagnostic ignored "-Wsign-compare"
	#endif

	#include <ctype.h>
	#include <strings.h>
	#ifdef HAVE_GLOB_H
	# include <glob.h>
	#endif

	#include "util/config_file.h"
	#include "configparser.h"
	void ub_c_error(const char *message);

	#if 0
	#define LEXOUT(s) printf s /* used ONLY when debugging */
	#else
	#define LEXOUT(s)
	#endif

	/** avoid warning in about fwrite return value */
	#define ECHO ub_c_error_msg("syntax error at text: %s", ub_c_text)

	/** A parser variable, this is a statement in the config file which is
	* of the form variable: value1 value2 ... nargs is the number of values. */
	#define YDVAR(nargs, var) \
	num_args=(nargs); \
	LEXOUT(("v(%s%d) ", ub_c_text, num_args)); \
	if(num_args > 0) { BEGIN(val); } \
	return (var);

	struct inc_state {
	char* filename;
	int line;
	YY_BUFFER_STATE buffer;
	struct inc_state* next;
	};
	static struct inc_state* config_include_stack = NULL;
	static int inc_depth = 0;
	static int inc_prev = 0;
	static int num_args = 0;

	void init_cfg_parse(void)
	{
	config_include_stack = NULL;
	inc_depth = 0;
	inc_prev = 0;
	num_args = 0;
	}

	static void config_start_include(const char* filename)
	{
	FILE *input;
	struct inc_state* s;
	char* nm;
	if(inc_depth++ > 100000) {
	ub_c_error_msg("too many include files");
	return;
	}
	if(*filename == '\0') {
	ub_c_error_msg("empty include file name");
	return;
	}
	s = (struct inc_state)malloc(sizeof(s));
	if(!s) {
	ub_c_error_msg("include %s: malloc failure", filename);
	return;
	}
	if(cfg_parser->chroot && strncmp(filename, cfg_parser->chroot,
	strlen(cfg_parser->chroot)) == 0) {
	filename += strlen(cfg_parser->chroot);
	}
	nm = strdup(filename);
	if(!nm) {
	ub_c_error_msg("include %s: strdup failure", filename);
	free(s);
	return;
	}
	input = fopen(filename, "r");
	if(!input) {
	ub_c_error_msg("cannot open include file '%s': %s",
	filename, strerror(errno));
	free(s);
	free(nm);
	return;
	}
	LEXOUT(("switch_to_include_file(%s)\n", filename));
	s->filename = cfg_parser->filename;
	s->line = cfg_parser->line;
	s->buffer = YY_CURRENT_BUFFER;
	s->next = config_include_stack;
	config_include_stack = s;
	cfg_parser->filename = nm;
	cfg_parser->line = 1;
	yy_switch_to_buffer(yy_create_buffer(input, YY_BUF_SIZE));
	}

	static void config_start_include_glob(const char* filename)
	{

	/* check for wildcards */
	#ifdef HAVE_GLOB
	glob_t g;
	size_t i;
	int r, flags;
	if(!(!strchr(filename, '*') && !strchr(filename, '?') && !strchr(filename, '[') &&
	!strchr(filename, '{') && !strchr(filename, '~'))) {
	flags = 0
	#ifdef GLOB_ERR
	\| GLOB_ERR
	#endif
	-#ifdef GLOB_NOSORT
	- \| GLOB_NOSORT
	-#endif
	+ /* do not set GLOB_NOSORT so the results are sorted
	+ and in a predictable order. */
	#ifdef GLOB_BRACE
	\| GLOB_BRACE
	#endif
	#ifdef GLOB_TILDE
	\| GLOB_TILDE
	#endif
	;
	memset(&g, 0, sizeof(g));
	if(cfg_parser->chroot && strncmp(filename, cfg_parser->chroot,
	strlen(cfg_parser->chroot)) == 0) {
	filename += strlen(cfg_parser->chroot);
	}
	r = glob(filename, flags, NULL, &g);
	if(r) {
	/* some error */
	globfree(&g);
	if(r == GLOB_NOMATCH)
	return; /* no matches for pattern */
	config_start_include(filename); /* let original deal with it */
	return;
	}
	/* process files found, if any */
	for(i=0; i<(size_t)g.gl_pathc; i++) {
	config_start_include(g.gl_pathv[i]);
	}
	globfree(&g);
	return;
	}
	#endif /* HAVE_GLOB */

	config_start_include(filename);
	}

	static void config_end_include(void)
	{
	struct inc_state* s = config_include_stack;
	--inc_depth;
	if(!s) return;
	free(cfg_parser->filename);
	cfg_parser->filename = s->filename;
	cfg_parser->line = s->line;
	yy_delete_buffer(YY_CURRENT_BUFFER);
	yy_switch_to_buffer(s->buffer);
	config_include_stack = s->next;
	free(s);
	}

	#ifndef yy_set_bol /* compat definition, for flex 2.4.6 */
	#define yy_set_bol(at_bol) \
	{ \
	if ( ! yy_current_buffer ) \
	yy_current_buffer = yy_create_buffer( ub_c_in, YY_BUF_SIZE ); \
	yy_current_buffer->yy_ch_buf[0] = ((at_bol)?'\n':' '); \
	}
	#endif

	%}
	%option noinput
	%option nounput
	%{
	#ifndef YY_NO_UNPUT
	#define YY_NO_UNPUT 1
	#endif
	#ifndef YY_NO_INPUT
	#define YY_NO_INPUT 1
	#endif
	%}

	SPACE [ \t]
	LETTER [a-zA-Z]
	UNQUOTEDLETTER [^\'\"\n\r \t\\]\|\\.
	UNQUOTEDLETTER_NOCOLON [^\:\'\"\n\r \t\\]\|\\.
	NEWLINE [\r\n]
	COMMENT \#
	COLON \:
	DQANY [^\"\n\r\\]\|\\.
	SQANY [^\'\n\r\\]\|\\.

	%x quotedstring singlequotedstr include include_quoted val

	%%
	<INITIAL,val>{SPACE}* {
	LEXOUT(("SP ")); /* ignore */ }
	<INITIAL,val>{SPACE}{COMMENT}. {
	/* note that flex makes the longest match and '.' is any but not nl */
	LEXOUT(("comment(%s) ", ub_c_text)); /* ignore */ }
	server{COLON} { YDVAR(0, VAR_SERVER) }
	qname-minimisation{COLON} { YDVAR(1, VAR_QNAME_MINIMISATION) }
	qname-minimisation-strict{COLON} { YDVAR(1, VAR_QNAME_MINIMISATION_STRICT) }
	num-threads{COLON} { YDVAR(1, VAR_NUM_THREADS) }
	verbosity{COLON} { YDVAR(1, VAR_VERBOSITY) }
	port{COLON} { YDVAR(1, VAR_PORT) }
	outgoing-range{COLON} { YDVAR(1, VAR_OUTGOING_RANGE) }
	outgoing-port-permit{COLON} { YDVAR(1, VAR_OUTGOING_PORT_PERMIT) }
	outgoing-port-avoid{COLON} { YDVAR(1, VAR_OUTGOING_PORT_AVOID) }
	outgoing-num-tcp{COLON} { YDVAR(1, VAR_OUTGOING_NUM_TCP) }
	incoming-num-tcp{COLON} { YDVAR(1, VAR_INCOMING_NUM_TCP) }
	do-ip4{COLON} { YDVAR(1, VAR_DO_IP4) }
	do-ip6{COLON} { YDVAR(1, VAR_DO_IP6) }
	prefer-ip6{COLON} { YDVAR(1, VAR_PREFER_IP6) }
	do-udp{COLON} { YDVAR(1, VAR_DO_UDP) }
	do-tcp{COLON} { YDVAR(1, VAR_DO_TCP) }
	tcp-upstream{COLON} { YDVAR(1, VAR_TCP_UPSTREAM) }
	tcp-mss{COLON} { YDVAR(1, VAR_TCP_MSS) }
	outgoing-tcp-mss{COLON} { YDVAR(1, VAR_OUTGOING_TCP_MSS) }
	tcp-idle-timeout{COLON} { YDVAR(1, VAR_TCP_IDLE_TIMEOUT) }
	edns-tcp-keepalive{COLON} { YDVAR(1, VAR_EDNS_TCP_KEEPALIVE) }
	edns-tcp-keepalive-timeout{COLON} { YDVAR(1, VAR_EDNS_TCP_KEEPALIVE_TIMEOUT) }
	ssl-upstream{COLON} { YDVAR(1, VAR_SSL_UPSTREAM) }
	tls-upstream{COLON} { YDVAR(1, VAR_SSL_UPSTREAM) }
	ssl-service-key{COLON} { YDVAR(1, VAR_SSL_SERVICE_KEY) }
	tls-service-key{COLON} { YDVAR(1, VAR_SSL_SERVICE_KEY) }
	ssl-service-pem{COLON} { YDVAR(1, VAR_SSL_SERVICE_PEM) }
	tls-service-pem{COLON} { YDVAR(1, VAR_SSL_SERVICE_PEM) }
	ssl-port{COLON} { YDVAR(1, VAR_SSL_PORT) }
	tls-port{COLON} { YDVAR(1, VAR_SSL_PORT) }
	ssl-cert-bundle{COLON} { YDVAR(1, VAR_TLS_CERT_BUNDLE) }
	tls-cert-bundle{COLON} { YDVAR(1, VAR_TLS_CERT_BUNDLE) }
	tls-win-cert{COLON} { YDVAR(1, VAR_TLS_WIN_CERT) }
	additional-ssl-port{COLON} { YDVAR(1, VAR_TLS_ADDITIONAL_PORT) }
	additional-tls-port{COLON} { YDVAR(1, VAR_TLS_ADDITIONAL_PORT) }
	tls-additional-ports{COLON} { YDVAR(1, VAR_TLS_ADDITIONAL_PORT) }
	tls-additional-port{COLON} { YDVAR(1, VAR_TLS_ADDITIONAL_PORT) }
	+tls-session-ticket-keys{COLON} { YDVAR(1, VAR_TLS_SESSION_TICKET_KEYS) }
	+tls-ciphers{COLON} { YDVAR(1, VAR_TLS_CIPHERS) }
	+tls-ciphersuites{COLON} { YDVAR(1, VAR_TLS_CIPHERSUITES) }
	use-systemd{COLON} { YDVAR(1, VAR_USE_SYSTEMD) }
	do-daemonize{COLON} { YDVAR(1, VAR_DO_DAEMONIZE) }
	interface{COLON} { YDVAR(1, VAR_INTERFACE) }
	ip-address{COLON} { YDVAR(1, VAR_INTERFACE) }
	outgoing-interface{COLON} { YDVAR(1, VAR_OUTGOING_INTERFACE) }
	interface-automatic{COLON} { YDVAR(1, VAR_INTERFACE_AUTOMATIC) }
	so-rcvbuf{COLON} { YDVAR(1, VAR_SO_RCVBUF) }
	so-sndbuf{COLON} { YDVAR(1, VAR_SO_SNDBUF) }
	so-reuseport{COLON} { YDVAR(1, VAR_SO_REUSEPORT) }
	ip-transparent{COLON} { YDVAR(1, VAR_IP_TRANSPARENT) }
	ip-freebind{COLON} { YDVAR(1, VAR_IP_FREEBIND) }
	chroot{COLON} { YDVAR(1, VAR_CHROOT) }
	username{COLON} { YDVAR(1, VAR_USERNAME) }
	directory{COLON} { YDVAR(1, VAR_DIRECTORY) }
	logfile{COLON} { YDVAR(1, VAR_LOGFILE) }
	pidfile{COLON} { YDVAR(1, VAR_PIDFILE) }
	root-hints{COLON} { YDVAR(1, VAR_ROOT_HINTS) }
	+stream-wait-size{COLON} { YDVAR(1, VAR_STREAM_WAIT_SIZE) }
	edns-buffer-size{COLON} { YDVAR(1, VAR_EDNS_BUFFER_SIZE) }
	msg-buffer-size{COLON} { YDVAR(1, VAR_MSG_BUFFER_SIZE) }
	msg-cache-size{COLON} { YDVAR(1, VAR_MSG_CACHE_SIZE) }
	msg-cache-slabs{COLON} { YDVAR(1, VAR_MSG_CACHE_SLABS) }
	rrset-cache-size{COLON} { YDVAR(1, VAR_RRSET_CACHE_SIZE) }
	rrset-cache-slabs{COLON} { YDVAR(1, VAR_RRSET_CACHE_SLABS) }
	cache-max-ttl{COLON} { YDVAR(1, VAR_CACHE_MAX_TTL) }
	cache-max-negative-ttl{COLON} { YDVAR(1, VAR_CACHE_MAX_NEGATIVE_TTL) }
	cache-min-ttl{COLON} { YDVAR(1, VAR_CACHE_MIN_TTL) }
	infra-host-ttl{COLON} { YDVAR(1, VAR_INFRA_HOST_TTL) }
	infra-lame-ttl{COLON} { YDVAR(1, VAR_INFRA_LAME_TTL) }
	infra-cache-slabs{COLON} { YDVAR(1, VAR_INFRA_CACHE_SLABS) }
	infra-cache-numhosts{COLON} { YDVAR(1, VAR_INFRA_CACHE_NUMHOSTS) }
	infra-cache-lame-size{COLON} { YDVAR(1, VAR_INFRA_CACHE_LAME_SIZE) }
	infra-cache-min-rtt{COLON} { YDVAR(1, VAR_INFRA_CACHE_MIN_RTT) }
	num-queries-per-thread{COLON} { YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) }
	jostle-timeout{COLON} { YDVAR(1, VAR_JOSTLE_TIMEOUT) }
	delay-close{COLON} { YDVAR(1, VAR_DELAY_CLOSE) }
	target-fetch-policy{COLON} { YDVAR(1, VAR_TARGET_FETCH_POLICY) }
	harden-short-bufsize{COLON} { YDVAR(1, VAR_HARDEN_SHORT_BUFSIZE) }
	harden-large-queries{COLON} { YDVAR(1, VAR_HARDEN_LARGE_QUERIES) }
	harden-glue{COLON} { YDVAR(1, VAR_HARDEN_GLUE) }
	harden-dnssec-stripped{COLON} { YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) }
	harden-below-nxdomain{COLON} { YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
	harden-referral-path{COLON} { YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
	harden-algo-downgrade{COLON} { YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
	use-caps-for-id{COLON} { YDVAR(1, VAR_USE_CAPS_FOR_ID) }
	caps-whitelist{COLON} { YDVAR(1, VAR_CAPS_WHITELIST) }
	unwanted-reply-threshold{COLON} { YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
	private-address{COLON} { YDVAR(1, VAR_PRIVATE_ADDRESS) }
	private-domain{COLON} { YDVAR(1, VAR_PRIVATE_DOMAIN) }
	prefetch-key{COLON} { YDVAR(1, VAR_PREFETCH_KEY) }
	prefetch{COLON} { YDVAR(1, VAR_PREFETCH) }
	+deny-any{COLON} { YDVAR(1, VAR_DENY_ANY) }
	stub-zone{COLON} { YDVAR(0, VAR_STUB_ZONE) }
	name{COLON} { YDVAR(1, VAR_NAME) }
	stub-addr{COLON} { YDVAR(1, VAR_STUB_ADDR) }
	stub-host{COLON} { YDVAR(1, VAR_STUB_HOST) }
	stub-prime{COLON} { YDVAR(1, VAR_STUB_PRIME) }
	stub-first{COLON} { YDVAR(1, VAR_STUB_FIRST) }
	stub-no-cache{COLON} { YDVAR(1, VAR_STUB_NO_CACHE) }
	stub-ssl-upstream{COLON} { YDVAR(1, VAR_STUB_SSL_UPSTREAM) }
	stub-tls-upstream{COLON} { YDVAR(1, VAR_STUB_SSL_UPSTREAM) }
	forward-zone{COLON} { YDVAR(0, VAR_FORWARD_ZONE) }
	forward-addr{COLON} { YDVAR(1, VAR_FORWARD_ADDR) }
	forward-host{COLON} { YDVAR(1, VAR_FORWARD_HOST) }
	forward-first{COLON} { YDVAR(1, VAR_FORWARD_FIRST) }
	forward-no-cache{COLON} { YDVAR(1, VAR_FORWARD_NO_CACHE) }
	forward-ssl-upstream{COLON} { YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) }
	forward-tls-upstream{COLON} { YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) }
	auth-zone{COLON} { YDVAR(0, VAR_AUTH_ZONE) }
	zonefile{COLON} { YDVAR(1, VAR_ZONEFILE) }
	master{COLON} { YDVAR(1, VAR_MASTER) }
	url{COLON} { YDVAR(1, VAR_URL) }
	allow-notify{COLON} { YDVAR(1, VAR_ALLOW_NOTIFY) }
	for-downstream{COLON} { YDVAR(1, VAR_FOR_DOWNSTREAM) }
	for-upstream{COLON} { YDVAR(1, VAR_FOR_UPSTREAM) }
	fallback-enabled{COLON} { YDVAR(1, VAR_FALLBACK_ENABLED) }
	view{COLON} { YDVAR(0, VAR_VIEW) }
	view-first{COLON} { YDVAR(1, VAR_VIEW_FIRST) }
	do-not-query-address{COLON} { YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) }
	do-not-query-localhost{COLON} { YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) }
	access-control{COLON} { YDVAR(2, VAR_ACCESS_CONTROL) }
	send-client-subnet{COLON} { YDVAR(1, VAR_SEND_CLIENT_SUBNET) }
	client-subnet-zone{COLON} { YDVAR(1, VAR_CLIENT_SUBNET_ZONE) }
	client-subnet-always-forward{COLON} { YDVAR(1, VAR_CLIENT_SUBNET_ALWAYS_FORWARD) }
	client-subnet-opcode{COLON} { YDVAR(1, VAR_CLIENT_SUBNET_OPCODE) }
	max-client-subnet-ipv4{COLON} { YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV4) }
	max-client-subnet-ipv6{COLON} { YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV6) }
	+min-client-subnet-ipv4{COLON} { YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV4) }
	+min-client-subnet-ipv6{COLON} { YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV6) }
	+max-ecs-tree-size-ipv4{COLON} { YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV4) }
	+max-ecs-tree-size-ipv6{COLON} { YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV6) }
	hide-identity{COLON} { YDVAR(1, VAR_HIDE_IDENTITY) }
	hide-version{COLON} { YDVAR(1, VAR_HIDE_VERSION) }
	hide-trustanchor{COLON} { YDVAR(1, VAR_HIDE_TRUSTANCHOR) }
	identity{COLON} { YDVAR(1, VAR_IDENTITY) }
	version{COLON} { YDVAR(1, VAR_VERSION) }
	module-config{COLON} { YDVAR(1, VAR_MODULE_CONF) }
	dlv-anchor{COLON} { YDVAR(1, VAR_DLV_ANCHOR) }
	dlv-anchor-file{COLON} { YDVAR(1, VAR_DLV_ANCHOR_FILE) }
	trust-anchor-file{COLON} { YDVAR(1, VAR_TRUST_ANCHOR_FILE) }
	auto-trust-anchor-file{COLON} { YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) }
	trusted-keys-file{COLON} { YDVAR(1, VAR_TRUSTED_KEYS_FILE) }
	trust-anchor{COLON} { YDVAR(1, VAR_TRUST_ANCHOR) }
	trust-anchor-signaling{COLON} { YDVAR(1, VAR_TRUST_ANCHOR_SIGNALING) }
	root-key-sentinel{COLON} { YDVAR(1, VAR_ROOT_KEY_SENTINEL) }
	val-override-date{COLON} { YDVAR(1, VAR_VAL_OVERRIDE_DATE) }
	val-sig-skew-min{COLON} { YDVAR(1, VAR_VAL_SIG_SKEW_MIN) }
	val-sig-skew-max{COLON} { YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
	val-bogus-ttl{COLON} { YDVAR(1, VAR_BOGUS_TTL) }
	val-clean-additional{COLON} { YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
	val-permissive-mode{COLON} { YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
	aggressive-nsec{COLON} { YDVAR(1, VAR_AGGRESSIVE_NSEC) }
	ignore-cd-flag{COLON} { YDVAR(1, VAR_IGNORE_CD_FLAG) }
	serve-expired{COLON} { YDVAR(1, VAR_SERVE_EXPIRED) }
	serve-expired-ttl{COLON} { YDVAR(1, VAR_SERVE_EXPIRED_TTL) }
	serve-expired-ttl-reset{COLON} { YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) }
	fake-dsa{COLON} { YDVAR(1, VAR_FAKE_DSA) }
	fake-sha1{COLON} { YDVAR(1, VAR_FAKE_SHA1) }
	val-log-level{COLON} { YDVAR(1, VAR_VAL_LOG_LEVEL) }
	key-cache-size{COLON} { YDVAR(1, VAR_KEY_CACHE_SIZE) }
	key-cache-slabs{COLON} { YDVAR(1, VAR_KEY_CACHE_SLABS) }
	neg-cache-size{COLON} { YDVAR(1, VAR_NEG_CACHE_SIZE) }
	val-nsec3-keysize-iterations{COLON} {
	YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
	add-holddown{COLON} { YDVAR(1, VAR_ADD_HOLDDOWN) }
	del-holddown{COLON} { YDVAR(1, VAR_DEL_HOLDDOWN) }
	keep-missing{COLON} { YDVAR(1, VAR_KEEP_MISSING) }
	permit-small-holddown{COLON} { YDVAR(1, VAR_PERMIT_SMALL_HOLDDOWN) }
	use-syslog{COLON} { YDVAR(1, VAR_USE_SYSLOG) }
	log-identity{COLON} { YDVAR(1, VAR_LOG_IDENTITY) }
	log-time-ascii{COLON} { YDVAR(1, VAR_LOG_TIME_ASCII) }
	log-queries{COLON} { YDVAR(1, VAR_LOG_QUERIES) }
	log-replies{COLON} { YDVAR(1, VAR_LOG_REPLIES) }
	+log-tag-queryreply{COLON} { YDVAR(1, VAR_LOG_TAG_QUERYREPLY) }
	log-local-actions{COLON} { YDVAR(1, VAR_LOG_LOCAL_ACTIONS) }
	log-servfail{COLON} { YDVAR(1, VAR_LOG_SERVFAIL) }
	local-zone{COLON} { YDVAR(2, VAR_LOCAL_ZONE) }
	local-data{COLON} { YDVAR(1, VAR_LOCAL_DATA) }
	local-data-ptr{COLON} { YDVAR(1, VAR_LOCAL_DATA_PTR) }
	unblock-lan-zones{COLON} { YDVAR(1, VAR_UNBLOCK_LAN_ZONES) }
	insecure-lan-zones{COLON} { YDVAR(1, VAR_INSECURE_LAN_ZONES) }
	statistics-interval{COLON} { YDVAR(1, VAR_STATISTICS_INTERVAL) }
	statistics-cumulative{COLON} { YDVAR(1, VAR_STATISTICS_CUMULATIVE) }
	extended-statistics{COLON} { YDVAR(1, VAR_EXTENDED_STATISTICS) }
	shm-enable{COLON} { YDVAR(1, VAR_SHM_ENABLE) }
	shm-key{COLON} { YDVAR(1, VAR_SHM_KEY) }
	remote-control{COLON} { YDVAR(0, VAR_REMOTE_CONTROL) }
	control-enable{COLON} { YDVAR(1, VAR_CONTROL_ENABLE) }
	control-interface{COLON} { YDVAR(1, VAR_CONTROL_INTERFACE) }
	control-port{COLON} { YDVAR(1, VAR_CONTROL_PORT) }
	control-use-cert{COLON} { YDVAR(1, VAR_CONTROL_USE_CERT) }
	server-key-file{COLON} { YDVAR(1, VAR_SERVER_KEY_FILE) }
	server-cert-file{COLON} { YDVAR(1, VAR_SERVER_CERT_FILE) }
	control-key-file{COLON} { YDVAR(1, VAR_CONTROL_KEY_FILE) }
	control-cert-file{COLON} { YDVAR(1, VAR_CONTROL_CERT_FILE) }
	python-script{COLON} { YDVAR(1, VAR_PYTHON_SCRIPT) }
	python{COLON} { YDVAR(0, VAR_PYTHON) }
	domain-insecure{COLON} { YDVAR(1, VAR_DOMAIN_INSECURE) }
	minimal-responses{COLON} { YDVAR(1, VAR_MINIMAL_RESPONSES) }
	rrset-roundrobin{COLON} { YDVAR(1, VAR_RRSET_ROUNDROBIN) }
	+unknown-server-time-limit{COLON} { YDVAR(1, VAR_UNKNOWN_SERVER_TIME_LIMIT) }
	max-udp-size{COLON} { YDVAR(1, VAR_MAX_UDP_SIZE) }
	dns64-prefix{COLON} { YDVAR(1, VAR_DNS64_PREFIX) }
	dns64-synthall{COLON} { YDVAR(1, VAR_DNS64_SYNTHALL) }
	dns64-ignore-aaaa{COLON} { YDVAR(1, VAR_DNS64_IGNORE_AAAA) }
	define-tag{COLON} { YDVAR(1, VAR_DEFINE_TAG) }
	local-zone-tag{COLON} { YDVAR(2, VAR_LOCAL_ZONE_TAG) }
	access-control-tag{COLON} { YDVAR(2, VAR_ACCESS_CONTROL_TAG) }
	access-control-tag-action{COLON} { YDVAR(3, VAR_ACCESS_CONTROL_TAG_ACTION) }
	access-control-tag-data{COLON} { YDVAR(3, VAR_ACCESS_CONTROL_TAG_DATA) }
	access-control-view{COLON} { YDVAR(2, VAR_ACCESS_CONTROL_VIEW) }
	local-zone-override{COLON} { YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) }
	dnstap{COLON} { YDVAR(0, VAR_DNSTAP) }
	dnstap-enable{COLON} { YDVAR(1, VAR_DNSTAP_ENABLE) }
	dnstap-socket-path{COLON} { YDVAR(1, VAR_DNSTAP_SOCKET_PATH) }
	dnstap-send-identity{COLON} { YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) }
	dnstap-send-version{COLON} { YDVAR(1, VAR_DNSTAP_SEND_VERSION) }
	dnstap-identity{COLON} { YDVAR(1, VAR_DNSTAP_IDENTITY) }
	dnstap-version{COLON} { YDVAR(1, VAR_DNSTAP_VERSION) }
	dnstap-log-resolver-query-messages{COLON} {
	YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) }
	dnstap-log-resolver-response-messages{COLON} {
	YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) }
	dnstap-log-client-query-messages{COLON} {
	YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) }
	dnstap-log-client-response-messages{COLON} {
	YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) }
	dnstap-log-forwarder-query-messages{COLON} {
	YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
	dnstap-log-forwarder-response-messages{COLON} {
	YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
	disable-dnssec-lame-check{COLON} { YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) }
	ip-ratelimit{COLON} { YDVAR(1, VAR_IP_RATELIMIT) }
	ratelimit{COLON} { YDVAR(1, VAR_RATELIMIT) }
	ip-ratelimit-slabs{COLON} { YDVAR(1, VAR_IP_RATELIMIT_SLABS) }
	ratelimit-slabs{COLON} { YDVAR(1, VAR_RATELIMIT_SLABS) }
	ip-ratelimit-size{COLON} { YDVAR(1, VAR_IP_RATELIMIT_SIZE) }
	ratelimit-size{COLON} { YDVAR(1, VAR_RATELIMIT_SIZE) }
	ratelimit-for-domain{COLON} { YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) }
	ratelimit-below-domain{COLON} { YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) }
	ip-ratelimit-factor{COLON} { YDVAR(1, VAR_IP_RATELIMIT_FACTOR) }
	ratelimit-factor{COLON} { YDVAR(1, VAR_RATELIMIT_FACTOR) }
	low-rtt{COLON} { YDVAR(1, VAR_LOW_RTT) }
	-low-rtt-pct{COLON} { YDVAR(1, VAR_LOW_RTT_PERMIL) }
	-low-rtt-permil{COLON} { YDVAR(1, VAR_LOW_RTT_PERMIL) }
	+fast-server-num{COLON} { YDVAR(1, VAR_FAST_SERVER_NUM) }
	+low-rtt-pct{COLON} { YDVAR(1, VAR_FAST_SERVER_PERMIL) }
	+low-rtt-permil{COLON} { YDVAR(1, VAR_FAST_SERVER_PERMIL) }
	+fast-server-permil{COLON} { YDVAR(1, VAR_FAST_SERVER_PERMIL) }
	response-ip-tag{COLON} { YDVAR(2, VAR_RESPONSE_IP_TAG) }
	response-ip{COLON} { YDVAR(2, VAR_RESPONSE_IP) }
	response-ip-data{COLON} { YDVAR(2, VAR_RESPONSE_IP_DATA) }
	dnscrypt{COLON} { YDVAR(0, VAR_DNSCRYPT) }
	dnscrypt-enable{COLON} { YDVAR(1, VAR_DNSCRYPT_ENABLE) }
	dnscrypt-port{COLON} { YDVAR(1, VAR_DNSCRYPT_PORT) }
	dnscrypt-provider{COLON} { YDVAR(1, VAR_DNSCRYPT_PROVIDER) }
	dnscrypt-secret-key{COLON} { YDVAR(1, VAR_DNSCRYPT_SECRET_KEY) }
	dnscrypt-provider-cert{COLON} { YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT) }
	dnscrypt-provider-cert-rotated{COLON} { YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT_ROTATED) }
	dnscrypt-shared-secret-cache-size{COLON} {
	YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) }
	dnscrypt-shared-secret-cache-slabs{COLON} {
	YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) }
	dnscrypt-nonce-cache-size{COLON} { YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SIZE) }
	dnscrypt-nonce-cache-slabs{COLON} { YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SLABS) }
	ipsecmod-enabled{COLON} { YDVAR(1, VAR_IPSECMOD_ENABLED) }
	ipsecmod-ignore-bogus{COLON} { YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) }
	ipsecmod-hook{COLON} { YDVAR(1, VAR_IPSECMOD_HOOK) }
	ipsecmod-max-ttl{COLON} { YDVAR(1, VAR_IPSECMOD_MAX_TTL) }
	ipsecmod-whitelist{COLON} { YDVAR(1, VAR_IPSECMOD_WHITELIST) }
	ipsecmod-strict{COLON} { YDVAR(1, VAR_IPSECMOD_STRICT) }
	cachedb{COLON} { YDVAR(0, VAR_CACHEDB) }
	backend{COLON} { YDVAR(1, VAR_CACHEDB_BACKEND) }
	secret-seed{COLON} { YDVAR(1, VAR_CACHEDB_SECRETSEED) }
	redis-server-host{COLON} { YDVAR(1, VAR_CACHEDB_REDISHOST) }
	redis-server-port{COLON} { YDVAR(1, VAR_CACHEDB_REDISPORT) }
	redis-timeout{COLON} { YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) }
	udp-upstream-without-downstream{COLON} { YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) }
	tcp-connection-limit{COLON} { YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
	<INITIAL,val>{NEWLINE} { LEXOUT(("NL\n")); cfg_parser->line++; }

	/* Quoted strings. Strip leading and ending quotes */
	<val>\" { BEGIN(quotedstring); LEXOUT(("QS ")); }
	<quotedstring><<EOF>> {
	ub_c_error("EOF inside quoted string");
	if(--num_args == 0) { BEGIN(INITIAL); }
	else { BEGIN(val); }
	}
	<quotedstring>{DQANY}* { LEXOUT(("STR(%s) ", ub_c_text)); yymore(); }
	<quotedstring>{NEWLINE} { ub_c_error("newline inside quoted string, no end \"");
	cfg_parser->line++; BEGIN(INITIAL); }
	<quotedstring>\" {
	LEXOUT(("QE "));
	if(--num_args == 0) { BEGIN(INITIAL); }
	else { BEGIN(val); }
	ub_c_text[ub_c_leng - 1] = '\0';
	ub_c_lval.str = strdup(ub_c_text);
	if(!ub_c_lval.str)
	ub_c_error("out of memory");
	return STRING_ARG;
	}

	/* Single Quoted strings. Strip leading and ending quotes */
	<val>\' { BEGIN(singlequotedstr); LEXOUT(("SQS ")); }
	<singlequotedstr><<EOF>> {
	ub_c_error("EOF inside quoted string");
	if(--num_args == 0) { BEGIN(INITIAL); }
	else { BEGIN(val); }
	}
	<singlequotedstr>{SQANY}* { LEXOUT(("STR(%s) ", ub_c_text)); yymore(); }
	<singlequotedstr>{NEWLINE} { ub_c_error("newline inside quoted string, no end '");
	cfg_parser->line++; BEGIN(INITIAL); }
	<singlequotedstr>\' {
	LEXOUT(("SQE "));
	if(--num_args == 0) { BEGIN(INITIAL); }
	else { BEGIN(val); }
	ub_c_text[ub_c_leng - 1] = '\0';
	ub_c_lval.str = strdup(ub_c_text);
	if(!ub_c_lval.str)
	ub_c_error("out of memory");
	return STRING_ARG;
	}

	/* include: directive */
	<INITIAL,val>include{COLON} {
	LEXOUT(("v(%s) ", ub_c_text)); inc_prev = YYSTATE; BEGIN(include); }
	<include><<EOF>> {
	ub_c_error("EOF inside include directive");
	BEGIN(inc_prev);
	}
	<include>{SPACE}* { LEXOUT(("ISP ")); /* ignore */ }
	<include>{NEWLINE} { LEXOUT(("NL\n")); cfg_parser->line++;}
	<include>\" { LEXOUT(("IQS ")); BEGIN(include_quoted); }
	<include>{UNQUOTEDLETTER}* {
	LEXOUT(("Iunquotedstr(%s) ", ub_c_text));
	config_start_include_glob(ub_c_text);
	BEGIN(inc_prev);
	}
	<include_quoted><<EOF>> {
	ub_c_error("EOF inside quoted string");
	BEGIN(inc_prev);
	}
	<include_quoted>{DQANY}* { LEXOUT(("ISTR(%s) ", ub_c_text)); yymore(); }
	<include_quoted>{NEWLINE} { ub_c_error("newline before \" in include name");
	cfg_parser->line++; BEGIN(inc_prev); }
	<include_quoted>\" {
	LEXOUT(("IQE "));
	ub_c_text[ub_c_leng - 1] = '\0';
	config_start_include_glob(ub_c_text);
	BEGIN(inc_prev);
	}
	<INITIAL,val><<EOF>> {
	LEXOUT(("LEXEOF "));
	yy_set_bol(1); /* Set beginning of line, so "^" rules match. */
	if (!config_include_stack) {
	yyterminate();
	} else {
	fclose(ub_c_in);
	config_end_include();
	}
	}

	<val>{UNQUOTEDLETTER}* { LEXOUT(("unquotedstr(%s) ", ub_c_text));
	if(--num_args == 0) { BEGIN(INITIAL); }
	ub_c_lval.str = strdup(ub_c_text); return STRING_ARG; }

	{UNQUOTEDLETTER_NOCOLON}* {
	ub_c_error_msg("unknown keyword '%s'", ub_c_text);
	}

	<*>. {
	ub_c_error_msg("stray '%s'", ub_c_text);
	}

	%%
	Index: head/contrib/unbound/util/configparser.y
	===================================================================
	--- head/contrib/unbound/util/configparser.y (revision 349719)
	+++ head/contrib/unbound/util/configparser.y (revision 349720)
	@@ -1,2817 +1,2980 @@
	/*
	* configparser.y -- yacc grammar for unbound configuration files
	*
	* Copyright (c) 2001-2006, NLnet Labs. All rights reserved.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	%{
	#include "config.h"

	#include <stdarg.h>
	#include <stdio.h>
	#include <string.h>
	#include <stdlib.h>
	#include <assert.h>

	#include "util/configyyrename.h"
	#include "util/config_file.h"
	#include "util/net_help.h"

	int ub_c_lex(void);
	void ub_c_error(const char *message);

	static void validate_respip_action(const char* action);

	/* these need to be global, otherwise they cannot be used inside yacc */
	extern struct config_parser_state* cfg_parser;

	#if 0
	#define OUTYY(s) printf s /* used ONLY when debugging */
	#else
	#define OUTYY(s)
	#endif

	%}
	%union {
	char* str;
	};

	%token SPACE LETTER NEWLINE COMMENT COLON ANY ZONESTR
	%token <str> STRING_ARG
	%token VAR_SERVER VAR_VERBOSITY VAR_NUM_THREADS VAR_PORT
	%token VAR_OUTGOING_RANGE VAR_INTERFACE
	%token VAR_DO_IP4 VAR_DO_IP6 VAR_PREFER_IP6 VAR_DO_UDP VAR_DO_TCP
	%token VAR_TCP_MSS VAR_OUTGOING_TCP_MSS VAR_TCP_IDLE_TIMEOUT
	%token VAR_EDNS_TCP_KEEPALIVE VAR_EDNS_TCP_KEEPALIVE_TIMEOUT
	%token VAR_CHROOT VAR_USERNAME VAR_DIRECTORY VAR_LOGFILE VAR_PIDFILE
	%token VAR_MSG_CACHE_SIZE VAR_MSG_CACHE_SLABS VAR_NUM_QUERIES_PER_THREAD
	%token VAR_RRSET_CACHE_SIZE VAR_RRSET_CACHE_SLABS VAR_OUTGOING_NUM_TCP
	%token VAR_INFRA_HOST_TTL VAR_INFRA_LAME_TTL VAR_INFRA_CACHE_SLABS
	%token VAR_INFRA_CACHE_NUMHOSTS VAR_INFRA_CACHE_LAME_SIZE VAR_NAME
	%token VAR_STUB_ZONE VAR_STUB_HOST VAR_STUB_ADDR VAR_TARGET_FETCH_POLICY
	%token VAR_HARDEN_SHORT_BUFSIZE VAR_HARDEN_LARGE_QUERIES
	%token VAR_FORWARD_ZONE VAR_FORWARD_HOST VAR_FORWARD_ADDR
	%token VAR_DO_NOT_QUERY_ADDRESS VAR_HIDE_IDENTITY VAR_HIDE_VERSION
	%token VAR_IDENTITY VAR_VERSION VAR_HARDEN_GLUE VAR_MODULE_CONF
	%token VAR_TRUST_ANCHOR_FILE VAR_TRUST_ANCHOR VAR_VAL_OVERRIDE_DATE
	%token VAR_BOGUS_TTL VAR_VAL_CLEAN_ADDITIONAL VAR_VAL_PERMISSIVE_MODE
	%token VAR_INCOMING_NUM_TCP VAR_MSG_BUFFER_SIZE VAR_KEY_CACHE_SIZE
	%token VAR_KEY_CACHE_SLABS VAR_TRUSTED_KEYS_FILE
	%token VAR_VAL_NSEC3_KEYSIZE_ITERATIONS VAR_USE_SYSLOG
	%token VAR_OUTGOING_INTERFACE VAR_ROOT_HINTS VAR_DO_NOT_QUERY_LOCALHOST
	%token VAR_CACHE_MAX_TTL VAR_HARDEN_DNSSEC_STRIPPED VAR_ACCESS_CONTROL
	%token VAR_LOCAL_ZONE VAR_LOCAL_DATA VAR_INTERFACE_AUTOMATIC
	%token VAR_STATISTICS_INTERVAL VAR_DO_DAEMONIZE VAR_USE_CAPS_FOR_ID
	%token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT
	%token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
	%token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
	%token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
	%token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
	%token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
	%token VAR_CONTROL_USE_CERT
	%token VAR_EXTENDED_STATISTICS VAR_LOCAL_DATA_PTR VAR_JOSTLE_TIMEOUT
	%token VAR_STUB_PRIME VAR_UNWANTED_REPLY_THRESHOLD VAR_LOG_TIME_ASCII
	%token VAR_DOMAIN_INSECURE VAR_PYTHON VAR_PYTHON_SCRIPT VAR_VAL_SIG_SKEW_MIN
	%token VAR_VAL_SIG_SKEW_MAX VAR_CACHE_MIN_TTL VAR_VAL_LOG_LEVEL
	%token VAR_AUTO_TRUST_ANCHOR_FILE VAR_KEEP_MISSING VAR_ADD_HOLDDOWN
	%token VAR_DEL_HOLDDOWN VAR_SO_RCVBUF VAR_EDNS_BUFFER_SIZE VAR_PREFETCH
	%token VAR_PREFETCH_KEY VAR_SO_SNDBUF VAR_SO_REUSEPORT VAR_HARDEN_BELOW_NXDOMAIN
	%token VAR_IGNORE_CD_FLAG VAR_LOG_QUERIES VAR_LOG_REPLIES VAR_LOG_LOCAL_ACTIONS
	%token VAR_TCP_UPSTREAM VAR_SSL_UPSTREAM
	%token VAR_SSL_SERVICE_KEY VAR_SSL_SERVICE_PEM VAR_SSL_PORT VAR_FORWARD_FIRST
	%token VAR_STUB_SSL_UPSTREAM VAR_FORWARD_SSL_UPSTREAM VAR_TLS_CERT_BUNDLE
	%token VAR_STUB_FIRST VAR_MINIMAL_RESPONSES VAR_RRSET_ROUNDROBIN
	%token VAR_MAX_UDP_SIZE VAR_DELAY_CLOSE
	%token VAR_UNBLOCK_LAN_ZONES VAR_INSECURE_LAN_ZONES
	%token VAR_INFRA_CACHE_MIN_RTT
	%token VAR_DNS64_PREFIX VAR_DNS64_SYNTHALL VAR_DNS64_IGNORE_AAAA
	%token VAR_DNSTAP VAR_DNSTAP_ENABLE VAR_DNSTAP_SOCKET_PATH
	%token VAR_DNSTAP_SEND_IDENTITY VAR_DNSTAP_SEND_VERSION
	%token VAR_DNSTAP_IDENTITY VAR_DNSTAP_VERSION
	%token VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES
	%token VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES
	%token VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES
	%token VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES
	%token VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES
	%token VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES
	%token VAR_RESPONSE_IP_TAG VAR_RESPONSE_IP VAR_RESPONSE_IP_DATA
	%token VAR_HARDEN_ALGO_DOWNGRADE VAR_IP_TRANSPARENT
	%token VAR_DISABLE_DNSSEC_LAME_CHECK
	%token VAR_IP_RATELIMIT VAR_IP_RATELIMIT_SLABS VAR_IP_RATELIMIT_SIZE
	%token VAR_RATELIMIT VAR_RATELIMIT_SLABS VAR_RATELIMIT_SIZE
	%token VAR_RATELIMIT_FOR_DOMAIN VAR_RATELIMIT_BELOW_DOMAIN
	%token VAR_IP_RATELIMIT_FACTOR VAR_RATELIMIT_FACTOR
	%token VAR_SEND_CLIENT_SUBNET VAR_CLIENT_SUBNET_ZONE
	%token VAR_CLIENT_SUBNET_ALWAYS_FORWARD VAR_CLIENT_SUBNET_OPCODE
	%token VAR_MAX_CLIENT_SUBNET_IPV4 VAR_MAX_CLIENT_SUBNET_IPV6
	+%token VAR_MIN_CLIENT_SUBNET_IPV4 VAR_MIN_CLIENT_SUBNET_IPV6
	+%token VAR_MAX_ECS_TREE_SIZE_IPV4 VAR_MAX_ECS_TREE_SIZE_IPV6
	%token VAR_CAPS_WHITELIST VAR_CACHE_MAX_NEGATIVE_TTL VAR_PERMIT_SMALL_HOLDDOWN
	%token VAR_QNAME_MINIMISATION VAR_QNAME_MINIMISATION_STRICT VAR_IP_FREEBIND
	%token VAR_DEFINE_TAG VAR_LOCAL_ZONE_TAG VAR_ACCESS_CONTROL_TAG
	%token VAR_LOCAL_ZONE_OVERRIDE VAR_ACCESS_CONTROL_TAG_ACTION
	%token VAR_ACCESS_CONTROL_TAG_DATA VAR_VIEW VAR_ACCESS_CONTROL_VIEW
	%token VAR_VIEW_FIRST VAR_SERVE_EXPIRED VAR_SERVE_EXPIRED_TTL
	%token VAR_SERVE_EXPIRED_TTL_RESET VAR_FAKE_DSA VAR_FAKE_SHA1
	%token VAR_LOG_IDENTITY VAR_HIDE_TRUSTANCHOR VAR_TRUST_ANCHOR_SIGNALING
	%token VAR_AGGRESSIVE_NSEC VAR_USE_SYSTEMD VAR_SHM_ENABLE VAR_SHM_KEY
	%token VAR_ROOT_KEY_SENTINEL
	%token VAR_DNSCRYPT VAR_DNSCRYPT_ENABLE VAR_DNSCRYPT_PORT VAR_DNSCRYPT_PROVIDER
	%token VAR_DNSCRYPT_SECRET_KEY VAR_DNSCRYPT_PROVIDER_CERT
	%token VAR_DNSCRYPT_PROVIDER_CERT_ROTATED
	%token VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE
	%token VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS
	%token VAR_DNSCRYPT_NONCE_CACHE_SIZE
	%token VAR_DNSCRYPT_NONCE_CACHE_SLABS
	%token VAR_IPSECMOD_ENABLED VAR_IPSECMOD_HOOK VAR_IPSECMOD_IGNORE_BOGUS
	%token VAR_IPSECMOD_MAX_TTL VAR_IPSECMOD_WHITELIST VAR_IPSECMOD_STRICT
	%token VAR_CACHEDB VAR_CACHEDB_BACKEND VAR_CACHEDB_SECRETSEED
	%token VAR_CACHEDB_REDISHOST VAR_CACHEDB_REDISPORT VAR_CACHEDB_REDISTIMEOUT
	%token VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM VAR_FOR_UPSTREAM
	%token VAR_AUTH_ZONE VAR_ZONEFILE VAR_MASTER VAR_URL VAR_FOR_DOWNSTREAM
	%token VAR_FALLBACK_ENABLED VAR_TLS_ADDITIONAL_PORT VAR_LOW_RTT VAR_LOW_RTT_PERMIL
	+%token VAR_FAST_SERVER_PERMIL VAR_FAST_SERVER_NUM
	%token VAR_ALLOW_NOTIFY VAR_TLS_WIN_CERT VAR_TCP_CONNECTION_LIMIT
	-%token VAR_FORWARD_NO_CACHE VAR_STUB_NO_CACHE VAR_LOG_SERVFAIL
	+%token VAR_FORWARD_NO_CACHE VAR_STUB_NO_CACHE VAR_LOG_SERVFAIL VAR_DENY_ANY
	+%token VAR_UNKNOWN_SERVER_TIME_LIMIT VAR_LOG_TAG_QUERYREPLY
	+%token VAR_STREAM_WAIT_SIZE VAR_TLS_CIPHERS VAR_TLS_CIPHERSUITES
	+%token VAR_TLS_SESSION_TICKET_KEYS

	%%
	toplevelvars: /* empty */ \| toplevelvars toplevelvar ;
	toplevelvar: serverstart contents_server \| stubstart contents_stub \|
	forwardstart contents_forward \| pythonstart contents_py \|
	rcstart contents_rc \| dtstart contents_dt \| viewstart contents_view \|
	dnscstart contents_dnsc \| cachedbstart contents_cachedb \|
	authstart contents_auth
	;

	/* server: declaration */
	serverstart: VAR_SERVER
	{
	OUTYY(("\nP(server:)\n"));
	}
	;
	contents_server: contents_server content_server
	\| ;
	content_server: server_num_threads \| server_verbosity \| server_port \|
	server_outgoing_range \| server_do_ip4 \|
	server_do_ip6 \| server_prefer_ip6 \|
	server_do_udp \| server_do_tcp \|
	server_tcp_mss \| server_outgoing_tcp_mss \| server_tcp_idle_timeout \|
	server_tcp_keepalive \| server_tcp_keepalive_timeout \|
	server_interface \| server_chroot \| server_username \|
	server_directory \| server_logfile \| server_pidfile \|
	server_msg_cache_size \| server_msg_cache_slabs \|
	server_num_queries_per_thread \| server_rrset_cache_size \|
	server_rrset_cache_slabs \| server_outgoing_num_tcp \|
	server_infra_host_ttl \| server_infra_lame_ttl \|
	server_infra_cache_slabs \| server_infra_cache_numhosts \|
	server_infra_cache_lame_size \| server_target_fetch_policy \|
	server_harden_short_bufsize \| server_harden_large_queries \|
	server_do_not_query_address \| server_hide_identity \|
	server_hide_version \| server_identity \| server_version \|
	server_harden_glue \| server_module_conf \| server_trust_anchor_file \|
	server_trust_anchor \| server_val_override_date \| server_bogus_ttl \|
	server_val_clean_additional \| server_val_permissive_mode \|
	server_incoming_num_tcp \| server_msg_buffer_size \|
	server_key_cache_size \| server_key_cache_slabs \|
	server_trusted_keys_file \| server_val_nsec3_keysize_iterations \|
	server_use_syslog \| server_outgoing_interface \| server_root_hints \|
	server_do_not_query_localhost \| server_cache_max_ttl \|
	server_harden_dnssec_stripped \| server_access_control \|
	server_local_zone \| server_local_data \| server_interface_automatic \|
	server_statistics_interval \| server_do_daemonize \|
	server_use_caps_for_id \| server_statistics_cumulative \|
	server_outgoing_port_permit \| server_outgoing_port_avoid \|
	server_dlv_anchor_file \| server_dlv_anchor \| server_neg_cache_size \|
	server_harden_referral_path \| server_private_address \|
	server_private_domain \| server_extended_statistics \|
	server_local_data_ptr \| server_jostle_timeout \|
	server_unwanted_reply_threshold \| server_log_time_ascii \|
	server_domain_insecure \| server_val_sig_skew_min \|
	server_val_sig_skew_max \| server_cache_min_ttl \| server_val_log_level \|
	server_auto_trust_anchor_file \| server_add_holddown \|
	server_del_holddown \| server_keep_missing \| server_so_rcvbuf \|
	server_edns_buffer_size \| server_prefetch \| server_prefetch_key \|
	server_so_sndbuf \| server_harden_below_nxdomain \| server_ignore_cd_flag \|
	server_log_queries \| server_log_replies \| server_tcp_upstream \| server_ssl_upstream \|
	server_log_local_actions \|
	server_ssl_service_key \| server_ssl_service_pem \| server_ssl_port \|
	server_minimal_responses \| server_rrset_roundrobin \| server_max_udp_size \|
	server_so_reuseport \| server_delay_close \|
	server_unblock_lan_zones \| server_insecure_lan_zones \|
	server_dns64_prefix \| server_dns64_synthall \| server_dns64_ignore_aaaa \|
	server_infra_cache_min_rtt \| server_harden_algo_downgrade \|
	server_ip_transparent \| server_ip_ratelimit \| server_ratelimit \|
	server_ip_ratelimit_slabs \| server_ratelimit_slabs \|
	server_ip_ratelimit_size \| server_ratelimit_size \|
	server_ratelimit_for_domain \|
	server_ratelimit_below_domain \| server_ratelimit_factor \|
	server_ip_ratelimit_factor \| server_send_client_subnet \|
	server_client_subnet_zone \| server_client_subnet_always_forward \|
	server_client_subnet_opcode \|
	server_max_client_subnet_ipv4 \| server_max_client_subnet_ipv6 \|
	+ server_min_client_subnet_ipv4 \| server_min_client_subnet_ipv6 \|
	+ server_max_ecs_tree_size_ipv4 \| server_max_ecs_tree_size_ipv6 \|
	server_caps_whitelist \| server_cache_max_negative_ttl \|
	server_permit_small_holddown \| server_qname_minimisation \|
	server_ip_freebind \| server_define_tag \| server_local_zone_tag \|
	server_disable_dnssec_lame_check \| server_access_control_tag \|
	server_local_zone_override \| server_access_control_tag_action \|
	server_access_control_tag_data \| server_access_control_view \|
	server_qname_minimisation_strict \| server_serve_expired \|
	server_serve_expired_ttl \| server_serve_expired_ttl_reset \|
	server_fake_dsa \| server_log_identity \| server_use_systemd \|
	server_response_ip_tag \| server_response_ip \| server_response_ip_data \|
	server_shm_enable \| server_shm_key \| server_fake_sha1 \|
	server_hide_trustanchor \| server_trust_anchor_signaling \|
	server_root_key_sentinel \|
	server_ipsecmod_enabled \| server_ipsecmod_hook \|
	server_ipsecmod_ignore_bogus \| server_ipsecmod_max_ttl \|
	server_ipsecmod_whitelist \| server_ipsecmod_strict \|
	server_udp_upstream_without_downstream \| server_aggressive_nsec \|
	server_tls_cert_bundle \| server_tls_additional_port \| server_low_rtt \|
	- server_low_rtt_permil \| server_tls_win_cert \|
	- server_tcp_connection_limit \| server_log_servfail
	+ server_fast_server_permil \| server_fast_server_num \| server_tls_win_cert \|
	+ server_tcp_connection_limit \| server_log_servfail \| server_deny_any \|
	+ server_unknown_server_time_limit \| server_log_tag_queryreply \|
	+ server_stream_wait_size \| server_tls_ciphers \|
	+ server_tls_ciphersuites \| server_tls_session_ticket_keys
	;
	stubstart: VAR_STUB_ZONE
	{
	struct config_stub* s;
	OUTYY(("\nP(stub_zone:)\n"));
	s = (struct config_stub*)calloc(1, sizeof(struct config_stub));
	if(s) {
	s->next = cfg_parser->cfg->stubs;
	cfg_parser->cfg->stubs = s;
	} else
	yyerror("out of memory");
	}
	;
	contents_stub: contents_stub content_stub
	\| ;
	content_stub: stub_name \| stub_host \| stub_addr \| stub_prime \| stub_first \|
	stub_no_cache \| stub_ssl_upstream
	;
	forwardstart: VAR_FORWARD_ZONE
	{
	struct config_stub* s;
	OUTYY(("\nP(forward_zone:)\n"));
	s = (struct config_stub*)calloc(1, sizeof(struct config_stub));
	if(s) {
	s->next = cfg_parser->cfg->forwards;
	cfg_parser->cfg->forwards = s;
	} else
	yyerror("out of memory");
	}
	;
	contents_forward: contents_forward content_forward
	\| ;
	content_forward: forward_name \| forward_host \| forward_addr \| forward_first \|
	forward_no_cache \| forward_ssl_upstream
	;
	viewstart: VAR_VIEW
	{
	struct config_view* s;
	OUTYY(("\nP(view:)\n"));
	s = (struct config_view*)calloc(1, sizeof(struct config_view));
	if(s) {
	s->next = cfg_parser->cfg->views;
	if(s->next && !s->next->name)
	yyerror("view without name");
	cfg_parser->cfg->views = s;
	} else
	yyerror("out of memory");
	}
	;
	contents_view: contents_view content_view
	\| ;
	content_view: view_name \| view_local_zone \| view_local_data \| view_first \|
	view_response_ip \| view_response_ip_data \| view_local_data_ptr
	;
	authstart: VAR_AUTH_ZONE
	{
	struct config_auth* s;
	OUTYY(("\nP(auth_zone:)\n"));
	s = (struct config_auth*)calloc(1, sizeof(struct config_auth));
	if(s) {
	s->next = cfg_parser->cfg->auths;
	cfg_parser->cfg->auths = s;
	/* defaults for auth zone */
	s->for_downstream = 1;
	s->for_upstream = 1;
	s->fallback_enabled = 0;
	} else
	yyerror("out of memory");
	}
	;
	contents_auth: contents_auth content_auth
	\| ;
	content_auth: auth_name \| auth_zonefile \| auth_master \| auth_url \|
	auth_for_downstream \| auth_for_upstream \| auth_fallback_enabled \|
	auth_allow_notify
	;
	server_num_threads: VAR_NUM_THREADS STRING_ARG
	{
	OUTYY(("P(server_num_threads:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->num_threads = atoi($2);
	free($2);
	}
	;
	server_verbosity: VAR_VERBOSITY STRING_ARG
	{
	OUTYY(("P(server_verbosity:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->verbosity = atoi($2);
	free($2);
	}
	;
	server_statistics_interval: VAR_STATISTICS_INTERVAL STRING_ARG
	{
	OUTYY(("P(server_statistics_interval:%s)\n", $2));
	if(strcmp($2, "") == 0 \|\| strcmp($2, "0") == 0)
	cfg_parser->cfg->stat_interval = 0;
	else if(atoi($2) == 0)
	yyerror("number expected");
	else cfg_parser->cfg->stat_interval = atoi($2);
	free($2);
	}
	;
	server_statistics_cumulative: VAR_STATISTICS_CUMULATIVE STRING_ARG
	{
	OUTYY(("P(server_statistics_cumulative:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->stat_cumulative = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_extended_statistics: VAR_EXTENDED_STATISTICS STRING_ARG
	{
	OUTYY(("P(server_extended_statistics:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->stat_extended = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_shm_enable: VAR_SHM_ENABLE STRING_ARG
	{
	OUTYY(("P(server_shm_enable:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->shm_enable = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_shm_key: VAR_SHM_KEY STRING_ARG
	{
	OUTYY(("P(server_shm_key:%s)\n", $2));
	if(strcmp($2, "") == 0 \|\| strcmp($2, "0") == 0)
	cfg_parser->cfg->shm_key = 0;
	else if(atoi($2) == 0)
	yyerror("number expected");
	else cfg_parser->cfg->shm_key = atoi($2);
	free($2);
	}
	;
	server_port: VAR_PORT STRING_ARG
	{
	OUTYY(("P(server_port:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("port number expected");
	else cfg_parser->cfg->port = atoi($2);
	free($2);
	}
	;
	server_send_client_subnet: VAR_SEND_CLIENT_SUBNET STRING_ARG
	{
	#ifdef CLIENT_SUBNET
	OUTYY(("P(server_send_client_subnet:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->client_subnet, $2))
	fatal_exit("out of memory adding client-subnet");
	#else
	OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
	#endif
	}
	;
	server_client_subnet_zone: VAR_CLIENT_SUBNET_ZONE STRING_ARG
	{
	#ifdef CLIENT_SUBNET
	OUTYY(("P(server_client_subnet_zone:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->client_subnet_zone,
	$2))
	fatal_exit("out of memory adding client-subnet-zone");
	#else
	OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
	#endif
	}
	;
	server_client_subnet_always_forward:
	VAR_CLIENT_SUBNET_ALWAYS_FORWARD STRING_ARG
	{
	#ifdef CLIENT_SUBNET
	OUTYY(("P(server_client_subnet_always_forward:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else
	cfg_parser->cfg->client_subnet_always_forward =
	(strcmp($2, "yes")==0);
	#else
	OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
	#endif
	free($2);
	}
	;
	server_client_subnet_opcode: VAR_CLIENT_SUBNET_OPCODE STRING_ARG
	{
	#ifdef CLIENT_SUBNET
	OUTYY(("P(client_subnet_opcode:%s)\n", $2));
	OUTYY(("P(Deprecated option, ignoring)\n"));
	#else
	OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
	#endif
	free($2);
	}
	;
	server_max_client_subnet_ipv4: VAR_MAX_CLIENT_SUBNET_IPV4 STRING_ARG
	{
	#ifdef CLIENT_SUBNET
	OUTYY(("P(max_client_subnet_ipv4:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("IPv4 subnet length expected");
	else if (atoi($2) > 32)
	cfg_parser->cfg->max_client_subnet_ipv4 = 32;
	else if (atoi($2) < 0)
	cfg_parser->cfg->max_client_subnet_ipv4 = 0;
	else cfg_parser->cfg->max_client_subnet_ipv4 = (uint8_t)atoi($2);
	#else
	OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
	#endif
	free($2);
	}
	;
	server_max_client_subnet_ipv6: VAR_MAX_CLIENT_SUBNET_IPV6 STRING_ARG
	{
	#ifdef CLIENT_SUBNET
	OUTYY(("P(max_client_subnet_ipv6:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("Ipv6 subnet length expected");
	else if (atoi($2) > 128)
	cfg_parser->cfg->max_client_subnet_ipv6 = 128;
	else if (atoi($2) < 0)
	cfg_parser->cfg->max_client_subnet_ipv6 = 0;
	else cfg_parser->cfg->max_client_subnet_ipv6 = (uint8_t)atoi($2);
	#else
	OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
	#endif
	free($2);
	}
	;
	+server_min_client_subnet_ipv4: VAR_MIN_CLIENT_SUBNET_IPV4 STRING_ARG
	+ {
	+ #ifdef CLIENT_SUBNET
	+ OUTYY(("P(min_client_subnet_ipv4:%s)\n", $2));
	+ if(atoi($2) == 0 && strcmp($2, "0") != 0)
	+ yyerror("IPv4 subnet length expected");
	+ else if (atoi($2) > 32)
	+ cfg_parser->cfg->min_client_subnet_ipv4 = 32;
	+ else if (atoi($2) < 0)
	+ cfg_parser->cfg->min_client_subnet_ipv4 = 0;
	+ else cfg_parser->cfg->min_client_subnet_ipv4 = (uint8_t)atoi($2);
	+ #else
	+ OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
	+ #endif
	+ free($2);
	+ }
	+ ;
	+server_min_client_subnet_ipv6: VAR_MIN_CLIENT_SUBNET_IPV6 STRING_ARG
	+ {
	+ #ifdef CLIENT_SUBNET
	+ OUTYY(("P(min_client_subnet_ipv6:%s)\n", $2));
	+ if(atoi($2) == 0 && strcmp($2, "0") != 0)
	+ yyerror("Ipv6 subnet length expected");
	+ else if (atoi($2) > 128)
	+ cfg_parser->cfg->min_client_subnet_ipv6 = 128;
	+ else if (atoi($2) < 0)
	+ cfg_parser->cfg->min_client_subnet_ipv6 = 0;
	+ else cfg_parser->cfg->min_client_subnet_ipv6 = (uint8_t)atoi($2);
	+ #else
	+ OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
	+ #endif
	+ free($2);
	+ }
	+ ;
	+server_max_ecs_tree_size_ipv4: VAR_MAX_ECS_TREE_SIZE_IPV4 STRING_ARG
	+ {
	+ #ifdef CLIENT_SUBNET
	+ OUTYY(("P(max_ecs_tree_size_ipv4:%s)\n", $2));
	+ if(atoi($2) == 0 && strcmp($2, "0") != 0)
	+ yyerror("IPv4 ECS tree size expected");
	+ else if (atoi($2) < 0)
	+ cfg_parser->cfg->max_ecs_tree_size_ipv4 = 0;
	+ else cfg_parser->cfg->max_ecs_tree_size_ipv4 = (uint32_t)atoi($2);
	+ #else
	+ OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
	+ #endif
	+ free($2);
	+ }
	+ ;
	+server_max_ecs_tree_size_ipv6: VAR_MAX_ECS_TREE_SIZE_IPV6 STRING_ARG
	+ {
	+ #ifdef CLIENT_SUBNET
	+ OUTYY(("P(max_ecs_tree_size_ipv6:%s)\n", $2));
	+ if(atoi($2) == 0 && strcmp($2, "0") != 0)
	+ yyerror("IPv6 ECS tree size expected");
	+ else if (atoi($2) < 0)
	+ cfg_parser->cfg->max_ecs_tree_size_ipv6 = 0;
	+ else cfg_parser->cfg->max_ecs_tree_size_ipv6 = (uint32_t)atoi($2);
	+ #else
	+ OUTYY(("P(Compiled without edns subnet option, ignoring)\n"));
	+ #endif
	+ free($2);
	+ }
	+ ;
	server_interface: VAR_INTERFACE STRING_ARG
	{
	OUTYY(("P(server_interface:%s)\n", $2));
	if(cfg_parser->cfg->num_ifs == 0)
	cfg_parser->cfg->ifs = calloc(1, sizeof(char*));
	else cfg_parser->cfg->ifs = realloc(cfg_parser->cfg->ifs,
	(cfg_parser->cfg->num_ifs+1)sizeof(char));
	if(!cfg_parser->cfg->ifs)
	yyerror("out of memory");
	else
	cfg_parser->cfg->ifs[cfg_parser->cfg->num_ifs++] = $2;
	}
	;
	server_outgoing_interface: VAR_OUTGOING_INTERFACE STRING_ARG
	{
	OUTYY(("P(server_outgoing_interface:%s)\n", $2));
	if(cfg_parser->cfg->num_out_ifs == 0)
	cfg_parser->cfg->out_ifs = calloc(1, sizeof(char*));
	else cfg_parser->cfg->out_ifs = realloc(
	cfg_parser->cfg->out_ifs,
	(cfg_parser->cfg->num_out_ifs+1)sizeof(char));
	if(!cfg_parser->cfg->out_ifs)
	yyerror("out of memory");
	else
	cfg_parser->cfg->out_ifs[
	cfg_parser->cfg->num_out_ifs++] = $2;
	}
	;
	server_outgoing_range: VAR_OUTGOING_RANGE STRING_ARG
	{
	OUTYY(("P(server_outgoing_range:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("number expected");
	else cfg_parser->cfg->outgoing_num_ports = atoi($2);
	free($2);
	}
	;
	server_outgoing_port_permit: VAR_OUTGOING_PORT_PERMIT STRING_ARG
	{
	OUTYY(("P(server_outgoing_port_permit:%s)\n", $2));
	if(!cfg_mark_ports($2, 1,
	cfg_parser->cfg->outgoing_avail_ports, 65536))
	yyerror("port number or range (\"low-high\") expected");
	free($2);
	}
	;
	server_outgoing_port_avoid: VAR_OUTGOING_PORT_AVOID STRING_ARG
	{
	OUTYY(("P(server_outgoing_port_avoid:%s)\n", $2));
	if(!cfg_mark_ports($2, 0,
	cfg_parser->cfg->outgoing_avail_ports, 65536))
	yyerror("port number or range (\"low-high\") expected");
	free($2);
	}
	;
	server_outgoing_num_tcp: VAR_OUTGOING_NUM_TCP STRING_ARG
	{
	OUTYY(("P(server_outgoing_num_tcp:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->outgoing_num_tcp = atoi($2);
	free($2);
	}
	;
	server_incoming_num_tcp: VAR_INCOMING_NUM_TCP STRING_ARG
	{
	OUTYY(("P(server_incoming_num_tcp:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->incoming_num_tcp = atoi($2);
	free($2);
	}
	;
	server_interface_automatic: VAR_INTERFACE_AUTOMATIC STRING_ARG
	{
	OUTYY(("P(server_interface_automatic:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->if_automatic = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_do_ip4: VAR_DO_IP4 STRING_ARG
	{
	OUTYY(("P(server_do_ip4:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->do_ip4 = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_do_ip6: VAR_DO_IP6 STRING_ARG
	{
	OUTYY(("P(server_do_ip6:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->do_ip6 = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_do_udp: VAR_DO_UDP STRING_ARG
	{
	OUTYY(("P(server_do_udp:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->do_udp = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_do_tcp: VAR_DO_TCP STRING_ARG
	{
	OUTYY(("P(server_do_tcp:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->do_tcp = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_prefer_ip6: VAR_PREFER_IP6 STRING_ARG
	{
	OUTYY(("P(server_prefer_ip6:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->prefer_ip6 = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_tcp_mss: VAR_TCP_MSS STRING_ARG
	{
	OUTYY(("P(server_tcp_mss:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->tcp_mss = atoi($2);
	free($2);
	}
	;
	server_outgoing_tcp_mss: VAR_OUTGOING_TCP_MSS STRING_ARG
	{
	OUTYY(("P(server_outgoing_tcp_mss:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->outgoing_tcp_mss = atoi($2);
	free($2);
	}
	;
	server_tcp_idle_timeout: VAR_TCP_IDLE_TIMEOUT STRING_ARG
	{
	OUTYY(("P(server_tcp_idle_timeout:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else if (atoi($2) > 120000)
	cfg_parser->cfg->tcp_idle_timeout = 120000;
	else if (atoi($2) < 1)
	cfg_parser->cfg->tcp_idle_timeout = 1;
	else cfg_parser->cfg->tcp_idle_timeout = atoi($2);
	free($2);
	}
	;
	server_tcp_keepalive: VAR_EDNS_TCP_KEEPALIVE STRING_ARG
	{
	OUTYY(("P(server_tcp_keepalive:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->do_tcp_keepalive = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_tcp_keepalive_timeout: VAR_EDNS_TCP_KEEPALIVE_TIMEOUT STRING_ARG
	{
	OUTYY(("P(server_tcp_keepalive_timeout:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else if (atoi($2) > 6553500)
	cfg_parser->cfg->tcp_keepalive_timeout = 6553500;
	else if (atoi($2) < 1)
	cfg_parser->cfg->tcp_keepalive_timeout = 0;
	else cfg_parser->cfg->tcp_keepalive_timeout = atoi($2);
	free($2);
	}
	;
	server_tcp_upstream: VAR_TCP_UPSTREAM STRING_ARG
	{
	OUTYY(("P(server_tcp_upstream:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->tcp_upstream = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_udp_upstream_without_downstream: VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM STRING_ARG
	{
	OUTYY(("P(server_udp_upstream_without_downstream:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->udp_upstream_without_downstream = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_ssl_upstream: VAR_SSL_UPSTREAM STRING_ARG
	{
	OUTYY(("P(server_ssl_upstream:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->ssl_upstream = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_ssl_service_key: VAR_SSL_SERVICE_KEY STRING_ARG
	{
	OUTYY(("P(server_ssl_service_key:%s)\n", $2));
	free(cfg_parser->cfg->ssl_service_key);
	cfg_parser->cfg->ssl_service_key = $2;
	}
	;
	server_ssl_service_pem: VAR_SSL_SERVICE_PEM STRING_ARG
	{
	OUTYY(("P(server_ssl_service_pem:%s)\n", $2));
	free(cfg_parser->cfg->ssl_service_pem);
	cfg_parser->cfg->ssl_service_pem = $2;
	}
	;
	server_ssl_port: VAR_SSL_PORT STRING_ARG
	{
	OUTYY(("P(server_ssl_port:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("port number expected");
	else cfg_parser->cfg->ssl_port = atoi($2);
	free($2);
	}
	;
	server_tls_cert_bundle: VAR_TLS_CERT_BUNDLE STRING_ARG
	{
	OUTYY(("P(server_tls_cert_bundle:%s)\n", $2));
	free(cfg_parser->cfg->tls_cert_bundle);
	cfg_parser->cfg->tls_cert_bundle = $2;
	}
	;
	server_tls_win_cert: VAR_TLS_WIN_CERT STRING_ARG
	{
	OUTYY(("P(server_tls_win_cert:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->tls_win_cert = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_tls_additional_port: VAR_TLS_ADDITIONAL_PORT STRING_ARG
	{
	OUTYY(("P(server_tls_additional_port:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->tls_additional_port,
	$2))
	yyerror("out of memory");
	}
	;
	+server_tls_ciphers: VAR_TLS_CIPHERS STRING_ARG
	+ {
	+ OUTYY(("P(server_tls_ciphers:%s)\n", $2));
	+ free(cfg_parser->cfg->tls_ciphers);
	+ cfg_parser->cfg->tls_ciphers = $2;
	+ }
	+ ;
	+server_tls_ciphersuites: VAR_TLS_CIPHERSUITES STRING_ARG
	+ {
	+ OUTYY(("P(server_tls_ciphersuites:%s)\n", $2));
	+ free(cfg_parser->cfg->tls_ciphersuites);
	+ cfg_parser->cfg->tls_ciphersuites = $2;
	+ }
	+ ;
	+server_tls_session_ticket_keys: VAR_TLS_SESSION_TICKET_KEYS STRING_ARG
	+ {
	+ OUTYY(("P(server_tls_session_ticket_keys:%s)\n", $2));
	+ if(!cfg_strlist_append(&cfg_parser->cfg->tls_session_ticket_keys,
	+ $2))
	+ yyerror("out of memory");
	+ }
	+ ;
	server_use_systemd: VAR_USE_SYSTEMD STRING_ARG
	{
	OUTYY(("P(server_use_systemd:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->use_systemd = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_do_daemonize: VAR_DO_DAEMONIZE STRING_ARG
	{
	OUTYY(("P(server_do_daemonize:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->do_daemonize = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_use_syslog: VAR_USE_SYSLOG STRING_ARG
	{
	OUTYY(("P(server_use_syslog:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->use_syslog = (strcmp($2, "yes")==0);
	#if !defined(HAVE_SYSLOG_H) && !defined(UB_ON_WINDOWS)
	if(strcmp($2, "yes") == 0)
	yyerror("no syslog services are available. "
	"(reconfigure and compile to add)");
	#endif
	free($2);
	}
	;
	server_log_time_ascii: VAR_LOG_TIME_ASCII STRING_ARG
	{
	OUTYY(("P(server_log_time_ascii:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->log_time_ascii = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_log_queries: VAR_LOG_QUERIES STRING_ARG
	{
	OUTYY(("P(server_log_queries:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->log_queries = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_log_replies: VAR_LOG_REPLIES STRING_ARG
	{
	OUTYY(("P(server_log_replies:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->log_replies = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	+server_log_tag_queryreply: VAR_LOG_TAG_QUERYREPLY STRING_ARG
	+ {
	+ OUTYY(("P(server_log_tag_queryreply:%s)\n", $2));
	+ if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	+ yyerror("expected yes or no.");
	+ else cfg_parser->cfg->log_tag_queryreply = (strcmp($2, "yes")==0);
	+ free($2);
	+ }
	+ ;
	server_log_servfail: VAR_LOG_SERVFAIL STRING_ARG
	{
	OUTYY(("P(server_log_servfail:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->log_servfail = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_log_local_actions: VAR_LOG_LOCAL_ACTIONS STRING_ARG
	{
	OUTYY(("P(server_log_local_actions:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->log_local_actions = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_chroot: VAR_CHROOT STRING_ARG
	{
	OUTYY(("P(server_chroot:%s)\n", $2));
	free(cfg_parser->cfg->chrootdir);
	cfg_parser->cfg->chrootdir = $2;
	}
	;
	server_username: VAR_USERNAME STRING_ARG
	{
	OUTYY(("P(server_username:%s)\n", $2));
	free(cfg_parser->cfg->username);
	cfg_parser->cfg->username = $2;
	}
	;
	server_directory: VAR_DIRECTORY STRING_ARG
	{
	OUTYY(("P(server_directory:%s)\n", $2));
	free(cfg_parser->cfg->directory);
	cfg_parser->cfg->directory = $2;
	/* change there right away for includes relative to this */
	if($2[0]) {
	char* d;
	#ifdef UB_ON_WINDOWS
	w_config_adjust_directory(cfg_parser->cfg);
	#endif
	d = cfg_parser->cfg->directory;
	/* adjust directory if we have already chroot,
	* like, we reread after sighup */
	if(cfg_parser->chroot && cfg_parser->chroot[0] &&
	strncmp(d, cfg_parser->chroot, strlen(
	cfg_parser->chroot)) == 0)
	d += strlen(cfg_parser->chroot);
	if(d[0]) {
	if(chdir(d))
	log_err("cannot chdir to directory: %s (%s)",
	d, strerror(errno));
	}
	}
	}
	;
	server_logfile: VAR_LOGFILE STRING_ARG
	{
	OUTYY(("P(server_logfile:%s)\n", $2));
	free(cfg_parser->cfg->logfile);
	cfg_parser->cfg->logfile = $2;
	cfg_parser->cfg->use_syslog = 0;
	}
	;
	server_pidfile: VAR_PIDFILE STRING_ARG
	{
	OUTYY(("P(server_pidfile:%s)\n", $2));
	free(cfg_parser->cfg->pidfile);
	cfg_parser->cfg->pidfile = $2;
	}
	;
	server_root_hints: VAR_ROOT_HINTS STRING_ARG
	{
	OUTYY(("P(server_root_hints:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->root_hints, $2))
	yyerror("out of memory");
	}
	;
	server_dlv_anchor_file: VAR_DLV_ANCHOR_FILE STRING_ARG
	{
	OUTYY(("P(server_dlv_anchor_file:%s)\n", $2));
	free(cfg_parser->cfg->dlv_anchor_file);
	cfg_parser->cfg->dlv_anchor_file = $2;
	}
	;
	server_dlv_anchor: VAR_DLV_ANCHOR STRING_ARG
	{
	OUTYY(("P(server_dlv_anchor:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->dlv_anchor_list, $2))
	yyerror("out of memory");
	}
	;
	server_auto_trust_anchor_file: VAR_AUTO_TRUST_ANCHOR_FILE STRING_ARG
	{
	OUTYY(("P(server_auto_trust_anchor_file:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->
	auto_trust_anchor_file_list, $2))
	yyerror("out of memory");
	}
	;
	server_trust_anchor_file: VAR_TRUST_ANCHOR_FILE STRING_ARG
	{
	OUTYY(("P(server_trust_anchor_file:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->
	trust_anchor_file_list, $2))
	yyerror("out of memory");
	}
	;
	server_trusted_keys_file: VAR_TRUSTED_KEYS_FILE STRING_ARG
	{
	OUTYY(("P(server_trusted_keys_file:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->
	trusted_keys_file_list, $2))
	yyerror("out of memory");
	}
	;
	server_trust_anchor: VAR_TRUST_ANCHOR STRING_ARG
	{
	OUTYY(("P(server_trust_anchor:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->trust_anchor_list, $2))
	yyerror("out of memory");
	}
	;
	server_trust_anchor_signaling: VAR_TRUST_ANCHOR_SIGNALING STRING_ARG
	{
	OUTYY(("P(server_trust_anchor_signaling:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else
	cfg_parser->cfg->trust_anchor_signaling =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_root_key_sentinel: VAR_ROOT_KEY_SENTINEL STRING_ARG
	{
	OUTYY(("P(server_root_key_sentinel:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else
	cfg_parser->cfg->root_key_sentinel =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_domain_insecure: VAR_DOMAIN_INSECURE STRING_ARG
	{
	OUTYY(("P(server_domain_insecure:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->domain_insecure, $2))
	yyerror("out of memory");
	}
	;
	server_hide_identity: VAR_HIDE_IDENTITY STRING_ARG
	{
	OUTYY(("P(server_hide_identity:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->hide_identity = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_hide_version: VAR_HIDE_VERSION STRING_ARG
	{
	OUTYY(("P(server_hide_version:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->hide_version = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_hide_trustanchor: VAR_HIDE_TRUSTANCHOR STRING_ARG
	{
	OUTYY(("P(server_hide_trustanchor:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->hide_trustanchor = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_identity: VAR_IDENTITY STRING_ARG
	{
	OUTYY(("P(server_identity:%s)\n", $2));
	free(cfg_parser->cfg->identity);
	cfg_parser->cfg->identity = $2;
	}
	;
	server_version: VAR_VERSION STRING_ARG
	{
	OUTYY(("P(server_version:%s)\n", $2));
	free(cfg_parser->cfg->version);
	cfg_parser->cfg->version = $2;
	}
	;
	server_so_rcvbuf: VAR_SO_RCVBUF STRING_ARG
	{
	OUTYY(("P(server_so_rcvbuf:%s)\n", $2));
	if(!cfg_parse_memsize($2, &cfg_parser->cfg->so_rcvbuf))
	yyerror("buffer size expected");
	free($2);
	}
	;
	server_so_sndbuf: VAR_SO_SNDBUF STRING_ARG
	{
	OUTYY(("P(server_so_sndbuf:%s)\n", $2));
	if(!cfg_parse_memsize($2, &cfg_parser->cfg->so_sndbuf))
	yyerror("buffer size expected");
	free($2);
	}
	;
	server_so_reuseport: VAR_SO_REUSEPORT STRING_ARG
	{
	OUTYY(("P(server_so_reuseport:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->so_reuseport =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_ip_transparent: VAR_IP_TRANSPARENT STRING_ARG
	{
	OUTYY(("P(server_ip_transparent:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->ip_transparent =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_ip_freebind: VAR_IP_FREEBIND STRING_ARG
	{
	OUTYY(("P(server_ip_freebind:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->ip_freebind =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	+server_stream_wait_size: VAR_STREAM_WAIT_SIZE STRING_ARG
	+ {
	+ OUTYY(("P(server_stream_wait_size:%s)\n", $2));
	+ if(!cfg_parse_memsize($2, &cfg_parser->cfg->stream_wait_size))
	+ yyerror("memory size expected");
	+ free($2);
	+ }
	+ ;
	server_edns_buffer_size: VAR_EDNS_BUFFER_SIZE STRING_ARG
	{
	OUTYY(("P(server_edns_buffer_size:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("number expected");
	else if (atoi($2) < 12)
	yyerror("edns buffer size too small");
	else if (atoi($2) > 65535)
	cfg_parser->cfg->edns_buffer_size = 65535;
	else cfg_parser->cfg->edns_buffer_size = atoi($2);
	free($2);
	}
	;
	server_msg_buffer_size: VAR_MSG_BUFFER_SIZE STRING_ARG
	{
	OUTYY(("P(server_msg_buffer_size:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("number expected");
	else if (atoi($2) < 4096)
	yyerror("message buffer size too small (use 4096)");
	else cfg_parser->cfg->msg_buffer_size = atoi($2);
	free($2);
	}
	;
	server_msg_cache_size: VAR_MSG_CACHE_SIZE STRING_ARG
	{
	OUTYY(("P(server_msg_cache_size:%s)\n", $2));
	if(!cfg_parse_memsize($2, &cfg_parser->cfg->msg_cache_size))
	yyerror("memory size expected");
	free($2);
	}
	;
	server_msg_cache_slabs: VAR_MSG_CACHE_SLABS STRING_ARG
	{
	OUTYY(("P(server_msg_cache_slabs:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("number expected");
	else {
	cfg_parser->cfg->msg_cache_slabs = atoi($2);
	if(!is_pow2(cfg_parser->cfg->msg_cache_slabs))
	yyerror("must be a power of 2");
	}
	free($2);
	}
	;
	server_num_queries_per_thread: VAR_NUM_QUERIES_PER_THREAD STRING_ARG
	{
	OUTYY(("P(server_num_queries_per_thread:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("number expected");
	else cfg_parser->cfg->num_queries_per_thread = atoi($2);
	free($2);
	}
	;
	server_jostle_timeout: VAR_JOSTLE_TIMEOUT STRING_ARG
	{
	OUTYY(("P(server_jostle_timeout:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->jostle_time = atoi($2);
	free($2);
	}
	;
	server_delay_close: VAR_DELAY_CLOSE STRING_ARG
	{
	OUTYY(("P(server_delay_close:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->delay_close = atoi($2);
	free($2);
	}
	;
	server_unblock_lan_zones: VAR_UNBLOCK_LAN_ZONES STRING_ARG
	{
	OUTYY(("P(server_unblock_lan_zones:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->unblock_lan_zones =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_insecure_lan_zones: VAR_INSECURE_LAN_ZONES STRING_ARG
	{
	OUTYY(("P(server_insecure_lan_zones:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->insecure_lan_zones =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_rrset_cache_size: VAR_RRSET_CACHE_SIZE STRING_ARG
	{
	OUTYY(("P(server_rrset_cache_size:%s)\n", $2));
	if(!cfg_parse_memsize($2, &cfg_parser->cfg->rrset_cache_size))
	yyerror("memory size expected");
	free($2);
	}
	;
	server_rrset_cache_slabs: VAR_RRSET_CACHE_SLABS STRING_ARG
	{
	OUTYY(("P(server_rrset_cache_slabs:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("number expected");
	else {
	cfg_parser->cfg->rrset_cache_slabs = atoi($2);
	if(!is_pow2(cfg_parser->cfg->rrset_cache_slabs))
	yyerror("must be a power of 2");
	}
	free($2);
	}
	;
	server_infra_host_ttl: VAR_INFRA_HOST_TTL STRING_ARG
	{
	OUTYY(("P(server_infra_host_ttl:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->host_ttl = atoi($2);
	free($2);
	}
	;
	server_infra_lame_ttl: VAR_INFRA_LAME_TTL STRING_ARG
	{
	OUTYY(("P(server_infra_lame_ttl:%s)\n", $2));
	verbose(VERB_DETAIL, "ignored infra-lame-ttl: %s (option "
	"removed, use infra-host-ttl)", $2);
	free($2);
	}
	;
	server_infra_cache_numhosts: VAR_INFRA_CACHE_NUMHOSTS STRING_ARG
	{
	OUTYY(("P(server_infra_cache_numhosts:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("number expected");
	else cfg_parser->cfg->infra_cache_numhosts = atoi($2);
	free($2);
	}
	;
	server_infra_cache_lame_size: VAR_INFRA_CACHE_LAME_SIZE STRING_ARG
	{
	OUTYY(("P(server_infra_cache_lame_size:%s)\n", $2));
	verbose(VERB_DETAIL, "ignored infra-cache-lame-size: %s "
	"(option removed, use infra-cache-numhosts)", $2);
	free($2);
	}
	;
	server_infra_cache_slabs: VAR_INFRA_CACHE_SLABS STRING_ARG
	{
	OUTYY(("P(server_infra_cache_slabs:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("number expected");
	else {
	cfg_parser->cfg->infra_cache_slabs = atoi($2);
	if(!is_pow2(cfg_parser->cfg->infra_cache_slabs))
	yyerror("must be a power of 2");
	}
	free($2);
	}
	;
	server_infra_cache_min_rtt: VAR_INFRA_CACHE_MIN_RTT STRING_ARG
	{
	OUTYY(("P(server_infra_cache_min_rtt:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->infra_cache_min_rtt = atoi($2);
	free($2);
	}
	;
	server_target_fetch_policy: VAR_TARGET_FETCH_POLICY STRING_ARG
	{
	OUTYY(("P(server_target_fetch_policy:%s)\n", $2));
	free(cfg_parser->cfg->target_fetch_policy);
	cfg_parser->cfg->target_fetch_policy = $2;
	}
	;
	server_harden_short_bufsize: VAR_HARDEN_SHORT_BUFSIZE STRING_ARG
	{
	OUTYY(("P(server_harden_short_bufsize:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->harden_short_bufsize =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_harden_large_queries: VAR_HARDEN_LARGE_QUERIES STRING_ARG
	{
	OUTYY(("P(server_harden_large_queries:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->harden_large_queries =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_harden_glue: VAR_HARDEN_GLUE STRING_ARG
	{
	OUTYY(("P(server_harden_glue:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->harden_glue =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_harden_dnssec_stripped: VAR_HARDEN_DNSSEC_STRIPPED STRING_ARG
	{
	OUTYY(("P(server_harden_dnssec_stripped:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->harden_dnssec_stripped =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_harden_below_nxdomain: VAR_HARDEN_BELOW_NXDOMAIN STRING_ARG
	{
	OUTYY(("P(server_harden_below_nxdomain:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->harden_below_nxdomain =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_harden_referral_path: VAR_HARDEN_REFERRAL_PATH STRING_ARG
	{
	OUTYY(("P(server_harden_referral_path:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->harden_referral_path =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_harden_algo_downgrade: VAR_HARDEN_ALGO_DOWNGRADE STRING_ARG
	{
	OUTYY(("P(server_harden_algo_downgrade:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->harden_algo_downgrade =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_use_caps_for_id: VAR_USE_CAPS_FOR_ID STRING_ARG
	{
	OUTYY(("P(server_use_caps_for_id:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->use_caps_bits_for_id =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG
	{
	OUTYY(("P(server_caps_whitelist:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->caps_whitelist, $2))
	yyerror("out of memory");
	}
	;
	server_private_address: VAR_PRIVATE_ADDRESS STRING_ARG
	{
	OUTYY(("P(server_private_address:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->private_address, $2))
	yyerror("out of memory");
	}
	;
	server_private_domain: VAR_PRIVATE_DOMAIN STRING_ARG
	{
	OUTYY(("P(server_private_domain:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->private_domain, $2))
	yyerror("out of memory");
	}
	;
	server_prefetch: VAR_PREFETCH STRING_ARG
	{
	OUTYY(("P(server_prefetch:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->prefetch = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_prefetch_key: VAR_PREFETCH_KEY STRING_ARG
	{
	OUTYY(("P(server_prefetch_key:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->prefetch_key = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	+server_deny_any: VAR_DENY_ANY STRING_ARG
	+ {
	+ OUTYY(("P(server_deny_any:%s)\n", $2));
	+ if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	+ yyerror("expected yes or no.");
	+ else cfg_parser->cfg->deny_any = (strcmp($2, "yes")==0);
	+ free($2);
	+ }
	+ ;
	server_unwanted_reply_threshold: VAR_UNWANTED_REPLY_THRESHOLD STRING_ARG
	{
	OUTYY(("P(server_unwanted_reply_threshold:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->unwanted_threshold = atoi($2);
	free($2);
	}
	;
	server_do_not_query_address: VAR_DO_NOT_QUERY_ADDRESS STRING_ARG
	{
	OUTYY(("P(server_do_not_query_address:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->donotqueryaddrs, $2))
	yyerror("out of memory");
	}
	;
	server_do_not_query_localhost: VAR_DO_NOT_QUERY_LOCALHOST STRING_ARG
	{
	OUTYY(("P(server_do_not_query_localhost:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->donotquery_localhost =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_access_control: VAR_ACCESS_CONTROL STRING_ARG STRING_ARG
	{
	OUTYY(("P(server_access_control:%s %s)\n", $2, $3));
	if(strcmp($3, "deny")!=0 && strcmp($3, "refuse")!=0 &&
	strcmp($3, "deny_non_local")!=0 &&
	strcmp($3, "refuse_non_local")!=0 &&
	strcmp($3, "allow_setrd")!=0 &&
	strcmp($3, "allow")!=0 &&
	strcmp($3, "allow_snoop")!=0) {
	yyerror("expected deny, refuse, deny_non_local, "
	"refuse_non_local, allow, allow_setrd or "
	"allow_snoop in access control action");
	+ free($2);
	+ free($3);
	} else {
	if(!cfg_str2list_insert(&cfg_parser->cfg->acls, $2, $3))
	fatal_exit("out of memory adding acl");
	}
	}
	;
	server_module_conf: VAR_MODULE_CONF STRING_ARG
	{
	OUTYY(("P(server_module_conf:%s)\n", $2));
	free(cfg_parser->cfg->module_conf);
	cfg_parser->cfg->module_conf = $2;
	}
	;
	server_val_override_date: VAR_VAL_OVERRIDE_DATE STRING_ARG
	{
	OUTYY(("P(server_val_override_date:%s)\n", $2));
	if(*$2 == '\0' \|\| strcmp($2, "0") == 0) {
	cfg_parser->cfg->val_date_override = 0;
	} else if(strlen($2) == 14) {
	cfg_parser->cfg->val_date_override =
	cfg_convert_timeval($2);
	if(!cfg_parser->cfg->val_date_override)
	yyerror("bad date/time specification");
	} else {
	if(atoi($2) == 0)
	yyerror("number expected");
	cfg_parser->cfg->val_date_override = atoi($2);
	}
	free($2);
	}
	;
	server_val_sig_skew_min: VAR_VAL_SIG_SKEW_MIN STRING_ARG
	{
	OUTYY(("P(server_val_sig_skew_min:%s)\n", $2));
	if(*$2 == '\0' \|\| strcmp($2, "0") == 0) {
	cfg_parser->cfg->val_sig_skew_min = 0;
	} else {
	cfg_parser->cfg->val_sig_skew_min = atoi($2);
	if(!cfg_parser->cfg->val_sig_skew_min)
	yyerror("number expected");
	}
	free($2);
	}
	;
	server_val_sig_skew_max: VAR_VAL_SIG_SKEW_MAX STRING_ARG
	{
	OUTYY(("P(server_val_sig_skew_max:%s)\n", $2));
	if(*$2 == '\0' \|\| strcmp($2, "0") == 0) {
	cfg_parser->cfg->val_sig_skew_max = 0;
	} else {
	cfg_parser->cfg->val_sig_skew_max = atoi($2);
	if(!cfg_parser->cfg->val_sig_skew_max)
	yyerror("number expected");
	}
	free($2);
	}
	;
	server_cache_max_ttl: VAR_CACHE_MAX_TTL STRING_ARG
	{
	OUTYY(("P(server_cache_max_ttl:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->max_ttl = atoi($2);
	free($2);
	}
	;
	server_cache_max_negative_ttl: VAR_CACHE_MAX_NEGATIVE_TTL STRING_ARG
	{
	OUTYY(("P(server_cache_max_negative_ttl:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->max_negative_ttl = atoi($2);
	free($2);
	}
	;
	server_cache_min_ttl: VAR_CACHE_MIN_TTL STRING_ARG
	{
	OUTYY(("P(server_cache_min_ttl:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->min_ttl = atoi($2);
	free($2);
	}
	;
	server_bogus_ttl: VAR_BOGUS_TTL STRING_ARG
	{
	OUTYY(("P(server_bogus_ttl:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->bogus_ttl = atoi($2);
	free($2);
	}
	;
	server_val_clean_additional: VAR_VAL_CLEAN_ADDITIONAL STRING_ARG
	{
	OUTYY(("P(server_val_clean_additional:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->val_clean_additional =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_val_permissive_mode: VAR_VAL_PERMISSIVE_MODE STRING_ARG
	{
	OUTYY(("P(server_val_permissive_mode:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->val_permissive_mode =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_aggressive_nsec: VAR_AGGRESSIVE_NSEC STRING_ARG
	{
	OUTYY(("P(server_aggressive_nsec:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else
	cfg_parser->cfg->aggressive_nsec =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_ignore_cd_flag: VAR_IGNORE_CD_FLAG STRING_ARG
	{
	OUTYY(("P(server_ignore_cd_flag:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->ignore_cd = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_serve_expired: VAR_SERVE_EXPIRED STRING_ARG
	{
	OUTYY(("P(server_serve_expired:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->serve_expired = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_serve_expired_ttl: VAR_SERVE_EXPIRED_TTL STRING_ARG
	{
	OUTYY(("P(server_serve_expired_ttl:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->serve_expired_ttl = atoi($2);
	free($2);
	}
	;
	server_serve_expired_ttl_reset: VAR_SERVE_EXPIRED_TTL_RESET STRING_ARG
	{
	OUTYY(("P(server_serve_expired_ttl_reset:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->serve_expired_ttl_reset = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_fake_dsa: VAR_FAKE_DSA STRING_ARG
	{
	OUTYY(("P(server_fake_dsa:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	#ifdef HAVE_SSL
	else fake_dsa = (strcmp($2, "yes")==0);
	if(fake_dsa)
	log_warn("test option fake_dsa is enabled");
	#endif
	free($2);
	}
	;
	server_fake_sha1: VAR_FAKE_SHA1 STRING_ARG
	{
	OUTYY(("P(server_fake_sha1:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	#ifdef HAVE_SSL
	else fake_sha1 = (strcmp($2, "yes")==0);
	if(fake_sha1)
	log_warn("test option fake_sha1 is enabled");
	#endif
	free($2);
	}
	;
	server_val_log_level: VAR_VAL_LOG_LEVEL STRING_ARG
	{
	OUTYY(("P(server_val_log_level:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->val_log_level = atoi($2);
	free($2);
	}
	;
	server_val_nsec3_keysize_iterations: VAR_VAL_NSEC3_KEYSIZE_ITERATIONS STRING_ARG
	{
	OUTYY(("P(server_val_nsec3_keysize_iterations:%s)\n", $2));
	free(cfg_parser->cfg->val_nsec3_key_iterations);
	cfg_parser->cfg->val_nsec3_key_iterations = $2;
	}
	;
	server_add_holddown: VAR_ADD_HOLDDOWN STRING_ARG
	{
	OUTYY(("P(server_add_holddown:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->add_holddown = atoi($2);
	free($2);
	}
	;
	server_del_holddown: VAR_DEL_HOLDDOWN STRING_ARG
	{
	OUTYY(("P(server_del_holddown:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->del_holddown = atoi($2);
	free($2);
	}
	;
	server_keep_missing: VAR_KEEP_MISSING STRING_ARG
	{
	OUTYY(("P(server_keep_missing:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->keep_missing = atoi($2);
	free($2);
	}
	;
	server_permit_small_holddown: VAR_PERMIT_SMALL_HOLDDOWN STRING_ARG
	{
	OUTYY(("P(server_permit_small_holddown:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->permit_small_holddown =
	(strcmp($2, "yes")==0);
	free($2);
	}
	server_key_cache_size: VAR_KEY_CACHE_SIZE STRING_ARG
	{
	OUTYY(("P(server_key_cache_size:%s)\n", $2));
	if(!cfg_parse_memsize($2, &cfg_parser->cfg->key_cache_size))
	yyerror("memory size expected");
	free($2);
	}
	;
	server_key_cache_slabs: VAR_KEY_CACHE_SLABS STRING_ARG
	{
	OUTYY(("P(server_key_cache_slabs:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("number expected");
	else {
	cfg_parser->cfg->key_cache_slabs = atoi($2);
	if(!is_pow2(cfg_parser->cfg->key_cache_slabs))
	yyerror("must be a power of 2");
	}
	free($2);
	}
	;
	server_neg_cache_size: VAR_NEG_CACHE_SIZE STRING_ARG
	{
	OUTYY(("P(server_neg_cache_size:%s)\n", $2));
	if(!cfg_parse_memsize($2, &cfg_parser->cfg->neg_cache_size))
	yyerror("memory size expected");
	free($2);
	}
	;
	server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
	{
	OUTYY(("P(server_local_zone:%s %s)\n", $2, $3));
	if(strcmp($3, "static")!=0 && strcmp($3, "deny")!=0 &&
	strcmp($3, "refuse")!=0 && strcmp($3, "redirect")!=0 &&
	strcmp($3, "transparent")!=0 && strcmp($3, "nodefault")!=0
	&& strcmp($3, "typetransparent")!=0
	&& strcmp($3, "always_transparent")!=0
	&& strcmp($3, "always_refuse")!=0
	&& strcmp($3, "always_nxdomain")!=0
	&& strcmp($3, "noview")!=0
	- && strcmp($3, "inform")!=0 && strcmp($3, "inform_deny")!=0)
	+ && strcmp($3, "inform")!=0 && strcmp($3, "inform_deny")!=0
	+ && strcmp($3, "inform_redirect") != 0) {
	yyerror("local-zone type: expected static, deny, "
	"refuse, redirect, transparent, "
	"typetransparent, inform, inform_deny, "
	- "always_transparent, always_refuse, "
	- "always_nxdomain, noview or nodefault");
	- else if(strcmp($3, "nodefault")==0) {
	+ "inform_redirect, always_transparent, "
	+ "always_refuse, always_nxdomain, noview "
	+ "or nodefault");
	+ free($2);
	+ free($3);
	+ } else if(strcmp($3, "nodefault")==0) {
	if(!cfg_strlist_insert(&cfg_parser->cfg->
	local_zones_nodefault, $2))
	fatal_exit("out of memory adding local-zone");
	free($3);
	} else {
	if(!cfg_str2list_insert(&cfg_parser->cfg->local_zones,
	$2, $3))
	fatal_exit("out of memory adding local-zone");
	}
	}
	;
	server_local_data: VAR_LOCAL_DATA STRING_ARG
	{
	OUTYY(("P(server_local_data:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->local_data, $2))
	fatal_exit("out of memory adding local-data");
	}
	;
	server_local_data_ptr: VAR_LOCAL_DATA_PTR STRING_ARG
	{
	char* ptr;
	OUTYY(("P(server_local_data_ptr:%s)\n", $2));
	ptr = cfg_ptr_reverse($2);
	free($2);
	if(ptr) {
	if(!cfg_strlist_insert(&cfg_parser->cfg->
	local_data, ptr))
	fatal_exit("out of memory adding local-data");
	} else {
	yyerror("local-data-ptr could not be reversed");
	}
	}
	;
	server_minimal_responses: VAR_MINIMAL_RESPONSES STRING_ARG
	{
	OUTYY(("P(server_minimal_responses:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->minimal_responses =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_rrset_roundrobin: VAR_RRSET_ROUNDROBIN STRING_ARG
	{
	OUTYY(("P(server_rrset_roundrobin:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->rrset_roundrobin =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	+server_unknown_server_time_limit: VAR_UNKNOWN_SERVER_TIME_LIMIT STRING_ARG
	+ {
	+ OUTYY(("P(server_unknown_server_time_limit:%s)\n", $2));
	+ cfg_parser->cfg->unknown_server_time_limit = atoi($2);
	+ free($2);
	+ }
	+ ;
	server_max_udp_size: VAR_MAX_UDP_SIZE STRING_ARG
	{
	OUTYY(("P(server_max_udp_size:%s)\n", $2));
	cfg_parser->cfg->max_udp_size = atoi($2);
	free($2);
	}
	;
	server_dns64_prefix: VAR_DNS64_PREFIX STRING_ARG
	{
	OUTYY(("P(dns64_prefix:%s)\n", $2));
	free(cfg_parser->cfg->dns64_prefix);
	cfg_parser->cfg->dns64_prefix = $2;
	}
	;
	server_dns64_synthall: VAR_DNS64_SYNTHALL STRING_ARG
	{
	OUTYY(("P(server_dns64_synthall:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->dns64_synthall = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_dns64_ignore_aaaa: VAR_DNS64_IGNORE_AAAA STRING_ARG
	{
	OUTYY(("P(dns64_ignore_aaaa:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->dns64_ignore_aaaa,
	$2))
	fatal_exit("out of memory adding dns64-ignore-aaaa");
	}
	;
	server_define_tag: VAR_DEFINE_TAG STRING_ARG
	{
	char* p, *s = $2;
	OUTYY(("P(server_define_tag:%s)\n", $2));
	while((p=strsep(&s, " \t\n")) != NULL) {
	if(*p) {
	if(!config_add_tag(cfg_parser->cfg, p))
	yyerror("could not define-tag, "
	"out of memory");
	}
	}
	free($2);
	}
	;
	server_local_zone_tag: VAR_LOCAL_ZONE_TAG STRING_ARG STRING_ARG
	{
	size_t len = 0;
	uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, $3,
	&len);
	free($3);
	OUTYY(("P(server_local_zone_tag:%s)\n", $2));
	- if(!bitlist)
	+ if(!bitlist) {
	yyerror("could not parse tags, (define-tag them first)");
	+ free($2);
	+ }
	if(bitlist) {
	if(!cfg_strbytelist_insert(
	&cfg_parser->cfg->local_zone_tags,
	$2, bitlist, len)) {
	yyerror("out of memory");
	free($2);
	}
	}
	}
	;
	server_access_control_tag: VAR_ACCESS_CONTROL_TAG STRING_ARG STRING_ARG
	{
	size_t len = 0;
	uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, $3,
	&len);
	free($3);
	OUTYY(("P(server_access_control_tag:%s)\n", $2));
	- if(!bitlist)
	+ if(!bitlist) {
	yyerror("could not parse tags, (define-tag them first)");
	+ free($2);
	+ }
	if(bitlist) {
	if(!cfg_strbytelist_insert(
	&cfg_parser->cfg->acl_tags,
	$2, bitlist, len)) {
	yyerror("out of memory");
	free($2);
	}
	}
	}
	;
	server_access_control_tag_action: VAR_ACCESS_CONTROL_TAG_ACTION STRING_ARG STRING_ARG STRING_ARG
	{
	OUTYY(("P(server_access_control_tag_action:%s %s %s)\n", $2, $3, $4));
	if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_actions,
	$2, $3, $4)) {
	yyerror("out of memory");
	free($2);
	free($3);
	free($4);
	}
	}
	;
	server_access_control_tag_data: VAR_ACCESS_CONTROL_TAG_DATA STRING_ARG STRING_ARG STRING_ARG
	{
	OUTYY(("P(server_access_control_tag_data:%s %s %s)\n", $2, $3, $4));
	if(!cfg_str3list_insert(&cfg_parser->cfg->acl_tag_datas,
	$2, $3, $4)) {
	yyerror("out of memory");
	free($2);
	free($3);
	free($4);
	}
	}
	;
	server_local_zone_override: VAR_LOCAL_ZONE_OVERRIDE STRING_ARG STRING_ARG STRING_ARG
	{
	OUTYY(("P(server_local_zone_override:%s %s %s)\n", $2, $3, $4));
	if(!cfg_str3list_insert(&cfg_parser->cfg->local_zone_overrides,
	$2, $3, $4)) {
	yyerror("out of memory");
	free($2);
	free($3);
	free($4);
	}
	}
	;
	server_access_control_view: VAR_ACCESS_CONTROL_VIEW STRING_ARG STRING_ARG
	{
	OUTYY(("P(server_access_control_view:%s %s)\n", $2, $3));
	if(!cfg_str2list_insert(&cfg_parser->cfg->acl_view,
	$2, $3)) {
	yyerror("out of memory");
	- free($2);
	- free($3);
	}
	}
	;
	server_response_ip_tag: VAR_RESPONSE_IP_TAG STRING_ARG STRING_ARG
	{
	size_t len = 0;
	uint8_t* bitlist = config_parse_taglist(cfg_parser->cfg, $3,
	&len);
	free($3);
	OUTYY(("P(response_ip_tag:%s)\n", $2));
	- if(!bitlist)
	+ if(!bitlist) {
	yyerror("could not parse tags, (define-tag them first)");
	+ free($2);
	+ }
	if(bitlist) {
	if(!cfg_strbytelist_insert(
	&cfg_parser->cfg->respip_tags,
	$2, bitlist, len)) {
	yyerror("out of memory");
	free($2);
	}
	}
	}
	;
	server_ip_ratelimit: VAR_IP_RATELIMIT STRING_ARG
	{
	OUTYY(("P(server_ip_ratelimit:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->ip_ratelimit = atoi($2);
	free($2);
	}
	;

