Switch from SVCB to IDELEG(65280)

Cleaned up the code
Fixed memory error
2026-08-18 05:35:46 +02:00 · 2025-01-17 15:31:51 +01:00 · 2024-07-12 15:05:12 +02:00 · 2024-07-12 10:34:03 +02:00 · 2024-06-20 16:21:36 +02:00 · 2024-06-20 12:46:03 +02:00
684 changed files with 9551 additions and 83580 deletions
@@ -12,7 +12,6 @@ jobs:
  build:
    runs-on: ${{ matrix.os }}
    strategy:
-      fail-fast: false
      matrix:
        include:
          - name: GCC on Linux
@@ -49,6 +48,15 @@ jobs:
            os: ubuntu-latest
            config: 'CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=address" --disable-flto --disable-static'
            make_test: "yes"
+          - name: Apple iPhone on iOS, armv7
+            os: macos-latest
+            AUTOTOOLS_HOST: armv7-apple-ios
+            OPENSSL_HOST: ios-cross
+            IOS_SDK: iPhoneOS
+            IOS_CPU: armv7s
+            test_ios: "yes"
+            config: "no"
+            make: "no"
          - name: Apple iPhone on iOS, arm64
            os: macos-latest
            AUTOTOOLS_HOST: aarch64-apple-ios
@@ -76,6 +84,15 @@ jobs:
            test_ios: "yes"
            config: "no"
            make: "no"
+          - name: iPhoneSimulator on OS X, i386
+            os: macos-latest
+            AUTOTOOLS_HOST: i386-apple-ios
+            OPENSSL_HOST: iphoneos-cross
+            IOS_SDK: iPhoneSimulator
+            IOS_CPU: i386
+            test_ios: "yes"
+            config: "no"
+            make: "no"
          - name: iPhoneSimulator on OS X, x86_64
            os: macos-latest
            AUTOTOOLS_HOST: x86_64-apple-ios
@@ -144,44 +161,13 @@ jobs:
            test_windows: "yes"
            config: "no"
            make: "no"
-          - name: FreeBSD
-            os: ubuntu-latest
-            config: "no"
-            make: "no"
-            with_cross_platform_action: "yes"
-            cross_platform_os: "freebsd"
-            cross_platform_arch: "x86-64"
-            cross_platform_version: "14.1"
-            cross_platform_config: "--enable-debug --disable-flto --with-libevent --disable-static"
-          - name: OpenBSD
-            os: ubuntu-latest
-            config: "no"
-            make: "no"
-            with_cross_platform_action: "yes"
-            cross_platform_os: "openbsd"
-            cross_platform_arch: "x86-64"
-            cross_platform_version: "7.5"
-            cross_platform_config: "--enable-debug --disable-flto --with-libevent --disable-static"
-          - name: NetBSD
-            os: ubuntu-latest
-            config: "no"
-            make: "no"
-            with_cross_platform_action: "yes"
-            cross_platform_os: "netbsd"
-            cross_platform_arch: "x86-64"
-            cross_platform_version: "10.0"
-            cross_platform_config: "--enable-debug --disable-flto --with-libevent --disable-static"
 
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v4
        with:
          submodules: false
-          persist-credentials: false
      - name: test_windows
        if: ${{ matrix.test_windows == 'yes' }}
-        env:
-          LIBEXPAT_FNAME: expat-2.7.0
-          LIBEXPAT_VERSION_DIR: R_2_7_0
        shell: bash
        run: |
          export unboundpath=`pwd`
@@ -189,8 +175,6 @@ jobs:
          cd ..
          export prepath=`pwd`
          echo prepath=${prepath}
-          # parralel build option
-          export MINJ="-j4"
          echo "choco install winflexbison3"
          choco install winflexbison3
          echo 'LEX="win_flex"'
@@ -213,8 +197,8 @@ jobs:
          C:/msys64/usr/bin/perl ./Configure no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl" PERL="C:/msys64/usr/bin/perl"
          # make the libs only, build faster
          echo "make build_libs"
-          #make $MINJ
-          make $MINJ build_libs
+          #make
+          make build_libs
          mv Makefile Makefile.orig
          # fixup \\ in the installtop to /.
          echo "fixup INSTALLTOP"
@@ -226,9 +210,9 @@ jobs:
          cd ..
          mkdir expat
          echo "curl expat"
-          curl -L -k -s -S -o $LIBEXPAT_FNAME.tar.gz https://github.com/libexpat/libexpat/releases/download/$LIBEXPAT_VERSION_DIR/$LIBEXPAT_FNAME.tar.gz
-          tar xzf $LIBEXPAT_FNAME.tar.gz
-          cd $LIBEXPAT_FNAME
+          curl -L -k -s -S -o expat-2.2.10.tar.gz https://github.com/libexpat/libexpat/releases/download/R_2_2_10/expat-2.2.10.tar.gz
+          tar xzf expat-2.2.10.tar.gz
+          cd expat-2.2.10
          echo "./configure SHELL=/usr/bin/bash CONFIG_SHELL=/usr/bin/bash --prefix=\"$prepath/expat\" --exec-prefix=\"$prepath/expat\" --bindir=\"$prepath/expat/bin\" --includedir=\"$prepath/expat/include\" --mandir=\"$prepath/expat/man\" --libdir=\"$prepath/expat/lib\""
          ./configure SHELL=/usr/bin/bash CONFIG_SHELL=/usr/bin/bash --prefix="$prepath/expat" --exec-prefix="$prepath/expat" --bindir="$prepath/expat/bin" --includedir="$prepath/expat/include" --mandir="$prepath/expat/man" --libdir="$prepath/expat/lib"
          # fixup SHELL is treated specially, but SHELZZ is not by make.
@@ -246,7 +230,7 @@ jobs:
          mv xmlwf/Makefile xmlwf/Makefile.orig
          sed -e 's/SHELL/SHELLZZ/g' < xmlwf/Makefile.orig > xmlwf/Makefile
          echo "make"
-          make $MINJ
+          make
          echo "make install"
          make install
          cd ..
@@ -254,7 +238,7 @@ jobs:
          cd unbound
          echo "./configure --enable-debug --enable-static-exe --disable-flto \"--with-ssl=$prepath/openssl\" --with-libexpat=\"$prepath/expat\" --disable-shared"
          ./configure --enable-debug --enable-static-exe --disable-flto "--with-ssl=$prepath/openssl" --with-libexpat="$prepath/expat" --disable-shared
-          make $MINJ
+          make
          # specific test output
          #make testbound.exe; ./testbound.exe -s
          #make testbound; ./testbound.exe -p testdata/acl.rpl -o -vvvv
@@ -347,33 +331,6 @@ jobs:
          echo "::group::make install"
          make install
          echo "::endgroup::"
-      - name: cross-platform-action on ${{ matrix.cross_platform_os }} ${{ matrix.cross_platform_version }}
-        if: ${{ matrix.with_cross_platform_action == 'yes' }}
-        uses: cross-platform-actions/action@v1.0.0
-        env:
-          CROSS_PLATFORM_OS: ${{ matrix.cross_platform_os }}
-        with:
-          environment_variables: CROSS_PLATFORM_OS
-          operating_system: ${{ matrix.cross_platform_os }}
-          architecture: ${{ matrix.cross_platform_arch }}
-          version: ${{ matrix.cross_platform_version }}
-          shell: bash
-          memory: 4G
-          cpu_count: 2
-          run: |
-            set -e -x
-            if test "$CROSS_PLATFORM_OS" = "freebsd"; then sudo pkg install -y openssl libevent expat; fi
-            if test "$CROSS_PLATFORM_OS" = "openbsd"; then sudo pkg_add libevent; fi
-            if test "$CROSS_PLATFORM_OS" = "netbsd"; then sudo pkgin -y install libevent; fi
-            echo "::group::configure"
-            ./configure ${{ matrix.cross_platform_config }}
-            echo "::endgroup::"
-            echo "::group::make"
-            make
-            echo "::endgroup::"
-            echo "::group::make test"
-            make test
-            echo "::endgroup::"
      - name: install libevent
        if: ${{ matrix.install_libevent == 'yes' }}
        run: sudo apt-get install libevent-dev
@@ -12,9 +12,7 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-    - uses: actions/checkout@v7
-      with:
-        persist-credentials: false
+    - uses: actions/checkout@v4
    - name: configure
      run: ./configure --enable-debug
    - name: make
@@ -10,9 +10,6 @@
 /config.status
 /dnstap/dnstap_config.h
 /dnscrypt/dnscrypt_config.h
-/util/configlexer.c
-/util/configparser.c
-/util/configparser.h
 /clubsyms.def
 /doc/example.conf
 /doc/libunbound.3
@@ -36,7 +33,6 @@
 /asynclook
 /delayer
 /dohclient
-/doqclient
 /lock-verify
 /memstats
 /perf
@@ -59,7 +55,6 @@
 /pythonmod/unboundmodule.py
 /testdata/result.*
 /testdata/.done-*
-/testdata/.skip-*
 /testdata/.perfstats.txt
 /doc/html
 /doc/xml
@@ -4,13 +4,13 @@
 [![Packaging status](https://repology.org/badge/tiny-repos/unbound.svg)](https://repology.org/project/unbound/versions)
 [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/unbound.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:unbound)
 [![Documentation Status](https://readthedocs.org/projects/unbound/badge/?version=latest)](https://unbound.readthedocs.io/en/latest/?badge=latest)
-[![Mastodon Follow](https://img.shields.io/mastodon/follow/114692612288811644?domain=social.nlnetlabs.nl&style=social)](https://social.nlnetlabs.nl/@nlnetlabs)
+[![Mastodon Follow](https://img.shields.io/mastodon/follow/109262826617293067?domain=https%3A%2F%2Ffosstodon.org&style=social)](https://fosstodon.org/@nlnetlabs)

 Unbound is a validating, recursive, caching DNS resolver. It is designed to be
 fast and lean and incorporates modern features based on open standards. If you
 have any feedback, we would love to hear from you. Don’t hesitate to
 [create an issue on Github](https://github.com/NLnetLabs/unbound/issues/new)
-or post a message on our [community forum](https://community.nlnetlabs.nl/).
+or post a message on the [Unbound mailing list](https://lists.nlnetlabs.nl/mailman/listinfo/unbound-users).
 You can learn more about Unbound by reading our
 [documentation](https://unbound.docs.nlnetlabs.nl/).

@@ -25,21 +25,18 @@ Unbound can be compiled and installed using:
 ./configure && make && make install
 ```

-You can use libevent if you want. libevent is useful when using many (e.g.,
-10000) outgoing ports.
+You can use libevent if you want. libevent is useful when using many (10000)
+outgoing ports. By default max 256 ports are opened at the same time and the
+builtin alternative is equally capable and a little faster.
+
 Use the `--with-libevent` configure option to compile Unbound with libevent
 support.

-If not, the default builtin alternative opens max 256 ports at the same time
-and is equally capable and a little faster.
-
-
 ## Unbound configuration

-All of Unbound's configuration options are described in the `unbound.conf(5)`
-man page, which will be installed and is also available on the Unbound
-[documentation page](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html)
-for the latest version.
+All of Unbound's configuration options are described in the man pages, which
+will be installed and are available on the Unbound
+[documentation page](https://unbound.docs.nlnetlabs.nl/).

-An example configuration file, with minimal documentation, is located in
+An example configuration file is located in
 [doc/example.conf](https://github.com/NLnetLabs/unbound/blob/master/doc/example.conf.in).
@@ -2,12 +2,7 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 51
-# 2025-11-06 Fix ACX_CHECK_NONSTRING_ATTRIBUTE to reject clang, that prints
-#	     a warning for 'unknown attribute' when nonstring is used.
-# 2025-09-29 add ac_cv_func_malloc_0_nonnull as a cache value for the malloc(0)
-#            check by ACX_FUNC_MALLOC.
-# 2025-09-29 add ACX_CHECK_NONSTRING_ATTRIBUTE, AHX_CONFIG_NONSTRING_ATTRIBUTE.
+# Version 48
 # 2024-01-16 fix to add -l:libssp.a to -lcrypto link check.
 #	     and check for getaddrinfo with only header.
 # 2024-01-15 fix to add crypt32 to -lcrypto link check when checking for gdi32.
@@ -76,7 +71,6 @@
 # ACX_DEPFLAG			- find cc dependency flags.
 # ACX_DETERMINE_EXT_FLAGS_UNBOUND - find out which flags enable BSD and POSIX.
 # ACX_CHECK_FORMAT_ATTRIBUTE	- find cc printf format syntax.
-# ACX_CHECK_NONSTRING_ATTRIBUTE - find cc nonstring attribute syntax.
 # ACX_CHECK_UNUSED_ATTRIBUTE	- find cc variable unused syntax.
 # ACX_CHECK_FLTO		- see if cc supports -flto and use it if so.
 # ACX_LIBTOOL_C_ONLY		- create libtool for C only, improved.
@@ -98,7 +92,6 @@
 # ACX_FUNC_IOCTLSOCKET		- find ioctlsocket, portably.
 # ACX_FUNC_MALLOC		- check malloc, define replacement .
 # AHX_CONFIG_FORMAT_ATTRIBUTE	- config.h text for format.
-# AHX_CONFIG_NONSTRING_ATTRIBUTE - config.h text for nonstring.
 # AHX_CONFIG_UNUSED_ATTRIBUTE	- config.h text for unused.
 # AHX_CONFIG_FSEEKO		- define fseeko, ftello fallback.
 # AHX_CONFIG_RAND_MAX		- define RAND_MAX if needed.
@@ -497,7 +490,7 @@ AC_DEFUN([AHX_CONFIG_FORMAT_ATTRIBUTE],
 ])

 dnl Check how to mark function arguments as unused.
-dnl result in HAVE_ATTR_UNUSED.
+dnl result in HAVE_ATTR_UNUSED.  
 dnl Make sure you include AHX_CONFIG_UNUSED_ATTRIBUTE also.
 AC_DEFUN([ACX_CHECK_UNUSED_ATTRIBUTE],
 [AC_REQUIRE([AC_PROG_CC])
@@ -532,49 +525,6 @@ if test $ac_cv_c_unused_attribute = yes; then
 fi
 ])dnl

-dnl Check how to mark function arguments as nonstring.
-dnl result in HAVE_ATTR_NONSTRING.
-dnl Make sure you include AHX_CONFIG_NONSTRING_ATTRIBUTE also.
-AC_DEFUN([ACX_CHECK_NONSTRING_ATTRIBUTE],
-[AC_REQUIRE([AC_PROG_CC])
-AC_REQUIRE([ACX_CHECK_ERROR_FLAGS])
-BAKCFLAGS="$CFLAGS"
-CFLAGS="$CFLAGS $ERRFLAG"
-AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "nonstring" attribute)
-AC_CACHE_VAL(ac_cv_c_nonstring_attribute,
-[ac_cv_c_nonstring_attribute=no
-AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>
-struct test {
-    char __attribute__((nonstring)) s[1];
-};
-]], [[
-   struct test t = { "1" };
-   (void) t;
-]])],[ac_cv_c_nonstring_attribute="yes"],[ac_cv_c_nonstring_attribute="no"])
-CFLAGS="$BAKCFLAGS"
-])
-
-dnl Setup ATTR_NONSTRING config.h parts.
-dnl make sure you call ACX_CHECK_NONSTRING_ATTRIBUTE also.
-AC_DEFUN([AHX_CONFIG_NONSTRING_ATTRIBUTE],
-[
-#if defined(DOXYGEN)
-#  define ATTR_NONSTRING(x)  x
-#elif defined(__cplusplus)
-#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
-#elif defined(HAVE_ATTR_NONSTRING)
-#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
-#else /* !HAVE_ATTR_NONSTRING */
-#  define ATTR_NONSTRING(x)  x
-#endif /* !HAVE_ATTR_NONSTRING */
-])
-
-AC_MSG_RESULT($ac_cv_c_nonstring_attribute)
-if test $ac_cv_c_nonstring_attribute = yes; then
-  AC_DEFINE(HAVE_ATTR_NONSTRING, 1, [Whether the C compiler accepts the "nonstring" attribute])
-fi
-])dnl
-
 dnl Pre-fun for ACX_LIBTOOL_C_ONLY
 AC_DEFUN([ACX_LIBTOOL_C_PRE], [
 # skip these tests, we do not need them.
@@ -1240,9 +1190,8 @@ dnl detect malloc and provide malloc compat prototype.
 dnl $1: unique name for compat code
 AC_DEFUN([ACX_FUNC_MALLOC],
 [
-	AC_CACHE_CHECK([for GNU libc compatible malloc],[ac_cv_func_malloc_0_nonnull],
-	[
-		AC_RUN_IFELSE([AC_LANG_PROGRAM(
+	AC_MSG_CHECKING([for GNU libc compatible malloc])
+	AC_RUN_IFELSE([AC_LANG_PROGRAM(
 [[#if defined STDC_HEADERS || defined HAVE_STDLIB_H
 #include <stdlib.h>
 #else
@@ -1250,16 +1199,14 @@ char *malloc ();
 #endif
 ]], [ if(malloc(0) != 0) return 1;])
 ],
-		[ac_cv_func_malloc_0_nonnull=no],
-		[ac_cv_func_malloc_0_nonnull=yes],
-		[ac_cv_func_malloc_0_nonnull="no (crosscompile)"])
-	])
-	AS_IF([test "$ac_cv_func_malloc_0_nonnull" = yes],
-		[AC_DEFINE([HAVE_MALLOC], 1, [If have GNU libc compatible malloc])],
-	[
-		AC_LIBOBJ(malloc)
-		AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])
-	])
+	[AC_MSG_RESULT([no])
+	AC_LIBOBJ(malloc)
+	AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])] ,
+	[AC_MSG_RESULT([yes])
+	AC_DEFINE([HAVE_MALLOC], 1, [If have GNU libc compatible malloc])],
+	[AC_MSG_RESULT([no (crosscompile)])
+	AC_LIBOBJ(malloc)
+	AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])] )
 ])

 dnl Define fallback for fseeko and ftello if needed.
@@ -9,7 +9,7 @@ AC_DEFUN([AC_PYTHON_DEVEL],[

        AC_PATH_PROG([PYTHON],[python[$PYTHON_VERSION]])
        if test -z "$PYTHON"; then
-           AC_MSG_ERROR([Cannot find 'python$PYTHON_VERSION' in your system path. You can use the environment variable 'PYTHON_VERSION=version_number' for an explicit version.])
+           AC_MSG_ERROR([Cannot find python$PYTHON_VERSION in your system path])
           PYTHON_VERSION=""
        fi

@@ -1,70 +0,0 @@
-# ===========================================================================
-#   https://www.gnu.org/software/autoconf-archive/ax_build_date_epoch.html
-# ===========================================================================
-#
-# SYNOPSIS
-#
-#   AX_BUILD_DATE_EPOCH(VARIABLE[, FORMAT[, ACTION-IF-FAIL]])
-#
-# DESCRIPTION
-#
-#   Sets VARIABLE to a string representing the current time.  It is
-#   formatted according to FORMAT if specified, otherwise it is formatted as
-#   the number of seconds (excluding leap seconds) since the UNIX epoch (01
-#   Jan 1970 00:00:00 UTC).
-#
-#   If the SOURCE_DATE_EPOCH environment variable is set, it uses the value
-#   of that variable instead of the current time.  See
-#   https://reproducible-builds.org/specs/source-date-epoch).  If
-#   SOURCE_DATE_EPOCH is set but cannot be properly interpreted as a UNIX
-#   timestamp, then execute ACTION-IF-FAIL if specified, otherwise error.
-#
-#   VARIABLE is AC_SUBST-ed.
-#
-# LICENSE
-#
-#   Copyright (c) 2016 Eric Bavier <bavier@member.fsf.org>
-#
-#   This program is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by the
-#   Free Software Foundation, either version 3 of the License, or (at your
-#   option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
-#   Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <https://www.gnu.org/licenses/>.
-#
-#   As a special exception, the respective Autoconf Macro's copyright owner
-#   gives unlimited permission to copy, distribute and modify the configure
-#   scripts that are the output of Autoconf when processing the Macro. You
-#   need not follow the terms of the GNU General Public License when using
-#   or distributing such scripts, even though portions of the text of the
-#   Macro appear in them. The GNU General Public License (GPL) does govern
-#   all other use of the material that constitutes the Autoconf Macro.
-#
-#   This special exception to the GPL applies to versions of the Autoconf
-#   Macro released by the Autoconf Archive. When you make and distribute a
-#   modified version of the Autoconf Macro, you may extend this special
-#   exception to the GPL to apply to your modified version as well.
-
-#serial 2
-
-AC_DEFUN([AX_BUILD_DATE_EPOCH],
-[dnl
-AC_MSG_CHECKING([for build time])
-ax_date_fmt="m4_default($2,%s)"
-AS_IF([test x"$SOURCE_DATE_EPOCH" = x],
- [$1=`date "+$ax_date_fmt"`],
- [ax_build_date=`date -u -d "@$SOURCE_DATE_EPOCH" "+$ax_date_fmt" 2>/dev/null \
-                 || date -u -r "$SOURCE_DATE_EPOCH" "+$ax_date_fmt" 2>/dev/null`
-  AS_IF([test x"$ax_build_date" = x],
-   [m4_ifval([$3],
-      [$3],
-      [AC_MSG_ERROR([malformed SOURCE_DATE_EPOCH])])],
-   [$1=$ax_build_date])])
-AC_MSG_RESULT([$$1])
-])dnl AX_BUILD_DATE_EPOCH
@@ -87,7 +87,7 @@
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.

-#serial 32
+#serial 31

 AU_ALIAS([ACX_PTHREAD], [AX_PTHREAD])
 AC_DEFUN([AX_PTHREAD], [
@@ -249,22 +249,7 @@ AS_IF([test "x$ax_pthread_clang" = "xyes"],
 # correctly enabled

 case $host_os in
-        solaris*)
-        # Solaris 11.4 introduced XPG7 support and did away with the need for
-        # _REENTRANT.
-
-        AC_EGREP_CPP([AX_PTHREAD_SOLARIS__REENTRANT],
-            [
-#            undef _XOPEN_SOURCE
-#            include <sys/feature_tests.h>
-#            if _XOPEN_VERSION < 700
-             AX_PTHREAD_SOLARIS__REENTRANT
-#            endif
-            ],
-            [ax_pthread_check_macro="_REENTRANT"],
-            [ax_pthread_check_macro="--"])
-        ;;
-        darwin* | hpux* | linux* | osf*)
+        darwin* | hpux* | linux* | osf* | solaris*)
        ax_pthread_check_macro="_REENTRANT"
        ;;

@@ -47,7 +47,6 @@
 #include "util/regional.h"
 #include "util/net_help.h"
 #include "util/config_file.h"
-#include "util/data/dname.h"
 #include "util/data/msgreply.h"
 #include "util/data/msgencode.h"
 #include "services/cache/dns.h"
@@ -342,7 +341,6 @@ calc_hash(struct query_info* qinfo, struct module_env* env, char* buf,
 	/* copy the hash info into the clear buffer */
 	if(clen + qinfo->qname_len < sizeof(clear)) {
 		memmove(clear+clen, qinfo->qname, qinfo->qname_len);
-		query_dname_tolower(clear+clen);
 		clen += qinfo->qname_len;
 	}
 	if(clen + 4 < sizeof(clear)) {
@@ -401,15 +399,12 @@ prep_data(struct module_qstate* qstate, struct sldns_buffer* buf)
 	   FLAGS_GET_RCODE(qstate->return_msg->rep->flags) !=
 		LDNS_RCODE_YXDOMAIN)
 		return 0;
-	/* Do not persist data the validator has not yet seen, or has rejected.
-	 * Otherwise an expired blob could maybe reach clients via
-	 * serve-expired. */
-	if(qstate->env->need_to_validate &&
-		qstate->return_msg->rep->security == sec_status_bogus)
-		return 0;
-	/* We don't store the reply if its TTL is 0. This is probably coming
-	 * from upstream and it is not meant to be stored. */
-	if(qstate->return_msg->rep->ttl == 0)
+	/* We don't store the reply if its TTL is 0 unless serve-expired is
+	 * enabled.  Such a reply won't be reusable and simply be a waste for
+	 * the backend.  It's also compatible with the default behavior of
+	 * dns_cache_store_msg(). */
+	if(qstate->return_msg->rep->ttl == 0 &&
+		!qstate->env->cfg->serve_expired)
 		return 0;

 	/* The EDE is added to the out-list so it is encoded in the cached message */
@@ -463,7 +458,7 @@ good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
 	 * - serve_expired needs to be set
 	 * - if SERVE_EXPIRED_TTL is set make sure that the record is not older
 	 *   than that. */
-	if(TTL_IS_EXPIRED((time_t)expiry, *qstate->env->now) &&
+	if((time_t)expiry < *qstate->env->now &&
 		(!qstate->env->cfg->serve_expired ||
 			(SERVE_EXPIRED_TTL &&
 			*qstate->env->now - (time_t)expiry > SERVE_EXPIRED_TTL)))
@@ -475,8 +470,7 @@ good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
 /* Adjust the TTL of the given RRset by 'subtract'.  If 'subtract' is
 * negative, set the TTL to 0. */
 static void
-packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract,
-	time_t timestamp)
+packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract)
 {
 	size_t i;
 	size_t total = data->count + data->rrsig_count;
@@ -488,13 +482,13 @@ packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract,
 			data->rr_ttl[i] -= subtract;
 		else	data->rr_ttl[i] = 0;
 	}
-	data->ttl_add = timestamp;
+	data->ttl_add = (subtract < data->ttl_add) ? (data->ttl_add - subtract) : 0;
 }

 /* Adjust the TTL of a DNS message and its RRs by 'adjust'.  If 'adjust' is
 * negative, set the TTLs to 0. */
 static void
-adjust_msg_ttl(struct dns_msg* msg, time_t adjust, time_t timestamp)
+adjust_msg_ttl(struct dns_msg* msg, time_t adjust)
 {
 	size_t i;
 	if(adjust >= 0 && msg->rep->ttl > adjust)
@@ -506,13 +500,13 @@ adjust_msg_ttl(struct dns_msg* msg, time_t adjust, time_t timestamp)

 	for(i=0; i<msg->rep->rrset_count; i++) {
 		packed_rrset_ttl_subtract((struct packed_rrset_data*)msg->
-			rep->rrsets[i]->entry.data, adjust, timestamp);
+			rep->rrsets[i]->entry.data, adjust);
 	}
 }

 /* Set the TTL of the given RRset to fixed value. */
 static void
-packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl, time_t timestamp)
+packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl)
 {
 	size_t i;
 	size_t total = data->count + data->rrsig_count;
@@ -520,12 +514,12 @@ packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl, time_t timestam
 	for(i=0; i<total; i++) {
 		data->rr_ttl[i] = ttl;
 	}
-	data->ttl_add = timestamp;
+	data->ttl_add = 0;
 }

 /* Set the TTL of a DNS message and its RRs by to a fixed value. */
 static void
-set_msg_ttl(struct dns_msg* msg, time_t ttl, time_t timestamp)
+set_msg_ttl(struct dns_msg* msg, time_t ttl)
 {
 	size_t i;
 	msg->rep->ttl = ttl;
@@ -534,14 +528,14 @@ set_msg_ttl(struct dns_msg* msg, time_t ttl, time_t timestamp)

 	for(i=0; i<msg->rep->rrset_count; i++) {
 		packed_rrset_ttl_set((struct packed_rrset_data*)msg->
-			rep->rrsets[i]->entry.data, ttl, timestamp);
+			rep->rrsets[i]->entry.data, ttl);
 	}
 }

 /** convert dns message in buffer to return_msg */
 static int
 parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
-	int* msg_expired, time_t* msg_timestamp, time_t* msg_expiry)
+	int* msg_expired)
 {
 	struct msg_parse* prs;
 	struct edns_data edns;
@@ -558,9 +552,6 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 		&timestamp, sizeof(timestamp));
 	expiry = be64toh(expiry);
 	timestamp = be64toh(timestamp);
-	log_assert(timestamp <= expiry);
-	*msg_expiry = (time_t)expiry;
-	*msg_timestamp = (time_t)timestamp;

 	/* parse DNS packet */
 	regional_free_all(qstate->env->scratch);
@@ -612,9 +603,11 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 		return 1; /* message from the future (clock skew?) */
 	}
 	adjust = *qstate->env->now - (time_t)timestamp;
-	if(TTL_IS_EXPIRED((time_t)expiry, *qstate->env->now)) {
+	if(qstate->return_msg->rep->ttl < adjust) {
 		verbose(VERB_ALGO, "cachedb msg expired");
 		*msg_expired = 1;
+		/* If serve-expired is enabled, we still use an expired message
+		 * setting the TTL to 0. */
 		if(!qstate->env->cfg->serve_expired ||
 			(FLAGS_GET_RCODE(qstate->return_msg->rep->flags)
 			!= LDNS_RCODE_NOERROR &&
@@ -623,21 +616,20 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 			FLAGS_GET_RCODE(qstate->return_msg->rep->flags)
 			!= LDNS_RCODE_YXDOMAIN))
 			return 0; /* message expired */
-		/* If serve-expired is enabled, we still use an expired message.
-		 * Set the TTL to 0 now and it will be handled specially later
-		 * when we need to store it internally. */
-		adjust = -1;
+		else
+			adjust = -1;
 	}
-	adjust_msg_ttl(qstate->return_msg, adjust, timestamp);
 	verbose(VERB_ALGO, "cachedb msg adjusted down by %d", (int)adjust);
-	if(qstate->env->cfg->aggressive_nsec) {
-		limit_nsec_ttl(qstate->return_msg);
-	}
+	adjust_msg_ttl(qstate->return_msg, adjust);

 	/* Similar to the unbound worker, if serve-expired is enabled and
 	 * the msg would be considered to be expired, mark the state so a
-	 * refetch will be scheduled. */
-	if(*msg_expired && !qstate->env->cfg->serve_expired_client_timeout) {
+	 * refetch will be scheduled.  The comparison between 'expiry' and
+	 * 'now' should be redundant given how these values were calculated,
+	 * but we check it just in case as does good_expiry_and_qinfo(). */
+	if(qstate->env->cfg->serve_expired &&
+		!qstate->env->cfg->serve_expired_client_timeout &&
+		(adjust == -1 || (time_t)expiry < *qstate->env->now)) {
 		qstate->need_refetch = 1;
 	}

@@ -650,7 +642,7 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 */
 static int
 cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie,
-	int* msg_expired, time_t* msg_timestamp, time_t* msg_expiry)
+	int* msg_expired)
 {
 	char key[(CACHEDB_HASHSIZE/8)*2+1];
 	calc_hash(&qstate->qinfo, qstate->env, key, sizeof(key));
@@ -667,8 +659,7 @@ cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie,
 	}

 	/* parse dns message into return_msg */
-	if( !parse_data(qstate, qstate->env->scratch_buffer, msg_expired,
-		msg_timestamp, msg_expiry) ) {
+	if( !parse_data(qstate, qstate->env->scratch_buffer, msg_expired) ) {
 		return 0;
 	}
 	return 1;
@@ -740,35 +731,28 @@ cachedb_intcache_lookup(struct module_qstate* qstate, struct cachedb_env* cde)
 * Store query into the internal cache of unbound.
 */
 static void
-cachedb_intcache_store(struct module_qstate* qstate, int msg_expired,
-	time_t msg_timestamp, time_t msg_expiry)
+cachedb_intcache_store(struct module_qstate* qstate, int msg_expired)
 {
 	uint32_t store_flags = qstate->query_flags;
 	int serve_expired = qstate->env->cfg->serve_expired;
+
+	if(qstate->env->cfg->serve_expired)
+		store_flags |= DNSCACHE_STORE_ZEROTTL;
 	if(!qstate->return_msg)
 		return;
 	if(serve_expired && msg_expired) {
-		time_t original_ttl = msg_expiry - msg_timestamp;
-		store_flags |= DNSCACHE_STORE_EXPIRED_MSG_CACHEDB;
-		/* Pass the original TTL of the expired message and signal with
-		 * the DNSCACHE_STORE_EXPIRED_MSG_CACHEDB flag that
-		 * dns_cache_store_msg() needs to set absolute expired TTLs
-		 * based on the original message TTL.
-		 * Results as expired message in the cache */
-		set_msg_ttl(qstate->return_msg, original_ttl, 0);
-		verbose(VERB_ALGO, "cachedb expired msg set to be expired now "
-			"(original ttl: %d)", (int)original_ttl);
+		/* Set TTLs to a value such that value + *env->now is
+		 * going to be now-3 seconds. Making it expired
+		 * in the cache. */
+		set_msg_ttl(qstate->return_msg, (time_t)-3);
 		/* The expired entry does not get checked by the validator
 		 * and we need a validation value for it. */
-		/* By setting this to unchecked, bogus data is not returned
-		 * as non-bogus. */
 		if(qstate->env->cfg->cachedb_check_when_serve_expired)
-			qstate->return_msg->rep->security = sec_status_unchecked;
+			qstate->return_msg->rep->security = sec_status_insecure;
 	}
 	(void)dns_cache_store(qstate->env, &qstate->qinfo,
 		qstate->return_msg->rep, 0, qstate->prefetch_leeway, 0,
-		qstate->region, store_flags, qstate->qstarttime,
-		qstate->is_valrec);
+		qstate->region, store_flags, qstate->qstarttime);
 	if(serve_expired && msg_expired) {
 		if(qstate->env->cfg->serve_expired_client_timeout) {
 			/* No expired response from the query state, the
@@ -777,14 +761,12 @@ cachedb_intcache_store(struct module_qstate* qstate, int msg_expired,
 			 * of cache. */
 			return;
 		}
+		/* set TTLs to zero again */
+		adjust_msg_ttl(qstate->return_msg, -1);
 		/* Send serve expired responses based on the cachedb
 		 * returned message, that was just stored in the cache.
 		 * It can then continue to work on this query. */
 		mesh_respond_serve_expired(qstate->mesh_info);
-		/* set TTLs as expired for this return_msg in case it is used
-		 * later on */
-		set_msg_ttl(qstate->return_msg,
-			EXPIRED_REPLY_TTL_CALC(msg_expiry, msg_timestamp), 0);
 	}
 }

@@ -802,7 +784,6 @@ cachedb_handle_query(struct module_qstate* qstate,
 	struct cachedb_env* ie, int id)
 {
 	int msg_expired = 0;
-	time_t msg_timestamp, msg_expiry;
 	qstate->is_cachedb_answer = 0;
 	/* check if we are enabled, and skip if so */
 	if(!ie->enabled) {
@@ -811,11 +792,8 @@ cachedb_handle_query(struct module_qstate* qstate,
 		return;
 	}

-	if(qstate->blacklist || qstate->no_cache_lookup
-		|| iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL,
-		NULL, 0)) {
-		/* cache is blacklisted or we are instructed from edns to not
-		 * look or a forwarder/stub forbids it */
+	if(qstate->blacklist || qstate->no_cache_lookup) {
+		/* cache is blacklisted or we are instructed from edns to not look */
 		/* pass request to next module */
 		qstate->ext_state[id] = module_wait_module;
 		return;
@@ -840,18 +818,18 @@ cachedb_handle_query(struct module_qstate* qstate,
 	}

 	/* ask backend cache to see if we have data */
-	if(cachedb_extcache_lookup(qstate, ie, &msg_expired, &msg_timestamp,
-		&msg_expiry)) {
+	if(cachedb_extcache_lookup(qstate, ie, &msg_expired)) {
 		if(verbosity >= VERB_ALGO)
 			log_dns_msg(ie->backend->name,
 				&qstate->return_msg->qinfo,
 				qstate->return_msg->rep);
 		/* store this result in internal cache */
-		cachedb_intcache_store(qstate,
-			msg_expired, msg_timestamp, msg_expiry);
+		cachedb_intcache_store(qstate, msg_expired);
 		/* In case we have expired data but there is a client timer for expired
 		 * answers, pass execution to next module in order to try updating the
 		 * data first.
+		 * TODO: this needs revisit. The expired data stored from cachedb has
+		 * 0 TTL which is picked up by iterator later when looking in the cache.
 		 */
 		if(qstate->env->cfg->serve_expired && msg_expired) {
 			qstate->return_msg = NULL;
@@ -868,13 +846,6 @@ cachedb_handle_query(struct module_qstate* qstate,
 				qstate->ext_state[id] = module_wait_module;
 				return;
 		}
-		/* No 0TTL answers escaping from external cache. */
-		if(qstate->return_msg->rep->ttl == 0) {
-			qstate->return_msg = NULL;
-			qstate->ext_state[id] = module_wait_module;
-			return;
-		}
-		log_assert(qstate->return_msg->rep->ttl > 0);
 		qstate->is_cachedb_answer = 1;
 		/* we are done with the query */
 		qstate->ext_state[id] = module_finished;
@@ -908,9 +879,7 @@ cachedb_handle_response(struct module_qstate* qstate,
 {
 	qstate->is_cachedb_answer = 0;
 	/* check if we are not enabled or instructed to not cache, and skip */
-	if(!ie->enabled || qstate->no_cache_store
-		|| iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL,
-		NULL, 0)) {
+	if(!ie->enabled || qstate->no_cache_store) {
 		/* we are done with the query */
 		qstate->ext_state[id] = module_finished;
 		return;
@@ -1014,7 +983,7 @@ cachedb_get_mem(struct module_env* env, int id)
 */
 static struct module_func_block cachedb_block = {
 	"cachedb",
-	NULL, NULL, &cachedb_init, &cachedb_deinit, &cachedb_operate,
+	&cachedb_init, &cachedb_deinit, &cachedb_operate,
 	&cachedb_inform_super, &cachedb_clear, &cachedb_get_mem
 };

@@ -46,62 +46,24 @@
 #include "cachedb/cachedb.h"
 #include "util/alloc.h"
 #include "util/config_file.h"
-#include "util/locks.h"
-#include "util/timeval_func.h"
 #include "sldns/sbuffer.h"

 #ifdef USE_REDIS
 #include "hiredis/hiredis.h"

 struct redis_moddata {
-	/* thread-specific redis contexts */
-	redisContext** ctxs;
-	redisContext** replica_ctxs;
-	/* number of ctx entries */
-	int numctxs;
-	/* server's IP address or host name */
-	const char* server_host;
-	const char* replica_server_host;
-	/* server's TCP port */
-	int server_port;
-	int replica_server_port;
-	/* server's unix path, or "", NULL if unused */
-	const char* server_path;
-	const char* replica_server_path;
-	/* server's AUTH password, or "", NULL if unused */
-	const char* server_password;
-	const char* replica_server_password;
-	/* timeout for commands */
-	struct timeval command_timeout;
-	struct timeval replica_command_timeout;
-	/* timeout for connection setup */
-	struct timeval connect_timeout;
-	struct timeval replica_connect_timeout;
-	/* the reconnect interval time. */
-	struct timeval reconnect_interval;
-	struct timeval replica_reconnect_interval;
-	/* reconnect attempts, 0 if connected, counts up failed reconnects. */
-	int reconnect_attempts;
-	int replica_reconnect_attempts;
-	/* Lock on reconnect_wait time. */
-	lock_basic_type wait_lock;
-	lock_basic_type replica_wait_lock;
-	/* reconnect wait time, wait until it has passed before reconnect. */
-	struct timeval reconnect_wait;
-	struct timeval replica_reconnect_wait;
-	/* the redis logical database to use */
-	int logical_db;
-	int replica_logical_db;
-	/* if the SET with EX command is supported */
-	int set_with_ex_available;
+	redisContext** ctxs;	/* thread-specific redis contexts */
+	int numctxs;		/* number of ctx entries */
+	const char* server_host; /* server's IP address or host name */
+	int server_port;	 /* server's TCP port */
+	const char* server_path; /* server's unix path, or "", NULL if unused */
+	const char* server_password; /* server's AUTH password, or "", NULL if unused */
+	struct timeval timeout;	 /* timeout for connection setup and commands */
+	int logical_db;		/* the redis logical database to use */
 };

-/** The limit on the number of redis connect attempts. After failure if
- * the number is exceeded, the reconnects are throttled by the wait time. */
-#define REDIS_RECONNECT_ATTEMPT_LIMIT 3
-
 static redisReply* redis_command(struct module_env*, struct cachedb_env*,
-	const char*, const uint8_t*, size_t, int);
+	const char*, const uint8_t*, size_t);

 static void
 moddata_clean(struct redis_moddata** moddata) {
@@ -115,145 +77,63 @@ moddata_clean(struct redis_moddata** moddata) {
 		}
 		free((*moddata)->ctxs);
 	}
-	if((*moddata)->replica_ctxs) {
-		int i;
-		for(i = 0; i < (*moddata)->numctxs; i++) {
-			if((*moddata)->replica_ctxs[i])
-				redisFree((*moddata)->replica_ctxs[i]);
-		}
-		free((*moddata)->replica_ctxs);
-	}
-	lock_basic_destroy(&(*moddata)->wait_lock);
-	lock_basic_destroy(&(*moddata)->replica_wait_lock);
 	free(*moddata);
 	*moddata = NULL;
 }

 static redisContext*
-redis_connect(const char* host, int port, const char* path,
-	const char* password, int logical_db,
-	const struct timeval connect_timeout,
-	const struct timeval command_timeout,
-	const struct timeval* reconnect_interval,
-	int* reconnect_attempts,
-	struct timeval* reconnect_wait,
-	lock_basic_type* wait_lock,
-	struct timeval* now_tv,
-	const char* infostr)
+redis_connect(const struct redis_moddata* moddata)
 {
-	struct timeval now_val;
 	redisContext* ctx;
-#ifdef THREADS_DISABLED
-	/* Fix attribute unused warning.
-	 * wait_lock is only used with lock_basic_* functions that are nop'ed
-	 * when compiled without thread support. */
-	(void)wait_lock;
-#endif /* THREADS_DISABLED */

-	/* See if the redis server is down, and reconnect has to wait. */
-	if(*reconnect_attempts > REDIS_RECONNECT_ATTEMPT_LIMIT) {
-		/* Acquire lock to look at timeval, the integer has atomic
-		 * integrity. */
-		struct timeval wait_tv;
-		if(now_tv) {
-			now_val = *now_tv;
-		} else {
-			if(gettimeofday(&now_val, NULL) < 0)
-				log_err("redis: gettimeofday: %s",
-					strerror(errno));
-		}
-		lock_basic_lock(wait_lock);
-		wait_tv = *reconnect_wait;
-		lock_basic_unlock(wait_lock);
-		if(timeval_smaller(&now_val, &wait_tv)) {
-			verbose(VERB_ALGO, "redis %sdown, reconnect wait",
-				infostr);
-			return NULL;
-		}
-	}
-
-	if(path && path[0]!=0) {
-		ctx = redisConnectUnixWithTimeout(path, connect_timeout);
+	if(moddata->server_path && moddata->server_path[0]!=0) {
+		ctx = redisConnectUnixWithTimeout(moddata->server_path,
+			moddata->timeout);
 	} else {
-		ctx = redisConnectWithTimeout(host, port, connect_timeout);
+		ctx = redisConnectWithTimeout(moddata->server_host,
+			moddata->server_port, moddata->timeout);
 	}
 	if(!ctx || ctx->err) {
 		const char *errstr = "out of memory";
 		if(ctx)
 			errstr = ctx->errstr;
-		log_err("failed to connect to redis %sserver: %s", infostr, errstr);
+		log_err("failed to connect to redis server: %s", errstr);
 		goto fail;
 	}
-	if(redisSetTimeout(ctx, command_timeout) != REDIS_OK) {
-		log_err("failed to set redis %stimeout, %s", infostr, ctx->errstr);
+	if(redisSetTimeout(ctx, moddata->timeout) != REDIS_OK) {
+		log_err("failed to set redis timeout");
 		goto fail;
 	}
-	if(password && password[0]!=0) {
+	if(moddata->server_password && moddata->server_password[0]!=0) {
 		redisReply* rep;
-		rep = redisCommand(ctx, "AUTH %s", password);
+		rep = redisCommand(ctx, "AUTH %s", moddata->server_password);
 		if(!rep || rep->type == REDIS_REPLY_ERROR) {
-			log_err("failed to authenticate %swith password", infostr);
+			log_err("failed to authenticate with password");
 			freeReplyObject(rep);
 			goto fail;
 		}
 		freeReplyObject(rep);
 	}
-	if(logical_db > 0) {
+	if(moddata->logical_db > 0) {
 		redisReply* rep;
-		rep = redisCommand(ctx, "SELECT %d", logical_db);
+		rep = redisCommand(ctx, "SELECT %d", moddata->logical_db);
 		if(!rep || rep->type == REDIS_REPLY_ERROR) {
-			log_err("failed %sto set logical database (%d)",
-				infostr, logical_db);
+			log_err("failed to set logical database (%d)",
+				moddata->logical_db);
 			freeReplyObject(rep);
 			goto fail;
 		}
 		freeReplyObject(rep);
 	}
-	*reconnect_attempts = 0;
-	if(verbosity >= VERB_OPS) {
-		char port_str[6+1];
-		port_str[0] = ' ';
-		(void)snprintf(port_str+1, sizeof(port_str)-1, "%d", port);
-		verbose(VERB_OPS, "Connection to Redis %sestablished (%s%s)",
-			infostr,
-			path&&path[0]!=0?path:host,
-			path&&path[0]!=0?"":port_str);
-	}
+	verbose(VERB_OPS, "Connection to Redis established");
 	return ctx;

 fail:
 	if(ctx)
 		redisFree(ctx);
-	(*reconnect_attempts)++;
-	if(*reconnect_attempts > REDIS_RECONNECT_ATTEMPT_LIMIT) {
-		/* Wait for the reconnect interval before trying again. */
-		struct timeval tv;
-		if(now_tv) {
-			now_val = *now_tv;
-		} else {
-			if(gettimeofday(&now_val, NULL) < 0)
-				log_err("redis: gettimeofday: %s",
-					strerror(errno));
-		}
-		tv = now_val;
-		timeval_add(&tv, reconnect_interval);
-		lock_basic_lock(wait_lock);
-		*reconnect_wait = tv;
-		lock_basic_unlock(wait_lock);
-		verbose(VERB_ALGO, "redis %sreconnect wait until %d.%6.6d",
-			infostr, (int)tv.tv_sec, (int)tv.tv_usec);
-	}
 	return NULL;
 }

-static void
-set_timeout(struct timeval* timeout, int value, int explicit_value)
-{
-	int v = explicit_value != 0 ? explicit_value : value;
-	timeout->tv_sec = v / 1000;
-	timeout->tv_usec = (v % 1000) * 1000;
-}
-
 static int
 redis_init(struct module_env* env, struct cachedb_env* cachedb_env)
 {
@@ -267,120 +147,42 @@ redis_init(struct module_env* env, struct cachedb_env* cachedb_env)
 		log_err("out of memory");
 		goto fail;
 	}
-	lock_basic_init(&moddata->wait_lock);
-	lock_protect(&moddata->wait_lock, &moddata->reconnect_wait,
-		sizeof(moddata->reconnect_wait));
-	lock_basic_init(&moddata->replica_wait_lock);
-	lock_protect(&moddata->replica_wait_lock,
-		&moddata->replica_reconnect_wait,
-		sizeof(moddata->replica_reconnect_wait));
 	moddata->numctxs = env->cfg->num_threads;
-	/* note: server_host and similar string configuration options are
-	 * shallow references to configured strings; we don't have to free them
-	 * in this module. */
-	moddata->server_host = env->cfg->redis_server_host;
-	moddata->replica_server_host = env->cfg->redis_replica_server_host;
-
-	moddata->server_port = env->cfg->redis_server_port;
-	moddata->replica_server_port = env->cfg->redis_replica_server_port;
-
-	moddata->server_path = env->cfg->redis_server_path;
-	moddata->replica_server_path = env->cfg->redis_replica_server_path;
-
-	moddata->server_password = env->cfg->redis_server_password;
-	moddata->replica_server_password = env->cfg->redis_replica_server_password;
-
-	set_timeout(&moddata->command_timeout,
-		env->cfg->redis_timeout,
-		env->cfg->redis_command_timeout);
-	set_timeout(&moddata->replica_command_timeout,
-		env->cfg->redis_replica_timeout,
-		env->cfg->redis_replica_command_timeout);
-	set_timeout(&moddata->connect_timeout,
-		env->cfg->redis_timeout,
-		env->cfg->redis_connect_timeout);
-	set_timeout(&moddata->replica_connect_timeout,
-		env->cfg->redis_replica_timeout,
-		env->cfg->redis_replica_connect_timeout);
-	set_timeout(&moddata->reconnect_interval, 1000, 0);
-	set_timeout(&moddata->replica_reconnect_interval, 1000, 0);
-
-	moddata->logical_db = env->cfg->redis_logical_db;
-	moddata->replica_logical_db = env->cfg->redis_replica_logical_db;
-
 	moddata->ctxs = calloc(env->cfg->num_threads, sizeof(redisContext*));
 	if(!moddata->ctxs) {
 		log_err("out of memory");
 		goto fail;
 	}
-	if((moddata->replica_server_host && moddata->replica_server_host[0]!=0)
-		|| (moddata->replica_server_path && moddata->replica_server_path[0]!=0)) {
-		/* There is a replica configured, allocate ctxs */
-		moddata->replica_ctxs = calloc(env->cfg->num_threads, sizeof(redisContext*));
-		if(!moddata->replica_ctxs) {
-			log_err("out of memory");
-			goto fail;
-		}
-	}
+	/* note: server_host is a shallow reference to configured string.
+	 * we don't have to free it in this module. */
+	moddata->server_host = env->cfg->redis_server_host;
+	moddata->server_port = env->cfg->redis_server_port;
+	moddata->server_path = env->cfg->redis_server_path;
+	moddata->server_password = env->cfg->redis_server_password;
+	moddata->timeout.tv_sec = env->cfg->redis_timeout / 1000;
+	moddata->timeout.tv_usec = (env->cfg->redis_timeout % 1000) * 1000;
+	moddata->logical_db = env->cfg->redis_logical_db;
 	for(i = 0; i < moddata->numctxs; i++) {
-		redisContext* ctx = redis_connect(
-			moddata->server_host,
-			moddata->server_port,
-			moddata->server_path,
-			moddata->server_password,
-			moddata->logical_db,
-			moddata->connect_timeout,
-			moddata->command_timeout,
-			&moddata->reconnect_interval,
-			&moddata->reconnect_attempts,
-			&moddata->reconnect_wait,
-			&moddata->wait_lock,
-			env->now_tv,
-			"");
+		redisContext* ctx = redis_connect(moddata);
 		if(!ctx) {
-			log_err("redis_init: failed to init redis "
-				"(for thread %d)", i);
-			/* And continue, the context can be established
-			 * later, just like after a disconnect. */
+			log_err("redis_init: failed to init redis");
+			goto fail;
 		}
 		moddata->ctxs[i] = ctx;
 	}
-	if(moddata->replica_ctxs) {
-		for(i = 0; i < moddata->numctxs; i++) {
-			redisContext* ctx = redis_connect(
-				moddata->replica_server_host,
-				moddata->replica_server_port,
-				moddata->replica_server_path,
-				moddata->replica_server_password,
-				moddata->replica_logical_db,
-				moddata->replica_connect_timeout,
-				moddata->replica_command_timeout,
-				&moddata->replica_reconnect_interval,
-				&moddata->replica_reconnect_attempts,
-				&moddata->replica_reconnect_wait,
-				&moddata->replica_wait_lock,
-				env->now_tv,
-				"replica ");
-			if(!ctx) {
-				log_err("redis_init: failed to init redis "
-					"replica (for thread %d)", i);
-				/* And continue, the context can be established
-				* later, just like after a disconnect. */
-			}
-			moddata->replica_ctxs[i] = ctx;
-		}
-	}
 	cachedb_env->backend_data = moddata;
-	if(env->cfg->redis_expire_records &&
-		moddata->ctxs[env->alloc->thread_num] != NULL) {
+	if(env->cfg->redis_expire_records) {
 		redisReply* rep = NULL;
 		int redis_reply_type = 0;
-		/** check if set with ex command is supported */
+		/** check if setex command is supported */
 		rep = redis_command(env, cachedb_env,
-			"SET __UNBOUND_REDIS_CHECK__ none EX 1", NULL, 0, 1);
+			"SETEX __UNBOUND_REDIS_CHECK__ 1 none", NULL, 0);
 		if(!rep) {
 			/** init failed, no response from redis server*/
-			goto set_with_ex_fail;
+			log_err("redis_init: failed to init redis, the "
+				"redis-expire-records option requires the SETEX command "
+				"(redis >= 2.0.0)");
+			goto fail;
 		}
 		redis_reply_type = rep->type;
 		freeReplyObject(rep);
@@ -388,18 +190,15 @@ redis_init(struct module_env* env, struct cachedb_env* cachedb_env)
 		case REDIS_REPLY_STATUS:
 			break;
 		default:
-			/** init failed, set_with_ex command not supported */
-			goto set_with_ex_fail;
+			/** init failed, setex command not supported */
+			log_err("redis_init: failed to init redis, the "
+				"redis-expire-records option requires the SETEX command "
+				"(redis >= 2.0.0)");
+			goto fail;
 		}
-		moddata->set_with_ex_available = 1;
 	}
 	return 1;

-set_with_ex_fail:
-	log_err("redis_init: failure during redis_init, the "
-		"redis-expire-records option requires the SET with EX command "
-		"(redis >= 2.6.12)");
-	return 1;
 fail:
 	moddata_clean(&moddata);
 	return 0;
@@ -430,9 +229,9 @@ redis_deinit(struct module_env* env, struct cachedb_env* cachedb_env)
 */
 static redisReply*
 redis_command(struct module_env* env, struct cachedb_env* cachedb_env,
-	const char* command, const uint8_t* data, size_t data_len, int write)
+	const char* command, const uint8_t* data, size_t data_len)
 {
-	redisContext* ctx, **ctx_selector;
+	redisContext* ctx;
 	redisReply* rep;
 	struct redis_moddata* d = (struct redis_moddata*)
 		cachedb_env->backend_data;
@@ -443,50 +242,17 @@ redis_command(struct module_env* env, struct cachedb_env* cachedb_env,
 	 * assumption throughout the unbound architecture, so we simply assert
 	 * it. */
 	log_assert(env->alloc->thread_num < d->numctxs);
-
-	ctx_selector = !write && d->replica_ctxs
-		?d->replica_ctxs
-		:d->ctxs;
-	ctx = ctx_selector[env->alloc->thread_num];
+	ctx = d->ctxs[env->alloc->thread_num];

 	/* If we've not established a connection to the server or we've closed
 	 * it on a failure, try to re-establish a new one.   Failures will be
 	 * logged in redis_connect(). */
 	if(!ctx) {
-		if(!write && d->replica_ctxs) {
-			ctx = redis_connect(
-				d->replica_server_host,
-				d->replica_server_port,
-				d->replica_server_path,
-				d->replica_server_password,
-				d->replica_logical_db,
-				d->replica_connect_timeout,
-				d->replica_command_timeout,
-				&d->replica_reconnect_interval,
-				&d->replica_reconnect_attempts,
-				&d->replica_reconnect_wait,
-				&d->replica_wait_lock,
-				env->now_tv,
-				"replica ");
-		} else {
-			ctx = redis_connect(
-				d->server_host,
-				d->server_port,
-				d->server_path,
-				d->server_password,
-				d->logical_db,
-				d->connect_timeout,
-				d->command_timeout,
-				&d->reconnect_interval,
-				&d->reconnect_attempts,
-				&d->reconnect_wait,
-				&d->wait_lock,
-				env->now_tv,
-				"");
-		}
-		ctx_selector[env->alloc->thread_num] = ctx;
+		ctx = redis_connect(d);
+		d->ctxs[env->alloc->thread_num] = ctx;
 	}
-	if(!ctx) return NULL;
+	if(!ctx)
+		return NULL;

 	/* Send the command and get a reply, synchronously. */
 	rep = (redisReply*)redisCommand(ctx, command, data, data_len);
@@ -496,7 +262,7 @@ redis_command(struct module_env* env, struct cachedb_env* cachedb_env,
 		log_err("redis_command: failed to receive a reply, "
 			"closing connection: %s", ctx->errstr);
 		redisFree(ctx);
-		ctx_selector[env->alloc->thread_num] = NULL;
+		d->ctxs[env->alloc->thread_num] = NULL;
 		return NULL;
 	}

@@ -514,14 +280,7 @@ redis_lookup(struct module_env* env, struct cachedb_env* cachedb_env,
 	char* key, struct sldns_buffer* result_buffer)
 {
 	redisReply* rep;
-	/* Supported commands:
-	 * - "GET " + key
-	 */
-#define REDIS_LOOKUP_MAX_BUF_LEN			\
-	4				/* "GET " */	\
-	+(CACHEDB_HASHSIZE/8)*2		/* key hash */	\
-	+ 1				/* \0 */
-	char cmdbuf[REDIS_LOOKUP_MAX_BUF_LEN];
+	char cmdbuf[4+(CACHEDB_HASHSIZE/8)*2+1]; /* "GET " + key */
 	int n;
 	int ret = 0;

@@ -533,7 +292,7 @@ redis_lookup(struct module_env* env, struct cachedb_env* cachedb_env,
 		return 0;
 	}

-	rep = redis_command(env, cachedb_env, cmdbuf, NULL, 0, 0);
+	rep = redis_command(env, cachedb_env, cmdbuf, NULL, 0);
 	if(!rep)
 		return 0;
 	switch(rep->type) {
@@ -570,45 +329,26 @@ redis_store(struct module_env* env, struct cachedb_env* cachedb_env,
 {
 	redisReply* rep;
 	int n;
-	struct redis_moddata* moddata = (struct redis_moddata*)
-		cachedb_env->backend_data;
-	int set_ttl = (moddata->set_with_ex_available &&
-		env->cfg->redis_expire_records &&
+	int set_ttl = (env->cfg->redis_expire_records &&
 		(!env->cfg->serve_expired || env->cfg->serve_expired_ttl > 0));
 	/* Supported commands:
 	 * - "SET " + key + " %b"
-	 * - "SET " + key + " %b EX " + ttl
-	 *   older redis 2.0.0 was "SETEX " + key + " " + ttl + " %b"
-	 * - "EXPIRE " + key + " 0"
+	 * - "SETEX " + key + " " + ttl + " %b"
 	 */
-#define REDIS_STORE_MAX_BUF_LEN				\
-	7			/* "EXPIRE " */		\
-	+(CACHEDB_HASHSIZE/8)*2	/* key hash */		\
-	+ 7			/* " %b EX " */		\
-	+ 20			/* ttl (uint64_t) */	\
-	+ 1			/* \0 */
-	char cmdbuf[REDIS_STORE_MAX_BUF_LEN];
+	char cmdbuf[6+(CACHEDB_HASHSIZE/8)*2+11+3+1];

 	if (!set_ttl) {
 		verbose(VERB_ALGO, "redis_store %s (%d bytes)", key, (int)data_len);
 		/* build command to set to a binary safe string */
 		n = snprintf(cmdbuf, sizeof(cmdbuf), "SET %s %%b", key);
-	} else if(ttl == 0) {
-		/* use the EXPIRE command, SET with EX 0 is an invalid time. */
-		/* Replies with REDIS_REPLY_INTEGER of 1. */
-		verbose(VERB_ALGO, "redis_store expire %s (%d bytes)",
-			key, (int)data_len);
-		n = snprintf(cmdbuf, sizeof(cmdbuf), "EXPIRE %s 0", key);
-		data = NULL;
-		data_len = 0;
 	} else {
 		/* add expired ttl time to redis ttl to avoid premature eviction of key */
 		ttl += env->cfg->serve_expired_ttl;
 		verbose(VERB_ALGO, "redis_store %s (%d bytes) with ttl %u",
-			key, (int)data_len, (unsigned)(uint32_t)ttl);
+			key, (int)data_len, (uint32_t)ttl);
 		/* build command to set to a binary safe string */
-		n = snprintf(cmdbuf, sizeof(cmdbuf), "SET %s %%b EX %u", key,
-			(unsigned)(uint32_t)ttl);
+		n = snprintf(cmdbuf, sizeof(cmdbuf), "SETEX %s %u %%b", key,
+			(uint32_t)ttl);
 	}


@@ -617,12 +357,11 @@ redis_store(struct module_env* env, struct cachedb_env* cachedb_env,
 		return;
 	}

-	rep = redis_command(env, cachedb_env, cmdbuf, data, data_len, 1);
+	rep = redis_command(env, cachedb_env, cmdbuf, data, data_len);
 	if(rep) {
 		verbose(VERB_ALGO, "redis_store set completed");
 		if(rep->type != REDIS_REPLY_STATUS &&
-			rep->type != REDIS_REPLY_ERROR &&
-			rep->type != REDIS_REPLY_INTEGER) {
+			rep->type != REDIS_REPLY_ERROR) {
 			log_err("redis_store: unexpected type of reply (%d)",
 				rep->type);
 		}
@@ -38,9 +38,6 @@
 #ifndef UB_ON_WINDOWS
 #include <sys/mman.h>
 #endif
-#ifdef __QNX__
-#include "util/log.h"
-#endif /* __QNX__ */

 #define KEYSTREAM_ONLY
 #include "chacha_private.h"
@@ -190,11 +187,7 @@ _rs_stir(void)
 		if(errno != ENOSYS ||
 			fallback_getentropy_urandom(rnd, sizeof rnd) == -1) {
 #ifdef SIGKILL
-#ifndef __QNX__
 			raise(SIGKILL);
-#else /* !__QNX__ */
-			fatal_exit("failed to getentropy");
-#endif /* __QNX__ */
 #else
 			exit(9); /* windows */
 #endif
@@ -48,8 +48,8 @@ typedef struct
  a = PLUS(a,b); d = ROTATE(XOR(d,a), 8); \
  c = PLUS(c,d); b = ROTATE(XOR(b,c), 7);

-static const char ATTR_NONSTRING(sigma[16]) = "expand 32-byte k";
-static const char ATTR_NONSTRING(tau[16]) = "expand 16-byte k";
+static const char sigma[16] = "expand 32-byte k";
+static const char tau[16] = "expand 16-byte k";

 static void
 chacha_keysetup(chacha_ctx *x,const u8 *k,u32 kbits,u32 ATTR_UNUSED(ivbits))
@@ -57,7 +57,7 @@ int getnameinfo(const struct sockaddr *sa, size_t ATTR_UNUSED(salen), char *host
 	}

 	if (host != NULL) {
-		if ((flags & NI_NUMERICHOST)) {
+		if (flags & NI_NUMERICHOST) {
 			if (strlcpy(host, inet_ntoa(sin->sin_addr),
 			    hostlen) >= hostlen)
 				return (EAI_MEMORY);
@@ -168,7 +168,7 @@ getaddrinfo(const char *hostname, const char *servname,
 			port = 0;
 	}

-	if (hints && (hints->ai_flags & AI_PASSIVE)) {
+	if (hints && hints->ai_flags & AI_PASSIVE) {
 		addr = htonl(0x00000000);
 		if (hostname && inet_aton(hostname, &in) != 0)
 			addr = in.s_addr;
@@ -193,7 +193,7 @@ getaddrinfo(const char *hostname, const char *servname,
 	}
 	
 	/* Don't try DNS if AI_NUMERICHOST is set */
-	if (hints && (hints->ai_flags & AI_NUMERICHOST))
+	if (hints && hints->ai_flags & AI_NUMERICHOST)
 		return (EAI_NONAME);
 	
 	hp = gethostbyname(hostname);
@@ -29,9 +29,7 @@
 #include <sys/param.h>
 #include <sys/ioctl.h>
 #include <sys/resource.h>
-#ifndef __QNX__
 #include <sys/syscall.h>
-#endif /* !__QNX__ */
 #ifdef SYS__sysctl
 #include <linux/sysctl.h>
 #endif
@@ -44,9 +42,7 @@
 #include <stdlib.h>
 #include <stdint.h>
 #include <stdio.h>
-#ifndef __QNX__
 #include <link.h>
-#endif /* __QNX__ */
 #include <termios.h>
 #include <fcntl.h>
 #include <signal.h>
@@ -64,14 +60,12 @@
 #define SHA512_Final(r, c)	sha512_digest(c, SHA512_DIGEST_SIZE, r)
 #endif

-#ifndef __QNX__
 #include <linux/types.h>
 #include <linux/random.h>
 #ifdef HAVE_GETAUXVAL
 #include <sys/auxv.h>
 #endif
 #include <sys/vfs.h>
-#endif /* !__QNX__ */
 #ifndef MAP_ANON
 #define MAP_ANON MAP_ANONYMOUS
 #endif
@@ -100,10 +94,8 @@ static int getentropy_urandom(void *buf, size_t len);
 #ifdef SYS__sysctl
 static int getentropy_sysctl(void *buf, size_t len);
 #endif
-#ifndef __QNX__
 static int getentropy_fallback(void *buf, size_t len);
 static int getentropy_phdr(struct dl_phdr_info *info, size_t size, void *data);
-#endif /* !__QNX__ */

 int
 getentropy(void *buf, size_t len)
@@ -186,7 +178,6 @@ getentropy(void *buf, size_t len)
 	 * sysctl ABI, or consider providing a new failsafe API which
 	 * works in a chroot or when file descriptors are exhausted.
 	 */
-#ifndef __QNX__
 #undef FAIL_INSTEAD_OF_TRYING_FALLBACK
 #ifdef FAIL_INSTEAD_OF_TRYING_FALLBACK
 	raise(SIGKILL);
@@ -194,9 +185,6 @@ getentropy(void *buf, size_t len)
 	ret = getentropy_fallback(buf, len);
 	if (ret != -1)
 		return (ret);
-#else /* !__QNX__ */
-	fatal_exit("failed to read from /dev/urandom");
-#endif /* __QNX__ */

 	errno = EIO;
 	return (ret);
@@ -226,11 +214,7 @@ getentropy_urandom(void *buf, size_t len)
 {
 	struct stat st;
 	size_t i;
-#ifndef __QNX__
 	int fd, cnt, flags;
-#else /* !__QNX__ */
-	int fd, flags;
-#endif /* __QNX__ */
 	int save_errno = errno;

 start:
@@ -257,12 +241,10 @@ start:
 		close(fd);
 		goto nodevrandom;
 	}
-#ifndef __QNX__
 	if (ioctl(fd, RNDGETENTCNT, &cnt) == -1) {
 		close(fd);
 		goto nodevrandom;
 	}
-#endif /* !__QNX__ */
 	for (i = 0; i < len; ) {
 		size_t wanted = len - i;
 		ssize_t ret = read(fd, (char *)buf + i, wanted);
@@ -283,7 +265,6 @@ nodevrandom:
 	return (-1);
 }

-#ifndef __QNX__
 #ifdef SYS__sysctl
 static int
 getentropy_sysctl(void *buf, size_t len)
@@ -556,4 +537,3 @@ getentropy_fallback(void *buf, size_t len)
 	errno = save_errno;
 	return (0);		/* satisfied */
 }
-#endif /* !__QNX__ */
@@ -20,25 +20,398 @@
 * http://man.openbsd.org/getentropy.2
 */

-/* Modified to use SecRandomCopyBytes. It is from macOS 10.7 (2011) and
- * iOS 2.0 (2008), and is the primary API for cryptographic random numbers. */
+#include <TargetConditionals.h>
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/ioctl.h>
+#include <sys/resource.h>
+#include <sys/syscall.h>
+#include <sys/sysctl.h>
+#include <sys/statvfs.h>
+#include <sys/socket.h>
+#include <sys/mount.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <termios.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <string.h>
 #include <errno.h>
-#include <Security/SecRandom.h>
+#include <unistd.h>
+#include <time.h>
+#include <mach/mach_time.h>
+#include <mach/mach_host.h>
+#include <mach/host_info.h>
+#if TARGET_OS_OSX
+#include <sys/socketvar.h>
+#include <sys/vmmeter.h>
+#endif
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#if TARGET_OS_OSX
+#include <netinet/udp.h>
+#include <netinet/ip_var.h>
+#include <netinet/tcp_var.h>
+#include <netinet/udp_var.h>
+#endif
+#include <CommonCrypto/CommonDigest.h>
+#define SHA512_Update(a, b, c)	(CC_SHA512_Update((a), (b), (c)))
+#define SHA512_Init(xxx) (CC_SHA512_Init((xxx)))
+#define SHA512_Final(xxx, yyy) (CC_SHA512_Final((xxx), (yyy)))
+#define SHA512_CTX CC_SHA512_CTX
+#define SHA512_DIGEST_LENGTH CC_SHA512_DIGEST_LENGTH
+
+#define REPEAT 5
+#define min(a, b) (((a) < (b)) ? (a) : (b))
+
+#define HX(a, b) \
+	do { \
+		if ((a)) \
+			HD(errno); \
+		else \
+			HD(b); \
+	} while (0)
+
+#define HR(x, l) (SHA512_Update(&ctx, (char *)(x), (l)))
+#define HD(x)	 (SHA512_Update(&ctx, (char *)&(x), sizeof (x)))
+#define HF(x)    (SHA512_Update(&ctx, (char *)&(x), sizeof (void*)))

 int	getentropy(void *buf, size_t len);

+static int getentropy_urandom(void *buf, size_t len);
+static int getentropy_fallback(void *buf, size_t len);
+
 int
 getentropy(void *buf, size_t len)
 {
+	int ret = -1;
+
 	if (len > 256) {
-		goto error;
+		errno = EIO;
+		return (-1);
 	}

-	if (SecRandomCopyBytes(kSecRandomDefault, len, buf) == errSecSuccess) {
-		return 0;
-	}
+	/*
+	 * Try to get entropy with /dev/urandom
+	 *
+	 * This can fail if the process is inside a chroot or if file
+	 * descriptors are exhausted.
+	 */
+	ret = getentropy_urandom(buf, len);
+	if (ret != -1)
+		return (ret);
+
+	/*
+	 * Entropy collection via /dev/urandom and sysctl have failed.
+	 *
+	 * No other API exists for collecting entropy, and we have
+	 * no failsafe way to get it on OSX that is not sensitive
+	 * to resource exhaustion.
+	 *
+	 * We have very few options:
+	 *     - Even syslog_r is unsafe to call at this low level, so
+	 *	 there is no way to alert the user or program.
+	 *     - Cannot call abort() because some systems have unsafe
+	 *	 corefiles.
+	 *     - Could raise(SIGKILL) resulting in silent program termination.
+	 *     - Return EIO, to hint that arc4random's stir function
+	 *       should raise(SIGKILL)
+	 *     - Do the best under the circumstances....
+	 *
+	 * This code path exists to bring light to the issue that OSX
+	 * does not provide a failsafe API for entropy collection.
+	 *
+	 * We hope this demonstrates that OSX should consider
+	 * providing a new failsafe API which works in a chroot or
+	 * when file descriptors are exhausted.
+	 */
+#undef FAIL_INSTEAD_OF_TRYING_FALLBACK
+#ifdef FAIL_INSTEAD_OF_TRYING_FALLBACK
+	raise(SIGKILL);
+#endif
+	ret = getentropy_fallback(buf, len);
+	if (ret != -1)
+		return (ret);

-error:
 	errno = EIO;
-	return -1;
+	return (ret);
+}
+
+static int
+getentropy_urandom(void *buf, size_t len)
+{
+	struct stat st;
+	size_t i;
+	int fd, flags;
+	int save_errno = errno;
+
+start:
+
+	flags = O_RDONLY;
+#ifdef O_NOFOLLOW
+	flags |= O_NOFOLLOW;
+#endif
+#ifdef O_CLOEXEC
+	flags |= O_CLOEXEC;
+#endif
+	fd = open("/dev/urandom", flags, 0);
+	if (fd == -1) {
+		if (errno == EINTR)
+			goto start;
+		goto nodevrandom;
+	}
+#ifndef O_CLOEXEC
+	fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
+#endif
+
+	/* Lightly verify that the device node looks sane */
+	if (fstat(fd, &st) == -1 || !S_ISCHR(st.st_mode)) {
+		close(fd);
+		goto nodevrandom;
+	}
+	for (i = 0; i < len; ) {
+		size_t wanted = len - i;
+		ssize_t ret = read(fd, (char *)buf + i, wanted);
+
+		if (ret == -1) {
+			if (errno == EAGAIN || errno == EINTR)
+				continue;
+			close(fd);
+			goto nodevrandom;
+		}
+		i += ret;
+	}
+	close(fd);
+	errno = save_errno;
+	return (0);		/* satisfied */
+nodevrandom:
+	errno = EIO;
+	return (-1);
+}
+
+#if TARGET_OS_OSX
+static int tcpmib[] = { CTL_NET, AF_INET, IPPROTO_TCP, TCPCTL_STATS };
+static int udpmib[] = { CTL_NET, AF_INET, IPPROTO_UDP, UDPCTL_STATS };
+static int ipmib[] = { CTL_NET, AF_INET, IPPROTO_IP, IPCTL_STATS };
+#endif
+static int kmib[] = { CTL_KERN, KERN_USRSTACK };
+static int hwmib[] = { CTL_HW, HW_USERMEM };
+
+static int
+getentropy_fallback(void *buf, size_t len)
+{
+	uint8_t results[SHA512_DIGEST_LENGTH];
+	int save_errno = errno, e, pgs = getpagesize(), faster = 0, repeat;
+	static int cnt;
+	struct timespec ts;
+	struct timeval tv;
+	struct rusage ru;
+	sigset_t sigset;
+	struct stat st;
+	SHA512_CTX ctx;
+	static pid_t lastpid;
+	pid_t pid;
+	size_t i, ii, m;
+	char *p;
+#if TARGET_OS_OSX
+	struct tcpstat tcpstat;
+	struct udpstat udpstat;
+	struct ipstat ipstat;
+#endif
+	u_int64_t mach_time;
+	unsigned int idata;
+	void *addr;
+
+	pid = getpid();
+	if (lastpid == pid) {
+		faster = 1;
+		repeat = 2;
+	} else {
+		faster = 0;
+		lastpid = pid;
+		repeat = REPEAT;
+	}
+	for (i = 0; i < len; ) {
+		int j;
+		SHA512_Init(&ctx);
+		for (j = 0; j < repeat; j++) {
+			HX((e = gettimeofday(&tv, NULL)) == -1, tv);
+			if (e != -1) {
+				cnt += (int)tv.tv_sec;
+				cnt += (int)tv.tv_usec;
+			}
+
+			mach_time = mach_absolute_time();
+			HD(mach_time);
+
+			ii = sizeof(addr);
+			HX(sysctl(kmib, sizeof(kmib) / sizeof(kmib[0]),
+			    &addr, &ii, NULL, 0) == -1, addr);
+
+			ii = sizeof(idata);
+			HX(sysctl(hwmib, sizeof(hwmib) / sizeof(hwmib[0]),
+			    &idata, &ii, NULL, 0) == -1, idata);
+
+#if TARGET_OS_OSX
+			ii = sizeof(tcpstat);
+			HX(sysctl(tcpmib, sizeof(tcpmib) / sizeof(tcpmib[0]),
+			    &tcpstat, &ii, NULL, 0) == -1, tcpstat);
+
+			ii = sizeof(udpstat);
+			HX(sysctl(udpmib, sizeof(udpmib) / sizeof(udpmib[0]),
+			    &udpstat, &ii, NULL, 0) == -1, udpstat);
+
+			ii = sizeof(ipstat);
+			HX(sysctl(ipmib, sizeof(ipmib) / sizeof(ipmib[0]),
+			    &ipstat, &ii, NULL, 0) == -1, ipstat);
+#endif
+
+			HX((pid = getpid()) == -1, pid);
+			HX((pid = getsid(pid)) == -1, pid);
+			HX((pid = getppid()) == -1, pid);
+			HX((pid = getpgid(0)) == -1, pid);
+			HX((e = getpriority(0, 0)) == -1, e);
+
+			if (!faster) {
+				ts.tv_sec = 0;
+				ts.tv_nsec = 1;
+				(void) nanosleep(&ts, NULL);
+			}
+
+			HX(sigpending(&sigset) == -1, sigset);
+			HX(sigprocmask(SIG_BLOCK, NULL, &sigset) == -1,
+			    sigset);
+
+			HF(getentropy);	/* an addr in this library */
+			HF(printf);		/* an addr in libc */
+			p = (char *)&p;
+			HD(p);		/* an addr on stack */
+			p = (char *)&errno;
+			HD(p);		/* the addr of errno */
+
+			if (i == 0) {
+				struct sockaddr_storage ss;
+				struct statvfs stvfs;
+				struct termios tios;
+				struct statfs stfs;
+				socklen_t ssl;
+				off_t off;
+
+				/*
+				 * Prime-sized mappings encourage fragmentation;
+				 * thus exposing some address entropy.
+				 */
+				struct mm {
+					size_t	npg;
+					void	*p;
+				} mm[] =	 {
+					{ 17, MAP_FAILED }, { 3, MAP_FAILED },
+					{ 11, MAP_FAILED }, { 2, MAP_FAILED },
+					{ 5, MAP_FAILED }, { 3, MAP_FAILED },
+					{ 7, MAP_FAILED }, { 1, MAP_FAILED },
+					{ 57, MAP_FAILED }, { 3, MAP_FAILED },
+					{ 131, MAP_FAILED }, { 1, MAP_FAILED },
+				};
+
+				for (m = 0; m < sizeof mm/sizeof(mm[0]); m++) {
+					HX(mm[m].p = mmap(NULL,
+					    mm[m].npg * pgs,
+					    PROT_READ|PROT_WRITE,
+					    MAP_PRIVATE|MAP_ANON, -1,
+					    (off_t)0), mm[m].p);
+					if (mm[m].p != MAP_FAILED) {
+						size_t mo;
+
+						/* Touch some memory... */
+						p = mm[m].p;
+						mo = cnt %
+						    (mm[m].npg * pgs - 1);
+						p[mo] = 1;
+						cnt += (int)((long)(mm[m].p)
+						    / pgs);
+					}
+
+					/* Check cnts and times... */
+					mach_time = mach_absolute_time();
+					HD(mach_time);
+					cnt += (int)mach_time;
+
+					HX((e = getrusage(RUSAGE_SELF,
+					    &ru)) == -1, ru);
+					if (e != -1) {
+						cnt += (int)ru.ru_utime.tv_sec;
+						cnt += (int)ru.ru_utime.tv_usec;
+					}
+				}
+
+				for (m = 0; m < sizeof mm/sizeof(mm[0]); m++) {
+					if (mm[m].p != MAP_FAILED)
+						munmap(mm[m].p, mm[m].npg * pgs);
+					mm[m].p = MAP_FAILED;
+				}
+
+				HX(stat(".", &st) == -1, st);
+				HX(statvfs(".", &stvfs) == -1, stvfs);
+				HX(statfs(".", &stfs) == -1, stfs);
+
+				HX(stat("/", &st) == -1, st);
+				HX(statvfs("/", &stvfs) == -1, stvfs);
+				HX(statfs("/", &stfs) == -1, stfs);
+
+				HX((e = fstat(0, &st)) == -1, st);
+				if (e == -1) {
+					if (S_ISREG(st.st_mode) ||
+					    S_ISFIFO(st.st_mode) ||
+					    S_ISSOCK(st.st_mode)) {
+						HX(fstatvfs(0, &stvfs) == -1,
+						    stvfs);
+						HX(fstatfs(0, &stfs) == -1,
+						    stfs);
+						HX((off = lseek(0, (off_t)0,
+						    SEEK_CUR)) < 0, off);
+					}
+					if (S_ISCHR(st.st_mode)) {
+						HX(tcgetattr(0, &tios) == -1,
+						    tios);
+					} else if (S_ISSOCK(st.st_mode)) {
+						memset(&ss, 0, sizeof ss);
+						ssl = sizeof(ss);
+						HX(getpeername(0,
+						    (void *)&ss, &ssl) == -1,
+						    ss);
+					}
+				}
+
+				HX((e = getrusage(RUSAGE_CHILDREN,
+				    &ru)) == -1, ru);
+				if (e != -1) {
+					cnt += (int)ru.ru_utime.tv_sec;
+					cnt += (int)ru.ru_utime.tv_usec;
+				}
+			} else {
+				/* Subsequent hashes absorb previous result */
+				HD(results);
+			}
+
+			HX((e = gettimeofday(&tv, NULL)) == -1, tv);
+			if (e != -1) {
+				cnt += (int)tv.tv_sec;
+				cnt += (int)tv.tv_usec;
+			}
+
+			HD(cnt);
+		}
+
+		SHA512_Final(results, &ctx);
+		memcpy((char *)buf + i, results, min(sizeof(results), len - i));
+		i += min(sizeof(results), len - i);
+	}
+	explicit_bzero(&ctx, sizeof ctx);
+	explicit_bzero(results, sizeof results);
+	errno = save_errno;
+	return (0);		/* satisfied */
 }
@@ -42,7 +42,10 @@ static const int	year_lengths[2] = {
 };

 static void
-timesub(const time_t * const timep, const long offset, struct tm * const tmp)
+timesub(timep, offset, tmp)
+const time_t * const			timep;
+const long				offset;
+struct tm * const		tmp;
 {
 	long			days;
 	long			rem;
@@ -59,7 +59,10 @@ static int	inet_pton6 (const char *src, uint8_t *dst);
 *	Paul Vixie, 1996.
 */
 int
-inet_pton(int af, const char *src, void *dst)
+inet_pton(af, src, dst)
+	int af;
+	const char *src;
+	void *dst;
 {
 	switch (af) {
 	case AF_INET:
@@ -88,7 +91,9 @@ inet_pton(int af, const char *src, void *dst)
 *	Paul Vixie, 1996.
 */
 static int
-inet_pton4(const char *src, uint8_t *dst)
+inet_pton4(src, dst)
+	const char *src;
+	uint8_t *dst;
 {
 	static const char digits[] = "0123456789";
 	int saw_digit, octets, ch;
@@ -140,7 +145,9 @@ inet_pton4(const char *src, uint8_t *dst)
 *	Paul Vixie, 1996.
 */
 static int
-inet_pton6(const char *src, uint8_t *dst)
+inet_pton6(src, dst)
+	const char *src;
+	uint8_t *dst;
 {
 	static const char xdigits_l[] = "0123456789abcdef",
 			  xdigits_u[] = "0123456789ABCDEF";
@@ -5,8 +5,12 @@
 #undef malloc
 #include <sys/types.h>

+#ifndef USE_WINSOCK
+void *malloc ();
+#else
 /* provide a prototype */
 void *malloc (size_t n);
+#endif

 /* Allocate an N-byte block of memory from the heap.
   If N is zero, allocate a 1-byte block.  */
@@ -1,8 +1,5 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */

-/* apply the fallthrough attribute. */
-#undef ATTR_FALLTHROUGH
-
 /* apply the noreturn attribute to a function that exits the program */
 #undef ATTR_NORETURN

@@ -31,9 +28,6 @@
 /* Whether daemon is deprecated */
 #undef DEPRECATED_DAEMON

-/* Whether X509_NAME_get_text_by_NID is deprecated */
-#undef DEPRECATED_X509_NAME_GET_TEXT_BY_NID
-
 /* Deprecate RSA 1024 bit length, makes that an unsupported key */
 #undef DEPRECATE_RSA_1024

@@ -63,18 +57,9 @@
 /* Define to 1 if you have the <arpa/inet.h> header file. */
 #undef HAVE_ARPA_INET_H

-/* Define to 1 if you have the `ASN1_STRING_get0_data' function. */
-#undef HAVE_ASN1_STRING_GET0_DATA
-
-/* Whether the C compiler accepts the "fallthrough" attribute */
-#undef HAVE_ATTR_FALLTHROUGH
-
 /* Whether the C compiler accepts the "format" attribute */
 #undef HAVE_ATTR_FORMAT

-/* Whether the C compiler accepts the "nonstring" attribute */
-#undef HAVE_ATTR_NONSTRING
-
 /* Whether the C compiler accepts the "noreturn" attribute */
 #undef HAVE_ATTR_NORETURN

@@ -138,18 +123,6 @@
   and to 0 if you don't. */
 #undef HAVE_DECL_NGHTTP2_SESSION_SERVER_NEW

-/* Define to 1 if you have the declaration of `ngtcp2_conn_server_new', and to
-   0 if you don't. */
-#undef HAVE_DECL_NGTCP2_CONN_SERVER_NEW
-
-/* Define to 1 if you have the declaration of `ngtcp2_crypto_encrypt_cb', and
-   to 0 if you don't. */
-#undef HAVE_DECL_NGTCP2_CRYPTO_ENCRYPT_CB
-
-/* Define to 1 if you have the declaration of `ngtcp2_crypto_ossl_ctx_new',
-   and to 0 if you don't. */
-#undef HAVE_DECL_NGTCP2_CRYPTO_OSSL_CTX_NEW
-
 /* Define to 1 if you have the declaration of `NID_ED25519', and to 0 if you
   don't. */
 #undef HAVE_DECL_NID_ED25519
@@ -186,10 +159,6 @@
   0 if you don't. */
 #undef HAVE_DECL_SSL_CTX_SET_ECDH_AUTO

-/* Define to 1 if you have the declaration of `SSL_CTX_set_tmp_ecdh', and to 0
-   if you don't. */
-#undef HAVE_DECL_SSL_CTX_SET_TMP_ECDH
-
 /* Define to 1 if you have the declaration of `strlcat', and to 0 if you
   don't. */
 #undef HAVE_DECL_STRLCAT
@@ -299,12 +268,6 @@
 /* Define to 1 if you have the `FIPS_mode' function. */
 #undef HAVE_FIPS_MODE

-/* Define to 1 if you have the `fnmatch' function. */
-#undef HAVE_FNMATCH
-
-/* Define to 1 if you have the <fnmatch.h> header file. */
-#undef HAVE_FNMATCH_H
-
 /* Define to 1 if you have the `fork' function. */
 #undef HAVE_FORK

@@ -401,9 +364,6 @@
 /* Define if we have LibreSSL */
 #undef HAVE_LIBRESSL

-/* If we have atomic_store */
-#undef HAVE_LINK_ATOMIC_STORE
-
 /* Define to 1 if you have the <linux/net_tstamp.h> header file. */
 #undef HAVE_LINUX_NET_TSTAMP_H

@@ -446,80 +406,12 @@
 /* Define to 1 if you have the <net/if.h> header file. */
 #undef HAVE_NET_IF_H

-/* Define to 1 if you have the <net/pfvar.h> header file. */
-#undef HAVE_NET_PFVAR_H
-
 /* Define this to use nghttp2 client. */
 #undef HAVE_NGHTTP2

 /* Define to 1 if you have the <nghttp2/nghttp2.h> header file. */
 #undef HAVE_NGHTTP2_NGHTTP2_H

-/* Define this to use ngtcp2. */
-#undef HAVE_NGTCP2
-
-/* Define to 1 if you have the `ngtcp2_ccerr_default' function. */
-#undef HAVE_NGTCP2_CCERR_DEFAULT
-
-/* Define to 1 if you have the `ngtcp2_conn_encode_0rtt_transport_params'
-   function. */
-#undef HAVE_NGTCP2_CONN_ENCODE_0RTT_TRANSPORT_PARAMS
-
-/* Define to 1 if you have the `ngtcp2_conn_get_max_local_streams_uni'
-   function. */
-#undef HAVE_NGTCP2_CONN_GET_MAX_LOCAL_STREAMS_UNI
-
-/* Define to 1 if you have the `ngtcp2_conn_get_num_scid' function. */
-#undef HAVE_NGTCP2_CONN_GET_NUM_SCID
-
-/* Define to 1 if you have the `ngtcp2_conn_in_closing_period' function. */
-#undef HAVE_NGTCP2_CONN_IN_CLOSING_PERIOD
-
-/* Define to 1 if you have the `ngtcp2_conn_in_draining_period' function. */
-#undef HAVE_NGTCP2_CONN_IN_DRAINING_PERIOD
-
-/* Define if ngtcp2_conn_shutdown_stream has 4 arguments. */
-#undef HAVE_NGTCP2_CONN_SHUTDOWN_STREAM4
-
-/* Define to 1 if you have the `ngtcp2_conn_tls_early_data_rejected' function.
-   */
-#undef HAVE_NGTCP2_CONN_TLS_EARLY_DATA_REJECTED
-
-/* Define to 1 if you have the `ngtcp2_crypto_encrypt_cb' function. */
-#undef HAVE_NGTCP2_CRYPTO_ENCRYPT_CB
-
-/* Define to 1 if you have the
-   `ngtcp2_crypto_quictls_configure_client_context' function. */
-#undef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_CLIENT_CONTEXT
-
-/* Define to 1 if you have the
-   `ngtcp2_crypto_quictls_configure_server_context' function. */
-#undef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_SERVER_CONTEXT
-
-/* Define to 1 if you have the
-   `ngtcp2_crypto_quictls_from_ossl_encryption_level' function. */
-#undef HAVE_NGTCP2_CRYPTO_QUICTLS_FROM_OSSL_ENCRYPTION_LEVEL
-
-/* Define to 1 if you have the `ngtcp2_crypto_quictls_init' function. */
-#undef HAVE_NGTCP2_CRYPTO_QUICTLS_INIT
-
-/* Define to 1 if the system has the type `ngtcp2_encryption_level'. */
-#undef HAVE_NGTCP2_ENCRYPTION_LEVEL
-
-/* Define to 1 if you have the <ngtcp2/ngtcp2_crypto_openssl.h> header file.
-   */
-#undef HAVE_NGTCP2_NGTCP2_CRYPTO_OPENSSL_H
-
-/* Define to 1 if you have the <ngtcp2/ngtcp2_crypto_ossl.h> header file. */
-#undef HAVE_NGTCP2_NGTCP2_CRYPTO_OSSL_H
-
-/* Define to 1 if you have the <ngtcp2/ngtcp2_crypto_quictls.h> header file.
-   */
-#undef HAVE_NGTCP2_NGTCP2_CRYPTO_QUICTLS_H
-
-/* Define to 1 if you have the <ngtcp2/ngtcp2.h> header file. */
-#undef HAVE_NGTCP2_NGTCP2_H
-
 /* Use libnss for crypto */
 #undef HAVE_NSS

@@ -529,9 +421,6 @@
 /* Define to 1 if you have the <openssl/bn.h> header file. */
 #undef HAVE_OPENSSL_BN_H

-/* Define to 1 if you have the `OPENSSL_cleanup' function. */
-#undef HAVE_OPENSSL_CLEANUP
-
 /* Define to 1 if you have the `OPENSSL_config' function. */
 #undef HAVE_OPENSSL_CONFIG

@@ -583,27 +472,12 @@
 /* Define if you have POSIX threads libraries and header files. */
 #undef HAVE_PTHREAD

-/* Define to 1 if you have the <pthread_np.h> header file. */
-#undef HAVE_PTHREAD_NP_H
-
 /* Have PTHREAD_PRIO_INHERIT. */
 #undef HAVE_PTHREAD_PRIO_INHERIT

 /* Define to 1 if the system has the type `pthread_rwlock_t'. */
 #undef HAVE_PTHREAD_RWLOCK_T

-/* Define if pthread_setname_np has the common 2 arguments. */
-#undef HAVE_PTHREAD_SETNAME_NP
-
-/* Define if pthread_setname_np has only 1 argument. */
-#undef HAVE_PTHREAD_SETNAME_NP1
-
-/* Define if pthread_setname_np has 3 arguments. */
-#undef HAVE_PTHREAD_SETNAME_NP3
-
-/* Define if pthread_setname_np exists as pthread_set_name_np instead. */
-#undef HAVE_PTHREAD_SET_NAME_NP
-
 /* Define to 1 if the system has the type `pthread_spinlock_t'. */
 #undef HAVE_PTHREAD_SPINLOCK_T

@@ -701,25 +575,12 @@
 /* Define to 1 if you have the `SSL_get1_peer_certificate' function. */
 #undef HAVE_SSL_GET1_PEER_CERTIFICATE

-/* Define to 1 if you have the `SSL_is_quic' function. */
-#undef HAVE_SSL_IS_QUIC
-
-/* Define to 1 if you have the `SSL_set1_dnsname' function. */
-#undef HAVE_SSL_SET1_DNSNAME
-
 /* Define to 1 if you have the `SSL_set1_host' function. */
 #undef HAVE_SSL_SET1_HOST

-/* Define to 1 if you have the `SSL_set_quic_tls_early_data_enabled' function.
-   */
-#undef HAVE_SSL_SET_QUIC_TLS_EARLY_DATA_ENABLED
-
 /* Define to 1 if you have the <stdarg.h> header file. */
 #undef HAVE_STDARG_H

-/* Define to 1 if you have the <stdatomic.h> header file. */
-#undef HAVE_STDATOMIC_H
-
 /* Define to 1 if you have the <stdbool.h> header file. */
 #undef HAVE_STDBOOL_H

@@ -756,32 +617,9 @@
 /* Define to 1 if `ipi_spec_dst' is a member of `struct in_pktinfo'. */
 #undef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST

-/* Define to 1 if `tokenlen' is a member of `struct ngtcp2_pkt_hd'. */
-#undef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN
-
-/* Define to 1 if `max_tx_udp_payload_size' is a member of `struct
-   ngtcp2_settings'. */
-#undef HAVE_STRUCT_NGTCP2_SETTINGS_MAX_TX_UDP_PAYLOAD_SIZE
-
-/* Define to 1 if `tokenlen' is a member of `struct ngtcp2_settings'. */
-#undef HAVE_STRUCT_NGTCP2_SETTINGS_TOKENLEN
-
-/* Define to 1 if `original_dcid_present' is a member of `struct
-   ngtcp2_transport_params'. */
-#undef HAVE_STRUCT_NGTCP2_TRANSPORT_PARAMS_ORIGINAL_DCID_PRESENT
-
-/* Define to 1 if the system has the type `struct ngtcp2_version_cid'. */
-#undef HAVE_STRUCT_NGTCP2_VERSION_CID
-
 /* Define to 1 if `sun_len' is a member of `struct sockaddr_un'. */
 #undef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN

-/* Define to 1 if `st_mtimensec' is a member of `struct stat'. */
-#undef HAVE_STRUCT_STAT_ST_MTIMENSEC
-
-/* Define to 1 if `st_mtim.tv_nsec' is a member of `struct stat'. */
-#undef HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC
-
 /* Define if you have Swig libraries and header files. */
 #undef HAVE_SWIG

@@ -878,12 +716,6 @@
 /* Define to 1 if you have the <ws2tcpip.h> header file. */
 #undef HAVE_WS2TCPIP_H

-/* Define to 1 if you have the `X509_get_key_usage' function. */
-#undef HAVE_X509_GET_KEY_USAGE
-
-/* Define to 1 if you have the `X509_NAME_get_text_by_NID' function. */
-#undef HAVE_X509_NAME_GET_TEXT_BY_NID
-
 /* Define to 1 if you have the `X509_VERIFY_PARAM_set1_host' function. */
 #undef HAVE_X509_VERIFY_PARAM_SET1_HOST

@@ -1086,9 +918,6 @@
 /* Define this to enable client TCP Fast Open. */
 #undef USE_MSG_FASTOPEN

-/* Define this to use ngtcp2_crypto_ossl. */
-#undef USE_NGTCP2_CRYPTO_OSSL
-
 /* Define this to enable client TCP Fast Open. */
 #undef USE_OSX_MSG_FASTOPEN

@@ -1437,17 +1266,6 @@
 #endif /* !HAVE_ATTR_UNUSED */


-#if defined(DOXYGEN)
-#  define ATTR_NONSTRING(x)  x
-#elif defined(__cplusplus)
-#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
-#elif defined(HAVE_ATTR_NONSTRING)
-#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
-#else /* !HAVE_ATTR_NONSTRING */
-#  define ATTR_NONSTRING(x)  x
-#endif /* !HAVE_ATTR_NONSTRING */
-
-
 #ifndef HAVE_FSEEKO
 #define fseeko fseek
 #define ftello ftell
@@ -1666,10 +1484,6 @@ struct sockaddr_storage;
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
 #  define free(p) unbound_stat_free_log(p, __FILE__, __LINE__, __func__)
 #  define realloc(p,s) unbound_stat_realloc_log(p, s, __FILE__, __LINE__, __func__)
-#  define strdup(s) unbound_stat_strdup_log(s, __FILE__, __LINE__, __func__)
-#ifdef HAVE_REALLOCARRAY
-#  define reallocarray(p,n,s) unbound_stat_reallocarray_log(p, n, s, __FILE__, __LINE__, __func__)
-#endif
 void *unbound_stat_malloc(size_t size);
 void *unbound_stat_calloc(size_t nmemb, size_t size);
 void unbound_stat_free(void *ptr);
@@ -1682,10 +1496,6 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-void *unbound_stat_reallocarray_log(void *ptr, size_t nmemb, size_t size,
-	const char* file, int line, const char* func);
-char *unbound_stat_strdup_log(const char *s, const char* file, int line,
-	const char* func);
 #elif defined(UNBOUND_ALLOC_LITE)
 #  include "util/alloc.h"
 #endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */
@@ -1696,8 +1506,6 @@ char *unbound_stat_strdup_log(const char *s, const char* file, int line,
 #define UNBOUND_DNS_OVER_TLS_PORT 853
 /** default port for DNS over HTTPS traffic. */
 #define UNBOUND_DNS_OVER_HTTPS_PORT 443
-/** default port for DNS over QUIC traffic. */
-#define UNBOUND_DNS_OVER_QUIC_PORT 853
 /** default port for unbound control traffic, registered port with IANA,
    ub-dns-control  8953/tcp    unbound dns nameserver control */
 #define UNBOUND_CONTROL_PORT 8953
@@ -2,7 +2,6 @@
 # Process this file with autoconf to produce a configure script.
 AC_PREREQ([2.56])
 sinclude(acx_nlnetlabs.m4)
-sinclude(ax_build_date_epoch.m4)
 sinclude(ax_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ax_pkg_swig.m4)
@@ -11,7 +10,7 @@ sinclude(dnscrypt/dnscrypt.m4)

 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[26])
+m4_define([VERSION_MINOR],[20])
 m4_define([VERSION_MICRO],[1])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
@@ -19,7 +18,7 @@ AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])

 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=40
+LIBUNBOUND_REVISION=28
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -114,19 +113,7 @@ LIBUNBOUND_AGE=1
 # 1.19.2 had 9:25:1
 # 1.19.3 had 9:26:1
 # 1.20.0 had 9:27:1
-# 1.21.0 had 9:28:1
-# 1.21.1 had 9:29:1
-# 1.22.0 had 9:30:1
-# 1.23.0 had 9:31:1
-# 1.23.1 had 9:32:1
-# 1.24.0 had 9:33:1
-# 1.24.1 had 9:34:1
-# 1.24.2 had 9:35:1
-# 1.25.0 had 9:36:1
-# 1.25.1 had 9:37:1
-# 1.25.2 had 9:38:1
-# 1.26.0 had 9:39:1
-# 1.26.1 had 9:40:1
+# 1.20.1 had 9:28:1

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -335,7 +322,6 @@ fi
 AC_C_INLINE
 ACX_CHECK_FORMAT_ATTRIBUTE
 ACX_CHECK_UNUSED_ATTRIBUTE
-ACX_CHECK_NONSTRING_ATTRIBUTE

 AC_DEFUN([CHECK_WEAK_ATTRIBUTE],
 [AC_REQUIRE([AC_PROG_CC])
@@ -353,8 +339,6 @@ AC_MSG_RESULT($ac_cv_c_weak_attribute)
 if test $ac_cv_c_weak_attribute = yes; then
  AC_DEFINE(HAVE_ATTR_WEAK, 1, [Whether the C compiler accepts the "weak" attribute])
  AC_DEFINE(ATTR_WEAK, [__attribute__((weak))], [apply the weak attribute to a symbol])
-else
-  AC_DEFINE(ATTR_WEAK,[], [apply the weak attribute to a symbol])
 fi
 ])dnl End of CHECK_WEAK_ATTRIBUTE

@@ -366,14 +350,7 @@ AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "noreturn" attribu
 AC_CACHE_VAL(ac_cv_c_noreturn_attribute,
 [ac_cv_c_noreturn_attribute=no
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h>
-#ifdef STDC_HEADERS
-# include <stdlib.h>
-#else
-# ifdef HAVE_STDLIB_H
-#  include <stdlib.h>
-# endif
-#endif
-__attribute__((noreturn)) void f(int x) { printf("%d", x); exit(1); }
+__attribute__((noreturn)) void f(int x) { printf("%d", x); }
 ]], [[
   f(1);
 ]])],[ac_cv_c_noreturn_attribute="yes"],[ac_cv_c_noreturn_attribute="no"])
@@ -383,54 +360,11 @@ AC_MSG_RESULT($ac_cv_c_noreturn_attribute)
 if test $ac_cv_c_noreturn_attribute = yes; then
  AC_DEFINE(HAVE_ATTR_NORETURN, 1, [Whether the C compiler accepts the "noreturn" attribute])
  AC_DEFINE(ATTR_NORETURN, [__attribute__((__noreturn__))], [apply the noreturn attribute to a function that exits the program])
-else
-  AC_DEFINE(ATTR_NORETURN,[], [apply the noreturn attribute to a function that exits the program])
 fi
 ])dnl End of CHECK_NORETURN_ATTRIBUTE

 CHECK_NORETURN_ATTRIBUTE

-AC_DEFUN([CHECK_FALLTHROUGH_ATTRIBUTE],
-[AC_REQUIRE([AC_PROG_CC])
-AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "fallthrough" attribute)
-BAKCFLAGS="$CFLAGS"
-CFLAGS="$CFLAGS -Werror"
-AC_CACHE_VAL(ac_cv_c_fallthrough_attribute,
-[ac_cv_c_fallthrough_attribute=no
-AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h>
-void f(int x) {
-	int y = 0;
-	switch(x) {
-	case 1:
-		y = 1;
-		__attribute__((fallthrough));
-		/* fallthrough */
-	case 2:
-		y++;
-		break;
-	case 3:
-		y = 3;
-		break;
-	}
-	printf("%d", y);
-}
-]], [[
-   f(1);
-]])],[ac_cv_c_fallthrough_attribute="yes"],[ac_cv_c_fallthrough_attribute="no"])
-])
-CFLAGS="$BAKCFLAGS"
-
-AC_MSG_RESULT($ac_cv_c_fallthrough_attribute)
-if test $ac_cv_c_fallthrough_attribute = yes; then
-  AC_DEFINE(HAVE_ATTR_FALLTHROUGH, 1, [Whether the C compiler accepts the "fallthrough" attribute])
-  AC_DEFINE(ATTR_FALLTHROUGH, [__attribute__((fallthrough));], [apply the fallthrough attribute.])
-else
-  AC_DEFINE(ATTR_FALLTHROUGH,[], [apply the fallthrough attribute.])
-fi
-])dnl End of CHECK_FALLTHROUGH_ATTRIBUTE
-
-CHECK_FALLTHROUGH_ATTRIBUTE
-
 if test "$srcdir" != "."; then
 	CPPFLAGS="$CPPFLAGS -I$srcdir"
 fi
@@ -485,7 +419,7 @@ PKG_PROG_PKG_CONFIG
 fi

 # Checks for header files.
-AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h netinet/tcp.h sys/param.h sys/select.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h fnmatch.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h sys/endian.h libkern/OSByteOrder.h sys/ipc.h sys/shm.h ifaddrs.h poll.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h netinet/tcp.h sys/param.h sys/select.h sys/socket.h sys/un.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h glob.h grp.h login_cap.h winsock2.h ws2tcpip.h endian.h sys/endian.h libkern/OSByteOrder.h sys/ipc.h sys/shm.h ifaddrs.h poll.h],,, [AC_INCLUDES_DEFAULT])
 # net/if.h portability for Darwin see:
 # https://www.gnu.org/software/autoconf/manual/autoconf-2.69/html_node/Header-Portability.html
 AC_CHECK_HEADERS([net/if.h],,, [
@@ -541,7 +475,6 @@ AC_CHECK_HEADERS([netioapi.h],,, [AC_INCLUDES_DEFAULT

 # Check for Linux timestamping headers
 AC_CHECK_HEADERS([linux/net_tstamp.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_HEADERS([stdatomic.h],,, [AC_INCLUDES_DEFAULT])

 # check for types.  
 # Using own tests for int64* because autoconf builtin only give 32bit.
@@ -648,19 +581,19 @@ AC_ARG_ENABLE(alloc-nonregional, AS_HELP_STRING([--enable-alloc-nonregional],[ e
 if test x_$enable_alloc_nonregional = x_yes; then
 	AC_DEFINE(UNBOUND_ALLOC_NONREGIONAL, 1, [use malloc not regions, for debug use])
 fi
-AS_IF([test x_$enable_alloc_checks = x_yes],[
+if test x_$enable_alloc_checks = x_yes; then
 	AC_DEFINE(UNBOUND_ALLOC_STATS, 1, [use statistics for allocs and frees, for debug use])
 	SLDNS_ALLOCCHECK_EXTRA_OBJ="alloc.lo log.lo"
 	AC_SUBST(SLDNS_ALLOCCHECK_EXTRA_OBJ)
 	ASYNCLOOK_ALLOCCHECK_EXTRA_OBJ="alloc.lo"
 	AC_SUBST(ASYNCLOOK_ALLOCCHECK_EXTRA_OBJ)
-],[
-	AS_IF([test x_$enable_alloc_lite = x_yes],[
+else
+	if test x_$enable_alloc_lite = x_yes; then
 		AC_DEFINE(UNBOUND_ALLOC_LITE, 1, [use to enable lightweight alloc assertions, for debug use])
-	],[
+	else
 		ACX_FUNC_MALLOC([unbound])
-	])
-])
+	fi
+fi

 # check windows threads (we use them, not pthreads, on windows).
 if test "$on_mingw" = "yes"; then
@@ -735,76 +668,6 @@ int main(void) {return 0;}
 		])
 fi

-if test x_$ub_have_pthreads != x_no; then
-	# Long checks to support pthread_setname_np().
-	# Some OSes have the extra non-portable functions in a specific
-	# header file.
-	AC_CHECK_HEADERS([pthread_np.h],,, [AC_INCLUDES_DEFAULT])
-	BAKCFLAGS="$CFLAGS"
-	CFLAGS="$CFLAGS -Werror"
-	# MacOS only has 1 argument, the name.
-	AC_MSG_CHECKING([whether pthread_setname_np has only 1 argument])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <pthread.h>
-#ifdef HAVE_PTHREAD_NP_H
-#include <pthread_np.h>
-#endif
-	],[
-	    (void)pthread_setname_np("");
-	])],[
-	    AC_MSG_RESULT(yes)
-	    AC_DEFINE(HAVE_PTHREAD_SETNAME_NP1, 1, [Define if pthread_setname_np has only 1 argument.])
-	],[
-	    AC_MSG_RESULT(no)
-	])
-	# NetBSD has 3 arguments to allow for formatting of the name.
-	AC_MSG_CHECKING([whether pthread_setname_np has 3 arguments])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <pthread.h>
-#ifdef HAVE_PTHREAD_NP_H
-#include <pthread_np.h>
-#endif
-	],[
-	    (void)pthread_setname_np(0, "", NULL);
-	])],[
-	    AC_MSG_RESULT(yes)
-	    AC_DEFINE(HAVE_PTHREAD_SETNAME_NP3, 1, [Define if pthread_setname_np has 3 arguments.])
-	],[
-	    AC_MSG_RESULT(no)
-	])
-	# Most OSes have the common 2 arguments, thread and name.
-	AC_MSG_CHECKING([whether pthread_setname_np has the common 2 arguments])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <pthread.h>
-#ifdef HAVE_PTHREAD_NP_H
-#include <pthread_np.h>
-#endif
-	],[
-	    (void)pthread_setname_np(0, "");
-	])],[
-	    AC_MSG_RESULT(yes)
-	    AC_DEFINE(HAVE_PTHREAD_SETNAME_NP, 1, [Define if pthread_setname_np has the common 2 arguments.])
-	],[
-	    AC_MSG_RESULT(no)
-	])
-	# FreeBSD/OpenBSD use a slightly different function name.
-	AC_MSG_CHECKING([whether pthread_setname_np exists as pthread_set_name_np instead])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <pthread.h>
-#ifdef HAVE_PTHREAD_NP_H
-#include <pthread_np.h>
-#endif
-	],[
-	    (void)pthread_set_name_np(0, "");
-	])],[
-	    AC_MSG_RESULT(yes)
-	    AC_DEFINE(HAVE_PTHREAD_SET_NAME_NP, 1, [Define if pthread_setname_np exists as pthread_set_name_np instead.])
-	],[
-	    AC_MSG_RESULT(no)
-	])
-	CFLAGS="$BAKCFLAGS"
-fi
-
 # check solaris thread library
 AC_ARG_WITH(solaris-threads, AS_HELP_STRING([--with-solaris-threads],[use solaris native thread library.]), [ ],[ withval="no" ])
 ub_have_sol_threads=no
@@ -997,8 +860,7 @@ if test "`uname`" = "Linux"; then
 	GCC_DOCKER_LINTFLAGS='-syntax'
 	AC_SUBST(GCC_DOCKER_LINTFLAGS)
 fi
-AX_BUILD_DATE_EPOCH(CONFIG_DATE, [%Y%m%d])
-AC_ARG_VAR(SOURCE_DATE_EPOCH, [If it is set, it uses the value of that variable instead of the current time as the build timestamp. The format is a unix timestamp. This enables reproducible build output.])
+CONFIG_DATE=`date +%Y%m%d`
 AC_SUBST(CONFIG_DATE)

 # Checks for libraries.
@@ -1082,22 +944,15 @@ else
 	AC_MSG_RESULT([no])
 fi
 AC_CHECK_HEADERS([openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h openssl/core_names.h openssl/param_build.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_default_properties_is_fips_enabled EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params OSSL_PARAM_BLD_new BIO_set_callback_ex OPENSSL_cleanup])
+AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_default_properties_is_fips_enabled EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params OSSL_PARAM_BLD_new BIO_set_callback_ex])

 # these check_funcs need -lssl
 BAKLIBS="$LIBS"
 LIBS="-lssl $LIBS"
-AC_CHECK_FUNCS([OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername SSL_set1_dnsname X509_get_key_usage ASN1_STRING_get0_data X509_VERIFY_PARAM_set1_host SSL_CTX_set_ciphersuites SSL_CTX_set_tlsext_ticket_key_evp_cb SSL_CTX_set_alpn_select_cb SSL_get0_alpn_selected SSL_CTX_set_alpn_protos SSL_get1_peer_certificate])
-AC_CHECK_FUNCS([X509_NAME_get_text_by_NID])
-if test $ac_cv_func_X509_NAME_get_text_by_NID = yes; then
-	ACX_FUNC_DEPRECATED([X509_NAME_get_text_by_NID], [
-		(void)X509_NAME_get_text_by_NID(NULL, 0, NULL, 0);], [
-#include "openssl/x509.h"
-])
-fi
+AC_CHECK_FUNCS([OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername X509_VERIFY_PARAM_set1_host SSL_CTX_set_ciphersuites SSL_CTX_set_tlsext_ticket_key_evp_cb SSL_CTX_set_alpn_select_cb SSL_get0_alpn_selected SSL_CTX_set_alpn_protos SSL_get1_peer_certificate])
 LIBS="$BAKLIBS"

-AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free,SSL_CTX_set_ecdh_auto,SSL_CTX_set_tmp_ecdh], [], [], [
+AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free,SSL_CTX_set_ecdh_auto], [], [], [
 AC_INCLUDES_DEFAULT
 #ifdef HAVE_OPENSSL_ERR_H
 #include <openssl/err.h>
@@ -1326,24 +1181,15 @@ case "$enable_ecdsa" in
      ;;
    *)
      if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
-	      AC_CHECK_FUNC(EVP_PKEY_fromdata, [
-	          # with EVP_PKEY_fromdata, check if EC is not disabled
-	          AC_CHECK_DECL([OPENSSL_NO_EC], [AC_MSG_ERROR([OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa])
-		  ], [], [AC_INCLUDES_DEFAULT
-#include <openssl/evp.h>
-		  ])
-		], [
-		  # without EVP_PKEY_fromdata, older openssl, check for support
-		  AC_CHECK_FUNC(ECDSA_sign, [], [AC_MSG_ERROR([OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa])])
-		  AC_CHECK_FUNC(SHA384_Init, [], [AC_MSG_ERROR([OpenSSL does not support SHA384: please upgrade or rerun with --disable-ecdsa])])
-		])
+	      AC_CHECK_FUNC(ECDSA_sign, [], [AC_MSG_ERROR([OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa])])
+	      AC_CHECK_FUNC(SHA384_Init, [], [AC_MSG_ERROR([OpenSSL does not support SHA384: please upgrade or rerun with --disable-ecdsa])])
 	      AC_CHECK_DECLS([NID_X9_62_prime256v1, NID_secp384r1], [], [AC_MSG_ERROR([OpenSSL does not support the ECDSA curves: please upgrade or rerun with --disable-ecdsa])], [AC_INCLUDES_DEFAULT
 #include <openssl/evp.h>
 	      ])
 	      # see if OPENSSL 1.0.0 or later (has EVP MD and Verify independency)
 	      AC_MSG_CHECKING([if openssl supports SHA2 and ECDSA with EVP])
 	      if grep OPENSSL_VERSION_TEXT $ssldir_include/openssl/opensslv.h | grep "OpenSSL" >/dev/null; then
-		if grep OPENSSL_VERSION_TEXT $ssldir_include/openssl/opensslv.h | grep "OpenSSL 0\." >/dev/null; then
+		if grep OPENSSL_VERSION_NUMBER $ssldir_include/openssl/opensslv.h | grep 0x0 >/dev/null; then
 		  AC_MSG_RESULT([no])
 		  AC_DEFINE_UNQUOTED([USE_ECDSA_EVP_WORKAROUND], [1], [Define this to enable an EVP workaround for older openssl])
 		else
@@ -1677,96 +1523,6 @@ if test x_$withval = x_yes -o x_$withval != x_no; then
    ])
 fi

-# ngtcp2
-AC_ARG_WITH(libngtcp2, AS_HELP_STRING([--with-libngtcp2=path],[specify explicit path for libngtcp2, for QUIC.]),
-    [ ],[ withval="no" ])
-found_libngtcp2="no"
-if test x_$withval = x_yes -o x_$withval != x_no; then
-   AC_MSG_CHECKING(for libngtcp2)
-   if test x_$withval = x_ -o x_$withval = x_yes; then
-            withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
-   fi
-   for dir in $withval ; do
-            if test -f "$dir/include/ngtcp2/ngtcp2.h"; then
-		found_libngtcp2="yes"
-		dnl assume /usr is in default path.
-		if test "$dir" != "/usr"; then
-                    CPPFLAGS="$CPPFLAGS -I$dir/include"
-		    LDFLAGS="$LDFLAGS -L$dir/lib"
-		fi
-		AC_MSG_RESULT(found in $dir)
-		AC_DEFINE([HAVE_NGTCP2], [1], [Define this to use ngtcp2.])
-		LIBS="$LIBS -lngtcp2"
-                break;
-            fi
-    done
-    if test x_$found_libngtcp2 != x_yes; then
-	AC_MSG_ERROR([Could not find libngtcp2, ngtcp2.h])
-    fi
-    AC_CHECK_HEADERS([ngtcp2/ngtcp2.h ngtcp2/ngtcp2_crypto_ossl.h ngtcp2/ngtcp2_crypto_openssl.h ngtcp2/ngtcp2_crypto_quictls.h],,, [AC_INCLUDES_DEFAULT])
-    AC_CHECK_DECLS([ngtcp2_conn_server_new], [], [], [AC_INCLUDES_DEFAULT
-    #include <ngtcp2/ngtcp2.h>
-    ])
-    AC_CHECK_DECLS([ngtcp2_crypto_encrypt_cb], [], [], [AC_INCLUDES_DEFAULT
-    #include <ngtcp2/ngtcp2_crypto.h>
-    ])
-    AC_CHECK_LIB([ngtcp2_crypto_ossl], [ngtcp2_crypto_encrypt_cb], [
-	LIBS="$LIBS -lngtcp2_crypto_ossl"
-	AC_DEFINE(USE_NGTCP2_CRYPTO_OSSL, 1, [Define this to use ngtcp2_crypto_ossl.])
-	    AC_CHECK_DECLS([ngtcp2_crypto_ossl_ctx_new], [], [AC_MSG_ERROR([No declaration of ngtcp2_crypto_ossl_ctx_new in the ngtcp2_crypto_ossl header file. Perhaps the ngtcp2_crypto_ossl devel header files need to be installed.])], [AC_INCLUDES_DEFAULT
-	    #include <ngtcp2/ngtcp2_crypto_ossl.h>
-	    ])
-    ], [
-        AC_CHECK_LIB([ngtcp2_crypto_openssl], [ngtcp2_crypto_encrypt_cb], [ LIBS="$LIBS -lngtcp2_crypto_openssl" ], [
-            AC_CHECK_LIB([ngtcp2_crypto_quictls], [ngtcp2_crypto_encrypt_cb], [ LIBS="$LIBS -lngtcp2_crypto_quictls" ])
-	])
-    ])
-    AC_CHECK_FUNCS([ngtcp2_crypto_encrypt_cb ngtcp2_ccerr_default ngtcp2_conn_in_closing_period ngtcp2_conn_in_draining_period ngtcp2_conn_get_max_local_streams_uni ngtcp2_crypto_quictls_from_ossl_encryption_level ngtcp2_crypto_quictls_configure_server_context ngtcp2_crypto_quictls_configure_client_context ngtcp2_crypto_quictls_init ngtcp2_conn_get_num_scid ngtcp2_conn_tls_early_data_rejected ngtcp2_conn_encode_0rtt_transport_params])
-
-    # these check_funcs need -lssl
-    BAKLIBS="$LIBS"
-    LIBS="-lssl $LIBS"
-    AC_CHECK_FUNCS([SSL_is_quic], [], [AC_MSG_ERROR([No QUIC support detected in OpenSSL. Need OpenSSL version with QUIC support to enable DNS over QUIC with libngtcp2.])])
-    AC_CHECK_FUNCS([SSL_set_quic_tls_early_data_enabled])
-    LIBS="$BAKLIBS"
-
-    AC_CHECK_TYPES([struct ngtcp2_version_cid, ngtcp2_encryption_level],,,[AC_INCLUDES_DEFAULT
-    #include <ngtcp2/ngtcp2.h>
-    ])
-    AC_CHECK_MEMBERS([struct ngtcp2_pkt_hd.tokenlen, struct ngtcp2_settings.tokenlen, struct ngtcp2_settings.max_tx_udp_payload_size, struct ngtcp2_transport_params.original_dcid_present],,,[AC_INCLUDES_DEFAULT
-    #include <ngtcp2/ngtcp2.h>
-    ])
-
-    AC_MSG_CHECKING([whether ngtcp2_conn_shutdown_stream has 4 arguments])
-    AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <ngtcp2/ngtcp2.h>
-    ],[
-	(void)ngtcp2_conn_shutdown_stream(NULL, 0, 0, 0);
-    ])],[
-	AC_MSG_RESULT(yes)
-	AC_DEFINE(HAVE_NGTCP2_CONN_SHUTDOWN_STREAM4, 1, [Define if ngtcp2_conn_shutdown_stream has 4 arguments.])
-    ],[
-	AC_MSG_RESULT(no)
-    ])
-
-    AC_CHECK_DECL([CLOCK_MONOTONIC]
-        , []
-        , [AC_MSG_ERROR([ngtcp2 for QUIC needs at least CLOCK_MONOTONIC on the system])]
-        , [AC_INCLUDES_DEFAULT
-#ifdef TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# ifdef HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-        ])
-
-fi
-
 # set static linking for uninstalled libraries if requested
 AC_SUBST(staticexe)
 staticexe=""
@@ -1783,12 +1539,10 @@ if test x_$enable_static_exe = x_yes; then
 			LIBS="$LIBS -lgdi32"
 		fi
 		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
-		if echo "$host" | $GREP -i -e linux >/dev/null; then
-			if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
-				:
-			else
-				LIBS="$LIBS -l:libssp.a"
-			fi
+		if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
+			:
+		else
+			LIBS="$LIBS -l:libssp.a"
 		fi
 	fi
 fi
@@ -1806,12 +1560,10 @@ if test x_$enable_fully_static = x_yes; then
 			LIBS="$LIBS -lgdi32"
 		fi
 		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
-		if echo "$host" | $GREP -i -e linux >/dev/null; then
-			if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
-				:
-			else
-				LIBS="$LIBS -l:libssp.a"
-			fi
+		if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
+			:
+		else
+			LIBS="$LIBS -l:libssp.a"
 		fi
 	fi
 fi
@@ -1870,7 +1622,6 @@ if test $ac_cv_func_daemon = yes; then
 ])
 fi

-AC_CHECK_MEMBERS([struct stat.st_mtimensec, struct stat.st_mtim.tv_nsec])
 AC_CHECK_MEMBERS([struct sockaddr_un.sun_len],,,[
 AC_INCLUDES_DEFAULT
 #ifdef HAVE_SYS_UN_H
@@ -1941,7 +1692,7 @@ AC_LINK_IFELSE([AC_LANG_PROGRAM([
  AC_MSG_RESULT(no))

 AC_SEARCH_LIBS([setusercontext], [util])
-AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam endpwent getrlimit setrlimit setsid chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob fnmatch initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync shmget accept4 getifaddrs if_nametoindex poll gettid])
+AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam endpwent getrlimit setrlimit setsid chroot kill chown sleep usleep random srandom recvmsg sendmsg writev socketpair glob initgroups strftime localtime_r setusercontext _beginthreadex endservent endprotoent fsync shmget accept4 getifaddrs if_nametoindex poll gettid])
 AC_CHECK_FUNCS([setresuid],,[AC_CHECK_FUNCS([setreuid])])
 AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])

@@ -1949,25 +1700,6 @@ AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])
 if echo $host_os | grep darwin8 > /dev/null; then
 	AC_DEFINE(DARWIN_BROKEN_SETREUID, 1, [Define this if on macOSX10.4-darwin8 and setreuid and setregid do not work])
 fi
-
-AC_MSG_CHECKING([for atomic_store])
-AC_LINK_IFELSE([AC_LANG_PROGRAM(AC_INCLUDES_DEFAULT [[
-#ifdef HAVE_STDATOMIC_H
-#include <stdatomic.h>
-#endif
-]], [[
-	int newvar = 5, var = 0;
-	atomic_store((_Atomic int*)&var, newvar);
-	newvar = 0;
-	/* condition to use the variables. */
-	if(var == newvar) return 1;
-]])], [
-	AC_MSG_RESULT(yes)
-	AC_DEFINE(HAVE_LINK_ATOMIC_STORE, 1, [If we have atomic_store])
-], [
-	AC_MSG_RESULT([no])
-])
-
 AC_CHECK_DECLS([inet_pton,inet_ntop], [], [], [
 AC_INCLUDES_DEFAULT
 #ifdef HAVE_NETINET_IN_H
@@ -2106,12 +1838,10 @@ if test x_$enable_lock_checks = x_yes; then
 	UBSYMS="-export-symbols clubsyms.def"
 	cp ${srcdir}/libunbound/ubsyms.def clubsyms.def
 	echo lock_protect >> clubsyms.def
-	echo lock_protect_place >> clubsyms.def
 	echo lock_unprotect >> clubsyms.def
 	echo lock_get_mem >> clubsyms.def
 	echo checklock_start >> clubsyms.def
 	echo checklock_stop >> clubsyms.def
-	echo checklock_set_output_name >> clubsyms.def
 	echo checklock_lock >> clubsyms.def
 	echo checklock_unlock >> clubsyms.def
 	echo checklock_init >> clubsyms.def
@@ -2192,17 +1922,15 @@ case "$enable_ipset" in
 		IPSET_OBJ="ipset.lo"
 		AC_SUBST(IPSET_OBJ)

-		# BSD's pf
-		AC_CHECK_HEADERS([net/pfvar.h], [], [
-		    # mnl
-		    AC_ARG_WITH(libmnl, AS_HELP_STRING([--with-libmnl=path],[specify explicit path for libmnl.]),
+		# mnl
+		AC_ARG_WITH(libmnl, AS_HELP_STRING([--with-libmnl=path],[specify explicit path for libmnl.]),
 			[ ],[ withval="yes" ])
-		    found_libmnl="no"
-		    AC_MSG_CHECKING(for libmnl)
-		    if test x_$withval = x_ -o x_$withval = x_yes; then
+		found_libmnl="no"
+		AC_MSG_CHECKING(for libmnl)
+		if test x_$withval = x_ -o x_$withval = x_yes; then
 			withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
-		    fi
-		    for dir in $withval ; do
+		fi
+		for dir in $withval ; do
 			if test -f "$dir/include/libmnl/libmnl.h" -o -f "$dir/include/libmnl/libmnl/libmnl.h"; then
 				found_libmnl="yes"
 				dnl assume /usr is in default path.
@@ -2220,14 +1948,10 @@ case "$enable_ipset" in
 				LIBS="$LIBS -lmnl"
 				break;
 			fi
-		    done
-		    if test x_$found_libmnl != x_yes; then
-			  AC_MSG_ERROR([Could not find libmnl, libmnl.h])
-		    fi
-		], [
-		  #include <netinet/in.h>
-		  #include <net/if.h>
-		])
+		done
+		if test x_$found_libmnl != x_yes; then
+			AC_MSG_ERROR([Could not find libmnl, libmnl.h])
+		fi
 		;;
    no|*)
    	# nothing
@@ -2408,7 +2132,6 @@ dnl includes

 AHX_CONFIG_FORMAT_ATTRIBUTE
 AHX_CONFIG_UNUSED_ATTRIBUTE
-AHX_CONFIG_NONSTRING_ATTRIBUTE
 AHX_CONFIG_FSEEKO
 AHX_CONFIG_MAXHOSTNAMELEN
 #if !defined(HAVE_SNPRINTF) || defined(SNPRINTF_RET_BROKEN)
@@ -2546,10 +2269,6 @@ struct sockaddr_storage;
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
 #  define free(p) unbound_stat_free_log(p, __FILE__, __LINE__, __func__)
 #  define realloc(p,s) unbound_stat_realloc_log(p, s, __FILE__, __LINE__, __func__)
-#  define strdup(s) unbound_stat_strdup_log(s, __FILE__, __LINE__, __func__)
-#ifdef HAVE_REALLOCARRAY
-#  define reallocarray(p,n,s) unbound_stat_reallocarray_log(p, n, s, __FILE__, __LINE__, __func__)
-#endif
 void *unbound_stat_malloc(size_t size);
 void *unbound_stat_calloc(size_t nmemb, size_t size);
 void unbound_stat_free(void *ptr);
@@ -2562,10 +2281,6 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-void *unbound_stat_reallocarray_log(void *ptr, size_t nmemb, size_t size,
-	const char* file, int line, const char* func);
-char *unbound_stat_strdup_log(const char *s, const char* file, int line,
-	const char* func);
 #elif defined(UNBOUND_ALLOC_LITE)
 #  include "util/alloc.h"
 #endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */
@@ -2576,8 +2291,6 @@ char *unbound_stat_strdup_log(const char *s, const char* file, int line,
 #define UNBOUND_DNS_OVER_TLS_PORT 853
 /** default port for DNS over HTTPS traffic. */
 #define UNBOUND_DNS_OVER_HTTPS_PORT 443
-/** default port for DNS over QUIC traffic. */
-#define UNBOUND_DNS_OVER_QUIC_PORT 853
 /** default port for unbound control traffic, registered port with IANA,
    ub-dns-control  8953/tcp    unbound dns nameserver control */
 #define UNBOUND_CONTROL_PORT 8953
@@ -2589,8 +2302,7 @@ char *unbound_stat_strdup_log(const char *s, const char* file, int line,
 dnl if we build from source tree, the man pages need @date@ and @version@
 dnl if this is a distro tarball, that was already done by makedist.sh
 AC_SUBST(version, [VERSION_MAJOR.VERSION_MINOR.VERSION_MICRO])
-AX_BUILD_DATE_EPOCH(date, [[%b %e, %Y]])
-AC_SUBST(date)
+AC_SUBST(date, [`date +'%b %e, %Y'`])

 AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service contrib/unbound_portable.service])
 AC_CONFIG_HEADERS([config.h])
@@ -58,5 +58,3 @@ distribution but may be helpful.
 * unbound.init_yocto: An init script to start and stop the server. Put it
  in /etc/init.d/unbound to use it. It is for the Yocto Project, in
  embedded systems, contributed by beni-sandu.
-* gost12.patch: adds ECC-GOST12 support for the informational RFC9558.
-  Contributed by Igor V. Ruzanov.
@@ -1,10 +1,10 @@
 diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
-index 172eb26c..2921c87f 100644
+index 5a75e319..c6c6dbe2 100644
 --- a/doc/unbound.conf.5.in
 +++ b/doc/unbound.conf.5.in
-@@ -2146,6 +2146,13 @@ Default: no
- .UNINDENT
- .INDENT 0.0
+@@ -970,6 +970,13 @@ potentially broken nameservers. A lot of domains will not be resolvable when
+ this option in enabled. Only use if you know what you are doing.
+ This option only has effect when qname-minimisation is enabled. Default is no.
 .TP
 +.B aaaa\-filter: \fI<yes or no>
 +Activate behavior similar to BIND's AAAA-filter.
@@ -13,14 +13,14 @@ index 172eb26c..2921c87f 100644
 +This also causes an additional A query to be sent for each AAAA query.
 +This breaks DNSSEC!
 +.TP
- .B aggressive\-nsec: \fI<yes or no>\fP 
- Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN and other
- denials, using information from previous NXDOMAINs answers.
+ .B aggressive\-nsec: \fI<yes or no>
+ Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN
+ and other denials, using information from previous NXDOMAINs answers.
 diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c
-index 49a5f5da..fbe434fa 100644
+index f093c1bf..e55a2246 100644
 --- a/iterator/iter_scrub.c
 +++ b/iterator/iter_scrub.c
-@@ -849,6 +849,32 @@ scrub_sanitize_rr_length(sldns_buffer* pkt, struct msg_parse* msg,
+@@ -679,6 +679,32 @@ static int sanitize_nsec_is_overreach(sldns_buffer* pkt,
 	return 0;
 }
 
@@ -53,15 +53,15 @@ index 49a5f5da..fbe434fa 100644
 /**
  * Given a response event, remove suspect RRsets from the response.
  * "Suspect" rrsets are potentially poison. Note that this routine expects
-@@ -869,6 +895,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
+@@ -698,6 +724,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
- 	struct iter_env* ie, struct module_qstate* qstate)
+ 	struct iter_env* ie)
 {
 +	int found_a_record = 0; /* ASN: do we have a A record? */
 	int del_addi = 0; /* if additional-holding rrsets are deleted, we
 		do not trust the normalized additional-A-AAAA any more */
- 	uint8_t* ns_rrset_dname = NULL;
-@@ -906,6 +933,13 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
+ 	struct rrset_parse* rrset, *prev;
+@@ -733,6 +760,13 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 		rrset = rrset->rrset_all_next;
 	}
 
@@ -75,9 +75,9 @@ index 49a5f5da..fbe434fa 100644
 	/* At this point, we brutally remove ALL rrsets that aren't 
 	 * children of the originating zone. The idea here is that, 
 	 * as far as we know, the server that we contacted is ONLY 
-@@ -925,6 +959,24 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
- 				continue;
- 		}
+@@ -744,6 +778,24 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
+ 	rrset = msg->rrset_first;
+ 	while(rrset) {
 
 +		/* ASN: For AAAA records only... */
 +		if((ie->aaaa_filter) && (rrset->type == LDNS_RR_TYPE_AAAA)) {
@@ -101,10 +101,10 @@ index 49a5f5da..fbe434fa 100644
 		if( (rrset->type == LDNS_RR_TYPE_A || 
 			rrset->type == LDNS_RR_TYPE_AAAA)) {
 diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c
-index 1da21896..6583dd0e 100644
+index 2482a1f4..bd5ba243 100644
 --- a/iterator/iter_utils.c
 +++ b/iterator/iter_utils.c
-@@ -250,6 +250,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
+@@ -177,6 +177,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 	iter_env->outbound_msg_retry = cfg->outbound_msg_retry;
 	iter_env->max_sent_count = cfg->max_sent_count;
 	iter_env->max_query_restarts = cfg->max_query_restarts;
@@ -113,12 +113,12 @@ index 1da21896..6583dd0e 100644
 }
 
 diff --git a/iterator/iterator.c b/iterator/iterator.c
-index 71e64655..735f4ca0 100644
+index 54006940..768fe202 100644
 --- a/iterator/iterator.c
 +++ b/iterator/iterator.c
-@@ -2412,6 +2412,53 @@ check_waiting_queries(struct iter_qstate* iq, struct module_qstate* qstate,
- 		qstate->ext_state[id] = module_wait_reply;
- 	}
+@@ -2155,6 +2155,53 @@ processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id)
+ 
+ 	return 0;
 }
 +
 +/**
@@ -170,8 +170,8 @@ index 71e64655..735f4ca0 100644
 	
 /** 
  * This is the request event state where the request will be sent to one of
-@@ -2554,6 +2601,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
- 		}
+@@ -2216,6 +2263,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
+ 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 	
 +	/* ASN: If we have a AAAA query, then also query for A records */
@@ -184,7 +184,7 @@ index 71e64655..735f4ca0 100644
 	/* Make sure we have a delegation point, otherwise priming failed
 	 * or another failure occurred */
 	if(!iq->dp) {
-@@ -4178,6 +4232,61 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -3648,6 +3702,61 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 	return 0;
 }
 
@@ -236,7 +236,7 @@ index 71e64655..735f4ca0 100644
 +		/* see if the failure did get (parent-lame) info */
 +		if(!cache_fill_missing(super->env,
 +			super_iq->qchase.qclass, super->region,
-+			super_iq->dp, 0))
+			super_iq->dp))
 +		log_err("ASN-AAAA-filter: out of memory adding missing");
 +		dpns->resolved = 1; /* mark as failed */
 +	}
@@ -246,7 +246,7 @@ index 71e64655..735f4ca0 100644
 /*
  * Return priming query results to interested super querystates.
  * 
-@@ -4197,6 +4306,9 @@ iter_inform_super(struct module_qstate* qstate, int id,
+@@ -3667,6 +3776,9 @@ iter_inform_super(struct module_qstate* qstate, int id,
 	else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
 		super->minfo[id])->state == DSNS_FIND_STATE)
 		processDSNSResponse(qstate, id, super);
@@ -256,7 +256,7 @@ index 71e64655..735f4ca0 100644
 	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
 		error_supers(qstate, id, super);
 	else if(qstate->is_priming)
-@@ -4234,6 +4346,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -3704,6 +3816,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
 			case INIT_REQUEST_3_STATE:
 				cont = processInitRequest3(qstate, iq, id);
 				break;
@@ -266,7 +266,7 @@ index 71e64655..735f4ca0 100644
 			case QUERYTARGETS_STATE:
 				cont = processQueryTargets(qstate, iq, ie, id);
 				break;
-@@ -4578,6 +4693,8 @@ iter_state_to_string(enum iter_state state)
+@@ -4040,6 +4155,8 @@ iter_state_to_string(enum iter_state state)
 		return "INIT REQUEST STATE (stage 2)";
 	case INIT_REQUEST_3_STATE:
 		return "INIT REQUEST STATE (stage 3)";
@@ -275,7 +275,7 @@ index 71e64655..735f4ca0 100644
 	case QUERYTARGETS_STATE :
 		return "QUERY TARGETS STATE";
 	case PRIME_RESP_STATE :
-@@ -4602,6 +4719,7 @@ iter_state_is_responsestate(enum iter_state s)
+@@ -4064,6 +4181,7 @@ iter_state_is_responsestate(enum iter_state s)
 		case INIT_REQUEST_STATE :
 		case INIT_REQUEST_2_STATE :
 		case INIT_REQUEST_3_STATE :
@@ -284,10 +284,10 @@ index 71e64655..735f4ca0 100644
 		case COLLECT_CLASS_STATE :
 			return 0;
 diff --git a/iterator/iterator.h b/iterator/iterator.h
-index ae4b4e45..a44f9d27 100644
+index 8b840528..a61c4195 100644
 --- a/iterator/iterator.h
 +++ b/iterator/iterator.h
-@@ -157,6 +157,9 @@ struct iter_env {
+@@ -133,6 +133,9 @@ struct iter_env {
 	 */
 	int* target_fetch_policy;
 
@@ -297,7 +297,7 @@ index ae4b4e45..a44f9d27 100644
 	/** lock on ratelimit counter */
 	lock_basic_type queries_ratelimit_lock;
 	/** number of queries that have been ratelimited */
-@@ -217,6 +220,14 @@ enum iter_state {
+@@ -187,6 +190,14 @@ enum iter_state {
 	 */
 	INIT_REQUEST_3_STATE,
 
@@ -312,9 +312,9 @@ index ae4b4e45..a44f9d27 100644
 	/**
 	 * Each time a delegation point changes for a given query or a 
 	 * query times out and/or wakes up, this state is (re)visited. 
-@@ -434,6 +445,13 @@ struct iter_qstate {
- 	 * already so that it is accepted later. */
- 	int empty_nodata_found;
+@@ -376,6 +387,13 @@ struct iter_qstate {
+ 	 */
+ 	int refetch_glue;
 
 +	/**
 +	 * ASN: This is a flag that, if true, means that this query is
@@ -327,10 +327,10 @@ index ae4b4e45..a44f9d27 100644
 	struct outbound_list outlist;
 
 diff --git a/pythonmod/interface.i b/pythonmod/interface.i
-index 2040fb9e..f073c3dc 100644
+index 1ca8686a..d91b19ec 100644
 --- a/pythonmod/interface.i
 +++ b/pythonmod/interface.i
-@@ -1013,6 +1013,7 @@ struct config_file {
+@@ -995,6 +995,7 @@ struct config_file {
    int harden_dnssec_stripped;
    int harden_referral_path;
    int use_caps_bits_for_id;
@@ -339,23 +339,23 @@ index 2040fb9e..f073c3dc 100644
    struct config_strlist* private_domain;
    size_t unwanted_threshold;
 diff --git a/util/config_file.c b/util/config_file.c
-index b1e767b3..5eb3c099 100644
+index 969d664b..8d94b008 100644
 --- a/util/config_file.c
 +++ b/util/config_file.c
-@@ -247,6 +247,7 @@ config_create(void)
+@@ -231,6 +231,7 @@ config_create(void)
+ 	cfg->harden_referral_path = 0;
 	cfg->harden_algo_downgrade = 0;
- 	cfg->harden_unknown_additional = 0;
 	cfg->use_caps_bits_for_id = 0;
 +	cfg->aaaa_filter = 0; /* ASN: default is disabled */
 	cfg->caps_whitelist = NULL;
 	cfg->private_address = NULL;
 	cfg->private_domain = NULL;
 diff --git a/util/config_file.h b/util/config_file.h
-index 44ac036b..1e59ab07 100644
+index c7c9a0a4..e3aa15b0 100644
 --- a/util/config_file.h
 +++ b/util/config_file.h
-@@ -311,6 +311,8 @@ struct config_file {
- 	int harden_unknown_additional;
+@@ -285,6 +285,8 @@ struct config_file {
+ 	int harden_algo_downgrade;
 	/** use 0x20 bits in query as random ID bits */
 	int use_caps_bits_for_id;
 +	/** ASN: enable AAAA filter? */
@@ -364,10 +364,10 @@ index 44ac036b..1e59ab07 100644
 	struct config_strlist* caps_whitelist;
 	/** strip away these private addrs from answers, no DNS Rebinding */
 diff --git a/util/configlexer.lex b/util/configlexer.lex
-index bc258673..76aab170 100644
+index 34a0e5dd..c890be2a 100644
 --- a/util/configlexer.lex
 +++ b/util/configlexer.lex
-@@ -327,6 +327,7 @@ use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
+@@ -317,6 +317,7 @@ use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
 caps-whitelist{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
 caps-exempt{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
 unwanted-reply-threshold{COLON}	{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
@@ -376,10 +376,10 @@ index bc258673..76aab170 100644
 private-domain{COLON}		{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
 prefetch-key{COLON}		{ YDVAR(1, VAR_PREFETCH_KEY) }
 diff --git a/util/configparser.y b/util/configparser.y
-index 82e1d878..dc19bed5 100644
+index d4f965f9..8cc237c6 100644
 --- a/util/configparser.y
 +++ b/util/configparser.y
-@@ -100,6 +100,7 @@ extern struct config_parser_state* cfg_parser;
+@@ -97,6 +97,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT
 %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
 %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
@@ -387,7 +387,7 @@ index 82e1d878..dc19bed5 100644
 %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
 %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
 %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
-@@ -276,6 +277,7 @@ content_server: server_num_threads | server_verbosity | server_port |
+@@ -247,6 +248,7 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size |
 	server_harden_referral_path | server_private_address |
 	server_private_domain | server_extended_statistics |
@@ -395,7 +395,7 @@ index 82e1d878..dc19bed5 100644
 	server_local_data_ptr | server_jostle_timeout |
 	server_unwanted_reply_threshold | server_log_time_ascii |
 	server_domain_insecure | server_val_sig_skew_min |
-@@ -1932,6 +1934,15 @@ server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG
+@@ -1754,6 +1756,15 @@ server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG
 			yyerror("out of memory");
 	}
 	;
@@ -1,24 +1,21 @@
 #!/usr/bin/env bash

-LIBEXPAT_FNAME=expat-2.7.0
-LIBEXPAT_VERSION_DIR=R_2_7_0
-
 echo "Downloading Expat"
-if ! curl -L -k -s -o $LIBEXPAT_FNAME.tar.gz https://github.com/libexpat/libexpat/releases/download/$LIBEXPAT_VERSION_DIR/$LIBEXPAT_FNAME.tar.gz;
+if ! curl -L -k -s -o expat-2.2.9.tar.gz https://github.com/libexpat/libexpat/releases/download/R_2_2_9/expat-2.2.9.tar.gz;
 then
    echo "Failed to download Expat"
    exit 1
 fi

 echo "Unpacking Expat"
-rm -rf ./$LIBEXPAT_FNAME
-if ! tar -xf $LIBEXPAT_FNAME.tar.gz;
+rm -rf ./expat-2.2.9
+if ! tar -xf expat-2.2.9.tar.gz;
 then
    echo "Failed to unpack Expat"
    exit 1
 fi

-cd $LIBEXPAT_FNAME || exit 1
+cd expat-2.2.9 || exit 1

 echo "Configuring Expat"
 if ! ./configure --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST" --prefix="$ANDROID_PREFIX"; then
@@ -1,325 +0,0 @@
-diff --git a/sldns/keyraw.c b/sldns/keyraw.c
-index 42a9262a3..cc6406a56 100644
--- a/sldns/keyraw.c
-+++ b/sldns/keyraw.c
-@@ -85,7 +85,7 @@ sldns_rr_dnskey_key_size_raw(const unsigned char* keydata,
- 		}
- 		break;
- #ifdef USE_GOST
-	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 		return 512;
- #endif
- #ifdef USE_ECDSA
-@@ -146,7 +146,7 @@ sldns_key_EVP_load_gost_id(void)
- 	if(gost_id) return gost_id;
- 
- 	/* see if configuration loaded gost implementation from other engine*/
-	meth = EVP_PKEY_asn1_find_str(NULL, "gost2001", -1);
-+	meth = EVP_PKEY_asn1_find_str(NULL, "gost2012_256", -1);
- 	if(meth) {
- 		EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
- 		return gost_id;
-@@ -170,7 +170,7 @@ sldns_key_EVP_load_gost_id(void)
- 		return 0;
- 	}
- 
-	meth = EVP_PKEY_asn1_find_str(&e, "gost2001", -1);
-+	meth = EVP_PKEY_asn1_find_str(&e, "gost2012_256", -1);
- 	if(!meth) {
- 		/* algo not found */
- 		ENGINE_finish(e);
-@@ -536,12 +536,17 @@ EVP_PKEY* sldns_key_rsa2pkey_raw(unsigned char* key, size_t len)
- EVP_PKEY*
- sldns_gost2pkey_raw(unsigned char* key, size_t keylen)
- {
-	/* prefix header for X509 encoding */
-	uint8_t asn[37] = { 0x30, 0x63, 0x30, 0x1c, 0x06, 0x06, 0x2a, 0x85, 
-		0x03, 0x02, 0x02, 0x13, 0x30, 0x12, 0x06, 0x07, 0x2a, 0x85, 
-		0x03, 0x02, 0x02, 0x23, 0x01, 0x06, 0x07, 0x2a, 0x85, 0x03, 
-		0x02, 0x02, 0x1e, 0x01, 0x03, 0x43, 0x00, 0x04, 0x40};
-	unsigned char encoded[37+64];
-+	/* prefix header for X509 encoding
-+	 *
-+	 * note: based on draft-makarenko-gost2012-dnssec-01 (pre-RFC9558 and it DOES work!)