	server_ratelimit: VAR_RATELIMIT STRING_ARG
	{
	OUTYY(("P(server_ratelimit:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->ratelimit = atoi($2);
	free($2);
	}
	;
	server_ip_ratelimit_size: VAR_IP_RATELIMIT_SIZE STRING_ARG
	{
	OUTYY(("P(server_ip_ratelimit_size:%s)\n", $2));
	if(!cfg_parse_memsize($2, &cfg_parser->cfg->ip_ratelimit_size))
	yyerror("memory size expected");
	free($2);
	}
	;
	server_ratelimit_size: VAR_RATELIMIT_SIZE STRING_ARG
	{
	OUTYY(("P(server_ratelimit_size:%s)\n", $2));
	if(!cfg_parse_memsize($2, &cfg_parser->cfg->ratelimit_size))
	yyerror("memory size expected");
	free($2);
	}
	;
	server_ip_ratelimit_slabs: VAR_IP_RATELIMIT_SLABS STRING_ARG
	{
	OUTYY(("P(server_ip_ratelimit_slabs:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("number expected");
	else {
	cfg_parser->cfg->ip_ratelimit_slabs = atoi($2);
	if(!is_pow2(cfg_parser->cfg->ip_ratelimit_slabs))
	yyerror("must be a power of 2");
	}
	free($2);
	}
	;
	server_ratelimit_slabs: VAR_RATELIMIT_SLABS STRING_ARG
	{
	OUTYY(("P(server_ratelimit_slabs:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("number expected");
	else {
	cfg_parser->cfg->ratelimit_slabs = atoi($2);
	if(!is_pow2(cfg_parser->cfg->ratelimit_slabs))
	yyerror("must be a power of 2");
	}
	free($2);
	}
	;
	server_ratelimit_for_domain: VAR_RATELIMIT_FOR_DOMAIN STRING_ARG STRING_ARG
	{
	OUTYY(("P(server_ratelimit_for_domain:%s %s)\n", $2, $3));
	if(atoi($3) == 0 && strcmp($3, "0") != 0) {
	yyerror("number expected");
	+ free($2);
	+ free($3);
	} else {
	if(!cfg_str2list_insert(&cfg_parser->cfg->
	ratelimit_for_domain, $2, $3))
	fatal_exit("out of memory adding "
	"ratelimit-for-domain");
	}
	}
	;
	server_ratelimit_below_domain: VAR_RATELIMIT_BELOW_DOMAIN STRING_ARG STRING_ARG
	{
	OUTYY(("P(server_ratelimit_below_domain:%s %s)\n", $2, $3));
	if(atoi($3) == 0 && strcmp($3, "0") != 0) {
	yyerror("number expected");
	+ free($2);
	+ free($3);
	} else {
	if(!cfg_str2list_insert(&cfg_parser->cfg->
	ratelimit_below_domain, $2, $3))
	fatal_exit("out of memory adding "
	"ratelimit-below-domain");
	}
	}
	;
	server_ip_ratelimit_factor: VAR_IP_RATELIMIT_FACTOR STRING_ARG
	{
	OUTYY(("P(server_ip_ratelimit_factor:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->ip_ratelimit_factor = atoi($2);
	free($2);
	}
	;
	server_ratelimit_factor: VAR_RATELIMIT_FACTOR STRING_ARG
	{
	OUTYY(("P(server_ratelimit_factor:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->ratelimit_factor = atoi($2);
	free($2);
	}
	;
	server_low_rtt: VAR_LOW_RTT STRING_ARG
	{
	- OUTYY(("P(server_low_rtt:%s)\n", $2));
	- if(atoi($2) == 0 && strcmp($2, "0") != 0)
	+ OUTYY(("P(low-rtt option is deprecated, use fast-server-num instead)\n"));
	+ free($2);
	+ }
	+ ;
	+server_fast_server_num: VAR_FAST_SERVER_NUM STRING_ARG
	+ {
	+ OUTYY(("P(server_fast_server_num:%s)\n", $2));
	+ if(atoi($2) <= 0)
	yyerror("number expected");
	- else cfg_parser->cfg->low_rtt = atoi($2);
	+ else cfg_parser->cfg->fast_server_num = atoi($2);
	free($2);
	}
	;
	-server_low_rtt_permil: VAR_LOW_RTT_PERMIL STRING_ARG
	+server_fast_server_permil: VAR_FAST_SERVER_PERMIL STRING_ARG
	{
	- OUTYY(("P(server_low_rtt_permil:%s)\n", $2));
	+ OUTYY(("P(server_fast_server_permil:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	- else cfg_parser->cfg->low_rtt_permil = atoi($2);
	+ else cfg_parser->cfg->fast_server_permil = atoi($2);
	free($2);
	}
	;
	server_qname_minimisation: VAR_QNAME_MINIMISATION STRING_ARG
	{
	OUTYY(("P(server_qname_minimisation:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->qname_minimisation =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_qname_minimisation_strict: VAR_QNAME_MINIMISATION_STRICT STRING_ARG
	{
	OUTYY(("P(server_qname_minimisation_strict:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->qname_minimisation_strict =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_ipsecmod_enabled: VAR_IPSECMOD_ENABLED STRING_ARG
	{
	#ifdef USE_IPSECMOD
	OUTYY(("P(server_ipsecmod_enabled:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->ipsecmod_enabled = (strcmp($2, "yes")==0);
	- free($2);
	#else
	OUTYY(("P(Compiled without IPsec module, ignoring)\n"));
	#endif
	+ free($2);
	}
	;
	server_ipsecmod_ignore_bogus: VAR_IPSECMOD_IGNORE_BOGUS STRING_ARG
	{
	#ifdef USE_IPSECMOD
	OUTYY(("P(server_ipsecmod_ignore_bogus:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->ipsecmod_ignore_bogus = (strcmp($2, "yes")==0);
	- free($2);
	#else
	OUTYY(("P(Compiled without IPsec module, ignoring)\n"));
	#endif
	+ free($2);
	}
	;
	server_ipsecmod_hook: VAR_IPSECMOD_HOOK STRING_ARG
	{
	#ifdef USE_IPSECMOD
	OUTYY(("P(server_ipsecmod_hook:%s)\n", $2));
	free(cfg_parser->cfg->ipsecmod_hook);
	cfg_parser->cfg->ipsecmod_hook = $2;
	#else
	OUTYY(("P(Compiled without IPsec module, ignoring)\n"));
	+ free($2);
	#endif
	}
	;
	server_ipsecmod_max_ttl: VAR_IPSECMOD_MAX_TTL STRING_ARG
	{
	#ifdef USE_IPSECMOD
	OUTYY(("P(server_ipsecmod_max_ttl:%s)\n", $2));
	if(atoi($2) == 0 && strcmp($2, "0") != 0)
	yyerror("number expected");
	else cfg_parser->cfg->ipsecmod_max_ttl = atoi($2);
	free($2);
	#else
	OUTYY(("P(Compiled without IPsec module, ignoring)\n"));
	+ free($2);
	#endif
	}
	;
	server_ipsecmod_whitelist: VAR_IPSECMOD_WHITELIST STRING_ARG
	{
	#ifdef USE_IPSECMOD
	OUTYY(("P(server_ipsecmod_whitelist:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->ipsecmod_whitelist, $2))
	yyerror("out of memory");
	#else
	OUTYY(("P(Compiled without IPsec module, ignoring)\n"));
	+ free($2);
	#endif
	}
	;
	server_ipsecmod_strict: VAR_IPSECMOD_STRICT STRING_ARG
	{
	#ifdef USE_IPSECMOD
	OUTYY(("P(server_ipsecmod_strict:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->ipsecmod_strict = (strcmp($2, "yes")==0);
	free($2);
	#else
	OUTYY(("P(Compiled without IPsec module, ignoring)\n"));
	+ free($2);
	#endif
	}
	;
	stub_name: VAR_NAME STRING_ARG
	{
	OUTYY(("P(name:%s)\n", $2));
	if(cfg_parser->cfg->stubs->name)
	yyerror("stub name override, there must be one name "
	"for one stub-zone");
	free(cfg_parser->cfg->stubs->name);
	cfg_parser->cfg->stubs->name = $2;
	}
	;
	stub_host: VAR_STUB_HOST STRING_ARG
	{
	OUTYY(("P(stub-host:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->hosts, $2))
	yyerror("out of memory");
	}
	;
	stub_addr: VAR_STUB_ADDR STRING_ARG
	{
	OUTYY(("P(stub-addr:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->stubs->addrs, $2))
	yyerror("out of memory");
	}
	;
	stub_first: VAR_STUB_FIRST STRING_ARG
	{
	OUTYY(("P(stub-first:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->stubs->isfirst=(strcmp($2, "yes")==0);
	free($2);
	}
	;
	stub_no_cache: VAR_STUB_NO_CACHE STRING_ARG
	{
	OUTYY(("P(stub-no-cache:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->stubs->no_cache=(strcmp($2, "yes")==0);
	free($2);
	}
	;
	stub_ssl_upstream: VAR_STUB_SSL_UPSTREAM STRING_ARG
	{
	OUTYY(("P(stub-ssl-upstream:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->stubs->ssl_upstream =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	stub_prime: VAR_STUB_PRIME STRING_ARG
	{
	OUTYY(("P(stub-prime:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->stubs->isprime =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	forward_name: VAR_NAME STRING_ARG
	{
	OUTYY(("P(name:%s)\n", $2));
	if(cfg_parser->cfg->forwards->name)
	yyerror("forward name override, there must be one "
	"name for one forward-zone");
	free(cfg_parser->cfg->forwards->name);
	cfg_parser->cfg->forwards->name = $2;
	}
	;
	forward_host: VAR_FORWARD_HOST STRING_ARG
	{
	OUTYY(("P(forward-host:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->hosts, $2))
	yyerror("out of memory");
	}
	;
	forward_addr: VAR_FORWARD_ADDR STRING_ARG
	{
	OUTYY(("P(forward-addr:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->forwards->addrs, $2))
	yyerror("out of memory");
	}
	;
	forward_first: VAR_FORWARD_FIRST STRING_ARG
	{
	OUTYY(("P(forward-first:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->forwards->isfirst=(strcmp($2, "yes")==0);
	free($2);
	}
	;
	forward_no_cache: VAR_FORWARD_NO_CACHE STRING_ARG
	{
	OUTYY(("P(forward-no-cache:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->forwards->no_cache=(strcmp($2, "yes")==0);
	free($2);
	}
	;
	forward_ssl_upstream: VAR_FORWARD_SSL_UPSTREAM STRING_ARG
	{
	OUTYY(("P(forward-ssl-upstream:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->forwards->ssl_upstream =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	auth_name: VAR_NAME STRING_ARG
	{
	OUTYY(("P(name:%s)\n", $2));
	if(cfg_parser->cfg->auths->name)
	yyerror("auth name override, there must be one name "
	"for one auth-zone");
	free(cfg_parser->cfg->auths->name);
	cfg_parser->cfg->auths->name = $2;
	}
	;
	auth_zonefile: VAR_ZONEFILE STRING_ARG
	{
	OUTYY(("P(zonefile:%s)\n", $2));
	free(cfg_parser->cfg->auths->zonefile);
	cfg_parser->cfg->auths->zonefile = $2;
	}
	;
	auth_master: VAR_MASTER STRING_ARG
	{
	OUTYY(("P(master:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->auths->masters, $2))
	yyerror("out of memory");
	}
	;
	auth_url: VAR_URL STRING_ARG
	{
	OUTYY(("P(url:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->auths->urls, $2))
	yyerror("out of memory");
	}
	;
	auth_allow_notify: VAR_ALLOW_NOTIFY STRING_ARG
	{
	OUTYY(("P(allow-notify:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->auths->allow_notify,
	$2))
	yyerror("out of memory");
	}
	;
	auth_for_downstream: VAR_FOR_DOWNSTREAM STRING_ARG
	{
	OUTYY(("P(for-downstream:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->auths->for_downstream =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	auth_for_upstream: VAR_FOR_UPSTREAM STRING_ARG
	{
	OUTYY(("P(for-upstream:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->auths->for_upstream =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	auth_fallback_enabled: VAR_FALLBACK_ENABLED STRING_ARG
	{
	OUTYY(("P(fallback-enabled:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->auths->fallback_enabled =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	view_name: VAR_NAME STRING_ARG
	{
	OUTYY(("P(name:%s)\n", $2));
	if(cfg_parser->cfg->views->name)
	yyerror("view name override, there must be one "
	"name for one view");
	free(cfg_parser->cfg->views->name);
	cfg_parser->cfg->views->name = $2;
	}
	;
	view_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
	{
	OUTYY(("P(view_local_zone:%s %s)\n", $2, $3));
	if(strcmp($3, "static")!=0 && strcmp($3, "deny")!=0 &&
	strcmp($3, "refuse")!=0 && strcmp($3, "redirect")!=0 &&
	strcmp($3, "transparent")!=0 && strcmp($3, "nodefault")!=0
	&& strcmp($3, "typetransparent")!=0
	&& strcmp($3, "always_transparent")!=0
	&& strcmp($3, "always_refuse")!=0
	&& strcmp($3, "always_nxdomain")!=0
	&& strcmp($3, "noview")!=0
	- && strcmp($3, "inform")!=0 && strcmp($3, "inform_deny")!=0)
	+ && strcmp($3, "inform")!=0 && strcmp($3, "inform_deny")!=0) {
	yyerror("local-zone type: expected static, deny, "
	"refuse, redirect, transparent, "
	"typetransparent, inform, inform_deny, "
	"always_transparent, always_refuse, "
	"always_nxdomain, noview or nodefault");
	- else if(strcmp($3, "nodefault")==0) {
	+ free($2);
	+ free($3);
	+ } else if(strcmp($3, "nodefault")==0) {
	if(!cfg_strlist_insert(&cfg_parser->cfg->views->
	local_zones_nodefault, $2))
	fatal_exit("out of memory adding local-zone");
	free($3);
	} else {
	if(!cfg_str2list_insert(
	&cfg_parser->cfg->views->local_zones,
	$2, $3))
	fatal_exit("out of memory adding local-zone");
	}
	}
	;
	view_response_ip: VAR_RESPONSE_IP STRING_ARG STRING_ARG
	{
	OUTYY(("P(view_response_ip:%s %s)\n", $2, $3));
	validate_respip_action($3);
	if(!cfg_str2list_insert(
	&cfg_parser->cfg->views->respip_actions, $2, $3))
	fatal_exit("out of memory adding per-view "
	"response-ip action");
	}
	;
	view_response_ip_data: VAR_RESPONSE_IP_DATA STRING_ARG STRING_ARG
	{
	OUTYY(("P(view_response_ip_data:%s)\n", $2));
	if(!cfg_str2list_insert(
	&cfg_parser->cfg->views->respip_data, $2, $3))
	fatal_exit("out of memory adding response-ip-data");
	}
	;
	view_local_data: VAR_LOCAL_DATA STRING_ARG
	{
	OUTYY(("P(view_local_data:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->views->local_data, $2)) {
	fatal_exit("out of memory adding local-data");
	- free($2);
	}
	}
	;
	view_local_data_ptr: VAR_LOCAL_DATA_PTR STRING_ARG
	{
	char* ptr;
	OUTYY(("P(view_local_data_ptr:%s)\n", $2));
	ptr = cfg_ptr_reverse($2);
	free($2);
	if(ptr) {
	if(!cfg_strlist_insert(&cfg_parser->cfg->views->
	local_data, ptr))
	fatal_exit("out of memory adding local-data");
	} else {
	yyerror("local-data-ptr could not be reversed");
	}
	}
	;
	view_first: VAR_VIEW_FIRST STRING_ARG
	{
	OUTYY(("P(view-first:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->views->isfirst=(strcmp($2, "yes")==0);
	free($2);
	}
	;
	rcstart: VAR_REMOTE_CONTROL
	{
	OUTYY(("\nP(remote-control:)\n"));
	}
	;
	contents_rc: contents_rc content_rc
	\| ;
	content_rc: rc_control_enable \| rc_control_interface \| rc_control_port \|
	rc_server_key_file \| rc_server_cert_file \| rc_control_key_file \|
	rc_control_cert_file \| rc_control_use_cert
	;
	rc_control_enable: VAR_CONTROL_ENABLE STRING_ARG
	{
	OUTYY(("P(control_enable:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->remote_control_enable =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	rc_control_port: VAR_CONTROL_PORT STRING_ARG
	{
	OUTYY(("P(control_port:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("control port number expected");
	else cfg_parser->cfg->control_port = atoi($2);
	free($2);
	}
	;
	rc_control_interface: VAR_CONTROL_INTERFACE STRING_ARG
	{
	OUTYY(("P(control_interface:%s)\n", $2));
	if(!cfg_strlist_append(&cfg_parser->cfg->control_ifs, $2))
	yyerror("out of memory");
	}
	;
	rc_control_use_cert: VAR_CONTROL_USE_CERT STRING_ARG
	{
	OUTYY(("P(control_use_cert:%s)\n", $2));
	cfg_parser->cfg->control_use_cert = (strcmp($2, "yes")==0);
	free($2);
	}
	;
	rc_server_key_file: VAR_SERVER_KEY_FILE STRING_ARG
	{
	OUTYY(("P(rc_server_key_file:%s)\n", $2));
	free(cfg_parser->cfg->server_key_file);
	cfg_parser->cfg->server_key_file = $2;
	}
	;
	rc_server_cert_file: VAR_SERVER_CERT_FILE STRING_ARG
	{
	OUTYY(("P(rc_server_cert_file:%s)\n", $2));
	free(cfg_parser->cfg->server_cert_file);
	cfg_parser->cfg->server_cert_file = $2;
	}
	;
	rc_control_key_file: VAR_CONTROL_KEY_FILE STRING_ARG
	{
	OUTYY(("P(rc_control_key_file:%s)\n", $2));
	free(cfg_parser->cfg->control_key_file);
	cfg_parser->cfg->control_key_file = $2;
	}
	;
	rc_control_cert_file: VAR_CONTROL_CERT_FILE STRING_ARG
	{
	OUTYY(("P(rc_control_cert_file:%s)\n", $2));
	free(cfg_parser->cfg->control_cert_file);
	cfg_parser->cfg->control_cert_file = $2;
	}
	;
	dtstart: VAR_DNSTAP
	{
	OUTYY(("\nP(dnstap:)\n"));
	}
	;
	contents_dt: contents_dt content_dt
	\| ;
	content_dt: dt_dnstap_enable \| dt_dnstap_socket_path \|
	dt_dnstap_send_identity \| dt_dnstap_send_version \|
	dt_dnstap_identity \| dt_dnstap_version \|
	dt_dnstap_log_resolver_query_messages \|
	dt_dnstap_log_resolver_response_messages \|
	dt_dnstap_log_client_query_messages \|
	dt_dnstap_log_client_response_messages \|
	dt_dnstap_log_forwarder_query_messages \|
	dt_dnstap_log_forwarder_response_messages
	;
	dt_dnstap_enable: VAR_DNSTAP_ENABLE STRING_ARG
	{
	OUTYY(("P(dt_dnstap_enable:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->dnstap = (strcmp($2, "yes")==0);
	+ free($2);
	}
	;
	dt_dnstap_socket_path: VAR_DNSTAP_SOCKET_PATH STRING_ARG
	{
	OUTYY(("P(dt_dnstap_socket_path:%s)\n", $2));
	free(cfg_parser->cfg->dnstap_socket_path);
	cfg_parser->cfg->dnstap_socket_path = $2;
	}
	;
	dt_dnstap_send_identity: VAR_DNSTAP_SEND_IDENTITY STRING_ARG
	{
	OUTYY(("P(dt_dnstap_send_identity:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->dnstap_send_identity = (strcmp($2, "yes")==0);
	+ free($2);
	}
	;
	dt_dnstap_send_version: VAR_DNSTAP_SEND_VERSION STRING_ARG
	{
	OUTYY(("P(dt_dnstap_send_version:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->dnstap_send_version = (strcmp($2, "yes")==0);
	+ free($2);
	}
	;
	dt_dnstap_identity: VAR_DNSTAP_IDENTITY STRING_ARG
	{
	OUTYY(("P(dt_dnstap_identity:%s)\n", $2));
	free(cfg_parser->cfg->dnstap_identity);
	cfg_parser->cfg->dnstap_identity = $2;
	}
	;
	dt_dnstap_version: VAR_DNSTAP_VERSION STRING_ARG
	{
	OUTYY(("P(dt_dnstap_version:%s)\n", $2));
	free(cfg_parser->cfg->dnstap_version);
	cfg_parser->cfg->dnstap_version = $2;
	}
	;
	dt_dnstap_log_resolver_query_messages: VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES STRING_ARG
	{
	OUTYY(("P(dt_dnstap_log_resolver_query_messages:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->dnstap_log_resolver_query_messages =
	(strcmp($2, "yes")==0);
	+ free($2);
	}
	;
	dt_dnstap_log_resolver_response_messages: VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES STRING_ARG
	{
	OUTYY(("P(dt_dnstap_log_resolver_response_messages:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->dnstap_log_resolver_response_messages =
	(strcmp($2, "yes")==0);
	+ free($2);
	}
	;
	dt_dnstap_log_client_query_messages: VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES STRING_ARG
	{
	OUTYY(("P(dt_dnstap_log_client_query_messages:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->dnstap_log_client_query_messages =
	(strcmp($2, "yes")==0);
	+ free($2);
	}
	;
	dt_dnstap_log_client_response_messages: VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES STRING_ARG
	{
	OUTYY(("P(dt_dnstap_log_client_response_messages:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->dnstap_log_client_response_messages =
	(strcmp($2, "yes")==0);
	+ free($2);
	}
	;
	dt_dnstap_log_forwarder_query_messages: VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES STRING_ARG
	{
	OUTYY(("P(dt_dnstap_log_forwarder_query_messages:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->dnstap_log_forwarder_query_messages =
	(strcmp($2, "yes")==0);
	+ free($2);
	}
	;
	dt_dnstap_log_forwarder_response_messages: VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES STRING_ARG
	{
	OUTYY(("P(dt_dnstap_log_forwarder_response_messages:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->dnstap_log_forwarder_response_messages =
	(strcmp($2, "yes")==0);
	+ free($2);
	}
	;
	pythonstart: VAR_PYTHON
	{
	OUTYY(("\nP(python:)\n"));
	}
	;
	contents_py: contents_py content_py
	\| ;
	content_py: py_script
	;
	py_script: VAR_PYTHON_SCRIPT STRING_ARG
	{
	OUTYY(("P(python-script:%s)\n", $2));
	free(cfg_parser->cfg->python_script);
	cfg_parser->cfg->python_script = $2;
	}
	server_disable_dnssec_lame_check: VAR_DISABLE_DNSSEC_LAME_CHECK STRING_ARG
	{
	OUTYY(("P(disable_dnssec_lame_check:%s)\n", $2));
	if (strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->disable_dnssec_lame_check =
	(strcmp($2, "yes")==0);
	free($2);
	}
	;
	server_log_identity: VAR_LOG_IDENTITY STRING_ARG
	{
	OUTYY(("P(server_log_identity:%s)\n", $2));
	free(cfg_parser->cfg->log_identity);
	cfg_parser->cfg->log_identity = $2;
	}
	;
	server_response_ip: VAR_RESPONSE_IP STRING_ARG STRING_ARG
	{
	OUTYY(("P(server_response_ip:%s %s)\n", $2, $3));
	validate_respip_action($3);
	if(!cfg_str2list_insert(&cfg_parser->cfg->respip_actions,
	$2, $3))
	fatal_exit("out of memory adding response-ip");
	}
	;
	server_response_ip_data: VAR_RESPONSE_IP_DATA STRING_ARG STRING_ARG
	{
	OUTYY(("P(server_response_ip_data:%s)\n", $2));
	- if(!cfg_str2list_insert(&cfg_parser->cfg->respip_data,
	- $2, $3))
	- fatal_exit("out of memory adding response-ip-data");
	+ if(!cfg_str2list_insert(&cfg_parser->cfg->respip_data,
	+ $2, $3))
	+ fatal_exit("out of memory adding response-ip-data");
	}
	;
	dnscstart: VAR_DNSCRYPT
	{
	OUTYY(("\nP(dnscrypt:)\n"));
	- OUTYY(("\nP(dnscrypt:)\n"));
	}
	;
	contents_dnsc: contents_dnsc content_dnsc
	\| ;
	content_dnsc:
	dnsc_dnscrypt_enable \| dnsc_dnscrypt_port \| dnsc_dnscrypt_provider \|
	dnsc_dnscrypt_secret_key \| dnsc_dnscrypt_provider_cert \|
	dnsc_dnscrypt_provider_cert_rotated \|
	dnsc_dnscrypt_shared_secret_cache_size \|
	dnsc_dnscrypt_shared_secret_cache_slabs \|
	dnsc_dnscrypt_nonce_cache_size \|
	dnsc_dnscrypt_nonce_cache_slabs
	;
	dnsc_dnscrypt_enable: VAR_DNSCRYPT_ENABLE STRING_ARG
	{
	OUTYY(("P(dnsc_dnscrypt_enable:%s)\n", $2));
	if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
	yyerror("expected yes or no.");
	else cfg_parser->cfg->dnscrypt = (strcmp($2, "yes")==0);
	free($2);
	}
	;

	dnsc_dnscrypt_port: VAR_DNSCRYPT_PORT STRING_ARG
	{
	OUTYY(("P(dnsc_dnscrypt_port:%s)\n", $2));
	-
	if(atoi($2) == 0)
	yyerror("port number expected");
	else cfg_parser->cfg->dnscrypt_port = atoi($2);
	free($2);
	}
	;
	dnsc_dnscrypt_provider: VAR_DNSCRYPT_PROVIDER STRING_ARG
	{
	OUTYY(("P(dnsc_dnscrypt_provider:%s)\n", $2));
	free(cfg_parser->cfg->dnscrypt_provider);
	cfg_parser->cfg->dnscrypt_provider = $2;
	}
	;
	dnsc_dnscrypt_provider_cert: VAR_DNSCRYPT_PROVIDER_CERT STRING_ARG
	{
	OUTYY(("P(dnsc_dnscrypt_provider_cert:%s)\n", $2));
	if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_provider_cert, $2))
	log_warn("dnscrypt-provider-cert %s is a duplicate", $2);
	if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert, $2))
	fatal_exit("out of memory adding dnscrypt-provider-cert");
	}
	;
	dnsc_dnscrypt_provider_cert_rotated: VAR_DNSCRYPT_PROVIDER_CERT_ROTATED STRING_ARG
	{
	OUTYY(("P(dnsc_dnscrypt_provider_cert_rotated:%s)\n", $2));
	if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_provider_cert_rotated, $2))
	fatal_exit("out of memory adding dnscrypt-provider-cert-rotated");
	}
	;
	dnsc_dnscrypt_secret_key: VAR_DNSCRYPT_SECRET_KEY STRING_ARG
	{
	OUTYY(("P(dnsc_dnscrypt_secret_key:%s)\n", $2));
	if(cfg_strlist_find(cfg_parser->cfg->dnscrypt_secret_key, $2))
	log_warn("dnscrypt-secret-key: %s is a duplicate", $2);
	if(!cfg_strlist_insert(&cfg_parser->cfg->dnscrypt_secret_key, $2))
	fatal_exit("out of memory adding dnscrypt-secret-key");
	}
	;
	dnsc_dnscrypt_shared_secret_cache_size: VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE STRING_ARG
	{
	OUTYY(("P(dnscrypt_shared_secret_cache_size:%s)\n", $2));
	if(!cfg_parse_memsize($2, &cfg_parser->cfg->dnscrypt_shared_secret_cache_size))
	yyerror("memory size expected");
	free($2);
	}
	;
	dnsc_dnscrypt_shared_secret_cache_slabs: VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS STRING_ARG
	{
	OUTYY(("P(dnscrypt_shared_secret_cache_slabs:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("number expected");
	else {
	cfg_parser->cfg->dnscrypt_shared_secret_cache_slabs = atoi($2);
	if(!is_pow2(cfg_parser->cfg->dnscrypt_shared_secret_cache_slabs))
	yyerror("must be a power of 2");
	}
	free($2);
	}
	;
	dnsc_dnscrypt_nonce_cache_size: VAR_DNSCRYPT_NONCE_CACHE_SIZE STRING_ARG
	{
	OUTYY(("P(dnscrypt_nonce_cache_size:%s)\n", $2));
	if(!cfg_parse_memsize($2, &cfg_parser->cfg->dnscrypt_nonce_cache_size))
	yyerror("memory size expected");
	free($2);
	}
	;
	dnsc_dnscrypt_nonce_cache_slabs: VAR_DNSCRYPT_NONCE_CACHE_SLABS STRING_ARG
	{
	OUTYY(("P(dnscrypt_nonce_cache_slabs:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("number expected");
	else {
	cfg_parser->cfg->dnscrypt_nonce_cache_slabs = atoi($2);
	if(!is_pow2(cfg_parser->cfg->dnscrypt_nonce_cache_slabs))
	yyerror("must be a power of 2");
	}
	free($2);
	}
	;
	cachedbstart: VAR_CACHEDB
	{
	OUTYY(("\nP(cachedb:)\n"));
	}
	;
	contents_cachedb: contents_cachedb content_cachedb
	\| ;
	content_cachedb: cachedb_backend_name \| cachedb_secret_seed \|
	redis_server_host \| redis_server_port \| redis_timeout
	;
	cachedb_backend_name: VAR_CACHEDB_BACKEND STRING_ARG
	{
	#ifdef USE_CACHEDB
	OUTYY(("P(backend:%s)\n", $2));
	if(cfg_parser->cfg->cachedb_backend)
	yyerror("cachedb backend override, there must be one "
	"backend");
	free(cfg_parser->cfg->cachedb_backend);
	cfg_parser->cfg->cachedb_backend = $2;
	#else
	OUTYY(("P(Compiled without cachedb, ignoring)\n"));
	+ free($2);
	#endif
	}
	;
	cachedb_secret_seed: VAR_CACHEDB_SECRETSEED STRING_ARG
	{
	#ifdef USE_CACHEDB
	OUTYY(("P(secret-seed:%s)\n", $2));
	if(cfg_parser->cfg->cachedb_secret)
	yyerror("cachedb secret-seed override, there must be "
	"only one secret");
	free(cfg_parser->cfg->cachedb_secret);
	cfg_parser->cfg->cachedb_secret = $2;
	#else
	OUTYY(("P(Compiled without cachedb, ignoring)\n"));
	free($2);
	#endif
	}
	;
	redis_server_host: VAR_CACHEDB_REDISHOST STRING_ARG
	{
	#if defined(USE_CACHEDB) && defined(USE_REDIS)
	OUTYY(("P(redis_server_host:%s)\n", $2));
	free(cfg_parser->cfg->redis_server_host);
	cfg_parser->cfg->redis_server_host = $2;
	#else
	OUTYY(("P(Compiled without cachedb or redis, ignoring)\n"));
	free($2);
	#endif
	}
	;
	redis_server_port: VAR_CACHEDB_REDISPORT STRING_ARG
	{
	#if defined(USE_CACHEDB) && defined(USE_REDIS)
	int port;
	OUTYY(("P(redis_server_port:%s)\n", $2));
	port = atoi($2);
	if(port == 0 \|\| port < 0 \|\| port > 65535)
	yyerror("valid redis server port number expected");
	else cfg_parser->cfg->redis_server_port = port;
	#else
	OUTYY(("P(Compiled without cachedb or redis, ignoring)\n"));
	#endif
	free($2);
	}
	;
	redis_timeout: VAR_CACHEDB_REDISTIMEOUT STRING_ARG
	{
	#if defined(USE_CACHEDB) && defined(USE_REDIS)
	OUTYY(("P(redis_timeout:%s)\n", $2));
	if(atoi($2) == 0)
	yyerror("redis timeout value expected");
	else cfg_parser->cfg->redis_timeout = atoi($2);
	#else
	OUTYY(("P(Compiled without cachedb or redis, ignoring)\n"));
	#endif
	free($2);
	}
	;
	server_tcp_connection_limit: VAR_TCP_CONNECTION_LIMIT STRING_ARG STRING_ARG
	{
	OUTYY(("P(server_tcp_connection_limit:%s %s)\n", $2, $3));
	if (atoi($3) < 0)
	yyerror("positive number expected");
	else {
	if(!cfg_str2list_insert(&cfg_parser->cfg->tcp_connection_limits, $2, $3))
	fatal_exit("out of memory adding tcp connection limit");
	}
	}
	;
	%%

	/* parse helper routines could be here */
	static void
	validate_respip_action(const char* action)
	{
	if(strcmp(action, "deny")!=0 &&
	strcmp(action, "redirect")!=0 &&
	strcmp(action, "inform")!=0 &&
	strcmp(action, "inform_deny")!=0 &&
	strcmp(action, "always_transparent")!=0 &&
	strcmp(action, "always_refuse")!=0 &&
	strcmp(action, "always_nxdomain")!=0)
	{
	yyerror("response-ip action: expected deny, redirect, "
	"inform, inform_deny, always_transparent, "
	"always_refuse or always_nxdomain");
	}
	}
	Index: head/contrib/unbound/util/data/msgencode.c
	===================================================================
	--- head/contrib/unbound/util/data/msgencode.c (revision 349719)
	+++ head/contrib/unbound/util/data/msgencode.c (revision 349720)
	@@ -1,920 +1,925 @@
	/*
	* util/data/msgencode.c - Encode DNS messages, queries and replies.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains a routines to encode DNS messages.
	*/

	#include "config.h"
	#include "util/data/msgencode.h"
	#include "util/data/msgreply.h"
	#include "util/data/msgparse.h"
	#include "util/data/dname.h"
	#include "util/log.h"
	#include "util/regional.h"
	#include "util/net_help.h"
	#include "sldns/sbuffer.h"
	#include "services/localzone.h"

	+#ifdef HAVE_TIME_H
	+#include <time.h>
	+#endif
	+#include <sys/time.h>
	+
	/** return code that means the function ran out of memory. negative so it does
	* not conflict with DNS rcodes. */
	#define RETVAL_OUTMEM -2
	/** return code that means the data did not fit (completely) in the packet */
	#define RETVAL_TRUNC -4
	/** return code that means all is peachy keen. Equal to DNS rcode NOERROR */
	#define RETVAL_OK 0

	/**
	* Data structure to help domain name compression in outgoing messages.
	* A tree of dnames and their offsets in the packet is kept.
	* It is kept sorted, not canonical, but by label at least, so that after
	* a lookup of a name you know its closest match, and the parent from that
	* closest match. These are possible compression targets.
	*
	* It is a binary tree, not a rbtree or balanced tree, as the effort
	* of keeping it balanced probably outweighs usefulness (given typical
	* DNS packet size).
	*/
	struct compress_tree_node {
	/** left node in tree, all smaller to this */
	struct compress_tree_node* left;
	/** right node in tree, all larger than this */
	struct compress_tree_node* right;

	/** the parent node - not for tree, but zone parent. One less label */
	struct compress_tree_node* parent;
	/** the domain name for this node. Pointer to uncompressed memory. */
	uint8_t* dname;
	/** number of labels in domain name, kept to help compare func. */
	int labs;
	/** offset in packet that points to this dname */
	size_t offset;
	};

	/**
	* Find domain name in tree, returns exact and closest match.
	* @param tree: root of tree.
	* @param dname: pointer to uncompressed dname.
	* @param labs: number of labels in domain name.
	* @param match: closest or exact match.
	* guaranteed to be smaller or equal to the sought dname.
	* can be null if the tree is empty.
	* @param matchlabels: number of labels that match with closest match.
	* can be zero is there is no match.
	* @param insertpt: insert location for dname, if not found.
	* @return: 0 if no exact match.
	*/
	static int
	compress_tree_search(struct compress_tree_node** tree, uint8_t* dname,
	int labs, struct compress_tree_node** match, int* matchlabels,
	struct compress_tree_node*** insertpt)
	{
	int c, n, closen=0;
	struct compress_tree_node* p = *tree;
	struct compress_tree_node* close = 0;
	struct compress_tree_node** prev = tree;
	while(p) {
	if((c = dname_lab_cmp(dname, labs, p->dname, p->labs, &n))
	== 0) {
	*matchlabels = n;
	*match = p;
	return 1;
	}
	if(c<0) {
	prev = &p->left;
	p = p->left;
	} else {
	closen = n;
	close = p; /* p->dname is smaller than dname */
	prev = &p->right;
	p = p->right;
	}
	}
	*insertpt = prev;
	*matchlabels = closen;
	*match = close;
	return 0;
	}

	/**
	* Lookup a domain name in compression tree.
	* @param tree: root of tree (not the node with '.').
	* @param dname: pointer to uncompressed dname.
	* @param labs: number of labels in domain name.
	* @param insertpt: insert location for dname, if not found.
	* @return: 0 if not found or compress treenode with best compression.
	*/
	static struct compress_tree_node*
	compress_tree_lookup(struct compress_tree_node** tree, uint8_t* dname,
	int labs, struct compress_tree_node*** insertpt)
	{
	struct compress_tree_node* p;
	int m;
	if(labs <= 1)
	return 0; /* do not compress root node */
	if(compress_tree_search(tree, dname, labs, &p, &m, insertpt)) {
	/* exact match */
	return p;
	}
	/* return some ancestor of p that compresses well. */
	if(m>1) {
	/* www.example.com. (labs=4) matched foo.example.com.(labs=4)
	* then matchcount = 3. need to go up. */
	while(p && p->labs > m)
	p = p->parent;
	return p;
	}
	return 0;
	}

	/**
	* Create node for domain name compression tree.
	* @param dname: pointer to uncompressed dname (stored in tree).
	* @param labs: number of labels in dname.
	* @param offset: offset into packet for dname.
	* @param region: how to allocate memory for new node.
	* @return new node or 0 on malloc failure.
	*/
	static struct compress_tree_node*
	compress_tree_newnode(uint8_t* dname, int labs, size_t offset,
	struct regional* region)
	{
	struct compress_tree_node* n = (struct compress_tree_node*)
	regional_alloc(region, sizeof(struct compress_tree_node));
	if(!n) return 0;
	n->left = 0;
	n->right = 0;
	n->parent = 0;
	n->dname = dname;
	n->labs = labs;
	n->offset = offset;
	return n;
	}

	/**
	* Store domain name and ancestors into compression tree.
	* @param dname: pointer to uncompressed dname (stored in tree).
	* @param labs: number of labels in dname.
	* @param offset: offset into packet for dname.
	* @param region: how to allocate memory for new node.
	* @param closest: match from previous lookup, used to compress dname.
	* may be NULL if no previous match.
	* if the tree has an ancestor of dname already, this must be it.
	* @param insertpt: where to insert the dname in tree.
	* @return: 0 on memory error.
	*/
	static int
	compress_tree_store(uint8_t* dname, int labs, size_t offset,
	struct regional* region, struct compress_tree_node* closest,
	struct compress_tree_node** insertpt)
	{
	uint8_t lablen;
	struct compress_tree_node* newnode;
	struct compress_tree_node* prevnode = NULL;
	int uplabs = labs-1; /* does not store root in tree */
	if(closest) uplabs = labs - closest->labs;
	log_assert(uplabs >= 0);
	/* algorithms builds up a vine of dname-labels to hang into tree */
	while(uplabs--) {
	if(offset > PTR_MAX_OFFSET) {
	/* insertion failed, drop vine */
	return 1; /* compression pointer no longer useful */
	}
	if(!(newnode = compress_tree_newnode(dname, labs, offset,
	region))) {
	/* insertion failed, drop vine */
	return 0;
	}

	if(prevnode) {
	/* chain nodes together, last one has one label more,
	* so is larger than newnode, thus goes right. */
	newnode->right = prevnode;
	prevnode->parent = newnode;
	}

	/* next label */
	lablen = *dname++;
	dname += lablen;
	offset += lablen+1;
	prevnode = newnode;
	labs--;
	}
	/* if we have a vine, hang the vine into the tree */
	if(prevnode) {
	*insertpt = prevnode;
	prevnode->parent = closest;
	}
	return 1;
	}

	/** compress a domain name */
	static int
	write_compressed_dname(sldns_buffer* pkt, uint8_t* dname, int labs,
	struct compress_tree_node* p)
	{
	/* compress it */
	int labcopy = labs - p->labs;
	uint8_t lablen;
	uint16_t ptr;

	if(labs == 1) {
	/* write root label */
	if(sldns_buffer_remaining(pkt) < 1)
	return 0;
	sldns_buffer_write_u8(pkt, 0);
	return 1;
	}

	/* copy the first couple of labels */
	while(labcopy--) {
	lablen = *dname++;
	if(sldns_buffer_remaining(pkt) < (size_t)lablen+1)
	return 0;
	sldns_buffer_write_u8(pkt, lablen);
	sldns_buffer_write(pkt, dname, lablen);
	dname += lablen;
	}
	/* insert compression ptr */
	if(sldns_buffer_remaining(pkt) < 2)
	return 0;
	ptr = PTR_CREATE(p->offset);
	sldns_buffer_write_u16(pkt, ptr);
	return 1;
	}

	/** compress owner name of RR, return RETVAL_OUTMEM RETVAL_TRUNC */
	static int
	compress_owner(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
	struct regional* region, struct compress_tree_node** tree,
	size_t owner_pos, uint16_t* owner_ptr, int owner_labs)
	{
	struct compress_tree_node* p;
	struct compress_tree_node** insertpt = NULL;
	if(!*owner_ptr) {
	/* compress first time dname */
	if((p = compress_tree_lookup(tree, key->rk.dname,
	owner_labs, &insertpt))) {
	if(p->labs == owner_labs)
	/* avoid ptr chains, since some software is
	* not capable of decoding ptr after a ptr. */
	*owner_ptr = htons(PTR_CREATE(p->offset));
	if(!write_compressed_dname(pkt, key->rk.dname,
	owner_labs, p))
	return RETVAL_TRUNC;
	/* check if typeclass+4 ttl + rdatalen is available */
	if(sldns_buffer_remaining(pkt) < 4+4+2)
	return RETVAL_TRUNC;
	} else {
	/* no compress */
	if(sldns_buffer_remaining(pkt) < key->rk.dname_len+4+4+2)
	return RETVAL_TRUNC;
	sldns_buffer_write(pkt, key->rk.dname,
	key->rk.dname_len);
	if(owner_pos <= PTR_MAX_OFFSET)
	*owner_ptr = htons(PTR_CREATE(owner_pos));
	}
	if(!compress_tree_store(key->rk.dname, owner_labs,
	owner_pos, region, p, insertpt))
	return RETVAL_OUTMEM;
	} else {
	/* always compress 2nd-further RRs in RRset */
	if(owner_labs == 1) {
	if(sldns_buffer_remaining(pkt) < 1+4+4+2)
	return RETVAL_TRUNC;
	sldns_buffer_write_u8(pkt, 0);
	} else {
	if(sldns_buffer_remaining(pkt) < 2+4+4+2)
	return RETVAL_TRUNC;
	sldns_buffer_write(pkt, owner_ptr, 2);
	}
	}
	return RETVAL_OK;
	}

	/** compress any domain name to the packet, return RETVAL_* */
	static int
	compress_any_dname(uint8_t* dname, sldns_buffer* pkt, int labs,
	struct regional* region, struct compress_tree_node** tree)
	{
	struct compress_tree_node* p;
	struct compress_tree_node** insertpt = NULL;
	size_t pos = sldns_buffer_position(pkt);
	if((p = compress_tree_lookup(tree, dname, labs, &insertpt))) {
	if(!write_compressed_dname(pkt, dname, labs, p))
	return RETVAL_TRUNC;
	} else {
	if(!dname_buffer_write(pkt, dname))
	return RETVAL_TRUNC;
	}
	if(!compress_tree_store(dname, labs, pos, region, p, insertpt))
	return RETVAL_OUTMEM;
	return RETVAL_OK;
	}

	/** return true if type needs domain name compression in rdata */
	static const sldns_rr_descriptor*
	type_rdata_compressable(struct ub_packed_rrset_key* key)
	{
	uint16_t t = ntohs(key->rk.type);
	if(sldns_rr_descript(t) &&
	sldns_rr_descript(t)->_compress == LDNS_RR_COMPRESS)
	return sldns_rr_descript(t);
	return 0;
	}

	/** compress domain names in rdata, return RETVAL_* */
	static int
	compress_rdata(sldns_buffer* pkt, uint8_t* rdata, size_t todolen,
	struct regional* region, struct compress_tree_node** tree,
	const sldns_rr_descriptor* desc)
	{
	int labs, r, rdf = 0;
	size_t dname_len, len, pos = sldns_buffer_position(pkt);
	uint8_t count = desc->_dname_count;

	sldns_buffer_skip(pkt, 2); /* rdata len fill in later */
	/* space for rdatalen checked for already */
	rdata += 2;
	todolen -= 2;
	while(todolen > 0 && count) {
	switch(desc->_wireformat[rdf]) {
	case LDNS_RDF_TYPE_DNAME:
	labs = dname_count_size_labels(rdata, &dname_len);
	if((r=compress_any_dname(rdata, pkt, labs, region,
	tree)) != RETVAL_OK)
	return r;
	rdata += dname_len;
	todolen -= dname_len;
	count--;
	len = 0;
	break;
	case LDNS_RDF_TYPE_STR:
	len = *rdata + 1;
	break;
	default:
	len = get_rdf_size(desc->_wireformat[rdf]);
	}
	if(len) {
	/* copy over */
	if(sldns_buffer_remaining(pkt) < len)
	return RETVAL_TRUNC;
	sldns_buffer_write(pkt, rdata, len);
	todolen -= len;
	rdata += len;
	}
	rdf++;
	}
	/* copy remainder */
	if(todolen > 0) {
	if(sldns_buffer_remaining(pkt) < todolen)
	return RETVAL_TRUNC;
	sldns_buffer_write(pkt, rdata, todolen);
	}

	/* set rdata len */
	sldns_buffer_write_u16_at(pkt, pos, sldns_buffer_position(pkt)-pos-2);
	return RETVAL_OK;
	}

	/** Returns true if RR type should be included */
	static int
	rrset_belongs_in_reply(sldns_pkt_section s, uint16_t rrtype, uint16_t qtype,
	int dnssec)
	{
	if(dnssec)
	return 1;
	/* skip non DNSSEC types, except if directly queried for */
	if(s == LDNS_SECTION_ANSWER) {
	if(qtype == LDNS_RR_TYPE_ANY \|\| qtype == rrtype)
	return 1;
	}
	/* check DNSSEC-ness */
	switch(rrtype) {
	case LDNS_RR_TYPE_SIG:
	case LDNS_RR_TYPE_KEY:
	case LDNS_RR_TYPE_NXT:
	case LDNS_RR_TYPE_DS:
	case LDNS_RR_TYPE_RRSIG:
	case LDNS_RR_TYPE_NSEC:
	case LDNS_RR_TYPE_DNSKEY:
	case LDNS_RR_TYPE_NSEC3:
	case LDNS_RR_TYPE_NSEC3PARAMS:
	return 0;
	}
	return 1;
	}

	/** store rrset in buffer in wireformat, return RETVAL_* */
	static int
	packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
	uint16_t* num_rrs, time_t timenow, struct regional* region,
	int do_data, int do_sig, struct compress_tree_node** tree,
	sldns_pkt_section s, uint16_t qtype, int dnssec, size_t rr_offset)
	{
	size_t i, j, owner_pos;
	int r, owner_labs;
	uint16_t owner_ptr = 0;
	struct packed_rrset_data* data = (struct packed_rrset_data*)
	key->entry.data;

	/* does this RR type belong in the answer? */
	if(!rrset_belongs_in_reply(s, ntohs(key->rk.type), qtype, dnssec))
	return RETVAL_OK;

	owner_labs = dname_count_labels(key->rk.dname);
	owner_pos = sldns_buffer_position(pkt);

	/* For an rrset with a fixed TTL, use the rrset's TTL as given */
	if((key->rk.flags & PACKED_RRSET_FIXEDTTL) != 0)
	timenow = 0;

	if(do_data) {
	const sldns_rr_descriptor* c = type_rdata_compressable(key);
	for(i=0; i<data->count; i++) {
	/* rrset roundrobin */
	j = (i + rr_offset) % data->count;
	if((r=compress_owner(key, pkt, region, tree,
	owner_pos, &owner_ptr, owner_labs))
	!= RETVAL_OK)
	return r;
	sldns_buffer_write(pkt, &key->rk.type, 2);
	sldns_buffer_write(pkt, &key->rk.rrset_class, 2);
	if(data->rr_ttl[j] < timenow)
	sldns_buffer_write_u32(pkt, 0);
	else sldns_buffer_write_u32(pkt,
	data->rr_ttl[j]-timenow);
	if(c) {
	if((r=compress_rdata(pkt, data->rr_data[j],
	data->rr_len[j], region, tree, c))
	!= RETVAL_OK)
	return r;
	} else {
	if(sldns_buffer_remaining(pkt) < data->rr_len[j])
	return RETVAL_TRUNC;
	sldns_buffer_write(pkt, data->rr_data[j],
	data->rr_len[j]);
	}
	}
	}
	/* insert rrsigs */
	if(do_sig && dnssec) {
	size_t total = data->count+data->rrsig_count;
	for(i=data->count; i<total; i++) {
	if(owner_ptr && owner_labs != 1) {
	if(sldns_buffer_remaining(pkt) <
	2+4+4+data->rr_len[i])
	return RETVAL_TRUNC;
	sldns_buffer_write(pkt, &owner_ptr, 2);
	} else {
	if((r=compress_any_dname(key->rk.dname,
	pkt, owner_labs, region, tree))
	!= RETVAL_OK)
	return r;
	if(sldns_buffer_remaining(pkt) <
	4+4+data->rr_len[i])
	return RETVAL_TRUNC;
	}
	sldns_buffer_write_u16(pkt, LDNS_RR_TYPE_RRSIG);
	sldns_buffer_write(pkt, &key->rk.rrset_class, 2);
	if(data->rr_ttl[i] < timenow)
	sldns_buffer_write_u32(pkt, 0);
	else sldns_buffer_write_u32(pkt,
	data->rr_ttl[i]-timenow);
	/* rrsig rdata cannot be compressed, perform 100+ byte
	* memcopy. */
	sldns_buffer_write(pkt, data->rr_data[i],
	data->rr_len[i]);
	}
	}
	/* change rrnum only after we are sure it fits */
	if(do_data)
	*num_rrs += data->count;
	if(do_sig && dnssec)
	*num_rrs += data->rrsig_count;

	return RETVAL_OK;
	}

	/** store msg section in wireformat buffer, return RETVAL_* */
	static int
	insert_section(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs,
	sldns_buffer* pkt, size_t rrsets_before, time_t timenow,
	struct regional* region, struct compress_tree_node** tree,
	sldns_pkt_section s, uint16_t qtype, int dnssec, size_t rr_offset)
	{
	int r;
	size_t i, setstart;
	/* we now allow this function to be called multiple times for the
	* same section, incrementally updating num_rrs. The caller is
	* responsible for initializing it (which is the case in the current
	* implementation). */

	if(s != LDNS_SECTION_ADDITIONAL) {
	if(s == LDNS_SECTION_ANSWER && qtype == LDNS_RR_TYPE_ANY)
	dnssec = 1; /* include all types in ANY answer */
	for(i=0; i<num_rrsets; i++) {
	setstart = sldns_buffer_position(pkt);
	if((r=packed_rrset_encode(rep->rrsets[rrsets_before+i],
	pkt, num_rrs, timenow, region, 1, 1, tree,
	s, qtype, dnssec, rr_offset))
	!= RETVAL_OK) {
	/* Bad, but if due to size must set TC bit */
	/* trim off the rrset neatly. */
	sldns_buffer_set_position(pkt, setstart);
	return r;
	}
	}
	} else {
	for(i=0; i<num_rrsets; i++) {
	setstart = sldns_buffer_position(pkt);
	if((r=packed_rrset_encode(rep->rrsets[rrsets_before+i],
	pkt, num_rrs, timenow, region, 1, 0, tree,
	s, qtype, dnssec, rr_offset))
	!= RETVAL_OK) {
	sldns_buffer_set_position(pkt, setstart);
	return r;
	}
	}
	if(dnssec)
	for(i=0; i<num_rrsets; i++) {
	setstart = sldns_buffer_position(pkt);
	if((r=packed_rrset_encode(rep->rrsets[rrsets_before+i],
	pkt, num_rrs, timenow, region, 0, 1, tree,
	s, qtype, dnssec, rr_offset))
	!= RETVAL_OK) {
	sldns_buffer_set_position(pkt, setstart);
	return r;
	}
	}
	}
	return RETVAL_OK;
	}

	/** store query section in wireformat buffer, return RETVAL */
	static int
	insert_query(struct query_info* qinfo, struct compress_tree_node** tree,
	sldns_buffer* buffer, struct regional* region)
	{
	uint8_t* qname = qinfo->local_alias ?
	qinfo->local_alias->rrset->rk.dname : qinfo->qname;
	size_t qname_len = qinfo->local_alias ?
	qinfo->local_alias->rrset->rk.dname_len : qinfo->qname_len;
	if(sldns_buffer_remaining(buffer) <
	qinfo->qname_len+sizeof(uint16_t)*2)
	return RETVAL_TRUNC; /* buffer too small */
	/* the query is the first name inserted into the tree */
	if(!compress_tree_store(qname, dname_count_labels(qname),
	sldns_buffer_position(buffer), region, NULL, tree))
	return RETVAL_OUTMEM;
	if(sldns_buffer_current(buffer) == qname)
	sldns_buffer_skip(buffer, (ssize_t)qname_len);
	else sldns_buffer_write(buffer, qname, qname_len);
	sldns_buffer_write_u16(buffer, qinfo->qtype);
	sldns_buffer_write_u16(buffer, qinfo->qclass);
	return RETVAL_OK;
	}

	static int
	positive_answer(struct reply_info* rep, uint16_t qtype) {
	size_t i;
	if (FLAGS_GET_RCODE(rep->flags) != LDNS_RCODE_NOERROR)
	return 0;

	for(i=0;i<rep->an_numrrsets; i++) {
	if(ntohs(rep->rrsets[i]->rk.type) == qtype) {
	/* in case it is a wildcard with DNSSEC, there will
	* be NSEC/NSEC3 records in the authority section
	* that we cannot remove */
	for(i=rep->an_numrrsets; i<rep->an_numrrsets+
	rep->ns_numrrsets; i++) {
	if(ntohs(rep->rrsets[i]->rk.type) ==
	LDNS_RR_TYPE_NSEC \|\|
	ntohs(rep->rrsets[i]->rk.type) ==
	LDNS_RR_TYPE_NSEC3)
	return 0;
	}
	return 1;
	}
	}
	return 0;
	}

	int
	reply_info_encode(struct query_info* qinfo, struct reply_info* rep,
	uint16_t id, uint16_t flags, sldns_buffer* buffer, time_t timenow,
	struct regional* region, uint16_t udpsize, int dnssec)
	{
	uint16_t ancount=0, nscount=0, arcount=0;
	struct compress_tree_node* tree = 0;
	int r;
	size_t rr_offset;

	sldns_buffer_clear(buffer);
	if(udpsize < sldns_buffer_limit(buffer))
	sldns_buffer_set_limit(buffer, udpsize);
	if(sldns_buffer_remaining(buffer) < LDNS_HEADER_SIZE)
	return 0;

	sldns_buffer_write(buffer, &id, sizeof(uint16_t));
	sldns_buffer_write_u16(buffer, flags);
	sldns_buffer_write_u16(buffer, rep->qdcount);
	/* set an, ns, ar counts to zero in case of small packets */
	sldns_buffer_write(buffer, "\000\000\000\000\000\000", 6);

	/* insert query section */
	if(rep->qdcount) {
	if((r=insert_query(qinfo, &tree, buffer, region)) !=
	RETVAL_OK) {
	if(r == RETVAL_TRUNC) {
	/* create truncated message */
	sldns_buffer_write_u16_at(buffer, 4, 0);
	LDNS_TC_SET(sldns_buffer_begin(buffer));
	sldns_buffer_flip(buffer);
	return 1;
	}
	return 0;
	}
	}
	/* roundrobin offset. using query id for random number. With ntohs
	* for different roundrobins for sequential id client senders. */
	- rr_offset = RRSET_ROUNDROBIN?ntohs(id):0;
	+ rr_offset = RRSET_ROUNDROBIN?ntohs(id)+(timenow?timenow:time(NULL)):0;

	/* "prepend" any local alias records in the answer section if this
	* response is supposed to be authoritative. Currently it should
	* be a single CNAME record (sanity-checked in worker_handle_request())
	* but it can be extended if and when we support more variations of
	* aliases. */
	if(qinfo->local_alias && (flags & BIT_AA)) {
	struct reply_info arep;
	time_t timezero = 0; /* to use the 'authoritative' TTL */
	memset(&arep, 0, sizeof(arep));
	arep.flags = rep->flags;
	arep.an_numrrsets = 1;
	arep.rrset_count = 1;
	arep.rrsets = &qinfo->local_alias->rrset;
	if((r=insert_section(&arep, 1, &ancount, buffer, 0,
	timezero, region, &tree, LDNS_SECTION_ANSWER,
	qinfo->qtype, dnssec, rr_offset)) != RETVAL_OK) {
	if(r == RETVAL_TRUNC) {
	/* create truncated message */
	sldns_buffer_write_u16_at(buffer, 6, ancount);
	LDNS_TC_SET(sldns_buffer_begin(buffer));
	sldns_buffer_flip(buffer);
	return 1;
	}
	return 0;
	}
	}

	/* insert answer section */
	if((r=insert_section(rep, rep->an_numrrsets, &ancount, buffer,
	0, timenow, region, &tree, LDNS_SECTION_ANSWER, qinfo->qtype,
	dnssec, rr_offset)) != RETVAL_OK) {
	if(r == RETVAL_TRUNC) {
	/* create truncated message */
	sldns_buffer_write_u16_at(buffer, 6, ancount);
	LDNS_TC_SET(sldns_buffer_begin(buffer));
	sldns_buffer_flip(buffer);
	return 1;
	}
	return 0;
	}
	sldns_buffer_write_u16_at(buffer, 6, ancount);

	/* if response is positive answer, auth/add sections are not required */
	if( ! (MINIMAL_RESPONSES && positive_answer(rep, qinfo->qtype)) ) {
	/* insert auth section */
	if((r=insert_section(rep, rep->ns_numrrsets, &nscount, buffer,
	rep->an_numrrsets, timenow, region, &tree,
	LDNS_SECTION_AUTHORITY, qinfo->qtype,
	dnssec, rr_offset)) != RETVAL_OK) {
	if(r == RETVAL_TRUNC) {
	/* create truncated message */
	sldns_buffer_write_u16_at(buffer, 8, nscount);
	LDNS_TC_SET(sldns_buffer_begin(buffer));
	sldns_buffer_flip(buffer);
	return 1;
	}
	return 0;
	}
	sldns_buffer_write_u16_at(buffer, 8, nscount);

	/* insert add section */
	if((r=insert_section(rep, rep->ar_numrrsets, &arcount, buffer,
	rep->an_numrrsets + rep->ns_numrrsets, timenow, region,
	&tree, LDNS_SECTION_ADDITIONAL, qinfo->qtype,
	dnssec, rr_offset)) != RETVAL_OK) {
	if(r == RETVAL_TRUNC) {
	/* no need to set TC bit, this is the additional */
	sldns_buffer_write_u16_at(buffer, 10, arcount);
	sldns_buffer_flip(buffer);
	return 1;
	}
	return 0;
	}
	sldns_buffer_write_u16_at(buffer, 10, arcount);
	}
	sldns_buffer_flip(buffer);
	return 1;
	}

	uint16_t
	calc_edns_field_size(struct edns_data* edns)
	{
	size_t rdatalen = 0;
	struct edns_option* opt;
	if(!edns \|\| !edns->edns_present)
	return 0;
	for(opt = edns->opt_list; opt; opt = opt->next) {
	rdatalen += 4 + opt->opt_len;
	}
	/* domain root '.' + type + class + ttl + rdatalen */
	return 1 + 2 + 2 + 4 + 2 + rdatalen;
	}

	void
	attach_edns_record(sldns_buffer* pkt, struct edns_data* edns)
	{
	size_t len;
	size_t rdatapos;
	struct edns_option* opt;
	if(!edns \|\| !edns->edns_present)
	return;
	/* inc additional count */
	sldns_buffer_write_u16_at(pkt, 10,
	sldns_buffer_read_u16_at(pkt, 10) + 1);
	len = sldns_buffer_limit(pkt);
	sldns_buffer_clear(pkt);
	sldns_buffer_set_position(pkt, len);
	/* write EDNS record */
	sldns_buffer_write_u8(pkt, 0); /* '.' label */
	sldns_buffer_write_u16(pkt, LDNS_RR_TYPE_OPT); /* type */
	sldns_buffer_write_u16(pkt, edns->udp_size); /* class */
	sldns_buffer_write_u8(pkt, edns->ext_rcode); /* ttl */
	sldns_buffer_write_u8(pkt, edns->edns_version);
	sldns_buffer_write_u16(pkt, edns->bits);
	rdatapos = sldns_buffer_position(pkt);
	sldns_buffer_write_u16(pkt, 0); /* rdatalen */
	/* write rdata */
	for(opt=edns->opt_list; opt; opt=opt->next) {
	sldns_buffer_write_u16(pkt, opt->opt_code);
	sldns_buffer_write_u16(pkt, opt->opt_len);
	if(opt->opt_len != 0)
	sldns_buffer_write(pkt, opt->opt_data, opt->opt_len);
	}
	if(edns->opt_list)
	sldns_buffer_write_u16_at(pkt, rdatapos,
	sldns_buffer_position(pkt)-rdatapos-2);
	sldns_buffer_flip(pkt);
	}

	int
	reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep,
	uint16_t id, uint16_t qflags, sldns_buffer* pkt, time_t timenow,
	int cached, struct regional* region, uint16_t udpsize,
	struct edns_data* edns, int dnssec, int secure)
	{
	uint16_t flags;
	unsigned int attach_edns = 0;

	if(!cached \|\| rep->authoritative) {
	/* original flags, copy RD and CD bits from query. */
	flags = rep->flags \| (qflags & (BIT_RD\|BIT_CD));
	} else {
	/* remove AA bit, copy RD and CD bits from query. */
	flags = (rep->flags & ~BIT_AA) \| (qflags & (BIT_RD\|BIT_CD));
	}
	if(secure && (dnssec \|\| (qflags&BIT_AD)))
	flags \|= BIT_AD;
	/* restore AA bit if we have a local alias and the response can be
	* authoritative. Also clear AD bit if set as the local data is the
	* primary answer. */
	if(qinf->local_alias &&
	(FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR \|\|
	FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NXDOMAIN)) {
	flags \|= BIT_AA;
	flags &= ~BIT_AD;
	}
	log_assert(flags & BIT_QR); /* QR bit must be on in our replies */
	if(udpsize < LDNS_HEADER_SIZE)
	return 0;
	if(sldns_buffer_capacity(pkt) < udpsize)
	udpsize = sldns_buffer_capacity(pkt);
	if(udpsize < LDNS_HEADER_SIZE + calc_edns_field_size(edns)) {
	/* packet too small to contain edns, omit it. */
	attach_edns = 0;
	} else {
	/* reserve space for edns record */
	attach_edns = (unsigned int)calc_edns_field_size(edns);
	udpsize -= attach_edns;
	}

	if(!reply_info_encode(qinf, rep, id, flags, pkt, timenow, region,
	udpsize, dnssec)) {
	log_err("reply encode: out of memory");
	return 0;
	}
	if(attach_edns && sldns_buffer_capacity(pkt) >=
	sldns_buffer_limit(pkt)+attach_edns)
	attach_edns_record(pkt, edns);
	return 1;
	}

	void
	qinfo_query_encode(sldns_buffer* pkt, struct query_info* qinfo)
	{
	uint16_t flags = 0; /* QUERY, NOERROR */
	const uint8_t* qname = qinfo->local_alias ?
	qinfo->local_alias->rrset->rk.dname : qinfo->qname;
	size_t qname_len = qinfo->local_alias ?
	qinfo->local_alias->rrset->rk.dname_len : qinfo->qname_len;
	sldns_buffer_clear(pkt);
	log_assert(sldns_buffer_remaining(pkt) >= 12+255+4/max query/);
	sldns_buffer_skip(pkt, 2); /* id done later */
	sldns_buffer_write_u16(pkt, flags);
	sldns_buffer_write_u16(pkt, 1); /* query count */
	sldns_buffer_write(pkt, "\000\000\000\000\000\000", 6); /* counts */
	sldns_buffer_write(pkt, qname, qname_len);
	sldns_buffer_write_u16(pkt, qinfo->qtype);
	sldns_buffer_write_u16(pkt, qinfo->qclass);
	sldns_buffer_flip(pkt);
	}

	void
	error_encode(sldns_buffer* buf, int r, struct query_info* qinfo,
	uint16_t qid, uint16_t qflags, struct edns_data* edns)
	{
	uint16_t flags;

	sldns_buffer_clear(buf);
	sldns_buffer_write(buf, &qid, sizeof(uint16_t));
	flags = (uint16_t)(BIT_QR \| BIT_RA \| r); /* QR and retcode*/
	flags \|= (qflags & (BIT_RD\|BIT_CD)); /* copy RD and CD bit */
	sldns_buffer_write_u16(buf, flags);
	if(qinfo) flags = 1;
	else flags = 0;
	sldns_buffer_write_u16(buf, flags);
	flags = 0;
	sldns_buffer_write(buf, &flags, sizeof(uint16_t));
	sldns_buffer_write(buf, &flags, sizeof(uint16_t));
	sldns_buffer_write(buf, &flags, sizeof(uint16_t));
	if(qinfo) {
	const uint8_t* qname = qinfo->local_alias ?
	qinfo->local_alias->rrset->rk.dname : qinfo->qname;
	size_t qname_len = qinfo->local_alias ?
	qinfo->local_alias->rrset->rk.dname_len :
	qinfo->qname_len;
	if(sldns_buffer_current(buf) == qname)
	sldns_buffer_skip(buf, (ssize_t)qname_len);
	else sldns_buffer_write(buf, qname, qname_len);
	sldns_buffer_write_u16(buf, qinfo->qtype);
	sldns_buffer_write_u16(buf, qinfo->qclass);
	}
	sldns_buffer_flip(buf);
	if(edns) {
	struct edns_data es = *edns;
	es.edns_version = EDNS_ADVERTISED_VERSION;
	es.udp_size = EDNS_ADVERTISED_SIZE;
	es.ext_rcode = 0;
	es.bits &= EDNS_DO;
	if(sldns_buffer_limit(buf) + calc_edns_field_size(&es) >
	edns->udp_size)
	return;
	attach_edns_record(buf, &es);
	}
	}
	Index: head/contrib/unbound/util/data/msgreply.c
	===================================================================
	--- head/contrib/unbound/util/data/msgreply.c (revision 349719)
	+++ head/contrib/unbound/util/data/msgreply.c (revision 349720)
	@@ -1,1247 +1,1255 @@
	/*
	* util/data/msgreply.c - store message and reply data.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains a data structure to store a message and its reply.
	*/