-+	 * ASN1 header described in RFC9558 is not suitable due to d2i_PUBKEY() works with
-+	 * non-compressed public keys (two additional bytes 0x04, 0x40 at the end of header)
-+	 */
-+	uint8_t asn[32] = { 0x30, 0x5e, 0x30, 0x17, 0x06, 0x08, 0x2a, 0x85,
-+			    0x03, 0x07, 0x01, 0x01, 0x01, 0x01, 0x30, 0x0b,
-+			    0x06, 0x09, 0x2a, 0x85, 0x03, 0x07, 0x01, 0x02,
-+			    0x01, 0x01, 0x01, 0x03, 0x43, 0x00, 0x04, 0x40 };
-+	unsigned char encoded[32+64];
- 	const unsigned char* pp;
- 	if(keylen != 64) {
- 		/* key wrong size */
-@@ -549,8 +554,8 @@ sldns_gost2pkey_raw(unsigned char* key, size_t keylen)
- 	}
- 
- 	/* create evp_key */
-	memmove(encoded, asn, 37);
-	memmove(encoded+37, key, 64);
-+	memmove(encoded, asn, 32);
-+	memmove(encoded+32, key, 64);
- 	pp = (unsigned char*)&encoded[0];
- 
- 	return d2i_PUBKEY(NULL, &pp, (int)sizeof(encoded));
-diff --git a/sldns/rrdef.h b/sldns/rrdef.h
-index bbc3d5b86..7d5f3c057 100644
--- a/sldns/rrdef.h
-+++ b/sldns/rrdef.h
-@@ -384,11 +384,12 @@ enum sldns_enum_algorithm
-         LDNS_RSASHA1_NSEC3      = 7,
-         LDNS_RSASHA256          = 8,   /* RFC 5702 */
-         LDNS_RSASHA512          = 10,  /* RFC 5702 */
-        LDNS_ECC_GOST           = 12,  /* RFC 5933 */
-+        LDNS_ECC_GOST           = 12,  /* RFC 5933, deprecated */
-         LDNS_ECDSAP256SHA256    = 13,  /* RFC 6605 */
-         LDNS_ECDSAP384SHA384    = 14,  /* RFC 6605 */
- 	LDNS_ED25519		= 15,  /* RFC 8080 */
- 	LDNS_ED448		= 16,  /* RFC 8080 */
-+	LDNS_ECC_GOST12		= 23,  /* RFC 9558 */
-         LDNS_INDIRECT           = 252,
-         LDNS_PRIVATEDNS         = 253,
-         LDNS_PRIVATEOID         = 254
-@@ -402,8 +403,9 @@ enum sldns_enum_hash
- {
-         LDNS_SHA1               = 1,  /* RFC 4034 */
-         LDNS_SHA256             = 2,  /* RFC 4509 */
-        LDNS_HASH_GOST          = 3,  /* RFC 5933 */
-        LDNS_SHA384             = 4   /* RFC 6605 */
-+        LDNS_HASH_GOST          = 3,  /* RFC 5933, deprecated */
-+        LDNS_SHA384             = 4,  /* RFC 6605 */
-+        LDNS_HASH_GOST12        = 5   /* RFC 9558 */
- };
- typedef enum sldns_enum_hash sldns_hash;
- 
-diff --git a/sldns/wire2str.c b/sldns/wire2str.c
-index 75b8f37b0..b4c4755e6 100644
--- a/sldns/wire2str.c
-+++ b/sldns/wire2str.c
-@@ -45,11 +45,12 @@ static sldns_lookup_table sldns_algorithms_data[] = {
- 	{ LDNS_RSASHA1_NSEC3, "RSASHA1-NSEC3-SHA1" },
- 	{ LDNS_RSASHA256, "RSASHA256"},
- 	{ LDNS_RSASHA512, "RSASHA512"},
-	{ LDNS_ECC_GOST, "ECC-GOST"},
-+	{ LDNS_ECC_GOST, "ECC-GOST"}, /* deprecated */
- 	{ LDNS_ECDSAP256SHA256, "ECDSAP256SHA256"},
- 	{ LDNS_ECDSAP384SHA384, "ECDSAP384SHA384"},
- 	{ LDNS_ED25519, "ED25519"},
- 	{ LDNS_ED448, "ED448"},
-+	{ LDNS_ECC_GOST12, "ECC-GOST12"},
- 	{ LDNS_INDIRECT, "INDIRECT" },
- 	{ LDNS_PRIVATEDNS, "PRIVATEDNS" },
- 	{ LDNS_PRIVATEOID, "PRIVATEOID" },
-@@ -61,8 +62,9 @@ sldns_lookup_table* sldns_algorithms = sldns_algorithms_data;
- static sldns_lookup_table sldns_hashes_data[] = {
- 	{ LDNS_SHA1, "SHA1" },
- 	{ LDNS_SHA256, "SHA256" },
-	{ LDNS_HASH_GOST, "HASH-GOST" },
-+	{ LDNS_HASH_GOST, "HASH-GOST" }, /* deprecated */
- 	{ LDNS_SHA384, "SHA384" },
-+	{ LDNS_HASH_GOST12, "HASH-GOST12" },
- 	{ 0, NULL }
- };
- sldns_lookup_table* sldns_hashes = sldns_hashes_data;
-diff --git a/testcode/unitverify.c b/testcode/unitverify.c
-index fcf2e2ffe..4a33e9f6a 100644
--- a/testcode/unitverify.c
-+++ b/testcode/unitverify.c
-@@ -696,7 +696,7 @@ verify_test(void)
- #endif
- #ifdef USE_GOST
- 	if(sldns_key_EVP_load_gost_id())
-	  verifytest_file(SRCDIRSTR "/testdata/test_sigs.gost", "20090807060504");
-+	  verifytest_file(SRCDIRSTR "/testdata/test_sigs.gost12", "20251226060504");
- 	else printf("Warning: skipped GOST, openssl does not provide gost.\n");
- #endif
- #ifdef USE_ECDSA
-diff --git a/testdata/test_sigs.gost12 b/testdata/test_sigs.gost12
-new file mode 100644
-index 000000000..72a250cff
--- /dev/null
-+++ b/testdata/test_sigs.gost12
-@@ -0,0 +1,39 @@
-+; Signature test file
-+
-+; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification.
-+; later entries are verified with it.
-+
-+; Test GOST signatures using algo number 23.
-+
-+ENTRY_BEGIN
-+SECTION QUESTION
-+nlnetlabs.nl.	IN DNSKEY
-+SECTION ANSWER
-+nlnetlabs.nl.   3600    IN      DNSKEY  256 3 23 cdOtkEcb6NhcdOpIbPYtWyWxdlUiKgtKQbYg3lIjtG7i3fYjUID9zyOgoQEiV9wuGCfrw5cNsnvNw+8HiVFK4g== ;{id = 12301 (zsk), size = 512b}
-+ENTRY_END
-+
-+; entry to test
-+ENTRY_BEGIN
-+SECTION QUESTION
-+open.nlnetlabs.nl. IN A
-+SECTION ANSWER
-+open.nlnetlabs.nl.      600     IN      A       213.154.224.1
-+open.nlnetlabs.nl.      600     IN      RRSIG   A 23 3 600 20260122084903 20251225084903 12301 nlnetlabs.nl. I12wYNs96DxMy26CWx296/sWMJAFg4nNXBo0sw7PnuMbJW5NFAmZYtFWhUdOWn4umaiodYOAmKG8Zg/OKvEtAQ==
-+ENTRY_END
-+
-+ENTRY_BEGIN
-+SECTION QUESTION
-+open.nlnetlabs.nl. IN AAAA
-+SECTION ANSWER
-+open.nlnetlabs.nl.      600     IN      AAAA    2001:7b8:206:1::1
-+open.nlnetlabs.nl.      600     IN      AAAA    2001:7b8:206:1::53
-+open.nlnetlabs.nl.      600     IN      RRSIG   AAAA 23 3 600 20260122084903 20251225084903 12301 nlnetlabs.nl. J0jHa+CP8HM6UDa2+uYgaze2mfpJTh2hkZ2KwMTYb5sfL6iBmxxql0c/403Itk4fMfYBMGn7zfzDQ+CxnCgSWw==
-+ENTRY_END
-+
-+ENTRY_BEGIN
-+SECTION QUESTION
-+open.nlnetlabs.nl. IN NSEC
-+SECTION ANSWER
-+open.nlnetlabs.nl.      86400   IN      NSEC    nlnetlabs.nl. A AAAA RRSIG NSEC
-+open.nlnetlabs.nl.      86400   IN      RRSIG   NSEC 23 3 86400 20260122084903 20251225084903 12301 nlnetlabs.nl. INCLYe9vAaNYaYx5Ay3Q6QdX+wPW9sMRvVlGt/jUEGgCi+88QlV80CT1oHrhRI66I14Wk6NRAGZRNx1tUPSHSg==
-+ENTRY_END
-diff --git a/validator/val_secalgo.c b/validator/val_secalgo.c
-index be8347b1b..4f621a309 100644
--- a/validator/val_secalgo.c
-+++ b/validator/val_secalgo.c
-@@ -246,10 +246,10 @@ ds_digest_size_supported(int algo)
- 			return SHA256_DIGEST_LENGTH;
- #endif
- #ifdef USE_GOST
-		case LDNS_HASH_GOST:
-+		case LDNS_HASH_GOST12:
- 			/* we support GOST if it can be loaded */
- 			(void)sldns_key_EVP_load_gost_id();
-			if(EVP_get_digestbyname("md_gost94"))
-+			if(EVP_get_digestbyname("md_gost12_256"))
- 				return 32;
- 			else	return 0;
- #endif
-@@ -265,9 +265,9 @@ ds_digest_size_supported(int algo)
- #ifdef USE_GOST
- /** Perform GOST hash */
- static int
-do_gost94(unsigned char* data, size_t len, unsigned char* dest)
-+do_gost12(unsigned char* data, size_t len, unsigned char* dest)
- {
-	const EVP_MD* md = EVP_get_digestbyname("md_gost94");
-+	const EVP_MD* md = EVP_get_digestbyname("md_gost12_256");
- 	if(!md) 
- 		return 0;
- 	return sldns_digest_evp(data, (unsigned int)len, dest, md);
-@@ -302,8 +302,8 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
- 			return 1;
- #endif
- #ifdef USE_GOST
-		case LDNS_HASH_GOST:
-			if(do_gost94(buf, len, res))
-+		case LDNS_HASH_GOST12:
-+			if(do_gost12(buf, len, res))
- 				return 1;
- 			break;
- #endif
-@@ -384,7 +384,7 @@ dnskey_algo_id_is_supported(int id)
- #endif
- 
- #ifdef USE_GOST
-	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 		/* we support GOST if it can be loaded */
- 		return sldns_key_EVP_load_gost_id();
- #endif
-@@ -612,17 +612,17 @@ setup_key_digest(int algo, EVP_PKEY** evp_key, const EVP_MD** digest_type,
- 
- 			break;
- #ifdef USE_GOST
-		case LDNS_ECC_GOST:
-+		case LDNS_ECC_GOST12:
- 			*evp_key = sldns_gost2pkey_raw(key, keylen);
- 			if(!*evp_key) {
- 				verbose(VERB_QUERY, "verify: "
- 					"sldns_gost2pkey_raw failed");
- 				return 0;
- 			}
-			*digest_type = EVP_get_digestbyname("md_gost94");
-+			*digest_type = EVP_get_digestbyname("md_gost12_256");
- 			if(!*digest_type) {
- 				verbose(VERB_QUERY, "verify: "
-					"EVP_getdigest md_gost94 failed");
-+					"EVP_getdigest md_gost12_256 failed");
- 				return 0;
- 			}
- 			break;
-@@ -964,7 +964,7 @@ ds_digest_size_supported(int algo)
- 			return SHA384_LENGTH;
- #endif
- 		/* GOST not supported in NSS */
-		case LDNS_HASH_GOST:
-+		case LDNS_HASH_GOST12:
- 		default: break;
- 	}
- 	return 0;
-@@ -991,7 +991,7 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
- 			return HASH_HashBuf(HASH_AlgSHA384, res, buf, len)
- 				== SECSuccess;
- #endif
-		case LDNS_HASH_GOST:
-+		case LDNS_HASH_GOST12:
- 		default: 
- 			verbose(VERB_QUERY, "unknown DS digest algorithm %d", 
- 				algo);
-@@ -1031,7 +1031,7 @@ dnskey_algo_id_is_supported(int id)
- 	case LDNS_ECDSAP384SHA384:
- 		return PK11_TokenExists(CKM_ECDSA);
- #endif
-	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 	default:
- 		return 0;
- 	}
-@@ -1352,7 +1352,7 @@ nss_setup_key_digest(int algo, SECKEYPublicKey** pubkey, HASH_HashType* htype,
- 			/* no prefix for DSA verification */
- 			break;
- #endif /* USE_ECDSA */
-		case LDNS_ECC_GOST:
-+		case LDNS_ECC_GOST12:
- 		default:
- 			verbose(VERB_QUERY, "verify: unknown algorithm %d", 
- 				algo);
-@@ -1675,7 +1675,7 @@ ds_digest_size_supported(int algo)
- 			return SHA384_DIGEST_SIZE;
- #endif
- 		/* GOST not supported */
-		case LDNS_HASH_GOST:
-+		case LDNS_ECC_GOST12:
- 		default:
- 			break;
- 	}
-@@ -1700,7 +1700,7 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
- 			return _digest_nettle(SHA384_DIGEST_SIZE, buf, len, res);
- 
- #endif
-		case LDNS_HASH_GOST:
-+		case LDNS_ECC_GOST12:
- 		default:
- 			verbose(VERB_QUERY, "unknown DS digest algorithm %d",
- 				algo);
-@@ -1744,7 +1744,7 @@ dnskey_algo_id_is_supported(int id)
- 		return 1;
- #endif
- 	case LDNS_RSAMD5: /* RFC 6725 deprecates RSAMD5 */
-	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 	default:
- 		return 0;
- 	}
-@@ -2103,7 +2103,7 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
- 			return sec_status_secure;
- #endif
- 	case LDNS_RSAMD5:
-	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 	default:
- 		*reason = "unable to verify signature, unknown algorithm";
- 		return sec_status_bogus;
@@ -1,32 +1,28 @@
 #!/usr/bin/env bash

-LIBEXPAT_FNAME=expat-2.7.0
-LIBEXPAT_VERSION_DIR=R_2_7_0
-
 echo "Downloading Expat"
-if ! curl -L -k -s -o $LIBEXPAT_FNAME.tar.gz https://github.com/libexpat/libexpat/releases/download/$LIBEXPAT_VERSION_DIR/$LIBEXPAT_FNAME.tar.gz;
+if ! curl -L -k -s -o expat-2.2.9.tar.gz https://github.com/libexpat/libexpat/releases/download/R_2_2_9/expat-2.2.9.tar.gz;
 then
    echo "Failed to download Expat"
    exit 1
 fi

 echo "Unpacking Expat"
-rm -rf ./$LIBEXPAT_FNAME
-if ! tar -xf $LIBEXPAT_FNAME.tar.gz;
+rm -rf ./expat-2.2.9
+if ! tar -xf expat-2.2.9.tar.gz;
 then
    echo "Failed to unpack Expat"
    exit 1
 fi

-cd $LIBEXPAT_FNAME || exit 1
+cd expat-2.2.9 || exit 1

 export PKG_CONFIG_PATH="$IOS_PREFIX/lib/pkgconfig"

 echo "Configuring Expat"
-if ! ./configure --without-tests				\
-       --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST"	\
-       --prefix="$IOS_PREFIX" ;
-then
+if ! ./configure \
+       --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST" \
+       --prefix="$IOS_PREFIX" ; then
    echo "Error: Failed to configure Expat"
    cat config.log
    exit 1
@@ -1,22 +1,21 @@
 #!/usr/bin/env bash
-OPENSSL_VERSION=1.1.1d

 echo "Downloading OpenSSL"
-if ! curl -L -k -s -o openssl-$OPENSSL_VERSION.tar.gz https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz;
+if ! curl -L -k -s -o openssl-1.1.1d.tar.gz https://www.openssl.org/source/openssl-1.1.1d.tar.gz;
 then
    echo "Failed to download OpenSSL"
    exit 1
 fi

 echo "Unpacking OpenSSL"
-rm -rf ./openssl-$OPENSSL_VERSION
-if ! tar -xf openssl-$OPENSSL_VERSION.tar.gz;
+rm -rf ./openssl-1.1.1d
+if ! tar -xf openssl-1.1.1d.tar.gz;
 then
    echo "Failed to unpack OpenSSL"
    exit 1
 fi

-cd openssl-$OPENSSL_VERSION || exit 1
+cd openssl-1.1.1d || exit 1

 if ! cp ../contrib/ios/15-ios.conf Configurations/; then
    echo "Failed to copy OpenSSL ios config"
@@ -28,8 +27,7 @@ fi
 # Also see https://github.com/openssl/openssl/issues/7607.
 if ! patch -u -p0 < ../contrib/ios/openssl.patch; then
    echo "Failed to patch OpenSSL"
-    # the partial patch may be useful.
-    #exit 1
+    exit 1
 fi

 echo "Configuring OpenSSL"
@@ -175,7 +175,6 @@ fi
 # For example, remove 4.3, 6.2, and 6.1 if they are not installed. We go back to
 # the 1.0 SDKs because Apple WatchOS uses low numbers, like 2.0 and 2.1.
 XCODE_SDK=
-if test -z "$SDK_VERSION"; then
 for i in $(seq -f "%.1f" 30.0 -0.1 1.0)
 do
    if [ -d "$XCODE_DEVELOPER_SDK/Developer/SDKs/$IOS_SDK$i.sdk" ]; then
@@ -183,10 +182,6 @@ do
        break
    fi
 done
-else
-    i="$SDK_VERSION"
-    XCODE_SDK="$IOS_SDK$i.sdk"
-fi

 # Error checking
 if [ -z "$XCODE_SDK" ]; then
@@ -38,18 +38,12 @@
 ;   - `LockPersonality=yes` locks down the personality system call so that the
 ;     kernel execution domain may not be changed from the default.
 ;
-;   - With /etc/systemd/network/*.network a setting to make sure the network
-;     is not considered online too early, can reduce network unreachable
-;     errors on server start:
-;     [Link]
-;     RequiredForOnline=routable
 ;
 [Unit]
 Description=Validating, recursive, and caching DNS resolver
 Documentation=man:unbound(8)
-After=network-online.target
-Wants=network-online.target
-Before=nss-lookup.target
+After=network.target
+Before=network-online.target nss-lookup.target

 [Install]
 WantedBy=multi-user.target
@@ -59,7 +53,7 @@ ExecReload=+/bin/kill -HUP $MAINPID
 ExecStart=@UNBOUND_SBIN_DIR@/unbound -d -p
 NotifyAccess=main
 Type=notify
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_ADMIN
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true
@@ -14,8 +14,8 @@
 [Unit]
 Description=Validating, recursive, and caching DNS resolver
 Documentation=man:unbound(8)
-After=network-online.target
-Before=nss-lookup.target
+After=network.target
+Before=network-online.target nss-lookup.target
 Wants=nss-lookup.target

 [Install]
@@ -26,7 +26,7 @@ ExecReload=+/bin/kill -HUP $MAINPID
 ExecStart=@UNBOUND_SBIN_DIR@/unbound -d -p
 NotifyAccess=main
 Type=notify
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_ADMIN
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true
@@ -221,9 +221,7 @@ acl_interface_insert(struct acl_list* acl_interface,
 	struct sockaddr_storage* addr, socklen_t addrlen,
 	enum acl_access control)
 {
-	struct acl_addr* node = acl_find_or_create(acl_interface, addr, addrlen, control);
-	node->is_interface = 1;
-	return node;
+	return acl_find_or_create(acl_interface, addr, addrlen, control);
 }

 /** apply acl_tag string */
@@ -553,6 +551,17 @@ acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg,
 	return 1;
 }

+int
+acl_interface_compare(const void* k1, const void* k2)
+{
+	struct addr_tree_node* n1 = (struct addr_tree_node*)k1;
+	struct addr_tree_node* n2 = (struct addr_tree_node*)k2;
+	return sockaddr_cmp(&n1->addr, n1->addrlen, &n2->addr,
+		n2->addrlen);
+	/* We don't care about comparing node->net. All addresses in the
+	 * acl_interface tree have either 32 (ipv4) or 128 (ipv6). */
+}
+
 void
 acl_interface_init(struct acl_list* acl_interface)
 {
@@ -807,23 +816,10 @@ log_acl_action(const char* action, struct sockaddr_storage* addr,
 		addr_to_str(&acladdr->node.addr, acladdr->node.addrlen,
 			n, sizeof(n));
 		verbose(VERB_ALGO, "%s query from %s port %d because of "
-			"%s/%d %s%s", action, a, (int)port, n,
-			acladdr->node.net,
-			acladdr->is_interface?"(ACL on interface IP) ":"",
+			"%s/%d %s", action, a, (int)port, n, acladdr->node.net,
 			acl_access_to_str(acl));
 	} else {
 		verbose(VERB_ALGO, "%s query from %s port %d", action, a,
 			(int)port);
 	}
 }
-
-void acl_list_swap_tree(struct acl_list* acl, struct acl_list* data)
-{
-	/* swap tree and region */
-	rbtree_type oldtree = acl->tree;
-	struct regional* oldregion = acl->region;
-	acl->tree = data->tree;
-	acl->region = data->region;
-	data->tree = oldtree;
-	data->region = oldregion;
-}
@@ -107,8 +107,6 @@ struct acl_addr {
 	struct config_strlist** tag_datas;
 	/** size of the tag_datas array */
 	size_t tag_datas_size;
-	/* If the acl node is for an interface */
-	int is_interface;
 	/* view element, NULL if none */
 	struct view* view;
 };
@@ -149,6 +147,9 @@ acl_interface_insert(struct acl_list* acl_interface,
 int acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg,
 	struct views* v);

+/** compare ACL interface "addr_tree" nodes (+port) */
+int acl_interface_compare(const void* k1, const void* k2);
+
 /**
 * Initialise (also clean) the acl_interface struct.
 * @param acl_interface: where to store.
@@ -201,12 +202,4 @@ const char* acl_access_to_str(enum acl_access acl);
 void log_acl_action(const char* action, struct sockaddr_storage* addr,
 	socklen_t addrlen, enum acl_access acl, struct acl_addr* acladdr);

-/**
- * Swap internal tree with preallocated entries.
- * @param acl: the acl structure.
- * @param data: the data structure used to take elements from. This contains
- * 	the old elements on return.
- */
-void acl_list_swap_tree(struct acl_list* acl, struct acl_list* data);
-
 #endif /* DAEMON_ACL_LIST_H */
@@ -62,231 +62,84 @@
 #include "sldns/wire2str.h"
 #include "sldns/str2wire.h"

-static void spool_txt_printf(struct config_strlist_head* txt,
-	const char* format, ...) ATTR_FORMAT(printf, 2, 3);
-
-/** Append to strlist at end, and log error if out of memory. */
-static void
-spool_txt_string(struct config_strlist_head* txt, char* str)
-{
-	if(!cfg_strlist_append(txt, strdup(str))) {
-		log_err("out of memory in spool text");
-	}
-}
-
-/** Spool txt to spool list. */
-static void
-spool_txt_vmsg(struct config_strlist_head* txt, const char* format,
-	va_list args)
-{
-	char msg[65535];
-	vsnprintf(msg, sizeof(msg), format, args);
-	spool_txt_string(txt, msg);
-}
-
-/** Print item to spool list. On alloc failure the list is as before. */
-static void
-spool_txt_printf(struct config_strlist_head* txt, const char* format, ...)
-{
-	va_list args;
-	va_start(args, format);
-	spool_txt_vmsg(txt, format, args);
-	va_end(args);
-}
-
 /** dump one rrset zonefile line */
-static void
-dump_rrset_line(struct config_strlist_head* txt, struct ub_packed_rrset_key* k,
-	time_t now, size_t i)
+static int
+dump_rrset_line(RES* ssl, struct ub_packed_rrset_key* k, time_t now, size_t i)
 {
-	char s[65535*4+2048];
+	char s[65535];
 	if(!packed_rr_to_string(k, i, now, s, sizeof(s))) {
-		spool_txt_string(txt, "BADRR\n");
-		return;
+		return ssl_printf(ssl, "BADRR\n");
 	}
-	spool_txt_string(txt, s);
+	return ssl_printf(ssl, "%s", s);
 }

 /** dump rrset key and data info */
-static void
-dump_rrset(struct config_strlist_head* txt, struct ub_packed_rrset_key* k,
+static int
+dump_rrset(RES* ssl, struct ub_packed_rrset_key* k, 
 	struct packed_rrset_data* d, time_t now)
 {
 	size_t i;
 	/* rd lock held by caller */
-	if(!k || !d) return;
-	if(k->id == 0) return; /* deleted */
-	if(d->ttl < now) return; /* expired */
+	if(!k || !d) return 1;
+	if(k->id == 0) return 1; /* deleted */
+	if(d->ttl < now) return 1; /* expired */

 	/* meta line */
-	spool_txt_printf(txt, ";rrset%s " ARG_LL "d %u %u %d %d\n",
+	if(!ssl_printf(ssl, ";rrset%s " ARG_LL "d %u %u %d %d\n",
 		(k->rk.flags & PACKED_RRSET_NSEC_AT_APEX)?" nsec_apex":"",
 		(long long)(d->ttl - now),
 		(unsigned)d->count, (unsigned)d->rrsig_count,
 		(int)d->trust, (int)d->security
-		);
+		)) 
+		return 0;
 	for(i=0; i<d->count + d->rrsig_count; i++) {
-		dump_rrset_line(txt, k, now, i);
-	}
-}
-
-/** Spool strlist to the output. */
-static int
-spool_strlist(RES* ssl, struct config_strlist* list)
-{
-	struct config_strlist* s;
-	for(s=list; s; s=s->next) {
-		if(!ssl_printf(ssl, "%s", s->str))
+		if(!dump_rrset_line(ssl, k, now, i))
 			return 0;
 	}
 	return 1;
 }

-/** dump lruhash cache and call callback for every item. */
+/** dump lruhash rrset cache */
 static int
-dump_lruhash(struct lruhash* table,
-	void (*func)(struct lruhash_entry*, struct config_strlist_head*, void*),
-	RES* ssl, void* arg)
+dump_rrset_lruhash(RES* ssl, struct lruhash* h, time_t now)
 {
-	int just_started = 1;
-	int not_done = 1;
-	hashvalue_type hash;
-	size_t num = 0; /* number of entries processed. */
-	size_t max = 2; /* number of entries after which it unlocks. */
-	struct config_strlist_head txt; /* Text strings spooled. */
-	memset(&txt, 0, sizeof(txt));
-
-	while(not_done) {
-		size_t i; /* hash bin. */
-		/* Process a number of items. */
-		num = 0;
-		lock_quick_lock(&table->lock);
-		if(just_started) {
-			i = 0;
-		} else {
-			i = hash&table->size_mask;
-		}
-		while(num < max) {
-			/* Process bin. */
-			int found = 0;
-			size_t num_bin = 0;
-			struct lruhash_bin* bin = &table->array[i];
-			struct lruhash_entry* e;
-			lock_quick_lock(&bin->lock);
-			for(e = bin->overflow_list; e; e = e->overflow_next) {
-				/* Entry e is locked by the func. */
-				func(e, &txt, arg);
-				num_bin++;
-			}
-			lock_quick_unlock(&bin->lock);
-			/* This addition of bin number of entries may take
-			 * it over the max. */
-			num += num_bin;
-
-			/* Move to next bin. */
-			/* Find one with an entry, with a  hash value, so we
-			 * can continue from the hash value. The hash value
-			 * can be indexed also if the array changes size. */
-			i++;
-			while(i < table->size) {
-				bin = &table->array[i];
-				lock_quick_lock(&bin->lock);
-				if(bin->overflow_list) {
-					hash = bin->overflow_list->hash;
-					lock_quick_unlock(&bin->lock);
-					found = 1;
-					just_started = 0;
-					break;
-				}
-				lock_quick_unlock(&bin->lock);
-				i++;
-			}
-			if(!found) {
-				not_done = 0;
-				break;
-			}
-		}
-		lock_quick_unlock(&table->lock);
-		/* Print the spooled items, that are collected while the
-		 * locks are locked. The print happens while they are not
-		 * locked. */
-		if(txt.first) {
-			if(!spool_strlist(ssl, txt.first)) {
-				config_delstrlist(txt.first);
-				return 0;
-			}
-			config_delstrlist(txt.first);
-			memset(&txt, 0, sizeof(txt));
-		}
-	}
-	/* Print the final spooled items. */
-	if(txt.first) {
-		if(!spool_strlist(ssl, txt.first)) {
-			config_delstrlist(txt.first);
+	struct lruhash_entry* e;
+	/* lruhash already locked by caller */
+	/* walk in order of lru; best first */
+	for(e=h->lru_start; e; e = e->lru_next) {
+		lock_rw_rdlock(&e->lock);
+		if(!dump_rrset(ssl, (struct ub_packed_rrset_key*)e->key,
+			(struct packed_rrset_data*)e->data, now)) {
+			lock_rw_unlock(&e->lock);
 			return 0;
 		}
-		config_delstrlist(txt.first);
+		lock_rw_unlock(&e->lock);
 	}
 	return 1;
 }

-/** dump slabhash cache and call callback for every item. */
-static int
-dump_slabhash(struct slabhash* sh,
-	void (*func)(struct lruhash_entry*, struct config_strlist_head*, void*),
-	RES* ssl, void* arg)
-{
-	/* Process a number of items at a time, then unlock the cache,
-	 * so that ordinary processing can continue. Keep an iteration marker
-	 * to continue the loop. That means the cache can change, items
-	 * could be inserted and deleted. And, for example, the hash table
-	 * can grow. */
-	size_t slab;
-	for(slab=0; slab<sh->size; slab++) {
-		if(!dump_lruhash(sh->array[slab], func, ssl, arg))
-			return 0;
-	}
-	return 1;
-}
-
-/** Struct for dump information. */
-struct dump_info {
-	/** The worker. */
-	struct worker* worker;
-	/** The printout connection. */
-	RES* ssl;
-};
-
-/** Dump the rrset cache entry */
-static void
-dump_rrset_entry(struct lruhash_entry* e, struct config_strlist_head* txt,
-	void* arg)
-{
-	struct dump_info* dump_info = (struct dump_info*)arg;
-	lock_rw_rdlock(&e->lock);
-	dump_rrset(txt, (struct ub_packed_rrset_key*)e->key,
-		(struct packed_rrset_data*)e->data,
-		*dump_info->worker->env.now);
-	lock_rw_unlock(&e->lock);
-}
-
 /** dump rrset cache */
 static int
 dump_rrset_cache(RES* ssl, struct worker* worker)
 {
 	struct rrset_cache* r = worker->env.rrset_cache;
-	struct dump_info dump_info;
-	dump_info.worker = worker;
-	dump_info.ssl = ssl;
+	size_t slab;
 	if(!ssl_printf(ssl, "START_RRSET_CACHE\n")) return 0;
-	if(!dump_slabhash(&r->table, &dump_rrset_entry, ssl, &dump_info))
-		return 0;
+	for(slab=0; slab<r->table.size; slab++) {
+		lock_quick_lock(&r->table.array[slab]->lock);
+		if(!dump_rrset_lruhash(ssl, r->table.array[slab],
+			*worker->env.now)) {
+			lock_quick_unlock(&r->table.array[slab]->lock);
+			return 0;
+		}
+		lock_quick_unlock(&r->table.array[slab]->lock);
+	}
 	return ssl_printf(ssl, "END_RRSET_CACHE\n");
 }

 /** dump message to rrset reference */
-static void
-dump_msg_ref(struct config_strlist_head* txt, struct ub_packed_rrset_key* k)
+static int
+dump_msg_ref(RES* ssl, struct ub_packed_rrset_key* k)
 {
 	char* nm, *tp, *cl;
 	nm = sldns_wire2str_dname(k->rk.dname, k->rk.dname_len);
@@ -296,25 +149,30 @@ dump_msg_ref(struct config_strlist_head* txt, struct ub_packed_rrset_key* k)
 		free(nm);
 		free(tp);
 		free(cl);
-		spool_txt_string(txt, "BADREF\n");
-		return;
+		return ssl_printf(ssl, "BADREF\n");
+	}
+	if(!ssl_printf(ssl, "%s %s %s %d\n", nm, cl, tp, (int)k->rk.flags)) {
+		free(nm);
+		free(tp);
+		free(cl);
+		return 0;
 	}
-	spool_txt_printf(txt, "%s %s %s %d\n", nm, cl, tp, (int)k->rk.flags);
 	free(nm);
 	free(tp);
 	free(cl);
+
+	return 1;
 }

 /** dump message entry */
-static void
-dump_msg(struct config_strlist_head* txt, struct query_info* k,
-	struct reply_info* d, time_t now)
+static int
+dump_msg(RES* ssl, struct query_info* k, struct reply_info* d, time_t now)
 {
 	size_t i;
 	char* nm, *tp, *cl;
-	if(!k || !d) return;
-	if(d->ttl < now) return; /* expired */
-
+	if(!k || !d) return 1;
+	if(d->ttl < now) return 1; /* expired */
+	
 	nm = sldns_wire2str_dname(k->qname, k->qname_len);
 	tp = sldns_wire2str_type(k->qtype);
 	cl = sldns_wire2str_class(k->qclass);
@@ -322,35 +180,45 @@ dump_msg(struct config_strlist_head* txt, struct query_info* k,
 		free(nm);
 		free(tp);
 		free(cl);
-		return; /* skip this entry */
+		return 1; /* skip this entry */
 	}
 	if(!rrset_array_lock(d->ref, d->rrset_count, now)) {
 		/* rrsets have timed out or do not exist */
 		free(nm);
 		free(tp);
 		free(cl);
-		return; /* skip this entry */
+		return 1; /* skip this entry */
 	}
-
+	
 	/* meta line */
-	spool_txt_printf(txt,
-		"msg %s %s %s %d %d " ARG_LL "d %d %u %u %u %d %s\n",
-		nm, cl, tp,
-		(int)d->flags, (int)d->qdcount,
-		(long long)(d->ttl-now), (int)d->security,
-		(unsigned)d->an_numrrsets,
-		(unsigned)d->ns_numrrsets,
-		(unsigned)d->ar_numrrsets,
-		(int)d->reason_bogus,
-		d->reason_bogus_str?d->reason_bogus_str:"");
+	if(!ssl_printf(ssl, "msg %s %s %s %d %d " ARG_LL "d %d %u %u %u %d %s\n",
+			nm, cl, tp,
+			(int)d->flags, (int)d->qdcount, 
+			(long long)(d->ttl-now), (int)d->security,
+			(unsigned)d->an_numrrsets,
+			(unsigned)d->ns_numrrsets,
+			(unsigned)d->ar_numrrsets,
+			(int)d->reason_bogus,
+			d->reason_bogus_str?d->reason_bogus_str:"")) {
+		free(nm);
+		free(tp);
+		free(cl);
+		rrset_array_unlock(d->ref, d->rrset_count);
+		return 0;
+	}
 	free(nm);
 	free(tp);
 	free(cl);
 	
 	for(i=0; i<d->rrset_count; i++) {
-		dump_msg_ref(txt, d->rrsets[i]);
+		if(!dump_msg_ref(ssl, d->rrsets[i])) {
+			rrset_array_unlock(d->ref, d->rrset_count);
+			return 0;
+		}
 	}
 	rrset_array_unlock(d->ref, d->rrset_count);
+
+	return 1;
 }

 /** copy msg to worker pad */
@@ -379,40 +247,49 @@ copy_msg(struct regional* region, struct lruhash_entry* e,
 	return (*k)->qname != NULL;
 }

-/** Dump the msg entry. */
-static void
-dump_msg_entry(struct lruhash_entry* e, struct config_strlist_head* txt,
-	void* arg)
+/** dump lruhash msg cache */
+static int
+dump_msg_lruhash(RES* ssl, struct worker* worker, struct lruhash* h)
 {
-	struct dump_info* dump_info = (struct dump_info*)arg;
+	struct lruhash_entry* e;
 	struct query_info* k;
 	struct reply_info* d;

-	regional_free_all(dump_info->worker->scratchpad);
-	/* Make copy of rrset in worker buffer. */
-	lock_rw_rdlock(&e->lock);
-	if(!copy_msg(dump_info->worker->scratchpad, e, &k, &d)) {
+	/* lruhash already locked by caller */
+	/* walk in order of lru; best first */
+	for(e=h->lru_start; e; e = e->lru_next) {
+		regional_free_all(worker->scratchpad);
+		lock_rw_rdlock(&e->lock);
+		/* make copy of rrset in worker buffer */
+		if(!copy_msg(worker->scratchpad, e, &k, &d)) {
+			lock_rw_unlock(&e->lock);
+			return 0;
+		}
 		lock_rw_unlock(&e->lock);
-		log_err("out of memory in dump_msg_entry");
-		return;
+		/* release lock so we can lookup the rrset references 
+		 * in the rrset cache */
+		if(!dump_msg(ssl, k, d, *worker->env.now)) {
+			return 0;
+		}
 	}
-	lock_rw_unlock(&e->lock);
-	/* Release lock so we can lookup the rrset references
-	 * in the rrset cache. */
-	dump_msg(txt, k, d, *dump_info->worker->env.now);
+	return 1;
 }

 /** dump msg cache */
 static int
 dump_msg_cache(RES* ssl, struct worker* worker)
 {
-	struct dump_info dump_info;
-	dump_info.worker = worker;
-	dump_info.ssl = ssl;
+	struct slabhash* sh = worker->env.msg_cache;
+	size_t slab;
 	if(!ssl_printf(ssl, "START_MSG_CACHE\n")) return 0;
-	if(!dump_slabhash(worker->env.msg_cache, &dump_msg_entry, ssl,
-		&dump_info))
-		return 0;
+	for(slab=0; slab<sh->size; slab++) {
+		lock_quick_lock(&sh->array[slab]->lock);
+		if(!dump_msg_lruhash(ssl, worker, sh->array[slab])) {
+			lock_quick_unlock(&sh->array[slab]->lock);
+			return 0;
+		}
+		lock_quick_unlock(&sh->array[slab]->lock);
+	}
 	return ssl_printf(ssl, "END_MSG_CACHE\n");
 }

@@ -455,7 +332,7 @@ load_rr(RES* ssl, sldns_buffer* buf, struct regional* region,
 	/* read the line */
 	if(!ssl_read_buf(ssl, buf))
 		return 0;
-	if(strcmp((char*)sldns_buffer_begin(buf), "BADRR") == 0) {
+	if(strncmp((char*)sldns_buffer_begin(buf), "BADRR\n", 6) == 0) {
 		*go_on = 0;
 		return 1;
 	}
@@ -815,7 +692,7 @@ load_msg(RES* ssl, sldns_buffer* buf, struct worker* worker)
 		return 1; /* skip this one, not all references satisfied */

 	if(!dns_cache_store(&worker->env, &qinf, &rep, 0, 0, 0, NULL, flags,
-		*worker->env.now, 1)) {
+		*worker->env.now)) {
 		log_warn("error out of memory");
 		return 0;
 	}
@@ -934,18 +811,12 @@ print_dp_main(RES* ssl, struct delegpt* dp, struct dns_msg* msg)
 		struct ub_packed_rrset_key* k = msg->rep->rrsets[i];
 		struct packed_rrset_data* d = 
 			(struct packed_rrset_data*)k->entry.data;
-		struct config_strlist_head txt;
-		memset(&txt, 0, sizeof(txt));
 		if(d->security == sec_status_bogus) {
 			if(!ssl_printf(ssl, "Address is BOGUS:\n"))
 				return;
 		}
-		dump_rrset(&txt, k, d, 0);
-		if(!spool_strlist(ssl, txt.first)) {
-			config_delstrlist(txt.first);
+		if(!dump_rrset(ssl, k, d, 0))
 			return;
-		}
-		config_delstrlist(txt.first);
 	    }
 	delegpt_count_ns(dp, &n_ns, &n_miss);
 	delegpt_count_addr(dp, &n_addr, &n_res, &n_avail);
@@ -965,7 +836,7 @@ int print_deleg_lookup(RES* ssl, struct worker* worker, uint8_t* nm,
 	struct delegpt* dp;
 	struct dns_msg* msg;
 	struct regional* region = worker->scratchpad;
-	char b[LDNS_MAX_DOMAINLEN];
+	char b[260];
 	struct query_info qinfo;
 	struct iter_hints_stub* stub;
 	int nolock = 0;
@@ -79,14 +79,12 @@
 #include "util/tcp_conn_limit.h"
 #include "util/edns.h"
 #include "services/listen_dnsport.h"
-#include "services/outside_network.h"
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
 #include "services/localzone.h"
 #include "services/view.h"
 #include "services/modstack.h"
 #include "services/authzone.h"
-#include "services/authload.h"
 #include "util/module.h"
 #include "util/random.h"
 #include "util/tube.h"
@@ -201,267 +199,6 @@ signal_handling_playback(struct worker* wrk)
 	sig_record_reload = 0;
 }

-#ifdef HAVE_SSL
-/* setup a listening ssl context, fatal_exit() on any failure */
-static void
-setup_listen_sslctx(void** ctx, int is_dot, int is_doh,
-	struct config_file* cfg, char* chroot)
-{
-	char* key = cfg->ssl_service_key;
-	char* pem = cfg->ssl_service_pem;
-	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-		key += strlen(chroot);
-	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-		pem += strlen(chroot);
-	if(!(*ctx = listen_sslctx_create(key, pem, NULL,
-		cfg->tls_ciphers, cfg->tls_ciphersuites,
-		(cfg->tls_session_ticket_keys.first &&
-		cfg->tls_session_ticket_keys.first->str[0] != 0),
-		is_dot, is_doh, cfg->tls_protocols))) {
-		log_err("could not set up listen SSL_CTX");
-		*ctx = NULL;
-	}
-}
-#endif /* HAVE_SSL */
-
-#ifdef HAVE_SSL
-void* daemon_setup_listen_dot_sslctx(struct daemon* daemon,
-	struct config_file* cfg)
-{
-	void* ctx;
-	(void)setup_listen_sslctx(&ctx, 1, 0, cfg, daemon->chroot);
-	return ctx;
-}
-#endif /* HAVE_SSL */
-
-#ifdef HAVE_SSL
-#ifdef HAVE_NGHTTP2_NGHTTP2_H
-void* daemon_setup_listen_doh_sslctx(struct daemon* daemon,
-	struct config_file* cfg)
-{
-	void* ctx;
-	(void)setup_listen_sslctx(&ctx, 0, 1, cfg, daemon->chroot);
-	return ctx;
-}
-#endif /* HAVE_NGHTTP2_NGHTTP2_H */
-#endif /* HAVE_SSL */
-
-#ifdef HAVE_SSL
-#ifdef HAVE_NGTCP2
-void* daemon_setup_listen_quic_sslctx(struct daemon* daemon,
-	struct config_file* cfg)
-{
-	void* ctx;
-	char* chroot = daemon->chroot;
-	char* key = cfg->ssl_service_key;
-	char* pem = cfg->ssl_service_pem;
-	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-		key += strlen(chroot);
-	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-		pem += strlen(chroot);
-
-	if(!(ctx = quic_sslctx_create(key, pem, NULL))) {
-		log_err("could not set up quic SSL_CTX");
-		return NULL;
-	}
-	return ctx;
-}
-#endif /* HAVE_NGTCP2 */
-#endif /* HAVE_SSL */
-
-#ifdef HAVE_SSL
-void* daemon_setup_connect_dot_sslctx(struct daemon* daemon,
-	struct config_file* cfg)
-{
-	void* ctx;
-	char* bundle, *chroot = daemon->chroot;
-	bundle = cfg->tls_cert_bundle;
-	if(chroot && bundle && strncmp(bundle, chroot, strlen(chroot)) == 0)
-		bundle += strlen(chroot);
-
-	if(!(ctx = connect_sslctx_create(NULL, NULL, bundle,
-		cfg->tls_win_cert))) {
-		log_err("could not set up connect SSL_CTX");
-		return NULL;
-	}
-	return ctx;
-}
-#endif /* HAVE_SSL */
-
-/* setups the needed ssl contexts, fatal_exit() on any failure */
-void
-daemon_setup_sslctxs(struct daemon* daemon, struct config_file* cfg)
-{
-#ifdef HAVE_SSL
-	char* chroot = daemon->chroot;
-	if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
-		char* key = cfg->ssl_service_key;
-		char* pem = cfg->ssl_service_pem;
-		if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-			key += strlen(chroot);
-		if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-			pem += strlen(chroot);
-
-		/* setup the session keys; the callback to use them will be
-		 * attached to each sslctx separately */
-		if(cfg->tls_session_ticket_keys.first &&
-			cfg->tls_session_ticket_keys.first->str[0] != 0) {
-			if(!listen_sslctx_setup_ticket_keys(
-				cfg->tls_session_ticket_keys.first, chroot)) {
-				fatal_exit("could not set session ticket SSL_CTX");
-			}
-		}
-		daemon->listen_dot_sslctx = daemon_setup_listen_dot_sslctx(
-			daemon, cfg);
-		if(!daemon->listen_dot_sslctx)
-			fatal_exit("Could not set up listen dot sslctx");
-#ifdef HAVE_NGHTTP2_NGHTTP2_H
-		if(cfg_has_https(cfg)) {
-			daemon->listen_doh_sslctx =
-				daemon_setup_listen_doh_sslctx(daemon, cfg);
-			if(!daemon->listen_doh_sslctx)
-				fatal_exit("Could not set up listen doh sslctx");
-		}
-#endif
-#ifdef HAVE_NGTCP2
-		if(cfg_has_quic(cfg)) {
-			daemon->listen_quic_sslctx =
-				daemon_setup_listen_quic_sslctx(daemon, cfg);
-			if(!daemon->listen_quic_sslctx)
-				fatal_exit("Could not set up listen quic sslctx");
-		}
-#endif /* HAVE_NGTCP2 */
-
-		/* Store the file name and mtime to detect changes later. */
-		daemon->ssl_service_key = strdup(cfg->ssl_service_key);
-		if(!daemon->ssl_service_key)
-			fatal_exit("could not setup ssl ctx: out of memory");
-		if(cfg->ssl_service_pem) {
-			daemon->ssl_service_pem = strdup(cfg->ssl_service_pem);
-			if(!daemon->ssl_service_pem)
-				fatal_exit("could not setup ssl ctx: out of memory");
-		} else {
-			daemon->ssl_service_pem = NULL;
-		}
-		if(!file_get_mtime(key,
-			&daemon->mtime_ssl_service_key,
-			&daemon->mtime_ns_ssl_service_key, NULL))
-			log_err("Could not stat(%s): %s",
-				key, strerror(errno));
-		if(pem) {
-			if(!file_get_mtime(pem,
-				&daemon->mtime_ssl_service_pem,
-				&daemon->mtime_ns_ssl_service_pem, NULL))
-				log_err("Could not stat(%s): %s",
-					pem, strerror(errno));
-		} else {
-			daemon->mtime_ssl_service_pem = 0;
-			daemon->mtime_ns_ssl_service_pem = 0;
-		}
-	}
-	daemon->connect_dot_sslctx = daemon_setup_connect_dot_sslctx(
-		daemon, cfg);
-	if(!daemon->connect_dot_sslctx)
-		fatal_exit("could not setup connect dot sslctx");
-#else /* HAVE_SSL */
-	(void)daemon;(void)cfg;
-#endif /* HAVE_SSL */
-}
-
-/** Delete the ssl ctxs */
-static void
-daemon_delete_sslctxs(struct daemon* daemon)
-{
-#ifdef HAVE_SSL
-	listen_sslctx_delete_ticket_keys();
-	SSL_CTX_free((SSL_CTX*)daemon->listen_dot_sslctx);
-	daemon->listen_dot_sslctx = NULL;
-	SSL_CTX_free((SSL_CTX*)daemon->listen_doh_sslctx);
-	daemon->listen_doh_sslctx = NULL;
-	SSL_CTX_free((SSL_CTX*)daemon->connect_dot_sslctx);
-	daemon->connect_dot_sslctx = NULL;
-	free(daemon->ssl_service_key);
-	daemon->ssl_service_key = NULL;
-	free(daemon->ssl_service_pem);
-	daemon->ssl_service_pem = NULL;
-#else
-	(void)daemon;
-#endif
-#ifdef HAVE_NGTCP2
-	SSL_CTX_free((SSL_CTX*)daemon->listen_quic_sslctx);
-	daemon->listen_quic_sslctx = NULL;
-#endif
-}
-
-int
-ssl_cert_changed(struct daemon* daemon, struct config_file* cfg)
-{
-	time_t mtime = 0;
-	long ns = 0;
-	char* chroot = daemon->chroot;
-	char* key = cfg->ssl_service_key;
-	char* pem = cfg->ssl_service_pem;
-	log_assert(daemon->ssl_service_key && cfg->ssl_service_key);
-	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-		key += strlen(chroot);
-	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-		pem += strlen(chroot);
-
-	if(strcmp(daemon->ssl_service_key, cfg->ssl_service_key) != 0)
-		return 1;
-	if(daemon->ssl_service_pem && cfg->ssl_service_pem &&
-	   strcmp(daemon->ssl_service_pem, cfg->ssl_service_pem) != 0)
-		return 1;
-	if(!file_get_mtime(key, &mtime, &ns, NULL)) {
-		log_err("Could not stat(%s): %s",
-			key, strerror(errno));
-		/* It has probably changed, but file read is likely going to
-		 * fail. */
-		return 0;
-	}
-	if(mtime != daemon->mtime_ssl_service_key ||
-		ns != daemon->mtime_ns_ssl_service_key)
-		return 1;
-	if(pem) {
-		if(!file_get_mtime(pem, &mtime, &ns, NULL)) {
-			log_err("Could not stat(%s): %s",
-				pem, strerror(errno));
-			/* It has probably changed, but file read is likely going to
-			 * fail. */
-			return 0;
-		}
-		if(mtime != daemon->mtime_ssl_service_pem ||
-			ns != daemon->mtime_ns_ssl_service_pem)
-			return 1;
-	}
-	return 0;
-}
-
-/** Reload the sslctxs if they have changed */
-static void
-daemon_reload_sslctxs(struct daemon* daemon)
-{
-#ifdef HAVE_SSL
-	if(daemon->cfg->ssl_service_key && daemon->cfg->ssl_service_key[0]) {
-		/* See if changed */
-		if(!daemon->ssl_service_key ||
-			ssl_cert_changed(daemon,daemon->cfg)) {
-			verbose(VERB_ALGO, "Reloading certificates");
-			daemon_delete_sslctxs(daemon);
-			daemon_setup_sslctxs(daemon, daemon->cfg);
-		}
-	} else {
-		/* See if sslctxs are removed from config. */
-		if(daemon->ssl_service_key) {
-			verbose(VERB_ALGO, "Removing certificates");
-			daemon_delete_sslctxs(daemon);
-		}
-	}
-#else
-	(void)daemon;
-#endif
-}
-
 struct daemon* 
 daemon_init(void)
 {
@@ -498,11 +235,7 @@ daemon_init(void)
 #  else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#    if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#    endif
-		, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #  endif
 #  if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
 	/* grab the COMP method ptr because openssl leaks it */
@@ -511,11 +244,7 @@ daemon_init(void)
 #  if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #  else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#    if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#    endif
-		, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #  endif
 #  if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
 	if(!ub_openssl_lock_init())
@@ -591,21 +320,11 @@ daemon_init(void)
 		free(daemon);
 		return NULL;
 	}
-	if(!(daemon->auth_load_info = auth_load_info_create())) {
-		edns_strings_delete(daemon->env->edns_strings);
-		auth_zones_delete(daemon->env->auth_zones);
-		acl_list_delete(daemon->acl_interface);
-		acl_list_delete(daemon->acl);
-		tcl_list_delete(daemon->tcl);
-		edns_known_options_delete(daemon->env);
-		free(daemon->env);
-		free(daemon);
-		return NULL;
-	}
 	return daemon;	
 }

-int setup_acl_for_ports(struct acl_list* list, struct listen_port* port_list)
+static int setup_acl_for_ports(struct acl_list* list,
+	struct listen_port* port_list)
 {
 	struct acl_addr* acl_node;
 	for(; port_list; port_list=port_list->next) {
@@ -625,7 +344,7 @@ int setup_acl_for_ports(struct acl_list* list, struct listen_port* port_list)
 	return 1;
 }

-int
+int 
 daemon_open_shared_ports(struct daemon* daemon)
 {
 	log_assert(daemon);
@@ -725,19 +444,6 @@ daemon_open_shared_ports(struct daemon* daemon)
 	return 1;
 }

-int
-daemon_privileged(struct daemon* daemon)
-{
-	daemon->env->cfg = daemon->cfg;
-	daemon->env->alloc = &daemon->superalloc;
-	daemon->env->worker = NULL;
-	if(!modstack_call_startup(&daemon->mods, daemon->cfg->module_conf,
-		daemon->env)) {
-		fatal_exit("failed to startup modules");
-	}
-	return 1;
-}
-
 /**
 * Setup modules. setup module stack.
 * @param daemon: the daemon
@@ -747,15 +453,11 @@ static void daemon_setup_modules(struct daemon* daemon)
 	daemon->env->cfg = daemon->cfg;
 	daemon->env->alloc = &daemon->superalloc;
 	daemon->env->worker = NULL;
-	if(daemon->mods_inited) {
-		modstack_call_deinit(&daemon->mods, daemon->env);
-	}
 	daemon->env->need_to_validate = 0; /* set by module init below */
-	if(!modstack_call_init(&daemon->mods, daemon->cfg->module_conf,
+	if(!modstack_setup(&daemon->mods, daemon->cfg->module_conf, 
 		daemon->env)) {
-		fatal_exit("failed to init modules");
+		fatal_exit("failed to setup modules");
 	}
-	daemon->mods_inited = 1;
 	log_edns_known_options(VERB_ALGO, daemon->env);
 }

@@ -801,10 +503,7 @@ daemon_clear_allocs(struct daemon* daemon)
 {
 	int i;

-	/* daemon->num may be different during reloads (after configuration
-	 * read). Use old_num which has the correct value used to setup the
-	 * worker_allocs */
-	for(i=0; i<daemon->old_num; i++) {
+	for(i=0; i<daemon->num; i++) {
 		alloc_clear(daemon->worker_allocs[i]);
 		free(daemon->worker_allocs[i]);
 	}
@@ -838,18 +537,6 @@ daemon_create_workers(struct daemon* daemon)
 		fatal_exit("out of memory during daemon init");
 	numport = daemon_get_shufport(daemon, shufport);
 	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
-	if(!(daemon->shared_ports = shared_ports_create(daemon->cfg->out_ifs,
-		daemon->cfg->num_out_ifs, daemon->cfg->do_ip4,
-		daemon->cfg->do_ip6, shufport, numport)))
-		fatal_exit("could not setup shared ports: out of memory");
-
-#ifdef HAVE_NGTCP2
-	if (cfg_has_quic(daemon->cfg)) {
-		daemon->doq_table = doq_table_create(daemon->cfg, daemon->rand);
-		if(!daemon->doq_table)
-			fatal_exit("could not create doq_table: out of memory");
-	}
-#endif
 	
 	daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1);
 	if(daemon->reuseport && (int)daemon->num < (int)daemon->num_ports) {
@@ -872,7 +559,10 @@ daemon_create_workers(struct daemon* daemon)
 #endif
 	}
 	for(i=0; i<daemon->num; i++) {
-		if(!(daemon->workers[i] = worker_create(daemon, i)))
+		if(!(daemon->workers[i] = worker_create(daemon, i,
+			shufport+numport*i/daemon->num, 
+			numport*(i+1)/daemon->num - numport*i/daemon->num)))
+			/* the above is not ports/numthr, due to rounding */
 			fatal_exit("could not create worker");
 	}
 	/* create per-worker alloc caches if not reusing existing ones. */
@@ -916,25 +606,6 @@ static void close_other_pipes(struct daemon* daemon, int thr)
 }
 #endif /* THREADS_DISABLED */

-/**
- * Function to set the thread local log ID.
- * Either the internal thread number, or the LWP ID on Linux based on
- * configuration.
- */
-static void
-set_log_thread_id(struct worker* worker, struct config_file* cfg)
-{
-	(void)cfg;
-	log_assert(worker);
-#if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
-	worker->thread_tid = gettid();
-	if(cfg->log_thread_id)
-		log_thread_set(&worker->thread_tid);
-	else
-#endif
-		log_thread_set(&worker->thread_num);
-}
-
 /**
 * Function to start one thread. 
 * @param arg: user argument.
@@ -945,15 +616,7 @@ thread_start(void* arg)
 {
 	struct worker* worker = (struct worker*)arg;
 	int port_num = 0;
-	set_log_thread_id(worker, worker->daemon->cfg);
-	{
-		char name[16]; /* seems to be the safest size between
-				  different OSes */
-		snprintf(name, sizeof(name), "unbound/%u", worker->thread_num);
-		/* worker->thr_id can be written to after the thread was made
-		 * by the creating thread, so this uses pthread_self. */
-		ub_thread_setname(ub_thread_self(), name);
-	}
+	log_thread_set(&worker->thread_num);
 	ub_thread_blocksigs();
 #ifdef THREADS_DISABLED
 	/* close pipe ends used by main */
@@ -967,9 +630,8 @@ thread_start(void* arg)
 		port_num = 0;
 #endif
 	if(!worker_init(worker, worker->daemon->cfg,
-			worker->daemon->ports[port_num], 0)) {
+			worker->daemon->ports[port_num], 0))
 		fatal_exit("Could not initialize thread");
-	}

 	worker_work(worker);
 	return NULL;
@@ -1029,17 +691,16 @@ daemon_fork(struct daemon* daemon)
 #endif

 	log_assert(daemon);
-	daemon_reload_sslctxs(daemon);
-	if(!(daemon->env->views = views_create()))
+	if(!(daemon->views = views_create()))
 		fatal_exit("Could not create views: out of memory");
 	/* create individual views and their localzone/data trees */
-	if(!views_apply_cfg(daemon->env->views, daemon->cfg))
+	if(!views_apply_cfg(daemon->views, daemon->cfg))
 		fatal_exit("Could not set up views");

-	if(!acl_list_apply_cfg(daemon->acl, daemon->cfg, daemon->env->views))
+	if(!acl_list_apply_cfg(daemon->acl, daemon->cfg, daemon->views))
 		fatal_exit("Could not setup access control list");
 	if(!acl_interface_apply_cfg(daemon->acl_interface, daemon->cfg,
-		daemon->env->views))
+		daemon->views))
 		fatal_exit("Could not setup interface control list");
 	if(!tcl_list_apply_cfg(daemon->tcl, daemon->cfg))
 		fatal_exit("Could not setup TCP connection limits");
@@ -1054,14 +715,6 @@ daemon_fork(struct daemon* daemon)
 				   "dnscrypt support");
 #endif
 	}
-	if(daemon->cfg->cookie_secret_file &&
-		daemon->cfg->cookie_secret_file[0]) {
-		if(!(daemon->cookie_secrets = cookie_secrets_create()))
-			fatal_exit("Could not create cookie_secrets: out of memory");
-		if(!cookie_secrets_apply_cfg(daemon->cookie_secrets,
-			daemon->cfg->cookie_secret_file))
-			fatal_exit("Could not setup cookie_secrets");
-	}
 	/* create global local_zones */
 	if(!(daemon->local_zones = local_zones_create()))
 		fatal_exit("Could not create local zones: out of memory");
@@ -1075,15 +728,15 @@ daemon_fork(struct daemon* daemon)
 		fatal_exit("Could not set root or stub hints");

 	/* process raw response-ip configuration data */
-	if(!(daemon->env->respip_set = respip_set_create()))
+	if(!(daemon->respip_set = respip_set_create()))
 		fatal_exit("Could not create response IP set");
-	if(!respip_global_apply_cfg(daemon->env->respip_set, daemon->cfg))
+	if(!respip_global_apply_cfg(daemon->respip_set, daemon->cfg))
 		fatal_exit("Could not set up response IP set");
-	if(!respip_views_apply_cfg(daemon->env->views, daemon->cfg,
+	if(!respip_views_apply_cfg(daemon->views, daemon->cfg,
 		&have_view_respip_cfg))
 		fatal_exit("Could not set up per-view response IP sets");
-	daemon->use_response_ip = !respip_set_is_empty(
-		daemon->env->respip_set) || have_view_respip_cfg;
+	daemon->use_response_ip = !respip_set_is_empty(daemon->respip_set) ||
+		have_view_respip_cfg;

 	/* setup modules */
 	daemon_setup_modules(daemon);
@@ -1115,25 +768,14 @@ daemon_fork(struct daemon* daemon)
 		fatal_exit("RPZ requires the respip module");

 	/* first create all the worker structures, so we can pass
-	 * them to the newly created threads.
+	 * them to the newly created threads. 
 	 */
 	daemon_create_workers(daemon);
-	/* Set it for the first (main) worker since it does not take part in
-	 * the thread_start() procedure.
-	 */
-	set_log_thread_id(daemon->workers[0], daemon->cfg);
-	/* If shm stats need an offset, calculate it */
-	if(daemon->cfg->shm_enable && daemon->cfg->stat_interval > 0) {
-		daemon->stat_time_specific = 1;
-		daemon->stat_time_offset =
-			((int)time(NULL))%daemon->cfg->stat_interval;
-	}

 #if defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
 	/* in libev the first inited base gets signals */
-	if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports[0], 1)) {
+	if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports[0], 1))
 		fatal_exit("Could not initialize main thread");
-	}
 #endif
 	
 	/* Now create the threads and init the workers.
@@ -1146,9 +788,8 @@ daemon_fork(struct daemon* daemon)
 	 */
 #if !(defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP))
 	/* libevent has the last inited base get signals (or any base) */
-	if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports[0], 1)) {
+	if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports[0], 1))
 		fatal_exit("Could not initialize main thread");
-	}
 #endif
 	signal_handling_playback(daemon->workers[0]);

@@ -1192,6 +833,7 @@ daemon_cleanup(struct daemon* daemon)
 	/* before stopping main worker, handle signals ourselves, so we
 	   don't die on multiple reload signals for example. */
 	signal_handling_record();
+	log_thread_set(NULL);
 	/* clean up caches because
 	 * a) RRset IDs will be recycled after a reload, causing collisions
 	 * b) validation config can change, thus rrset, msg, keycache clear
@@ -1210,18 +852,14 @@ daemon_cleanup(struct daemon* daemon)
 	daemon->env->hints = NULL;
 	local_zones_delete(daemon->local_zones);
 	daemon->local_zones = NULL;
-	respip_set_delete(daemon->env->respip_set);
-	daemon->env->respip_set = NULL;
-	views_delete(daemon->env->views);
-	daemon->env->views = NULL;
+	respip_set_delete(daemon->respip_set);
+	daemon->respip_set = NULL;
+	views_delete(daemon->views);
+	daemon->views = NULL;
 	if(daemon->env->auth_zones)
 		auth_zones_cleanup(daemon->env->auth_zones);
-	/* key cache is cleared by module deinit during next daemon_fork() */
+	/* key cache is cleared by module desetup during next daemon_fork() */
 	daemon_remote_clear(daemon->rc);
-	if(daemon->fast_reload_thread)
-		fast_reload_thread_stop(daemon->fast_reload_thread);
-	if(daemon->fast_reload_printq_list)
-		fast_reload_printq_list_delete(daemon->fast_reload_printq_list);
 	for(i=0; i<daemon->num; i++)
 		worker_delete(daemon->workers[i]);
 	free(daemon->workers);
@@ -1233,8 +871,6 @@ daemon_cleanup(struct daemon* daemon)
 	if(!daemon->reuse_cache || daemon->need_to_exit)
 		daemon_clear_allocs(daemon);
 	daemon->num = 0;
-	shared_ports_delete(daemon->shared_ports);
-	daemon->shared_ports = NULL;
 #ifdef USE_DNSTAP
 	dt_delete(daemon->dtenv);
 	daemon->dtenv = NULL;
@@ -1242,12 +878,6 @@ daemon_cleanup(struct daemon* daemon)
 #ifdef USE_DNSCRYPT
 	dnsc_delete(daemon->dnscenv);
 	daemon->dnscenv = NULL;
-#endif
-#ifdef HAVE_NGTCP2
-	if (daemon->doq_table) {
-		doq_table_delete(daemon->doq_table);
-		daemon->doq_table = NULL;
-	}
 #endif
 	daemon->cfg = NULL;
 }
@@ -1258,9 +888,7 @@ daemon_delete(struct daemon* daemon)
 	size_t i;
 	if(!daemon)
 		return;
-	modstack_call_deinit(&daemon->mods, daemon->env);
-	modstack_call_destartup(&daemon->mods, daemon->env);
-	modstack_free(&daemon->mods);
+	modstack_desetup(&daemon->mods, daemon->env);
 	daemon_remote_delete(daemon->rc);
 	for(i = 0; i < daemon->num_ports; i++)
 		listening_ports_free(daemon->ports[i]);
@@ -1274,19 +902,20 @@ daemon_delete(struct daemon* daemon)
 		edns_strings_delete(daemon->env->edns_strings);
 		auth_zones_delete(daemon->env->auth_zones);
 	}
-	auth_load_info_delete(daemon->auth_load_info);
 	ub_randfree(daemon->rand);
 	alloc_clear(&daemon->superalloc);
 	acl_list_delete(daemon->acl);
 	acl_list_delete(daemon->acl_interface);
 	tcl_list_delete(daemon->tcl);
-	cookie_secrets_delete(daemon->cookie_secrets);
 	listen_desetup_locks();
 	free(daemon->chroot);
 	free(daemon->pidfile);
-	free(daemon->cfgfile);
 	free(daemon->env);
-	daemon_delete_sslctxs(daemon);
+#ifdef HAVE_SSL
+	listen_sslctx_delete_ticket_keys();
+	SSL_CTX_free((SSL_CTX*)daemon->listen_sslctx);
+	SSL_CTX_free((SSL_CTX*)daemon->connect_sslctx);
+#endif
 	free(daemon);
 	/* lex cleanup */
 	ub_c_lex_destroy();
@@ -1298,7 +927,7 @@ daemon_delete(struct daemon* daemon)
 #  if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS && HAVE_DECL_SK_SSL_COMP_POP_FREE
 #    ifndef S_SPLINT_S
 #      if OPENSSL_VERSION_NUMBER < 0x10100000
-	sk_SSL_COMP_pop_free(comp_meth, (void(*)(SSL_COMP*))CRYPTO_free);
+	sk_SSL_COMP_pop_free(comp_meth, (void(*)())CRYPTO_free);
 #      endif
 #    endif
 #  endif
@@ -1321,9 +950,6 @@ daemon_delete(struct daemon* daemon)
 #  if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
 	ub_openssl_lock_delete();
 #  endif
-#ifdef HAVE_OPENSSL_CLEANUP
-	OPENSSL_cleanup();
-#endif
 #ifndef HAVE_ARC4RANDOM
 	_ARC4_LOCK_DESTROY();
 #endif
@@ -58,12 +58,6 @@ struct ub_randstate;
 struct daemon_remote;
 struct respip_set;
 struct shm_main_info;
-struct doq_table;
-struct cookie_secrets;
-struct fast_reload_thread;
-struct fast_reload_printq;
-struct auth_load_general_info;
-struct shared_ports;

 #include "dnstap/dnstap_config.h"
 #ifdef USE_DNSTAP
@@ -99,30 +93,10 @@ struct daemon {
 	int rc_port;
 	/** listening ports for remote control */
 	struct listen_port* rc_ports;
-	/** the shared ports structure, with random ports numbers. */
-	struct shared_ports* shared_ports;
 	/** remote control connections management (for first worker) */
 	struct daemon_remote* rc;
-	/** ssl context for listening to dnstcp over ssl */
-	void* listen_dot_sslctx;
-	/** ssl context for connecting to dnstcp over ssl */
-	void* connect_dot_sslctx;
-	/** ssl context for listening to DoH */
-	void* listen_doh_sslctx;
-	/** ssl context for listening to quic */
-	void* listen_quic_sslctx;
-	/** the file name that the ssl context is made with, private key. */
-	char* ssl_service_key;
-	/** the file name that the ssl context is made with, certificate. */
-	char* ssl_service_pem;
-	/** modification time for ssl_service_key, in sec and ns. Like
-	 * in a struct timespec, but without that for portability. */
-	time_t mtime_ssl_service_key;
-	long mtime_ns_ssl_service_key;
-	/** modification time for ssl_service_pem, in sec and ns. Like
-	 * in a struct timespec, but without that for portability. */
-	time_t mtime_ssl_service_pem;
-	long mtime_ns_ssl_service_pem;
+	/** ssl context for listening to dnstcp over ssl, and connecting ssl */
+	void* listen_sslctx, *connect_sslctx;
 	/** num threads allocated */
 	int num;
 	/** num threads allocated in the previous config or 0 at first */
@@ -141,8 +115,6 @@ struct daemon {
 	struct module_env* env;
 	/** stack of module callbacks */
 	struct module_stack mods;
-	/** The module stack has been inited */
-	int mods_inited;
 	/** access control, which client IPs are allowed to connect */
 	struct acl_list* acl;
 	/** access control, which interfaces are allowed to connect */
@@ -155,18 +127,15 @@ struct daemon {
 	struct timeval time_last_stat;
 	/** time when daemon started */
 	struct timeval time_boot;
+	/** views structure containing view tree */
+	struct views* views;
 #ifdef USE_DNSTAP
 	/** the dnstap environment master value, copied and changed by threads*/
 	struct dt_env* dtenv;
 #endif
-	/** The SHM info for shared memory stats. */
 	struct shm_main_info* shm_info;
-	/** if the timeout for statistics is attempted at specific offset.
-	 * If it is true, the stat timeout is the interval+offset, and that
-	 * picks (roughly) the same time offset every time period. */
-	int stat_time_specific;
-	/** if the timeout is specific, what offset in the period. */
-	int stat_time_offset;
+	/** response-ip set with associated actions and tags. */
+	struct respip_set* respip_set;
 	/** some response-ip tags or actions are configured if true */
 	int use_response_ip;
 	/** some RPZ policies are configured */
@@ -175,25 +144,8 @@ struct daemon {
 	/** the dnscrypt environment */
 	struct dnsc_env* dnscenv;
 #endif
-	/** the doq connection table */
-	struct doq_table* doq_table;
 	/** reuse existing cache on reload if other conditions allow it. */
 	int reuse_cache;
-	/** the EDNS cookie secrets from the cookie-secret-file */
-	struct cookie_secrets* cookie_secrets;
-	/** the fast reload thread, or NULL */
-	struct fast_reload_thread* fast_reload_thread;
-	/** the fast reload printq list */
-	struct fast_reload_printq* fast_reload_printq_list;
-	/** the fast reload option to drop mesh queries, true if so. */
-	int fast_reload_drop_mesh;
-	/** for fast reload, if the tcl, tcp connection limits, has
-	 * changes for workers */
-	int fast_reload_tcl_has_changes;
-	/** config file name */
-	char* cfgfile;
-	/** Auth load threads, the number of active threads. */
-	struct auth_load_general_info* auth_load_info;
 };

 /**
@@ -210,15 +162,6 @@ struct daemon* daemon_init(void);
 */
 int daemon_open_shared_ports(struct daemon* daemon);

-/**
- * Do daemon setup that needs privileges
- * like opening privileged ports or opening device files.
- * The cfg member pointer must have been set for the daemon.
- * @param daemon: the daemon.
- * @return: false on error.
- */
-int daemon_privileged(struct daemon* daemon);
-
 /**
 * Fork workers and start service.
 * When the routine exits, it is no longer forked.
@@ -246,34 +189,4 @@ void daemon_delete(struct daemon* daemon);
 */
 void daemon_apply_cfg(struct daemon* daemon, struct config_file* cfg);

-/**
- * Setup acl list to have entries for the port list.
- * @param list: the acl interface
- * @param port_list: list of open ports, or none.
- * @return false on failure
- */
-int setup_acl_for_ports(struct acl_list* list, struct listen_port* port_list);
-
-/* setups the needed ssl contexts, fatal_exit() on any failure */
-void daemon_setup_sslctxs(struct daemon* daemon, struct config_file* cfg);
-
-/** See if the SSL cert files have changed */
-int ssl_cert_changed(struct daemon* daemon, struct config_file* cfg);
-
-/** Setup the listening DoT SSL_CTX, returns the ssl ctx. */
-void* daemon_setup_listen_dot_sslctx(struct daemon* daemon,
-	struct config_file* cfg);
-
-/** Setup the listening DoH SSL_CTX, returns the ssl ctx. */
-void* daemon_setup_listen_doh_sslctx(struct daemon* daemon,
-	struct config_file* cfg);
-
-/** Setup the listening Quic SSL_CTX, returns the ssl ctx */
-void* daemon_setup_listen_quic_sslctx(struct daemon* daemon,
-	struct config_file* cfg);
-
-/** Setup the connect DoT SSL_CTX, returns the ssl ctx */
-void* daemon_setup_connect_dot_sslctx(struct daemon* daemon,
-	struct config_file* cfg);
-
 #endif /* DAEMON_H */
@@ -48,8 +48,6 @@
 #ifdef HAVE_OPENSSL_SSL_H
 #include <openssl/ssl.h>
 #endif
-#include "util/locks.h"
-#include "libunbound/remote.h"
 struct config_file;
 struct listen_list;
 struct listen_port;
@@ -57,7 +55,6 @@ struct worker;
 struct comm_reply;
 struct comm_point;
 struct daemon_remote;
-struct config_strlist_head;

 /** number of milliseconds timeout on incoming remote control handshake */
 #define REMOTE_CONTROL_TCP_TIMEOUT 120000
@@ -121,145 +118,6 @@ struct remote_stream {
 };
 typedef struct remote_stream RES;

-/**
- * Notification status. This is exchanged between the fast reload thread
- * and the server thread, over the commpair sockets.
- */
-enum fast_reload_notification {
-	/** nothing, not used */
-	fast_reload_notification_none = 0,
-	/** the fast reload thread is done */
-	fast_reload_notification_done = 1,
-	/** the fast reload thread is done but with an error, it failed */
-	fast_reload_notification_done_error = 2,
-	/** the fast reload thread is told to exit by the server thread.
-	 * Sent on server quit while the reload is running. */
-	fast_reload_notification_exit = 3,
-	/** the fast reload thread has exited, after being told to exit */
-	fast_reload_notification_exited = 4,
-	/** the fast reload thread has information to print out */
-	fast_reload_notification_printout = 5,
-	/** stop as part of the reload the thread and other threads */
-	fast_reload_notification_reload_stop = 6,
-	/** ack the stop as part of the reload, and also ack start */
-	fast_reload_notification_reload_ack = 7,
-	/** resume from stop as part of the reload */
-	fast_reload_notification_reload_start = 8,
-	/** the fast reload thread wants the mainthread to poll workers,
-	 * after the reload, sent when nopause is used */
-	fast_reload_notification_reload_nopause_poll = 9
-};
-
-/**
- * Fast reload printout queue. Contains a list of strings, that need to be
- * printed over the file descriptor.