	#include "config.h"
	#include "util/data/msgreply.h"
	#include "util/storage/lookup3.h"
	#include "util/log.h"
	#include "util/alloc.h"
	#include "util/netevent.h"
	#include "util/net_help.h"
	#include "util/data/dname.h"
	#include "util/regional.h"
	#include "util/data/msgparse.h"
	#include "util/data/msgencode.h"
	#include "sldns/sbuffer.h"
	#include "sldns/wire2str.h"
	#include "util/module.h"
	#include "util/fptr_wlist.h"

	/** MAX TTL default for messages and rrsets */
	time_t MAX_TTL = 3600 * 24 * 10; /* ten days */
	/** MIN TTL default for messages and rrsets */
	time_t MIN_TTL = 0;
	/** MAX Negative TTL, for SOA records in authority section */
	time_t MAX_NEG_TTL = 3600; /* one hour */
	/** Time to serve records after expiration */
	time_t SERVE_EXPIRED_TTL = 0;

	/** allocate qinfo, return 0 on error */
	static int
	parse_create_qinfo(sldns_buffer* pkt, struct msg_parse* msg,
	struct query_info* qinf, struct regional* region)
	{
	if(msg->qname) {
	if(region)
	qinf->qname = (uint8_t*)regional_alloc(region,
	msg->qname_len);
	else qinf->qname = (uint8_t*)malloc(msg->qname_len);
	if(!qinf->qname) return 0;
	dname_pkt_copy(pkt, qinf->qname, msg->qname);
	} else qinf->qname = 0;
	qinf->qname_len = msg->qname_len;
	qinf->qtype = msg->qtype;
	qinf->qclass = msg->qclass;
	qinf->local_alias = NULL;
	return 1;
	}

	/** constructor for replyinfo */
	struct reply_info*
	construct_reply_info_base(struct regional* region, uint16_t flags, size_t qd,
	time_t ttl, time_t prettl, time_t expttl, size_t an, size_t ns,
	size_t ar, size_t total, enum sec_status sec)
	{
	struct reply_info* rep;
	/* rrset_count-1 because the first ref is part of the struct. */
	size_t s = sizeof(struct reply_info) - sizeof(struct rrset_ref) +
	sizeof(struct ub_packed_rrset_key) total;
	if(total >= RR_COUNT_MAX) return NULL; /* sanity check on numRRS*/
	if(region)
	rep = (struct reply_info*)regional_alloc(region, s);
	else rep = (struct reply_info*)malloc(s +
	sizeof(struct rrset_ref) * (total));
	if(!rep)
	return NULL;
	rep->flags = flags;
	rep->qdcount = qd;
	rep->ttl = ttl;
	rep->prefetch_ttl = prettl;
	rep->serve_expired_ttl = expttl;
	rep->an_numrrsets = an;
	rep->ns_numrrsets = ns;
	rep->ar_numrrsets = ar;
	rep->rrset_count = total;
	rep->security = sec;
	rep->authoritative = 0;
	/* array starts after the refs */
	if(region)
	rep->rrsets = (struct ub_packed_rrset_key**)&(rep->ref[0]);
	else rep->rrsets = (struct ub_packed_rrset_key**)&(rep->ref[total]);
	/* zero the arrays to assist cleanup in case of malloc failure */
	memset( rep->rrsets, 0, sizeof(struct ub_packed_rrset_key) total);
	if(!region)
	memset( &rep->ref[0], 0, sizeof(struct rrset_ref) * total);
	return rep;
	}

	/** allocate replyinfo, return 0 on error */
	static int
	parse_create_repinfo(struct msg_parse* msg, struct reply_info** rep,
	struct regional* region)
	{
	*rep = construct_reply_info_base(region, msg->flags, msg->qdcount, 0,
	0, 0, msg->an_rrsets, msg->ns_rrsets, msg->ar_rrsets,
	msg->rrset_count, sec_status_unchecked);
	if(!*rep)
	return 0;
	return 1;
	}

	int
	reply_info_alloc_rrset_keys(struct reply_info* rep, struct alloc_cache* alloc,
	struct regional* region)
	{
	size_t i;
	for(i=0; i<rep->rrset_count; i++) {
	if(region) {
	rep->rrsets[i] = (struct ub_packed_rrset_key*)
	regional_alloc(region,
	sizeof(struct ub_packed_rrset_key));
	if(rep->rrsets[i]) {
	memset(rep->rrsets[i], 0,
	sizeof(struct ub_packed_rrset_key));
	rep->rrsets[i]->entry.key = rep->rrsets[i];
	}
	}
	else rep->rrsets[i] = alloc_special_obtain(alloc);
	if(!rep->rrsets[i])
	return 0;
	rep->rrsets[i]->entry.data = NULL;
	}
	return 1;
	}

	/** find the minimumttl in the rdata of SOA record */
	static time_t
	soa_find_minttl(struct rr_parse* rr)
	{
	uint16_t rlen = sldns_read_uint16(rr->ttl_data+4);
	if(rlen < 20)
	return 0; /* rdata too small for SOA (dname, dname, 532bit) /
	/* minimum TTL is the last 32bit value in the rdata of the record */
	/* at position ttl_data + 4(ttl) + 2(rdatalen) + rdatalen - 4(timeval)*/
	return (time_t)sldns_read_uint32(rr->ttl_data+6+rlen-4);
	}

	/** do the rdata copy */
	static int
	rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to,
	struct rr_parse* rr, time_t* rr_ttl, uint16_t type,
	sldns_pkt_section section)
	{
	uint16_t pkt_len;
	const sldns_rr_descriptor* desc;

	*rr_ttl = sldns_read_uint32(rr->ttl_data);
	/* RFC 2181 Section 8. if msb of ttl is set treat as if zero. */
	if(*rr_ttl & 0x80000000U)
	*rr_ttl = 0;
	if(type == LDNS_RR_TYPE_SOA && section == LDNS_SECTION_AUTHORITY) {
	/* negative response. see if TTL of SOA record larger than the
	* minimum-ttl in the rdata of the SOA record */
	if(*rr_ttl > soa_find_minttl(rr))
	*rr_ttl = soa_find_minttl(rr);
	if(*rr_ttl > MAX_NEG_TTL)
	*rr_ttl = MAX_NEG_TTL;
	}
	if(*rr_ttl < MIN_TTL)
	*rr_ttl = MIN_TTL;
	+ if(*rr_ttl > MAX_TTL)
	+ *rr_ttl = MAX_TTL;
	if(*rr_ttl < data->ttl)
	data->ttl = *rr_ttl;

	if(rr->outside_packet) {
	/* uncompressed already, only needs copy */
	memmove(to, rr->ttl_data+sizeof(uint32_t), rr->size);
	return 1;
	}

	sldns_buffer_set_position(pkt, (size_t)
	(rr->ttl_data - sldns_buffer_begin(pkt) + sizeof(uint32_t)));
	/* insert decompressed size into rdata len stored in memory */
	/* -2 because rdatalen bytes are not included. */
	pkt_len = htons(rr->size - 2);
	memmove(to, &pkt_len, sizeof(uint16_t));
	to += 2;
	/* read packet rdata len */
	pkt_len = sldns_buffer_read_u16(pkt);
	if(sldns_buffer_remaining(pkt) < pkt_len)
	return 0;
	desc = sldns_rr_descript(type);
	if(pkt_len > 0 && desc && desc->_dname_count > 0) {
	int count = (int)desc->_dname_count;
	int rdf = 0;
	size_t len;
	size_t oldpos;
	/* decompress dnames. */
	while(pkt_len > 0 && count) {
	switch(desc->_wireformat[rdf]) {
	case LDNS_RDF_TYPE_DNAME:
	oldpos = sldns_buffer_position(pkt);
	dname_pkt_copy(pkt, to,
	sldns_buffer_current(pkt));
	to += pkt_dname_len(pkt);
	pkt_len -= sldns_buffer_position(pkt)-oldpos;
	count--;
	len = 0;
	break;
	case LDNS_RDF_TYPE_STR:
	len = sldns_buffer_current(pkt)[0] + 1;
	break;
	default:
	len = get_rdf_size(desc->_wireformat[rdf]);
	break;
	}
	if(len) {
	memmove(to, sldns_buffer_current(pkt), len);
	to += len;
	sldns_buffer_skip(pkt, (ssize_t)len);
	log_assert(len <= pkt_len);
	pkt_len -= len;
	}
	rdf++;
	}
	}
	/* copy remaining rdata */
	if(pkt_len > 0)
	memmove(to, sldns_buffer_current(pkt), pkt_len);

	return 1;
	}

	/** copy over the data into packed rrset */
	static int
	parse_rr_copy(sldns_buffer* pkt, struct rrset_parse* pset,
	struct packed_rrset_data* data)
	{
	size_t i;
	struct rr_parse* rr = pset->rr_first;
	uint8_t* nextrdata;
	size_t total = pset->rr_count + pset->rrsig_count;
	data->ttl = MAX_TTL;
	data->count = pset->rr_count;
	data->rrsig_count = pset->rrsig_count;
	data->trust = rrset_trust_none;
	data->security = sec_status_unchecked;
	/* layout: struct - rr_len - rr_data - rr_ttl - rdata - rrsig */
	data->rr_len = (size_t)((uint8_t)data +
	sizeof(struct packed_rrset_data));
	data->rr_data = (uint8_t**)&(data->rr_len[total]);
	data->rr_ttl = (time_t*)&(data->rr_data[total]);
	nextrdata = (uint8_t*)&(data->rr_ttl[total]);
	for(i=0; i<data->count; i++) {
	data->rr_len[i] = rr->size;
	data->rr_data[i] = nextrdata;
	nextrdata += rr->size;
	if(!rdata_copy(pkt, data, data->rr_data[i], rr,
	&data->rr_ttl[i], pset->type, pset->section))
	return 0;
	rr = rr->next;
	}
	/* if rrsig, its rdata is at nextrdata */
	rr = pset->rrsig_first;
	for(i=data->count; i<total; i++) {
	data->rr_len[i] = rr->size;
	data->rr_data[i] = nextrdata;
	nextrdata += rr->size;
	if(!rdata_copy(pkt, data, data->rr_data[i], rr,
	&data->rr_ttl[i], LDNS_RR_TYPE_RRSIG, pset->section))
	return 0;
	rr = rr->next;
	}
	return 1;
	}

	/** create rrset return 0 on failure */
	static int
	parse_create_rrset(sldns_buffer* pkt, struct rrset_parse* pset,
	struct packed_rrset_data** data, struct regional* region)
	{
	/* allocate */
	size_t s;
	if(pset->rr_count > RR_COUNT_MAX \|\| pset->rrsig_count > RR_COUNT_MAX \|\|
	pset->size > RR_COUNT_MAX)
	return 0; /* protect against integer overflow */
	s = sizeof(struct packed_rrset_data) +
	(pset->rr_count + pset->rrsig_count) *
	(sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t)) +
	pset->size;
	if(region)
	*data = regional_alloc(region, s);
	else *data = malloc(s);
	if(!*data)
	return 0;
	/* copy & decompress */
	if(!parse_rr_copy(pkt, pset, *data)) {
	if(!region) free(*data);
	return 0;
	}
	return 1;
	}

	/** get trust value for rrset */
	static enum rrset_trust
	get_rrset_trust(struct msg_parse* msg, struct rrset_parse* rrset)
	{
	uint16_t AA = msg->flags & BIT_AA;
	if(rrset->section == LDNS_SECTION_ANSWER) {
	if(AA) {
	/* RFC2181 says remainder of CNAME chain is nonauth*/
	if(msg->rrset_first &&
	msg->rrset_first->section==LDNS_SECTION_ANSWER
	&& msg->rrset_first->type==LDNS_RR_TYPE_CNAME){
	if(rrset == msg->rrset_first)
	return rrset_trust_ans_AA;
	else return rrset_trust_ans_noAA;
	}
	if(msg->rrset_first &&
	msg->rrset_first->section==LDNS_SECTION_ANSWER
	&& msg->rrset_first->type==LDNS_RR_TYPE_DNAME){
	if(rrset == msg->rrset_first \|\|
	rrset == msg->rrset_first->rrset_all_next)
	return rrset_trust_ans_AA;
	else return rrset_trust_ans_noAA;
	}
	return rrset_trust_ans_AA;
	}
	else return rrset_trust_ans_noAA;
	} else if(rrset->section == LDNS_SECTION_AUTHORITY) {
	if(AA) return rrset_trust_auth_AA;
	else return rrset_trust_auth_noAA;
	} else {
	/* addit section */
	if(AA) return rrset_trust_add_AA;
	else return rrset_trust_add_noAA;
	}
	/* NOTREACHED */
	return rrset_trust_none;
	}

	int
	parse_copy_decompress_rrset(sldns_buffer* pkt, struct msg_parse* msg,
	struct rrset_parse pset, struct regional region,
	struct ub_packed_rrset_key* pk)
	{
	struct packed_rrset_data* data;
	pk->rk.flags = pset->flags;
	pk->rk.dname_len = pset->dname_len;
	if(region)
	pk->rk.dname = (uint8_t*)regional_alloc(
	region, pset->dname_len);
	else pk->rk.dname =
	(uint8_t*)malloc(pset->dname_len);
	if(!pk->rk.dname)
	return 0;
	/** copy & decompress dname */
	dname_pkt_copy(pkt, pk->rk.dname, pset->dname);
	/** copy over type and class */
	pk->rk.type = htons(pset->type);
	pk->rk.rrset_class = pset->rrset_class;
	/** read data part. */
	if(!parse_create_rrset(pkt, pset, &data, region))
	return 0;
	pk->entry.data = (void*)data;
	pk->entry.key = (void*)pk;
	pk->entry.hash = pset->hash;
	data->trust = get_rrset_trust(msg, pset);
	return 1;
	}

	/**
	* Copy and decompress rrs
	* @param pkt: the packet for compression pointer resolution.
	* @param msg: the parsed message
	* @param rep: reply info to put rrs into.
	* @param region: if not NULL, used for allocation.
	* @return 0 on failure.
	*/
	static int
	parse_copy_decompress(sldns_buffer* pkt, struct msg_parse* msg,
	struct reply_info* rep, struct regional* region)
	{
	size_t i;
	struct rrset_parse *pset = msg->rrset_first;
	struct packed_rrset_data* data;
	log_assert(rep);
	rep->ttl = MAX_TTL;
	rep->security = sec_status_unchecked;
	if(rep->rrset_count == 0)
	rep->ttl = NORR_TTL;

	for(i=0; i<rep->rrset_count; i++) {
	if(!parse_copy_decompress_rrset(pkt, msg, pset, region,
	rep->rrsets[i]))
	return 0;
	data = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
	if(data->ttl < rep->ttl)
	rep->ttl = data->ttl;

	pset = pset->rrset_all_next;
	}
	rep->prefetch_ttl = PREFETCH_TTL_CALC(rep->ttl);
	rep->serve_expired_ttl = rep->ttl + SERVE_EXPIRED_TTL;
	return 1;
	}

	int
	parse_create_msg(sldns_buffer* pkt, struct msg_parse* msg,
	struct alloc_cache* alloc, struct query_info* qinf,
	struct reply_info** rep, struct regional* region)
	{
	log_assert(pkt && msg);
	if(!parse_create_qinfo(pkt, msg, qinf, region))
	return 0;
	if(!parse_create_repinfo(msg, rep, region))
	return 0;
	if(!reply_info_alloc_rrset_keys(*rep, alloc, region)) {
	if(!region) reply_info_parsedelete(*rep, alloc);
	return 0;
	}
	if(!parse_copy_decompress(pkt, msg, *rep, region)) {
	if(!region) reply_info_parsedelete(*rep, alloc);
	return 0;
	}
	return 1;
	}

	int reply_info_parse(sldns_buffer* pkt, struct alloc_cache* alloc,
	struct query_info* qinf, struct reply_info** rep,
	struct regional* region, struct edns_data* edns)
	{
	/* use scratch pad region-allocator during parsing. */
	struct msg_parse* msg;
	int ret;

	qinf->qname = NULL;
	qinf->local_alias = NULL;
	*rep = NULL;
	if(!(msg = regional_alloc(region, sizeof(*msg)))) {
	return LDNS_RCODE_SERVFAIL;
	}
	memset(msg, 0, sizeof(*msg));

	sldns_buffer_set_position(pkt, 0);
	if((ret = parse_packet(pkt, msg, region)) != 0) {
	return ret;
	}
	if((ret = parse_extract_edns(msg, edns, region)) != 0)
	return ret;

	/* parse OK, allocate return structures */
	/* this also performs dname decompression */
	if(!parse_create_msg(pkt, msg, alloc, qinf, rep, NULL)) {
	query_info_clear(qinf);
	reply_info_parsedelete(*rep, alloc);
	*rep = NULL;
	return LDNS_RCODE_SERVFAIL;
	}
	return 0;
	}

	/** helper compare function to sort in lock order */
	static int
	reply_info_sortref_cmp(const void* a, const void* b)
	{
	struct rrset_ref* x = (struct rrset_ref*)a;
	struct rrset_ref* y = (struct rrset_ref*)b;
	if(x->key < y->key) return -1;
	if(x->key > y->key) return 1;
	return 0;
	}

	void
	reply_info_sortref(struct reply_info* rep)
	{
	qsort(&rep->ref[0], rep->rrset_count, sizeof(struct rrset_ref),
	reply_info_sortref_cmp);
	}

	void
	reply_info_set_ttls(struct reply_info* rep, time_t timenow)
	{
	size_t i, j;
	rep->ttl += timenow;
	rep->prefetch_ttl += timenow;
	rep->serve_expired_ttl += timenow;
	for(i=0; i<rep->rrset_count; i++) {
	struct packed_rrset_data* data = (struct packed_rrset_data*)
	rep->ref[i].key->entry.data;
	if(i>0 && rep->ref[i].key == rep->ref[i-1].key)
	continue;
	data->ttl += timenow;
	for(j=0; j<data->count + data->rrsig_count; j++) {
	data->rr_ttl[j] += timenow;
	}
	}
	}

	void
	reply_info_parsedelete(struct reply_info* rep, struct alloc_cache* alloc)
	{
	size_t i;
	if(!rep)
	return;
	/* no need to lock, since not shared in hashtables. */
	for(i=0; i<rep->rrset_count; i++) {
	ub_packed_rrset_parsedelete(rep->rrsets[i], alloc);
	}
	free(rep);
	}

	int
	query_info_parse(struct query_info* m, sldns_buffer* query)
	{
	uint8_t* q = sldns_buffer_begin(query);
	/* minimum size: header + \0 + qtype + qclass */
	if(sldns_buffer_limit(query) < LDNS_HEADER_SIZE + 5)
	return 0;
	if((LDNS_OPCODE_WIRE(q) != LDNS_PACKET_QUERY && LDNS_OPCODE_WIRE(q) !=
	LDNS_PACKET_NOTIFY) \|\| LDNS_QDCOUNT(q) != 1 \|\|
	sldns_buffer_position(query) != 0)
	return 0;
	sldns_buffer_skip(query, LDNS_HEADER_SIZE);
	m->qname = sldns_buffer_current(query);
	if((m->qname_len = query_dname_len(query)) == 0)
	return 0; /* parse error */
	if(sldns_buffer_remaining(query) < 4)
	return 0; /* need qtype, qclass */
	m->qtype = sldns_buffer_read_u16(query);
	m->qclass = sldns_buffer_read_u16(query);
	m->local_alias = NULL;
	return 1;
	}

	/** tiny subroutine for msgreply_compare */
	#define COMPARE_IT(x, y) \
	if( (x) < (y) ) return -1; \
	else if( (x) > (y) ) return +1; \
	log_assert( (x) == (y) );

	int
	query_info_compare(void* m1, void* m2)
	{
	struct query_info* msg1 = (struct query_info*)m1;
	struct query_info* msg2 = (struct query_info*)m2;
	int mc;
	/* from most different to least different for speed */
	COMPARE_IT(msg1->qtype, msg2->qtype);
	if((mc = query_dname_compare(msg1->qname, msg2->qname)) != 0)
	return mc;
	log_assert(msg1->qname_len == msg2->qname_len);
	COMPARE_IT(msg1->qclass, msg2->qclass);
	return 0;
	#undef COMPARE_IT
	}

	void
	query_info_clear(struct query_info* m)
	{
	free(m->qname);
	m->qname = NULL;
	}

	size_t
	msgreply_sizefunc(void* k, void* d)
	{
	struct msgreply_entry* q = (struct msgreply_entry*)k;
	struct reply_info* r = (struct reply_info*)d;
	size_t s = sizeof(struct msgreply_entry) + sizeof(struct reply_info)
	+ q->key.qname_len + lock_get_mem(&q->entry.lock)
	- sizeof(struct rrset_ref);
	s += r->rrset_count * sizeof(struct rrset_ref);
	s += r->rrset_count * sizeof(struct ub_packed_rrset_key*);
	return s;
	}

	void
	query_entry_delete(void k, void ATTR_UNUSED(arg))
	{
	struct msgreply_entry* q = (struct msgreply_entry*)k;
	lock_rw_destroy(&q->entry.lock);
	query_info_clear(&q->key);
	free(q);
	}

	void
	reply_info_delete(void* d, void* ATTR_UNUSED(arg))
	{
	struct reply_info* r = (struct reply_info*)d;
	free(r);
	}

	hashvalue_type
	query_info_hash(struct query_info *q, uint16_t flags)
	{
	hashvalue_type h = 0xab;
	h = hashlittle(&q->qtype, sizeof(q->qtype), h);
	if(q->qtype == LDNS_RR_TYPE_AAAA && (flags&BIT_CD))
	h++;
	h = hashlittle(&q->qclass, sizeof(q->qclass), h);
	h = dname_query_hash(q->qname, h);
	return h;
	}

	struct msgreply_entry*
	query_info_entrysetup(struct query_info* q, struct reply_info* r,
	hashvalue_type h)
	{
	struct msgreply_entry* e = (struct msgreply_entry*)malloc(
	sizeof(struct msgreply_entry));
	if(!e) return NULL;
	memcpy(&e->key, q, sizeof(*q));
	e->entry.hash = h;
	e->entry.key = e;
	e->entry.data = r;
	lock_rw_init(&e->entry.lock);
	lock_protect(&e->entry.lock, &e->key.qname, sizeof(e->key.qname));
	lock_protect(&e->entry.lock, &e->key.qname_len, sizeof(e->key.qname_len));
	lock_protect(&e->entry.lock, &e->key.qtype, sizeof(e->key.qtype));
	lock_protect(&e->entry.lock, &e->key.qclass, sizeof(e->key.qclass));
	lock_protect(&e->entry.lock, &e->key.local_alias, sizeof(e->key.local_alias));
	lock_protect(&e->entry.lock, &e->entry.hash, sizeof(e->entry.hash));
	lock_protect(&e->entry.lock, &e->entry.key, sizeof(e->entry.key));
	lock_protect(&e->entry.lock, &e->entry.data, sizeof(e->entry.data));
	lock_protect(&e->entry.lock, e->key.qname, e->key.qname_len);
	q->qname = NULL;
	return e;
	}

	/** copy rrsets from replyinfo to dest replyinfo */
	static int
	repinfo_copy_rrsets(struct reply_info* dest, struct reply_info* from,
	struct regional* region)
	{
	size_t i, s;
	struct packed_rrset_data* fd, *dd;
	struct ub_packed_rrset_key* fk, *dk;
	for(i=0; i<dest->rrset_count; i++) {
	fk = from->rrsets[i];
	dk = dest->rrsets[i];
	fd = (struct packed_rrset_data*)fk->entry.data;
	dk->entry.hash = fk->entry.hash;
	dk->rk = fk->rk;
	if(region) {
	dk->id = fk->id;
	dk->rk.dname = (uint8_t*)regional_alloc_init(region,
	fk->rk.dname, fk->rk.dname_len);
	} else
	dk->rk.dname = (uint8_t*)memdup(fk->rk.dname,
	fk->rk.dname_len);
	if(!dk->rk.dname)
	return 0;
	s = packed_rrset_sizeof(fd);
	if(region)
	dd = (struct packed_rrset_data*)regional_alloc_init(
	region, fd, s);
	else dd = (struct packed_rrset_data*)memdup(fd, s);
	if(!dd)
	return 0;
	packed_rrset_ptr_fixup(dd);
	dk->entry.data = (void*)dd;
	}
	return 1;
	}

	struct reply_info*
	reply_info_copy(struct reply_info* rep, struct alloc_cache* alloc,
	struct regional* region)
	{
	struct reply_info* cp;
	cp = construct_reply_info_base(region, rep->flags, rep->qdcount,
	rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl,
	rep->an_numrrsets, rep->ns_numrrsets, rep->ar_numrrsets,
	rep->rrset_count, rep->security);
	if(!cp)
	return NULL;
	/* allocate ub_key structures special or not */
	if(!reply_info_alloc_rrset_keys(cp, alloc, region)) {
	if(!region)
	reply_info_parsedelete(cp, alloc);
	return NULL;
	}
	if(!repinfo_copy_rrsets(cp, rep, region)) {
	if(!region)
	reply_info_parsedelete(cp, alloc);
	return NULL;
	}
	return cp;
	}

	uint8_t*
	reply_find_final_cname_target(struct query_info* qinfo, struct reply_info* rep)
	{
	uint8_t* sname = qinfo->qname;
	size_t snamelen = qinfo->qname_len;
	size_t i;
	for(i=0; i<rep->an_numrrsets; i++) {
	struct ub_packed_rrset_key* s = rep->rrsets[i];
	/* follow CNAME chain (if any) */
	if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME &&
	ntohs(s->rk.rrset_class) == qinfo->qclass &&
	snamelen == s->rk.dname_len &&
	query_dname_compare(sname, s->rk.dname) == 0) {
	get_cname_target(s, &sname, &snamelen);
	}
	}
	if(sname != qinfo->qname)
	return sname;
	return NULL;
	}

	struct ub_packed_rrset_key*
	reply_find_answer_rrset(struct query_info* qinfo, struct reply_info* rep)
	{
	uint8_t* sname = qinfo->qname;
	size_t snamelen = qinfo->qname_len;
	size_t i;
	for(i=0; i<rep->an_numrrsets; i++) {
	struct ub_packed_rrset_key* s = rep->rrsets[i];
	/* first match type, for query of qtype cname */
	if(ntohs(s->rk.type) == qinfo->qtype &&
	ntohs(s->rk.rrset_class) == qinfo->qclass &&
	snamelen == s->rk.dname_len &&
	query_dname_compare(sname, s->rk.dname) == 0) {
	return s;
	}
	/* follow CNAME chain (if any) */
	if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME &&
	ntohs(s->rk.rrset_class) == qinfo->qclass &&
	snamelen == s->rk.dname_len &&
	query_dname_compare(sname, s->rk.dname) == 0) {
	get_cname_target(s, &sname, &snamelen);
	}
	}
	return NULL;
	}

	struct ub_packed_rrset_key* reply_find_rrset_section_an(struct reply_info* rep,
	uint8_t* name, size_t namelen, uint16_t type, uint16_t dclass)
	{
	size_t i;
	for(i=0; i<rep->an_numrrsets; i++) {
	struct ub_packed_rrset_key* s = rep->rrsets[i];
	if(ntohs(s->rk.type) == type &&
	ntohs(s->rk.rrset_class) == dclass &&
	namelen == s->rk.dname_len &&
	query_dname_compare(name, s->rk.dname) == 0) {
	return s;
	}
	}
	return NULL;
	}

	struct ub_packed_rrset_key* reply_find_rrset_section_ns(struct reply_info* rep,
	uint8_t* name, size_t namelen, uint16_t type, uint16_t dclass)
	{
	size_t i;
	for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
	struct ub_packed_rrset_key* s = rep->rrsets[i];
	if(ntohs(s->rk.type) == type &&
	ntohs(s->rk.rrset_class) == dclass &&
	namelen == s->rk.dname_len &&
	query_dname_compare(name, s->rk.dname) == 0) {
	return s;
	}
	}
	return NULL;
	}

	struct ub_packed_rrset_key* reply_find_rrset(struct reply_info* rep,
	uint8_t* name, size_t namelen, uint16_t type, uint16_t dclass)
	{
	size_t i;
	for(i=0; i<rep->rrset_count; i++) {
	struct ub_packed_rrset_key* s = rep->rrsets[i];
	if(ntohs(s->rk.type) == type &&
	ntohs(s->rk.rrset_class) == dclass &&
	namelen == s->rk.dname_len &&
	query_dname_compare(name, s->rk.dname) == 0) {
	return s;
	}
	}
	return NULL;
	}

	void
	log_dns_msg(const char* str, struct query_info* qinfo, struct reply_info* rep)
	{
	/* not particularly fast but flexible, make wireformat and print */
	sldns_buffer* buf = sldns_buffer_new(65535);
	struct regional* region = regional_create();
	if(!reply_info_encode(qinfo, rep, 0, rep->flags, buf, 0,
	region, 65535, 1)) {
	log_info("%s: log_dns_msg: out of memory", str);
	} else {
	char* s = sldns_wire2str_pkt(sldns_buffer_begin(buf),
	sldns_buffer_limit(buf));
	if(!s) {
	log_info("%s: log_dns_msg: ldns tostr failed", str);
	} else {
	log_info("%s %s", str, s);
	}
	free(s);
	}
	sldns_buffer_free(buf);
	regional_destroy(region);
	}

	void
	log_reply_info(enum verbosity_value v, struct query_info *qinf,
	struct sockaddr_storage *addr, socklen_t addrlen, struct timeval dur,
	int cached, struct sldns_buffer *rmsg)
	{
	char qname_buf[LDNS_MAX_DOMAINLEN+1];
	char clientip_buf[128];
	char rcode_buf[16];
	char type_buf[16];
	char class_buf[16];
	size_t pktlen;
	uint16_t rcode = FLAGS_GET_RCODE(sldns_buffer_read_u16_at(rmsg, 2));

	if(verbosity < v)
	return;

	sldns_wire2str_rcode_buf((int)rcode, rcode_buf, sizeof(rcode_buf));
	addr_to_str(addr, addrlen, clientip_buf, sizeof(clientip_buf));
	if(rcode == LDNS_RCODE_FORMERR)
	{
	- log_info("%s - - - %s - - - ", clientip_buf, rcode_buf);
	+ if(LOG_TAG_QUERYREPLY)
	+ log_reply("%s - - - %s - - - ", clientip_buf, rcode_buf);
	+ else log_info("%s - - - %s - - - ", clientip_buf, rcode_buf);
	} else {
	if(qinf->qname)
	dname_str(qinf->qname, qname_buf);
	else snprintf(qname_buf, sizeof(qname_buf), "null");
	pktlen = sldns_buffer_limit(rmsg);
	sldns_wire2str_type_buf(qinf->qtype, type_buf, sizeof(type_buf));
	sldns_wire2str_class_buf(qinf->qclass, class_buf, sizeof(class_buf));
	- log_info("%s %s %s %s %s " ARG_LL "d.%6.6d %d %d",
	+ if(LOG_TAG_QUERYREPLY)
	+ log_reply("%s %s %s %s %s " ARG_LL "d.%6.6d %d %d",
	+ clientip_buf, qname_buf, type_buf, class_buf,
	+ rcode_buf, (long long)dur.tv_sec, (int)dur.tv_usec, cached, (int)pktlen);
	+ else log_info("%s %s %s %s %s " ARG_LL "d.%6.6d %d %d",
	clientip_buf, qname_buf, type_buf, class_buf,
	rcode_buf, (long long)dur.tv_sec, (int)dur.tv_usec, cached, (int)pktlen);
	}
	}

	void
	log_query_info(enum verbosity_value v, const char* str,
	struct query_info* qinf)
	{
	log_nametypeclass(v, str, qinf->qname, qinf->qtype, qinf->qclass);
	}

	int
	reply_check_cname_chain(struct query_info* qinfo, struct reply_info* rep)
	{
	/* check only answer section rrs for matching cname chain.
	* the cache may return changed rdata, but owner names are untouched.*/
	size_t i;
	uint8_t* sname = qinfo->qname;
	size_t snamelen = qinfo->qname_len;
	for(i=0; i<rep->an_numrrsets; i++) {
	uint16_t t = ntohs(rep->rrsets[i]->rk.type);
	if(t == LDNS_RR_TYPE_DNAME)
	continue; /* skip dnames; note TTL 0 not cached */
	/* verify that owner matches current sname */
	if(query_dname_compare(sname, rep->rrsets[i]->rk.dname) != 0){
	/* cname chain broken */
	return 0;
	}
	/* if this is a cname; move on */
	if(t == LDNS_RR_TYPE_CNAME) {
	get_cname_target(rep->rrsets[i], &sname, &snamelen);
	}
	}
	return 1;
	}

	int
	reply_all_rrsets_secure(struct reply_info* rep)
	{
	size_t i;
	for(i=0; i<rep->rrset_count; i++) {
	if( ((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
	->security != sec_status_secure )
	return 0;
	}
	return 1;
	}

	struct reply_info*
	parse_reply_in_temp_region(sldns_buffer* pkt, struct regional* region,
	struct query_info* qi)
	{
	struct reply_info* rep;
	struct msg_parse* msg;
	if(!(msg = regional_alloc(region, sizeof(*msg)))) {
	return NULL;
	}
	memset(msg, 0, sizeof(*msg));
	sldns_buffer_set_position(pkt, 0);
	if(parse_packet(pkt, msg, region) != 0){
	return 0;
	}
	if(!parse_create_msg(pkt, msg, NULL, qi, &rep, region)) {
	return 0;
	}
	return rep;
	}

	int edns_opt_append(struct edns_data* edns, struct regional* region,
	uint16_t code, size_t len, uint8_t* data)
	{
	struct edns_option** prevp;
	struct edns_option* opt;

	/* allocate new element */
	opt = (struct edns_option)regional_alloc(region, sizeof(opt));
	if(!opt)
	return 0;
	opt->next = NULL;
	opt->opt_code = code;
	opt->opt_len = len;
	opt->opt_data = NULL;
	if(len > 0) {
	opt->opt_data = regional_alloc_init(region, data, len);
	if(!opt->opt_data)
	return 0;
	}

	/* append at end of list */
	prevp = &edns->opt_list;
	while(*prevp != NULL)
	prevp = &((*prevp)->next);
	*prevp = opt;
	return 1;
	}

	int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
	uint8_t* data, struct regional* region)
	{
	struct edns_option** prevp;
	struct edns_option* opt;

	/* allocate new element */
	opt = (struct edns_option)regional_alloc(region, sizeof(opt));
	if(!opt)
	return 0;
	opt->next = NULL;
	opt->opt_code = code;
	opt->opt_len = len;
	opt->opt_data = NULL;
	if(len > 0) {
	opt->opt_data = regional_alloc_init(region, data, len);
	if(!opt->opt_data)
	return 0;
	}

	/* append at end of list */
	prevp = list;
	while(*prevp != NULL) {
	prevp = &((*prevp)->next);
	}
	*prevp = opt;
	return 1;
	}

	int edns_opt_list_remove(struct edns_option** list, uint16_t code)
	{
	/* The list should already be allocated in a region. Freeing the
	* allocated space in a region is not possible. We just unlink the
	* required elements and they will be freed together with the region. */

	struct edns_option* prev;
	struct edns_option* curr;
	if(!list \|\| !(*list)) return 0;

	/* Unlink and repoint if the element(s) are first in list */
	while(list && list && (list)->opt_code == code) {
	list = (list)->next;
	}

	if(!list \|\| !(*list)) return 1;
	/* Unlink elements and reattach the list */
	prev = *list;
	curr = (*list)->next;
	while(curr != NULL) {
	if(curr->opt_code == code) {
	prev->next = curr->next;
	curr = curr->next;
	} else {
	prev = curr;
	curr = curr->next;
	}
	}
	return 1;
	}

	static int inplace_cb_reply_call_generic(
	struct inplace_cb* callback_list, enum inplace_cb_list_type type,
	struct query_info* qinfo, struct module_qstate* qstate,
	struct reply_info* rep, int rcode, struct edns_data* edns,
	struct comm_reply* repinfo, struct regional* region)
	{
	struct inplace_cb* cb;
	struct edns_option* opt_list_out = NULL;
	#if defined(EXPORT_ALL_SYMBOLS)
	(void)type; /* param not used when fptr_ok disabled */
	#endif
	if(qstate)
	opt_list_out = qstate->edns_opts_front_out;
	for(cb=callback_list; cb; cb=cb->next) {
	fptr_ok(fptr_whitelist_inplace_cb_reply_generic(
	(inplace_cb_reply_func_type*)cb->cb, type));
	(void)((inplace_cb_reply_func_type)cb->cb)(qinfo, qstate, rep,
	rcode, edns, &opt_list_out, repinfo, region, cb->id, cb->cb_arg);
	}
	edns->opt_list = opt_list_out;
	return 1;
	}

	int inplace_cb_reply_call(struct module_env* env, struct query_info* qinfo,
	struct module_qstate* qstate, struct reply_info* rep, int rcode,
	struct edns_data* edns, struct comm_reply* repinfo, struct regional* region)
	{
	return inplace_cb_reply_call_generic(
	env->inplace_cb_lists[inplace_cb_reply], inplace_cb_reply, qinfo,
	qstate, rep, rcode, edns, repinfo, region);
	}

	int inplace_cb_reply_cache_call(struct module_env* env,
	struct query_info* qinfo, struct module_qstate* qstate,
	struct reply_info* rep, int rcode, struct edns_data* edns,
	struct comm_reply* repinfo, struct regional* region)
	{
	return inplace_cb_reply_call_generic(
	env->inplace_cb_lists[inplace_cb_reply_cache], inplace_cb_reply_cache,
	qinfo, qstate, rep, rcode, edns, repinfo, region);
	}

	int inplace_cb_reply_local_call(struct module_env* env,
	struct query_info* qinfo, struct module_qstate* qstate,
	struct reply_info* rep, int rcode, struct edns_data* edns,
	struct comm_reply* repinfo, struct regional* region)
	{
	return inplace_cb_reply_call_generic(
	env->inplace_cb_lists[inplace_cb_reply_local], inplace_cb_reply_local,
	qinfo, qstate, rep, rcode, edns, repinfo, region);
	}

	int inplace_cb_reply_servfail_call(struct module_env* env,
	struct query_info* qinfo, struct module_qstate* qstate,
	struct reply_info* rep, int rcode, struct edns_data* edns,
	struct comm_reply* repinfo, struct regional* region)
	{
	/* We are going to servfail. Remove any potential edns options. */
	if(qstate)
	qstate->edns_opts_front_out = NULL;
	return inplace_cb_reply_call_generic(
	env->inplace_cb_lists[inplace_cb_reply_servfail],
	inplace_cb_reply_servfail, qinfo, qstate, rep, rcode, edns, repinfo,
	region);
	}

	int inplace_cb_query_call(struct module_env* env, struct query_info* qinfo,
	uint16_t flags, struct sockaddr_storage* addr, socklen_t addrlen,
	uint8_t* zone, size_t zonelen, struct module_qstate* qstate,
	struct regional* region)
	{
	struct inplace_cb* cb = env->inplace_cb_lists[inplace_cb_query];
	for(; cb; cb=cb->next) {
	fptr_ok(fptr_whitelist_inplace_cb_query(
	(inplace_cb_query_func_type*)cb->cb));
	(void)((inplace_cb_query_func_type)cb->cb)(qinfo, flags,
	qstate, addr, addrlen, zone, zonelen, region,
	cb->id, cb->cb_arg);
	}
	return 1;
	}

	int inplace_cb_edns_back_parsed_call(struct module_env* env,
	struct module_qstate* qstate)
	{
	struct inplace_cb* cb =
	env->inplace_cb_lists[inplace_cb_edns_back_parsed];
	for(; cb; cb=cb->next) {
	fptr_ok(fptr_whitelist_inplace_cb_edns_back_parsed(
	(inplace_cb_edns_back_parsed_func_type*)cb->cb));
	(void)((inplace_cb_edns_back_parsed_func_type)cb->cb)(qstate,
	cb->id, cb->cb_arg);
	}
	return 1;
	}

	int inplace_cb_query_response_call(struct module_env* env,
	struct module_qstate* qstate, struct dns_msg* response) {
	struct inplace_cb* cb =
	env->inplace_cb_lists[inplace_cb_query_response];
	for(; cb; cb=cb->next) {
	fptr_ok(fptr_whitelist_inplace_cb_query_response(
	(inplace_cb_query_response_func_type*)cb->cb));
	(void)((inplace_cb_query_response_func_type)cb->cb)(qstate,
	response, cb->id, cb->cb_arg);
	}
	return 1;
	}

	struct edns_option* edns_opt_copy_region(struct edns_option* list,
	struct regional* region)
	{
	struct edns_option* result = NULL, cur = NULL, s;
	while(list) {
	/* copy edns option structure */
	s = regional_alloc_init(region, list, sizeof(*list));
	if(!s) return NULL;
	s->next = NULL;

	/* copy option data */
	if(s->opt_data) {
	s->opt_data = regional_alloc_init(region, s->opt_data,
	s->opt_len);
	if(!s->opt_data)
	return NULL;
	}

	/* link into list */
	if(cur)
	cur->next = s;
	else result = s;
	cur = s;

	/* examine next element */
	list = list->next;
	}
	return result;
	}

	int edns_opt_compare(struct edns_option* p, struct edns_option* q)
	{
	if(!p && !q) return 0;
	if(!p) return -1;
	if(!q) return 1;
	log_assert(p && q);
	if(p->opt_code != q->opt_code)
	return (int)q->opt_code - (int)p->opt_code;
	if(p->opt_len != q->opt_len)
	return (int)q->opt_len - (int)p->opt_len;
	if(p->opt_len != 0)
	return memcmp(p->opt_data, q->opt_data, p->opt_len);
	return 0;
	}

	int edns_opt_list_compare(struct edns_option* p, struct edns_option* q)
	{
	int r;
	while(p && q) {
	r = edns_opt_compare(p, q);
	if(r != 0)
	return r;
	p = p->next;
	q = q->next;
	}
	if(p \|\| q) {
	/* uneven length lists */
	if(p) return 1;
	if(q) return -1;
	}
	return 0;
	}

	void edns_opt_list_free(struct edns_option* list)
	{
	struct edns_option* n;
	while(list) {
	free(list->opt_data);
	n = list->next;
	free(list);
	list = n;
	}
	}

	struct edns_option* edns_opt_copy_alloc(struct edns_option* list)
	{
	struct edns_option* result = NULL, cur = NULL, s;
	while(list) {
	/* copy edns option structure */
	s = memdup(list, sizeof(*list));
	if(!s) {
	edns_opt_list_free(result);
	return NULL;
	}
	s->next = NULL;

	/* copy option data */
	if(s->opt_data) {
	s->opt_data = memdup(s->opt_data, s->opt_len);
	if(!s->opt_data) {
	free(s);
	edns_opt_list_free(result);
	return NULL;
	}
	}

	/* link into list */
	if(cur)
	cur->next = s;
	else result = s;
	cur = s;

	/* examine next element */
	list = list->next;
	}
	return result;
	}

	struct edns_option* edns_opt_list_find(struct edns_option* list, uint16_t code)
	{
	struct edns_option* p;
	for(p=list; p; p=p->next) {
	if(p->opt_code == code)
	return p;
	}
	return NULL;
	}
	Index: head/contrib/unbound/util/data/msgreply.h
	===================================================================
	--- head/contrib/unbound/util/data/msgreply.h (revision 349719)
	+++ head/contrib/unbound/util/data/msgreply.h (revision 349720)
	@@ -1,689 +1,689 @@
	/*
	* util/data/msgreply.h - store message and reply data.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains a data structure to store a message and its reply.
	*/

	#ifndef UTIL_DATA_MSGREPLY_H
	#define UTIL_DATA_MSGREPLY_H
	#include "util/storage/lruhash.h"
	#include "util/data/packed_rrset.h"
	struct sldns_buffer;
	struct comm_reply;
	struct alloc_cache;
	struct iovec;
	struct regional;
	struct edns_data;
	struct edns_option;
	struct inplace_cb;
	struct module_qstate;
	struct module_env;
	struct msg_parse;
	struct rrset_parse;
	struct local_rrset;
	struct dns_msg;

	/** calculate the prefetch TTL as 90% of original. Calculation
	* without numerical overflow (uin32_t) */
	#define PREFETCH_TTL_CALC(ttl) ((ttl) - (ttl)/10)

	/**
	* Structure to store query information that makes answers to queries
	* different.
	*/
	struct query_info {
	/**
	* Salient data on the query: qname, in wireformat.
	* can be allocated or a pointer to outside buffer.
	* User has to keep track on the status of this.
	*/
	uint8_t* qname;
	/** length of qname (including last 0 octet) */
	size_t qname_len;
	/** qtype, host byte order */
	uint16_t qtype;
	/** qclass, host byte order */
	uint16_t qclass;
	/**
	* Alias local answer(s) for the qname. If 'qname' is an alias defined
	* in a local zone, this field will be set to the corresponding local
	* RRset when the alias is determined.
	* In the initial implementation this can only be a single CNAME RR
	* (or NULL), but it could possibly be extended to be a DNAME or a
	* chain of aliases.
	* Users of this structure are responsible to initialize this field
	* to be NULL; otherwise other part of query handling code may be
	* confused.
	* Users also have to be careful about the lifetime of data. On return
	* from local zone lookup, it may point to data derived from
	* configuration that may be dynamically invalidated or data allocated
	* in an ephemeral regional allocator. A deep copy of the data may
	* have to be generated if it has to be kept during iterative
	* resolution. */
	struct local_rrset* local_alias;
	};

	/**
	* Information to reference an rrset
	*/
	struct rrset_ref {
	/** the key with lock, and ptr to packed data. */
	struct ub_packed_rrset_key* key;
	/** id needed */
	rrset_id_type id;
	};

	/**
	* Structure to store DNS query and the reply packet.
	* To use it, copy over the flags from reply and modify using flags from
	* the query (RD,CD if not AA). prepend ID.
	*
	* Memory layout is:
	* o struct
	* o rrset_ref array
	* o packed_rrset_key* array.
	*
	* Memory layout is sometimes not packed, when the message is synthesized,
	* for easy of the generation. It is allocated packed when it is copied
	* from the region allocation to the malloc allocation.
	*/
	struct reply_info {
	/** the flags for the answer, host byte order. */
	uint16_t flags;

	/**
	* This flag informs unbound the answer is authoritative and
	* the AA flag should be preserved.
	*/
	uint8_t authoritative;

	/**
	* Number of RRs in the query section.
	* If qdcount is not 0, then it is 1, and the data that appears
	* in the reply is the same as the query_info.
	* Host byte order.
	*/
	uint8_t qdcount;

	/** 32 bit padding to pad struct member alignment to 64 bits. */
	uint32_t padding;

	/**
	* TTL of the entire reply (for negative caching).
	* only for use when there are 0 RRsets in this message.
	* if there are RRsets, check those instead.
	*/
	time_t ttl;

	/**
	* TTL for prefetch. After it has expired, a prefetch is suitable.
	* Smaller than the TTL, otherwise the prefetch would not happen.
	*/
	time_t prefetch_ttl;

	/**
	- * Reply TTL extended with serve exipred TTL, to limit time to serve
	+ * Reply TTL extended with serve expired TTL, to limit time to serve
	* expired message.
	*/
	time_t serve_expired_ttl;

	/**
	* The security status from DNSSEC validation of this message.
	*/
	enum sec_status security;

	/**
	* Number of RRsets in each section.
	* The answer section. Add up the RRs in every RRset to calculate
	* the number of RRs, and the count for the dns packet.
	* The number of RRs in RRsets can change due to RRset updates.
	*/
	size_t an_numrrsets;

	/** Count of authority section RRsets */
	size_t ns_numrrsets;
	/** Count of additional section RRsets */
	size_t ar_numrrsets;

	/** number of RRsets: an_numrrsets + ns_numrrsets + ar_numrrsets */
	size_t rrset_count;

	/**
	* List of pointers (only) to the rrsets in the order in which
	* they appear in the reply message.
	* Number of elements is ancount+nscount+arcount RRsets.
	* This is a pointer to that array.
	* Use the accessor function for access.
	*/
	struct ub_packed_rrset_key** rrsets;

	/**
	* Packed array of ids (see counts) and pointers to packed_rrset_key.
	* The number equals ancount+nscount+arcount RRsets.
	* These are sorted in ascending pointer, the locking order. So
	* this list can be locked (and id, ttl checked), to see if
	* all the data is available and recent enough.
	*
	* This is defined as an array of size 1, so that the compiler
	* associates the identifier with this position in the structure.
	* Array bound overflow on this array then gives access to the further
	* elements of the array, which are allocated after the main structure.
	*
	* It could be more pure to define as array of size 0, ref[0].
	* But ref[1] may be less confusing for compilers.
	* Use the accessor function for access.
	*/
	struct rrset_ref ref[1];
	};

	/**
	* Structure to keep hash table entry for message replies.
	*/
	struct msgreply_entry {
	/** the hash table key */
	struct query_info key;
	/** the hash table entry, data is struct reply_info* */
	struct lruhash_entry entry;
	};

	/**
	* Constructor for replyinfo.
	* @param region: where to allocate the results, pass NULL to use malloc.
	* @param flags: flags for the replyinfo.
	* @param qd: qd count
	* @param ttl: TTL of replyinfo
	* @param prettl: prefetch ttl
	* @param expttl: serve expired ttl
	* @param an: an count
	* @param ns: ns count
	* @param ar: ar count
	* @param total: total rrset count (presumably an+ns+ar).
	* @param sec: security status of the reply info.
	* @return the reply_info base struct with the array for putting the rrsets
	* in. The array has been zeroed. Returns NULL on malloc failure.
	*/
	struct reply_info*
	construct_reply_info_base(struct regional* region, uint16_t flags, size_t qd,
	time_t ttl, time_t prettl, time_t expttl, size_t an, size_t ns,
	size_t ar, size_t total, enum sec_status sec);

	/**
	* Parse wire query into a queryinfo structure, return 0 on parse error.
	* initialises the (prealloced) queryinfo structure as well.
	* This query structure contains a pointer back info the buffer!
	* This pointer avoids memory allocation. allocqname does memory allocation.
	* @param m: the prealloced queryinfo structure to put query into.
	* must be unused, or _clear()ed.
	* @param query: the wireformat packet query. starts with ID.
	* @return: 0 on format error.
	*/
	int query_info_parse(struct query_info* m, struct sldns_buffer* query);

	/**
	* Parse query reply.
	* Fills in preallocated query_info structure (with ptr into buffer).
	* Allocates reply_info and packed_rrsets. These are not yet added to any
	* caches or anything, this is only parsing. Returns formerror on qdcount > 1.
	* @param pkt: the packet buffer. Must be positioned after the query section.
	* @param alloc: creates packed rrset key structures.
	* @param rep: allocated reply_info is returned (only on no error).
	* @param qinf: query_info is returned (only on no error).
	* @param region: where to store temporary data (for parsing).
	* @param edns: where to store edns information, does not need to be inited.
	* @return: zero is OK, or DNS error code in case of error
	* o FORMERR for parse errors.
	* o SERVFAIL for memory allocation errors.
	*/
	int reply_info_parse(struct sldns_buffer* pkt, struct alloc_cache* alloc,
	struct query_info* qinf, struct reply_info** rep,
	struct regional* region, struct edns_data* edns);

	/**
	* Allocate and decompress parsed message and rrsets.
	* @param pkt: for name decompression.
	* @param msg: parsed message in scratch region.
	* @param alloc: alloc cache for special rrset key structures.
	* Not used if region!=NULL, it can be NULL in that case.
	* @param qinf: where to store query info.
	* qinf itself is allocated by the caller.
	* @param rep: reply info is allocated and returned.
	* @param region: if this parameter is NULL then malloc and the alloc is used.
	* otherwise, everything is allocated in this region.
	* In a region, no special rrset key structures are needed (not shared),
	* and no rrset_ref array in the reply is built up.
	* @return 0 if allocation failed.
	*/
	int parse_create_msg(struct sldns_buffer* pkt, struct msg_parse* msg,
	struct alloc_cache* alloc, struct query_info* qinf,
	struct reply_info** rep, struct regional* region);

	/** get msg reply struct (in temp region) */
	struct reply_info* parse_reply_in_temp_region(struct sldns_buffer* pkt,
	struct regional* region, struct query_info* qi);

	/**
	* Sorts the ref array.
	* @param rep: reply info. rrsets must be filled in.
	*/
	void reply_info_sortref(struct reply_info* rep);

	/**
	* Set TTLs inside the replyinfo to absolute values.
	* @param rep: reply info. rrsets must be filled in.
	* Also refs must be filled in.
	* @param timenow: the current time.
	*/
	void reply_info_set_ttls(struct reply_info* rep, time_t timenow);

	/**
	* Delete reply_info and packed_rrsets (while they are not yet added to the
	* hashtables.). Returns rrsets to the alloc cache.
	* @param rep: reply_info to delete.
	* @param alloc: where to return rrset structures to.
	*/
	void reply_info_parsedelete(struct reply_info* rep, struct alloc_cache* alloc);

	/**
	* Compare two queryinfo structures, on query and type, class.
	* It is _not_ sorted in canonical ordering.
	* @param m1: struct query_info* , void* here to ease use as function pointer.
	* @param m2: struct query_info* , void* here to ease use as function pointer.
	* @return: 0 = same, -1 m1 is smaller, +1 m1 is larger.
	*/
	int query_info_compare(void* m1, void* m2);

	/** clear out query info structure */
	void query_info_clear(struct query_info* m);

	/** calculate size of struct query_info + reply_info */
	size_t msgreply_sizefunc(void* k, void* d);

	/** delete msgreply_entry key structure */
	void query_entry_delete(void q, void arg);

	/** delete reply_info data structure */
	void reply_info_delete(void* d, void* arg);

	/** calculate hash value of query_info, lowercases the qname,
	* uses CD flag for AAAA qtype */
	hashvalue_type query_info_hash(struct query_info *q, uint16_t flags);

	/**
	* Setup query info entry
	* @param q: query info to copy. Emptied as if clear is called.
	* @param r: reply to init data.
	* @param h: hash value.
	* @return: newly allocated message reply cache item.
	*/
	struct msgreply_entry* query_info_entrysetup(struct query_info* q,
	struct reply_info* r, hashvalue_type h);

	/**
	* Copy reply_info and all rrsets in it and allocate.
	* @param rep: what to copy, probably inside region, no ref[] array in it.
	* @param alloc: how to allocate rrset keys.
	* Not used if region!=NULL, it can be NULL in that case.
	* @param region: if this parameter is NULL then malloc and the alloc is used.
	* otherwise, everything is allocated in this region.
	* In a region, no special rrset key structures are needed (not shared),
	* and no rrset_ref array in the reply is built up.
	* @return new reply info or NULL on memory error.
	*/
	struct reply_info* reply_info_copy(struct reply_info* rep,
	struct alloc_cache* alloc, struct regional* region);

	/**
	* Allocate (special) rrset keys.
	* @param rep: reply info in which the rrset keys to be allocated, rrset[]
	* array should have bee allocated with NULL pointers.
	* @param alloc: how to allocate rrset keys.
	* Not used if region!=NULL, it can be NULL in that case.
	* @param region: if this parameter is NULL then the alloc is used.
	* otherwise, rrset keys are allocated in this region.
	* In a region, no special rrset key structures are needed (not shared).
	* and no rrset_ref array in the reply needs to be built up.
	* @return 1 on success, 0 on error
	*/
	int reply_info_alloc_rrset_keys(struct reply_info* rep,
	struct alloc_cache* alloc, struct regional* region);

	/**
	* Copy a parsed rrset into given key, decompressing and allocating rdata.
	* @param pkt: packet for decompression
	* @param msg: the parser message (for flags for trust).
	* @param pset: the parsed rrset to copy.
	* @param region: if NULL - malloc, else data is allocated in this region.
	* @param pk: a freshly obtained rrsetkey structure. No dname is set yet,
	* will be set on return.
	* Note that TTL will still be relative on return.
	* @return false on alloc failure.
	*/
	int parse_copy_decompress_rrset(struct sldns_buffer* pkt, struct msg_parse* msg,
	struct rrset_parse pset, struct regional region,
	struct ub_packed_rrset_key* pk);

	/**
	* Find final cname target in reply, the one matching qinfo. Follows CNAMEs.
	* @param qinfo: what to start with.
	* @param rep: looks in answer section of this message.
	* @return: pointer dname, or NULL if not found.
	*/
	uint8_t* reply_find_final_cname_target(struct query_info* qinfo,
	struct reply_info* rep);

	/**
	* Check if cname chain in cached reply is still valid.
	* @param qinfo: query info with query name.
	* @param rep: reply to check.
	* @return: true if valid, false if invalid.
	*/
	int reply_check_cname_chain(struct query_info* qinfo, struct reply_info* rep);

	/**
	* Check security status of all RRs in the message.
	* @param rep: reply to check
	* @return: true if all RRs are secure. False if not.
	* True if there are zero RRs.
	*/
	int reply_all_rrsets_secure(struct reply_info* rep);

	/**
	* Find answer rrset in reply, the one matching qinfo. Follows CNAMEs, so the
	* result may have a different owner name.
	* @param qinfo: what to look for.
	* @param rep: looks in answer section of this message.
	* @return: pointer to rrset, or NULL if not found.
	*/
	struct ub_packed_rrset_key* reply_find_answer_rrset(struct query_info* qinfo,
	struct reply_info* rep);

	/**
	* Find rrset in reply, inside the answer section. Does not follow CNAMEs.
	* @param rep: looks in answer section of this message.
	* @param name: what to look for.
	* @param namelen: length of name.
	* @param type: looks for (host order).
	* @param dclass: looks for (host order).
	* @return: pointer to rrset, or NULL if not found.
	*/
	struct ub_packed_rrset_key* reply_find_rrset_section_an(struct reply_info* rep,
	uint8_t* name, size_t namelen, uint16_t type, uint16_t dclass);

	/**
	* Find rrset in reply, inside the authority section. Does not follow CNAMEs.
	* @param rep: looks in authority section of this message.
	* @param name: what to look for.
	* @param namelen: length of name.
	* @param type: looks for (host order).
	* @param dclass: looks for (host order).
	* @return: pointer to rrset, or NULL if not found.
	*/
	struct ub_packed_rrset_key* reply_find_rrset_section_ns(struct reply_info* rep,
	uint8_t* name, size_t namelen, uint16_t type, uint16_t dclass);

	/**
	* Find rrset in reply, inside any section. Does not follow CNAMEs.
	* @param rep: looks in answer,authority and additional section of this message.
	* @param name: what to look for.
	* @param namelen: length of name.
	* @param type: looks for (host order).
	* @param dclass: looks for (host order).
	* @return: pointer to rrset, or NULL if not found.
	*/
	struct ub_packed_rrset_key* reply_find_rrset(struct reply_info* rep,
	uint8_t* name, size_t namelen, uint16_t type, uint16_t dclass);

	/**
	* Debug send the query info and reply info to the log in readable form.
	* @param str: descriptive string printed with packet content.
	* @param qinfo: query section.
	* @param rep: rest of message.
	*/
	void log_dns_msg(const char* str, struct query_info* qinfo,
	struct reply_info* rep);

	/**
	* Print string with neat domain name, type, class,
	* status code from, and size of a query response.
	*
	* @param v: at what verbosity level to print this.
	* @param qinf: query section.
	* @param addr: address of the client.
	* @param addrlen: length of the client address.
	* @param dur: how long it took to complete the query.
	* @param cached: whether or not the reply is coming from
	* the cache, or an outside network.
	* @param rmsg: sldns buffer packet.
	*/
	void log_reply_info(enum verbosity_value v, struct query_info *qinf,
	struct sockaddr_storage *addr, socklen_t addrlen, struct timeval dur,
	int cached, struct sldns_buffer *rmsg);

	/**
	* Print string with neat domain name, type, class from query info.
	* @param v: at what verbosity level to print this.
	* @param str: string of message.
	* @param qinf: query info structure with name, type and class.
	*/
	void log_query_info(enum verbosity_value v, const char* str,
	struct query_info* qinf);

	/**
	* Append edns option to edns data structure
	* @param edns: the edns data structure to append the edns option to.
	* @param region: region to allocate the new edns option.
	* @param code: the edns option's code.
	* @param len: the edns option's length.
	* @param data: the edns option's data.
	* @return false on failure.
	*/
	int edns_opt_append(struct edns_data* edns, struct regional* region,
	uint16_t code, size_t len, uint8_t* data);

	/**
	* Append edns option to edns option list
	* @param list: the edns option list to append the edns option to.
	* @param code: the edns option's code.
	* @param len: the edns option's length.
	* @param data: the edns option's data.
	* @param region: region to allocate the new edns option.
	* @return false on failure.
	*/
	int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
	uint8_t* data, struct regional* region);

	/**
	* Remove any option found on the edns option list that matches the code.
	* @param list: the list of edns options.
	* @param code: the opt code to remove.
	* @return true when at least one edns option was removed, false otherwise.
	*/
	int edns_opt_list_remove(struct edns_option** list, uint16_t code);

	/**
	* Find edns option in edns list
	* @param list: list of edns options (eg. edns.opt_list)
	* @param code: opt code to find.
	* @return NULL or the edns_option element.
	*/
	struct edns_option* edns_opt_list_find(struct edns_option* list, uint16_t code);

	/**
	* Call the registered functions in the inplace_cb_reply linked list.
	* This function is going to get called while answering with a resolved query.
	* @param env: module environment.
	* @param qinfo: query info.
	* @param qstate: module qstate.
	* @param rep: Reply info. Could be NULL.
	* @param rcode: return code.
	* @param edns: edns data of the reply.
	* @param repinfo: comm_reply. NULL.
	* @param region: region to store data.
	* @return false on failure (a callback function returned an error).
	*/
	int inplace_cb_reply_call(struct module_env* env, struct query_info* qinfo,
	struct module_qstate* qstate, struct reply_info* rep, int rcode,
	struct edns_data* edns, struct comm_reply* repinfo, struct regional* region);

	/**
	* Call the registered functions in the inplace_cb_reply_cache linked list.
	* This function is going to get called while answering from cache.
	* @param env: module environment.
	* @param qinfo: query info.
	* @param qstate: module qstate. NULL when replying from cache.
	* @param rep: Reply info.
	* @param rcode: return code.
	* @param edns: edns data of the reply. Edns input can be found here.
	* @param repinfo: comm_reply. Reply information for a communication point.
	* @param region: region to store data.
	* @return false on failure (a callback function returned an error).
	*/
	int inplace_cb_reply_cache_call(struct module_env* env,
	struct query_info* qinfo, struct module_qstate* qstate,
	struct reply_info* rep, int rcode, struct edns_data* edns,
	struct comm_reply* repinfo, struct regional* region);

	/**
	* Call the registered functions in the inplace_cb_reply_local linked list.
	* This function is going to get called while answering with local data.
	* @param env: module environment.
	* @param qinfo: query info.
	* @param qstate: module qstate. NULL when replying from cache.
	* @param rep: Reply info.
	* @param rcode: return code.
	* @param edns: edns data of the reply. Edns input can be found here.
	* @param repinfo: comm_reply. Reply information for a communication point.
	* @param region: region to store data.
	* @return false on failure (a callback function returned an error).
	*/
	int inplace_cb_reply_local_call(struct module_env* env,
	struct query_info* qinfo, struct module_qstate* qstate,
	struct reply_info* rep, int rcode, struct edns_data* edns,
	struct comm_reply* repinfo, struct regional* region);

	/**
	* Call the registered functions in the inplace_cb_reply linked list.
	* This function is going to get called while answering with a servfail.
	* @param env: module environment.
	* @param qinfo: query info.
	* @param qstate: module qstate. Contains the edns option lists. Could be NULL.
	* @param rep: Reply info. NULL when servfail.
	* @param rcode: return code. LDNS_RCODE_SERVFAIL.
	* @param edns: edns data of the reply. Edns input can be found here if qstate
	* is NULL.
	* @param repinfo: comm_reply. Reply information for a communication point.
	* @param region: region to store data.
	* @return false on failure (a callback function returned an error).
	*/
	int inplace_cb_reply_servfail_call(struct module_env* env,
	struct query_info* qinfo, struct module_qstate* qstate,
	struct reply_info* rep, int rcode, struct edns_data* edns,
	struct comm_reply* repinfo, struct regional* region);

	/**
	* Call the registered functions in the inplace_cb_query linked list.
	* This function is going to get called just before sending a query to a
	* nameserver.
	* @param env: module environment.
	* @param qinfo: query info.
	* @param flags: flags of the query.
	* @param addr: to which server to send the query.
	* @param addrlen: length of addr.
	* @param zone: name of the zone of the delegation point. wireformat dname.
	* This is the delegation point name for which the server is deemed
	* authoritative.
	* @param zonelen: length of zone.
	* @param qstate: module qstate.
	* @param region: region to store data.
	* @return false on failure (a callback function returned an error).
	*/
	int inplace_cb_query_call(struct module_env* env, struct query_info* qinfo,
	uint16_t flags, struct sockaddr_storage* addr, socklen_t addrlen,
	uint8_t* zone, size_t zonelen, struct module_qstate* qstate,
	struct regional* region);

	/**
	* Call the registered functions in the inplace_cb_edns_back_parsed linked list.
	* This function is going to get called after parsing the EDNS data on the
	* reply from a nameserver.
	* @param env: module environment.
	* @param qstate: module qstate.
	* @return false on failure (a callback function returned an error).
	*/
	int inplace_cb_edns_back_parsed_call(struct module_env* env,
	struct module_qstate* qstate);

	/**
	* Call the registered functions in the inplace_cb_query_response linked list.
	* This function is going to get called after receiving a reply from a
	* nameserver.
	* @param env: module environment.
	* @param qstate: module qstate.
	* @param response: received response
	* @return false on failure (a callback function returned an error).
	*/
	int inplace_cb_query_response_call(struct module_env* env,
	struct module_qstate* qstate, struct dns_msg* response);

	/**
	* Copy edns option list allocated to the new region
	*/
	struct edns_option* edns_opt_copy_region(struct edns_option* list,
	struct regional* region);

	/**
	* Copy edns option list allocated with malloc
	*/
	struct edns_option* edns_opt_copy_alloc(struct edns_option* list);

	/**
	* Free edns option list allocated with malloc
	*/
	void edns_opt_list_free(struct edns_option* list);

	/**
	* Compare an edns option. (not entire list). Also compares contents.
	*/
	int edns_opt_compare(struct edns_option* p, struct edns_option* q);

	/**
	* Compare edns option lists, also the order and contents of edns-options.
	*/
	int edns_opt_list_compare(struct edns_option* p, struct edns_option* q);

	#endif /* UTIL_DATA_MSGREPLY_H */
	Index: head/contrib/unbound/util/edns.c
	===================================================================
	--- head/contrib/unbound/util/edns.c (revision 349719)
	+++ head/contrib/unbound/util/edns.c (revision 349720)
	@@ -1,85 +1,85 @@
	/*
	* util/edns.c - handle base EDNS options.
	*
	* Copyright (c) 2018, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains functions for base EDNS options.
	*/

	#include "config.h"
	-
	+#include "util/edns.h"
	#include "util/config_file.h"
	#include "util/netevent.h"
	#include "util/regional.h"
	#include "util/data/msgparse.h"
	#include "util/data/msgreply.h"

	#include "edns.h"

	static int edns_keepalive(struct edns_data* edns_out, struct edns_data* edns_in,
	struct comm_point* c, struct regional* region)
	{
	if(c->type == comm_udp)
	return 1;

	/* To respond with a Keepalive option, the client connection
	* must have received one message with a TCP Keepalive EDNS option,
	* and that option must have 0 length data. Subsequent messages
	* sent on that connection will have a TCP Keepalive option.
	*/
	if(c->tcp_keepalive \|\|
	edns_opt_list_find(edns_in->opt_list, LDNS_EDNS_KEEPALIVE)) {
	int keepalive = c->tcp_timeout_msec / 100;
	uint8_t data[2];
	data[0] = (uint8_t)((keepalive >> 8) & 0xff);
	data[1] = (uint8_t)(keepalive & 0xff);
	if(!edns_opt_list_append(&edns_out->opt_list, LDNS_EDNS_KEEPALIVE,
	sizeof(data), data, region))
	return 0;
	c->tcp_keepalive = 1;
	}
	return 1;
	}

	int apply_edns_options(struct edns_data* edns_out, struct edns_data* edns_in,
	struct config_file* cfg, struct comm_point* c, struct regional* region)
	{
	if(cfg->do_tcp_keepalive &&
	!edns_keepalive(edns_out, edns_in, c, region))
	return 0;

	return 1;
	}
	Index: head/contrib/unbound/util/fptr_wlist.c
	===================================================================
	--- head/contrib/unbound/util/fptr_wlist.c (revision 349719)
	+++ head/contrib/unbound/util/fptr_wlist.c (revision 349720)
	@@ -1,592 +1,599 @@
	/*
	* util/fptr_wlist.c - function pointer whitelists.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains functions that check function pointers.
	* The functions contain a whitelist of known good callback values.
	* Any other values lead to an error.
	*
	* Due to the listing nature, this file violates all the modularization
	* boundaries in the program.
	*/
	#include "config.h"
	#include "util/fptr_wlist.h"
	#include "util/mini_event.h"
	#include "services/outside_network.h"
	#include "services/mesh.h"
	#include "services/localzone.h"
	#include "services/authzone.h"
	#include "services/cache/infra.h"
	#include "services/cache/rrset.h"
	#include "services/view.h"
	#include "dns64/dns64.h"
	#include "iterator/iterator.h"
	#include "iterator/iter_fwd.h"
	#include "validator/validator.h"
	#include "validator/val_anchor.h"
	#include "validator/val_nsec3.h"
	#include "validator/val_sigcrypt.h"
	#include "validator/val_kentry.h"
	#include "validator/val_neg.h"
	#include "validator/autotrust.h"
	#include "util/data/msgreply.h"
	#include "util/data/packed_rrset.h"
	#include "util/storage/slabhash.h"
	#include "util/storage/dnstree.h"
	#include "util/locks.h"
	#include "libunbound/libworker.h"
	#include "libunbound/context.h"
	#include "libunbound/worker.h"
	#include "util/tube.h"
	#include "util/config_file.h"
	#ifdef UB_ON_WINDOWS
	#include "winrc/win_svc.h"
	#endif
	#include "respip/respip.h"

	#ifdef WITH_PYTHONMODULE
	#include "pythonmod/pythonmod.h"
	#endif
	#ifdef USE_CACHEDB
	#include "cachedb/cachedb.h"
	#endif
	#ifdef USE_IPSECMOD
	#include "ipsecmod/ipsecmod.h"
	#endif
	#ifdef CLIENT_SUBNET
	#include "edns-subnet/subnetmod.h"
	#endif

	int
	fptr_whitelist_comm_point(comm_point_callback_type *fptr)
	{
	if(fptr == &worker_handle_request) return 1;
	else if(fptr == &outnet_udp_cb) return 1;
	else if(fptr == &outnet_tcp_cb) return 1;
	else if(fptr == &tube_handle_listen) return 1;
	else if(fptr == &auth_xfer_probe_udp_callback) return 1;
	else if(fptr == &auth_xfer_transfer_tcp_callback) return 1;
	else if(fptr == &auth_xfer_transfer_http_callback) return 1;
	return 0;
	}

	int
	fptr_whitelist_comm_point_raw(comm_point_callback_type *fptr)
	{
	if(fptr == &tube_handle_listen) return 1;
	else if(fptr == &tube_handle_write) return 1;
	else if(fptr == &remote_accept_callback) return 1;
	else if(fptr == &remote_control_callback) return 1;
	return 0;
	}

	int
	fptr_whitelist_comm_timer(void (fptr)(void))
	{
	if(fptr == &pending_udp_timer_cb) return 1;
	else if(fptr == &outnet_tcptimer) return 1;
	else if(fptr == &pending_udp_timer_delay_cb) return 1;
	else if(fptr == &worker_stat_timer_cb) return 1;
	else if(fptr == &worker_probe_timer_cb) return 1;
	#ifdef UB_ON_WINDOWS
	else if(fptr == &wsvc_cron_cb) return 1;
	#endif
	else if(fptr == &auth_xfer_timer) return 1;
	else if(fptr == &auth_xfer_probe_timer_callback) return 1;
	+ else if(fptr == &auth_xfer_transfer_timer_callback) return 1;
	return 0;
	}

	int
	fptr_whitelist_comm_signal(void (fptr)(int, void))
	{
	if(fptr == &worker_sighandler) return 1;
	return 0;
	}

	int fptr_whitelist_start_accept(void (fptr)(void))
	{
	if(fptr == &worker_start_accept) return 1;
	return 0;
	}

	int fptr_whitelist_stop_accept(void (fptr)(void))
	{
	if(fptr == &worker_stop_accept) return 1;
	return 0;
	}

	int
	fptr_whitelist_event(void (fptr)(int, short, void ))
	{
	if(fptr == &comm_point_udp_callback) return 1;
	else if(fptr == &comm_point_udp_ancil_callback) return 1;
	else if(fptr == &comm_point_tcp_accept_callback) return 1;
	else if(fptr == &comm_point_tcp_handle_callback) return 1;
	else if(fptr == &comm_timer_callback) return 1;
	else if(fptr == &comm_signal_callback) return 1;
	else if(fptr == &comm_point_local_handle_callback) return 1;
	else if(fptr == &comm_point_raw_handle_callback) return 1;
	else if(fptr == &tube_handle_signal) return 1;
	else if(fptr == &comm_base_handle_slow_accept) return 1;
	else if(fptr == &comm_point_http_handle_callback) return 1;
	#ifdef UB_ON_WINDOWS
	else if(fptr == &worker_win_stop_cb) return 1;
	#endif
	return 0;
	}

	int
	fptr_whitelist_pending_udp(comm_point_callback_type *fptr)
	{
	if(fptr == &serviced_udp_callback) return 1;
	else if(fptr == &worker_handle_reply) return 1;
	else if(fptr == &libworker_handle_reply) return 1;
	return 0;
	}

	int
	fptr_whitelist_pending_tcp(comm_point_callback_type *fptr)
	{
	if(fptr == &serviced_tcp_callback) return 1;
	else if(fptr == &worker_handle_reply) return 1;
	else if(fptr == &libworker_handle_reply) return 1;
	return 0;
	}

	int
	fptr_whitelist_serviced_query(comm_point_callback_type *fptr)
	{
	if(fptr == &worker_handle_service_reply) return 1;
	else if(fptr == &libworker_handle_service_reply) return 1;
	return 0;
	}

	int
	fptr_whitelist_rbtree_cmp(int (fptr) (const void , const void *))
	{
	if(fptr == &mesh_state_compare) return 1;
	else if(fptr == &mesh_state_ref_compare) return 1;
	else if(fptr == &addr_tree_compare) return 1;
	else if(fptr == &local_zone_cmp) return 1;
	else if(fptr == &local_data_cmp) return 1;
	else if(fptr == &fwd_cmp) return 1;
	else if(fptr == &pending_cmp) return 1;
	else if(fptr == &serviced_cmp) return 1;
	else if(fptr == &name_tree_compare) return 1;
	else if(fptr == &order_lock_cmp) return 1;
	else if(fptr == &codeline_cmp) return 1;
	else if(fptr == &nsec3_hash_cmp) return 1;
	else if(fptr == &mini_ev_cmp) return 1;
	else if(fptr == &anchor_cmp) return 1;
	else if(fptr == &canonical_tree_compare) return 1;
	else if(fptr == &context_query_cmp) return 1;
	else if(fptr == &val_neg_data_compare) return 1;
	else if(fptr == &val_neg_zone_compare) return 1;
	else if(fptr == &probetree_cmp) return 1;
	else if(fptr == &replay_var_compare) return 1;
	else if(fptr == &view_cmp) return 1;
	else if(fptr == &auth_zone_cmp) return 1;
	else if(fptr == &auth_data_cmp) return 1;
	else if(fptr == &auth_xfer_cmp) return 1;
	return 0;
	}

	int
	fptr_whitelist_hash_sizefunc(lruhash_sizefunc_type fptr)
	{
	if(fptr == &msgreply_sizefunc) return 1;
	else if(fptr == &ub_rrset_sizefunc) return 1;
	else if(fptr == &infra_sizefunc) return 1;
	else if(fptr == &key_entry_sizefunc) return 1;
	else if(fptr == &rate_sizefunc) return 1;
	else if(fptr == &ip_rate_sizefunc) return 1;
	else if(fptr == &test_slabhash_sizefunc) return 1;
	#ifdef CLIENT_SUBNET
	else if(fptr == &msg_cache_sizefunc) return 1;
	#endif
	#ifdef USE_DNSCRYPT
	else if(fptr == &dnsc_shared_secrets_sizefunc) return 1;
	else if(fptr == &dnsc_nonces_sizefunc) return 1;
	#endif
	return 0;
	}

	int
	fptr_whitelist_hash_compfunc(lruhash_compfunc_type fptr)
	{
	if(fptr == &query_info_compare) return 1;
	else if(fptr == &ub_rrset_compare) return 1;
	else if(fptr == &infra_compfunc) return 1;
	else if(fptr == &key_entry_compfunc) return 1;
	else if(fptr == &rate_compfunc) return 1;
	else if(fptr == &ip_rate_compfunc) return 1;
	else if(fptr == &test_slabhash_compfunc) return 1;
	#ifdef USE_DNSCRYPT
	else if(fptr == &dnsc_shared_secrets_compfunc) return 1;
	else if(fptr == &dnsc_nonces_compfunc) return 1;
	#endif
	return 0;
	}

	int
	fptr_whitelist_hash_delkeyfunc(lruhash_delkeyfunc_type fptr)
	{
	if(fptr == &query_entry_delete) return 1;
	else if(fptr == &ub_rrset_key_delete) return 1;
	else if(fptr == &infra_delkeyfunc) return 1;
	else if(fptr == &key_entry_delkeyfunc) return 1;
	else if(fptr == &rate_delkeyfunc) return 1;
	else if(fptr == &ip_rate_delkeyfunc) return 1;
	else if(fptr == &test_slabhash_delkey) return 1;
	#ifdef USE_DNSCRYPT
	else if(fptr == &dnsc_shared_secrets_delkeyfunc) return 1;
	else if(fptr == &dnsc_nonces_delkeyfunc) return 1;
	#endif
	return 0;
	}

	int
	fptr_whitelist_hash_deldatafunc(lruhash_deldatafunc_type fptr)
	{
	if(fptr == &reply_info_delete) return 1;
	else if(fptr == &rrset_data_delete) return 1;
	else if(fptr == &infra_deldatafunc) return 1;
	else if(fptr == &key_entry_deldatafunc) return 1;
	else if(fptr == &rate_deldatafunc) return 1;
	else if(fptr == &test_slabhash_deldata) return 1;
	#ifdef CLIENT_SUBNET
	else if(fptr == &subnet_data_delete) return 1;
	#endif
	#ifdef USE_DNSCRYPT
	else if(fptr == &dnsc_shared_secrets_deldatafunc) return 1;
	else if(fptr == &dnsc_nonces_deldatafunc) return 1;
	#endif
	return 0;
	}

	int
	fptr_whitelist_hash_markdelfunc(lruhash_markdelfunc_type fptr)
	{
	if(fptr == NULL) return 1;
	else if(fptr == &rrset_markdel) return 1;
	+#ifdef CLIENT_SUBNET
	+ else if(fptr == &subnet_markdel) return 1;
	+#endif
	return 0;
	}

	/** whitelist env->send_query callbacks */
	int
	fptr_whitelist_modenv_send_query(struct outbound_entry* (*fptr)(
	struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec,
	int nocaps, struct sockaddr_storage* addr, socklen_t addrlen,
	uint8_t* zone, size_t zonelen, int ssl_upstream, char* tls_auth_name,
	struct module_qstate* q))
	{
	if(fptr == &worker_send_query) return 1;
	else if(fptr == &libworker_send_query) return 1;
	return 0;
	}

	int
	fptr_whitelist_modenv_detach_subs(void (*fptr)(
	struct module_qstate* qstate))
	{
	if(fptr == &mesh_detach_subs) return 1;
	return 0;
	}

	int
	fptr_whitelist_modenv_attach_sub(int (*fptr)(
	struct module_qstate* qstate, struct query_info* qinfo,
	uint16_t qflags, int prime, int valrec, struct module_qstate** newq))
	{
	if(fptr == &mesh_attach_sub) return 1;
	return 0;
	}

	int
	fptr_whitelist_modenv_add_sub(int (*fptr)(
	struct module_qstate* qstate, struct query_info* qinfo,
	uint16_t qflags, int prime, int valrec, struct module_qstate** newq,
	struct mesh_state** sub))
	{
	if(fptr == &mesh_add_sub) return 1;
	return 0;
	}

	int
	fptr_whitelist_modenv_kill_sub(void (fptr)(struct module_qstate newq))
	{
	if(fptr == &mesh_state_delete) return 1;
	return 0;
	}

	int
	fptr_whitelist_modenv_detect_cycle(int (*fptr)(
	struct module_qstate* qstate, struct query_info* qinfo,
	uint16_t flags, int prime, int valrec))
	{
	if(fptr == &mesh_detect_cycle) return 1;
	return 0;
	}

	int
	fptr_whitelist_mod_init(int (fptr)(struct module_env env, int id))
	{
	if(fptr == &iter_init) return 1;
	else if(fptr == &val_init) return 1;
	else if(fptr == &dns64_init) return 1;
	else if(fptr == &respip_init) return 1;
	#ifdef WITH_PYTHONMODULE
	else if(fptr == &pythonmod_init) return 1;
	#endif
	#ifdef USE_CACHEDB
	else if(fptr == &cachedb_init) return 1;
	#endif
	#ifdef USE_IPSECMOD
	else if(fptr == &ipsecmod_init) return 1;
	#endif
	#ifdef CLIENT_SUBNET
	else if(fptr == &subnetmod_init) return 1;
	#endif
	return 0;
	}

	int
	fptr_whitelist_mod_deinit(void (fptr)(struct module_env env, int id))
	{
	if(fptr == &iter_deinit) return 1;
	else if(fptr == &val_deinit) return 1;
	else if(fptr == &dns64_deinit) return 1;
	else if(fptr == &respip_deinit) return 1;
	#ifdef WITH_PYTHONMODULE
	else if(fptr == &pythonmod_deinit) return 1;
	#endif
	#ifdef USE_CACHEDB
	else if(fptr == &cachedb_deinit) return 1;
	#endif
	#ifdef USE_IPSECMOD
	else if(fptr == &ipsecmod_deinit) return 1;
	#endif
	#ifdef CLIENT_SUBNET
	else if(fptr == &subnetmod_deinit) return 1;
	#endif
	return 0;
	}

	int
	fptr_whitelist_mod_operate(void (fptr)(struct module_qstate qstate,
	enum module_ev event, int id, struct outbound_entry* outbound))
	{
	if(fptr == &iter_operate) return 1;
	else if(fptr == &val_operate) return 1;
	else if(fptr == &dns64_operate) return 1;
	else if(fptr == &respip_operate) return 1;
	#ifdef WITH_PYTHONMODULE
	else if(fptr == &pythonmod_operate) return 1;
	#endif
	#ifdef USE_CACHEDB
	else if(fptr == &cachedb_operate) return 1;
	#endif
	#ifdef USE_IPSECMOD
	else if(fptr == &ipsecmod_operate) return 1;
	#endif
	#ifdef CLIENT_SUBNET
	else if(fptr == &subnetmod_operate) return 1;
	#endif
	return 0;
	}

	int
	fptr_whitelist_mod_inform_super(void (*fptr)(
	struct module_qstate* qstate, int id, struct module_qstate* super))
	{
	if(fptr == &iter_inform_super) return 1;
	else if(fptr == &val_inform_super) return 1;
	else if(fptr == &dns64_inform_super) return 1;
	else if(fptr == &respip_inform_super) return 1;
	#ifdef WITH_PYTHONMODULE
	else if(fptr == &pythonmod_inform_super) return 1;
	#endif
	#ifdef USE_CACHEDB
	else if(fptr == &cachedb_inform_super) return 1;
	#endif
	#ifdef USE_IPSECMOD
	else if(fptr == &ipsecmod_inform_super) return 1;
	#endif
	#ifdef CLIENT_SUBNET
	else if(fptr == &subnetmod_inform_super) return 1;
	#endif
	return 0;
	}

	int
	fptr_whitelist_mod_clear(void (fptr)(struct module_qstate qstate,
	int id))
	{
	if(fptr == &iter_clear) return 1;
	else if(fptr == &val_clear) return 1;
	else if(fptr == &dns64_clear) return 1;
	else if(fptr == &respip_clear) return 1;
	#ifdef WITH_PYTHONMODULE
	else if(fptr == &pythonmod_clear) return 1;
	#endif
	#ifdef USE_CACHEDB
	else if(fptr == &cachedb_clear) return 1;
	#endif
	#ifdef USE_IPSECMOD
	else if(fptr == &ipsecmod_clear) return 1;
	#endif
	#ifdef CLIENT_SUBNET
	else if(fptr == &subnetmod_clear) return 1;
	#endif
	return 0;
	}

	int
	fptr_whitelist_mod_get_mem(size_t (fptr)(struct module_env env, int id))
	{
	if(fptr == &iter_get_mem) return 1;
	else if(fptr == &val_get_mem) return 1;
	else if(fptr == &dns64_get_mem) return 1;
	else if(fptr == &respip_get_mem) return 1;
	#ifdef WITH_PYTHONMODULE
	else if(fptr == &pythonmod_get_mem) return 1;
	#endif
	#ifdef USE_CACHEDB
	else if(fptr == &cachedb_get_mem) return 1;
	#endif
	#ifdef USE_IPSECMOD
	else if(fptr == &ipsecmod_get_mem) return 1;
	#endif
	#ifdef CLIENT_SUBNET
	else if(fptr == &subnetmod_get_mem) return 1;
	#endif
	return 0;
	}

	int
	fptr_whitelist_alloc_cleanup(void (fptr)(void))
	{
	if(fptr == &worker_alloc_cleanup) return 1;
	return 0;
	}

	int fptr_whitelist_tube_listen(tube_callback_type* fptr)
	{
	if(fptr == &worker_handle_control_cmd) return 1;
	else if(fptr == &libworker_handle_control_cmd) return 1;
	return 0;
	}

	int fptr_whitelist_mesh_cb(mesh_cb_func_type fptr)
	{
	if(fptr == &libworker_fg_done_cb) return 1;
	else if(fptr == &libworker_bg_done_cb) return 1;
	else if(fptr == &libworker_event_done_cb) return 1;
	else if(fptr == &probe_answer_cb) return 1;
	else if(fptr == &auth_xfer_probe_lookup_callback) return 1;
	else if(fptr == &auth_xfer_transfer_lookup_callback) return 1;
	return 0;
	}

	int fptr_whitelist_print_func(void (fptr)(char,void*))
	{
	if(fptr == &config_print_func) return 1;
	else if(fptr == &config_collate_func) return 1;
	else if(fptr == &remote_get_opt_ssl) return 1;
	return 0;
	}

	int fptr_whitelist_inplace_cb_reply_generic(inplace_cb_reply_func_type* fptr,
	enum inplace_cb_list_type type)
	{
	#ifndef WITH_PYTHONMODULE
	(void)fptr;
	#endif
	if(type == inplace_cb_reply) {
	#ifdef WITH_PYTHONMODULE
	if(fptr == &python_inplace_cb_reply_generic) return 1;
	#endif
	} else if(type == inplace_cb_reply_cache) {
	#ifdef WITH_PYTHONMODULE
	if(fptr == &python_inplace_cb_reply_generic) return 1;
	#endif
	} else if(type == inplace_cb_reply_local) {
	#ifdef WITH_PYTHONMODULE
	if(fptr == &python_inplace_cb_reply_generic) return 1;
	#endif
	} else if(type == inplace_cb_reply_servfail) {
	#ifdef WITH_PYTHONMODULE
	if(fptr == &python_inplace_cb_reply_generic) return 1;
	#endif
	}
	return 0;
	}

	int fptr_whitelist_inplace_cb_query(inplace_cb_query_func_type* fptr)
	{
	#ifdef CLIENT_SUBNET
	if(fptr == &ecs_whitelist_check)
	return 1;
	-#else
	- (void)fptr;
	#endif
	+#ifdef WITH_PYTHONMODULE
	+ if(fptr == &python_inplace_cb_query_generic)
	+ return 1;
	+#endif
	+ (void)fptr;
	return 0;
	}

	int fptr_whitelist_inplace_cb_edns_back_parsed(
	inplace_cb_edns_back_parsed_func_type* fptr)
	{
	#ifdef CLIENT_SUBNET
	if(fptr == &ecs_edns_back_parsed)
	return 1;
	#else
	(void)fptr;
	#endif
	return 0;
	}

	int fptr_whitelist_inplace_cb_query_response(
	inplace_cb_query_response_func_type* fptr)
	{
	#ifdef CLIENT_SUBNET
	if(fptr == &ecs_query_response)
	return 1;
	#else
	(void)fptr;
	#endif
	return 0;
	}
	Index: head/contrib/unbound/util/iana_ports.inc
	===================================================================
	--- head/contrib/unbound/util/iana_ports.inc (revision 349719)
	+++ head/contrib/unbound/util/iana_ports.inc (revision 349720)
	@@ -1,5477 +1,5481 @@
	1,
	2,
	3,
	5,
	7,
	9,
	11,
	13,
	17,
	18,
	19,
	20,
	21,
	22,
	23,
	24,
	25,
	27,
	29,
	31,
	33,
	35,
	37,
	38,
	39,
	41,
	42,
	43,
	44,
	45,
	46,
	48,
	49,
	50,
	52,
	53,
	54,
	55,
	56,
	57,
	58,
	59,
	62,
	63,
	64,
	65,
	66,
	67,
	68,
	69,
	70,
	71,
	72,
	73,
	74,
	75,
	76,
	77,
	78,
	79,
	80,
	82,
	83,
	84,
	85,
	86,
	87,
	88,
	89,
	90,
	91,
	92,
	93,
	94,
	95,
	96,
	97,
	98,
	99,
	101,
	102,
	103,
	104,
	105,
	106,
	107,
	108,
	109,
	110,
	111,
	112,
	113,
	115,
	116,
	117,
	118,
	119,
	120,
	121,
	122,
	123,
	124,
	125,
	126,
	127,
	128,
	129,
	130,
	131,
	132,
	133,
	134,
	135,
	136,
	137,
	138,
	139,
	140,
	141,
	142,
	143,
	144,
	145,
	146,
	147,
	148,
	149,
	150,
	151,
	152,
	153,
	154,
	155,
	156,
	157,
	158,
	159,
	160,
	161,
	162,
	163,
	164,
	165,
	166,
	167,
	168,
	169,
	170,
	171,
	172,
	173,
	174,
	175,
	176,
	177,
	178,
	179,
	180,
	181,
	182,
	183,
	184,
	185,
	186,
	187,
	188,
	189,
	190,
	191,
	192,
	193,
	194,
	195,
	196,
	197,
	198,
	199,
	200,
	201,
	202,
	203,
	204,
	205,
	206,
	207,
	208,
	209,
	210,
	211,
	212,
	213,
	214,
	215,
	216,
	217,
	218,
	219,
	220,
	221,
	222,
	223,
	224,
	242,
	243,
	244,
	245,
	246,
	247,
	248,
	256,
	257,
	259,
	260,
	261,
	262,
	263,
	264,
	265,
	266,
	267,
	268,
	269,
	270,
	280,
	281,
	282,
	283,
	284,
	286,
	287,
	308,
	309,
	310,
	311,
	312,
	313,
	314,
	315,
	316,
	317,
	318,
	319,
	320,
	321,
	322,
	333,
	344,
	345,
	346,
	347,
	348,
	349,
	350,
	351,
	352,
	353,
	354,
	355,
	356,
	357,
	358,
	359,
	360,
	361,
	362,
	363,
	364,
	365,
	366,
	367,
	368,
	369,
	370,
	371,
	372,
	373,
	374,
	375,
	376,
	377,
	378,
	379,
	380,
	381,
	382,
	383,
	384,
	385,
	386,
	387,
	388,
	389,
	390,
	391,
	392,
	393,
	394,
	395,
	396,
	397,
	398,
	399,
	400,
	401,
	402,
	403,
	404,
	405,
	406,
	407,
	408,
	409,
	410,
	411,
	412,
	413,
	414,
	415,
	416,
	417,
	418,
	419,
	420,
	421,
	422,
	423,
	424,
	425,
	426,
	427,
	428,
	429,
	430,
	431,
	432,
	433,
	434,
	435,
	436,
	437,
	438,
	439,
	440,
	441,
	442,
	443,
	444,
	445,
	446,
	447,
	448,
	449,
	450,
	451,
	452,
	453,
	454,
	455,
	456,
	457,
	458,
	459,
	460,
	461,
	462,
	463,
	464,
	465,
	466,
	467,
	468,
	469,
	470,
	471,
	472,
	473,
	474,
	475,
	476,
	477,
	478,
	479,
	480,
	481,
	482,
	483,
	484,
	485,
	486,
	487,
	488,
	489,
	490,
	491,
	492,
	493,
	494,
	495,
	496,
	497,
	498,
	499,
	500,
	501,
	502,
	503,
	504,
	505,
	506,
	507,
	508,
	509,
	510,
	511,
	512,
	513,
	514,
	515,
	516,
	517,
	518,
	519,
	520,
	521,
	522,
	523,
	524,
	525,
	526,
	527,
	528,
	529,
	530,
	531,
	532,
	533,
	534,
	535,
	536,
	537,
	538,
	539,
	540,
	541,
	542,
	543,
	544,
	545,
	546,
	547,
	548,
	549,
	550,
	551,
	552,
	553,
	554,
	555,
	556,
	557,
	558,
	559,
	560,
	561,
	562,
	563,
	564,
	565,
	566,
	567,
	568,
	569,
	570,
	571,
	572,
	573,
	574,
	575,
	576,
	577,
	578,
	579,
	580,
	581,
	582,
	583,
	584,
	586,
	587,
	588,
	589,
	590,
	591,
	592,
	593,
	594,
	595,
	596,
	597,
	598,
	599,
	600,
	601,
	602,
	603,
	604,
	605,
	606,
	607,
	608,
	609,
	610,
	611,
	612,
	613,
	614,
	615,
	616,
	617,
	618,
	619,
	620,
	621,
	622,
	623,
	624,
	625,
	626,
	627,
	628,
	629,
	630,
	631,
	632,
	633,
	634,
	635,
	636,
	637,
	638,
	639,
	640,
	641,
	642,
	643,
	644,
	645,
	646,
	647,
	648,
	649,
	650,
	651,
	652,
	653,
	654,
	655,
	656,
	657,
	658,
	660,
	661,
	662,
	663,
	664,
	665,
	666,
	667,
	668,
	669,
	670,
	671,
	672,
	673,
	674,
	675,
	676,
	677,
	678,
	679,
	680,
	681,
	682,
	683,
	684,
	685,
	686,
	687,
	688,
	689,
	690,
	691,
	692,
	693,
	694,
	695,
	696,
	697,
	698,
	699,
	700,
	701,
	702,
	704,
	705,
	706,
	707,
	709,
	710,
	711,
	712,
	713,
	714,
	715,
	716,
	729,
	730,
	731,
	741,
	742,
	744,
	747,
	748,
	749,
	750,
	751,
	752,
	753,
	754,
	758,
	759,
	760,
	761,
	762,
	763,
	764,
	765,
	767,
	769,
	770,
	771,
	772,
	773,
	774,
	775,
	776,
	777,
	780,
	800,
	801,
	802,
	810,
	828,
	829,
	830,
	831,
	832,
	833,
	847,
	848,
	853,
	854,
	860,
	861,
	862,
	873,
	886,
	887,
	888,
	900,
	901,
	902,
	903,
	910,
	911,
	912,
	913,
	989,
	990,
	991,
	992,
	993,
	995,
	996,
	997,
	998,
	999,
	1000,
	1008,
	1010,
	1021,
	1022,
	1025,
	1026,
	1027,
	1029,
	1033,
	1034,
	1035,
	1036,
	1037,
	1038,
	1039,
	1040,
	1041,
	1042,
	1043,
	1044,
	1045,
	1046,
	1047,
	1048,
	1049,
	1050,
	1051,
	1052,
	1053,
	1054,
	1055,
	1056,
	1057,
	1058,
	1059,
	1060,
	1061,
	1062,
	1063,
	1064,
	1065,
	1066,
	1067,
	1068,
	1069,
	1070,
	1071,
	1072,
	1073,
	1074,
	1075,
	1076,
	1077,
	1078,
	1079,
	1080,
	1081,
	1082,
	1083,
	1084,
	1085,
	1086,
	1087,
	1088,
	1089,
	1090,
	1091,
	1092,
	1093,
	1094,
	1095,
	1096,
	1097,
	1098,
	1099,
	1100,
	1101,
	1102,
	1103,
	1104,
	1105,
	1106,
	1107,
	1108,
	1110,
	1111,
	1112,
	1113,
	1114,
	1115,
	1116,
	1117,
	1118,
	1119,
	1120,
	1121,
	1122,
	1123,
	1124,
	1125,
	1126,
	1127,
	1128,
	1129,
	1130,
	1131,
	1132,
	1133,
	1134,
	1135,
	1136,
	1137,
	1138,
	1139,
	1140,
	1141,
	1142,
	1143,
	1144,
	1145,
	1146,
	1147,
	1148,
	1149,
	1150,
	1151,
	1152,
	1153,
	1154,
	1155,
	1156,
	1157,
	1158,
	1159,
	1160,
	1161,
	1162,
	1163,
	1164,
	1165,
	1166,
	1167,
	1168,
	1169,
	1170,
	1171,
	1172,
	1173,
	1174,
	1175,
	1176,
	1177,
	1178,
	1179,
	1180,
	1181,
	1182,
	1183,
	1184,
	1185,
	1186,
	1187,
	1188,
	1189,
	1190,
	1191,
	1192,
	1193,
	1194,
	1195,
	1196,
	1197,
	1198,
	1199,
	1200,
	1201,
	1202,
	1203,
	1204,
	1205,
	1206,
	1207,
	1208,
	1209,
	1210,
	1211,
	1212,
	1213,
	1214,
	1215,
	1216,
	1217,
	1218,
	1219,
	1220,
	1221,
	1222,
	1223,
	1224,
	1225,
	1226,
	1227,
	1228,
	1229,
	1230,
	1231,
	1232,
	1233,
	1234,
	1235,
	1236,
	1237,
	1238,
	1239,
	1240,
	1241,
	1242,
	1243,
	1244,
	1245,
	1246,
	1247,
	1248,
	1249,
	1250,
	1251,
	1252,
	1253,
	1254,
	1255,
	1256,
	1257,
	1258,
	1259,
	1260,
	1261,
	1262,
	1263,
	1264,
	1265,
	1266,
	1267,
	1268,
	1269,
	1270,
	1271,
	1272,
	1273,
	1274,
	1275,
	1277,
	1278,
	1279,
	1280,
	1281,
	1282,
	1283,
	1284,
	1285,
	1286,
	1287,
	1288,
	1289,
	1290,
	1291,
	1292,
	1293,
	1294,
	1295,
	1296,
	1297,
	1298,
	1299,
	1300,
	1301,
	1302,
	1303,
	1304,
	1305,
	1306,
	1307,
	1308,
	1309,
	1310,
	1311,
	1312,
	1313,
	1314,
	1315,
	1316,
	1317,
	1318,
	1319,
	1320,
	1321,
	1322,
	1323,
	1324,
	1325,
	1326,
	1327,
	1328,
	1329,
	1330,
	1331,
	1332,
	1333,
	1334,
	1335,
	1336,
	1337,
	1338,
	1339,
	1340,
	1341,
	1342,
	1343,
	1344,
	1345,
	1346,
	1347,
	1348,
	1349,
	1350,
	1351,
	1352,
	1353,
	1354,
	1355,
	1356,
	1357,
	1358,
	1359,
	1360,
	1361,
	1362,
	1363,
	1364,
	1365,
	1366,
	1367,
	1368,
	1369,
	1370,
	1371,
	1372,
	1373,
	1374,
	1375,
	1376,
	1377,
	1378,
	1379,
	1380,
	1381,
	1382,
	1383,
	1384,
	1385,
	1386,
	1387,
	1388,
	1389,
	1390,
	1391,
	1392,
	1393,
	1394,
	1395,
	1396,
	1397,
	1398,
	1399,
	1400,
	1401,
	1402,
	1403,
	1404,
	1405,
	1406,
	1408,
	1409,
	1410,
	1411,
	1412,
	1413,
	1414,
	1415,
	1416,
	1417,
	1418,
	1419,
	1420,
	1421,
	1422,
	1423,
	1424,
	1425,
	1426,
	1427,
	1428,
	1429,
	1430,
	1431,
	1432,
	1433,
	1434,
	1435,
	1436,
	1437,
	1438,
	1439,
	1440,
	1441,
	1442,
	1443,
	1444,
	1445,
	1446,
	1447,
	1448,
	1449,
	1450,
	1451,
	1452,
	1453,
	1454,
	1455,
	1456,
	1457,
	1458,
	1459,
	1460,
	1461,
	1462,
	1463,
	1464,
	1465,
	1466,
	1467,
	1468,
	1469,
	1470,
	1471,
	1472,
	1473,
	1474,
	1475,
	1476,
	1477,
	1478,
	1479,
	1480,
	1481,
	1482,
	1483,
	1484,
	1485,
	1486,
	1487,
	1488,
	1489,
	1490,
	1492,
	1493,
	1494,
	1495,
	1496,
	1497,
	1498,
	1499,
	1500,
	1501,
	1502,
	1503,
	1504,
	1505,
	1506,
	1507,
	1508,
	1509,
	1510,
	1511,
	1512,
	1513,
	1514,
	1515,
	1516,
	1517,
	1518,
	1519,
	1520,
	1521,
	1522,
	1523,
	1524,
	1525,
	1526,
	1527,
	1528,
	1529,
	1530,
	1531,
	1532,
	1533,
	1534,
	1535,
	1536,
	1537,
	1538,
	1539,
	1540,
	1541,
	1542,
	1543,
	1544,
	1545,
	1546,
	1547,
	1548,
	1549,
	1550,
	1551,
	1552,
	1553,
	1554,
	1555,
	1556,
	1557,
	1558,
	1559,
	1560,
	1561,
	1562,
	1563,
	1564,
	1565,
	1566,
	1567,
	1568,
	1569,
	1570,
	1571,
	1572,
	1573,
	1574,
	1575,
	1576,
	1577,
	1578,
	1579,
	1580,
	1581,
	1582,
	1583,
	1584,
	1585,
	1586,
	1587,
	1588,
	1589,
	1590,
	1591,
	1592,
	1593,
	1594,
	1595,
	1596,
	1597,
	1598,
	1599,
	1600,
	1601,
	1602,
	1603,
	1604,
	1605,
	1606,
	1607,
	1608,
	1609,
	1610,
	1611,
	1612,
	1613,
	1614,
	1615,
	1616,
	1617,
	1618,
	1619,
	1620,
	1621,
	1622,
	1623,
	1624,
	1625,
	1626,
	1627,
	1628,
	1629,
	1630,
	1631,
	1632,
	1633,
	1634,
	1635,
	1636,
	1637,
	1638,
	1639,
	1640,
	1641,
	1642,
	1643,
	1644,
	1645,
	1646,
	1647,
	1648,
	1649,
	1650,
	1651,
	1652,
	1653,
	1654,
	1655,
	1656,
	1657,
	1658,
	1659,
	1660,
	1661,
	1662,
	1663,
	1664,
	1665,
	1666,
	1667,
	1668,
	1669,
	1670,
	1671,
	1672,
	1673,
	1674,
	1675,
	1676,
	1677,
	1678,
	1679,
	1680,
	1681,
	1682,
	1683,
	1684,
	1685,
	1686,
	1687,
	1688,
	1689,
	1690,
	1691,
	1692,
	1693,
	1694,
	1695,
	1696,
	1697,
	1698,
	1699,
	1700,
	1701,
	1702,
	1703,
	1704,
	1705,
	1706,
	1707,
	1708,
	1709,
	1710,
	1711,
	1712,
	1713,
	1714,
	1715,
	1716,
	1717,
	1718,
	1719,
	1720,
	1721,
	1722,
	1723,
	1724,
	1725,
	1726,
	1727,
	1728,
	1729,
	1730,
	1731,
	1732,
	1733,
	1734,
	1735,
	1736,
	1737,
	1738,
	1739,
	1740,
	1741,
	1742,
	1743,
	1744,
	1745,
	1746,
	1747,
	1748,
	1749,
	1750,
	1751,
	1752,
	1754,
	1755,
	1756,
	1757,
	1758,
	1759,
	1760,
	1761,
	1762,
	1763,
	1764,
	1765,
	1766,
	1767,
	1768,
	1769,
	1770,
	1771,
	1772,
	1773,
	1774,
	1776,
	1777,
	1778,
	1779,
	1780,
	1781,
	1782,
	1784,
	1785,
	1786,
	1787,
	1788,
	1789,
	1790,
	1791,
	1792,
	1793,
	1794,
	1795,
	1796,
	1797,
	1798,
	1799,
	1800,
	1801,
	1802,
	1803,
	1804,
	1805,
	1806,
	1807,
	1808,
	1809,
	1810,
	1811,
	1812,
	1813,
	1814,
	1815,
	1816,
	1817,
	1818,
	1819,
	1820,
	1821,
	1822,
	1823,
	1824,
	1825,
	1826,
	1827,
	1828,
	1829,
	1830,
	1831,
	1832,
	1833,
	1834,
	1835,
	1836,
	1837,
	1838,
	1839,
	1840,
	1841,
	1842,
	1843,
	1844,
	1845,
	1846,
	1847,
	1848,
	1849,
	1850,
	1851,
	1852,
	1853,
	1854,
	1855,
	1856,
	1857,
	1858,
	1859,
	1860,
	1861,
	1862,
	1863,
	1864,
	1865,
	1866,
	1867,
	1868,
	1869,
	1870,
	1871,
	1872,
	1873,
	1874,
	1875,
	1876,
	1877,
	1878,
	1879,
	1880,
	1881,
	1882,
	1883,
	1884,
	1885,
	1886,
	1887,
	1888,
	1889,
	1890,
	1891,
	1892,
	1893,
	1894,
	1896,
	1897,
	1898,
	1899,
	1900,
	1901,
	1902,
	1903,
	1904,
	1905,
	1906,
	1907,
	1908,
	1909,
	1910,
	1911,
	1912,
	1913,
	1914,
	1915,
	1916,
	1917,
	1918,
	1919,
	1920,
	1921,
	1922,
	1923,
	1924,
	1925,
	1926,
	1927,
	1928,
	1929,
	1930,
	1931,
	1932,
	1933,
	1934,
	1935,
	1936,
	1937,
	1938,
	1939,
	1940,
	1941,
	1942,
	1943,
	1944,
	1945,
	1946,
	1947,
	1948,
	1949,
	1950,
	1951,
	1952,
	1953,
	1954,
	1955,
	1956,
	1957,
	1958,
	1959,
	1960,
	1961,
	1962,
	1963,
	1964,
	1965,
	1966,
	1967,
	1968,
	1969,
	1970,
	1971,
	1972,
	1973,
	1974,
	1975,
	1976,
	1977,
	1978,
	1979,
	1980,
	1981,
	1982,
	1983,
	1984,
	1985,
	1986,
	1987,
	1988,
	1989,
	1990,
	1991,
	1992,
	1993,
	1994,
	1995,
	1996,
	1997,
	1998,
	1999,
	2000,
	2001,
	2002,
	2003,
	2004,
	2005,
	2006,
	2007,
	2008,
	2009,
	2010,
	2011,
	2012,
	2013,
	2014,
	2015,
	2016,
	2017,
	2018,
	2019,
	2020,
	2021,
	2022,
	2023,
	2024,
	2025,
	2026,
	2027,
	2028,
	2029,
	2030,
	2031,
	2032,
	2033,
	2034,
	2035,
	2036,
	2037,
	2038,
	2039,
	2040,
	2041,
	2042,
	2043,
	2044,
	2045,
	2046,
	2047,
	2048,
	2049,
	2050,
	2051,
	2052,
	2053,
	2054,
	2055,
	2056,
	2057,
	2058,
	2059,
	2060,
	2061,
	2062,
	2063,
	2064,
	2065,
	2066,
	2067,
	2068,
	2069,
	2070,
	2071,
	2072,
	2073,
	2074,
	2075,
	2076,
	2077,
	2078,
	2079,
	2080,
	2081,
	2082,
	2083,
	2084,
	2085,
	2086,
	2087,
	2088,
	2089,
	2090,
	2091,
	2092,
	2093,
	2094,
	2095,
	2096,
	2097,
	2098,
	2099,
	2100,
	2101,
	2102,
	2103,
	2104,
	2105,
	2106,
	2107,
	2108,
	2109,
	2110,
	2111,
	2112,
	2113,
	2114,
	2115,
	2116,
	2117,
	2118,
	2119,
	2120,
	2121,
	2122,
	2123,
	2124,
	2125,
	2126,
	2127,
	2128,
	2129,
	2130,
	2131,
	2132,
	2133,
	2134,
	2135,
	2136,
	2137,
	2138,
	2139,
	2140,
	2141,
	2142,
	2143,
	2144,
	2145,
	2146,
	2147,
	2148,
	2149,
	2150,
	2151,
	2152,
	2153,
	2154,
	2155,
	2156,
	2157,
	2158,
	2159,
	2160,
	2161,
	2162,
	2163,
	2164,
	2165,
	2166,
	2167,
	2168,
	2169,
	2170,
	2171,
	2172,
	2173,
	2174,
	2175,
	2176,
	2177,
	2178,
	2179,
	2180,
	2181,
	2182,
	2183,
	2184,
	2185,
	2186,
	2187,
	2190,
	2191,
	2192,
	2193,
	2197,
	2198,
	2199,
	2200,
	2201,
	2202,
	2203,
	2204,
	2205,
	2206,
	2207,
	2208,
	2209,
	2210,
	2211,
	2212,
	2213,
	2214,
	2215,
	2216,
	2217,
	2218,
	2219,
	2220,
	2221,
	2222,
	2223,
	2224,
	2226,
	2227,
	2228,
	2229,
	2230,
	2231,
	2232,
	2233,
	2234,
	2235,
	2236,
	2237,
	2238,
	2239,
	2240,
	2241,
	2242,
	2243,
	2244,
	2245,
	2246,
	2247,
	2248,
	2249,
	2250,
	2251,
	2252,
	2253,
	2254,
	2255,
	2256,
	2257,
	2258,
	2260,
	2261,
	2262,
	2263,
	2264,
	2265,
	2266,
	2267,
	2268,
	2269,
	2270,
	2271,
	2272,
	2273,
	2274,
	2275,
	2276,
	2277,
	2278,
	2279,
	2280,
	2281,
	2282,
	2283,
	2284,
	2285,
	2286,
	2287,
	2288,
	2289,
	2290,
	2291,
	2292,
	2293,
	2294,
	2295,
	2296,
	2297,
	2298,
	2299,
	2300,
	2301,
	2302,
	2303,
	2304,
	2305,
	2306,
	2307,
	2308,
	2309,
	2310,
	2311,
	2312,
	2313,
	2314,
	2315,
	2316,
	2317,
	2318,
	2319,
	2320,
	2321,
	2322,
	2323,
	2324,
	2325,
	2326,
	2327,
	2328,
	2329,
	2330,
	2331,
	2332,
	2333,
	2334,
	2335,
	2336,
	2337,
	2338,
	2339,
	2340,
	2341,
	2342,
	2343,
	2344,
	2345,
	2346,
	2347,
	2348,
	2349,
	2350,
	2351,
	2352,
	2353,
	2354,
	2355,
	2356,
	2357,
	2358,
	2359,
	2360,
	2361,
	2362,
	2363,
	2364,
	2365,
	2366,
	2367,
	2368,
	2370,
	2372,
	2381,
	2382,
	2383,
	2384,
	2385,
	2386,
	2387,
	2388,
	2389,
	2390,
	2391,
	2392,
	2393,
	2394,
	2395,
	2396,
	2397,
	2398,
	2399,
	2400,
	2401,
	2402,
	2403,
	2404,
	2405,
	2406,
	2407,
	2409,
	2410,
	2411,
	2412,
	2413,
	2414,
	2415,
	2416,
	2417,
	2418,
	2419,
	2420,
	2421,
	2422,
	2423,
	2424,
	2425,
	2426,
	2427,
	2428,
	2429,
	2430,
	2431,
	2432,
	2433,
	2434,
	2435,
	2436,
	2437,
	2438,
	2439,
	2440,
	2441,
	2442,
	2443,
	2444,
	2445,
	2446,
	2447,
	2448,
	2449,
	2450,
	2451,
	2452,
	2453,
	2454,
	2455,
	2456,
	2457,
	2458,
	2459,
	2460,
	2461,
	2462,
	2463,
	2464,
	2465,
	2466,
	2467,
	2468,
	2469,
	2470,
	2471,
	2472,
	2473,
	2474,
	2475,
	2476,
	2477,
	2478,
	2479,
	2480,
	2481,
	2482,
	2483,
	2484,
	2485,
	2486,
	2487,
	2488,
	2489,
	2490,
	2491,
	2492,
	2493,
	2494,
	2495,
	2496,
	2497,
	2498,
	2499,
	2500,
	2501,
	2502,
	2503,
	2504,
	2505,
	2506,
	2507,
	2508,
	2509,
	2510,
	2511,
	2512,
	2513,
	2514,
	2515,
	2516,
	2517,
	2518,
	2519,
	2520,
	2521,
	2522,
	2523,
	2524,
	2525,
	2526,
	2527,
	2528,
	2529,
	2530,
	2531,
	2532,
	2533,
	2534,
	2535,
	2536,
	2537,
	2538,
	2539,
	2540,
	2541,
	2542,
	2543,
	2544,
	2545,
	2546,
	2547,
	2548,
	2549,
	2550,
	2551,
	2552,
	2553,
	2554,
	2555,
	2556,
	2557,
	2558,
	2559,
	2560,
	2561,
	2562,
	2563,
	2564,
	2565,
	2566,
	2567,
	2568,
	2569,
	2570,
	2571,
	2572,
	2573,
	2574,
	2575,
	2576,
	2577,
	2578,
	2579,
	2580,
	2581,
	2582,
	2583,
	2584,
	2585,
	2586,
	2587,
	2588,
	2589,
	2590,
	2591,
	2592,
	2593,
	2594,
	2595,
	2596,
	2597,
	2598,
	2599,
	2600,
	2601,
	2602,
	2603,
	2604,
	2605,
	2606,
	2607,
	2608,
	2609,
	2610,
	2611,
	2612,
	2613,
	2614,
	2615,
	2616,
	2617,
	2618,
	2619,
	2620,
	2621,
	2622,
	2623,
	2624,
	2625,
	2626,
	2627,
	2628,
	2629,
	2630,
	2631,
	2632,
	2633,
	2634,
	2635,
	2636,
	2637,
	2638,
	2639,
	2640,
	2641,
	2642,
	2643,
	2644,
	2645,
	2646,
	2647,
	2648,
	2649,
	2650,
	2651,
	2652,
	2653,
	2654,
	2655,
	2656,
	2657,
	2658,
	2659,
	2660,
	2661,
	2662,
	2663,
	2664,
	2665,
	2666,
	2667,
	2668,
	2669,
	2670,
	2671,
	2672,
	2673,
	2674,
	2675,
	2676,
	2677,
	2678,
	2679,
	2680,
	2681,
	2683,
	2684,
	2685,
	2686,
	2687,
	2688,
	2689,
	2690,
	2691,
	2692,
	2694,
	2695,
	2696,
	2697,
	2698,
	2699,
	2700,
	2701,
	2702,
	2703,
	2704,
	2705,
	2706,
	2707,
	2708,
	2709,
	2710,
	2711,
	2712,
	2713,
	2714,
	2715,
	2716,
	2717,
	2718,
	2719,
	2720,
	2721,
	2722,
	2723,
	2724,
	2725,
	2726,
	2727,
	2728,
	2729,
	2730,
	2731,
	2732,
	2733,
	2734,
	2735,
	2736,
	2737,
	2738,
	2739,
	2740,
	2741,
	2742,
	2743,
	2744,
	2745,
	2746,
	2747,
	2748,
	2749,
	2750,
	2751,
	2752,
	2753,
	2754,
	2755,
	2756,
	2757,
	2758,
	2759,
	2760,
	2761,
	2762,
	2763,
	2764,
	2765,
	2766,
	2767,
	2768,
	2769,
	2770,
	2771,
	2772,
	2773,
	2774,
	2775,
	2776,
	2777,
	2778,
	2779,
	2780,
	2781,
	2782,
	2783,
	2784,
	2785,
	2786,
	2787,
	2788,
	2789,
	2790,
	2791,
	2792,
	2793,
	2795,
	2796,
	2797,
	2798,
	2799,
	2800,
	2801,
	2802,
	2803,
	2804,
	2805,
	2806,
	2807,
	2808,
	2809,
	2810,
	2811,
	2812,
	2813,
	2814,
	2815,
	2816,
	2817,
	2818,
	2819,
	2820,
	2821,
	2822,
	2823,
	2824,
	2826,
	2827,
	2828,
	2829,
	2830,
	2831,
	2832,
	2833,
	2834,
	2835,
	2836,
	2837,
	2838,
	2839,
	2840,
	2841,
	2842,
	2843,
	2844,
	2845,
	2846,
	2847,
	2848,
	2849,
	2850,
	2851,
	2852,
	2853,
	2854,
	2856,
	2857,
	2858,
	2859,
	2860,
	2861,
	2862,
	2863,
	2864,
	2865,
	2866,
	2867,
	2868,
	2869,
	2870,
	2871,
	2872,
	2874,
	2875,
	2876,
	2877,
	2878,
	2879,
	2880,
	2881,
	2882,
	2883,
	2884,
	2885,
	2886,
	2887,
	2888,
	2889,
	2890,
	2891,
	2892,
	2893,
	2894,
	2895,
	2896,
	2897,
	2898,
	2899,
	2900,
	2901,
	2902,
	2903,
	2904,
	2906,
	2907,
	2908,
	2909,
	2910,
	2911,
	2912,
	2913,
	2914,
	2915,
	2916,
	2917,
	2918,
	2919,
	2920,
	2921,
	2922,
	2923,
	2924,
	2926,
	2927,
	2928,
	2929,
	2930,
	2931,
	2932,
	2933,
	2934,
	2935,
	2936,
	2937,
	2938,
	2939,
	2940,
	2941,
	2942,
	2943,
	2944,
	2945,
	2946,
	2947,
	2948,
	2949,
	2950,
	2951,
	2952,
	2953,
	2954,
	2955,
	2956,
	2957,
	2958,
	2959,
	2960,
	2961,
	2962,
	2963,
	2964,
	2965,
	2966,
	2967,
	2968,
	2969,
	2970,
	2971,
	2972,
	2973,
	2974,
	2975,
	2976,
	2977,
	2978,
	2979,
	2980,
	2981,
	2982,
	2983,
	2984,
	2985,
	2986,
	2987,
	2988,
	2989,
	2990,
	2991,
	2992,
	2993,
	2994,
	2995,
	2996,
	2997,
	2998,
	3000,
	3002,
	3003,
	3004,
	3005,
	3006,
	3007,
	3008,
	3009,
	3010,
	3011,
	3012,
	3013,
	3014,
	3015,
	3016,
	3017,
	3018,
	3019,
	3020,
	3021,
	3022,
	3023,
	3024,
	3025,
	3026,
	3027,
	3028,
	3029,
	3030,
	3031,
	3032,
	3033,
	3034,
	3035,
	3036,
	3037,
	3038,
	3039,
	3040,
	3041,
	3042,
	3043,
	3044,
	3045,
	3046,
	3047,
	3048,
	3049,
	3050,
	3051,
	3052,
	3053,
	3054,
	3055,
	3056,
	3057,
	3058,
	3059,
	3060,
	3061,
	3062,
	3063,
	3064,
	3065,
	3066,
	3067,
	3068,
	3069,
	3070,
	3072,
	3073,
	3074,
	3075,
	3076,
	3077,
	3078,
	3079,
	3080,
	3081,
	3082,
	3083,
	3084,
	3085,
	3086,
	3087,
	3088,
	3089,
	3090,
	3091,
	3093,
	3094,
	3095,
	3096,
	3098,
	3099,
	3100,
	3101,
	3102,
	3103,
	3104,
	3105,
	3106,
	3107,
	3108,
	3109,
	3110,
	3111,
	3112,
	3113,
	3114,
	3115,
	3116,
	3117,
	3118,
	3119,
	3120,
	3122,
	3123,
	3124,
	3125,
	3127,
	3128,
	3129,
	3130,
	3131,
	3132,
	3133,
	3134,
	3135,
	3136,
	3137,
	3138,
	3139,
	3140,
	3141,
	3142,
	3143,
	3144,
	3145,
	3146,
	3147,
	3148,
	3149,
	3150,
	3151,
	3152,
	3153,
	3154,
	3155,
	3156,
	3157,
	3158,
	3159,
	3160,
	3161,
	3162,
	3163,
	3164,
	3165,
	3166,
	3167,
	3168,
	3169,
	3170,
	3171,
	3172,
	3173,
	3174,
	3175,
	3176,
	3177,
	3178,
	3179,
	3180,
	3181,
	3182,
	3183,
	3184,
	3185,
	3186,
	3187,
	3188,
	3189,
	3190,
	3191,
	3192,
	3193,
	3194,
	3195,
	3196,
	3197,
	3198,
	3199,
	3200,
	3201,
	3202,
	3203,
	3204,
	3205,
	3206,
	3207,
	3208,
	3209,
	3210,
	3211,
	3212,
	3213,
	3214,
	3215,
	3216,
	3217,
	3218,
	3219,
	3220,
	3221,
	3222,
	3223,
	3224,
	3225,
	3226,
	3227,
	3228,
	3229,
	3230,
	3231,
	3232,
	3233,
	3234,
	3235,
	3236,
	3237,
	3238,
	3239,
	3240,
	3241,
	3242,
	3243,
	3244,
	3245,
	3246,
	3247,
	3248,
	3249,
	3250,
	3251,
	3252,
	3253,
	3254,
	3255,
	3256,
	3257,
	3258,
	3259,
	3260,
	3261,
	3262,
	3263,
	3264,
	3265,
	3266,
	3267,
	3268,
	3269,
	3270,
	3271,
	3272,
	3273,
	3274,
	3275,
	3276,
	3277,
	3278,
	3279,
	3280,
	3281,
	3282,
	3283,
	3284,
	3285,
	3286,
	3287,
	3288,
	3289,
	3290,
	3291,
	3292,
	3293,
	3294,
	3295,
	3296,
	3297,
	3298,
	3299,
	3302,
	3303,
	3304,
	3305,
	3306,
	3307,
	3308,
	3309,
	3310,
	3311,
	3312,
	3313,
	3314,
	3315,
	3316,
	3317,
	3318,
	3319,
	3320,
	3321,
	3326,
	3327,
	3328,
	3329,
	3330,
	3331,
	3332,
	3333,
	3334,
	3335,
	3336,
	3337,
	3338,
	3339,
	3340,
	3341,
	3342,
	3343,
	3344,
	3345,
	3346,
	3347,
	3348,
	3349,
	3350,
	3351,
	3352,
	3353,
	3354,
	3355,
	3356,
	3357,
	3358,
	3359,
	3360,
	3361,
	3362,
	3363,
	3364,
	3365,
	3366,
	3372,
	3373,
	3374,
	3375,
	3376,
	3377,
	3378,
	3379,
	3380,
	3381,
	3382,
	3383,
	3384,
	3385,
	3386,
	3387,
	3388,
	3389,
	3390,
	3391,
	3392,
	3393,
	3394,
	3395,
	3396,
	3397,
	3398,
	3399,
	3400,
	3401,
	3402,
	3405,
	3406,
	3407,
	3408,
	3409,
	3410,
	3411,
	3412,
	3413,
	3414,
	3415,
	3416,
	3417,
	3418,
	3419,
	3420,
	3421,
	3422,
	3423,
	3424,
	3425,
	3426,
	3427,
	3428,
	3429,
	3430,
	3431,
	3432,
	3433,
	3434,
	3435,
	3436,
	3437,
	3438,
	3439,
	3440,
	3441,
	3442,
	3443,
	3444,
	3445,
	3446,
	3447,
	3448,
	3449,
	3450,
	3451,
	3452,
	3453,
	3454,
	3455,
	3456,
	3457,
	3458,
	3459,
	3460,
	3461,
	3462,
	3463,
	3464,
	3465,
	3466,
	3467,
	3468,
	3469,
	3470,
	3471,
	3472,
	3473,
	3474,
	3475,
	3476,
	3477,
	3478,
	3479,
	3480,
	3481,
	3482,
	3483,
	3484,
	3485,
	3486,
	3487,
	3488,
	3489,
	3490,
	3491,
	3492,
	3493,
	3494,
	3495,
	3496,
	3497,
	3498,
	3499,
	3500,
	3501,
	3502,
	3503,
	3504,
	3505,
	3506,
	3507,
	3508,
	3509,
	3510,
	3511,
	3512,
	3513,
	3514,
	3515,
	3516,
	3517,
	3518,
	3519,
	3520,
	3521,
	3522,
	3523,
	3524,
	3525,
	3526,
	3527,
	3528,
	3529,
	3530,
	3531,
	3532,
	3533,
	3534,
	3535,
	3536,
	3537,
	3538,
	3539,
	3540,
	3541,
	3542,
	3543,
	3544,
	3545,
	3547,
	3548,
	3549,
	3550,
	3551,
	3552,
	3553,
	3554,
	3555,
	3556,
	3557,
	3558,
	3559,
	3560,
	3561,
	3562,
	3563,
	3564,
	3567,
	3568,
	3569,
	3570,
	3571,
	3572,
	3573,
	3574,
	3575,
	3576,
	3577,
	3578,
	3579,
	3580,
	3581,
	3582,
	3583,
	3584,
	3585,
	3586,
	3587,
	3588,
	3589,
	3590,
	3591,
	3592,
	3593,
	3594,
	3595,
	3596,
	3597,
	3598,
	3599,
	3600,
	3601,
	3602,
	3603,
	3604,
	3605,
	3606,
	3607,
	3608,
	3609,
	3610,
	3611,
	3612,
	3613,
	3614,
	3615,
	3616,
	3617,
	3618,
	3619,
	3620,
	3621,
	3622,
	3623,
	3624,
	3625,
	3626,
	3627,
	3628,
	3629,
	3630,
	3631,
	3632,
	3633,
	3634,
	3635,
	3636,
	3637,
	3638,
	3639,
	3640,
	3641,
	3642,
	3643,
	3644,
	3645,
	3646,
	3647,
	3648,
	3649,
	3650,
	3651,
	3652,
	3653,
	3654,
	3655,
	3656,
	3657,
	3658,
	3659,
	3660,
	3661,
	3662,
	3663,
	3664,
	3665,
	3666,
	3667,
	3668,
	3669,
	3670,
	3671,
	3672,
	3673,
	3674,
	3675,
	3676,
	3677,
	3678,
	3679,
	3680,
	3681,
	3682,
	3683,
	3684,
	3685,
	3686,
	3687,
	3688,
	3689,
	3690,
	3691,
	3692,
	3695,
	3696,
	3697,
	3698,
	3699,
	3700,
	3701,
	3702,
	3703,
	3704,
	3705,
	3706,
	3707,
	3708,
	3709,
	3710,
	3711,
	3712,
	3713,
	3714,
	3715,
	3716,
	3717,
	3718,
	3719,
	3720,
	3721,
	3722,
	3723,
	3724,
	3725,
	3726,
	3727,
	3728,
	3729,
	3730,
	3731,
	3732,
	3733,
	3734,
	3735,
	3736,
	3738,
	3739,
	3740,
	3741,
	3742,
	3743,
	3744,
	3745,
	3746,
	3747,
	3748,
	3749,
	3750,
	3751,
	3752,
	3753,
	3754,
	3755,
	3756,
	3757,
	3758,
	3759,
	3760,
	3761,
	3762,
	3763,
	3764,
	3765,
	3767,
	3768,
	3769,
	3770,
	3771,
	3772,
	3773,
	3774,
	3775,
	3776,
	3777,
	3778,
	3779,
	3780,
	3781,
	3782,
	3783,
	3784,
	3785,
	3786,
	3787,
	3788,
	3789,
	3790,
	3791,
	3792,
	3793,
	3794,
	3795,
	3796,
	3797,
	3798,
	3799,
	3800,
	3801,
	3802,
	3803,
	3804,
	3805,
	3806,
	3807,
	3808,
	3809,
	3810,
	3811,
	3812,
	3813,
	3814,
	3815,
	3816,
	3817,
	3818,
	3819,
	3820,
	3821,
	3822,
	3823,
	3824,
	3825,
	3826,
	3827,
	3828,
	3829,
	3830,
	3831,
	3832,
	3833,
	3834,
	3835,
	3836,
	3837,
	3838,
	3839,
	3840,
	3842,
	3843,
	3844,
	3845,
	3846,
	3847,
	3848,
	3849,
	3850,
	3851,
	3852,
	3853,
	3854,
	3855,
	3856,
	3857,
	3858,
	3859,
	3860,
	3861,
	3862,
	3863,
	3865,
	3866,
	3867,
	3869,
	3870,
	3871,
	3872,
	3873,
	3874,
	3875,
	3876,
	3877,
	3878,
	3879,
	3880,
	3881,
	3882,
	3883,
	3884,
	3885,
	3886,
	3887,
	3888,
	3889,
	3890,
	3891,
	3892,
	3893,
	3894,
	3895,
	3896,
	3897,
	3898,
	3899,
	3900,
	3901,
	3902,
	3903,
	3904,
	3905,
	3906,
	3907,
	3908,
	3909,
	3910,
	3911,
	3912,
	3913,
	3914,
	3915,
	3916,
	3917,
	3918,
	3919,
	3920,
	3921,
	3922,
	3923,
	3924,
	3925,
	3926,
	3927,
	3928,
	3929,
	3930,
	3931,
	3932,
	3933,
	3934,
	3935,
	3936,
	3937,
	3938,
	3939,
	3940,
	3941,
	3942,
	3943,
	3944,
	3945,
	3946,
	3947,
	3948,
	3949,
	3950,
	3951,
	3952,
	3953,
	3954,
	3955,
	3956,
	3957,
	3958,
	3959,
	3960,
	3961,
	3962,
	3963,
	3964,
	3965,
	3966,
	3967,
	3968,
	3969,
	3970,
	3971,
	3972,
	3973,
	3974,
	3975,
	3976,
	3977,
	3978,
	3979,
	3980,
	3981,
	3982,
	3983,
	3984,
	3985,
	3986,
	3987,
	3988,
	3989,
	3990,
	3991,
	3992,
	3993,
	3995,
	3996,
	3997,
	3998,
	3999,
	4000,
	4001,
	4002,
	4003,
	4004,
	4005,
	4006,
	4007,
	4008,
	4009,
	4010,
	4011,
	4012,
	4013,
	4014,
	4015,
	4016,
	4017,
	4018,
	4019,
	4020,
	4021,
	4022,
	4023,
	4024,
	4025,
	4026,
	4027,
	4028,
	4029,
	4030,
	4031,
	4032,
	4033,
	4034,
	4035,
	4036,
	4037,
	4038,
	4039,
	4040,
	4041,
	4042,
	4043,
	4044,
	4045,
	4046,
	4047,
	4049,
	4050,
	4051,
	4052,
	4053,
	4054,
	4055,
	4056,
	4057,
	4058,
	4059,
	4060,
	4061,
	4062,
	4063,
	4064,
	4065,
	4066,
	4067,
	4068,
	4069,
	4070,
	4071,
	4072,
	4073,
	4074,
	4075,
	4076,
	4077,
	4079,
	4080,
	4081,
	4082,
	4083,
	4084,
	4086,
	4089,
	4090,
	4091,
	4092,
	4093,
	4094,
	4095,
	4096,
	4097,
	4098,
	4099,
	4100,
	4101,
	4102,
	4103,
	4104,
	4105,
	4106,
	4107,
	4108,
	4109,
	4110,
	4111,
	4112,
	4113,
	4114,
	4115,
	4116,
	4117,
	4118,
	4119,
	4121,
	4122,
	4123,
	4124,
	4125,
	4126,
	4127,
	4128,
	4129,
	4130,
	4131,
	4132,
	4133,
	4134,
	4135,
	4136,
	4137,
	4138,
	4139,
	4140,
	4141,
	4142,
	4143,
	4145,
	4146,
	4147,
	4148,
	4149,
	4150,
	4151,
	4152,
	4153,
	4154,
	4155,
	4156,
	4157,
	4158,
	4159,
	4160,
	4161,
	4162,
	4163,
	4164,
	4165,
	4166,
	4167,
	4168,
	4169,
	4172,
	4173,
	4174,
	4177,
	4178,
	4179,
	4180,
	4181,
	4182,
	4183,
	4184,
	4185,
	4188,
	4191,
	4192,
	4197,
	4199,
	4300,
	4301,
	4302,
	4303,
	4304,
	4305,
	4306,
	4307,
	4308,
	4309,
	4310,
	4320,
	4321,
	4322,
	4323,
	4325,
	4326,
	4327,
	4328,
	4333,
	4340,
	4341,
	4342,
	4343,
	4344,
	4345,
	4346,
	4347,
	4348,
	4349,
	4350,
	4351,
	4352,
	4353,
	4354,
	4355,
	4356,
	4357,
	4358,
	4359,
	4361,
	4362,
	4366,
	4368,
	4369,
	4370,
	4371,
	4372,
	4373,
	4375,
	4376,
	4377,
	4378,
	4379,
	4389,
	4390,
	4394,
	4395,
	4400,
	4401,
	4402,
	4403,
	4404,
	4405,
	4406,
	4412,
	4413,
	4416,
	4418,
	4420,
	4425,
	4426,
	4430,
	4432,
	4441,
	4442,
	4443,
	4444,
	4445,
	4446,
	4447,
	4448,
	4449,
	4450,
	4451,
	4452,
	4453,
	4454,
	4455,
	4456,
	4457,
	4458,
	4484,
	4486,
	4488,
	4500,
	4534,
	4535,
	4536,
	4537,
	4538,
	4545,
	4546,
	4547,
	4548,
	4549,
	4550,
	4551,
	4552,
	4554,
	4555,
	4556,
	4557,
	4558,
	4559,
	4566,
	4567,
	4568,
	4569,
	4591,
	4592,
	4593,
	4594,
	4595,
	4596,
	4597,
	4598,
	4599,
	4600,
	4601,
	4621,
	4658,
	4659,
	4660,
	4661,
	4662,
	4663,
	4664,
	4665,
	4666,
	4667,
	4668,
	4669,
	4670,
	4671,
	4672,
	4673,
	4674,
	4675,
	4676,
	4677,
	4678,
	4679,
	4680,
	4681,
	4682,
	4683,
	4684,
	4685,
	4686,
	4687,
	4688,
	4689,
	4690,
	4691,
	4692,
	4700,
	4701,
	4702,
	4711,
	4725,
	4726,
	4727,
	4728,
	4729,
	4730,
	4732,
	4737,
	4738,
	4739,
	4740,
	4741,
	4742,
	4743,
	4744,
	4745,
	4746,
	4747,
	4749,
	4750,
	4751,
	4752,
	4753,
	4754,
	4755,
	4784,
	4785,
	4789,
	4790,
	4791,
	4800,
	4801,
	4802,
	4803,
	4804,
	4827,
	4837,
	4838,
	4839,
	4840,
	4841,
	4842,
	4843,
	4844,
	4845,
	4846,
	4847,
	4848,
	4849,
	4850,
	4851,
	4867,
	4868,
	4869,
	4870,
	4871,
	4876,
	4877,
	4878,
	4881,
	4882,
	4884,
	4885,
	4894,
	4899,
	4900,
	4914,
	4936,
	4937,
	4940,
	4941,
	4942,
	4949,
	4950,
	4951,
	4952,
	4969,
	4970,
	4980,
	4986,
	4987,
	4988,
	4989,
	4990,
	4991,
	4999,
	5000,
	5001,
	5002,
	5003,
	5004,
	5005,
	5006,
	5007,
	5008,
	5009,
	5010,
	5011,
	5012,
	5013,
	5014,
	5020,
	5021,
	5022,
	5023,
	5024,
	5025,
	5026,
	5027,
	5029,
	5030,
	5031,
	5042,
	5043,
	5044,
	5046,
	5047,
	5049,
	5050,
	5051,
	5052,
	5053,
	5055,
	5056,
	5057,
	5058,
	5059,
	5060,
	5061,
	5062,
	5064,
	5065,
	5066,
	5067,
	5069,
	5070,
	5071,
	5072,
	5073,
	5074,
	5078,
	5079,
	5080,
	5081,
	5082,
	5083,
	5084,
	5085,
	5092,
	5093,
	5094,
	5099,
	5100,
	5101,
	5102,
	5104,
	5105,
	5111,
	5112,
	5116,
	5120,
	5133,
	5136,
	5137,
	5145,
	5150,
	5151,
	5152,
	5154,
	5155,
	5164,
	5165,
	5166,
	5167,
	5168,
	5190,
	5191,
	5192,
	5193,
	5200,
	5201,
	5202,
	5203,
	5223,
	5224,
	5225,
	5226,
	5227,
	5234,
	5235,
	5236,
	5237,
	5245,
	5246,
	5247,
	5248,
	5249,
	5250,
	5251,
	5252,
	5264,
	5265,
	5270,
	5271,
	5272,
	5282,
	5298,
	5299,
	5300,
	5301,
	5302,
	5303,
	5304,
	5305,
	5306,
	5307,
	5308,
	5309,
	5310,
	5312,
	5313,
	5314,
	5315,
	5343,
	5344,
	5349,
	5350,
	5351,
	5352,
	5353,
	5354,
	5355,
	5356,
	5357,
	5358,
	5359,
	5360,
	5361,
	5362,
	5363,
	5364,
	5397,
	5398,
	5399,
	5400,
	5401,
	5402,
	5403,
	5404,
	5405,
	5406,
	5407,
	5408,
	5409,
	5410,
	5411,
	5412,
	5413,
	5414,
	5415,
	5416,
	5417,
	5418,
	5419,
	5420,
	5421,
	5422,
	5423,
	5424,
	5425,
	5426,
	5427,
	5428,
	5429,
	5430,
	5431,
	5432,
	5433,
	5434,
	5435,
	5436,
	5437,
	5443,
	5450,
	5453,
	5454,
	5455,
	5456,
	5461,
	5462,
	5463,
	5464,
	5465,
	5474,
	5500,
	5501,
	5502,
	5503,
	5504,
	5505,
	5506,
	5553,
	5554,
	5555,
	5556,
	5567,
	5568,
	5569,
	5573,
	5580,
	5581,
	5582,
	5583,
	5584,
	5585,
	5597,
	5598,
	5599,
	5600,
	5601,
	5602,
	5603,
	5604,
	5605,
	5627,
	5628,
	5629,
	5630,
	5631,
	5632,
	5633,
	5634,
	5670,
	5671,
	5672,
	5673,
	5674,
	5675,
	5676,
	5677,
	5678,
	5679,
	5680,
	5681,
	5682,
	5683,
	5684,
	5687,
	5688,
	5689,
	5713,
	5714,
	5715,
	5716,
	5717,
	5718,
	5719,
	5720,
	5721,
	5722,
	5723,
	5724,
	5728,
	5729,
	5730,
	5741,
	5742,
	5743,
	5744,
	5745,
	5746,
	5747,
	5748,
	5750,
	5755,
	5757,
	5766,
	5767,
	5768,
	5769,
	5770,
	5771,
	5777,
	5781,
	5782,
	5783,
	5784,
	5785,
	5786,
	5787,
	5793,
	5794,
	5813,
	5814,
	5859,
	5863,
	5900,
	5910,
	5911,
	5912,
	5913,
	5963,
	5968,
	5969,
	5984,
	5985,
	5986,
	5987,
	5988,
	5989,
	5990,
	5991,
	5992,
	5999,
	6000,
	6064,
	6065,
	6066,
	6069,
	6070,
	6071,
	6072,
	6073,
	6074,
	6080,
	6081,
	6082,
	6083,
	6085,
	6086,
	6087,
	6088,
	6100,
	6101,
	6102,
	6103,
	6104,
	6105,
	6106,
	6107,
	6108,
	6109,
	6110,
	6111,
	6112,
	6118,
	6122,
	6123,
	6124,
	6133,
	6140,
	6141,
	6142,
	6143,
	6144,
	6145,
	6146,
	6147,
	6148,
	6149,
	6160,
	6161,
	6162,
	6163,
	6200,
	6201,
	6209,
	6222,
	6241,
	6242,
	6243,
	6244,
	6251,
	6252,
	6253,
	6268,
	6269,
	6300,
	6301,
	6306,
	6315,
	6316,
	6317,
	6320,
	6321,
	6322,
	6324,
	6343,
	6346,
	6347,
	6350,
	6355,
	6360,
	6363,
	6370,
	6382,
	6389,
	6390,
	6417,
	6419,
	6420,
	6421,
	6443,
	6444,
	6445,
	6446,
	6455,
	6456,
	6464,
	6471,
	6480,
	6481,
	6482,
	6483,
	6484,
	6485,
	6486,
	6487,
	6488,
	6489,
	6500,
	6501,
	6502,
	6503,
	6505,
	6506,
	6507,
	6508,
	6509,
	6510,
	6511,
	6514,
	6515,
	6543,
	6544,
	6547,
	6548,
	6549,
	6550,
	6551,
	6558,
	6566,
	6568,
	6579,
	6580,
	6581,
	6582,
	6583,
	6619,
	6620,
	6621,
	6622,
	6623,
	6626,
	6627,
	6628,
	6629,
	6633,
	6634,
	6635,
	6636,
	6653,
	6657,
	6670,
	6671,
	6672,
	6673,
	6678,
	6679,
	6689,
	6696,
	6701,
	6702,
	6703,
	6714,
	6715,
	6767,
	6768,
	6769,
	6770,
	6771,
	6784,
	6785,
	6786,
	6787,
	6788,
	6790,
	6791,
	6801,
	6831,
	6841,
	6842,
	6850,
	6868,
	6888,
	6935,
	6936,
	6946,
	6951,
	6961,
	6962,
	6963,
	6964,
	6965,
	6966,
	6969,
	6997,
	6998,
	6999,
	7000,
	7001,
	7002,
	7003,
	7004,
	7005,
	7006,
	7007,
	7008,
	7009,
	7010,
	7011,
	7012,
	7013,
	7014,
	7015,
	7016,
	7017,
	7019,
	7020,
	7021,
	7022,
	7023,
	7024,
	7025,
	7030,
	7040,
	7070,
	7071,
	7072,
	7080,
	7088,
	7095,
	7099,
	7100,
	7101,
	7107,
	7121,
	7128,
	7129,
	7161,
	7162,
	7163,
	7164,
	7165,
	7166,
	7169,
	7170,
	7171,
	7174,
	7181,
	7200,
	7201,
	7227,
	7235,
	7244,
	7262,
	7272,
	7273,
	7274,
	7275,
	7276,
	7277,
	7278,
	7279,
	7280,
	7281,
	7282,
	7365,
	7391,
	7392,
	7393,
	7394,
	7395,
	7397,
	7400,
	7401,
	7402,
	7410,
	7411,
	7420,
	7421,
	7426,
	7427,
	7428,
	7429,
	7430,
	7431,
	7437,
	7443,
	7473,
	7491,
	7500,
	7501,
	7510,
	7511,
	7542,
	7543,
	7544,
	7545,
	7546,
	7547,
	7548,
	7549,
	7550,
	7560,
	7566,
	7570,
	7574,
	7588,
	7606,
	7624,
	7627,
	7628,
	7629,
	7633,
	7648,
	7663,
	7674,
	7675,
	7676,
	7677,
	7680,
	7689,
	7697,
	7707,
	7708,
	7720,
	7724,
	7725,
	7726,
	7727,
	7728,
	7734,
	7738,
	7741,
	7743,
	7744,
	7747,
	7777,
	7778,
	7779,
	7781,
	7784,
	7786,
	7787,
	7789,
	7794,
	7797,
	7798,
	7799,
	7800,
	7801,
	7802,
	7810,
	7845,
	7846,
	7872,
	7880,
	7887,
	7900,
	7901,
	7902,
	7903,
	7913,
	7932,
	7933,
	7962,
	7967,
	7979,
	7980,
	7982,
	7998,
	7999,
	8000,
	8001,
	8002,
	8003,
	8005,
	8006,
	8007,
	8008,
	8019,
	8020,
	8021,
	8022,
	8023,
	8025,
	8026,
	8032,
	8033,
	8034,
	8040,
	8041,
	8052,
	8053,
	8054,
	8055,
	8056,
	8057,
	8058,
	8059,
	8060,
	8074,
	8080,
	8081,
	8082,
	8083,
	8086,
	8087,
	8088,
	8097,
	8100,
	+8111,
	8115,
	8116,
	8118,
	8121,
	8122,
	8128,
	8129,
	8130,
	8131,
	8132,
	8148,
	8149,
	8160,
	8161,
	8182,
	8184,
	8192,
	8194,
	8195,
	8199,
	8200,
	8201,
	8202,
	8204,
	8205,
	8206,
	8207,
	8208,
	+8211,
	8230,
	8231,
	8232,
	8243,
	+8266,
	8276,
	8280,
	8282,
	8292,
	8294,
	8300,
	8301,
	8320,
	8321,
	8322,
	8351,
	8376,
	8377,
	8378,
	8379,
	8380,
	8383,
	8384,
	8400,
	8401,
	8402,
	8403,
	8416,
	8417,
	8442,
	8443,
	8444,
	8445,
	8450,
	8472,
	8473,
	8474,
	8500,
	8501,
	8503,
	8554,
	8555,
	8567,
	8600,
	8609,
	8610,
	8611,
	8612,
	8613,
	8614,
	8675,
	8686,
	8732,
	8733,
	8763,
	8764,
	8765,
	8766,
	8770,
	8786,
	8787,
	8793,
	8800,
	8804,
	8805,
	8807,
	8808,
	+8809,
	8873,
	8880,
	8883,
	8888,
	8889,
	8890,
	8891,
	8892,
	8893,
	8894,
	8899,
	8900,
	8901,
	8910,
	8911,
	8912,
	8913,
	8954,
	8980,
	8981,
	8989,
	8990,
	8991,
	8999,
	9000,
	9001,
	9002,
	9006,
	9007,
	9009,
	9011,
	9020,
	9021,
	9022,
	9023,
	9024,
	9025,
	9026,
	9060,
	9080,
	9081,
	9084,
	9085,
	9086,
	9087,
	9088,
	9089,
	9090,
	9091,
	9092,
	9100,
	9101,
	9102,
	9103,
	9104,
	9105,
	9106,
	9111,
	9119,
	9131,
	9160,
	9161,
	9162,
	9163,
	9164,
	9191,
	9200,
	9201,
	9202,
	9203,
	9204,
	9205,
	9206,
	9207,
	9208,
	9209,
	9210,
	9211,
	9212,
	9213,
	9214,
	9215,
	9216,
	9217,
	9222,
	9255,
	9277,
	9278,
	9279,
	9280,
	9281,
	9282,
	9283,
	9284,
	9285,
	9286,
	9287,
	9292,
	9293,
	9294,
	9295,
	9300,
	9318,
	9321,
	9343,
	9344,
	9346,
	9374,
	9380,
	9396,
	9397,
	9400,
	9401,
	9402,
	9418,
	9443,
	9444,
	9450,
	9500,
	9522,
	9535,
	9536,
	9555,
	9592,
	9593,
	9594,
	9595,
	9596,
	9597,
	9598,
	9599,
	9600,
	9612,
	9618,
	9628,
	9629,
	9632,
	9667,
	9668,
	9694,
	9695,
	9700,
	9747,
	9750,
	9753,
	9762,
	9800,
	9801,
	9802,
	9875,
	9878,
	9888,
	9889,
	9898,
	9899,
	9900,
	9901,
	9903,
	9909,
	9911,
	9950,
	9951,
	9952,
	9953,
	9955,
	9956,
	9966,
	9987,
	9990,
	9991,
	9992,
	9993,
	9994,
	9995,
	9996,
	9997,
	9998,
	9999,
	10000,
	10001,
	10002,
	10003,
	10007,
	10008,
	10009,
	10023,
	10050,
	10051,
	10080,
	10081,
	10100,
	10101,
	10102,
	10103,
	10104,
	10107,
	10110,
	10111,
	10113,
	10114,
	10115,
	10116,
	10117,
	10128,
	10160,
	10161,
	10162,
	10200,
	10201,
	10252,
	10253,
	10260,
	10288,
	10439,
	10500,
	10540,
	10541,
	10542,
	10543,
	10544,
	10800,
	10805,
	10810,
	10860,
	10880,
	10990,
	11000,
	11001,
	11095,
	11106,
	11108,
	11111,
	11112,
	11161,
	11162,
	11163,
	11164,
	11165,
	11171,
	11201,
	11208,
	11211,
	11319,
	11320,
	11321,
	11367,
	11371,
	11430,
	11600,
	11720,
	11723,
	11751,
	11796,
	11876,
	11877,
	11967,
	12000,
	12001,
	12002,
	12003,
	12004,
	12005,
	12006,
	12007,
	12008,
	12009,
	12012,
	12013,
	12109,
	12121,
	12168,
	12172,
	12300,
	12321,
	12322,
	12345,
	12753,
	13160,
	13216,
	13217,
	13218,
	13223,
	13224,
	13400,
	13720,
	13721,
	13722,
	13724,
	13782,
	13783,
	13785,
	13786,
	13818,
	13819,
	13820,
	13821,
	13822,
	13894,
	13929,
	14000,
	14001,
	14002,
	14033,
	14034,
	14141,
	14142,
	14145,
	14149,
	14154,
	14250,
	14414,
	14936,
	14937,
	15000,
	15118,
	15345,
	15363,
	15555,
	15660,
	15740,
	15998,
	16003,
	16161,
	16309,
	16310,
	16311,
	16360,
	16361,
	16367,
	16368,
	16384,
	16666,
	16900,
	16950,
	16991,
	16992,
	16993,
	16994,
	16995,
	17007,
	17185,
	17219,
	17220,
	17221,
	17222,
	17224,
	17225,
	17234,
	17235,
	17500,
	17729,
	17754,
	17755,
	17756,
	18000,
	18181,
	18182,
	18183,
	18184,
	18185,
	18186,
	18187,
	18241,
	18262,
	18463,
	18634,
	18635,
	18668,
	18769,
	18881,
	18888,
	19000,
	19007,
	19191,
	19194,
	19220,
	19283,
	19315,
	19398,
	19410,
	19411,
	19412,
	19539,
	19540,
	19541,
	19788,
	19999,
	20000,
	20001,
	20002,
	20003,
	20005,
	20012,
	20014,
	20034,
	20046,
	20048,
	20049,
	20167,
	20202,
	20222,
	20480,
	20670,
	20999,
	21000,
	21554,
	21590,
	21800,
	21845,
	21846,
	21847,
	21848,
	21849,
	22000,
	22001,
	22002,
	22003,
	22004,
	22005,
	22273,
	22305,
	22335,
	22343,
	22347,
	22350,
	22555,
	22763,
	22800,
	22951,
	23000,
	23001,
	23002,
	23003,
	23004,
	23005,
	23272,
	23294,
	23333,
	23400,
	23401,
	23402,
	24000,
	24001,
	24002,
	24003,
	24004,
	24005,
	24006,
	24242,
	24249,
	24321,
	24322,
	24386,
	24465,
	24554,
	24577,
	24676,
	24677,
	24678,
	24680,
	24850,
	24922,
	25000,
	25001,
	25002,
	25003,
	25004,
	25005,
	25006,
	25007,
	25008,
	25009,
	25793,
	25900,
	25901,
	25902,
	25903,
	25954,
	25955,
	26000,
	26133,
	26208,
	26260,
	26261,
	26262,
	26263,
	26486,
	26487,
	26489,
	27345,
	27442,
	27504,
	27782,
	27999,
	28000,
	28119,
	28200,
	28240,
	29167,
	30001,
	30002,
	30003,
	30004,
	30260,
	30832,
	30999,
	31016,
	31029,
	31416,
	31457,
	31620,
	31765,
	31948,
	31949,
	32034,
	32249,
	32483,
	32635,
	32636,
	32767,
	32768,
	32769,
	32770,
	32771,
	32772,
	32773,
	32774,
	32775,
	32776,
	32777,
	32801,
	32896,
	33123,
	33331,
	33334,
	33434,
	33435,
	33656,
	34249,
	34378,
	34379,
	34567,
	34962,
	34963,
	34964,
	34980,
	35001,
	35004,
	35100,
	35355,
	36001,
	36411,
	36865,
	37475,
	37654,
	38002,
	38201,
	38202,
	38203,
	39681,
	40000,
	40023,
	40841,
	40842,
	40843,
	40853,
	41111,
	41230,
	41794,
	41795,
	42508,
	42509,
	42510,
	43000,
	43188,
	43189,
	43190,
	43210,
	43438,
	43439,
	43440,
	43441,
	44321,
	44322,
	44544,
	44553,
	44600,
	44818,
	44900,
	45000,
	45054,
	45514,
	45678,
	45825,
	45966,
	46999,
	47000,
	47100,
	47557,
	47624,
	47806,
	47808,
	47809,
	48000,
	48001,
	48002,
	48003,
	48128,
	48129,
	48556,
	48619,
	48653,
	49001,
	Index: head/contrib/unbound/util/log.c
	===================================================================
	--- head/contrib/unbound/util/log.c (revision 349719)
	+++ head/contrib/unbound/util/log.c (revision 349720)
	@@ -1,508 +1,517 @@
	/*
	* util/log.c - implementation of the log code
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/
	/**
	* \file
	* Implementation of log.h.
	*/

	#include "config.h"
	#include "util/log.h"
	#include "util/locks.h"
	#include "sldns/sbuffer.h"
	#include <stdarg.h>
	#ifdef HAVE_TIME_H
	#include <time.h>
	#endif
	#ifdef HAVE_SYSLOG_H
	# include <syslog.h>
	#else
	/*define LOG_ constants /
	# define LOG_CRIT 2
	# define LOG_ERR 3
	# define LOG_WARNING 4
	# define LOG_NOTICE 5
	# define LOG_INFO 6
	# define LOG_DEBUG 7
	#endif
	#ifdef UB_ON_WINDOWS
	# include "winrc/win_svc.h"
	#endif

	/* default verbosity */
	enum verbosity_value verbosity = 0;
	/** the file logged to. */
	static FILE* logfile = 0;
	/** if key has been created */
	static int key_created = 0;
	/** pthread key for thread ids in logfile */
	static ub_thread_key_type logkey;
	#ifndef THREADS_DISABLED
	/** pthread mutex to protect FILE* */
	static lock_quick_type log_lock;
	#endif
	/** the identity of this executable/process */
	static const char* ident="unbound";
	#if defined(HAVE_SYSLOG_H) \|\| defined(UB_ON_WINDOWS)
	/** are we using syslog(3) to log to */
	static int logging_to_syslog = 0;
	#endif /* HAVE_SYSLOG_H */
	-/** time to print in log, if NULL, use time(2) */
	-static time_t* log_now = NULL;
	/** print time in UTC or in secondsfrom1970 */
	static int log_time_asc = 0;

	void
	log_init(const char* filename, int use_syslog, const char* chrootdir)
	{
	FILE *f;
	if(!key_created) {
	key_created = 1;
	ub_thread_key_create(&logkey, NULL);
	lock_quick_init(&log_lock);
	}
	lock_quick_lock(&log_lock);
	if(logfile
	#if defined(HAVE_SYSLOG_H) \|\| defined(UB_ON_WINDOWS)
	\|\| logging_to_syslog
	#endif
	) {
	lock_quick_unlock(&log_lock); /* verbose() needs the lock */
	verbose(VERB_QUERY, "switching log to %s",
	use_syslog?"syslog":(filename&&filename[0]?filename:"stderr"));
	lock_quick_lock(&log_lock);
	}
	if(logfile && logfile != stderr) {
	FILE* cl = logfile;
	logfile = NULL; /* set to NULL before it is closed, so that
	other threads have a valid logfile or NULL */
	fclose(cl);
	}
	#ifdef HAVE_SYSLOG_H
	if(logging_to_syslog) {
	closelog();
	logging_to_syslog = 0;
	}
	if(use_syslog) {
	/* do not delay opening until first write, because we may
	* chroot and no longer be able to access dev/log and so on */
	openlog(ident, LOG_NDELAY, LOG_DAEMON);
	logging_to_syslog = 1;
	lock_quick_unlock(&log_lock);
	return;
	}
	#elif defined(UB_ON_WINDOWS)
	if(logging_to_syslog) {
	logging_to_syslog = 0;
	}
	if(use_syslog) {
	logging_to_syslog = 1;
	lock_quick_unlock(&log_lock);
	return;
	}
	#endif /* HAVE_SYSLOG_H */
	if(!filename \|\| !filename[0]) {
	logfile = stderr;
	lock_quick_unlock(&log_lock);
	return;
	}
	/* open the file for logging */
	if(chrootdir && chrootdir[0] && strncmp(filename, chrootdir,
	strlen(chrootdir)) == 0)
	filename += strlen(chrootdir);
	f = fopen(filename, "a");
	if(!f) {
	lock_quick_unlock(&log_lock);
	log_err("Could not open logfile %s: %s", filename,
	strerror(errno));
	return;
	}
	#ifndef UB_ON_WINDOWS
	/* line buffering does not work on windows */
	setvbuf(f, NULL, (int)_IOLBF, 0);
	#endif
	logfile = f;
	lock_quick_unlock(&log_lock);
	}

	void log_file(FILE *f)
	{
	lock_quick_lock(&log_lock);
	logfile = f;
	lock_quick_unlock(&log_lock);
	}

	void log_thread_set(int* num)
	{
	ub_thread_key_set(logkey, num);
	}

	int log_thread_get(void)
	{
	unsigned int* tid;
	if(!key_created) return 0;
	tid = (unsigned int*)ub_thread_key_get(logkey);
	return (int)(tid?*tid:0);
	}

	void log_ident_set(const char* id)
	{
	ident = id;
	}

	-void log_set_time(time_t* t)
	-{
	- log_now = t;
	-}
	-
	void log_set_time_asc(int use_asc)
	{
	log_time_asc = use_asc;
	}

	void* log_get_lock(void)
	{
	if(!key_created)
	return NULL;
	#ifndef THREADS_DISABLED
	return (void*)&log_lock;
	#else
	return NULL;
	#endif
	}

	void
	log_vmsg(int pri, const char* type,
	const char *format, va_list args)
	{
	char message[MAXSYSLOGMSGLEN];
	unsigned int* tid = (unsigned int*)ub_thread_key_get(logkey);
	time_t now;
	#if defined(HAVE_STRFTIME) && defined(HAVE_LOCALTIME_R)
	char tmbuf[32];
	struct tm tm;
	#elif defined(UB_ON_WINDOWS)
	char tmbuf[128], dtbuf[128];
	#endif
	(void)pri;
	vsnprintf(message, sizeof(message), format, args);
	#ifdef HAVE_SYSLOG_H
	if(logging_to_syslog) {
	syslog(pri, "[%d:%x] %s: %s",
	(int)getpid(), tid?*tid:0, type, message);
	return;
	}
	#elif defined(UB_ON_WINDOWS)
	if(logging_to_syslog) {
	char m[32768];
	HANDLE* s;
	LPCTSTR str = m;
	DWORD tp = MSG_GENERIC_ERR;
	WORD wt = EVENTLOG_ERROR_TYPE;
	if(strcmp(type, "info") == 0) {
	tp=MSG_GENERIC_INFO;
	wt=EVENTLOG_INFORMATION_TYPE;
	} else if(strcmp(type, "warning") == 0) {
	tp=MSG_GENERIC_WARN;
	wt=EVENTLOG_WARNING_TYPE;
	} else if(strcmp(type, "notice") == 0
	\|\| strcmp(type, "debug") == 0) {
	tp=MSG_GENERIC_SUCCESS;
	wt=EVENTLOG_SUCCESS;
	}
	snprintf(m, sizeof(m), "[%s:%x] %s: %s",
	ident, tid?*tid:0, type, message);
	s = RegisterEventSource(NULL, SERVICE_NAME);
	if(!s) return;
	ReportEvent(s, wt, 0, tp, NULL, 1, 0, &str, NULL);
	DeregisterEventSource(s);
	return;
	}
	#endif /* HAVE_SYSLOG_H */
	lock_quick_lock(&log_lock);
	if(!logfile) {
	lock_quick_unlock(&log_lock);
	return;
	}
	- if(log_now)
	- now = (time_t)*log_now;
	- else now = (time_t)time(NULL);
	+ now = (time_t)time(NULL);
	#if defined(HAVE_STRFTIME) && defined(HAVE_LOCALTIME_R)
	if(log_time_asc && strftime(tmbuf, sizeof(tmbuf), "%b %d %H:%M:%S",
	localtime_r(&now, &tm))%(sizeof(tmbuf)) != 0) {
	/* %sizeof buf!=0 because old strftime returned max on error */
	fprintf(logfile, "%s %s[%d:%x] %s: %s\n", tmbuf,
	ident, (int)getpid(), tid?*tid:0, type, message);
	} else
	#elif defined(UB_ON_WINDOWS)
	if(log_time_asc && GetTimeFormat(LOCALE_USER_DEFAULT, 0, NULL, NULL,
	tmbuf, sizeof(tmbuf)) && GetDateFormat(LOCALE_USER_DEFAULT, 0,
	NULL, NULL, dtbuf, sizeof(dtbuf))) {
	fprintf(logfile, "%s %s %s[%d:%x] %s: %s\n", dtbuf, tmbuf,
	ident, (int)getpid(), tid?*tid:0, type, message);
	} else
	#endif
	fprintf(logfile, "[" ARG_LL "d] %s[%d:%x] %s: %s\n", (long long)now,
	ident, (int)getpid(), tid?*tid:0, type, message);
	#ifdef UB_ON_WINDOWS
	/* line buffering does not work on windows */
	fflush(logfile);
	#endif
	lock_quick_unlock(&log_lock);
	}

	/**
	* implementation of log_info
	* @param format: format string printf-style.
	*/
	void
	log_info(const char *format, ...)
	{
	va_list args;
	va_start(args, format);
	log_vmsg(LOG_INFO, "info", format, args);
	va_end(args);
	}

	/**
	* implementation of log_err
	* @param format: format string printf-style.
	*/
	void
	log_err(const char *format, ...)
	{
	va_list args;
	va_start(args, format);
	log_vmsg(LOG_ERR, "error", format, args);
	va_end(args);
	}

	/**
	* implementation of log_warn
	* @param format: format string printf-style.
	*/
	void
	log_warn(const char *format, ...)
	{
	va_list args;
	va_start(args, format);
	log_vmsg(LOG_WARNING, "warning", format, args);
	va_end(args);
	}

	/**
	* implementation of fatal_exit
	* @param format: format string printf-style.
	*/
	void
	fatal_exit(const char *format, ...)
	{
	va_list args;
	va_start(args, format);
	log_vmsg(LOG_CRIT, "fatal error", format, args);
	va_end(args);
	exit(1);
	}

	/**
	* implementation of verbose
	* @param level: verbose level for the message.
	* @param format: format string printf-style.
	*/
	void
	verbose(enum verbosity_value level, const char* format, ...)
	{
	va_list args;
	va_start(args, format);
	if(verbosity >= level) {
	if(level == VERB_OPS)
	log_vmsg(LOG_NOTICE, "notice", format, args);
	else if(level == VERB_DETAIL)
	log_vmsg(LOG_INFO, "info", format, args);
	else log_vmsg(LOG_DEBUG, "debug", format, args);
	}
	va_end(args);
	}

	/** log hex data */
	static void
	log_hex_f(enum verbosity_value v, const char* msg, void* data, size_t length)
	{
	size_t i, j;
	uint8_t* data8 = (uint8_t*)data;
	const char* hexchar = "0123456789ABCDEF";
	char buf[1024+1]; /* alloc blocksize hex chars + \0 */
	const size_t blocksize = 512;
	size_t len;

	if(length == 0) {
	verbose(v, "%s[%u]", msg, (unsigned)length);
	return;
	}

	for(i=0; i<length; i+=blocksize/2) {
	len = blocksize/2;
	if(length - i < blocksize/2)
	len = length - i;
	for(j=0; j<len; j++) {
	buf[j*2] = hexchar[ data8[i+j] >> 4 ];
	buf[j*2 + 1] = hexchar[ data8[i+j] & 0xF ];
	}
	buf[len*2] = 0;
	verbose(v, "%s[%u:%u] %.*s", msg, (unsigned)length,
	(unsigned)i, (int)len*2, buf);
	}
	}

	void
	log_hex(const char* msg, void* data, size_t length)
	{
	log_hex_f(verbosity, msg, data, length);
	+}
	+
	+void
	+log_query(const char *format, ...)
	+{
	+ va_list args;
	+ va_start(args, format);
	+ log_vmsg(LOG_INFO, "query", format, args);
	+ va_end(args);
	+}
	+
	+void
	+log_reply(const char *format, ...)
	+{
	+ va_list args;
	+ va_start(args, format);
	+ log_vmsg(LOG_INFO, "reply", format, args);
	+ va_end(args);
	}

	void log_buf(enum verbosity_value level, const char* msg, sldns_buffer* buf)
	{
	if(verbosity < level)
	return;
	log_hex_f(level, msg, sldns_buffer_begin(buf), sldns_buffer_limit(buf));
	}