- */
-struct fast_reload_printq {
-	/** if this item is in a list, the previous and next */
-	struct fast_reload_printq *prev, *next;
-	/** if this item is in a list, it is true. */
-	int in_list;
-	/** list of strings to printout */
-	struct config_strlist_head* to_print;
-	/** the current item to print. It is malloced. NULL if none. */
-	char* client_item;
-	/** The length, strlen, of the client_item, that has to be sent. */
-	int client_len;
-	/** The number of bytes sent of client_item. */
-	int client_byte_count;
-	/** the comm point for the client connection, the remote control
-	 * client. */
-	struct comm_point* client_cp;
-	/** the remote control connection to print output to. */
-	struct remote_stream remote;
-	/** the worker that the event is added in */
-	struct worker* worker;
-};
-
-/**
- * Fast reload auth zone change. Keeps track if an auth zone was removed,
- * added or changed. This is needed because workers can have events for
- * dealing with auth zones, like transfers, and those have to be removed
- * too, not just the auth zone structure from the tree. */
-struct fast_reload_auth_change {
-	/** next in the list of auth zone changes. */
-	struct fast_reload_auth_change* next;
-	/** the zone in the old config */
-	struct auth_zone* old_z;
-	/** the zone in the new config */
-	struct auth_zone* new_z;
-	/** if the zone was deleted */
-	int is_deleted;
-	/** if the zone was added */
-	int is_added;
-	/** if the zone has been changed */
-	int is_changed;
-};
-
-/**
- * Fast reload thread structure
- */
-struct fast_reload_thread {
-	/** the thread number for the dtio thread,
-	 * must be first to cast thread arg to int* in checklock code. */
-	int threadnum;
-	/** communication socket pair, that sends commands */
-	int commpair[2];
-	/** thread id, of the io thread */
-	ub_thread_type tid;
-#ifdef HAVE_GETTID
-	/** thread tid, the LWP id */
-	pid_t thread_tid;
-	/** if logging should include the LWP id */
-	int thread_tid_log;
-#endif
-	/** if the io processing has started */
-	int started;
-	/** if the thread has to quit */
-	int need_to_quit;
-	/** verbosity of the fast_reload command, the number of +v options */
-	int fr_verb;
-	/** option to not pause threads during reload */
-	int fr_nopause;
-	/** option to drop mesh queries */
-	int fr_drop_mesh;
-
-	/** the event that listens on the remote service worker to the
-	 * commpair, it receives content from the fast reload thread. */
-	void* service_event;
-	/** if the event that listens on the remote service worker has
-	 * been added to the comm base. */
-	int service_event_is_added;
-	/** the service event can read a cmd, nonblocking, so it can
-	 * save the partial read cmd here */
-	uint32_t service_read_cmd;
-	/** the number of bytes in service_read_cmd */
-	int service_read_cmd_count;
-	/** the worker that the service_event is added in */
-	struct worker* worker;
-
-	/** the printout of output to the remote client. */
-	struct fast_reload_printq *printq;
-
-	/** lock on fr_output, to stop race when both remote control thread
-	 * and fast reload thread use fr_output list. */
-	lock_basic_type fr_output_lock;
-	/** list of strings, that the fast reload thread produces that have
-	 * to be printed. The remote control thread can pick them up with
-	 * the lock. */
-	struct config_strlist_head* fr_output;
-
-	/** communication socket pair, to respond to the reload request */
-	int commreload[2];
-
-	/** the list of auth zone changes. */
-	struct fast_reload_auth_change* auth_zone_change_list;
-	/** the old tree of auth zones, to lookup. */
-	struct auth_zones* old_auth_zones;
-	/** If the ssl ctxs have changed. */
-	int sslctxs_changed;
-};
-
 /**
 * Create new remote control state for the daemon.
 * @param cfg: config file with key file settings.
@@ -345,31 +203,4 @@ int ssl_printf(RES* ssl, const char* format, ...)
 int ssl_read_line(RES* ssl, char* buf, size_t max);
 #endif /* HAVE_SSL */

-/**
- * Start fast reload thread
- * @param ssl: the RES connection to print to.
- * @param worker: the remote servicing worker.
- * @param s: the rc_state that is servicing the remote control connection to
- *	the remote control client. It needs to be moved away to stay connected
- *	while the fast reload is running.
- * @param fr_verb: verbosity to print output at. 0 is nothing, 1 is some
- *	and 2 is more detail.
- * @param fr_nopause: option to not pause threads during reload.
- * @param fr_drop_mesh: option to drop mesh queries.
- */
-void fast_reload_thread_start(RES* ssl, struct worker* worker,
-	struct rc_state* s, int fr_verb, int fr_nopause, int fr_drop_mesh);
-
-/**
- * Stop fast reload thread
- * @param fast_reload_thread: the thread struct.
- */
-void fast_reload_thread_stop(struct fast_reload_thread* fast_reload_thread);
-
-/** fast reload printq delete list */
-void fast_reload_printq_list_delete(struct fast_reload_printq* list);
-
-/** Pick up per worker changes after a fast reload. */
-void fast_reload_worker_pickup_changes(struct worker* worker);
-
 #endif /* DAEMON_REMOTE_H */
@@ -262,7 +262,6 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 	s->svr = worker->stats;
 	s->mesh_num_states = (long long)worker->env.mesh->all.count;
 	s->mesh_num_reply_states = (long long)worker->env.mesh->num_reply_states;
-	s->mesh_num_reply_addrs = (long long)worker->env.mesh->num_reply_addrs;
 	s->mesh_jostled = (long long)worker->env.mesh->stats_jostled;
 	s->mesh_dropped = (long long)worker->env.mesh->stats_dropped;
 	s->mesh_replies_sent = (long long)worker->env.mesh->replies_sent;
@@ -274,7 +273,6 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 	/* add in the values from the mesh */
 	s->svr.ans_secure += (long long)worker->env.mesh->ans_secure;
 	s->svr.ans_bogus += (long long)worker->env.mesh->ans_bogus;
-	s->svr.val_ops += (long long)worker->env.mesh->val_ops;
 	s->svr.ans_rcode_nodata += (long long)worker->env.mesh->ans_nodata;
 	s->svr.ans_expired += (long long)worker->env.mesh->ans_expired;
 	for(i=0; i<UB_STATS_RCODE_NUM; i++)
@@ -283,14 +281,6 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 		s->svr.rpz_action[i] += (long long)worker->env.mesh->rpz_action[i];
 	timehist_export(worker->env.mesh->histogram, s->svr.hist,
 		NUM_BUCKETS_HIST);
-	s->svr.num_queries_discard_timeout +=
-		(long long)worker->env.mesh->num_queries_discard_timeout;
-	s->svr.num_queries_replyaddr_limit +=
-		(long long)worker->env.mesh->num_queries_replyaddr_limit;
-	s->svr.num_queries_wait_limit +=
-		(long long)worker->env.mesh->num_queries_wait_limit;
-	s->svr.num_dns_error_reports +=
-		(long long)worker->env.mesh->num_dns_error_reports;
 	/* values from outside network */
 	s->svr.unwanted_replies = (long long)worker->back->unwanted_replies;
 	s->svr.qtcp_outgoing = (long long)worker->back->num_tcp_outgoing;
@@ -335,8 +325,20 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 	s->svr.num_query_dnscrypt_replay = 0;
 #endif /* USE_DNSCRYPT */
 	if(worker->env.auth_zones) {
-		s->svr.num_query_authzone_up += (long long)worker->env.mesh->num_query_authzone_up;
-		s->svr.num_query_authzone_down += (long long)worker->env.mesh->num_query_authzone_down;
+		if(reset && !worker->env.cfg->stat_cumulative) {
+			lock_rw_wrlock(&worker->env.auth_zones->lock);
+		} else {
+			lock_rw_rdlock(&worker->env.auth_zones->lock);
+		}
+		s->svr.num_query_authzone_up = (long long)worker->env.
+			auth_zones->num_query_up;
+		s->svr.num_query_authzone_down = (long long)worker->env.
+			auth_zones->num_query_down;
+		if(reset && !worker->env.cfg->stat_cumulative) {
+			worker->env.auth_zones->num_query_up = 0;
+			worker->env.auth_zones->num_query_down = 0;
+		}
+		lock_rw_unlock(&worker->env.auth_zones->lock);
 	}
 	s->svr.mem_stream_wait =
 		(long long)tcp_req_info_get_stream_buffer_size();
@@ -344,12 +346,6 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 		(long long)http2_get_query_buffer_size();
 	s->svr.mem_http2_response_buffer =
 		(long long)http2_get_response_buffer_size();
-#ifdef HAVE_NGTCP2
-	s->svr.mem_quic = (long long)doq_table_quic_size_get(
-		worker->daemon->doq_table);
-#else
-	s->svr.mem_quic = 0;
-#endif /* HAVE_NGTCP2 */

 	/* Set neg cache usage numbers */
 	set_neg_cache_stats(worker, &s->svr, reset);
@@ -395,13 +391,6 @@ void server_stats_obtain(struct worker* worker, struct worker* who,
 	else 	worker_send_cmd(who, worker_cmd_stats_noreset);
 	verbose(VERB_ALGO, "wait for stats reply");
 	if(tube_wait_timeout(worker->cmd, STATS_THREAD_WAIT) == 0) {
-#if defined(HAVE_PTHREAD) && defined(SIZEOF_PTHREAD_T) && defined(SIZEOF_UNSIGNED_LONG)
-#  if SIZEOF_PTHREAD_T == SIZEOF_UNSIGNED_LONG
-		unsigned long pthid = 0;
-		if(verbosity >= VERB_OPS)
-			memcpy(&pthid, &who->thr_id, sizeof(unsigned long));
-#  endif
-#endif
 		verbose(VERB_OPS, "no response from thread %d"
 #ifdef HAVE_GETTID
 			" LWP %u"
@@ -418,32 +407,16 @@ void server_stats_obtain(struct worker* worker, struct worker* who,
 #endif
 #if defined(HAVE_PTHREAD) && defined(SIZEOF_PTHREAD_T) && defined(SIZEOF_UNSIGNED_LONG)
 #  if SIZEOF_PTHREAD_T == SIZEOF_UNSIGNED_LONG
-			, pthid
+			, (unsigned long)*((unsigned long*)&who->thr_id)
 #  endif
 #endif
 			);
-		log_err("server_stats_obtain: no response from worker %d "
-			"(stats timeout); returning zero stats for this worker",
-			who->thread_num);
-		/* A later reply from the worker, would be sizeof stats reply,
-		 * and the worker_handle_control_cmd routine discards if
-		 * it is not a 4byte command, when that is received here. */
-		memset(s, 0, sizeof(*s));
-		return;
-	}
-	if(!tube_read_msg(worker->cmd, &reply, &len, 0)) {
-		log_err("server_stats_obtain: failed to read stats from worker "
-			"(tube read error); returning zero stats for this worker");
-		memset(s, 0, sizeof(*s));
-		return;
-	}
-	if(len != (uint32_t)sizeof(*s)) {
-		log_err("server_stats_obtain: wrong stats length %d (expected %d); "
-			"discarding", (int)len, (int)sizeof(*s));
-		free(reply);
-		memset(s, 0, sizeof(*s));
-		return;
 	}
+	if(!tube_read_msg(worker->cmd, &reply, &len, 0))
+		fatal_exit("failed to read stats over cmd channel");
+	if(len != (uint32_t)sizeof(*s))
+		fatal_exit("stats on cmd channel wrong length %d %d",
+			(int)len, (int)sizeof(*s));
 	memcpy(s, reply, (size_t)len);
 	free(reply);
 }
@@ -455,7 +428,7 @@ void server_stats_reply(struct worker* worker, int reset)
 	verbose(VERB_ALGO, "write stats replymsg");
 	if(!tube_write_msg(worker->daemon->workers[0]->cmd,
 		(uint8_t*)&s, sizeof(s), 0))
-		log_err("could not write stat values over cmd channel");
+		fatal_exit("could not write stat values over cmd channel");
 }

 void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
@@ -465,17 +438,9 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 	total->svr.num_queries_cookie_valid += a->svr.num_queries_cookie_valid;
 	total->svr.num_queries_cookie_client += a->svr.num_queries_cookie_client;
 	total->svr.num_queries_cookie_invalid += a->svr.num_queries_cookie_invalid;
-	total->svr.num_queries_discard_timeout +=
-		a->svr.num_queries_discard_timeout;
-	total->svr.num_queries_replyaddr_limit +=
-		a->svr.num_queries_replyaddr_limit;
-	total->svr.num_queries_wait_limit += a->svr.num_queries_wait_limit;
-	total->svr.num_dns_error_reports += a->svr.num_dns_error_reports;
 	total->svr.num_queries_missed_cache += a->svr.num_queries_missed_cache;
 	total->svr.num_queries_prefetch += a->svr.num_queries_prefetch;
 	total->svr.num_queries_timed_out += a->svr.num_queries_timed_out;
-	total->svr.num_query_authzone_up += a->svr.num_query_authzone_up;
-	total->svr.num_query_authzone_down += a->svr.num_query_authzone_down;
 	if (total->svr.max_query_time_us < a->svr.max_query_time_us)
 		total->svr.max_query_time_us = a->svr.max_query_time_us;
 	total->svr.sum_query_list_size += a->svr.sum_query_list_size;
@@ -483,9 +448,9 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 #ifdef USE_DNSCRYPT
 	total->svr.num_query_dnscrypt_crypted += a->svr.num_query_dnscrypt_crypted;
 	total->svr.num_query_dnscrypt_cert += a->svr.num_query_dnscrypt_cert;
-	total->svr.num_query_dnscrypt_cleartext +=
+	total->svr.num_query_dnscrypt_cleartext += \
 		a->svr.num_query_dnscrypt_cleartext;
-	total->svr.num_query_dnscrypt_crypted_malformed +=
+	total->svr.num_query_dnscrypt_crypted_malformed += \
 		a->svr.num_query_dnscrypt_crypted_malformed;
 #endif /* USE_DNSCRYPT */
 	/* the max size reached is upped to higher of both */
@@ -502,7 +467,6 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 		total->svr.qtls += a->svr.qtls;
 		total->svr.qtls_resume += a->svr.qtls_resume;
 		total->svr.qhttps += a->svr.qhttps;
-		total->svr.qquic += a->svr.qquic;
 		total->svr.qipv6 += a->svr.qipv6;
 		total->svr.qbit_QR += a->svr.qbit_QR;
 		total->svr.qbit_AA += a->svr.qbit_AA;
@@ -517,7 +481,6 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 		total->svr.ans_rcode_nodata += a->svr.ans_rcode_nodata;
 		total->svr.ans_secure += a->svr.ans_secure;
 		total->svr.ans_bogus += a->svr.ans_bogus;
-		total->svr.val_ops += a->svr.val_ops;
 		total->svr.unwanted_replies += a->svr.unwanted_replies;
 		total->svr.unwanted_queries += a->svr.unwanted_queries;
 		total->svr.tcp_accept_usage += a->svr.tcp_accept_usage;
@@ -540,7 +503,6 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)

 	total->mesh_num_states += a->mesh_num_states;
 	total->mesh_num_reply_states += a->mesh_num_reply_states;
-	total->mesh_num_reply_addrs += a->mesh_num_reply_addrs;
 	total->mesh_jostled += a->mesh_jostled;
 	total->mesh_dropped += a->mesh_dropped;
 	total->mesh_replies_sent += a->mesh_replies_sent;
@@ -564,8 +526,7 @@ void server_stats_insquery(struct ub_server_stats* stats, struct comm_point* c,
 	else	stats->qclass_big++;
 	stats->qopcode[ LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) ]++;
 	if(c->type != comm_udp) {
-		if(c->type != comm_doq)
-			stats->qtcp++;
+		stats->qtcp++;
 		if(c->ssl != NULL) {
 			stats->qtls++;
 #ifdef HAVE_SSL
@@ -574,10 +535,6 @@ void server_stats_insquery(struct ub_server_stats* stats, struct comm_point* c,
 #endif
 			if(c->type == comm_http)
 				stats->qhttps++;
-#ifdef HAVE_NGTCP2
-			else if(c->type == comm_doq)
-				stats->qquic++;
-#endif
 		}
 	}
 	if(repinfo && addr_is_ip6(&repinfo->remote_addr, repinfo->remote_addrlen))
@@ -174,7 +174,7 @@ static void
 checkrlimits(struct config_file* cfg)
 {
 #ifndef S_SPLINT_S
-#if defined(HAVE_GETRLIMIT) && !defined(unbound_testbound)
+#ifdef HAVE_GETRLIMIT
 	/* list has number of ports to listen to, ifs number addresses */
 	int list = ((cfg->do_udp?1:0) + (cfg->do_tcp?1 + 
 			(int)cfg->incoming_num_tcp:0));
@@ -463,18 +463,6 @@ detach(void)
 #endif /* HAVE_DAEMON */
 }

-/** setup the remote and ticket keys */
-static void
-setup_sslctx_remote(struct daemon* daemon, struct config_file* cfg)
-{
-#ifdef HAVE_SSL
-	if(!(daemon->rc = daemon_remote_create(cfg)))
-		fatal_exit("could not set up remote-control");
-#else /* HAVE_SSL */
-	(void)daemon;(void)cfg;
-#endif /* HAVE_SSL */
-}
-
 /** daemonize, drop user privileges and chroot if needed */
 static void
 perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
@@ -485,11 +473,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #endif
 #ifdef HAVE_GETPWNAM
 	struct passwd *pwd = NULL;
-#endif

-	if(!daemon_privileged(daemon))
-		fatal_exit("could not do privileged setup");
-#ifdef HAVE_GETPWNAM
 	if(cfg->username && cfg->username[0]) {
 		if((pwd = getpwnam(cfg->username)) == NULL)
 			fatal_exit("user '%s' does not exist.", cfg->username);
@@ -501,8 +485,36 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #endif

 	/* read ssl keys while superuser and outside chroot */
-	setup_sslctx_remote(daemon, cfg);
-	daemon_setup_sslctxs(daemon, cfg);
+#ifdef HAVE_SSL
+	if(!(daemon->rc = daemon_remote_create(cfg)))
+		fatal_exit("could not set up remote-control");
+	if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
+		if(!(daemon->listen_sslctx = listen_sslctx_create(
+			cfg->ssl_service_key, cfg->ssl_service_pem, NULL)))
+			fatal_exit("could not set up listen SSL_CTX");
+		if(cfg->tls_ciphers && cfg->tls_ciphers[0]) {
+			if (!SSL_CTX_set_cipher_list(daemon->listen_sslctx, cfg->tls_ciphers)) {
+				fatal_exit("failed to set tls-cipher %s", cfg->tls_ciphers);
+			}
+		}
+#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
+		if(cfg->tls_ciphersuites && cfg->tls_ciphersuites[0]) {
+			if (!SSL_CTX_set_ciphersuites(daemon->listen_sslctx, cfg->tls_ciphersuites)) {
+				fatal_exit("failed to set tls-ciphersuites %s", cfg->tls_ciphersuites);
+			}
+		}
+#endif
+		if(cfg->tls_session_ticket_keys.first &&
+			cfg->tls_session_ticket_keys.first->str[0] != 0) {
+			if(!listen_sslctx_setup_ticket_keys(daemon->listen_sslctx, cfg->tls_session_ticket_keys.first)) {
+				fatal_exit("could not set session ticket SSL_CTX");
+			}
+		}
+	}
+	if(!(daemon->connect_sslctx = connect_sslctx_create(NULL, NULL,
+		cfg->tls_cert_bundle, cfg->tls_win_cert)))
+		fatal_exit("could not set up connect SSL_CTX");
+#endif

 	/* init syslog (as root) if needed, before daemonize, otherwise
 	 * a fork error could not be printed since daemonize closed stderr.*/
@@ -665,9 +677,6 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 	 * it would succeed on SIGHUP as well */
 	if(!cfg->use_syslog)
 		log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
-	daemon->cfgfile = strdup(*cfgfile);
-	if(!daemon->cfgfile)
-		fatal_exit("out of memory in daemon cfgfile strdup");
 }

 /**
@@ -702,7 +711,6 @@ run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode, int need_pi
 					"the commandline to see more errors, "
 					"or unbound-checkconf", cfgfile);
 			log_warn("Continuing with default config settings");
-			config_auto_slab_values(cfg);
 		}
 		apply_settings(daemon, cfg, cmdline_verbose, debug_mode);
 		if(!done_setup)
@@ -160,11 +160,9 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 		+ sizeof(worker->rndstate)
 		+ regional_get_mem(worker->scratchpad)
 		+ sizeof(*worker->env.scratch_buffer)
-		+ sldns_buffer_capacity(worker->env.scratch_buffer);
-	if(worker->daemon->env->fwds)
-		log_info("forwards=%u", (unsigned)forwards_get_mem(worker->env.fwds));
-	if(worker->daemon->env->hints)
-		log_info("hints=%u", (unsigned)hints_get_mem(worker->env.hints));
+		+ sldns_buffer_capacity(worker->env.scratch_buffer)
+		+ forwards_get_mem(worker->env.fwds)
+		+ hints_get_mem(worker->env.hints);
 	if(worker->thread_num == 0)
 		me += acl_list_get_mem(worker->daemon->acl);
 	if(cur_serv) {
@@ -255,8 +253,7 @@ worker_handle_service_reply(struct comm_point* c, void* arg, int error,
 		return 0;
 	}
 	/* sanity check. */
-	if(sldns_buffer_limit(c->buffer) < LDNS_HEADER_SIZE
-		|| !LDNS_QR_WIRE(sldns_buffer_begin(c->buffer))
+	if(!LDNS_QR_WIRE(sldns_buffer_begin(c->buffer))
 		|| LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) !=
 			LDNS_PACKET_QUERY
 		|| LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) > 1) {
@@ -293,44 +290,6 @@ worker_err_ratelimit(struct worker* worker, int err)
 	return err;
 }

-/**
- * Reply with an error.
- * This reply includes the qname if it has been parsed.
- * For error ratelimiting, the err ratelimit routine should be checked
- * beforehand. The reply is without EDNS, and copies RD and sets QR flag.
- * @param pkt: the packet buffer from the comm point.
- * @param err: the error code that would be wanted.
- * @param qname_len: 0 if not parsed, and the qname length in packet.
- */
-static void
-query_error(sldns_buffer* pkt, int err, size_t qname_len)
-{
-	/* Preserve the RD flag.
-	 * The CD flag must be cleared in authoritative answers,
-	 * also the AD flag need not be copied into answers.
-	 * The other flags need not be copied into the answer. */
-	sldns_buffer_write_u16_at(pkt, 2,
-		sldns_buffer_read_u16_at(pkt, 2)&0x0100U);
-	LDNS_QR_SET(sldns_buffer_begin(pkt)); /* Set QR flag. */
-	LDNS_RCODE_SET(sldns_buffer_begin(pkt), err); /* Set rcode */
-
-	if(qname_len && LDNS_QDCOUNT(sldns_buffer_begin(pkt))>=1 &&
-		qname_len <= LDNS_MAX_DOMAINLEN) {
-		/* Copy query into the answer. */
-		LDNS_QDCOUNT_SET(sldns_buffer_begin(pkt), 1);
-		sldns_buffer_set_position(pkt, LDNS_HEADER_SIZE +
-			qname_len + 2 /* type */ + 2 /* class */ );
-	} else {
-		/* No query section in answer. */
-		LDNS_QDCOUNT_SET(sldns_buffer_begin(pkt), 0);
-		sldns_buffer_set_position(pkt, LDNS_HEADER_SIZE);
-	}
-	LDNS_ANCOUNT_SET(sldns_buffer_begin(pkt), 0);
-	LDNS_NSCOUNT_SET(sldns_buffer_begin(pkt), 0);
-	LDNS_ARCOUNT_SET(sldns_buffer_begin(pkt), 0);
-	sldns_buffer_flip(pkt);
-}
-
 /**
 * Structure holding the result of the worker_check_request function.
 * Based on configuration it could be called up to four times; ideally should
@@ -368,6 +327,7 @@ worker_check_request(sldns_buffer* pkt, struct worker* worker,
 		return;
 	}
 	if(LDNS_TC_WIRE(sldns_buffer_begin(pkt))) {
+		LDNS_TC_CLR(sldns_buffer_begin(pkt));
 		verbose(VERB_QUERY, "request bad, has TC bit on");
 		out->value = worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 		return;
@@ -409,84 +369,6 @@ worker_check_request(sldns_buffer* pkt, struct worker* worker,
 	return;
 }

-/**
- * Send fast-reload acknowledgement to the mainthread in one byte.
- * This signals that this worker has received the previous command.
- * The worker is waiting if that is after a reload_stop command.
- * Or the worker has briefly processed the event itself, and in doing so
- * released data pointers to old config, after a reload_poll command.
- */
-static void
-worker_send_reload_ack(struct worker* worker)
-{
-	/* If this is clipped to 8 bits because thread_num>255, then that
-	 * is not a problem, the receiver counts the number of bytes received.
-	 * The number is informative only. */
-	uint8_t c = (uint8_t)worker->thread_num;
-	ssize_t ret;
-	while(1) {
-		ret = send(worker->daemon->fast_reload_thread->commreload[1],
-			(void*)&c, 1, 0);
-		if(ret == -1) {
-			if(
-#ifndef USE_WINSOCK
-				errno == EINTR || errno == EAGAIN
-#  ifdef EWOULDBLOCK
-				|| errno == EWOULDBLOCK
-#  endif
-#else
-				WSAGetLastError() == WSAEINTR ||
-				WSAGetLastError() == WSAEINPROGRESS ||
-				WSAGetLastError() == WSAEWOULDBLOCK
-#endif
-				)
-				continue; /* Try again. */
-			log_err("worker reload ack reply: send failed: %s",
-				sock_strerror(errno));
-			break;
-		}
-		break;
-	}
-}
-
-/** stop and wait to resume the worker */
-static void
-worker_stop_and_wait(struct worker* worker)
-{
-	uint8_t* buf = NULL;
-	uint32_t len = 0, cmd;
-	worker_send_reload_ack(worker);
-	/* wait for reload */
-	if(!tube_read_msg(worker->cmd, &buf, &len, 0)) {
-		log_err("worker reload read reply failed");
-		return;
-	}
-	if(len != sizeof(uint32_t)) {
-		log_err("worker reload reply, bad control msg length %d",
-			(int)len);
-		free(buf);
-		return;
-	}
-	cmd = sldns_read_uint32(buf);
-	free(buf);
-	if(cmd == worker_cmd_quit) {
-		/* quit anyway */
-		verbose(VERB_ALGO, "reload reply, control cmd quit");
-		comm_base_exit(worker->base);
-		return;
-	}
-	if(cmd != worker_cmd_reload_start) {
-		log_err("worker reload reply, wrong reply command");
-	}
-	if(worker->daemon->fast_reload_drop_mesh) {
-		verbose(VERB_ALGO, "worker: drop mesh queries after reload");
-		mesh_delete_all(worker->env.mesh);
-	}
-	fast_reload_worker_pickup_changes(worker);
-	worker_send_reload_ack(worker);
-	verbose(VERB_ALGO, "worker resume after reload");
-}
-
 void
 worker_handle_control_cmd(struct tube* ATTR_UNUSED(tube), uint8_t* msg,
 	size_t len, int error, void* arg)
@@ -501,9 +383,7 @@ worker_handle_control_cmd(struct tube* ATTR_UNUSED(tube), uint8_t* msg,
 		return;
 	}
 	if(len != sizeof(uint32_t)) {
-		verbose(VERB_ALGO, "bad control msg length %d", (int)len);
-		free(msg);
-		return;
+		fatal_exit("bad control msg length %d", (int)len);
 	}
 	cmd = sldns_read_uint32(msg);
 	free(msg);
@@ -524,15 +404,6 @@ worker_handle_control_cmd(struct tube* ATTR_UNUSED(tube), uint8_t* msg,
 		verbose(VERB_ALGO, "got control cmd remote");
 		daemon_remote_exec(worker);
 		break;
-	case worker_cmd_reload_stop:
-		verbose(VERB_ALGO, "got control cmd reload_stop");
-		worker_stop_and_wait(worker);
-		break;
-	case worker_cmd_reload_poll:
-		verbose(VERB_ALGO, "got control cmd reload_poll");
-		fast_reload_worker_pickup_changes(worker);
-		worker_send_reload_ack(worker);
-		break;
 	default:
 		log_err("bad command %d", (int)cmd);
 		break;
@@ -716,8 +587,7 @@ apply_respip_action(struct worker* worker, const struct query_info* qinfo,
 	struct respip_client_info* cinfo, struct reply_info* rep,
 	struct sockaddr_storage* addr, socklen_t addrlen,
 	struct ub_packed_rrset_key** alias_rrset,
-	struct reply_info** encode_repp, struct auth_zones* az,
-	int* rpz_passthru)
+	struct reply_info** encode_repp, struct auth_zones* az)
 {
 	struct respip_action_info actinfo = {0, 0, 0, 0, NULL, 0, NULL};
 	actinfo.action = respip_none;
@@ -728,8 +598,7 @@ apply_respip_action(struct worker* worker, const struct query_info* qinfo,
 		return 1;

 	if(!respip_rewrite_reply(qinfo, cinfo, rep, encode_repp, &actinfo,
-		alias_rrset, 0, worker->scratchpad, az, rpz_passthru,
-		worker->env.views, worker->env.respip_set))
+		alias_rrset, 0, worker->scratchpad, az, NULL))
 		return 0;

 	/* xxx_deny actions mean dropping the reply, unless the original reply
@@ -775,7 +644,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	int* is_secure_answer, struct ub_packed_rrset_key** alias_rrset,
 	struct reply_info** partial_repp,
 	struct reply_info* rep, uint16_t id, uint16_t flags,
-	struct comm_reply* repinfo, struct edns_data* edns, int* rpz_passthru)
+	struct comm_reply* repinfo, struct edns_data* edns)
 {
 	time_t timenow = *worker->env.now;
 	uint16_t udpsize = edns->udp_size;
@@ -787,21 +656,25 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	*partial_repp = NULL;  /* avoid accidental further pass */

 	/* Check TTL */
-	if(TTL_IS_EXPIRED(rep->ttl, timenow)) {
+	if(rep->ttl < timenow) {
 		/* Check if we need to serve expired now */
 		if(worker->env.cfg->serve_expired &&
-			/* if serve-expired-client-timeout is set, serve
-			 * an expired record without attempting recursion
-			 * if the serve_expired_norec_ttl is set for the record
-			 * as we know that recursion is currently failing. */
-			(!worker->env.cfg->serve_expired_client_timeout ||
-			 timenow < rep->serve_expired_norec_ttl)
+			!worker->env.cfg->serve_expired_client_timeout
 #ifdef USE_CACHEDB
 			&& !(worker->env.cachedb_enabled &&
 			  worker->env.cfg->cachedb_check_when_serve_expired)
 #endif
 			) {
-				if(!reply_info_can_answer_expired(rep, timenow))
+				if(worker->env.cfg->serve_expired_ttl &&
+					rep->serve_expired_ttl < timenow)
+					return 0;
+				/* Ignore expired failure answers */
+				if(FLAGS_GET_RCODE(rep->flags) !=
+					LDNS_RCODE_NOERROR &&
+					FLAGS_GET_RCODE(rep->flags) !=
+					LDNS_RCODE_NXDOMAIN &&
+					FLAGS_GET_RCODE(rep->flags) !=
+					LDNS_RCODE_YXDOMAIN)
 					return 0;
 				if(!rrset_array_lock(rep->ref, rep->rrset_count, 0))
 					return 0;
@@ -885,13 +758,12 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	if((worker->daemon->use_response_ip || worker->daemon->use_rpz) &&
 		!partial_rep && !apply_respip_action(worker, qinfo, cinfo, rep,
 		&repinfo->client_addr, repinfo->client_addrlen, alias_rrset,
-		&encode_rep, worker->env.auth_zones, rpz_passthru)) {
+		&encode_rep, worker->env.auth_zones)) {
 		goto bail_out;
 	} else if(partial_rep &&
 		!respip_merge_cname(partial_rep, qinfo, rep, cinfo,
 		must_validate, &encode_rep, worker->scratchpad,
-		worker->env.auth_zones, worker->env.views,
-		worker->env.respip_set)) {
+		worker->env.auth_zones)) {
 		goto bail_out;
 	}
 	if(encode_rep != rep) {
@@ -1012,7 +884,6 @@ chaos_replystr(sldns_buffer* pkt, char** str, int num, struct edns_data* edns,
 	size_t udpsize = edns->udp_size;
 	edns->edns_version = EDNS_ADVERTISED_VERSION;
 	edns->udp_size = EDNS_ADVERTISED_SIZE;
-	edns->ext_rcode = 0;
 	edns->bits &= EDNS_DO;
 	if(!inplace_cb_reply_local_call(&worker->env, NULL, NULL, NULL,
 		LDNS_RCODE_NOERROR, edns, repinfo, worker->scratchpad,
@@ -1213,7 +1084,7 @@ answer_notify(struct worker* w, struct query_info* qinfo,

 	if(verbosity >= VERB_DETAIL) {
 		char buf[380];
-		char zname[LDNS_MAX_DOMAINLEN];
+		char zname[255+1];
 		char sr[25];
 		dname_str(qinfo->qname, zname);
 		sr[0]=0;
@@ -1271,7 +1142,9 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		worker_check_request(c->buffer, worker, check_result);
 		if(check_result->value != 0) {
 			if(check_result->value != -1) {
-				query_error(c->buffer, check_result->value, 0);
+				LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+					check_result->value);
 				return 1;
 			}
 			comm_point_drop_reply(repinfo);
@@ -1288,17 +1161,41 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		/* check additional section is present and that we respond with EDEs */
 		if(LDNS_ARCOUNT(sldns_buffer_begin(c->buffer)) != 1
 			|| !ede) {
-			query_error(c->buffer, LDNS_RCODE_REFUSED, 0);
+			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				LDNS_RCODE_REFUSED);
+			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+			sldns_buffer_flip(c->buffer);
 			return 1;
 		}

 		if (!query_dname_len(c->buffer)) {
-			query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
+			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				LDNS_RCODE_FORMERR);
+			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+			sldns_buffer_flip(c->buffer);
 			return 1;
 		}
 		/* space available for query type and class? */
 		if (sldns_buffer_remaining(c->buffer) < 2 * sizeof(uint16_t)) {
-			query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
+                        LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+                        LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				 LDNS_RCODE_FORMERR);
+			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+                        sldns_buffer_flip(c->buffer);
 			return 1;
 		}
 		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
@@ -1320,27 +1217,35 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 			if(!skip_pkt_rrs(c->buffer,
 				((int)LDNS_ANCOUNT(sldns_buffer_begin(c->buffer)))+
 				((int)LDNS_NSCOUNT(sldns_buffer_begin(c->buffer))))) {
-				query_error(c->buffer, LDNS_RCODE_FORMERR,
-					opt_rr_mark - LDNS_HEADER_SIZE
-					- 2 /* qtype */ - 2 /* qclass */);
+				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+					LDNS_RCODE_FORMERR);
+				LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+				LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+				LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+				sldns_buffer_set_position(c->buffer, opt_rr_mark);
+				sldns_buffer_flip(c->buffer);
 				return 1;
 			}
 		}
 		/* Do we have a valid OPT RR here? If not return REFUSED (could be a valid TSIG or something so no FORMERR) */
 		/* domain name must be the root of length 1. */
 		if(sldns_buffer_remaining(c->buffer) < 1 || *sldns_buffer_current(c->buffer) != 0) {
-			query_error(c->buffer, LDNS_RCODE_REFUSED,
-				opt_rr_mark - LDNS_HEADER_SIZE
-				- 2 /* qtype */ - 2 /* qclass */);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			sldns_buffer_set_position(c->buffer, opt_rr_mark);
+			sldns_buffer_flip(c->buffer);
 			return 1;
 		} else {
 			sldns_buffer_skip(c->buffer, 1); /* skip root label */
 		}
 		if(sldns_buffer_remaining(c->buffer) < 2 ||
 			sldns_buffer_read_u16(c->buffer) != LDNS_RR_TYPE_OPT) {
-			query_error(c->buffer, LDNS_RCODE_REFUSED,
-				opt_rr_mark - LDNS_HEADER_SIZE
-				- 2 /* qtype */ - 2 /* qclass */);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			sldns_buffer_set_position(c->buffer, opt_rr_mark);
+			sldns_buffer_flip(c->buffer);
 			return 1;
 		}
 		/* Write OPT RR directly after the query,
@@ -1452,24 +1357,6 @@ check_ip_ratelimit(struct worker* worker, struct sockaddr_storage* addr,
 	return 1;
 }

-/*
- * This is the callback function when a request arrives. It is passed
- * the packet and user argument. Return true to send a reply.
- * This is of type comm_point_callback_type. The struct comm_point contains
- * more comments on the comm_point.callback member about the function.
- * @param c: the comm_point where the request arrives on.
- * @param arg: the user argument for the callback, the worker.
- * @param error: This can be NETEVENT_NOERROR, NETEVENT_TIMEOUT,
- *	NETEVENT_CLOSED or other comm point callback error values.
- * @param repinfo: The reply info, use it to send a reply. If the reply
- *	is immediate, return 1. If the reply is later on return 0 and save
- *	the repinfo, to call comm_point_send_reply on.
- * @return 1 to sent a reply straight away, for like cache response so that
- *	no allocation needs to be done. And only internal preallocated buffers
- *	are used. Return 0 and save the repinfo to reply later, for responses
- *	that need to be looked up. Return 0 and call comm_point_drop_reply on
- *	the repinfo to drop the response.
- */
 int
 worker_handle_request(struct comm_point* c, void* arg, int error,
 	struct comm_reply* repinfo)
@@ -1497,8 +1384,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	struct reply_info* partial_rep = NULL;
 	struct query_info* lookup_qinfo = &qinfo;
 	struct query_info qinfo_tmp; /* placeholder for lookup_qinfo */
-	uint8_t* alias_orig_qname = NULL; /* original qname for logs, if
-		a local_alias is used to change the qname. */
 	struct respip_client_info* cinfo = NULL, cinfo_tmp;
 	struct timeval wait_time;
 	struct check_request_result check_result = {0,0};
@@ -1516,7 +1401,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		if (worker->stats.max_query_time_us < wait_queue_time)
 			worker->stats.max_query_time_us = wait_queue_time;
 		if(wait_queue_time >
-			(long long)worker->env.cfg->sock_queue_timeout * 1000000) {
+			(long long)(worker->env.cfg->sock_queue_timeout * 1000000)) {
 			/* count and drop queries that were sitting in the socket queue too long */
 			worker->stats.num_queries_timed_out++;
 			return 0;
@@ -1530,7 +1415,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		return 0;
 	}
 	if(c->dnscrypt && !repinfo->is_dnscrypted) {
-		char buf[LDNS_MAX_DOMAINLEN];
+		char buf[LDNS_MAX_DOMAINLEN+1];
 		/* Check if this is unencrypted and asking for certs */
 		worker_check_request(c->buffer, worker, &check_result);
 		if(check_result.value != 0) {
@@ -1538,10 +1423,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 				"dnscrypt: worker check request: bad query.");
 			log_addr(VERB_CLIENT,"from",&repinfo->client_addr,
 				repinfo->client_addrlen);
-			if(check_result.value != -1) {
-				query_error(c->buffer, check_result.value, 0);
-				return 1;
-			}
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
@@ -1550,13 +1431,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 				"dnscrypt: worker parse request: formerror.");
 			log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 				repinfo->client_addrlen);
-			if(worker_err_ratelimit(worker, LDNS_RCODE_FORMERR) == -1) {
-				comm_point_drop_reply(repinfo);
-				return 0;
-			}
-			query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
-			sldns_buffer_copy(c->dnscrypt_buffer, c->buffer);
-			return 1;
+			comm_point_drop_reply(repinfo);
+			return 0;
 		}
 		dname_str(qinfo.qname, buf);
 		if(!(qinfo.qtype == LDNS_RR_TYPE_TXT &&
@@ -1567,15 +1443,9 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 				worker->daemon->dnscenv->provider_name,
 				sldns_rr_descript(qinfo.qtype)->_name,
 				buf);
-			if(worker_err_ratelimit(worker, LDNS_RCODE_SERVFAIL) == -1) {
-				comm_point_drop_reply(repinfo);
-				return 0;
-			}
-			query_error(c->buffer, LDNS_RCODE_SERVFAIL,
-				qinfo.qname_len);
+			comm_point_drop_reply(repinfo);
 			worker->stats.num_query_dnscrypt_cleartext++;
-			sldns_buffer_copy(c->dnscrypt_buffer, c->buffer);
-			return 1;
+			return 0;
 		}
 		worker->stats.num_query_dnscrypt_cert++;
 		sldns_buffer_rewind(c->buffer);
@@ -1615,7 +1485,9 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		verbose(VERB_ALGO, "worker check request: bad query.");
 		log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
 		if(check_result.value != -1) {
-			query_error(c->buffer, check_result.value, 0);
+			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				check_result.value);
 			return 1;
 		}
 		comm_point_drop_reply(repinfo);
@@ -1649,7 +1521,10 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
-		query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
+		sldns_buffer_rewind(c->buffer);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_FORMERR);
 		goto send_reply;
 	}
 	if(worker->env.cfg->log_queries) {
@@ -1662,11 +1537,10 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		verbose(VERB_ALGO, "worker request: refused zone transfer.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
-		if(worker_err_ratelimit(worker, LDNS_RCODE_REFUSED) == -1) {
-			comm_point_drop_reply(repinfo);
-			return 0;
-		}
-		query_error(c->buffer, LDNS_RCODE_REFUSED, qinfo.qname_len);
+		sldns_buffer_rewind(c->buffer);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_REFUSED);
 		if(worker->stats.extended) {
 			worker->stats.qtype[qinfo.qtype]++;
 		}
@@ -1685,7 +1559,10 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
-		query_error(c->buffer, LDNS_RCODE_FORMERR, qinfo.qname_len);
+		sldns_buffer_rewind(c->buffer);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_FORMERR);
 		if(worker->stats.extended) {
 			worker->stats.qtype[qinfo.qtype]++;
 		}
@@ -1693,17 +1570,12 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	}
 	if((ret=parse_edns_from_query_pkt(
 			c->buffer, &edns, worker->env.cfg, c, repinfo,
-			*worker->env.now, worker->scratchpad,
-			worker->daemon->cookie_secrets)) != 0) {
+			(worker->env.now ? *worker->env.now : time(NULL)),
+			worker->scratchpad)) != 0) {
 		struct edns_data reply_edns;
 		verbose(VERB_ALGO, "worker parse edns: formerror.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
-		if(worker_err_ratelimit(worker, ret) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
 		memset(&reply_edns, 0, sizeof(reply_edns));
 		reply_edns.edns_present = 1;
 		error_encode(c->buffer, ret, &qinfo,
@@ -1720,11 +1592,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			verbose(VERB_ALGO, "query with bad edns version.");
 			log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 				repinfo->client_addrlen);
-			if(worker_err_ratelimit(worker, EDNS_RCODE_BADVERS) == -1) {
-				comm_point_drop_reply(repinfo);
-				regional_free_all(worker->scratchpad);
-				return 0;
-			}
 			extended_error_encode(c->buffer, EDNS_RCODE_BADVERS, &qinfo,
 				*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 				sldns_buffer_read_u16_at(c->buffer, 2), 0, &edns);
@@ -1752,7 +1619,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			repinfo->client_addrlen, edns.cookie_valid,
 			c->buffer)) {
 			worker->stats.num_queries_ip_ratelimited++;
-			regional_free_all(worker->scratchpad);
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
@@ -1770,11 +1636,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,

 	else if(edns.cookie_present) {
 		/* Cookie present, but not valid: Cookie was bad! */
-		if(worker_err_ratelimit(worker, LDNS_EXT_RCODE_BADCOOKIE) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
 		extended_error_encode(c->buffer,
 			LDNS_EXT_RCODE_BADCOOKIE, &qinfo,
 			*(uint16_t*)(void *)
@@ -1789,11 +1650,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			"need cookie or stateful transport");
 		log_addr(VERB_ALGO, "from",&repinfo->remote_addr
 		                          , repinfo->remote_addrlen);
-		if(worker_err_ratelimit(worker, LDNS_RCODE_REFUSED) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
 		EDNS_OPT_LIST_APPEND_EDE(&edns.opt_list_out,
 			worker->scratchpad, LDNS_EDE_OTHER,
 			"DNS Cookie needed for UDP replies");
@@ -1820,14 +1676,14 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		verbose(VERB_ALGO, "worker request: edns is too small.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
-		if(worker_err_ratelimit(worker, LDNS_RCODE_SERVFAIL) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
-		/* A small error without qname, and TC flag on. */
-		query_error(c->buffer, LDNS_RCODE_SERVFAIL, 0);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 		LDNS_TC_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_SERVFAIL);
+		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+		sldns_buffer_write_at(c->buffer, 4,
+			(uint8_t*)"\0\0\0\0\0\0\0\0", 8);
+		sldns_buffer_flip(c->buffer);
 		regional_free_all(worker->scratchpad);
 		goto send_reply;
 	}
@@ -1835,13 +1691,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		server_stats_insquery(&worker->stats, c, qinfo.qtype,
 			qinfo.qclass, &edns, repinfo);
 	if(c->type != comm_udp)
-#ifdef USE_DNSCRYPT
-		edns.udp_size = (c->dnscrypt && repinfo->is_dnscrypted)
-			? sldns_buffer_capacity(c->buffer) - DNSCRYPT_REPLY_HEADER_SIZE
-			: 65535;
-#else
 		edns.udp_size = 65535; /* max size for TCP replies */
-#endif
 	if(qinfo.qclass == LDNS_RR_CLASS_CH && answer_chaos(worker, &qinfo,
 		&edns, repinfo, c->buffer)) {
 		regional_free_all(worker->scratchpad);
@@ -1880,9 +1730,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		goto send_reply;
 	}
 	if(worker->env.auth_zones &&
-		auth_zones_downstream_answer(worker->env.auth_zones,
-		&worker->env, &qinfo, &edns, repinfo, c->buffer,
-		worker->scratchpad)) {
+		auth_zones_answer(worker->env.auth_zones, &worker->env,
+		&qinfo, &edns, repinfo, c->buffer, worker->scratchpad)) {
 		regional_free_all(worker->scratchpad);
 		if(sldns_buffer_limit(c->buffer) == 0) {
 			comm_point_drop_reply(repinfo);
@@ -1918,15 +1767,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	 * ACLs allow the snooping. */
 	if(!(LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) &&
 		acl != acl_allow_snoop ) {
-		log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
-			&repinfo->client_addr, repinfo->client_addrlen);
-		/* This ratelimited error query is accounted in the stats,
-		 * as an incoming query. */
-		if(worker_err_ratelimit(worker, LDNS_RCODE_REFUSED) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
 		if(worker->env.cfg->ede) {
 			EDNS_OPT_LIST_APPEND_EDE(&edns.opt_list_out,
 				worker->scratchpad, LDNS_EDE_NOT_AUTHORITATIVE, "");
@@ -1935,22 +1775,29 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 			sldns_buffer_read_u16_at(c->buffer, 2), &edns);
 		regional_free_all(worker->scratchpad);
+		log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
+			&repinfo->client_addr, repinfo->client_addrlen);
+
 		goto send_reply;
 	}

 	/* If we've found a local alias, replace the qname with the alias
 	 * target before resolving it. */
 	if(qinfo.local_alias) {
-		if(qinfo.local_alias->rrset &&
-			qinfo.local_alias->rrset->rk.dname)
-			/* Store the original qname, used for logs, since
-			 * local_alias can be removed by region_free_all. */
-			alias_orig_qname = qinfo.local_alias->rrset->rk.dname;
-		if(!local_alias_shallow_copy_qname(qinfo.local_alias, &qinfo.qname,
-			&qinfo.qname_len)) {
+		struct ub_packed_rrset_key* rrset = qinfo.local_alias->rrset;
+		struct packed_rrset_data* d = rrset->entry.data;
+
+		/* Sanity check: our current implementation only supports
+		 * a single CNAME RRset as a local alias. */
+		if(qinfo.local_alias->next ||
+			rrset->rk.type != htons(LDNS_RR_TYPE_CNAME) ||
+			d->count != 1) {
+			log_err("assumption failure: unexpected local alias");
 			regional_free_all(worker->scratchpad);
 			return 0; /* drop it */
 		}
+		qinfo.qname = d->rr_data[0] + 2;
+		qinfo.qname_len = d->rr_len[0] - 2;
 	}

 	/* If we may apply IP-based actions to the answer, build the client
@@ -1967,7 +1814,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		cinfo_tmp.tag_datas = acladdr->tag_datas;
 		cinfo_tmp.tag_datas_size = acladdr->tag_datas_size;
 		cinfo_tmp.view = acladdr->view;
-		cinfo_tmp.view_name = NULL;
+		cinfo_tmp.respip_set = worker->daemon->respip_set;
 		cinfo = &cinfo_tmp;
 	}

@@ -1993,19 +1840,19 @@ lookup_cache:
 				&alias_rrset, &partial_rep, rep,
 				*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 				sldns_buffer_read_u16_at(c->buffer, 2), repinfo,
-				&edns, &rpz_passthru)) {
+				&edns)) {
 				/* prefetch it if the prefetch TTL expired.
 				 * Note that if there is more than one pass
 				 * its qname must be that used for cache
 				 * lookup. */
 				if((worker->env.cfg->prefetch &&
-					rep->prefetch_ttl <= *worker->env.now) ||
+					*worker->env.now >= rep->prefetch_ttl) ||
 					(worker->env.cfg->serve_expired &&
-					TTL_IS_EXPIRED(rep->ttl, *worker->env.now) &&
-					!(*worker->env.now < rep->serve_expired_norec_ttl))) {
-					time_t leeway =
-						TTL_IS_EXPIRED(rep->ttl, *worker->env.now)
-						? 0 : rep->ttl - *worker->env.now;
+					*worker->env.now > rep->ttl)) {
+
+					time_t leeway = rep->ttl - *worker->env.now;
+					if(rep->ttl < *worker->env.now)
+						leeway = 0;
 					lock_rw_unlock(&e->lock);

 					reply_and_prefetch(worker, lookup_qinfo,
@@ -2111,25 +1958,26 @@ send_reply_rc:
 	{
 		struct timeval tv;
 		memset(&tv, 0, sizeof(tv));
-		if(alias_orig_qname) {
+		if(qinfo.local_alias && qinfo.local_alias->rrset &&
+			qinfo.local_alias->rrset->rk.dname) {
 			/* log original qname, before the local alias was
 			 * used to resolve that CNAME to something else */
-			qinfo.qname = alias_orig_qname;
+			qinfo.qname = qinfo.local_alias->rrset->rk.dname;
 			log_reply_info(NO_VERBOSE, &qinfo,
 				&repinfo->client_addr, repinfo->client_addrlen,
 				tv, 1, c->buffer,
 				(worker->env.cfg->log_destaddr?(void*)repinfo->c->socket->addr:NULL),
-				c->type, c->ssl);
+				c->type);
 		} else {
 			log_reply_info(NO_VERBOSE, &qinfo,
 				&repinfo->client_addr, repinfo->client_addrlen,
 				tv, 1, c->buffer,
 				(worker->env.cfg->log_destaddr?(void*)repinfo->c->socket->addr:NULL),
-				c->type, c->ssl);
+				c->type);
 		}
 	}
 #ifdef USE_DNSCRYPT
-	if(!dnsc_handle_uncurved_request(repinfo, c->buffer)) {
+	if(!dnsc_handle_uncurved_request(repinfo)) {
 		return 0;
 	}
 #endif
@@ -2177,37 +2025,10 @@ worker_restart_timer(struct worker* worker)
 {
 	if(worker->env.cfg->stat_interval > 0) {
 		struct timeval tv;
-		if(worker->daemon->stat_time_specific) {
-			struct timeval dest, now;
-			int interval = worker->env.cfg->stat_interval;
-			int offset = worker->daemon->stat_time_offset;
-			int nows, spec;
-			if(gettimeofday(&now, NULL) < 0)
-				log_err("gettimeofday: %s", strerror(errno));
 #ifndef S_SPLINT_S
-			nows = (int)now.tv_sec;
-			/* The next time is on the timer interval, at the
-			 * specific offset, time value % interval = offset. */
-			/* It relies on the integer division below to drop the
-			 * remainder in order to calculate the expected
-			 * result. */
-			spec = ((nows-offset)/interval+1)*interval+offset;
-			/* This is instead of an assertion, and should not
-			 * be needed. So assert(spec > nows), tv is going to
-			 * be positive. */
-			if(spec<=nows) spec += interval;
-			dest.tv_sec = spec;
-			dest.tv_usec = 0;
+		tv.tv_sec = worker->env.cfg->stat_interval;
+		tv.tv_usec = 0;
 #endif
-			/* Subtract in timeval, so the fractions of a second
-			 * are rounded to the whole specific time. */
-			timeval_subtract(&tv, &dest, &now);
-		} else {
-#ifndef S_SPLINT_S
-			tv.tv_sec = worker->env.cfg->stat_interval;
-			tv.tv_usec = 0;
-#endif
-		}
 		comm_timer_set(worker->stat_timer, &tv);
 	}
 }
@@ -2242,16 +2063,23 @@ void worker_probe_timer_cb(void* arg)
 }

 struct worker*
-worker_create(struct daemon* daemon, int id)
+worker_create(struct daemon* daemon, int id, int* ports, int n)
 {
 	unsigned int seed;
 	struct worker* worker = (struct worker*)calloc(1,
 		sizeof(struct worker));
 	if(!worker)
 		return NULL;
+	worker->numports = n;
+	worker->ports = (int*)memdup(ports, sizeof(int)*n);
+	if(!worker->ports) {
+		free(worker);
+		return NULL;
+	}
 	worker->daemon = daemon;
 	worker->thread_num = id;
 	if(!(worker->cmd = tube_create())) {
+		free(worker->ports);
 		free(worker);
 		return NULL;
 	}
@@ -2259,6 +2087,7 @@ worker_create(struct daemon* daemon, int id)
 	if(!(worker->rndstate = ub_initstate(daemon->rand))) {
 		log_err("could not init random numbers.");
 		tube_delete(worker->cmd);
+		free(worker->ports);
 		free(worker);
 		return NULL;
 	}
@@ -2274,6 +2103,9 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	struct dt_env* dtenv = &worker->dtenv;
 #else
 	void* dtenv = NULL;
+#endif
+#ifdef HAVE_GETTID
+	worker->thread_tid = gettid();
 #endif
 	worker->need_to_exit = 0;
 	worker->base = comm_base_create(do_sigs);
@@ -2342,11 +2174,8 @@ worker_init(struct worker* worker, struct config_file *cfg,
 			: cfg->tcp_idle_timeout,
 		cfg->harden_large_queries, cfg->http_max_streams,
 		cfg->http_endpoint, cfg->http_notls_downstream,
-		worker->daemon->tcl, worker->daemon->listen_dot_sslctx,
-		worker->daemon->listen_doh_sslctx,
-		worker->daemon->listen_quic_sslctx,
-		dtenv, worker->daemon->doq_table, worker->env.rnd,
-		cfg, worker_handle_request, worker);
+		worker->daemon->tcl, worker->daemon->listen_sslctx,
+		dtenv, worker_handle_request, worker);
 	if(!worker->front) {
 		log_err("could not create listening sockets");
 		worker_delete(worker);
@@ -2357,14 +2186,14 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		cfg->out_ifs, cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6,
 		cfg->do_tcp?cfg->outgoing_num_tcp:0, cfg->ip_dscp,
 		worker->daemon->env->infra_cache, worker->rndstate,
-		cfg->use_caps_bits_for_id,
+		cfg->use_caps_bits_for_id, worker->ports, worker->numports,
 		cfg->unwanted_threshold, cfg->outgoing_tcp_mss,
 		&worker_alloc_cleanup, worker,
 		cfg->do_udp || cfg->udp_upstream_without_downstream,
-		worker->daemon->connect_dot_sslctx, cfg->delay_close,
+		worker->daemon->connect_sslctx, cfg->delay_close,
 		cfg->tls_use_sni, dtenv, cfg->udp_connect,
 		cfg->max_reuse_tcp_queries, cfg->tcp_reuse_timeout,
-		cfg->tcp_auth_query_timeout, worker->daemon->shared_ports);
+		cfg->tcp_auth_query_timeout);
 	if(!worker->back) {
 		log_err("could not create outgoing sockets");
 		worker_delete(worker);
@@ -2383,8 +2212,6 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		worker_stat_timer_cb, worker);
 	if(!worker->stat_timer) {
 		log_err("could not create statistics timer");
-		worker_delete(worker);
-		return 0;
 	}

 	/* we use the msg_buffer_size as a good estimate for what the
@@ -2517,6 +2344,7 @@ worker_delete(struct worker* worker)
 	tube_delete(worker->cmd);
 	comm_timer_delete(worker->stat_timer);
 	comm_timer_delete(worker->env.probe_timer);
+	free(worker->ports);
 	if(worker->thread_num == 0) {
 #ifdef UB_ON_WINDOWS
 		wsvc_desetup_worker(worker);
@@ -2537,8 +2365,6 @@ worker_delete(struct worker* worker)
 	/* don't touch worker->alloc, as it's maintained in daemon */
 	regional_destroy(worker->env.scratch);
 	regional_destroy(worker->scratchpad);
-	/* The thread id can reference this worker's id value, so clear it. */
-	log_thread_set(NULL);
 	free(worker);
 }

@@ -2547,8 +2373,7 @@ worker_send_query(struct query_info* qinfo, uint16_t flags, int dnssec,
 	int want_dnssec, int nocaps, int check_ratelimit,
 	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* zone,
 	size_t zonelen, int tcp_upstream, int ssl_upstream, char* tls_auth_name,
-	struct module_qstate* q, int* was_ratelimited,
-	int* ratelimit_incremented)
+	struct module_qstate* q, int* was_ratelimited)
 {
 	struct worker* worker = q->env->worker;
 	struct outbound_entry* e = (struct outbound_entry*)regional_alloc(
@@ -2560,7 +2385,7 @@ worker_send_query(struct query_info* qinfo, uint16_t flags, int dnssec,
 		want_dnssec, nocaps, check_ratelimit, tcp_upstream,
 		ssl_upstream, tls_auth_name, addr, addrlen, zone, zonelen, q,
 		worker_handle_service_reply, e, worker->back->udp_buff, q->env,
-		was_ratelimited, ratelimit_incremented);
+		was_ratelimited);
 	if(!e->qsent) {
 		return NULL;
 	}
@@ -2609,8 +2434,7 @@ struct outbound_entry* libworker_send_query(
 	struct sockaddr_storage* ATTR_UNUSED(addr), socklen_t ATTR_UNUSED(addrlen),
 	uint8_t* ATTR_UNUSED(zone), size_t ATTR_UNUSED(zonelen), int ATTR_UNUSED(tcp_upstream),
 	int ATTR_UNUSED(ssl_upstream), char* ATTR_UNUSED(tls_auth_name),
-	struct module_qstate* ATTR_UNUSED(q), int* ATTR_UNUSED(was_ratelimited),
-	int* ATTR_UNUSED(ratelimit_incremented))
+	struct module_qstate* ATTR_UNUSED(q), int* ATTR_UNUSED(was_ratelimited))
 {
 	log_assert(0);
 	return 0;
@@ -2652,11 +2476,6 @@ void libworker_event_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
 	log_assert(0);
 }

-void libworker_alloc_cleanup(void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
 int context_query_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
 {
 	log_assert(0);
@@ -2690,19 +2509,3 @@ void dtio_mainfdcallback(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
 	log_assert(0);
 }
 #endif
-
-#ifdef HAVE_NGTCP2
-void doq_client_event_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
-
-#ifdef HAVE_NGTCP2
-void doq_client_timer_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
@@ -72,13 +72,7 @@ enum worker_commands {
 	/** obtain statistics without statsclear */
 	worker_cmd_stats_noreset,
 	/** execute remote control command */
-	worker_cmd_remote,
-	/** for fast-reload, perform stop */
-	worker_cmd_reload_stop,
-	/** for fast-reload, start again */
-	worker_cmd_reload_start,
-	/** for fast-reload, poll to make sure worker has released data */
-	worker_cmd_reload_poll
+	worker_cmd_remote
 };

 /**
@@ -104,6 +98,10 @@ struct worker {
 	struct listen_dnsport* front;
 	/** the backside outside network interface to the auth servers */
 	struct outside_network* back;
+	/** ports to be used by this worker. */
+	int* ports;
+	/** number of ports for this worker */
+	int numports;
 	/** the signal handler */
 	struct comm_signal* comsig;
 	/** commpoint to listen to commands. */
@@ -142,9 +140,11 @@ struct worker {
 * with backpointers only. Use worker_init on it later.
 * @param daemon: the daemon that this worker thread is part of.
 * @param id: the thread number from 0.. numthreads-1.
+ * @param ports: the ports it is allowed to use, array.
+ * @param n: the number of ports.
 * @return: the new worker or NULL on alloc failure.
 */
-struct worker* worker_create(struct daemon* daemon, int id);
+struct worker* worker_create(struct daemon* daemon, int id, int* ports, int n);

 /**
 * Initialize worker.
@@ -366,23 +366,22 @@ static int
 dns64_apply_cfg(struct dns64_env* dns64_env, struct config_file* cfg)
 {
    struct config_strlist* s;
-    const char* dns64_prefix = cfg->dns64_prefix ?
-	cfg->dns64_prefix : DEFAULT_DNS64_PREFIX;
-    verbose(VERB_ALGO, "dns64-prefix: %s", dns64_prefix);
-    if (!netblockstrtoaddr(dns64_prefix, 0, &dns64_env->prefix_addr,
+    verbose(VERB_ALGO, "dns64-prefix: %s", cfg->dns64_prefix);
+    if (!netblockstrtoaddr(cfg->dns64_prefix ? cfg->dns64_prefix :
+                DEFAULT_DNS64_PREFIX, 0, &dns64_env->prefix_addr,
                &dns64_env->prefix_addrlen, &dns64_env->prefix_net)) {
-        log_err("cannot parse dns64-prefix netblock: %s", dns64_prefix);
+        log_err("cannot parse dns64-prefix netblock: %s", cfg->dns64_prefix);
        return 0;
    }
    if (!addr_is_ip6(&dns64_env->prefix_addr, dns64_env->prefix_addrlen)) {
-        log_err("dns64_prefix is not IPv6: %s", dns64_prefix);
+        log_err("dns64_prefix is not IPv6: %s", cfg->dns64_prefix);
        return 0;
    }
    if (dns64_env->prefix_net != 32 && dns64_env->prefix_net != 40 &&
            dns64_env->prefix_net != 48 && dns64_env->prefix_net != 56 &&
            dns64_env->prefix_net != 64 && dns64_env->prefix_net != 96 ) {
-        log_err("dns64-prefix length is not 32, 40, 48, 56, 64 or 96: %s",
-                dns64_prefix);
+        log_err("dns64-prefix length it not 32, 40, 48, 56, 64 or 96: %s",
+                cfg->dns64_prefix);
        return 0;
    }
    for(s = cfg->dns64_ignore_aaaa; s; s = s->next) {
@@ -497,8 +496,8 @@ handle_ipv6_ptr(struct module_qstate* qstate, int id)

    /* Create the new sub-query. */
    fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-    if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->client_info,
-	    qstate->query_flags, 0, 0, &subq))
+    if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0, 0,
+                &subq))
        return module_error;
    if (subq) {
        subq->curmod = id;
@@ -523,8 +522,8 @@ generate_type_A_query(struct module_qstate* qstate, int id)

 	/* Start the sub-query. */
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->client_info,
-		qstate->query_flags, 0, 0, &subq))
+	if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0,
+				       0, &subq))
 	{
 		verbose(VERB_ALGO, "dns64: sub-query creation failed");
 		return module_error;
@@ -632,7 +631,7 @@ handle_event_moddone(struct module_qstate* qstate, int id)

 	/* When an AAAA query completes check if we want to perform DNS64
 	 * synthesis. We skip queries with DNSSEC enabled (!CD) and
-	 * ones generated by us to retrieve the A/PTR record to use for
+	 * ones generated by us to retrive the A/PTR record to use for
 	 * synth. */
 	int could_synth =
 		qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA &&
@@ -643,12 +642,6 @@ handle_event_moddone(struct module_qstate* qstate, int id)
 		qstate->return_msg->rep &&
 		reply_find_answer_rrset(&qstate->qinfo, qstate->return_msg->rep);
 	int synth_qname = 0;
-	if(could_synth && !has_data && qstate->env->need_to_validate &&
-		qstate->return_msg && qstate->return_msg->rep &&
-		qstate->return_msg->rep->security == sec_status_bogus) {
-		verbose(VERB_ALGO, "dns64: bogus AAAA reply not synthesized");
-		could_synth = 0;
-	}

 	if(could_synth &&
 		(!has_data ||
@@ -660,16 +653,12 @@ handle_event_moddone(struct module_qstate* qstate, int id)

 	/* Store the response in cache. */
 	if( (!iq || !iq->started_no_cache_store) &&
-		!qstate->rpz_applied && !qstate->rpz_passthru &&
-		!qstate->is_subnet_answer &&
 		qstate->return_msg &&
 		qstate->return_msg->rep &&
-		!qstate->fwd_stub_no_cache &&
 		!dns_cache_store(
 			qstate->env, &qstate->qinfo, qstate->return_msg->rep,
-			0, qstate->prefetch_leeway, 0, NULL,
-			qstate->query_flags, qstate->qstarttime,
-			qstate->is_valrec))
+			0, 0, 0, NULL,
+			qstate->query_flags, qstate->qstarttime))
 		log_err("out of memory");

 	/* do nothing */
@@ -712,7 +701,6 @@ dns64_operate(struct module_qstate* qstate, enum module_ev event, int id,
 			iq->state = DNS64_NEW_QUERY;
 			iq->started_no_cache_store = qstate->no_cache_store;
 			qstate->no_cache_store = 1;
-			ATTR_FALLTHROUGH
  			/* fallthrough */
 		case module_event_pass:
 			qstate->ext_state[id] = handle_event_pass(qstate, id);
@@ -726,15 +714,8 @@ dns64_operate(struct module_qstate* qstate, enum module_ev event, int id,
 	}
 	if(qstate->ext_state[id] == module_finished) {
 		iq = (struct dns64_qstate*)qstate->minfo[id];
-		if(iq && iq->state != DNS64_INTERNAL_QUERY) {
-			if(qstate->fwd_stub_no_cache) {
-				/* If the forward/stub has no cache, then
-				 * continue with the query with no cache. */
-				qstate->no_cache_store = qstate->fwd_stub_no_cache;
-			} else {
-				qstate->no_cache_store = iq->started_no_cache_store;
-			}
-		}
+		if(iq && iq->state != DNS64_INTERNAL_QUERY)
+			qstate->no_cache_store = iq->started_no_cache_store;
 	}
 }

@@ -841,7 +822,6 @@ dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate
 	size_t i, s;
 	struct packed_rrset_data* fd, *dd;
 	struct ub_packed_rrset_key* fk, *dk;
-	int allocated_return_msg = 0;

 	verbose(VERB_ALGO, "converting A answers to AAAA answers");

@@ -857,7 +837,6 @@ dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate
 			return;
 		memset(super->return_msg, 0, sizeof(*super->return_msg));
 		super->return_msg->qinfo = super->qinfo;
-		allocated_return_msg = 1;
 	}

 	rep = qstate->return_msg->rep;
@@ -867,17 +846,13 @@ dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate
 	 */
 	cp = construct_reply_info_base(super->region, rep->flags, rep->qdcount,
 		rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl,
-		rep->serve_expired_norec_ttl,
 		rep->an_numrrsets, rep->ns_numrrsets, rep->ar_numrrsets,
 		rep->rrset_count, rep->security, LDNS_EDE_NONE);
-	if(!cp) {
-		if(allocated_return_msg) super->return_msg = NULL;
+	if(!cp)
 		return;
-	}

 	/* allocate ub_key structures special or not */
 	if(!reply_info_alloc_rrset_keys(cp, NULL, super->region)) {
-		if(allocated_return_msg) super->return_msg = NULL;
 		return;
 	}

@@ -892,10 +867,8 @@ dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate
 		if(i<rep->an_numrrsets && fk->rk.type == htons(LDNS_RR_TYPE_A)) {
 			/* also sets dk->entry.hash */
 			dns64_synth_aaaa_data(fk, fd, dk, &dd, super->region, dns64_env);
-			if(!dd) {
-				if(allocated_return_msg) super->return_msg = NULL;
+			if(!dd)
 				return;
-			}
 			/* Delete negative AAAA record from cache stored by
 			 * the iterator module */
 			rrset_cache_remove(super->env->rrset_cache, dk->rk.dname, 
@@ -912,19 +885,15 @@ dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate
 			dk->rk.dname = (uint8_t*)regional_alloc_init(super->region,
 				fk->rk.dname, fk->rk.dname_len);

-			if(!dk->rk.dname) {
-				if(allocated_return_msg) super->return_msg = NULL;
+			if(!dk->rk.dname)
 				return;
-			}

 			s = packed_rrset_sizeof(fd);
 			dd = (struct packed_rrset_data*)regional_alloc_init(
 				super->region, fd, s);

-			if(!dd) {
-				if(allocated_return_msg) super->return_msg = NULL;
+			if(!dd)
 				return;
-			}
 		}

 		packed_rrset_ptr_fixup(dd);
@@ -955,10 +924,8 @@ dns64_adjust_ptr(struct module_qstate* qstate, struct module_qstate* super)
        return;
    super->return_msg->qinfo = super->qinfo;
    if (!(super->return_msg->rep = reply_info_copy(qstate->return_msg->rep,
-                    NULL, super->region))) {
-	super->return_msg = NULL;
+                    NULL, super->region)))
        return;
-    }

    /*
     * Adjust the domain name of the answer RR set so that it matches the
@@ -1027,21 +994,6 @@ dns64_inform_super(struct module_qstate* qstate, int id,
 	/* Use return code from A query in response to client. */
 	if (super->return_rcode != LDNS_RCODE_NOERROR)
 		super->return_rcode = qstate->return_rcode;
-	/* RPZ applied to the subquery need to then change (not cache)
-	 * the super query. With the super query not cached, it is
-	 * going to run the state machine modules on incoming queries,
-	 * that fetch the subquery (cache) response, and modify it
-	 * according to the rpz policy. That makes the synthesized
-	 * super query also adjusted by rpz policies. But loses cache
-	 * hits. Even though the subquery likely is answered from cache,
-	 * internally in its state machine process. */
-	if(qstate->rpz_applied)
-		super->rpz_applied = 1;
-	if(qstate->rpz_passthru)
-		super->rpz_passthru = 1;
-
-	/* Since the super qstate has a new response, its errinf is removed. */
-	super->errinf = NULL;

 	/* Generate a response suitable for the original query. */
 	if (qstate->qinfo.qtype == LDNS_RR_TYPE_A) {
@@ -1050,19 +1002,11 @@ dns64_inform_super(struct module_qstate* qstate, int id,
 		log_assert(qstate->qinfo.qtype == LDNS_RR_TYPE_PTR);
 		dns64_adjust_ptr(qstate, super);
 	}
-	/* If the sub-query has no cache store, then also the super query. */
-	if(qstate->fwd_stub_no_cache)
-		super->fwd_stub_no_cache = 1;

 	/* Store the generated response in cache. */
-	if ( super->return_msg && super->return_msg->rep &&
-		(!super_dq || !super_dq->started_no_cache_store) &&
-		!qstate->fwd_stub_no_cache &&
-		!super->rpz_applied && !super->rpz_passthru &&
-		!super->is_subnet_answer &&
+	if ( (!super_dq || !super_dq->started_no_cache_store) &&
 		!dns_cache_store(super->env, &super->qinfo, super->return_msg->rep,
-		0, super->prefetch_leeway, 0, NULL, super->query_flags,
-		qstate->qstarttime, qstate->is_valrec))
+		0, 0, 0, NULL, super->query_flags, qstate->qstarttime))
 		log_err("out of memory");
 }

@@ -1100,8 +1044,8 @@ dns64_get_mem(struct module_env* env, int id)
 */
 static struct module_func_block dns64_block = {
 	"dns64",
-	NULL, NULL, &dns64_init, &dns64_deinit, &dns64_operate,
-	&dns64_inform_super, &dns64_clear, &dns64_get_mem
+	&dns64_init, &dns64_deinit, &dns64_operate, &dns64_inform_super,
+	&dns64_clear, &dns64_get_mem
 };

 /**
@@ -361,7 +361,7 @@ dnscrypt_server_uncurve(struct dnsc_env* env,

    len -= DNSCRYPT_QUERY_HEADER_SIZE;

-    while (len>0 && *sldns_buffer_at(buffer, --len) == 0)
+    while (*sldns_buffer_at(buffer, --len) == 0)
        ;

    if (*sldns_buffer_at(buffer, len) != 0x80) {
@@ -474,18 +474,10 @@ dnscrypt_server_curve(const dnsccert *cert,
    uint8_t *const buf = sldns_buffer_begin(buffer);
    size_t len = sldns_buffer_limit(buffer);

-    if(len + DNSCRYPT_REPLY_HEADER_SIZE > sldns_buffer_capacity(buffer))
-	return -1;
-    sldns_buffer_clear(buffer);
-
    if(udp){
        if (max_len > max_reply_size)
            max_len = max_reply_size;
    }
-    if(max_len > sldns_buffer_capacity(buffer))
-	max_len = sldns_buffer_capacity(buffer);
-    if(max_len > 65535)
-	    max_len = 65535;


    memcpy(nonce, client_nonce, crypto_box_HALF_NONCEBYTES);
@@ -528,7 +520,6 @@ dnscrypt_server_curve(const dnsccert *cert,
                          DNSCRYPT_MAGIC_HEADER_LEN,
                          nonce,
                          crypto_box_NONCEBYTES);
-    sldns_buffer_flip(buffer);
    sldns_buffer_set_limit(buffer, len + DNSCRYPT_REPLY_HEADER_SIZE);
    return 0;
 }
@@ -672,8 +663,6 @@ dnsc_find_cert(struct dnsc_env* dnscenv, struct sldns_buffer* buffer)
 	}
 	dnscrypt_header = (struct dnscrypt_query_header *)sldns_buffer_begin(buffer);
 	for (i = 0U; i < dnscenv->signed_certs_count; i++) {
-		if(!certs[i].keypair)
-			continue;
 		if (memcmp(certs[i].magic_query, dnscrypt_header->magic_query,
                   DNSCRYPT_MAGIC_HEADER_LEN) == 0) {
 			return &certs[i];
@@ -815,7 +804,6 @@ dnsc_parse_keys(struct dnsc_env *env, struct config_file *cfg)
 		sizeof *env->keypairs);
 	env->certs = sodium_allocarray(env->signed_certs_count,
 		sizeof *env->certs);
-	memset(env->certs, 0, env->signed_certs_count * sizeof(*env->certs));

 	cert_id = 0U;
 	keypair_id = 0U;
@@ -842,14 +830,7 @@ dnsc_parse_keys(struct dnsc_env *env, struct config_file *cfg)
 			if(memcmp(current_keypair->crypt_publickey,
 				env->signed_certs[c].server_publickey,
 				crypto_box_PUBLICKEYBYTES) == 0) {
-				dnsccert* current_cert;
-				if(cert_id >= env->signed_certs_count) {
-					log_err("dnscrypt: secret key %s matches a cert that "
-						"is already bound to another key (duplicate "
-						"dnscrypt-secret-key?)", head->str);
-					return -1;
-				}
-				current_cert = &env->certs[cert_id++];
+				dnsccert *current_cert = &env->certs[cert_id++];
 				found_cert = 1;
 				current_cert->keypair = current_keypair;
 				memcpy(current_cert->magic_query,
@@ -931,13 +912,12 @@ dnsc_handle_curved_request(struct dnsc_env* dnscenv,
 }

 int
-dnsc_handle_uncurved_request(struct comm_reply *repinfo,
-	struct sldns_buffer* buffer)
+dnsc_handle_uncurved_request(struct comm_reply *repinfo)
 {
    if(!repinfo->c->dnscrypt) {
        return 1;
    }
-    sldns_buffer_copy(repinfo->c->dnscrypt_buffer, buffer);
+    sldns_buffer_copy(repinfo->c->dnscrypt_buffer, repinfo->c->buffer);
    if(!repinfo->is_dnscrypted) {
        return 1;
    }
@@ -983,19 +963,12 @@ dnsc_create(void)
 int
 dnsc_apply_cfg(struct dnsc_env *env, struct config_file *cfg)
 {
-    int nkeys;
    if(dnsc_parse_certs(env, cfg) <= 0) {
        fatal_exit("dnsc_apply_cfg: no cert file loaded");
    }
-    nkeys = dnsc_parse_keys(env, cfg);
-    if(nkeys <= 0) {
+    if(dnsc_parse_keys(env, cfg) <= 0) {
        fatal_exit("dnsc_apply_cfg: no key file loaded");
    }
-    if((size_t)nkeys < env->signed_certs_count) {
-	fatal_exit("dnsc_apply_cfg: %u dnscrypt-provider-cert file(s) have no "
-		"matching dnscrypt-secret-key",
-		(unsigned)(env->signed_certs_count - (size_t)nkeys));
-    }
    randombytes_buf(env->hash_key, sizeof env->hash_key);
    env->provider_name = cfg->dnscrypt_provider;

@@ -128,8 +128,7 @@ int dnsc_handle_curved_request(struct dnsc_env* dnscenv,
 * \return 0 in case of failure.
 */

-int dnsc_handle_uncurved_request(struct comm_reply *repinfo,
-	struct sldns_buffer* buffer);
+int dnsc_handle_uncurved_request(struct comm_reply *repinfo);

 /**
 * Computes the size of the shared secret cache entry.
@@ -86,31 +86,6 @@ dt_pack(const Dnstap__Dnstap *d, void **buf, size_t *sz)
 	return 1;
 }

-/** See if the message is sent due to dnstap sample rate */
-static int
-dt_sample_rate_limited(struct dt_env* env)
-{
-	lock_basic_lock(&env->sample_lock);
-	/* Sampling is every [n] packets. Where n==1, every packet is sent */
-	if(env->sample_rate > 1) {
-		int submit = 0;
-		/* if sampling is engaged... */
-		if (env->sample_rate_count > env->sample_rate) {
-			/* once the count passes the limit */
-			/* submit the message */
-			submit = 1;
-			/* and reset the count */
-			env->sample_rate_count = 0;
-		}
-		/* increment count regardless */
-		env->sample_rate_count++;
-		lock_basic_unlock(&env->sample_lock);
-		return !submit;
-	}
-	lock_basic_unlock(&env->sample_lock);
-	return 0;
-}
-
 static void
 dt_send(const struct dt_env *env, void *buf, size_t len_buf)
 {
@@ -171,89 +146,71 @@ dt_create(struct config_file* cfg)
 	env = (struct dt_env *) calloc(1, sizeof(struct dt_env));
 	if (!env)
 		return NULL;
-	lock_basic_init(&env->sample_lock);

 	env->dtio = dt_io_thread_create();
 	if(!env->dtio) {
 		log_err("malloc failure");
-		dt_delete(env);
+		free(env);
 		return NULL;
 	}
 	if(!dt_io_thread_apply_cfg(env->dtio, cfg)) {
-		dt_delete(env);
-		return NULL;
-	}
-	if(!dt_apply_cfg(env, cfg)) {
-		dt_delete(env);
+		dt_io_thread_delete(env->dtio);
+		free(env);
 		return NULL;
 	}
+	dt_apply_cfg(env, cfg);
 	return env;
 }

-static int
+static void
 dt_apply_identity(struct dt_env *env, struct config_file *cfg)
 {
 	char buf[MAXHOSTNAMELEN+1];
-	if (!cfg->dnstap_send_identity) {
-		free(env->identity);
-		env->identity = NULL;
-		env->len_identity = 0;
-		return 1;
-	}
+	if (!cfg->dnstap_send_identity)
+		return;
 	free(env->identity);
 	if (cfg->dnstap_identity == NULL || cfg->dnstap_identity[0] == 0) {
 		if (gethostname(buf, MAXHOSTNAMELEN) == 0) {
 			buf[MAXHOSTNAMELEN] = 0;
 			env->identity = strdup(buf);
 		} else {
-			log_err("dt_apply_identity: gethostname() failed: %s",
-				strerror(errno));
-			env->identity = NULL;
-			env->len_identity = 0;
-			return 0;
+			fatal_exit("dt_apply_identity: gethostname() failed");
 		}
 	} else {
 		env->identity = strdup(cfg->dnstap_identity);
 	}
-	if (env->identity == NULL) {
-		log_err("dt_apply_identity: strdup() failed");
-		env->len_identity = 0;
-		return 0;
-	}
+	if (env->identity == NULL)
+		fatal_exit("dt_apply_identity: strdup() failed");
 	env->len_identity = (unsigned int)strlen(env->identity);
 	verbose(VERB_OPS, "dnstap identity field set to \"%s\"",
 		env->identity);
-	return 1;
 }

-static int
+static void
 dt_apply_version(struct dt_env *env, struct config_file *cfg)
 {
-	if (!cfg->dnstap_send_version) {
-		free(env->version);
-		env->version = NULL;
-		env->len_version = 0;
-		return 1;
-	}
+	if (!cfg->dnstap_send_version)
+		return;
 	free(env->version);
 	if (cfg->dnstap_version == NULL || cfg->dnstap_version[0] == 0)
 		env->version = strdup(PACKAGE_STRING);
 	else
 		env->version = strdup(cfg->dnstap_version);
-	if (env->version == NULL) {
-		log_err("dt_apply_version: strdup() failed");
-		env->len_version = 0;
-		return 0;
-	}
+	if (env->version == NULL)
+		fatal_exit("dt_apply_version: strdup() failed");
 	env->len_version = (unsigned int)strlen(env->version);
 	verbose(VERB_OPS, "dnstap version field set to \"%s\"",
 		env->version);
-	return 1;
 }

 void
-dt_apply_logcfg(struct dt_env *env, struct config_file *cfg)
+dt_apply_cfg(struct dt_env *env, struct config_file *cfg)
 {
+	if (!cfg->dnstap)
+		return;
+
+	dt_apply_identity(env, cfg);
+	dt_apply_version(env, cfg);
 	if ((env->log_resolver_query_messages = (unsigned int)
 	     cfg->dnstap_log_resolver_query_messages))
 	{
@@ -284,26 +241,6 @@ dt_apply_logcfg(struct dt_env *env, struct config_file *cfg)
 	{
 		verbose(VERB_OPS, "dnstap Message/FORWARDER_RESPONSE enabled");
 	}
-	lock_basic_lock(&env->sample_lock);
-	if((env->sample_rate = (unsigned int)cfg->dnstap_sample_rate))
-	{
-		verbose(VERB_OPS, "dnstap SAMPLE_RATE enabled and set to \"%d\"", (int)env->sample_rate);
-	}
-	lock_basic_unlock(&env->sample_lock);
-}
-
-int
-dt_apply_cfg(struct dt_env *env, struct config_file *cfg)
-{
-	if (!cfg->dnstap)
-		return 1;
-
-	dt_apply_logcfg(env, cfg);
-	if(!dt_apply_identity(env, cfg))
-		return 0;
-	if(!dt_apply_version(env, cfg))
-		return 0;
-	return 1;
 }

 int
@@ -336,7 +273,6 @@ dt_delete(struct dt_env *env)
 	if (!env)
 		return;
 	dt_io_thread_delete(env->dtio);
-	lock_basic_destroy(&env->sample_lock);
 	free(env->identity);
 	free(env->version);
 	free(env);
@@ -473,9 +409,6 @@ dt_msg_send_client_query(struct dt_env *env,
 	struct dt_msg dm;
 	struct timeval qtime;

-	if(dt_sample_rate_limited(env))
-		return;
-
 	if(tstamp)
 		memcpy(&qtime, tstamp, sizeof(qtime));
 	else 	gettimeofday(&qtime, NULL);
@@ -514,9 +447,6 @@ dt_msg_send_client_response(struct dt_env *env,
 	struct dt_msg dm;
 	struct timeval rtime;

-	if(dt_sample_rate_limited(env))
-		return;
-
 	gettimeofday(&rtime, NULL);

 	/* type */
@@ -554,14 +484,11 @@ dt_msg_send_outside_query(struct dt_env *env,
 	struct timeval qtime;
 	uint16_t qflags;

-	if(dt_sample_rate_limited(env))
-		return;
-
 	gettimeofday(&qtime, NULL);
 	qflags = sldns_buffer_read_u16_at(qmsg, 2);

 	/* type */
-	if ((qflags & BIT_RD)) {
+	if (qflags & BIT_RD) {
 		if (!env->log_forwarder_query_messages)
 			return;
 		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_QUERY);
@@ -610,15 +537,12 @@ dt_msg_send_outside_response(struct dt_env *env,
 	struct dt_msg dm;
 	uint16_t qflags;

-	if(dt_sample_rate_limited(env))
-		return;
-
 	(void)qbuf_len; log_assert(qbuf_len >= sizeof(qflags));
 	memcpy(&qflags, qbuf, sizeof(qflags));
 	qflags = ntohs(qflags);

 	/* type */
-	if ((qflags & BIT_RD)) {
+	if (qflags & BIT_RD) {
 		if (!env->log_forwarder_response_messages)
 			return;
 		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_RESPONSE);
@@ -39,7 +39,6 @@

 #ifdef USE_DNSTAP

-#include "util/locks.h"
 struct config_file;
 struct sldns_buffer;
 struct dt_msg_queue;
@@ -76,13 +75,6 @@ struct dt_env {
 	unsigned log_forwarder_query_messages : 1;
 	/** whether to log Message/FORWARDER_RESPONSE */
 	unsigned log_forwarder_response_messages : 1;
-
-	/** lock on sample count */
-	lock_basic_type sample_lock;
-	/** rate limit value from config, samples 1/N messages */
-	unsigned int sample_rate;
-	/** rate limit counter */
-	unsigned int sample_rate_count;
 };

 /**
@@ -102,16 +94,9 @@ dt_create(struct config_file* cfg);
 * Apply config settings.
 * @param env: dnstap environment object.
 * @param cfg: new config settings.
- * @return false on failure.
 */
-int dt_apply_cfg(struct dt_env *env, struct config_file *cfg);
-
-/**
- * Apply config settings for log enable for message types.
- * @param env: dnstap environment object.
- * @param cfg: new config settings.
- */
-void dt_apply_logcfg(struct dt_env *env, struct config_file *cfg);
+void
+dt_apply_cfg(struct dt_env *env, struct config_file *cfg);

 /**
 * Initialize per-worker state in dnstap environment object.
@@ -18,41 +18,10 @@ AC_DEFUN([dt_DNSTAP],
        [opt_dnstap_socket_path="$1"])

    if test "x$opt_dnstap" != "xno"; then
-	AC_PATH_PROG([PROTOC], [protoc])
-	# 'protoc-c' is deprecated. We use 'protoc' instead. If it can not be
-	# found, try 'protoc-c'.
-	if test -z "$PROTOC"; then
-	    AC_PATH_PROG([PROTOC_C], [protoc-c])
-	else
-	    PROTOC_C="$PROTOC"
-	fi
-	if test -z "$PROTOC_C"; then
-	  AC_MSG_ERROR([[The protoc or protoc-c program was not found. It is needed for dnstap, use --disable-dnstap, or install protobuf-c to provide protoc or protoc-c]])
-	fi
-
-	# Check for protoc-gen-c plugin
-	AC_PATH_PROG([PROTOC_GEN_C], [protoc-gen-c])
-	if test -z "$PROTOC_GEN_C"; then
-	  AC_MSG_ERROR([[The protoc-gen-c plugin was not found. It is needed for dnstap, use --disable-dnstap, or install protobuf-c-compiler to provide protoc-gen-c]])
-	fi
-
-	# Test that protoc-gen-c actually works
-	AC_MSG_CHECKING([if protoc-gen-c plugin works])
-	cat > conftest.proto << EOF
-syntax = "proto2";
-message TestMessage {
-  optional string test_field = 1;
-}
-EOF
-	if $PROTOC_C --c_out=. conftest.proto >/dev/null 2>&1; then
-	  AC_MSG_RESULT([yes])
-	  rm -f conftest.proto conftest.pb-c.c conftest.pb-c.h
-	else
-	  AC_MSG_RESULT([no])
-	  rm -f conftest.proto conftest.pb-c.c conftest.pb-c.h
-	  AC_MSG_ERROR([[The protoc-gen-c plugin is not working properly. Please ensure protobuf-c-compiler is properly installed]])
-	fi
-
+        AC_PATH_PROG([PROTOC_C], [protoc-c])
+        if test -z "$PROTOC_C"; then
+          AC_MSG_ERROR([The protoc-c program was not found. Please install protobuf-c!])
+        fi
        AC_ARG_WITH([protobuf-c],
            AS_HELP_STRING([--with-protobuf-c=path], [Path where protobuf-c is installed, for dnstap]),
            [
@@ -65,38 +34,41 @@ EOF
                LDFLAGS="$LDFLAGS -L$withval/lib"
            ],
            [
-                if test -n "$PKG_CONFIG"; then
-                    PKG_CHECK_MODULES([PROTOBUFC], [libprotobuf-c],
-                        [
-                            CFLAGS="$CFLAGS $PROTOBUFC_CFLAGS"
-                            LIBS="$LIBS $PROTOBUFC_LIBS"
-                        ],
-                        [
-                            # pkg-config failed; try falling back to known values
-                            # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
-                            if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
-                                CFLAGS="$CFLAGS -I/usr/include/google"
-                            else
-                                if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
-                                    CFLAGS="$CFLAGS -I/usr/local/include/google"
-                                    LDFLAGS="$LDFLAGS -L/usr/local/lib"
+                ifdef([PKG_CHECK_MODULES],
+                    [
+                        PKG_CHECK_MODULES([PROTOBUFC], [libprotobuf-c],
+                            [
+                                CFLAGS="$CFLAGS $PROTOBUFC_CFLAGS"
+                                LIBS="$LIBS $PROTOBUFC_LIBS"
+                            ],
+                            [
+                                # pkg-config failed; try falling back to known values
+                                # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
+                                if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
+                                    CFLAGS="$CFLAGS -I/usr/include/google"
                                else
-                                    AC_MSG_ERROR([The protobuf-c package was not found with pkg-config. Please install protobuf-c!])
+                                    if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
+                                        CFLAGS="$CFLAGS -I/usr/local/include/google"
+                                        LDFLAGS="$LDFLAGS -L/usr/local/lib"
+                                    else
+                                        AC_MSG_ERROR([The protobuf-c package was not found with pkg-config. Please install protobuf-c!])
+                                    fi
                                fi
+                            ]
+                        )
+                    ],
+                    [
+                        # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
+                        if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
+                            CFLAGS="$CFLAGS -I/usr/include/google"
+                        else
+                            if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
+                                CFLAGS="$CFLAGS -I/usr/local/include/google"
+                                LDFLAGS="$LDFLAGS -L/usr/local/lib"
                            fi
-                        ]
-                    )
-                else
-                    # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
-                    if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
-                        CFLAGS="$CFLAGS -I/usr/include/google"
-                    else
-                        if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
-                            CFLAGS="$CFLAGS -I/usr/local/include/google"
-                            LDFLAGS="$LDFLAGS -L/usr/local/lib"
                        fi
-                    fi
-                fi
+                    ]
+                )
            ]
        )
        AC_SEARCH_LIBS([protobuf_c_message_pack], [protobuf-c], [],
@@ -98,7 +98,7 @@ message Policy {
    // rule: the rule matched by the message.
    //
    // In a RPZ context, this is the owner name of the rule in
-    // the Response Policy Zone in wire format.
+    // the Reponse Policy Zone in wire format.
    optional bytes rule = 2;

    // action: the policy action taken in response to the
@@ -176,7 +176,10 @@ void
 mq_wakeup_cb(void* arg)
 {
 	struct dt_msg_queue* mq = (struct dt_msg_queue*)arg;
-
+	/* even if the dtio is already active, because perhaps much
+	 * traffic suddenly, we leave the timer running to save on
+	 * managing it, the once a second timer is less work then
+	 * starting and stopping the timer frequently */
 	lock_basic_lock(&mq->dtio->wakeup_timer_lock);
 	mq->dtio->wakeup_timer_enabled = 0;
 	lock_basic_unlock(&mq->dtio->wakeup_timer_lock);
@@ -207,8 +210,6 @@ dt_msg_queue_start_timer(struct dt_msg_queue* mq, int wakeupnow)
 	lock_basic_lock(&mq->dtio->wakeup_timer_lock);
 	if(mq->dtio->wakeup_timer_enabled) {
 		if(wakeupnow) {
-			tv.tv_sec = 0;
-			tv.tv_usec = 0;
 			comm_timer_set(mq->wakeup_timer, &tv);
 		}
 		lock_basic_unlock(&mq->dtio->wakeup_timer_lock);
@@ -220,14 +221,8 @@ dt_msg_queue_start_timer(struct dt_msg_queue* mq, int wakeupnow)
 	if(!wakeupnow) {
 		tv.tv_sec = 1;
 		tv.tv_usec = 0;
-		/* If it is already set, keep it running. */
-		if(!comm_timer_is_set(mq->wakeup_timer))
-			comm_timer_set(mq->wakeup_timer, &tv);
-	} else {
-		tv.tv_sec = 0;
-		tv.tv_usec = 0;
-		comm_timer_set(mq->wakeup_timer, &tv);
 	}
+	comm_timer_set(mq->wakeup_timer, &tv);
 	lock_basic_unlock(&mq->dtio->wakeup_timer_lock);
 }

@@ -265,9 +260,8 @@ dt_msg_queue_submit(struct dt_msg_queue* mq, void* buf, size_t len)

 	/* acquire lock */
 	lock_basic_lock(&mq->lock);
-	/* if list was empty, start timer for (eventual) wakeup,
-	 * or if dtio is not writing now an eventual wakeup is needed. */
-	if(mq->first == NULL || !mq->dtio->event_added_is_write)
+	/* if list was empty, start timer for (eventual) wakeup */
+	if(mq->first == NULL)
 		wakeupstarttimer = 1;
 	/* if list contains more than wakeupnum elements, wakeup now,
 	 * or if list is (going to be) almost full */
@@ -448,9 +442,6 @@ int dt_io_thread_apply_cfg(struct dt_io_thread* dtio, struct config_file *cfg)
 		dtio->tls_use_sni = cfg->tls_use_sni;
 #endif /* HAVE_SSL */
 	}
-#ifdef HAVE_GETTID
-	dtio->thread_tid_log = cfg->log_thread_id;
-#endif
 	return 1;
 }

@@ -1268,13 +1259,6 @@ static void dtio_sleep(struct dt_io_thread* dtio)
 	/* unregister the event polling for write, because there is
 	 * nothing to be written */
 	(void)dtio_add_output_event_read(dtio);
-
-	/* Set wakeuptimer enabled off; so that the next worker thread that
-	 * wants to log starts a timer if needed, since the writer thread
-	 * has gone to sleep. */
-	lock_basic_lock(&dtio->wakeup_timer_lock);
-	dtio->wakeup_timer_enabled = 0;
-	lock_basic_unlock(&dtio->wakeup_timer_lock);
 }

 #ifdef HAVE_SSL
@@ -1338,11 +1322,7 @@ static int dtio_ssl_check_peer(struct dt_io_thread* dtio)
 	if((SSL_get_verify_mode(dtio->ssl)&SSL_VERIFY_PEER)) {
 		/* verification */
 		if(SSL_get_verify_result(dtio->ssl) == X509_V_OK) {
-#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
-			X509* x = SSL_get1_peer_certificate(dtio->ssl);
-#else
 			X509* x = SSL_get_peer_certificate(dtio->ssl);
-#endif
 			if(!x) {
 				verbose(VERB_ALGO, "dnstap io, %s, SSL "
 					"connection failed no certificate",
@@ -1367,11 +1347,7 @@ static int dtio_ssl_check_peer(struct dt_io_thread* dtio)
 #endif
 			X509_free(x);
 		} else {
-#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
-			X509* x = SSL_get1_peer_certificate(dtio->ssl);
-#else
 			X509* x = SSL_get_peer_certificate(dtio->ssl);
-#endif
 			if(x) {
 				log_cert(VERB_ALGO, "dnstap io, peer "
 					"certificate", x);
@@ -1512,11 +1488,9 @@ void dtio_output_cb(int ATTR_UNUSED(fd), short bits, void* arg)
 	}
 #endif

-	if((bits&UB_EV_READ) || dtio->ssl_brief_write) {
-#ifdef HAVE_SSL
+	if((bits&UB_EV_READ || dtio->ssl_brief_write)) {
 		if(dtio->ssl_brief_write)
 			(void)dtio_disable_brief_write(dtio);
-#endif
 		if(dtio->ready_frame_sent && !dtio->accept_frame_received) {
 			if(dtio_read_accept_frame(dtio) <= 0)
 				return;
@@ -1539,22 +1513,8 @@ void dtio_output_cb(int ATTR_UNUSED(fd), short bits, void* arg)
 					/* no messages on the first iteration,
 					 * the queues are all empty */
 					dtio_sleep(dtio);
-					/* After putting to sleep, see if
-					 * a message is in a message queue,
-					 * if so, resume service. Stops a
-					 * race condition where a thread could
-					 * have one message but the dtio
-					 * also just went to sleep. With the
-					 * message queued between the
-					 * dtio_find_msg and dtio_sleep
-					 * calls. */
-					if(dtio_find_msg(dtio)) {
-						if(!dtio_add_output_event_write(dtio))
-							return;
-					}
 				}
-				if(!dtio->cur_msg)
-					return; /* nothing to do */
+				return; /* nothing to do */
 			}
 		}

@@ -2133,18 +2093,7 @@ static void* dnstap_io(void* arg)
 	struct dt_io_thread* dtio = (struct dt_io_thread*)arg;
 	time_t secs = 0;
 	struct timeval now;
-	const char name[16] = "unbound/dnstap"; /* seems to be the safest size
-						   between different OSes */
-
-#if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
-	dtio->thread_tid = gettid();
-	if(dtio->thread_tid_log)
-		log_thread_set(&dtio->thread_tid);
-	else
-#endif
-		log_thread_set(&dtio->threadnum);
-
-	ub_thread_setname(ub_thread_self(), name);
+	log_thread_set(&dtio->threadnum);

 	/* setup */
 	verbose(VERB_ALGO, "start dnstap io thread");
@@ -131,12 +131,6 @@ struct dt_io_thread {
 	struct dt_io_list_item* io_list_iter;
 	/** thread id, of the io thread */
 	ub_thread_type tid;
-#ifdef HAVE_GETTID
-	/** thread tid, the LWP id */
-	pid_t thread_tid;
-	/** if logging should include the LWP id */
-	int thread_tid_log;
-#endif
 	/** if the io processing has started */
 	int started;
 	/** ssl context for the io thread, for tls connections. type SSL_CTX* */
@@ -75,18 +75,17 @@
 static void usage(char* argv[])
 {
 	printf("usage: %s [options]\n", argv[0]);
-	printf("	Listen to dnstap messages\n");
+	printf(" 	Listen to dnstap messages\n");
 	printf("stdout has dnstap log, stderr has verbose server log\n");
-	printf("-u <socketpath>		listen to unix socket with this file name\n");
-	printf("-s <serverip[@port]>	listen for TCP on the IP and port\n");
-	printf("-t <serverip[@port]>	listen for TLS on IP and port\n");
-	printf("-x <server.key>		server key file for TLS service\n");
-	printf("-y <server.pem>		server cert file for TLS service\n");
-	printf("-z <verify.pem>		cert file to verify client connections\n");
-	printf("-l			long format for DNS printout\n");
-	printf("-v			more verbose log output\n");
-	printf("-c			internal unit test and exit\n");
-	printf("-h			this help text\n");
+	printf("-u <socketpath> listen to unix socket with this file name\n");
+	printf("-s <serverip[@port]> listen for TCP on the IP and port\n");
+	printf("-t <serverip[@port]> listen for TLS on IP and port\n");
+	printf("-x <server.key> server key file for TLS service\n");
+	printf("-y <server.pem> server cert file for TLS service\n");
+	printf("-z <verify.pem> cert file to verify client connections\n");
+	printf("-l 		long format for DNS printout\n");
+	printf("-v 		more verbose log output\n");
+	printf("-h 		this help text\n");
 	exit(1);
 }

@@ -103,14 +102,6 @@ struct main_tap_data {
 	struct tap_socket_list* acceptlist;
 };

-/* list of data */
-struct tap_data_list {
-	/** next in list */
-	struct tap_data_list* next;
-	/** the data */
-	struct tap_data* d;
-};
-
 /** tap callback variables */
 struct tap_data {
 	/** the fd */
@@ -137,10 +128,6 @@ struct tap_data {
 	uint8_t* frame;
 	/** length of this frame */
 	size_t len;
-	/** back pointer to the tap_data_list entry;
-	 * used to NULL the forward pointer to this data
-	 * when this data is freed. */
-	struct tap_data_list* data_list;
 };

 /** list of sockets */
@@ -169,89 +156,8 @@ struct tap_socket {
 	char* ip;
 	/** for a TLS socket, the tls context */
 	SSL_CTX* sslctx;
-	/** dumb way to deal with memory leaks:
-	 * tap_data was only freed on errors and not during exit leading to
-	 * false positives when testing for memory leaks. */
-	struct tap_data_list* data_list;
 };

-/** try to delete tail entries from the list if all of them have no data */
-static void tap_data_list_try_to_free_tail(struct tap_data_list* list)
-{
-	struct tap_data_list* current = list;
-	log_assert(!list->d);
-	if(!list->next) /* we are the last, we can't remove ourselves */
-		return;
-	list = list->next;
-	while(list) {
-		if(list->d) /* a tail entry still has data; return */
-			return;
-		list = list->next;
-	}
-	/* keep the next */
-	list = current->next;
-	/* the tail will be removed; but not ourselves */
-	current->next = NULL;
-	while(list) {
-		current = list;
-		list = list->next;
-		free(current);
-	}
-}
-
-/** delete the tap structure */
-static void tap_data_free(struct tap_data* data, int free_tail)
-{
-	if(!data)
-		return;
-	if(data->ev) {
-		ub_event_del(data->ev);
-		ub_event_free(data->ev);
-	}
-#ifdef HAVE_SSL
-	SSL_free(data->ssl);
-#endif
-	sock_close(data->fd);
-	free(data->id);
-	free(data->frame);
-	if(data->data_list) {
-		data->data_list->d = NULL;
-		if(free_tail)
-			tap_data_list_try_to_free_tail(data->data_list);
-	}
-	free(data);
-}
-
-/** insert tap_data in the tap_data_list */
-static int tap_data_list_insert(struct tap_data_list** liststart,
-	struct tap_data* d)
-{
-	struct tap_data_list* entry = (struct tap_data_list*)
-		malloc(sizeof(*entry));
-	if(!entry)
-		return 0;
-	entry->next = *liststart;
-	entry->d = d;
-	d->data_list = entry;
-	*liststart = entry;
-	return 1;
-}
-
-/** delete the tap_data_list and free any remaining tap_data */
-static void tap_data_list_delete(struct tap_data_list* list)
-{
-	struct tap_data_list* e = list, *next;
-	while(e) {
-		next = e->next;
-		if(e->d) {
-			tap_data_free(e->d, 0);
-			e->d = NULL;
-		}
-		free(e);
-		e = next;
-	}
-}
-
 /** del the tap event */
 static void tap_socket_delev(struct tap_socket* s)
 {
@@ -267,7 +173,7 @@ static void tap_socket_close(struct tap_socket* s)
 {
 	if(!s) return;
 	if(s->fd == -1) return;
-	sock_close(s->fd);
+	close(s->fd);
 	s->fd = -1;
 }

@@ -278,7 +184,6 @@ static void tap_socket_delete(struct tap_socket* s)
 #ifdef HAVE_SSL
 	SSL_CTX_free(s->sslctx);
 #endif
-	tap_data_list_delete(s->data_list);
 	ub_event_free(s->ev);
 	free(s->socketpath);
 	free(s->ip);
@@ -330,7 +235,7 @@ static struct tap_socket* tap_socket_new_tcpaccept(char* ip,
 /** create new socket (unconnected, not base-added), or NULL malloc fail */
 static struct tap_socket* tap_socket_new_tlsaccept(char* ip,
 	void (*ev_cb)(int, short, void*), void* data, char* server_key,
-	char* server_cert, char* verifypem, char* tls_protocols)
+	char* server_cert, char* verifypem)
 {
 	struct tap_socket* s = calloc(1, sizeof(*s));
 	if(!s) {
@@ -346,8 +251,7 @@ static struct tap_socket* tap_socket_new_tlsaccept(char* ip,
 	s->fd = -1;
 	s->ev_cb = ev_cb;
 	s->data = data;
-	s->sslctx = listen_sslctx_create(server_key, server_cert, verifypem,
-		NULL, NULL, 0, 0, 0, tls_protocols);
+	s->sslctx = listen_sslctx_create(server_key, server_cert, verifypem);
 	if(!s->sslctx) {
 		log_err("could not create ssl context");
 		free(s->ip);
@@ -824,12 +728,27 @@ static ssize_t tap_receive(struct tap_data* data, void* buf, size_t len)
 	return receive_bytes(data, data->fd, buf, len);
 }

+/** delete the tap structure */
+static void tap_data_free(struct tap_data* data)
+{
+	ub_event_del(data->ev);
+	ub_event_free(data->ev);
+#ifdef HAVE_SSL
+	SSL_free(data->ssl);
+#endif
+	close(data->fd);
+	free(data->id);
+	free(data->frame);
+	free(data);
+}
+
 /** reply with ACCEPT control frame to bidirectional client,
 * returns 0 on error */
 static int reply_with_accept(struct tap_data* data)
 {
 #ifdef USE_DNSTAP
 	/* len includes the escape and framelength */
+	int r;
 	size_t len = 0;
 	void* acceptframe = fstrm_create_control_frame_accept(
 		DNSTAP_CONTENT_TYPE, &len);
@@ -840,8 +759,6 @@ static int reply_with_accept(struct tap_data* data)

 	fd_set_block(data->fd);
 	if(data->ssl) {
-#ifdef HAVE_SSL
-		int r;
 		if((r=SSL_write(data->ssl, acceptframe, len)) <= 0) {
 			int r2;
 			if((r2=SSL_get_error(data->ssl, r)) == SSL_ERROR_ZERO_RETURN)
@@ -852,7 +769,6 @@ static int reply_with_accept(struct tap_data* data)
 			free(acceptframe);
 			return 0;
 		}
-#endif
 	} else {
 		if(send(data->fd, acceptframe, len, 0) == -1) {
 			log_err("send failed: %s", sock_strerror(errno));
@@ -888,7 +804,6 @@ static int reply_with_finish(struct tap_data* data)

 	fd_set_block(data->fd);
 	if(data->ssl) {
-#ifdef HAVE_SSL
 		int r;
 		if((r=SSL_write(data->ssl, finishframe, len)) <= 0) {
 			int r2;
@@ -900,7 +815,6 @@ static int reply_with_finish(struct tap_data* data)
 			free(finishframe);
 			return 0;
 		}
-#endif
 	} else {
 		if(send(data->fd, finishframe, len, 0) == -1) {
 			log_err("send failed: %s", sock_strerror(errno));
@@ -928,11 +842,7 @@ static int tap_check_peer(struct tap_data* data)
 	if((SSL_get_verify_mode(data->ssl)&SSL_VERIFY_PEER)) {
 		/* verification */
 		if(SSL_get_verify_result(data->ssl) == X509_V_OK) {
-#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
-			X509* x = SSL_get1_peer_certificate(data->ssl);
-#else
 			X509* x = SSL_get_peer_certificate(data->ssl);
-#endif
 			if(!x) {
 				if(verbosity) log_info("SSL connection %s"
 					" failed no certificate", data->id);
@@ -954,11 +864,7 @@ static int tap_check_peer(struct tap_data* data)
 #endif
 			X509_free(x);
 		} else {
-#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
-			X509* x = SSL_get1_peer_certificate(data->ssl);
-#else
 			X509* x = SSL_get_peer_certificate(data->ssl);
-#endif
 			if(x) {
 				if(verbosity)
 					log_cert(VERB_ALGO, "peer certificate", x);
@@ -1000,7 +906,7 @@ static int tap_handshake(struct tap_data* data)
 			return 0;
 		} else if(r == 0) {
 			/* closed */
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return 0;
 		} else if(want == SSL_ERROR_SYSCALL) {
 			/* SYSCALL and errno==0 means closed uncleanly */
@@ -1018,7 +924,7 @@ static int tap_handshake(struct tap_data* data)
 			if(!silent)
 				log_err("SSL_handshake syscall: %s",
 					strerror(errno));
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return 0;
 		} else {
 			unsigned long err = ERR_get_error();
@@ -1028,7 +934,7 @@ static int tap_handshake(struct tap_data* data)
 				verbose(VERB_OPS, "ssl handshake failed "
 					"from %s", data->id);
 			}
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return 0;
 		}
 	}
@@ -1036,7 +942,7 @@ static int tap_handshake(struct tap_data* data)
 	data->ssl_handshake_done = 1;
 	if(!tap_check_peer(data)) {
 		/* closed */
-		tap_data_free(data, 1);
+		tap_data_free(data);
 		return 0;
 	}
 	return 1;
@@ -1062,7 +968,7 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 		if(verbosity>=4) log_info("s recv %d", (int)ret);
 		if(ret == 0) {
 			/* closed or error */
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return;
 		} else if(ret == -1) {
 			/* continue later */
@@ -1084,7 +990,7 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 			data->frame = calloc(1, data->len);
 			if(!data->frame) {
 				log_err("out of memory");
-				tap_data_free(data, 1);
+				tap_data_free(data);
 				return;
 			}
 		}
@@ -1097,7 +1003,7 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 		if(verbosity>=4) log_info("f recv %d", (int)r);
 		if(r == 0) {
 			/* closed or error */
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return;
 		} else if(r == -1) {
 			/* continue later */
@@ -1122,13 +1028,13 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 		data->is_bidirectional = 1;
 		if(verbosity) log_info("bidirectional stream");
 		if(!reply_with_accept(data)) {
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return;
 		}
 	} else if(data->len >= 4 && sldns_read_uint32(data->frame) ==
 		FSTRM_CONTROL_FRAME_STOP && data->is_bidirectional) {
 		if(!reply_with_finish(data)) {
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return;
 		}
 	}
@@ -1140,6 +1046,7 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 	data->len = 0;
 	data->len_done = 0;
 	data->data_done = 0;
+
 }

 /** callback for main listening file descriptor */
@@ -1152,9 +1059,7 @@ void dtio_mainfdcallback(int fd, short ATTR_UNUSED(bits), void* arg)
 	char* id = NULL;
 	struct sockaddr_storage addr;
 	socklen_t addrlen = (socklen_t)sizeof(addr);
-	int s;
-	memset(&addr, 0, sizeof(addr));
-	s = accept(fd, (struct sockaddr*)&addr, &addrlen);
+	int s = accept(fd, (struct sockaddr*)&addr, &addrlen);
 	if(s == -1) {
 #ifndef USE_WINSOCK
 		/* EINTR is signal interrupt. others are closed connection. */
@@ -1224,8 +1129,6 @@ void dtio_mainfdcallback(int fd, short ATTR_UNUSED(bits), void* arg)
 		&dtio_tap_callback, data);
 	if(!data->ev) fatal_exit("could not ub_event_new");
 	if(ub_event_add(data->ev, NULL) != 0) fatal_exit("could not ub_event_add");
-	if(!tap_data_list_insert(&tap_sock->data_list, data))
-		fatal_exit("could not tap_data_list_insert");
 }

 /** setup local accept sockets */
@@ -1261,13 +1164,13 @@ static void setup_tcp_list(struct main_tap_data* maindata,
 /** setup tls accept sockets */
 static void setup_tls_list(struct main_tap_data* maindata,
 	struct config_strlist_head* tls_list, char* server_key,
-	char* server_cert, char* verifypem, char* tls_protocols)
+	char* server_cert, char* verifypem)
 {
 	struct config_strlist* item;
 	for(item = tls_list->first; item; item = item->next) {
 		struct tap_socket* s;
 		s = tap_socket_new_tlsaccept(item->str, &dtio_mainfdcallback,
-			maindata, server_key, server_cert, verifypem, tls_protocols);
+			maindata, server_key, server_cert, verifypem);
 		if(!s) fatal_exit("out of memory");
 		if(!tap_socket_list_insert(&maindata->acceptlist, s))
 			fatal_exit("out of memory");
@@ -1300,7 +1203,7 @@ static void
 setup_and_run(struct config_strlist_head* local_list,
 	struct config_strlist_head* tcp_list,
 	struct config_strlist_head* tls_list, char* server_key,
-	char* server_cert, char* verifypem, char* tls_protocols)
+	char* server_cert, char* verifypem)
 {
 	time_t secs = 0;
 	struct timeval now;
@@ -1326,7 +1229,7 @@ setup_and_run(struct config_strlist_head* local_list,
 	setup_local_list(maindata, local_list);
 	setup_tcp_list(maindata, tcp_list);
 	setup_tls_list(maindata, tls_list, server_key, server_cert,
-		verifypem, tls_protocols);
+		verifypem);
 	if(!tap_socket_list_addevs(maindata->acceptlist, base))
 		fatal_exit("could not setup accept events");
 	if(verbosity) log_info("start of service");
@@ -1340,114 +1243,6 @@ setup_and_run(struct config_strlist_head* local_list,
 	free(maindata);
 }

-/* internal unit tests */
-static int internal_unittest()
-{
-	/* unit test tap_data_list_try_to_free_tail() */
-#define unit_tap_datas_max 5
-	struct tap_data* datas[unit_tap_datas_max];
-	struct tap_data_list* list;
-	struct tap_socket* socket = calloc(1, sizeof(*socket));
-	size_t i = 0;
-	log_assert(socket);
-	log_assert(unit_tap_datas_max>2); /* needed for the test */
-	for(i=0; i<unit_tap_datas_max; i++) {
-		datas[i] = calloc(1, sizeof(struct tap_data));
-		log_assert(datas[i]);
-		log_assert(tap_data_list_insert(&socket->data_list, datas[i]));
-	}
-	/* sanity base check */
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==unit_tap_datas_max);
-
-	/* Free the last data, tail cannot be erased */
-	list = socket->data_list;
-	while(list->next) list = list->next;
-	free(list->d);
-	list->d = NULL;
-	tap_data_list_try_to_free_tail(list);
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==unit_tap_datas_max);
-
-	/* Free the third to last data, tail cannot be erased */
-	list = socket->data_list;
-	for(i=0; i<unit_tap_datas_max-3; i++) list = list->next;
-	free(list->d);
-	list->d = NULL;
-	tap_data_list_try_to_free_tail(list);
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==unit_tap_datas_max);
-
-	/* Free the second to last data, try to remove tail from the third
-	 * again, tail (last 2) should be removed */
-	list = socket->data_list;
-	for(i=0; i<unit_tap_datas_max-2; i++) list = list->next;
-	free(list->d);
-	list->d = NULL;
-	list = socket->data_list;
-	while(list->d) list = list->next;
-	tap_data_list_try_to_free_tail(list);
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==unit_tap_datas_max-2);
-
-	/* Free all the remaining data, try to remove tail from the start,
-	 * only the start should remain */
-	list = socket->data_list;
-	while(list) {
-		free(list->d);
-		list->d = NULL;
-		list = list->next;
-	}
-	tap_data_list_try_to_free_tail(socket->data_list);
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==1);
-
-	/* clean up */
-	tap_data_list_delete(socket->data_list);
-	free(socket);
-
-	/* Start again. Add two elements */
-	socket = calloc(1, sizeof(*socket));
-	log_assert(socket);
-	for(i=0; i<2; i++) {
-		datas[i] = calloc(1, sizeof(struct tap_data));
-		log_assert(datas[i]);
-		log_assert(tap_data_list_insert(&socket->data_list, datas[i]));
-	}
-	/* sanity base check */
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==2);
-
-	/* Free the last data, tail cannot be erased */
-	list = socket->data_list;
-	while(list->next) list = list->next;
-	free(list->d);
-	list->d = NULL;
-	tap_data_list_try_to_free_tail(list);
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==2);
-
-	/* clean up */
-	tap_data_list_delete(socket->data_list);
-	free(socket);
-
-	if(log_get_lock()) {
-		lock_basic_destroy((lock_basic_type*)log_get_lock());
-	}
-	checklock_stop();
-#ifdef USE_WINSOCK
-	WSACleanup();
-#endif
-	return 0;
-}
-
 /** getopt global, in case header files fail to declare it. */
 extern int optind;
 /** getopt global, in case header files fail to declare it. */
@@ -1462,8 +1257,6 @@ int main(int argc, char** argv)
 	struct config_strlist_head tcp_list;
 	struct config_strlist_head tls_list;
 	char* server_key = NULL, *server_cert = NULL, *verifypem = NULL;
-
-	char* tls_protocols = "TLSv1.2 TLSv1.3";
 #ifdef USE_WINSOCK
 	WSADATA wsa_data;
 	if(WSAStartup(MAKEWORD(2,2), &wsa_data) != 0) {
@@ -1500,7 +1293,7 @@ int main(int argc, char** argv)
 #endif

 	/* command line options */
-	while( (c=getopt(argc, argv, "hcls:t:u:vx:y:z:")) != -1) {
+	while( (c=getopt(argc, argv, "hls:t:u:vx:y:z:")) != -1) {
 		switch(c) {
 			case 'u':
 				if(!cfg_strlist_append(&local_list,
@@ -1536,20 +1329,14 @@ int main(int argc, char** argv)
 			case 'v':
 				verbosity++;
 				break;
-			case 'c':
-#ifndef UNBOUND_DEBUG
-				fatal_exit("-c option needs compilation with "
-					"--enable-debug");
-#endif
-				return internal_unittest();
 			case 'h':
 			case '?':
 			default:
 				usage(argv);
 		}
 	}
-	/* argc -= optind; not using further arguments */
-	/* argv += optind; not using further arguments */
+	argc -= optind;
+	argv += optind;

 	if(usessl) {
 #ifdef HAVE_SSL
@@ -1563,32 +1350,21 @@ int main(int argc, char** argv)
 #else
 		OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 			| OPENSSL_INIT_ADD_ALL_DIGESTS
-			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-			| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-			, NULL);
+			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 		(void)SSL_library_init();
 #else
-		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-			| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-			, NULL);
+		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 #endif /* HAVE_SSL */
 	}
 	setup_and_run(&local_list, &tcp_list, &tls_list, server_key,
-		server_cert, verifypem, tls_protocols);
+		server_cert, verifypem);
 	config_delstrlist(local_list.first);
 	config_delstrlist(tcp_list.first);
 	config_delstrlist(tls_list.first);

-	if(log_get_lock()) {
-		lock_basic_destroy((lock_basic_type*)log_get_lock());
-	}
 	checklock_stop();
 #ifdef USE_WINSOCK
 	WSACleanup();
@@ -1659,8 +1435,7 @@ struct outbound_entry* worker_send_query(
 	socklen_t ATTR_UNUSED(addrlen), uint8_t* ATTR_UNUSED(zone),
 	size_t ATTR_UNUSED(zonelen), int ATTR_UNUSED(tcp_upstream),
 	int ATTR_UNUSED(ssl_upstream), char* ATTR_UNUSED(tls_auth_name),
-	struct module_qstate* ATTR_UNUSED(q), int* ATTR_UNUSED(was_ratelimited),
-	int* ATTR_UNUSED(ratelimit_incremented))
+	struct module_qstate* ATTR_UNUSED(q), int* ATTR_UNUSED(was_ratelimited))
 {
 	log_assert(0);
 	return 0;
@@ -1694,8 +1469,7 @@ struct outbound_entry* libworker_send_query(
 	socklen_t ATTR_UNUSED(addrlen), uint8_t* ATTR_UNUSED(zone),
 	size_t ATTR_UNUSED(zonelen), int ATTR_UNUSED(tcp_upstream),
 	int ATTR_UNUSED(ssl_upstream), char* ATTR_UNUSED(tls_auth_name),
-	struct module_qstate* ATTR_UNUSED(q), int* ATTR_UNUSED(was_ratelimited),
-	int* ATTR_UNUSED(ratelimit_incremented))
+	struct module_qstate* ATTR_UNUSED(q), int* ATTR_UNUSED(was_ratelimited))
 {
 	log_assert(0);
 	return 0;
@@ -1737,11 +1511,6 @@ void libworker_event_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
 	log_assert(0);
 }

-void libworker_alloc_cleanup(void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
 int context_query_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
 {
 	log_assert(0);
@@ -1803,33 +1572,3 @@ void remote_get_opt_ssl(char* ATTR_UNUSED(str), void* ATTR_UNUSED(arg))
 {
        log_assert(0);
 }
-
-void fast_reload_service_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
-int fast_reload_client_callback(struct comm_point* ATTR_UNUSED(c),
-	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
-        struct comm_reply* ATTR_UNUSED(repinfo))
-{
-	log_assert(0);
-	return 0;
-}
-
-#ifdef HAVE_NGTCP2
-void doq_client_event_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
-
-#ifdef HAVE_NGTCP2
-void doq_client_timer_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
@@ -13,7 +13,7 @@ If you're not using DNSSEC then you may remove "validator".

 2. The "dns64-prefix" directive indicates your DNS64 prefix. For example:

-    dns64-prefix: 64:ff9b::/96
+    dns64-prefix: 64:FF9B::/96

 The prefix must be a /96 or shorter.

@@ -42,9 +42,9 @@ To enable NAT64 in Unbound, add to unbound.conf's "server" section:
    do-nat64: yes

 The NAT64 prefix defaults to the DNS64 prefix, which in turn defaults to the
-standard 64:ff9b::/96 prefix.  You can reconfigure it with:
+standard 64:FF9B::/96 prefix.  You can reconfigure it with:

-    nat64-prefix: 64:ff9b::/96
+    nat64-prefix: 64:FF9B::/96

 To test NAT64 operation, pick a domain that only has IPv4 reachability for its
 nameservers and try resolving any names in that domain.
@@ -1,21 +0,0 @@
-After Unbound 1.23.0, the source of the man pages is in reStructuredText format.
-
-This helps with the online documentation at https://unbound.docs.nlnetlabs.nl
-and makes it easier to maintain and contribute to the documentation.
-
-The templated man pages (*.in) are still part of the code repository as to not
-alter current procedures that could be in place by users/packagers.
-
-These man pages (*.in) are still the ones being used when
-configuring/installing Unbound.
-Packagers/users do not have to generate any man pages themselves, this is done
-by the core developers during development and upon releasing new versions.
-
-The templated man pages (*.in) are generated by Sphinx (used for the online
-documentation).
-The online documentation has its own repository at
-https://github.com/NLnetLabs/unbound-manual.
-
-In that README.md (https://github.com/NLnetLabs/unbound-manual/README.md)
-there are further simple instructions on how to generate the templated man
-pages there and update them in this repository.
@@ -54,7 +54,7 @@ server:
 	# interface: 192.0.2.153
 	# interface: 192.0.2.154
 	# interface: 192.0.2.154@5003
-	# interface: 2001:db8::5
+	# interface: 2001:DB8::5
 	# interface: eth0@5003

 	# enable this feature to copy the source address of queries to reply.
@@ -72,12 +72,12 @@ server:
 	# server from by ip-address. If none, the default (all) interface
 	# is used. Specify every interface on a 'outgoing-interface:' line.
 	# outgoing-interface: 192.0.2.153
-	# outgoing-interface: 2001:db8::5
-	# outgoing-interface: 2001:db8::6
+	# outgoing-interface: 2001:DB8::5
+	# outgoing-interface: 2001:DB8::6

 	# Specify a netblock to use remainder 64 bits as random bits for
 	# upstream queries.  Uses freebind option (Linux).
-	# outgoing-interface: 2001:db8::/64
+	# outgoing-interface: 2001:DB8::/64
 	# Also (Linux:) ip -6 addr add 2001:db8::/64 dev lo
 	# And: ip -6 route add local 2001:db8::/64 dev lo
 	# And set prefer-ip6: yes to use the ip6 randomness from a netblock.
@@ -116,8 +116,8 @@ server:
 	# so-rcvbuf: 0

 	# buffer size for UDP port 53 outgoing (SO_SNDBUF socket option).
-	# 0 is system default. Set larger to handle spikes on very busy servers.
-	# so-sndbuf: 4m
+	# 0 is system default.  Use 4m to handle spikes on very busy servers.
+	# so-sndbuf: 0

 	# use SO_REUSEPORT to distribute queries over threads.
 	# at extreme load it could be better to turn it off to distribute even.
@@ -163,7 +163,7 @@ server:
 	# msg-cache-slabs: 4

 	# the number of queries that a thread gets to service.
-	# num-queries-per-thread: 2048
+	# num-queries-per-thread: 1024

 	# if very busy, 50% queries run to completion, 50% get timeout in msec
 	# jostle-timeout: 200
@@ -187,22 +187,6 @@ server:
 	# query upon encountering a CNAME record.
 	# max-query-restarts: 11

-	# Limit on number of NS records in NS RRset for incoming packets.
-	# iter-scrub-ns: 20
-
-	# Limit on number of CNAME, DNAME records for incoming packets.
-	# iter-scrub-cname: 11
-
-	# Limit on number of RRSIGs for an RRset for incoming packets.
-	# iter-scrub-rrsig: 8
-
-	# Limit on upstream queries for an incoming query and its recursion.
-	# max-global-quota: 200
-
-	# Should the scrubber remove promiscuous NS from positive answers,
-	# protects against poison attempts.
-	# iter-scrub-promiscuous: yes
-
 	# msec for waiting for an unknown server to reply.  Increase if you
 	# are behind a slow satellite link, to eg. 1128.
 	# unknown-server-time-limit: 376
@@ -222,12 +206,6 @@ server:
 	# Apart from the default, the wait limit with cookie can be adjusted.
 	# wait-limit-cookie-netblock: 192.0.2.0/24 50000

-	# Defaults for loopback, it has no wait limit.
-	# wait-limit-netblock: 127.0.0.0/8 -1
-	# wait-limit-netblock: ::1/128 -1
-	# wait-limit-cookie-netblock: 127.0.0.0/8 -1
-	# wait-limit-cookie-netblock: ::1/128 -1
-
 	# the amount of memory to use for the RRset cache.
 	# plain value in bytes or you can append k, m or G. default is "4Mb".
 	# rrset-cache-size: 4m
@@ -250,7 +228,7 @@ server:

 	# the time to live (TTL) value lower bound, in seconds. Default 0.
 	# For negative responses in the cache. If disabled, default,
-	# cache-min-ttl applies if configured.
+	# cache-min-tll applies if configured.
 	# cache-min-negative-ttl: 0

 	# the time to live (TTL) value for cached roundtrip times, lameness and
@@ -286,7 +264,7 @@ server:
 	# do-ip6: yes

 	# If running unbound on an IPv6-only host, domains that only have
-	# IPv4 servers would become unresolvable.  If NAT64 is available in
+	# IPv4 servers would become unresolveable.  If NAT64 is available in
 	# the network, unbound can use NAT64 to reach these servers with
 	# the following option.  This is NOT needed for enabling DNS64 on a
 	# system that has IPv4 connectivity.
@@ -382,7 +360,7 @@ server:
 	# interface-action: 192.0.2.153 allow
 	# interface-action: 192.0.2.154 allow
 	# interface-action: 192.0.2.154@5003 allow
-	# interface-action: 2001:db8::5 allow
+	# interface-action: 2001:DB8::5 allow
 	# interface-action: eth0@5003 allow

 	# Similar to 'access-control-tag:' but for interfaces.
@@ -474,10 +452,6 @@ server:
 	# print UTC timestamp in ascii to logfile, default is epoch in seconds.
 	# log-time-ascii: no

-	# log timestamp in ISO8601 format if also log-time-ascii is enabled.
-	# (y-m-dTh:m:s.msec[+-]tzhours:tzminutes)
-	# log-time-iso: no
-
 	# print one line with time, IP, name, type, class for every query.
 	# log-queries: no

@@ -499,10 +473,6 @@ server:
 	# print log lines that say why queries return SERVFAIL to clients.
 	# log-servfail: no

-	# log system-wide Linux thread ID, insted of Unbound's internal thread
-	# counter. Only on Linux and only when threads are available.
-	# log-thread-id: no
-
 	# the pid file. Can be an absolute path outside of chroot/work dir.
 	# pidfile: "@UNBOUND_PIDFILE@"

@@ -554,9 +524,6 @@ server:
 	# Harden against out of zone rrsets, to avoid spoofing attempts.
 	# harden-glue: yes

-	# Harden against unverified (outside-zone, including sibling zone) glue rrsets
-	# harden-unverified-glue: no
-
 	# Harden against receiving dnssec-stripped data. If you turn it
 	# off, failing to validate dnskey data for a trustanchor will
 	# trigger insecure mode for that zone (like without a trustanchor).
@@ -573,9 +540,8 @@ server:
 	# harden-referral-path: no

 	# Harden against algorithm downgrade when multiple algorithms are
-	# advertised in the DS record.  If no, allows any algorithm
-	# to validate the zone which is the standard behavior for validators.
-	# Check the manpage for detailed information.
+	# advertised in the DS record.  If no, allows the weakest algorithm
+	# to validate the zone.
 	# harden-algo-downgrade: no

 	# Harden against unknown records in the authority section and the
@@ -665,7 +631,7 @@ server:
 	# or, just before the iterator).
 	# module-config: "validator iterator"

-	# File with trusted keys, kept up-to-date using RFC5011 probes,
+	# File with trusted keys, kept uptodate using RFC5011 probes,
 	# initial file like trust-anchor-file, then it stores metadata.
 	# Use several entries, one per domain name, to track multiple zones.
 	#
@@ -725,7 +691,7 @@ server:
 	# val-max-restart: 5

 	# Should additional section of secure message also be kept clean of
-	# non-secure data. Useful to shield the users of this validator from
+	# unsecure data. Useful to shield the users of this validator from
 	# potential bogus data in the additional section. All unsigned data
 	# in the additional section is removed from secure messages.
 	# val-clean-additional: yes
@@ -748,13 +714,12 @@ server:
 	# disable-edns-do: no

 	# Serve expired responses from cache, with serve-expired-reply-ttl in
-	# the response. By default it first tries to refresh an expired answer.
-	# Can be configured with serve-expired-client-timeout.
+	# the response, and then attempt to fetch the data afresh.
 	# serve-expired: no
 	#
 	# Limit serving of expired responses to configured seconds after
 	# expiration. 0 disables the limit.
-	# serve-expired-ttl: 86400
+	# serve-expired-ttl: 0
 	#
 	# Set the TTL of expired records to the serve-expired-ttl value after a
 	# failed attempt to retrieve the record from upstream. This makes sure
@@ -763,14 +728,14 @@ server:
 	# serve-expired-ttl-reset: no
 	#
 	# TTL value to use when replying with expired data.
-	# Capped by the original TTL of the record.
 	# serve-expired-reply-ttl: 30
 	#
 	# Time in milliseconds before replying to the client with expired data.
 	# This essentially enables the serve-stale behavior as specified in
-	# RFC 8767 that first tries to resolve before immediately responding
-	# with expired data.  0 disables this behavior.
-	# serve-expired-client-timeout: 1800
+	# RFC 8767 that first tries to resolve before
+	# immediately responding with expired data.  0 disables this behavior.
+	# A recommended value is 1800.
+	# serve-expired-client-timeout: 0

 	# Return the original TTL as received from the upstream name server rather
 	# than the decrementing TTL as stored in the cache.  Enabling this feature
@@ -829,8 +794,6 @@ server:
 	# local-zone: "127.in-addr.arpa." nodefault
 	# local-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." nodefault
 	# local-zone: "home.arpa." nodefault
-	# local-zone: "resolver.arpa." nodefault
-	# local-zone: "service.arpa." nodefault
 	# local-zone: "onion." nodefault
 	# local-zone: "test." nodefault
 	# local-zone: "invalid." nodefault
@@ -899,10 +862,6 @@ server:
 	#   that name
 	# o block_a resolves all records normally but returns
 	#   NODATA for A queries and ignores local data for that name
-	# o block_aaaa similarly to block_a, resolves all records normally but
-	#   returns NODATA for AAAA queries and ignores local data for that name
-	# o block_a_wdata like block_a but uses local data if present.
-	# o block_aaaa_wdata like block_aaaa but uses local data if present.
 	# o always_null returns 0.0.0.0 or ::0 for any name in the zone.
 	# o noview breaks out of that view towards global local-zones.
 	#
@@ -937,22 +896,6 @@ server:
 	# add a netblock specific override to a localzone, with zone type
 	# local-zone-override: "example.com" 192.0.2.0/24 refuse

-	# Action to apply when the IP address in an AAAA or A RR in the answer
-	# section of a response matches the specified IP netblock.
-	# Requires use of the respip module.
-	# response-ip: 192.0.2.0/24 redirect
-
-	# Redirect as specified by the "resource record string" when the IP
-	# address in an AAAA or A RR in the answer section of a response
-	# matches the specified IP netblock.
-	# Requires use of the respip module.
-	# response-ip-data: 192.0.2.0/24 "example. A 192.0.2.1"
-
-	# Apply tag(s) when the IP address in an AAAA or A RR in the answer
-	# section of a response matches the specified IP netblock.
-	# Requires use of the respip module.
-	# response-ip-tag: 192.0.2.0/24 "tag1 tag2"
-
 	# service clients over TLS (on the TCP sockets) with plain DNS inside
 	# the TLS stream, and over HTTPS using HTTP/2 as specified in RFC8484.
 	# Give the certificate to use and private key.
@@ -961,23 +904,21 @@ server:
 	# tls-service-pem: "path/to/publiccertfile.pem"
 	# tls-port: 853
 	# https-port: 443
-	# quic-port: 853
-
-	# Also serve tls on these port numbers (eg. 443, ...), by listing
-	# tls-additional-port: portno for each of the port numbers.

 	# cipher setting for TLSv1.2
 	# tls-ciphers: "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256"
 	# cipher setting for TLSv1.3
 	# tls-ciphersuites: "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_8_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"

-	# Use the SNI extension for TLS connections.  Default is yes.
-	# Changing the value requires a restart.
-	# tls-use-sni: yes
+	# Pad responses to padded queries received over TLS
+	# pad-responses: yes

-	# TLS protocols.
-	# Changing the value requires a restart.
-	# tls-protocols: "TLSv1.2 TLSv1.3"
+	# Padded responses will be padded to the closest multiple of this size.
+	# pad-responses-block-size: 468
+
+	# Use the SNI extension for TLS connections.  Default is yes.
+	# Changing the value requires a reload.
+	# tls-use-sni: yes

 	# Add the secret file for TLS Session Ticket.
 	# Secret file must be 80 bytes of random data.
@@ -999,18 +940,15 @@ server:
 	# and on other systems, the default openssl certificates
 	# tls-system-cert: no

-	# Pad responses to padded queries received over TLS
-	# pad-responses: yes
-
-	# Padded responses will be padded to the closest multiple of this size.
-	# pad-responses-block-size: 468
-
 	# Pad queries over TLS upstreams
 	# pad-queries: yes

 	# Padded queries will be padded to the closest multiple of this size.
 	# pad-queries-block-size: 128

+	# Also serve tls on these port numbers (eg. 443, ...), by listing
+	# tls-additional-port: portno for each of the port numbers.
+
 	# HTTP endpoint to provide DNS-over-HTTPS service on.
 	# http-endpoint: "/dns-query"

@@ -1030,9 +968,6 @@ server:
 	# Disable TLS for DNS-over-HTTP downstream service.
 	# http-notls-downstream: no

-	# Maximum number of bytes used for QUIC buffers.
-	# quic-size: 8m
-
 	# The interfaces that use these listed port numbers will support and
 	# expect PROXYv2. For UDP and TCP/TLS interfaces.
 	# proxy-protocol-port: portno for each of the port numbers.
@@ -1109,11 +1044,6 @@ server:
 	# example value "000102030405060708090a0b0c0d0e0f".
 	# cookie-secret: <128 bit random hex string>

-	# File with cookie secrets, the 'cookie-secret:' option is ignored
-	# and the file can be managed to have staging and active secrets
-	# with remote control commands. Disabled with "". Default is "".
-	# cookie-secret-file: "/usr/local/etc/unbound_cookiesecrets.txt"
-
 	# Enable to attach Extended DNS Error codes (RFC8914) to responses.
 	# ede: no

@@ -1122,11 +1052,6 @@ server:
 	# Note that the ede option above needs to be enabled for this to work.
 	# ede-serve-expired: no

-	# Enable DNS Error Reporting (RFC9567).
-	# qname-minimisation is advised to be turned on as well to increase
-	# privacy on the outgoing reports.
-	# dns-error-reporting: no
-
 	# Specific options for ipsecmod. Unbound needs to be configured with
 	# --enable-ipsecmod for these to take effect.
 	#
@@ -1291,16 +1216,12 @@ remote-control:
 #	zonemd-check: no
 #	zonemd-reject-absence: no
 #	zonefile: "example.org.zone"
-#	max-transfer-size: 0
-#	max-transfer-time: 0
-

 # Views
-# Create named views. Name must be unique.
-# Map views to requests using the access-control-view/interface-view options.
-# Views can contain zero or more local-zone and local-data options.
-# Options from matching views will override global options.
-# Global options will be used if no matching view is found.
+# Create named views. Name must be unique. Map views to requests using
+# the access-control-view option. Views can contain zero or more local-zone
+# and local-data options. Options from matching views will override global
+# options. Global options will be used if no matching view is found.
 # With view-first yes, it will try to answer using the global local-zone and
 # local-data elements if there is no view specific match.
 # view:
@@ -1308,8 +1229,6 @@ remote-control:
 #	local-zone: "example.com" redirect
 #	local-data: "example.com A 192.0.2.3"
 #	local-data-ptr: "192.0.2.3 www.example.com"
-#	response-ip: 192.0.2.0/24 redirect
-#	response-ip-data: 192.0.2.0/24 "example. A 192.0.2.1"
 #	view-first: no
 # view:
 #	name: "anotherview"
@@ -1360,35 +1279,15 @@ remote-control:
 #     # redis server's TCP port
 #     redis-server-port: 6379
 #     # if the server uses a unix socket, set its path, or "" when not used.
-#     redis-server-path: "/var/lib/redis/redis-server.sock"
+#     # redis-server-path: "/var/lib/redis/redis-server.sock"
 #     # if the server uses an AUTH password, specify here, or "" when not used.
-#     redis-server-password: ""
+#     # redis-server-password: ""
 #     # timeout (in ms) for communication with the redis server
 #     redis-timeout: 100
-#     # timeout (in ms) for commands, if 0, uses redis-timeout.
-#     redis-command-timeout: 0
-#     # timeout (in ms) for connection set up, if 0, uses redis-timeout.
-#     redis-connect-timeout: 0
 #     # set timeout on redis records based on DNS response TTL
 #     redis-expire-records: no
 #     # redis logical database to use, 0 is the default database.
 #     redis-logical-db: 0
-#     # redis replica server's IP address or host name
-#     redis-replica-server-host: 127.0.0.1
-#     # redis replica server's TCP port
-#     redis-replica-server-port: 6379
-#     # if the replica server uses a unix socket, set its path, or "" when not used.
-#     redis-replica-server-path: "/var/lib/redis/redis-server.sock"
-#     # if the replica server uses an AUTH password, specify here, or "" when not used.
-#     redis-replica-server-password: ""
-#     # timeout (in ms) for communication with the redis replica server
-#     redis-replica-timeout: 100
-#     # timeout (in ms) for redis replica commands, if 0, uses redis-replica-timeout.
-#     redis-replica-command-timeout: 0
-#     # timeout (in ms) for redis replica connection set up, if 0, uses redis-replica-timeout.
-#     redis-replica-connect-timeout: 0
-#     # redis logical database to use for the replica server, 0 is the default database.
-#     redis-replica-logical-db: 0

 # IPSet
 # Add specify domain into set via ipset.
@@ -1430,8 +1329,6 @@ remote-control:
 # 	dnstap-identity: ""
 # 	# if "" it uses the package version.
 # 	dnstap-version: ""
-# 	# log only 1/N messages, if 0 it is disabled. default 0.
-# 	dnstap-sample-rate: 0
 # 	dnstap-log-resolver-query-messages: no
 # 	dnstap-log-resolver-response-messages: no
 # 	dnstap-log-client-query-messages: no
@@ -1440,8 +1337,7 @@ remote-control:
 # 	dnstap-log-forwarder-response-messages: no

 # Response Policy Zones
-# RPZ policies. Applied in order of configuration. Any match from an earlier
-# RPZ zone will terminate the RPZ lookup. QNAME, Response IP
+# RPZ policies. Applied in order of configuration. QNAME, Response IP
 # Address, nsdname, nsip and clientip triggers are supported. Supported
 # actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp-only
 # and drop.  Policies can be loaded from a file, or using zone
@@ -1460,5 +1356,3 @@ remote-control:
 #     rpz-signal-nxdomain-ra: no
 #     for-downstream: no
 #     tags: "example"
-#     max-transfer-size: 0
-#     max-transfer-time: 0
@@ -1,306 +1,335 @@
-.\" Man page generated from reStructuredText.
-.
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.TH "LIBUNBOUND" "3" "@date@" "@version@" "Unbound"
-.SH NAME
-libunbound \- Unbound DNS validating resolver @version@ functions.
-.SH SYNOPSIS
-.sp
-\fB#include <unbound.h>\fP
-.sp
-struct ub_ctx * \fBub_ctx_create\fP(void);
-.sp
-void \fBub_ctx_delete\fP(struct ub_ctx* ctx);
-.sp
-int \fBub_ctx_set_option\fP(struct ub_ctx* ctx, char* opt, char* val);
-.sp
-int \fBub_ctx_get_option\fP(struct ub_ctx* ctx, char* opt, char** val);
-.sp
-int \fBub_ctx_config\fP(struct ub_ctx* ctx, char* fname);
-.sp
-int \fBub_ctx_set_fwd\fP(struct ub_ctx* ctx, char* addr);
-.INDENT 0.0
-.TP
-int \fBub_ctx_set_stub\fP(struct ub_ctx* ctx, char* zone, char* addr,
-int isprime);
-.UNINDENT
-.sp
-int \fBub_ctx_set_tls\fP(struct ub_ctx* ctx, int tls);
-.sp
-int \fBub_ctx_resolvconf\fP(struct ub_ctx* ctx, char* fname);
-.sp
-int \fBub_ctx_hosts\fP(struct ub_ctx* ctx, char* fname);
-.sp
-int \fBub_ctx_add_ta\fP(struct ub_ctx* ctx, char* ta);
-.sp
-int \fBub_ctx_add_ta_autr\fP(struct ub_ctx* ctx, char* fname);
-.sp
-int \fBub_ctx_add_ta_file\fP(struct ub_ctx* ctx, char* fname);
-.sp
-int \fBub_ctx_trustedkeys\fP(struct ub_ctx* ctx, char* fname);
-.sp
-int \fBub_ctx_debugout\fP(struct ub_ctx* ctx, FILE* out);
-.sp
-int \fBub_ctx_debuglevel\fP(struct ub_ctx* ctx, int d);
-.sp
-int \fBub_ctx_async\fP(struct ub_ctx* ctx, int dothread);
-.sp
-int \fBub_poll\fP(struct ub_ctx* ctx);
-.sp
-int \fBub_wait\fP(struct ub_ctx* ctx);
-.sp
-int \fBub_fd\fP(struct ub_ctx* ctx);
-.sp
-int \fBub_process\fP(struct ub_ctx* ctx);
-.INDENT 0.0
-.TP
-int \fBub_resolve\fP(struct ub_ctx* ctx, char* name,
-int rrtype, int rrclass, struct ub_result** result);
-.TP
-int \fBub_resolve_async\fP(struct ub_ctx* ctx, char* name,
-int rrtype, int rrclass, void* mydata,
-ub_callback_type* callback, int* async_id);
-.UNINDENT
-.sp
-int \fBub_cancel\fP(struct ub_ctx* ctx, int async_id);
-.sp
-void \fBub_resolve_free\fP(struct ub_result* result);
-.sp
-const char * \fBub_strerror\fP(int err);
-.sp
-int \fBub_ctx_print_local_zones\fP(struct ub_ctx* ctx);
-.sp
-int \fBub_ctx_zone_add\fP(struct ub_ctx* ctx, char* zone_name, char* zone_type);
-.sp
-int \fBub_ctx_zone_remove\fP(struct ub_ctx* ctx, char* zone_name);
-.sp
-int \fBub_ctx_data_add\fP(struct ub_ctx* ctx, char* data);
-.sp
-int \fBub_ctx_data_remove\fP(struct ub_ctx* ctx, char* data);
-.SH DESCRIPTION
-.sp
-Unbound is an implementation of a DNS resolver, that does caching and DNSSEC
-validation.
-This is the library API, for using the \fB\-lunbound\fP library.
-The server daemon is described in \fI\%unbound(8)\fP\&.
-The library works independent from a running unbound server, and can be used to
-convert hostnames to ip addresses, and back, and obtain other information from
-the DNS.
-The library performs public\-key validation of results with DNSSEC.
-.sp
-The library uses a variable of type \fIstruct ub_ctx\fP to keep context between
-calls.
-The user must maintain it, creating it with \fBub_ctx_create\fP and deleting it
-with \fBub_ctx_delete\fP\&.
-It can be created and deleted at any time.
-Creating it anew removes any previous configuration (such as trusted keys) and
-clears any cached results.
-.sp
-The functions are thread\-safe, and a context can be used in a threaded (as well
-as in a non\-threaded) environment.
-Also resolution (and validation) can be performed blocking and non\-blocking
-(also called asynchronous).
-The async method returns from the call immediately, so that processing can go
-on, while the results become available later.
-.sp
+.TH "libunbound" "3" "@date@" "NLnet Labs" "unbound @version@"
+.\"
+.\" libunbound.3 -- unbound library functions manual
+.\"
+.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
+.\"
+.\" See LICENSE for the license.
+.\"
+.\"
+.SH "NAME"
+.B libunbound,
+.B unbound.h,
+.B ub_ctx,
+.B ub_result,
+.B ub_callback_type,
+.B ub_ctx_create,
+.B ub_ctx_delete,
+.B ub_ctx_set_option,
+.B ub_ctx_get_option,
+.B ub_ctx_config,
+.B ub_ctx_set_fwd,
+.B ub_ctx_set_stub,
+.B ub_ctx_set_tls,
+.B ub_ctx_resolvconf,
+.B ub_ctx_hosts,
+.B ub_ctx_add_ta,
+.B ub_ctx_add_ta_autr,
+.B ub_ctx_add_ta_file,
+.B ub_ctx_trustedkeys,
+.B ub_ctx_debugout,
+.B ub_ctx_debuglevel,
+.B ub_ctx_async,
+.B ub_poll,
+.B ub_wait,
+.B ub_fd,
+.B ub_process,
+.B ub_resolve,
+.B ub_resolve_async,
+.B ub_cancel,
+.B ub_resolve_free,
+.B ub_strerror,
+.B ub_ctx_print_local_zones,
+.B ub_ctx_zone_add,
+.B ub_ctx_zone_remove,
+.B ub_ctx_data_add,
+.B ub_ctx_data_remove
+\- Unbound DNS validating resolver @version@ functions.
+.SH "SYNOPSIS"
+.B #include <unbound.h>
+.LP
+\fIstruct ub_ctx *\fR
+\fBub_ctx_create\fR(\fIvoid\fR);
+.LP
+\fIvoid\fR
+\fBub_ctx_delete\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_ctx_set_option\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR opt, \fIchar*\fR val);
+.LP
+\fIint\fR
+\fBub_ctx_get_option\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR opt, \fIchar**\fR val);
+.LP
+\fIint\fR
+\fBub_ctx_config\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_set_fwd\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR addr);
+.LP
+\fIint\fR
+\fBub_ctx_set_stub\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR zone,
+\fIchar*\fR addr,
+.br
+		\fIint\fR isprime);
+.LP
+\fIint\fR
+\fBub_ctx_set_tls\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR tls);
+.LP
+\fIint\fR
+\fBub_ctx_resolvconf\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_hosts\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_add_ta\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR ta);
+.LP
+\fIint\fR
+\fBub_ctx_add_ta_autr\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_add_ta_file\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_trustedkeys\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_debugout\fR(\fIstruct ub_ctx*\fR ctx, \fIFILE*\fR out);
+.LP
+\fIint\fR
+\fBub_ctx_debuglevel\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR d);
+.LP
+\fIint\fR
+\fBub_ctx_async\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR dothread);
+.LP
+\fIint\fR
+\fBub_poll\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_wait\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_fd\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_process\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_resolve\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR name, 
+.br
+           \fIint\fR rrtype, \fIint\fR rrclass, \fIstruct ub_result**\fR result);
+.LP
+\fIint\fR
+\fBub_resolve_async\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR name, 
+.br
+                 \fIint\fR rrtype, \fIint\fR rrclass, \fIvoid*\fR mydata, 
+.br
+                 \fIub_callback_type\fR callback, \fIint*\fR async_id);
+.LP
+\fIint\fR
+\fBub_cancel\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR async_id);
+.LP
+\fIvoid\fR
+\fBub_resolve_free\fR(\fIstruct ub_result*\fR result);
+.LP
+\fIconst char *\fR
+\fBub_strerror\fR(\fIint\fR err);
+.LP
+\fIint\fR
+\fBub_ctx_print_local_zones\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_ctx_zone_add\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR zone_name, \fIchar*\fR zone_type);
+.LP
+\fIint\fR
+\fBub_ctx_zone_remove\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR zone_name);
+.LP
+\fIint\fR
+\fBub_ctx_data_add\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR data);
+.LP
+\fIint\fR
+\fBub_ctx_data_remove\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR data);
+.SH "DESCRIPTION"
+.B Unbound 
+is an implementation of a DNS resolver, that does caching and 
+DNSSEC validation. This is the library API, for using the \-lunbound library.
+The server daemon is described in \fIunbound\fR(8).
+The library works independent from a running unbound server, and
+can be used to convert hostnames to ip addresses, and back,
+and obtain other information from the DNS. The library performs public\-key
+validation of results with DNSSEC.
+.P
+The library uses a variable of type \fIstruct ub_ctx\fR to keep context
+between calls. The user must maintain it, creating it with
+.B ub_ctx_create
+and deleting it with
+.B ub_ctx_delete\fR.
+It can be created and deleted at any time. Creating it anew removes any 
+previous configuration (such as trusted keys) and clears any cached results.
+.P
+The functions are thread\-safe, and a context can be used in a threaded (as 
+well as in a non\-threaded) environment. Also resolution (and validation) 
+can be performed blocking and non\-blocking (also called asynchronous). 
+The async method returns from the call immediately, so that processing 
+can go on, while the results become available later. 
+.P
 The functions are discussed in turn below.
-.SH FUNCTIONS
-.INDENT 0.0
-.TP
+.SH "FUNCTIONS"
+.TP 
 .B ub_ctx_create
 Create a new context, initialised with defaults.
-The information from \fB/etc/resolv.conf\fP and \fB/etc/hosts\fP is
-not utilised by default.
-Use \fBub_ctx_resolvconf\fP and \fBub_ctx_hosts\fP to read them.
-Before you call this, use the openssl functions
-\fBCRYPTO_set_id_callback\fP and \fBCRYPTO_set_locking_callback\fP to set
-up asynchronous operation if you use lib openssl (the application calls
-these functions once for initialisation).
-Openssl 1.0.0 or later uses the \fBCRYPTO_THREADID_set_callback\fP
-function.
+The information from /etc/resolv.conf and /etc/hosts is not utilised 
+by default. Use 
+.B ub_ctx_resolvconf
+and
+.B ub_ctx_hosts
+to read them.
+Before you call this, use the openssl functions CRYPTO_set_id_callback and
+CRYPTO_set_locking_callback to set up asynchronous operation if you use
+lib openssl (the application calls these functions once for initialisation).
+Openssl 1.0.0 or later uses the CRYPTO_THREADID_set_callback function.
 .TP
 .B ub_ctx_delete
 Delete validation context and free associated resources.
-Outstanding async queries are killed and callbacks are not called for
-them.
+Outstanding async queries are killed and callbacks are not called for them.
 .TP
 .B ub_ctx_set_option
-A power\-user interface that lets you specify one of the options from
-the config file format, see \fI\%unbound.conf(5)\fP\&.
-Not all options are relevant.
-For some specific options, such as adding trust anchors, special
-routines exist.
-Pass the option name with the trailing \fB\(aq:\(aq\fP\&.
+A power\-user interface that lets you specify one of the options from the
+config file format, see \fIunbound.conf\fR(5). Not all options are
+relevant. For some specific options, such as adding trust anchors, special
+routines exist. Pass the option name with the trailing ':'.
 .TP
 .B ub_ctx_get_option
-A power\-user interface that gets an option value.
-Some options cannot be gotten, and others return a newline separated
-list.
-Pass the option name without trailing \fB\(aq:\(aq\fP\&.
-The returned value must be free(2)d by the caller.
+A power\-user interface that gets an option value.  Some options cannot be
+gotten, and others return a newline separated list.  Pass the option name
+without trailing ':'.  The returned value must be free(2)d by the caller.
 .TP
 .B ub_ctx_config
-A power\-user interface that lets you specify an unbound config file,
-see \fI\%unbound.conf(5)\fP, which is read for
-configuration.
-Not all options are relevant.
-For some specific options, such as adding trust anchors, special
-routines exist.
-This function is thread\-safe only if a single instance of \fBub_ctx\fP*
-exists in the application.
-If several instances exist the application has to ensure that
-\fBub_ctx_config\fP is not called in parallel by the different instances.
+A power\-user interface that lets you specify an unbound config file, see
+\fIunbound.conf\fR(5), which is read for configuration. Not all options are
+relevant. For some specific options, such as adding trust anchors, special
+routines exist.  This function is thread\-safe only if a single instance of
+ub_ctx* exists in the application.  If several instances exist the
+application has to ensure that ub_ctx_config is not called in parallel by
+the different instances.
 .TP
 .B ub_ctx_set_fwd
-Set machine to forward DNS queries to, the caching resolver to use.
-IP4 or IP6 address.
-Forwards all DNS requests to that machine, which is expected to run a
-recursive resolver.
-If the proxy is not DNSSEC capable, validation may fail.
-Can be called several times, in that case the addresses are used as
-backup servers.
-At this time it is only possible to set configuration before the first
-resolve is done.
+Set machine to forward DNS queries to, the caching resolver to use. 
+IP4 or IP6 address. Forwards all DNS requests to that machine, which 
+is expected to run a recursive resolver. If the proxy is not 
+DNSSEC capable, validation may fail. Can be called several times, in 
+that case the addresses are used as backup servers.
+At this time it is only possible to set configuration before the
+first resolve is done.
 .TP
 .B ub_ctx_set_stub
-Set a stub zone, authoritative dns servers to use for a particular
-zone.
-IP4 or IP6 address.
-If the address is NULL the stub entry is removed.
-Set isprime true if you configure root hints with it.
-Otherwise similar to the stub zone item from unbound\(aqs config file.
-Can be called several times, for different zones, or to add multiple
-addresses for a particular zone.
-At this time it is only possible to set configuration before the first
-resolve is done.
+Set a stub zone, authoritative dns servers to use for a particular zone.
+IP4 or IP6 address.  If the address is NULL the stub entry is removed.
+Set isprime true if you configure root hints with it.  Otherwise similar to
+the stub zone item from unbound's config file.  Can be called several times,
+for different zones, or to add multiple addresses for a particular zone.
+At this time it is only possible to set configuration before the
+first resolve is done.
 .TP
 .B ub_ctx_set_tls
-Enable DNS over TLS (DoT) for machines set with \fBub_ctx_set_fwd\fP\&.
-At this time it is only possible to set configuration before the first
-resolve is done.
+Enable DNS over TLS (DoT) for machines set with 
+.B ub_ctx_set_fwd.
+At this time it is only possible to set configuration before the
+first resolve is done.
 .TP
 .B ub_ctx_resolvconf
-By default the root servers are queried and full resolver mode is used,
-but you can use this call to read the list of nameservers to use from
-the filename given.
-Usually \fB\(dq/etc/resolv.conf\(dq\fP\&.
-Uses those nameservers as caching proxies.
+By default the root servers are queried and full resolver mode is used, but
+you can use this call to read the list of nameservers to use from the
+filename given.
+Usually "/etc/resolv.conf". Uses those nameservers as caching proxies.
 If they do not support DNSSEC, validation may fail.
 Only nameservers are picked up, the searchdomain, ndots and other
-settings from \fIresolv.conf(5)\fP are ignored.
-If fname NULL is passed, \fB\(dq/etc/resolv.conf\(dq\fP is used (if on
-Windows, the system\-wide configured nameserver is picked instead).
-At this time it is only possible to set configuration before the first
-resolve is done.
+settings from \fIresolv.conf\fR(5) are ignored.
+If fname NULL is passed, "/etc/resolv.conf" is used (if on Windows, 
+the system\-wide configured nameserver is picked instead).
+At this time it is only possible to set configuration before the
+first resolve is done.
 .TP
 .B ub_ctx_hosts
 Read list of hosts from the filename given.
-Usually \fB\(dq/etc/hosts\(dq\fP\&.
-When queried for, these addresses are not marked DNSSEC secure.
-If fname NULL is passed, \fB\(dq/etc/hosts\(dq\fP is used (if on Windows,
-\fBetc/hosts\fP from WINDIR is picked instead).
-At this time it is only possible to set configuration before the first
-resolve is done.
+Usually "/etc/hosts". When queried for, these addresses are not marked 
+DNSSEC secure. If fname NULL is passed, "/etc/hosts" is used 
+(if on Windows, etc/hosts from WINDIR is picked instead).
+At this time it is only possible to set configuration before the
+first resolve is done.
 .TP
-.B ub_ctx_add_ta
+.B
+ub_ctx_add_ta
 Add a trust anchor to the given context.
-At this time it is only possible to add trusted keys before the first
-resolve is done.
+At this time it is only possible to add trusted keys before the
+first resolve is done.
 The format is a string, similar to the zone\-file format,
-\fB[domainname]\fP \fB[type]\fP \fB[rdata contents]\fP\&.
-Both DS and DNSKEY records are accepted.
+[domainname] [type] [rdata contents]. Both DS and DNSKEY records are accepted.
 .TP
 .B ub_ctx_add_ta_autr
-Add filename with automatically tracked trust anchor to the given
-context.
-Pass name of a file with the managed trust anchor.
-You can create this file with
-\fI\%unbound\-anchor(8)\fP for the root anchor.
-You can also create it with an initial file with one line with a DNSKEY
-or DS record.
+Add filename with automatically tracked trust anchor to the given context.
+Pass name of a file with the managed trust anchor.  You can create this
+file with \fIunbound\-anchor\fR(8) for the root anchor.  You can also
+create it with an initial file with one line with a DNSKEY or DS record.
 If the file is writable, it is updated when the trust anchor changes.
-At this time it is only possible to add trusted keys before the first
-resolve is done.
+At this time it is only possible to add trusted keys before the
+first resolve is done.
 .TP
 .B ub_ctx_add_ta_file
 Add trust anchors to the given context.
 Pass name of a file with DS and DNSKEY records in zone file format.
-At this time it is only possible to add trusted keys before the first
-resolve is done.
+At this time it is only possible to add trusted keys before the
+first resolve is done.
 .TP
 .B ub_ctx_trustedkeys
 Add trust anchors to the given context.
-Pass the name of a bind\-style config file with \fBtrusted\-keys{}\fP\&.
-At this time it is only possible to add trusted keys before the first
-resolve is done.
+Pass the name of a bind\-style config file with trusted\-keys{}.
+At this time it is only possible to add trusted keys before the
+first resolve is done.
 .TP
 .B ub_ctx_debugout
-Set debug and error log output to the given stream.
-Pass NULL to disable output.
-Default is stderr.
-File\-names or using syslog can be enabled using config options, this
-routine is for using your own stream.
+Set debug and error log output to the given stream. Pass NULL to disable
+output. Default is stderr. File\-names or using syslog can be enabled
+using config options, this routine is for using your own stream.
 .TP
 .B ub_ctx_debuglevel
-Set debug verbosity for the context.
-Output is directed to stderr.
+Set debug verbosity for the context. Output is directed to stderr.
 Higher debug level gives more output.
 .TP
 .B ub_ctx_async
 Set a context behaviour for asynchronous action.
-if set to true, enables threading and a call to \fBub_resolve_async\fP
+if set to true, enables threading and a call to 
+.B ub_resolve_async 
 creates a thread to handle work in the background.
 If false, a process is forked to handle work in the background.
-Changes to this setting after \fBub_resolve_async\fP calls have been made
-have no effect (delete and re\-create the context to change).
+Changes to this setting after 
+.B ub_resolve_async 
+calls have been made have no effect (delete and re\-create the context 
+to change).
 .TP
 .B ub_poll
 Poll a context to see if it has any new results.
-Do not poll in a loop, instead extract the \fBfd\fP below to poll for
-readiness, and then check, or wait using the wait routine.
+Do not poll in a loop, instead extract the fd below to poll for readiness,
+and then check, or wait using the wait routine.
 Returns 0 if nothing to read, or nonzero if a result is available.
-If nonzero, call \fBub_process\fP to do callbacks.
+If nonzero, call 
+.B ub_process 
+to do callbacks.
 .TP
 .B ub_wait
-Wait for a context to finish with results.
-Calls \fBub_process\fP after the wait for you.
-After the wait, there are no more outstanding asynchronous queries.
+Wait for a context to finish with results. Calls 
+.B ub_process 
+after the wait for you. After the wait, there are no more outstanding 
+asynchronous queries.
 .TP
 .B ub_fd
-Get file descriptor.
-Wait for it to become readable, at this point answers are returned from
-the asynchronous validating resolver.
-Then call the \fBub_process\fP to continue processing.
+Get file descriptor. Wait for it to become readable, at this point
+answers are returned from the asynchronous validating resolver.
+Then call the \fBub_process\fR to continue processing.
 .TP
 .B ub_process
 Call this routine to continue processing results from the validating
-resolver (when the \fBfd\fP becomes readable).
+resolver (when the fd becomes readable).
 Will perform necessary callbacks.
 .TP
 .B ub_resolve
@@ -311,111 +340,95 @@ The result structure is newly allocated with the resulting data.
 .TP
 .B ub_resolve_async
 Perform asynchronous resolution and validation of the target name.
-Arguments mean the same as for \fBub_resolve\fP except no data is
-returned immediately, instead a callback is called later.
-The callback receives a copy of the mydata pointer, that you can use to
-pass information to the callback.
-The callback type is a function pointer to a function declared as:
-.INDENT 7.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-void my_callback_function(void* my_arg, int err,
-                struct ub_result* result);
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-The \fBasync_id\fP is returned so you can (at your option) decide to
-track it and cancel the request if needed.
-If you pass a NULL pointer the \fBasync_id\fP is not returned.
+Arguments mean the same as for \fBub_resolve\fR except no
+data is returned immediately, instead a callback is called later.
+The callback receives a copy of the mydata pointer, that you can use to pass
+information to the callback. The callback type is a function pointer to
+a function declared as
+.IP
+void my_callback_function(void* my_arg, int err, 
+.br
+                  struct ub_result* result);
+.IP
+The async_id is returned so you can (at your option) decide to track it
+and cancel the request if needed.  If you pass a NULL pointer the async_id
+is not returned. 
 .TP
 .B ub_cancel
-Cancel an async query in progress.
-This may return an error if the query does not exist, or the query is
-already being delivered, in that case you may still get a callback for
-the query.
+Cancel an async query in progress.  This may return an error if the query
+does not exist, or the query is already being delivered, in that case you 
+may still get a callback for the query.
 .TP
 .B ub_resolve_free
-Free struct \fBub_result\fP contents after use.
+Free struct ub_result contents after use.
 .TP
 .B ub_strerror
-Convert error value from one of the unbound library functions to a
-human readable string.
+Convert error value from one of the unbound library functions 
+to a human readable string.
 .TP
 .B ub_ctx_print_local_zones
 Debug printout the local authority information to debug output.
 .TP
 .B ub_ctx_zone_add
-Add new zone to local authority info, like local\-zone
-\fI\%unbound.conf(5)\fP statement.
+Add new zone to local authority info, like local\-zone \fIunbound.conf\fR(5) 
+statement.
 .TP
 .B ub_ctx_zone_remove
 Delete zone from local authority info.
 .TP
 .B ub_ctx_data_add
 Add resource record data to local authority info, like local\-data
-\fI\%unbound.conf(5)\fP statement.
+\fIunbound.conf\fR(5) statement.
 .TP
 .B ub_ctx_data_remove
 Delete local authority data from the name given.
-.UNINDENT
-.SH RESULT DATA STRUCTURE
-.sp
-The result of the DNS resolution and validation is returned as \fIstruct
-ub_result\fP\&.
-The result structure contains the following entries:
-.INDENT 0.0
-.INDENT 3.5
-.sp
+.SH "RESULT DATA STRUCTURE"
+The result of the DNS resolution and validation is returned as 
+\fIstruct ub_result\fR. The result structure contains the following entries.
+.P
 .nf
-.ft C
-struct ub_result {
-     char* qname;         /* text string, original question */
-     int qtype;           /* type code asked for */
-     int qclass;          /* class code asked for */
-     char** data;         /* array of rdata items, NULL terminated*/
-     int* len;            /* array with lengths of rdata items */
-     char* canonname;     /* canonical name of result */
-     int rcode;           /* additional error code in case of no data */
-     void* answer_packet; /* full network format answer packet */
-     int answer_len;      /* length of packet in octets */
-     int havedata;        /* true if there is data */
-     int nxdomain;        /* true if nodata because name does not exist */
-     int secure;          /* true if result is secure */
-     int bogus;           /* true if a security failure happened */
-     char* why_bogus;     /* string with error if bogus */
-     int was_ratelimited; /* true if the query was ratelimited (SERVFAIL) by unbound */
-     int ttl;             /* number of seconds the result is valid */
-};
-.ft P
+	struct ub_result {
+		char* qname; /* text string, original question */
+		int qtype;   /* type code asked for */
+		int qclass;  /* class code asked for */
+		char** data; /* array of rdata items, NULL terminated*/
+		int* len;    /* array with lengths of rdata items */
+		char* canonname; /* canonical name of result */
+		int rcode;   /* additional error code in case of no data */
+		void* answer_packet; /* full network format answer packet */
+		int answer_len;  /* length of packet in octets */
+		int havedata; /* true if there is data */
+		int nxdomain; /* true if nodata because name does not exist */
+		int secure;   /* true if result is secure */
+		int bogus;    /* true if a security failure happened */
+		char* why_bogus; /* string with error if bogus */
+		int was_ratelimited; /* true if the query was ratelimited (SERVFAIL) by unbound */
+		int ttl;     /* number of seconds the result is valid */
+	};
 .fi
-.UNINDENT
-.UNINDENT
-.sp
-If both secure and bogus are false, security was not enabled for the domain of
-the query.
-Else, they are not both true, one of them is true.
-.SH RETURN VALUES
-.sp
-Many routines return an error code.
-The value 0 (zero) denotes no error happened.
-Other values can be passed to \fBub_strerror\fP to obtain a readable error
-string.
-\fBub_strerror\fP returns a zero terminated string.
-\fBub_ctx_create\fP returns NULL on an error (a malloc failure).
-\fBub_poll\fP returns true if some information may be available, false otherwise.
-\fBub_fd\fP returns a file descriptor or \-1 on error.
-\fBub_ctx_config\fP and \fBub_ctx_resolvconf\fP attempt to leave errno informative
-on a function return with file read failure.
-.SH SEE ALSO
-.sp
-\fI\%unbound.conf(5)\fP, \fI\%unbound(8)\fP\&.
-.SH AUTHOR
-Unbound developers are mentioned in the CREDITS file in the distribution.
-.SH COPYRIGHT
-1999-2026, NLnet Labs
-.\" Generated by docutils manpage writer.
-.
+.P
+If both secure and bogus are false, security was not enabled for the 
+domain of the query.  Else, they are not both true, one of them is true.
+.SH "RETURN VALUES"
+Many routines return an error code. The value 0 (zero) denotes no error
+happened. Other values can be passed to
+.B ub_strerror
+to obtain a readable error string.
+.B ub_strerror
+returns a zero terminated string.
+.B ub_ctx_create
+returns NULL on an error (a malloc failure).
+.B ub_poll
+returns true if some information may be available, false otherwise.
+.B ub_fd
+returns a file descriptor or \-1 on error.
+.B ub_ctx_config
+and
+.B ub_ctx_resolvconf
+attempt to leave errno informative on a function return with file read failure.
+.SH "SEE ALSO"
+\fIunbound.conf\fR(5), 
+\fIunbound\fR(8).
+.SH "AUTHORS"
+.B Unbound
+developers are mentioned in the CREDITS file in the distribution.
@@ -1,491 +0,0 @@
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-libunbound(3)
-=============
-
-Synopsis
--------
-
-.. only:: html
-
-    .. code-block:: c
-
-        #include <unbound.h>
-
-        struct ub_ctx * ub_ctx_create(void);
-
-        void ub_ctx_delete(struct ub_ctx* ctx);
-
-        int ub_ctx_set_option(struct ub_ctx* ctx, char* opt, char* val);
-
-        int ub_ctx_get_option(struct ub_ctx* ctx, char* opt, char** val);
-
-        int ub_ctx_config(struct ub_ctx* ctx, char* fname);
-
-        int ub_ctx_set_fwd(struct ub_ctx* ctx, char* addr);
-
-        int ub_ctx_set_stub(struct ub_ctx* ctx, char* zone, char* addr,
-                            int isprime);
-
-        int ub_ctx_set_tls(struct ub_ctx* ctx, int tls);
-
-        int ub_ctx_resolvconf(struct ub_ctx* ctx, char* fname);
-
-        int ub_ctx_hosts(struct ub_ctx* ctx, char* fname);
-
-        int ub_ctx_add_ta(struct ub_ctx* ctx, char* ta);
-
-        int ub_ctx_add_ta_autr(struct ub_ctx* ctx, char* fname);
-
-        int ub_ctx_add_ta_file(struct ub_ctx* ctx, char* fname);
-
-        int ub_ctx_trustedkeys(struct ub_ctx* ctx, char* fname);
-
-        int ub_ctx_debugout(struct ub_ctx* ctx, FILE* out);
-
-        int ub_ctx_debuglevel(struct ub_ctx* ctx, int d);
-
-        int ub_ctx_async(struct ub_ctx* ctx, int dothread);
-
-        int ub_poll(struct ub_ctx* ctx);
-
-        int ub_wait(struct ub_ctx* ctx);
-
-        int ub_fd(struct ub_ctx* ctx);
-
-        int ub_process(struct ub_ctx* ctx);
-
-        int ub_resolve(struct ub_ctx* ctx, char* name, int rrtype,
-                       int rrclass, struct ub_result** result);
-
-        int ub_resolve_async(struct ub_ctx* ctx, char* name, int rrtype,
-                             int rrclass, void* mydata, ub_callback_type callback,
-                             int* async_id);
-
-        int ub_cancel(struct ub_ctx* ctx, int async_id);
-
-        void ub_resolve_free(struct ub_result* result);
-
-        const char * ub_strerror(int err);
-
-        int ub_ctx_print_local_zones(struct ub_ctx* ctx);
-
-        int ub_ctx_zone_add(struct ub_ctx* ctx, char* zone_name, char* zone_type);
-
-        int ub_ctx_zone_remove(struct ub_ctx* ctx, char* zone_name);
-
-        int ub_ctx_data_add(struct ub_ctx* ctx, char* data);
-
-        int ub_ctx_data_remove(struct ub_ctx* ctx, char* data);
-
-.. only:: man
-
-    **#include <unbound.h>**
-
-    struct ub_ctx \* **ub_ctx_create**\ (void);
-
-    void **ub_ctx_delete**\ (struct ub_ctx\* ctx);
-
-    int **ub_ctx_set_option**\ (struct ub_ctx\* ctx, char\* opt, char\* val);
-
-    int **ub_ctx_get_option**\ (struct ub_ctx\* ctx, char\* opt, char\*\* val);
-
-    int **ub_ctx_config**\ (struct ub_ctx\* ctx, char* fname);
-
-    int **ub_ctx_set_fwd**\ (struct ub_ctx\* ctx, char\* addr);
-
-    int **ub_ctx_set_stub**\ (struct ub_ctx\* ctx, char\* zone, char\* addr,
-        int isprime);
-
-    int **ub_ctx_set_tls**\ (struct ub_ctx\* ctx, int tls);
-
-    int **ub_ctx_resolvconf**\ (struct ub_ctx\* ctx, char\* fname);
-
-    int **ub_ctx_hosts**\ (struct ub_ctx\* ctx, char\* fname);
-
-    int **ub_ctx_add_ta**\ (struct ub_ctx\* ctx, char\* ta);
-
-    int **ub_ctx_add_ta_autr**\ (struct ub_ctx\* ctx, char\* fname);
-
-    int **ub_ctx_add_ta_file**\ (struct ub_ctx\* ctx, char\* fname);
-
-    int **ub_ctx_trustedkeys**\ (struct ub_ctx\* ctx, char\* fname);
-
-    int **ub_ctx_debugout**\ (struct ub_ctx\* ctx, FILE\* out);
-
-    int **ub_ctx_debuglevel**\ (struct ub_ctx\* ctx, int d);
-
-    int **ub_ctx_async**\ (struct ub_ctx\* ctx, int dothread);
-
-    int **ub_poll**\ (struct ub_ctx\* ctx);
-
-    int **ub_wait**\ (struct ub_ctx\* ctx);
-
-    int **ub_fd**\ (struct ub_ctx\* ctx);
-
-    int **ub_process**\ (struct ub_ctx\* ctx);
-
-    int **ub_resolve**\ (struct ub_ctx\* ctx, char\* name,
-        int rrtype, int rrclass, struct ub_result\*\* result);
-
-    int **ub_resolve_async**\ (struct ub_ctx\* ctx, char\* name,
-        int rrtype, int rrclass, void\* mydata,
-        ub_callback_type\* callback, int\* async_id);
-
-    int **ub_cancel**\ (struct ub_ctx\* ctx, int async_id);
-
-    void **ub_resolve_free**\ (struct ub_result\* result);
-
-    const char \* **ub_strerror**\ (int err);
-
-    int **ub_ctx_print_local_zones**\ (struct ub_ctx\* ctx);
-
-    int **ub_ctx_zone_add**\ (struct ub_ctx\* ctx, char\* zone_name, char\* zone_type);
-
-    int **ub_ctx_zone_remove**\ (struct ub_ctx\* ctx, char\* zone_name);
-
-    int **ub_ctx_data_add**\ (struct ub_ctx\* ctx, char\* data);
-
-    int **ub_ctx_data_remove**\ (struct ub_ctx\* ctx, char\* data);
-
-Description
-----------
-
-Unbound is an implementation of a DNS resolver, that does caching and DNSSEC
-validation.
-This is the library API, for using the ``-lunbound`` library.
-The server daemon is described in :doc:`unbound(8)</manpages/unbound>`.
-The library works independent from a running unbound server, and can be used to
-convert hostnames to ip addresses, and back, and obtain other information from
-the DNS.
-The library performs public-key validation of results with DNSSEC.
-
-The library uses a variable of type *struct ub_ctx* to keep context between
-calls.
-The user must maintain it, creating it with **ub_ctx_create** and deleting it
-with **ub_ctx_delete**.
-It can be created and deleted at any time.
-Creating it anew removes any previous configuration (such as trusted keys) and
-clears any cached results.
-
-The functions are thread-safe, and a context can be used in a threaded (as well
-as in a non-threaded) environment.
-Also resolution (and validation) can be performed blocking and non-blocking
-(also called asynchronous).
-The async method returns from the call immediately, so that processing can go
-on, while the results become available later.
-
-The functions are discussed in turn below.
-
-Functions
---------
-
-.. glossary::
-
-    ub_ctx_create
-        Create a new context, initialised with defaults.
-        The information from :file:`/etc/resolv.conf` and :file:`/etc/hosts` is
-        not utilised by default.
-        Use **ub_ctx_resolvconf** and **ub_ctx_hosts** to read them.
-        Before you call this, use the openssl functions
-        **CRYPTO_set_id_callback** and **CRYPTO_set_locking_callback** to set
-        up asynchronous operation if you use lib openssl (the application calls
-        these functions once for initialisation).
-        Openssl 1.0.0 or later uses the **CRYPTO_THREADID_set_callback**
-        function.
-
-    ub_ctx_delete
-        Delete validation context and free associated resources.
-        Outstanding async queries are killed and callbacks are not called for
-        them.
-
-    ub_ctx_set_option
-        A power-user interface that lets you specify one of the options from
-        the config file format, see :doc:`unbound.conf(5)</manpages/unbound.conf>`.
-        Not all options are relevant.
-        For some specific options, such as adding trust anchors, special
-        routines exist.
-        Pass the option name with the trailing ``':'``.
-
-    ub_ctx_get_option
-        A power-user interface that gets an option value.
-        Some options cannot be gotten, and others return a newline separated
-        list.
-        Pass the option name without trailing ``':'``.
-        The returned value must be free(2)d by the caller.
-
-    ub_ctx_config
-        A power-user interface that lets you specify an unbound config file,
-        see :doc:`unbound.conf(5)</manpages/unbound.conf>`, which is read for
-        configuration.
-        Not all options are relevant.
-        For some specific options, such as adding trust anchors, special
-        routines exist.
-        This function is thread-safe only if a single instance of **ub_ctx**\*
-        exists in the application.
-        If several instances exist the application has to ensure that
-        **ub_ctx_config** is not called in parallel by the different instances.
-
-    ub_ctx_set_fwd
-        Set machine to forward DNS queries to, the caching resolver to use.
-        IP4 or IP6 address.
-        Forwards all DNS requests to that machine, which is expected to run a
-        recursive resolver.
-        If the proxy is not DNSSEC capable, validation may fail.
-        Can be called several times, in that case the addresses are used as
-        backup servers.
-        At this time it is only possible to set configuration before the first
-        resolve is done.
-
-    ub_ctx_set_stub
-        Set a stub zone, authoritative dns servers to use for a particular
-        zone.
-        IP4 or IP6 address.
-        If the address is NULL the stub entry is removed.
-        Set isprime true if you configure root hints with it.
-        Otherwise similar to the stub zone item from unbound's config file.
-        Can be called several times, for different zones, or to add multiple
-        addresses for a particular zone.
-        At this time it is only possible to set configuration before the first
-        resolve is done.
-
-    ub_ctx_set_tls
-        Enable DNS over TLS (DoT) for machines set with **ub_ctx_set_fwd**.
-        At this time it is only possible to set configuration before the first
-        resolve is done.
-
-    ub_ctx_resolvconf
-        By default the root servers are queried and full resolver mode is used,
-        but you can use this call to read the list of nameservers to use from
-        the filename given.
-        Usually :file:`"/etc/resolv.conf"`.
-        Uses those nameservers as caching proxies.
-        If they do not support DNSSEC, validation may fail.
-        Only nameservers are picked up, the searchdomain, ndots and other
-        settings from *resolv.conf(5)* are ignored.
-        If fname NULL is passed, :file:`"/etc/resolv.conf"` is used (if on
-        Windows, the system-wide configured nameserver is picked instead).
-        At this time it is only possible to set configuration before the first
-        resolve is done.
-
-    ub_ctx_hosts
-        Read list of hosts from the filename given.
-        Usually :file:`"/etc/hosts"`.
-        When queried for, these addresses are not marked DNSSEC secure.
-        If fname NULL is passed, :file:`"/etc/hosts"` is used (if on Windows,
-        :file:`etc/hosts` from WINDIR is picked instead).
-        At this time it is only possible to set configuration before the first
-        resolve is done.
-
-    ub_ctx_add_ta
-        Add a trust anchor to the given context.
-        At this time it is only possible to add trusted keys before the first
-        resolve is done.
-        The format is a string, similar to the zone-file format,
-        **[domainname]** **[type]** **[rdata contents]**.
-        Both DS and DNSKEY records are accepted.
-
-    ub_ctx_add_ta_autr
-        Add filename with automatically tracked trust anchor to the given
-        context.
-        Pass name of a file with the managed trust anchor.
-        You can create this file with
-        :doc:`unbound-anchor(8)</manpages/unbound-anchor>` for the root anchor.
-        You can also create it with an initial file with one line with a DNSKEY
-        or DS record.
-        If the file is writable, it is updated when the trust anchor changes.
-        At this time it is only possible to add trusted keys before the first
-        resolve is done.
-
-    ub_ctx_add_ta_file
-        Add trust anchors to the given context.
-        Pass name of a file with DS and DNSKEY records in zone file format.
-        At this time it is only possible to add trusted keys before the first
-        resolve is done.
-
-    ub_ctx_trustedkeys
-        Add trust anchors to the given context.
-        Pass the name of a bind-style config file with ``trusted-keys{}``.
-        At this time it is only possible to add trusted keys before the first
-        resolve is done.
-
-    ub_ctx_debugout
-        Set debug and error log output to the given stream.
-        Pass NULL to disable output.
-        Default is stderr.
-        File-names or using syslog can be enabled using config options, this
-        routine is for using your own stream.
-
-    ub_ctx_debuglevel
-        Set debug verbosity for the context.
-        Output is directed to stderr.
-        Higher debug level gives more output.
-
-    ub_ctx_async
-        Set a context behaviour for asynchronous action.
-        if set to true, enables threading and a call to **ub_resolve_async**
-        creates a thread to handle work in the background.
-        If false, a process is forked to handle work in the background.
-        Changes to this setting after **ub_resolve_async** calls have been made
-        have no effect (delete and re-create the context to change).
-
-    ub_poll
-        Poll a context to see if it has any new results.
-        Do not poll in a loop, instead extract the **fd** below to poll for
-        readiness, and then check, or wait using the wait routine.
-        Returns 0 if nothing to read, or nonzero if a result is available.
-        If nonzero, call **ub_process** to do callbacks.
-
-    ub_wait
-        Wait for a context to finish with results.
-        Calls **ub_process** after the wait for you.
-        After the wait, there are no more outstanding asynchronous queries.
-
-    ub_fd 
-        Get file descriptor.
-        Wait for it to become readable, at this point answers are returned from
-        the asynchronous validating resolver.
-        Then call the **ub_process** to continue processing.
-
-    ub_process
-        Call this routine to continue processing results from the validating
-        resolver (when the **fd** becomes readable).
-        Will perform necessary callbacks.
-
-    ub_resolve
-        Perform resolution and validation of the target name.
-        The name is a domain name in a zero terminated text string.
-        The rrtype and rrclass are DNS type and class codes.
-        The result structure is newly allocated with the resulting data.
-
-    ub_resolve_async
-        Perform asynchronous resolution and validation of the target name.
-        Arguments mean the same as for **ub_resolve** except no data is
-        returned immediately, instead a callback is called later.
-        The callback receives a copy of the mydata pointer, that you can use to
-        pass information to the callback.
-        The callback type is a function pointer to a function declared as:
-
-        .. code-block:: c
-
-            void my_callback_function(void* my_arg, int err,
-                            struct ub_result* result);
-
-        The **async_id** is returned so you can (at your option) decide to
-        track it and cancel the request if needed.
-        If you pass a NULL pointer the **async_id** is not returned.
-
-    ub_cancel
-        Cancel an async query in progress.
-        This may return an error if the query does not exist, or the query is
-        already being delivered, in that case you may still get a callback for
-        the query.
-
-    ub_resolve_free
-        Free struct **ub_result** contents after use.
-
-    ub_strerror
-        Convert error value from one of the unbound library functions to a
-        human readable string.
-
-    ub_ctx_print_local_zones
-        Debug printout the local authority information to debug output.
-
-    ub_ctx_zone_add
-        Add new zone to local authority info, like local-zone
-        :doc:`unbound.conf(5)</manpages/unbound.conf>` statement.
-
-    ub_ctx_zone_remove
-        Delete zone from local authority info.
-
-    ub_ctx_data_add
-        Add resource record data to local authority info, like local-data
-        :doc:`unbound.conf(5)</manpages/unbound.conf>` statement.
-
-    ub_ctx_data_remove
-        Delete local authority data from the name given.
-
-Result Data structure
---------------------
-
-The result of the DNS resolution and validation is returned as *struct
-ub_result*.
-The result structure contains the following entries:
-
-.. code-block:: c
-
-    struct ub_result {
-         char* qname;         /* text string, original question */
-         int qtype;           /* type code asked for */
-         int qclass;          /* class code asked for */
-         char** data;         /* array of rdata items, NULL terminated*/
-         int* len;            /* array with lengths of rdata items */
-         char* canonname;     /* canonical name of result */
-         int rcode;           /* additional error code in case of no data */
-         void* answer_packet; /* full network format answer packet */
-         int answer_len;      /* length of packet in octets */
-         int havedata;        /* true if there is data */
-         int nxdomain;        /* true if nodata because name does not exist */
-         int secure;          /* true if result is secure */
-         int bogus;           /* true if a security failure happened */
-         char* why_bogus;     /* string with error if bogus */
-         int was_ratelimited; /* true if the query was ratelimited (SERVFAIL) by unbound */
-         int ttl;             /* number of seconds the result is valid */
-    };
-
-If both secure and bogus are false, security was not enabled for the domain of
-the query.
-Else, they are not both true, one of them is true.
-
-Return Values
-------------
-
-Many routines return an error code.
-The value 0 (zero) denotes no error happened.
-Other values can be passed to **ub_strerror** to obtain a readable error
-string.
-**ub_strerror** returns a zero terminated string.
-**ub_ctx_create** returns NULL on an error (a malloc failure).
-**ub_poll** returns true if some information may be available, false otherwise.
-**ub_fd** returns a file descriptor or -1 on error.
-**ub_ctx_config** and **ub_ctx_resolvconf** attempt to leave errno informative
-on a function return with file read failure.
-
-See Also
--------
-
-:doc:`unbound.conf(5)</manpages/unbound.conf>`, :doc:`unbound(8)</manpages/unbound>`.
@@ -1,309 +1,189 @@
-.\" Man page generated from reStructuredText.
-.
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.TH "UNBOUND-ANCHOR" "8" "@date@" "@version@" "Unbound"
-.SH NAME
-unbound-anchor \- Unbound @version@ anchor utility.
-.SH SYNOPSIS
-.sp
-\fBunbound\-anchor\fP [\fBopts\fP]
-.SH DESCRIPTION
-.sp
-\fBunbound\-anchor\fP performs setup or update of the root trust anchor for DNSSEC
-validation.
-The program fetches the trust anchor with the method from \fI\%RFC 7958\fP when
-regular \fI\%RFC 5011\fP update fails to bring it up to date.
-It can be run from the commandline, or run as part of startup scripts before
-you start the \fI\%unbound(8)\fP DNS server.
-.sp
-Note that if you want to use \fI\%RFC 5011\fP with Unbound (i.e., the
-\fI\%auto\-trust\-anchor\-file\fP option) so
-that trust anchor information is automatically tracked by Unbound during
-operation, the user that Unbound runs under (by default \(aqunbound\(aq) must have
-write permissions to the file and the directory the file lives in (for creating
-temporary files).
-In this case you would probably want to run this program as the designated
-Unbound user.
-.sp
+.TH "unbound-anchor" "8" "@date@" "NLnet Labs" "unbound @version@"
+.\"
+.\" unbound-anchor.8 -- unbound anchor maintenance utility manual
+.\"
+.\" Copyright (c) 2008, NLnet Labs. All rights reserved.
+.\"
+.\" See LICENSE for the license.
+.\"
+.\"
+.SH "NAME"
+.B unbound\-anchor
+\- Unbound anchor utility.
+.SH "SYNOPSIS"
+.B unbound\-anchor
+.RB [ opts ]
+.SH "DESCRIPTION"
+.B Unbound\-anchor
+performs setup or update of the root trust anchor for DNSSEC validation.
+The program fetches the trust anchor with the method from RFC7958 when
+regular RFC5011 update fails to bring it up to date.
+It can be run (as root) from the commandline, or run as part of startup
+scripts.  Before you start the \fIunbound\fR(8) DNS server.
+.P
 Suggested usage:
-.INDENT 0.0
-.INDENT 3.5
-.sp
+.P
 .nf
-.ft C
-# in the init scripts.
-# provide or update the root anchor (if necessary)
-unbound\-anchor \-a \(dq@UNBOUND_ROOTKEY_FILE@\(dq
-
-# Please note usage of this root anchor is at your own risk
-# and under the terms of our LICENSE (see source).
-#
-# start validating resolver
-# the unbound.conf contains:
-# auto\-trust\-anchor\-file: \(dq@UNBOUND_ROOTKEY_FILE@\(dq
-unbound \-c unbound.conf
-.ft P
+	# in the init scripts.
+	# provide or update the root anchor (if necessary)
+	unbound-anchor \-a "@UNBOUND_ROOTKEY_FILE@"
+	# Please note usage of this root anchor is at your own risk
+	# and under the terms of our LICENSE (see source).
+	#
+	# start validating resolver
+	# the unbound.conf contains:
+	#   auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
+	unbound \-c unbound.conf
 .fi
-.UNINDENT
-.UNINDENT
-.sp
-This tool provides builtin default contents for the root anchor and root update
-certificate files.
-.sp
+.P
+This tool provides builtin default contents for the root anchor and root
+update certificate files.
+.P
 It tests if the root anchor file works, and if not, and an update is possible,
 attempts to update the root anchor using the root update certificate.
-It performs a https fetch of
-\fI\%root\-anchors.xml\fP
-and checks the results (\fI\%RFC 7958\fP); if all checks are successful, it updates
-the root anchor file.
-Otherwise the root anchor file is unchanged.
-It performs \fI\%RFC 5011\fP tracking if the DNSSEC information available via the
-DNS makes that possible.
-.sp
-It does not perform an update if the certificate is expired, if the network is
-down or other errors occur.
-.sp
+It performs a https fetch of root-anchors.xml and checks the results (RFC7958),
+if all checks are successful, it updates the root anchor file.  Otherwise
+the root anchor file is unchanged.  It performs RFC5011 tracking if the
+DNSSEC information available via the DNS makes that possible.
+.P
+It does not perform an update if the certificate is expired, if the network
+is down or other errors occur.
+.P
 The available options are:
-.INDENT 0.0
 .TP
-.B \-a <file>
+.B \-a \fIfile
 The root anchor key file, that is read in and written out.
-Default is \fB@UNBOUND_ROOTKEY_FILE@\fP\&.
-If the file does not exist, or is empty, a builtin root key is written
-to it.
-.UNINDENT
-.INDENT 0.0
+Default is @UNBOUND_ROOTKEY_FILE@.
+If the file does not exist, or is empty, a builtin root key is written to it.
 .TP
-.B \-c <file>
+.B \-c \fIfile
 The root update certificate file, that is read in.
-Default is \fB@UNBOUND_ROOTCERT_FILE@\fP\&.
+Default is @UNBOUND_ROOTCERT_FILE@.
 If the file does not exist, or is empty, a builtin certificate is used.
-.UNINDENT
-.INDENT 0.0
 .TP
 .B \-l
 List the builtin root key and builtin root update certificate on stdout.
-.UNINDENT
-.INDENT 0.0
 .TP
-.B \-u <name>
-The server name, it connects to \fBhttps://name\fP\&.
-Specify without \fBhttps://\fP prefix.
-The default is \fB\(dqdata.iana.org\(dq\fP\&.
-It connects to the port specified with \fI\%\-P\fP\&.
+.B \-u \fIname
+The server name, it connects to https://name.  Specify without https:// prefix.
+The default is "data.iana.org".  It connects to the port specified with \-P.
 You can pass an IPv4 address or IPv6 address (no brackets) if you want.
-.UNINDENT
-.INDENT 0.0
 .TP
 .B \-S
-Do not use SNI for the HTTPS connection.
-Default is to use SNI.
-.UNINDENT
-.INDENT 0.0
+Do not use SNI for the HTTPS connection.  Default is to use SNI.
 .TP
-.B \-b <address>
-The source address to bind to for domain resolution and contacting the
-server on https.
-May be either an IPv4 address or IPv6 address (no brackets).
-.UNINDENT
-.INDENT 0.0
+.B \-b \fIaddress
+The source address to bind to for domain resolution and contacting the server
+on https.  May be either an IPv4 address or IPv6 address (no brackets).
 .TP
-.B \-x <path>
-The pathname to the root\-anchors.xml file on the server.
-(forms URL with \fI\%\-u\fP).
-The default is \fB/root\-anchors/root\-anchors.xml\fP\&.
-.UNINDENT
-.INDENT 0.0
+.B \-x \fIpath
+The pathname to the root\-anchors.xml file on the server. (forms URL with \-u).
+The default is /root\-anchors/root\-anchors.xml.
 .TP
-.B \-s <path>
-The pathname to the root\-anchors.p7s file on the server.
-(forms URL with \fI\%\-u\fP).
-The default is \fB/root\-anchors/root\-anchors.p7s\fP\&.
-This file has to be a PKCS7 signature over the xml file, using the pem
-file (\fI\%\-c\fP) as trust anchor.
-.UNINDENT
-.INDENT 0.0
+.B \-s \fIpath
+The pathname to the root\-anchors.p7s file on the server. (forms URL with \-u).
+The default is /root\-anchors/root\-anchors.p7s.  This file has to be a PKCS7
+signature over the xml file, using the pem file (\-c) as trust anchor.
 .TP
-.B \-n <name>
-The emailAddress for the Subject of the signer\(aqs certificate from the
-p7s signature file.
-Only signatures from this name are allowed.
-The default is \fBdnssec@iana.org\fP\&.
-If you pass \fB\(dq\(dq\fP then the emailAddress is not checked.
-.UNINDENT
-.INDENT 0.0
+.B \-n \fIname
+The emailAddress for the Subject of the signer's certificate from the p7s
+signature file.  Only signatures from this name are allowed.  default is
+dnssec@iana.org.  If you pass "" then the emailAddress is not checked.
 .TP
 .B \-4
-Use IPv4 for domain resolution and contacting the server on
-https.
-Default is to use IPv4 and IPv6 where appropriate.
-.UNINDENT
-.INDENT 0.0
+Use IPv4 for domain resolution and contacting the server on https.  Default is
+to use IPv4 and IPv6 where appropriate.
 .TP
 .B \-6
-Use IPv6 for domain resolution and contacting the server on https.
-Default is to use IPv4 and IPv6 where appropriate.
-.UNINDENT
-.INDENT 0.0
+Use IPv6 for domain resolution and contacting the server on https.  Default is
+to use IPv4 and IPv6 where appropriate.
 .TP
-.B \-f <resolv.conf>
-Use the given resolv.conf file.
-Not enabled by default, but you could try to pass
-\fB/etc/resolv.conf\fP on some systems.
-It contains the IP addresses of the recursive nameservers to use.
-However, since this tool could be used to bootstrap that very recursive
-nameserver, it would not be useful (since that server is not up yet,
-since we are bootstrapping it).
-It could be useful in a situation where you know an upstream cache is
-deployed (and running) and in captive portal situations.
-.UNINDENT
-.INDENT 0.0
+.B \-f \fIresolv.conf
+Use the given resolv.conf file.  Not enabled by default, but you could try to
+pass /etc/resolv.conf on some systems.  It contains the IP addresses of the
+recursive nameservers to use.  However, since this tool could be used to
+bootstrap that very recursive nameserver, it would not be useful (since
+that server is not up yet, since we are bootstrapping it).  It could be
+useful in a situation where you know an upstream cache is deployed (and
+running) and in captive portal situations.
 .TP
-.B \-r <root.hints>
-Use the given root.hints file (same syntax as the BIND and Unbound root
-hints file) to bootstrap domain resolution.
-By default a list of builtin root hints is used.
-unbound\-anchor goes to the network itself for these roots, to resolve
-the server (\fI\%\-u\fP option) and to check the root DNSKEY records.
+.B \-r \fIroot.hints
+Use the given root.hints file (same syntax as the BIND and Unbound root hints
+file) to bootstrap domain resolution.  By default a list of builtin root
+hints is used.  Unbound\-anchor goes to the network itself for these roots,
+to resolve the server (\-u option) and to check the root DNSKEY records.
 It does so, because the tool when used for bootstrapping the recursive
-resolver, cannot use that recursive resolver itself because it is
-bootstrapping that server.
-.UNINDENT
-.INDENT 0.0
+resolver, cannot use that recursive resolver itself because it is bootstrapping
+that server.
 .TP
 .B \-R
-Allow fallback from \fI\%\-f\fP \fB<resolv.conf>\fP file to direct root
-servers query.
-It allows you to prefer local resolvers, but fallback automatically to
-direct root query if they do not respond or do not support DNSSEC.
-.UNINDENT
-.INDENT 0.0
+Allow fallback from \-f resolv.conf file to direct root servers query.
+It allows you to prefer local resolvers, but fallback automatically
+to direct root query if they do not respond or do not support DNSSEC.
 .TP
 .B \-v
-More verbose.
-Once prints informational messages, multiple times may enable large
-debug amounts (such as full certificates or byte\-dumps of downloaded
-files).
-By default it prints almost nothing.
-It also prints nothing on errors by default; in that case the original
-root anchor file is simply left undisturbed, so that a recursive server
-can start right after it.
-.UNINDENT
-.INDENT 0.0
+More verbose. Once prints informational messages, multiple times may enable
+large debug amounts (such as full certificates or byte\-dumps of downloaded
+files).  By default it prints almost nothing.  It also prints nothing on
+errors by default; in that case the original root anchor file is simply
+left undisturbed, so that a recursive server can start right after it.
 .TP
-.B \-C <unbound.conf>
-Debug option to read \fB<unbound.conf>\fP into the resolver process
-used.
-.UNINDENT
-.INDENT 0.0
+.B \-C \fIunbound.conf
+Debug option to read unbound.conf into the resolver process used.
 .TP
-.B \-P <port>
-Set the port number to use for the https connection.
-The default is 443.
-.UNINDENT
-.INDENT 0.0
+.B \-P \fIport
+Set the port number to use for the https connection.  The default is 443.
 .TP
 .B \-F
-Debug option to force update of the root anchor through downloading the
-xml file and verifying it with the certificate.
-By default it first tries to update by contacting the DNS, which uses
-much less bandwidth, is much faster (200 msec not 2 sec), and is nicer
-to the deployed infrastructure.
-With this option, it still attempts to do so (and may verbosely tell
-you), but then ignores the result and goes on to use the xml fallback
-method.
-.UNINDENT
-.INDENT 0.0
+Debug option to force update of the root anchor through downloading the xml
+file and verifying it with the certificate.  By default it first tries to
+update by contacting the DNS, which uses much less bandwidth, is much
+faster (200 msec not 2 sec), and is nicer to the deployed infrastructure.
+With this option, it still attempts to do so (and may verbosely tell you),
+but then ignores the result and goes on to use the xml fallback method.
 .TP
 .B \-h
 Show the version and commandline option help.
-.UNINDENT
-.SH EXIT CODE
-.sp
+.SH "EXIT CODE"
 This tool exits with value 1 if the root anchor was updated using the
-certificate or if the builtin root\-anchor was used.
-It exits with code 0 if no update was necessary, if the update was possible
-with \fI\%RFC 5011\fP tracking, or if an error occurred.
-.sp
+certificate or if the builtin root-anchor was used.  It exits with code
+0 if no update was necessary, if the update was possible with RFC5011
+tracking, or if an error occurred.
+.P
 You can check the exit value in this manner:
-.INDENT 0.0
-.INDENT 3.5
-.sp
 .nf
-.ft C
-unbound\-anchor \-a \(dqroot.key\(dq || logger \(dqPlease check root.key\(dq
-.ft P
+	unbound-anchor \-a "root.key" || logger "Please check root.key"
 .fi
-.UNINDENT
-.UNINDENT
-.sp
 Or something more suitable for your operational environment.
-.SH TRUST
-.sp
-The root keys and update certificate included in this tool are provided for
-convenience and under the terms of our license (see the LICENSE file in the
-source distribution or \fI\%https://github.com/NLnetLabs/unbound/blob/master/LICENSE\fP
-and might be stale or not suitable to your purpose.
-.sp
-By running \fI\%unbound\-anchor \-l\fP the keys and certificate that are
+.SH "TRUST"
+The root keys and update certificate included in this tool
+are provided for convenience and under the terms of our
+license (see the LICENSE file in the source distribution or
+https://github.com/NLnetLabs/unbound/blob/master/LICENSE) and might be stale or
+not suitable to your purpose.
+.P
+By running "unbound\-anchor \-l" the  keys and certificate that are
 configured in the code are printed for your convenience.
-.sp
-The built\-in configuration can be overridden by providing a root\-cert file and
-a rootkey file.
-.SH FILES
-.INDENT 0.0
+.P
+The build\-in configuration can be overridden by providing a root\-cert
+file and a rootkey file.
+.SH "FILES"
 .TP
-.B @UNBOUND_ROOTKEY_FILE@
-The root anchor file, updated with 5011 tracking, and read and written
-to.
+.I @UNBOUND_ROOTKEY_FILE@
+The root anchor file, updated with 5011 tracking, and read and written to.
 The file is created if it does not exist.
 .TP
-.B @UNBOUND_ROOTCERT_FILE@
-The trusted self\-signed certificate that is used to verify the
-downloaded DNSSEC root trust anchor.
-You can update it by fetching it from
-\fI\%https://data.iana.org/root\-anchors/icannbundle.pem\fP (and validate it).
+.I @UNBOUND_ROOTCERT_FILE@
+The trusted self\-signed certificate that is used to verify the downloaded
+DNSSEC root trust anchor.  You can update it by fetching it from
+https://data.iana.org/root\-anchors/icannbundle.pem (and validate it).
 If the file does not exist or is empty, a builtin version is used.
 .TP
-.B \fI\%https://data.iana.org/root\-anchors/root\-anchors.xml\fP
+.I https://data.iana.org/root\-anchors/root\-anchors.xml
 Source for the root key information.
 .TP
-.B \fI\%https://data.iana.org/root\-anchors/root\-anchors.p7s\fP
+.I https://data.iana.org/root\-anchors/root\-anchors.p7s
 Signature on the root key information.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fI\%unbound.conf(5)\fP,
-\fI\%unbound(8)\fP\&.
-.SH AUTHOR
-Unbound developers are mentioned in the CREDITS file in the distribution.
-.SH COPYRIGHT
-1999-2026, NLnet Labs
-.\" Generated by docutils manpage writer.
-.
+.SH "SEE ALSO"
+\fIunbound.conf\fR(5),
+\fIunbound\fR(8).
@@ -1,290 +0,0 @@
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-.. program:: unbound-anchor
-
-unbound-anchor(8)
-=================
-
-Synopsis
--------
-
-**unbound-anchor** [``opts``]
-
-Description
-----------
-
-``unbound-anchor`` performs setup or update of the root trust anchor for DNSSEC
-validation.
-The program fetches the trust anchor with the method from :rfc:`7958` when
-regular :rfc:`5011` update fails to bring it up to date.
-It can be run from the commandline, or run as part of startup scripts before
-you start the :doc:`unbound(8)</manpages/unbound>` DNS server.
-
-Note that if you want to use :rfc:`5011` with Unbound (i.e., the
-:ref:`auto-trust-anchor-file<unbound.conf.auto-trust-anchor-file>` option) so
-that trust anchor information is automatically tracked by Unbound during
-operation, the user that Unbound runs under (by default 'unbound') must have
-write permissions to the file and the directory the file lives in (for creating
-temporary files).
-In this case you would probably want to run this program as the designated
-Unbound user.
-
-Suggested usage:
-
-.. code-block:: text
-
-   # in the init scripts.
-   # provide or update the root anchor (if necessary)
-   unbound-anchor -a "@UNBOUND_ROOTKEY_FILE@"
-
-   # Please note usage of this root anchor is at your own risk
-   # and under the terms of our LICENSE (see source).
-   #
-   # start validating resolver
-   # the unbound.conf contains:
-   # auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
-   unbound -c unbound.conf
-
-This tool provides builtin default contents for the root anchor and root update
-certificate files.
-
-It tests if the root anchor file works, and if not, and an update is possible,
-attempts to update the root anchor using the root update certificate.
-It performs a https fetch of
-`root-anchors.xml <http://data.iana.org/root-anchors/root-anchors.xml>`__
-and checks the results (:rfc:`7958`); if all checks are successful, it updates
-the root anchor file.
-Otherwise the root anchor file is unchanged.
-It performs :rfc:`5011` tracking if the DNSSEC information available via the
-DNS makes that possible.
-
-It does not perform an update if the certificate is expired, if the network is
-down or other errors occur.
-
-The available options are:
-
-.. option:: -a <file>
-
-       The root anchor key file, that is read in and written out.
-       Default is :file:`@UNBOUND_ROOTKEY_FILE@`.
-       If the file does not exist, or is empty, a builtin root key is written
-       to it.
-
-.. option:: -c <file>
-
-       The root update certificate file, that is read in.
-       Default is :file:`@UNBOUND_ROOTCERT_FILE@`.
-       If the file does not exist, or is empty, a builtin certificate is used.
-
-.. option:: -l
-
-       List the builtin root key and builtin root update certificate on stdout.
-
-.. option:: -u <name>
-
-       The server name, it connects to ``https://name``.
-       Specify without ``https://`` prefix.
-       The default is ``"data.iana.org"``.
-       It connects to the port specified with :option:`-P`.
-       You can pass an IPv4 address or IPv6 address (no brackets) if you want.
-
-.. option:: -S
-
-       Do not use SNI for the HTTPS connection.
-       Default is to use SNI.
-
-.. option:: -b <address>
-
-       The source address to bind to for domain resolution and contacting the
-       server on https.
-       May be either an IPv4 address or IPv6 address (no brackets).
-
-.. option:: -x <path>
-
-       The pathname to the root-anchors.xml file on the server.
-       (forms URL with :option:`-u`).
-       The default is :file:`/root-anchors/root-anchors.xml`.
-
-.. option:: -s <path>
-
-       The pathname to the root-anchors.p7s file on the server.
-       (forms URL with :option:`-u`).
-       The default is :file:`/root-anchors/root-anchors.p7s`.
-       This file has to be a PKCS7 signature over the xml file, using the pem
-       file (:option:`-c`) as trust anchor.
-
-.. option:: -n <name>
-
-       The emailAddress for the Subject of the signer's certificate from the
-       p7s signature file.
-       Only signatures from this name are allowed.
-       The default is ``dnssec@iana.org``.
-       If you pass ``""`` then the emailAddress is not checked.
-
-.. option:: -4
-
-       Use IPv4 for domain resolution and contacting the server on
-       https.
-       Default is to use IPv4 and IPv6 where appropriate.
-
-.. option:: -6
-
-       Use IPv6 for domain resolution and contacting the server on https.
-       Default is to use IPv4 and IPv6 where appropriate.
-
-.. option:: -f <resolv.conf>
-
-       Use the given resolv.conf file.
-       Not enabled by default, but you could try to pass
-       :file:`/etc/resolv.conf` on some systems.
-       It contains the IP addresses of the recursive nameservers to use.
-       However, since this tool could be used to bootstrap that very recursive
-       nameserver, it would not be useful (since that server is not up yet,
-       since we are bootstrapping it).
-       It could be useful in a situation where you know an upstream cache is
-       deployed (and running) and in captive portal situations.
-
-.. option:: -r <root.hints>
-
-       Use the given root.hints file (same syntax as the BIND and Unbound root
-       hints file) to bootstrap domain resolution.
-       By default a list of builtin root hints is used.
-       unbound-anchor goes to the network itself for these roots, to resolve
-       the server (:option:`-u` option) and to check the root DNSKEY records.
-       It does so, because the tool when used for bootstrapping the recursive
-       resolver, cannot use that recursive resolver itself because it is
-       bootstrapping that server.
-
-.. option:: -R
-
-       Allow fallback from :option:`-f` ``<resolv.conf>`` file to direct root
-       servers query.
-       It allows you to prefer local resolvers, but fallback automatically to
-       direct root query if they do not respond or do not support DNSSEC.
-
-.. option:: -v
-
-       More verbose.
-       Once prints informational messages, multiple times may enable large
-       debug amounts (such as full certificates or byte-dumps of downloaded
-       files).
-       By default it prints almost nothing.
-       It also prints nothing on errors by default; in that case the original
-       root anchor file is simply left undisturbed, so that a recursive server
-       can start right after it.
-
-.. option:: -C <unbound.conf>
-
-       Debug option to read :file:`<unbound.conf>` into the resolver process
-       used.
-
-.. option:: -P <port>
-
-       Set the port number to use for the https connection.
-       The default is 443.
-
-.. option:: -F
-
-       Debug option to force update of the root anchor through downloading the
-       xml file and verifying it with the certificate.
-       By default it first tries to update by contacting the DNS, which uses
-       much less bandwidth, is much faster (200 msec not 2 sec), and is nicer
-       to the deployed infrastructure.
-       With this option, it still attempts to do so (and may verbosely tell
-       you), but then ignores the result and goes on to use the xml fallback
-       method.
-
-.. option:: -h
-
-       Show the version and commandline option help.
-
-Exit Code
---------
-
-This tool exits with value 1 if the root anchor was updated using the
-certificate or if the builtin root-anchor was used.
-It exits with code 0 if no update was necessary, if the update was possible
-with :rfc:`5011` tracking, or if an error occurred.
-
-You can check the exit value in this manner:
-
-.. code-block:: text
-
-       unbound-anchor -a "root.key" || logger "Please check root.key"
-
-Or something more suitable for your operational environment.
-
-Trust
-----
-
-The root keys and update certificate included in this tool are provided for
-convenience and under the terms of our license (see the LICENSE file in the
-source distribution or https://github.com/NLnetLabs/unbound/blob/master/LICENSE
-and might be stale or not suitable to your purpose.
-
-By running :option:`unbound-anchor -l` the keys and certificate that are
-configured in the code are printed for your convenience.
-
-The built-in configuration can be overridden by providing a root-cert file and
-a rootkey file.
-
-Files
-----
-
-@UNBOUND_ROOTKEY_FILE@
-       The root anchor file, updated with 5011 tracking, and read and written
-       to.
-       The file is created if it does not exist.
-
-@UNBOUND_ROOTCERT_FILE@
-       The trusted self-signed certificate that is used to verify the
-       downloaded DNSSEC root trust anchor.
-       You can update it by fetching it from
-       https://data.iana.org/root-anchors/icannbundle.pem (and validate it).
-       If the file does not exist or is empty, a builtin version is used.
-
-https://data.iana.org/root-anchors/root-anchors.xml
-       Source for the root key information.
-
-https://data.iana.org/root-anchors/root-anchors.p7s
-       Signature on the root key information.
-
-See Also
--------
-
-:doc:`unbound.conf(5)</manpages/unbound.conf>`,
-:doc:`unbound(8)</manpages/unbound>`.
@@ -1,93 +1,56 @@
-.\" Man page generated from reStructuredText.
-.
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.TH "UNBOUND-CHECKCONF" "8" "@date@" "@version@" "Unbound"
-.SH NAME
-unbound-checkconf \- Check Unbound @version@ configuration file for errors.
-.SH SYNOPSIS
-.sp
-\fBunbound\-checkconf\fP [\fB\-hf\fP] [\fB\-o option\fP] [cfgfile]
-.SH DESCRIPTION
-.sp
-\fBunbound\-checkconf\fP checks the configuration file for the
-\fI\%unbound(8)\fP DNS resolver for syntax and other errors.
+.TH "unbound-checkconf" "8" "@date@" "NLnet Labs" "unbound @version@"
+.\"
+.\" unbound-checkconf.8 -- unbound configuration checker manual
+.\"
+.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
+.\"
+.\" See LICENSE for the license.
+.\"
+.\"
+.SH "NAME"
+unbound\-checkconf
+\- Check Unbound configuration file for errors.
+.SH "SYNOPSIS"
+.B unbound\-checkconf
+.RB [ \-h ]
+.RB [ \-f ]
+.RB [ \-q ]
+.RB [ \-o
+.IR option ]
+.RI [ cfgfile ]
+.SH "DESCRIPTION"
+.B Unbound\-checkconf
+checks the configuration file for the
+\fIunbound\fR(8)
+DNS resolver for syntax and other errors.
 The config file syntax is described in
-\fI\%unbound.conf(5)\fP\&.
-.sp
+\fIunbound.conf\fR(5).
+.P
 The available options are:
-.INDENT 0.0
 .TP
 .B \-h
 Show the version and commandline option help.
-.UNINDENT
-.INDENT 0.0
 .TP
 .B \-f
-Print full pathname, with chroot applied to it.
-Use with the \fI\%\-o\fP option.
-.UNINDENT
-.INDENT 0.0
+Print full pathname, with chroot applied to it.  Use with the \-o option.
+.TP
+.B \-o\fI option
+If given, after checking the config file the value of this option is
+printed to stdout.  For "" (disabled) options an empty line is printed.
 .TP
 .B \-q
 Make the operation quiet, suppress output on success.
-.UNINDENT
-.INDENT 0.0
 .TP
-.B \-o <option>
-If given, after checking the config file the value of this option is
-printed to stdout.
-For \fB\(dq\(dq\fP (disabled) options an empty line is printed.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B cfgfile
-The config file to read with settings for Unbound.
-It is checked.
+.I cfgfile
+The config file to read with settings for Unbound. It is checked.
 If omitted, the config file at the default location is checked.
-.UNINDENT
-.SH EXIT CODE
-.sp
-The \fBunbound\-checkconf\fP program exits with status code 1 on error, 0 for a
-correct config file.
-.SH FILES
-.INDENT 0.0
+.SH "EXIT CODE"
+The unbound\-checkconf program exits with status code 1 on error,
+0 for a correct config file.
+.SH "FILES"
 .TP
-.B @ub_conf_file@
+.I @ub_conf_file@
 Unbound configuration file.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fI\%unbound.conf(5)\fP,
-\fI\%unbound(8)\fP\&.
-.SH AUTHOR
-Unbound developers are mentioned in the CREDITS file in the distribution.
-.SH COPYRIGHT
-1999-2026, NLnet Labs
-.\" Generated by docutils manpage writer.
-.
+.SH "SEE ALSO"
+\fIunbound.conf\fR(5),
+\fIunbound\fR(8).
@@ -1,98 +0,0 @@
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-.. program:: unbound-checkconf
-
-unbound-checkconf(8)
-====================
-
-Synopsis
--------
-
-**unbound-checkconf** [``-hf``] [``-o option``] [cfgfile]
-
-Description
-----------
-
-``unbound-checkconf`` checks the configuration file for the
-:doc:`unbound(8)</manpages/unbound>` DNS resolver for syntax and other errors.
-The config file syntax is described in
-:doc:`unbound.conf(5)</manpages/unbound.conf>`.
-
-The available options are:
-
-.. option:: -h
-
-    Show the version and commandline option help.
-
-.. option:: -f
-
-    Print full pathname, with chroot applied to it.
-    Use with the :option:`-o` option.
-
-.. option:: -q
-
-    Make the operation quiet, suppress output on success.
-
-.. option:: -o <option>
-
-    If given, after checking the config file the value of this option is
-    printed to stdout.
-    For ``""`` (disabled) options an empty line is printed.
-
-.. option:: cfgfile
-
-    The config file to read with settings for Unbound.
-    It is checked.
-    If omitted, the config file at the default location is checked.
-
-Exit Code
---------
-
-The ``unbound-checkconf`` program exits with status code 1 on error, 0 for a
-correct config file.
-
-Files
-----
-
-@ub_conf_file@
-    Unbound configuration file.
-
-See Also
--------
-
-:doc:`unbound.conf(5)</manpages/unbound.conf>`,
-:doc:`unbound(8)</manpages/unbound>`.
@@ -1,190 +1,118 @@
-.\" Man page generated from reStructuredText.
-.
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.TH "UNBOUND-HOST" "1" "@date@" "@version@" "Unbound"
-.SH NAME
-unbound-host \- Unbound @version@ DNS lookup utility.
-.SH SYNOPSIS
-.sp
-\fBunbound\-host\fP [\fB\-C configfile\fP] [\fB\-vdhr46D\fP] [\fB\-c class\fP]
-[\fB\-t type\fP] [\fB\-y key\fP] [\fB\-f keyfile\fP] [\fB\-F namedkeyfile\fP] hostname
-.SH DESCRIPTION
-.sp
-\fBunbound\-host\fP uses the Unbound validating resolver to query for the hostname
-and display results.
-With the \fI\%\-v\fP option it displays validation status: secure, insecure,
-bogus (security failure).
-.sp
-By default it reads no configuration file whatsoever.
-It attempts to reach the internet root servers.
-With \fI\%\-C\fP an unbound config file and with \fI\%\-r\fP \fBresolv.conf\fP
-can be read.
-.sp
+.TH "unbound\-host" "1" "@date@" "NLnet Labs" "unbound @version@"
+.\"
+.\" unbound-host.1 -- unbound DNS lookup utility
+.\"
+.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
+.\"
+.\" See LICENSE for the license.
+.\"
+.\"
+.SH "NAME"
+.B unbound\-host
+\- unbound DNS lookup utility
+.SH "SYNOPSIS"
+.B unbound\-host
+.RB [ \-C
+.IR configfile ]
+.RB [ \-vdhr46D ]
+.RB [ \-c
+.IR class ]
+.RB [ \-t
+.IR type ]
+.RB [ \-y
+.IR key ]
+.RB [ \-f
+.IR keyfile ]
+.RB [ \-F
+.IR namedkeyfile ]
+.I hostname
+.SH "DESCRIPTION"
+.B Unbound\-host
+uses the Unbound validating resolver to query for the hostname and display
+results. With the \fB\-v\fR option it displays validation
+status: secure, insecure, bogus (security failure).
+.P
+By default it reads no configuration file whatsoever.  It attempts to reach
+the internet root servers.  With \fB\-C\fR an Unbound config file and with
+\fB\-r\fR resolv.conf can be read.
+.P
 The available options are:
-.INDENT 0.0
 .TP
-.B hostname
+.I hostname
 This name is resolved (looked up in the DNS).
 If a IPv4 or IPv6 address is given, a reverse lookup is performed.
-.UNINDENT
-.INDENT 0.0
 .TP
 .B \-h
 Show the version and commandline option help.
-.UNINDENT
-.INDENT 0.0
 .TP
 .B \-v
 Enable verbose output and it shows validation results, on every line.
-Secure means that the NXDOMAIN (no such domain name), nodata (no such
-data) or positive data response validated correctly with one of the
-keys.
+Secure means that the NXDOMAIN (no such domain name), nodata (no such data)
+or positive data response validated correctly with one of the keys.
 Insecure means that that domain name has no security set up for it.
-Bogus (security failure) means that the response failed one or more
-checks, it is likely wrong, outdated, tampered with, or broken.
-.UNINDENT
-.INDENT 0.0
+Bogus (security failure) means that the response failed one or more checks,
+it is likely wrong, outdated, tampered with, or broken.
 .TP
 .B \-d
-Enable debug output to stderr.
-One \fI\%\-d\fP shows what the resolver and validator are doing and may
-tell you what is going on.
-More times, \fI\%\-d\fP \fI\%\-d\fP, gives a lot of output, with every
-packet sent and received.
-.UNINDENT
-.INDENT 0.0
+Enable debug output to stderr. One \-d shows what the resolver and validator
+are doing and may tell you what is going on. More times, \-d \-d, gives a
+lot of output, with every packet sent and received.
 .TP
-.B \-c <class>
-Specify the class to lookup for, the default is IN the internet
-class.
-.UNINDENT
-.INDENT 0.0
+.B \-c \fIclass
+Specify the class to lookup for, the default is IN the internet class.
 .TP
-.B \-t <type>
-Specify the type of data to lookup.
-The default looks for IPv4, IPv6 and mail handler data, or domain name
-pointers for reverse queries.
-.UNINDENT
-.INDENT 0.0
+.B \-t \fItype
+Specify the type of data to lookup. The default looks for IPv4, IPv6 and
+mail handler data, or domain name pointers for reverse queries.
 .TP
-.B \-y <key>
-Specify a public key to use as trust anchor.
-This is the base for a chain of trust that is built up from the trust
-anchor to the response, in order to validate the response message.
-Can be given as a DS or DNSKEY record.
-For example:
-.INDENT 7.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-\-y \(dqexample.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD\(dq
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.UNINDENT
-.INDENT 0.0
+.B \-y \fIkey
+Specify a public key to use as trust anchor. This is the base for a chain
+of trust that is built up from the trust anchor to the response, in order
+to validate the response message. Can be given as a DS or DNSKEY record.
+For example \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD".
 .TP
 .B \-D
-Enables DNSSEC validation.
-Reads the root anchor from the default configured root anchor at the
-default location, \fB@UNBOUND_ROOTKEY_FILE@\fP\&.
-.UNINDENT
-.INDENT 0.0
+Enables DNSSEC validation.  Reads the root anchor from the default configured
+root anchor at the default location, \fI@UNBOUND_ROOTKEY_FILE@\fR.
 .TP
-.B \-f <keyfile>
-Reads keys from a file.
-Every line has a DS or DNSKEY record, in the format as for \fI\%\-y\fP\&.
-The zone file format, the same as \fBdig\fP and \fBdrill\fP produce.
-.UNINDENT
-.INDENT 0.0
+.B \-f \fIkeyfile
+Reads keys from a file. Every line has a DS or DNSKEY record, in the format
+as for \-y. The zone file format, the same as dig and drill produce.
 .TP
-.B \-F <namedkeyfile>
-Reads keys from a BIND\-style \fBnamed.conf\fP file.
-Only the \fBtrusted\-key {};\fP entries are read.
-.UNINDENT
-.INDENT 0.0
+.B \-F \fInamedkeyfile
+Reads keys from a BIND\-style named.conf file. Only the trusted\-key {}; entries
+are read.
 .TP
-.B \-C <configfile>
-Uses the specified unbound.conf to prime \fI\%libunbound(3)\fP\&.
+.B \-C \fIconfigfile
+Uses the specified unbound.conf to prime
+.IR libunbound (3).
 Pass it as first argument if you want to override some options from the
 config file with further arguments on the commandline.
-.UNINDENT
-.INDENT 0.0
 .TP
 .B \-r
-Read \fB/etc/resolv.conf\fP, and use the forward DNS servers from
-there (those could have been set by DHCP).
-More info in \fIresolv.conf(5)\fP\&.
+Read /etc/resolv.conf, and use the forward DNS servers from there (those could
+have been set by DHCP).  More info in
+.IR resolv.conf (5).
 Breaks validation if those servers do not support DNSSEC.
-.UNINDENT
-.INDENT 0.0
 .TP
 .B \-4
 Use solely the IPv4 network for sending packets.
-.UNINDENT
-.INDENT 0.0
 .TP
 .B \-6
 Use solely the IPv6 network for sending packets.
-.UNINDENT
-.SH EXAMPLES
-.sp
-Some examples of use.
-The keys shown below are fakes, thus a security failure is encountered.
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
+.SH "EXAMPLES"
+Some examples of use. The keys shown below are fakes, thus a security failure
+is encountered.
+.P
 $ unbound\-host www.example.com
-
-$ unbound\-host \-v \-y \(dqexample.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD\(dq www.example.com
-
-$ unbound\-host \-v \-y \(dqexample.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD\(dq 192.0.2.153
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SH EXIT CODE
-.sp
-The \fBunbound\-host\fP program exits with status code 1 on error, 0 on no error.
-The data may not be available on exit code 0, exit code 1 means the lookup
-encountered a fatal error.
-.SH SEE ALSO
-.sp
-\fI\%unbound.conf(5)\fP,
-\fI\%unbound(8)\fP\&.
-.SH AUTHOR
-Unbound developers are mentioned in the CREDITS file in the distribution.
-.SH COPYRIGHT
-1999-2026, NLnet Labs
-.\" Generated by docutils manpage writer.
-.
+.P
+$ unbound\-host \-v \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" www.example.com
+.P
+$ unbound\-host \-v \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" 192.0.2.153
+.SH "EXIT CODE"
+The unbound\-host program exits with status code 1 on error,
+0 on no error. The data may not be available on exit code 0, exit code 1
+means the lookup encountered a fatal error.
+.SH "SEE ALSO"
+\fIunbound.conf\fR(5),
+\fIunbound\fR(8).
@@ -1,176 +0,0 @@
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-.. program:: unbound-host
-
-unbound-host(1)
-===============
-
-Synopsis
--------
-
-**unbound-host** [``-C configfile``] [``-vdhr46D``] [``-c class``]
-[``-t type``] [``-y key``] [``-f keyfile``] [``-F namedkeyfile``] hostname
-
-Description
-----------
-
-``unbound-host`` uses the Unbound validating resolver to query for the hostname
-and display results.
-With the :option:`-v` option it displays validation status: secure, insecure,
-bogus (security failure).
-
-By default it reads no configuration file whatsoever.
-It attempts to reach the internet root servers.
-With :option:`-C` an unbound config file and with :option:`-r` ``resolv.conf``
-can be read.
-
-The available options are:
-
-.. option:: hostname
-
-       This name is resolved (looked up in the DNS).
-       If a IPv4 or IPv6 address is given, a reverse lookup is performed.
-
-.. option:: -h
-
-       Show the version and commandline option help.
-
-.. option:: -v
-
-       Enable verbose output and it shows validation results, on every line.
-       Secure means that the NXDOMAIN (no such domain name), nodata (no such
-       data) or positive data response validated correctly with one of the
-       keys.
-       Insecure means that that domain name has no security set up for it.
-       Bogus (security failure) means that the response failed one or more
-       checks, it is likely wrong, outdated, tampered with, or broken.
-
-.. option:: -d
-
-       Enable debug output to stderr.
-       One :option:`-d` shows what the resolver and validator are doing and may
-       tell you what is going on.
-       More times, :option:`-d` :option:`-d`, gives a lot of output, with every
-       packet sent and received.
-
-.. option:: -c <class>
-
-       Specify the class to lookup for, the default is IN the internet
-       class.
-
-.. option:: -t <type>
-
-       Specify the type of data to lookup.
-       The default looks for IPv4, IPv6 and mail handler data, or domain name
-       pointers for reverse queries.
-
-.. option:: -y <key>
-
-       Specify a public key to use as trust anchor.
-       This is the base for a chain of trust that is built up from the trust
-       anchor to the response, in order to validate the response message.
-       Can be given as a DS or DNSKEY record.
-       For example:
-
-       .. code-block:: text
-
-            -y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD"
-
-.. option:: -D
-
-       Enables DNSSEC validation.
-       Reads the root anchor from the default configured root anchor at the
-       default location, :file:`@UNBOUND_ROOTKEY_FILE@`.
-
-.. option:: -f <keyfile>
-
-       Reads keys from a file.
-       Every line has a DS or DNSKEY record, in the format as for :option:`-y`.
-       The zone file format, the same as ``dig`` and ``drill`` produce.
-
-.. option:: -F <namedkeyfile>
-
-       Reads keys from a BIND-style :file:`named.conf` file.
-       Only the ``trusted-key {};`` entries are read.
-
-.. option:: -C <configfile>
-
-       Uses the specified unbound.conf to prime :doc:`libunbound(3)</manpages/libunbound>`.
-       Pass it as first argument if you want to override some options from the
-       config file with further arguments on the commandline.
-
-.. option:: -r
-
-       Read :file:`/etc/resolv.conf`, and use the forward DNS servers from
-       there (those could have been set by DHCP).
-       More info in *resolv.conf(5)*.
-       Breaks validation if those servers do not support DNSSEC.
-
-.. option:: -4
-
-       Use solely the IPv4 network for sending packets.
-
-.. option:: -6
-
-       Use solely the IPv6 network for sending packets.
-
-Examples
--------
-
-Some examples of use.
-The keys shown below are fakes, thus a security failure is encountered.
-
-.. code-block:: text
-
-       $ unbound-host www.example.com
-
-       $ unbound-host -v -y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" www.example.com
-
-       $ unbound-host -v -y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" 192.0.2.153
-
-Exit Code
---------
-
-The ``unbound-host`` program exits with status code 1 on error, 0 on no error.
-The data may not be available on exit code 0, exit code 1 means the lookup
-encountered a fatal error.
-
-See Also
--------
-
-:doc:`unbound.conf(5)</manpages/unbound.conf>`,
-:doc:`unbound(8)</manpages/unbound>`.
@@ -1,123 +1,88 @@
-.\" Man page generated from reStructuredText.
-.
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.TH "UNBOUND" "8" "@date@" "@version@" "Unbound"
-.SH NAME
-unbound \- Unbound DNS validating resolver @version@.
-.SH SYNOPSIS
-.sp
-\fBunbound\fP [\fB\-hdpVv\fP] [\fB\-c <cfgfile>\fP]
-.SH DESCRIPTION
-.sp
-\fBunbound\fP is a caching DNS resolver.
-.sp
-It uses a built in list of authoritative nameservers for the root zone (\fB\&.\fP),
+.TH "unbound" "8" "@date@" "NLnet Labs" "unbound @version@"
+.\"
+.\" unbound.8 -- unbound manual
+.\"
+.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
+.\"
+.\" See LICENSE for the license.
+.\"
+.\"
+.SH "NAME"
+.B unbound
+\- Unbound DNS validating resolver @version@.
+.SH "SYNOPSIS"
+.B unbound
+.RB [ \-h ]
+.RB [ \-d ]
+.RB [ \-p ]
+.RB [ \-v ]
+.RB [ \-c
+.IR cfgfile ]
+.SH "DESCRIPTION"
+.B Unbound
+is a caching DNS resolver.
+.P
+It uses a built in list of authoritative nameservers for the root zone (.),
 the so called root hints.
-On receiving a DNS query it will ask the root nameservers for an answer and
-will in almost all cases receive a delegation to a top level domain (TLD)
-authoritative nameserver.
+On receiving a DNS query it will ask the root nameservers for
+an answer and will in almost all cases receive a delegation to a top level
+domain (TLD) authoritative nameserver.
 It will then ask that nameserver for an answer.
-It will recursively continue until an answer is found or no answer is available
-(NXDOMAIN).
-For performance and efficiency reasons that answer is cached for a certain time
-(the answer\(aqs time\-to\-live or TTL).
+It will recursively continue until an answer is found or no answer is
+available (NXDOMAIN).
+For performance and efficiency reasons that answer is cached for a
+certain time (the answer's time\-to\-live or TTL).
 A second query for the same name will then be answered from the cache.
 Unbound can also do DNSSEC validation.
+.P
+To use a locally running
+.B Unbound
+for resolving put
 .sp
-To use a locally running Unbound for resolving put:
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
+.RS 6n
 nameserver 127.0.0.1
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-into \fIresolv.conf(5)\fP\&.
-.sp
-If authoritative DNS is needed as well using \fI\%nsd(8)\fP,
-careful setup is required because authoritative nameservers and resolvers are
-using the same port number (53).
+.RE
 .sp
+into
+.IR resolv.conf (5).
+.P
+If authoritative DNS is needed as well using
+.IR nsd (8),
+careful setup is required because authoritative nameservers and
+resolvers are using the same port number (53).
+.P
 The available options are:
-.INDENT 0.0
 .TP
 .B \-h
 Show the version number and commandline option help, and exit.
-.UNINDENT
-.INDENT 0.0
 .TP
-.B \-c <cfgfile>
-Set the config file with settings for unbound to read instead of reading the
-file at the default location, \fB@ub_conf_file@\fP\&.
-The syntax is described in \fI\%unbound.conf(5)\fP\&.
-.UNINDENT
-.INDENT 0.0
+.B \-c\fI cfgfile
+Set the config file with settings for Unbound to read instead of reading the
+file at the default location, @ub_conf_file@. The syntax is
+described in \fIunbound.conf\fR(5).
 .TP
 .B \-d
-Debug flag: do not fork into the background, but stay attached to the
-console.
-This flag will also delay writing to the log file until the thread\-spawn
-time, so that most config and setup errors appear on stderr.
-If given twice or more, logging does not switch to the log file or to
-syslog, but the log messages are printed to stderr all the time.
-.UNINDENT
-.INDENT 0.0
+Debug flag: do not fork into the background, but stay attached to
+the console.  This flag will also delay writing to the log file until
+the thread\-spawn time, so that most config and setup errors appear on
+stderr. If given twice or more, logging does not switch to the log file
+or to syslog, but the log messages are printed to stderr all the time.
 .TP
 .B \-p
-Don\(aqt use a pidfile.
-This argument should only be used by supervision systems which can ensure
-that only one instance of Unbound will run concurrently.
-.UNINDENT
-.INDENT 0.0
+Don't use a pidfile.  This argument should only be used by supervision
+systems which can ensure that only one instance of Unbound will run
+concurrently.
 .TP
 .B \-v
-Increase verbosity.
-If given multiple times, more information is logged.
-This is in addition to the verbosity (if any) from the config file.
-.UNINDENT
-.INDENT 0.0
+Increase verbosity. If given multiple times, more information is logged.
+This is added to the verbosity (if any) from the config file.
 .TP
 .B \-V
 Show the version number and build options, and exit.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fI\%unbound.conf(5)\fP,
-\fI\%unbound\-checkconf(8)\fP,
-\fI\%nsd(8)\fP\&.
-.SH AUTHOR
-Unbound developers are mentioned in the CREDITS file in the distribution.
-.SH COPYRIGHT
-1999-2026, NLnet Labs
-.\" Generated by docutils manpage writer.
-.
+.SH "SEE ALSO"
+\fIunbound.conf\fR(5),
+\fIunbound\-checkconf\fR(8),
+\fInsd\fR(8).
+.SH "AUTHORS"
+.B Unbound
+developers are mentioned in the CREDITS file in the distribution.
@@ -1226,7 +1226,7 @@ VERBATIM_HEADERS       = NO
 # generated with the -Duse_libclang=ON option for CMake.
 # The default value is: NO.

-#CLANG_ASSISTED_PARSING = NO
+CLANG_ASSISTED_PARSING = NO

 # If the CLANG_ASSISTED_PARSING tag is set to YES and the CLANG_ADD_INC_PATHS
 # tag is set to YES then doxygen will add the directory of each input to the
@@ -1234,7 +1234,7 @@ VERBATIM_HEADERS       = NO
 # The default value is: YES.
 # This tag requires that the tag CLANG_ASSISTED_PARSING is set to YES.

-#CLANG_ADD_INC_PATHS    = YES
+CLANG_ADD_INC_PATHS    = YES

 # If clang assisted parsing is enabled you can provide the compiler with command
 # line options that you would normally use when invoking the compiler. Note that
@@ -1242,7 +1242,7 @@ VERBATIM_HEADERS       = NO
 # specified with INPUT and INCLUDE_PATH.
 # This tag requires that the tag CLANG_ASSISTED_PARSING is set to YES.

-#CLANG_OPTIONS          =
+CLANG_OPTIONS          =

 # If clang assisted parsing is enabled you can provide the clang parser with the
 # path to the directory containing a file called compile_commands.json. This
@@ -1255,7 +1255,7 @@ VERBATIM_HEADERS       = NO
 # Note: The availability of this option depends on whether or not doxygen was
 # generated with the -Duse_libclang=ON option for CMake.

-#CLANG_DATABASE_PATH    =
+CLANG_DATABASE_PATH    =

 #---------------------------------------------------------------------------
 # Configuration options related to the alphabetical class index
@@ -1,119 +0,0 @@
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-.. program:: unbound
-
-unbound(8)
-==========
-
-Synopsis
--------
-
-**unbound** [``-hdpVv``] [``-c <cfgfile>``]
-
-Description
-----------
-
-``unbound`` is a caching DNS resolver.
-
-It uses a built in list of authoritative nameservers for the root zone (``.``),
-the so called root hints.
-On receiving a DNS query it will ask the root nameservers for an answer and
-will in almost all cases receive a delegation to a top level domain (TLD)
-authoritative nameserver.
-It will then ask that nameserver for an answer.
-It will recursively continue until an answer is found or no answer is available
-(NXDOMAIN).
-For performance and efficiency reasons that answer is cached for a certain time
-(the answer's time-to-live or TTL).
-A second query for the same name will then be answered from the cache.
-Unbound can also do DNSSEC validation.
-
-To use a locally running Unbound for resolving put:
-
-.. code-block:: text
-
-   nameserver 127.0.0.1
-
-into *resolv.conf(5)*.
-
-If authoritative DNS is needed as well using :external+nsd:doc:`manpages/nsd`,
-careful setup is required because authoritative nameservers and resolvers are
-using the same port number (53).
-
-The available options are:
-
-.. option:: -h
-
- Show the version number and commandline option help, and exit.
-
-.. option:: -c <cfgfile>
-
-   Set the config file with settings for unbound to read instead of reading the
-   file at the default location, :file:`@ub_conf_file@`.
-   The syntax is described in :doc:`unbound.conf(5)</manpages/unbound.conf>`.
-
-.. option:: -d
-
-   Debug flag: do not fork into the background, but stay attached to the
-   console.
-   This flag will also delay writing to the log file until the thread-spawn
-   time, so that most config and setup errors appear on stderr.
-   If given twice or more, logging does not switch to the log file or to
-   syslog, but the log messages are printed to stderr all the time.
-
-.. option:: -p
-
-   Don't use a pidfile.
-   This argument should only be used by supervision systems which can ensure
-   that only one instance of Unbound will run concurrently.
-
-.. option:: -v
-
-   Increase verbosity.
-   If given multiple times, more information is logged.
-   This is in addition to the verbosity (if any) from the config file.
-
-.. option:: -V
-
-   Show the version number and build options, and exit.
-
-See Also
--------
-
-:doc:`unbound.conf(5)</manpages/unbound.conf>`,
-:doc:`unbound-checkconf(8)</manpages/unbound-checkconf>`,
-:external+nsd:doc:`manpages/nsd`.
@@ -297,8 +297,8 @@ inplace_cb_delete_wrapped(struct module_env* env, enum inplace_cb_list_type type
 */
 static struct module_func_block dynlibmod_block = {
   "dynlib",
-   NULL, NULL, &dynlibmod_init, &dynlibmod_deinit, &dynlibmod_operate,
-   &dynlibmod_inform_super, &dynlibmod_clear, &dynlibmod_get_mem
+   &dynlibmod_init, &dynlibmod_deinit, &dynlibmod_operate, &dynlibmod_inform_super,
+   &dynlibmod_clear, &dynlibmod_get_mem
 };

 struct module_func_block* dynlibmod_get_funcblock(void)
@@ -459,7 +459,6 @@ addrtree_insert(struct addrtree *tree, const addrkey_t *addr,
 			/* Data is stored in other leafnode */
 			node = newnode;
 			newnode = node_create(tree, elem, scope, ttl);
-			if (!newnode) return;
 			if (!edge_create(newnode, addr, sourcemask, node,
 				index^1)) {
 				clean_node(tree, newnode);
@@ -116,7 +116,7 @@ struct addredge {
 	addrlen_t len;
 	/** child node this edge is connected to */
 	struct addrnode *node;
-	/** Parent node this edge is connected to */
+	/** Parent node this ege is connected to */
 	struct addrnode *parent_node;
 	/** Index of this edge in parent_node */
 	int parent_index;
@@ -51,7 +51,6 @@
 #include "services/cache/dns.h"
 #include "util/module.h"
 #include "util/regional.h"
-#include "util/fptr_wlist.h"
 #include "util/storage/slabhash.h"
 #include "util/config_file.h"
 #include "util/data/msgreply.h"
@@ -70,7 +69,6 @@ subnet_data_delete(void *d, void *ATTR_UNUSED(arg))
 	r = (struct subnet_msg_cache_data*)d;
 	addrtree_delete(r->tree4);
 	addrtree_delete(r->tree6);
-	free(r->reason_fail);
 	free(r);
 }

@@ -85,8 +83,6 @@ msg_cache_sizefunc(void *k, void *d)
 		+ q->key.qname_len + lock_get_mem(&q->entry.lock);
 	s += addrtree_size(r->tree4);
 	s += addrtree_size(r->tree6);
-	if(r->reason_fail)
-		s += strlen(r->reason_fail)+1;
 	return s;
 }

@@ -157,32 +153,9 @@ int ecs_whitelist_check(struct query_info* qinfo,
 		return 1;
 	sn_env = (struct subnet_env*)qstate->env->modinfo[id];

-	if(sq->is_subquery_nonsubnet) {
-		if(sq->is_subquery_scopezero) {
-			/* Check if the result can be stored in the global cache,
-			 * this is okay if the address and name are not configured
-			 * as subnet address and subnet zone. */
-			if(!ecs_is_whitelisted(sn_env->whitelist,
-				addr, addrlen, qinfo->qname, qinfo->qname_len,
-				qinfo->qclass)) {
-				/* The stub or forward can have no_cache set.*/
-				if(iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL, NULL, 0)) {
-					verbose(VERB_ALGO, "subnet subquery is not stored globally, stuborfwd is no_cache");
-				} else {
-					verbose(VERB_ALGO, "subnet store subquery global, name and addr have no subnet treatment.%s",
-						(sq->started_no_cache_store?
-						" But the subnet module was started with no_cache_store for the super query, and that is still applied to this query":""));
-					qstate->no_cache_store = sq->started_no_cache_store;
-				}
-			}
-		}
-		return 1;
-	}
-
 	/* Cache by default, might be disabled after parsing EDNS option
 	 * received from nameserver. */
-	if(!iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL, NULL, 0)
-		&& sq->ecs_client_in.subnet_validdata) {
+	if(!iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL, NULL, 0)) {
 		qstate->no_cache_store = 0;
 	}

@@ -203,18 +176,12 @@ int ecs_whitelist_check(struct query_info* qinfo,
 			if(sq->ecs_server_out.subnet_source_mask == 0) {
 				sq->subnet_sent_no_subnet = 1;
 				sq->subnet_sent = 0;
-				/* The result should end up in subnet cache,
-				 * not in global cache. */
-				qstate->no_cache_store = 1;
 				return 1;
 			}
 			subnet_ecs_opt_list_append(&sq->ecs_server_out,
 				&qstate->edns_opts_back_out, qstate, region);
 		}
 		sq->subnet_sent = 1;
-		/* Do not store servfails in global cache, since the subnet
-		 * option is sent out. */
-		qstate->no_cache_store = 1;
 	}
 	else {
 		/* Outgoing ECS option is set, but we don't want to sent it to
@@ -265,13 +232,13 @@ subnetmod_init(struct module_env *env, int id)
 		HASH_DEFAULT_STARTARRAY, env->cfg->msg_cache_size,
 		msg_cache_sizefunc, query_info_compare, query_entry_delete,
 		subnet_data_delete, NULL);
+	slabhash_setmarkdel(sn_env->subnet_msg_cache, &subnet_markdel);
 	if(!sn_env->subnet_msg_cache) {
 		log_err("subnetcache: could not create cache");
 		free(sn_env);
 		env->modinfo[id] = NULL;
 		return 0;
 	}
-	slabhash_setmarkdel(sn_env->subnet_msg_cache, &subnet_markdel);
 	/* whitelist for edns subnet capable servers */
 	sn_env->whitelist = ecs_whitelist_create();
 	if(!sn_env->whitelist ||
@@ -436,35 +403,6 @@ update_cache(struct module_qstate *qstate, int id)
 	}
 	/* lru_entry->lock is locked regardless of how we got here,
 	 * either from the slabhash_lookup, or above in the new allocated */
-	if(!qstate->return_msg && qstate->error_response_cache) {
-		struct subnet_msg_cache_data *data =
-			(struct subnet_msg_cache_data*)lru_entry->data;
-		data->ttl_servfail = *qstate->env->now + NORR_TTL;
-		data->ede_fail = errinf_to_reason_bogus(qstate);
-		diff_size = (data->reason_fail?strlen(data->reason_fail)+1:0);
-		if(qstate->errinf) {
-			char* str = errinf_to_str_misc(qstate);
-			free(data->reason_fail);
-			data->reason_fail = NULL;
-			if(str)
-				data->reason_fail = strdup(str);
-		}
-		diff_size = (data->reason_fail?strlen(data->reason_fail)+1:0)
-			- diff_size;
-		lock_rw_unlock(&lru_entry->lock);
-		if (need_to_insert) {
-			slabhash_insert(subnet_msg_cache, h, lru_entry,
-				lru_entry->data, NULL);
-		} else {
-			slabhash_update_space_used(subnet_msg_cache, h, NULL,
-				diff_size);
-		}
-		return;
-	}
-	if(!qstate->return_msg) {
-		lock_rw_unlock(&lru_entry->lock);
-		return;
-	}
 	/* Step 2, find the correct tree */
 	if (!(tree = get_tree(lru_entry->data, edns, sne, qstate->env->cfg))) {
 		lock_rw_unlock(&lru_entry->lock);
@@ -508,21 +446,6 @@ update_cache(struct module_qstate *qstate, int id)
 	}
 }

-/** See if there is a stored servfail, returns true if so, and sets reply. */
-static int
-lookup_check_servfail(struct module_qstate *qstate,
-	struct subnet_msg_cache_data *data)
-{
-	struct module_env *env = qstate->env;
-	if(!data)
-		return 0;
-	if(!data->ttl_servfail || TTL_IS_EXPIRED(data->ttl_servfail, *env->now))
-		return 0;
-	qstate->return_rcode = LDNS_RCODE_SERVFAIL;
-	errinf_ede(qstate, data->reason_fail, data->ede_fail);
-	return 1;
-}
-
 /** Lookup in cache and reply true iff reply is sent. */
 static int
 lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq, int prefetch)
@@ -536,8 +459,6 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq,
 	struct addrtree *tree;
 	struct addrnode *node;
 	uint8_t scope;
-	int must_validate = (!(qstate->query_flags&BIT_CD)
-		|| qstate->env->cfg->ignore_cd) && qstate->env->need_to_validate;

 	memset(&sq->ecs_client_out, 0, sizeof(sq->ecs_client_out));

@@ -551,20 +472,12 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq,
 	tree = (ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4)?
 		data->tree4 : data->tree6;
 	if (!tree) { /* qinfo in cache but not for this family */
-		if(lookup_check_servfail(qstate, data)) {
-			lock_rw_unlock(&e->lock);
-			return 1;
-		}
 		lock_rw_unlock(&e->lock);
 		return 0;
 	}
 	node = addrtree_find(tree, (addrkey_t*)ecs->subnet_addr, 
 		ecs->subnet_source_mask, *env->now);
 	if (!node) { /* plain old cache miss */
-		if(lookup_check_servfail(qstate, data)) {
-			lock_rw_unlock(&e->lock);
-			return 1;
-		}
 		lock_rw_unlock(&e->lock);
 		return 0;
 	}
@@ -573,24 +486,12 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq,
 		(struct reply_info *)node->elem, qstate->region, *env->now, 0,
 		env->scratch);
 	scope = (uint8_t)node->scope;
+	lock_rw_unlock(&e->lock);
 	
 	if (!qstate->return_msg) { /* Failed allocation or expired TTL */
-		if(lookup_check_servfail(qstate, data)) {
-			lock_rw_unlock(&e->lock);
-			return 1;
-		}
-		lock_rw_unlock(&e->lock);
 		return 0;
 	}
-	lock_rw_unlock(&e->lock);
-	if(qstate->return_msg->rep->security == sec_status_unchecked
-		&& must_validate) {
-		/* The message has to be validated first. */
-		verbose(VERB_ALGO, "subnet: unchecked cache entry needs "
-			"validation");
-		return 0;
-	}
-
+	
 	if (sq->subnet_downstream) { /* relay to interested client */
 		sq->ecs_client_out.subnet_scope_mask = scope;
 		sq->ecs_client_out.subnet_addr_fam = ecs->subnet_addr_fam;
@@ -621,87 +522,6 @@ common_prefix(uint8_t *a, uint8_t *b, uint8_t net)
 	return !memcmp(a, b, n) && ((net % 8) == 0 || a[n] == b[n]);
 }

-/**
- * Create sub request that looks up the query.
- * @param qstate: query state
- * @param id: module id.
- * @param sq: subnet qstate
- * @return false on failure.
- */
-static int
-generate_sub_request(struct module_qstate *qstate, int id, struct subnet_qstate* sq)
-{
-	struct module_qstate* subq = NULL;
-	uint16_t qflags = 0; /* OPCODE QUERY, no flags */
-	int prime = 0;
-	int valrec = 0;
-	struct query_info qinf;
-	qinf.qname = qstate->qinfo.qname;
-	qinf.qname_len = qstate->qinfo.qname_len;
-	qinf.qtype = qstate->qinfo.qtype;
-	qinf.qclass = qstate->qinfo.qclass;
-	qinf.local_alias = NULL;
-
-	qflags |= BIT_RD;
-	if((qstate->query_flags & BIT_CD)!=0) {
-		qflags |= BIT_CD;
-		/* The valrec is left off. Leave out: valrec = 1;
-		 * So that the cache is protected with DNSSEC validation.
-		 * Just like the global cache. DNSSEC validation is performed
-		 * regardless of the setting of the querier's CD flag. */
-	}
-
-	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &qinf, qstate->client_info,
-		qflags, prime, valrec, &subq)) {
-		return 0;
-	}
-	if(subq) {
-		/* It is possible to access the subquery module state. */
-		struct subnet_qstate* subsq;
-		if(!subnet_new_qstate(subq, id)) {
-			verbose(VERB_ALGO, "Could not allocate new subnet qstate");
-			return 0;
-		}
-		subsq = (struct subnet_qstate*)subq->minfo[id];
-		subsq->is_subquery_nonsubnet = 1;
-		subsq->started_no_cache_store = sq->started_no_cache_store;
-
-		/* When the client asks 0.0.0.0/0 and the name is not treated
-		 * as subnet, it is to be stored in the global cache.
-		 * Store that the client asked for that, if so. */
-		if(sq->ecs_client_in.subnet_source_mask == 0 &&
-			edns_opt_list_find(qstate->edns_opts_front_in,
-				qstate->env->cfg->client_subnet_opcode)) {
-			subq->no_cache_store = 1;
-			subsq->is_subquery_scopezero = 1;
-		}
-	}
-	return 1;
-}
-
-/**
- * Perform the query without subnet
- * @param qstate: query state
- * @param id: module id.
- * @param sq: subnet qstate
- * @return module state
- */
-static enum module_ext_state
-generate_lookup_without_subnet(struct module_qstate *qstate, int id,
-	struct subnet_qstate* sq)
-{
-	verbose(VERB_ALGO, "subnetcache: make subquery to look up without subnet");
-	if(!generate_sub_request(qstate, id, sq)) {
-		verbose(VERB_ALGO, "Could not generate sub query");
-		qstate->return_rcode = LDNS_RCODE_SERVFAIL;
-		qstate->return_msg = NULL;
-		return module_finished;
-	}
-	sq->wait_subquery = 1;
-	return module_wait_subquery;
-}
-
 static enum module_ext_state
 eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 {
@@ -718,12 +538,6 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		/* already an answer and its not a message, but retain
 		 * the actual rcode, instead of module_error, so send
 		 * module_finished */
-		if(qstate->error_response_cache) {
-			verbose(VERB_ALGO, "subnet: store error response");
-			lock_rw_wrlock(&sne->biglock);
-			update_cache(qstate, id);
-			lock_rw_unlock(&sne->biglock);
-		}
 		return module_finished;
 	}

@@ -743,7 +557,14 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		 * is still useful to put it in the edns subnet cache for
 		 * when a client explicitly asks for subnet specific answer. */
 		verbose(VERB_QUERY, "subnetcache: Authority indicates no support");
-		return generate_lookup_without_subnet(qstate, id, sq);
+		if(!sq->started_no_cache_store) {
+			lock_rw_wrlock(&sne->biglock);
+			update_cache(qstate, id);
+			lock_rw_unlock(&sne->biglock);
+		}
+		if (sq->subnet_downstream)
+			cp_edns_bad_response(c_out, c_in);
+		return module_finished;
 	}

 	/* Purposefully there was no sent subnet, and there is consequently
@@ -768,14 +589,14 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		!common_prefix(s_out->subnet_addr, s_in->subnet_addr, 
 			s_out->subnet_source_mask))
 	{
-		/* we can not accept, perform query without option */
+		/* we can not accept, restart query without option */
 		verbose(VERB_QUERY, "subnetcache: forged data");
 		s_out->subnet_validdata = 0;
 		(void)edns_opt_list_remove(&qstate->edns_opts_back_out,
 			qstate->env->cfg->client_subnet_opcode);
 		sq->subnet_sent = 0;
 		sq->subnet_sent_no_subnet = 0;
-		return generate_lookup_without_subnet(qstate, id, sq);
+		return module_restart_next;
 	}

 	lock_rw_wrlock(&sne->biglock);
@@ -973,11 +794,6 @@ ecs_edns_back_parsed(struct module_qstate* qstate, int id,
 				sq->max_scope = sq->ecs_server_in.subnet_scope_mask;
 	} else if(sq->subnet_sent_no_subnet) {
 		/* The answer can be stored as scope 0, not in global cache. */
-		/* This was already set in ecs_whitelist_check */
-		qstate->no_cache_store = 1;
-	} else if(sq->subnet_sent) {
-		/* Need another query to be able to store in global cache. */
-		/* This was already set in ecs_whitelist_check */
 		qstate->no_cache_store = 1;
 	}

@@ -996,33 +812,6 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 		strmodulevent(event));
 	log_query_info(VERB_QUERY, "subnetcache operate: query", &qstate->qinfo);

-	if(sq && sq->wait_subquery_done) {
-		/* The subquery lookup returned. */
-		if(sq->ecs_client_in.subnet_source_mask == 0 &&
-			edns_opt_list_find(qstate->edns_opts_front_in,
-				qstate->env->cfg->client_subnet_opcode)) {
-			if(!sq->started_no_cache_store &&
-				qstate->return_msg) {
-				lock_rw_wrlock(&sne->biglock);
-				update_cache(qstate, id);
-				lock_rw_unlock(&sne->biglock);
-			}
-			if (sq->subnet_downstream)
-				cp_edns_bad_response(&sq->ecs_client_out,
-					&sq->ecs_client_in);
-			/* It is a scope zero lookup, append edns subnet
-			 * option to the querier. */
-			subnet_ecs_opt_list_append(&sq->ecs_client_out,
-				&qstate->edns_opts_front_out, qstate,
-				qstate->region);
-			qstate->is_subnet_answer = 1;
-		}
-		sq->wait_subquery_done = 0;
-		qstate->ext_state[id] = module_finished;
-		qstate->no_cache_store = sq->started_no_cache_store;
-		qstate->no_cache_lookup = sq->started_no_cache_lookup;
-		return;
-	}
 	if((event == module_event_new || event == module_event_pass) &&
 		sq == NULL) {
 		struct edns_option* ecs_opt;
@@ -1033,8 +822,6 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 		}

 		sq = (struct subnet_qstate*)qstate->minfo[id];
-		if(sq->wait_subquery)
-			return; /* Wait for that subquery to return */

 		if((ecs_opt = edns_opt_list_find(
 			qstate->edns_opts_front_in,
@@ -1064,14 +851,6 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 			/* No clients are interested in result or we could not
 			 * parse it, we don't do client subnet */
 			sq->ecs_server_out.subnet_validdata = 0;
-			if(edns_opt_list_find(qstate->edns_opts_front_in,
-				qstate->env->cfg->client_subnet_opcode)) {
-				/* aggregated this deaggregated state */
-				qstate->ext_state[id] =
-					generate_lookup_without_subnet(
-					qstate, id, sq);
-				return;
-			}
 			verbose(VERB_ALGO, "subnetcache: pass to next module");
 			qstate->ext_state[id] = module_wait_module;
 			return;
@@ -1095,7 +874,6 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 				qstate->env->cfg->prefetch)) {
 				sne->num_msg_cache++;
 				lock_rw_unlock(&sne->biglock);
-				qstate->is_subnet_answer = 1;
 				verbose(VERB_QUERY, "subnetcache: answered from cache");
 				qstate->ext_state[id] = module_finished;

@@ -1113,14 +891,6 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 			}
 			lock_rw_unlock(&sne->biglock);
 		}
-		if(sq->ecs_client_in.subnet_source_mask == 0 &&
-			edns_opt_list_find(qstate->edns_opts_front_in,
-				qstate->env->cfg->client_subnet_opcode)) {
-			/* client asked for resolution without edns subnet */
-			qstate->ext_state[id] = generate_lookup_without_subnet(
-				qstate, id, sq);
-			return;
-		}
 		
 		sq->ecs_server_out.subnet_addr_fam =
 			sq->ecs_client_in.subnet_addr_fam;
@@ -1157,8 +927,6 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 		qstate->ext_state[id] = module_wait_module;
 		return;
 	}
-	if(sq && sq->wait_subquery)
-		return; /* Wait for that subquery to return */
 	/* Query handed back by next module, we have a 'final' answer */
 	if(sq && event == module_event_moddone) {
 		qstate->ext_state[id] = eval_response(qstate, id, sq);
@@ -1167,7 +935,6 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 			subnet_ecs_opt_list_append(&sq->ecs_client_out,
 				&qstate->edns_opts_front_out, qstate,
 				qstate->region);
-			qstate->is_subnet_answer = 1;
 			if(verbosity >= VERB_ALGO) {
 				subnet_log_print("reply has edns subnet",
 					edns_opt_list_find(
@@ -1208,27 +975,10 @@ subnetmod_clear(struct module_qstate *ATTR_UNUSED(qstate),
 }

 void
-subnetmod_inform_super(struct module_qstate *qstate, int id,
-	struct module_qstate *super)
+subnetmod_inform_super(struct module_qstate *ATTR_UNUSED(qstate),
+	int ATTR_UNUSED(id), struct module_qstate *ATTR_UNUSED(super))
 {
-	struct subnet_qstate* super_sq =
-		(struct subnet_qstate*)super->minfo[id];
-	log_query_info(VERB_ALGO, "subnetcache inform_super: query",
-		&super->qinfo);
-	super_sq->wait_subquery = 0;
-	super_sq->wait_subquery_done = 1;
-	if(qstate->return_rcode != LDNS_RCODE_NOERROR ||
-		!qstate->return_msg) {
-		super->return_msg = NULL;
-		super->return_rcode = LDNS_RCODE_SERVFAIL;
-		return;
-	}
-	super->return_rcode = LDNS_RCODE_NOERROR;
-	super->return_msg = dns_copy_msg(qstate->return_msg, super->region);
-	if(!super->return_msg) {
-		log_err("subnetcache: copy response, out of memory");
-		super->return_rcode = LDNS_RCODE_SERVFAIL;
-	}
+	/* Not used */
 }

 size_t
@@ -1245,8 +995,7 @@ subnetmod_get_mem(struct module_env *env, int id)
 * The module function block 
 */
 static struct module_func_block subnetmod_block = {
-	"subnetcache",
-	NULL, NULL, &subnetmod_init, &subnetmod_deinit, &subnetmod_operate,
+	"subnetcache", &subnetmod_init, &subnetmod_deinit, &subnetmod_operate,
 	&subnetmod_inform_super, &subnetmod_clear, &subnetmod_get_mem
 };

@@ -69,18 +69,8 @@ struct subnet_env {
 };

 struct subnet_msg_cache_data {
-	/** Tree for nodes with IPv4 subnets. */
 	struct addrtree* tree4;
-	/** Tree for nodes with IPv6 subnets. */
 	struct addrtree* tree6;
-	/** If servfail is stored, for how long. Abs time in seconds.
-	 * This protects against too much recusion on the item when
-	 * resolution fails, for a couple of seconds. */
-	time_t ttl_servfail;
-	/** servfail ede */
-	sldns_ede_code ede_fail;
-	/** servfail reason */
-	char* reason_fail;
 };

 struct subnet_qstate {
@@ -112,14 +102,6 @@ struct subnet_qstate {
 	int started_no_cache_store;
 	/** has the subnet module been started with no_cache_lookup? */
 	int started_no_cache_lookup;
-	/** Wait for subquery that has been started for nonsubnet lookup. */
-	int wait_subquery;
-	/** The subquery waited for is done. */
-	int wait_subquery_done;
-	/** The subnet state is a subquery state for nonsubnet lookup. */
-	int is_subquery_nonsubnet;
-	/** This is a subquery, and it is made due to a scope zero request. */
-	int is_subquery_scopezero;
 };

 void subnet_data_delete(void* d, void* ATTR_UNUSED(arg));
@@ -100,8 +100,6 @@ ipsecmod_whitelist_apply_cfg(struct ipsecmod_env* ie,
 	struct config_file* cfg)
 {
 	ie->whitelist = rbtree_create(name_tree_compare);
-	if (!ie->whitelist)
-		return 0;
 	if(!read_whitelist(ie->whitelist, cfg))
 		return 0;
 	name_tree_init_parents(ie->whitelist);
@@ -51,28 +51,18 @@
 #include "util/config_file.h"
 #include "services/cache/dns.h"
 #include "sldns/wire2str.h"
-#ifdef HAVE_SYS_WAIT_H
-#include <sys/wait.h>
-#endif

 /** Apply configuration to ipsecmod module 'global' state. */
 static int
 ipsecmod_apply_cfg(struct ipsecmod_env* ipsecmod_env, struct config_file* cfg)
 {
-	if(cfg->ipsecmod_whitelist &&
-		!ipsecmod_whitelist_apply_cfg(ipsecmod_env, cfg))
-		return 0;
-	if(!cfg->ipsecmod_enabled)
-		return 1;
 	if(!cfg->ipsecmod_hook || (cfg->ipsecmod_hook && !cfg->ipsecmod_hook[0])) {
 		log_err("ipsecmod: missing ipsecmod-hook.");
 		return 0;
 	}
-	if(access(cfg->ipsecmod_hook, X_OK) != 0) {
-		log_err("ipsecmod: ipsecmod-hook '%s' is not an executable file: %s",
-			cfg->ipsecmod_hook, strerror(errno));
+	if(cfg->ipsecmod_whitelist &&
+		!ipsecmod_whitelist_apply_cfg(ipsecmod_env, cfg))
 		return 0;
-	}
 	return 1;
 }

@@ -173,7 +163,7 @@ generate_request(struct module_qstate* qstate, int id, uint8_t* name,
 	}

 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &ask, NULL,
+	if(!(*qstate->env->attach_sub)(qstate, &ask,
 		(uint16_t)(BIT_RD|flags), 0, 0, &newq)){
 		log_err("Could not generate request: out of memory");
 		return 0;
@@ -260,16 +250,27 @@ call_hook(struct module_qstate* qstate, struct ipsecmod_qstate* iq,
 	struct ipsecmod_env* ATTR_UNUSED(ie))
 {
 	size_t slen, tempdata_len, tempstring_len, i;
-	char qname_s[LDNS_MAX_DOMAINLEN*5+16], ttl_s[32], a_s[32768], k_s[32768];
-	char *s, *tempstring;
+	char str[65535], *s, *tempstring;
 	int w = 0, w_temp, qtype;
 	struct ub_packed_rrset_key* rrset_key;
 	struct packed_rrset_data* rrset_data;
 	uint8_t *tempdata;
-	pid_t pid;
-	int st;
-	char* argv[6];

+	/* Check if a shell is available */
+	if(system(NULL) == 0) {
+		log_err("ipsecmod: no shell available for ipsecmod-hook");
+		return 0;
+	}
+
+	/* Zero the buffer. */
+	s = str;
+	slen = sizeof(str);
+	memset(s, 0, slen);
+
+	/* Copy the hook into the buffer. */
+	w += sldns_str_print(&s, &slen, "%s", qstate->env->cfg->ipsecmod_hook);
+	/* Put space into the buffer. */
+	w += sldns_str_print(&s, &slen, " ");
 	/* Copy the qname into the buffer. */
 	tempstring = sldns_wire2str_dname(qstate->qinfo.qname,
 		qstate->qinfo.qname_len);
@@ -282,24 +283,17 @@ call_hook(struct module_qstate* qstate, struct ipsecmod_qstate* iq,
 		free(tempstring);
 		return 0;
 	}
-	if(strlen(tempstring)+1 > sizeof(qname_s)) {
-		log_err("ipsecmod: string too long");
-		free(tempstring);
-		return 0;
-	}
-	snprintf(qname_s, sizeof(qname_s), "%s", tempstring);
+	w += sldns_str_print(&s, &slen, "\"%s\"", tempstring);
 	free(tempstring);
-
+	/* Put space into the buffer. */
+	w += sldns_str_print(&s, &slen, " ");
 	/* Copy the IPSECKEY TTL into the buffer. */
 	rrset_data = (struct packed_rrset_data*)iq->ipseckey_rrset->entry.data;
-	snprintf(ttl_s, sizeof(ttl_s), "%ld", (long)rrset_data->ttl);
-
+	w += sldns_str_print(&s, &slen, "\"%ld\"", (long)rrset_data->ttl);
+	/* Put space into the buffer. */
+	w += sldns_str_print(&s, &slen, " ");
 	rrset_key = reply_find_answer_rrset(&qstate->return_msg->qinfo,
 		qstate->return_msg->rep);
-	if(!rrset_key) {
-		log_err("ipsecmod: could not find answer rrset for A/AAAA");
-		return 0;
-	}
 	/* Double check that the records are indeed A/AAAA.
 	 * This should never happen as this function is only executed for A/AAAA
 	 * queries but make sure we don't pass anything other than A/AAAA to the
@@ -310,15 +304,9 @@ call_hook(struct module_qstate* qstate, struct ipsecmod_qstate* iq,
 		return 0;
 	}
 	rrset_data = (struct packed_rrset_data*)rrset_key->entry.data;
-	if(!rrset_data) {
-		log_err("ipsecmod: Answer has no data");
-		return 0;
-	}
-	/* Copy the A/AAAA record(s) into the buffer. */
-	w = 0;
-	s = a_s;
-	slen = sizeof(a_s);
-	memset(s, 0, slen);
+	/* Copy the A/AAAA record(s) into the buffer. Start and end this section
+	 * with a double quote. */
+	w += sldns_str_print(&s, &slen, "\"");
 	for(i=0; i<rrset_data->count; i++) {
 		if(i > 0) {
 			/* Put space into the buffer. */
@@ -334,7 +322,7 @@ call_hook(struct module_qstate* qstate, struct ipsecmod_qstate* iq,
 		} else if((size_t)w_temp >= slen) {
 			s = NULL; /* We do not want str to point outside of buffer. */
 			slen = 0;
-			log_err("ipsecmod: command addr argument too long");
+			log_err("ipsecmod: shell command too long");
 			return 0;
 		} else {
 			s += w_temp;
@@ -342,17 +330,12 @@ call_hook(struct module_qstate* qstate, struct ipsecmod_qstate* iq,
 			w += w_temp;
 		}
 	}
-	if(w >= (int)sizeof(a_s)) {
-		log_err("ipsecmod: command addr argument too long");
-		return 0;
-	}
-
+	w += sldns_str_print(&s, &slen, "\"");
+	/* Put space into the buffer. */
+	w += sldns_str_print(&s, &slen, " ");
 	/* Copy the IPSECKEY record(s) into the buffer. Start and end this section
 	 * with a double quote. */
-	w = 0;
-	s = k_s;
-	slen = sizeof(k_s);
-	memset(s, 0, slen);
+	w += sldns_str_print(&s, &slen, "\"");
 	rrset_data = (struct packed_rrset_data*)iq->ipseckey_rrset->entry.data;
 	for(i=0; i<rrset_data->count; i++) {
 		if(i > 0) {
@@ -379,44 +362,15 @@ call_hook(struct module_qstate* qstate, struct ipsecmod_qstate* iq,
 			w += w_temp;
 		}
 	}
-	if(w >= (int)sizeof(k_s)) {
-		log_err("ipsecmod: command ipseckey argument too long");
+	w += sldns_str_print(&s, &slen, "\"");
+	if(w >= (int)sizeof(str)) {
+		log_err("ipsecmod: shell command too long");
 		return 0;
 	}
-
+	verbose(VERB_ALGO, "ipsecmod: shell command: '%s'", str);
 	/* ipsecmod-hook should return 0 on success. */
-	/* exec the ipsecmod-hook */
-	argv[0] = qstate->env->cfg->ipsecmod_hook;
-	argv[1] = qname_s;
-	argv[2] = ttl_s;
-	argv[3] = a_s;
-	argv[4] = k_s;
-	argv[5] = NULL;
-	verbose(VERB_ALGO, "ipsecmod: exec %s \"%s\" %s \"%s\" \"%s\"",
-		argv[0], argv[1], argv[2], argv[3], argv[4]);
-	if((pid = fork()) < 0) {
-		log_err("ipsecmod: for exec, can not fork: %s",
-			strerror(errno));
+	if(system(str) != 0)
 		return 0;
-	}
-	if(pid == 0) {
-		if(execv(argv[0], argv) < 0)
-			fprintf(stderr, "ipsecmod: execv: %s\n",
-				strerror(errno));
-		_exit(127);
-	}
-	while(1) {
-		if(waitpid(pid, &st, 0) < 0) {
-			if(errno == EINTR)
-				continue;
-			log_err("ipsecmod: wait_pid: %s", strerror(errno));
-		}
-		break;
-	}
-	if(!(WIFEXITED(st) && WEXITSTATUS(st) == 0)) {
-		/* the command failed */
-		return 0;
-	}
 	return 1;
 }

@@ -481,12 +435,6 @@ ipsecmod_handle_query(struct module_qstate* qstate,
 			 * ipsecmod_max_ttl. */
 			rrset_key = reply_find_answer_rrset(&qstate->return_msg->qinfo,
 				qstate->return_msg->rep);
-			if(!rrset_key) {
-				log_err("ipsecmod: reply-find-answer failed");
-				errinf(qstate, "ipsecmod: reply-find-answer failed");
-				ipsecmod_error(qstate, id);
-				return;
-			}
 			rrset_data = (struct packed_rrset_data*)rrset_key->entry.data;
 			if(rrset_data->ttl > (time_t)qstate->env->cfg->ipsecmod_max_ttl) {
 				/* Update TTL for rrset to fixed value. */
@@ -508,8 +456,7 @@ ipsecmod_handle_query(struct module_qstate* qstate,
 	/* Store A/AAAA in cache. */
 	if(!dns_cache_store(qstate->env, &qstate->qinfo,
 		qstate->return_msg->rep, 0, qstate->prefetch_leeway,
-		0, qstate->region, qstate->query_flags, qstate->qstarttime,
-		qstate->is_valrec)) {
+		0, qstate->region, qstate->query_flags, qstate->qstarttime)) {
 		log_err("ipsecmod: out of memory caching record");
 	}
 	qstate->ext_state[id] = module_finished;
@@ -628,8 +575,6 @@ ipsecmod_inform_super(struct module_qstate* qstate, int id,
 		verbose(VERB_ALGO, "super has no ipsecmod state");
 		return;
 	}
-	if(!siq->enabled)
-		return;

 	if(qstate->return_msg) {
 		struct ub_packed_rrset_key* rrset_key = reply_find_answer_rrset(
@@ -670,7 +615,7 @@ ipsecmod_get_mem(struct module_env* env, int id)
 */
 static struct module_func_block ipsecmod_block = {
 	"ipsecmod",
-	NULL, NULL, &ipsecmod_init, &ipsecmod_deinit, &ipsecmod_operate,
+	&ipsecmod_init, &ipsecmod_deinit, &ipsecmod_operate,
 	&ipsecmod_inform_super, &ipsecmod_clear, &ipsecmod_get_mem
 };

@@ -17,19 +17,9 @@
 #include "sldns/wire2str.h"
 #include "sldns/parseutil.h"

-#ifdef HAVE_NET_PFVAR_H
-#include <fcntl.h>
-#include <sys/ioctl.h>
-#include <netinet/in.h>
-#include <net/if.h>
-#include <net/pfvar.h>
-typedef intptr_t filter_dev;
-#else
 #include <libmnl/libmnl.h>
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/ipset/ip_set.h>
-typedef struct mnl_socket * filter_dev;
-#endif

 #define BUFF_LEN 256

@@ -51,99 +41,28 @@ static int error_response(struct module_qstate* qstate, int id, int rcode) {
 	return 0;
 }

-#ifdef HAVE_NET_PFVAR_H
-static void * open_filter() {
-	filter_dev dev;
+static struct mnl_socket * open_mnl_socket() {
+	struct mnl_socket *mnl;

-	dev = open("/dev/pf", O_RDWR);
-	if (dev == -1) {
-		log_err("open(\"/dev/pf\") failed: %s", strerror(errno));
-		return NULL;
-	}
-	else
-		return (void *)dev;
-}
-#else
-static void * open_filter() {
-	filter_dev dev;
-
-	dev = mnl_socket_open(NETLINK_NETFILTER);
-	if (!dev) {
+	mnl = mnl_socket_open(NETLINK_NETFILTER);
+	if (!mnl) {
 		log_err("ipset: could not open netfilter.");
 		return NULL;
 	}

-	if (mnl_socket_bind(dev, 0, MNL_SOCKET_AUTOPID) < 0) {
-		mnl_socket_close(dev);
+	if (mnl_socket_bind(mnl, 0, MNL_SOCKET_AUTOPID) < 0) {
+		mnl_socket_close(mnl);
 		log_err("ipset: could not bind netfilter.");
 		return NULL;
 	}
-	return (void *)dev;
+	return mnl;
 }
-#endif

-#ifdef HAVE_NET_PFVAR_H
-static int add_to_ipset(filter_dev dev, const char *setname, const void *ipaddr, int af) {
-	struct pfioc_table io;
-	struct pfr_addr addr;
-	const char *p;
-	int i;
-
-	bzero(&io, sizeof(io));
-	bzero(&addr, sizeof(addr));
-
-	p = strrchr(setname, '/');
-	if (p) {
-		i = p - setname;
-		if (i >= PATH_MAX) {
-			errno = ENAMETOOLONG;
-			return -1;
-		}
-		memcpy(io.pfrio_table.pfrt_anchor, setname, i);
-		if (i < PATH_MAX)
-			io.pfrio_table.pfrt_anchor[i] = '\0';
-		p++;
-	}
-	else
-		p = setname;
-
-	if (strlen(p) >= PF_TABLE_NAME_SIZE) {
-		errno = ENAMETOOLONG;
-		return -1;
-	}
-	strlcpy(io.pfrio_table.pfrt_name, p, PF_TABLE_NAME_SIZE);
-
-	io.pfrio_buffer = &addr;
-	io.pfrio_size = 1;
-	io.pfrio_esize = sizeof(addr);
-
-	switch (af) {
-		case AF_INET:
-			addr.pfra_ip4addr = *(struct in_addr *)ipaddr;
-			addr.pfra_net = 32;
-			break;
-		case AF_INET6:
-			addr.pfra_ip6addr = *(struct in6_addr *)ipaddr;
-			addr.pfra_net = 128;
-			break;
-		default:
-		errno = EAFNOSUPPORT;
-		return -1;
-	}
-	addr.pfra_af = af;
-
-	if (ioctl(dev, DIOCRADDADDRS, &io) == -1) {
-		log_err("ioctl failed: %s", strerror(errno));
-		return -1;
-	}
-	return 0;
-}
-#else
-static int add_to_ipset(filter_dev dev, const char *setname, const void *ipaddr, int af) {
+static int add_to_ipset(struct mnl_socket *mnl, const char *setname, const void *ipaddr, int af) {
 	struct nlmsghdr *nlh;
 	struct nfgenmsg *nfg;
 	struct nlattr *nested[2];
-	char buffer[BUFF_LEN];
+	static char buffer[BUFF_LEN];

 	if (strlen(setname) >= IPSET_MAXNAMELEN) {
 		errno = ENAMETOOLONG;
@@ -172,15 +91,14 @@ static int add_to_ipset(filter_dev dev, const char *setname, const void *ipaddr,
 	mnl_attr_nest_end(nlh, nested[1]);
 	mnl_attr_nest_end(nlh, nested[0]);

-	if (mnl_socket_sendto(dev, nlh, nlh->nlmsg_len) < 0) {
+	if (mnl_socket_sendto(mnl, nlh, nlh->nlmsg_len) < 0) {
 		return -1;
 	}
 	return 0;
 }
-#endif

 static void
-ipset_add_rrset_data(struct ipset_env *ie,
+ipset_add_rrset_data(struct ipset_env *ie, struct mnl_socket *mnl,
 	struct packed_rrset_data *d, const char* setname, int af,
 	const char* dname)
 {
@@ -205,9 +123,12 @@ ipset_add_rrset_data(struct ipset_env *ie,
 					snprintf(ip, sizeof(ip), "(inet_ntop_error)");
 				verbose(VERB_QUERY, "ipset: add %s to %s for %s", ip, setname, dname);
 			}
-			ret = add_to_ipset((filter_dev)ie->dev, setname, rr_data + 2, af);
+			ret = add_to_ipset(mnl, setname, rr_data + 2, af);
 			if (ret < 0) {
 				log_err("ipset: could not add %s into %s", dname, setname);
+
+				mnl_socket_close(mnl);
+				ie->mnl = NULL;
 				break;
 			}
 		}
@@ -216,35 +137,26 @@ ipset_add_rrset_data(struct ipset_env *ie,

 static int
 ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
-	struct ub_packed_rrset_key *rrset, const char *qname, int qlen,
-	const char *setname, int af)
+	struct mnl_socket *mnl, struct ub_packed_rrset_key *rrset,
+	const char *qname, const int qlen, const char *setname, int af)
 {
-	char dname[LDNS_MAX_DOMAINLEN*4+16];
+	static char dname[BUFF_LEN];
 	const char *ds, *qs;
 	int dlen, plen;

 	struct config_strlist *p;
 	struct packed_rrset_data *d;

-	dlen = sldns_wire2str_dname_buf(rrset->rk.dname, rrset->rk.dname_len, dname, sizeof(dname));
-	if (dlen == 0 || dlen >= (int)sizeof(dname)) {
+	dlen = sldns_wire2str_dname_buf(rrset->rk.dname, rrset->rk.dname_len, dname, BUFF_LEN);
+	if (dlen == 0) {
 		log_err("bad domain name");
 		return -1;
 	}
-	if (dname[dlen - 1] == '.') {
-		dlen--;
-	}
-	if (qname[qlen - 1] == '.') {
-		qlen--;
-	}

 	for (p = env->cfg->local_zones_ipset; p; p = p->next) {
 		ds = NULL;
 		qs = NULL;
 		plen = strlen(p->str);
-		if (p->str[plen - 1] == '.') {
-			plen--;
-		}

 		if (dlen == plen || (dlen > plen && dname[dlen - plen - 1] == '.' )) {
 			ds = dname + (dlen - plen);
@@ -255,7 +167,8 @@ ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
 		if ((ds && strncasecmp(p->str, ds, plen) == 0)
 			|| (qs && strncasecmp(p->str, qs, plen) == 0)) {
 			d = (struct packed_rrset_data*)rrset->entry.data;
-			ipset_add_rrset_data(ie, d, setname, af, dname);
+			ipset_add_rrset_data(ie, mnl, d, setname,
+				af, dname);
 			break;
 		}
 	}
@@ -265,28 +178,27 @@ ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
 static int ipset_update(struct module_env *env, struct dns_msg *return_msg,
 	struct query_info qinfo, struct ipset_env *ie)
 {
+	struct mnl_socket *mnl;
 	size_t i;
 	const char *setname;
 	struct ub_packed_rrset_key *rrset;
 	int af;
-	char qname[LDNS_MAX_DOMAINLEN*4+16];
+	static char qname[BUFF_LEN];
 	int qlen;

-#ifdef HAVE_NET_PFVAR_H
-#else
-	if (!ie->dev) {
+	mnl = (struct mnl_socket *)ie->mnl;
+	if (!mnl) {
 		/* retry to create mnl socket */
-		ie->dev = open_filter();
-		if (!ie->dev) {
-			log_warn("ipset open_filter failed");
+		mnl = open_mnl_socket();
+		if (!mnl) {
 			return -1;
 		}
+		ie->mnl = mnl;
 	}
-#endif

 	qlen = sldns_wire2str_dname_buf(qinfo.qname, qinfo.qname_len,
-		qname, sizeof(qname));
-	if(qlen == 0 || qlen >= (int)sizeof(qname)) {
+		qname, BUFF_LEN);
+	if(qlen == 0) {
 		log_err("bad domain name");
 		return -1;
 	}
@@ -305,8 +217,8 @@ static int ipset_update(struct module_env *env, struct dns_msg *return_msg,
 		}

 		if (setname) {
-			if(ipset_check_zones_for_rrset(env, ie, rrset, qname,
-				qlen, setname, af) == -1)
+			if(ipset_check_zones_for_rrset(env, ie, mnl, rrset,
+				qname, qlen, setname, af) == -1)
 				return -1;
 		}
 	}
@@ -314,7 +226,7 @@ static int ipset_update(struct module_env *env, struct dns_msg *return_msg,
 	return 0;
 }

-int ipset_startup(struct module_env* env, int id) {
+int ipset_init(struct module_env* env, int id) {
 	struct ipset_env *ipset_env;

 	ipset_env = (struct ipset_env *)calloc(1, sizeof(struct ipset_env));
@@ -325,56 +237,10 @@ int ipset_startup(struct module_env* env, int id) {

 	env->modinfo[id] = (void *)ipset_env;

-#ifdef HAVE_NET_PFVAR_H
-	ipset_env->dev = open_filter();
-	if (!ipset_env->dev) {
-		log_err("ipset open_filter failed");
-		return 0;
-	}
-#else
-	ipset_env->dev = NULL;
-#endif
-	return 1;
-}
-
-void ipset_destartup(struct module_env* env, int id) {
-	filter_dev dev;
-	struct ipset_env *ipset_env;
-
-	if (!env || !env->modinfo[id]) {
-		return;
-	}
-	ipset_env = (struct ipset_env*)env->modinfo[id];
-
-	dev = (filter_dev)ipset_env->dev;
-	if (dev) {
-#if HAVE_NET_PFVAR_H
-		close(dev);
-#else
-		mnl_socket_close(dev);
-#endif
-		ipset_env->dev = NULL;
-	}
-
-	free(ipset_env);
-	env->modinfo[id] = NULL;
-}
-
-int ipset_init(struct module_env* env, int id) {
-	struct ipset_env *ipset_env = env->modinfo[id];
+	ipset_env->mnl = NULL;

 	ipset_env->name_v4 = env->cfg->ipset_name_v4;
 	ipset_env->name_v6 = env->cfg->ipset_name_v6;
-#ifndef HAVE_NET_PFVAR_H
-	if (ipset_env->name_v4 && strlen(ipset_env->name_v4) >= IPSET_MAXNAMELEN) {
-		log_err("ipset: name-v4 exceeds IPSET_MAXNAMELEN (%d)", IPSET_MAXNAMELEN);
-		return 0;
-	}
-	if (ipset_env->name_v6 && strlen(ipset_env->name_v6) >= IPSET_MAXNAMELEN) {
-		log_err("ipset: name-v6 exceeds IPSET_MAXNAMELEN (%d)", IPSET_MAXNAMELEN);
-		return 0;
-	}
-#endif

 	ipset_env->v4_enabled = !ipset_env->name_v4 || (strlen(ipset_env->name_v4) == 0) ? 0 : 1;
 	ipset_env->v6_enabled = !ipset_env->name_v6 || (strlen(ipset_env->name_v6) == 0) ? 0 : 1;
@@ -387,8 +253,24 @@ int ipset_init(struct module_env* env, int id) {
 	return 1;
 }

-void ipset_deinit(struct module_env *ATTR_UNUSED(env), int ATTR_UNUSED(id)) {
-	/* nothing */
+void ipset_deinit(struct module_env *env, int id) {
+	struct mnl_socket *mnl;
+	struct ipset_env *ipset_env;
+
+	if (!env || !env->modinfo[id]) {
+		return;
+	}
+
+	ipset_env = (struct ipset_env *)env->modinfo[id];
+
+	mnl = (struct mnl_socket *)ipset_env->mnl;
+	if (mnl) {
+		mnl_socket_close(mnl);
+		ipset_env->mnl = NULL;
+	}
+
+	free(ipset_env);
+	env->modinfo[id] = NULL;
 }

 static int ipset_new(struct module_qstate* qstate, int id) {
@@ -494,8 +376,8 @@ size_t ipset_get_mem(struct module_env *env, int id) {
 */
 static struct module_func_block ipset_block = {
 	"ipset",
-	&ipset_startup, &ipset_destartup, &ipset_init, &ipset_deinit,
-	&ipset_operate, &ipset_inform_super, &ipset_clear, &ipset_get_mem
+	&ipset_init, &ipset_deinit, &ipset_operate,
+	&ipset_inform_super, &ipset_clear, &ipset_get_mem
 };

 struct module_func_block * ipset_get_funcblock(void) {
@@ -37,7 +37,7 @@ extern "C" {
 #endif

 struct ipset_env {
-	void* dev;
+    void* mnl;

 	int v4_enabled;
 	int v6_enabled;
@@ -50,10 +50,6 @@ struct ipset_qstate {
 	int dummy;
 };

-/** Startup the ipset module */
-int ipset_startup(struct module_env* env, int id);
-/** Destartup the ipset module */
-void ipset_destartup(struct module_env* env, int id);
 /** Init the ipset module */
 int ipset_init(struct module_env* env, int id);
 /** Deinit the ipset module */
@@ -118,10 +118,10 @@ delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name,
 		sizeof(struct delegpt_ns));
 	if(!ns)
 		return 0;
+	ns->next = dp->nslist;
 	ns->namelen = len;
+	dp->nslist = ns;
 	ns->name = regional_alloc_init(region, name, ns->namelen);
-	if(!ns->name)
-		return 0;
 	ns->cache_lookup_count = 0;
 	ns->resolved = 0;
 	ns->got4 = 0;
@@ -137,9 +137,7 @@ delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name,
 	} else {
 		ns->tls_auth_name = NULL;
 	}
-	ns->next = dp->nslist;
-	dp->nslist = ns;
-	return 1;
+	return ns->name != 0;
 }

 struct delegpt_ns*
@@ -225,7 +223,11 @@ delegpt_add_addr(struct delegpt* dp, struct regional* region,
 		sizeof(struct delegpt_addr));
 	if(!a)
 		return 0;
+	a->next_target = dp->target_list;
+	dp->target_list = a;
 	a->next_result = 0;
+	a->next_usable = dp->usable_list;
+	dp->usable_list = a;
 	memcpy(&a->addr, addr, addrlen);
 	a->addrlen = addrlen;
 	a->attempts = 0;
@@ -239,10 +241,6 @@ delegpt_add_addr(struct delegpt* dp, struct regional* region,
 	} else {
 		a->tls_auth_name = NULL;
 	}
-	a->next_target = dp->target_list;
-	dp->target_list = a;
-	a->next_usable = dp->usable_list;
-	dp->usable_list = a;
 	return 1;
 }

@@ -280,7 +278,7 @@ delegpt_count_addr(struct delegpt* dp, size_t* numaddr, size_t* numres,

 void delegpt_log(enum verbosity_value v, struct delegpt* dp)
 {
-	char buf[LDNS_MAX_DOMAINLEN];
+	char buf[LDNS_MAX_DOMAINLEN+1];
 	struct delegpt_ns* ns;
 	struct delegpt_addr* a;
 	size_t missing=0, numns=0, numaddr=0, numres=0, numavail=0;
@@ -400,33 +398,58 @@ delegpt_count_missing_targets(struct delegpt* dp, int* alllame)

 /** find NS rrset in given list */
 static struct ub_packed_rrset_key*
-find_NS(struct reply_info* rep, size_t from, size_t to, uint16_t qclass)
+find_NS(struct reply_info* rep, size_t from, size_t to)
 {
 	size_t i;
 	for(i=from; i<to; i++) {
-		if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS &&
-			ntohs(rep->rrsets[i]->rk.rrset_class) == qclass)
+		if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS)
 			return rep->rrsets[i];
 	}
 	return NULL;
 }

+struct delegpt* delegpt_from_deleg(struct dns_msg*, struct regional* region, uint8_t* ipv4, uint8_t* ipv6, uint8_t* ns_name, size_t ns_name_len) {
+	struct delegpt* dp;
+	dp = delegpt_create(region);
+	delegpt_set_name(dp, region, ns_name);
+    delegpt_add_ns(dp, region,  ns_name, 0, NULL, 53);
+	// delegpt_rrset_add_ns(dp, region, ns_rrset, 0);
+    if (ipv4 != NULL) {
+        struct sockaddr_in sa4;
+        socklen_t lenv4 = (socklen_t)sizeof(sa4);
+        memset(&sa4, 0, lenv4);
+        sa4.sin_family = AF_INET;
+        memmove(&sa4.sin_addr, ipv4, INET_SIZE);
+        delegpt_add_target(dp, region, ns_name, ns_name_len, (struct sockaddr_storage*)&sa4, lenv4, 0, 0, NULL);
+        }
+    if (ipv6 != NULL) {
+        struct sockaddr_in6 sa6;
+        socklen_t lenv6 = (socklen_t)sizeof(sa6);
+        memset(&sa6, 0, lenv6);
+        sa6.sin6_family = AF_INET6;
+        memmove(&sa6.sin6_addr, ipv6, INET6_SIZE);
+        delegpt_add_target(dp, region, ns_name, ns_name_len, (struct sockaddr_storage*)&sa6, lenv6, 0, 0, NULL);
+    }
+    return dp;
+// delegpt_add_addr(struct delegpt* dp, struct regional* region,
+// 	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t bogus,
+// 	uint8_t lame, char* tls_auth_name, int port, int* additions)
+}
+
 struct delegpt* 
-delegpt_from_message(struct dns_msg* msg, struct regional* region, int port)
+delegpt_from_message(struct dns_msg* msg, struct regional* region)
 {
 	struct ub_packed_rrset_key* ns_rrset = NULL;
 	struct delegpt* dp;
 	size_t i;
 	/* look for NS records in the authority section... */
 	ns_rrset = find_NS(msg->rep, msg->rep->an_numrrsets, 
-		msg->rep->an_numrrsets+msg->rep->ns_numrrsets,
-		msg->qinfo.qclass);
+		msg->rep->an_numrrsets+msg->rep->ns_numrrsets);

 	/* In some cases (even legitimate, perfectly legal cases), the 
 	 * NS set for the "referral" might be in the answer section. */
 	if(!ns_rrset)
-		ns_rrset = find_NS(msg->rep, 0, msg->rep->an_numrrsets,
-			msg->qinfo.qclass);
+		ns_rrset = find_NS(msg->rep, 0, msg->rep->an_numrrsets);
 	
 	/* If there was no NS rrset in the authority section, then this 
 	 * wasn't a referral message. (It might not actually be a 
@@ -441,7 +464,7 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region, int port)
 	dp->has_parent_side_NS = 1; /* created from message */
 	if(!delegpt_set_name(dp, region, ns_rrset->rk.dname))
 		return NULL;
-	if(!delegpt_rrset_add_ns(dp, region, ns_rrset, 0, port))
+	if(!delegpt_rrset_add_ns(dp, region, ns_rrset, 0))
 		return NULL;

 	/* add glue, A and AAAA in answer and additional section */
@@ -452,12 +475,10 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region, int port)
 			i < (msg->rep->an_numrrsets+msg->rep->ns_numrrsets))
 			continue;

-		if(ntohs(s->rk.type) == LDNS_RR_TYPE_A &&
-			ntohs(s->rk.rrset_class) == msg->qinfo.qclass) {
+		if(ntohs(s->rk.type) == LDNS_RR_TYPE_A) {
 			if(!delegpt_add_rrset_A(dp, region, s, 0, NULL))
 				return NULL;
-		} else if(ntohs(s->rk.type) == LDNS_RR_TYPE_AAAA &&
-			ntohs(s->rk.rrset_class) == msg->qinfo.qclass) {
+		} else if(ntohs(s->rk.type) == LDNS_RR_TYPE_AAAA) {
 			if(!delegpt_add_rrset_AAAA(dp, region, s, 0, NULL))
 				return NULL;
 		}
@@ -467,7 +488,7 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region, int port)

 int 
 delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,
-        struct ub_packed_rrset_key* ns_rrset, uint8_t lame, int port)
+        struct ub_packed_rrset_key* ns_rrset, uint8_t lame)
 {
 	struct packed_rrset_data* nsdata = (struct packed_rrset_data*)
 		ns_rrset->entry.data;
@@ -482,7 +503,7 @@ delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,
 			continue; /* bad format */
 		/* add rdata of NS (= wirefmt dname), skip rdatalen bytes */
 		if(!delegpt_add_ns(dp, region, nsdata->rr_data[i]+2, lame,
-			NULL, (port==-1?UNBOUND_DNS_PORT:port)))
+			NULL, UNBOUND_DNS_PORT))
 			return 0;
 	}
 	return 1;
@@ -541,7 +562,7 @@ delegpt_add_rrset(struct delegpt* dp, struct regional* region,
 	if(!rrset)
 		return 1;
 	if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_NS)
-		return delegpt_rrset_add_ns(dp, region, rrset, lame, -1);
+		return delegpt_rrset_add_ns(dp, region, rrset, lame);
 	else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_A)
 		return delegpt_add_rrset_A(dp, region, rrset, lame, additions);
 	else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_AAAA)
@@ -666,6 +687,8 @@ int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame,
 		free(ns);
 		return 0;
 	}
+	ns->next = dp->nslist;
+	dp->nslist = ns;
 	ns->cache_lookup_count = 0;
 	ns->resolved = 0;
 	ns->got4 = 0;
@@ -684,8 +707,6 @@ int delegpt_add_ns_mlc(struct delegpt* dp, uint8_t* name, uint8_t lame,
 	} else {
 		ns->tls_auth_name = NULL;
 	}
-	ns->next = dp->nslist;
-	dp->nslist = ns;
 	return 1;
 }

@@ -711,7 +732,11 @@ int delegpt_add_addr_mlc(struct delegpt* dp, struct sockaddr_storage* addr,
 	a = (struct delegpt_addr*)malloc(sizeof(struct delegpt_addr));
 	if(!a)
 		return 0;
+	a->next_target = dp->target_list;
+	dp->target_list = a;
 	a->next_result = 0;
+	a->next_usable = dp->usable_list;
+	dp->usable_list = a;
 	memcpy(&a->addr, addr, addrlen);
 	a->addrlen = addrlen;
 	a->attempts = 0;
@@ -727,10 +752,6 @@ int delegpt_add_addr_mlc(struct delegpt* dp, struct sockaddr_storage* addr,
 	} else {
 		a->tls_auth_name = NULL;
 	}
-	a->next_target = dp->target_list;
-	dp->target_list = a;
-	a->next_usable = dp->usable_list;
-	dp->usable_list = a;
 	return 1;
 }

@@ -79,16 +79,6 @@ struct delegpt {
 	 * Also true if the delegationpoint was created from a delegation
 	 * message and thus contains the parent-side-info already. */
 	uint8_t has_parent_side_NS;
-	/** if true, the delegation point has reached last resort processing
-	 *  and the parent side information has been possibly added to the
-	 *  delegation point.
-	 *  For now this signals that further target lookups will ignore
-	 *  the configured target-fetch-policy and only resolve on
-	 *  demand to try and avoid triggering limits at this stage (.i.e, it
-	 *  is very likely that the A/AAAA queries for the newly added name
-	 *  servers will not yield new IP addresses and trigger NXNS
-	 *  countermeasures. */
-	uint8_t fallback_to_parent_side_NS;
 	/** for assertions on type of delegpt */
 	uint8_t dp_type_mlc;
 	/** use SSL for upstream query */
@@ -221,11 +211,10 @@ int delegpt_add_ns(struct delegpt* dp, struct regional* regional,
 * @param regional: where to allocate the info.
 * @param ns_rrset: NS rrset.
 * @param lame: rrset is lame, disprefer it.
- * @param port: port or -1 if not set.
 * @return 0 on alloc error.
 */
 int delegpt_rrset_add_ns(struct delegpt* dp, struct regional* regional,
-	struct ub_packed_rrset_key* ns_rrset, uint8_t lame, int port);
+	struct ub_packed_rrset_key* ns_rrset, uint8_t lame);

 /**
 * Add target address to the delegation point.
@@ -366,13 +355,13 @@ size_t delegpt_count_targets(struct delegpt* dp);
 *
 * @param msg: the dns message, referral.
 * @param regional: where to allocate delegation point.
- * @param port: if not -1 specifies a port number.
 * @return new delegation point or NULL on alloc error, or if the
 *         message was not appropriate.
 */
 struct delegpt* delegpt_from_message(struct dns_msg* msg, 
-	struct regional* regional, int port);
+	struct regional* regional);

+struct delegpt* delegpt_from_deleg(struct dns_msg*, struct regional* region, uint8_t* ipv4, uint8_t* pv6, uint8_t* ns_name, size_t ns_name_len);
 /**
 * Mark negative return in delegation point for specific nameserver.
 * sets the got4 or got6 to negative, updates the ns->resolved.
@@ -132,18 +132,6 @@ donotq_apply_cfg(struct iter_donotq* dq, struct config_file* cfg)
 		if(cfg->do_ip6) {
 			if(!donotq_str_cfg(dq, "::1"))
 				return 0;
-			if(!donotq_str_cfg(dq, "::ffff:127.0.0.0/104"))
-				return 0;
-		}
-		/* RFC 1122 3.2.1.3 / RFC 6890 / RFC 4291 2.5.2: not valid as
-		 * destination; on Linux these route to the local host. */
-		if(!donotq_str_cfg(dq, "0.0.0.0/8"))
-			return 0;
-		if(cfg->do_ip6) {
-			if(!donotq_str_cfg(dq, "::"))
-				return 0;
-			if(!donotq_str_cfg(dq, "::ffff:0:0/96"))
-				return 0;
 		}
 	}
 	addr_tree_init_parents(&dq->tree);
@@ -129,7 +129,7 @@ forwards_insert_data(struct iter_forwards* fwd, uint16_t c, uint8_t* nm,
 	node->namelabs = nmlabs;
 	node->dp = dp;
 	if(!rbtree_insert(fwd->tree, &node->node)) {
-		char buf[LDNS_MAX_DOMAINLEN];
+		char buf[257];
 		dname_str(nm, buf);
 		log_err("duplicate forward zone %s ignored.", buf);
 		delegpt_free_mlc(dp);
@@ -139,17 +139,6 @@ forwards_insert_data(struct iter_forwards* fwd, uint16_t c, uint8_t* nm,
 	return 1;
 }

-static struct iter_forward_zone*
-fwd_zone_find(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
-{
-	struct iter_forward_zone key;
-	key.node.key = &key;
-	key.dclass = c;
-	key.name = nm;
-	key.namelabs = dname_count_size_labels(nm, &key.namelen);
-	return (struct iter_forward_zone*)rbtree_search(fwd->tree, &key);
-}
-
 /** insert new info into forward structure given dp */
 static int
 forwards_insert(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp)
@@ -228,11 +217,6 @@ read_fwds_host(struct config_stub* s, struct delegpt* dp)
 				s->name, p->str);
 			return 0;
 		}
-		if(dname_subdomain_c(dname, dp->name)) {
-			log_warn("forward-host '%s' may have a circular "
-				"dependency on forward-zone '%s'",
-				p->str, s->name);
-		}
 #if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
 		if(tls_auth_name)
 			log_err("no name verification functionality in "
@@ -337,40 +321,6 @@ make_stub_holes(struct iter_forwards* fwd, struct config_file* cfg)
 			log_err("cannot parse stub name '%s'", s->name);
 			return 0;
 		}
-		if(fwd_zone_find(fwd, LDNS_RR_CLASS_IN, dname) != NULL) {
-			/* Already a forward zone there. */
-			free(dname);
-			continue;
-		}
-		if(!fwd_add_stub_hole(fwd, LDNS_RR_CLASS_IN, dname)) {
-			free(dname);
-			log_err("out of memory");
-			return 0;
-		}
-		free(dname);
-	}
-	return 1;
-}
-
-/** make NULL entries for auths */
-static int
-make_auth_holes(struct iter_forwards* fwd, struct config_file* cfg)
-{
-	struct config_auth* a;
-	uint8_t* dname;
-	size_t dname_len;
-	for(a = cfg->auths; a; a = a->next) {
-		if(!a->name) continue;
-		dname = sldns_str2wire_dname(a->name, &dname_len);
-		if(!dname) {
-			log_err("cannot parse auth name '%s'", a->name);
-			return 0;
-		}
-		if(fwd_zone_find(fwd, LDNS_RR_CLASS_IN, dname) != NULL) {
-			/* Already a forward zone there. */
-			free(dname);
-			continue;
-		}
 		if(!fwd_add_stub_hole(fwd, LDNS_RR_CLASS_IN, dname)) {
 			free(dname);
 			log_err("out of memory");
@@ -403,16 +353,6 @@ forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg)
 		lock_rw_unlock(&fwd->lock);
 		return 0;
 	}
-	/* TODO: Now we punch holes for auth zones as well so that in
-	 *       iterator:forward_request() we see the configured
-	 *       delegation point, but code flow/naming is hard to follow.
-	 *       Consider having a single tree with configured
-	 *       delegation points for all categories
-	 *       (stubs, forwards, auths). */
-	if(!make_auth_holes(fwd, cfg)) {
-		lock_rw_unlock(&fwd->lock);
-		return 0;
-	}
 	fwd_init_parents(fwd);
 	lock_rw_unlock(&fwd->lock);
 	return 1;
@@ -563,6 +503,17 @@ forwards_get_mem(struct iter_forwards* fwd)
 	return s;
 }

+static struct iter_forward_zone*
+fwd_zone_find(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
+{
+	struct iter_forward_zone key;
+	key.node.key = &key;
+	key.dclass = c;
+	key.name = nm;
+	key.namelabs = dname_count_size_labels(nm, &key.namelen);
+	return (struct iter_forward_zone*)rbtree_search(fwd->tree, &key);
+}
+
 int 
 forwards_add_zone(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp,
 	int nolock)
@@ -639,19 +590,3 @@ forwards_delete_stub_hole(struct iter_forwards* fwd, uint16_t c,
 	fwd_init_parents(fwd);
 	if(!nolock) { lock_rw_unlock(&fwd->lock); }
 }
-
-void
-forwards_swap_tree(struct iter_forwards* fwd, struct iter_forwards* data)
-{
-	rbtree_type* oldtree = fwd->tree;
-	if(oldtree) {
-		lock_unprotect(&fwd->lock, oldtree);
-	}
-	if(data->tree) {
-		lock_unprotect(&data->lock, data->tree);
-	}
-	fwd->tree = data->tree;
-	data->tree = oldtree;
-	lock_protect(&fwd->lock, fwd->tree, sizeof(*fwd->tree));
-	lock_protect(&data->lock, data->tree, sizeof(*data->tree));
-}
@@ -234,13 +234,4 @@ int forwards_add_stub_hole(struct iter_forwards* fwd, uint16_t c,
 void forwards_delete_stub_hole(struct iter_forwards* fwd, uint16_t c,
 	uint8_t* nm, int nolock);

-/**
- * Swap internal tree with preallocated entries. Caller should manage
- * the locks.
- * @param fwd: the forward data structure.
- * @param data: the data structure used to take elements from. This contains
- * 	the old elements on return.
- */
-void forwards_swap_tree(struct iter_forwards* fwd, struct iter_forwards* data);
-
 #endif /* ITERATOR_ITER_FWD_H */
@@ -181,7 +181,7 @@ hints_insert(struct iter_hints* hints, uint16_t c, struct delegpt* dp,
 	node->noprime = (uint8_t)noprime;
 	if(!name_tree_insert(&hints->tree, &node->node, dp->name, dp->namelen,
 		dp->namelabs, c)) {
-		char buf[LDNS_MAX_DOMAINLEN];
+		char buf[257];
 		dname_str(dp->name, buf);
 		log_err("second hints for zone %s ignored.", buf);
 		delegpt_free_mlc(dp);
@@ -231,11 +231,6 @@ read_stubs_host(struct config_stub* s, struct delegpt* dp)
 				s->name, p->str);
 			return 0;
 		}
-		if(dname_subdomain_c(dname, dp->name)) {
-			log_warn("stub-host '%s' may have a circular "
-				"dependency on stub-zone '%s'",
-				p->str, s->name);
-		}
 #if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
 		if(tls_auth_name)
 			log_err("no name verification functionality in "
@@ -616,14 +611,3 @@ hints_delete_stub(struct iter_hints* hints, uint16_t c, uint8_t* nm,
 	name_tree_init_parents(&hints->tree);
 	if(!nolock) { lock_rw_unlock(&hints->lock); }
 }
-
-void
-hints_swap_tree(struct iter_hints* hints, struct iter_hints* data)
-{
-	rbnode_type* oldroot = hints->tree.root;
-	size_t oldcount = hints->tree.count;
-	hints->tree.root = data->tree.root;
-	hints->tree.count = data->tree.count;
-	data->tree.root = oldroot;
-	data->tree.count = oldcount;
-}
@@ -198,13 +198,4 @@ int hints_add_stub(struct iter_hints* hints, uint16_t c, struct delegpt* dp,
 void hints_delete_stub(struct iter_hints* hints, uint16_t c,
 	uint8_t* nm, int nolock);

-/**
- * Swap internal tree with preallocated entries. Caller should manage
- * the locks.
- * @param hints: the hints data structure.
- * @param data: the data structure used to take elements from. This contains
- * 	the old elements on return.
- */
-void hints_swap_tree(struct iter_hints* hints, struct iter_hints* data);
-
 #endif /* ITERATOR_ITER_HINTS_H */
@@ -207,168 +207,6 @@ size_t priv_get_mem(struct iter_priv* priv)
 	return sizeof(*priv) + regional_get_mem(priv->region);
 }

-/**
- * Check if svcparam ipv4hint contains a private address.
- * @param priv: private address lookup struct.
- * @param d: the data bytes.
- * @param data_len: number of data bytes in the svcparam.
- * @param addr: address to return the private address to log in to.
- *	It has space for IPv4 and IPv6 addresses.
- * @param addrlen: length of the addr. Returns the correct size for the addr.
- * @return true if the rdata contains a private address.
- */
-static int svcb_ipv4hint_contains_priv_addr(struct iter_priv* priv,
-	uint8_t* d, uint16_t data_len, struct sockaddr_storage* addr,
-	socklen_t* addrlen)
-{
-	struct sockaddr_in sa;
-	*addrlen = (socklen_t)sizeof(struct sockaddr_in);
-	memset(&sa, 0, sizeof(struct sockaddr_in));
-	sa.sin_family = AF_INET;
-	sa.sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
-
-	while(data_len >= LDNS_IP4ADDRLEN) {
-		memmove(&sa.sin_addr, d, LDNS_IP4ADDRLEN);
-		memmove(addr, &sa, *addrlen);
-		if(priv_lookup_addr(priv, addr, *addrlen))
-			return 1;
-
-		d += LDNS_IP4ADDRLEN;
-		data_len -= LDNS_IP4ADDRLEN;
-	}
-	/* if data_len != 0 here, then the svcparam is malformed. */
-	return 0;
-}
-
-/**
- * Check if svcparam ipv6hint contains a private address.
- * @param priv: private address lookup struct.
- * @param d: the data bytes.
- * @param data_len: number of data bytes in the svcparam.
- * @param addr: address to return the private address to log in to.
- *	It has space for IPv4 and IPv6 addresses.
- * @param addrlen: length of the addr. Returns the correct size for the addr.
- * @return true if the rdata contains a private address.
- */
-static int svcb_ipv6hint_contains_priv_addr(struct iter_priv* priv,
-	uint8_t* d, uint16_t data_len, struct sockaddr_storage* addr,
-	socklen_t* addrlen)
-{
-	struct sockaddr_in6 sa;
-	*addrlen = (socklen_t)sizeof(struct sockaddr_in6);
-	memset(&sa, 0, sizeof(struct sockaddr_in6));
-	sa.sin6_family = AF_INET6;
-	sa.sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
-
-	while(data_len >= LDNS_IP6ADDRLEN) {
-		memmove(&sa.sin6_addr, d, LDNS_IP6ADDRLEN);
-		memmove(addr, &sa, *addrlen);
-		if(priv_lookup_addr(priv, addr, *addrlen))
-			return 1;
-
-		d += LDNS_IP6ADDRLEN;
-		data_len -= LDNS_IP6ADDRLEN;
-	}
-	/* if data_len != 0 here, then the svcparam is malformed. */
-	return 0;
-}
-
-/**
- * Check if type SVCB and HTTPS rdata contains a private address.
- * @param priv: private address lookup struct.
- * @param pkt: the packet.
- * @param rr: the rr with rdata to check.
- * @param addr: address to return the private address to log in to.
- * @param addrlen: length of the addr. Initially the total size, on
- *	return the correct size for the addr.
- * @return true if the rdata contains a private address.
- */
-static int svcb_rr_contains_priv_addr(struct iter_priv* priv,
-	sldns_buffer* pkt, struct rr_parse* rr, struct sockaddr_storage* addr,
-	socklen_t* addrlen)
-{
-	uint8_t* d = rr->ttl_data;
-	uint16_t svcparamkey, data_len, rdatalen;
-	size_t oldpos, dname_len, dname_start, dname_compr_len;
-	d += 4; /* skip TTL */
-	rdatalen = sldns_read_uint16(d); /* read rdata length */
-	d += 2;
-
-	if(rdatalen < 2 /* priority */ + 1 /* 1 length target */)
-		return 0; /* malformed, too short */
-	d += 2; /* skip priority */
-	rdatalen -= 2;
-	oldpos = sldns_buffer_position(pkt);
-	sldns_buffer_set_position(pkt, (size_t)(d - sldns_buffer_begin(pkt)));
-	dname_start = sldns_buffer_position(pkt);
-	dname_len = pkt_dname_len(pkt);
-	dname_compr_len = sldns_buffer_position(pkt) - dname_start;
-	sldns_buffer_set_position(pkt, oldpos);
-	if(dname_len == 0)
-		return 0; /* dname malformed */
-	if(dname_compr_len > rdatalen)
-		return 0; /* malformed */
-	d += dname_compr_len; /* skip target */
-	rdatalen -= dname_compr_len;
-
-	while(rdatalen >= 4) {
-		svcparamkey = sldns_read_uint16(d);
-		data_len = sldns_read_uint16(d+2);
-		d += 4;
-		rdatalen -= 4;
-
-		/* verify that we have data_len data */
-		if(data_len > rdatalen) {
-			/* It is malformed, but if there are addresses
-			 * in there it can be rejected. */
-			data_len = rdatalen;
-		}
-
-		if(!data_len)
-			continue; /* no data for the svcparamkey */
-
-		if(svcparamkey == SVCB_KEY_IPV4HINT) {
-			if(svcb_ipv4hint_contains_priv_addr(priv, d, data_len,
-				addr, addrlen))
-				return 1;
-		} else if(svcparamkey == SVCB_KEY_IPV6HINT) {
-			if(svcb_ipv6hint_contains_priv_addr(priv, d, data_len,
-				addr, addrlen))
-				return 1;
-		}
-		d += data_len;
-		rdatalen -= data_len;
-	}
-	/* If rdatalen != 0 here, then the svcb rdata is malformed. */
-	return 0;
-}
-
-/**
- * Check if the SVCB and HTTPS rrset is bad.
- * @param priv: private address lookup struct.
- * @param pkt: the packet.
- * @param rrset: the rrset to check.
- * @return 1 if the entire rrset has to be removed. 0 if not.
- * It removes RRs if they have private addresses, and log that.
- */
-static int priv_svcb_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
-	struct rrset_parse* rrset)
-{
-	struct rr_parse* rr, *prev = NULL;
-	struct sockaddr_storage addr;
-	socklen_t addrlen = (socklen_t)sizeof(addr);
-	for(rr = rrset->rr_first; rr; rr = rr->next) {
-		if(svcb_rr_contains_priv_addr(priv, pkt, rr, &addr,
-			&addrlen)) {
-			if(msgparse_rrset_remove_rr("sanitize: removing public name with private address", pkt, rrset, prev, rr, &addr, addrlen))
-				return 1;
-			continue;
-		}
-		prev = rr;
-	}
-	return 0;
-}
-
 int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 	struct rrset_parse* rrset)
 {
@@ -430,11 +268,7 @@ int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 				}
 				prev = rr;
 			}
-		} else if(rrset->type == LDNS_RR_TYPE_SVCB ||
-			rrset->type == LDNS_RR_TYPE_HTTPS) {
-			if(priv_svcb_rrset_bad(priv, pkt, rrset))
-				return 1;
-		}
+		} 
 	}
 	return 0;
 }
@@ -107,7 +107,7 @@ response_type_from_cache(struct dns_msg* msg,
 enum response_type 
 response_type_from_server(int rdset,
 	struct dns_msg* msg, struct query_info* request, struct delegpt* dp,
-	int* empty_nodata_found, int msg_lame_empty, int msg_lame_referral)
+	int* empty_nodata_found)
 {
 	uint8_t* origzone = (uint8_t*)"\000"; /* the default */
 	struct ub_packed_rrset_key* s;
@@ -122,10 +122,6 @@ response_type_from_server(int rdset,

 	/* If the message is NXDOMAIN, then it answers the question. */
 	if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_NXDOMAIN) {
-		if(msg->rep->an_numrrsets == 0 &&
-			msg->rep->ns_numrrsets == 0 &&
-			msg_lame_empty)
-			return RESPONSE_TYPE_LAME;
 		/* make sure its not recursive when we don't want it to */
 		if( (msg->rep->flags&BIT_RA) &&
 			!(msg->rep->flags&BIT_AA) && !rdset)
@@ -147,10 +143,6 @@ response_type_from_server(int rdset,
 	if(FLAGS_GET_RCODE(msg->rep->flags) != LDNS_RCODE_NOERROR)
 		return RESPONSE_TYPE_THROWAWAY;

-	if(msg->rep->an_numrrsets == 0 && msg->rep->ns_numrrsets == 0 &&
-		msg_lame_empty)
-		return RESPONSE_TYPE_LAME;
-
 	/* Note: TC bit has already been handled */

 	if(dp) {
@@ -257,16 +249,13 @@ response_type_from_server(int rdset,
 				 * which gives ns==zone delegation from cache 
 				 * without AA bit as well, with nodata nosoa*/
 				/* real answer must be +AA and SOA RFC(2308),
-				 * this is picked up as lame_referral by the
-				 * sanitize step, so it can spot if there
-				 * was data in the answer section before
-				 * removal. If such data is then removed we
-				 * do not want to turn that answer into lame.
-				 * But if it was not there, it can be lame. */
-				if(msg_lame_referral &&
-					msg->rep->an_numrrsets==0 &&
+				 * so this is wrong, and we SERVFAIL it if
+				 * this is the only possible reply, if it
+				 * is misdeployed the THROWAWAY makes us pick
+				 * the next server from the selection */
+				if(msg->rep->an_numrrsets==0 &&
 					!(msg->rep->flags&BIT_AA) && !rdset)
-					return RESPONSE_TYPE_LAME;
+					return RESPONSE_TYPE_THROWAWAY;
 				return RESPONSE_TYPE_ANSWER;
 			}
 			/* If we are getting a referral upwards (or to 
@@ -120,14 +120,10 @@ enum response_type response_type_from_cache(struct dns_msg* msg,
 * @param dp: The delegation point that was being queried
 *          when the response was returned.
 * @param empty_nodata_found: flag to keep track of empty nodata detection.
- * @param msg_lame_empty: The scrubber indicates that this empty message
- *	is lame, before it became empty.
- * @param msg_lame_referral: returned true if the reply has a referral before
- *	scrub.
 * @return the response type (CNAME or ANSWER).
 */
 enum response_type response_type_from_server(int rdset, 
 	struct dns_msg* msg, struct query_info* request, struct delegpt* dp,
-	int* empty_nodata_found, int msg_lame_empty, int msg_lame_referral);
+	int* empty_nodata_found);

 #endif /* ITERATOR_ITER_RESPTYPE_H */
@@ -285,17 +285,6 @@ synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
 		return NULL;
 	memmove(cn->rr_first->ttl_data, rrset->rr_first->ttl_data,
 		sizeof(uint32_t)); /* RFC6672: synth CNAME TTL == DNAME TTL */
-	/* Apply cache TTL policy so DNAME and synthesized CNAME stay equal
-	 * and respect cache-min-ttl/cache-max-ttl (same as rdata_copy path). */
-	if(!SERVE_ORIGINAL_TTL) {
-		uint32_t ttl = sldns_read_uint32(cn->rr_first->ttl_data);
-		time_t ttl_t = (time_t)ttl;
-		if(ttl_t < MIN_TTL) ttl_t = MIN_TTL;
-		if(ttl_t > MAX_TTL) ttl_t = MAX_TTL;
-		ttl = (uint32_t)ttl_t;
-		sldns_write_uint32(cn->rr_first->ttl_data, ttl);
-		sldns_write_uint32(rrset->rr_first->ttl_data, ttl);
-	}
 	sldns_write_uint16(cn->rr_first->ttl_data+4, aliaslen);
 	memmove(cn->rr_first->ttl_data+6, alias, aliaslen);
 	cn->rr_first->size = sizeof(uint16_t)+aliaslen;
@@ -316,20 +305,6 @@ synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
 	return cn;
 }

-/** Check if the packet has type NS in answer or authority section */
-static int
-pkt_contains_ns(struct msg_parse* msg)
-{
-	struct rrset_parse* rrset;
-	for(rrset = msg->rrset_first; rrset; rrset = rrset->rrset_all_next) {
-		if(rrset->type == LDNS_RR_TYPE_NS &&
-			(rrset->section == LDNS_SECTION_ANSWER ||
-			rrset->section == LDNS_SECTION_AUTHORITY))
-			return 1;
-	}
-	return 0;
-}
-
 /** check if DNAME applies to a name */
 static int
 pkt_strict_sub(sldns_buffer* pkt, uint8_t* sname, uint8_t* dr)
@@ -392,86 +367,6 @@ type_allowed_in_additional_section(uint16_t tp)
 	return 0;
 }

-/** Shorten RRset */
-static void
-shorten_rrset(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
-{
-	/* The too large NS RRset is shortened. This is so that too large
-	 * content does not overwhelm the cache. It may make the rrset
-	 * bogus if it was signed, and then the domain is not resolved any
-	 * more, that is okay, the NS RRset was too large. During a referral
-	 * it can be shortened and then the first part of the list could
-	 * be used to resolve. The scrub continues to disallow glue for the
-	 * removed nameserver RRs and removes that too. Because the glue
-	 * is not marked as okay, since the RRs have been removed here. */
-	int i;
-	struct rr_parse* rr = rrset->rr_first, *prev = NULL;
-	if(!rr)
-		return;
-	if(count < 1)
-		return; /* cannot leave a still-linked rrset_parse with rr_count == 0 */
-	for(i=0; i<count; i++) {
-		prev = rr;
-		rr = rr->next;
-		if(!rr)
-			return; /* The RRset is already short. */
-	}
-	if(verbosity >= VERB_QUERY
-		&& rrset->dname_len <= LDNS_MAX_DOMAINLEN) {
-		uint8_t buf[LDNS_MAX_DOMAINLEN+1];
-		dname_pkt_copy(pkt, buf, rrset->dname);
-		log_nametypeclass(VERB_QUERY, "normalize: shorten RRset:", buf,
-			rrset->type, ntohs(rrset->rrset_class));
-	}
-	/* remove further rrs */
-	rrset->rr_last = prev;
-	rrset->rr_count = count;
-	while(rr) {
-		rrset->size -= rr->size;
-		rr = rr->next;
-	}
-	if(rrset->rr_last)
-		rrset->rr_last->next = NULL;
-	else	rrset->rr_first = NULL;
-}
-
-/** Shorten RRSIGs list */
-static void
-shorten_rrsig(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
-{
-	/* The too large list of RRSIGs on the RRset is shortened.
-	 * This is so that too large content does not overwhelm the cache.
-	 * The validator does not validate more than a max number of
-	 * RRSIGs as well. */
-	int i;
-	struct rr_parse* rr = rrset->rrsig_first, *prev = NULL;
-	if(!rr)
-		return;
-	for(i=0; i<count; i++) {
-		prev = rr;
-		rr = rr->next;
-		if(!rr)
-			return; /* The RRSIG list is already short. */
-	}
-	if(verbosity >= VERB_QUERY
-		&& rrset->dname_len <= LDNS_MAX_DOMAINLEN) {
-		uint8_t buf[LDNS_MAX_DOMAINLEN+1];
-		dname_pkt_copy(pkt, buf, rrset->dname);
-		log_nametypeclass(VERB_QUERY, "normalize: shorten RRSIGs:",
-			buf, rrset->type, ntohs(rrset->rrset_class));
-	}
-	/* remove further rrsigs */
-	rrset->rrsig_last = prev;
-	rrset->rrsig_count = count;
-	while(rr) {
-		rrset->size -= rr->size;
-		rr = rr->next;
-	}
-	if(rrset->rrsig_last)
-		rrset->rrsig_last->next = NULL;
-	else	rrset->rrsig_first = NULL;
-}
-
 /**
 * This routine normalizes a response. This includes removing "irrelevant"
 * records from the answer and additional sections and (re)synthesizing
@@ -482,23 +377,19 @@ shorten_rrsig(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
 * @param qinfo: original query.
 * @param region: where to allocate synthesized CNAMEs.
 * @param env: module env with config options.
- * @param zonename: name of server zone.
 * @return 0 on error.
 */
 static int
 scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, 
 	struct query_info* qinfo, struct regional* region,
-	struct module_env* env, uint8_t* zonename)
+	struct module_env* env)
 {
 	uint8_t* sname = qinfo->qname;
 	size_t snamelen = qinfo->qname_len;
 	struct rrset_parse* rrset, *prev, *nsset=NULL;
-	int cname_length = 0; /* number of CNAMEs, or DNAMEs */
-	int has_answer = 0; /* if answer section contains nonCNAME,nonDNAME */

 	if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR &&
-		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN &&
-		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_YXDOMAIN)
+		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN)
 		return 1;

 	/* For the ANSWER section, remove all "irrelevant" records and add
@@ -510,21 +401,8 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 	prev = NULL;
 	rrset = msg->rrset_first;
 	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
-		if((int)rrset->rrsig_count > env->cfg->iter_scrub_rrsig)
-			shorten_rrsig(pkt, rrset, env->cfg->iter_scrub_rrsig);
-		if(cname_length > env->cfg->iter_scrub_cname) {
-			/* Too many CNAMEs, or DNAMEs, from the authority
-			 * server, scrub down the length to something
-			 * shorter. This deletes everything after the limit
-			 * is reached. The iterator is going to look up
-			 * the content one by one anyway. */
-			remove_rrset("normalize: removing because too many cnames:",
-				pkt, msg, prev, &rrset);
-			continue;
-		}
-		if(rrset->type == LDNS_RR_TYPE_DNAME &&
-			pkt_strict_sub(pkt, sname, rrset->dname) &&
-			pkt_sub(pkt, rrset->dname, zonename)) {
+		if(rrset->type == LDNS_RR_TYPE_DNAME && 
+			pkt_strict_sub(pkt, sname, rrset->dname)) {
 			/* check if next rrset is correct CNAME. else,
 			 * synthesize a CNAME */
 			struct rrset_parse* nx = rrset->rrset_all_next;
@@ -536,23 +414,12 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					(unsigned)rrset->rr_count);
 				return 0;
 			}
-			if(has_answer) {
-				remove_rrset("normalize: removing DNAME redirection after answer:",
-					pkt, msg, prev, &rrset);
-				continue;
-			}
 			if(!synth_cname(sname, snamelen, rrset, alias, 
 				&aliaslen, pkt)) {
 				verbose(VERB_ALGO, "synthesized CNAME "
 					"too long");
-				if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_YXDOMAIN) {
-					prev = rrset;
-					rrset = rrset->rrset_all_next;
-					continue;
-				}
 				return 0;
 			}
-			cname_length++;
 			if(nx && nx->type == LDNS_RR_TYPE_CNAME && 
 			   dname_pkt_compare(pkt, sname, nx->dname) == 0) {
 				/* check next cname */
@@ -575,6 +442,8 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				log_err("out of memory synthesizing CNAME");
 				return 0;
 			}
+			/* FIXME: resolve the conflict between synthesized 
+			 * CNAME ttls and the cache. */
 			rrset = nx;
 			continue;

@@ -591,18 +460,11 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 		if(rrset->type == LDNS_RR_TYPE_CNAME) {
 			struct rrset_parse* nx = rrset->rrset_all_next;
 			uint8_t* oldsname = sname;
-			if(has_answer) {
-				remove_rrset("normalize: removing redirection after answer:",
-					pkt, msg, prev, &rrset);
-				continue;
-			}
-			cname_length++;
 			/* see if the next one is a DNAME, if so, swap them */
 			if(nx && nx->section == LDNS_SECTION_ANSWER &&
 				nx->type == LDNS_RR_TYPE_DNAME &&
 				nx->rr_count == 1 &&
-				pkt_strict_sub(pkt, sname, nx->dname) &&
-				pkt_sub(pkt, nx->dname, zonename)) {
+				pkt_strict_sub(pkt, sname, nx->dname)) {
 				/* there is a DNAME after this CNAME, it 
 				 * is in the ANSWER section, and the DNAME
 				 * applies to the name we cover */
@@ -645,10 +507,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					LDNS_SECTION_ANSWER &&
 					dname_pkt_compare(pkt, oldsname,
 					rrset->dname) == 0) {
-					if(rrset->type == LDNS_RR_TYPE_NS &&
-						rrset->rr_count > env->cfg->iter_scrub_ns) {
-						shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
-					}
 					prev = rrset;
 					rrset = rrset->rrset_all_next;
 				}
@@ -664,17 +522,11 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 			continue;
 		}

-		if(rrset->type == LDNS_RR_TYPE_NS &&
-			rrset->rr_count > env->cfg->iter_scrub_ns) {
-			shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
-		}
-
 		/* Mark the additional names from relevant rrset as OK. */
 		/* only for RRsets that match the query name, other ones
 		 * will be removed by sanitize, so no additional for them */
 		if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) == 0)
 			mark_additional_rrset(pkt, msg, rrset);
-		has_answer = 1;
 		
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
@@ -698,8 +550,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
-		if((int)rrset->rrsig_count > env->cfg->iter_scrub_rrsig)
-			shorten_rrsig(pkt, rrset, env->cfg->iter_scrub_rrsig);
 		/* only one NS set allowed in authority section */
 		if(rrset->type==LDNS_RR_TYPE_NS) {
 			/* NS set must be pertinent to the query */
@@ -721,50 +571,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					"RRset:", pkt, msg, prev, &rrset);
 				continue;
 			}
-			/* If the NS set is a promiscuous NS set, scrub that
-			 * to remove potential for poisonous contents that
-			 * affects other names in the same zone. Remove
-			 * promiscuous NS sets in positive answers, that
-			 * thus have records in the answer section. Nodata
-			 * and nxdomain promiscuous NS sets have been removed
-			 * already. Since the NS rrset is scrubbed, its
-			 * address records are also not marked to be allowed
-			 * and are removed later. */
-			if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR &&
-				msg->an_rrsets != 0 &&
-				env->cfg->iter_scrub_promiscuous) {
-				remove_rrset("normalize: removing promiscuous "
-					"RRset:", pkt, msg, prev, &rrset);
-				continue;
-			}
-			/* Also delete promiscuous NS for other RCODEs */
-			if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR
-				&& env->cfg->iter_scrub_promiscuous) {
-				remove_rrset("normalize: removing promiscuous "
-					"RRset:", pkt, msg, prev, &rrset);
-				continue;
-			}
-			/* Also delete promiscuous NS for NOERROR with nodata
-			 * for authoritative answers, not for delegations.
-			 * NOERROR with an_rrsets!=0 already handled.
-			 * Also NOERROR and soa_in_auth already handled.
-			 * NOERROR with an_rrsets==0, and not a referral.
-			 * referral is (NS not the zonename, noSOA).
-			 */
-			if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR
-				&& msg->an_rrsets == 0
-				&& !(dname_pkt_compare(pkt, rrset->dname,
-				     zonename) != 0 && !soa_in_auth(msg))
-				&& env->cfg->iter_scrub_promiscuous) {
-				remove_rrset("normalize: removing promiscuous "
-					"RRset:", pkt, msg, prev, &rrset);
-				continue;
-			}
-			if(ntohs(rrset->rrset_class) != qinfo->qclass) {
-				remove_rrset("normalize: removing other class "
-					"RRset:", pkt, msg, prev, &rrset);
-				continue;
-			}
 			if(nsset == NULL) {
 				nsset = rrset;
 			} else {
@@ -772,25 +578,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					"RRset:", pkt, msg, prev, &rrset);
 				continue;
 			}
-			if(rrset->rr_count > env->cfg->iter_scrub_ns) {
-				/* If this is not a referral, and the NS RRset
-				 * is signed, then remove it entirely, so
-				 * that when it becomes bogus it does not
-				 * make the message that is otherwise fine
-				 * into a bogus message. */
-				if(!(msg->an_rrsets == 0 &&
-					FLAGS_GET_RCODE(msg->flags) ==
-					LDNS_RCODE_NOERROR &&
-					!soa_in_auth(msg) &&
-					!(msg->flags & BIT_AA)) &&
-					rrset->rrsig_count != 0) {
-					remove_rrset("normalize: removing too large NS "
-						"RRset:", pkt, msg, prev, &rrset);
-					continue;
-				} else {
-					shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
-				}
-			}
 		}
 		/* if this is type DS and we query for type DS we just got
 		 * a referral answer for our type DS query, fix packet */
@@ -810,13 +597,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 			rrset->rrset_all_next = NULL;
 			return 1;
 		}
-		/* Only mark glue as allowed for type NS in the authority
-		 * section. Other RR types do not get glue for them, it
-		 * is allowed from the answer section, but not authority
-		 * so that a message can not have address records cached
-		 * as a side effect to the query. */
-		if(rrset->type==LDNS_RR_TYPE_NS)
-			mark_additional_rrset(pkt, msg, rrset);
+		mark_additional_rrset(pkt, msg, rrset);
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -853,8 +634,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
-		if((int)rrset->rrsig_count > env->cfg->iter_scrub_rrsig)
-			shorten_rrsig(pkt, rrset, env->cfg->iter_scrub_rrsig);
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -1001,24 +780,15 @@ scrub_sanitize_rr_length(sldns_buffer* pkt, struct msg_parse* msg,
 * @param env: module environment with config and cache.
 * @param ie: iterator environment with private address data.
 * @param qstate: for setting errinf for EDE error messages.
- * @param pkt_before_NS: if the packet had type NS before scrub. If that
- *	is removed now, that indicates this may have been lame.
- * @param msg_lame_empty: returned true if the empty packet is lame.
- * @param msg_lame_referral: returned true if the reply has a referral before
- *	scrub.
- * @param rdset: if RD bit was sent in query sent by unbound.
 * @return 0 on error.
 */
 static int
 scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg, 
 	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
-	struct iter_env* ie, struct module_qstate* qstate,
-	int pkt_before_NS, int* msg_lame_empty, int* msg_lame_referral,
-	int rdset)
+	struct iter_env* ie, struct module_qstate* qstate)
 {
 	int del_addi = 0; /* if additional-holding rrsets are deleted, we
 		do not trust the normalized additional-A-AAAA any more */
-	uint8_t* ns_rrset_dname = NULL;
 	int added_rrlen_ede = 0;
 	struct rrset_parse* rrset, *prev;
 	prev = NULL;
@@ -1073,10 +843,8 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 		}

 		/* remove private addresses */
-		if(rrset->type == LDNS_RR_TYPE_A ||
-			rrset->type == LDNS_RR_TYPE_AAAA ||
-			rrset->type == LDNS_RR_TYPE_SVCB ||
-			rrset->type == LDNS_RR_TYPE_HTTPS) {
+		if( (rrset->type == LDNS_RR_TYPE_A || 
+			rrset->type == LDNS_RR_TYPE_AAAA)) {

 			/* do not set servfail since this leads to too
 			 * many drops of other people using rfc1918 space */
@@ -1126,16 +894,6 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 				continue;
 			}
 		}
-		if(rrset->type == LDNS_RR_TYPE_NS &&
-			(rrset->section == LDNS_SECTION_AUTHORITY ||
-			rrset->section == LDNS_SECTION_ANSWER)) {
-			/* If the type is NS, and we're in the
-			 * answer or authority section, then
-			 * store the dname so we can check
-			 * against the glue records
-			 * further down	*/
-			ns_rrset_dname = rrset->dname;
-		}
 		if(del_addi && rrset->section == LDNS_SECTION_ADDITIONAL) {
 			remove_rrset("sanitize: removing potential "
 			"poison reference RRset:", pkt, msg, prev, &rrset);
@@ -1148,44 +906,9 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
-		if(env->cfg->harden_unverified_glue && ns_rrset_dname &&
-			rrset->section == LDNS_SECTION_ADDITIONAL &&
-			(rrset->type == LDNS_RR_TYPE_A || rrset->type == LDNS_RR_TYPE_AAAA) &&
-			!pkt_strict_sub(pkt, rrset->dname, ns_rrset_dname)) {
-			/* We're in the additional section, looking
-			 * at an A/AAAA rrset, have a previous
-			 * delegation point and we notice that
-			 * the glue records are NOT for strict
-			 * subdomains of the delegation. So set a
-			 * flag, recompute the hash for the rrset
-			 * and write the A/AAAA record to cache.
-			 * It'll be retrieved if we can't separately
-			 * resolve the glue	*/
-			rrset->flags = PACKED_RRSET_UNVERIFIED_GLUE;
-			rrset->hash = pkt_hash_rrset(pkt, rrset->dname, rrset->type, rrset->rrset_class, rrset->flags);
-			store_rrset(pkt, msg, env, rrset);
-			remove_rrset("sanitize: storing potential "
-			"unverified glue reference RRset:", pkt, msg, prev, &rrset);
-			continue;
-		}
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
-
-	/* If the packet is empty now, but it was not before. And there
-	 * was type NS in authority, then that indicates the answer is lame. */
-	if(msg->rrset_first == NULL && pkt_before_NS) {
-		*msg_lame_empty = 1;
-		verbose(VERB_ALGO, "sanitize: empty message had referral to NS before, marked as lame");
-	} else if(pkt_before_NS && msg->an_rrsets==0 &&
-		!(msg->flags&BIT_AA) && !rdset) {
-		/* If the packet is now a referral, not really a nodata,
-		 * then if it was also with an empty answer section before,
-		 * it is also lame. */
-		*msg_lame_referral = 1;
-		verbose(VERB_ALGO, "sanitize: message has referral not answer, marked as lame");
-	}
-
 	return 1;
 }

@@ -1193,15 +916,11 @@ int
 scrub_message(sldns_buffer* pkt, struct msg_parse* msg, 
 	struct query_info* qinfo, uint8_t* zonename, struct regional* region,
 	struct module_env* env, struct module_qstate* qstate,
-	struct iter_env* ie, int* msg_lame_empty, int* msg_lame_referral,
-	int rdset)
+	struct iter_env* ie)
 {
-	int pkt_before_NS;
 	/* basic sanity checks */
 	log_nametypeclass(VERB_ALGO, "scrub for", zonename, LDNS_RR_TYPE_NS, 
 		qinfo->qclass);
-	*msg_lame_empty = 0;
-	*msg_lame_referral = 0;
 	if(msg->qdcount > 1)
 		return 0;
 	if( !(msg->flags&BIT_QR) )
@@ -1212,8 +931,7 @@ scrub_message(sldns_buffer* pkt, struct msg_parse* msg,
 	/* this is not required for basic operation but is a forgery 
 	 * resistance (security) feature */
 	if((FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR ||
-		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN ||
-		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_YXDOMAIN) &&
+		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN) &&
 		msg->qdcount == 0)
 		return 0;

@@ -1226,21 +944,11 @@ scrub_message(sldns_buffer* pkt, struct msg_parse* msg,
 			return 0;
 	}

-	/* If the packet contains type NS in authority before scrub,
-	 * like a self referral. With the answer section empty, it
-	 * was not AA, the query was not sent with RD, with NS in auth,
-	 * and no SOA in auth. For a negative answer, type SOA is present.
-	 * This detects certain lameness if after has removed that. */
-	pkt_before_NS = msg->an_rrsets == 0 &&
-		!(msg->flags&BIT_AA) && !rdset &&
-		pkt_contains_ns(msg) && !soa_in_auth(msg);
-
 	/* normalize the response, this cleans up the additional.  */
-	if(!scrub_normalize(pkt, msg, qinfo, region, env, zonename))
+	if(!scrub_normalize(pkt, msg, qinfo, region, env))
 		return 0;
 	/* delete all out-of-zone information */
-	if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie, qstate,
-		pkt_before_NS, msg_lame_empty, msg_lame_referral, rdset))
+	if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie, qstate))
 		return 0;
 	return 1;
 }
@@ -62,16 +62,11 @@ struct module_qstate;
 * @param env: module environment with config settings and cache. 
 * @param qstate: for setting errinf for EDE error messages.
 * @param ie: iterator module environment data.
- * @param msg_lame_empty: returned true if the empty packet is lame.
- * @param msg_lame_referral: returned true if the reply has a referral before
- *	scrub.
- * @param rdset: if RD bit was sent in query sent by unbound.
 * @return: false if the message is total waste. true if scrubbed with success.
 */
 int scrub_message(struct sldns_buffer* pkt, struct msg_parse* msg, 
 	struct query_info* qinfo, uint8_t* zonename, struct regional* regional,
 	struct module_env* env, struct module_qstate* qstate,
-	struct iter_env* ie, int* msg_lame_empty, int* msg_lame_referral,
-	int rdset);
+	struct iter_env* ie);

 #endif /* ITERATOR_ITER_SCRUB_H */
@@ -77,73 +77,41 @@
 static const char DEFAULT_NAT64_PREFIX[] = "64:ff9b::/96";

 /** fillup fetch policy array */
-static int
-fetch_fill(int* target_fetch_policy, int max_dependency_depth, const char* str)
+static void
+fetch_fill(struct iter_env* ie, const char* str)
 {
 	char* s = (char*)str, *e;
 	int i;
-	for(i=0; i<max_dependency_depth+1; i++) {
-		target_fetch_policy[i] = strtol(s, &e, 10);
-		if(s == e) {
-			log_err("cannot parse fetch policy number %s", s);
-			return 0;
-		}
+	for(i=0; i<ie->max_dependency_depth+1; i++) {
+		ie->target_fetch_policy[i] = strtol(s, &e, 10);
+		if(s == e)
+			fatal_exit("cannot parse fetch policy number %s", s);
 		s = e;
 	}
-	return 1;
 }

 /** Read config string that represents the target fetch policy */
-int
-read_fetch_policy(int** target_fetch_policy, int* max_dependency_depth,
-	const char* str)
+static int
+read_fetch_policy(struct iter_env* ie, const char* str)
 {
 	int count = cfg_count_numbers(str);
 	if(count < 1) {
 		log_err("Cannot parse target fetch policy: \"%s\"", str);
 		return 0;
 	}
-	*max_dependency_depth = count - 1;
-	*target_fetch_policy = (int*)calloc(
-		(size_t)(*max_dependency_depth)+1, sizeof(int));
-	if(!*target_fetch_policy) {
+	ie->max_dependency_depth = count - 1;
+	ie->target_fetch_policy = (int*)calloc(
+		(size_t)ie->max_dependency_depth+1, sizeof(int));
+	if(!ie->target_fetch_policy) {
 		log_err("alloc fetch policy: out of memory");
 		return 0;
 	}
-	if(!fetch_fill(*target_fetch_policy, *max_dependency_depth, str))
-		return 0;
+	fetch_fill(ie, str);
 	return 1;
 }

-struct rbtree_type*
-caps_white_create(void)
-{
-	struct rbtree_type* caps_white = rbtree_create(name_tree_compare);
-	if(!caps_white)
-		log_err("out of memory");
-	return caps_white;
-}
-
-/** delete caps_whitelist element */
-static void
-caps_free(struct rbnode_type* n, void* ATTR_UNUSED(d))
-{
-	if(n) {
-		free(((struct name_tree_node*)n)->name);
-		free(n);
-	}
-}
-
-void
-caps_white_delete(struct rbtree_type* caps_white)
-{
-	if(!caps_white)
-		return;
-	traverse_postorder(caps_white, caps_free, NULL);
-	free(caps_white);
-}
-
-int
+/** apply config caps whitelist items to name tree */
+static int
 caps_white_apply_cfg(rbtree_type* ntree, struct config_file* cfg)
 {
 	struct config_strlist* p;
@@ -176,42 +144,13 @@ caps_white_apply_cfg(rbtree_type* ntree, struct config_file* cfg)
 	return 1;
 }

-int
-nat64_apply_cfg(struct iter_nat64* nat64, struct config_file* cfg)
-{
-	const char *nat64_prefix;
-
-	nat64_prefix = cfg->nat64_prefix;
-	if(!nat64_prefix)
-		nat64_prefix = cfg->dns64_prefix;
-	if(!nat64_prefix)
-		nat64_prefix = DEFAULT_NAT64_PREFIX;
-	if(!netblockstrtoaddr(nat64_prefix, 0, &nat64->nat64_prefix_addr,
-		&nat64->nat64_prefix_addrlen, &nat64->nat64_prefix_net)) {
-		log_err("cannot parse nat64-prefix netblock: %s", nat64_prefix);
-		return 0;
-	}
-	if(!addr_is_ip6(&nat64->nat64_prefix_addr,
-		nat64->nat64_prefix_addrlen)) {
-		log_err("nat64-prefix is not IPv6: %s", cfg->nat64_prefix);
-		return 0;
-	}
-	if(!prefixnet_is_nat64(nat64->nat64_prefix_net)) {
-		log_err("nat64-prefix length it not 32, 40, 48, 56, 64 or 96: %s",
-			nat64_prefix);
-		return 0;
-	}
-	nat64->use_nat64 = cfg->do_nat64;
-	return 1;
-}
-
 int
 iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 {
+	const char *nat64_prefix;
 	int i;
 	/* target fetch policy */
-	if(!read_fetch_policy(&iter_env->target_fetch_policy,
-		&iter_env->max_dependency_depth, cfg->target_fetch_policy))
+	if(!read_fetch_policy(iter_env, cfg->target_fetch_policy))
 		return 0;
 	for(i=0; i<iter_env->max_dependency_depth+1; i++)
 		verbose(VERB_QUERY, "target fetch policy for level %d is %d",
@@ -231,7 +170,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 	}
 	if(cfg->caps_whitelist) {
 		if(!iter_env->caps_white)
-			iter_env->caps_white = caps_white_create();
+			iter_env->caps_white = rbtree_create(name_tree_compare);
 		if(!iter_env->caps_white || !caps_white_apply_cfg(
 			iter_env->caps_white, cfg)) {
 			log_err("Could not set capsforid whitelist");
@@ -240,22 +179,38 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)

 	}

-	if(!nat64_apply_cfg(&iter_env->nat64, cfg)) {
-		log_err("Could not setup nat64");
+	nat64_prefix = cfg->nat64_prefix;
+	if(!nat64_prefix)
+		nat64_prefix = cfg->dns64_prefix;
+	if(!nat64_prefix)
+		nat64_prefix = DEFAULT_NAT64_PREFIX;
+	if(!netblockstrtoaddr(nat64_prefix, 0, &iter_env->nat64_prefix_addr,
+		&iter_env->nat64_prefix_addrlen,
+		&iter_env->nat64_prefix_net)) {
+		log_err("cannot parse nat64-prefix netblock: %s", nat64_prefix);
+		return 0;
+	}
+	if(!addr_is_ip6(&iter_env->nat64_prefix_addr,
+		iter_env->nat64_prefix_addrlen)) {
+		log_err("nat64-prefix is not IPv6: %s", cfg->nat64_prefix);
+		return 0;
+	}
+	if(!prefixnet_is_nat64(iter_env->nat64_prefix_net)) {
+		log_err("nat64-prefix length it not 32, 40, 48, 56, 64 or 96: %s",
+			nat64_prefix);
 		return 0;
 	}

 	iter_env->supports_ipv6 = cfg->do_ip6;
 	iter_env->supports_ipv4 = cfg->do_ip4;
+	iter_env->use_nat64 = cfg->do_nat64;
 	iter_env->outbound_msg_retry = cfg->outbound_msg_retry;
 	iter_env->max_sent_count = cfg->max_sent_count;
 	iter_env->max_query_restarts = cfg->max_query_restarts;
 	return 1;
 }

-/** filter out unsuitable targets.
- * Applies NAT64 if needed as well by replacing the IPv4 with the synthesized
- * IPv6 address.
+/** filter out unsuitable targets
 * @param iter_env: iterator environment with ipv6-support flag.
 * @param env: module environment with infra cache.
 * @param name: zone name
@@ -308,52 +263,17 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	if(a->bogus)
 		return -1; /* address of server is bogus */
 	if(donotq_lookup(iter_env->donotq, &a->addr, a->addrlen)) {
-		if(iter_env->nat64.use_nat64 &&
-			addr_is_ip6(&a->addr, a->addrlen) &&
-			a->addrlen == iter_env->nat64.nat64_prefix_addrlen &&
-			addr_in_common(&a->addr, 128,
-				&iter_env->nat64.nat64_prefix_addr,
-				iter_env->nat64.nat64_prefix_net,
-				iter_env->nat64.nat64_prefix_addrlen) ==
-				iter_env->nat64.nat64_prefix_net) {
-			/* The NAT64 is enabled, and address is IPv6, it is
-			 * in the NAT64 prefix. It is allowed.
-			 * So that in an IPv6-only cluster without internet
-			 * access, that makes the NAT64 translation continue
-			 * to work. The NAT64 prefix is allowed. */
-			/* Otherwise, after a timeout, the already NAT64
-			 * translated address would be treated differently,
-			 * and that causes confusion. */
-			log_addr(VERB_ALGO, "the addr is on the donotquery "
-				"list, but allowed because it is NAT64",
-				&a->addr, a->addrlen);
-		} else {
-			log_addr(VERB_ALGO, "skip addr on the donotquery list",
-				&a->addr, a->addrlen);
-			return -1; /* server is on the donotquery list */
-		}
+		log_addr(VERB_ALGO, "skip addr on the donotquery list",
+			&a->addr, a->addrlen);
+		return -1; /* server is on the donotquery list */
 	}
 	if(!iter_env->supports_ipv6 && addr_is_ip6(&a->addr, a->addrlen)) {
 		return -1; /* there is no ip6 available */
 	}
-	if(!iter_env->supports_ipv4 && !iter_env->nat64.use_nat64 &&
+	if(!iter_env->supports_ipv4 && !iter_env->use_nat64 &&
 	   !addr_is_ip6(&a->addr, a->addrlen)) {
 		return -1; /* there is no ip4 available */
 	}
-	if(iter_env->nat64.use_nat64 && !addr_is_ip6(&a->addr, a->addrlen)) {
-		struct sockaddr_storage real_addr;
-		socklen_t real_addrlen;
-		addr_to_nat64(&a->addr, &iter_env->nat64.nat64_prefix_addr,
-			iter_env->nat64.nat64_prefix_addrlen,
-			iter_env->nat64.nat64_prefix_net,
-			&real_addr, &real_addrlen);
-		log_name_addr(VERB_QUERY, "NAT64 apply: from: ",
-			name, &a->addr, a->addrlen);
-		log_name_addr(VERB_QUERY, "NAT64 apply:   to: ",
-			name, &real_addr, real_addrlen);
-		a->addr = real_addr;
-		a->addrlen = real_addrlen;
-	}
 	/* check lameness - need zone , class info */
 	if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen,
 		name, namelen, qtype, &lame, &dnsseclame, &reclame,
@@ -773,11 +693,10 @@ dns_copy_msg(struct dns_msg* from, struct regional* region)
 void
 iter_dns_store(struct module_env* env, struct query_info* msgqinf,
 	struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
-	struct regional* region, uint16_t flags, time_t qstarttime,
-	int is_valrec)
+	struct regional* region, uint16_t flags, time_t qstarttime)
 {
 	if(!dns_cache_store(env, msgqinf, msgrep, is_referral, leeway,
-		pside, region, flags, qstarttime, is_valrec))
+		pside, region, flags, qstarttime))
 		log_err("out of memory: cannot store data in cache");
 }

@@ -1313,8 +1232,7 @@ iter_lookup_parent_NS_from_cache(struct module_env* env, struct delegpt* dp,
 		log_rrset_key(VERB_ALGO, "found parent-side NS in cache", akey);
 		dp->has_parent_side_NS = 1;
 		/* and mark the new names as lame */
-		if(!delegpt_rrset_add_ns(dp, region, akey, 1,
-			deleg_port_number(env))) {
+		if(!delegpt_rrset_add_ns(dp, region, akey, 1)) {
 			lock_rw_unlock(&akey->entry.lock);
 			return 0;
 		}
@@ -1549,11 +1467,6 @@ iter_stub_fwd_no_cache(struct module_qstate *qstate, struct query_info *qinf,
 	struct delegpt *dp;
 	int nolock = 1;

-	log_assert((retdpname && retdpnamelen
-		&& dpname_storage && dpname_storage_len > 0) ||
-		(retdpname == NULL && retdpnamelen == NULL
-		 && dpname_storage == NULL && dpname_storage_len == 0));
-
 	/* Check for stub. */
 	/* Lock both forwards and hints for atomic read. */
 	lock_rw_rdlock(&qstate->env->fwds->lock);
@@ -1575,15 +1488,14 @@ iter_stub_fwd_no_cache(struct module_qstate *qstate, struct query_info *qinf,

 	/* check stub */
 	if (stub != NULL && stub->dp != NULL) {
-		enum verbosity_value level = VERB_ALGO;
 		int stub_no_cache = stub->dp->no_cache;
 		lock_rw_unlock(&qstate->env->fwds->lock);
-		if(verbosity >= level && stub_no_cache) {
-			char qname[LDNS_MAX_DOMAINLEN];
-			char dpname[LDNS_MAX_DOMAINLEN];
+		if(stub_no_cache) {
+			char qname[255+1];
+			char dpname[255+1];
 			dname_str(qinf->qname, qname);
 			dname_str(stub->dp->name, dpname);
-			verbose(level, "stub for %s %s has no_cache", qname, dpname);
+			verbose(VERB_ALGO, "stub for %s %s has no_cache", qname, dpname);
 		}
 		if(retdpname) {
 			if(stub->dp->namelen > dpname_storage_len) {
@@ -1604,15 +1516,14 @@ iter_stub_fwd_no_cache(struct module_qstate *qstate, struct query_info *qinf,

 	/* Check for forward. */
 	if (dp) {
-		enum verbosity_value level = VERB_ALGO;
 		int dp_no_cache = dp->no_cache;
 		lock_rw_unlock(&qstate->env->hints->lock);
-		if(verbosity >= level && dp_no_cache) {
-			char qname[LDNS_MAX_DOMAINLEN];
-			char dpname[LDNS_MAX_DOMAINLEN];
+		if(dp_no_cache) {
+			char qname[255+1];
+			char dpname[255+1];
 			dname_str(qinf->qname, qname);
 			dname_str(dp->name, dpname);
-			verbose(level, "forward for %s %s has no_cache", qname, dpname);
+			verbose(VERB_ALGO, "forward for %s %s has no_cache", qname, dpname);
 		}
 		if(retdpname) {
 			if(dp->namelen > dpname_storage_len) {
@@ -1653,62 +1564,3 @@ void iterator_set_ip46_support(struct module_stack* mods,
 	if(outnet->num_ip6 == 0)
 		ie->supports_ipv6 = 0;
 }
-
-void
-limit_nsec_ttl(struct dns_msg* msg)
-{
-	/* Limit NSEC and NSEC3 TTL in response, RFC9077 */
-	size_t i;
-	int found = 0;
-	time_t soa_ttl = 0;
-	/* Limit the NSEC and NSEC3 TTL values to the SOA TTL and SOA minimum
-	 * TTL. That has already been applied to the SOA record ttl. */
-	for(i=0; i<msg->rep->rrset_count; i++) {
-		struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
-		if(ntohs(s->rk.type) == LDNS_RR_TYPE_SOA) {
-			struct packed_rrset_data* soadata = (struct packed_rrset_data*)s->entry.data;
-			found = 1;
-			soa_ttl = soadata->ttl;
-			break;
-		}
-	}
-	if(!found)
-		return;
-	for(i=0; i<msg->rep->rrset_count; i++) {
-		struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
-		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC ||
-			ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
-			struct packed_rrset_data* data = (struct packed_rrset_data*)s->entry.data;
-			/* Limit the negative TTL. */
-			if(data->ttl > soa_ttl) {
-				if(verbosity >= VERB_ALGO) {
-					char buf[256];
-					snprintf(buf, sizeof(buf),
-						"limiting TTL %d of %s record to the SOA TTL of %d for",
-						(int)data->ttl, ((ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC)?"NSEC":"NSEC3"), (int)soa_ttl);
-					log_nametypeclass(VERB_ALGO, buf,
-						s->rk.dname, ntohs(s->rk.type),
-						ntohs(s->rk.rrset_class));
-				}
-				data->ttl = soa_ttl;
-			}
-		}
-	}
-}
-
-void
-iter_make_minimal(struct reply_info* rep)
-{
-	size_t rem = rep->ns_numrrsets + rep->ar_numrrsets;
-	rep->ns_numrrsets = 0;
-	rep->ar_numrrsets = 0;
-	rep->rrset_count -= rem;
-}
-
-int
-deleg_port_number(struct module_env* env)
-{
-	if(env->cfg->ssl_upstream)
-		return env->cfg->ssl_port;
-	return -1;
-}
@@ -61,7 +61,6 @@ struct sock_list;
 struct ub_packed_rrset_key;
 struct module_stack;
 struct outside_network;
-struct iter_nat64;

 /* max number of lookups in the cache for target nameserver names.
 * This stops, for large delegations, N*N lookups in the cache. */
@@ -84,7 +83,6 @@ int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);
 /**
 * Select a valid, nice target to send query to.
 * Sorting and removing unsuitable targets is combined.
- * Adds records to the infra cache if not already there.
 *
 * @param iter_env: iterator module global state, with ip6 enabled and 
 *	do-not-query-addresses.
@@ -144,7 +142,6 @@ struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);
 * @param region: to copy modified (cache is better) rrs back to.
 * @param flags: with BIT_CD for dns64 AAAA translated queries.
 * @param qstarttime: time of query start.
- * @param is_valrec: if the query is validation recursion and does not get
 * return void, because we are not interested in alloc errors,
 * 	the iterator and validator can operate on the results in their
 * 	scratch space (the qstate.region) and are not dependent on the cache.
@@ -153,8 +150,7 @@ struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);
 */
 void iter_dns_store(struct module_env* env, struct query_info* qinf,
 	struct reply_info* rep, int is_referral, time_t leeway, int pside,
-	struct regional* region, uint16_t flags, time_t qstarttime,
-	int is_valrec);
+	struct regional* region, uint16_t flags, time_t qstarttime);

 /**
 * Select randomly with n/m probability.
@@ -432,58 +428,4 @@ int iter_stub_fwd_no_cache(struct module_qstate *qstate,
 void iterator_set_ip46_support(struct module_stack* mods,
 	struct module_env* env, struct outside_network* outnet);

-/**
- * Read config string that represents the target fetch policy.
- * @param target_fetch_policy: alloced on return.
- * @param max_dependency_depth: set on return.
- * @param str: the config string
- * @return false on failure.
- */
-int read_fetch_policy(int** target_fetch_policy, int* max_dependency_depth,
-	const char* str);
-
-/**
- * Create caps exempt data structure.
- * @return NULL on failure.
- */
-struct rbtree_type* caps_white_create(void);
-
-/**
- * Delete caps exempt data structure.
- * @param caps_white: caps exempt tree.
- */
-void caps_white_delete(struct rbtree_type* caps_white);
-
-/**
- * Apply config caps whitelist items to name tree
- * @param ntree: caps exempt tree.
- * @param cfg: config with options.
- */
-int caps_white_apply_cfg(struct rbtree_type* ntree, struct config_file* cfg);
-
-/**
- * Apply config for nat64
- * @param nat64: the nat64 state.
- * @param cfg: config with options.
- * @return false on failure.
- */
-int nat64_apply_cfg(struct iter_nat64* nat64, struct config_file* cfg);
-
-/**
- * Limit NSEC and NSEC3 TTL in response, RFC9077
- * @param msg: dns message, the SOA record ttl is used to restrict ttls
- *	of NSEC and NSEC3 RRsets. If no SOA record, nothing happens.
- */
-void limit_nsec_ttl(struct dns_msg* msg);
-
-/**
- * Make the response minimal. Removed authority and additional section,
- * that works when there is an answer in the answer section.
- * @param rep: reply to modify.
- */
-void iter_make_minimal(struct reply_info* rep);
-
-/** See if we need a different port number */
-int deleg_port_number(struct module_env* env);
-
 #endif /* ITERATOR_ITER_UTILS_H */
@@ -46,6 +46,8 @@
 #include "util/data/msgreply.h"
 #include "util/module.h"
 struct delegpt;
+struct iter_hints;
+struct iter_forwards;
 struct iter_donotq;
 struct iter_prep_list;
 struct iter_priv;
@@ -53,9 +55,6 @@ struct rbtree_type;

 /** max number of targets spawned for a query and its subqueries */
 #define MAX_TARGET_COUNT	64
-/** max number of upstream queries for a query and its subqueries, it is
- * never reset. */
-extern int MAX_GLOBAL_QUOTA;
 /** max number of target lookups per qstate, per delegation point */
 #define MAX_DP_TARGET_COUNT	16
 /** max number of nxdomains allowed for target lookups for a query and
@@ -104,28 +103,6 @@ extern int BLACKLIST_PENALTY;
 #define RTT_BAND 400
 /** Number of retries for empty nodata packets before it is accepted. */
 #define EMPTY_NODATA_RETRY_COUNT 2
-/** max label-strip iterations in DSNS_FIND_STATE (RFC 4035 4.2 parent-NS
- * search) before giving up; bounds upstream NS sends per client DS.
- * Means the max number of labels in grandchild to the grandparent zone that
- * are co-hosted. */
-#define MAX_DSNS_FIND_COUNT    20
-
-/**
- * Iterator global state for nat64.
- */
-struct iter_nat64 {
-	/** A flag to locally apply NAT64 to make IPv4 addrs into IPv6 */
-	int use_nat64;
-
-	/** NAT64 prefix address, cf. dns64_env->prefix_addr */
-	struct sockaddr_storage nat64_prefix_addr;
-
-	/** sizeof(sockaddr_in6) */
-	socklen_t nat64_prefix_addrlen;
-
-	/** CIDR mask length of NAT64 prefix */
-	int nat64_prefix_net;
-};

 /**
 * Global state for the iterator.
@@ -137,8 +114,17 @@ struct iter_env {
 	/** A flag to indicate whether or not we have an IPv4 route */
 	int supports_ipv4;

-	/** State for nat64 */
-	struct iter_nat64 nat64;
+	/** A flag to locally apply NAT64 to make IPv4 addrs into IPv6 */
+	int use_nat64;
+
+	/** NAT64 prefix address, cf. dns64_env->prefix_addr */
+	struct sockaddr_storage nat64_prefix_addr;
+
+	/** sizeof(sockaddr_in6) */
+	socklen_t nat64_prefix_addrlen;
+
+	/** CIDR mask length of NAT64 prefix */
+	int nat64_prefix_net;

 	/** A set of inetaddrs that should never be queried. */
 	struct iter_donotq* donotq;
@@ -262,9 +248,6 @@ enum target_count_variables {
 	TARGET_COUNT_QUERIES,
 	/** Number of nxdomain responses encountered. */
 	TARGET_COUNT_NX,
-	/** Global quota on number of queries to upstream servers per
-	 * client request, that is never reset. */
-	TARGET_COUNT_GLOBAL_QUOTA,

 	/** This should stay last here, it is used for the allocation */
 	TARGET_COUNT_MAX,
@@ -380,10 +363,6 @@ struct iter_qstate {
 	/** if true, already tested for ratelimiting and passed the test */
 	int ratelimit_ok;

-	/** If the last query, that may be a referral, incremented the
-	 * ratelimit counter. */
-	int ratelimit_incremented;
-
 	/**
 	 * The query must store NS records from referrals as parentside RRs
 	 * Enabled once it hits resolution problems, to throttle retries.
@@ -408,8 +387,6 @@ struct iter_qstate {
 	uint8_t* dsns_point;
 	/** length of the dname in dsns_point */
 	size_t dsns_point_len;
-	/** number of label-strip iterations performed in DSNS_FIND_STATE */
-	int dsns_count;

 	/** 
 	 * expected dnssec information for this iteration step. 
@@ -445,13 +422,6 @@ struct iter_qstate {
 	 * already so that it is accepted later. */
 	int empty_nodata_found;

-	/** Store if the answer was empty, but lame, before it became empty.*/
-	int msg_lame_empty;
-
-	/** Store if the answer was a referral, to self, before scrub. So the
-	 * it is not some sort of answer. */
-	int msg_lame_referral;
-
 	/** list of pending queries to authoritative servers. */
 	struct outbound_list outlist;

@@ -461,6 +431,12 @@ struct iter_qstate {
 	/** State for capsfail: QNAME minimisation state for comparisons. */
 	enum minimisation_state caps_minimisation_state;

+    //DELEG added code
+    int deleg_state;
+    uint8_t* deleg_original_qname;
+    size_t deleg_original_qname_len;
+    uint16_t original_query;
+
 	/**
 	 * The query info that is sent upstream. Will be a subset of qchase
 	 * when qname minimisation is enabled.
@@ -1,49 +0,0 @@
-/*
- * libunbound/authload.h - prototypes for auth load methods.
- *
- * Copyright (c) 2026, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file declares the methods that must be implemented to use the
- * auth load service.
- */
-
-#ifndef LIBUNBOUND_AUTHLOAD_H
-#define LIBUNBOUND_AUTHLOAD_H
-
-/** The worker routine that services the auth load connection. */
-void worker_auth_load_service_cb(int fd, short bits, void* arg);
-
-#endif /* LIBUNBOUND_AUTHLOAD_H */
@@ -75,9 +75,7 @@ context_finalize(struct ub_ctx* ctx)
 	ctx->pipe_pid = getpid();
 	cfg_apply_local_port_policy(cfg, 65536);
 	config_apply(cfg);
-	if(!modstack_call_startup(&ctx->mods, cfg->module_conf, ctx->env))
-		return UB_INITFAIL;
-	if(!modstack_call_init(&ctx->mods, cfg->module_conf, ctx->env))
+	if(!modstack_setup(&ctx->mods, cfg->module_conf, ctx->env))
 		return UB_INITFAIL;
 	listen_setup_locks();
 	log_edns_known_options(VERB_ALGO, ctx->env);
@@ -395,7 +393,7 @@ context_serialize_cancel(struct ctx_query* q, uint32_t* len)
 	/* format of cancel:
 	 * 	o uint32 cmd
 	 * 	o uint32 async-id */
-	uint8_t* p = (uint8_t*)reallocarray(NULL, 2, sizeof(uint32_t));
+	uint8_t* p = (uint8_t*)reallocarray(NULL, sizeof(uint32_t), 2);
 	if(!p) return NULL;
 	*len = 2*sizeof(uint32_t);
 	sldns_write_uint32(p, UB_LIBCMD_CANCEL);
@@ -167,8 +167,6 @@ struct ctx_query {
        ub_event_callback_type cb_event;
 	/** for async query, the callback user arg */
 	void* cb_arg;
-	/** for async query the unique info */
-	void* unique_info;

 	/** answer message, result from resolver lookup. */
 	uint8_t* msg;
@@ -188,9 +188,7 @@ ub_ctx_create(void)
 		int e = errno;
 		ub_randfree(ctx->seed_rnd);
 		config_delete(ctx->env->cfg);
-		modstack_call_deinit(&ctx->mods, ctx->env);
-		modstack_call_destartup(&ctx->mods, ctx->env);
-		modstack_free(&ctx->mods);
+		modstack_desetup(&ctx->mods, ctx->env);
 		listen_desetup_locks();
 		edns_known_options_delete(ctx->env);
 		edns_strings_delete(ctx->env->edns_strings);
@@ -204,9 +202,7 @@ ub_ctx_create(void)
 		tube_delete(ctx->qq_pipe);
 		ub_randfree(ctx->seed_rnd);
 		config_delete(ctx->env->cfg);
-		modstack_call_deinit(&ctx->mods, ctx->env);
-		modstack_call_destartup(&ctx->mods, ctx->env);
-		modstack_free(&ctx->mods);
+		modstack_desetup(&ctx->mods, ctx->env);
 		listen_desetup_locks();
 		edns_known_options_delete(ctx->env);
 		edns_strings_delete(ctx->env->edns_strings);
@@ -364,9 +360,7 @@ ub_ctx_delete(struct ub_ctx* ctx)
 	}
 	libworker_delete_event(ctx->event_worker);

-	modstack_call_deinit(&ctx->mods, ctx->env);
-	modstack_call_destartup(&ctx->mods, ctx->env);
-	modstack_free(&ctx->mods);
+	modstack_desetup(&ctx->mods, ctx->env);
 	a = ctx->alloc_list;
 	while(a) {
 		na = a->super;
@@ -571,8 +565,6 @@ ub_ctx_async(struct ub_ctx* ctx, int dothread)
 int 
 ub_poll(struct ub_ctx* ctx)
 {
-	if(!ctx || ctx->event_base)
-		return UB_INITFAIL;
 	/* no need to hold lock while testing for readability. */
 	return tube_poll(ctx->rr_pipe);
 }
@@ -580,8 +572,6 @@ ub_poll(struct ub_ctx* ctx)
 int 
 ub_fd(struct ub_ctx* ctx)
 {
-	if(!ctx || ctx->event_base)
-		return -1;
 	return tube_read_fd(ctx->rr_pipe);
 }

@@ -676,8 +666,6 @@ ub_process(struct ub_ctx* ctx)
 	int r;
 	uint8_t* msg;
 	uint32_t len;
-	if(!ctx || ctx->event_base)
-		return UB_INITFAIL;
 	while(1) {
 		msg = NULL;
 		lock_basic_lock(&ctx->rrpipe_lock);
@@ -706,8 +694,6 @@ ub_wait(struct ub_ctx* ctx)
 	int r;
 	uint8_t* msg;
 	uint32_t len;
-	if(!ctx || ctx->event_base)
-		return UB_INITFAIL;
 	/* this is basically the same loop as _process(), but with changes.
 	 * holds the rrpipe lock and waits with tube_wait */
 	while(1) {
@@ -845,8 +831,6 @@ ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype,
 	struct ctx_query* q;
 	uint8_t* msg = NULL;
 	uint32_t len = 0;
-	if(!ctx || ctx->event_base)
-		return UB_INITFAIL;

 	if(async_id)
 		*async_id = 0;
@@ -1477,15 +1461,8 @@ ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base) {
 	
 	lock_basic_lock(&ctx->cfglock);
 	/* destroy the current worker - safe to pass in NULL */
-
-	/* Unlock the cfglock during libworker_delete_event, since it
-	 * calls context_release_alloc, that wants to lock cfglock again.
-	 * Since the event base is used from one thread, the one that
-	 * called this function, it is safe to do so. */
-	lock_basic_unlock(&ctx->cfglock);
 	libworker_delete_event(ctx->event_worker);
 	ctx->event_worker = NULL;
-	lock_basic_lock(&ctx->cfglock);
 	new_base = ub_libevent_event_base(base);
 	if (new_base)
 		ctx->event_base = new_base;	
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Philip Homburg	4d384333ae	Switch from SVCB to IDELEG(65280)	2025-01-17 15:31:51 +01:00
jessevz	c3c54f04b4	Cleaned up the code	2024-07-12 15:05:12 +02:00
jessevz	fe919666ac	Fixed memory error	2024-07-12 10:34:03 +02:00
jessevz	35847e3be1	added _deleg query to apex to check if deleg capable	2024-06-20 16:21:36 +02:00
jessevz	6fe6f673ad	Fixed bug where lame delegation was returned	2024-06-20 12:46:03 +02:00
jessevz	c6ce5d9652	Works now for every situation	2024-06-19 16:02:38 +02:00
jessevz	b8607195b0	Can now query for stuff that is not at apex	2024-06-19 14:35:09 +02:00
jessevz	98b899608e	made deleg work with all resource records (not only A records)	2024-06-19 12:28:44 +02:00
jessevz	8f51ec4ce2	made _deleg work when multiple _deleg domains need to be tracked	2024-06-18 15:54:54 +02:00
jessevz	d050ff923e	rewrote some logic	2024-06-13 11:41:04 +02:00
jessevz	3c347e345c	changed malloc to regional allocs	2024-06-13 10:40:03 +02:00
jessevz	42b7ce9c41	Made a first rough working version for _deleg	2024-06-13 10:04:37 +02:00
jessevz	011c5a0e0f	Made it possible to change queries into _deleg queries	2024-06-12 09:26:32 +02:00