	#ifdef USE_WINSOCK
	char* wsa_strerror(DWORD err)
	{
	static char unknown[32];

	switch(err) {
	case WSA_INVALID_HANDLE: return "Specified event object handle is invalid.";
	case WSA_NOT_ENOUGH_MEMORY: return "Insufficient memory available.";
	case WSA_INVALID_PARAMETER: return "One or more parameters are invalid.";
	case WSA_OPERATION_ABORTED: return "Overlapped operation aborted.";
	case WSA_IO_INCOMPLETE: return "Overlapped I/O event object not in signaled state.";
	case WSA_IO_PENDING: return "Overlapped operations will complete later.";
	case WSAEINTR: return "Interrupted function call.";
	case WSAEBADF: return "File handle is not valid.";
	case WSAEACCES: return "Permission denied.";
	case WSAEFAULT: return "Bad address.";
	case WSAEINVAL: return "Invalid argument.";
	case WSAEMFILE: return "Too many open files.";
	case WSAEWOULDBLOCK: return "Resource temporarily unavailable.";
	case WSAEINPROGRESS: return "Operation now in progress.";
	case WSAEALREADY: return "Operation already in progress.";
	case WSAENOTSOCK: return "Socket operation on nonsocket.";
	case WSAEDESTADDRREQ: return "Destination address required.";
	case WSAEMSGSIZE: return "Message too long.";
	case WSAEPROTOTYPE: return "Protocol wrong type for socket.";
	case WSAENOPROTOOPT: return "Bad protocol option.";
	case WSAEPROTONOSUPPORT: return "Protocol not supported.";
	case WSAESOCKTNOSUPPORT: return "Socket type not supported.";
	case WSAEOPNOTSUPP: return "Operation not supported.";
	case WSAEPFNOSUPPORT: return "Protocol family not supported.";
	case WSAEAFNOSUPPORT: return "Address family not supported by protocol family.";
	case WSAEADDRINUSE: return "Address already in use.";
	case WSAEADDRNOTAVAIL: return "Cannot assign requested address.";
	case WSAENETDOWN: return "Network is down.";
	case WSAENETUNREACH: return "Network is unreachable.";
	case WSAENETRESET: return "Network dropped connection on reset.";
	case WSAECONNABORTED: return "Software caused connection abort.";
	case WSAECONNRESET: return "Connection reset by peer.";
	case WSAENOBUFS: return "No buffer space available.";
	case WSAEISCONN: return "Socket is already connected.";
	case WSAENOTCONN: return "Socket is not connected.";
	case WSAESHUTDOWN: return "Cannot send after socket shutdown.";
	case WSAETOOMANYREFS: return "Too many references.";
	case WSAETIMEDOUT: return "Connection timed out.";
	case WSAECONNREFUSED: return "Connection refused.";
	case WSAELOOP: return "Cannot translate name.";
	case WSAENAMETOOLONG: return "Name too long.";
	case WSAEHOSTDOWN: return "Host is down.";
	case WSAEHOSTUNREACH: return "No route to host.";
	case WSAENOTEMPTY: return "Directory not empty.";
	case WSAEPROCLIM: return "Too many processes.";
	case WSAEUSERS: return "User quota exceeded.";
	case WSAEDQUOT: return "Disk quota exceeded.";
	case WSAESTALE: return "Stale file handle reference.";
	case WSAEREMOTE: return "Item is remote.";
	case WSASYSNOTREADY: return "Network subsystem is unavailable.";
	case WSAVERNOTSUPPORTED: return "Winsock.dll version out of range.";
	case WSANOTINITIALISED: return "Successful WSAStartup not yet performed.";
	case WSAEDISCON: return "Graceful shutdown in progress.";
	case WSAENOMORE: return "No more results.";
	case WSAECANCELLED: return "Call has been canceled.";
	case WSAEINVALIDPROCTABLE: return "Procedure call table is invalid.";
	case WSAEINVALIDPROVIDER: return "Service provider is invalid.";
	case WSAEPROVIDERFAILEDINIT: return "Service provider failed to initialize.";
	case WSASYSCALLFAILURE: return "System call failure.";
	case WSASERVICE_NOT_FOUND: return "Service not found.";
	case WSATYPE_NOT_FOUND: return "Class type not found.";
	case WSA_E_NO_MORE: return "No more results.";
	case WSA_E_CANCELLED: return "Call was canceled.";
	case WSAEREFUSED: return "Database query was refused.";
	case WSAHOST_NOT_FOUND: return "Host not found.";
	case WSATRY_AGAIN: return "Nonauthoritative host not found.";
	case WSANO_RECOVERY: return "This is a nonrecoverable error.";
	case WSANO_DATA: return "Valid name, no data record of requested type.";
	case WSA_QOS_RECEIVERS: return "QOS receivers.";
	case WSA_QOS_SENDERS: return "QOS senders.";
	case WSA_QOS_NO_SENDERS: return "No QOS senders.";
	case WSA_QOS_NO_RECEIVERS: return "QOS no receivers.";
	case WSA_QOS_REQUEST_CONFIRMED: return "QOS request confirmed.";
	case WSA_QOS_ADMISSION_FAILURE: return "QOS admission error.";
	case WSA_QOS_POLICY_FAILURE: return "QOS policy failure.";
	case WSA_QOS_BAD_STYLE: return "QOS bad style.";
	case WSA_QOS_BAD_OBJECT: return "QOS bad object.";
	case WSA_QOS_TRAFFIC_CTRL_ERROR: return "QOS traffic control error.";
	case WSA_QOS_GENERIC_ERROR: return "QOS generic error.";
	case WSA_QOS_ESERVICETYPE: return "QOS service type error.";
	case WSA_QOS_EFLOWSPEC: return "QOS flowspec error.";
	case WSA_QOS_EPROVSPECBUF: return "Invalid QOS provider buffer.";
	case WSA_QOS_EFILTERSTYLE: return "Invalid QOS filter style.";
	case WSA_QOS_EFILTERTYPE: return "Invalid QOS filter type.";
	case WSA_QOS_EFILTERCOUNT: return "Incorrect QOS filter count.";
	case WSA_QOS_EOBJLENGTH: return "Invalid QOS object length.";
	case WSA_QOS_EFLOWCOUNT: return "Incorrect QOS flow count.";
	/case WSA_QOS_EUNKOWNPSOBJ: return "Unrecognized QOS object.";/
	case WSA_QOS_EPOLICYOBJ: return "Invalid QOS policy object.";
	case WSA_QOS_EFLOWDESC: return "Invalid QOS flow descriptor.";
	case WSA_QOS_EPSFLOWSPEC: return "Invalid QOS provider-specific flowspec.";
	case WSA_QOS_EPSFILTERSPEC: return "Invalid QOS provider-specific filterspec.";
	case WSA_QOS_ESDMODEOBJ: return "Invalid QOS shape discard mode object.";
	case WSA_QOS_ESHAPERATEOBJ: return "Invalid QOS shaping rate object.";
	case WSA_QOS_RESERVED_PETYPE: return "Reserved policy QOS element type.";
	default:
	snprintf(unknown, sizeof(unknown),
	"unknown WSA error code %d", (int)err);
	return unknown;
	}
	}
	#endif /* USE_WINSOCK */
	Index: head/contrib/unbound/util/log.h
	===================================================================
	--- head/contrib/unbound/util/log.h (revision 349719)
	+++ head/contrib/unbound/util/log.h (revision 349720)
	@@ -1,216 +1,223 @@
	/*
	* util/log.h - logging service
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains logging functions.
	*/

	#ifndef UTIL_LOG_H
	#define UTIL_LOG_H
	struct sldns_buffer;

	/**
	* verbosity value:
	*/
	enum verbosity_value {
	/** 0 - no verbose messages */
	NO_VERBOSE = 0,
	/** 1 - operational information */
	VERB_OPS,
	/** 2 - detailed information */
	VERB_DETAIL,
	/** 3 - query level information */
	VERB_QUERY,
	/** 4 - algorithm level information */
	VERB_ALGO,
	/** 5 - querier client information */
	VERB_CLIENT
	};

	/** The global verbosity setting */
	extern enum verbosity_value verbosity;

	/**
	* log a verbose message, pass the level for this message.
	* It has printf formatted arguments. No trailing newline is needed.
	* @param level: verbosity level for this message, compared to global
	* verbosity setting.
	* @param format: printf-style format string. Arguments follow.
	*/
	void verbose(enum verbosity_value level,
	const char* format, ...) ATTR_FORMAT(printf, 2, 3);

	/**
	* call this to initialize logging services.
	* @param filename: if NULL stderr is used.
	* @param use_syslog: set to true to ignore filename and use syslog(3).
	* @param chrootdir: to which directory we have been chrooted, if any.
	*/
	void log_init(const char* filename, int use_syslog, const char* chrootdir);

	/**
	* Set logging to go to the specified file *.
	* This setting does not affect the use_syslog setting.
	* @param f: to that file, or pass NULL to disable logging.
	*/
	void log_file(FILE *f);

	/**
	* Init a thread (will print this number for the thread log entries).
	* Must be called from the thread itself. If not called 0 is printed.
	* @param num: number to print for this thread. Owned by caller, must
	* continue to exist.
	*/
	void log_thread_set(int* num);

	/**
	* Get the thread id from logging system. Set after log_init is
	* initialised, or log_thread_set for newly created threads.
	* This initialisation happens in unbound as a daemon, in daemon
	* startup code, when that spawns threads.
	* @return thread number, from 0 and up. Before initialised, returns 0.
	*/
	int log_thread_get(void);

	/**
	* Set identity to print, default is 'unbound'.
	* @param id: string to print. Name of executable.
	*/
	void log_ident_set(const char* id);

	/**
	- * Set the time value to print in log entries.
	- * @param t: the point is copied and used to find the time.
	- * if NULL, time(2) is used.
	- */
	-void log_set_time(time_t* t);
	-
	-/**
	* Set if the time value is printed ascii or decimal in log entries.
	* @param use_asc: if true, ascii is printed, otherwise decimal.
	* If the conversion fails or you have no time functions,
	* decimal is printed.
	*/
	void log_set_time_asc(int use_asc);

	/** get log lock */
	void* log_get_lock(void);

	/**
	* Log informational message.
	* Pass printf formatted arguments. No trailing newline is needed.
	* @param format: printf-style format string. Arguments follow.
	*/
	void log_info(const char* format, ...) ATTR_FORMAT(printf, 1, 2);

	/**
	* Log error message.
	* Pass printf formatted arguments. No trailing newline is needed.
	* @param format: printf-style format string. Arguments follow.
	*/
	void log_err(const char* format, ...) ATTR_FORMAT(printf, 1, 2);

	/**
	* Log warning message.
	* Pass printf formatted arguments. No trailing newline is needed.
	* @param format: printf-style format string. Arguments follow.
	*/
	void log_warn(const char* format, ...) ATTR_FORMAT(printf, 1, 2);

	/**
	* Log a hex-string to the log. Can be any length.
	* performs mallocs to do so, slow. But debug useful.
	* @param msg: string desc to accompany the hexdump.
	* @param data: data to dump in hex format.
	* @param length: length of data.
	*/
	void log_hex(const char* msg, void* data, size_t length);
	+
	+/**
	+ * Log query.
	+ * Pass printf formatted arguments. No trailing newline is needed.
	+ * @param format: printf-style format string. Arguments follow.
	+ */
	+void log_query(const char* format, ...) ATTR_FORMAT(printf, 1, 2);
	+
	+/**
	+ * Log reply.
	+ * Pass printf formatted arguments. No trailing newline is needed.
	+ * @param format: printf-style format string. Arguments follow.
	+ */
	+void log_reply(const char* format, ...) ATTR_FORMAT(printf, 1, 2);

	/**
	* Easy alternative for log_hex, takes a sldns_buffer.
	* @param level: verbosity level for this message, compared to global
	* verbosity setting.
	* @param msg: string desc to print
	* @param buf: the buffer.
	*/
	void log_buf(enum verbosity_value level, const char* msg, struct sldns_buffer* buf);

	/**
	* Log fatal error message, and exit the current process.
	* Pass printf formatted arguments. No trailing newline is needed.
	* @param format: printf-style format string. Arguments follow.
	*/
	void fatal_exit(const char* format, ...) ATTR_FORMAT(printf, 1, 2) ATTR_NORETURN;

	/**
	* va_list argument version of log_info.
	* @param pri: priority type, for example 5 (INFO).
	* @param type: string to designate type of message (info, error).
	* @param format: the printf style format to print. no newline.
	* @param args: arguments for format string.
	*/
	void log_vmsg(int pri, const char* type, const char* format, va_list args);

	/**
	* an assertion that is thrown to the logfile.
	*/
	#ifdef UNBOUND_DEBUG
	#ifdef __clang_analyzer__
	/* clang analyzer needs to know that log_assert is an assertion, otherwise
	* it could complain about the nullptr the assert is guarding against. */
	#define log_assert(x) assert(x)
	#else
	# define log_assert(x) \
	do { if(!(x)) \
	fatal_exit("%s:%d: %s: assertion %s failed", \
	__FILE__, __LINE__, __func__, #x); \
	} while(0);
	#endif
	#else
	# define log_assert(x) /nothing/
	#endif

	#ifdef USE_WINSOCK
	/**
	* Convert WSA error into string.
	* @param err: from WSAGetLastError()
	* @return: string.
	*/
	char* wsa_strerror(DWORD err);
	#endif /* USE_WINSOCK */

	#endif /* UTIL_LOG_H */
	Index: head/contrib/unbound/util/mini_event.c
	===================================================================
	--- head/contrib/unbound/util/mini_event.c (revision 349719)
	+++ head/contrib/unbound/util/mini_event.c (revision 349720)
	@@ -1,391 +1,391 @@
	/*
	* mini_event.c - implementation of part of libevent api, portably.
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*
	*/

	/**
	* \file
	* fake libevent implementation. Less broad in functionality, and only
	* supports select(2).
	*/

	#include "config.h"
	+#include "util/mini_event.h"
	#ifdef HAVE_TIME_H
	#include <time.h>
	#endif
	#include <sys/time.h>

	#if defined(USE_MINI_EVENT) && !defined(USE_WINSOCK)
	#include <signal.h>
	-#include "util/mini_event.h"
	#include "util/fptr_wlist.h"

	/** compare events in tree, based on timevalue, ptr for uniqueness */
	int mini_ev_cmp(const void* a, const void* b)
	{
	const struct event e = (const struct event)a;
	const struct event f = (const struct event)b;
	if(e->ev_timeout.tv_sec < f->ev_timeout.tv_sec)
	return -1;
	if(e->ev_timeout.tv_sec > f->ev_timeout.tv_sec)
	return 1;
	if(e->ev_timeout.tv_usec < f->ev_timeout.tv_usec)
	return -1;
	if(e->ev_timeout.tv_usec > f->ev_timeout.tv_usec)
	return 1;
	if(e < f)
	return -1;
	if(e > f)
	return 1;
	return 0;
	}

	/** set time */
	static int
	settime(struct event_base* base)
	{
	if(gettimeofday(base->time_tv, NULL) < 0) {
	return -1;
	}
	#ifndef S_SPLINT_S
	*base->time_secs = (time_t)base->time_tv->tv_sec;
	#endif
	return 0;
	}

	/** create event base */
	void event_init(time_t time_secs, struct timeval* time_tv)
	{
	struct event_base* base = (struct event_base*)malloc(
	sizeof(struct event_base));
	if(!base)
	return NULL;
	memset(base, 0, sizeof(*base));
	base->time_secs = time_secs;
	base->time_tv = time_tv;
	if(settime(base) < 0) {
	event_base_free(base);
	return NULL;
	}
	base->times = rbtree_create(mini_ev_cmp);
	if(!base->times) {
	event_base_free(base);
	return NULL;
	}
	base->capfd = MAX_FDS;
	#ifdef FD_SETSIZE
	if((int)FD_SETSIZE < base->capfd)
	base->capfd = (int)FD_SETSIZE;
	#endif
	base->fds = (struct event**)calloc((size_t)base->capfd,
	sizeof(struct event*));
	if(!base->fds) {
	event_base_free(base);
	return NULL;
	}
	base->signals = (struct event*)calloc(MAX_SIG, sizeof(struct event));
	if(!base->signals) {
	event_base_free(base);
	return NULL;
	}
	#ifndef S_SPLINT_S
	FD_ZERO(&base->reads);
	FD_ZERO(&base->writes);
	#endif
	return base;
	}

	/** get version */
	const char *event_get_version(void)
	{
	return "mini-event-"PACKAGE_VERSION;
	}

	/** get polling method, select */
	const char *event_get_method(void)
	{
	return "select";
	}

	/** call timeouts handlers, and return how long to wait for next one or -1 */
	static void handle_timeouts(struct event_base* base, struct timeval* now,
	struct timeval* wait)
	{
	struct event* p;
	#ifndef S_SPLINT_S
	wait->tv_sec = (time_t)-1;
	#endif

	while((rbnode_type)(p = (struct event)rbtree_first(base->times))
	!=RBTREE_NULL) {
	#ifndef S_SPLINT_S
	if(p->ev_timeout.tv_sec > now->tv_sec \|\|
	(p->ev_timeout.tv_sec==now->tv_sec &&
	p->ev_timeout.tv_usec > now->tv_usec)) {
	/* there is a next larger timeout. wait for it */
	wait->tv_sec = p->ev_timeout.tv_sec - now->tv_sec;
	if(now->tv_usec > p->ev_timeout.tv_usec) {
	wait->tv_sec--;
	wait->tv_usec = 1000000 - (now->tv_usec -
	p->ev_timeout.tv_usec);
	} else {
	wait->tv_usec = p->ev_timeout.tv_usec
	- now->tv_usec;
	}
	return;
	}
	#endif
	/* event times out, remove it */
	(void)rbtree_delete(base->times, p);
	p->ev_events &= ~EV_TIMEOUT;
	fptr_ok(fptr_whitelist_event(p->ev_callback));
	(*p->ev_callback)(p->ev_fd, EV_TIMEOUT, p->ev_arg);
	}
	}

	/** call select and callbacks for that */
	static int handle_select(struct event_base* base, struct timeval* wait)
	{
	fd_set r, w;
	int ret, i;

	#ifndef S_SPLINT_S
	if(wait->tv_sec==(time_t)-1)
	wait = NULL;
	#endif
	memmove(&r, &base->reads, sizeof(fd_set));
	memmove(&w, &base->writes, sizeof(fd_set));
	memmove(&base->ready, &base->content, sizeof(fd_set));

	if((ret = select(base->maxfd+1, &r, &w, NULL, wait)) == -1) {
	ret = errno;
	if(settime(base) < 0)
	return -1;
	errno = ret;
	if(ret == EAGAIN \|\| ret == EINTR)
	return 0;
	return -1;
	}
	if(settime(base) < 0)
	return -1;

	for(i=0; i<base->maxfd+1; i++) {
	short bits = 0;
	if(!base->fds[i] \|\| !(FD_ISSET(i, &base->ready))) {
	continue;
	}
	if(FD_ISSET(i, &r)) {
	bits \|= EV_READ;
	ret--;
	}
	if(FD_ISSET(i, &w)) {
	bits \|= EV_WRITE;
	ret--;
	}
	bits &= base->fds[i]->ev_events;
	if(bits) {
	fptr_ok(fptr_whitelist_event(
	base->fds[i]->ev_callback));
	(*base->fds[i]->ev_callback)(base->fds[i]->ev_fd,
	bits, base->fds[i]->ev_arg);
	if(ret==0)
	break;
	}
	}
	return 0;
	}

	/** run select in a loop */
	int event_base_dispatch(struct event_base* base)
	{
	struct timeval wait;
	if(settime(base) < 0)
	return -1;
	while(!base->need_to_exit)
	{
	/* see if timeouts need handling */
	handle_timeouts(base, base->time_tv, &wait);
	if(base->need_to_exit)
	return 0;
	/* do select */
	if(handle_select(base, &wait) < 0) {
	if(base->need_to_exit)
	return 0;
	return -1;
	}
	}
	return 0;
	}

	/** exit that loop */
	int event_base_loopexit(struct event_base* base,
	struct timeval* ATTR_UNUSED(tv))
	{
	base->need_to_exit = 1;
	return 0;
	}

	/* free event base, free events yourself */
	void event_base_free(struct event_base* base)
	{
	if(!base)
	return;
	free(base->times);
	free(base->fds);
	free(base->signals);
	free(base);
	}

	/** set content of event */
	void event_set(struct event* ev, int fd, short bits,
	void (cb)(int, short, void ), void* arg)
	{
	ev->node.key = ev;
	ev->ev_fd = fd;
	ev->ev_events = bits;
	ev->ev_callback = cb;
	fptr_ok(fptr_whitelist_event(ev->ev_callback));
	ev->ev_arg = arg;
	ev->added = 0;
	}

	/* add event to a base */
	int event_base_set(struct event_base* base, struct event* ev)
	{
	ev->ev_base = base;
	ev->added = 0;
	return 0;
	}

	/* add event to make it active, you may not change it with event_set anymore */
	int event_add(struct event* ev, struct timeval* tv)
	{
	if(ev->added)
	event_del(ev);
	if(ev->ev_fd != -1 && ev->ev_fd >= ev->ev_base->capfd)
	return -1;
	if( (ev->ev_events&(EV_READ\|EV_WRITE)) && ev->ev_fd != -1) {
	ev->ev_base->fds[ev->ev_fd] = ev;
	if(ev->ev_events&EV_READ) {
	FD_SET(FD_SET_T ev->ev_fd, &ev->ev_base->reads);
	}
	if(ev->ev_events&EV_WRITE) {
	FD_SET(FD_SET_T ev->ev_fd, &ev->ev_base->writes);
	}
	FD_SET(FD_SET_T ev->ev_fd, &ev->ev_base->content);
	FD_CLR(FD_SET_T ev->ev_fd, &ev->ev_base->ready);
	if(ev->ev_fd > ev->ev_base->maxfd)
	ev->ev_base->maxfd = ev->ev_fd;
	}
	if(tv && (ev->ev_events&EV_TIMEOUT)) {
	#ifndef S_SPLINT_S
	struct timeval *now = ev->ev_base->time_tv;
	ev->ev_timeout.tv_sec = tv->tv_sec + now->tv_sec;
	ev->ev_timeout.tv_usec = tv->tv_usec + now->tv_usec;
	while(ev->ev_timeout.tv_usec > 1000000) {
	ev->ev_timeout.tv_usec -= 1000000;
	ev->ev_timeout.tv_sec++;
	}
	#endif
	(void)rbtree_insert(ev->ev_base->times, &ev->node);
	}
	ev->added = 1;
	return 0;
	}

	/* remove event, you may change it again */
	int event_del(struct event* ev)
	{
	if(ev->ev_fd != -1 && ev->ev_fd >= ev->ev_base->capfd)
	return -1;
	if((ev->ev_events&EV_TIMEOUT))
	(void)rbtree_delete(ev->ev_base->times, &ev->node);
	if((ev->ev_events&(EV_READ\|EV_WRITE)) && ev->ev_fd != -1) {
	ev->ev_base->fds[ev->ev_fd] = NULL;
	FD_CLR(FD_SET_T ev->ev_fd, &ev->ev_base->reads);
	FD_CLR(FD_SET_T ev->ev_fd, &ev->ev_base->writes);
	FD_CLR(FD_SET_T ev->ev_fd, &ev->ev_base->ready);
	FD_CLR(FD_SET_T ev->ev_fd, &ev->ev_base->content);
	}
	ev->added = 0;
	return 0;
	}

	/** which base gets to handle signals */
	static struct event_base* signal_base = NULL;
	/** signal handler */
	static RETSIGTYPE sigh(int sig)
	{
	struct event* ev;
	if(!signal_base \|\| sig < 0 \|\| sig >= MAX_SIG)
	return;
	ev = signal_base->signals[sig];
	if(!ev)
	return;
	fptr_ok(fptr_whitelist_event(ev->ev_callback));
	(*ev->ev_callback)(sig, EV_SIGNAL, ev->ev_arg);
	}

	/** install signal handler */
	int signal_add(struct event* ev, struct timeval* ATTR_UNUSED(tv))
	{
	if(ev->ev_fd == -1 \|\| ev->ev_fd >= MAX_SIG)
	return -1;
	signal_base = ev->ev_base;
	ev->ev_base->signals[ev->ev_fd] = ev;
	ev->added = 1;
	if(signal(ev->ev_fd, sigh) == SIG_ERR) {
	return -1;
	}
	return 0;
	}

	/** remove signal handler */
	int signal_del(struct event* ev)
	{
	if(ev->ev_fd == -1 \|\| ev->ev_fd >= MAX_SIG)
	return -1;
	ev->ev_base->signals[ev->ev_fd] = NULL;
	ev->added = 0;
	return 0;
	}

	#else /* USE_MINI_EVENT */
	#ifndef USE_WINSOCK
	int mini_ev_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
	{
	return 0;
	}
	#endif /* not USE_WINSOCK */
	#endif /* USE_MINI_EVENT */
	Index: head/contrib/unbound/util/net_help.c
	===================================================================
	--- head/contrib/unbound/util/net_help.c (revision 349719)
	+++ head/contrib/unbound/util/net_help.c (revision 349720)
	@@ -1,1058 +1,1258 @@
	/*
	* util/net_help.c - implementation of the network helper code
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/
	/**
	* \file
	* Implementation of net_help.h.
	*/

	#include "config.h"
	#include "util/net_help.h"
	#include "util/log.h"
	#include "util/data/dname.h"
	#include "util/module.h"
	#include "util/regional.h"
	+#include "util/config_file.h"
	#include "sldns/parseutil.h"
	#include "sldns/wire2str.h"
	#include <fcntl.h>
	#ifdef HAVE_OPENSSL_SSL_H
	#include <openssl/ssl.h>
	+#include <openssl/evp.h>
	+#include <openssl/rand.h>
	#endif
	#ifdef HAVE_OPENSSL_ERR_H
	#include <openssl/err.h>
	#endif
	#ifdef USE_WINSOCK
	#include <wincrypt.h>
	#endif

	/** max length of an IP address (the address portion) that we allow */
	#define MAX_ADDR_STRLEN 128 /* characters */
	/** default value for EDNS ADVERTISED size */
	uint16_t EDNS_ADVERTISED_SIZE = 4096;

	/** minimal responses when positive answer: default is no */
	int MINIMAL_RESPONSES = 0;

	/** rrset order roundrobin: default is no */
	int RRSET_ROUNDROBIN = 0;

	+/** log tag queries with name instead of 'info' for filtering */
	+int LOG_TAG_QUERYREPLY = 0;
	+
	+static struct tls_session_ticket_key {
	+ unsigned char *key_name;
	+ unsigned char *aes_key;
	+ unsigned char *hmac_key;
	+} *ticket_keys;
	+
	/* returns true is string addr is an ip6 specced address */
	int
	str_is_ip6(const char* str)
	{
	if(strchr(str, ':'))
	return 1;
	else return 0;
	}

	int
	fd_set_nonblock(int s)
	{
	#ifdef HAVE_FCNTL
	int flag;
	if((flag = fcntl(s, F_GETFL)) == -1) {
	log_err("can't fcntl F_GETFL: %s", strerror(errno));
	flag = 0;
	}
	flag \|= O_NONBLOCK;
	if(fcntl(s, F_SETFL, flag) == -1) {
	log_err("can't fcntl F_SETFL: %s", strerror(errno));
	return 0;
	}
	#elif defined(HAVE_IOCTLSOCKET)
	unsigned long on = 1;
	if(ioctlsocket(s, FIONBIO, &on) != 0) {
	log_err("can't ioctlsocket FIONBIO on: %s",
	wsa_strerror(WSAGetLastError()));
	}
	#endif
	return 1;
	}

	int
	fd_set_block(int s)
	{
	#ifdef HAVE_FCNTL
	int flag;
	if((flag = fcntl(s, F_GETFL)) == -1) {
	log_err("cannot fcntl F_GETFL: %s", strerror(errno));
	flag = 0;
	}
	flag &= ~O_NONBLOCK;
	if(fcntl(s, F_SETFL, flag) == -1) {
	log_err("cannot fcntl F_SETFL: %s", strerror(errno));
	return 0;
	}
	#elif defined(HAVE_IOCTLSOCKET)
	unsigned long off = 0;
	if(ioctlsocket(s, FIONBIO, &off) != 0) {
	if(WSAGetLastError() != WSAEINVAL \|\| verbosity >= 4)
	log_err("can't ioctlsocket FIONBIO off: %s",
	wsa_strerror(WSAGetLastError()));
	}
	#endif
	return 1;
	}

	int
	is_pow2(size_t num)
	{
	if(num == 0) return 1;
	return (num & (num-1)) == 0;
	}

	void*
	memdup(void* data, size_t len)
	{
	void* d;
	if(!data) return NULL;
	if(len == 0) return NULL;
	d = malloc(len);
	if(!d) return NULL;
	memcpy(d, data, len);
	return d;
	}

	void
	log_addr(enum verbosity_value v, const char* str,
	struct sockaddr_storage* addr, socklen_t addrlen)
	{
	uint16_t port;
	const char* family = "unknown";
	char dest[100];
	int af = (int)((struct sockaddr_in*)addr)->sin_family;
	void* sinaddr = &((struct sockaddr_in*)addr)->sin_addr;
	if(verbosity < v)
	return;
	switch(af) {
	case AF_INET: family="ip4"; break;
	case AF_INET6: family="ip6";
	sinaddr = &((struct sockaddr_in6*)addr)->sin6_addr;
	break;
	case AF_LOCAL:
	dest[0]=0;
	(void)inet_ntop(af, sinaddr, dest,
	(socklen_t)sizeof(dest));
	verbose(v, "%s local %s", str, dest);
	return; /* do not continue and try to get port */
	default: break;
	}
	if(inet_ntop(af, sinaddr, dest, (socklen_t)sizeof(dest)) == 0) {
	(void)strlcpy(dest, "(inet_ntop error)", sizeof(dest));
	}
	dest[sizeof(dest)-1] = 0;
	port = ntohs(((struct sockaddr_in*)addr)->sin_port);
	if(verbosity >= 4)
	verbose(v, "%s %s %s port %d (len %d)", str, family, dest,
	(int)port, (int)addrlen);
	else verbose(v, "%s %s port %d", str, dest, (int)port);
	}

	int
	extstrtoaddr(const char* str, struct sockaddr_storage* addr,
	socklen_t* addrlen)
	{
	char* s;
	int port = UNBOUND_DNS_PORT;
	if((s=strchr(str, '@'))) {
	char buf[MAX_ADDR_STRLEN];
	if(s-str >= MAX_ADDR_STRLEN) {
	return 0;
	}
	(void)strlcpy(buf, str, sizeof(buf));
	buf[s-str] = 0;
	port = atoi(s+1);
	if(port == 0 && strcmp(s+1,"0")!=0) {
	return 0;
	}
	return ipstrtoaddr(buf, port, addr, addrlen);
	}
	return ipstrtoaddr(str, port, addr, addrlen);
	}


	int
	ipstrtoaddr(const char* ip, int port, struct sockaddr_storage* addr,
	socklen_t* addrlen)
	{
	uint16_t p;
	if(!ip) return 0;
	p = (uint16_t) port;
	if(str_is_ip6(ip)) {
	char buf[MAX_ADDR_STRLEN];
	char* s;
	struct sockaddr_in6* sa = (struct sockaddr_in6*)addr;
	*addrlen = (socklen_t)sizeof(struct sockaddr_in6);
	memset(sa, 0, *addrlen);
	sa->sin6_family = AF_INET6;
	sa->sin6_port = (in_port_t)htons(p);
	if((s=strchr(ip, '%'))) { /* ip6%interface, rfc 4007 */
	if(s-ip >= MAX_ADDR_STRLEN)
	return 0;
	(void)strlcpy(buf, ip, sizeof(buf));
	buf[s-ip]=0;
	sa->sin6_scope_id = (uint32_t)atoi(s+1);
	ip = buf;
	}
	if(inet_pton((int)sa->sin6_family, ip, &sa->sin6_addr) <= 0) {
	return 0;
	}
	} else { /* ip4 */
	struct sockaddr_in* sa = (struct sockaddr_in*)addr;
	*addrlen = (socklen_t)sizeof(struct sockaddr_in);
	memset(sa, 0, *addrlen);
	sa->sin_family = AF_INET;
	sa->sin_port = (in_port_t)htons(p);
	if(inet_pton((int)sa->sin_family, ip, &sa->sin_addr) <= 0) {
	return 0;
	}
	}
	return 1;
	}

	int netblockstrtoaddr(const char* str, int port, struct sockaddr_storage* addr,
	socklen_t* addrlen, int* net)
	{
	char buf[64];
	char* s;
	*net = (str_is_ip6(str)?128:32);
	if((s=strchr(str, '/'))) {
	if(atoi(s+1) > *net) {
	log_err("netblock too large: %s", str);
	return 0;
	}
	*net = atoi(s+1);
	if(*net == 0 && strcmp(s+1, "0") != 0) {
	log_err("cannot parse netblock: '%s'", str);
	return 0;
	}
	strlcpy(buf, str, sizeof(buf));
	s = strchr(buf, '/');
	if(s) *s = 0;
	s = buf;
	}
	if(!ipstrtoaddr(s?s:str, port, addr, addrlen)) {
	log_err("cannot parse ip address: '%s'", str);
	return 0;
	}
	if(s) {
	addr_mask(addr, addrlen, net);
	}
	return 1;
	}

	int authextstrtoaddr(char* str, struct sockaddr_storage* addr,
	socklen_t* addrlen, char** auth_name)
	{
	char* s;
	int port = UNBOUND_DNS_PORT;
	if((s=strchr(str, '@'))) {
	char buf[MAX_ADDR_STRLEN];
	size_t len = (size_t)(s-str);
	char* hash = strchr(s+1, '#');
	if(hash) {
	*auth_name = hash+1;
	} else {
	*auth_name = NULL;
	}
	if(len >= MAX_ADDR_STRLEN) {
	return 0;
	}
	(void)strlcpy(buf, str, sizeof(buf));
	buf[len] = 0;
	port = atoi(s+1);
	if(port == 0) {
	if(!hash && strcmp(s+1,"0")!=0)
	return 0;
	if(hash && strncmp(s+1,"0#",2)!=0)
	return 0;
	}
	return ipstrtoaddr(buf, port, addr, addrlen);
	}
	if((s=strchr(str, '#'))) {
	char buf[MAX_ADDR_STRLEN];
	size_t len = (size_t)(s-str);
	if(len >= MAX_ADDR_STRLEN) {
	return 0;
	}
	(void)strlcpy(buf, str, sizeof(buf));
	buf[len] = 0;
	port = UNBOUND_DNS_OVER_TLS_PORT;
	*auth_name = s+1;
	return ipstrtoaddr(buf, port, addr, addrlen);
	}
	*auth_name = NULL;
	return ipstrtoaddr(str, port, addr, addrlen);
	}

	/** store port number into sockaddr structure */
	void
	sockaddr_store_port(struct sockaddr_storage* addr, socklen_t addrlen, int port)
	{
	if(addr_is_ip6(addr, addrlen)) {
	struct sockaddr_in6* sa = (struct sockaddr_in6*)addr;
	sa->sin6_port = (in_port_t)htons((uint16_t)port);
	} else {
	struct sockaddr_in* sa = (struct sockaddr_in*)addr;
	sa->sin_port = (in_port_t)htons((uint16_t)port);
	}
	}

	void
	log_nametypeclass(enum verbosity_value v, const char* str, uint8_t* name,
	uint16_t type, uint16_t dclass)
	{
	char buf[LDNS_MAX_DOMAINLEN+1];
	char t[12], c[12];
	const char ts, cs;
	if(verbosity < v)
	return;
	dname_str(name, buf);
	if(type == LDNS_RR_TYPE_TSIG) ts = "TSIG";
	else if(type == LDNS_RR_TYPE_IXFR) ts = "IXFR";
	else if(type == LDNS_RR_TYPE_AXFR) ts = "AXFR";
	else if(type == LDNS_RR_TYPE_MAILB) ts = "MAILB";
	else if(type == LDNS_RR_TYPE_MAILA) ts = "MAILA";
	else if(type == LDNS_RR_TYPE_ANY) ts = "ANY";
	else if(sldns_rr_descript(type) && sldns_rr_descript(type)->_name)
	ts = sldns_rr_descript(type)->_name;
	else {
	snprintf(t, sizeof(t), "TYPE%d", (int)type);
	ts = t;
	}
	if(sldns_lookup_by_id(sldns_rr_classes, (int)dclass) &&
	sldns_lookup_by_id(sldns_rr_classes, (int)dclass)->name)
	cs = sldns_lookup_by_id(sldns_rr_classes, (int)dclass)->name;
	else {
	snprintf(c, sizeof(c), "CLASS%d", (int)dclass);
	cs = c;
	}
	log_info("%s %s %s %s", str, buf, ts, cs);
	}

	+void
	+log_query_in(const char* str, uint8_t* name, uint16_t type, uint16_t dclass)
	+{
	+ char buf[LDNS_MAX_DOMAINLEN+1];
	+ char t[12], c[12];
	+ const char ts, cs;
	+ dname_str(name, buf);
	+ if(type == LDNS_RR_TYPE_TSIG) ts = "TSIG";
	+ else if(type == LDNS_RR_TYPE_IXFR) ts = "IXFR";
	+ else if(type == LDNS_RR_TYPE_AXFR) ts = "AXFR";
	+ else if(type == LDNS_RR_TYPE_MAILB) ts = "MAILB";
	+ else if(type == LDNS_RR_TYPE_MAILA) ts = "MAILA";
	+ else if(type == LDNS_RR_TYPE_ANY) ts = "ANY";
	+ else if(sldns_rr_descript(type) && sldns_rr_descript(type)->_name)
	+ ts = sldns_rr_descript(type)->_name;
	+ else {
	+ snprintf(t, sizeof(t), "TYPE%d", (int)type);
	+ ts = t;
	+ }
	+ if(sldns_lookup_by_id(sldns_rr_classes, (int)dclass) &&
	+ sldns_lookup_by_id(sldns_rr_classes, (int)dclass)->name)
	+ cs = sldns_lookup_by_id(sldns_rr_classes, (int)dclass)->name;
	+ else {
	+ snprintf(c, sizeof(c), "CLASS%d", (int)dclass);
	+ cs = c;
	+ }
	+ if(LOG_TAG_QUERYREPLY)
	+ log_query("%s %s %s %s", str, buf, ts, cs);
	+ else log_info("%s %s %s %s", str, buf, ts, cs);
	+}
	+
	void log_name_addr(enum verbosity_value v, const char* str, uint8_t* zone,
	struct sockaddr_storage* addr, socklen_t addrlen)
	{
	uint16_t port;
	const char* family = "unknown_family ";
	char namebuf[LDNS_MAX_DOMAINLEN+1];
	char dest[100];
	int af = (int)((struct sockaddr_in*)addr)->sin_family;
	void* sinaddr = &((struct sockaddr_in*)addr)->sin_addr;
	if(verbosity < v)
	return;
	switch(af) {
	case AF_INET: family=""; break;
	case AF_INET6: family="";
	sinaddr = &((struct sockaddr_in6*)addr)->sin6_addr;
	break;
	case AF_LOCAL: family="local "; break;
	default: break;
	}
	if(inet_ntop(af, sinaddr, dest, (socklen_t)sizeof(dest)) == 0) {
	(void)strlcpy(dest, "(inet_ntop error)", sizeof(dest));
	}
	dest[sizeof(dest)-1] = 0;
	port = ntohs(((struct sockaddr_in*)addr)->sin_port);
	dname_str(zone, namebuf);
	if(af != AF_INET && af != AF_INET6)
	verbose(v, "%s <%s> %s%s#%d (addrlen %d)",
	str, namebuf, family, dest, (int)port, (int)addrlen);
	else verbose(v, "%s <%s> %s%s#%d",
	str, namebuf, family, dest, (int)port);
	}

	void log_err_addr(const char* str, const char* err,
	struct sockaddr_storage* addr, socklen_t addrlen)
	{
	uint16_t port;
	char dest[100];
	int af = (int)((struct sockaddr_in*)addr)->sin_family;
	void* sinaddr = &((struct sockaddr_in*)addr)->sin_addr;
	if(af == AF_INET6)
	sinaddr = &((struct sockaddr_in6*)addr)->sin6_addr;
	if(inet_ntop(af, sinaddr, dest, (socklen_t)sizeof(dest)) == 0) {
	(void)strlcpy(dest, "(inet_ntop error)", sizeof(dest));
	}
	dest[sizeof(dest)-1] = 0;
	port = ntohs(((struct sockaddr_in*)addr)->sin_port);
	if(verbosity >= 4)
	log_err("%s: %s for %s port %d (len %d)", str, err, dest,
	(int)port, (int)addrlen);
	else log_err("%s: %s for %s port %d", str, err, dest, (int)port);
	}

	int
	sockaddr_cmp(struct sockaddr_storage* addr1, socklen_t len1,
	struct sockaddr_storage* addr2, socklen_t len2)
	{
	struct sockaddr_in* p1_in = (struct sockaddr_in*)addr1;
	struct sockaddr_in* p2_in = (struct sockaddr_in*)addr2;
	struct sockaddr_in6* p1_in6 = (struct sockaddr_in6*)addr1;
	struct sockaddr_in6* p2_in6 = (struct sockaddr_in6*)addr2;
	if(len1 < len2)
	return -1;
	if(len1 > len2)
	return 1;
	log_assert(len1 == len2);
	if( p1_in->sin_family < p2_in->sin_family)
	return -1;
	if( p1_in->sin_family > p2_in->sin_family)
	return 1;
	log_assert( p1_in->sin_family == p2_in->sin_family );
	/* compare ip4 */
	if( p1_in->sin_family == AF_INET ) {
	/* just order it, ntohs not required */
	if(p1_in->sin_port < p2_in->sin_port)
	return -1;
	if(p1_in->sin_port > p2_in->sin_port)
	return 1;
	log_assert(p1_in->sin_port == p2_in->sin_port);
	return memcmp(&p1_in->sin_addr, &p2_in->sin_addr, INET_SIZE);
	} else if (p1_in6->sin6_family == AF_INET6) {
	/* just order it, ntohs not required */
	if(p1_in6->sin6_port < p2_in6->sin6_port)
	return -1;
	if(p1_in6->sin6_port > p2_in6->sin6_port)
	return 1;
	log_assert(p1_in6->sin6_port == p2_in6->sin6_port);
	return memcmp(&p1_in6->sin6_addr, &p2_in6->sin6_addr,
	INET6_SIZE);
	} else {
	/* eek unknown type, perform this comparison for sanity. */
	return memcmp(addr1, addr2, len1);
	}
	}

	int
	sockaddr_cmp_addr(struct sockaddr_storage* addr1, socklen_t len1,
	struct sockaddr_storage* addr2, socklen_t len2)
	{
	struct sockaddr_in* p1_in = (struct sockaddr_in*)addr1;
	struct sockaddr_in* p2_in = (struct sockaddr_in*)addr2;
	struct sockaddr_in6* p1_in6 = (struct sockaddr_in6*)addr1;
	struct sockaddr_in6* p2_in6 = (struct sockaddr_in6*)addr2;
	if(len1 < len2)
	return -1;
	if(len1 > len2)
	return 1;
	log_assert(len1 == len2);
	if( p1_in->sin_family < p2_in->sin_family)
	return -1;
	if( p1_in->sin_family > p2_in->sin_family)
	return 1;
	log_assert( p1_in->sin_family == p2_in->sin_family );
	/* compare ip4 */
	if( p1_in->sin_family == AF_INET ) {
	return memcmp(&p1_in->sin_addr, &p2_in->sin_addr, INET_SIZE);
	} else if (p1_in6->sin6_family == AF_INET6) {
	return memcmp(&p1_in6->sin6_addr, &p2_in6->sin6_addr,
	INET6_SIZE);
	} else {
	/* eek unknown type, perform this comparison for sanity. */
	return memcmp(addr1, addr2, len1);
	}
	}

	int
	addr_is_ip6(struct sockaddr_storage* addr, socklen_t len)
	{
	if(len == (socklen_t)sizeof(struct sockaddr_in6) &&
	((struct sockaddr_in6*)addr)->sin6_family == AF_INET6)
	return 1;
	else return 0;
	}

	void
	addr_mask(struct sockaddr_storage* addr, socklen_t len, int net)
	{
	uint8_t mask[8] = {0x0, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe};
	int i, max;
	uint8_t* s;
	if(addr_is_ip6(addr, len)) {
	s = (uint8_t)&((struct sockaddr_in6)addr)->sin6_addr;
	max = 128;
	} else {
	s = (uint8_t)&((struct sockaddr_in)addr)->sin_addr;
	max = 32;
	}
	if(net >= max)
	return;
	for(i=net/8+1; i<max/8; i++) {
	s[i] = 0;
	}
	s[net/8] &= mask[net&0x7];
	}

	int
	addr_in_common(struct sockaddr_storage* addr1, int net1,
	struct sockaddr_storage* addr2, int net2, socklen_t addrlen)
	{
	int min = (net1<net2)?net1:net2;
	int i, to;
	int match = 0;
	uint8_t* s1, *s2;
	if(addr_is_ip6(addr1, addrlen)) {
	s1 = (uint8_t)&((struct sockaddr_in6)addr1)->sin6_addr;
	s2 = (uint8_t)&((struct sockaddr_in6)addr2)->sin6_addr;
	to = 16;
	} else {
	s1 = (uint8_t)&((struct sockaddr_in)addr1)->sin_addr;
	s2 = (uint8_t)&((struct sockaddr_in)addr2)->sin_addr;
	to = 4;
	}
	/* match = bits_in_common(s1, s2, to); */
	for(i=0; i<to; i++) {
	if(s1[i] == s2[i]) {
	match += 8;
	} else {
	uint8_t z = s1[i]^s2[i];
	log_assert(z);
	while(!(z&0x80)) {
	match++;
	z<<=1;
	}
	break;
	}
	}
	if(match > min) match = min;
	return match;
	}

	void
	addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen,
	char* buf, size_t len)
	{
	int af = (int)((struct sockaddr_in*)addr)->sin_family;
	void* sinaddr = &((struct sockaddr_in*)addr)->sin_addr;
	if(addr_is_ip6(addr, addrlen))
	sinaddr = &((struct sockaddr_in6*)addr)->sin6_addr;
	if(inet_ntop(af, sinaddr, buf, (socklen_t)len) == 0) {
	snprintf(buf, len, "(inet_ntop_error)");
	}
	}

	int
	addr_is_ip4mapped(struct sockaddr_storage* addr, socklen_t addrlen)
	{
	/* prefix for ipv4 into ipv6 mapping is ::ffff:x.x.x.x */
	const uint8_t map_prefix[16] =
	{0,0,0,0, 0,0,0,0, 0,0,0xff,0xff, 0,0,0,0};
	uint8_t* s;
	if(!addr_is_ip6(addr, addrlen))
	return 0;
	/* s is 16 octet ipv6 address string */
	s = (uint8_t)&((struct sockaddr_in6)addr)->sin6_addr;
	return (memcmp(s, map_prefix, 12) == 0);
	}

	int addr_is_broadcast(struct sockaddr_storage* addr, socklen_t addrlen)
	{
	int af = (int)((struct sockaddr_in*)addr)->sin_family;
	void* sinaddr = &((struct sockaddr_in*)addr)->sin_addr;
	return af == AF_INET && addrlen>=(socklen_t)sizeof(struct sockaddr_in)
	&& memcmp(sinaddr, "\377\377\377\377", 4) == 0;
	}

	int addr_is_any(struct sockaddr_storage* addr, socklen_t addrlen)
	{
	int af = (int)((struct sockaddr_in*)addr)->sin_family;
	void* sinaddr = &((struct sockaddr_in*)addr)->sin_addr;
	void* sin6addr = &((struct sockaddr_in6*)addr)->sin6_addr;
	if(af == AF_INET && addrlen>=(socklen_t)sizeof(struct sockaddr_in)
	&& memcmp(sinaddr, "\000\000\000\000", 4) == 0)
	return 1;
	else if(af==AF_INET6 && addrlen>=(socklen_t)sizeof(struct sockaddr_in6)
	&& memcmp(sin6addr, "\000\000\000\000\000\000\000\000"
	"\000\000\000\000\000\000\000\000", 16) == 0)
	return 1;
	return 0;
	}

	void sock_list_insert(struct sock_list** list, struct sockaddr_storage* addr,
	socklen_t len, struct regional* region)
	{
	struct sock_list* add = (struct sock_list*)regional_alloc(region,
	sizeof(*add) - sizeof(add->addr) + (size_t)len);
	if(!add) {
	log_err("out of memory in socketlist insert");
	return;
	}
	log_assert(list);
	add->next = *list;
	add->len = len;
	*list = add;
	if(len) memmove(&add->addr, addr, len);
	}

	void sock_list_prepend(struct sock_list** list, struct sock_list* add)
	{
	struct sock_list* last = add;
	if(!last)
	return;
	while(last->next)
	last = last->next;
	last->next = *list;
	*list = add;
	}

	int sock_list_find(struct sock_list* list, struct sockaddr_storage* addr,
	socklen_t len)
	{
	while(list) {
	if(len == list->len) {
	if(len == 0 \|\| sockaddr_cmp_addr(addr, len,
	&list->addr, list->len) == 0)
	return 1;
	}
	list = list->next;
	}
	return 0;
	}

	void sock_list_merge(struct sock_list** list, struct regional* region,
	struct sock_list* add)
	{
	struct sock_list* p;
	for(p=add; p; p=p->next) {
	if(!sock_list_find(*list, &p->addr, p->len))
	sock_list_insert(list, &p->addr, p->len, region);
	}
	}

	void
	log_crypto_err(const char* str)
	{
	#ifdef HAVE_SSL
	/* error:[error code]:[library name]:[function name]:[reason string] */
	char buf[128];
	unsigned long e;
	ERR_error_string_n(ERR_get_error(), buf, sizeof(buf));
	log_err("%s crypto %s", str, buf);
	while( (e=ERR_get_error()) ) {
	ERR_error_string_n(e, buf, sizeof(buf));
	log_err("and additionally crypto %s", buf);
	}
	#else
	(void)str;
	#endif /* HAVE_SSL */
	}

	int
	listen_sslctx_setup(void* ctxt)
	{
	#ifdef HAVE_SSL
	SSL_CTX* ctx = (SSL_CTX*)ctxt;
	/* no SSLv2, SSLv3 because has defects */
	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)
	!= SSL_OP_NO_SSLv2){
	log_crypto_err("could not set SSL_OP_NO_SSLv2");
	return 0;
	}
	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)
	!= SSL_OP_NO_SSLv3){
	log_crypto_err("could not set SSL_OP_NO_SSLv3");
	return 0;
	}
	#if defined(SSL_OP_NO_TLSv1) && defined(SSL_OP_NO_TLSv1_1)
	/* if we have tls 1.1 disable 1.0 */
	if((SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1) & SSL_OP_NO_TLSv1)
	!= SSL_OP_NO_TLSv1){
	log_crypto_err("could not set SSL_OP_NO_TLSv1");
	return 0;
	}
	#endif
	#if defined(SSL_OP_NO_TLSv1_1) && defined(SSL_OP_NO_TLSv1_2)
	/* if we have tls 1.2 disable 1.1 */
	if((SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_1) & SSL_OP_NO_TLSv1_1)
	!= SSL_OP_NO_TLSv1_1){
	log_crypto_err("could not set SSL_OP_NO_TLSv1_1");
	return 0;
	}
	#endif
	#if defined(SHA256_DIGEST_LENGTH) && defined(USE_ECDSA)
	/* if we have sha256, set the cipher list to have no known vulns */
	if(!SSL_CTX_set_cipher_list(ctx, "TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"))
	log_crypto_err("could not set cipher list with SSL_CTX_set_cipher_list");
	#endif

	if((SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE) &
	SSL_OP_CIPHER_SERVER_PREFERENCE) !=
	SSL_OP_CIPHER_SERVER_PREFERENCE) {
	log_crypto_err("could not set SSL_OP_CIPHER_SERVER_PREFERENCE");
	return 0;
	}

	#ifdef HAVE_SSL_CTX_SET_SECURITY_LEVEL
	SSL_CTX_set_security_level(ctx, 0);
	#endif
	#else
	(void)ctxt;
	#endif /* HAVE_SSL */
	return 1;
	}

	void
	listen_sslctx_setup_2(void* ctxt)
	{
	#ifdef HAVE_SSL
	SSL_CTX* ctx = (SSL_CTX*)ctxt;
	(void)ctx;
	#if HAVE_DECL_SSL_CTX_SET_ECDH_AUTO
	if(!SSL_CTX_set_ecdh_auto(ctx,1)) {
	log_crypto_err("Error in SSL_CTX_ecdh_auto, not enabling ECDHE");
	}
	#elif defined(USE_ECDSA)
	if(1) {
	EC_KEY *ecdh = EC_KEY_new_by_curve_name (NID_X9_62_prime256v1);
	if (!ecdh) {
	log_crypto_err("could not find p256, not enabling ECDHE");
	} else {
	if (1 != SSL_CTX_set_tmp_ecdh (ctx, ecdh)) {
	log_crypto_err("Error in SSL_CTX_set_tmp_ecdh, not enabling ECDHE");
	}
	EC_KEY_free (ecdh);
	}
	}
	#endif
	#else
	(void)ctxt;
	#endif /* HAVE_SSL */
	}

	void* listen_sslctx_create(char* key, char* pem, char* verifypem)
	{
	#ifdef HAVE_SSL
	SSL_CTX* ctx = SSL_CTX_new(SSLv23_server_method());
	if(!ctx) {
	log_crypto_err("could not SSL_CTX_new");
	return NULL;
	}
	+ if(!key \|\| key[0] == 0) {
	+ log_err("error: no tls-service-key file specified");
	+ SSL_CTX_free(ctx);
	+ return NULL;
	+ }
	+ if(!pem \|\| pem[0] == 0) {
	+ log_err("error: no tls-service-pem file specified");
	+ SSL_CTX_free(ctx);
	+ return NULL;
	+ }
	if(!listen_sslctx_setup(ctx)) {
	SSL_CTX_free(ctx);
	return NULL;
	}
	if(!SSL_CTX_use_certificate_chain_file(ctx, pem)) {
	log_err("error for cert file: %s", pem);
	log_crypto_err("error in SSL_CTX use_certificate_chain_file");
	SSL_CTX_free(ctx);
	return NULL;
	}
	if(!SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM)) {
	log_err("error for private key file: %s", key);
	log_crypto_err("Error in SSL_CTX use_PrivateKey_file");
	SSL_CTX_free(ctx);
	return NULL;
	}
	if(!SSL_CTX_check_private_key(ctx)) {
	log_err("error for key file: %s", key);
	log_crypto_err("Error in SSL_CTX check_private_key");
	SSL_CTX_free(ctx);
	return NULL;
	}
	listen_sslctx_setup_2(ctx);
	if(verifypem && verifypem[0]) {
	if(!SSL_CTX_load_verify_locations(ctx, verifypem, NULL)) {
	log_crypto_err("Error in SSL_CTX verify locations");
	SSL_CTX_free(ctx);
	return NULL;
	}
	SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(
	verifypem));
	SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
	}
	return ctx;
	#else
	(void)key; (void)pem; (void)verifypem;
	return NULL;
	#endif
	}

	#ifdef USE_WINSOCK
	/* For windows, the CA trust store is not read by openssl.
	Add code to open the trust store using wincrypt API and add
	the root certs into openssl trust store */
	static int
	add_WIN_cacerts_to_openssl_store(SSL_CTX* tls_ctx)
	{
	HCERTSTORE hSystemStore;
	PCCERT_CONTEXT pTargetCert = NULL;
	X509_STORE* store;

	verbose(VERB_ALGO, "Adding Windows certificates from system root store to CA store");

	/* load just once per context lifetime for this version
	TODO: dynamically update CA trust changes as they are available */
	if (!tls_ctx)
	return 0;

	/* Call wincrypt's CertOpenStore to open the CA root store. */

	if ((hSystemStore = CertOpenStore(
	CERT_STORE_PROV_SYSTEM,
	0,
	0,
	/* NOTE: mingw does not have this const: replace with 1 << 16 from code
	CERT_SYSTEM_STORE_CURRENT_USER, */
	1 << 16,
	L"root")) == 0)
	{
	return 0;
	}

	store = SSL_CTX_get_cert_store(tls_ctx);
	if (!store)
	return 0;

	/* failure if the CA store is empty or the call fails */
	if ((pTargetCert = CertEnumCertificatesInStore(
	hSystemStore, pTargetCert)) == 0) {
	verbose(VERB_ALGO, "CA certificate store for Windows is empty.");
	return 0;
	}
	/* iterate over the windows cert store and add to openssl store */
	do
	{
	X509 *cert1 = d2i_X509(NULL,
	(const unsigned char **)&pTargetCert->pbCertEncoded,
	pTargetCert->cbCertEncoded);
	if (!cert1) {
	/* return error if a cert fails */
	verbose(VERB_ALGO, "%s %d:%s",
	"Unable to parse certificate in memory",
	(int)ERR_get_error(), ERR_error_string(ERR_get_error(), NULL));
	return 0;
	}
	else {
	/* return error if a cert add to store fails */
	if (X509_STORE_add_cert(store, cert1) == 0) {
	unsigned long error = ERR_peek_last_error();

	/* Ignore error X509_R_CERT_ALREADY_IN_HASH_TABLE which means the
	* certificate is already in the store. */
	if(ERR_GET_LIB(error) != ERR_LIB_X509 \|\|
	ERR_GET_REASON(error) != X509_R_CERT_ALREADY_IN_HASH_TABLE) {
	verbose(VERB_ALGO, "%s %d:%s\n",
	"Error adding certificate", (int)ERR_get_error(),
	ERR_error_string(ERR_get_error(), NULL));
	X509_free(cert1);
	return 0;
	}
	}
	X509_free(cert1);
	}
	} while ((pTargetCert = CertEnumCertificatesInStore(
	hSystemStore, pTargetCert)) != 0);

	/* Clean up memory and quit. */
	if (pTargetCert)
	CertFreeCertificateContext(pTargetCert);
	if (hSystemStore)
	{
	if (!CertCloseStore(
	hSystemStore, 0))
	return 0;
	}
	verbose(VERB_ALGO, "Completed adding Windows certificates to CA store successfully");
	return 1;
	}
	#endif /* USE_WINSOCK */

	void* connect_sslctx_create(char* key, char* pem, char* verifypem, int wincert)
	{
	#ifdef HAVE_SSL
	SSL_CTX* ctx = SSL_CTX_new(SSLv23_client_method());
	if(!ctx) {
	log_crypto_err("could not allocate SSL_CTX pointer");
	return NULL;
	}
	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)
	!= SSL_OP_NO_SSLv2) {
	log_crypto_err("could not set SSL_OP_NO_SSLv2");
	SSL_CTX_free(ctx);
	return NULL;
	}
	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)
	!= SSL_OP_NO_SSLv3) {
	log_crypto_err("could not set SSL_OP_NO_SSLv3");
	SSL_CTX_free(ctx);
	return NULL;
	}
	if(key && key[0]) {
	if(!SSL_CTX_use_certificate_chain_file(ctx, pem)) {
	log_err("error in client certificate %s", pem);
	log_crypto_err("error in certificate file");
	SSL_CTX_free(ctx);
	return NULL;
	}
	if(!SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM)) {
	log_err("error in client private key %s", key);
	log_crypto_err("error in key file");
	SSL_CTX_free(ctx);
	return NULL;
	}
	if(!SSL_CTX_check_private_key(ctx)) {
	log_err("error in client key %s", key);
	log_crypto_err("error in SSL_CTX_check_private_key");
	SSL_CTX_free(ctx);
	return NULL;
	}
	}
	if((verifypem && verifypem[0]) \|\| wincert) {
	if(verifypem && verifypem[0]) {
	if(!SSL_CTX_load_verify_locations(ctx, verifypem, NULL)) {
	log_crypto_err("error in SSL_CTX verify");
	SSL_CTX_free(ctx);
	return NULL;
	}
	}
	#ifdef USE_WINSOCK
	if(wincert) {
	if(!add_WIN_cacerts_to_openssl_store(ctx)) {
	log_crypto_err("error in add_WIN_cacerts_to_openssl_store");
	SSL_CTX_free(ctx);
	return NULL;
	}
	}
	#else
	(void)wincert;
	#endif
	SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
	}
	return ctx;
	#else
	(void)key; (void)pem; (void)verifypem; (void)wincert;
	return NULL;
	#endif
	}

	void* incoming_ssl_fd(void* sslctx, int fd)
	{
	#ifdef HAVE_SSL
	SSL* ssl = SSL_new((SSL_CTX*)sslctx);
	if(!ssl) {
	log_crypto_err("could not SSL_new");
	return NULL;
	}
	SSL_set_accept_state(ssl);
	(void)SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);
	if(!SSL_set_fd(ssl, fd)) {
	log_crypto_err("could not SSL_set_fd");
	SSL_free(ssl);
	return NULL;
	}
	return ssl;
	#else
	(void)sslctx; (void)fd;
	return NULL;
	#endif
	}

	void* outgoing_ssl_fd(void* sslctx, int fd)
	{
	#ifdef HAVE_SSL
	SSL* ssl = SSL_new((SSL_CTX*)sslctx);
	if(!ssl) {
	log_crypto_err("could not SSL_new");
	return NULL;
	}
	SSL_set_connect_state(ssl);
	(void)SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);
	if(!SSL_set_fd(ssl, fd)) {
	log_crypto_err("could not SSL_set_fd");
	SSL_free(ssl);
	return NULL;
	}
	return ssl;
	#else
	(void)sslctx; (void)fd;
	return NULL;
	#endif
	}

	#if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED) && defined(CRYPTO_LOCK) && OPENSSL_VERSION_NUMBER < 0x10100000L
	/** global lock list for openssl locks */
	static lock_basic_type *ub_openssl_locks = NULL;

	/** callback that gets thread id for openssl */
	+#ifdef HAVE_CRYPTO_THREADID_SET_CALLBACK
	+static void
	+ub_crypto_id_cb(CRYPTO_THREADID *id)
	+{
	+ CRYPTO_THREADID_set_numeric(id, (unsigned long)log_thread_get());
	+}
	+#else
	static unsigned long
	ub_crypto_id_cb(void)
	{
	return (unsigned long)log_thread_get();
	}
	+#endif

	static void
	ub_crypto_lock_cb(int mode, int type, const char *ATTR_UNUSED(file),
	int ATTR_UNUSED(line))
	{
	if((mode&CRYPTO_LOCK)) {
	lock_basic_lock(&ub_openssl_locks[type]);
	} else {
	lock_basic_unlock(&ub_openssl_locks[type]);
	}
	}
	#endif /* OPENSSL_THREADS */

	int ub_openssl_lock_init(void)
	{
	#if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED) && defined(CRYPTO_LOCK) && OPENSSL_VERSION_NUMBER < 0x10100000L
	int i;
	ub_openssl_locks = (lock_basic_type*)reallocarray(
	NULL, (size_t)CRYPTO_num_locks(), sizeof(lock_basic_type));
	if(!ub_openssl_locks)
	return 0;
	for(i=0; i<CRYPTO_num_locks(); i++) {
	lock_basic_init(&ub_openssl_locks[i]);
	}
	+# ifdef HAVE_CRYPTO_THREADID_SET_CALLBACK
	+ CRYPTO_THREADID_set_callback(&ub_crypto_id_cb);
	+# else
	CRYPTO_set_id_callback(&ub_crypto_id_cb);
	+# endif
	CRYPTO_set_locking_callback(&ub_crypto_lock_cb);
	#endif /* OPENSSL_THREADS */
	return 1;
	}

	void ub_openssl_lock_delete(void)
	{
	#if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED) && defined(CRYPTO_LOCK) && OPENSSL_VERSION_NUMBER < 0x10100000L
	int i;
	if(!ub_openssl_locks)
	return;
	+# ifdef HAVE_CRYPTO_THREADID_SET_CALLBACK
	+ CRYPTO_THREADID_set_callback(NULL);
	+# else
	CRYPTO_set_id_callback(NULL);
	+# endif
	CRYPTO_set_locking_callback(NULL);
	for(i=0; i<CRYPTO_num_locks(); i++) {
	lock_basic_destroy(&ub_openssl_locks[i]);
	}
	free(ub_openssl_locks);
	#endif /* OPENSSL_THREADS */
	}

	+int listen_sslctx_setup_ticket_keys(void* sslctx, struct config_strlist* tls_session_ticket_keys) {
	+#ifdef HAVE_SSL
	+ size_t s = 1;
	+ struct config_strlist* p;
	+ struct tls_session_ticket_key *keys;
	+ for(p = tls_session_ticket_keys; p; p = p->next) {
	+ s++;
	+ }
	+ keys = calloc(s, sizeof(struct tls_session_ticket_key));
	+ memset(keys, 0, ssizeof(keys));
	+ ticket_keys = keys;
	+
	+ for(p = tls_session_ticket_keys; p; p = p->next) {
	+ size_t n;
	+ unsigned char data = (unsigned char )malloc(80);
	+ FILE *f = fopen(p->str, "r");
	+ if(!f) {
	+ log_err("could not read tls-session-ticket-key %s: %s", p->str, strerror(errno));
	+ free(data);
	+ return 0;
	+ }
	+ n = fread(data, 1, 80, f);
	+ fclose(f);
	+
	+ if(n != 80) {
	+ log_err("tls-session-ticket-key %s is %d bytes, must be 80 bytes", p->str, (int)n);
	+ free(data);
	+ return 0;
	+ }
	+ verbose(VERB_OPS, "read tls-session-ticket-key: %s", p->str);
	+
	+ keys->key_name = data;
	+ keys->aes_key = data + 16;
	+ keys->hmac_key = data + 48;
	+ keys++;
	+ }
	+ /* terminate array with NULL key name entry */
	+ keys->key_name = NULL;
	+ if(SSL_CTX_set_tlsext_ticket_key_cb(sslctx, tls_session_ticket_key_cb) == 0) {
	+ log_err("no support for TLS session ticket");
	+ return 0;
	+ }
	+ return 1;
	+#else
	+ (void)sslctx;
	+ (void)tls_session_ticket_keys;
	+ return 0;
	+#endif
	+
	+}
	+
	+int tls_session_ticket_key_cb(void ATTR_UNUSED(sslctx), unsigned char key_name, unsigned char* iv, void evp_sctx, void hmac_ctx, int enc)
	+{
	+#ifdef HAVE_SSL
	+ const EVP_MD *digest;
	+ const EVP_CIPHER *cipher;
	+ int evp_cipher_length;
	+ digest = EVP_sha256();
	+ cipher = EVP_aes_256_cbc();
	+ evp_cipher_length = EVP_CIPHER_iv_length(cipher);
	+ if( enc == 1 ) {
	+ /* encrypt */
	+ verbose(VERB_CLIENT, "start session encrypt");
	+ memcpy(key_name, ticket_keys->key_name, 16);
	+ if (RAND_bytes(iv, evp_cipher_length) != 1) {
	+ verbose(VERB_CLIENT, "RAND_bytes failed");
	+ return -1;
	+ }
	+ if (EVP_EncryptInit_ex(evp_sctx, cipher, NULL, ticket_keys->aes_key, iv) != 1) {
	+ verbose(VERB_CLIENT, "EVP_EncryptInit_ex failed");
	+ return -1;
	+ }
	+ if (HMAC_Init_ex(hmac_ctx, ticket_keys->hmac_key, 32, digest, NULL) != 1) {
	+ verbose(VERB_CLIENT, "HMAC_Init_ex failed");
	+ return -1;
	+ }
	+ return 1;
	+ } else if (enc == 0) {
	+ /* decrypt */
	+ struct tls_session_ticket_key *key;
	+ verbose(VERB_CLIENT, "start session decrypt");
	+ for(key = ticket_keys; key->key_name != NULL; key++) {
	+ if (!memcmp(key_name, key->key_name, 16)) {
	+ verbose(VERB_CLIENT, "Found session_key");
	+ break;
	+ }
	+ }
	+ if(key->key_name == NULL) {
	+ verbose(VERB_CLIENT, "Not found session_key");
	+ return 0;
	+ }
	+
	+ if (HMAC_Init_ex(hmac_ctx, key->hmac_key, 32, digest, NULL) != 1) {
	+ verbose(VERB_CLIENT, "HMAC_Init_ex failed");
	+ return -1;
	+ }
	+ if (EVP_DecryptInit_ex(evp_sctx, cipher, NULL, key->aes_key, iv) != 1) {
	+ log_err("EVP_DecryptInit_ex failed");
	+ return -1;
	+ }
	+
	+ return (key == ticket_keys) ? 1 : 2;
	+ }
	+ return -1;
	+#else
	+ (void)key_name;
	+ (void)iv;
	+ (void)evp_sctx;
	+ (void)hmac_ctx;
	+ (void)enc;
	+ return 0;
	+#endif
	+}
	+
	+void
	+listen_sslctx_delete_ticket_keys(void)
	+{
	+ struct tls_session_ticket_key *key;
	+ if(!ticket_keys) return;
	+ for(key = ticket_keys; key->key_name != NULL; key++) {
	+ /* wipe key data from memory*/
	+#ifdef HAVE_EXPLICIT_BZERO
	+ explicit_bzero(key->key_name, 80);
	+#else
	+ memset(key->key_name, 0xdd, 80);
	+#endif
	+ free(key->key_name);
	+ }
	+ free(ticket_keys);
	+ ticket_keys = NULL;
	+}
	Index: head/contrib/unbound/util/net_help.h
	===================================================================
	--- head/contrib/unbound/util/net_help.h (revision 349719)
	+++ head/contrib/unbound/util/net_help.h (revision 349720)
	@@ -1,431 +1,467 @@
	/*
	* util/net_help.h - network help functions
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains functions to perform network related tasks.
	*/

	#ifndef NET_HELP_H
	#define NET_HELP_H
	#include "util/log.h"
	struct sock_list;
	struct regional;
	+struct config_strlist;

	/** DNS constants for uint16_t style flag manipulation. host byteorder.
	* 1 1 1 1 1 1
	* 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
	* +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
	* \|QR\| Opcode \|AA\|TC\|RD\|RA\| Z\|AD\|CD\| RCODE \|
	* +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
	*/
	/** CD flag */
	#define BIT_CD 0x0010
	/** AD flag */
	#define BIT_AD 0x0020
	/** Z flag */
	#define BIT_Z 0x0040
	/** RA flag */
	#define BIT_RA 0x0080
	/** RD flag */
	#define BIT_RD 0x0100
	/** TC flag */
	#define BIT_TC 0x0200
	/** AA flag */
	#define BIT_AA 0x0400
	/** QR flag */
	#define BIT_QR 0x8000
	/** get RCODE bits from uint16 flags */
	#define FLAGS_GET_RCODE(f) ((f) & 0xf)
	/** set RCODE bits in uint16 flags */
	#define FLAGS_SET_RCODE(f, r) (f = (((f) & 0xfff0) \| (r)))

	/** timeout in milliseconds for UDP queries to auth servers. */
	#define UDP_AUTH_QUERY_TIMEOUT 3000
	/** timeout in milliseconds for TCP queries to auth servers. */
	#define TCP_AUTH_QUERY_TIMEOUT 3000
	/** Advertised version of EDNS capabilities */
	#define EDNS_ADVERTISED_VERSION 0
	/** Advertised size of EDNS capabilities */
	extern uint16_t EDNS_ADVERTISED_SIZE;
	/** bits for EDNS bitfield */
	#define EDNS_DO 0x8000 /* Dnssec Ok */
	/** byte size of ip4 address */
	#define INET_SIZE 4
	/** byte size of ip6 address */
	#define INET6_SIZE 16

	/** DNSKEY zone sign key flag */
	#define DNSKEY_BIT_ZSK 0x0100
	/** DNSKEY secure entry point, KSK flag */
	#define DNSKEY_BIT_SEP 0x0001

	/** minimal responses when positive answer */
	extern int MINIMAL_RESPONSES;

	/** rrset order roundrobin */
	extern int RRSET_ROUNDROBIN;

	+/** log tag queries with name instead of 'info' for filtering */
	+extern int LOG_TAG_QUERYREPLY;
	+
	/**
	* See if string is ip4 or ip6.
	* @param str: IP specification.
	* @return: true if string addr is an ip6 specced address.
	*/
	int str_is_ip6(const char* str);

	/**
	* Set fd nonblocking.
	* @param s: file descriptor.
	* @return: 0 on error (error is printed to log).
	*/
	int fd_set_nonblock(int s);

	/**
	* Set fd (back to) blocking.
	* @param s: file descriptor.
	* @return: 0 on error (error is printed to log).
	*/
	int fd_set_block(int s);

	/**
	* See if number is a power of 2.
	* @param num: the value.
	* @return: true if the number is a power of 2.
	*/
	int is_pow2(size_t num);

	/**
	* Allocate memory and copy over contents.
	* @param data: what to copy over.
	* @param len: length of data.
	* @return: NULL on malloc failure, or newly malloced data.
	*/
	void* memdup(void* data, size_t len);

	/**
	* Prints the sockaddr in readable format with log_info. Debug helper.
	* @param v: at what verbosity level to print this.
	* @param str: descriptive string printed with it.
	* @param addr: the sockaddr to print. Can be ip4 or ip6.
	* @param addrlen: length of addr.
	*/
	void log_addr(enum verbosity_value v, const char* str,
	struct sockaddr_storage* addr, socklen_t addrlen);

	/**
	* Prints zone name and sockaddr in readable format with log_info. Debug.
	* @param v: at what verbosity level to print this.
	* @param str: descriptive string printed with it.
	* @param zone: DNS domain name, uncompressed wireformat.
	* @param addr: the sockaddr to print. Can be ip4 or ip6.
	* @param addrlen: length of addr.
	*/
	void log_name_addr(enum verbosity_value v, const char* str, uint8_t* zone,
	struct sockaddr_storage* addr, socklen_t addrlen);

	/**
	* Log errno and addr.
	* @param str: descriptive string printed with it.
	* @param err: errno string to print, i.e. strerror(errno).
	* @param addr: the sockaddr to print. Can be ip4 or ip6.
	* @param addrlen: length of addr.
	*/
	void log_err_addr(const char* str, const char* err,
	struct sockaddr_storage* addr, socklen_t addrlen);

	/**
	* Convert address string, with "@port" appendix, to sockaddr.
	* Uses DNS port by default.
	* @param str: the string
	* @param addr: where to store sockaddr.
	* @param addrlen: length of stored sockaddr is returned.
	* @return 0 on error.
	*/
	int extstrtoaddr(const char* str, struct sockaddr_storage* addr,
	socklen_t* addrlen);

	/**
	* Convert ip address string and port to sockaddr.
	* @param ip: ip4 or ip6 address string.
	* @param port: port number, host format.
	* @param addr: where to store sockaddr.
	* @param addrlen: length of stored sockaddr is returned.
	* @return 0 on error.
	*/
	int ipstrtoaddr(const char* ip, int port, struct sockaddr_storage* addr,
	socklen_t* addrlen);

	/**
	* Convert ip netblock (ip/netsize) string and port to sockaddr.
	* performs a copy internally to avoid writing over 'ip' string.
	* @param ip: ip4 or ip6 address string.
	* @param port: port number, host format.
	* @param addr: where to store sockaddr.
	* @param addrlen: length of stored sockaddr is returned.
	* @param net: netblock size is returned.
	* @return 0 on error.
	*/
	int netblockstrtoaddr(const char* ip, int port, struct sockaddr_storage* addr,
	socklen_t* addrlen, int* net);

	/**
	* Convert address string, with "@port" appendix, to sockaddr.
	* It can also have an "#tls-auth-name" appendix (after the port).
	* The returned tls-auth-name string is a pointer into the input string.
	* Uses DNS port by default.
	* @param str: the string
	* @param addr: where to store sockaddr.
	* @param addrlen: length of stored sockaddr is returned.
	* @param auth_name: returned pointer to tls_auth_name, or NULL if none.
	* @return 0 on error.
	*/
	int authextstrtoaddr(char* str, struct sockaddr_storage* addr,
	socklen_t* addrlen, char** auth_name);

	/**
	* Store port number into sockaddr structure
	* @param addr: sockaddr structure, ip4 or ip6.
	* @param addrlen: length of addr.
	* @param port: port number to put into the addr.
	*/
	void sockaddr_store_port(struct sockaddr_storage* addr, socklen_t addrlen,
	int port);

	/**
	* Print string with neat domain name, type and class.
	* @param v: at what verbosity level to print this.
	* @param str: string of message.
	* @param name: domain name uncompressed wireformat.
	* @param type: host format RR type.
	* @param dclass: host format RR class.
	*/
	void log_nametypeclass(enum verbosity_value v, const char* str,
	uint8_t* name, uint16_t type, uint16_t dclass);

	/**
	+ * Like log_nametypeclass, but logs with log_query for query logging
	+ */
	+void log_query_in(const char* str, uint8_t* name, uint16_t type,
	+ uint16_t dclass);
	+
	+/**
	* Compare two sockaddrs. Imposes an ordering on the addresses.
	* Compares address and port.
	* @param addr1: address 1.
	* @param len1: lengths of addr1.
	* @param addr2: address 2.
	* @param len2: lengths of addr2.
	* @return: 0 if addr1 == addr2. -1 if addr1 is smaller, +1 if larger.
	*/
	int sockaddr_cmp(struct sockaddr_storage* addr1, socklen_t len1,
	struct sockaddr_storage* addr2, socklen_t len2);

	/**
	* Compare two sockaddrs. Compares address, not the port.
	* @param addr1: address 1.
	* @param len1: lengths of addr1.
	* @param addr2: address 2.
	* @param len2: lengths of addr2.
	* @return: 0 if addr1 == addr2. -1 if addr1 is smaller, +1 if larger.
	*/
	int sockaddr_cmp_addr(struct sockaddr_storage* addr1, socklen_t len1,
	struct sockaddr_storage* addr2, socklen_t len2);

	/**
	* Checkout address family.
	* @param addr: the sockaddr to examine.
	* @param len: the length of addr.
	* @return: true if sockaddr is ip6.
	*/
	int addr_is_ip6(struct sockaddr_storage* addr, socklen_t len);

	/**
	* Make sure the sockaddr ends in zeroes. For tree insertion and subsequent
	* comparison.
	* @param addr: the ip4 or ip6 addr.
	* @param len: length of addr.
	* @param net: number of bits to leave untouched, the rest of the netblock
	* address is zeroed.
	*/
	void addr_mask(struct sockaddr_storage* addr, socklen_t len, int net);

	/**
	* See how many bits are shared, equal, between two addrs.
	* @param addr1: first addr.
	* @param net1: netblock size of first addr.
	* @param addr2: second addr.
	* @param net2: netblock size of second addr.
	* @param addrlen: length of first addr and of second addr.
	* They must be of the same length (i.e. same type IP4, IP6).
	* @return: number of bits the same.
	*/
	int addr_in_common(struct sockaddr_storage* addr1, int net1,
	struct sockaddr_storage* addr2, int net2, socklen_t addrlen);

	/**
	* Put address into string, works for IPv4 and IPv6.
	* @param addr: address
	* @param addrlen: length of address
	* @param buf: result string stored here
	* @param len: length of buf.
	* On failure a string with "error" is stored inside.
	*/
	void addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen,
	char* buf, size_t len);

	/**
	* See if sockaddr is an ipv6 mapped ipv4 address, "::ffff:0.0.0.0"
	* @param addr: address
	* @param addrlen: length of address
	* @return true if so
	*/
	int addr_is_ip4mapped(struct sockaddr_storage* addr, socklen_t addrlen);

	/**
	* See if sockaddr is 255.255.255.255.
	* @param addr: address
	* @param addrlen: length of address
	* @return true if so
	*/
	int addr_is_broadcast(struct sockaddr_storage* addr, socklen_t addrlen);

	/**
	* See if sockaddr is 0.0.0.0 or ::0.
	* @param addr: address
	* @param addrlen: length of address
	* @return true if so
	*/
	int addr_is_any(struct sockaddr_storage* addr, socklen_t addrlen);

	/**
	* Insert new socket list item. If fails logs error.
	* @param list: pointer to pointer to first item.
	* @param addr: address or NULL if 'cache'.
	* @param len: length of addr, or 0 if 'cache'.
	* @param region: where to allocate
	*/
	void sock_list_insert(struct sock_list** list, struct sockaddr_storage* addr,
	socklen_t len, struct regional* region);

	/**
	* Append one list to another. Must both be from same qstate(regional).
	* @param list: pointer to result list that is modified.
	* @param add: item(s) to add. They are prepended to list.
	*/
	void sock_list_prepend(struct sock_list** list, struct sock_list* add);

	/**
	* Find addr in list.
	* @param list: to search in
	* @param addr: address to look for.
	* @param len: length. Can be 0, look for 'cache entry'.
	* @return true if found.
	*/
	int sock_list_find(struct sock_list* list, struct sockaddr_storage* addr,
	socklen_t len);

	/**
	* Merge socklist into another socket list. Allocates the new entries
	* freshly and copies them over, so also performs a region switchover.
	* Allocation failures are logged.
	* @param list: the destination list (checked for duplicates)
	* @param region: where to allocate
	* @param add: the list of entries to add.
	*/
	void sock_list_merge(struct sock_list** list, struct regional* region,
	struct sock_list* add);

	/**
	* Log libcrypto error with descriptive string. Calls log_err().
	* @param str: what failed.
	*/
	void log_crypto_err(const char* str);

	/**
	* Set SSL_OP_NOxxx options on SSL context to disable bad crypto
	* @param ctxt: SSL_CTX*
	* @return false on failure.
	*/
	int listen_sslctx_setup(void* ctxt);

	/**
	* Further setup of listening SSL context, after keys loaded.
	* @param ctxt: SSL_CTX*
	*/
	void listen_sslctx_setup_2(void* ctxt);

	/**
	* create SSL listen context
	* @param key: private key file.
	* @param pem: public key cert.
	* @param verifypem: if nonNULL, verifylocation file.
	* return SSL_CTX* or NULL on failure (logged).
	*/
	void* listen_sslctx_create(char* key, char* pem, char* verifypem);

	/**
	* create SSL connect context
	* @param key: if nonNULL (also pem nonNULL), the client private key.
	* @param pem: client public key (or NULL if key is NULL).
	* @param verifypem: if nonNULL used for verifylocation file.
	* @param wincert: add system certificate store to ctx (add to verifypem ca
	* certs).
	* @return SSL_CTX* or NULL on failure (logged).
	*/
	void* connect_sslctx_create(char* key, char* pem, char* verifypem, int wincert);

	/**
	* accept a new fd and wrap it in a BIO in SSL
	* @param sslctx: the SSL_CTX to use (from listen_sslctx_create()).
	* @param fd: from accept, nonblocking.
	* @return SSL or NULL on alloc failure.
	*/
	void* incoming_ssl_fd(void* sslctx, int fd);

	/**
	* connect a new fd and wrap it in a BIO in SSL
	* @param sslctx: the SSL_CTX to use (from connect_sslctx_create())
	* @param fd: from connect.
	* @return SSL or NULL on alloc failure
	*/
	void* outgoing_ssl_fd(void* sslctx, int fd);

	/**
	* Initialize openssl locking for thread safety
	* @return false on failure (alloc failure).
	*/
	int ub_openssl_lock_init(void);

	/**
	* De-init the allocated openssl locks
	*/
	void ub_openssl_lock_delete(void);
	+
	+/**
	+ * setup TLS session ticket
	+ * @param sslctx: the SSL_CTX to use (from connect_sslctx_create())
	+ * @param tls_session_ticket_keys: TLS ticket secret filenames
	+ * @return false on failure (alloc failure).
	+ */
	+int listen_sslctx_setup_ticket_keys(void* sslctx,
	+ struct config_strlist* tls_session_ticket_keys);
	+
	+/**
	+ * callback TLS session ticket encrypt and decrypt
	+ * For use with SSL_CTX_set_tlsext_ticket_key_cb
	+ * @param s: the SSL_CTX to use (from connect_sslctx_create())
	+ * @param key_name: secret name, 16 bytes
	+ * @param iv: up to EVP_MAX_IV_LENGTH.
	+ * @param evp_ctx: the evp cipher context, function sets this.
	+ * @param hmac_ctx: the hmax context, function sets this.
	+ * @param enc: 1 is encrypt, 0 is decrypt
	+ * @return 0 on no ticket, 1 for okay, and 2 for okay but renew the ticket
	+ * (the ticket is decrypt only). and <0 for failures.
	+ */
	+int tls_session_ticket_key_cb(void s, unsigned char key_name,unsigned char* iv, void evp_ctx, void hmac_ctx, int enc);
	+
	+/** Free memory used for TLS session ticket keys */
	+void listen_sslctx_delete_ticket_keys(void);

	#endif /* NET_HELP_H */
	Index: head/contrib/unbound/util/netevent.c
	===================================================================
	--- head/contrib/unbound/util/netevent.c (revision 349719)
	+++ head/contrib/unbound/util/netevent.c (revision 349720)
	@@ -1,3300 +1,3419 @@
	/*
	* util/netevent.c - event notification
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains event notification functions.
	*/
	#include "config.h"
	#include "util/netevent.h"
	#include "util/ub_event.h"
	#include "util/log.h"
	#include "util/net_help.h"
	#include "util/tcp_conn_limit.h"
	#include "util/fptr_wlist.h"
	#include "sldns/pkthdr.h"
	#include "sldns/sbuffer.h"
	#include "sldns/str2wire.h"
	#include "dnstap/dnstap.h"
	#include "dnscrypt/dnscrypt.h"
	+#include "services/listen_dnsport.h"
	#ifdef HAVE_OPENSSL_SSL_H
	#include <openssl/ssl.h>
	#endif
	#ifdef HAVE_OPENSSL_ERR_H
	#include <openssl/err.h>
	#endif

	/* -------- Start of local definitions -------- */
	/** if CMSG_ALIGN is not defined on this platform, a workaround */
	#ifndef CMSG_ALIGN
	# ifdef __CMSG_ALIGN
	# define CMSG_ALIGN(n) __CMSG_ALIGN(n)
	# elif defined(CMSG_DATA_ALIGN)
	# define CMSG_ALIGN _CMSG_DATA_ALIGN
	# else
	# define CMSG_ALIGN(len) (((len)+sizeof(long)-1) & ~(sizeof(long)-1))
	# endif
	#endif

	/** if CMSG_LEN is not defined on this platform, a workaround */
	#ifndef CMSG_LEN
	# define CMSG_LEN(len) (CMSG_ALIGN(sizeof(struct cmsghdr))+(len))
	#endif

	/** if CMSG_SPACE is not defined on this platform, a workaround */
	#ifndef CMSG_SPACE
	# ifdef _CMSG_HDR_ALIGN
	# define CMSG_SPACE(l) (CMSG_ALIGN(l)+_CMSG_HDR_ALIGN(sizeof(struct cmsghdr)))
	# else
	# define CMSG_SPACE(l) (CMSG_ALIGN(l)+CMSG_ALIGN(sizeof(struct cmsghdr)))
	# endif
	#endif

	/** The TCP writing query timeout in milliseconds */
	#define TCP_QUERY_TIMEOUT 120000
	/** The minimum actual TCP timeout to use, regardless of what we advertise,
	* in msec */
	#define TCP_QUERY_TIMEOUT_MINIMUM 200

	#ifndef NONBLOCKING_IS_BROKEN
	/** number of UDP reads to perform per read indication from select */
	#define NUM_UDP_PER_SELECT 100
	#else
	#define NUM_UDP_PER_SELECT 1
	#endif

	/**
	* The internal event structure for keeping ub_event info for the event.
	* Possibly other structures (list, tree) this is part of.
	*/
	struct internal_event {
	/** the comm base */
	struct comm_base* base;
	/** ub_event event type */
	struct ub_event* ev;
	};

	/**
	* Internal base structure, so that every thread has its own events.
	*/
	struct internal_base {
	/** ub_event event_base type. */
	struct ub_event_base* base;
	/** seconds time pointer points here */
	time_t secs;
	/** timeval with current time */
	struct timeval now;
	/** the event used for slow_accept timeouts */
	struct ub_event* slow_accept;
	/** true if slow_accept is enabled */
	int slow_accept_enabled;
	};

	/**
	* Internal timer structure, to store timer event in.
	*/
	struct internal_timer {
	/** the super struct from which derived */
	struct comm_timer super;
	/** the comm base */
	struct comm_base* base;
	/** ub_event event type */
	struct ub_event* ev;
	/** is timer enabled */
	uint8_t enabled;
	};

	/**
	* Internal signal structure, to store signal event in.
	*/
	struct internal_signal {
	/** ub_event event type */
	struct ub_event* ev;
	/** next in signal list */
	struct internal_signal* next;
	};

	/** create a tcp handler with a parent */
	static struct comm_point* comm_point_create_tcp_handler(
	struct comm_base base, struct comm_point parent, size_t bufsize,
	- comm_point_callback_type* callback, void* callback_arg);
	+ struct sldns_buffer* spoolbuf, comm_point_callback_type* callback,
	+ void* callback_arg);

	/* -------- End of local definitions -------- */

	struct comm_base*
	comm_base_create(int sigs)
	{
	struct comm_base* b = (struct comm_base*)calloc(1,
	sizeof(struct comm_base));
	const char evnm="event", evsys="", *evmethod="";

	if(!b)
	return NULL;
	b->eb = (struct internal_base*)calloc(1, sizeof(struct internal_base));
	if(!b->eb) {
	free(b);
	return NULL;
	}
	b->eb->base = ub_default_event_base(sigs, &b->eb->secs, &b->eb->now);
	if(!b->eb->base) {
	free(b->eb);
	free(b);
	return NULL;
	}
	ub_comm_base_now(b);
	ub_get_event_sys(b->eb->base, &evnm, &evsys, &evmethod);
	- verbose(VERB_ALGO, "%s %s user %s method.", evnm, evsys, evmethod);
	+ verbose(VERB_ALGO, "%s %s uses %s method.", evnm, evsys, evmethod);
	return b;
	}

	struct comm_base*
	comm_base_create_event(struct ub_event_base* base)
	{
	struct comm_base* b = (struct comm_base*)calloc(1,
	sizeof(struct comm_base));
	if(!b)
	return NULL;
	b->eb = (struct internal_base*)calloc(1, sizeof(struct internal_base));
	if(!b->eb) {
	free(b);
	return NULL;
	}
	b->eb->base = base;
	ub_comm_base_now(b);
	return b;
	}

	void
	comm_base_delete(struct comm_base* b)
	{
	if(!b)
	return;
	if(b->eb->slow_accept_enabled) {
	if(ub_event_del(b->eb->slow_accept) != 0) {
	log_err("could not event_del slow_accept");
	}
	ub_event_free(b->eb->slow_accept);
	}
	ub_event_base_free(b->eb->base);
	b->eb->base = NULL;
	free(b->eb);
	free(b);
	}

	void
	comm_base_delete_no_base(struct comm_base* b)
	{
	if(!b)
	return;
	if(b->eb->slow_accept_enabled) {
	if(ub_event_del(b->eb->slow_accept) != 0) {
	log_err("could not event_del slow_accept");
	}
	ub_event_free(b->eb->slow_accept);
	}
	b->eb->base = NULL;
	free(b->eb);
	free(b);
	}

	void
	comm_base_timept(struct comm_base* b, time_t tt, struct timeval tv)
	{
	*tt = &b->eb->secs;
	*tv = &b->eb->now;
	}

	void
	comm_base_dispatch(struct comm_base* b)
	{
	int retval;
	retval = ub_event_base_dispatch(b->eb->base);
	if(retval < 0) {
	fatal_exit("event_dispatch returned error %d, "
	"errno is %s", retval, strerror(errno));
	}
	}

	void comm_base_exit(struct comm_base* b)
	{
	if(ub_event_base_loopexit(b->eb->base) != 0) {
	log_err("Could not loopexit");
	}
	}

	void comm_base_set_slow_accept_handlers(struct comm_base* b,
	void (stop_acc)(void), void (start_acc)(void), void* arg)
	{
	b->stop_accept = stop_acc;
	b->start_accept = start_acc;
	b->cb_arg = arg;
	}

	struct ub_event_base* comm_base_internal(struct comm_base* b)
	{
	return b->eb->base;
	}

	/** see if errno for udp has to be logged or not uses globals */
	static int
	udp_send_errno_needs_log(struct sockaddr* addr, socklen_t addrlen)
	{
	/* do not log transient errors (unless high verbosity) */
	#if defined(ENETUNREACH) \|\| defined(EHOSTDOWN) \|\| defined(EHOSTUNREACH) \|\| defined(ENETDOWN)
	switch(errno) {
	# ifdef ENETUNREACH
	case ENETUNREACH:
	# endif
	# ifdef EHOSTDOWN
	case EHOSTDOWN:
	# endif
	# ifdef EHOSTUNREACH
	case EHOSTUNREACH:
	# endif
	# ifdef ENETDOWN
	case ENETDOWN:
	# endif
	if(verbosity < VERB_ALGO)
	return 0;
	default:
	break;
	}
	#endif
	/* permission denied is gotten for every send if the
	* network is disconnected (on some OS), squelch it */
	if( ((errno == EPERM)
	# ifdef EADDRNOTAVAIL
	/* 'Cannot assign requested address' also when disconnected */
	\|\| (errno == EADDRNOTAVAIL)
	# endif
	) && verbosity < VERB_DETAIL)
	return 0;
	# ifdef EADDRINUSE
	/* If SO_REUSEADDR is set, we could try to connect to the same server
	* from the same source port twice. */
	if(errno == EADDRINUSE && verbosity < VERB_DETAIL)
	return 0;
	# endif
	/* squelch errors where people deploy AAAA ::ffff:bla for
	* authority servers, which we try for intranets. */
	if(errno == EINVAL && addr_is_ip4mapped(
	(struct sockaddr_storage*)addr, addrlen) &&
	verbosity < VERB_DETAIL)
	return 0;
	/* SO_BROADCAST sockopt can give access to 255.255.255.255,
	* but a dns cache does not need it. */
	if(errno == EACCES && addr_is_broadcast(
	(struct sockaddr_storage*)addr, addrlen) &&
	verbosity < VERB_DETAIL)
	return 0;
	return 1;
	}

	int tcp_connect_errno_needs_log(struct sockaddr* addr, socklen_t addrlen)
	{
	return udp_send_errno_needs_log(addr, addrlen);
	}

	/* send a UDP reply */
	int
	comm_point_send_udp_msg(struct comm_point c, sldns_buffer packet,
	struct sockaddr* addr, socklen_t addrlen)
	{
	ssize_t sent;
	log_assert(c->fd != -1);
	#ifdef UNBOUND_DEBUG
	if(sldns_buffer_remaining(packet) == 0)
	log_err("error: send empty UDP packet");
	#endif
	log_assert(addr && addrlen > 0);
	sent = sendto(c->fd, (void*)sldns_buffer_begin(packet),
	sldns_buffer_remaining(packet), 0,
	addr, addrlen);
	if(sent == -1) {
	/* try again and block, waiting for IO to complete,
	* we want to send the answer, and we will wait for
	* the ethernet interface buffer to have space. */
	#ifndef USE_WINSOCK
	if(errno == EAGAIN \|\|
	# ifdef EWOULDBLOCK
	errno == EWOULDBLOCK \|\|
	# endif
	errno == ENOBUFS) {
	#else
	if(WSAGetLastError() == WSAEINPROGRESS \|\|
	WSAGetLastError() == WSAENOBUFS \|\|
	WSAGetLastError() == WSAEWOULDBLOCK) {
	#endif
	int e;
	fd_set_block(c->fd);
	sent = sendto(c->fd, (void*)sldns_buffer_begin(packet),
	sldns_buffer_remaining(packet), 0,
	addr, addrlen);
	e = errno;
	fd_set_nonblock(c->fd);
	errno = e;
	}
	}
	if(sent == -1) {
	if(!udp_send_errno_needs_log(addr, addrlen))
	return 0;
	#ifndef USE_WINSOCK
	verbose(VERB_OPS, "sendto failed: %s", strerror(errno));
	#else
	verbose(VERB_OPS, "sendto failed: %s",
	wsa_strerror(WSAGetLastError()));
	#endif
	log_addr(VERB_OPS, "remote address is",
	(struct sockaddr_storage*)addr, addrlen);
	return 0;
	} else if((size_t)sent != sldns_buffer_remaining(packet)) {
	log_err("sent %d in place of %d bytes",
	(int)sent, (int)sldns_buffer_remaining(packet));
	return 0;
	}
	return 1;
	}

	#if defined(AF_INET6) && defined(IPV6_PKTINFO) && (defined(HAVE_RECVMSG) \|\| defined(HAVE_SENDMSG))
	/** print debug ancillary info */
	static void p_ancil(const char* str, struct comm_reply* r)
	{
	if(r->srctype != 4 && r->srctype != 6) {
	log_info("%s: unknown srctype %d", str, r->srctype);
	return;
	}
	if(r->srctype == 6) {
	char buf[1024];
	if(inet_ntop(AF_INET6, &r->pktinfo.v6info.ipi6_addr,
	buf, (socklen_t)sizeof(buf)) == 0) {
	(void)strlcpy(buf, "(inet_ntop error)", sizeof(buf));
	}
	buf[sizeof(buf)-1]=0;
	log_info("%s: %s %d", str, buf, r->pktinfo.v6info.ipi6_ifindex);
	} else if(r->srctype == 4) {
	#ifdef IP_PKTINFO
	char buf1[1024], buf2[1024];
	if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_addr,
	buf1, (socklen_t)sizeof(buf1)) == 0) {
	(void)strlcpy(buf1, "(inet_ntop error)", sizeof(buf1));
	}
	buf1[sizeof(buf1)-1]=0;
	#ifdef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST
	if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_spec_dst,
	buf2, (socklen_t)sizeof(buf2)) == 0) {
	(void)strlcpy(buf2, "(inet_ntop error)", sizeof(buf2));
	}
	buf2[sizeof(buf2)-1]=0;
	#else
	buf2[0]=0;
	#endif
	log_info("%s: %d %s %s", str, r->pktinfo.v4info.ipi_ifindex,
	buf1, buf2);
	#elif defined(IP_RECVDSTADDR)
	char buf1[1024];
	if(inet_ntop(AF_INET, &r->pktinfo.v4addr,
	buf1, (socklen_t)sizeof(buf1)) == 0) {
	(void)strlcpy(buf1, "(inet_ntop error)", sizeof(buf1));
	}
	buf1[sizeof(buf1)-1]=0;
	log_info("%s: %s", str, buf1);
	#endif /* IP_PKTINFO or PI_RECVDSTDADDR */
	}
	}
	#endif /* AF_INET6 && IPV6_PKTINFO && HAVE_RECVMSG\|\|HAVE_SENDMSG */

	/** send a UDP reply over specified interface*/
	static int
	comm_point_send_udp_msg_if(struct comm_point c, sldns_buffer packet,
	struct sockaddr* addr, socklen_t addrlen, struct comm_reply* r)
	{
	#if defined(AF_INET6) && defined(IPV6_PKTINFO) && defined(HAVE_SENDMSG)
	ssize_t sent;
	struct msghdr msg;
	struct iovec iov[1];
	char control[256];
	#ifndef S_SPLINT_S
	struct cmsghdr *cmsg;
	#endif /* S_SPLINT_S */

	log_assert(c->fd != -1);
	#ifdef UNBOUND_DEBUG
	if(sldns_buffer_remaining(packet) == 0)
	log_err("error: send empty UDP packet");
	#endif
	log_assert(addr && addrlen > 0);

	msg.msg_name = addr;
	msg.msg_namelen = addrlen;
	iov[0].iov_base = sldns_buffer_begin(packet);
	iov[0].iov_len = sldns_buffer_remaining(packet);
	msg.msg_iov = iov;
	msg.msg_iovlen = 1;
	msg.msg_control = control;
	#ifndef S_SPLINT_S
	msg.msg_controllen = sizeof(control);
	#endif /* S_SPLINT_S */
	msg.msg_flags = 0;

	#ifndef S_SPLINT_S
	cmsg = CMSG_FIRSTHDR(&msg);
	if(r->srctype == 4) {
	#ifdef IP_PKTINFO
	void* cmsg_data;
	msg.msg_controllen = CMSG_SPACE(sizeof(struct in_pktinfo));
	log_assert(msg.msg_controllen <= sizeof(control));
	cmsg->cmsg_level = IPPROTO_IP;
	cmsg->cmsg_type = IP_PKTINFO;
	memmove(CMSG_DATA(cmsg), &r->pktinfo.v4info,
	sizeof(struct in_pktinfo));
	/* unset the ifindex to not bypass the routing tables */
	cmsg_data = CMSG_DATA(cmsg);
	((struct in_pktinfo *) cmsg_data)->ipi_ifindex = 0;
	cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
	#elif defined(IP_SENDSRCADDR)
	msg.msg_controllen = CMSG_SPACE(sizeof(struct in_addr));
	log_assert(msg.msg_controllen <= sizeof(control));
	cmsg->cmsg_level = IPPROTO_IP;
	cmsg->cmsg_type = IP_SENDSRCADDR;
	memmove(CMSG_DATA(cmsg), &r->pktinfo.v4addr,
	sizeof(struct in_addr));
	cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
	#else
	verbose(VERB_ALGO, "no IP_PKTINFO or IP_SENDSRCADDR");
	msg.msg_control = NULL;
	#endif /* IP_PKTINFO or IP_SENDSRCADDR */
	} else if(r->srctype == 6) {
	void* cmsg_data;
	msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo));
	log_assert(msg.msg_controllen <= sizeof(control));
	cmsg->cmsg_level = IPPROTO_IPV6;
	cmsg->cmsg_type = IPV6_PKTINFO;
	memmove(CMSG_DATA(cmsg), &r->pktinfo.v6info,
	sizeof(struct in6_pktinfo));
	/* unset the ifindex to not bypass the routing tables */
	cmsg_data = CMSG_DATA(cmsg);
	((struct in6_pktinfo *) cmsg_data)->ipi6_ifindex = 0;
	cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
	} else {
	/* try to pass all 0 to use default route */
	msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo));
	log_assert(msg.msg_controllen <= sizeof(control));
	cmsg->cmsg_level = IPPROTO_IPV6;
	cmsg->cmsg_type = IPV6_PKTINFO;
	memset(CMSG_DATA(cmsg), 0, sizeof(struct in6_pktinfo));
	cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
	}
	#endif /* S_SPLINT_S */
	if(verbosity >= VERB_ALGO)
	p_ancil("send_udp over interface", r);
	sent = sendmsg(c->fd, &msg, 0);
	if(sent == -1) {
	/* try again and block, waiting for IO to complete,
	* we want to send the answer, and we will wait for
	* the ethernet interface buffer to have space. */
	#ifndef USE_WINSOCK
	if(errno == EAGAIN \|\|
	# ifdef EWOULDBLOCK
	errno == EWOULDBLOCK \|\|
	# endif
	errno == ENOBUFS) {
	#else
	if(WSAGetLastError() == WSAEINPROGRESS \|\|
	WSAGetLastError() == WSAENOBUFS \|\|
	WSAGetLastError() == WSAEWOULDBLOCK) {
	#endif
	int e;
	fd_set_block(c->fd);
	sent = sendmsg(c->fd, &msg, 0);
	e = errno;
	fd_set_nonblock(c->fd);
	errno = e;
	}
	}
	if(sent == -1) {
	if(!udp_send_errno_needs_log(addr, addrlen))
	return 0;
	verbose(VERB_OPS, "sendmsg failed: %s", strerror(errno));
	log_addr(VERB_OPS, "remote address is",
	(struct sockaddr_storage*)addr, addrlen);
	#ifdef __NetBSD__
	/* netbsd 7 has IP_PKTINFO for recv but not send */
	if(errno == EINVAL && r->srctype == 4)
	log_err("sendmsg: No support for sendmsg(IP_PKTINFO). "
	"Please disable interface-automatic");
	#endif
	return 0;
	} else if((size_t)sent != sldns_buffer_remaining(packet)) {
	log_err("sent %d in place of %d bytes",
	(int)sent, (int)sldns_buffer_remaining(packet));
	return 0;
	}
	return 1;
	#else
	(void)c;
	(void)packet;
	(void)addr;
	(void)addrlen;
	(void)r;
	log_err("sendmsg: IPV6_PKTINFO not supported");
	return 0;
	#endif /* AF_INET6 && IPV6_PKTINFO && HAVE_SENDMSG */
	}

	void
	comm_point_udp_ancil_callback(int fd, short event, void* arg)
	{
	#if defined(AF_INET6) && defined(IPV6_PKTINFO) && defined(HAVE_RECVMSG)
	struct comm_reply rep;
	struct msghdr msg;
	struct iovec iov[1];
	ssize_t rcv;
	char ancil[256];
	int i;
	#ifndef S_SPLINT_S
	struct cmsghdr* cmsg;
	#endif /* S_SPLINT_S */

	rep.c = (struct comm_point*)arg;
	log_assert(rep.c->type == comm_udp);

	if(!(event&UB_EV_READ))
	return;
	log_assert(rep.c && rep.c->buffer && rep.c->fd == fd);
	ub_comm_base_now(rep.c->ev->base);
	for(i=0; i<NUM_UDP_PER_SELECT; i++) {
	sldns_buffer_clear(rep.c->buffer);
	rep.addrlen = (socklen_t)sizeof(rep.addr);
	log_assert(fd != -1);
	log_assert(sldns_buffer_remaining(rep.c->buffer) > 0);
	msg.msg_name = &rep.addr;
	msg.msg_namelen = (socklen_t)sizeof(rep.addr);
	iov[0].iov_base = sldns_buffer_begin(rep.c->buffer);
	iov[0].iov_len = sldns_buffer_remaining(rep.c->buffer);
	msg.msg_iov = iov;
	msg.msg_iovlen = 1;
	msg.msg_control = ancil;
	#ifndef S_SPLINT_S
	msg.msg_controllen = sizeof(ancil);
	#endif /* S_SPLINT_S */
	msg.msg_flags = 0;
	rcv = recvmsg(fd, &msg, 0);
	if(rcv == -1) {
	if(errno != EAGAIN && errno != EINTR) {
	log_err("recvmsg failed: %s", strerror(errno));
	}
	return;
	}
	rep.addrlen = msg.msg_namelen;
	sldns_buffer_skip(rep.c->buffer, rcv);
	sldns_buffer_flip(rep.c->buffer);
	rep.srctype = 0;
	#ifndef S_SPLINT_S
	for(cmsg = CMSG_FIRSTHDR(&msg); cmsg != NULL;
	cmsg = CMSG_NXTHDR(&msg, cmsg)) {
	if( cmsg->cmsg_level == IPPROTO_IPV6 &&
	cmsg->cmsg_type == IPV6_PKTINFO) {
	rep.srctype = 6;
	memmove(&rep.pktinfo.v6info, CMSG_DATA(cmsg),
	sizeof(struct in6_pktinfo));
	break;
	#ifdef IP_PKTINFO
	} else if( cmsg->cmsg_level == IPPROTO_IP &&
	cmsg->cmsg_type == IP_PKTINFO) {
	rep.srctype = 4;
	memmove(&rep.pktinfo.v4info, CMSG_DATA(cmsg),
	sizeof(struct in_pktinfo));
	break;
	#elif defined(IP_RECVDSTADDR)
	} else if( cmsg->cmsg_level == IPPROTO_IP &&
	cmsg->cmsg_type == IP_RECVDSTADDR) {
	rep.srctype = 4;
	memmove(&rep.pktinfo.v4addr, CMSG_DATA(cmsg),
	sizeof(struct in_addr));
	break;
	#endif /* IP_PKTINFO or IP_RECVDSTADDR */
	}
	}
	if(verbosity >= VERB_ALGO)
	p_ancil("receive_udp on interface", &rep);
	#endif /* S_SPLINT_S */
	fptr_ok(fptr_whitelist_comm_point(rep.c->callback));
	if((*rep.c->callback)(rep.c, rep.c->cb_arg, NETEVENT_NOERROR, &rep)) {
	/* send back immediate reply */
	(void)comm_point_send_udp_msg_if(rep.c, rep.c->buffer,
	(struct sockaddr*)&rep.addr, rep.addrlen, &rep);
	}
	if(!rep.c \|\| rep.c->fd == -1) /* commpoint closed */
	break;
	}
	#else
	(void)fd;
	(void)event;
	(void)arg;
	fatal_exit("recvmsg: No support for IPV6_PKTINFO; IP_PKTINFO or IP_RECVDSTADDR. "
	"Please disable interface-automatic");
	#endif /* AF_INET6 && IPV6_PKTINFO && HAVE_RECVMSG */
	}

	void
	comm_point_udp_callback(int fd, short event, void* arg)
	{
	struct comm_reply rep;
	ssize_t rcv;
	int i;
	struct sldns_buffer *buffer;

	rep.c = (struct comm_point*)arg;
	log_assert(rep.c->type == comm_udp);

	if(!(event&UB_EV_READ))
	return;
	log_assert(rep.c && rep.c->buffer && rep.c->fd == fd);
	ub_comm_base_now(rep.c->ev->base);
	for(i=0; i<NUM_UDP_PER_SELECT; i++) {
	sldns_buffer_clear(rep.c->buffer);
	rep.addrlen = (socklen_t)sizeof(rep.addr);
	log_assert(fd != -1);
	log_assert(sldns_buffer_remaining(rep.c->buffer) > 0);
	rcv = recvfrom(fd, (void*)sldns_buffer_begin(rep.c->buffer),
	sldns_buffer_remaining(rep.c->buffer), 0,
	(struct sockaddr*)&rep.addr, &rep.addrlen);
	if(rcv == -1) {
	#ifndef USE_WINSOCK
	if(errno != EAGAIN && errno != EINTR)
	log_err("recvfrom %d failed: %s",
	fd, strerror(errno));
	#else
	if(WSAGetLastError() != WSAEINPROGRESS &&
	WSAGetLastError() != WSAECONNRESET &&
	WSAGetLastError()!= WSAEWOULDBLOCK)
	log_err("recvfrom failed: %s",
	wsa_strerror(WSAGetLastError()));
	#endif
	return;
	}
	sldns_buffer_skip(rep.c->buffer, rcv);
	sldns_buffer_flip(rep.c->buffer);
	rep.srctype = 0;
	fptr_ok(fptr_whitelist_comm_point(rep.c->callback));
	if((*rep.c->callback)(rep.c, rep.c->cb_arg, NETEVENT_NOERROR, &rep)) {
	/* send back immediate reply */
	#ifdef USE_DNSCRYPT
	buffer = rep.c->dnscrypt_buffer;
	#else
	buffer = rep.c->buffer;
	#endif
	(void)comm_point_send_udp_msg(rep.c, buffer,
	(struct sockaddr*)&rep.addr, rep.addrlen);
	}
	if(!rep.c \|\| rep.c->fd != fd) /* commpoint closed to -1 or reused for
	another UDP port. Note rep.c cannot be reused with TCP fd. */
	break;
	}
	}

	/** Use a new tcp handler for new query fd, set to read query */
	static void
	setup_tcp_handler(struct comm_point* c, int fd, int cur, int max)
	{
	int handler_usage;
	log_assert(c->type == comm_tcp);
	log_assert(c->fd == -1);
	sldns_buffer_clear(c->buffer);
	#ifdef USE_DNSCRYPT
	if (c->dnscrypt)
	sldns_buffer_clear(c->dnscrypt_buffer);
	#endif
	c->tcp_is_reading = 1;
	c->tcp_byte_count = 0;
	/* if more than half the tcp handlers are in use, use a shorter
	* timeout for this TCP connection, we need to make space for
	* other connections to be able to get attention */
	/* If > 50% TCP handler structures in use, set timeout to 1/100th
	* configured value.
	* If > 65%TCP handler structures in use, set to 1/500th configured
	* value.
	* If > 80% TCP handler structures in use, set to 0.
	*
	* If the timeout to use falls below 200 milliseconds, an actual
	* timeout of 200ms is used.
	*/
	handler_usage = (cur * 100) / max;
	if(handler_usage > 50 && handler_usage <= 65)
	c->tcp_timeout_msec /= 100;
	else if (handler_usage > 65 && handler_usage <= 80)
	c->tcp_timeout_msec /= 500;
	else if (handler_usage > 80)
	c->tcp_timeout_msec = 0;
	comm_point_start_listening(c, fd,
	c->tcp_timeout_msec < TCP_QUERY_TIMEOUT_MINIMUM
	? TCP_QUERY_TIMEOUT_MINIMUM
	: c->tcp_timeout_msec);
	}

	void comm_base_handle_slow_accept(int ATTR_UNUSED(fd),
	short ATTR_UNUSED(event), void* arg)
	{
	struct comm_base* b = (struct comm_base*)arg;
	/* timeout for the slow accept, re-enable accepts again */
	if(b->start_accept) {
	verbose(VERB_ALGO, "wait is over, slow accept disabled");
	fptr_ok(fptr_whitelist_start_accept(b->start_accept));
	(*b->start_accept)(b->cb_arg);
	b->eb->slow_accept_enabled = 0;
	}
	}

	int comm_point_perform_accept(struct comm_point* c,
	struct sockaddr_storage* addr, socklen_t* addrlen)
	{
	int new_fd;
	addrlen = (socklen_t)sizeof(addr);
	#ifndef HAVE_ACCEPT4
	new_fd = accept(c->fd, (struct sockaddr*)addr, addrlen);
	#else
	/* SOCK_NONBLOCK saves extra calls to fcntl for the same result */
	new_fd = accept4(c->fd, (struct sockaddr*)addr, addrlen, SOCK_NONBLOCK);
	#endif
	if(new_fd == -1) {
	#ifndef USE_WINSOCK
	/* EINTR is signal interrupt. others are closed connection. */
	if( errno == EINTR \|\| errno == EAGAIN
	#ifdef EWOULDBLOCK
	\|\| errno == EWOULDBLOCK
	#endif
	#ifdef ECONNABORTED
	\|\| errno == ECONNABORTED
	#endif
	#ifdef EPROTO
	\|\| errno == EPROTO
	#endif /* EPROTO */
	)
	return -1;
	#if defined(ENFILE) && defined(EMFILE)
	if(errno == ENFILE \|\| errno == EMFILE) {
	/* out of file descriptors, likely outside of our
	* control. stop accept() calls for some time */
	if(c->ev->base->stop_accept) {
	struct comm_base* b = c->ev->base;
	struct timeval tv;
	verbose(VERB_ALGO, "out of file descriptors: "
	"slow accept");
	b->eb->slow_accept_enabled = 1;
	fptr_ok(fptr_whitelist_stop_accept(
	b->stop_accept));
	(*b->stop_accept)(b->cb_arg);
	/* set timeout, no mallocs */
	tv.tv_sec = NETEVENT_SLOW_ACCEPT_TIME/1000;
	tv.tv_usec = (NETEVENT_SLOW_ACCEPT_TIME%1000)*1000;
	b->eb->slow_accept = ub_event_new(b->eb->base,
	-1, UB_EV_TIMEOUT,
	comm_base_handle_slow_accept, b);
	if(b->eb->slow_accept == NULL) {
	/* we do not want to log here, because
	* that would spam the logfiles.
	* error: "event_base_set failed." */
	}
	else if(ub_event_add(b->eb->slow_accept, &tv)
	!= 0) {
	/* we do not want to log here,
	* error: "event_add failed." */
	}
	}
	return -1;
	}
	#endif
	log_err_addr("accept failed", strerror(errno), addr, *addrlen);
	#else /* USE_WINSOCK */
	if(WSAGetLastError() == WSAEINPROGRESS \|\|
	WSAGetLastError() == WSAECONNRESET)
	return -1;
	if(WSAGetLastError() == WSAEWOULDBLOCK) {
	ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ);
	return -1;
	}
	log_err_addr("accept failed", wsa_strerror(WSAGetLastError()),
	addr, *addrlen);
	#endif
	return -1;
	}
	if(c->tcp_conn_limit && c->type == comm_tcp_accept) {
	c->tcl_addr = tcl_addr_lookup(c->tcp_conn_limit, addr, *addrlen);
	if(!tcl_new_connection(c->tcl_addr)) {
	if(verbosity >= 3)
	log_err_addr("accept rejected",
	"connection limit exceeded", addr, *addrlen);
	close(new_fd);
	return -1;
	}
	}
	#ifndef HAVE_ACCEPT4
	fd_set_nonblock(new_fd);
	#endif
	return new_fd;
	}

	#ifdef USE_WINSOCK
	static long win_bio_cb(BIO b, int oper, const char ATTR_UNUSED(argp),
	int ATTR_UNUSED(argi), long argl, long retvalue)
	{
	int wsa_err = WSAGetLastError(); /* store errcode before it is gone */
	verbose(VERB_ALGO, "bio_cb %d, %s %s %s", oper,
	(oper&BIO_CB_RETURN)?"return":"before",
	(oper&BIO_CB_READ)?"read":((oper&BIO_CB_WRITE)?"write":"other"),
	wsa_err==WSAEWOULDBLOCK?"wsawb":"");
	/* on windows, check if previous operation caused EWOULDBLOCK */
	if( (oper == (BIO_CB_READ\|BIO_CB_RETURN) && argl == 0) \|\|
	(oper == (BIO_CB_GETS\|BIO_CB_RETURN) && argl == 0)) {
	if(wsa_err == WSAEWOULDBLOCK)
	ub_winsock_tcp_wouldblock((struct ub_event*)
	BIO_get_callback_arg(b), UB_EV_READ);
	}
	if( (oper == (BIO_CB_WRITE\|BIO_CB_RETURN) && argl == 0) \|\|
	(oper == (BIO_CB_PUTS\|BIO_CB_RETURN) && argl == 0)) {
	if(wsa_err == WSAEWOULDBLOCK)
	ub_winsock_tcp_wouldblock((struct ub_event*)
	BIO_get_callback_arg(b), UB_EV_WRITE);
	}
	/* return original return value */
	return retvalue;
	}

	/** set win bio callbacks for nonblocking operations */
	void
	comm_point_tcp_win_bio_cb(struct comm_point* c, void* thessl)
	{
	SSL* ssl = (SSL*)thessl;
	/* set them both just in case, but usually they are the same BIO */
	BIO_set_callback(SSL_get_rbio(ssl), &win_bio_cb);
	BIO_set_callback_arg(SSL_get_rbio(ssl), (char*)c->ev->ev);
	BIO_set_callback(SSL_get_wbio(ssl), &win_bio_cb);
	BIO_set_callback_arg(SSL_get_wbio(ssl), (char*)c->ev->ev);
	}
	#endif

	void
	comm_point_tcp_accept_callback(int fd, short event, void* arg)
	{
	struct comm_point* c = (struct comm_point)arg, c_hdl;
	int new_fd;
	log_assert(c->type == comm_tcp_accept);
	if(!(event & UB_EV_READ)) {
	log_info("ignoring tcp accept event %d", (int)event);
	return;
	}
	ub_comm_base_now(c->ev->base);
	/* find free tcp handler. */
	if(!c->tcp_free) {
	log_warn("accepted too many tcp, connections full");
	return;
	}
	/* accept incoming connection. */
	c_hdl = c->tcp_free;
	+ /* clear leftover flags from previous use, and then set the
	+ * correct event base for the event structure for libevent */
	+ ub_event_free(c_hdl->ev->ev);
	+ c_hdl->ev->ev = ub_event_new(c_hdl->ev->base->eb->base, -1, UB_EV_PERSIST \| UB_EV_READ \| UB_EV_TIMEOUT, comm_point_tcp_handle_callback, c_hdl);
	+ if(!c_hdl->ev->ev) {
	+ log_warn("could not ub_event_new, dropped tcp");
	+ return;
	+ }
	log_assert(fd != -1);
	(void)fd;
	new_fd = comm_point_perform_accept(c, &c_hdl->repinfo.addr,
	&c_hdl->repinfo.addrlen);
	if(new_fd == -1)
	return;
	if(c->ssl) {
	c_hdl->ssl = incoming_ssl_fd(c->ssl, new_fd);
	if(!c_hdl->ssl) {
	c_hdl->fd = new_fd;
	comm_point_close(c_hdl);
	return;
	}
	c_hdl->ssl_shake_state = comm_ssl_shake_read;
	#ifdef USE_WINSOCK
	comm_point_tcp_win_bio_cb(c_hdl, c_hdl->ssl);
	#endif
	}

	/* grab the tcp handler buffers */
	c->cur_tcp_count++;
	c->tcp_free = c_hdl->tcp_free;
	if(!c->tcp_free) {
	/* stop accepting incoming queries for now. */
	comm_point_stop_listening(c);
	}
	setup_tcp_handler(c_hdl, new_fd, c->cur_tcp_count, c->max_tcp_count);
	}

	/** Make tcp handler free for next assignment */
	static void
	reclaim_tcp_handler(struct comm_point* c)
	{
	log_assert(c->type == comm_tcp);
	if(c->ssl) {
	#ifdef HAVE_SSL
	SSL_shutdown(c->ssl);
	SSL_free(c->ssl);
	c->ssl = NULL;
	#endif
	}
	comm_point_close(c);
	if(c->tcp_parent) {
	c->tcp_parent->cur_tcp_count--;
	c->tcp_free = c->tcp_parent->tcp_free;
	c->tcp_parent->tcp_free = c;
	if(!c->tcp_free) {
	/* re-enable listening on accept socket */
	comm_point_start_listening(c->tcp_parent, -1, -1);
	}
	}
	}

	/** do the callback when writing is done */
	static void
	tcp_callback_writer(struct comm_point* c)
	{
	log_assert(c->type == comm_tcp);
	sldns_buffer_clear(c->buffer);
	if(c->tcp_do_toggle_rw)
	c->tcp_is_reading = 1;
	c->tcp_byte_count = 0;
	/* switch from listening(write) to listening(read) */
	- comm_point_stop_listening(c);
	- comm_point_start_listening(c, -1, -1);
	+ if(c->tcp_req_info) {
	+ tcp_req_info_handle_writedone(c->tcp_req_info);
	+ } else {
	+ comm_point_stop_listening(c);
	+ comm_point_start_listening(c, -1, -1);
	+ }
	}

	/** do the callback when reading is done */
	static void
	tcp_callback_reader(struct comm_point* c)
	{
	log_assert(c->type == comm_tcp \|\| c->type == comm_local);
	sldns_buffer_flip(c->buffer);
	if(c->tcp_do_toggle_rw)
	c->tcp_is_reading = 0;
	c->tcp_byte_count = 0;
	- if(c->type == comm_tcp)
	- comm_point_stop_listening(c);
	- fptr_ok(fptr_whitelist_comm_point(c->callback));
	- if( (*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, &c->repinfo) ) {
	- comm_point_start_listening(c, -1, c->tcp_timeout_msec);
	+ if(c->tcp_req_info) {
	+ tcp_req_info_handle_readdone(c->tcp_req_info);
	+ } else {
	+ if(c->type == comm_tcp)
	+ comm_point_stop_listening(c);
	+ fptr_ok(fptr_whitelist_comm_point(c->callback));
	+ if( (*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, &c->repinfo) ) {
	+ comm_point_start_listening(c, -1, c->tcp_timeout_msec);
	+ }
	}
	}

	#ifdef HAVE_SSL
	/** log certificate details */
	static void
	log_cert(unsigned level, const char* str, X509* cert)
	{
	BIO* bio;
	char nul = 0;
	char* pp = NULL;
	long len;
	if(verbosity < level) return;
	bio = BIO_new(BIO_s_mem());
	if(!bio) return;
	X509_print_ex(bio, cert, 0, (unsigned long)-1
	^(X509_FLAG_NO_SUBJECT
	\|X509_FLAG_NO_ISSUER\|X509_FLAG_NO_VALIDITY
	\|X509_FLAG_NO_EXTENSIONS\|X509_FLAG_NO_AUX
	\|X509_FLAG_NO_ATTRIBUTES));
	BIO_write(bio, &nul, (int)sizeof(nul));
	len = BIO_get_mem_data(bio, &pp);
	if(len != 0 && pp) {
	verbose(level, "%s: \n%s", str, pp);
	}
	BIO_free(bio);
	}
	#endif /* HAVE_SSL */

	/** continue ssl handshake */
	#ifdef HAVE_SSL
	static int
	ssl_handshake(struct comm_point* c)
	{
	int r;
	if(c->ssl_shake_state == comm_ssl_shake_hs_read) {
	/* read condition satisfied back to writing */
	comm_point_listen_for_rw(c, 1, 1);
	c->ssl_shake_state = comm_ssl_shake_none;
	return 1;
	}
	if(c->ssl_shake_state == comm_ssl_shake_hs_write) {
	/* write condition satisfied, back to reading */
	comm_point_listen_for_rw(c, 1, 0);
	c->ssl_shake_state = comm_ssl_shake_none;
	return 1;
	}

	ERR_clear_error();
	r = SSL_do_handshake(c->ssl);
	if(r != 1) {
	int want = SSL_get_error(c->ssl, r);
	if(want == SSL_ERROR_WANT_READ) {
	if(c->ssl_shake_state == comm_ssl_shake_read)
	return 1;
	c->ssl_shake_state = comm_ssl_shake_read;
	comm_point_listen_for_rw(c, 1, 0);
	return 1;
	} else if(want == SSL_ERROR_WANT_WRITE) {
	if(c->ssl_shake_state == comm_ssl_shake_write)
	return 1;
	c->ssl_shake_state = comm_ssl_shake_write;
	comm_point_listen_for_rw(c, 0, 1);
	return 1;
	} else if(r == 0) {
	return 0; /* closed */
	} else if(want == SSL_ERROR_SYSCALL) {
	/* SYSCALL and errno==0 means closed uncleanly */
	if(errno != 0)
	log_err("SSL_handshake syscall: %s",
	strerror(errno));
	return 0;
	} else {
	log_crypto_err("ssl handshake failed");
	log_addr(1, "ssl handshake failed", &c->repinfo.addr,
	c->repinfo.addrlen);
	return 0;
	}
	}
	/* this is where peer verification could take place */
	if((SSL_get_verify_mode(c->ssl)&SSL_VERIFY_PEER)) {
	/* verification */
	if(SSL_get_verify_result(c->ssl) == X509_V_OK) {
	X509* x = SSL_get_peer_certificate(c->ssl);
	if(!x) {
	log_addr(VERB_ALGO, "SSL connection failed: "
	"no certificate",
	&c->repinfo.addr, c->repinfo.addrlen);
	return 0;
	}
	log_cert(VERB_ALGO, "peer certificate", x);
	#ifdef HAVE_SSL_GET0_PEERNAME
	if(SSL_get0_peername(c->ssl)) {
	char buf[255];
	snprintf(buf, sizeof(buf), "SSL connection "
	"to %s authenticated",
	SSL_get0_peername(c->ssl));
	log_addr(VERB_ALGO, buf, &c->repinfo.addr,
	c->repinfo.addrlen);
	} else {
	#endif
	log_addr(VERB_ALGO, "SSL connection "
	"authenticated", &c->repinfo.addr,
	c->repinfo.addrlen);
	#ifdef HAVE_SSL_GET0_PEERNAME
	}
	#endif
	X509_free(x);
	} else {
	X509* x = SSL_get_peer_certificate(c->ssl);
	if(x) {
	log_cert(VERB_ALGO, "peer certificate", x);
	X509_free(x);
	}
	log_addr(VERB_ALGO, "SSL connection failed: "
	"failed to authenticate",
	&c->repinfo.addr, c->repinfo.addrlen);
	return 0;
	}
	} else {
	/* unauthenticated, the verify peer flag was not set
	* in c->ssl when the ssl object was created from ssl_ctx */
	log_addr(VERB_ALGO, "SSL connection", &c->repinfo.addr,
	c->repinfo.addrlen);
	}

	/* setup listen rw correctly */
	if(c->tcp_is_reading) {
	if(c->ssl_shake_state != comm_ssl_shake_read)
	comm_point_listen_for_rw(c, 1, 0);
	} else {
	comm_point_listen_for_rw(c, 1, 1);
	}
	c->ssl_shake_state = comm_ssl_shake_none;
	return 1;
	}
	#endif /* HAVE_SSL */

	/** ssl read callback on TCP */
	static int
	ssl_handle_read(struct comm_point* c)
	{
	#ifdef HAVE_SSL
	int r;
	if(c->ssl_shake_state != comm_ssl_shake_none) {
	if(!ssl_handshake(c))
	return 0;
	if(c->ssl_shake_state != comm_ssl_shake_none)
	return 1;
	}
	if(c->tcp_byte_count < sizeof(uint16_t)) {
	/* read length bytes */
	ERR_clear_error();
	if((r=SSL_read(c->ssl, (void*)sldns_buffer_at(c->buffer,
	c->tcp_byte_count), (int)(sizeof(uint16_t) -
	c->tcp_byte_count))) <= 0) {
	int want = SSL_get_error(c->ssl, r);
	if(want == SSL_ERROR_ZERO_RETURN) {
	+ if(c->tcp_req_info)
	+ return tcp_req_info_handle_read_close(c->tcp_req_info);
	return 0; /* shutdown, closed */
	} else if(want == SSL_ERROR_WANT_READ) {
	ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ);
	return 1; /* read more later */
	} else if(want == SSL_ERROR_WANT_WRITE) {
	c->ssl_shake_state = comm_ssl_shake_hs_write;
	comm_point_listen_for_rw(c, 0, 1);
	return 1;
	} else if(want == SSL_ERROR_SYSCALL) {
	+#ifdef ECONNRESET
	+ if(errno == ECONNRESET && verbosity < 2)
	+ return 0; /* silence reset by peer */
	+#endif
	if(errno != 0)
	log_err("SSL_read syscall: %s",
	strerror(errno));
	return 0;
	}
	log_crypto_err("could not SSL_read");
	return 0;
	}
	c->tcp_byte_count += r;
	if(c->tcp_byte_count < sizeof(uint16_t))
	return 1;
	if(sldns_buffer_read_u16_at(c->buffer, 0) >
	sldns_buffer_capacity(c->buffer)) {
	verbose(VERB_QUERY, "ssl: dropped larger than buffer");
	return 0;
	}
	sldns_buffer_set_limit(c->buffer,
	sldns_buffer_read_u16_at(c->buffer, 0));
	if(sldns_buffer_limit(c->buffer) < LDNS_HEADER_SIZE) {
	verbose(VERB_QUERY, "ssl: dropped bogus too short.");
	return 0;
	}
	sldns_buffer_skip(c->buffer, (ssize_t)(c->tcp_byte_count-sizeof(uint16_t)));
	verbose(VERB_ALGO, "Reading ssl tcp query of length %d",
	(int)sldns_buffer_limit(c->buffer));
	}
	if(sldns_buffer_remaining(c->buffer) > 0) {
	ERR_clear_error();
	r = SSL_read(c->ssl, (void*)sldns_buffer_current(c->buffer),
	(int)sldns_buffer_remaining(c->buffer));
	if(r <= 0) {
	int want = SSL_get_error(c->ssl, r);
	if(want == SSL_ERROR_ZERO_RETURN) {
	+ if(c->tcp_req_info)
	+ return tcp_req_info_handle_read_close(c->tcp_req_info);
	return 0; /* shutdown, closed */
	} else if(want == SSL_ERROR_WANT_READ) {
	ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ);
	return 1; /* read more later */
	} else if(want == SSL_ERROR_WANT_WRITE) {
	c->ssl_shake_state = comm_ssl_shake_hs_write;
	comm_point_listen_for_rw(c, 0, 1);
	return 1;
	} else if(want == SSL_ERROR_SYSCALL) {
	+#ifdef ECONNRESET
	+ if(errno == ECONNRESET && verbosity < 2)
	+ return 0; /* silence reset by peer */
	+#endif
	if(errno != 0)
	log_err("SSL_read syscall: %s",
	strerror(errno));
	return 0;
	}
	log_crypto_err("could not SSL_read");
	return 0;
	}
	sldns_buffer_skip(c->buffer, (ssize_t)r);
	}
	if(sldns_buffer_remaining(c->buffer) <= 0) {
	tcp_callback_reader(c);
	}
	return 1;
	#else
	(void)c;
	return 0;
	#endif /* HAVE_SSL */
	}

	/** ssl write callback on TCP */
	static int
	ssl_handle_write(struct comm_point* c)
	{
	#ifdef HAVE_SSL
	int r;
	if(c->ssl_shake_state != comm_ssl_shake_none) {
	if(!ssl_handshake(c))
	return 0;
	if(c->ssl_shake_state != comm_ssl_shake_none)
	return 1;
	}
	/* ignore return, if fails we may simply block */
	(void)SSL_set_mode(c->ssl, SSL_MODE_ENABLE_PARTIAL_WRITE);
	if(c->tcp_byte_count < sizeof(uint16_t)) {
	uint16_t len = htons(sldns_buffer_limit(c->buffer));
	ERR_clear_error();
	if(sizeof(uint16_t)+sldns_buffer_remaining(c->buffer) <
	LDNS_RR_BUF_SIZE) {
	/* combine the tcp length and the query for write,
	* this emulates writev */
	uint8_t buf[LDNS_RR_BUF_SIZE];
	memmove(buf, &len, sizeof(uint16_t));
	memmove(buf+sizeof(uint16_t),
	sldns_buffer_current(c->buffer),
	sldns_buffer_remaining(c->buffer));
	r = SSL_write(c->ssl, (void*)(buf+c->tcp_byte_count),
	(int)(sizeof(uint16_t)+
	sldns_buffer_remaining(c->buffer)
	- c->tcp_byte_count));
	} else {
	r = SSL_write(c->ssl,
	(void)(((uint8_t)&len)+c->tcp_byte_count),
	(int)(sizeof(uint16_t)-c->tcp_byte_count));
	}
	if(r <= 0) {
	int want = SSL_get_error(c->ssl, r);
	if(want == SSL_ERROR_ZERO_RETURN) {
	return 0; /* closed */
	} else if(want == SSL_ERROR_WANT_READ) {
	- c->ssl_shake_state = comm_ssl_shake_read;
	+ c->ssl_shake_state = comm_ssl_shake_hs_read;
	comm_point_listen_for_rw(c, 1, 0);
	return 1; /* wait for read condition */
	} else if(want == SSL_ERROR_WANT_WRITE) {
	ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE);
	return 1; /* write more later */
	} else if(want == SSL_ERROR_SYSCALL) {
	+#ifdef EPIPE
	+ if(errno == EPIPE && verbosity < 2)
	+ return 0; /* silence 'broken pipe' */
	+#endif
	if(errno != 0)
	log_err("SSL_write syscall: %s",
	strerror(errno));
	return 0;
	}
	log_crypto_err("could not SSL_write");
	return 0;
	}
	c->tcp_byte_count += r;
	if(c->tcp_byte_count < sizeof(uint16_t))
	return 1;
	sldns_buffer_set_position(c->buffer, c->tcp_byte_count -
	sizeof(uint16_t));
	if(sldns_buffer_remaining(c->buffer) == 0) {
	tcp_callback_writer(c);
	return 1;
	}
	}
	log_assert(sldns_buffer_remaining(c->buffer) > 0);
	ERR_clear_error();
	r = SSL_write(c->ssl, (void*)sldns_buffer_current(c->buffer),
	(int)sldns_buffer_remaining(c->buffer));
	if(r <= 0) {
	int want = SSL_get_error(c->ssl, r);
	if(want == SSL_ERROR_ZERO_RETURN) {
	return 0; /* closed */
	} else if(want == SSL_ERROR_WANT_READ) {
	- c->ssl_shake_state = comm_ssl_shake_read;
	+ c->ssl_shake_state = comm_ssl_shake_hs_read;
	comm_point_listen_for_rw(c, 1, 0);
	return 1; /* wait for read condition */
	} else if(want == SSL_ERROR_WANT_WRITE) {
	ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE);
	return 1; /* write more later */
	} else if(want == SSL_ERROR_SYSCALL) {
	+#ifdef EPIPE
	+ if(errno == EPIPE && verbosity < 2)
	+ return 0; /* silence 'broken pipe' */
	+#endif
	if(errno != 0)
	log_err("SSL_write syscall: %s",
	strerror(errno));
	return 0;
	}
	log_crypto_err("could not SSL_write");
	return 0;
	}
	sldns_buffer_skip(c->buffer, (ssize_t)r);

	if(sldns_buffer_remaining(c->buffer) == 0) {
	tcp_callback_writer(c);
	}
	return 1;
	#else
	(void)c;
	return 0;
	#endif /* HAVE_SSL */
	}

	/** handle ssl tcp connection with dns contents */
	static int
	ssl_handle_it(struct comm_point* c)
	{
	if(c->tcp_is_reading)
	return ssl_handle_read(c);
	return ssl_handle_write(c);
	}

	/** Handle tcp reading callback.
	* @param fd: file descriptor of socket.
	* @param c: comm point to read from into buffer.
	* @param short_ok: if true, very short packets are OK (for comm_local).
	* @return: 0 on error
	*/
	static int
	comm_point_tcp_handle_read(int fd, struct comm_point* c, int short_ok)
	{
	ssize_t r;
	log_assert(c->type == comm_tcp \|\| c->type == comm_local);
	if(c->ssl)
	return ssl_handle_it(c);
	if(!c->tcp_is_reading)
	return 0;

	log_assert(fd != -1);
	if(c->tcp_byte_count < sizeof(uint16_t)) {
	/* read length bytes */
	r = recv(fd,(void*)sldns_buffer_at(c->buffer,c->tcp_byte_count),
	sizeof(uint16_t)-c->tcp_byte_count, 0);
	- if(r == 0)
	+ if(r == 0) {
	+ if(c->tcp_req_info)
	+ return tcp_req_info_handle_read_close(c->tcp_req_info);
	return 0;
	- else if(r == -1) {
	+ } else if(r == -1) {
	#ifndef USE_WINSOCK
	if(errno == EINTR \|\| errno == EAGAIN)
	return 1;
	#ifdef ECONNRESET
	if(errno == ECONNRESET && verbosity < 2)
	return 0; /* silence reset by peer */
	#endif
	log_err_addr("read (in tcp s)", strerror(errno),
	&c->repinfo.addr, c->repinfo.addrlen);
	#else /* USE_WINSOCK */
	if(WSAGetLastError() == WSAECONNRESET)
	return 0;
	if(WSAGetLastError() == WSAEINPROGRESS)
	return 1;
	if(WSAGetLastError() == WSAEWOULDBLOCK) {
	ub_winsock_tcp_wouldblock(c->ev->ev,
	UB_EV_READ);
	return 1;
	}
	log_err_addr("read (in tcp s)",
	wsa_strerror(WSAGetLastError()),
	&c->repinfo.addr, c->repinfo.addrlen);
	#endif
	return 0;
	}
	c->tcp_byte_count += r;
	if(c->tcp_byte_count != sizeof(uint16_t))
	return 1;
	if(sldns_buffer_read_u16_at(c->buffer, 0) >
	sldns_buffer_capacity(c->buffer)) {
	verbose(VERB_QUERY, "tcp: dropped larger than buffer");
	return 0;
	}
	sldns_buffer_set_limit(c->buffer,
	sldns_buffer_read_u16_at(c->buffer, 0));
	if(!short_ok &&
	sldns_buffer_limit(c->buffer) < LDNS_HEADER_SIZE) {
	verbose(VERB_QUERY, "tcp: dropped bogus too short.");
	return 0;
	}
	verbose(VERB_ALGO, "Reading tcp query of length %d",
	(int)sldns_buffer_limit(c->buffer));
	}

	log_assert(sldns_buffer_remaining(c->buffer) > 0);
	r = recv(fd, (void*)sldns_buffer_current(c->buffer),
	sldns_buffer_remaining(c->buffer), 0);
	if(r == 0) {
	+ if(c->tcp_req_info)
	+ return tcp_req_info_handle_read_close(c->tcp_req_info);
	return 0;
	} else if(r == -1) {
	#ifndef USE_WINSOCK
	if(errno == EINTR \|\| errno == EAGAIN)
	return 1;
	log_err_addr("read (in tcp r)", strerror(errno),
	&c->repinfo.addr, c->repinfo.addrlen);
	#else /* USE_WINSOCK */
	if(WSAGetLastError() == WSAECONNRESET)
	return 0;
	if(WSAGetLastError() == WSAEINPROGRESS)
	return 1;
	if(WSAGetLastError() == WSAEWOULDBLOCK) {
	ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ);
	return 1;
	}
	log_err_addr("read (in tcp r)",
	wsa_strerror(WSAGetLastError()),
	&c->repinfo.addr, c->repinfo.addrlen);
	#endif
	return 0;
	}
	sldns_buffer_skip(c->buffer, r);
	if(sldns_buffer_remaining(c->buffer) <= 0) {
	tcp_callback_reader(c);
	}
	return 1;
	}

	/**
	* Handle tcp writing callback.
	* @param fd: file descriptor of socket.
	* @param c: comm point to write buffer out of.
	* @return: 0 on error
	*/
	static int
	comm_point_tcp_handle_write(int fd, struct comm_point* c)
	{
	ssize_t r;
	struct sldns_buffer *buffer;
	log_assert(c->type == comm_tcp);
	#ifdef USE_DNSCRYPT
	buffer = c->dnscrypt_buffer;
	#else
	buffer = c->buffer;
	#endif
	if(c->tcp_is_reading && !c->ssl)
	return 0;
	log_assert(fd != -1);
	if(c->tcp_byte_count == 0 && c->tcp_check_nb_connect) {
	/* check for pending error from nonblocking connect */
	/* from Stevens, unix network programming, vol1, 3rd ed, p450*/
	int error = 0;
	socklen_t len = (socklen_t)sizeof(error);
	if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error,
	&len) < 0){
	#ifndef USE_WINSOCK
	error = errno; /* on solaris errno is error */
	#else /* USE_WINSOCK */
	error = WSAGetLastError();
	#endif
	}
	#ifndef USE_WINSOCK
	#if defined(EINPROGRESS) && defined(EWOULDBLOCK)
	if(error == EINPROGRESS \|\| error == EWOULDBLOCK)
	return 1; /* try again later */
	else
	#endif
	if(error != 0 && verbosity < 2)
	return 0; /* silence lots of chatter in the logs */
	else if(error != 0) {
	log_err_addr("tcp connect", strerror(error),
	&c->repinfo.addr, c->repinfo.addrlen);
	#else /* USE_WINSOCK */
	/* examine error */
	if(error == WSAEINPROGRESS)
	return 1;
	else if(error == WSAEWOULDBLOCK) {
	ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE);
	return 1;
	} else if(error != 0 && verbosity < 2)
	return 0;
	else if(error != 0) {
	log_err_addr("tcp connect", wsa_strerror(error),
	&c->repinfo.addr, c->repinfo.addrlen);
	#endif /* USE_WINSOCK */
	return 0;
	}
	}
	if(c->ssl)
	return ssl_handle_it(c);

	#ifdef USE_MSG_FASTOPEN
	/* Only try this on first use of a connection that uses tfo,
	otherwise fall through to normal write */
	/* Also, TFO support on WINDOWS not implemented at the moment */
	if(c->tcp_do_fastopen == 1) {
	/* this form of sendmsg() does both a connect() and send() so need to
	look for various flavours of error*/
	uint16_t len = htons(sldns_buffer_limit(buffer));
	struct msghdr msg;
	struct iovec iov[2];
	c->tcp_do_fastopen = 0;
	memset(&msg, 0, sizeof(msg));
	iov[0].iov_base = (uint8_t*)&len + c->tcp_byte_count;
	iov[0].iov_len = sizeof(uint16_t) - c->tcp_byte_count;
	iov[1].iov_base = sldns_buffer_begin(buffer);
	iov[1].iov_len = sldns_buffer_limit(buffer);
	log_assert(iov[0].iov_len > 0);
	- log_assert(iov[1].iov_len > 0);
	msg.msg_name = &c->repinfo.addr;
	msg.msg_namelen = c->repinfo.addrlen;
	msg.msg_iov = iov;
	msg.msg_iovlen = 2;
	r = sendmsg(fd, &msg, MSG_FASTOPEN);
	if (r == -1) {
	#if defined(EINPROGRESS) && defined(EWOULDBLOCK)
	/* Handshake is underway, maybe because no TFO cookie available.
	Come back to write the message*/
	if(errno == EINPROGRESS \|\| errno == EWOULDBLOCK)
	return 1;
	#endif
	if(errno == EINTR \|\| errno == EAGAIN)
	return 1;
	/* Not handling EISCONN here as shouldn't ever hit that case.*/
	if(errno != EPIPE && errno != 0 && verbosity < 2)
	return 0; /* silence lots of chatter in the logs */
	if(errno != EPIPE && errno != 0) {
	log_err_addr("tcp sendmsg", strerror(errno),
	&c->repinfo.addr, c->repinfo.addrlen);
	return 0;
	}
	/* fallthrough to nonFASTOPEN
	* (MSG_FASTOPEN on Linux 3 produces EPIPE)
	* we need to perform connect() */
	if(connect(fd, (struct sockaddr *)&c->repinfo.addr, c->repinfo.addrlen) == -1) {
	#ifdef EINPROGRESS
	if(errno == EINPROGRESS)
	return 1; /* wait until connect done*/
	#endif
	#ifdef USE_WINSOCK
	if(WSAGetLastError() == WSAEINPROGRESS \|\|
	WSAGetLastError() == WSAEWOULDBLOCK)
	return 1; /* wait until connect done*/
	#endif
	if(tcp_connect_errno_needs_log(
	(struct sockaddr *)&c->repinfo.addr, c->repinfo.addrlen)) {
	log_err_addr("outgoing tcp: connect after EPIPE for fastopen",
	strerror(errno), &c->repinfo.addr, c->repinfo.addrlen);
	}
	return 0;
	}

	} else {
	c->tcp_byte_count += r;
	if(c->tcp_byte_count < sizeof(uint16_t))
	return 1;
	sldns_buffer_set_position(buffer, c->tcp_byte_count -
	sizeof(uint16_t));
	if(sldns_buffer_remaining(buffer) == 0) {
	tcp_callback_writer(c);
	return 1;
	}
	}
	}
	#endif /* USE_MSG_FASTOPEN */

	if(c->tcp_byte_count < sizeof(uint16_t)) {
	uint16_t len = htons(sldns_buffer_limit(buffer));
	#ifdef HAVE_WRITEV
	struct iovec iov[2];
	iov[0].iov_base = (uint8_t*)&len + c->tcp_byte_count;
	iov[0].iov_len = sizeof(uint16_t) - c->tcp_byte_count;
	iov[1].iov_base = sldns_buffer_begin(buffer);
	iov[1].iov_len = sldns_buffer_limit(buffer);
	log_assert(iov[0].iov_len > 0);
	- log_assert(iov[1].iov_len > 0);
	r = writev(fd, iov, 2);
	#else /* HAVE_WRITEV */
	r = send(fd, (void)(((uint8_t)&len)+c->tcp_byte_count),
	sizeof(uint16_t)-c->tcp_byte_count, 0);
	#endif /* HAVE_WRITEV */
	if(r == -1) {
	#ifndef USE_WINSOCK
	# ifdef EPIPE
	if(errno == EPIPE && verbosity < 2)
	return 0; /* silence 'broken pipe' */
	#endif
	if(errno == EINTR \|\| errno == EAGAIN)
	return 1;
	+#ifdef ECONNRESET
	+ if(errno == ECONNRESET && verbosity < 2)
	+ return 0; /* silence reset by peer */
	+#endif
	# ifdef HAVE_WRITEV
	log_err_addr("tcp writev", strerror(errno),
	&c->repinfo.addr, c->repinfo.addrlen);
	# else /* HAVE_WRITEV */
	log_err_addr("tcp send s", strerror(errno),
	&c->repinfo.addr, c->repinfo.addrlen);
	# endif /* HAVE_WRITEV */
	#else
	if(WSAGetLastError() == WSAENOTCONN)
	return 1;
	if(WSAGetLastError() == WSAEINPROGRESS)
	return 1;
	if(WSAGetLastError() == WSAEWOULDBLOCK) {
	ub_winsock_tcp_wouldblock(c->ev->ev,
	UB_EV_WRITE);
	return 1;
	}
	+ if(WSAGetLastError() == WSAECONNRESET && verbosity < 2)
	+ return 0; /* silence reset by peer */
	log_err_addr("tcp send s",
	wsa_strerror(WSAGetLastError()),
	&c->repinfo.addr, c->repinfo.addrlen);
	#endif
	return 0;
	}
	c->tcp_byte_count += r;
	if(c->tcp_byte_count < sizeof(uint16_t))
	return 1;
	sldns_buffer_set_position(buffer, c->tcp_byte_count -
	sizeof(uint16_t));
	if(sldns_buffer_remaining(buffer) == 0) {
	tcp_callback_writer(c);
	return 1;
	}
	}
	log_assert(sldns_buffer_remaining(buffer) > 0);
	r = send(fd, (void*)sldns_buffer_current(buffer),
	sldns_buffer_remaining(buffer), 0);
	if(r == -1) {
	#ifndef USE_WINSOCK
	if(errno == EINTR \|\| errno == EAGAIN)
	return 1;
	+#ifdef ECONNRESET
	+ if(errno == ECONNRESET && verbosity < 2)
	+ return 0; /* silence reset by peer */
	+#endif
	log_err_addr("tcp send r", strerror(errno),
	&c->repinfo.addr, c->repinfo.addrlen);
	#else
	if(WSAGetLastError() == WSAEINPROGRESS)
	return 1;
	if(WSAGetLastError() == WSAEWOULDBLOCK) {
	ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE);
	return 1;
	}
	+ if(WSAGetLastError() == WSAECONNRESET && verbosity < 2)
	+ return 0; /* silence reset by peer */
	log_err_addr("tcp send r", wsa_strerror(WSAGetLastError()),
	&c->repinfo.addr, c->repinfo.addrlen);
	#endif
	return 0;
	}
	sldns_buffer_skip(buffer, r);

	if(sldns_buffer_remaining(buffer) == 0) {
	tcp_callback_writer(c);
	}

	return 1;
	}

	+/** read again to drain buffers when there could be more to read */
	+static void
	+tcp_req_info_read_again(int fd, struct comm_point* c)
	+{
	+ while(c->tcp_req_info->read_again) {
	+ int r;
	+ c->tcp_req_info->read_again = 0;
	+ if(c->tcp_is_reading)
	+ r = comm_point_tcp_handle_read(fd, c, 0);
	+ else r = comm_point_tcp_handle_write(fd, c);
	+ if(!r) {
	+ reclaim_tcp_handler(c);
	+ if(!c->tcp_do_close) {
	+ fptr_ok(fptr_whitelist_comm_point(
	+ c->callback));
	+ (void)(*c->callback)(c, c->cb_arg,
	+ NETEVENT_CLOSED, NULL);
	+ }
	+ return;
	+ }
	+ }
	+}
	+
	void
	comm_point_tcp_handle_callback(int fd, short event, void* arg)
	{
	struct comm_point* c = (struct comm_point*)arg;
	log_assert(c->type == comm_tcp);
	ub_comm_base_now(c->ev->base);

	#ifdef USE_DNSCRYPT
	/* Initialize if this is a dnscrypt socket */
	if(c->tcp_parent) {
	c->dnscrypt = c->tcp_parent->dnscrypt;
	}
	if(c->dnscrypt && c->dnscrypt_buffer == c->buffer) {
	c->dnscrypt_buffer = sldns_buffer_new(sldns_buffer_capacity(c->buffer));
	if(!c->dnscrypt_buffer) {
	log_err("Could not allocate dnscrypt buffer");
	reclaim_tcp_handler(c);
	if(!c->tcp_do_close) {
	fptr_ok(fptr_whitelist_comm_point(
	c->callback));
	(void)(*c->callback)(c, c->cb_arg,
	NETEVENT_CLOSED, NULL);
	}
	return;
	}
	}
	#endif

	+ if(event&UB_EV_TIMEOUT) {
	+ verbose(VERB_QUERY, "tcp took too long, dropped");
	+ reclaim_tcp_handler(c);
	+ if(!c->tcp_do_close) {
	+ fptr_ok(fptr_whitelist_comm_point(c->callback));
	+ (void)(*c->callback)(c, c->cb_arg,
	+ NETEVENT_TIMEOUT, NULL);
	+ }
	+ return;
	+ }
	if(event&UB_EV_READ) {
	+ int has_tcpq = (c->tcp_req_info != NULL);
	if(!comm_point_tcp_handle_read(fd, c, 0)) {
	reclaim_tcp_handler(c);
	if(!c->tcp_do_close) {
	fptr_ok(fptr_whitelist_comm_point(
	c->callback));
	(void)(*c->callback)(c, c->cb_arg,
	NETEVENT_CLOSED, NULL);
	}
	}
	+ if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again)
	+ tcp_req_info_read_again(fd, c);
	return;
	}
	if(event&UB_EV_WRITE) {
	+ int has_tcpq = (c->tcp_req_info != NULL);
	if(!comm_point_tcp_handle_write(fd, c)) {
	reclaim_tcp_handler(c);
	if(!c->tcp_do_close) {
	fptr_ok(fptr_whitelist_comm_point(
	c->callback));
	(void)(*c->callback)(c, c->cb_arg,
	NETEVENT_CLOSED, NULL);
	}
	}
	+ if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again)
	+ tcp_req_info_read_again(fd, c);
	return;
	}
	- if(event&UB_EV_TIMEOUT) {
	- verbose(VERB_QUERY, "tcp took too long, dropped");
	- reclaim_tcp_handler(c);
	- if(!c->tcp_do_close) {
	- fptr_ok(fptr_whitelist_comm_point(c->callback));
	- (void)(*c->callback)(c, c->cb_arg,
	- NETEVENT_TIMEOUT, NULL);
	- }
	- return;
	- }
	log_err("Ignored event %d for tcphdl.", event);
	}

	/** Make http handler free for next assignment */
	static void
	reclaim_http_handler(struct comm_point* c)
	{
	log_assert(c->type == comm_http);
	if(c->ssl) {
	#ifdef HAVE_SSL
	SSL_shutdown(c->ssl);
	SSL_free(c->ssl);
	c->ssl = NULL;
	#endif
	}
	comm_point_close(c);
	if(c->tcp_parent) {
	c->tcp_parent->cur_tcp_count--;
	c->tcp_free = c->tcp_parent->tcp_free;
	c->tcp_parent->tcp_free = c;
	if(!c->tcp_free) {
	/* re-enable listening on accept socket */
	comm_point_start_listening(c->tcp_parent, -1, -1);
	}
	}
	}

	/** read more data for http (with ssl) */
	static int
	ssl_http_read_more(struct comm_point* c)
	{
	#ifdef HAVE_SSL
	int r;
	log_assert(sldns_buffer_remaining(c->buffer) > 0);
	ERR_clear_error();
	r = SSL_read(c->ssl, (void*)sldns_buffer_current(c->buffer),
	(int)sldns_buffer_remaining(c->buffer));
	if(r <= 0) {
	int want = SSL_get_error(c->ssl, r);
	if(want == SSL_ERROR_ZERO_RETURN) {
	return 0; /* shutdown, closed */
	} else if(want == SSL_ERROR_WANT_READ) {
	return 1; /* read more later */
	} else if(want == SSL_ERROR_WANT_WRITE) {
	c->ssl_shake_state = comm_ssl_shake_hs_write;
	comm_point_listen_for_rw(c, 0, 1);
	return 1;
	} else if(want == SSL_ERROR_SYSCALL) {
	+#ifdef ECONNRESET
	+ if(errno == ECONNRESET && verbosity < 2)
	+ return 0; /* silence reset by peer */
	+#endif
	if(errno != 0)
	log_err("SSL_read syscall: %s",
	strerror(errno));
	return 0;
	}
	log_crypto_err("could not SSL_read");
	return 0;
	}
	sldns_buffer_skip(c->buffer, (ssize_t)r);
	return 1;
	#else
	(void)c;
	return 0;
	#endif /* HAVE_SSL */
	}

	/** read more data for http */
	static int
	http_read_more(int fd, struct comm_point* c)
	{
	ssize_t r;
	log_assert(sldns_buffer_remaining(c->buffer) > 0);
	r = recv(fd, (void*)sldns_buffer_current(c->buffer),
	sldns_buffer_remaining(c->buffer), 0);
	if(r == 0) {
	return 0;
	} else if(r == -1) {
	#ifndef USE_WINSOCK
	if(errno == EINTR \|\| errno == EAGAIN)
	return 1;
	log_err_addr("read (in http r)", strerror(errno),
	&c->repinfo.addr, c->repinfo.addrlen);
	#else /* USE_WINSOCK */
	if(WSAGetLastError() == WSAECONNRESET)
	return 0;
	if(WSAGetLastError() == WSAEINPROGRESS)
	return 1;
	if(WSAGetLastError() == WSAEWOULDBLOCK) {
	ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ);
	return 1;
	}
	log_err_addr("read (in http r)",
	wsa_strerror(WSAGetLastError()),
	&c->repinfo.addr, c->repinfo.addrlen);
	#endif
	return 0;
	}
	sldns_buffer_skip(c->buffer, r);
	return 1;
	}

	/** return true if http header has been read (one line complete) */
	static int
	http_header_done(sldns_buffer* buf)
	{
	size_t i;
	for(i=sldns_buffer_position(buf); i<sldns_buffer_limit(buf); i++) {
	/* there was a \r before the \n, but we ignore that */
	if((char)sldns_buffer_read_u8_at(buf, i) == '\n')
	return 1;
	}
	return 0;
	}

	/** return character string into buffer for header line, moves buffer
	* past that line and puts zero terminator into linefeed-newline */
	static char*
	http_header_line(sldns_buffer* buf)
	{
	char* result = (char*)sldns_buffer_current(buf);
	size_t i;
	for(i=sldns_buffer_position(buf); i<sldns_buffer_limit(buf); i++) {
	/* terminate the string on the \r */
	if((char)sldns_buffer_read_u8_at(buf, i) == '\r')
	sldns_buffer_write_u8_at(buf, i, 0);
	/* terminate on the \n and skip past the it and done */
	if((char)sldns_buffer_read_u8_at(buf, i) == '\n') {
	sldns_buffer_write_u8_at(buf, i, 0);
	sldns_buffer_set_position(buf, i+1);
	return result;
	}
	}
	return NULL;
	}

	/** move unread buffer to start and clear rest for putting the rest into it */
	static void
	http_moveover_buffer(sldns_buffer* buf)
	{
	size_t pos = sldns_buffer_position(buf);
	size_t len = sldns_buffer_remaining(buf);
	sldns_buffer_clear(buf);
	memmove(sldns_buffer_begin(buf), sldns_buffer_at(buf, pos), len);
	sldns_buffer_set_position(buf, len);
	}

	/** a http header is complete, process it */
	static int
	http_process_initial_header(struct comm_point* c)
	{
	char* line = http_header_line(c->buffer);
	if(!line) return 1;
	verbose(VERB_ALGO, "http header: %s", line);
	if(strncasecmp(line, "HTTP/1.1 ", 9) == 0) {
	/* check returncode */
	if(line[9] != '2') {
	verbose(VERB_ALGO, "http bad status %s", line+9);
	return 0;
	}
	} else if(strncasecmp(line, "Content-Length: ", 16) == 0) {
	if(!c->http_is_chunked)
	c->tcp_byte_count = (size_t)atoi(line+16);
	} else if(strncasecmp(line, "Transfer-Encoding: chunked", 19+7) == 0) {
	c->tcp_byte_count = 0;
	c->http_is_chunked = 1;
	} else if(line[0] == 0) {
	/* end of initial headers */
	c->http_in_headers = 0;
	if(c->http_is_chunked)
	c->http_in_chunk_headers = 1;
	/* remove header text from front of buffer
	* the buffer is going to be used to return the data segment
	* itself and we don't want the header to get returned
	* prepended with it */
	http_moveover_buffer(c->buffer);
	sldns_buffer_flip(c->buffer);
	return 1;
	}
	/* ignore other headers */
	return 1;
	}

	/** a chunk header is complete, process it, return 0=fail, 1=continue next
	* header line, 2=done with chunked transfer*/
	static int
	http_process_chunk_header(struct comm_point* c)
	{
	char* line = http_header_line(c->buffer);
	if(!line) return 1;
	if(c->http_in_chunk_headers == 3) {
	verbose(VERB_ALGO, "http chunk trailer: %s", line);
	/* are we done ? */
	if(line[0] == 0 && c->tcp_byte_count == 0) {
	/* callback of http reader when NETEVENT_DONE,
	* end of data, with no data in buffer */
	sldns_buffer_set_position(c->buffer, 0);
	sldns_buffer_set_limit(c->buffer, 0);
	fptr_ok(fptr_whitelist_comm_point(c->callback));
	(void)(*c->callback)(c, c->cb_arg, NETEVENT_DONE, NULL);
	/* return that we are done */
	return 2;
	}
	if(line[0] == 0) {
	/* continue with header of the next chunk */
	c->http_in_chunk_headers = 1;
	/* remove header text from front of buffer */
	http_moveover_buffer(c->buffer);
	sldns_buffer_flip(c->buffer);
	return 1;
	}
	/* ignore further trail headers */
	return 1;
	}
	verbose(VERB_ALGO, "http chunk header: %s", line);
	if(c->http_in_chunk_headers == 1) {
	/* read chunked start line */
	char* end = NULL;
	c->tcp_byte_count = (size_t)strtol(line, &end, 16);
	if(end == line)
	return 0;
	c->http_in_chunk_headers = 0;
	/* remove header text from front of buffer */
	http_moveover_buffer(c->buffer);
	sldns_buffer_flip(c->buffer);
	if(c->tcp_byte_count == 0) {
	/* done with chunks, process chunk_trailer lines */
	c->http_in_chunk_headers = 3;
	}
	return 1;
	}
	/* ignore other headers */
	return 1;
	}

	/** handle nonchunked data segment */
	static int
	http_nonchunk_segment(struct comm_point* c)
	{
	/* c->buffer at position..limit has new data we read in.
	* the buffer itself is full of nonchunked data.
	* we are looking to read tcp_byte_count more data
	* and then the transfer is done. */
	size_t remainbufferlen;
	size_t got_now = sldns_buffer_limit(c->buffer) - c->http_stored;
	if(c->tcp_byte_count <= got_now) {
	/* done, this is the last data fragment */
	c->http_stored = 0;
	sldns_buffer_set_position(c->buffer, 0);
	fptr_ok(fptr_whitelist_comm_point(c->callback));
	(void)(*c->callback)(c, c->cb_arg, NETEVENT_DONE, NULL);
	return 1;
	}
	c->tcp_byte_count -= got_now;
	/* if we have the buffer space,
	* read more data collected into the buffer */
	remainbufferlen = sldns_buffer_capacity(c->buffer) -
	sldns_buffer_limit(c->buffer);
	if(remainbufferlen >= c->tcp_byte_count \|\|
	remainbufferlen >= 2048) {
	size_t total = sldns_buffer_limit(c->buffer);
	sldns_buffer_clear(c->buffer);
	sldns_buffer_set_position(c->buffer, total);
	c->http_stored = total;
	/* return and wait to read more */
	return 1;
	}
	/* call callback with this data amount, then
	* wait for more */
	c->http_stored = 0;
	sldns_buffer_set_position(c->buffer, 0);
	fptr_ok(fptr_whitelist_comm_point(c->callback));
	(void)(*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, NULL);
	/* c->callback has to buffer_clear(c->buffer). */
	/* return and wait to read more */
	return 1;
	}

	/** handle nonchunked data segment, return 0=fail, 1=wait, 2=process more */
	static int
	http_chunked_segment(struct comm_point* c)
	{
	/* the c->buffer has from position..limit new data we read. */
	/* the current chunk has length tcp_byte_count.
	* once we read that read more chunk headers.
	*/
	size_t remainbufferlen;
	size_t got_now = sldns_buffer_limit(c->buffer) - c->http_stored;
	if(c->tcp_byte_count <= got_now) {
	/* the chunk has completed (with perhaps some extra data
	* from next chunk header and next chunk) */
	/* save too much info into temp buffer */
	size_t fraglen;
	struct comm_reply repinfo;
	c->http_stored = 0;
	sldns_buffer_skip(c->buffer, (ssize_t)c->tcp_byte_count);
	sldns_buffer_clear(c->http_temp);
	sldns_buffer_write(c->http_temp,
	sldns_buffer_current(c->buffer),
	sldns_buffer_remaining(c->buffer));
	sldns_buffer_flip(c->http_temp);

	/* callback with this fragment */
	fraglen = sldns_buffer_position(c->buffer);
	sldns_buffer_set_position(c->buffer, 0);
	sldns_buffer_set_limit(c->buffer, fraglen);
	repinfo = c->repinfo;
	fptr_ok(fptr_whitelist_comm_point(c->callback));
	(void)(*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, &repinfo);
	/* c->callback has to buffer_clear(). */

	/* is commpoint deleted? */
	if(!repinfo.c) {
	return 1;
	}
	/* copy waiting info */
	sldns_buffer_clear(c->buffer);
	sldns_buffer_write(c->buffer,
	sldns_buffer_begin(c->http_temp),
	sldns_buffer_remaining(c->http_temp));
	sldns_buffer_flip(c->buffer);
	/* process end of chunk trailer header lines, until
	* an empty line */
	c->http_in_chunk_headers = 3;
	/* process more data in buffer (if any) */
	return 2;
	}
	c->tcp_byte_count -= got_now;

	/* if we have the buffer space,
	* read more data collected into the buffer */
	remainbufferlen = sldns_buffer_capacity(c->buffer) -
	sldns_buffer_limit(c->buffer);
	if(remainbufferlen >= c->tcp_byte_count \|\|
	remainbufferlen >= 2048) {
	size_t total = sldns_buffer_limit(c->buffer);
	sldns_buffer_clear(c->buffer);
	sldns_buffer_set_position(c->buffer, total);
	c->http_stored = total;
	/* return and wait to read more */
	return 1;
	}

	/* callback of http reader for a new part of the data */
	c->http_stored = 0;
	sldns_buffer_set_position(c->buffer, 0);
	fptr_ok(fptr_whitelist_comm_point(c->callback));
	(void)(*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, NULL);
	/* c->callback has to buffer_clear(c->buffer). */
	/* return and wait to read more */
	return 1;
	}

	/**
	* Handle http reading callback.
	* @param fd: file descriptor of socket.
	* @param c: comm point to read from into buffer.
	* @return: 0 on error
	*/
	static int
	comm_point_http_handle_read(int fd, struct comm_point* c)
	{
	log_assert(c->type == comm_http);
	log_assert(fd != -1);

	/* if we are in ssl handshake, handle SSL handshake */
	#ifdef HAVE_SSL
	if(c->ssl && c->ssl_shake_state != comm_ssl_shake_none) {
	if(!ssl_handshake(c))
	return 0;
	if(c->ssl_shake_state != comm_ssl_shake_none)
	return 1;
	}
	#endif /* HAVE_SSL */

	if(!c->tcp_is_reading)
	return 1;
	/* read more data */
	if(c->ssl) {
	if(!ssl_http_read_more(c))
	return 0;
	} else {
	if(!http_read_more(fd, c))
	return 0;
	}

	sldns_buffer_flip(c->buffer);
	while(sldns_buffer_remaining(c->buffer) > 0) {
	/* if we are reading headers, read more headers */
	if(c->http_in_headers \|\| c->http_in_chunk_headers) {
	/* if header is done, process the header */
	if(!http_header_done(c->buffer)) {
	/* copy remaining data to front of buffer
	* and set rest for writing into it */
	http_moveover_buffer(c->buffer);
	/* return and wait to read more */
	return 1;
	}
	if(!c->http_in_chunk_headers) {
	/* process initial headers */
	if(!http_process_initial_header(c))
	return 0;
	} else {
	/* process chunk headers */
	int r = http_process_chunk_header(c);
	if(r == 0) return 0;
	if(r == 2) return 1; /* done */
	/* r == 1, continue */
	}
	/* see if we have more to process */
	continue;
	}

	if(!c->http_is_chunked) {
	/* if we are reading nonchunks, process that*/
	return http_nonchunk_segment(c);
	} else {
	/* if we are reading chunks, read the chunk */
	int r = http_chunked_segment(c);
	if(r == 0) return 0;
	if(r == 1) return 1;
	continue;
	}
	}
	/* broke out of the loop; could not process header instead need
	* to read more */
	/* moveover any remaining data and read more data */
	http_moveover_buffer(c->buffer);
	/* return and wait to read more */
	return 1;
	}

	/** check pending connect for http */
	static int
	http_check_connect(int fd, struct comm_point* c)
	{
	/* check for pending error from nonblocking connect */
	/* from Stevens, unix network programming, vol1, 3rd ed, p450*/
	int error = 0;
	socklen_t len = (socklen_t)sizeof(error);
	if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error,
	&len) < 0){
	#ifndef USE_WINSOCK
	error = errno; /* on solaris errno is error */
	#else /* USE_WINSOCK */
	error = WSAGetLastError();
	#endif
	}
	#ifndef USE_WINSOCK
	#if defined(EINPROGRESS) && defined(EWOULDBLOCK)
	if(error == EINPROGRESS \|\| error == EWOULDBLOCK)
	return 1; /* try again later */
	else
	#endif
	if(error != 0 && verbosity < 2)
	return 0; /* silence lots of chatter in the logs */
	else if(error != 0) {
	log_err_addr("http connect", strerror(error),
	&c->repinfo.addr, c->repinfo.addrlen);
	#else /* USE_WINSOCK */
	/* examine error */
	if(error == WSAEINPROGRESS)
	return 1;
	else if(error == WSAEWOULDBLOCK) {
	ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE);
	return 1;
	} else if(error != 0 && verbosity < 2)
	return 0;
	else if(error != 0) {
	log_err_addr("http connect", wsa_strerror(error),
	&c->repinfo.addr, c->repinfo.addrlen);
	#endif /* USE_WINSOCK */
	return 0;
	}
	/* keep on processing this socket */
	return 2;
	}

	/** write more data for http (with ssl) */
	static int
	ssl_http_write_more(struct comm_point* c)
	{
	#ifdef HAVE_SSL
	int r;
	log_assert(sldns_buffer_remaining(c->buffer) > 0);
	ERR_clear_error();
	r = SSL_write(c->ssl, (void*)sldns_buffer_current(c->buffer),
	(int)sldns_buffer_remaining(c->buffer));
	if(r <= 0) {
	int want = SSL_get_error(c->ssl, r);
	if(want == SSL_ERROR_ZERO_RETURN) {
	return 0; /* closed */
	} else if(want == SSL_ERROR_WANT_READ) {
	- c->ssl_shake_state = comm_ssl_shake_read;
	+ c->ssl_shake_state = comm_ssl_shake_hs_read;
	comm_point_listen_for_rw(c, 1, 0);
	return 1; /* wait for read condition */
	} else if(want == SSL_ERROR_WANT_WRITE) {
	return 1; /* write more later */
	} else if(want == SSL_ERROR_SYSCALL) {
	+#ifdef EPIPE
	+ if(errno == EPIPE && verbosity < 2)
	+ return 0; /* silence 'broken pipe' */
	+#endif
	if(errno != 0)
	log_err("SSL_write syscall: %s",
	strerror(errno));
	return 0;
	}
	log_crypto_err("could not SSL_write");
	return 0;
	}
	sldns_buffer_skip(c->buffer, (ssize_t)r);
	return 1;
	#else
	(void)c;
	return 0;
	#endif /* HAVE_SSL */
	}

	/** write more data for http */
	static int
	http_write_more(int fd, struct comm_point* c)
	{
	ssize_t r;
	log_assert(sldns_buffer_remaining(c->buffer) > 0);
	r = send(fd, (void*)sldns_buffer_current(c->buffer),
	sldns_buffer_remaining(c->buffer), 0);
	if(r == -1) {
	#ifndef USE_WINSOCK
	if(errno == EINTR \|\| errno == EAGAIN)
	return 1;
	log_err_addr("http send r", strerror(errno),
	&c->repinfo.addr, c->repinfo.addrlen);
	#else
	if(WSAGetLastError() == WSAEINPROGRESS)
	return 1;
	if(WSAGetLastError() == WSAEWOULDBLOCK) {
	ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE);
	return 1;
	}
	log_err_addr("http send r", wsa_strerror(WSAGetLastError()),
	&c->repinfo.addr, c->repinfo.addrlen);
	#endif
	return 0;
	}
	sldns_buffer_skip(c->buffer, r);
	return 1;
	}

	/**
	* Handle http writing callback.
	* @param fd: file descriptor of socket.
	* @param c: comm point to write buffer out of.
	* @return: 0 on error
	*/
	static int
	comm_point_http_handle_write(int fd, struct comm_point* c)
	{
	log_assert(c->type == comm_http);
	log_assert(fd != -1);

	/* check pending connect errors, if that fails, we wait for more,
	* or we can continue to write contents */
	if(c->tcp_check_nb_connect) {
	int r = http_check_connect(fd, c);
	if(r == 0) return 0;
	if(r == 1) return 1;
	c->tcp_check_nb_connect = 0;
	}
	/* if we are in ssl handshake, handle SSL handshake */
	#ifdef HAVE_SSL
	if(c->ssl && c->ssl_shake_state != comm_ssl_shake_none) {
	if(!ssl_handshake(c))
	return 0;
	if(c->ssl_shake_state != comm_ssl_shake_none)
	return 1;
	}
	#endif /* HAVE_SSL */
	if(c->tcp_is_reading)
	return 1;
	/* if we are writing, write more */
	if(c->ssl) {
	if(!ssl_http_write_more(c))
	return 0;
	} else {
	if(!http_write_more(fd, c))
	return 0;
	}

	/* we write a single buffer contents, that can contain
	* the http request, and then flip to read the results */
	/* see if write is done */
	if(sldns_buffer_remaining(c->buffer) == 0) {
	sldns_buffer_clear(c->buffer);
	if(c->tcp_do_toggle_rw)
	c->tcp_is_reading = 1;
	c->tcp_byte_count = 0;
	/* switch from listening(write) to listening(read) */
	comm_point_stop_listening(c);
	comm_point_start_listening(c, -1, -1);
	}
	return 1;
	}

	void
	comm_point_http_handle_callback(int fd, short event, void* arg)
	{
	struct comm_point* c = (struct comm_point*)arg;
	log_assert(c->type == comm_http);
	ub_comm_base_now(c->ev->base);

	+ if(event&UB_EV_TIMEOUT) {
	+ verbose(VERB_QUERY, "http took too long, dropped");
	+ reclaim_http_handler(c);
	+ if(!c->tcp_do_close) {
	+ fptr_ok(fptr_whitelist_comm_point(c->callback));
	+ (void)(*c->callback)(c, c->cb_arg,
	+ NETEVENT_TIMEOUT, NULL);
	+ }
	+ return;
	+ }
	if(event&UB_EV_READ) {
	if(!comm_point_http_handle_read(fd, c)) {
	reclaim_http_handler(c);
	if(!c->tcp_do_close) {
	fptr_ok(fptr_whitelist_comm_point(
	c->callback));
	(void)(*c->callback)(c, c->cb_arg,
	NETEVENT_CLOSED, NULL);
	}
	}
	return;
	}
	if(event&UB_EV_WRITE) {
	if(!comm_point_http_handle_write(fd, c)) {
	reclaim_http_handler(c);
	if(!c->tcp_do_close) {
	fptr_ok(fptr_whitelist_comm_point(
	c->callback));
	(void)(*c->callback)(c, c->cb_arg,
	NETEVENT_CLOSED, NULL);
	}
	}
	return;
	}
	- if(event&UB_EV_TIMEOUT) {
	- verbose(VERB_QUERY, "http took too long, dropped");
	- reclaim_http_handler(c);
	- if(!c->tcp_do_close) {
	- fptr_ok(fptr_whitelist_comm_point(c->callback));
	- (void)(*c->callback)(c, c->cb_arg,
	- NETEVENT_TIMEOUT, NULL);
	- }
	- return;
	- }
	log_err("Ignored event %d for httphdl.", event);
	}

	void comm_point_local_handle_callback(int fd, short event, void* arg)
	{
	struct comm_point* c = (struct comm_point*)arg;
	log_assert(c->type == comm_local);
	ub_comm_base_now(c->ev->base);

	if(event&UB_EV_READ) {
	if(!comm_point_tcp_handle_read(fd, c, 1)) {
	fptr_ok(fptr_whitelist_comm_point(c->callback));
	(void)(*c->callback)(c, c->cb_arg, NETEVENT_CLOSED,
	NULL);
	}
	return;
	}
	log_err("Ignored event %d for localhdl.", event);
	}

	void comm_point_raw_handle_callback(int ATTR_UNUSED(fd),
	short event, void* arg)
	{
	struct comm_point* c = (struct comm_point*)arg;
	int err = NETEVENT_NOERROR;
	log_assert(c->type == comm_raw);
	ub_comm_base_now(c->ev->base);

	if(event&UB_EV_TIMEOUT)
	err = NETEVENT_TIMEOUT;
	fptr_ok(fptr_whitelist_comm_point_raw(c->callback));
	(void)(*c->callback)(c, c->cb_arg, err, NULL);
	}

	struct comm_point*
	comm_point_create_udp(struct comm_base base, int fd, sldns_buffer buffer,
	comm_point_callback_type* callback, void* callback_arg)
	{
	struct comm_point* c = (struct comm_point*)calloc(1,
	sizeof(struct comm_point));
	short evbits;
	if(!c)
	return NULL;
	c->ev = (struct internal_event*)calloc(1,
	sizeof(struct internal_event));
	if(!c->ev) {
	free(c);
	return NULL;
	}
	c->ev->base = base;
	c->fd = fd;
	c->buffer = buffer;
	c->timeout = NULL;
	c->tcp_is_reading = 0;
	c->tcp_byte_count = 0;
	c->tcp_parent = NULL;
	c->max_tcp_count = 0;
	c->cur_tcp_count = 0;
	c->tcp_handlers = NULL;
	c->tcp_free = NULL;
	c->type = comm_udp;
	c->tcp_do_close = 0;
	c->do_not_close = 0;
	c->tcp_do_toggle_rw = 0;
	c->tcp_check_nb_connect = 0;
	#ifdef USE_MSG_FASTOPEN
	c->tcp_do_fastopen = 0;
	#endif
	#ifdef USE_DNSCRYPT
	c->dnscrypt = 0;
	c->dnscrypt_buffer = buffer;
	#endif
	c->inuse = 0;
	c->callback = callback;
	c->cb_arg = callback_arg;
	evbits = UB_EV_READ \| UB_EV_PERSIST;
	/* ub_event stuff */
	c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits,
	comm_point_udp_callback, c);
	if(c->ev->ev == NULL) {
	log_err("could not baseset udp event");
	comm_point_delete(c);
	return NULL;
	}
	if(fd!=-1 && ub_event_add(c->ev->ev, c->timeout) != 0 ) {
	log_err("could not add udp event");
	comm_point_delete(c);
	return NULL;
	}
	return c;
	}

	struct comm_point*
	comm_point_create_udp_ancil(struct comm_base *base, int fd,
	sldns_buffer* buffer,
	comm_point_callback_type* callback, void* callback_arg)
	{
	struct comm_point* c = (struct comm_point*)calloc(1,
	sizeof(struct comm_point));
	short evbits;
	if(!c)
	return NULL;
	c->ev = (struct internal_event*)calloc(1,
	sizeof(struct internal_event));
	if(!c->ev) {
	free(c);
	return NULL;
	}
	c->ev->base = base;
	c->fd = fd;
	c->buffer = buffer;
	c->timeout = NULL;
	c->tcp_is_reading = 0;
	c->tcp_byte_count = 0;
	c->tcp_parent = NULL;
	c->max_tcp_count = 0;
	c->cur_tcp_count = 0;
	c->tcp_handlers = NULL;
	c->tcp_free = NULL;
	c->type = comm_udp;
	c->tcp_do_close = 0;
	c->do_not_close = 0;
	#ifdef USE_DNSCRYPT
	c->dnscrypt = 0;
	c->dnscrypt_buffer = buffer;
	#endif
	c->inuse = 0;
	c->tcp_do_toggle_rw = 0;
	c->tcp_check_nb_connect = 0;
	#ifdef USE_MSG_FASTOPEN
	c->tcp_do_fastopen = 0;
	#endif
	c->callback = callback;
	c->cb_arg = callback_arg;
	evbits = UB_EV_READ \| UB_EV_PERSIST;
	/* ub_event stuff */
	c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits,
	comm_point_udp_ancil_callback, c);
	if(c->ev->ev == NULL) {
	log_err("could not baseset udp event");
	comm_point_delete(c);
	return NULL;
	}
	if(fd!=-1 && ub_event_add(c->ev->ev, c->timeout) != 0 ) {
	log_err("could not add udp event");
	comm_point_delete(c);
	return NULL;
	}
	return c;
	}

	static struct comm_point*
	comm_point_create_tcp_handler(struct comm_base *base,
	struct comm_point* parent, size_t bufsize,
	- comm_point_callback_type* callback, void* callback_arg)
	+ struct sldns_buffer* spoolbuf, comm_point_callback_type* callback,
	+ void* callback_arg)
	{
	struct comm_point* c = (struct comm_point*)calloc(1,
	sizeof(struct comm_point));
	short evbits;
	if(!c)
	return NULL;
	c->ev = (struct internal_event*)calloc(1,
	sizeof(struct internal_event));
	if(!c->ev) {
	free(c);
	return NULL;
	}
	c->ev->base = base;
	c->fd = -1;
	c->buffer = sldns_buffer_new(bufsize);
	if(!c->buffer) {
	free(c->ev);
	free(c);
	return NULL;
	}
	c->timeout = (struct timeval*)malloc(sizeof(struct timeval));
	if(!c->timeout) {
	sldns_buffer_free(c->buffer);
	free(c->ev);
	free(c);
	return NULL;
	}
	c->tcp_is_reading = 0;
	c->tcp_byte_count = 0;
	c->tcp_parent = parent;
	c->tcp_timeout_msec = parent->tcp_timeout_msec;
	c->tcp_conn_limit = parent->tcp_conn_limit;
	c->tcl_addr = NULL;
	c->tcp_keepalive = 0;
	c->max_tcp_count = 0;
	c->cur_tcp_count = 0;
	c->tcp_handlers = NULL;
	c->tcp_free = NULL;
	c->type = comm_tcp;
	c->tcp_do_close = 0;
	c->do_not_close = 0;
	c->tcp_do_toggle_rw = 1;
	c->tcp_check_nb_connect = 0;
	#ifdef USE_MSG_FASTOPEN
	c->tcp_do_fastopen = 0;
	#endif
	#ifdef USE_DNSCRYPT
	c->dnscrypt = 0;
	/* We don't know just yet if this is a dnscrypt channel. Allocation
	* will be done when handling the callback. */
	c->dnscrypt_buffer = c->buffer;
	#endif
	c->repinfo.c = c;
	c->callback = callback;
	c->cb_arg = callback_arg;
	+ if(spoolbuf) {
	+ c->tcp_req_info = tcp_req_info_create(spoolbuf);
	+ if(!c->tcp_req_info) {
	+ log_err("could not create tcp commpoint");
	+ sldns_buffer_free(c->buffer);
	+ free(c->timeout);
	+ free(c->ev);
	+ free(c);
	+ return NULL;
	+ }
	+ c->tcp_req_info->cp = c;
	+ c->tcp_do_close = 1;
	+ c->tcp_do_toggle_rw = 0;
	+ }
	/* add to parent free list */
	c->tcp_free = parent->tcp_free;
	parent->tcp_free = c;
	/* ub_event stuff */
	evbits = UB_EV_PERSIST \| UB_EV_READ \| UB_EV_TIMEOUT;
	c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits,
	comm_point_tcp_handle_callback, c);
	if(c->ev->ev == NULL)
	{
	log_err("could not basetset tcphdl event");
	parent->tcp_free = c->tcp_free;
	+ tcp_req_info_delete(c->tcp_req_info);
	+ sldns_buffer_free(c->buffer);
	+ free(c->timeout);
	free(c->ev);
	free(c);
	return NULL;
	}
	return c;
	}

	struct comm_point*
	comm_point_create_tcp(struct comm_base *base, int fd, int num,
	int idle_timeout, struct tcl_list* tcp_conn_limit, size_t bufsize,
	- comm_point_callback_type* callback, void* callback_arg)
	+ struct sldns_buffer* spoolbuf, comm_point_callback_type* callback,
	+ void* callback_arg)
	{
	struct comm_point* c = (struct comm_point*)calloc(1,
	sizeof(struct comm_point));
	short evbits;
	int i;
	/* first allocate the TCP accept listener */
	if(!c)
	return NULL;
	c->ev = (struct internal_event*)calloc(1,
	sizeof(struct internal_event));
	if(!c->ev) {
	free(c);
	return NULL;
	}
	c->ev->base = base;
	c->fd = fd;
	c->buffer = NULL;
	c->timeout = NULL;
	c->tcp_is_reading = 0;
	c->tcp_byte_count = 0;
	c->tcp_timeout_msec = idle_timeout;
	c->tcp_conn_limit = tcp_conn_limit;
	c->tcl_addr = NULL;
	c->tcp_keepalive = 0;
	c->tcp_parent = NULL;
	c->max_tcp_count = num;
	c->cur_tcp_count = 0;
	c->tcp_handlers = (struct comm_point**)calloc((size_t)num,
	sizeof(struct comm_point*));
	if(!c->tcp_handlers) {
	free(c->ev);
	free(c);
	return NULL;
	}
	c->tcp_free = NULL;
	c->type = comm_tcp_accept;
	c->tcp_do_close = 0;
	c->do_not_close = 0;
	c->tcp_do_toggle_rw = 0;
	c->tcp_check_nb_connect = 0;
	#ifdef USE_MSG_FASTOPEN
	c->tcp_do_fastopen = 0;
	#endif
	#ifdef USE_DNSCRYPT
	c->dnscrypt = 0;
	c->dnscrypt_buffer = NULL;
	#endif
	c->callback = NULL;
	c->cb_arg = NULL;
	evbits = UB_EV_READ \| UB_EV_PERSIST;
	/* ub_event stuff */
	c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits,
	comm_point_tcp_accept_callback, c);
	if(c->ev->ev == NULL) {
	log_err("could not baseset tcpacc event");
	comm_point_delete(c);
	return NULL;
	}
	if (ub_event_add(c->ev->ev, c->timeout) != 0) {
	log_err("could not add tcpacc event");
	comm_point_delete(c);
	return NULL;
	}
	/* now prealloc the tcp handlers */
	for(i=0; i<num; i++) {
	c->tcp_handlers[i] = comm_point_create_tcp_handler(base,
	- c, bufsize, callback, callback_arg);
	+ c, bufsize, spoolbuf, callback, callback_arg);
	if(!c->tcp_handlers[i]) {
	comm_point_delete(c);
	return NULL;
	}
	}

	return c;
	}

	struct comm_point*
	comm_point_create_tcp_out(struct comm_base *base, size_t bufsize,
	comm_point_callback_type* callback, void* callback_arg)
	{
	struct comm_point* c = (struct comm_point*)calloc(1,
	sizeof(struct comm_point));
	short evbits;
	if(!c)
	return NULL;
	c->ev = (struct internal_event*)calloc(1,
	sizeof(struct internal_event));
	if(!c->ev) {
	free(c);
	return NULL;
	}
	c->ev->base = base;
	c->fd = -1;
	c->buffer = sldns_buffer_new(bufsize);
	if(!c->buffer) {
	free(c->ev);
	free(c);
	return NULL;
	}
	c->timeout = NULL;
	c->tcp_is_reading = 0;
	c->tcp_byte_count = 0;
	c->tcp_timeout_msec = TCP_QUERY_TIMEOUT;
	c->tcp_conn_limit = NULL;
	c->tcl_addr = NULL;
	c->tcp_keepalive = 0;
	c->tcp_parent = NULL;
	c->max_tcp_count = 0;
	c->cur_tcp_count = 0;
	c->tcp_handlers = NULL;
	c->tcp_free = NULL;
	c->type = comm_tcp;
	c->tcp_do_close = 0;
	c->do_not_close = 0;
	c->tcp_do_toggle_rw = 1;
	c->tcp_check_nb_connect = 1;
	#ifdef USE_MSG_FASTOPEN
	c->tcp_do_fastopen = 1;
	#endif
	#ifdef USE_DNSCRYPT
	c->dnscrypt = 0;
	c->dnscrypt_buffer = c->buffer;
	#endif
	c->repinfo.c = c;
	c->callback = callback;
	c->cb_arg = callback_arg;
	evbits = UB_EV_PERSIST \| UB_EV_WRITE;
	c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits,
	comm_point_tcp_handle_callback, c);
	if(c->ev->ev == NULL)
	{
	log_err("could not baseset tcpout event");
	sldns_buffer_free(c->buffer);
	free(c->ev);
	free(c);
	return NULL;
	}

	return c;
	}

	struct comm_point*
	comm_point_create_http_out(struct comm_base *base, size_t bufsize,
	comm_point_callback_type* callback, void* callback_arg,
	sldns_buffer* temp)
	{
	struct comm_point* c = (struct comm_point*)calloc(1,
	sizeof(struct comm_point));
	short evbits;
	if(!c)
	return NULL;
	c->ev = (struct internal_event*)calloc(1,
	sizeof(struct internal_event));
	if(!c->ev) {
	free(c);
	return NULL;
	}
	c->ev->base = base;
	c->fd = -1;
	c->buffer = sldns_buffer_new(bufsize);
	if(!c->buffer) {
	free(c->ev);
	free(c);
	return NULL;
	}
	c->timeout = NULL;
	c->tcp_is_reading = 0;
	c->tcp_byte_count = 0;
	c->tcp_parent = NULL;
	c->max_tcp_count = 0;
	c->cur_tcp_count = 0;
	c->tcp_handlers = NULL;
	c->tcp_free = NULL;
	c->type = comm_http;
	c->tcp_do_close = 0;
	c->do_not_close = 0;
	c->tcp_do_toggle_rw = 1;
	c->tcp_check_nb_connect = 1;
	c->http_in_headers = 1;
	c->http_in_chunk_headers = 0;
	c->http_is_chunked = 0;
	c->http_temp = temp;
	#ifdef USE_MSG_FASTOPEN
	c->tcp_do_fastopen = 1;
	#endif
	#ifdef USE_DNSCRYPT
	c->dnscrypt = 0;
	c->dnscrypt_buffer = c->buffer;
	#endif
	c->repinfo.c = c;
	c->callback = callback;
	c->cb_arg = callback_arg;
	evbits = UB_EV_PERSIST \| UB_EV_WRITE;
	c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits,
	comm_point_http_handle_callback, c);
	if(c->ev->ev == NULL)
	{
	log_err("could not baseset tcpout event");
	#ifdef HAVE_SSL
	SSL_free(c->ssl);
	#endif
	sldns_buffer_free(c->buffer);
	free(c->ev);
	free(c);
	return NULL;
	}

	return c;
	}

	struct comm_point*
	comm_point_create_local(struct comm_base *base, int fd, size_t bufsize,
	comm_point_callback_type* callback, void* callback_arg)
	{
	struct comm_point* c = (struct comm_point*)calloc(1,
	sizeof(struct comm_point));
	short evbits;
	if(!c)
	return NULL;
	c->ev = (struct internal_event*)calloc(1,
	sizeof(struct internal_event));
	if(!c->ev) {
	free(c);
	return NULL;
	}
	c->ev->base = base;
	c->fd = fd;
	c->buffer = sldns_buffer_new(bufsize);
	if(!c->buffer) {
	free(c->ev);
	free(c);
	return NULL;
	}
	c->timeout = NULL;
	c->tcp_is_reading = 1;
	c->tcp_byte_count = 0;
	c->tcp_parent = NULL;
	c->max_tcp_count = 0;
	c->cur_tcp_count = 0;
	c->tcp_handlers = NULL;
	c->tcp_free = NULL;
	c->type = comm_local;
	c->tcp_do_close = 0;
	c->do_not_close = 1;
	c->tcp_do_toggle_rw = 0;
	c->tcp_check_nb_connect = 0;
	#ifdef USE_MSG_FASTOPEN
	c->tcp_do_fastopen = 0;
	#endif
	#ifdef USE_DNSCRYPT
	c->dnscrypt = 0;
	c->dnscrypt_buffer = c->buffer;
	#endif
	c->callback = callback;
	c->cb_arg = callback_arg;
	/* ub_event stuff */
	evbits = UB_EV_PERSIST \| UB_EV_READ;
	c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits,
	comm_point_local_handle_callback, c);
	if(c->ev->ev == NULL) {
	log_err("could not baseset localhdl event");
	free(c->ev);
	free(c);
	return NULL;
	}
	if (ub_event_add(c->ev->ev, c->timeout) != 0) {
	log_err("could not add localhdl event");
	ub_event_free(c->ev->ev);
	free(c->ev);
	free(c);
	return NULL;
	}
	return c;
	}

	struct comm_point*
	comm_point_create_raw(struct comm_base* base, int fd, int writing,
	comm_point_callback_type* callback, void* callback_arg)
	{
	struct comm_point* c = (struct comm_point*)calloc(1,
	sizeof(struct comm_point));
	short evbits;
	if(!c)
	return NULL;
	c->ev = (struct internal_event*)calloc(1,
	sizeof(struct internal_event));
	if(!c->ev) {
	free(c);
	return NULL;
	}
	c->ev->base = base;
	c->fd = fd;
	c->buffer = NULL;
	c->timeout = NULL;
	c->tcp_is_reading = 0;
	c->tcp_byte_count = 0;
	c->tcp_parent = NULL;
	c->max_tcp_count = 0;
	c->cur_tcp_count = 0;
	c->tcp_handlers = NULL;
	c->tcp_free = NULL;
	c->type = comm_raw;
	c->tcp_do_close = 0;
	c->do_not_close = 1;
	c->tcp_do_toggle_rw = 0;
	c->tcp_check_nb_connect = 0;
	#ifdef USE_MSG_FASTOPEN
	c->tcp_do_fastopen = 0;
	#endif
	#ifdef USE_DNSCRYPT
	c->dnscrypt = 0;
	c->dnscrypt_buffer = c->buffer;
	#endif
	c->callback = callback;
	c->cb_arg = callback_arg;
	/* ub_event stuff */
	if(writing)
	evbits = UB_EV_PERSIST \| UB_EV_WRITE;
	else evbits = UB_EV_PERSIST \| UB_EV_READ;
	c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits,
	comm_point_raw_handle_callback, c);
	if(c->ev->ev == NULL) {
	log_err("could not baseset rawhdl event");
	free(c->ev);
	free(c);
	return NULL;
	}
	if (ub_event_add(c->ev->ev, c->timeout) != 0) {
	log_err("could not add rawhdl event");
	ub_event_free(c->ev->ev);
	free(c->ev);
	free(c);
	return NULL;
	}
	return c;
	}

	void
	comm_point_close(struct comm_point* c)
	{
	if(!c)
	return;
	if(c->fd != -1) {
	if(ub_event_del(c->ev->ev) != 0) {
	log_err("could not event_del on close");
	}
	}
	tcl_close_connection(c->tcl_addr);
	+ if(c->tcp_req_info)
	+ tcp_req_info_clear(c->tcp_req_info);
	/* close fd after removing from event lists, or epoll.. is messed up */
	if(c->fd != -1 && !c->do_not_close) {
	if(c->type == comm_tcp \|\| c->type == comm_http) {
	/* delete sticky events for the fd, it gets closed */
	ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_READ);
	ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE);
	}
	verbose(VERB_ALGO, "close fd %d", c->fd);
	#ifndef USE_WINSOCK
	close(c->fd);
	#else
	closesocket(c->fd);
	#endif
	}
	c->fd = -1;
	}

	void
	comm_point_delete(struct comm_point* c)
	{
	if(!c)
	return;
	if((c->type == comm_tcp \|\| c->type == comm_http) && c->ssl) {
	#ifdef HAVE_SSL
	SSL_shutdown(c->ssl);
	SSL_free(c->ssl);
	#endif
	}
	comm_point_close(c);
	if(c->tcp_handlers) {
	int i;
	for(i=0; i<c->max_tcp_count; i++)
	comm_point_delete(c->tcp_handlers[i]);
	free(c->tcp_handlers);
	}
	free(c->timeout);
	if(c->type == comm_tcp \|\| c->type == comm_local \|\| c->type == comm_http) {
	sldns_buffer_free(c->buffer);
	#ifdef USE_DNSCRYPT
	if(c->dnscrypt && c->dnscrypt_buffer != c->buffer) {
	sldns_buffer_free(c->dnscrypt_buffer);
	}
	#endif
	+ if(c->tcp_req_info) {
	+ tcp_req_info_delete(c->tcp_req_info);
	+ }
	}
	ub_event_free(c->ev->ev);
	free(c->ev);
	free(c);
	}

	void
	comm_point_send_reply(struct comm_reply *repinfo)
	{
	struct sldns_buffer* buffer;
	log_assert(repinfo && repinfo->c);
	#ifdef USE_DNSCRYPT
	buffer = repinfo->c->dnscrypt_buffer;
	if(!dnsc_handle_uncurved_request(repinfo)) {
	return;
	}
	#else
	buffer = repinfo->c->buffer;
	#endif
	if(repinfo->c->type == comm_udp) {
	if(repinfo->srctype)
	comm_point_send_udp_msg_if(repinfo->c,
	buffer, (struct sockaddr*)&repinfo->addr,
	repinfo->addrlen, repinfo);
	else
	comm_point_send_udp_msg(repinfo->c, buffer,
	(struct sockaddr*)&repinfo->addr, repinfo->addrlen);
	#ifdef USE_DNSTAP
	if(repinfo->c->dtenv != NULL &&
	repinfo->c->dtenv->log_client_response_messages)
	dt_msg_send_client_response(repinfo->c->dtenv,
	&repinfo->addr, repinfo->c->type, repinfo->c->buffer);
	#endif
	} else {
	#ifdef USE_DNSTAP
	if(repinfo->c->tcp_parent->dtenv != NULL &&
	repinfo->c->tcp_parent->dtenv->log_client_response_messages)
	dt_msg_send_client_response(repinfo->c->tcp_parent->dtenv,
	&repinfo->addr, repinfo->c->type, repinfo->c->buffer);
	#endif
	- comm_point_start_listening(repinfo->c, -1,
	- repinfo->c->tcp_timeout_msec);
	+ if(repinfo->c->tcp_req_info) {
	+ tcp_req_info_send_reply(repinfo->c->tcp_req_info);
	+ } else {
	+ comm_point_start_listening(repinfo->c, -1,
	+ repinfo->c->tcp_timeout_msec);
	+ }
	}
	}

	void
	comm_point_drop_reply(struct comm_reply* repinfo)
	{
	if(!repinfo)
	return;
	log_assert(repinfo && repinfo->c);
	log_assert(repinfo->c->type != comm_tcp_accept);
	if(repinfo->c->type == comm_udp)
	return;
	+ if(repinfo->c->tcp_req_info)
	+ repinfo->c->tcp_req_info->is_drop = 1;
	reclaim_tcp_handler(repinfo->c);
	}

	void
	comm_point_stop_listening(struct comm_point* c)
	{
	verbose(VERB_ALGO, "comm point stop listening %d", c->fd);
	if(ub_event_del(c->ev->ev) != 0) {
	log_err("event_del error to stoplisten");
	}
	}

	void
	comm_point_start_listening(struct comm_point* c, int newfd, int msec)
	{
	- verbose(VERB_ALGO, "comm point start listening %d",
	- c->fd==-1?newfd:c->fd);
	+ verbose(VERB_ALGO, "comm point start listening %d (%d msec)",
	+ c->fd==-1?newfd:c->fd, msec);
	if(c->type == comm_tcp_accept && !c->tcp_free) {
	/* no use to start listening no free slots. */
	return;
	}
	if(msec != -1 && msec != 0) {
	if(!c->timeout) {
	c->timeout = (struct timeval*)malloc(sizeof(
	struct timeval));
	if(!c->timeout) {
	log_err("cpsl: malloc failed. No net read.");
	return;
	}
	}
	ub_event_add_bits(c->ev->ev, UB_EV_TIMEOUT);
	#ifndef S_SPLINT_S /* splint fails on struct timeval. */
	c->timeout->tv_sec = msec/1000;
	c->timeout->tv_usec = (msec%1000)*1000;
	#endif /* S_SPLINT_S */
	}
	if(c->type == comm_tcp \|\| c->type == comm_http) {
	ub_event_del_bits(c->ev->ev, UB_EV_READ\|UB_EV_WRITE);
	if(c->tcp_is_reading)
	ub_event_add_bits(c->ev->ev, UB_EV_READ);
	else ub_event_add_bits(c->ev->ev, UB_EV_WRITE);
	}
	if(newfd != -1) {
	if(c->fd != -1) {
	#ifndef USE_WINSOCK
	close(c->fd);
	#else
	closesocket(c->fd);
	#endif
	}
	c->fd = newfd;
	ub_event_set_fd(c->ev->ev, c->fd);
	}
	if(ub_event_add(c->ev->ev, msec==0?NULL:c->timeout) != 0) {
	log_err("event_add failed. in cpsl.");
	}
	}

	void comm_point_listen_for_rw(struct comm_point* c, int rd, int wr)
	{
	verbose(VERB_ALGO, "comm point listen_for_rw %d %d", c->fd, wr);
	if(ub_event_del(c->ev->ev) != 0) {
	log_err("event_del error to cplf");
	}
	ub_event_del_bits(c->ev->ev, UB_EV_READ\|UB_EV_WRITE);
	if(rd) ub_event_add_bits(c->ev->ev, UB_EV_READ);
	if(wr) ub_event_add_bits(c->ev->ev, UB_EV_WRITE);
	if(ub_event_add(c->ev->ev, c->timeout) != 0) {
	log_err("event_add failed. in cplf.");
	}
	}

	size_t comm_point_get_mem(struct comm_point* c)
	{
	size_t s;
	if(!c)
	return 0;
	s = sizeof(c) + sizeof(c->ev);
	if(c->timeout)
	s += sizeof(*c->timeout);
	if(c->type == comm_tcp \|\| c->type == comm_local) {
	s += sizeof(*c->buffer) + sldns_buffer_capacity(c->buffer);
	#ifdef USE_DNSCRYPT
	s += sizeof(*c->dnscrypt_buffer);
	if(c->buffer != c->dnscrypt_buffer) {
	s += sldns_buffer_capacity(c->dnscrypt_buffer);
	}
	#endif
	}
	if(c->type == comm_tcp_accept) {
	int i;
	for(i=0; i<c->max_tcp_count; i++)
	s += comm_point_get_mem(c->tcp_handlers[i]);
	}
	return s;
	}

	struct comm_timer*
	comm_timer_create(struct comm_base* base, void (cb)(void), void* cb_arg)
	{
	struct internal_timer tm = (struct internal_timer)calloc(1,
	sizeof(struct internal_timer));
	if(!tm) {
	log_err("malloc failed");
	return NULL;
	}
	tm->super.ev_timer = tm;
	tm->base = base;
	tm->super.callback = cb;
	tm->super.cb_arg = cb_arg;
	tm->ev = ub_event_new(base->eb->base, -1, UB_EV_TIMEOUT,
	comm_timer_callback, &tm->super);
	if(tm->ev == NULL) {
	log_err("timer_create: event_base_set failed.");
	free(tm);
	return NULL;
	}
	return &tm->super;
	}

	void
	comm_timer_disable(struct comm_timer* timer)
	{
	if(!timer)
	return;
	ub_timer_del(timer->ev_timer->ev);
	timer->ev_timer->enabled = 0;
	}

	void
	comm_timer_set(struct comm_timer* timer, struct timeval* tv)
	{
	log_assert(tv);
	if(timer->ev_timer->enabled)
	comm_timer_disable(timer);
	if(ub_timer_add(timer->ev_timer->ev, timer->ev_timer->base->eb->base,
	comm_timer_callback, timer, tv) != 0)
	log_err("comm_timer_set: evtimer_add failed.");
	timer->ev_timer->enabled = 1;
	}

	void
	comm_timer_delete(struct comm_timer* timer)
	{
	if(!timer)
	return;
	comm_timer_disable(timer);
	/* Free the sub struct timer->ev_timer derived from the super struct timer.
	* i.e. assert(timer == timer->ev_timer)
	*/
	ub_event_free(timer->ev_timer->ev);
	free(timer->ev_timer);
	}

	void
	comm_timer_callback(int ATTR_UNUSED(fd), short event, void* arg)
	{
	struct comm_timer* tm = (struct comm_timer*)arg;
	if(!(event&UB_EV_TIMEOUT))
	return;
	ub_comm_base_now(tm->ev_timer->base);
	tm->ev_timer->enabled = 0;
	fptr_ok(fptr_whitelist_comm_timer(tm->callback));
	(*tm->callback)(tm->cb_arg);
	}

	int
	comm_timer_is_set(struct comm_timer* timer)
	{
	return (int)timer->ev_timer->enabled;
	}

	size_t
	comm_timer_get_mem(struct comm_timer* ATTR_UNUSED(timer))
	{
	return sizeof(struct internal_timer);
	}

	struct comm_signal*
	comm_signal_create(struct comm_base* base,
	void (callback)(int, void), void* cb_arg)
	{
	struct comm_signal* com = (struct comm_signal*)malloc(
	sizeof(struct comm_signal));
	if(!com) {
	log_err("malloc failed");
	return NULL;
	}
	com->base = base;
	com->callback = callback;
	com->cb_arg = cb_arg;
	com->ev_signal = NULL;
	return com;
	}

	void
	comm_signal_callback(int sig, short event, void* arg)
	{
	struct comm_signal* comsig = (struct comm_signal*)arg;
	if(!(event & UB_EV_SIGNAL))
	return;
	ub_comm_base_now(comsig->base);
	fptr_ok(fptr_whitelist_comm_signal(comsig->callback));
	(*comsig->callback)(sig, comsig->cb_arg);
	}

	int
	comm_signal_bind(struct comm_signal* comsig, int sig)
	{
	struct internal_signal* entry = (struct internal_signal*)calloc(1,
	sizeof(struct internal_signal));
	if(!entry) {
	log_err("malloc failed");
	return 0;
	}
	log_assert(comsig);
	/* add signal event */
	entry->ev = ub_signal_new(comsig->base->eb->base, sig,
	comm_signal_callback, comsig);
	if(entry->ev == NULL) {
	log_err("Could not create signal event");
	free(entry);
	return 0;
	}
	if(ub_signal_add(entry->ev, NULL) != 0) {
	log_err("Could not add signal handler");
	ub_event_free(entry->ev);
	free(entry);
	return 0;
	}
	/* link into list */
	entry->next = comsig->ev_signal;
	comsig->ev_signal = entry;
	return 1;
	}

	void
	comm_signal_delete(struct comm_signal* comsig)
	{
	struct internal_signal* p, *np;
	if(!comsig)
	return;
	p=comsig->ev_signal;
	while(p) {
	np = p->next;
	ub_signal_del(p->ev);
	ub_event_free(p->ev);
	free(p);
	p = np;
	}
	free(comsig);
	}
	Index: head/contrib/unbound/util/netevent.h
	===================================================================
	--- head/contrib/unbound/util/netevent.h (revision 349719)
	+++ head/contrib/unbound/util/netevent.h (revision 349720)
	@@ -1,783 +1,789 @@
	/*
	* util/netevent.h - event notification
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains event notification functions.
	*
	* There are three types of communication points
	* o UDP socket - perthread buffer.
	* o TCP-accept socket - array of TCP-sockets, socketcount.
	* o TCP socket - own buffer, parent-TCPaccept, read/write state,
	* number of bytes read/written, timeout.
	*
	* There are sockets aimed towards our clients and towards the internet.
	* o frontside - aimed towards our clients, queries come in, answers back.
	* o behind - aimed towards internet, to the authoritative DNS servers.
	*
	* Several event types are available:
	* o comm_base - for thread safety of the comm points, one per thread.
	* o comm_point - udp and tcp networking, with callbacks.
	* o comm_timer - a timeout with callback.
	* o comm_signal - callbacks when signal is caught.
	* o comm_reply - holds reply info during networking callback.
	*
	*/

	#ifndef NET_EVENT_H
	#define NET_EVENT_H

	#include "dnscrypt/dnscrypt.h"

	struct sldns_buffer;
	struct comm_point;
	struct comm_reply;
	struct tcl_list;
	struct ub_event_base;

	/* internal event notification data storage structure. */
	struct internal_event;
	struct internal_base;
	struct internal_timer; /* A sub struct of the comm_timer super struct */

	/** callback from communication point function type */
	typedef int comm_point_callback_type(struct comm_point, void, int,
	struct comm_reply*);

	/** to pass no_error to callback function */
	#define NETEVENT_NOERROR 0
	/** to pass closed connection to callback function */
	#define NETEVENT_CLOSED -1
	/** to pass timeout happened to callback function */
	#define NETEVENT_TIMEOUT -2
	/** to pass fallback from capsforID to callback function; 0x20 failed */
	#define NETEVENT_CAPSFAIL -3
	/** to pass done transfer to callback function; http file is complete */
	#define NETEVENT_DONE -4

	/** timeout to slow accept calls when not possible, in msec. */
	#define NETEVENT_SLOW_ACCEPT_TIME 2000

	/**
	* A communication point dispatcher. Thread specific.
	*/
	struct comm_base {
	/** behind the scenes structure. with say libevent info. alloced */
	struct internal_base* eb;
	/** callback to stop listening on accept sockets,
	* performed when accept() will not function properly */
	void (stop_accept)(void);
	/** callback to start listening on accept sockets, performed
	* after stop_accept() then a timeout has passed. */
	void (start_accept)(void);
	/** user argument for stop_accept and start_accept functions */
	void* cb_arg;
	};

	/**
	* Reply information for a communication point.
	*/
	struct comm_reply {
	/** the comm_point with fd to send reply on to. */
	struct comm_point* c;
	/** the address (for UDP based communication) */
	struct sockaddr_storage addr;
	/** length of address */
	socklen_t addrlen;
	/** return type 0 (none), 4(IP4), 6(IP6) */
	int srctype;
	/* DnsCrypt context */
	#ifdef USE_DNSCRYPT
	uint8_t client_nonce[crypto_box_HALF_NONCEBYTES];
	uint8_t nmkey[crypto_box_BEFORENMBYTES];
	const dnsccert *dnsc_cert;
	int is_dnscrypted;
	#endif
	/** the return source interface data */
	union {
	#ifdef IPV6_PKTINFO
	struct in6_pktinfo v6info;
	#endif
	#ifdef IP_PKTINFO
	struct in_pktinfo v4info;
	#elif defined(IP_RECVDSTADDR)
	struct in_addr v4addr;
	#endif
	}
	/** variable with return source data */
	pktinfo;
	/** max udp size for udp packets */
	size_t max_udp_size;
	};

	/**
	* Communication point to the network
	* These behaviours can be accomplished by setting the flags
	* and passing return values from the callback.
	* udp frontside: called after readdone. sendafter.
	* tcp frontside: called readdone, sendafter. close.
	* udp behind: called after readdone. No send after.
	* tcp behind: write done, read done, then called. No send after.
	*/
	struct comm_point {
	/** behind the scenes structure, with say libevent info. alloced. */
	struct internal_event* ev;

	/** file descriptor for communication point */
	int fd;

	/** timeout (NULL if it does not). Malloced. */
	struct timeval* timeout;

	/** buffer pointer. Either to perthread, or own buffer or NULL */
	struct sldns_buffer* buffer;

	/* -------- TCP Handler -------- */
	/** Read/Write state for TCP */
	int tcp_is_reading;
	/** The current read/write count for TCP */
	size_t tcp_byte_count;
	/** parent communication point (for TCP sockets) */
	struct comm_point* tcp_parent;
	/** sockaddr from peer, for TCP handlers */
	struct comm_reply repinfo;

	/* -------- TCP Accept -------- */
	/** the number of TCP handlers for this tcp-accept socket */
	int max_tcp_count;
	/** current number of tcp handler in-use for this accept socket */
	int cur_tcp_count;
	/** malloced array of tcp handlers for a tcp-accept,
	of size max_tcp_count. */
	struct comm_point** tcp_handlers;
	/** linked list of free tcp_handlers to use for new queries.
	For tcp_accept the first entry, for tcp_handlers the next one. */
	struct comm_point* tcp_free;

	/* -------- SSL TCP DNS ------- */
	/** the SSL object with rw bio (owned) or for commaccept ctx ref */
	void* ssl;
	/** handshake state for init and renegotiate */
	enum {
	/** no handshake, it has been done */
	comm_ssl_shake_none = 0,
	/** ssl initial handshake wants to read */
	comm_ssl_shake_read,
	/** ssl initial handshake wants to write */
	comm_ssl_shake_write,
	/** ssl_write wants to read */
	comm_ssl_shake_hs_read,
	/** ssl_read wants to write */
	comm_ssl_shake_hs_write
	} ssl_shake_state;

	/* -------- HTTP ------- */
	/** Currently reading in http headers */
	int http_in_headers;
	/** Currently reading in chunk headers, 0=not, 1=firstline, 2=unused
	* (more lines), 3=trailer headers after chunk */
	int http_in_chunk_headers;
	/** chunked transfer */
	int http_is_chunked;
	/** http temp buffer (shared buffer for temporary work) */
	struct sldns_buffer* http_temp;
	/** http stored content in buffer */
	size_t http_stored;

	/* -------- dnstap ------- */
	/** the dnstap environment */
	struct dt_env* dtenv;

	/** is this a UDP, TCP-accept or TCP socket. */
	enum comm_point_type {
	/** UDP socket - handle datagrams. */
	comm_udp,
	/** TCP accept socket - only creates handlers if readable. */
	comm_tcp_accept,
	/** TCP handler socket - handle byteperbyte readwrite. */
	comm_tcp,
	/** HTTP handler socket */
	comm_http,
	/** AF_UNIX socket - for internal commands. */
	comm_local,
	/** raw - not DNS format - for pipe readers and writers */
	comm_raw
	}
	/** variable with type of socket, UDP,TCP-accept,TCP,pipe */
	type;

	/* ---------- Behaviour ----------- */
	/** if set the connection is NOT closed on delete. */
	int do_not_close;

	/** if set, the connection is closed on error, on timeout,
	and after read/write completes. No callback is done. */
	int tcp_do_close;

	/** if set, read/write completes:
	read/write state of tcp is toggled.
	buffer reset/bytecount reset.
	this flag cleared.
	So that when that is done the callback is called. */
	int tcp_do_toggle_rw;

	/** timeout in msec for TCP wait times for this connection */
	int tcp_timeout_msec;

	/** if set, tcp keepalive is enabled on this connection */
	int tcp_keepalive;

	/** if set, checks for pending error from nonblocking connect() call.*/
	int tcp_check_nb_connect;

	/** if set, check for connection limit on tcp accept. */
	struct tcl_list* tcp_conn_limit;
	/** the entry for the connection. */
	struct tcl_addr* tcl_addr;

	+ /** the structure to keep track of open requests on this channel */
	+ struct tcp_req_info* tcp_req_info;
	+
	#ifdef USE_MSG_FASTOPEN
	/** used to track if the sendto() call should be done when using TFO. */
	int tcp_do_fastopen;
	#endif

	#ifdef USE_DNSCRYPT
	/** Is this a dnscrypt channel */
	int dnscrypt;
	/** encrypted buffer pointer. Either to perthread, or own buffer or NULL */
	struct sldns_buffer* dnscrypt_buffer;
	#endif
	/** number of queries outstanding on this socket, used by
	* outside network for udp ports */
	int inuse;

	/** callback when done.
	tcp_accept does not get called back, is NULL then.
	If a timeout happens, callback with timeout=1 is called.
	If an error happens, callback is called with error set
	nonzero. If not NETEVENT_NOERROR, it is an errno value.
	If the connection is closed (by remote end) then the
	callback is called with error set to NETEVENT_CLOSED=-1.
	If a timeout happens on the connection, the error is set to
	NETEVENT_TIMEOUT=-2.
	The reply_info can be copied if the reply needs to happen at a
	later time. It consists of a struct with commpoint and address.
	It can be passed to a msg send routine some time later.
	Note the reply information is temporary and must be copied.
	NULL is passed for_reply info, in cases where error happened.

	declare as:
	int my_callback(struct comm_point* c, void* my_arg, int error,
	struct comm_reply *reply_info);

	if the routine returns 0, nothing is done.
	Notzero, the buffer will be sent back to client.
	For UDP this is done without changing the commpoint.
	In TCP it sets write state.
	*/
	comm_point_callback_type* callback;
	/** argument to pass to callback. */
	void *cb_arg;
	};

	/**
	* Structure only for making timeout events.
	*/
	struct comm_timer {
	/** the internal event stuff (derived) */
	struct internal_timer* ev_timer;

	/** callback function, takes user arg only */
	void (callback)(void);

	/** callback user argument */
	void* cb_arg;
	};

	/**
	* Structure only for signal events.
	*/
	struct comm_signal {
	/** the communication base */
	struct comm_base* base;

	/** the internal event stuff */
	struct internal_signal* ev_signal;

	/** callback function, takes signal number and user arg */
	void (callback)(int, void);

	/** callback user argument */
	void* cb_arg;
	};

	/**
	* Create a new comm base.
	* @param sigs: if true it attempts to create a default loop for
	* signal handling.
	* @return: the new comm base. NULL on error.
	*/
	struct comm_base* comm_base_create(int sigs);

	/**
	* Create comm base that uses the given ub_event_base (underlying pluggable
	* event mechanism pointer).
	* @param base: underlying pluggable event base.
	* @return: the new comm base. NULL on error.
	*/
	struct comm_base* comm_base_create_event(struct ub_event_base* base);

	/**
	* Delete comm base structure but not the underlying lib event base.
	* All comm points must have been deleted.
	* @param b: the base to delete.
	*/
	void comm_base_delete_no_base(struct comm_base* b);

	/**
	* Destroy a comm base.
	* All comm points must have been deleted.
	* @param b: the base to delete.
	*/
	void comm_base_delete(struct comm_base* b);

	/**
	* Obtain two pointers. The pointers never change (until base_delete()).
	* The pointers point to time values that are updated regularly.
	* @param b: the communication base that will update the time values.
	* @param tt: pointer to time in seconds is returned.
	* @param tv: pointer to time in microseconds is returned.
	*/
	void comm_base_timept(struct comm_base* b, time_t tt, struct timeval tv);

	/**
	* Dispatch the comm base events.
	* @param b: the communication to perform.
	*/
	void comm_base_dispatch(struct comm_base* b);

	/**
	* Exit from dispatch loop.
	* @param b: the communication base that is in dispatch().
	*/
	void comm_base_exit(struct comm_base* b);

	/**
	* Set the slow_accept mode handlers. You can not provide these if you do
	* not perform accept() calls.
	* @param b: comm base
	* @param stop_accept: function that stops listening to accept fds.
	* @param start_accept: function that resumes listening to accept fds.
	* @param arg: callback arg to pass to the functions.
	*/
	void comm_base_set_slow_accept_handlers(struct comm_base* b,
	void (stop_accept)(void), void (start_accept)(void), void* arg);

	/**
	* Access internal data structure (for util/tube.c on windows)
	* @param b: comm base
	* @return ub_event_base.
	*/
	struct ub_event_base* comm_base_internal(struct comm_base* b);

	/**
	* Create an UDP comm point. Calls malloc.
	* setups the structure with the parameters you provide.
	* @param base: in which base to alloc the commpoint.
	* @param fd : file descriptor of open UDP socket.
	* @param buffer: shared buffer by UDP sockets from this thread.
	* @param callback: callback function pointer.
	* @param callback_arg: will be passed to your callback function.
	* @return: returns the allocated communication point. NULL on error.
	* Sets timeout to NULL. Turns off TCP options.
	*/
	struct comm_point* comm_point_create_udp(struct comm_base* base,
	int fd, struct sldns_buffer* buffer,
	comm_point_callback_type* callback, void* callback_arg);

	/**
	* Create an UDP with ancillary data comm point. Calls malloc.
	* Uses recvmsg instead of recv to get udp message.
	* setups the structure with the parameters you provide.
	* @param base: in which base to alloc the commpoint.
	* @param fd : file descriptor of open UDP socket.
	* @param buffer: shared buffer by UDP sockets from this thread.
	* @param callback: callback function pointer.
	* @param callback_arg: will be passed to your callback function.
	* @return: returns the allocated communication point. NULL on error.
	* Sets timeout to NULL. Turns off TCP options.
	*/
	struct comm_point* comm_point_create_udp_ancil(struct comm_base* base,
	int fd, struct sldns_buffer* buffer,
	comm_point_callback_type* callback, void* callback_arg);

	/**
	* Create a TCP listener comm point. Calls malloc.
	* Setups the structure with the parameters you provide.
	* Also Creates TCP Handlers, pre allocated for you.
	* Uses the parameters you provide.
	* @param base: in which base to alloc the commpoint.
	* @param fd: file descriptor of open TCP socket set to listen nonblocking.
	* @param num: becomes max_tcp_count, the routine allocates that
	* many tcp handler commpoints.
	* @param idle_timeout: TCP idle timeout in ms.
	* @param tcp_conn_limit: TCP connection limit info.
	* @param bufsize: size of buffer to create for handlers.
	+ * @param spoolbuf: shared spool buffer for tcp_req_info structures.
	+ * or NULL to not create those structures in the tcp handlers.
	* @param callback: callback function pointer for TCP handlers.
	* @param callback_arg: will be passed to your callback function.
	* @return: returns the TCP listener commpoint. You can find the
	* TCP handlers in the array inside the listener commpoint.
	* returns NULL on error.
	* Inits timeout to NULL. All handlers are on the free list.
	*/
	struct comm_point* comm_point_create_tcp(struct comm_base* base,
	int fd, int num, int idle_timeout, struct tcl_list* tcp_conn_limit,
	- size_t bufsize, comm_point_callback_type* callback, void* callback_arg);
	+ size_t bufsize, struct sldns_buffer* spoolbuf,
	+ comm_point_callback_type* callback, void* callback_arg);

	/**
	* Create an outgoing TCP commpoint. No file descriptor is opened, left at -1.
	* @param base: in which base to alloc the commpoint.
	* @param bufsize: size of buffer to create for handlers.
	* @param callback: callback function pointer for the handler.
	* @param callback_arg: will be passed to your callback function.
	* @return: the commpoint or NULL on error.
	*/
	struct comm_point* comm_point_create_tcp_out(struct comm_base* base,
	size_t bufsize, comm_point_callback_type* callback, void* callback_arg);

	/**
	* Create an outgoing HTTP commpoint. No file descriptor is opened, left at -1.
	* @param base: in which base to alloc the commpoint.
	* @param bufsize: size of buffer to create for handlers.
	* @param callback: callback function pointer for the handler.
	* @param callback_arg: will be passed to your callback function.
	* @param temp: sldns buffer, shared between other http_out commpoints, for
	* temporary data when performing callbacks.
	* @return: the commpoint or NULL on error.
	*/
	struct comm_point* comm_point_create_http_out(struct comm_base* base,
	size_t bufsize, comm_point_callback_type* callback,
	void* callback_arg, struct sldns_buffer* temp);

	/**
	* Create commpoint to listen to a local domain file descriptor.
	* @param base: in which base to alloc the commpoint.
	* @param fd: file descriptor of open AF_UNIX socket set to listen nonblocking.
	* @param bufsize: size of buffer to create for handlers.
	* @param callback: callback function pointer for the handler.
	* @param callback_arg: will be passed to your callback function.
	* @return: the commpoint or NULL on error.
	*/
	struct comm_point* comm_point_create_local(struct comm_base* base,
	int fd, size_t bufsize,
	comm_point_callback_type* callback, void* callback_arg);

	/**
	* Create commpoint to listen to a local domain pipe descriptor.
	* @param base: in which base to alloc the commpoint.
	* @param fd: file descriptor.
	* @param writing: true if you want to listen to writes, false for reads.
	* @param callback: callback function pointer for the handler.
	* @param callback_arg: will be passed to your callback function.
	* @return: the commpoint or NULL on error.
	*/
	struct comm_point* comm_point_create_raw(struct comm_base* base,
	int fd, int writing,
	comm_point_callback_type* callback, void* callback_arg);

	/**
	* Close a comm point fd.
	* @param c: comm point to close.
	*/
	void comm_point_close(struct comm_point* c);

	/**
	* Close and deallocate (free) the comm point. If the comm point is
	* a tcp-accept point, also its tcp-handler points are deleted.
	* @param c: comm point to delete.
	*/
	void comm_point_delete(struct comm_point* c);

	/**
	* Send reply. Put message into commpoint buffer.
	* @param repinfo: The reply info copied from a commpoint callback call.
	*/
	void comm_point_send_reply(struct comm_reply* repinfo);

	/**
	* Drop reply. Cleans up.
	* @param repinfo: The reply info copied from a commpoint callback call.
	*/
	void comm_point_drop_reply(struct comm_reply* repinfo);

	/**
	* Send an udp message over a commpoint.
	* @param c: commpoint to send it from.
	* @param packet: what to send.
	* @param addr: where to send it to.
	* @param addrlen: length of addr.
	* @return: false on a failure.
	*/
	int comm_point_send_udp_msg(struct comm_point* c, struct sldns_buffer* packet,
	struct sockaddr* addr, socklen_t addrlen);

	/**
	* Stop listening for input on the commpoint. No callbacks will happen.
	* @param c: commpoint to disable. The fd is not closed.
	*/
	void comm_point_stop_listening(struct comm_point* c);

	/**
	* Start listening again for input on the comm point.
	* @param c: commpoint to enable again.
	* @param newfd: new fd, or -1 to leave fd be.
	* @param msec: timeout in milliseconds, or -1 for no (change to the) timeout.
	* So seconds*1000.
	*/
	void comm_point_start_listening(struct comm_point* c, int newfd, int msec);

	/**
	* Stop listening and start listening again for reading or writing.
	* @param c: commpoint
	* @param rd: if true, listens for reading.
	* @param wr: if true, listens for writing.
	*/
	void comm_point_listen_for_rw(struct comm_point* c, int rd, int wr);

	/**
	* Get size of memory used by comm point.
	* For TCP handlers this includes subhandlers.
	* For UDP handlers, this does not include the (shared) UDP buffer.
	* @param c: commpoint.
	* @return size in bytes.
	*/
	size_t comm_point_get_mem(struct comm_point* c);

	/**
	* create timer. Not active upon creation.
	* @param base: event handling base.
	* @param cb: callback function: void myfunc(void* myarg);
	* @param cb_arg: user callback argument.
	* @return: the new timer or NULL on error.
	*/
	struct comm_timer* comm_timer_create(struct comm_base* base,
	void (cb)(void), void* cb_arg);

	/**
	* disable timer. Stops callbacks from happening.
	* @param timer: to disable.
	*/
	void comm_timer_disable(struct comm_timer* timer);

	/**
	* reset timevalue for timer.
	* @param timer: timer to (re)set.
	* @param tv: when the timer should activate. if NULL timer is disabled.
	*/
	void comm_timer_set(struct comm_timer* timer, struct timeval* tv);

	/**
	* delete timer.
	* @param timer: to delete.
	*/
	void comm_timer_delete(struct comm_timer* timer);

	/**
	* see if timeout has been set to a value.
	* @param timer: the timer to examine.
	* @return: false if disabled or not set.
	*/
	int comm_timer_is_set(struct comm_timer* timer);

	/**
	* Get size of memory used by comm timer.
	* @param timer: the timer to examine.
	* @return size in bytes.
	*/
	size_t comm_timer_get_mem(struct comm_timer* timer);

	/**
	* Create a signal handler. Call signal_bind() later to bind to a signal.
	* @param base: communication base to use.
	* @param callback: called when signal is caught.
	* @param cb_arg: user argument to callback
	* @return: the signal struct or NULL on error.
	*/
	struct comm_signal* comm_signal_create(struct comm_base* base,
	void (callback)(int, void), void* cb_arg);

	/**
	* Bind signal struct to catch a signal. A signle comm_signal can be bound
	* to multiple signals, calling comm_signal_bind multiple times.
	* @param comsig: the communication point, with callback information.
	* @param sig: signal number.
	* @return: true on success. false on error.
	*/
	int comm_signal_bind(struct comm_signal* comsig, int sig);

	/**
	* Delete the signal communication point.
	* @param comsig: to delete.
	*/
	void comm_signal_delete(struct comm_signal* comsig);

	/**
	* perform accept(2) with error checking.
	* @param c: commpoint with accept fd.
	* @param addr: remote end returned here.
	* @param addrlen: length of remote end returned here.
	* @return new fd, or -1 on error.
	* if -1, error message has been printed if necessary, simply drop
	* out of the reading handler.
	*/
	int comm_point_perform_accept(struct comm_point* c,
	struct sockaddr_storage* addr, socklen_t* addrlen);

	/** internal routines **/

	/**
	* This routine is published for checks and tests, and is only used internally.
	* handle libevent callback for udp comm point.
	* @param fd: file descriptor.
	* @param event: event bits from libevent:
	* EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
	* @param arg: the comm_point structure.
	*/
	void comm_point_udp_callback(int fd, short event, void* arg);

	/**
	* This routine is published for checks and tests, and is only used internally.
	* handle libevent callback for udp ancillary data comm point.
	* @param fd: file descriptor.
	* @param event: event bits from libevent:
	* EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
	* @param arg: the comm_point structure.
	*/
	void comm_point_udp_ancil_callback(int fd, short event, void* arg);

	/**
	* This routine is published for checks and tests, and is only used internally.
	* handle libevent callback for tcp accept comm point
	* @param fd: file descriptor.
	* @param event: event bits from libevent:
	* EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
	* @param arg: the comm_point structure.
	*/
	void comm_point_tcp_accept_callback(int fd, short event, void* arg);

	/**
	* This routine is published for checks and tests, and is only used internally.
	* handle libevent callback for tcp data comm point
	* @param fd: file descriptor.
	* @param event: event bits from libevent:
	* EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
	* @param arg: the comm_point structure.
	*/
	void comm_point_tcp_handle_callback(int fd, short event, void* arg);

	/**
	* This routine is published for checks and tests, and is only used internally.
	* handle libevent callback for tcp data comm point
	* @param fd: file descriptor.
	* @param event: event bits from libevent:
	* EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
	* @param arg: the comm_point structure.
	*/
	void comm_point_http_handle_callback(int fd, short event, void* arg);

	/**
	* This routine is published for checks and tests, and is only used internally.
	* handle libevent callback for timer comm.
	* @param fd: file descriptor (always -1).
	* @param event: event bits from libevent:
	* EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
	* @param arg: the comm_timer structure.
	*/
	void comm_timer_callback(int fd, short event, void* arg);

	/**
	* This routine is published for checks and tests, and is only used internally.
	* handle libevent callback for signal comm.
	* @param fd: file descriptor (used for the signal number).
	* @param event: event bits from libevent:
	* EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
	* @param arg: the internal commsignal structure.
	*/
	void comm_signal_callback(int fd, short event, void* arg);

	/**
	* This routine is published for checks and tests, and is only used internally.
	* libevent callback for AF_UNIX fds
	* @param fd: file descriptor.
	* @param event: event bits from libevent:
	* EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
	* @param arg: the comm_point structure.
	*/
	void comm_point_local_handle_callback(int fd, short event, void* arg);

	/**
	* This routine is published for checks and tests, and is only used internally.
	* libevent callback for raw fd access.
	* @param fd: file descriptor.
	* @param event: event bits from libevent:
	* EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
	* @param arg: the comm_point structure.
	*/
	void comm_point_raw_handle_callback(int fd, short event, void* arg);

	/**
	* This routine is published for checks and tests, and is only used internally.
	* libevent callback for timeout on slow accept.
	* @param fd: file descriptor.
	* @param event: event bits from libevent:
	* EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
	* @param arg: the comm_point structure.
	*/
	void comm_base_handle_slow_accept(int fd, short event, void* arg);

	#ifdef USE_WINSOCK
	/**
	* Callback for openssl BIO to on windows detect WSAEWOULDBLOCK and notify
	* the winsock_event of this for proper TCP nonblocking implementation.
	* @param c: comm_point, fd must be set its struct event is registered.
	* @param ssl: openssl SSL, fd must be set so it has a bio.
	*/
	void comm_point_tcp_win_bio_cb(struct comm_point* c, void* ssl);
	#endif

	/** see if errno for tcp connect has to be logged or not. This uses errno */
	int tcp_connect_errno_needs_log(struct sockaddr* addr, socklen_t addrlen);

	#endif /* NET_EVENT_H */
	Index: head/contrib/unbound/util/storage/lookup3.c
	===================================================================
	--- head/contrib/unbound/util/storage/lookup3.c (revision 349719)
	+++ head/contrib/unbound/util/storage/lookup3.c (revision 349720)
	@@ -1,1046 +1,1050 @@
	/*
	+ May 2019(Wouter) patch to enable the valgrind clean implementation all the
	+ time. This enables better security audit and checks, which is better
	+ than the speedup. Git issue #30. Renamed the define ARRAY_CLEAN_ACCESS.
	February 2013(Wouter) patch defines for BSD endianness, from Brad Smith.
	January 2012(Wouter) added randomised initial value, fallout from 28c3.
	March 2007(Wouter) adapted from lookup3.c original, add config.h include.
	added #ifdef VALGRIND to remove 298,384,660 'unused variable k8' warnings.
	added include of lookup3.h to check definitions match declarations.
	removed include of stdint - config.h takes care of platform independence.
	added fallthrough comments for new gcc warning suppression.
	url http://burtleburtle.net/bob/hash/index.html.
	*/
	/*
	-------------------------------------------------------------------------------
	lookup3.c, by Bob Jenkins, May 2006, Public Domain.

	These are functions for producing 32-bit hashes for hash table lookup.
	hashword(), hashlittle(), hashlittle2(), hashbig(), mix(), and final()
	are externally useful functions. Routines to test the hash are included
	if SELF_TEST is defined. You can use this free for any purpose. It's in
	the public domain. It has no warranty.

	You probably want to use hashlittle(). hashlittle() and hashbig()
	hash byte arrays. hashlittle() is is faster than hashbig() on
	little-endian machines. Intel and AMD are little-endian machines.
	On second thought, you probably want hashlittle2(), which is identical to
	hashlittle() except it returns two 32-bit hashes for the price of one.
	You could implement hashbig2() if you wanted but I haven't bothered here.

	If you want to find a hash of, say, exactly 7 integers, do
	a = i1; b = i2; c = i3;
	mix(a,b,c);
	a += i4; b += i5; c += i6;
	mix(a,b,c);
	a += i7;
	final(a,b,c);
	then use c as the hash value. If you have a variable length array of
	4-byte integers to hash, use hashword(). If you have a byte array (like
	a character string), use hashlittle(). If you have several byte arrays, or
	a mix of things, see the comments above hashlittle().

	Why is this so big? I read 12 bytes at a time into 3 4-byte integers,
	then mix those integers. This is fast (you can do a lot more thorough
	mixing with 12*3 instructions on 3 integers than you can with 3 instructions
	on 1 byte), but shoehorning those bytes into integers efficiently is messy.
	-------------------------------------------------------------------------------
	*/
	/#define SELF_TEST 1/
	+#define ARRAY_CLEAN_ACCESS 1

	#include "config.h"
	#include "util/storage/lookup3.h"
	#include <stdio.h> /* defines printf for tests */
	#include <time.h> /* defines time_t for timings in the test */
	/#include <stdint.h> defines uint32_t etc (from config.h) /
	#include <sys/param.h> /* attempt to define endianness */
	#ifdef HAVE_SYS_TYPES_H
	# include <sys/types.h> /* attempt to define endianness (solaris) */
	#endif
	#if defined(linux) \|\| defined(__OpenBSD__)
	# ifdef HAVE_ENDIAN_H
	# include <endian.h> /* attempt to define endianness */
	# else
	# include <machine/endian.h> /* on older OpenBSD */
	# endif
	#endif
	#if defined(__FreeBSD__) \|\| defined(__NetBSD__) \|\| defined(__DragonFly__)
	#include <sys/endian.h> /* attempt to define endianness */
	#endif

	/* random initial value */
	static uint32_t raninit = (uint32_t)0xdeadbeef;

	void
	hash_set_raninit(uint32_t v)
	{
	raninit = v;
	}

	/*
	* My best guess at if you are big-endian or little-endian. This may
	* need adjustment.
	*/
	#if (defined(__BYTE_ORDER) && defined(__LITTLE_ENDIAN) && \
	__BYTE_ORDER == __LITTLE_ENDIAN) \|\| \
	(defined(i386) \|\| defined(__i386__) \|\| defined(__i486__) \|\| \
	defined(__i586__) \|\| defined(__i686__) \|\| defined(vax) \|\| defined(MIPSEL) \|\| defined(__x86))
	# define HASH_LITTLE_ENDIAN 1
	# define HASH_BIG_ENDIAN 0
	#elif (defined(__BYTE_ORDER) && defined(__BIG_ENDIAN) && \
	__BYTE_ORDER == __BIG_ENDIAN) \|\| \
	(defined(sparc) \|\| defined(__sparc) \|\| defined(__sparc__) \|\| defined(POWERPC) \|\| defined(mc68000) \|\| defined(sel))
	# define HASH_LITTLE_ENDIAN 0
	# define HASH_BIG_ENDIAN 1
	#elif defined(_MACHINE_ENDIAN_H_)
	/* test for machine_endian_h protects failure if some are empty strings */
	# if defined(_BYTE_ORDER) && defined(_BIG_ENDIAN) && _BYTE_ORDER == _BIG_ENDIAN
	# define HASH_LITTLE_ENDIAN 0
	# define HASH_BIG_ENDIAN 1
	# endif
	# if defined(_BYTE_ORDER) && defined(_LITTLE_ENDIAN) && _BYTE_ORDER == _LITTLE_ENDIAN
	# define HASH_LITTLE_ENDIAN 1
	# define HASH_BIG_ENDIAN 0
	# endif /* _MACHINE_ENDIAN_H_ */
	#else
	# define HASH_LITTLE_ENDIAN 0
	# define HASH_BIG_ENDIAN 0
	#endif

	#define hashsize(n) ((uint32_t)1<<(n))
	#define hashmask(n) (hashsize(n)-1)
	#define rot(x,k) (((x)<<(k)) \| ((x)>>(32-(k))))

	/*
	-------------------------------------------------------------------------------
	mix -- mix 3 32-bit values reversibly.

	This is reversible, so any information in (a,b,c) before mix() is
	still in (a,b,c) after mix().

	If four pairs of (a,b,c) inputs are run through mix(), or through
	mix() in reverse, there are at least 32 bits of the output that
	are sometimes the same for one pair and different for another pair.
	This was tested for:
	* pairs that differed by one bit, by two bits, in any combination
	of top bits of (a,b,c), or in any combination of bottom bits of
	(a,b,c).
	* "differ" is defined as +, -, ^, or ~^. For + and -, I transformed
	the output delta to a Gray code (a^(a>>1)) so a string of 1's (as
	is commonly produced by subtraction) look like a single 1-bit
	difference.
	* the base values were pseudorandom, all zero but one bit set, or
	all zero plus a counter that starts at zero.

	Some k values for my "a-=c; a^=rot(c,k); c+=b;" arrangement that
	satisfy this are
	4 6 8 16 19 4
	9 15 3 18 27 15
	14 9 3 7 17 3
	Well, "9 15 3 18 27 15" didn't quite get 32 bits diffing
	for "differ" defined as + with a one-bit base and a two-bit delta. I
	used http://burtleburtle.net/bob/hash/avalanche.html to choose
	the operations, constants, and arrangements of the variables.

	This does not achieve avalanche. There are input bits of (a,b,c)
	that fail to affect some output bits of (a,b,c), especially of a. The
	most thoroughly mixed value is c, but it doesn't really even achieve
	avalanche in c.

	This allows some parallelism. Read-after-writes are good at doubling
	the number of bits affected, so the goal of mixing pulls in the opposite
	direction as the goal of parallelism. I did what I could. Rotates
	seem to cost as much as shifts on every machine I could lay my hands
	on, and rotates are much kinder to the top and bottom bits, so I used
	rotates.
	-------------------------------------------------------------------------------
	*/
	#define mix(a,b,c) \
	{ \
	a -= c; a ^= rot(c, 4); c += b; \
	b -= a; b ^= rot(a, 6); a += c; \
	c -= b; c ^= rot(b, 8); b += a; \
	a -= c; a ^= rot(c,16); c += b; \
	b -= a; b ^= rot(a,19); a += c; \
	c -= b; c ^= rot(b, 4); b += a; \
	}

	/*
	-------------------------------------------------------------------------------
	final -- final mixing of 3 32-bit values (a,b,c) into c

	Pairs of (a,b,c) values differing in only a few bits will usually
	produce values of c that look totally different. This was tested for
	* pairs that differed by one bit, by two bits, in any combination
	of top bits of (a,b,c), or in any combination of bottom bits of
	(a,b,c).
	* "differ" is defined as +, -, ^, or ~^. For + and -, I transformed
	the output delta to a Gray code (a^(a>>1)) so a string of 1's (as
	is commonly produced by subtraction) look like a single 1-bit
	difference.
	* the base values were pseudorandom, all zero but one bit set, or
	all zero plus a counter that starts at zero.

	These constants passed:
	14 11 25 16 4 14 24
	12 14 25 16 4 14 24
	and these came close:
	4 8 15 26 3 22 24
	10 8 15 26 3 22 24
	11 8 15 26 3 22 24
	-------------------------------------------------------------------------------
	*/
	#define final(a,b,c) \
	{ \
	c ^= b; c -= rot(b,14); \
	a ^= c; a -= rot(c,11); \
	b ^= a; b -= rot(a,25); \
	c ^= b; c -= rot(b,16); \
	a ^= c; a -= rot(c,4); \
	b ^= a; b -= rot(a,14); \
	c ^= b; c -= rot(b,24); \
	}

	/*
	--------------------------------------------------------------------
	This works on all machines. To be useful, it requires
	-- that the key be an array of uint32_t's, and
	-- that the length be the number of uint32_t's in the key

	The function hashword() is identical to hashlittle() on little-endian
	machines, and identical to hashbig() on big-endian machines,
	except that the length has to be measured in uint32_ts rather than in
	bytes. hashlittle() is more complicated than hashword() only because
	hashlittle() has to dance around fitting the key bytes into registers.
	--------------------------------------------------------------------
	*/
	uint32_t hashword(
	const uint32_t k, / the key, an array of uint32_t values */
	size_t length, /* the length of the key, in uint32_ts */
	uint32_t initval) /* the previous hash, or an arbitrary value */
	{
	uint32_t a,b,c;

	/* Set up the internal state */
	a = b = c = raninit + (((uint32_t)length)<<2) + initval;

	/------------------------------------------------- handle most of the key /
	while (length > 3)
	{
	a += k[0];
	b += k[1];
	c += k[2];
	mix(a,b,c);
	length -= 3;
	k += 3;
	}

	/------------------------------------------- handle the last 3 uint32_t's /
	switch(length) /* all the case statements fall through */
	{
	case 3 : c+=k[2];
	/* fallthrough */
	case 2 : b+=k[1];
	/* fallthrough */
	case 1 : a+=k[0];
	final(a,b,c);
	case 0: /* case 0: nothing left to add */
	break;
	}
	/------------------------------------------------------ report the result /
	return c;
	}


	#ifdef SELF_TEST

	/*
	--------------------------------------------------------------------
	hashword2() -- same as hashword(), but take two seeds and return two
	32-bit values. pc and pb must both be nonnull, and pc and pb must
	both be initialized with seeds. If you pass in (*pb)==0, the output
	(*pc) will be the same as the return value from hashword().
	--------------------------------------------------------------------
	*/
	void hashword2 (
	const uint32_t k, / the key, an array of uint32_t values */
	size_t length, /* the length of the key, in uint32_ts */
	uint32_t pc, / IN: seed OUT: primary hash value */
	uint32_t pb) / IN: more seed OUT: secondary hash value */
	{
	uint32_t a,b,c;

	/* Set up the internal state */
	a = b = c = raninit + ((uint32_t)(length<<2)) + *pc;
	c += *pb;

	/------------------------------------------------- handle most of the key /
	while (length > 3)
	{
	a += k[0];
	b += k[1];
	c += k[2];
	mix(a,b,c);
	length -= 3;
	k += 3;
	}

	/------------------------------------------- handle the last 3 uint32_t's /
	switch(length) /* all the case statements fall through */
	{
	case 3 : c+=k[2];
	case 2 : b+=k[1];
	case 1 : a+=k[0];
	final(a,b,c);
	case 0: /* case 0: nothing left to add */
	break;
	}
	/------------------------------------------------------ report the result /
	pc=c; pb=b;
	}

	#endif /* SELF_TEST */

	/*
	-------------------------------------------------------------------------------
	hashlittle() -- hash a variable-length key into a 32-bit value
	k : the key (the unaligned variable-length array of bytes)
	length : the length of the key, counting by bytes
	initval : can be any 4-byte value
	Returns a 32-bit value. Every bit of the key affects every bit of
	the return value. Two keys differing by one or two bits will have
	totally different hash values.

	The best hash table sizes are powers of 2. There is no need to do
	mod a prime (mod is sooo slow!). If you need less than 32 bits,
	use a bitmask. For example, if you need only 10 bits, do
	h = (h & hashmask(10));
	In which case, the hash table should have hashsize(10) elements.

	If you are hashing n strings (uint8_t **)k, do it like this:
	for (i=0, h=0; i<n; ++i) h = hashlittle( k[i], len[i], h);

	By Bob Jenkins, 2006. bob_jenkins@burtleburtle.net. You may use this
	code any way you wish, private, educational, or commercial. It's free.

	Use for hash table lookup, or anything where one collision in 2^^32 is
	acceptable. Do NOT use for cryptographic purposes.
	-------------------------------------------------------------------------------
	*/

	uint32_t hashlittle( const void *key, size_t length, uint32_t initval)
	{
	uint32_t a,b,c; /* internal state */
	union { const void ptr; size_t i; } u; / needed for Mac Powerbook G4 */

	/* Set up the internal state */
	a = b = c = raninit + ((uint32_t)length) + initval;

	u.ptr = key;
	if (HASH_LITTLE_ENDIAN && ((u.i & 0x3) == 0)) {
	const uint32_t k = (const uint32_t )key; /* read 32-bit chunks */
	-#ifdef VALGRIND
	+#ifdef ARRAY_CLEAN_ACCESS
	const uint8_t *k8;
	#endif

	/------ all but last block: aligned reads and affect 32 bits of (a,b,c) /
	while (length > 12)
	{
	a += k[0];
	b += k[1];
	c += k[2];
	mix(a,b,c);
	length -= 12;
	k += 3;
	}

	/----------------------------- handle the last (probably partial) block /
	/*
	* "k[2]&0xffffff" actually reads beyond the end of the string, but
	* then masks off the part it's not allowed to read. Because the
	* string is aligned, the masked-off tail is in the same word as the
	* rest of the string. Every machine with memory protection I've seen
	* does it on word boundaries, so is OK with this. But VALGRIND will
	* still catch it and complain. The masking trick does make the hash
	* noticeably faster for short strings (like English words).
	*/
	-#ifndef VALGRIND
	+#ifndef ARRAY_CLEAN_ACCESS

	switch(length)
	{
	case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
	case 11: c+=k[2]&0xffffff; b+=k[1]; a+=k[0]; break;
	case 10: c+=k[2]&0xffff; b+=k[1]; a+=k[0]; break;
	case 9 : c+=k[2]&0xff; b+=k[1]; a+=k[0]; break;
	case 8 : b+=k[1]; a+=k[0]; break;
	case 7 : b+=k[1]&0xffffff; a+=k[0]; break;
	case 6 : b+=k[1]&0xffff; a+=k[0]; break;
	case 5 : b+=k[1]&0xff; a+=k[0]; break;
	case 4 : a+=k[0]; break;
	case 3 : a+=k[0]&0xffffff; break;
	case 2 : a+=k[0]&0xffff; break;
	case 1 : a+=k[0]&0xff; break;
	case 0 : return c; /* zero length strings require no mixing */
	}

	#else /* make valgrind happy */

	k8 = (const uint8_t *)k;
	switch(length)
	{
	case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
	case 11: c+=((uint32_t)k8[10])<<16; /* fall through */
	case 10: c+=((uint32_t)k8[9])<<8; /* fall through */
	case 9 : c+=k8[8]; /* fall through */
	case 8 : b+=k[1]; a+=k[0]; break;
	case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */
	case 6 : b+=((uint32_t)k8[5])<<8; /* fall through */
	case 5 : b+=k8[4]; /* fall through */
	case 4 : a+=k[0]; break;
	case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */
	case 2 : a+=((uint32_t)k8[1])<<8; /* fall through */
	case 1 : a+=k8[0]; break;
	case 0 : return c;
	}

	#endif /* !valgrind */

	} else if (HASH_LITTLE_ENDIAN && ((u.i & 0x1) == 0)) {
	const uint16_t k = (const uint16_t )key; /* read 16-bit chunks */
	const uint8_t *k8;

	/--------------- all but last block: aligned reads and different mixing /
	while (length > 12)
	{
	a += k[0] + (((uint32_t)k[1])<<16);
	b += k[2] + (((uint32_t)k[3])<<16);
	c += k[4] + (((uint32_t)k[5])<<16);
	mix(a,b,c);
	length -= 12;
	k += 6;
	}

	/----------------------------- handle the last (probably partial) block /
	k8 = (const uint8_t *)k;
	switch(length)
	{
	case 12: c+=k[4]+(((uint32_t)k[5])<<16);
	b+=k[2]+(((uint32_t)k[3])<<16);
	a+=k[0]+(((uint32_t)k[1])<<16);
	break;
	case 11: c+=((uint32_t)k8[10])<<16; /* fall through */
	case 10: c+=k[4];
	b+=k[2]+(((uint32_t)k[3])<<16);
	a+=k[0]+(((uint32_t)k[1])<<16);
	break;
	case 9 : c+=k8[8]; /* fall through */
	case 8 : b+=k[2]+(((uint32_t)k[3])<<16);
	a+=k[0]+(((uint32_t)k[1])<<16);
	break;
	case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */
	case 6 : b+=k[2];
	a+=k[0]+(((uint32_t)k[1])<<16);
	break;
	case 5 : b+=k8[4]; /* fall through */
	case 4 : a+=k[0]+(((uint32_t)k[1])<<16);
	break;
	case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */
	case 2 : a+=k[0];
	break;
	case 1 : a+=k8[0];
	break;
	case 0 : return c; /* zero length requires no mixing */
	}

	} else { /* need to read the key one byte at a time */
	const uint8_t k = (const uint8_t )key;

	/--------------- all but the last block: affect some 32 bits of (a,b,c) /
	while (length > 12)
	{
	a += k[0];
	a += ((uint32_t)k[1])<<8;
	a += ((uint32_t)k[2])<<16;
	a += ((uint32_t)k[3])<<24;
	b += k[4];
	b += ((uint32_t)k[5])<<8;
	b += ((uint32_t)k[6])<<16;
	b += ((uint32_t)k[7])<<24;
	c += k[8];
	c += ((uint32_t)k[9])<<8;
	c += ((uint32_t)k[10])<<16;
	c += ((uint32_t)k[11])<<24;
	mix(a,b,c);
	length -= 12;
	k += 12;
	}

	/-------------------------------- last block: affect all 32 bits of (c) /
	switch(length) /* all the case statements fall through */
	{
	case 12: c+=((uint32_t)k[11])<<24;
	/* fallthrough */
	case 11: c+=((uint32_t)k[10])<<16;
	/* fallthrough */
	case 10: c+=((uint32_t)k[9])<<8;
	/* fallthrough */
	case 9 : c+=k[8];
	/* fallthrough */
	case 8 : b+=((uint32_t)k[7])<<24;
	/* fallthrough */
	case 7 : b+=((uint32_t)k[6])<<16;
	/* fallthrough */
	case 6 : b+=((uint32_t)k[5])<<8;
	/* fallthrough */
	case 5 : b+=k[4];
	/* fallthrough */
	case 4 : a+=((uint32_t)k[3])<<24;
	/* fallthrough */
	case 3 : a+=((uint32_t)k[2])<<16;
	/* fallthrough */
	case 2 : a+=((uint32_t)k[1])<<8;
	/* fallthrough */
	case 1 : a+=k[0];
	break;
	case 0 : return c;
	}
	}

	final(a,b,c);
	return c;
	}

	#ifdef SELF_TEST

	/*
	* hashlittle2: return 2 32-bit hash values
	*
	* This is identical to hashlittle(), except it returns two 32-bit hash
	* values instead of just one. This is good enough for hash table
	* lookup with 2^^64 buckets, or if you want a second hash if you're not
	* happy with the first, or if you want a probably-unique 64-bit ID for
	* the key. pc is better mixed than pb, so use *pc first. If you want
	* a 64-bit value do something like "pc + (((uint64_t)pb)<<32)".
	*/
	void hashlittle2(
	const void key, / the key to hash */
	size_t length, /* length of the key */
	uint32_t pc, / IN: primary initval, OUT: primary hash */
	uint32_t pb) / IN: secondary initval, OUT: secondary hash */
	{
	uint32_t a,b,c; /* internal state */
	union { const void ptr; size_t i; } u; / needed for Mac Powerbook G4 */

	/* Set up the internal state */
	a = b = c = raninit + ((uint32_t)length) + *pc;
	c += *pb;

	u.ptr = key;
	if (HASH_LITTLE_ENDIAN && ((u.i & 0x3) == 0)) {
	const uint32_t k = (const uint32_t )key; /* read 32-bit chunks */
	#ifdef VALGRIND
	const uint8_t *k8;
	#endif

	/------ all but last block: aligned reads and affect 32 bits of (a,b,c) /
	while (length > 12)
	{
	a += k[0];
	b += k[1];
	c += k[2];
	mix(a,b,c);
	length -= 12;
	k += 3;
	}

	/----------------------------- handle the last (probably partial) block /
	/*
	* "k[2]&0xffffff" actually reads beyond the end of the string, but
	* then masks off the part it's not allowed to read. Because the
	* string is aligned, the masked-off tail is in the same word as the
	* rest of the string. Every machine with memory protection I've seen
	* does it on word boundaries, so is OK with this. But VALGRIND will
	* still catch it and complain. The masking trick does make the hash
	* noticeably faster for short strings (like English words).
	*/
	#ifndef VALGRIND

	switch(length)
	{
	case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
	case 11: c+=k[2]&0xffffff; b+=k[1]; a+=k[0]; break;
	case 10: c+=k[2]&0xffff; b+=k[1]; a+=k[0]; break;
	case 9 : c+=k[2]&0xff; b+=k[1]; a+=k[0]; break;
	case 8 : b+=k[1]; a+=k[0]; break;
	case 7 : b+=k[1]&0xffffff; a+=k[0]; break;
	case 6 : b+=k[1]&0xffff; a+=k[0]; break;
	case 5 : b+=k[1]&0xff; a+=k[0]; break;
	case 4 : a+=k[0]; break;
	case 3 : a+=k[0]&0xffffff; break;
	case 2 : a+=k[0]&0xffff; break;
	case 1 : a+=k[0]&0xff; break;
	case 0 : pc=c; pb=b; return; /* zero length strings require no mixing */
	}

	#else /* make valgrind happy */

	k8 = (const uint8_t *)k;
	switch(length)
	{
	case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
	case 11: c+=((uint32_t)k8[10])<<16; /* fall through */
	case 10: c+=((uint32_t)k8[9])<<8; /* fall through */
	case 9 : c+=k8[8]; /* fall through */
	case 8 : b+=k[1]; a+=k[0]; break;
	case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */
	case 6 : b+=((uint32_t)k8[5])<<8; /* fall through */
	case 5 : b+=k8[4]; /* fall through */
	case 4 : a+=k[0]; break;
	case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */
	case 2 : a+=((uint32_t)k8[1])<<8; /* fall through */
	case 1 : a+=k8[0]; break;
	case 0 : pc=c; pb=b; return; /* zero length strings require no mixing */
	}

	#endif /* !valgrind */

	} else if (HASH_LITTLE_ENDIAN && ((u.i & 0x1) == 0)) {
	const uint16_t k = (const uint16_t )key; /* read 16-bit chunks */
	const uint8_t *k8;

	/--------------- all but last block: aligned reads and different mixing /
	while (length > 12)
	{
	a += k[0] + (((uint32_t)k[1])<<16);
	b += k[2] + (((uint32_t)k[3])<<16);
	c += k[4] + (((uint32_t)k[5])<<16);
	mix(a,b,c);
	length -= 12;
	k += 6;
	}

	/----------------------------- handle the last (probably partial) block /
	k8 = (const uint8_t *)k;
	switch(length)
	{
	case 12: c+=k[4]+(((uint32_t)k[5])<<16);
	b+=k[2]+(((uint32_t)k[3])<<16);
	a+=k[0]+(((uint32_t)k[1])<<16);
	break;
	case 11: c+=((uint32_t)k8[10])<<16; /* fall through */
	case 10: c+=k[4];
	b+=k[2]+(((uint32_t)k[3])<<16);
	a+=k[0]+(((uint32_t)k[1])<<16);
	break;
	case 9 : c+=k8[8]; /* fall through */
	case 8 : b+=k[2]+(((uint32_t)k[3])<<16);
	a+=k[0]+(((uint32_t)k[1])<<16);
	break;
	case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */
	case 6 : b+=k[2];
	a+=k[0]+(((uint32_t)k[1])<<16);
	break;
	case 5 : b+=k8[4]; /* fall through */
	case 4 : a+=k[0]+(((uint32_t)k[1])<<16);
	break;
	case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */
	case 2 : a+=k[0];
	break;
	case 1 : a+=k8[0];
	break;
	case 0 : pc=c; pb=b; return; /* zero length strings require no mixing */
	}

	} else { /* need to read the key one byte at a time */
	const uint8_t k = (const uint8_t )key;

	/--------------- all but the last block: affect some 32 bits of (a,b,c) /
	while (length > 12)
	{
	a += k[0];
	a += ((uint32_t)k[1])<<8;
	a += ((uint32_t)k[2])<<16;
	a += ((uint32_t)k[3])<<24;
	b += k[4];
	b += ((uint32_t)k[5])<<8;
	b += ((uint32_t)k[6])<<16;
	b += ((uint32_t)k[7])<<24;
	c += k[8];
	c += ((uint32_t)k[9])<<8;
	c += ((uint32_t)k[10])<<16;
	c += ((uint32_t)k[11])<<24;
	mix(a,b,c);
	length -= 12;
	k += 12;
	}

	/-------------------------------- last block: affect all 32 bits of (c) /
	switch(length) /* all the case statements fall through */
	{
	case 12: c+=((uint32_t)k[11])<<24;
	case 11: c+=((uint32_t)k[10])<<16;
	case 10: c+=((uint32_t)k[9])<<8;
	case 9 : c+=k[8];
	case 8 : b+=((uint32_t)k[7])<<24;
	case 7 : b+=((uint32_t)k[6])<<16;
	case 6 : b+=((uint32_t)k[5])<<8;
	case 5 : b+=k[4];
	case 4 : a+=((uint32_t)k[3])<<24;
	case 3 : a+=((uint32_t)k[2])<<16;
	case 2 : a+=((uint32_t)k[1])<<8;
	case 1 : a+=k[0];
	break;
	case 0 : pc=c; pb=b; return; /* zero length strings require no mixing */
	}
	}

	final(a,b,c);
	pc=c; pb=b;
	}

	#endif /* SELF_TEST */

	#if 0 /* currently not used */

	/*
	* hashbig():
	* This is the same as hashword() on big-endian machines. It is different
	* from hashlittle() on all machines. hashbig() takes advantage of
	* big-endian byte ordering.
	*/
	uint32_t hashbig( const void *key, size_t length, uint32_t initval)
	{
	uint32_t a,b,c;
	union { const void ptr; size_t i; } u; / to cast key to (size_t) happily */

	/* Set up the internal state */
	a = b = c = raninit + ((uint32_t)length) + initval;

	u.ptr = key;
	if (HASH_BIG_ENDIAN && ((u.i & 0x3) == 0)) {
	const uint32_t k = (const uint32_t )key; /* read 32-bit chunks */
	#ifdef VALGRIND
	const uint8_t *k8;
	#endif

	/------ all but last block: aligned reads and affect 32 bits of (a,b,c) /
	while (length > 12)
	{
	a += k[0];
	b += k[1];
	c += k[2];
	mix(a,b,c);
	length -= 12;
	k += 3;
	}

	/----------------------------- handle the last (probably partial) block /
	/*
	* "k[2]<<8" actually reads beyond the end of the string, but
	* then shifts out the part it's not allowed to read. Because the
	* string is aligned, the illegal read is in the same word as the
	* rest of the string. Every machine with memory protection I've seen
	* does it on word boundaries, so is OK with this. But VALGRIND will
	* still catch it and complain. The masking trick does make the hash
	* noticeably faster for short strings (like English words).
	*/
	#ifndef VALGRIND

	switch(length)
	{
	case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
	case 11: c+=k[2]&0xffffff00; b+=k[1]; a+=k[0]; break;
	case 10: c+=k[2]&0xffff0000; b+=k[1]; a+=k[0]; break;
	case 9 : c+=k[2]&0xff000000; b+=k[1]; a+=k[0]; break;
	case 8 : b+=k[1]; a+=k[0]; break;
	case 7 : b+=k[1]&0xffffff00; a+=k[0]; break;
	case 6 : b+=k[1]&0xffff0000; a+=k[0]; break;
	case 5 : b+=k[1]&0xff000000; a+=k[0]; break;
	case 4 : a+=k[0]; break;
	case 3 : a+=k[0]&0xffffff00; break;
	case 2 : a+=k[0]&0xffff0000; break;
	case 1 : a+=k[0]&0xff000000; break;
	case 0 : return c; /* zero length strings require no mixing */
	}

	#else /* make valgrind happy */

	k8 = (const uint8_t *)k;
	switch(length) /* all the case statements fall through */
	{
	case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
	case 11: c+=((uint32_t)k8[10])<<8; /* fall through */
	case 10: c+=((uint32_t)k8[9])<<16; /* fall through */
	case 9 : c+=((uint32_t)k8[8])<<24; /* fall through */
	case 8 : b+=k[1]; a+=k[0]; break;
	case 7 : b+=((uint32_t)k8[6])<<8; /* fall through */
	case 6 : b+=((uint32_t)k8[5])<<16; /* fall through */
	case 5 : b+=((uint32_t)k8[4])<<24; /* fall through */
	case 4 : a+=k[0]; break;
	case 3 : a+=((uint32_t)k8[2])<<8; /* fall through */
	case 2 : a+=((uint32_t)k8[1])<<16; /* fall through */
	case 1 : a+=((uint32_t)k8[0])<<24; break;
	case 0 : return c;
	}

	#endif /* !VALGRIND */

	} else { /* need to read the key one byte at a time */
	const uint8_t k = (const uint8_t )key;

	/--------------- all but the last block: affect some 32 bits of (a,b,c) /
	while (length > 12)
	{
	a += ((uint32_t)k[0])<<24;
	a += ((uint32_t)k[1])<<16;
	a += ((uint32_t)k[2])<<8;
	a += ((uint32_t)k[3]);
	b += ((uint32_t)k[4])<<24;
	b += ((uint32_t)k[5])<<16;
	b += ((uint32_t)k[6])<<8;
	b += ((uint32_t)k[7]);
	c += ((uint32_t)k[8])<<24;
	c += ((uint32_t)k[9])<<16;
	c += ((uint32_t)k[10])<<8;
	c += ((uint32_t)k[11]);
	mix(a,b,c);
	length -= 12;
	k += 12;
	}

	/-------------------------------- last block: affect all 32 bits of (c) /
	switch(length) /* all the case statements fall through */
	{
	case 12: c+=k[11];
	case 11: c+=((uint32_t)k[10])<<8;
	case 10: c+=((uint32_t)k[9])<<16;
	case 9 : c+=((uint32_t)k[8])<<24;
	case 8 : b+=k[7];
	case 7 : b+=((uint32_t)k[6])<<8;
	case 6 : b+=((uint32_t)k[5])<<16;
	case 5 : b+=((uint32_t)k[4])<<24;
	case 4 : a+=k[3];
	case 3 : a+=((uint32_t)k[2])<<8;
	case 2 : a+=((uint32_t)k[1])<<16;
	case 1 : a+=((uint32_t)k[0])<<24;
	break;
	case 0 : return c;
	}
	}

	final(a,b,c);
	return c;
	}

	#endif /* 0 == currently not used */

	#ifdef SELF_TEST

	/* used for timings */
	void driver1(void)
	{
	uint8_t buf[256];
	uint32_t i;
	uint32_t h=0;
	time_t a,z;

	time(&a);
	for (i=0; i<256; ++i) buf[i] = 'x';
	for (i=0; i<1; ++i)
	{
	h = hashlittle(&buf[0],1,h);
	}
	time(&z);
	if (z-a > 0) printf("time %d %.8x\n", z-a, h);
	}

	/* check that every input bit changes every output bit half the time */
	#define HASHSTATE 1
	#define HASHLEN 1
	#define MAXPAIR 60
	#define MAXLEN 70
	void driver2(void)
	{
	uint8_t qa[MAXLEN+1], qb[MAXLEN+2], a = &qa[0], b = &qb[1];
	uint32_t c[HASHSTATE], d[HASHSTATE], i=0, j=0, k, l, m=0, z;
	uint32_t e[HASHSTATE],f[HASHSTATE],g[HASHSTATE],h[HASHSTATE];
	uint32_t x[HASHSTATE],y[HASHSTATE];
	uint32_t hlen;

	printf("No more than %d trials should ever be needed \n",MAXPAIR/2);
	for (hlen=0; hlen < MAXLEN; ++hlen)
	{
	z=0;
	for (i=0; i<hlen; ++i) /----------------------- for each input byte, /
	{
	for (j=0; j<8; ++j) /------------------------ for each input bit, /
	{
	for (m=1; m<8; ++m) /------------ for several possible initvals, /
	{
	for (l=0; l<HASHSTATE; ++l)
	e[l]=f[l]=g[l]=h[l]=x[l]=y[l]=~((uint32_t)0);

	/---- check that every output bit is affected by that input bit /
	for (k=0; k<MAXPAIR; k+=2)
	{
	uint32_t finished=1;
	/* keys have one bit different */
	for (l=0; l<hlen+1; ++l) {a[l] = b[l] = (uint8_t)0;}
	/* have a and b be two keys differing in only one bit */
	a[i] ^= (k<<j);
	a[i] ^= (k>>(8-j));
	c[0] = hashlittle(a, hlen, m);
	b[i] ^= ((k+1)<<j);
	b[i] ^= ((k+1)>>(8-j));
	d[0] = hashlittle(b, hlen, m);
	/* check every bit is 1, 0, set, and not set at least once */
	for (l=0; l<HASHSTATE; ++l)
	{
	e[l] &= (c[l]^d[l]);
	f[l] &= ~(c[l]^d[l]);
	g[l] &= c[l];
	h[l] &= ~c[l];
	x[l] &= d[l];
	y[l] &= ~d[l];
	if (e[l]\|f[l]\|g[l]\|h[l]\|x[l]\|y[l]) finished=0;
	}
	if (finished) break;
	}
	if (k>z) z=k;
	if (k==MAXPAIR)
	{
	printf("Some bit didn't change: ");
	printf("%.8x %.8x %.8x %.8x %.8x %.8x ",
	e[0],f[0],g[0],h[0],x[0],y[0]);
	printf("i %d j %d m %d len %d\n", i, j, m, hlen);
	}
	if (z==MAXPAIR) goto done;
	}
	}
	}
	done:
	if (z < MAXPAIR)
	{
	printf("Mix success %2d bytes %2d initvals ",i,m);
	printf("required %d trials\n", z/2);
	}
	}
	printf("\n");
	}

	/* Check for reading beyond the end of the buffer and alignment problems */
	void driver3(void)
	{
	uint8_t buf[MAXLEN+20], *b;
	uint32_t len;
	uint8_t q[] = "This is the time for all good men to come to the aid of their country...";
	uint32_t h;
	uint8_t qq[] = "xThis is the time for all good men to come to the aid of their country...";
	uint32_t i;
	uint8_t qqq[] = "xxThis is the time for all good men to come to the aid of their country...";
	uint32_t j;
	uint8_t qqqq[] = "xxxThis is the time for all good men to come to the aid of their country...";
	uint32_t ref,x,y;
	uint8_t *p;

	printf("Endianness. These lines should all be the same (for values filled in):\n");
	printf("%.8x %.8x %.8x\n",
	hashword((const uint32_t *)q, (sizeof(q)-1)/4, 13),
	hashword((const uint32_t *)q, (sizeof(q)-5)/4, 13),
	hashword((const uint32_t *)q, (sizeof(q)-9)/4, 13));
	p = q;
	printf("%.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x\n",
	hashlittle(p, sizeof(q)-1, 13), hashlittle(p, sizeof(q)-2, 13),
	hashlittle(p, sizeof(q)-3, 13), hashlittle(p, sizeof(q)-4, 13),
	hashlittle(p, sizeof(q)-5, 13), hashlittle(p, sizeof(q)-6, 13),
	hashlittle(p, sizeof(q)-7, 13), hashlittle(p, sizeof(q)-8, 13),
	hashlittle(p, sizeof(q)-9, 13), hashlittle(p, sizeof(q)-10, 13),
	hashlittle(p, sizeof(q)-11, 13), hashlittle(p, sizeof(q)-12, 13));
	p = &qq[1];
	printf("%.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x\n",
	hashlittle(p, sizeof(q)-1, 13), hashlittle(p, sizeof(q)-2, 13),
	hashlittle(p, sizeof(q)-3, 13), hashlittle(p, sizeof(q)-4, 13),
	hashlittle(p, sizeof(q)-5, 13), hashlittle(p, sizeof(q)-6, 13),
	hashlittle(p, sizeof(q)-7, 13), hashlittle(p, sizeof(q)-8, 13),
	hashlittle(p, sizeof(q)-9, 13), hashlittle(p, sizeof(q)-10, 13),
	hashlittle(p, sizeof(q)-11, 13), hashlittle(p, sizeof(q)-12, 13));
	p = &qqq[2];
	printf("%.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x\n",
	hashlittle(p, sizeof(q)-1, 13), hashlittle(p, sizeof(q)-2, 13),
	hashlittle(p, sizeof(q)-3, 13), hashlittle(p, sizeof(q)-4, 13),
	hashlittle(p, sizeof(q)-5, 13), hashlittle(p, sizeof(q)-6, 13),
	hashlittle(p, sizeof(q)-7, 13), hashlittle(p, sizeof(q)-8, 13),
	hashlittle(p, sizeof(q)-9, 13), hashlittle(p, sizeof(q)-10, 13),
	hashlittle(p, sizeof(q)-11, 13), hashlittle(p, sizeof(q)-12, 13));
	p = &qqqq[3];
	printf("%.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x\n",
	hashlittle(p, sizeof(q)-1, 13), hashlittle(p, sizeof(q)-2, 13),
	hashlittle(p, sizeof(q)-3, 13), hashlittle(p, sizeof(q)-4, 13),
	hashlittle(p, sizeof(q)-5, 13), hashlittle(p, sizeof(q)-6, 13),
	hashlittle(p, sizeof(q)-7, 13), hashlittle(p, sizeof(q)-8, 13),
	hashlittle(p, sizeof(q)-9, 13), hashlittle(p, sizeof(q)-10, 13),
	hashlittle(p, sizeof(q)-11, 13), hashlittle(p, sizeof(q)-12, 13));
	printf("\n");

	/* check that hashlittle2 and hashlittle produce the same results */
	i=47; j=0;
	hashlittle2(q, sizeof(q), &i, &j);
	if (hashlittle(q, sizeof(q), 47) != i)
	printf("hashlittle2 and hashlittle mismatch\n");

	/* check that hashword2 and hashword produce the same results */
	len = raninit;
	i=47, j=0;
	hashword2(&len, 1, &i, &j);
	if (hashword(&len, 1, 47) != i)
	printf("hashword2 and hashword mismatch %x %x\n",
	i, hashword(&len, 1, 47));

	/* check hashlittle doesn't read before or after the ends of the string */
	for (h=0, b=buf+1; h<8; ++h, ++b)
	{
	for (i=0; i<MAXLEN; ++i)
	{
	len = i;
	for (j=0; j<i; ++j) *(b+j)=0;

	/* these should all be equal */
	ref = hashlittle(b, len, (uint32_t)1);
	*(b+i)=(uint8_t)~0;
	*(b-1)=(uint8_t)~0;
	x = hashlittle(b, len, (uint32_t)1);
	y = hashlittle(b, len, (uint32_t)1);
	if ((ref != x) \|\| (ref != y))
	{
	printf("alignment error: %.8x %.8x %.8x %d %d\n",ref,x,y,
	h, i);
	}
	}
	}
	}

	/* check for problems with nulls */
	void driver4(void)
	{
	uint8_t buf[1];
	uint32_t h,i,state[HASHSTATE];


	buf[0] = ~0;
	for (i=0; i<HASHSTATE; ++i) state[i] = 1;
	printf("These should all be different\n");
	for (i=0, h=0; i<8; ++i)
	{
	h = hashlittle(buf, 0, h);
	printf("%2ld 0-byte strings, hash is %.8x\n", i, h);
	}
	}


	int main(void)
	{
	driver1(); /* test that the key is hashed: used for timings */
	driver2(); /* test that whole key is hashed thoroughly */
	driver3(); /* test that nothing but the key is hashed */
	driver4(); /* test hashing multiple buffers (all buffers are null) */
	return 1;
	}

	#endif /* SELF_TEST */
	Index: head/contrib/unbound/util/ub_event.c
	===================================================================
	--- head/contrib/unbound/util/ub_event.c (revision 349719)
	+++ head/contrib/unbound/util/ub_event.c (revision 349720)
	@@ -1,450 +1,464 @@
	/*
	* util/ub_event.c - directly call libevent (compatability) functions
	*
	* Copyright (c) 2007, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains and implementation for the indirection layer for pluggable
	* events that transparently passes it either directly to libevent, or calls
	* the libevent compatibility layer functions.
	*/
	#include "config.h"
	#include <sys/time.h>
	#include "util/ub_event.h"
	#include "util/log.h"
	#include "util/netevent.h"
	#include "util/tube.h"

	/* We define libevent structures here to hide the libevent stuff. */

	#ifdef USE_MINI_EVENT
	# ifdef USE_WINSOCK
	# include "util/winsock_event.h"
	# else
	# include "util/mini_event.h"
	# endif /* USE_WINSOCK */
	#else /* USE_MINI_EVENT */
	/* we use libevent */
	# ifdef HAVE_EVENT_H
	# include <event.h>
	# else
	# include "event2/event.h"
	# include "event2/event_struct.h"
	# include "event2/event_compat.h"
	# endif
	#endif /* USE_MINI_EVENT */

	#if UB_EV_TIMEOUT != EV_TIMEOUT \|\| UB_EV_READ != EV_READ \|\| \
	UB_EV_WRITE != EV_WRITE \|\| UB_EV_SIGNAL != EV_SIGNAL \|\| \
	UB_EV_PERSIST != EV_PERSIST
	/* Only necessary for libev */
	# define NATIVE_BITS(b) ( \
	(((b) & UB_EV_TIMEOUT) ? EV_TIMEOUT : 0) \
	\| (((b) & UB_EV_READ ) ? EV_READ : 0) \
	\| (((b) & UB_EV_WRITE ) ? EV_WRITE : 0) \
	\| (((b) & UB_EV_SIGNAL ) ? EV_SIGNAL : 0) \
	\| (((b) & UB_EV_PERSIST) ? EV_PERSIST : 0))

	# define UB_EV_BITS(b) ( \
	(((b) & EV_TIMEOUT) ? UB_EV_TIMEOUT : 0) \
	\| (((b) & EV_READ ) ? UB_EV_READ : 0) \
	\| (((b) & EV_WRITE ) ? UB_EV_WRITE : 0) \
	\| (((b) & EV_SIGNAL ) ? UB_EV_SIGNAL : 0) \
	\| (((b) & EV_PERSIST) ? UB_EV_PERSIST : 0))

	# define UB_EV_BITS_CB(C) void my_ ## C (int fd, short bits, void *arg) \
	{ (C)(fd, UB_EV_BITS(bits), arg); }

	UB_EV_BITS_CB(comm_point_udp_callback);
	UB_EV_BITS_CB(comm_point_udp_ancil_callback)
	UB_EV_BITS_CB(comm_point_tcp_accept_callback)
	UB_EV_BITS_CB(comm_point_tcp_handle_callback)
	UB_EV_BITS_CB(comm_timer_callback)
	UB_EV_BITS_CB(comm_signal_callback)
	UB_EV_BITS_CB(comm_point_local_handle_callback)
	UB_EV_BITS_CB(comm_point_raw_handle_callback)
	UB_EV_BITS_CB(comm_point_http_handle_callback)
	UB_EV_BITS_CB(tube_handle_signal)
	UB_EV_BITS_CB(comm_base_handle_slow_accept)

	static void (NATIVE_BITS_CB(void (cb)(int, short, void)))(int, short, void)
	{
	if(cb == comm_point_udp_callback)
	return my_comm_point_udp_callback;
	else if(cb == comm_point_udp_ancil_callback)
	return my_comm_point_udp_ancil_callback;
	else if(cb == comm_point_tcp_accept_callback)
	return my_comm_point_tcp_accept_callback;
	else if(cb == comm_point_tcp_handle_callback)
	return my_comm_point_tcp_handle_callback;
	else if(cb == comm_timer_callback)
	return my_comm_timer_callback;
	else if(cb == comm_signal_callback)
	return my_comm_signal_callback;
	else if(cb == comm_point_local_handle_callback)
	return my_comm_point_local_handle_callback;
	else if(cb == comm_point_raw_handle_callback)
	return my_comm_point_raw_handle_callback;
	else if(cb == comm_point_http_handle_callback)
	return my_comm_point_http_handle_callback;
	else if(cb == tube_handle_signal)
	return my_tube_handle_signal;
	else if(cb == comm_base_handle_slow_accept)
	return my_comm_base_handle_slow_accept;
	else {
	log_assert(0); /* this NULL callback pointer should not happen,
	we should have the necessary routine listed above */
	return NULL;
	}
	}
	#else
	# define NATIVE_BITS(b) (b)
	# define NATIVE_BITS_CB(c) (c)
	#endif

	#ifndef EVFLAG_AUTO
	#define EVFLAG_AUTO 0
	#endif

	#define AS_EVENT_BASE(x) ((struct event_base*)x)
	#define AS_UB_EVENT_BASE(x) ((struct ub_event_base*)x)
	#define AS_EVENT(x) ((struct event*)x)
	#define AS_UB_EVENT(x) ((struct ub_event*)x)

	const char* ub_event_get_version(void)
	{
	return event_get_version();
	}

	#if (defined(HAVE_EV_LOOP) \|\| defined(HAVE_EV_DEFAULT_LOOP)) && defined(EVBACKEND_SELECT)
	static const char* ub_ev_backend2str(int b)
	{
	switch(b) {
	case EVBACKEND_SELECT: return "select";
	case EVBACKEND_POLL: return "poll";
	case EVBACKEND_EPOLL: return "epoll";
	case EVBACKEND_KQUEUE: return "kqueue";
	case EVBACKEND_DEVPOLL: return "devpoll";
	case EVBACKEND_PORT: return "evport";
	}
	return "unknown";
	}
	#endif

	void
	ub_get_event_sys(struct ub_event_base* base, const char n, const char s,
	const char** m)
	{
	#ifdef USE_WINSOCK
	(void)base;
	*n = "event";
	*s = "winsock";
	*m = "WSAWaitForMultipleEvents";
	#elif defined(USE_MINI_EVENT)
	(void)base;
	*n = "mini-event";
	*s = "internal";
	*m = "select";
	#else
	struct event_base* b = AS_EVENT_BASE(base);
	*s = event_get_version();
	# if defined(HAVE_EV_LOOP) \|\| defined(HAVE_EV_DEFAULT_LOOP)
	*n = "libev";
	if (!b)
	b = (struct event_base*)ev_default_loop(EVFLAG_AUTO);
	# ifdef EVBACKEND_SELECT
	m = ub_ev_backend2str(ev_backend((struct ev_loop)b));
	# else
	*m = "not obtainable";
	# endif
	# elif defined(HAVE_EVENT_BASE_GET_METHOD)
	*n = "libevent";
	if (!b)
	b = event_base_new();
	*m = event_base_get_method(b);
	# else
	*n = "unknown";
	*m = "not obtainable";
	(void)b;
	# endif
	# ifdef HAVE_EVENT_BASE_FREE
	if (b && b != AS_EVENT_BASE(base))
	event_base_free(b);
	# endif
	#endif
	}

	struct ub_event_base*
	ub_default_event_base(int sigs, time_t* time_secs, struct timeval* time_tv)
	{
	void* base;

	(void)base;
	#ifdef USE_MINI_EVENT
	(void)sigs;
	/* use mini event time-sharing feature */
	base = event_init(time_secs, time_tv);
	#else
	(void)time_secs;
	(void)time_tv;
	# if defined(HAVE_EV_LOOP) \|\| defined(HAVE_EV_DEFAULT_LOOP)
	/* libev */
	if(sigs)
	base = ev_default_loop(EVFLAG_AUTO);
	else
	base = ev_loop_new(EVFLAG_AUTO);
	# else
	(void)sigs;
	# ifdef HAVE_EVENT_BASE_NEW
	base = event_base_new();
	# else
	base = event_init();
	# endif
	# endif
	#endif
	return (struct ub_event_base*)base;
	}

	struct ub_event_base *
	ub_libevent_event_base(struct event_base* libevent_base)
	{
	#ifdef USE_MINI_EVENT
	(void)libevent_base;
	return NULL;
	#else
	return AS_UB_EVENT_BASE(libevent_base);
	#endif
	}

	struct event_base *
	ub_libevent_get_event_base(struct ub_event_base* base)
	{
	#ifdef USE_MINI_EVENT
	(void)base;
	return NULL;
	#else
	return AS_EVENT_BASE(base);
	#endif
	}

	void
	ub_event_base_free(struct ub_event_base* base)
	{
	#ifdef USE_MINI_EVENT
	event_base_free(AS_EVENT_BASE(base));
	#elif defined(HAVE_EVENT_BASE_FREE) && defined(HAVE_EVENT_BASE_ONCE)
	/* only libevent 1.2+ has it, but in 1.2 it is broken -
	assertion fails on signal handling ev that is not deleted
	in libevent 1.3c (event_base_once appears) this is fixed. */
	event_base_free(AS_EVENT_BASE(base));
	#else
	(void)base;
	#endif /* HAVE_EVENT_BASE_FREE and HAVE_EVENT_BASE_ONCE */
	}

	int
	ub_event_base_dispatch(struct ub_event_base* base)
	{
	return event_base_dispatch(AS_EVENT_BASE(base));
	}

	int
	ub_event_base_loopexit(struct ub_event_base* base)
	{
	return event_base_loopexit(AS_EVENT_BASE(base), NULL);
	}

	struct ub_event*
	ub_event_new(struct ub_event_base* base, int fd, short bits,
	void (cb)(int, short, void), void* arg)
	{
	struct event ev = (struct event)calloc(1, sizeof(struct event));

	if (!ev)
	return NULL;

	+#ifndef HAVE_EVENT_ASSIGN
	event_set(ev, fd, NATIVE_BITS(bits), NATIVE_BITS_CB(cb), arg);
	if (event_base_set(AS_EVENT_BASE(base), ev) != 0) {
	free(ev);
	return NULL;
	}
	+#else
	+ if (event_assign(ev, AS_EVENT_BASE(base), fd, bits, cb, arg) != 0) {
	+ free(ev);
	+ return NULL;
	+ }
	+#endif
	return AS_UB_EVENT(ev);
	}

	struct ub_event*
	ub_signal_new(struct ub_event_base* base, int fd,
	void (cb)(int, short, void), void* arg)
	{
	struct event ev = (struct event)calloc(1, sizeof(struct event));

	if (!ev)
	return NULL;

	+#if !HAVE_DECL_EVSIGNAL_ASSIGN
	signal_set(ev, fd, NATIVE_BITS_CB(cb), arg);
	if (event_base_set(AS_EVENT_BASE(base), ev) != 0) {
	free(ev);
	return NULL;
	}
	+#else
	+ if (evsignal_assign(ev, AS_EVENT_BASE(base), fd, cb, arg) != 0) {
	+ free(ev);
	+ return NULL;
	+ }
	+#endif
	return AS_UB_EVENT(ev);
	}

	struct ub_event*
	ub_winsock_register_wsaevent(struct ub_event_base* base, void* wsaevent,
	void (cb)(int, short, void), void* arg)
	{
	#if defined(USE_MINI_EVENT) && defined(USE_WINSOCK)
	struct event ev = (struct event)calloc(1, sizeof(struct event));

	if (!ev)
	return NULL;

	if (winsock_register_wsaevent(AS_EVENT_BASE(base), ev, wsaevent, cb,
	arg))
	return AS_UB_EVENT(ev);
	free(ev);
	return NULL;
	#else
	(void)base;
	(void)wsaevent;
	(void)cb;
	(void)arg;
	return NULL;
	#endif
	}

	void
	ub_event_add_bits(struct ub_event* ev, short bits)
	{
	AS_EVENT(ev)->ev_events \|= NATIVE_BITS(bits);
	}

	void
	ub_event_del_bits(struct ub_event* ev, short bits)
	{
	AS_EVENT(ev)->ev_events &= ~NATIVE_BITS(bits);
	}

	void
	ub_event_set_fd(struct ub_event* ev, int fd)
	{
	AS_EVENT(ev)->ev_fd = fd;
	}

	void
	ub_event_free(struct ub_event* ev)
	{
	if (ev)
	free(AS_EVENT(ev));
	}

	int
	ub_event_add(struct ub_event* ev, struct timeval* tv)
	{
	return event_add(AS_EVENT(ev), tv);
	}

	int
	ub_event_del(struct ub_event* ev)
	{
	return event_del(AS_EVENT(ev));
	}

	int
	ub_timer_add(struct ub_event* ev, struct ub_event_base* base,
	void (cb)(int, short, void), void* arg, struct timeval* tv)
	{
	event_set(AS_EVENT(ev), -1, EV_TIMEOUT, NATIVE_BITS_CB(cb), arg);
	if (event_base_set(AS_EVENT_BASE(base), AS_EVENT(ev)) != 0)
	return -1;
	return evtimer_add(AS_EVENT(ev), tv);
	}

	int
	ub_timer_del(struct ub_event* ev)
	{
	return evtimer_del(AS_EVENT(ev));
	}

	int
	ub_signal_add(struct ub_event* ev, struct timeval* tv)
	{
	return signal_add(AS_EVENT(ev), tv);
	}

	int
	ub_signal_del(struct ub_event* ev)
	{
	return signal_del(AS_EVENT(ev));
	}

	void
	ub_winsock_unregister_wsaevent(struct ub_event* ev)
	{
	#if defined(USE_MINI_EVENT) && defined(USE_WINSOCK)
	winsock_unregister_wsaevent(AS_EVENT(ev));
	free(AS_EVENT(ev));
	#else
	(void)ev;
	#endif
	}

	void
	ub_winsock_tcp_wouldblock(struct ub_event* ev, int eventbits)
	{
	#if defined(USE_MINI_EVENT) && defined(USE_WINSOCK)
	winsock_tcp_wouldblock(AS_EVENT(ev), NATIVE_BITS(eventbits));
	#else
	(void)ev;
	(void)eventbits;
	#endif
	}

	void ub_comm_base_now(struct comm_base* cb)
	{
	#ifdef USE_MINI_EVENT
	/** minievent updates the time when it blocks. */
	(void)cb; /* nothing to do */
	#else /* !USE_MINI_EVENT */
	/** fillup the time values in the event base */
	time_t *tt;
	struct timeval *tv;
	comm_base_timept(cb, &tt, &tv);
	if(gettimeofday(tv, NULL) < 0) {
	log_err("gettimeofday: %s", strerror(errno));
	}
	*tt = tv->tv_sec;
	#endif /* USE_MINI_EVENT */
	}

	Index: head/contrib/unbound/validator/val_neg.c
	===================================================================
	--- head/contrib/unbound/validator/val_neg.c (revision 349719)
	+++ head/contrib/unbound/validator/val_neg.c (revision 349720)
	@@ -1,1650 +1,1651 @@
	/*
	* validator/val_neg.c - validator aggressive negative caching functions.
	*
	* Copyright (c) 2008, NLnet Labs. All rights reserved.
	*
	* This software is open source.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	*
	* Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	*
	* Neither the name of the NLNET LABS nor the names of its contributors may
	* be used to endorse or promote products derived from this software without
	* specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
	* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/**
	* \file
	*
	* This file contains helper functions for the validator module.
	* The functions help with aggressive negative caching.
	* This creates new denials of existence, and proofs for absence of types
	* from cached NSEC records.
	*/
	#include "config.h"
	#ifdef HAVE_OPENSSL_SSL_H
	#include "openssl/ssl.h"
	#define NSEC3_SHA_LEN SHA_DIGEST_LENGTH
	#else
	#define NSEC3_SHA_LEN 20
	#endif
	#include "validator/val_neg.h"
	#include "validator/val_nsec.h"
	#include "validator/val_nsec3.h"
	#include "validator/val_utils.h"
	#include "util/data/dname.h"
	#include "util/data/msgreply.h"
	#include "util/log.h"
	#include "util/net_help.h"
	#include "util/config_file.h"
	#include "services/cache/rrset.h"
	#include "services/cache/dns.h"
	#include "sldns/rrdef.h"
	#include "sldns/sbuffer.h"

	int val_neg_data_compare(const void* a, const void* b)
	{
	struct val_neg_data* x = (struct val_neg_data*)a;
	struct val_neg_data* y = (struct val_neg_data*)b;
	int m;
	return dname_canon_lab_cmp(x->name, x->labs, y->name, y->labs, &m);
	}

	int val_neg_zone_compare(const void* a, const void* b)
	{
	struct val_neg_zone* x = (struct val_neg_zone*)a;
	struct val_neg_zone* y = (struct val_neg_zone*)b;
	int m;
	if(x->dclass != y->dclass) {
	if(x->dclass < y->dclass)
	return -1;
	return 1;
	}
	return dname_canon_lab_cmp(x->name, x->labs, y->name, y->labs, &m);
	}

	struct val_neg_cache* val_neg_create(struct config_file* cfg, size_t maxiter)
	{
	struct val_neg_cache* neg = (struct val_neg_cache*)calloc(1,
	sizeof(*neg));
	if(!neg) {
	log_err("Could not create neg cache: out of memory");
	return NULL;
	}
	neg->nsec3_max_iter = maxiter;
	neg->max = 10241024; / 1 M is thousands of entries */
	if(cfg) neg->max = cfg->neg_cache_size;
	rbtree_init(&neg->tree, &val_neg_zone_compare);
	lock_basic_init(&neg->lock);
	lock_protect(&neg->lock, neg, sizeof(*neg));
	return neg;
	}

	size_t val_neg_get_mem(struct val_neg_cache* neg)
	{
	size_t result;
	lock_basic_lock(&neg->lock);
	result = sizeof(*neg) + neg->use;
	lock_basic_unlock(&neg->lock);
	return result;
	}

	/** clear datas on cache deletion */
	static void
	neg_clear_datas(rbnode_type* n, void* ATTR_UNUSED(arg))
	{
	struct val_neg_data* d = (struct val_neg_data*)n;
	free(d->name);
	free(d);
	}

	/** clear zones on cache deletion */
	static void
	neg_clear_zones(rbnode_type* n, void* ATTR_UNUSED(arg))
	{
	struct val_neg_zone* z = (struct val_neg_zone*)n;
	/* delete all the rrset entries in the tree */
	traverse_postorder(&z->tree, &neg_clear_datas, NULL);
	free(z->nsec3_salt);
	free(z->name);
	free(z);
	}

	void neg_cache_delete(struct val_neg_cache* neg)
	{
	if(!neg) return;
	lock_basic_destroy(&neg->lock);
	/* delete all the zones in the tree */
	traverse_postorder(&neg->tree, &neg_clear_zones, NULL);
	free(neg);
	}

	/**
	* Put data element at the front of the LRU list.
	* @param neg: negative cache with LRU start and end.
	* @param data: this data is fronted.
	*/
	static void neg_lru_front(struct val_neg_cache* neg,
	struct val_neg_data* data)
	{
	data->prev = NULL;
	data->next = neg->first;
	if(!neg->first)
	neg->last = data;
	else neg->first->prev = data;
	neg->first = data;
	}

	/**
	* Remove data element from LRU list.
	* @param neg: negative cache with LRU start and end.
	* @param data: this data is removed from the list.
	*/
	static void neg_lru_remove(struct val_neg_cache* neg,
	struct val_neg_data* data)
	{
	if(data->prev)
	data->prev->next = data->next;
	else neg->first = data->next;
	if(data->next)
	data->next->prev = data->prev;
	else neg->last = data->prev;
	}

	/**
	* Touch LRU for data element, put it at the start of the LRU list.
	* @param neg: negative cache with LRU start and end.
	* @param data: this data is used.
	*/
	static void neg_lru_touch(struct val_neg_cache* neg,
	struct val_neg_data* data)
	{
	if(data == neg->first)
	return; /* nothing to do */
	/* remove from current lru position */
	neg_lru_remove(neg, data);
	/* add at front */
	neg_lru_front(neg, data);
	}

	/**
	* Delete a zone element from the negative cache.
	* May delete other zone elements to keep tree coherent, or
	* only mark the element as 'not in use'.
	* @param neg: negative cache.
	* @param z: zone element to delete.
	*/
	static void neg_delete_zone(struct val_neg_cache* neg, struct val_neg_zone* z)
	{
	struct val_neg_zone* p, *np;
	if(!z) return;
	log_assert(z->in_use);
	log_assert(z->count > 0);
	z->in_use = 0;

	/* go up the tree and reduce counts */
	p = z;
	while(p) {
	log_assert(p->count > 0);
	p->count --;
	p = p->parent;
	}

	/* remove zones with zero count */
	p = z;
	while(p && p->count == 0) {
	np = p->parent;
	(void)rbtree_delete(&neg->tree, &p->node);
	neg->use -= p->len + sizeof(*p);
	free(p->nsec3_salt);
	free(p->name);
	free(p);
	p = np;
	}
	}

	void neg_delete_data(struct val_neg_cache* neg, struct val_neg_data* el)
	{
	struct val_neg_zone* z;
	struct val_neg_data* p, *np;
	if(!el) return;
	z = el->zone;
	log_assert(el->in_use);
	log_assert(el->count > 0);
	el->in_use = 0;

	/* remove it from the lru list */
	neg_lru_remove(neg, el);
	+ log_assert(neg->first != el && neg->last != el);

	/* go up the tree and reduce counts */
	p = el;
	while(p) {
	log_assert(p->count > 0);
	p->count --;
	p = p->parent;
	}

	/* delete 0 count items from tree */
	p = el;
	while(p && p->count == 0) {
	np = p->parent;
	(void)rbtree_delete(&z->tree, &p->node);
	neg->use -= p->len + sizeof(*p);
	free(p->name);
	free(p);
	p = np;
	}

	/* check if the zone is now unused */
	if(z->tree.count == 0) {
	neg_delete_zone(neg, z);
	}
	}

	/**
	* Create more space in negative cache
	* The oldest elements are deleted until enough space is present.
	* Empty zones are deleted.
	* @param neg: negative cache.
	* @param need: how many bytes are needed.
	*/
	static void neg_make_space(struct val_neg_cache* neg, size_t need)
	{
	/* delete elements until enough space or its empty */
	while(neg->last && neg->max < neg->use + need) {
	neg_delete_data(neg, neg->last);
	}
	}

	struct val_neg_zone* neg_find_zone(struct val_neg_cache* neg,
	uint8_t* nm, size_t len, uint16_t dclass)
	{
	struct val_neg_zone lookfor;
	struct val_neg_zone* result;
	lookfor.node.key = &lookfor;
	lookfor.name = nm;
	lookfor.len = len;
	lookfor.labs = dname_count_labels(lookfor.name);
	lookfor.dclass = dclass;

	result = (struct val_neg_zone*)
	rbtree_search(&neg->tree, lookfor.node.key);
	return result;
	}

	/**
	* Find the given data
	* @param zone: negative zone
	* @param nm: what to look for.
	* @param len: length of nm
	* @param labs: labels in nm
	* @return data or NULL if not found.
	*/
	static struct val_neg_data* neg_find_data(struct val_neg_zone* zone,
	uint8_t* nm, size_t len, int labs)
	{
	struct val_neg_data lookfor;
	struct val_neg_data* result;
	lookfor.node.key = &lookfor;
	lookfor.name = nm;
	lookfor.len = len;
	lookfor.labs = labs;

	result = (struct val_neg_data*)
	rbtree_search(&zone->tree, lookfor.node.key);
	return result;
	}

	/**
	* Calculate space needed for the data and all its parents
	* @param rep: NSEC entries.
	* @return size.
	*/
	static size_t calc_data_need(struct reply_info* rep)
	{
	uint8_t* d;
	size_t i, len, res = 0;

	for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
	if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC) {
	d = rep->rrsets[i]->rk.dname;
	len = rep->rrsets[i]->rk.dname_len;
	res = sizeof(struct val_neg_data) + len;
	while(!dname_is_root(d)) {
	log_assert(len > 1); /* not root label */
	dname_remove_label(&d, &len);
	res += sizeof(struct val_neg_data) + len;
	}
	}
	}
	return res;
	}

	/**
	* Calculate space needed for zone and all its parents
	* @param d: name of zone
	* @param len: length of name
	* @return size.
	*/
	static size_t calc_zone_need(uint8_t* d, size_t len)
	{
	size_t res = sizeof(struct val_neg_zone) + len;
	while(!dname_is_root(d)) {
	log_assert(len > 1); /* not root label */
	dname_remove_label(&d, &len);
	res += sizeof(struct val_neg_zone) + len;
	}
	return res;
	}

	/**
	* Find closest existing parent zone of the given name.
	* @param neg: negative cache.
	* @param nm: name to look for
	* @param nm_len: length of nm
	* @param labs: labelcount of nm.
	* @param qclass: class.
	* @return the zone or NULL if none found.
	*/
	static struct val_neg_zone* neg_closest_zone_parent(struct val_neg_cache* neg,
	uint8_t* nm, size_t nm_len, int labs, uint16_t qclass)
	{
	struct val_neg_zone key;
	struct val_neg_zone* result;
	rbnode_type* res = NULL;
	key.node.key = &key;
	key.name = nm;
	key.len = nm_len;
	key.labs = labs;
	key.dclass = qclass;
	if(rbtree_find_less_equal(&neg->tree, &key, &res)) {
	/* exact match */
	result = (struct val_neg_zone*)res;
	} else {
	/* smaller element (or no element) */
	int m;
	result = (struct val_neg_zone*)res;
	if(!result \|\| result->dclass != qclass)
	return NULL;
	/* count number of labels matched */
	(void)dname_lab_cmp(result->name, result->labs, key.name,
	key.labs, &m);
	while(result) { /* go up until qname is subdomain of stub */
	if(result->labs <= m)
	break;
	result = result->parent;
	}
	}
	return result;
	}

	/**
	* Find closest existing parent data for the given name.
	* @param zone: to look in.
	* @param nm: name to look for
	* @param nm_len: length of nm
	* @param labs: labelcount of nm.
	* @return the data or NULL if none found.
	*/
	static struct val_neg_data* neg_closest_data_parent(
	struct val_neg_zone* zone, uint8_t* nm, size_t nm_len, int labs)
	{
	struct val_neg_data key;
	struct val_neg_data* result;
	rbnode_type* res = NULL;
	key.node.key = &key;
	key.name = nm;
	key.len = nm_len;
	key.labs = labs;
	if(rbtree_find_less_equal(&zone->tree, &key, &res)) {
	/* exact match */
	result = (struct val_neg_data*)res;
	} else {
	/* smaller element (or no element) */
	int m;
	result = (struct val_neg_data*)res;
	if(!result)
	return NULL;
	/* count number of labels matched */
	(void)dname_lab_cmp(result->name, result->labs, key.name,
	key.labs, &m);
	while(result) { /* go up until qname is subdomain of stub */
	if(result->labs <= m)
	break;
	result = result->parent;
	}
	}
	return result;
	}

	/**
	* Create a single zone node
	* @param nm: name for zone (copied)
	* @param nm_len: length of name
	* @param labs: labels in name.
	* @param dclass: class of zone, host order.
	* @return new zone or NULL on failure
	*/
	static struct val_neg_zone* neg_setup_zone_node(
	uint8_t* nm, size_t nm_len, int labs, uint16_t dclass)
	{
	struct val_neg_zone* zone =
	(struct val_neg_zone)calloc(1, sizeof(zone));
	if(!zone) {
	return NULL;
	}
	zone->node.key = zone;
	zone->name = memdup(nm, nm_len);
	if(!zone->name) {
	free(zone);
	return NULL;
	}
	zone->len = nm_len;
	zone->labs = labs;
	zone->dclass = dclass;

	rbtree_init(&zone->tree, &val_neg_data_compare);
	return zone;
	}

	/**
	* Create a linked list of parent zones, starting at longname ending on
	* the parent (can be NULL, creates to the root).
	* @param nm: name for lowest in chain
	* @param nm_len: length of name
	* @param labs: labels in name.
	* @param dclass: class of zone.
	* @param parent: NULL for to root, else so it fits under here.
	* @return zone; a chain of zones and their parents up to the parent.
	* or NULL on malloc failure
	*/
	static struct val_neg_zone* neg_zone_chain(
	uint8_t* nm, size_t nm_len, int labs, uint16_t dclass,
	struct val_neg_zone* parent)
	{
	int i;
	int tolabs = parent?parent->labs:0;
	struct val_neg_zone* zone, prev = NULL, first = NULL;

	/* create the new subtree, i is labelcount of current creation */
	/* this creates a 'first' to z->parent=NULL list of zones */
	for(i=labs; i!=tolabs; i--) {
	/* create new item */
	zone = neg_setup_zone_node(nm, nm_len, i, dclass);
	if(!zone) {
	/* need to delete other allocations in this routine!*/
	struct val_neg_zone* p=first, *np;
	while(p) {
	np = p->parent;
	free(p->name);
	free(p);
	p = np;
	}
	return NULL;
	}
	if(i == labs) {
	first = zone;
	} else {
	prev->parent = zone;
	}
	/* prepare for next name */
	prev = zone;
	dname_remove_label(&nm, &nm_len);
	}
	return first;
	}

	void val_neg_zone_take_inuse(struct val_neg_zone* zone)
	{
	if(!zone->in_use) {
	struct val_neg_zone* p;
	zone->in_use = 1;
	/* increase usage count of all parents */
	for(p=zone; p; p = p->parent) {
	p->count++;
	}
	}
	}

	struct val_neg_zone* neg_create_zone(struct val_neg_cache* neg,
	uint8_t* nm, size_t nm_len, uint16_t dclass)
	{
	struct val_neg_zone* zone;
	struct val_neg_zone* parent;
	struct val_neg_zone* p, *np;
	int labs = dname_count_labels(nm);

	/* find closest enclosing parent zone that (still) exists */
	parent = neg_closest_zone_parent(neg, nm, nm_len, labs, dclass);
	if(parent && query_dname_compare(parent->name, nm) == 0)
	return parent; /* already exists, weird */
	/* if parent exists, it is in use */
	log_assert(!parent \|\| parent->count > 0);
	zone = neg_zone_chain(nm, nm_len, labs, dclass, parent);
	if(!zone) {
	return NULL;
	}

	/* insert the list of zones into the tree */
	p = zone;
	while(p) {
	np = p->parent;
	/* mem use */
	neg->use += sizeof(struct val_neg_zone) + p->len;
	/* insert in tree */
	(void)rbtree_insert(&neg->tree, &p->node);
	/* last one needs proper parent pointer */
	if(np == NULL)
	p->parent = parent;
	p = np;
	}
	return zone;
	}

	/** find zone name of message, returns the SOA record */
	static struct ub_packed_rrset_key* reply_find_soa(struct reply_info* rep)
	{
	size_t i;
	for(i=rep->an_numrrsets; i< rep->an_numrrsets+rep->ns_numrrsets; i++){
	if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_SOA)
	return rep->rrsets[i];
	}
	return NULL;
	}

	/** see if the reply has NSEC records worthy of caching */
	static int reply_has_nsec(struct reply_info* rep)
	{
	size_t i;
	struct packed_rrset_data* d;
	if(rep->security != sec_status_secure)
	return 0;
	for(i=rep->an_numrrsets; i< rep->an_numrrsets+rep->ns_numrrsets; i++){
	if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC) {
	d = (struct packed_rrset_data*)rep->rrsets[i]->
	entry.data;
	if(d->security == sec_status_secure)
	return 1;
	}
	}
	return 0;
	}


	/**
	* Create single node of data element.
	* @param nm: name (copied)
	* @param nm_len: length of name
	* @param labs: labels in name.
	* @return element with name nm, or NULL malloc failure.
	*/
	static struct val_neg_data* neg_setup_data_node(
	uint8_t* nm, size_t nm_len, int labs)
	{
	struct val_neg_data* el;
	el = (struct val_neg_data)calloc(1, sizeof(el));
	if(!el) {
	return NULL;
	}
	el->node.key = el;
	el->name = memdup(nm, nm_len);
	if(!el->name) {
	free(el);
	return NULL;
	}
	el->len = nm_len;
	el->labs = labs;
	return el;
	}

	/**
	* Create chain of data element and parents
	* @param nm: name
	* @param nm_len: length of name
	* @param labs: labels in name.
	* @param parent: up to where to make, if NULL up to root label.
	* @return lowest element with name nm, or NULL malloc failure.
	*/
	static struct val_neg_data* neg_data_chain(
	uint8_t* nm, size_t nm_len, int labs, struct val_neg_data* parent)
	{
	int i;
	int tolabs = parent?parent->labs:0;
	struct val_neg_data* el, first = NULL, prev = NULL;

	/* create the new subtree, i is labelcount of current creation */
	/* this creates a 'first' to z->parent=NULL list of zones */
	for(i=labs; i!=tolabs; i--) {
	/* create new item */
	el = neg_setup_data_node(nm, nm_len, i);
	if(!el) {
	/* need to delete other allocations in this routine!*/
	struct val_neg_data* p = first, *np;
	while(p) {
	np = p->parent;
	free(p->name);
	free(p);
	p = np;
	}
	return NULL;
	}
	if(i == labs) {
	first = el;
	} else {
	prev->parent = el;
	}

	/* prepare for next name */
	prev = el;
	dname_remove_label(&nm, &nm_len);
	}
	return first;
	}

	/**
	* Remove NSEC records between start and end points.
	* By walking the tree, the tree is sorted canonically.
	* @param neg: negative cache.
	* @param zone: the zone
	* @param el: element to start walking at.
	* @param nsec: the nsec record with the end point
	*/
	static void wipeout(struct val_neg_cache* neg, struct val_neg_zone* zone,
	struct val_neg_data* el, struct ub_packed_rrset_key* nsec)
	{
	struct packed_rrset_data* d = (struct packed_rrset_data*)nsec->
	entry.data;
	uint8_t* end;
	size_t end_len;
	int end_labs, m;
	rbnode_type* walk, *next;
	struct val_neg_data* cur;
	uint8_t buf[257];
	/* get endpoint */
	if(!d \|\| d->count == 0 \|\| d->rr_len[0] < 2+1)
	return;
	if(ntohs(nsec->rk.type) == LDNS_RR_TYPE_NSEC) {
	end = d->rr_data[0]+2;
	end_len = dname_valid(end, d->rr_len[0]-2);
	end_labs = dname_count_labels(end);
	} else {
	/* NSEC3 */
	if(!nsec3_get_nextowner_b32(nsec, 0, buf, sizeof(buf)))
	return;
	end = buf;
	end_labs = dname_count_size_labels(end, &end_len);
	}

	/* sanity check, both owner and end must be below the zone apex */
	if(!dname_subdomain_c(el->name, zone->name) \|\|
	!dname_subdomain_c(end, zone->name))
	return;

	/* detect end of zone NSEC ; wipe until the end of zone */
	if(query_dname_compare(end, zone->name) == 0) {
	end = NULL;
	}

	walk = rbtree_next(&el->node);
	while(walk && walk != RBTREE_NULL) {
	cur = (struct val_neg_data*)walk;
	/* sanity check: must be larger than start */
	if(dname_canon_lab_cmp(cur->name, cur->labs,
	el->name, el->labs, &m) <= 0) {
	/* r == 0 skip original record. */
	/* r < 0 too small! */
	walk = rbtree_next(walk);
	continue;
	}
	/* stop at endpoint, also data at empty nonterminals must be
	* removed (no NSECs there) so everything between
	* start and end */
	if(end && dname_canon_lab_cmp(cur->name, cur->labs,
	end, end_labs, &m) >= 0) {
	break;
	}
	/* this element has to be deleted, but we cannot do it
	* now, because we are walking the tree still ... */
	/* get the next element: */
	next = rbtree_next(walk);
	/* now delete the original element, this may trigger
	* rbtree rebalances, but really, the next element is
	* the one we need.
	* But it may trigger delete of other data and the
	* entire zone. However, if that happens, this is done
	* by deleting the parents of the element for deletion,
	* and maybe also the entire zone if it is empty.
	* But parents are smaller in canonical compare, thus,
	* if a larger element exists, then it is not a parent,
	* it cannot get deleted, the zone cannot get empty.
	* If the next==NULL, then zone can be empty. */
	if(cur->in_use)
	neg_delete_data(neg, cur);
	walk = next;
	}
	}

	void neg_insert_data(struct val_neg_cache* neg,
	struct val_neg_zone* zone, struct ub_packed_rrset_key* nsec)
	{
	struct packed_rrset_data* d;
	struct val_neg_data* parent;
	struct val_neg_data* el;
	uint8_t* nm = nsec->rk.dname;
	size_t nm_len = nsec->rk.dname_len;
	int labs = dname_count_labels(nsec->rk.dname);

	d = (struct packed_rrset_data*)nsec->entry.data;
	if( !(d->security == sec_status_secure \|\|
	(d->security == sec_status_unchecked && d->rrsig_count > 0)))
	return;
	log_nametypeclass(VERB_ALGO, "negcache rr",
	nsec->rk.dname, ntohs(nsec->rk.type),
	ntohs(nsec->rk.rrset_class));

	/* find closest enclosing parent data that (still) exists */
	parent = neg_closest_data_parent(zone, nm, nm_len, labs);
	if(parent && query_dname_compare(parent->name, nm) == 0) {
	/* perfect match already exists */
	log_assert(parent->count > 0);
	el = parent;
	} else {
	struct val_neg_data* p, *np;

	/* create subtree for perfect match */
	/* if parent exists, it is in use */
	log_assert(!parent \|\| parent->count > 0);

	el = neg_data_chain(nm, nm_len, labs, parent);
	if(!el) {
	log_err("out of memory inserting NSEC negative cache");
	return;
	}
	el->in_use = 0; /* set on below */

	/* insert the list of zones into the tree */
	p = el;
	while(p) {
	np = p->parent;
	/* mem use */
	neg->use += sizeof(struct val_neg_data) + p->len;
	/* insert in tree */
	p->zone = zone;
	(void)rbtree_insert(&zone->tree, &p->node);
	/* last one needs proper parent pointer */
	if(np == NULL)
	p->parent = parent;
	p = np;
	}
	}

	if(!el->in_use) {
	struct val_neg_data* p;

	el->in_use = 1;
	/* increase usage count of all parents */
	for(p=el; p; p = p->parent) {
	p->count++;
	}

	neg_lru_front(neg, el);
	} else {
	/* in use, bring to front, lru */
	neg_lru_touch(neg, el);
	}

	/* if nsec3 store last used parameters */
	if(ntohs(nsec->rk.type) == LDNS_RR_TYPE_NSEC3) {
	int h;
	uint8_t* s;
	size_t slen, it;
	if(nsec3_get_params(nsec, 0, &h, &it, &s, &slen) &&
	it <= neg->nsec3_max_iter &&
	(h != zone->nsec3_hash \|\| it != zone->nsec3_iter \|\|
	slen != zone->nsec3_saltlen \|\|
	memcmp(zone->nsec3_salt, s, slen) != 0)) {

	if(slen > 0) {
	uint8_t* sa = memdup(s, slen);
	if(sa) {
	free(zone->nsec3_salt);
	zone->nsec3_salt = sa;
	zone->nsec3_saltlen = slen;
	zone->nsec3_iter = it;
	zone->nsec3_hash = h;
	}
	} else {
	free(zone->nsec3_salt);
	zone->nsec3_salt = NULL;
	zone->nsec3_saltlen = 0;
	zone->nsec3_iter = it;
	zone->nsec3_hash = h;
	}
	}
	}

	/* wipe out the cache items between NSEC start and end */
	wipeout(neg, zone, el, nsec);
	}

	/** see if the reply has signed NSEC records and return the signer */
	static uint8_t* reply_nsec_signer(struct reply_info* rep, size_t* signer_len,
	uint16_t* dclass)
	{
	size_t i;
	struct packed_rrset_data* d;
	uint8_t* s;
	for(i=rep->an_numrrsets; i< rep->an_numrrsets+rep->ns_numrrsets; i++){
	if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC \|\|
	ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC3) {
	d = (struct packed_rrset_data*)rep->rrsets[i]->
	entry.data;
	/* return first signer name of first NSEC */
	if(d->rrsig_count != 0) {
	val_find_rrset_signer(rep->rrsets[i],
	&s, signer_len);
	if(s && *signer_len) {
	*dclass = ntohs(rep->rrsets[i]->
	rk.rrset_class);
	return s;
	}
	}
	}
	}
	return 0;
	}

	void val_neg_addreply(struct val_neg_cache* neg, struct reply_info* rep)
	{
	size_t i, need;
	struct ub_packed_rrset_key* soa;
	uint8_t* dname = NULL;
	size_t dname_len;
	uint16_t rrset_class;
	struct val_neg_zone* zone;
	/* see if secure nsecs inside */
	if(!reply_has_nsec(rep))
	return;
	/* find the zone name in message */
	if((soa = reply_find_soa(rep))) {
	dname = soa->rk.dname;
	dname_len = soa->rk.dname_len;
	rrset_class = ntohs(soa->rk.rrset_class);
	}
	else {
	/* No SOA in positive (wildcard) answer. Use signer from the
	* validated answer RRsets' signature. */
	if(!(dname = reply_nsec_signer(rep, &dname_len, &rrset_class)))
	return;
	}

	log_nametypeclass(VERB_ALGO, "negcache insert for zone",
	dname, LDNS_RR_TYPE_SOA, rrset_class);

	/* ask for enough space to store all of it */
	need = calc_data_need(rep) +
	calc_zone_need(dname, dname_len);
	lock_basic_lock(&neg->lock);
	neg_make_space(neg, need);

	/* find or create the zone entry */
	zone = neg_find_zone(neg, dname, dname_len, rrset_class);
	if(!zone) {
	if(!(zone = neg_create_zone(neg, dname, dname_len,
	rrset_class))) {
	lock_basic_unlock(&neg->lock);
	log_err("out of memory adding negative zone");
	return;
	}
	}
	val_neg_zone_take_inuse(zone);

	/* insert the NSECs */
	for(i=rep->an_numrrsets; i< rep->an_numrrsets+rep->ns_numrrsets; i++){
	if(ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_NSEC)
	continue;
	if(!dname_subdomain_c(rep->rrsets[i]->rk.dname,
	zone->name)) continue;
	/* insert NSEC into this zone's tree */
	neg_insert_data(neg, zone, rep->rrsets[i]);
	}
	if(zone->tree.count == 0) {
	/* remove empty zone if inserts failed */
	neg_delete_zone(neg, zone);
	}
	lock_basic_unlock(&neg->lock);
	}

	/**
	* Lookup closest data record. For NSEC denial.
	* @param zone: zone to look in
	* @param qname: name to look for.
	* @param len: length of name
	* @param labs: labels in name
	* @param data: data element, exact or smaller or NULL
	* @return true if exact match.
	*/
	static int neg_closest_data(struct val_neg_zone* zone,
	uint8_t* qname, size_t len, int labs, struct val_neg_data** data)
	{
	struct val_neg_data key;
	rbnode_type* r;
	key.node.key = &key;
	key.name = qname;
	key.len = len;
	key.labs = labs;
	if(rbtree_find_less_equal(&zone->tree, &key, &r)) {
	/* exact match */
	data = (struct val_neg_data)r;
	return 1;
	} else {
	/* smaller match */
	data = (struct val_neg_data)r;
	return 0;
	}
	}

	int val_neg_dlvlookup(struct val_neg_cache* neg, uint8_t* qname, size_t len,
	uint16_t qclass, struct rrset_cache* rrset_cache, time_t now)
	{
	/* lookup closest zone */
	struct val_neg_zone* zone;
	struct val_neg_data* data;
	int labs;
	struct ub_packed_rrset_key* nsec;
	struct packed_rrset_data* d;
	uint32_t flags;
	uint8_t* wc;
	struct query_info qinfo;
	if(!neg) return 0;

	log_nametypeclass(VERB_ALGO, "negcache dlvlookup", qname,
	LDNS_RR_TYPE_DLV, qclass);

	labs = dname_count_labels(qname);
	lock_basic_lock(&neg->lock);
	zone = neg_closest_zone_parent(neg, qname, len, labs, qclass);
	while(zone && !zone->in_use)
	zone = zone->parent;
	if(!zone) {
	lock_basic_unlock(&neg->lock);
	return 0;
	}
	log_nametypeclass(VERB_ALGO, "negcache zone", zone->name, 0,
	zone->dclass);

	/* DLV is defined to use NSEC only */
	if(zone->nsec3_hash) {
	lock_basic_unlock(&neg->lock);
	return 0;
	}

	/* lookup closest data record */
	(void)neg_closest_data(zone, qname, len, labs, &data);
	while(data && !data->in_use)
	data = data->parent;
	if(!data) {
	lock_basic_unlock(&neg->lock);
	return 0;
	}
	log_nametypeclass(VERB_ALGO, "negcache rr", data->name,
	LDNS_RR_TYPE_NSEC, zone->dclass);

	/* lookup rrset in rrset cache */
	flags = 0;
	if(query_dname_compare(data->name, zone->name) == 0)
	flags = PACKED_RRSET_NSEC_AT_APEX;
	nsec = rrset_cache_lookup(rrset_cache, data->name, data->len,
	LDNS_RR_TYPE_NSEC, zone->dclass, flags, now, 0);

	/* check if secure and TTL ok */
	if(!nsec) {
	lock_basic_unlock(&neg->lock);
	return 0;
	}
	d = (struct packed_rrset_data*)nsec->entry.data;
	if(!d \|\| now > d->ttl) {
	lock_rw_unlock(&nsec->entry.lock);
	/* delete data record if expired */
	neg_delete_data(neg, data);
	lock_basic_unlock(&neg->lock);
	return 0;
	}
	if(d->security != sec_status_secure) {
	lock_rw_unlock(&nsec->entry.lock);
	neg_delete_data(neg, data);
	lock_basic_unlock(&neg->lock);
	return 0;
	}
	verbose(VERB_ALGO, "negcache got secure rrset");

	/* check NSEC security */
	/* check if NSEC proves no DLV type exists */
	/* check if NSEC proves NXDOMAIN for qname */
	qinfo.qname = qname;
	qinfo.qtype = LDNS_RR_TYPE_DLV;
	qinfo.qclass = qclass;
	qinfo.local_alias = NULL;
	if(!nsec_proves_nodata(nsec, &qinfo, &wc) &&
	!val_nsec_proves_name_error(nsec, qname)) {
	/* the NSEC is not a denial for the DLV */
	lock_rw_unlock(&nsec->entry.lock);
	lock_basic_unlock(&neg->lock);
	verbose(VERB_ALGO, "negcache not proven");
	return 0;
	}
	/* so the NSEC was a NODATA proof, or NXDOMAIN proof. */

	/* no need to check for wildcard NSEC; no wildcards in DLV repos */
	/* no need to lookup SOA record for client; no response message */

	lock_rw_unlock(&nsec->entry.lock);
	/* if OK touch the LRU for neg_data element */
	neg_lru_touch(neg, data);
	lock_basic_unlock(&neg->lock);
	verbose(VERB_ALGO, "negcache DLV denial proven");
	return 1;
	}

	void val_neg_addreferral(struct val_neg_cache* neg, struct reply_info* rep,
	uint8_t* zone_name)
	{
	size_t i, need;
	uint8_t* signer;
	size_t signer_len;
	uint16_t dclass;
	struct val_neg_zone* zone;
	/* no SOA in this message, find RRSIG over NSEC's signer name.
	* note the NSEC records are maybe not validated yet */
	signer = reply_nsec_signer(rep, &signer_len, &dclass);
	if(!signer)
	return;
	if(!dname_subdomain_c(signer, zone_name)) {
	/* the signer is not in the bailiwick, throw it out */
	return;
	}

	log_nametypeclass(VERB_ALGO, "negcache insert referral ",
	signer, LDNS_RR_TYPE_NS, dclass);

	/* ask for enough space to store all of it */
	need = calc_data_need(rep) + calc_zone_need(signer, signer_len);
	lock_basic_lock(&neg->lock);
	neg_make_space(neg, need);

	/* find or create the zone entry */
	zone = neg_find_zone(neg, signer, signer_len, dclass);
	if(!zone) {
	if(!(zone = neg_create_zone(neg, signer, signer_len,
	dclass))) {
	lock_basic_unlock(&neg->lock);
	log_err("out of memory adding negative zone");
	return;
	}
	}
	val_neg_zone_take_inuse(zone);

	/* insert the NSECs */
	for(i=rep->an_numrrsets; i< rep->an_numrrsets+rep->ns_numrrsets; i++){
	if(ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_NSEC &&
	ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_NSEC3)
	continue;
	if(!dname_subdomain_c(rep->rrsets[i]->rk.dname,
	zone->name)) continue;
	/* insert NSEC into this zone's tree */
	neg_insert_data(neg, zone, rep->rrsets[i]);
	}
	if(zone->tree.count == 0) {
	/* remove empty zone if inserts failed */
	neg_delete_zone(neg, zone);
	}
	lock_basic_unlock(&neg->lock);
	}

	/**
	* Check that an NSEC3 rrset does not have a type set.
	* None of the nsec3s in a hash-collision are allowed to have the type.
	* (since we do not know which one is the nsec3 looked at, flags, ..., we
	* ignore the cached item and let it bypass negative caching).
	* @param k: the nsec3 rrset to check.
	* @param t: type to check
	* @return true if no RRs have the type.
	*/
	static int nsec3_no_type(struct ub_packed_rrset_key* k, uint16_t t)
	{
	int count = (int)((struct packed_rrset_data*)k->entry.data)->count;
	int i;
	for(i=0; i<count; i++)
	if(nsec3_has_type(k, i, t))
	return 0;
	return 1;
	}

	/**
	* See if rrset exists in rrset cache.
	* If it does, the bit is checked, and if not expired, it is returned
	* allocated in region.
	* @param rrset_cache: rrset cache
	* @param qname: to lookup rrset name
	* @param qname_len: length of qname.
	* @param qtype: type of rrset to lookup, host order
	* @param qclass: class of rrset to lookup, host order
	* @param flags: flags for rrset to lookup
	* @param region: where to alloc result
	* @param checkbit: if true, a bit in the nsec typemap is checked for absence.
	* @param checktype: which bit to check
	* @param now: to check ttl against
	* @return rrset or NULL
	*/
	static struct ub_packed_rrset_key*
	grab_nsec(struct rrset_cache* rrset_cache, uint8_t* qname, size_t qname_len,
	uint16_t qtype, uint16_t qclass, uint32_t flags,
	struct regional* region, int checkbit, uint16_t checktype,
	time_t now)
	{
	struct ub_packed_rrset_key* r, *k = rrset_cache_lookup(rrset_cache,
	qname, qname_len, qtype, qclass, flags, now, 0);
	struct packed_rrset_data* d;
	if(!k) return NULL;
	d = (struct packed_rrset_data*)k->entry.data;
	if(d->ttl < now) {
	lock_rw_unlock(&k->entry.lock);
	return NULL;
	}
	/* only secure or unchecked records that have signatures. */
	if( ! ( d->security == sec_status_secure \|\|
	(d->security == sec_status_unchecked &&
	d->rrsig_count > 0) ) ) {
	lock_rw_unlock(&k->entry.lock);
	return NULL;
	}
	/* check if checktype is absent */
	if(checkbit && (
	(qtype == LDNS_RR_TYPE_NSEC && nsec_has_type(k, checktype)) \|\|
	(qtype == LDNS_RR_TYPE_NSEC3 && !nsec3_no_type(k, checktype))
	)) {
	lock_rw_unlock(&k->entry.lock);
	return NULL;
	}
	/* looks OK! copy to region and return it */
	r = packed_rrset_copy_region(k, region, now);
	/* if it failed, we return the NULL */
	lock_rw_unlock(&k->entry.lock);
	return r;
	}

	/**
	* Get best NSEC record for qname. Might be matching, covering or totally
	* useless.
	* @param neg_cache: neg cache
	* @param qname: to lookup rrset name
	* @param qname_len: length of qname.
	* @param qclass: class of rrset to lookup, host order
	* @param rrset_cache: rrset cache
	* @param now: to check ttl against
	* @param region: where to alloc result
	* @return rrset or NULL
	*/
	static struct ub_packed_rrset_key*
	neg_find_nsec(struct val_neg_cache* neg_cache, uint8_t* qname, size_t qname_len,
	uint16_t qclass, struct rrset_cache* rrset_cache, time_t now,
	struct regional* region)
	{
	int labs;
	uint32_t flags;
	struct val_neg_zone* zone;
	struct val_neg_data* data;
	struct ub_packed_rrset_key* nsec;

	labs = dname_count_labels(qname);
	lock_basic_lock(&neg_cache->lock);
	zone = neg_closest_zone_parent(neg_cache, qname, qname_len, labs,
	qclass);
	while(zone && !zone->in_use)
	zone = zone->parent;
	if(!zone) {
	lock_basic_unlock(&neg_cache->lock);
	return NULL;
	}

	/* NSEC only for now */
	if(zone->nsec3_hash) {
	lock_basic_unlock(&neg_cache->lock);
	return NULL;
	}

	/* ignore return value, don't care if it is an exact or smaller match */
	(void)neg_closest_data(zone, qname, qname_len, labs, &data);
	if(!data) {
	lock_basic_unlock(&neg_cache->lock);
	return NULL;
	}

	/* ENT nodes are not in use, try the previous node. If the previous node
	* is not in use, we don't have an useful NSEC and give up. */
	if(!data->in_use) {
	data = (struct val_neg_data)rbtree_previous((rbnode_type)data);
	if((rbnode_type*)data == RBTREE_NULL \|\| !data->in_use) {
	lock_basic_unlock(&neg_cache->lock);
	return NULL;
	}
	}

	flags = 0;
	if(query_dname_compare(data->name, zone->name) == 0)
	flags = PACKED_RRSET_NSEC_AT_APEX;

	nsec = grab_nsec(rrset_cache, data->name, data->len, LDNS_RR_TYPE_NSEC,
	zone->dclass, flags, region, 0, 0, now);
	lock_basic_unlock(&neg_cache->lock);
	return nsec;
	}

	/** find nsec3 closest encloser in neg cache */
	static struct val_neg_data*
	neg_find_nsec3_ce(struct val_neg_zone* zone, uint8_t* qname, size_t qname_len,
	int qlabs, sldns_buffer* buf, uint8_t* hashnc, size_t* nclen)
	{
	struct val_neg_data* data;
	uint8_t hashce[NSEC3_SHA_LEN];
	uint8_t b32[257];
	size_t celen, b32len;

	*nclen = 0;
	while(qlabs > 0) {
	/* hash */
	if(!(celen=nsec3_get_hashed(buf, qname, qname_len,
	zone->nsec3_hash, zone->nsec3_iter, zone->nsec3_salt,
	zone->nsec3_saltlen, hashce, sizeof(hashce))))
	return NULL;
	if(!(b32len=nsec3_hash_to_b32(hashce, celen, zone->name,
	zone->len, b32, sizeof(b32))))
	return NULL;

	/* lookup (exact match only) */
	data = neg_find_data(zone, b32, b32len, zone->labs+1);
	if(data && data->in_use) {
	/* found ce match! */
	return data;
	}

	*nclen = celen;
	memmove(hashnc, hashce, celen);
	dname_remove_label(&qname, &qname_len);
	qlabs --;
	}
	return NULL;
	}

	/** check nsec3 parameters on nsec3 rrset with current zone values */
	static int
	neg_params_ok(struct val_neg_zone* zone, struct ub_packed_rrset_key* rrset)
	{
	int h;
	uint8_t* s;
	size_t slen, it;
	if(!nsec3_get_params(rrset, 0, &h, &it, &s, &slen))
	return 0;
	return (h == zone->nsec3_hash && it == zone->nsec3_iter &&
	slen == zone->nsec3_saltlen &&
	memcmp(zone->nsec3_salt, s, slen) == 0);
	}

	/** get next closer for nsec3 proof */
	static struct ub_packed_rrset_key*
	neg_nsec3_getnc(struct val_neg_zone* zone, uint8_t* hashnc, size_t nclen,
	struct rrset_cache* rrset_cache, struct regional* region,
	time_t now, uint8_t* b32, size_t maxb32)
	{
	struct ub_packed_rrset_key* nc_rrset;
	struct val_neg_data* data;
	size_t b32len;

	if(!(b32len=nsec3_hash_to_b32(hashnc, nclen, zone->name,
	zone->len, b32, maxb32)))
	return NULL;
	(void)neg_closest_data(zone, b32, b32len, zone->labs+1, &data);
	if(!data && zone->tree.count != 0) {
	/* could be before the first entry ; return the last
	* entry (possibly the rollover nsec3 at end) */
	data = (struct val_neg_data*)rbtree_last(&zone->tree);
	}
	while(data && !data->in_use)
	data = data->parent;
	if(!data)
	return NULL;
	/* got a data element in tree, grab it */
	nc_rrset = grab_nsec(rrset_cache, data->name, data->len,
	LDNS_RR_TYPE_NSEC3, zone->dclass, 0, region, 0, 0, now);
	if(!nc_rrset)
	return NULL;
	if(!neg_params_ok(zone, nc_rrset))
	return NULL;
	return nc_rrset;
	}

	/** neg cache nsec3 proof procedure*/
	static struct dns_msg*
	neg_nsec3_proof_ds(struct val_neg_zone* zone, uint8_t* qname, size_t qname_len,
	int qlabs, sldns_buffer* buf, struct rrset_cache* rrset_cache,
	struct regional* region, time_t now, uint8_t* topname)
	{
	struct dns_msg* msg;
	struct val_neg_data* data;
	uint8_t hashnc[NSEC3_SHA_LEN];
	size_t nclen;
	struct ub_packed_rrset_key* ce_rrset, *nc_rrset;
	struct nsec3_cached_hash c;
	uint8_t nc_b32[257];

	/* for NSEC3 ; determine the closest encloser for which we
	* can find an exact match. Remember the hashed lower name,
	* since that is the one we need a closest match for.
	* If we find a match straight away, then it becomes NODATA.
	* Otherwise, NXDOMAIN or if OPTOUT, an insecure delegation.
	* Also check that parameters are the same on closest encloser
	* and on closest match.
	*/
	if(!zone->nsec3_hash)
	return NULL; /* not nsec3 zone */

	if(!(data=neg_find_nsec3_ce(zone, qname, qname_len, qlabs, buf,
	hashnc, &nclen))) {
	return NULL;
	}

	/* grab the ce rrset */
	ce_rrset = grab_nsec(rrset_cache, data->name, data->len,
	LDNS_RR_TYPE_NSEC3, zone->dclass, 0, region, 1,
	LDNS_RR_TYPE_DS, now);
	if(!ce_rrset)
	return NULL;
	if(!neg_params_ok(zone, ce_rrset))
	return NULL;

	if(nclen == 0) {
	/* exact match, just check the type bits */
	/* need: -SOA, -DS, +NS */
	if(nsec3_has_type(ce_rrset, 0, LDNS_RR_TYPE_SOA) \|\|
	nsec3_has_type(ce_rrset, 0, LDNS_RR_TYPE_DS) \|\|
	!nsec3_has_type(ce_rrset, 0, LDNS_RR_TYPE_NS))
	return NULL;
	if(!(msg = dns_msg_create(qname, qname_len,
	LDNS_RR_TYPE_DS, zone->dclass, region, 1)))
	return NULL;
	/* TTL reduced in grab_nsec */
	if(!dns_msg_authadd(msg, region, ce_rrset, 0))
	return NULL;
	return msg;
	}

	/* optout is not allowed without knowing the trust-anchor in use,
	* otherwise the optout could spoof away that anchor */
	if(!topname)
	return NULL;

	/* if there is no exact match, it must be in an optout span
	* (an existing DS implies an NSEC3 must exist) */
	nc_rrset = neg_nsec3_getnc(zone, hashnc, nclen, rrset_cache,
	region, now, nc_b32, sizeof(nc_b32));
	if(!nc_rrset)
	return NULL;
	if(!neg_params_ok(zone, nc_rrset))
	return NULL;
	if(!nsec3_has_optout(nc_rrset, 0))
	return NULL;
	c.hash = hashnc;
	c.hash_len = nclen;
	c.b32 = nc_b32+1;
	c.b32_len = (size_t)nc_b32[0];
	if(nsec3_covers(zone->name, &c, nc_rrset, 0, buf)) {
	/* nc_rrset covers the next closer name.
	* ce_rrset equals a closer encloser.
	* nc_rrset is optout.
	* No need to check wildcard for type DS */
	/* capacity=3: ce + nc + soa(if needed) */
	if(!(msg = dns_msg_create(qname, qname_len,
	LDNS_RR_TYPE_DS, zone->dclass, region, 3)))
	return NULL;
	/* now=0 because TTL was reduced in grab_nsec */
	if(!dns_msg_authadd(msg, region, ce_rrset, 0))
	return NULL;
	if(!dns_msg_authadd(msg, region, nc_rrset, 0))
	return NULL;
	return msg;
	}
	return NULL;
	}

	/**
	* Add SOA record for external responses.
	* @param rrset_cache: to look into.
	* @param now: current time.
	* @param region: where to perform the allocation
	* @param msg: current msg with NSEC.
	* @param zone: val_neg_zone if we have one.
	* @return false on lookup or alloc failure.
	*/
	static int add_soa(struct rrset_cache* rrset_cache, time_t now,
	struct regional* region, struct dns_msg* msg, struct val_neg_zone* zone)
	{
	struct ub_packed_rrset_key* soa;
	uint8_t* nm;
	size_t nmlen;
	uint16_t dclass;
	if(zone) {
	nm = zone->name;
	nmlen = zone->len;
	dclass = zone->dclass;
	} else {
	/* Assumes the signer is the zone SOA to add */
	nm = reply_nsec_signer(msg->rep, &nmlen, &dclass);
	if(!nm)
	return 0;
	}
	soa = rrset_cache_lookup(rrset_cache, nm, nmlen, LDNS_RR_TYPE_SOA,
	dclass, PACKED_RRSET_SOA_NEG, now, 0);
	if(!soa)
	return 0;
	if(!dns_msg_authadd(msg, region, soa, now)) {
	lock_rw_unlock(&soa->entry.lock);
	return 0;
	}
	lock_rw_unlock(&soa->entry.lock);
	return 1;
	}

	struct dns_msg*
	val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo,
	struct regional* region, struct rrset_cache* rrset_cache,
	sldns_buffer* buf, time_t now, int addsoa, uint8_t* topname,
	struct config_file* cfg)
	{
	struct dns_msg* msg;
	struct ub_packed_rrset_key* nsec; /* qname matching/covering nsec */
	struct ub_packed_rrset_key* wcrr; /* wildcard record or nsec */
	uint8_t* nodata_wc = NULL;
	uint8_t* ce = NULL;
	size_t ce_len;
	uint8_t wc_ce[LDNS_MAX_DOMAINLEN+3];
	struct query_info wc_qinfo;
	struct ub_packed_rrset_key* cache_wc;
	struct packed_rrset_data* wcrr_data;
	int rcode = LDNS_RCODE_NOERROR;
	uint8_t* zname;
	size_t zname_len;
	int zname_labs;
	struct val_neg_zone* zone;

	/* only for DS queries when aggressive use of NSEC is disabled */
	if(qinfo->qtype != LDNS_RR_TYPE_DS && !cfg->aggressive_nsec)
	return NULL;
	log_assert(!topname \|\| dname_subdomain_c(qinfo->qname, topname));

	/* Get best available NSEC for qname */
	nsec = neg_find_nsec(neg, qinfo->qname, qinfo->qname_len, qinfo->qclass,
	rrset_cache, now, region);

	/* Matching NSEC, use to generate No Data answer. Not creating answers
	* yet for No Data proven using wildcard. */
	if(nsec && nsec_proves_nodata(nsec, qinfo, &nodata_wc) && !nodata_wc) {
	if(!(msg = dns_msg_create(qinfo->qname, qinfo->qname_len,
	qinfo->qtype, qinfo->qclass, region, 2)))
	return NULL;
	if(!dns_msg_authadd(msg, region, nsec, 0))
	return NULL;
	if(addsoa && !add_soa(rrset_cache, now, region, msg, NULL))
	return NULL;

	lock_basic_lock(&neg->lock);
	neg->num_neg_cache_noerror++;
	lock_basic_unlock(&neg->lock);
	return msg;
	} else if(nsec && val_nsec_proves_name_error(nsec, qinfo->qname)) {
	if(!(msg = dns_msg_create(qinfo->qname, qinfo->qname_len,
	qinfo->qtype, qinfo->qclass, region, 3)))
	return NULL;
	if(!(ce = nsec_closest_encloser(qinfo->qname, nsec)))
	return NULL;
	dname_count_size_labels(ce, &ce_len);

	/* No extra extra NSEC required if both nameerror qname and
	* nodata .ce. are proven already. /
	if(!nodata_wc \|\| query_dname_compare(nodata_wc, ce) != 0) {
	/* Qname proven non existing, get wildcard record for
	* QTYPE or NSEC covering or matching wildcard. */

	/* Num labels in ce is always smaller than in qname,
	* therefore adding the wildcard label cannot overflow
	* buffer. */
	wc_ce[0] = 1;
	wc_ce[1] = (uint8_t)'*';
	memmove(wc_ce+2, ce, ce_len);
	wc_qinfo.qname = wc_ce;
	wc_qinfo.qname_len = ce_len + 2;
	wc_qinfo.qtype = qinfo->qtype;


	if((cache_wc = rrset_cache_lookup(rrset_cache, wc_qinfo.qname,
	wc_qinfo.qname_len, wc_qinfo.qtype,
	qinfo->qclass, 0/flags/, now, 0/read only/))) {
	/* Synthesize wildcard answer */
	wcrr_data = (struct packed_rrset_data*)cache_wc->entry.data;
	if(!(wcrr_data->security == sec_status_secure \|\|
	(wcrr_data->security == sec_status_unchecked &&
	wcrr_data->rrsig_count > 0))) {
	lock_rw_unlock(&cache_wc->entry.lock);
	return NULL;
	}
	if(!(wcrr = packed_rrset_copy_region(cache_wc,
	region, now))) {
	lock_rw_unlock(&cache_wc->entry.lock);
	return NULL;
	};
	lock_rw_unlock(&cache_wc->entry.lock);
	wcrr->rk.dname = qinfo->qname;
	wcrr->rk.dname_len = qinfo->qname_len;
	if(!dns_msg_ansadd(msg, region, wcrr, 0))
	return NULL;
	/* No SOA needed for wildcard synthesised
	* answer. */
	addsoa = 0;
	} else {
	/* Get wildcard NSEC for possible non existence
	* proof */
	if(!(wcrr = neg_find_nsec(neg, wc_qinfo.qname,
	wc_qinfo.qname_len, qinfo->qclass,
	rrset_cache, now, region)))
	return NULL;

	nodata_wc = NULL;
	if(val_nsec_proves_name_error(wcrr, wc_ce))
	rcode = LDNS_RCODE_NXDOMAIN;
	else if(!nsec_proves_nodata(wcrr, &wc_qinfo,
	&nodata_wc) \|\| nodata_wc)
	/* &nodata_wc shouldn't be set, wc_qinfo
	* already contains wildcard domain. */
	/* NSEC doesn't prove anything for
	* wildcard. */
	return NULL;
	if(query_dname_compare(wcrr->rk.dname,
	nsec->rk.dname) != 0)
	if(!dns_msg_authadd(msg, region, wcrr, 0))
	return NULL;
	}
	}

	if(!dns_msg_authadd(msg, region, nsec, 0))
	return NULL;
	if(addsoa && !add_soa(rrset_cache, now, region, msg, NULL))
	return NULL;

	/* Increment statistic counters */
	lock_basic_lock(&neg->lock);
	if(rcode == LDNS_RCODE_NOERROR)
	neg->num_neg_cache_noerror++;
	else if(rcode == LDNS_RCODE_NXDOMAIN)
	neg->num_neg_cache_nxdomain++;
	lock_basic_unlock(&neg->lock);

	FLAGS_SET_RCODE(msg->rep->flags, rcode);
	return msg;
	}

	/* No aggressive use of NSEC3 for now, only proceed for DS types. */
	if(qinfo->qtype != LDNS_RR_TYPE_DS){
	return NULL;
	}
	/* check NSEC3 neg cache for type DS */
	/* need to look one zone higher for DS type */
	zname = qinfo->qname;
	zname_len = qinfo->qname_len;
	dname_remove_label(&zname, &zname_len);
	zname_labs = dname_count_labels(zname);

	/* lookup closest zone */
	lock_basic_lock(&neg->lock);
	zone = neg_closest_zone_parent(neg, zname, zname_len, zname_labs,
	qinfo->qclass);
	while(zone && !zone->in_use)
	zone = zone->parent;
	/* check that the zone is not too high up so that we do not pick data
	* out of a zone that is above the last-seen key (or trust-anchor). */
	if(zone && topname) {
	if(!dname_subdomain_c(zone->name, topname))
	zone = NULL;
	}
	if(!zone) {
	lock_basic_unlock(&neg->lock);
	return NULL;
	}

	msg = neg_nsec3_proof_ds(zone, qinfo->qname, qinfo->qname_len,
	zname_labs+1, buf, rrset_cache, region, now, topname);
	if(msg && addsoa && !add_soa(rrset_cache, now, region, msg, zone)) {
	lock_basic_unlock(&neg->lock);
	return NULL;
	}
	lock_basic_unlock(&neg->lock);
	return msg;
	}
	Index: head/contrib/unbound
	===================================================================
	--- head/contrib/unbound (revision 349719)
	+++ head/contrib/unbound (revision 349720)

	Property changes on: head/contrib/unbound
	___________________________________________________________________
	Modified: svn:mergeinfo
	## -0,0 +0,1 ##
	Merged /vendor/unbound/dist:r343835,349557,349559

File Metadata

Mime Type: application/octet-stream
Expires: Fri, Apr 26, 6:17 AM (1 d, 23 h)
Storage Engine: chunks
Storage Format: Chunks
Storage Handle: ofxq7x7IMeAl
Default Alt Text: (4 MB)

Offset	End	Complete
0	4194304	Yes
4194304	5082457	Yes

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions