Shumon's invalid query type EDE return

2026-08-17 21:25:50 +02:00 · 2024-07-25 19:29:09 -07:00
150 changed files with 624 additions and 17454 deletions
@@ -161,33 +161,6 @@ jobs:
            test_windows: "yes"
            config: "no"
            make: "no"
-          - name: FreeBSD
-            os: ubuntu-latest
-            config: "no"
-            make: "no"
-            with_cross_platform_action: "yes"
-            cross_platform_os: "freebsd"
-            cross_platform_arch: "x86-64"
-            cross_platform_version: "14.1"
-            cross_platform_config: "--enable-debug --disable-flto --with-libevent --disable-static"
-          - name: OpenBSD
-            os: ubuntu-latest
-            config: "no"
-            make: "no"
-            with_cross_platform_action: "yes"
-            cross_platform_os: "openbsd"
-            cross_platform_arch: "x86-64"
-            cross_platform_version: "7.5"
-            cross_platform_config: "--enable-debug --disable-flto --with-libevent --disable-static"
-          - name: NetBSD
-            os: ubuntu-latest
-            config: "no"
-            make: "no"
-            with_cross_platform_action: "yes"
-            cross_platform_os: "netbsd"
-            cross_platform_arch: "x86-64"
-            cross_platform_version: "10.0"
-            cross_platform_config: "--enable-debug --disable-flto --with-libevent --disable-static"
 
    steps:
      - uses: actions/checkout@v4
@@ -358,33 +331,6 @@ jobs:
          echo "::group::make install"
          make install
          echo "::endgroup::"
-      - name: cross-platform-action on ${{ matrix.cross_platform_os }} ${{ matrix.cross_platform_version }}
-        if: ${{ matrix.with_cross_platform_action == 'yes' }}
-        uses: cross-platform-actions/action@v0.25.0
-        env:
-          CROSS_PLATFORM_OS: ${{ matrix.cross_platform_os }}
-        with:
-          environment_variables: CROSS_PLATFORM_OS
-          operating_system: ${{ matrix.cross_platform_os }}
-          architecture: ${{ matrix.cross_platform_arch }}
-          version: ${{ matrix.cross_platform_version }}
-          shell: bash
-          memory: 4G
-          cpu_count: 2
-          run: |
-            set -e -x
-            if test "$CROSS_PLATFORM_OS" = "freebsd"; then sudo pkg install -y openssl libevent expat; fi
-            if test "$CROSS_PLATFORM_OS" = "openbsd"; then sudo pkg_add libevent; fi
-            if test "$CROSS_PLATFORM_OS" = "netbsd"; then sudo pkgin -y install libevent; fi
-            echo "::group::configure"
-            ./configure ${{ matrix.cross_platform_config }}
-            echo "::endgroup::"
-            echo "::group::make"
-            make
-            echo "::endgroup::"
-            echo "::group::make test"
-            make test
-            echo "::endgroup::"
      - name: install libevent
        if: ${{ matrix.install_libevent == 'yes' }}
        run: sudo apt-get install libevent-dev
@@ -36,7 +36,6 @@
 /asynclook
 /delayer
 /dohclient
-/doqclient
 /lock-verify
 /memstats
 /perf
@@ -179,11 +179,11 @@ testcode/unitlruhash.c testcode/unitmain.c testcode/unitmsgparse.c \
 testcode/unitneg.c testcode/unitregional.c testcode/unitslabhash.c \
 testcode/unitverify.c testcode/readhex.c testcode/testpkts.c testcode/unitldns.c \
 testcode/unitecs.c testcode/unitauth.c testcode/unitzonemd.c \
-testcode/unittcpreuse.c testcode/unitdoq.c
+testcode/unittcpreuse.c
 UNITTEST_OBJ=unitanchor.lo unitdname.lo unitlruhash.lo unitmain.lo \
 unitmsgparse.lo unitneg.lo unitregional.lo unitslabhash.lo unitverify.lo \
 readhex.lo testpkts.lo unitldns.lo unitecs.lo unitauth.lo unitzonemd.lo \
-unittcpreuse.lo unitdoq.lo
+unittcpreuse.lo
 UNITTEST_OBJ_LINK=$(UNITTEST_OBJ) worker_cb.lo $(COMMON_OBJ) $(SLDNS_OBJ) \
 $(COMPAT_OBJ)
 DAEMON_SRC=daemon/acl_list.c daemon/cachedump.c daemon/daemon.c \
@@ -242,10 +242,6 @@ DOHCLIENT_SRC=testcode/dohclient.c
 DOHCLIENT_OBJ=dohclient.lo
 DOHCLIENT_OBJ_LINK=$(DOHCLIENT_OBJ) worker_cb.lo $(COMMON_OBJ) $(COMPAT_OBJ) \
 $(SLDNS_OBJ)
-DOQCLIENT_SRC=testcode/doqclient.c
-DOQCLIENT_OBJ=doqclient.lo
-DOQCLIENT_OBJ_LINK=$(DOQCLIENT_OBJ) $(COMMON_OBJ) $(COMPAT_OBJ) \
-$(SLDNS_OBJ)
 PERF_SRC=testcode/perf.c
 PERF_OBJ=perf.lo
 PERF_OBJ_LINK=$(PERF_OBJ) worker_cb.lo $(COMMON_OBJ) $(COMPAT_OBJ) $(SLDNS_OBJ)
@@ -292,7 +288,7 @@ ALL_SRC=$(COMMON_SRC) $(UNITTEST_SRC) $(DAEMON_SRC) \
 	$(CONTROL_SRC) $(UBANCHOR_SRC) $(PETAL_SRC) $(DNSTAP_SOCKET_SRC)\
 	$(PYTHONMOD_SRC) $(PYUNBOUND_SRC) $(WIN_DAEMON_THE_SRC) \
 	$(SVCINST_SRC) $(SVCUNINST_SRC) $(ANCHORUPD_SRC) $(SLDNS_SRC) \
-	$(DOHCLIENT_SRC) $(DOQCLIENT_SRC) $(READZONE_SRC)
+	$(DOHCLIENT_SRC) $(READZONE_SRC)

 ALL_OBJ=$(COMMON_OBJ) $(UNITTEST_OBJ) $(DAEMON_OBJ) \
 	$(TESTBOUND_OBJ) $(LOCKVERIFY_OBJ) $(PKTVIEW_OBJ) \
@@ -301,7 +297,7 @@ ALL_OBJ=$(COMMON_OBJ) $(UNITTEST_OBJ) $(DAEMON_OBJ) \
 	$(CONTROL_OBJ) $(UBANCHOR_OBJ) $(PETAL_OBJ) $(DNSTAP_SOCKET_OBJ)\
 	$(COMPAT_OBJ) $(PYUNBOUND_OBJ) \
 	$(SVCINST_OBJ) $(SVCUNINST_OBJ) $(ANCHORUPD_OBJ) $(SLDNS_OBJ) \
-	$(DOHCLIENT_OBJ) $(DOQCLIENT_OBJ) $(READZONE_OBJ)
+	$(DOHCLIENT_OBJ) $(READZONE_OBJ)

 COMPILE=$(LIBTOOL) --tag=CC --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS) @PTHREAD_CFLAGS_ONLY@
 LINK=$(LIBTOOL) --tag=CC --mode=link $(CC) $(staticexe) $(RUNTIME_PATH) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS)
@@ -338,7 +334,7 @@ rsrc_unbound_checkconf.o:	$(srcdir)/winrc/rsrc_unbound_checkconf.rc config.h
 TEST_BIN=asynclook$(EXEEXT) delayer$(EXEEXT) \
 	lock-verify$(EXEEXT) memstats$(EXEEXT) perf$(EXEEXT) \
 	petal$(EXEEXT) pktview$(EXEEXT) streamtcp$(EXEEXT) \
-	$(DNSTAP_SOCKET_TESTBIN) dohclient$(EXEEXT) doqclient$(EXEEXT) \
+	$(DNSTAP_SOCKET_TESTBIN) dohclient$(EXEEXT) \
 	testbound$(EXEEXT) unittest$(EXEEXT) readzone$(EXEEXT)
 tests:	all $(TEST_BIN)

@@ -420,9 +416,6 @@ streamtcp$(EXEEXT):	$(STREAMTCP_OBJ_LINK)
 dohclient$(EXEEXT):	$(DOHCLIENT_OBJ_LINK)
 	$(LINK) -o $@ $(DOHCLIENT_OBJ_LINK) $(SSLLIB) $(LIBS)

-doqclient$(EXEEXT):	$(DOQCLIENT_OBJ_LINK)
-	$(LINK) -o $@ $(DOQCLIENT_OBJ_LINK) $(SSLLIB) $(LIBS)
-
 perf$(EXEEXT):	$(PERF_OBJ_LINK)
 	$(LINK) -o $@ $(PERF_OBJ_LINK) $(SSLLIB) $(LIBS)

@@ -710,8 +703,6 @@ depend:

 # build rules
 ipset.lo ipset.o: $(srcdir)/ipset/ipset.c
-doqclient.lo doqclient.o: $(srcdir)/testcode/doqclient.c
-unitdoq.lo unitdoq.o: $(srcdir)/testcode/unitdoq.c

 # Dependencies
 dns.lo dns.o: $(srcdir)/services/cache/dns.c config.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/util/log.h \
@@ -1307,7 +1298,7 @@ remote.lo remote.o: $(srcdir)/daemon/remote.c config.h $(srcdir)/daemon/remote.h
 $(srcdir)/validator/val_anchor.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
 $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/iterator/iter_delegpt.h \
 $(srcdir)/services/outside_network.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/parseutil.h \
- $(srcdir)/sldns/wire2str.h $(srcdir)/util/edns.h
+ $(srcdir)/sldns/wire2str.h
 stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
 $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
 $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
@@ -621,9 +621,6 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 	}
 	verbose(VERB_ALGO, "cachedb msg adjusted down by %d", (int)adjust);
 	adjust_msg_ttl(qstate->return_msg, adjust);
-	if(qstate->env->cfg->aggressive_nsec) {
-		limit_nsec_ttl(qstate->return_msg);
-	}

 	/* Similar to the unbound worker, if serve-expired is enabled and
 	 * the msg would be considered to be expired, mark the state so a
@@ -831,6 +828,8 @@ cachedb_handle_query(struct module_qstate* qstate,
 		/* In case we have expired data but there is a client timer for expired
 		 * answers, pass execution to next module in order to try updating the
 		 * data first.
+		 * TODO: this needs revisit. The expired data stored from cachedb has
+		 * 0 TTL which is picked up by iterator later when looking in the cache.
 		 */
 		if(qstate->env->cfg->serve_expired && msg_expired) {
 			qstate->return_msg = NULL;
@@ -58,8 +58,7 @@ struct redis_moddata {
 	int server_port;	 /* server's TCP port */
 	const char* server_path; /* server's unix path, or "", NULL if unused */
 	const char* server_password; /* server's AUTH password, or "", NULL if unused */
-	struct timeval command_timeout;	 /* timeout for commands */
-	struct timeval connect_timeout;	 /* timeout for connect */
+	struct timeval timeout;	 /* timeout for connection setup and commands */
 	int logical_db;		/* the redis logical database to use */
 };

@@ -89,10 +88,10 @@ redis_connect(const struct redis_moddata* moddata)

 	if(moddata->server_path && moddata->server_path[0]!=0) {
 		ctx = redisConnectUnixWithTimeout(moddata->server_path,
-			moddata->connect_timeout);
+			moddata->timeout);
 	} else {
 		ctx = redisConnectWithTimeout(moddata->server_host,
-			moddata->server_port, moddata->connect_timeout);
+			moddata->server_port, moddata->timeout);
 	}
 	if(!ctx || ctx->err) {
 		const char *errstr = "out of memory";
@@ -101,7 +100,7 @@ redis_connect(const struct redis_moddata* moddata)
 		log_err("failed to connect to redis server: %s", errstr);
 		goto fail;
 	}
-	if(redisSetTimeout(ctx, moddata->command_timeout) != REDIS_OK) {
+	if(redisSetTimeout(ctx, moddata->timeout) != REDIS_OK) {
 		log_err("failed to set redis timeout");
 		goto fail;
 	}
@@ -160,24 +159,8 @@ redis_init(struct module_env* env, struct cachedb_env* cachedb_env)
 	moddata->server_port = env->cfg->redis_server_port;
 	moddata->server_path = env->cfg->redis_server_path;
 	moddata->server_password = env->cfg->redis_server_password;
-	moddata->command_timeout.tv_sec = env->cfg->redis_timeout / 1000;
-	moddata->command_timeout.tv_usec =
-		(env->cfg->redis_timeout % 1000) * 1000;
-	moddata->connect_timeout.tv_sec = env->cfg->redis_timeout / 1000;
-	moddata->connect_timeout.tv_usec =
-		(env->cfg->redis_timeout % 1000) * 1000;
-	if(env->cfg->redis_command_timeout != 0) {
-		moddata->command_timeout.tv_sec =
-			env->cfg->redis_command_timeout / 1000;
-		moddata->command_timeout.tv_usec =
-			(env->cfg->redis_command_timeout % 1000) * 1000;
-	}
-	if(env->cfg->redis_connect_timeout != 0) {
-		moddata->connect_timeout.tv_sec =
-			env->cfg->redis_connect_timeout / 1000;
-		moddata->connect_timeout.tv_usec =
-			(env->cfg->redis_connect_timeout % 1000) * 1000;
-	}
+	moddata->timeout.tv_sec = env->cfg->redis_timeout / 1000;
+	moddata->timeout.tv_usec = (env->cfg->redis_timeout % 1000) * 1000;
 	moddata->logical_db = env->cfg->redis_logical_db;
 	for(i = 0; i < moddata->numctxs; i++) {
 		redisContext* ctx = redis_connect(moddata);
@@ -1,8 +1,5 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */

-/* apply the fallthrough attribute. */
-#undef ATTR_FALLTHROUGH
-
 /* apply the noreturn attribute to a function that exits the program */
 #undef ATTR_NORETURN

@@ -60,9 +57,6 @@
 /* Define to 1 if you have the <arpa/inet.h> header file. */
 #undef HAVE_ARPA_INET_H

-/* Whether the C compiler accepts the "fallthrough" attribute */
-#undef HAVE_ATTR_FALLTHROUGH
-
 /* Whether the C compiler accepts the "format" attribute */
 #undef HAVE_ATTR_FORMAT

@@ -129,14 +123,6 @@
   and to 0 if you don't. */
 #undef HAVE_DECL_NGHTTP2_SESSION_SERVER_NEW

-/* Define to 1 if you have the declaration of `ngtcp2_conn_server_new', and to
-   0 if you don't. */
-#undef HAVE_DECL_NGTCP2_CONN_SERVER_NEW
-
-/* Define to 1 if you have the declaration of `ngtcp2_crypto_encrypt_cb', and
-   to 0 if you don't. */
-#undef HAVE_DECL_NGTCP2_CRYPTO_ENCRYPT_CB
-
 /* Define to 1 if you have the declaration of `NID_ED25519', and to 0 if you
   don't. */
 #undef HAVE_DECL_NID_ED25519
@@ -429,65 +415,6 @@
 /* Define to 1 if you have the <nghttp2/nghttp2.h> header file. */
 #undef HAVE_NGHTTP2_NGHTTP2_H

-/* Define this to use ngtcp2. */
-#undef HAVE_NGTCP2
-
-/* Define to 1 if you have the `ngtcp2_ccerr_default' function. */
-#undef HAVE_NGTCP2_CCERR_DEFAULT
-
-/* Define to 1 if you have the `ngtcp2_conn_encode_0rtt_transport_params'
-   function. */
-#undef HAVE_NGTCP2_CONN_ENCODE_0RTT_TRANSPORT_PARAMS
-
-/* Define to 1 if you have the `ngtcp2_conn_get_max_local_streams_uni'
-   function. */
-#undef HAVE_NGTCP2_CONN_GET_MAX_LOCAL_STREAMS_UNI
-
-/* Define to 1 if you have the `ngtcp2_conn_get_num_scid' function. */
-#undef HAVE_NGTCP2_CONN_GET_NUM_SCID
-
-/* Define to 1 if you have the `ngtcp2_conn_in_closing_period' function. */
-#undef HAVE_NGTCP2_CONN_IN_CLOSING_PERIOD
-
-/* Define to 1 if you have the `ngtcp2_conn_in_draining_period' function. */
-#undef HAVE_NGTCP2_CONN_IN_DRAINING_PERIOD
-
-/* Define if ngtcp2_conn_shutdown_stream has 4 arguments. */
-#undef HAVE_NGTCP2_CONN_SHUTDOWN_STREAM4
-
-/* Define to 1 if you have the `ngtcp2_conn_tls_early_data_rejected' function.
-   */
-#undef HAVE_NGTCP2_CONN_TLS_EARLY_DATA_REJECTED
-
-/* Define to 1 if you have the `ngtcp2_crypto_encrypt_cb' function. */
-#undef HAVE_NGTCP2_CRYPTO_ENCRYPT_CB
-
-/* Define to 1 if you have the
-   `ngtcp2_crypto_quictls_configure_client_context' function. */
-#undef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_CLIENT_CONTEXT
-
-/* Define to 1 if you have the
-   `ngtcp2_crypto_quictls_configure_server_context' function. */
-#undef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_SERVER_CONTEXT
-
-/* Define to 1 if you have the
-   `ngtcp2_crypto_quictls_from_ossl_encryption_level' function. */
-#undef HAVE_NGTCP2_CRYPTO_QUICTLS_FROM_OSSL_ENCRYPTION_LEVEL
-
-/* Define to 1 if the system has the type `ngtcp2_encryption_level'. */
-#undef HAVE_NGTCP2_ENCRYPTION_LEVEL
-
-/* Define to 1 if you have the <ngtcp2/ngtcp2_crypto_openssl.h> header file.
-   */
-#undef HAVE_NGTCP2_NGTCP2_CRYPTO_OPENSSL_H
-
-/* Define to 1 if you have the <ngtcp2/ngtcp2_crypto_quictls.h> header file.
-   */
-#undef HAVE_NGTCP2_NGTCP2_CRYPTO_QUICTLS_H
-
-/* Define to 1 if you have the <ngtcp2/ngtcp2.h> header file. */
-#undef HAVE_NGTCP2_NGTCP2_H
-
 /* Use libnss for crypto */
 #undef HAVE_NSS

@@ -654,9 +581,6 @@
 /* Define to 1 if you have the `SSL_get1_peer_certificate' function. */
 #undef HAVE_SSL_GET1_PEER_CERTIFICATE

-/* Define to 1 if you have the `SSL_is_quic' function. */
-#undef HAVE_SSL_IS_QUIC
-
 /* Define to 1 if you have the `SSL_set1_host' function. */
 #undef HAVE_SSL_SET1_HOST

@@ -699,23 +623,6 @@
 /* Define to 1 if `ipi_spec_dst' is a member of `struct in_pktinfo'. */
 #undef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST

-/* Define to 1 if `tokenlen' is a member of `struct ngtcp2_pkt_hd'. */
-#undef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN
-
-/* Define to 1 if `max_tx_udp_payload_size' is a member of `struct
-   ngtcp2_settings'. */
-#undef HAVE_STRUCT_NGTCP2_SETTINGS_MAX_TX_UDP_PAYLOAD_SIZE
-
-/* Define to 1 if `tokenlen' is a member of `struct ngtcp2_settings'. */
-#undef HAVE_STRUCT_NGTCP2_SETTINGS_TOKENLEN
-
-/* Define to 1 if `original_dcid_present' is a member of `struct
-   ngtcp2_transport_params'. */
-#undef HAVE_STRUCT_NGTCP2_TRANSPORT_PARAMS_ORIGINAL_DCID_PRESENT
-
-/* Define to 1 if the system has the type `struct ngtcp2_version_cid'. */
-#undef HAVE_STRUCT_NGTCP2_VERSION_CID
-
 /* Define to 1 if `sun_len' is a member of `struct sockaddr_un'. */
 #undef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN

@@ -1583,10 +1490,6 @@ struct sockaddr_storage;
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
 #  define free(p) unbound_stat_free_log(p, __FILE__, __LINE__, __func__)
 #  define realloc(p,s) unbound_stat_realloc_log(p, s, __FILE__, __LINE__, __func__)
-#  define strdup(s) unbound_stat_strdup_log(s, __FILE__, __LINE__, __func__)
-#ifdef HAVE_REALLOCARRAY
-#  define reallocarray(p,n,s) unbound_stat_reallocarray_log(p, n, s, __FILE__, __LINE__, __func__)
-#endif
 void *unbound_stat_malloc(size_t size);
 void *unbound_stat_calloc(size_t nmemb, size_t size);
 void unbound_stat_free(void *ptr);
@@ -1599,10 +1502,6 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-void *unbound_stat_reallocarray_log(void *ptr, size_t nmemb, size_t size,
-	const char* file, int line, const char* func);
-char *unbound_stat_strdup_log(const char *s, const char* file, int line,
-	const char* func);
 #elif defined(UNBOUND_ALLOC_LITE)
 #  include "util/alloc.h"
 #endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */
@@ -1613,8 +1512,6 @@ char *unbound_stat_strdup_log(const char *s, const char* file, int line,
 #define UNBOUND_DNS_OVER_TLS_PORT 853
 /** default port for DNS over HTTPS traffic. */
 #define UNBOUND_DNS_OVER_HTTPS_PORT 443
-/** default port for DNS over QUIC traffic. */
-#define UNBOUND_DNS_OVER_QUIC_PORT 853
 /** default port for unbound control traffic, registered port with IANA,
    ub-dns-control  8953/tcp    unbound dns nameserver control */
 #define UNBOUND_CONTROL_PORT 8953
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for unbound 1.22.0.
+# Generated by GNU Autoconf 2.71 for unbound 1.20.1.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues>.
 #
@@ -622,8 +622,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.22.0'
-PACKAGE_STRING='unbound 1.22.0'
+PACKAGE_VERSION='1.20.1'
+PACKAGE_STRING='unbound 1.20.1'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues'
 PACKAGE_URL=''

@@ -921,7 +921,6 @@ with_libevent
 with_libexpat
 with_libhiredis
 with_libnghttp2
-with_libngtcp2
 enable_static_exe
 enable_fully_static
 enable_lock_checks
@@ -1509,7 +1508,7 @@ if test "$ac_init_help" = "long"; then
  # Omit some internal or obsolete options to make the list less imposing.
  # This message is too long to be a string in the A/UX 3.1 sh.
  cat <<_ACEOF
-\`configure' configures unbound 1.22.0 to adapt to many kinds of systems.
+\`configure' configures unbound 1.20.1 to adapt to many kinds of systems.

 Usage: $0 [OPTION]... [VAR=VALUE]...

@@ -1575,7 +1574,7 @@ fi

 if test -n "$ac_init_help"; then
  case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.22.0:";;
+     short | recursive ) echo "Configuration of unbound 1.20.1:";;
   esac
  cat <<\_ACEOF

@@ -1710,7 +1709,6 @@ Optional Packages:
  --with-libexpat=path    specify explicit path for libexpat.
  --with-libhiredis=path  specify explicit path for libhiredis.
  --with-libnghttp2=path  specify explicit path for libnghttp2.
-  --with-libngtcp2=path   specify explicit path for libngtcp2, for QUIC.
  --with-dnstap-socket-path=pathname
                          set default dnstap socket path
  --with-protobuf-c=path  Path where protobuf-c is installed, for dnstap
@@ -1824,7 +1822,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
  cat <<\_ACEOF
-unbound configure 1.22.0
+unbound configure 1.20.1
 generated by GNU Autoconf 2.71

 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2481,7 +2479,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.

-It was created by unbound $as_me 1.22.0, which was
+It was created by unbound $as_me 1.20.1, which was
 generated by GNU Autoconf 2.71.  Invocation command line was

  $ $0$ac_configure_args_raw
@@ -3243,13 +3241,13 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu

 UNBOUND_VERSION_MAJOR=1

-UNBOUND_VERSION_MINOR=22
+UNBOUND_VERSION_MINOR=20

-UNBOUND_VERSION_MICRO=0
+UNBOUND_VERSION_MICRO=1


 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=30
+LIBUNBOUND_REVISION=28
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -3344,9 +3342,7 @@ LIBUNBOUND_AGE=1
 # 1.19.2 had 9:25:1
 # 1.19.3 had 9:26:1
 # 1.20.0 had 9:27:1
-# 1.21.0 had 9:28:1
-# 1.21.1 had 9:29:1
-# 1.22.0 had 9:30:1
+# 1.20.1 had 9:28:1

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -6980,10 +6976,6 @@ printf "%s\n" "#define HAVE_ATTR_WEAK 1" >>confdefs.h

 printf "%s\n" "#define ATTR_WEAK __attribute__((weak))" >>confdefs.h

-else
-
-printf "%s\n" "#define ATTR_WEAK /**/" >>confdefs.h
-
 fi


@@ -7031,79 +7023,6 @@ printf "%s\n" "#define HAVE_ATTR_NORETURN 1" >>confdefs.h

 printf "%s\n" "#define ATTR_NORETURN __attribute__((__noreturn__))" >>confdefs.h

-else
-
-printf "%s\n" "#define ATTR_NORETURN /**/" >>confdefs.h
-
-fi
-
-
-
-
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler (${CC-cc}) accepts the \"fallthrough\" attribute" >&5
-printf %s "checking whether the C compiler (${CC-cc}) accepts the \"fallthrough\" attribute... " >&6; }
-BAKCFLAGS="$CFLAGS"
-CFLAGS="$CFLAGS -Werror"
-if test ${ac_cv_c_fallthrough_attribute+y}
-then :
-  printf %s "(cached) " >&6
-else $as_nop
-  ac_cv_c_fallthrough_attribute=no
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
- #include <stdio.h>
-void f(int x) {
-	int y = 0;
-	switch(x) {
-	case 1:
-		y = 1;
-		__attribute__((fallthrough));
-		/* fallthrough */
-	case 2:
-		y++;
-		break;
-	case 3:
-		y = 3;
-		break;
-	}
-	printf("%d", y);
-}
-
-int
-main (void)
-{
-
-   f(1);
-
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"
-then :
-  ac_cv_c_fallthrough_attribute="yes"
-else $as_nop
-  ac_cv_c_fallthrough_attribute="no"
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
-
-fi
-
-CFLAGS="$BAKCFLAGS"
-
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_fallthrough_attribute" >&5
-printf "%s\n" "$ac_cv_c_fallthrough_attribute" >&6; }
-if test $ac_cv_c_fallthrough_attribute = yes; then
-
-printf "%s\n" "#define HAVE_ATTR_FALLTHROUGH 1" >>confdefs.h
-
-
-printf "%s\n" "#define ATTR_FALLTHROUGH __attribute__((fallthrough));" >>confdefs.h
-
-else
-
-printf "%s\n" "#define ATTR_FALLTHROUGH /**/" >>confdefs.h
-
 fi


@@ -22207,353 +22126,6 @@ printf "%s\n" "#define HAVE_DECL_NGHTTP2_SESSION_SERVER_NEW $ac_have_decl" >>con

 fi

-# ngtcp2
-
-# Check whether --with-libngtcp2 was given.
-if test ${with_libngtcp2+y}
-then :
-  withval=$with_libngtcp2;
-else $as_nop
-   withval="no"
-fi
-
-found_libngtcp2="no"
-if test x_$withval = x_yes -o x_$withval != x_no; then
-   { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for libngtcp2" >&5
-printf %s "checking for libngtcp2... " >&6; }
-   if test x_$withval = x_ -o x_$withval = x_yes; then
-            withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
-   fi
-   for dir in $withval ; do
-            if test -f "$dir/include/ngtcp2/ngtcp2.h"; then
-		found_libngtcp2="yes"
-				if test "$dir" != "/usr"; then
-                    CPPFLAGS="$CPPFLAGS -I$dir/include"
-		    LDFLAGS="$LDFLAGS -L$dir/lib"
-		fi
-		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: found in $dir" >&5
-printf "%s\n" "found in $dir" >&6; }
-
-printf "%s\n" "#define HAVE_NGTCP2 1" >>confdefs.h
-
-		LIBS="$LIBS -lngtcp2"
-                break;
-            fi
-    done
-    if test x_$found_libngtcp2 != x_yes; then
-	as_fn_error $? "Could not find libngtcp2, ngtcp2.h" "$LINENO" 5
-    fi
-    ac_fn_c_check_header_compile "$LINENO" "ngtcp2/ngtcp2.h" "ac_cv_header_ngtcp2_ngtcp2_h" "$ac_includes_default
-"
-if test "x$ac_cv_header_ngtcp2_ngtcp2_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_NGTCP2_NGTCP2_H 1" >>confdefs.h
-
-fi
-ac_fn_c_check_header_compile "$LINENO" "ngtcp2/ngtcp2_crypto_openssl.h" "ac_cv_header_ngtcp2_ngtcp2_crypto_openssl_h" "$ac_includes_default
-"
-if test "x$ac_cv_header_ngtcp2_ngtcp2_crypto_openssl_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_NGTCP2_NGTCP2_CRYPTO_OPENSSL_H 1" >>confdefs.h
-
-fi
-ac_fn_c_check_header_compile "$LINENO" "ngtcp2/ngtcp2_crypto_quictls.h" "ac_cv_header_ngtcp2_ngtcp2_crypto_quictls_h" "$ac_includes_default
-"
-if test "x$ac_cv_header_ngtcp2_ngtcp2_crypto_quictls_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_NGTCP2_NGTCP2_CRYPTO_QUICTLS_H 1" >>confdefs.h
-
-fi
-
-    ac_fn_check_decl "$LINENO" "ngtcp2_conn_server_new" "ac_cv_have_decl_ngtcp2_conn_server_new" "$ac_includes_default
-    #include <ngtcp2/ngtcp2.h>
-
-" "$ac_c_undeclared_builtin_options" "CFLAGS"
-if test "x$ac_cv_have_decl_ngtcp2_conn_server_new" = xyes
-then :
-  ac_have_decl=1
-else $as_nop
-  ac_have_decl=0
-fi
-printf "%s\n" "#define HAVE_DECL_NGTCP2_CONN_SERVER_NEW $ac_have_decl" >>confdefs.h
-
-    ac_fn_check_decl "$LINENO" "ngtcp2_crypto_encrypt_cb" "ac_cv_have_decl_ngtcp2_crypto_encrypt_cb" "$ac_includes_default
-    #include <ngtcp2/ngtcp2_crypto.h>
-
-" "$ac_c_undeclared_builtin_options" "CFLAGS"
-if test "x$ac_cv_have_decl_ngtcp2_crypto_encrypt_cb" = xyes
-then :
-  ac_have_decl=1
-else $as_nop
-  ac_have_decl=0
-fi
-printf "%s\n" "#define HAVE_DECL_NGTCP2_CRYPTO_ENCRYPT_CB $ac_have_decl" >>confdefs.h
-
-    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ngtcp2_crypto_encrypt_cb in -lngtcp2_crypto_openssl" >&5
-printf %s "checking for ngtcp2_crypto_encrypt_cb in -lngtcp2_crypto_openssl... " >&6; }
-if test ${ac_cv_lib_ngtcp2_crypto_openssl_ngtcp2_crypto_encrypt_cb+y}
-then :
-  printf %s "(cached) " >&6
-else $as_nop
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-lngtcp2_crypto_openssl  $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-char ngtcp2_crypto_encrypt_cb ();
-int
-main (void)
-{
-return ngtcp2_crypto_encrypt_cb ();
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"
-then :
-  ac_cv_lib_ngtcp2_crypto_openssl_ngtcp2_crypto_encrypt_cb=yes
-else $as_nop
-  ac_cv_lib_ngtcp2_crypto_openssl_ngtcp2_crypto_encrypt_cb=no
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.beam \
-    conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_ngtcp2_crypto_openssl_ngtcp2_crypto_encrypt_cb" >&5
-printf "%s\n" "$ac_cv_lib_ngtcp2_crypto_openssl_ngtcp2_crypto_encrypt_cb" >&6; }
-if test "x$ac_cv_lib_ngtcp2_crypto_openssl_ngtcp2_crypto_encrypt_cb" = xyes
-then :
-   LIBS="$LIBS -lngtcp2_crypto_openssl"
-fi
-
-    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ngtcp2_crypto_encrypt_cb in -lngtcp2_crypto_quictls" >&5
-printf %s "checking for ngtcp2_crypto_encrypt_cb in -lngtcp2_crypto_quictls... " >&6; }
-if test ${ac_cv_lib_ngtcp2_crypto_quictls_ngtcp2_crypto_encrypt_cb+y}
-then :
-  printf %s "(cached) " >&6
-else $as_nop
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-lngtcp2_crypto_quictls  $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-char ngtcp2_crypto_encrypt_cb ();
-int
-main (void)
-{
-return ngtcp2_crypto_encrypt_cb ();
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"
-then :
-  ac_cv_lib_ngtcp2_crypto_quictls_ngtcp2_crypto_encrypt_cb=yes
-else $as_nop
-  ac_cv_lib_ngtcp2_crypto_quictls_ngtcp2_crypto_encrypt_cb=no
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.beam \
-    conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_ngtcp2_crypto_quictls_ngtcp2_crypto_encrypt_cb" >&5
-printf "%s\n" "$ac_cv_lib_ngtcp2_crypto_quictls_ngtcp2_crypto_encrypt_cb" >&6; }
-if test "x$ac_cv_lib_ngtcp2_crypto_quictls_ngtcp2_crypto_encrypt_cb" = xyes
-then :
-   LIBS="$LIBS -lngtcp2_crypto_quictls"
-fi
-
-    ac_fn_c_check_func "$LINENO" "ngtcp2_crypto_encrypt_cb" "ac_cv_func_ngtcp2_crypto_encrypt_cb"
-if test "x$ac_cv_func_ngtcp2_crypto_encrypt_cb" = xyes
-then :
-  printf "%s\n" "#define HAVE_NGTCP2_CRYPTO_ENCRYPT_CB 1" >>confdefs.h
-
-fi
-ac_fn_c_check_func "$LINENO" "ngtcp2_ccerr_default" "ac_cv_func_ngtcp2_ccerr_default"
-if test "x$ac_cv_func_ngtcp2_ccerr_default" = xyes
-then :
-  printf "%s\n" "#define HAVE_NGTCP2_CCERR_DEFAULT 1" >>confdefs.h
-
-fi
-ac_fn_c_check_func "$LINENO" "ngtcp2_conn_in_closing_period" "ac_cv_func_ngtcp2_conn_in_closing_period"
-if test "x$ac_cv_func_ngtcp2_conn_in_closing_period" = xyes
-then :
-  printf "%s\n" "#define HAVE_NGTCP2_CONN_IN_CLOSING_PERIOD 1" >>confdefs.h
-
-fi
-ac_fn_c_check_func "$LINENO" "ngtcp2_conn_in_draining_period" "ac_cv_func_ngtcp2_conn_in_draining_period"
-if test "x$ac_cv_func_ngtcp2_conn_in_draining_period" = xyes
-then :
-  printf "%s\n" "#define HAVE_NGTCP2_CONN_IN_DRAINING_PERIOD 1" >>confdefs.h
-
-fi
-ac_fn_c_check_func "$LINENO" "ngtcp2_conn_get_max_local_streams_uni" "ac_cv_func_ngtcp2_conn_get_max_local_streams_uni"
-if test "x$ac_cv_func_ngtcp2_conn_get_max_local_streams_uni" = xyes
-then :
-  printf "%s\n" "#define HAVE_NGTCP2_CONN_GET_MAX_LOCAL_STREAMS_UNI 1" >>confdefs.h
-
-fi
-ac_fn_c_check_func "$LINENO" "ngtcp2_crypto_quictls_from_ossl_encryption_level" "ac_cv_func_ngtcp2_crypto_quictls_from_ossl_encryption_level"
-if test "x$ac_cv_func_ngtcp2_crypto_quictls_from_ossl_encryption_level" = xyes
-then :
-  printf "%s\n" "#define HAVE_NGTCP2_CRYPTO_QUICTLS_FROM_OSSL_ENCRYPTION_LEVEL 1" >>confdefs.h
-
-fi
-ac_fn_c_check_func "$LINENO" "ngtcp2_crypto_quictls_configure_server_context" "ac_cv_func_ngtcp2_crypto_quictls_configure_server_context"
-if test "x$ac_cv_func_ngtcp2_crypto_quictls_configure_server_context" = xyes
-then :
-  printf "%s\n" "#define HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_SERVER_CONTEXT 1" >>confdefs.h
-
-fi
-ac_fn_c_check_func "$LINENO" "ngtcp2_crypto_quictls_configure_client_context" "ac_cv_func_ngtcp2_crypto_quictls_configure_client_context"
-if test "x$ac_cv_func_ngtcp2_crypto_quictls_configure_client_context" = xyes
-then :
-  printf "%s\n" "#define HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_CLIENT_CONTEXT 1" >>confdefs.h
-
-fi
-ac_fn_c_check_func "$LINENO" "ngtcp2_conn_get_num_scid" "ac_cv_func_ngtcp2_conn_get_num_scid"
-if test "x$ac_cv_func_ngtcp2_conn_get_num_scid" = xyes
-then :
-  printf "%s\n" "#define HAVE_NGTCP2_CONN_GET_NUM_SCID 1" >>confdefs.h
-
-fi
-ac_fn_c_check_func "$LINENO" "ngtcp2_conn_tls_early_data_rejected" "ac_cv_func_ngtcp2_conn_tls_early_data_rejected"
-if test "x$ac_cv_func_ngtcp2_conn_tls_early_data_rejected" = xyes
-then :
-  printf "%s\n" "#define HAVE_NGTCP2_CONN_TLS_EARLY_DATA_REJECTED 1" >>confdefs.h
-
-fi
-ac_fn_c_check_func "$LINENO" "ngtcp2_conn_encode_0rtt_transport_params" "ac_cv_func_ngtcp2_conn_encode_0rtt_transport_params"
-if test "x$ac_cv_func_ngtcp2_conn_encode_0rtt_transport_params" = xyes
-then :
-  printf "%s\n" "#define HAVE_NGTCP2_CONN_ENCODE_0RTT_TRANSPORT_PARAMS 1" >>confdefs.h
-
-fi
-
-
-  for ac_func in SSL_is_quic
-do :
-  ac_fn_c_check_func "$LINENO" "SSL_is_quic" "ac_cv_func_SSL_is_quic"
-if test "x$ac_cv_func_SSL_is_quic" = xyes
-then :
-  printf "%s\n" "#define HAVE_SSL_IS_QUIC 1" >>confdefs.h
-
-else $as_nop
-  as_fn_error $? "No QUIC support detected in OpenSSL. Need OpenSSL version with QUIC support to enable DNS over QUIC with libngtcp2." "$LINENO" 5
-fi
-
-done
-    ac_fn_c_check_type "$LINENO" "struct ngtcp2_version_cid" "ac_cv_type_struct_ngtcp2_version_cid" "$ac_includes_default
-    #include <ngtcp2/ngtcp2.h>
-
-"
-if test "x$ac_cv_type_struct_ngtcp2_version_cid" = xyes
-then :
-
-printf "%s\n" "#define HAVE_STRUCT_NGTCP2_VERSION_CID 1" >>confdefs.h
-
-
-fi
-ac_fn_c_check_type "$LINENO" "ngtcp2_encryption_level" "ac_cv_type_ngtcp2_encryption_level" "$ac_includes_default
-    #include <ngtcp2/ngtcp2.h>
-
-"
-if test "x$ac_cv_type_ngtcp2_encryption_level" = xyes
-then :
-
-printf "%s\n" "#define HAVE_NGTCP2_ENCRYPTION_LEVEL 1" >>confdefs.h
-
-
-fi
-
-    ac_fn_c_check_member "$LINENO" "struct ngtcp2_pkt_hd" "tokenlen" "ac_cv_member_struct_ngtcp2_pkt_hd_tokenlen" "$ac_includes_default
-    #include <ngtcp2/ngtcp2.h>
-
-"
-if test "x$ac_cv_member_struct_ngtcp2_pkt_hd_tokenlen" = xyes
-then :
-
-printf "%s\n" "#define HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN 1" >>confdefs.h
-
-
-fi
-ac_fn_c_check_member "$LINENO" "struct ngtcp2_settings" "tokenlen" "ac_cv_member_struct_ngtcp2_settings_tokenlen" "$ac_includes_default
-    #include <ngtcp2/ngtcp2.h>
-
-"
-if test "x$ac_cv_member_struct_ngtcp2_settings_tokenlen" = xyes
-then :
-
-printf "%s\n" "#define HAVE_STRUCT_NGTCP2_SETTINGS_TOKENLEN 1" >>confdefs.h
-
-
-fi
-ac_fn_c_check_member "$LINENO" "struct ngtcp2_settings" "max_tx_udp_payload_size" "ac_cv_member_struct_ngtcp2_settings_max_tx_udp_payload_size" "$ac_includes_default
-    #include <ngtcp2/ngtcp2.h>
-
-"
-if test "x$ac_cv_member_struct_ngtcp2_settings_max_tx_udp_payload_size" = xyes
-then :
-
-printf "%s\n" "#define HAVE_STRUCT_NGTCP2_SETTINGS_MAX_TX_UDP_PAYLOAD_SIZE 1" >>confdefs.h
-
-
-fi
-ac_fn_c_check_member "$LINENO" "struct ngtcp2_transport_params" "original_dcid_present" "ac_cv_member_struct_ngtcp2_transport_params_original_dcid_present" "$ac_includes_default
-    #include <ngtcp2/ngtcp2.h>
-
-"
-if test "x$ac_cv_member_struct_ngtcp2_transport_params_original_dcid_present" = xyes
-then :
-
-printf "%s\n" "#define HAVE_STRUCT_NGTCP2_TRANSPORT_PARAMS_ORIGINAL_DCID_PRESENT 1" >>confdefs.h
-
-
-fi
-
-
-    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether ngtcp2_conn_shutdown_stream has 4 arguments" >&5
-printf %s "checking whether ngtcp2_conn_shutdown_stream has 4 arguments... " >&6; }
-    cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-$ac_includes_default
-#include <ngtcp2/ngtcp2.h>
-
-int
-main (void)
-{
-
-	(void)ngtcp2_conn_shutdown_stream(NULL, 0, 0, 0);
-
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"
-then :
-
-	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-printf "%s\n" "yes" >&6; }
-
-printf "%s\n" "#define HAVE_NGTCP2_CONN_SHUTDOWN_STREAM4 1" >>confdefs.h
-
-
-else $as_nop
-
-	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
-printf "%s\n" "no" >&6; }
-
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
-
-fi
-
 # set static linking for uninstalled libraries if requested

 staticexe=""
@@ -24137,12 +23709,10 @@ if test x_$enable_lock_checks = x_yes; then
 	UBSYMS="-export-symbols clubsyms.def"
 	cp ${srcdir}/libunbound/ubsyms.def clubsyms.def
 	echo lock_protect >> clubsyms.def
-	echo lock_protect_place >> clubsyms.def
 	echo lock_unprotect >> clubsyms.def
 	echo lock_get_mem >> clubsyms.def
 	echo checklock_start >> clubsyms.def
 	echo checklock_stop >> clubsyms.def
-	echo checklock_set_output_name >> clubsyms.def
 	echo checklock_lock >> clubsyms.def
 	echo checklock_unlock >> clubsyms.def
 	echo checklock_init >> clubsyms.def
@@ -24997,7 +24567,7 @@ printf "%s\n" "#define MAXSYSLOGMSGLEN 10240" >>confdefs.h



-version=1.22.0
+version=1.20.1

 date=`date +'%b %e, %Y'`

@@ -25509,7 +25079,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.22.0, which was
+This file was extended by unbound $as_me 1.20.1, which was
 generated by GNU Autoconf 2.71.  Invocation command line was

  CONFIG_FILES    = $CONFIG_FILES
@@ -25577,7 +25147,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-unbound config.status 1.22.0
+unbound config.status 1.20.1
 configured by $0, generated by GNU Autoconf 2.71,
  with options \\"\$ac_cs_config\\"

@@ -10,15 +10,15 @@ sinclude(dnscrypt/dnscrypt.m4)

 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[22])
-m4_define([VERSION_MICRO],[0])
+m4_define([VERSION_MINOR],[20])
+m4_define([VERSION_MICRO],[1])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])

 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=30
+LIBUNBOUND_REVISION=28
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -113,9 +113,7 @@ LIBUNBOUND_AGE=1
 # 1.19.2 had 9:25:1
 # 1.19.3 had 9:26:1
 # 1.20.0 had 9:27:1
-# 1.21.0 had 9:28:1
-# 1.21.1 had 9:29:1
-# 1.22.0 had 9:30:1
+# 1.20.1 had 9:28:1

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -341,8 +339,6 @@ AC_MSG_RESULT($ac_cv_c_weak_attribute)
 if test $ac_cv_c_weak_attribute = yes; then
  AC_DEFINE(HAVE_ATTR_WEAK, 1, [Whether the C compiler accepts the "weak" attribute])
  AC_DEFINE(ATTR_WEAK, [__attribute__((weak))], [apply the weak attribute to a symbol])
-else
-  AC_DEFINE(ATTR_WEAK,[], [apply the weak attribute to a symbol])
 fi
 ])dnl End of CHECK_WEAK_ATTRIBUTE

@@ -364,54 +360,11 @@ AC_MSG_RESULT($ac_cv_c_noreturn_attribute)
 if test $ac_cv_c_noreturn_attribute = yes; then
  AC_DEFINE(HAVE_ATTR_NORETURN, 1, [Whether the C compiler accepts the "noreturn" attribute])
  AC_DEFINE(ATTR_NORETURN, [__attribute__((__noreturn__))], [apply the noreturn attribute to a function that exits the program])
-else
-  AC_DEFINE(ATTR_NORETURN,[], [apply the noreturn attribute to a function that exits the program])
 fi
 ])dnl End of CHECK_NORETURN_ATTRIBUTE

 CHECK_NORETURN_ATTRIBUTE

-AC_DEFUN([CHECK_FALLTHROUGH_ATTRIBUTE],
-[AC_REQUIRE([AC_PROG_CC])
-AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "fallthrough" attribute)
-BAKCFLAGS="$CFLAGS"
-CFLAGS="$CFLAGS -Werror"
-AC_CACHE_VAL(ac_cv_c_fallthrough_attribute,
-[ac_cv_c_fallthrough_attribute=no
-AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h>
-void f(int x) {
-	int y = 0;
-	switch(x) {
-	case 1:
-		y = 1;
-		__attribute__((fallthrough));
-		/* fallthrough */
-	case 2:
-		y++;
-		break;
-	case 3:
-		y = 3;
-		break;
-	}
-	printf("%d", y);
-}
-]], [[
-   f(1);
-]])],[ac_cv_c_fallthrough_attribute="yes"],[ac_cv_c_fallthrough_attribute="no"])
-])
-CFLAGS="$BAKCFLAGS"
-
-AC_MSG_RESULT($ac_cv_c_fallthrough_attribute)
-if test $ac_cv_c_fallthrough_attribute = yes; then
-  AC_DEFINE(HAVE_ATTR_FALLTHROUGH, 1, [Whether the C compiler accepts the "fallthrough" attribute])
-  AC_DEFINE(ATTR_FALLTHROUGH, [__attribute__((fallthrough));], [apply the fallthrough attribute.])
-else
-  AC_DEFINE(ATTR_FALLTHROUGH,[], [apply the fallthrough attribute.])
-fi
-])dnl End of CHECK_FALLTHROUGH_ATTRIBUTE
-
-CHECK_FALLTHROUGH_ATTRIBUTE
-
 if test "$srcdir" != "."; then
 	CPPFLAGS="$CPPFLAGS -I$srcdir"
 fi
@@ -1579,64 +1532,6 @@ if test x_$withval = x_yes -o x_$withval != x_no; then
    ])
 fi

-# ngtcp2
-AC_ARG_WITH(libngtcp2, AS_HELP_STRING([--with-libngtcp2=path],[specify explicit path for libngtcp2, for QUIC.]),
-    [ ],[ withval="no" ])
-found_libngtcp2="no"
-if test x_$withval = x_yes -o x_$withval != x_no; then
-   AC_MSG_CHECKING(for libngtcp2)
-   if test x_$withval = x_ -o x_$withval = x_yes; then
-            withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
-   fi
-   for dir in $withval ; do
-            if test -f "$dir/include/ngtcp2/ngtcp2.h"; then
-		found_libngtcp2="yes"
-		dnl assume /usr is in default path.
-		if test "$dir" != "/usr"; then
-                    CPPFLAGS="$CPPFLAGS -I$dir/include"
-		    LDFLAGS="$LDFLAGS -L$dir/lib"
-		fi
-		AC_MSG_RESULT(found in $dir)
-		AC_DEFINE([HAVE_NGTCP2], [1], [Define this to use ngtcp2.])
-		LIBS="$LIBS -lngtcp2"
-                break;
-            fi
-    done
-    if test x_$found_libngtcp2 != x_yes; then
-	AC_MSG_ERROR([Could not find libngtcp2, ngtcp2.h])
-    fi
-    AC_CHECK_HEADERS([ngtcp2/ngtcp2.h ngtcp2/ngtcp2_crypto_openssl.h ngtcp2/ngtcp2_crypto_quictls.h],,, [AC_INCLUDES_DEFAULT])
-    AC_CHECK_DECLS([ngtcp2_conn_server_new], [], [], [AC_INCLUDES_DEFAULT
-    #include <ngtcp2/ngtcp2.h>
-    ])
-    AC_CHECK_DECLS([ngtcp2_crypto_encrypt_cb], [], [], [AC_INCLUDES_DEFAULT
-    #include <ngtcp2/ngtcp2_crypto.h>
-    ])
-    AC_CHECK_LIB([ngtcp2_crypto_openssl], [ngtcp2_crypto_encrypt_cb], [ LIBS="$LIBS -lngtcp2_crypto_openssl" ])
-    AC_CHECK_LIB([ngtcp2_crypto_quictls], [ngtcp2_crypto_encrypt_cb], [ LIBS="$LIBS -lngtcp2_crypto_quictls" ])
-    AC_CHECK_FUNCS([ngtcp2_crypto_encrypt_cb ngtcp2_ccerr_default ngtcp2_conn_in_closing_period ngtcp2_conn_in_draining_period ngtcp2_conn_get_max_local_streams_uni ngtcp2_crypto_quictls_from_ossl_encryption_level ngtcp2_crypto_quictls_configure_server_context ngtcp2_crypto_quictls_configure_client_context ngtcp2_conn_get_num_scid ngtcp2_conn_tls_early_data_rejected ngtcp2_conn_encode_0rtt_transport_params])
-    AC_CHECK_FUNCS([SSL_is_quic], [], [AC_MSG_ERROR([No QUIC support detected in OpenSSL. Need OpenSSL version with QUIC support to enable DNS over QUIC with libngtcp2.])])
-    AC_CHECK_TYPES([struct ngtcp2_version_cid, ngtcp2_encryption_level],,,[AC_INCLUDES_DEFAULT
-    #include <ngtcp2/ngtcp2.h>
-    ])
-    AC_CHECK_MEMBERS([struct ngtcp2_pkt_hd.tokenlen, struct ngtcp2_settings.tokenlen, struct ngtcp2_settings.max_tx_udp_payload_size, struct ngtcp2_transport_params.original_dcid_present],,,[AC_INCLUDES_DEFAULT
-    #include <ngtcp2/ngtcp2.h>
-    ])
-
-    AC_MSG_CHECKING([whether ngtcp2_conn_shutdown_stream has 4 arguments])
-    AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <ngtcp2/ngtcp2.h>
-    ],[
-	(void)ngtcp2_conn_shutdown_stream(NULL, 0, 0, 0);
-    ])],[
-	AC_MSG_RESULT(yes)
-	AC_DEFINE(HAVE_NGTCP2_CONN_SHUTDOWN_STREAM4, 1, [Define if ngtcp2_conn_shutdown_stream has 4 arguments.])
-    ],[
-	AC_MSG_RESULT(no)
-    ])
-
-fi
-
 # set static linking for uninstalled libraries if requested
 AC_SUBST(staticexe)
 staticexe=""
@@ -1952,12 +1847,10 @@ if test x_$enable_lock_checks = x_yes; then
 	UBSYMS="-export-symbols clubsyms.def"
 	cp ${srcdir}/libunbound/ubsyms.def clubsyms.def
 	echo lock_protect >> clubsyms.def
-	echo lock_protect_place >> clubsyms.def
 	echo lock_unprotect >> clubsyms.def
 	echo lock_get_mem >> clubsyms.def
 	echo checklock_start >> clubsyms.def
 	echo checklock_stop >> clubsyms.def
-	echo checklock_set_output_name >> clubsyms.def
 	echo checklock_lock >> clubsyms.def
 	echo checklock_unlock >> clubsyms.def
 	echo checklock_init >> clubsyms.def
@@ -2391,10 +2284,6 @@ struct sockaddr_storage;
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
 #  define free(p) unbound_stat_free_log(p, __FILE__, __LINE__, __func__)
 #  define realloc(p,s) unbound_stat_realloc_log(p, s, __FILE__, __LINE__, __func__)
-#  define strdup(s) unbound_stat_strdup_log(s, __FILE__, __LINE__, __func__)
-#ifdef HAVE_REALLOCARRAY
-#  define reallocarray(p,n,s) unbound_stat_reallocarray_log(p, n, s, __FILE__, __LINE__, __func__)
-#endif
 void *unbound_stat_malloc(size_t size);
 void *unbound_stat_calloc(size_t nmemb, size_t size);
 void unbound_stat_free(void *ptr);
@@ -2407,10 +2296,6 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-void *unbound_stat_reallocarray_log(void *ptr, size_t nmemb, size_t size,
-	const char* file, int line, const char* func);
-char *unbound_stat_strdup_log(const char *s, const char* file, int line,
-	const char* func);
 #elif defined(UNBOUND_ALLOC_LITE)
 #  include "util/alloc.h"
 #endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */
@@ -2421,8 +2306,6 @@ char *unbound_stat_strdup_log(const char *s, const char* file, int line,
 #define UNBOUND_DNS_OVER_TLS_PORT 853
 /** default port for DNS over HTTPS traffic. */
 #define UNBOUND_DNS_OVER_HTTPS_PORT 443
-/** default port for DNS over QUIC traffic. */
-#define UNBOUND_DNS_OVER_QUIC_PORT 853
 /** default port for unbound control traffic, registered port with IANA,
    ub-dns-control  8953/tcp    unbound dns nameserver control */
 #define UNBOUND_CONTROL_PORT 8953
@@ -557,12 +557,6 @@ daemon_create_workers(struct daemon* daemon)
 		fatal_exit("out of memory during daemon init");
 	numport = daemon_get_shufport(daemon, shufport);
 	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
-
-#ifdef HAVE_NGTCP2
-	daemon->doq_table = doq_table_create(daemon->cfg, daemon->rand);
-	if(!daemon->doq_table)
-		fatal_exit("could not create doq_table: out of memory");
-#endif
 	
 	daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1);
 	if(daemon->reuseport && (int)daemon->num < (int)daemon->num_ports) {
@@ -741,14 +735,6 @@ daemon_fork(struct daemon* daemon)
 				   "dnscrypt support");
 #endif
 	}
-	if(daemon->cfg->cookie_secret_file &&
-		daemon->cfg->cookie_secret_file[0]) {
-		if(!(daemon->cookie_secrets = cookie_secrets_create()))
-			fatal_exit("Could not create cookie_secrets: out of memory");
-		if(!cookie_secrets_apply_cfg(daemon->cookie_secrets,
-			daemon->cfg->cookie_secret_file))
-			fatal_exit("Could not setup cookie_secrets");
-	}
 	/* create global local_zones */
 	if(!(daemon->local_zones = local_zones_create()))
 		fatal_exit("Could not create local zones: out of memory");
@@ -912,10 +898,6 @@ daemon_cleanup(struct daemon* daemon)
 #ifdef USE_DNSCRYPT
 	dnsc_delete(daemon->dnscenv);
 	daemon->dnscenv = NULL;
-#endif
-#ifdef HAVE_NGTCP2
-	doq_table_delete(daemon->doq_table);
-	daemon->doq_table = NULL;
 #endif
 	daemon->cfg = NULL;
 }
@@ -947,7 +929,6 @@ daemon_delete(struct daemon* daemon)
 	acl_list_delete(daemon->acl);
 	acl_list_delete(daemon->acl_interface);
 	tcl_list_delete(daemon->tcl);
-	cookie_secrets_delete(daemon->cookie_secrets);
 	listen_desetup_locks();
 	free(daemon->chroot);
 	free(daemon->pidfile);
@@ -58,8 +58,6 @@ struct ub_randstate;
 struct daemon_remote;
 struct respip_set;
 struct shm_main_info;
-struct doq_table;
-struct cookie_secrets;

 #include "dnstap/dnstap_config.h"
 #ifdef USE_DNSTAP
@@ -148,12 +146,8 @@ struct daemon {
 	/** the dnscrypt environment */
 	struct dnsc_env* dnscenv;
 #endif
-	/** the doq connection table */
-	struct doq_table* doq_table;
 	/** reuse existing cache on reload if other conditions allow it. */
 	int reuse_cache;
-	/** the EDNS cookie secrets from the cookie-secret-file */
-	struct cookie_secrets* cookie_secrets;
 };

 /**
@@ -88,7 +88,6 @@
 #include "sldns/wire2str.h"
 #include "sldns/sbuffer.h"
 #include "util/timeval_func.h"
-#include "util/edns.h"
 #ifdef USE_CACHEDB
 #include "cachedb/cachedb.h"
 #endif
@@ -302,7 +301,7 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
 		/* open fd */
 		fd = create_tcp_accept_sock(res, 1, &noproto, 0,
 			cfg->ip_transparent, 0, 0, cfg->ip_freebind,
-			cfg->use_systemd, cfg->ip_dscp, "unbound-control");
+			cfg->use_systemd, cfg->ip_dscp);
 		freeaddrinfo(res);
 	}

@@ -866,10 +865,6 @@ print_mem(RES* ssl, struct worker* worker, struct daemon* daemon,
 	if(!print_longnum(ssl, "mem.http.response_buffer"SQ,
 		(size_t)s->svr.mem_http2_response_buffer))
 		return 0;
-#ifdef HAVE_NGTCP2
-	if(!print_longnum(ssl, "mem.quic"SQ, (size_t)s->svr.mem_quic))
-		return 0;
-#endif /* HAVE_NGTCP2 */
 	return 1;
 }

@@ -1000,10 +995,6 @@ print_ext(RES* ssl, struct ub_stats_info* s, int inhibit_zero)
 		(unsigned long)s->svr.qipv6)) return 0;
 	if(!ssl_printf(ssl, "num.query.https"SQ"%lu\n",
 		(unsigned long)s->svr.qhttps)) return 0;
-#ifdef HAVE_NGTCP2
-	if(!ssl_printf(ssl, "num.query.quic"SQ"%lu\n",
-		(unsigned long)s->svr.qquic)) return 0;
-#endif /* HAVE_NGTCP2 */
 	/* flags */
 	if(!ssl_printf(ssl, "num.query.flags.QR"SQ"%lu\n",
 		(unsigned long)s->svr.qbit_QR)) return 0;
@@ -1961,8 +1952,6 @@ bogus_del_msg(struct lruhash_entry* e, void* arg)
 	struct reply_info* d = (struct reply_info*)e->data;
 	if(d->security == sec_status_bogus) {
 		d->ttl = inf->expired;
-		d->prefetch_ttl = inf->expired;
-		d->serve_expired_ttl = inf->expired;
 		inf->num_msgs++;
 #ifdef USE_CACHEDB
 		if(inf->remcachedb && inf->worker->env.cachedb_enabled)
@@ -2045,8 +2034,6 @@ negative_del_msg(struct lruhash_entry* e, void* arg)
 	 * or NOERROR rcode with ANCOUNT==0: a NODATA answer */
 	if(FLAGS_GET_RCODE(d->flags) != 0 || d->an_numrrsets == 0) {
 		d->ttl = inf->expired;
-		d->prefetch_ttl = inf->expired;
-		d->serve_expired_ttl = inf->expired;
 		inf->num_msgs++;
 #ifdef USE_CACHEDB
 		if(inf->remcachedb && inf->worker->env.cachedb_enabled)
@@ -3208,210 +3195,6 @@ do_rpz_disable(RES* ssl, struct worker* worker, char* arg)
    do_rpz_enable_disable(ssl, worker, arg, 0);
 }

-/** Write the cookie secrets to file, returns `0` on failure.
- * Caller has to hold the lock. */
-static int
-cookie_secret_file_dump(RES* ssl, struct worker* worker) {
-	char const* secret_file = worker->env.cfg->cookie_secret_file;
-	struct cookie_secrets* cookie_secrets = worker->daemon->cookie_secrets;
-	char secret_hex[UNBOUND_COOKIE_SECRET_SIZE * 2 + 1];
-	FILE* f;
-	size_t i;
-	if(secret_file == NULL || secret_file[0]==0) {
-		(void)ssl_printf(ssl, "error: no cookie secret file configured\n");
-		return 0;
-	}
-	log_assert( secret_file != NULL );
-
-	/* open write only and truncate */
-	if((f = fopen(secret_file, "w")) == NULL ) {
-		(void)ssl_printf(ssl, "unable to open cookie secret file %s: %s",
-		                 secret_file, strerror(errno));
-		return 0;
-	}
-	if(cookie_secrets == NULL) {
-		/* nothing to write */
-		fclose(f);
-		return 1;
-	}
-
-	for(i = 0; i < cookie_secrets->cookie_count; i++) {
-		struct cookie_secret const* cs = &cookie_secrets->
-			cookie_secrets[i];
-		ssize_t const len = hex_ntop(cs->cookie_secret,
-			UNBOUND_COOKIE_SECRET_SIZE, secret_hex,
-			sizeof(secret_hex));
-		(void)len; /* silence unused variable warning with -DNDEBUG */
-		log_assert( len == UNBOUND_COOKIE_SECRET_SIZE * 2 );
-		secret_hex[UNBOUND_COOKIE_SECRET_SIZE * 2] = '\0';
-		fprintf(f, "%s\n", secret_hex);
-	}
-	explicit_bzero(secret_hex, sizeof(secret_hex));
-	fclose(f);
-	return 1;
-}
-
-/** Activate cookie secret */
-static void
-do_activate_cookie_secret(RES* ssl, struct worker* worker) {
-	char const* secret_file = worker->env.cfg->cookie_secret_file;
-	struct cookie_secrets* cookie_secrets = worker->daemon->cookie_secrets;
-
-	if(secret_file == NULL || secret_file[0] == 0) {
-		(void)ssl_printf(ssl, "error: no cookie secret file configured\n");
-		return;
-	}
-	if(cookie_secrets == NULL) {
-		(void)ssl_printf(ssl, "error: there are no cookie_secrets.");
-		return;
-	}
-	lock_basic_lock(&cookie_secrets->lock);
-
-	if(cookie_secrets->cookie_count <= 1 ) {
-		lock_basic_unlock(&cookie_secrets->lock);
-		(void)ssl_printf(ssl, "error: no staging cookie secret to activate\n");
-		return;
-	}
-	/* Only the worker 0 writes to file, the others update state. */
-	if(worker->thread_num == 0 && !cookie_secret_file_dump(ssl, worker)) {
-		lock_basic_unlock(&cookie_secrets->lock);
-		(void)ssl_printf(ssl, "error: writing to cookie secret file: \"%s\"\n",
-				secret_file);
-		return;
-	}
-	activate_cookie_secret(cookie_secrets);
-	if(worker->thread_num == 0)
-		(void)cookie_secret_file_dump(ssl, worker);
-	lock_basic_unlock(&cookie_secrets->lock);
-	send_ok(ssl);
-}
-
-/** Drop cookie secret */
-static void
-do_drop_cookie_secret(RES* ssl, struct worker* worker) {
-	char const* secret_file = worker->env.cfg->cookie_secret_file;
-	struct cookie_secrets* cookie_secrets = worker->daemon->cookie_secrets;
-
-	if(secret_file == NULL || secret_file[0] == 0) {
-		(void)ssl_printf(ssl, "error: no cookie secret file configured\n");
-		return;
-	}
-	if(cookie_secrets == NULL) {
-		(void)ssl_printf(ssl, "error: there are no cookie_secrets.");
-		return;
-	}
-	lock_basic_lock(&cookie_secrets->lock);
-
-	if(cookie_secrets->cookie_count <= 1 ) {
-		lock_basic_unlock(&cookie_secrets->lock);
-		(void)ssl_printf(ssl, "error: can not drop the currently active cookie secret\n");
-		return;
-	}
-	/* Only the worker 0 writes to file, the others update state. */
-	if(worker->thread_num == 0 && !cookie_secret_file_dump(ssl, worker)) {
-		lock_basic_unlock(&cookie_secrets->lock);
-		(void)ssl_printf(ssl, "error: writing to cookie secret file: \"%s\"\n",
-				secret_file);
-		return;
-	}
-	drop_cookie_secret(cookie_secrets);
-	if(worker->thread_num == 0)
-		(void)cookie_secret_file_dump(ssl, worker);
-	lock_basic_unlock(&cookie_secrets->lock);
-	send_ok(ssl);
-}
-
-/** Add cookie secret */
-static void
-do_add_cookie_secret(RES* ssl, struct worker* worker, char* arg) {
-	uint8_t secret[UNBOUND_COOKIE_SECRET_SIZE];
-	char const* secret_file = worker->env.cfg->cookie_secret_file;
-	struct cookie_secrets* cookie_secrets = worker->daemon->cookie_secrets;
-
-	if(secret_file == NULL || secret_file[0] == 0) {
-		(void)ssl_printf(ssl, "error: no cookie secret file configured\n");
-		return;
-	}
-	if(cookie_secrets == NULL) {
-		worker->daemon->cookie_secrets = cookie_secrets_create();
-		if(!worker->daemon->cookie_secrets) {
-			(void)ssl_printf(ssl, "error: out of memory");
-			return;
-		}
-		cookie_secrets = worker->daemon->cookie_secrets;
-	}
-	lock_basic_lock(&cookie_secrets->lock);
-
-	if(*arg == '\0') {
-		lock_basic_unlock(&cookie_secrets->lock);
-		(void)ssl_printf(ssl, "error: missing argument (cookie_secret)\n");
-		return;
-	}
-	if(strlen(arg) != 32) {
-		lock_basic_unlock(&cookie_secrets->lock);
-		explicit_bzero(arg, strlen(arg));
-		(void)ssl_printf(ssl, "invalid cookie secret: invalid argument length\n");
-		(void)ssl_printf(ssl, "please provide a 128bit hex encoded secret\n");
-		return;
-	}
-	if(hex_pton(arg, secret, UNBOUND_COOKIE_SECRET_SIZE) !=
-		UNBOUND_COOKIE_SECRET_SIZE ) {
-		lock_basic_unlock(&cookie_secrets->lock);
-		explicit_bzero(secret, UNBOUND_COOKIE_SECRET_SIZE);
-		explicit_bzero(arg, strlen(arg));
-		(void)ssl_printf(ssl, "invalid cookie secret: parse error\n");
-		(void)ssl_printf(ssl, "please provide a 128bit hex encoded secret\n");
-		return;
-	}
-	/* Only the worker 0 writes to file, the others update state. */
-	if(worker->thread_num == 0 && !cookie_secret_file_dump(ssl, worker)) {
-		lock_basic_unlock(&cookie_secrets->lock);
-		explicit_bzero(secret, UNBOUND_COOKIE_SECRET_SIZE);
-		explicit_bzero(arg, strlen(arg));
-		(void)ssl_printf(ssl, "error: writing to cookie secret file: \"%s\"\n",
-				secret_file);
-		return;
-	}
-	add_cookie_secret(cookie_secrets, secret, UNBOUND_COOKIE_SECRET_SIZE);
-	explicit_bzero(secret, UNBOUND_COOKIE_SECRET_SIZE);
-	if(worker->thread_num == 0)
-		(void)cookie_secret_file_dump(ssl, worker);
-	lock_basic_unlock(&cookie_secrets->lock);
-	explicit_bzero(arg, strlen(arg));
-	send_ok(ssl);
-}
-
-/** Print cookie secrets */
-static void
-do_print_cookie_secrets(RES* ssl, struct worker* worker) {
-	struct cookie_secrets* cookie_secrets = worker->daemon->cookie_secrets;
-	char secret_hex[UNBOUND_COOKIE_SECRET_SIZE * 2 + 1];
-	int i;
-
-	if(!cookie_secrets)
-		return; /* Output is empty. */
-	lock_basic_lock(&cookie_secrets->lock);
-	for(i = 0; (size_t)i < cookie_secrets->cookie_count; i++) {
-		struct cookie_secret const* cs = &cookie_secrets->
-			cookie_secrets[i];
-		ssize_t const len = hex_ntop(cs->cookie_secret,
-			UNBOUND_COOKIE_SECRET_SIZE, secret_hex,
-			sizeof(secret_hex));
-		(void)len; /* silence unused variable warning with -DNDEBUG */
-		log_assert( len == UNBOUND_COOKIE_SECRET_SIZE * 2 );
-		secret_hex[UNBOUND_COOKIE_SECRET_SIZE * 2] = '\0';
-		if (i == 0)
-			(void)ssl_printf(ssl, "active : %s\n",  secret_hex);
-		else if (cookie_secrets->cookie_count == 2)
-			(void)ssl_printf(ssl, "staging: %s\n",  secret_hex);
-		else
-			(void)ssl_printf(ssl, "staging[%d]: %s\n", i,
-				secret_hex);
-	}
-	lock_basic_unlock(&cookie_secrets->lock);
-	explicit_bzero(secret_hex, sizeof(secret_hex));
-}
-
 /** check for name with end-of-string, space or tab after it */
 static int
 cmdcmp(char* p, const char* cmd, size_t len)
@@ -3544,9 +3327,6 @@ execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd,
 	} else if(cmdcmp(p, "view_local_datas", 16)) {
 		do_view_datas_add(rc, ssl, worker, skipwhite(p+16));
 		return;
-	} else if(cmdcmp(p, "print_cookie_secrets", 20)) {
-		do_print_cookie_secrets(ssl, worker);
-		return;
 	}

 #ifdef THREADS_DISABLED
@@ -3611,12 +3391,6 @@ execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd,
 		do_rpz_enable(ssl, worker, skipwhite(p+10));
 	} else if(cmdcmp(p, "rpz_disable", 11)) {
 		do_rpz_disable(ssl, worker, skipwhite(p+11));
-	} else if(cmdcmp(p, "add_cookie_secret", 17)) {
-		do_add_cookie_secret(ssl, worker, skipwhite(p+17));
-	} else if(cmdcmp(p, "drop_cookie_secret", 18)) {
-		do_drop_cookie_secret(ssl, worker);
-	} else if(cmdcmp(p, "activate_cookie_secret", 22)) {
-		do_activate_cookie_secret(ssl, worker);
 	} else {
 		(void)ssl_printf(ssl, "error unknown command '%s'\n", p);
 	}
@@ -346,12 +346,6 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 		(long long)http2_get_query_buffer_size();
 	s->svr.mem_http2_response_buffer =
 		(long long)http2_get_response_buffer_size();
-#ifdef HAVE_NGTCP2
-	s->svr.mem_quic = (long long)doq_table_quic_size_get(
-		worker->daemon->doq_table);
-#else
-	s->svr.mem_quic = 0;
-#endif /* HAVE_NGTCP2 */

 	/* Set neg cache usage numbers */
 	set_neg_cache_stats(worker, &s->svr, reset);
@@ -480,7 +474,6 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 		total->svr.qtls += a->svr.qtls;
 		total->svr.qtls_resume += a->svr.qtls_resume;
 		total->svr.qhttps += a->svr.qhttps;
-		total->svr.qquic += a->svr.qquic;
 		total->svr.qipv6 += a->svr.qipv6;
 		total->svr.qbit_QR += a->svr.qbit_QR;
 		total->svr.qbit_AA += a->svr.qbit_AA;
@@ -540,8 +533,7 @@ void server_stats_insquery(struct ub_server_stats* stats, struct comm_point* c,
 	else	stats->qclass_big++;
 	stats->qopcode[ LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) ]++;
 	if(c->type != comm_udp) {
-		if(c->type != comm_doq)
-			stats->qtcp++;
+		stats->qtcp++;
 		if(c->ssl != NULL) {
 			stats->qtls++;
 #ifdef HAVE_SSL
@@ -550,10 +542,6 @@ void server_stats_insquery(struct ub_server_stats* stats, struct comm_point* c,
 #endif
 			if(c->type == comm_http)
 				stats->qhttps++;
-#ifdef HAVE_NGTCP2
-			else if(c->type == comm_doq)
-				stats->qquic++;
-#endif
 		}
 	}
 	if(repinfo && addr_is_ip6(&repinfo->remote_addr, repinfo->remote_addrlen))
@@ -160,11 +160,9 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 		+ sizeof(worker->rndstate)
 		+ regional_get_mem(worker->scratchpad)
 		+ sizeof(*worker->env.scratch_buffer)
-		+ sldns_buffer_capacity(worker->env.scratch_buffer);
-	if(worker->daemon->env->fwds)
-		log_info("forwards=%u", (unsigned)forwards_get_mem(worker->env.fwds));
-	if(worker->daemon->env->hints)
-		log_info("hints=%u", (unsigned)hints_get_mem(worker->env.hints));
+		+ sldns_buffer_capacity(worker->env.scratch_buffer)
+		+ forwards_get_mem(worker->env.fwds)
+		+ hints_get_mem(worker->env.hints);
 	if(worker->thread_num == 0)
 		me += acl_list_get_mem(worker->daemon->acl);
 	if(cur_serv) {
@@ -661,18 +659,22 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	if(rep->ttl < timenow) {
 		/* Check if we need to serve expired now */
 		if(worker->env.cfg->serve_expired &&
-			/* if serve-expired-client-timeout is set, serve
-			 * an expired record without attempting recursion
-			 * if the serve_expired_norec_ttl is set for the record
-			 * as we know that recursion is currently failing. */
-			(!worker->env.cfg->serve_expired_client_timeout ||
-			 timenow < rep->serve_expired_norec_ttl)
+			!worker->env.cfg->serve_expired_client_timeout
 #ifdef USE_CACHEDB
 			&& !(worker->env.cachedb_enabled &&
 			  worker->env.cfg->cachedb_check_when_serve_expired)
 #endif
 			) {
-				if(!reply_info_can_answer_expired(rep, timenow))
+				if(worker->env.cfg->serve_expired_ttl &&
+					rep->serve_expired_ttl < timenow)
+					return 0;
+				/* Ignore expired failure answers */
+				if(FLAGS_GET_RCODE(rep->flags) !=
+					LDNS_RCODE_NOERROR &&
+					FLAGS_GET_RCODE(rep->flags) !=
+					LDNS_RCODE_NXDOMAIN &&
+					FLAGS_GET_RCODE(rep->flags) !=
+					LDNS_RCODE_YXDOMAIN)
 					return 0;
 				if(!rrset_array_lock(rep->ref, rep->rrset_count, 0))
 					return 0;
@@ -1109,6 +1111,172 @@ answer_notify(struct worker* w, struct query_info* qinfo,
 	LDNS_OPCODE_SET(sldns_buffer_begin(pkt), LDNS_PACKET_NOTIFY);
 }

+static int
+make_ede_error(struct comm_point* c, struct worker* worker,
+		struct comm_reply* repinfo, int rcode, int16_t ede_code,
+		int ede, struct check_request_result* check_result)
+{
+	size_t opt_rr_mark;
+
+	if(worker->stats.extended)
+		worker->stats.unwanted_queries++;
+	worker_check_request(c->buffer, worker, check_result);
+	if(check_result->value != 0) {
+		if(check_result->value != -1) {
+			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				check_result->value);
+			return 1;
+		}
+		comm_point_drop_reply(repinfo);
+		return 0;
+	}
+	/* worker_check_request() above guarantees that the buffer contains at
+	 * least a header and that qdcount == 1
+	 */
+	log_assert(sldns_buffer_limit(c->buffer) >= LDNS_HEADER_SIZE
+		&& LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) == 1);
+
+	sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE); /* skip header */
+
+	/* check additional section is present and that we respond with EDEs */
+	if(LDNS_ARCOUNT(sldns_buffer_begin(c->buffer)) != 1
+		|| !ede) {
+		LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), rcode);
+		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+		sldns_buffer_flip(c->buffer);
+		return 1;
+	}
+
+	if (!query_dname_len(c->buffer)) {
+		LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_FORMERR);
+		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+		sldns_buffer_flip(c->buffer);
+		return 1;
+	}
+	/* space available for query type and class? */
+	if (sldns_buffer_remaining(c->buffer) < 2 * sizeof(uint16_t)) {
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			 LDNS_RCODE_FORMERR);
+		LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+		sldns_buffer_flip(c->buffer);
+		return 1;
+	}
+	LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+	LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), rcode);
+
+	sldns_buffer_skip(c->buffer, (ssize_t)sizeof(uint16_t)); /* skip qtype */
+
+	sldns_buffer_skip(c->buffer, (ssize_t)sizeof(uint16_t)); /* skip qclass */
+
+	/* The OPT RR to be returned should come directly after
+	 * the query, so mark this spot.
+	 */
+	opt_rr_mark = sldns_buffer_position(c->buffer);
+
+	/* Skip through the RR records */
+	if(LDNS_ANCOUNT(sldns_buffer_begin(c->buffer)) != 0 ||
+		LDNS_NSCOUNT(sldns_buffer_begin(c->buffer)) != 0) {
+		if(!skip_pkt_rrs(c->buffer,
+			((int)LDNS_ANCOUNT(sldns_buffer_begin(c->buffer)))+
+			((int)LDNS_NSCOUNT(sldns_buffer_begin(c->buffer))))) {
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				LDNS_RCODE_FORMERR);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			sldns_buffer_set_position(c->buffer, opt_rr_mark);
+			sldns_buffer_flip(c->buffer);
+			return 1;
+		}
+	}
+	/* Do we have a valid OPT RR here? If not return rcode (could be a valid TSIG or something so no FORMERR) */
+	/* domain name must be the root of length 1. */
+	if(sldns_buffer_remaining(c->buffer) < 1 || *sldns_buffer_current(c->buffer) != 0) {
+		LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		sldns_buffer_set_position(c->buffer, opt_rr_mark);
+		sldns_buffer_flip(c->buffer);
+		return 1;
+	} else {
+		sldns_buffer_skip(c->buffer, 1); /* skip root label */
+	}
+	if(sldns_buffer_remaining(c->buffer) < 2 ||
+		sldns_buffer_read_u16(c->buffer) != LDNS_RR_TYPE_OPT) {
+		LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		sldns_buffer_set_position(c->buffer, opt_rr_mark);
+		sldns_buffer_flip(c->buffer);
+		return 1;
+	}
+	/* Write OPT RR directly after the query,
+	 * so without the (possibly skipped) Answer and NS RRs
+	 */
+	LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+	LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+	sldns_buffer_clear(c->buffer); /* reset write limit */
+	sldns_buffer_set_position(c->buffer, opt_rr_mark);
+
+	/* Check if OPT record can be written
+	 * 17 == root label (1) + RR type (2) + UDP Size (2)
+	 *     + Fields (4) + rdata len (2) + EDE Option code (2)
+	 *     + EDE Option length (2) + EDE info-code (2)
+	 */
+	if (sldns_buffer_available(c->buffer, 17) == 0) {
+		LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		sldns_buffer_flip(c->buffer);
+		return 1;
+	}
+
+	LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 1);
+
+	/* root label */
+	sldns_buffer_write_u8(c->buffer, 0);
+	sldns_buffer_write_u16(c->buffer, LDNS_RR_TYPE_OPT);
+	sldns_buffer_write_u16(c->buffer, EDNS_ADVERTISED_SIZE);
+
+	/* write OPT Record TTL Field */
+	sldns_buffer_write_u32(c->buffer, 0);
+
+	/* write rdata len: EDE option + length + info-code */
+	sldns_buffer_write_u16(c->buffer, 6);
+
+	/* write OPTIONS; add EDE option code */
+	sldns_buffer_write_u16(c->buffer, LDNS_EDNS_EDE);
+
+	/* write single EDE option length (for just 1 info-code) */
+	sldns_buffer_write_u16(c->buffer, 2);
+
+	/* write single EDE info-code */
+	sldns_buffer_write_u16(c->buffer, ede_code);
+
+	sldns_buffer_flip(c->buffer);
+
+	verbose(VERB_ALGO, "attached EDE code: %d", ede_code);
+
+	return 1;
+
+
+}
+
 static int
 deny_refuse(struct comm_point* c, enum acl_access acl,
 	enum acl_access deny, enum acl_access refuse,
@@ -1127,174 +1295,14 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 			worker->stats.unwanted_queries++;
 		return 0;
 	} else if(acl == refuse) {
-		size_t opt_rr_mark;
-
 		if(verbosity >= VERB_ALGO) {
 			log_acl_action("refused", &repinfo->client_addr,
 				repinfo->client_addrlen, acl, acladdr);
 			log_buf(VERB_ALGO, "refuse", c->buffer);
 		}
-
-		if(worker->stats.extended)
-			worker->stats.unwanted_queries++;
-		worker_check_request(c->buffer, worker, check_result);
-		if(check_result->value != 0) {
-			if(check_result->value != -1) {
-				LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-					check_result->value);
-				return 1;
-			}
-			comm_point_drop_reply(repinfo);
-			return 0;
-		}
-		/* worker_check_request() above guarantees that the buffer contains at
-		 * least a header and that qdcount == 1
-		 */
-		log_assert(sldns_buffer_limit(c->buffer) >= LDNS_HEADER_SIZE
-			&& LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) == 1);
-
-		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE); /* skip header */
-
-		/* check additional section is present and that we respond with EDEs */
-		if(LDNS_ARCOUNT(sldns_buffer_begin(c->buffer)) != 1
-			|| !ede) {
-			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-				LDNS_RCODE_REFUSED);
-			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
-			sldns_buffer_flip(c->buffer);
-			return 1;
-		}
-
-		if (!query_dname_len(c->buffer)) {
-			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-				LDNS_RCODE_FORMERR);
-			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
-			sldns_buffer_flip(c->buffer);
-			return 1;
-		}
-		/* space available for query type and class? */
-		if (sldns_buffer_remaining(c->buffer) < 2 * sizeof(uint16_t)) {
-                        LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-                        LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-				 LDNS_RCODE_FORMERR);
-			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
-                        sldns_buffer_flip(c->buffer);
-			return 1;
-		}
-		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-			LDNS_RCODE_REFUSED);
-
-		sldns_buffer_skip(c->buffer, (ssize_t)sizeof(uint16_t)); /* skip qtype */
-
-		sldns_buffer_skip(c->buffer, (ssize_t)sizeof(uint16_t)); /* skip qclass */
-
-		/* The OPT RR to be returned should come directly after
-		 * the query, so mark this spot.
-		 */
-		opt_rr_mark = sldns_buffer_position(c->buffer);
-
-		/* Skip through the RR records */
-		if(LDNS_ANCOUNT(sldns_buffer_begin(c->buffer)) != 0 ||
-			LDNS_NSCOUNT(sldns_buffer_begin(c->buffer)) != 0) {
-			if(!skip_pkt_rrs(c->buffer,
-				((int)LDNS_ANCOUNT(sldns_buffer_begin(c->buffer)))+
-				((int)LDNS_NSCOUNT(sldns_buffer_begin(c->buffer))))) {
-				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-					LDNS_RCODE_FORMERR);
-				LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-				LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-				LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-				sldns_buffer_set_position(c->buffer, opt_rr_mark);
-				sldns_buffer_flip(c->buffer);
-				return 1;
-			}
-		}
-		/* Do we have a valid OPT RR here? If not return REFUSED (could be a valid TSIG or something so no FORMERR) */
-		/* domain name must be the root of length 1. */
-		if(sldns_buffer_remaining(c->buffer) < 1 || *sldns_buffer_current(c->buffer) != 0) {
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			sldns_buffer_set_position(c->buffer, opt_rr_mark);
-			sldns_buffer_flip(c->buffer);
-			return 1;
-		} else {
-			sldns_buffer_skip(c->buffer, 1); /* skip root label */
-		}
-		if(sldns_buffer_remaining(c->buffer) < 2 ||
-			sldns_buffer_read_u16(c->buffer) != LDNS_RR_TYPE_OPT) {
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			sldns_buffer_set_position(c->buffer, opt_rr_mark);
-			sldns_buffer_flip(c->buffer);
-			return 1;
-		}
-		/* Write OPT RR directly after the query,
-		 * so without the (possibly skipped) Answer and NS RRs
-		 */
-		LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-		LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-		sldns_buffer_clear(c->buffer); /* reset write limit */
-		sldns_buffer_set_position(c->buffer, opt_rr_mark);
-
-		/* Check if OPT record can be written
-		 * 17 == root label (1) + RR type (2) + UDP Size (2)
-		 *     + Fields (4) + rdata len (2) + EDE Option code (2)
-		 *     + EDE Option length (2) + EDE info-code (2)
-		 */
-		if (sldns_buffer_available(c->buffer, 17) == 0) {
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			sldns_buffer_flip(c->buffer);
-			return 1;
-		}
-
-		LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 1);
-
-		/* root label */
-		sldns_buffer_write_u8(c->buffer, 0);
-		sldns_buffer_write_u16(c->buffer, LDNS_RR_TYPE_OPT);
-		sldns_buffer_write_u16(c->buffer, EDNS_ADVERTISED_SIZE);
-
-		/* write OPT Record TTL Field */
-		sldns_buffer_write_u32(c->buffer, 0);
-
-		/* write rdata len: EDE option + length + info-code */
-		sldns_buffer_write_u16(c->buffer, 6);
-
-		/* write OPTIONS; add EDE option code */
-		sldns_buffer_write_u16(c->buffer, LDNS_EDNS_EDE);
-
-		/* write single EDE option length (for just 1 info-code) */
-		sldns_buffer_write_u16(c->buffer, 2);
-
-		/* write single EDE info-code */
-		sldns_buffer_write_u16(c->buffer, LDNS_EDE_PROHIBITED);
-
-		sldns_buffer_flip(c->buffer);
-
-		verbose(VERB_ALGO, "attached EDE code: %d", LDNS_EDE_PROHIBITED);
-
-		return 1;
-
+		return make_ede_error(c, worker, repinfo, LDNS_RCODE_REFUSED,
+				LDNS_EDE_PROHIBITED, ede, check_result);
 	}
-
 	return -1;
 }

@@ -1550,6 +1558,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		qinfo.qtype == LDNS_RR_TYPE_MAILA ||
 		qinfo.qtype == LDNS_RR_TYPE_MAILB ||
 		(qinfo.qtype >= 128 && qinfo.qtype <= 248)) {
+		size_t opt_rr_mark;
+
 		verbose(VERB_ALGO, "worker request: formerror for meta-type.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
@@ -1557,20 +1567,17 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
-		sldns_buffer_rewind(c->buffer);
-		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-			LDNS_RCODE_FORMERR);
-		if(worker->stats.extended) {
-			worker->stats.qtype[qinfo.qtype]++;
+		if (make_ede_error(c, worker, repinfo, LDNS_RCODE_FORMERR,
+				LDNS_EDE_INVALID_QUERY_TYPE,
+				worker->env.cfg->ede, &check_result)) {
+			goto send_reply;
 		}
-		goto send_reply;
+		return 0;
 	}
 	if((ret=parse_edns_from_query_pkt(
 			c->buffer, &edns, worker->env.cfg, c, repinfo,
 			(worker->env.now ? *worker->env.now : time(NULL)),
-			worker->scratchpad,
-			worker->daemon->cookie_secrets)) != 0) {
+			worker->scratchpad)) != 0) {
 		struct edns_data reply_edns;
 		verbose(VERB_ALGO, "worker parse edns: formerror.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
@@ -2174,9 +2181,7 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		cfg->harden_large_queries, cfg->http_max_streams,
 		cfg->http_endpoint, cfg->http_notls_downstream,
 		worker->daemon->tcl, worker->daemon->listen_sslctx,
-		dtenv, worker->daemon->doq_table, worker->env.rnd,
-		cfg->ssl_service_key, cfg->ssl_service_pem, cfg,
-		worker_handle_request, worker);
+		dtenv, worker_handle_request, worker);
 	if(!worker->front) {
 		log_err("could not create listening sockets");
 		worker_delete(worker);
@@ -2510,19 +2515,3 @@ void dtio_mainfdcallback(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
 	log_assert(0);
 }
 #endif
-
-#ifdef HAVE_NGTCP2
-void doq_client_event_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
-
-#ifdef HAVE_NGTCP2
-void doq_client_timer_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
@@ -657,7 +657,7 @@ handle_event_moddone(struct module_qstate* qstate, int id)
 		qstate->return_msg->rep &&
 		!dns_cache_store(
 			qstate->env, &qstate->qinfo, qstate->return_msg->rep,
-			0, qstate->prefetch_leeway, 0, NULL,
+			0, 0, 0, NULL,
 			qstate->query_flags, qstate->qstarttime))
 		log_err("out of memory");

@@ -701,7 +701,6 @@ dns64_operate(struct module_qstate* qstate, enum module_ev event, int id,
 			iq->state = DNS64_NEW_QUERY;
 			iq->started_no_cache_store = qstate->no_cache_store;
 			qstate->no_cache_store = 1;
-			ATTR_FALLTHROUGH
  			/* fallthrough */
 		case module_event_pass:
 			qstate->ext_state[id] = handle_event_pass(qstate, id);
@@ -847,7 +846,6 @@ dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate
 	 */
 	cp = construct_reply_info_base(super->region, rep->flags, rep->qdcount,
 		rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl,
-		rep->serve_expired_norec_ttl,
 		rep->an_numrrsets, rep->ns_numrrsets, rep->ar_numrrsets,
 		rep->rrset_count, rep->security, LDNS_EDE_NONE);
 	if(!cp)
@@ -1008,7 +1006,7 @@ dns64_inform_super(struct module_qstate* qstate, int id,
 	/* Store the generated response in cache. */
 	if ( (!super_dq || !super_dq->started_no_cache_store) &&
 		!dns_cache_store(super->env, &super->qinfo, super->return_msg->rep,
-		0, super->prefetch_leeway, 0, NULL, super->query_flags, qstate->qstarttime))
+		0, 0, 0, NULL, super->query_flags, qstate->qstarttime))
 		log_err("out of memory");
 }

@@ -1510,10 +1510,8 @@ void dtio_output_cb(int ATTR_UNUSED(fd), short bits, void* arg)
 #endif

 	if((bits&UB_EV_READ || dtio->ssl_brief_write)) {
-#ifdef HAVE_SSL
 		if(dtio->ssl_brief_write)
 			(void)dtio_disable_brief_write(dtio);
-#endif
 		if(dtio->ready_frame_sent && !dtio->accept_frame_received) {
 			if(dtio_read_accept_frame(dtio) <= 0)
 				return;
@@ -200,25 +200,18 @@ static void tap_data_list_try_to_free_tail(struct tap_data_list* list)
 }

 /** delete the tap structure */
-static void tap_data_free(struct tap_data* data, int free_tail)
+static void tap_data_free(struct tap_data* data)
 {
-	if(!data)
-		return;
-	if(data->ev) {
-		ub_event_del(data->ev);
-		ub_event_free(data->ev);
-	}
+	ub_event_del(data->ev);
+	ub_event_free(data->ev);
 #ifdef HAVE_SSL
 	SSL_free(data->ssl);
 #endif
-	sock_close(data->fd);
+	close(data->fd);
 	free(data->id);
 	free(data->frame);
-	if(data->data_list) {
-		data->data_list->d = NULL;
-		if(free_tail)
-			tap_data_list_try_to_free_tail(data->data_list);
-	}
+	data->data_list->d = NULL;
+	tap_data_list_try_to_free_tail(data->data_list);
 	free(data);
 }

@@ -244,7 +237,7 @@ static void tap_data_list_delete(struct tap_data_list* list)
 	while(e) {
 		next = e->next;
 		if(e->d) {
-			tap_data_free(e->d, 0);
+			tap_data_free(e->d);
 			e->d = NULL;
 		}
 		free(e);
@@ -267,7 +260,7 @@ static void tap_socket_close(struct tap_socket* s)
 {
 	if(!s) return;
 	if(s->fd == -1) return;
-	sock_close(s->fd);
+	close(s->fd);
 	s->fd = -1;
 }

@@ -829,6 +822,7 @@ static int reply_with_accept(struct tap_data* data)
 {
 #ifdef USE_DNSTAP
 	/* len includes the escape and framelength */
+	int r;
 	size_t len = 0;
 	void* acceptframe = fstrm_create_control_frame_accept(
 		DNSTAP_CONTENT_TYPE, &len);
@@ -839,8 +833,6 @@ static int reply_with_accept(struct tap_data* data)

 	fd_set_block(data->fd);
 	if(data->ssl) {
-#ifdef HAVE_SSL
-		int r;
 		if((r=SSL_write(data->ssl, acceptframe, len)) <= 0) {
 			int r2;
 			if((r2=SSL_get_error(data->ssl, r)) == SSL_ERROR_ZERO_RETURN)
@@ -851,7 +843,6 @@ static int reply_with_accept(struct tap_data* data)
 			free(acceptframe);
 			return 0;
 		}
-#endif
 	} else {
 		if(send(data->fd, acceptframe, len, 0) == -1) {
 			log_err("send failed: %s", sock_strerror(errno));
@@ -887,7 +878,6 @@ static int reply_with_finish(struct tap_data* data)

 	fd_set_block(data->fd);
 	if(data->ssl) {
-#ifdef HAVE_SSL
 		int r;
 		if((r=SSL_write(data->ssl, finishframe, len)) <= 0) {
 			int r2;
@@ -899,7 +889,6 @@ static int reply_with_finish(struct tap_data* data)
 			free(finishframe);
 			return 0;
 		}
-#endif
 	} else {
 		if(send(data->fd, finishframe, len, 0) == -1) {
 			log_err("send failed: %s", sock_strerror(errno));
@@ -999,7 +988,7 @@ static int tap_handshake(struct tap_data* data)
 			return 0;
 		} else if(r == 0) {
 			/* closed */
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return 0;
 		} else if(want == SSL_ERROR_SYSCALL) {
 			/* SYSCALL and errno==0 means closed uncleanly */
@@ -1017,7 +1006,7 @@ static int tap_handshake(struct tap_data* data)
 			if(!silent)
 				log_err("SSL_handshake syscall: %s",
 					strerror(errno));
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return 0;
 		} else {
 			unsigned long err = ERR_get_error();
@@ -1027,7 +1016,7 @@ static int tap_handshake(struct tap_data* data)
 				verbose(VERB_OPS, "ssl handshake failed "
 					"from %s", data->id);
 			}
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return 0;
 		}
 	}
@@ -1035,7 +1024,7 @@ static int tap_handshake(struct tap_data* data)
 	data->ssl_handshake_done = 1;
 	if(!tap_check_peer(data)) {
 		/* closed */
-		tap_data_free(data, 1);
+		tap_data_free(data);
 		return 0;
 	}
 	return 1;
@@ -1061,7 +1050,7 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 		if(verbosity>=4) log_info("s recv %d", (int)ret);
 		if(ret == 0) {
 			/* closed or error */
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return;
 		} else if(ret == -1) {
 			/* continue later */
@@ -1083,7 +1072,7 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 			data->frame = calloc(1, data->len);
 			if(!data->frame) {
 				log_err("out of memory");
-				tap_data_free(data, 1);
+				tap_data_free(data);
 				return;
 			}
 		}
@@ -1096,7 +1085,7 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 		if(verbosity>=4) log_info("f recv %d", (int)r);
 		if(r == 0) {
 			/* closed or error */
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return;
 		} else if(r == -1) {
 			/* continue later */
@@ -1121,13 +1110,13 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 		data->is_bidirectional = 1;
 		if(verbosity) log_info("bidirectional stream");
 		if(!reply_with_accept(data)) {
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return;
 		}
 	} else if(data->len >= 4 && sldns_read_uint32(data->frame) ==
 		FSTRM_CONTROL_FRAME_STOP && data->is_bidirectional) {
 		if(!reply_with_finish(data)) {
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return;
 		}
 	}
@@ -1151,9 +1140,7 @@ void dtio_mainfdcallback(int fd, short ATTR_UNUSED(bits), void* arg)
 	char* id = NULL;
 	struct sockaddr_storage addr;
 	socklen_t addrlen = (socklen_t)sizeof(addr);
-	int s;
-	memset(&addr, 0, sizeof(addr));
-	s = accept(fd, (struct sockaddr*)&addr, &addrlen);
+	int s = accept(fd, (struct sockaddr*)&addr, &addrlen);
 	if(s == -1) {
 #ifndef USE_WINSOCK
 		/* EINTR is signal interrupt. others are closed connection. */
@@ -1409,41 +1396,6 @@ static int internal_unittest()
 	/* clean up */
 	tap_data_list_delete(socket->data_list);
 	free(socket);
-
-	/* Start again. Add two elements */
-	socket = calloc(1, sizeof(*socket));
-	log_assert(socket);
-	for(i=0; i<2; i++) {
-		datas[i] = calloc(1, sizeof(struct tap_data));
-		log_assert(datas[i]);
-		log_assert(tap_data_list_insert(&socket->data_list, datas[i]));
-	}
-	/* sanity base check */
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==2);
-
-	/* Free the last data, tail cannot be erased */
-	list = socket->data_list;
-	while(list->next) list = list->next;
-	free(list->d);
-	list->d = NULL;
-	tap_data_list_try_to_free_tail(list);
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==2);
-
-	/* clean up */
-	tap_data_list_delete(socket->data_list);
-	free(socket);
-
-	if(log_get_lock()) {
-		lock_basic_destroy((lock_basic_type*)log_get_lock());
-	}
-	checklock_stop();
-#ifdef USE_WINSOCK
-	WSACleanup();
-#endif
 	return 0;
 }

@@ -1545,8 +1497,8 @@ int main(int argc, char** argv)
 				usage(argv);
 		}
 	}
-	/* argc -= optind; not using further arguments */
-	/* argv += optind; not using further arguments */
+	argc -= optind;
+	argv += optind;

 	if(usessl) {
 #ifdef HAVE_SSL
@@ -1575,9 +1527,6 @@ int main(int argc, char** argv)
 	config_delstrlist(tcp_list.first);
 	config_delstrlist(tls_list.first);

-	if(log_get_lock()) {
-		lock_basic_destroy((lock_basic_type*)log_get_lock());
-	}
 	checklock_stop();
 #ifdef USE_WINSOCK
 	WSACleanup();
@@ -1785,19 +1734,3 @@ void remote_get_opt_ssl(char* ATTR_UNUSED(str), void* ATTR_UNUSED(arg))
 {
        log_assert(0);
 }
-
-#ifdef HAVE_NGTCP2
-void doq_client_event_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
-
-#ifdef HAVE_NGTCP2
-void doq_client_timer_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
@@ -1,205 +1,3 @@
-10 October 2024: Wouter
-	- Fix cookie_file test sporadic fails for time change during
-	  the test.
-	- Fix add reallocarray to alloc stats unit test, and disable
-	  override of strdup in unbound-host, and the result of config
-	  get option is freed properly.
-
-9 October 2024: Wouter
-	- Merge #871: DNS over QUIC. This adds `quic-port: 853` and
-	  `quic-size: 8m` that enable dnsoverquic, and the counters
-	  `num.query.quic` and `mem.quic` in the statistics output.
-	  The feature needs to be enabled by compiling with libngtcp2,
-	  with `--with-libngtcp2=path` and libngtcp2 needs openssl+quic,
-	  pass that with `--with-ssl=path` to compile unbound as well.
-	- Fix to limit NSEC TTL for messages from cachedb. Fix to limit the
-	  prefetch ttl for messages after a CNAME with short TTL.
-	- Fix for dnstap compile of doqclient with doq disabled.
-
-8 October 2024: Wouter
-	- Fix #1149: unbound-control-setup hangs sometimes depending on
-	  the openssl version.
-	- Fix #1128: Cannot override tcp-upstream and tls-upstream with
-	  forward-tcp-upstream and forward-tls-upstream.
-
-3 October 2024: Yorgos
-	- Fix CVE-2024-8508, unbounded name compression could lead to denial
-	  of service.
-	- This fix was part of 1.21.1, a security point release on 1.21.0.
-	  The code repository continues with this fix and the version number
-	  1.22.0.
-
-30 September 2024: Wouter
-	- Fix negative cache NSEC3 parameter compares for zero length NSEC3
-	  salt.
-	- Fix unbound dnstap socket test program analyzer warnings about
-	  unused variable assignments and variable initialization.
-
-25 September 2024: Wouter
-	- Fix #1144: [FR] log timestamps in ISO8601 format with timezone.
-	  This adds the option `log-time-iso: yes` that logs in ISO8601
-	  format.
-
-24 September 2024: Yorgos
-	- Attempt to further fix doh_downstream_buffer_size.tdir flakiness.
-	- More clear text for prefetch and minimal-responses in the
-	  unbound.conf man page.
-	- Merge #1143: Fix cache update when serve expired is used. Expired
-	  records are favored over resolution and validation failures when
-	  serve-expired is used.
-
-23 September 2024: Wouter
-	- Fix dns64 with prefetch that the prefetch is stored in cache.
-
-23 September 2024: Yorgos
-	- Fix doxygen warnings by commenting out CLANG_ASSISTED_PARSING,
-	  CLANG_ADD_INC_PATHS, CLANG_OPTIONS and CLANG_DATABASE_PATH; they were
-	  already disabled.
-
-17 September 2024: Wouter
-	- Add redis-command-timeout: 20 and redis-connect-timeout: 200,
-	  that can set the timeout separately for commands and the
-	  connection set up to the redis server. If they are not
-	  specified, the redis-timeout value is used.
-
-16 September 2024: Wouter
-	- Merge #1140: Fix spelling mistake in comments.
-
-11 September 2024: Yorgos
-	- Fix and add comments in testdata/val_negcache_ttl.rpl.
-
-10 September 2024: Wouter
-	- Fix to limit NSEC and NSEC3 TTL when aggressive nsec is
-	  enabled (RFC9077).
-	- Add unit test for ttl limit for aggressive nsec.
-
-6 September 2024: Yorgos
-	- Fix alloc-size and calloc-transposed-args compiler warnings.
-	- Fix comment to not trigger doxygen unknown command.
-
-5 September 2024: Wouter
-	- Fix config file read for dnstap-sample-rate.
-
-2 September 2024: Wouter
-	- Merge #1135: Add new IANA trust anchor.
-
-30 August 2024: Wouter
-	- Merge #1132: b.root renumbering.
-	- Fix for #1132, adjusted unit test for change in the test file.
-	- Fix for #1132, comment about adjusted copy of reference check.
-
-29 August 2024: Wouter
-	- Unit test for auth zone transfer TLS, and TLS failure.
-	- Fix to print port number in logs for auth zone transfer activities.
-
-28 August 2024: Wouter
-	- Fix that when rpz is applied the message does not get picked up by
-	  the validator. That stops validation failures for the message.
-	- Fix that stub-zone and forward-zone clauses do not exhaust memory
-	  for long content.
-
-27 August 2024: Wouter
-	- Fix #1130: Loads of logs: "validation failure: key for validation
-	  <domain>. is marked as invalid because of a previous" for
-	  non-DNSSEC signed zone.
-
-23 August 2024: Wouter
-	- Merge patch to fix for glue that is outside of zone, with
-	  `harden-unverified-glue`, from Karthik Umashankar (Microsoft).
-	  Enabling this option protects the Unbound resolver against bad
-	  glue, that is unverified out of zone glue, by resolving them.
-	  It uses the records as last resort if there is no other working
-	  glue.
-	- Fix #1127: error: "memory exhausted" when defining more than 9994
-	  local-zones.
-	- Fix documentation for cache_fill_missing function.
-
-21 August 2024: Wouter
-	- Add cross platform freebsd, openbsd and netbsd to github ci.
-	- Fix for char signedness warnings on NetBSD.
-
-20 August 2024: Wouter
-	- Add iter-scrub-ns, iter-scrub-cname and max-global-quota
-	  configuration options.
-
-19 August 2024: Wouter
-	- Fix #1126: unbound-control-setup hangs while testing for openssl
-	  presence starting from version 1.21.0.
-
-9 August 2024: Wouter
-	- Fix spelling for the cache-min-negative-ttl entry in the
-	  example.conf.
-	- Tag for release 1.21.0, the repository continues with 1.21.1
-	  in development.
-
-8 August 2024: Wouter
-	- Fix CAMP issues with global quota. Thanks to Huayi Duan, Marco
-	  Bearzi, Jodok Vieli, and Cagin Tanir from NetSec group, ETH Zurich.
-	- Fix CacheFlush issues with limit on NS RRs. Thanks to Yehuda Afek,
-	  Anat Bremler-Barr, Shoham Danino and Yuval Shavitt (Tel-Aviv
-	  University and Reichman University).
-	- Set version number to 1.21.0 for release. This has tag 1.21.0rc1.
-	- Fix that for windows the module startup is called and sets up
-	  the module-config.
-
-2 August 2024: Wouter
-	- Fix that alloc stats has strdup checks, it stops debuggers from
-	  complaining about mismatch at free time.
-	- Fix testbound for alloc stats strdup in util/alloc.c.
-	- Merge #1090: Cookie secret file. Adds
-	  `cookie-secret-file: "unbound_cookiesecrets.txt"` option to store
-	  cookie secrets for EDNS COOKIE secret rollover. The remote control
-	  add_cookie_secret, activate_cookie_secret and drop_cookie_secret
-	  commands can be used for rollover, the command print_cookie_secrets
-	  shows the values in use.
-	- Fix that alloc stats for forwards and hints are printed, and when
-	  alloc stats is enabled, the unit test for unbound control waits for
-	  reloads to complete.
-
-1 August 2024: Wouter
-	- Fix dnstap test program, cleans up to have clean memory on exit,
-	  for tap_data_free, does not delete NULL items. Also it does not try
-	  to free the tail, specifically in the free of the list since that
-	  picked up the next item in the list for its loop causing invalid
-	  free. Added internal unit test to unbound-dnstap-socket for that.
-	- Fix that the worker mem report with alloc stats does not attempt
-	  to print memory use of forwards and hints if they have been
-	  deleted already.
-
-31 July 2024: Wouter
-	- Fix for #1114: Fix that cache fill for forward-host names is
-	  performed, so that with nonzero target-fetch-policy it fetches
-	  forwarder addresses and uses them from cache. Also updated that
-	  delegation point cache fill routines use CDflag for AAAA message
-	  lookups, so that its negative lookup stops a recursion since the
-	  cache uses the bit for disambiguation for dns64 but the recursion
-	  uses CDflag for the AAAA target lookups, so the check correctly
-	  stops a useless recursion by its cache lookup.
-
-30 July 2024: Wouter
-	- Fix to document parameters of auth_zone_verify_zonemd_with_key.
-
-25 July 2024: Wouter
-	- Add root key 38696 from 2024 for DNSSEC validation. It is added
-	  to the default root keys in unbound-anchor. The content can be
-	  inspected with `unbound-anchor -l`.
-
-23 July 2024: Yorgos
-	- Fix #1106: ratelimit-below-domain logs the wrong FROM address.
-	- Cleanup ede.tdir test.
-	- For #935 and #1104, clarify RPZ order and semantics.
-
-23 July 2024: Wouter
-	- Merge #1110: Make fallthrough explicit for libworker.c.
-	- For #1110: Test for fallthrough attribute in configure and add
-	  fallthrough attribute annotations.
-	- Fix compile when the compiler does not support the noreturn
-	  attribute.
-	- Fix to have empty definition when not supported for weak attribute.
-	- Fix uninitialized variable warning in create_tcp_accept_sock.
-	- Fix link of dnstap without openssl.
-	- Fix link of unbound-dnstap-socket without openssl.
-
 19 July 2024: Wouter
 	- Add dnstap-sample-rate that logs only 1/N messages, for high volume
 	  server environments. Thanks Dan Luther.
@@ -187,15 +187,6 @@ server:
 	# query upon encountering a CNAME record.
 	# max-query-restarts: 11

-	# Limit on number of NS records in NS RRset for incoming packets.
-	# iter-scrub-ns: 20
-
-	# Limit on number of CNAME, DNAME records for incoming packets.
-	# iter-scrub-cname: 11
-
-	# Limit on upstream queries for an incoming query and its recursion.
-	# max-global-quota: 128
-
 	# msec for waiting for an unknown server to reply.  Increase if you
 	# are behind a slow satellite link, to eg. 1128.
 	# unknown-server-time-limit: 376
@@ -237,7 +228,7 @@ server:

 	# the time to live (TTL) value lower bound, in seconds. Default 0.
 	# For negative responses in the cache. If disabled, default,
-	# cache-min-ttl applies if configured.
+	# cache-min-tll applies if configured.
 	# cache-min-negative-ttl: 0

 	# the time to live (TTL) value for cached roundtrip times, lameness and
@@ -461,10 +452,6 @@ server:
 	# print UTC timestamp in ascii to logfile, default is epoch in seconds.
 	# log-time-ascii: no

-	# log timestamp in ISO8601 format if also log-time-ascii is enabled.
-	# (y-m-dTh:m:s.msec[+-]tzhours:tzminutes)
-	# log-time-iso: no
-
 	# print one line with time, IP, name, type, class for every query.
 	# log-queries: no

@@ -537,9 +524,6 @@ server:
 	# Harden against out of zone rrsets, to avoid spoofing attempts.
 	# harden-glue: yes

-	# Harden against unverified (outside-zone, including sibling zone) glue rrsets
-	# harden-unverified-glue: no
-
 	# Harden against receiving dnssec-stripped data. If you turn it
 	# off, failing to validate dnskey data for a trustanchor will
 	# trigger insecure mode for that zone (like without a trustanchor).
@@ -920,7 +904,6 @@ server:
 	# tls-service-pem: "path/to/publiccertfile.pem"
 	# tls-port: 853
 	# https-port: 443
-	# quic-port: 853

 	# cipher setting for TLSv1.2
 	# tls-ciphers: "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256"
@@ -985,9 +968,6 @@ server:
 	# Disable TLS for DNS-over-HTTP downstream service.
 	# http-notls-downstream: no

-	# Maximum number of bytes used for QUIC buffers.
-	# quic-size: 8m
-
 	# The interfaces that use these listed port numbers will support and
 	# expect PROXYv2. For UDP and TCP/TLS interfaces.
 	# proxy-protocol-port: portno for each of the port numbers.
@@ -1064,11 +1044,6 @@ server:
 	# example value "000102030405060708090a0b0c0d0e0f".
 	# cookie-secret: <128 bit random hex string>

-	# File with cookie secrets, the 'cookie-secret:' option is ignored
-	# and the file can be managed to have staging and active secrets
-	# with remote control commands. Disabled with "". Default is "".
-	# cookie-secret-file: "/usr/local/etc/unbound_cookiesecrets.txt"
-
 	# Enable to attach Extended DNS Error codes (RFC8914) to responses.
 	# ede: no

@@ -1309,10 +1284,6 @@ remote-control:
 #     # redis-server-password: ""
 #     # timeout (in ms) for communication with the redis server
 #     redis-timeout: 100
-#     # timeout (in ms) for commands, if 0, uses redis-timeout.
-#     redis-command-timeout: 0
-#     # timeout (in ms) for connection set up, if 0, uses redis-timeout.
-#     redis-connect-timeout: 0
 #     # set timeout on redis records based on DNS response TTL
 #     redis-expire-records: no
 #     # redis logical database to use, 0 is the default database.
@@ -1368,8 +1339,7 @@ remote-control:
 # 	dnstap-log-forwarder-response-messages: no

 # Response Policy Zones
-# RPZ policies. Applied in order of configuration. Any match from an earlier
-# RPZ zone will terminate the RPZ lookup. QNAME, Response IP
+# RPZ policies. Applied in order of configuration. QNAME, Response IP
 # Address, nsdname, nsip and clientip triggers are supported. Supported
 # actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp-only
 # and drop.  Policies can be loaded from a file, or using zone
@@ -350,41 +350,6 @@ Remove a list of \fIlocal_data\fR for given view from stdin. Like local_datas_re
 .TP
 .B view_local_datas \fIview\fR
 Add a list of \fIlocal_data\fR for given view from stdin.  Like local_datas.
-.TP
-.B add_cookie_secret <secret>
-Add or replace a cookie secret persistently. <secret> needs to be an 128 bit
-hex string.
-.IP
-Cookie secrets can be either \fIactive\fR or \fIstaging\fR. \fIActive\fR cookie
-secrets are used to create DNS Cookies, but verification of a DNS Cookie
-succeeds with any of the \fIactive\fR or \fIstaging\fR cookie secrets. The
-state of the current cookie secrets can be printed with the
-\fBprint_cookie_secrets\fR command.
-.IP
-When there are no cookie secrets configured yet, the <secret> is added as
-\fIactive\fR. If there is already an \fIactive\fR cookie secret, the <secret>
-is added as \fIstaging\fR or replacing an existing \fIstaging\fR secret.
-.IP
-To "roll" a cookie secret used in an anycast set. The new secret has to be
-added as staging secret to \fBall\fR nodes in the anycast set. When \fBall\fR
-nodes can verify DNS Cookies with the new secret, the new secret can be
-activated with the \fBactivate_cookie_secret\fR command. After \fBall\fR nodes
-have the new secret \fIactive\fR for at least one hour, the previous secret can
-be dropped with the \fBdrop_cookie_secret\fR command.
-.IP
-Persistence is accomplished by writing to a file which if configured with the
-\fBcookie\-secret\-file\fR option in the server section of the config file.
-This is disabled by default, "".
-.TP
-.B drop_cookie_secret
-Drop the \fIstaging\fR cookie secret.
-.TP
-.B activate_cookie_secret
-Make the current \fIstaging\fR cookie secret \fIactive\fR, and the current
-\fIactive\fR cookie secret \fIstaging\fR.
-.TP
-.B print_cookie_secrets
-Show the current configured cookie secrets with their status.
 .SH "EXIT CODE"
 The unbound\-control program exits with status code 1 on error, 0 on success.
 .SH "SET UP"
@@ -606,10 +571,6 @@ queries waiting for request stream completion.
 Memory in bytes used by the HTTP/2 response buffers. Containing DNS responses
 waiting to be written back to the clients.
 .TP
-.I mem.quic
-Memory in bytes used by QUIC. Containing connection information, stream
-information, queries read and responses written back to the clients.
-.TP
 .I histogram.<sec>.<usec>.to.<sec>.<usec>
 Shows a histogram, summed over all threads. Every element counts the
 recursive queries whose reply time fit between the lower and upper bound.
@@ -658,10 +619,6 @@ Number of queries that were made using HTTPS towards the Unbound server.
 These are also counted in num.query.tcp and num.query.tls, because HTTPS
 uses TLS and TCP.
 .TP
-.I num.query.quic
-Number of queries that were made using QUIC towards the Unbound server.
-These are also counted in num.query.tls, because TLS is used for these queries.
-.TP
 .I num.query.ipv6
 Number of queries that were made using IPv6 towards the Unbound server.
 .TP
@@ -566,9 +566,6 @@ tls\-system\-cert to load CA certs, otherwise the connections cannot be
 authenticated. This option enables TLS for all of them, but if you do not set
 this you can configure TLS specifically for some forward zones with
 forward\-tls\-upstream.  And also with stub\-tls\-upstream.
-If the tls\-upstream option is enabled, it is for all the forwards and stubs,
-where the forward\-tls\-upstream and stub\-tls\-upstream options are ignored,
-as if they had been set to yes.
 .TP
 .B ssl\-upstream: \fI<yes or no>
 Alternate syntax for \fBtls\-upstream\fR.  If both are present in the config
@@ -719,18 +716,6 @@ PROXYv2 is supported for UDP and TCP/TLS listening interfaces.
 There is no support for PROXYv2 on a DoH or DNSCrypt listening interface.
 Can list multiple, each on a new statement.
 .TP
-.B quic\-port: \fI<number>
-The port number on which to provide DNS-over-QUIC service, default 853, only
-interfaces configured with that port number as @number get the QUIC service.
-The interface uses QUIC for the UDP traffic on that port number.
-.TP
-.B quic\-size: \fI<size in bytes>
-Maximum number of bytes for all QUIC buffers and data combined. Default is 8
-megabytes. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes,
-megabytes or gigabytes (1024*1024 bytes in a megabyte). New connections receive
-connection refused when the limit is exceeded. New streams are reset when the
-limit is exceeded.
-.TP
 .B use\-systemd: \fI<yes or no>
 Enable or disable systemd socket activation.
 Default is no.
@@ -951,10 +936,6 @@ Sets logfile lines to use a timestamp in UTC ascii. Default is no, which
 prints the seconds since 1970 in brackets. No effect if using syslog, in
 that case syslog formats the timestamp printed into the log files.
 .TP
-.B log\-time\-iso:\fR <yes or no>
-Log time in ISO8601 format, if \fBlog\-time\-ascii:\fR yes is also set.
-Default is no.
-.TP
 .B log\-queries: \fI<yes or no>
 Prints one line per query to the log, with the log timestamp and IP address,
 name, type and class.  Default is no.  Note that it takes time to print these
@@ -1067,11 +1048,6 @@ payload is very large.
 .B harden\-glue: \fI<yes or no>
 Will trust glue only if it is within the servers authority. Default is yes.
 .TP
-.B harden\-unverified\-glue: \fI<yes or no>
-Will trust only in-zone glue. Will try to resolve all out of zone
-(\fI<unverfied>) glue. Will fallback to the original glue if unable to resolve.
-Default is no.
-.TP
 .B harden\-dnssec\-stripped: \fI<yes or no>
 Require DNSSEC data for trust\-anchored zones, if such data is absent,
 the zone becomes bogus. If turned off, and no DNSSEC data is received
@@ -1195,11 +1171,10 @@ IP6 ::1 and IP4 127.0.0.1/8. If no, then localhost can be used to send
 queries to. Default is yes.
 .TP
 .B prefetch: \fI<yes or no>
-If yes, cache hits on message cache elements that are on their last 10 percent
-of their TTL value trigger a prefetch to keep the cache up to date.
-Default is no.
-Turning it on gives about 10 percent more traffic and load on the machine, but
-popular items do not expire from the cache.
+If yes, message cache elements are prefetched before they expire to
+keep the cache up to date.  Default is no.  Turning it on gives about
+10 percent more traffic and load on the machine, but popular items do
+not expire from the cache.
 .TP
 .B prefetch\-key: \fI<yes or no>
 If yes, fetch the DNSKEYs earlier in the validation process, when a DS
@@ -1219,13 +1194,12 @@ from the query ID, for speed and thread safety).  Default is yes.
 .B minimal-responses: \fI<yes or no>
 If yes, Unbound does not insert authority/additional sections into response
 messages when those sections are not required.  This reduces response
-size significantly, and may avoid TCP fallback for some responses which may
-cause a slight speedup.  The default is yes, even though the DNS
+size significantly, and may avoid TCP fallback for some responses.
+This may cause a slight speedup.  The default is yes, even though the DNS
 protocol RFCs mandate these sections, and the additional content could
-save roundtrips for clients that use the additional content.
-However these sections are hardly used by clients.
-Enabling prefetch can benefit clients that need the additional content
-by trying to keep that content fresh in the cache.
+be of use and save roundtrips for clients.  Because they are not used,
+and the saved roundtrips are easier saved with prefetch, whilst this is
+faster.
 .TP
 .B disable-dnssec-lame-check: \fI<yes or no>
 If true, disables the DNSSEC lameness check in the iterator.  This check
@@ -1983,23 +1957,6 @@ Changing this value needs caution as it can allow long CNAME chains to be
 accepted, where Unbound needs to verify (resolve) each link individually.
 Default is 11.
 .TP 5
-.B iter\-scrub\-ns: \fI<number>
-Limit on the number of NS records allowed in an rrset of type NS, from the
-iterator scrubber. This protects the internals of the resolver from overly
-large NS sets. Default is 20.
-.TP 5
-.B iter\-scrub\-cname: \fI<number>
-Limit on the number of CNAME, DNAME records in an answer, from the iterator
-scrubber. This protects the internals of the resolver from overly long
-indirection chains. Clips off the remainder of the reply packet at that point.
-Default is 11.
-.TP 5
-.B max\-global\-quota: \fI<number>
-Limit on the number of upstream queries sent out for an incoming query and
-its subqueries from recursion. It is not reset during the resolution. When
-it is exceeded the query is failed and the lookup process stops.
-Default is 128.
-.TP 5
 .B fast\-server\-permil: \fI<number>
 Specify how many times out of 1000 to pick from the set of fastest servers.
 0 turns the feature off.  A value of 900 would pick from the fastest
@@ -2026,20 +1983,6 @@ Useful to explicitly set for servers in an anycast deployment that need to
 share the secret in order to verify each other's Server Cookies.
 An example hex string would be "000102030405060708090a0b0c0d0e0f".
 Default is a 128 bits random secret generated at startup time.
-This option is ignored if a \fBcookie\-secret\-file\fR is
-present.  In that case the secrets from that file are used in DNS Cookie
-calculations.
-.TP 5
-.B cookie\-secret\-file: \fI<filename>
-File from which the secrets are read used in DNS Cookie calculations. When this
-file exists, the secrets in this file are used and the secret specified by the
-\fBcookie-secret\fR option is ignored.
-Enable it by setting a filename, like "/usr/local/etc/unbound_cookiesecrets.txt".
-The content of this file must be manipulated with the \fBadd_cookie_secret\fR,
-\fBdrop_cookie_secret\fR and \fBactivate_cookie_secret\fR commands to the
-\fIunbound\-control\fR(8) tool. Please see that manpage on how to perform a
-safe cookie secret rollover.
-Default is "" (disabled).
 .TP 5
 .B edns\-client\-string: \fI<IP netblock> <string>
 Include an EDNS0 option containing configured ascii string in queries with
@@ -2831,14 +2774,6 @@ if the Redis server does not have the requested data, and will try to
 re-establish a new connection later.
 This option defaults to 100 milliseconds.
 .TP
-.B redis-command-timeout: \fI<msec>\fR
-The timeout to use for redis commands, in milliseconds. If 0, it uses the
-redis\-timeout value. The default is 0.
-.TP
-.B redis-connect-timeout: \fI<msec>\fR
-The timeout to use for redis connection set up, in milliseconds. If 0, it
-uses the redis\-timeout value. The default is 0.
-.TP
 .B redis-expire-records: \fI<yes or no>
 If Redis record expiration is enabled.  If yes, Unbound sets timeout for Redis
 records so that Redis can evict keys that have expired automatically.  If
@@ -2948,11 +2883,9 @@ Enable to log forwarder response messages.  Default is no.
 .SS Response Policy Zone Options
 .LP
 Response Policy Zones are configured with \fBrpz:\fR, and each one must have a
-\fBname:\fR. There can be multiple ones, by listing multiple RPZ clauses, each
-with a different name. RPZ clauses are applied in order of configuration and
-any match from an earlier RPZ zone will terminate the RPZ lookup. Note that a
-PASSTHRU action is still considered a match.
-The \fBrespip\fR module needs to be added to the \fBmodule-config\fR, e.g.:
+\fBname:\fR. There can be multiple ones, by listing multiple rpz clauses, each
+with a different name. RPZ clauses are applied in order of configuration. The
+\fBrespip\fR module needs to be added to the \fBmodule-config\fR, e.g.:
 \fBmodule-config: "respip validator iterator"\fR.
 .P
 QNAME, Response IP Address, nsdname, nsip and clientip triggers are supported.
@@ -2960,13 +2893,12 @@ Supported actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp\-only
 and drop.  RPZ QNAME triggers are applied after \fBlocal\-zones\fR and
 before \fBauth\-zones\fR.
 .P
-The RPZ zone is a regular DNS zone formatted with a SOA start record as usual.
-The items in the zone are entries, that specify what to act on (the trigger)
-and what to do (the action).
-The trigger to act on is recorded in the name, the action to do is recorded as
-the resource record.
-The names all end in the zone name, so you could type the trigger names without
-a trailing dot in the zonefile.
+The rpz zone is formatted with a SOA start record as usual.  The items in
+the zone are entries, that specify what to act on (the trigger) and what to
+do (the action).  The trigger to act on is recorded in the name, the action
+to do is recorded as the resource record.  The names all end in the zone
+name, so you could type the trigger names without a trailing dot in the
+zonefile.
 .P
 An example RPZ record, that answers example.com with NXDOMAIN
 .nf
@@ -3066,7 +2998,7 @@ externally blocked. Default is no.
 If enabled the zone is authoritatively answered for and queries for the RPZ
 zone information are answered to downstream clients. This is useful for
 monitoring scripts, that can then access the SOA information to check if
-the RPZ information is up to date. Default is no.
+the rpz information is up to date. Default is no.
 .TP
 .B tags: \fI<list of tags>
 Limit the policies from this RPZ clause to clients with a matching tag. Tags
@@ -1226,7 +1226,7 @@ VERBATIM_HEADERS       = NO
 # generated with the -Duse_libclang=ON option for CMake.
 # The default value is: NO.

-#CLANG_ASSISTED_PARSING = NO
+CLANG_ASSISTED_PARSING = NO

 # If the CLANG_ASSISTED_PARSING tag is set to YES and the CLANG_ADD_INC_PATHS
 # tag is set to YES then doxygen will add the directory of each input to the
@@ -1234,7 +1234,7 @@ VERBATIM_HEADERS       = NO
 # The default value is: YES.
 # This tag requires that the tag CLANG_ASSISTED_PARSING is set to YES.

-#CLANG_ADD_INC_PATHS    = YES
+CLANG_ADD_INC_PATHS    = YES

 # If clang assisted parsing is enabled you can provide the compiler with command
 # line options that you would normally use when invoking the compiler. Note that
@@ -1242,7 +1242,7 @@ VERBATIM_HEADERS       = NO
 # specified with INPUT and INCLUDE_PATH.
 # This tag requires that the tag CLANG_ASSISTED_PARSING is set to YES.

-#CLANG_OPTIONS          =
+CLANG_OPTIONS          =

 # If clang assisted parsing is enabled you can provide the clang parser with the
 # path to the directory containing a file called compile_commands.json. This
@@ -1255,7 +1255,7 @@ VERBATIM_HEADERS       = NO
 # Note: The availability of this option depends on whether or not doxygen was
 # generated with the -Duse_libclang=ON option for CMake.

-#CLANG_DATABASE_PATH    =
+CLANG_DATABASE_PATH    =

 #---------------------------------------------------------------------------
 # Configuration options related to the alphabetical class index
@@ -367,47 +367,6 @@ type_allowed_in_additional_section(uint16_t tp)
 	return 0;
 }

-/** Shorten RRset */
-static void
-shorten_rrset(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
-{
-	/* The too large NS RRset is shortened. This is so that too large
-	 * content does not overwhelm the cache. It may make the rrset
-	 * bogus if it was signed, and then the domain is not resolved any
-	 * more, that is okay, the NS RRset was too large. During a referral
-	 * it can be shortened and then the first part of the list could
-	 * be used to resolve. The scrub continues to disallow glue for the
-	 * removed nameserver RRs and removes that too. Because the glue
-	 * is not marked as okay, since the RRs have been removed here. */
-	int i;
-	struct rr_parse* rr = rrset->rr_first, *prev = NULL;
-	if(!rr)
-		return;
-	for(i=0; i<count; i++) {
-		prev = rr;
-		rr = rr->next;
-		if(!rr)
-			return; /* The RRset is already short. */
-	}
-	if(verbosity >= VERB_QUERY
-		&& rrset->dname_len <= LDNS_MAX_DOMAINLEN) {
-		uint8_t buf[LDNS_MAX_DOMAINLEN+1];
-		dname_pkt_copy(pkt, buf, rrset->dname);
-		log_nametypeclass(VERB_QUERY, "normalize: shorten RRset:", buf,
-			rrset->type, ntohs(rrset->rrset_class));
-	}
-	/* remove further rrs */
-	rrset->rr_last = prev;
-	rrset->rr_count = count;
-	while(rr) {
-		rrset->size -= rr->size;
-		rr = rr->next;
-	}
-	if(rrset->rr_last)
-		rrset->rr_last->next = NULL;
-	else	rrset->rr_first = NULL;
-}
-
 /**
 * This routine normalizes a response. This includes removing "irrelevant"
 * records from the answer and additional sections and (re)synthesizing
@@ -428,7 +387,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 	uint8_t* sname = qinfo->qname;
 	size_t snamelen = qinfo->qname_len;
 	struct rrset_parse* rrset, *prev, *nsset=NULL;
-	int cname_length = 0; /* number of CNAMEs, or DNAMEs */

 	if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR &&
 		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN)
@@ -443,16 +401,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 	prev = NULL;
 	rrset = msg->rrset_first;
 	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
-		if(cname_length > env->cfg->iter_scrub_cname) {
-			/* Too many CNAMEs, or DNAMEs, from the authority
-			 * server, scrub down the length to something
-			 * shorter. This deletes everything after the limit
-			 * is reached. The iterator is going to look up
-			 * the content one by one anyway. */
-			remove_rrset("normalize: removing because too many cnames:",
-				pkt, msg, prev, &rrset);
-			continue;
-		}
 		if(rrset->type == LDNS_RR_TYPE_DNAME && 
 			pkt_strict_sub(pkt, sname, rrset->dname)) {
 			/* check if next rrset is correct CNAME. else,
@@ -472,7 +420,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					"too long");
 				return 0;
 			}
-			cname_length++;
 			if(nx && nx->type == LDNS_RR_TYPE_CNAME && 
 			   dname_pkt_compare(pkt, sname, nx->dname) == 0) {
 				/* check next cname */
@@ -513,7 +460,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 		if(rrset->type == LDNS_RR_TYPE_CNAME) {
 			struct rrset_parse* nx = rrset->rrset_all_next;
 			uint8_t* oldsname = sname;
-			cname_length++;
 			/* see if the next one is a DNAME, if so, swap them */
 			if(nx && nx->section == LDNS_SECTION_ANSWER &&
 				nx->type == LDNS_RR_TYPE_DNAME &&
@@ -561,10 +507,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					LDNS_SECTION_ANSWER &&
 					dname_pkt_compare(pkt, oldsname,
 					rrset->dname) == 0) {
-					if(rrset->type == LDNS_RR_TYPE_NS &&
-						rrset->rr_count > env->cfg->iter_scrub_ns) {
-						shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
-					}
 					prev = rrset;
 					rrset = rrset->rrset_all_next;
 				}
@@ -580,11 +522,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 			continue;
 		}

-		if(rrset->type == LDNS_RR_TYPE_NS &&
-			rrset->rr_count > env->cfg->iter_scrub_ns) {
-			shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
-		}
-
 		/* Mark the additional names from relevant rrset as OK. */
 		/* only for RRsets that match the query name, other ones
 		 * will be removed by sanitize, so no additional for them */
@@ -641,25 +578,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					"RRset:", pkt, msg, prev, &rrset);
 				continue;
 			}
-			if(rrset->rr_count > env->cfg->iter_scrub_ns) {
-				/* If this is not a referral, and the NS RRset
-				 * is signed, then remove it entirely, so
-				 * that when it becomes bogus it does not
-				 * make the message that is otherwise fine
-				 * into a bogus message. */
-				if(!(msg->an_rrsets == 0 &&
-					FLAGS_GET_RCODE(msg->flags) ==
-					LDNS_RCODE_NOERROR &&
-					!soa_in_auth(msg) &&
-					!(msg->flags & BIT_AA)) &&
-					rrset->rrsig_count != 0) {
-					remove_rrset("normalize: removing too large NS "
-						"RRset:", pkt, msg, prev, &rrset);
-					continue;
-				} else {
-					shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
-				}
-			}
 		}
 		/* if this is type DS and we query for type DS we just got
 		 * a referral answer for our type DS query, fix packet */
@@ -871,7 +789,6 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 {
 	int del_addi = 0; /* if additional-holding rrsets are deleted, we
 		do not trust the normalized additional-A-AAAA any more */
-	uint8_t* ns_rrset_dname = NULL;
 	int added_rrlen_ede = 0;
 	struct rrset_parse* rrset, *prev;
 	prev = NULL;
@@ -977,16 +894,6 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 				continue;
 			}
 		}
-		if(rrset->type == LDNS_RR_TYPE_NS &&
-			(rrset->section == LDNS_SECTION_AUTHORITY ||
-			rrset->section == LDNS_SECTION_ANSWER)) {
-			/* If the type is NS, and we're in the
-			 * answer or authority section, then
-			 * store the dname so we can check
-			 * against the glue records
-			 * further down	*/
-			ns_rrset_dname = rrset->dname;
-		}
 		if(del_addi && rrset->section == LDNS_SECTION_ADDITIONAL) {
 			remove_rrset("sanitize: removing potential "
 			"poison reference RRset:", pkt, msg, prev, &rrset);
@@ -999,26 +906,6 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
-		if(env->cfg->harden_unverified_glue && ns_rrset_dname &&
-			rrset->section == LDNS_SECTION_ADDITIONAL &&
-			(rrset->type == LDNS_RR_TYPE_A || rrset->type == LDNS_RR_TYPE_AAAA) &&
-			!pkt_strict_sub(pkt, rrset->dname, ns_rrset_dname)) {
-			/* We're in the additional section, looking
-			 * at an A/AAAA rrset, have a previous
-			 * delegation point and we notice that
-			 * the glue records are NOT for strict
-			 * subdomains of the delegation. So set a
-			 * flag, recompute the hash for the rrset
-			 * and write the A/AAAA record to cache.
-			 * It'll be retrieved if we can't separately
-			 * resolve the glue	*/
-			rrset->flags = PACKED_RRSET_UNVERIFIED_GLUE;
-			rrset->hash = pkt_hash_rrset(pkt, rrset->dname, rrset->type, rrset->rrset_class, rrset->flags);
-			store_rrset(pkt, msg, env, rrset);
-			remove_rrset("sanitize: storing potential "
-			"unverified glue reference RRset:", pkt, msg, prev, &rrset);
-			continue;
-		}
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -1564,45 +1564,3 @@ void iterator_set_ip46_support(struct module_stack* mods,
 	if(outnet->num_ip6 == 0)
 		ie->supports_ipv6 = 0;
 }
-
-void
-limit_nsec_ttl(struct dns_msg* msg)
-{
-	/* Limit NSEC and NSEC3 TTL in response, RFC9077 */
-	size_t i;
-	int found = 0;
-	time_t soa_ttl = 0;
-	/* Limit the NSEC and NSEC3 TTL values to the SOA TTL and SOA minimum
-	 * TTL. That has already been applied to the SOA record ttl. */
-	for(i=0; i<msg->rep->rrset_count; i++) {
-		struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
-		if(ntohs(s->rk.type) == LDNS_RR_TYPE_SOA) {
-			struct packed_rrset_data* soadata = (struct packed_rrset_data*)s->entry.data;
-			found = 1;
-			soa_ttl = soadata->ttl;
-			break;
-		}
-	}
-	if(!found)
-		return;
-	for(i=0; i<msg->rep->rrset_count; i++) {
-		struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
-		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC ||
-			ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
-			struct packed_rrset_data* data = (struct packed_rrset_data*)s->entry.data;
-			/* Limit the negative TTL. */
-			if(data->ttl > soa_ttl) {
-				if(verbosity >= VERB_ALGO) {
-					char buf[256];
-					snprintf(buf, sizeof(buf),
-						"limiting TTL %d of %s record to the SOA TTL of %d for",
-						(int)data->ttl, ((ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC)?"NSEC":"NSEC3"), (int)soa_ttl);
-					log_nametypeclass(VERB_ALGO, buf,
-						s->rk.dname, ntohs(s->rk.type),
-						ntohs(s->rk.rrset_class));
-				}
-				data->ttl = soa_ttl;
-			}
-		}
-	}
-}
@@ -428,11 +428,4 @@ int iter_stub_fwd_no_cache(struct module_qstate *qstate,
 void iterator_set_ip46_support(struct module_stack* mods,
 	struct module_env* env, struct outside_network* outnet);

-/**
- * Limit NSEC and NSEC3 TTL in response, RFC9077
- * @param msg: dns message, the SOA record ttl is used to restrict ttls
- *	of NSEC and NSEC3 RRsets. If no SOA record, nothing happens.
- */
-void limit_nsec_ttl(struct dns_msg* msg);
-
 #endif /* ITERATOR_ITER_UTILS_H */
@@ -70,8 +70,6 @@
 #include "sldns/parseutil.h"
 #include "sldns/sbuffer.h"

-/* number of packets */
-int MAX_GLOBAL_QUOTA = 128;
 /* in msec */
 int UNKNOWN_SERVER_NICENESS = 376;
 /* in msec */
@@ -254,7 +252,7 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 		} else {
 			/* see if the failure did get (parent-lame) info */
 			if(!cache_fill_missing(super->env, super_iq->qchase.qclass,
-				super->region, super_iq->dp, 0))
+				super->region, super_iq->dp))
 				log_err("out of memory adding missing");
 		}
 		delegpt_mark_neg(dpns, qstate->qinfo.qtype);
@@ -322,21 +320,16 @@ error_response_cache(struct module_qstate* qstate, int id, int rcode)
 		qstate->qinfo.qname, qstate->qinfo.qname_len,
 		qstate->qinfo.qtype, qstate->qinfo.qclass,
 		qstate->query_flags, 0,
-		qstate->env->cfg->serve_expired)) != NULL) {
+		qstate->env->cfg->serve_expired_ttl_reset)) != NULL) {
 		struct reply_info* rep = (struct reply_info*)msg->entry.data;
-		if(qstate->env->cfg->serve_expired && rep) {
-			if(qstate->env->cfg->serve_expired_ttl_reset &&
-				*qstate->env->now + qstate->env->cfg->serve_expired_ttl
-				> rep->serve_expired_ttl) {
-				verbose(VERB_ALGO, "reset serve-expired-ttl for "
-					"response in cache");
-				rep->serve_expired_ttl = *qstate->env->now +
-					qstate->env->cfg->serve_expired_ttl;
-			}
-			verbose(VERB_ALGO, "set serve-expired-norec-ttl for "
+		if(qstate->env->cfg->serve_expired &&
+			qstate->env->cfg->serve_expired_ttl_reset && rep &&
+			*qstate->env->now + qstate->env->cfg->serve_expired_ttl
+			> rep->serve_expired_ttl) {
+			verbose(VERB_ALGO, "reset serve-expired-ttl for "
 				"response in cache");
-			rep->serve_expired_norec_ttl = NORR_TTL +
-				*qstate->env->now;
+			rep->serve_expired_ttl = *qstate->env->now +
+				qstate->env->cfg->serve_expired_ttl;
 		}
 		if(rep && (FLAGS_GET_RCODE(rep->flags) ==
 			LDNS_RCODE_NOERROR ||
@@ -414,11 +407,8 @@ iter_prepend(struct iter_qstate* iq, struct dns_msg* msg,
 	num_an = 0;
 	for(p = iq->an_prepend_list; p; p = p->next) {
 		sets[num_an++] = p->rrset;
-		if(ub_packed_rrset_ttl(p->rrset) < msg->rep->ttl) {
+		if(ub_packed_rrset_ttl(p->rrset) < msg->rep->ttl)
 			msg->rep->ttl = ub_packed_rrset_ttl(p->rrset);
-			msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
-			msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
-		}
 	}
 	memcpy(sets+num_an, msg->rep->rrsets, msg->rep->an_numrrsets *
 		sizeof(struct ub_packed_rrset_key*));
@@ -431,11 +421,8 @@ iter_prepend(struct iter_qstate* iq, struct dns_msg* msg,
 			msg->rep->ns_numrrsets, p->rrset))
 			continue;
 		sets[msg->rep->an_numrrsets + num_an + num_ns++] = p->rrset;
-		if(ub_packed_rrset_ttl(p->rrset) < msg->rep->ttl) {
+		if(ub_packed_rrset_ttl(p->rrset) < msg->rep->ttl)
 			msg->rep->ttl = ub_packed_rrset_ttl(p->rrset);
-			msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
-			msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
-		}
 	}
 	memcpy(sets + num_an + msg->rep->an_numrrsets + num_ns, 
 		msg->rep->rrsets + msg->rep->an_numrrsets, 
@@ -773,14 +760,6 @@ target_count_increase_nx(struct iter_qstate* iq, int num)
 		iq->target_count[TARGET_COUNT_NX] += num;
 }

-static void
-target_count_increase_global_quota(struct iter_qstate* iq, int num)
-{
-	target_count_create(iq);
-	if(iq->target_count)
-		iq->target_count[TARGET_COUNT_GLOBAL_QUOTA] += num;
-}
-
 /**
 * Generate a subrequest.
 * Generate a local request event. Local events are tied to this module, and
@@ -1581,11 +1560,6 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			errinf(qstate, "malloc failure for forward zone");
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
-		if(!cache_fill_missing(qstate->env, iq->qchase.qclass,
-			qstate->region, iq->dp, 0)) {
-			errinf(qstate, "malloc failure, copy extra info into delegation point");
-			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
-		}
 		if((qstate->query_flags&BIT_RD)==0) {
 			/* If the server accepts RD=0 queries and forwards
 			 * with RD=1, then if the server is listed as an NS
@@ -2163,15 +2137,6 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		verbose(VERB_QUERY, "configured stub or forward servers failed -- returning SERVFAIL");
 		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
-	if(qstate->env->cfg->harden_unverified_glue) {
-		if(!cache_fill_missing(qstate->env, iq->qchase.qclass,
-			qstate->region, iq->dp, PACKED_RRSET_UNVERIFIED_GLUE))
-			log_err("out of memory in cache_fill_missing");
-		if(iq->dp->usable_list) {
-			verbose(VERB_ALGO, "try unverified glue from cache");
-			return next_state(iq, QUERYTARGETS_STATE);
-		}
-	}
 	if(!iq->dp->has_parent_side_NS && dname_is_root(iq->dp->name)) {
 		struct delegpt* dp;
 		int nolock = 0;
@@ -2214,7 +2179,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 	/* see if that makes new names available */
 	if(!cache_fill_missing(qstate->env, iq->qchase.qclass, 
-		qstate->region, iq->dp, 0))
+		qstate->region, iq->dp))
 		log_err("out of memory in cache_fill_missing");
 	if(iq->dp->usable_list) {
 		verbose(VERB_ALGO, "try parent-side-name, w. glue from cache");
@@ -3043,17 +3008,6 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 	}

-	target_count_increase_global_quota(iq, 1);
-	if(iq->target_count && iq->target_count[TARGET_COUNT_GLOBAL_QUOTA]
-		> MAX_GLOBAL_QUOTA) {
-		char s[LDNS_MAX_DOMAINLEN+1];
-		dname_str(qstate->qinfo.qname, s);
-		verbose(VERB_QUERY, "request %s has exceeded the maximum "
-			"global quota on number of upstream queries %d", s,
-			iq->target_count[TARGET_COUNT_GLOBAL_QUOTA]);
-		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
-	}
-
 	/* Do not check ratelimit for forwarding queries or if we already got a
 	 * pass. */
 	sq_check_ratelimit = (!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok);
@@ -3446,7 +3400,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 				old_dp->name, old_dp->namelen);
 		}
 		if(!cache_fill_missing(qstate->env, iq->qchase.qclass, 
-			qstate->region, iq->dp, 0)) {
+			qstate->region, iq->dp)) {
 			errinf(qstate, "malloc failure, copy extra info into delegation point");
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
@@ -4015,8 +3969,6 @@ processClassResponse(struct module_qstate* qstate, int id,
 			to->rep->prefetch_ttl = from->rep->prefetch_ttl;
 		if(from->rep->serve_expired_ttl < to->rep->serve_expired_ttl)
 			to->rep->serve_expired_ttl = from->rep->serve_expired_ttl;
-		if(from->rep->serve_expired_norec_ttl < to->rep->serve_expired_norec_ttl)
-			to->rep->serve_expired_norec_ttl = from->rep->serve_expired_norec_ttl;
 	}
 	/* are we done? */
 	foriq->num_current_queries --;
@@ -4379,10 +4331,7 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 	if(verbosity >= VERB_ALGO)
 		log_dns_msg("incoming scrubbed packet:", &iq->response->qinfo, 
 			iq->response->rep);
-
-	if(qstate->env->cfg->aggressive_nsec) {
-		limit_nsec_ttl(iq->response);
-	}
+	
 	if(event == module_event_capsfail || iq->caps_fallback) {
 		if(qstate->env->cfg->qname_minimisation &&
 			iq->minimisation_state != DONOT_MINIMISE_STATE) {
@@ -55,9 +55,6 @@ struct rbtree_type;

 /** max number of targets spawned for a query and its subqueries */
 #define MAX_TARGET_COUNT	64
-/** max number of upstream queries for a query and its subqueries, it is
- * never reset. */
-extern int MAX_GLOBAL_QUOTA;
 /** max number of target lookups per qstate, per delegation point */
 #define MAX_DP_TARGET_COUNT	16
 /** max number of nxdomains allowed for target lookups for a query and
@@ -251,9 +248,6 @@ enum target_count_variables {
 	TARGET_COUNT_QUERIES,
 	/** Number of nxdomain responses encountered. */
 	TARGET_COUNT_NX,
-	/** Global quota on number of queries to upstream servers per
-	 * client request, that is never reset. */
-	TARGET_COUNT_GLOBAL_QUOTA,

 	/** This should stay last here, it is used for the allocation */
 	TARGET_COUNT_MAX,
@@ -395,7 +395,7 @@ context_serialize_cancel(struct ctx_query* q, uint32_t* len)
 	/* format of cancel:
 	 * 	o uint32 cmd
 	 * 	o uint32 async-id */
-	uint8_t* p = (uint8_t*)reallocarray(NULL, 2, sizeof(uint32_t));
+	uint8_t* p = (uint8_t*)reallocarray(NULL, sizeof(uint32_t), 2);
 	if(!p) return NULL;
 	*len = 2*sizeof(uint32_t);
 	sldns_write_uint32(p, UB_LIBCMD_CANCEL);
@@ -292,7 +292,6 @@ libworker_do_cmd(struct libworker* w, uint8_t* msg, uint32_t len)
 			log_err("unknown command for bg worker %d", 
 				(int)context_serial_getcmd(msg, len));
 			/* and fall through to quit */
-			ATTR_FALLTHROUGH
 			/* fallthrough */
 		case UB_LIBCMD_QUIT:
 			free(msg);
@@ -1058,19 +1057,3 @@ void dtio_mainfdcallback(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
 	log_assert(0);
 }
 #endif
-
-#ifdef HAVE_NGTCP2
-void doq_client_event_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
-
-#ifdef HAVE_NGTCP2
-void doq_client_timer_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
@@ -30,7 +30,6 @@ def dnssecParse(domain, rrType=RR_TYPE_A):
 resolver = ub_ctx()
 resolver.add_ta(".   IN DS   19036 8 2 49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5")
 resolver.add_ta(".   IN DS   20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D")
-resolver.add_ta(".   IN DS   38696 8 2 683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16")

 dnssecParse("nic.cz")
 dnssecParse("nonexistent-domain-blablabla.cz")
@@ -845,10 +845,6 @@ struct ub_server_stats {
 	long long qtls_resume;
 	/** RPZ action stats */
 	long long rpz_action[UB_STATS_RPZ_ACTION_NUM];
-	/** number of bytes in QUIC buffers */
-	long long mem_quic;
-	/** number of queries over (DNS over) QUIC */
-	long long qquic;
 };

 /**
@@ -176,10 +176,6 @@ config_file
   
      Harden against spoofed glue (out of zone data).
   
-   .. attribute:: harden_unverified_glue
-
-      Harden against unverified glue.
-
   .. attribute:: harden_dnssec_stripped
   
      Harden against receiving no DNSSEC data for trust anchor.
@@ -1009,7 +1009,6 @@ struct config_file {
   int harden_short_bufsize;
   int harden_large_queries;
   int harden_glue;
-   int harden_unverified_glue;
   int harden_dnssec_stripped;
   int harden_referral_path;
   int use_caps_bits_for_id;
@@ -3684,29 +3684,6 @@ auth_zone_parse_notify_serial(sldns_buffer* pkt, uint32_t *serial)
 	return 1;
 }

-/** print addr to str, and if not 53, append "@port_number", for logs. */
-static void addr_port_to_str(struct sockaddr_storage* addr, socklen_t addrlen,
-	char* buf, size_t len)
-{
-	uint16_t port = 0;
-	if(addr_is_ip6(addr, addrlen)) {
-		struct sockaddr_in6* sa = (struct sockaddr_in6*)addr;
-		port = ntohs((uint16_t)sa->sin6_port);
-	} else {
-		struct sockaddr_in* sa = (struct sockaddr_in*)addr;
-		port = ntohs((uint16_t)sa->sin_port);
-	}
-	if(port == UNBOUND_DNS_PORT) {
-		/* If it is port 53, print it plainly. */
-		addr_to_str(addr, addrlen, buf, len);
-	} else {
-		char a[256];
-		a[0]=0;
-		addr_to_str(addr, addrlen, a, sizeof(a));
-		snprintf(buf, len, "%s@%d", a, (int)port);
-	}
-}
-
 /** see if addr appears in the list */
 static int
 addr_in_list(struct auth_addr* list, struct sockaddr_storage* addr,
@@ -5539,7 +5516,7 @@ xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env)
 		if(!xfr->task_transfer->cp) {
 			char zname[255+1], as[256];
 			dname_str(xfr->name, zname);
-			addr_port_to_str(&addr, addrlen, as, sizeof(as));
+			addr_to_str(&addr, addrlen, as, sizeof(as));
 			verbose(VERB_ALGO, "cannot create http cp "
 				"connection for %s to %s", zname, as);
 			return 0;
@@ -5548,7 +5525,7 @@ xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env)
 		if(verbosity >= VERB_ALGO) {
 			char zname[255+1], as[256];
 			dname_str(xfr->name, zname);
-			addr_port_to_str(&addr, addrlen, as, sizeof(as));
+			addr_to_str(&addr, addrlen, as, sizeof(as));
 			verbose(VERB_ALGO, "auth zone %s transfer next HTTP fetch from %s started", zname, as);
 		}
 		/* Create or refresh the list of allow_notify addrs */
@@ -5571,7 +5548,7 @@ xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env)
 	if(!xfr->task_transfer->cp) {
 		char zname[255+1], as[256];
 		dname_str(xfr->name, zname);
-		addr_port_to_str(&addr, addrlen, as, sizeof(as));
+		addr_to_str(&addr, addrlen, as, sizeof(as));
 		verbose(VERB_ALGO, "cannot create tcp cp connection for "
 			"xfr %s to %s", zname, as);
 		return 0;
@@ -5580,7 +5557,7 @@ xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env)
 	if(verbosity >= VERB_ALGO) {
 		char zname[255+1], as[256];
 		dname_str(xfr->name, zname);
-		addr_port_to_str(&addr, addrlen, as, sizeof(as));
+		addr_to_str(&addr, addrlen, as, sizeof(as));
 		verbose(VERB_ALGO, "auth zone %s transfer next %s fetch from %s started", zname, 
 			(xfr->task_transfer->on_ixfr?"IXFR":"AXFR"), as);
 	}
@@ -5683,7 +5660,7 @@ xfr_master_add_addrs(struct auth_master* m, struct ub_packed_rrset_key* rrset,
 		}
 		if(verbosity >= VERB_ALGO) {
 			char s[64];
-			addr_port_to_str(&a->addr, a->addrlen, s, sizeof(s));
+			addr_to_str(&a->addr, a->addrlen, s, sizeof(s));
 			verbose(VERB_ALGO, "auth host %s lookup %s",
 				m->host, s);
 		}
@@ -6429,7 +6406,7 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 		if(!xfr->task_probe->cp) {
 			char zname[255+1], as[256];
 			dname_str(xfr->name, zname);
-			addr_port_to_str(&addr, addrlen, as, sizeof(as));
+			addr_to_str(&addr, addrlen, as, sizeof(as));
 			verbose(VERB_ALGO, "cannot create udp cp for "
 				"probe %s to %s", zname, as);
 			return 0;
@@ -6449,7 +6426,7 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 		(struct sockaddr*)&addr, addrlen, 0)) {
 		char zname[255+1], as[256];
 		dname_str(xfr->name, zname);
-		addr_port_to_str(&addr, addrlen, as, sizeof(as));
+		addr_to_str(&addr, addrlen, as, sizeof(as));
 		verbose(VERB_ALGO, "failed to send soa probe for %s to %s",
 			zname, as);
 		return 0;
@@ -6457,7 +6434,7 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 	if(verbosity >= VERB_ALGO) {
 		char zname[255+1], as[256];
 		dname_str(xfr->name, zname);
-		addr_port_to_str(&addr, addrlen, as, sizeof(as));
+		addr_to_str(&addr, addrlen, as, sizeof(as));
 		verbose(VERB_ALGO, "auth zone %s soa probe sent to %s", zname,
 			as);
 	}
@@ -8135,8 +8112,6 @@ auth_zone_verify_zonemd_with_key(struct auth_zone* z, struct module_env* env,
 * @param why_bogus: if the routine fails, returns the failure reason.
 * @param keystorage: where to store the ub_packed_rrset_key that is created
 * 	on success. A pointer to it is returned on success.
- * @param reasonbuf: buffer to use for fail reason string print.
- * @param reasonlen: length of reasonbuf.
 * @return the dnskey RRset, reference to zone data and keystorage, or
 * 	NULL on failure.
 */
@@ -88,7 +88,7 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 		/* update ref if it was in the cache */
 		switch(rrset_cache_update(env->rrset_cache, &rep->ref[i],
 				env->alloc, ((ntohs(rep->ref[i].key->rk.type)==
-				LDNS_RR_TYPE_NS && !pside)?qstarttime:now) + leeway)) {
+				LDNS_RR_TYPE_NS && !pside)?qstarttime:now + leeway))) {
 		case 0: /* ref unchanged, item inserted */
 			break;
 		case 2: /* ref updated, cache is superior */
@@ -110,7 +110,6 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 			/* no break: also copy key item */
 			/* the line below is matched by gcc regex and silences
 			 * the fallthrough warning */
-			ATTR_FALLTHROUGH
 			/* fallthrough */
 		case 1: /* ref updated, item inserted */
 			rep->rrsets[i] = rep->ref[i].key;
@@ -162,7 +161,7 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 	size_t i;

 	/* store RRsets */
-	for(i=0; i<rep->rrset_count; i++) {
+        for(i=0; i<rep->rrset_count; i++) {
 		rep->ref[i].key = rep->rrsets[i];
 		rep->ref[i].id = rep->rrsets[i]->id;
 	}
@@ -197,7 +196,6 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 	reply_info_sortref(rep);
 	if(!(e = query_info_entrysetup(qinfo, rep, hash))) {
 		log_err("store_msg: malloc failed");
-		reply_info_delete(rep, NULL);
 		return;
 	}
 	slabhash_insert(env->msg_cache, hash, &e->entry, rep, env->alloc);
@@ -347,13 +345,6 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 			 * not use dns64 translation */
 			neg = msg_cache_lookup(env, ns->name, ns->namelen,
 				LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
-			/* Because recursion for lookup uses BIT_CD, check
-			 * for that so it stops the recursion lookup, if a
-			 * negative answer is cached. Because the cache uses
-			 * the CD flag for type AAAA. */
-			if(!neg)
-				neg = msg_cache_lookup(env, ns->name, ns->namelen,
-					LDNS_RR_TYPE_AAAA, qclass, BIT_CD, now, 0);
 			if(neg) {
 				delegpt_add_neg_msg(dp, neg);
 				lock_rw_unlock(&neg->entry.lock);
@@ -366,7 +357,7 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 /** find and add A and AAAA records for missing nameservers in delegpt */
 int
 cache_fill_missing(struct module_env* env, uint16_t qclass, 
-	struct regional* region, struct delegpt* dp, uint32_t flags)
+	struct regional* region, struct delegpt* dp)
 {
 	struct delegpt_ns* ns;
 	struct msgreply_entry* neg;
@@ -377,7 +368,7 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 			continue;
 		ns->cache_lookup_count++;
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
-			ns->namelen, LDNS_RR_TYPE_A, qclass, flags, now, 0);
+			ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 		if(akey) {
 			if(!delegpt_add_rrset_A(dp, region, akey, ns->lame,
 				NULL)) {
@@ -413,13 +404,6 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 			 * not use dns64 translation */
 			neg = msg_cache_lookup(env, ns->name, ns->namelen,
 				LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
-			/* Because recursion for lookup uses BIT_CD, check
-			 * for that so it stops the recursion lookup, if a
-			 * negative answer is cached. Because the cache uses
-			 * the CD flag for type AAAA. */
-			if(!neg)
-				neg = msg_cache_lookup(env, ns->name, ns->namelen,
-					LDNS_RR_TYPE_AAAA, qclass, BIT_CD, now, 0);
 			if(neg) {
 				delegpt_add_neg_msg(dp, neg);
 				lock_rw_unlock(&neg->entry.lock);
@@ -608,8 +592,22 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 	time_t now_control = now;
 	if(now > r->ttl) {
 		/* Check if we are allowed to serve expired */
-		if(!allow_expired || !reply_info_can_answer_expired(r, now))
+		if(allow_expired) {
+			if(env->cfg->serve_expired_ttl &&
+				r->serve_expired_ttl < now) {
+				return NULL;
+			}
+			/* Ignore expired failure answers */
+			if(FLAGS_GET_RCODE(r->flags) !=
+				LDNS_RCODE_NOERROR &&
+				FLAGS_GET_RCODE(r->flags) !=
+				LDNS_RCODE_NXDOMAIN &&
+				FLAGS_GET_RCODE(r->flags) !=
+				LDNS_RCODE_YXDOMAIN)
+				return 0;
+		} else {
 			return NULL;
+		}
 		/* Change the current time so we can pass the below TTL checks when
 		 * serving expired data. */
 		now_control = r->ttl - env->cfg->serve_expired_reply_ttl;
@@ -628,7 +626,6 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 	else
 		msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
-	msg->rep->serve_expired_norec_ttl = 0;
 	msg->rep->security = r->security;
 	msg->rep->an_numrrsets = r->an_numrrsets;
 	msg->rep->ns_numrrsets = r->ns_numrrsets;
@@ -712,7 +709,6 @@ rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	msg->rep->ttl = d->ttl - now;
 	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
-	msg->rep->serve_expired_norec_ttl = 0;
 	msg->rep->security = sec_status_unchecked;
 	msg->rep->an_numrrsets = 1;
 	msg->rep->ns_numrrsets = 0;
@@ -752,7 +748,6 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	msg->rep->ttl = d->ttl - now;
 	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
-	msg->rep->serve_expired_norec_ttl = 0;
 	msg->rep->security = sec_status_unchecked;
 	msg->rep->an_numrrsets = 1;
 	msg->rep->ns_numrrsets = 0;
@@ -1060,35 +1055,6 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 	struct regional* region, uint32_t flags, time_t qstarttime)
 {
 	struct reply_info* rep = NULL;
-	if(SERVE_EXPIRED) {
-		/* We are serving expired records. Before caching, check if a
-		 * useful expired record exists. */
-		struct msgreply_entry* e = msg_cache_lookup(env,
-			msgqinf->qname, msgqinf->qname_len, msgqinf->qtype,
-			msgqinf->qclass, flags, 0, 0);
-		if(e) {
-			struct reply_info* cached = e->entry.data;
-			if(cached->ttl < *env->now
-				&& reply_info_could_use_expired(cached, *env->now)
-				/* If we are validating make sure only
-				 * validating modules can update such messages.
-				 * In that case don't cache it and let a
-				 * subsequent module handle the caching. For
-				 * example, the iterator should not replace an
-				 * expired secure answer with a fresh unchecked
-				 * one and let the validator manage caching. */
-				&& cached->security != sec_status_bogus
-				&& (env->need_to_validate &&
-				msgrep->security == sec_status_unchecked)) {
-				verbose(VERB_ALGO, "a validated expired entry "
-					"could be overwritten, skip caching "
-					"the new message at this stage");
-				lock_rw_unlock(&e->entry.lock);
-				return 1;
-			}
-			lock_rw_unlock(&e->entry.lock);
-		}
-	}
 	/* alloc, malloc properly (not in region, like msg is) */
 	rep = reply_info_copy(msgrep, env->alloc, NULL);
 	if(!rep)
@@ -202,11 +202,10 @@ struct dns_msg* dns_cache_lookup(struct module_env* env,
 * @param qclass: which class to look in.
 * @param region: where to store new dp info.
 * @param dp: delegation point to fill missing entries.
- * @param flags: rrset flags, or 0.
 * @return false on alloc failure.
 */
 int cache_fill_missing(struct module_env* env, uint16_t qclass, 
-	struct regional* region, struct delegpt* dp, uint32_t flags);
+	struct regional* region, struct delegpt* dp);

 /**
 * Utility, create new, unpacked data structure for cache response.
@@ -128,8 +128,8 @@ need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns)
 {
 	struct packed_rrset_data* newd = (struct packed_rrset_data*)nd;
 	struct packed_rrset_data* cached = (struct packed_rrset_data*)cd;
-	/*	o if new data is expired, cached data is better */
-	if( newd->ttl < timenow && timenow <= cached->ttl)
+	/*	o if new data is expired, current data is better */
+	if( newd->ttl < timenow && cached->ttl >= timenow)
 		return 0;
 	/* 	o store if rrset has been validated 
 	 *  		everything better than bogus data 
@@ -140,9 +140,9 @@ need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns)
 	if( cached->security == sec_status_bogus && 
 		newd->security != sec_status_bogus && !equal)
 		return 1;
-        /*      o if new RRset is more trustworthy - insert it */
+        /*      o if current RRset is more trustworthy - insert it */
        if( newd->trust > cached->trust ) {
-		/* if the cached rrset is bogus, and new is equal,
+		/* if the cached rrset is bogus, and this one equal,
 		 * do not update the TTL - let it expire. */
 		if(equal && cached->ttl >= timenow && 
 			cached->security == sec_status_bogus)
@@ -155,7 +155,7 @@ need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns)
 	/*  o same trust, but different in data - insert it */
 	if( newd->trust == cached->trust && !equal ) {
 		/* if this is type NS, do not 'stick' to owner that changes
-		 * the NS RRset, but use the cached TTL for the new data, and
+		 * the NS RRset, but use the old TTL for the new data, and
 		 * update to fetch the latest data. ttl is not expired, because
 		 * that check was before this one. */
 		if(ns) {
@@ -43,16 +43,10 @@
 #define LISTEN_DNSPORT_H

 #include "util/netevent.h"
-#include "util/rbtree.h"
-#include "util/locks.h"
 #include "daemon/acl_list.h"
 #ifdef HAVE_NGHTTP2_NGHTTP2_H
 #include <nghttp2/nghttp2.h>
 #endif
-#ifdef HAVE_NGTCP2
-#include <ngtcp2/ngtcp2.h>
-#include <ngtcp2/ngtcp2_crypto.h>
-#endif
 struct listen_list;
 struct config_file;
 struct addrinfo;
@@ -106,9 +100,7 @@ enum listen_type {
 	/** udp ipv6 (v4mapped) for use with ancillary data + dnscrypt*/
 	listen_type_udpancil_dnscrypt,
 	/** HTTP(2) over TLS over TCP */
-	listen_type_http,
-	/** DNS over QUIC */
-	listen_type_doq
+	listen_type_http
 };

 /*
@@ -196,11 +188,6 @@ int resolve_interface_names(char** ifs, int num_ifs,
 * @param tcp_conn_limit: TCP connection limit info.
 * @param sslctx: nonNULL if ssl context.
 * @param dtenv: nonNULL if dnstap enabled.
- * @param doq_table: the doq connection table, with shared information.
- * @param rnd: random state.
- * @param ssl_service_key: the SSL service key file.
- * @param ssl_service_pem: the SSL service pem file.
- * @param cfg: config file struct.
 * @param cb: callback function when a request arrives. It is passed
 *	  the packet and user argument. Return true to send a reply.
 * @param cb_arg: user data argument for callback function.
@@ -211,10 +198,8 @@ listen_create(struct comm_base* base, struct listen_port* ports,
 	size_t bufsize, int tcp_accept_count, int tcp_idle_timeout,
 	int harden_large_queries, uint32_t http_max_streams,
 	char* http_endpoint, int http_notls, struct tcl_list* tcp_conn_limit,
-	void* sslctx, struct dt_env* dtenv, struct doq_table* doq_table,
-	struct ub_randstate* rnd, const char* ssl_service_key,
-	const char* ssl_service_pem, struct config_file* cfg,
-	comm_point_callback_type* cb, void *cb_arg);
+	void* sslctx, struct dt_env* dtenv, comm_point_callback_type* cb,
+	void *cb_arg);

 /**
 * delete the listening structure
@@ -293,12 +278,11 @@ int create_udp_sock(int family, int socktype, struct sockaddr* addr,
 * @param freebind: set IP_FREEBIND socket option.
 * @param use_systemd: if true, fetch sockets from systemd.
 * @param dscp: DSCP to use.
- * @param additional: additional log information for the socket type.
 * @return: the socket. -1 on error.
 */
 int create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 	int* reuseport, int transparent, int mss, int nodelay, int freebind,
-	int use_systemd, int dscp, const char* additional);
+	int use_systemd, int dscp);

 /**
 * Create and bind local listening socket
@@ -468,377 +452,6 @@ int http2_submit_dns_response(struct http2_session* h2_session);
 int http2_submit_dns_response(void* v);
 #endif /* HAVE_NGHTTP2 */

-#ifdef HAVE_NGTCP2
-struct doq_conid;
-struct doq_server_socket;
-
-/**
- * DoQ shared connection table. This is the connections for the host.
- * And some config parameter values for connections. The host has to
- * respond on that ip,port for those connections, so they are shared
- * between threads.
- */
-struct doq_table {
-	/** the lock on the tree and config elements. insert and deletion,
-	 * also lookup in the tree needs to hold the lock. */
-	lock_rw_type lock;
-	/** rbtree of doq_conn, the connections to different destination
-	 * addresses, and can be found by dcid. */
-	struct rbtree_type* conn_tree;
-	/** lock for the conid tree, needed for the conid tree and also
-	 * the conid elements */
-	lock_rw_type conid_lock;
-	/** rbtree of doq_conid, connections can be found by their
-	 * connection ids. Lookup by connection id, finds doq_conn. */
-	struct rbtree_type* conid_tree;
-	/** the server scid length */
-	int sv_scidlen;
-	/** the static secret for the server */
-	uint8_t* static_secret;
-	/** length of the static secret */
-	size_t static_secret_len;
-	/** the idle timeout in nanoseconds */
-	uint64_t idle_timeout;
-	/** the list of write interested connections, hold the doq_table.lock
-	 * to change them */
-	struct doq_conn* write_list_first, *write_list_last;
-	/** rbtree of doq_timer. */
-	struct rbtree_type* timer_tree;
-	/** lock on the current_size counter. */
-	lock_basic_type size_lock;
-	/** current use, in bytes, of QUIC buffers.
-	 * The doq_conn ngtcp2_conn structure, SSL structure and conid structs
-	 * are not counted. */
-	size_t current_size;
-};
-
-/** create doq table */
-struct doq_table* doq_table_create(struct config_file* cfg,
-	struct ub_randstate* rnd);
-
-/** delete doq table */
-void doq_table_delete(struct doq_table* table);
-
-/**
- * Timer information for doq timer.
- */
-struct doq_timer {
-	/** The rbnode in the tree sorted by timeout value. Key this struct. */
-	struct rbnode_type node;
-	/** The timeout value. Absolute time value. */
-	struct timeval time;
-	/** If the timer is in the time tree, with the node. */
-	int timer_in_tree;
-	/** If there are more timers with the exact same timeout value,
-	 * they form a set of timers. The rbnode timer has a link to the list
-	 * with the other timers in the set. The rbnode timer is not a
-	 * member of the list with the other timers. The other timers are not
-	 * linked into the tree. */
-	struct doq_timer* setlist_first, *setlist_last;
-	/** If the timer is on the setlist. */
-	int timer_in_list;
-	/** If in the setlist, the next and prev element. */
-	struct doq_timer* setlist_next, *setlist_prev;
-	/** The connection that is timeouted. */
-	struct doq_conn* conn;
-	/** The worker that is waiting for the timeout event.
-	 * Set for the rbnode tree linked element. If a worker is waiting
-	 * for the event. If NULL, no worker is waiting for this timeout. */
-	struct doq_server_socket* worker_doq_socket;
-};
-
-/**
- * Key information that makes a doq_conn node in the tree lookup.
- */
-struct doq_conn_key {
-	/** the remote endpoint and local endpoint and ifindex */
-	struct doq_pkt_addr paddr;
-	/** the doq connection dcid */
-	uint8_t* dcid;
-	/** length of dcid */
-	size_t dcidlen;
-};
-
-/**
- * DoQ connection, for DNS over QUIC. One connection to a remote endpoint
- * with a number of streams in it. Every stream is like a tcp stream with
- * a uint16_t length, query read, and a uint16_t length and answer written.
- */
-struct doq_conn {
-	/** rbtree node, key is addresses and dcid */
-	struct rbnode_type node;
-	/** lock on the connection */
-	lock_basic_type lock;
-	/** the key information, with dcid and address endpoint */
-	struct doq_conn_key key;
-	/** the doq server socket for inside callbacks */
-	struct doq_server_socket* doq_socket;
-	/** the doq table this connection is part of */
-	struct doq_table* table;
-	/** if the connection is about to be deleted. */
-	uint8_t is_deleted;
-	/** the version, the client chosen version of QUIC */
-	uint32_t version;
-	/** the ngtcp2 connection, a server connection */
-	struct ngtcp2_conn* conn;
-	/** the connection ids that are associated with this doq_conn.
-	 * There can be a number, that can change. They are linked here,
-	 * so that upon removal, the list of actually associated conid
-	 * elements can be removed as well. */
-	struct doq_conid* conid_list;
-	/** the ngtcp2 last error for the connection */
-#ifdef HAVE_NGTCP2_CCERR_DEFAULT
-	struct ngtcp2_ccerr ccerr;
-#else
-	struct ngtcp2_connection_close_error last_error;
-#endif
-	/** the recent tls alert error code */
-	uint8_t tls_alert;
-	/** the ssl context, SSL* */
-	void* ssl;
-#ifdef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_SERVER_CONTEXT
-	/** the connection reference for ngtcp2_conn and userdata in ssl */
-	struct ngtcp2_crypto_conn_ref conn_ref;
-#endif
-	/** closure packet, if any */
-	uint8_t* close_pkt;
-	/** length of closure packet. */
-	size_t close_pkt_len;
-	/** closure ecn */
-	uint32_t close_ecn;
-	/** the streams for this connection, of type doq_stream */
-	struct rbtree_type stream_tree;
-	/** the streams that want write, they have something to write.
-	 * The list is ordered, the last have to wait for the first to
-	 * get their data written. */
-	struct doq_stream* stream_write_first, *stream_write_last;
-	/** the conn has write interest if true, no write interest if false. */
-	uint8_t write_interest;
-	/** if the conn is on the connection write list */
-	uint8_t on_write_list;
-	/** the connection write list prev and next, if on the write list */
-	struct doq_conn* write_prev, *write_next;
-	/** The timer for the connection. If unused, it is not in the tree
-	 * and not in the list. It is alloced here, so that it is prealloced.
-	 * It has to be set after every read and write on the connection, so
-	 * this improves performance, but also the allocation does not fail. */
-	struct doq_timer timer;
-};
-
-/**
- * Connection ID and the doq_conn that is that connection. A connection
- * has an original dcid, and then more connection ids associated.
- */
-struct doq_conid {
-	/** rbtree node, key is the connection id. */
-	struct rbnode_type node;
-	/** the next and prev in the list of conids for the doq_conn */
-	struct doq_conid* next, *prev;
-	/** key to the doq_conn that is the connection */
-	struct doq_conn_key key;
-	/** the connection id, byte string */
-	uint8_t* cid;
-	/** the length of cid */
-	size_t cidlen;
-};
-
-/**
- * DoQ stream, for DNS over QUIC.
- */
-struct doq_stream {
-	/** the rbtree node for the stream, key is the stream_id */
-	rbnode_type node;
-	/** the stream id */
-	int64_t stream_id;
-	/** if the stream is closed */
-	uint8_t is_closed;
-	/** if the query is complete */
-	uint8_t is_query_complete;
-	/** the number of bytes read on the stream, up to querylen+2. */
-	size_t nread;
-	/** the length of the input query bytes */
-	size_t inlen;
-	/** the input bytes */
-	uint8_t* in;
-	/** does the stream have an answer to send */
-	uint8_t is_answer_available;
-	/** the answer bytes sent, up to outlen+2. */
-	size_t nwrite;
-	/** the length of the output answer bytes */
-	size_t outlen;
-	/** the output length in network wireformat */
-	uint16_t outlen_wire;
-	/** the output packet bytes */
-	uint8_t* out;
-	/** if the stream is on the write list */
-	uint8_t on_write_list;
-	/** the prev and next on the write list, if on the list */
-	struct doq_stream* write_prev, *write_next;
-};
-
-/** doq application error code that is sent when a stream is closed */
-#define DOQ_APP_ERROR_CODE 1
-
-/**
- * Create the doq connection.
- * @param c: the comm point for the listening doq socket.
- * @param paddr: with remote and local address and ifindex for the
- * 	connection destination. This is where packets are sent.
- * @param dcid: the dcid, Destination Connection ID.
- * @param dcidlen: length of dcid.
- * @param version: client chosen version.
- * @return new doq connection or NULL on allocation failure.
- */
-struct doq_conn* doq_conn_create(struct comm_point* c,
-	struct doq_pkt_addr* paddr, const uint8_t* dcid, size_t dcidlen,
-	uint32_t version);
-
-/**
- * Delete the doq connection structure.
- * @param conn: to delete.
- * @param table: with memory size.
- */
-void doq_conn_delete(struct doq_conn* conn, struct doq_table* table);
-
-/** compare function of doq_conn */
-int doq_conn_cmp(const void* key1, const void* key2);
-
-/** compare function of doq_conid */
-int doq_conid_cmp(const void* key1, const void* key2);
-
-/** compare function of doq_timer */
-int doq_timer_cmp(const void* key1, const void* key2);
-
-/** compare function of doq_stream */
-int doq_stream_cmp(const void* key1, const void* key2);
-
-/** setup the doq_socket server tls context */
-int doq_socket_setup_ctx(struct doq_server_socket* doq_socket);
-
-/** setup the doq connection callbacks, and settings. */
-int doq_conn_setup(struct doq_conn* conn, uint8_t* scid, size_t scidlen,
-	uint8_t* ocid, size_t ocidlen, const uint8_t* token, size_t tokenlen);
-
-/** fill a buffer with random data */
-void doq_fill_rand(struct ub_randstate* rnd, uint8_t* buf, size_t len);
-
-/** delete a doq_conid */
-void doq_conid_delete(struct doq_conid* conid);
-
-/** add a connection id to the doq_conn.
- * caller must hold doq_table.conid_lock. */
-int doq_conn_associate_conid(struct doq_conn* conn, uint8_t* data,
-	size_t datalen);
-
-/** remove a connection id from the doq_conn.
- * caller must hold doq_table.conid_lock. */
-void doq_conn_dissociate_conid(struct doq_conn* conn, const uint8_t* data,
-	size_t datalen);
-
-/** initial setup to link current connection ids to the doq_conn */
-int doq_conn_setup_conids(struct doq_conn* conn);
-
-/** remove the connection ids from the doq_conn.
- * caller must hold doq_table.conid_lock. */
-void doq_conn_clear_conids(struct doq_conn* conn);
-
-/** find a conid in the doq_conn connection.
- * caller must hold table.conid_lock. */
-struct doq_conid* doq_conid_find(struct doq_table* doq_table,
-	const uint8_t* data, size_t datalen);
-
-/** receive a packet for a connection */
-int doq_conn_recv(struct comm_point* c, struct doq_pkt_addr* paddr,
-	struct doq_conn* conn, struct ngtcp2_pkt_info* pi, int* err_retry,
-	int* err_drop);
-
-/** send packets for a connection */
-int doq_conn_write_streams(struct comm_point* c, struct doq_conn* conn,
-	int* err_drop);
-
-/** send the close packet for the connection, perhaps again. */
-int doq_conn_send_close(struct comm_point* c, struct doq_conn* conn);
-
-/** delete doq stream */
-void doq_stream_delete(struct doq_stream* stream);
-
-/** doq read a connection key from repinfo. It is not malloced, but points
- * into the repinfo for the dcid. */
-void doq_conn_key_from_repinfo(struct doq_conn_key* key,
-	struct comm_reply* repinfo);
-
-/** doq find a stream in the connection */
-struct doq_stream* doq_stream_find(struct doq_conn* conn, int64_t stream_id);
-
-/** doq shutdown the stream. */
-int doq_stream_close(struct doq_conn* conn, struct doq_stream* stream,
-	int send_shutdown);
-
-/** send reply for a connection */
-int doq_stream_send_reply(struct doq_conn* conn, struct doq_stream* stream,
-	struct sldns_buffer* buf);
-
-/** the connection has write interest, wants to write packets */
-void doq_conn_write_enable(struct doq_conn* conn);
-
-/** the connection has no write interest, does not want to write packets */
-void doq_conn_write_disable(struct doq_conn* conn);
-
-/** set the connection on or off the write list, depending on write interest */
-void doq_conn_set_write_list(struct doq_table* table, struct doq_conn* conn);
-
-/** doq remove the connection from the write list */
-void doq_conn_write_list_remove(struct doq_table* table,
-	struct doq_conn* conn);
-
-/** doq get the first conn from the write list, if any, popped from list.
- * Locks the conn that is returned. */
-struct doq_conn* doq_table_pop_first(struct doq_table* table);
-
-/**
- * doq check if the timer for the conn needs to be changed.
- * @param conn: connection, caller must hold lock on it.
- * @param tv: time value, absolute time, returned.
- * @return true if timer needs to be set to tv, false if no change is needed
- * 	to the timer. The timer is already set to the right time in that case.
- */
-int doq_conn_check_timer(struct doq_conn* conn, struct timeval* tv);
-
-/** doq remove timer from tree */
-void doq_timer_tree_remove(struct doq_table* table, struct doq_timer* timer);
-
-/** doq remove timer from list */
-void doq_timer_list_remove(struct doq_table* table, struct doq_timer* timer);
-
-/** doq unset the timer if it was set. */
-void doq_timer_unset(struct doq_table* table, struct doq_timer* timer);
-
-/** doq set the timer and add it. */
-void doq_timer_set(struct doq_table* table, struct doq_timer* timer,
-	struct doq_server_socket* worker_doq_socket, struct timeval* tv);
-
-/** doq find a timeout in the timer tree */
-struct doq_timer* doq_timer_find_time(struct doq_table* table,
-	struct timeval* tv);
-
-/** doq handle timeout for a connection. Pass conn locked. Returns false for
- * deletion. */
-int doq_conn_handle_timeout(struct doq_conn* conn);
-
-/** doq add size to the current quic buffer counter */
-void doq_table_quic_size_add(struct doq_table* table, size_t add);
-
-/** doq subtract size from the current quic buffer counter */
-void doq_table_quic_size_subtract(struct doq_table* table, size_t subtract);
-
-/** doq check if mem is available for quic. */
-int doq_table_quic_size_available(struct doq_table* table,
-	struct config_file* cfg, size_t mem);
-
-/** doq get the quic size value */
-size_t doq_table_quic_size_get(struct doq_table* table);
-#endif /* HAVE_NGTCP2 */
-
 char* set_ip_dscp(int socket, int addrfamily, int ds);

 /** for debug and profiling purposes only
@@ -846,14 +459,4 @@ char* set_ip_dscp(int socket, int addrfamily, int ds);
 */
 void verbose_print_unbound_socket(struct unbound_socket* ub_sock);

-/** event callback for testcode/doqclient */
-void doq_client_event_cb(int fd, short event, void* arg);
-
-/** timer event callback for testcode/doqclient */
-void doq_client_timer_cb(int fd, short event, void* arg);
-
-#ifdef HAVE_NGTCP2
-/** get a timestamp in nanoseconds */
-ngtcp2_tstamp doq_get_timestamp_nanosec(void);
-#endif
 #endif /* LISTEN_DNSPORT_H */
@@ -311,7 +311,7 @@ int mesh_make_new_space(struct mesh_area* mesh, sldns_buffer* qbuf)

 struct dns_msg*
 mesh_serve_expired_lookup(struct module_qstate* qstate,
-	struct query_info* lookup_qinfo, int* is_expired)
+	struct query_info* lookup_qinfo)
 {
 	hashvalue_type h;
 	struct lruhash_entry* e;
@@ -321,7 +321,6 @@ mesh_serve_expired_lookup(struct module_qstate* qstate,
 	time_t timenow = *qstate->env->now;
 	int must_validate = (!(qstate->query_flags&BIT_CD)
 		|| qstate->env->cfg->ignore_cd) && qstate->env->need_to_validate;
-	*is_expired = 0;
 	/* Lookup cache */
 	h = query_info_hash(lookup_qinfo, qstate->query_flags);
 	e = slabhash_lookup(qstate->env->msg_cache, h, lookup_qinfo, 0);
@@ -329,7 +328,6 @@ mesh_serve_expired_lookup(struct module_qstate* qstate,

 	key = (struct msgreply_entry*)e->key;
 	data = (struct reply_info*)e->data;
-	if(data->ttl < timenow) *is_expired = 1;
 	msg = tomsg(qstate->env, &key->key, data, qstate->region, timenow,
 		qstate->env->cfg->serve_expired, qstate->env->scratch);
 	if(!msg)
@@ -2178,7 +2176,6 @@ mesh_serve_expired_callback(void* arg)
 	int must_validate = (!(qstate->query_flags&BIT_CD)
 		|| qstate->env->cfg->ignore_cd) && qstate->env->need_to_validate;
 	int i = 0;
-	int is_expired;
 	if(!qstate->serve_expired_data) return;
 	verbose(VERB_ALGO, "Serve expired: Trying to reply with expired data");
 	comm_timer_delete(qstate->serve_expired_data->timer);
@@ -2196,7 +2193,7 @@ mesh_serve_expired_callback(void* arg)
 		fptr_ok(fptr_whitelist_serve_expired_lookup(
 			qstate->serve_expired_data->get_cached_answer));
 		msg = (*qstate->serve_expired_data->get_cached_answer)(qstate,
-			lookup_qinfo, &is_expired);
+			lookup_qinfo);
 		if(!msg)
 			return;
 		/* Reset these in case we pass a second time from here. */
@@ -2288,10 +2285,8 @@ mesh_serve_expired_callback(void* arg)

 		/* Add EDE Stale Answer (RCF8914). Ignore global ede as this is
 		 * warning instead of an error */
-		if(r->edns.edns_present &&
-			qstate->env->cfg->ede_serve_expired &&
-			qstate->env->cfg->ede &&
-			is_expired) {
+		if (r->edns.edns_present && qstate->env->cfg->ede_serve_expired &&
+			qstate->env->cfg->ede) {
 			edns_opt_list_append_ede(&r->edns.opt_list_out,
 				mstate->s.region, LDNS_EDE_STALE_ANSWER, NULL);
 		}
@@ -673,12 +673,11 @@ void mesh_serve_expired_callback(void* arg);
 * the same behavior as when replying from cache.
 * @param qstate: the module qstate.
 * @param lookup_qinfo: the query info to look for in the cache.
- * @param is_expired: set if the cached answer is expired.
 * @return dns_msg if a cached answer was found, otherwise NULL.
 */
 struct dns_msg*
 mesh_serve_expired_lookup(struct module_qstate* qstate,
-	struct query_info* lookup_qinfo, int* is_expired);
+	struct query_info* lookup_qinfo);

 /**
 * See if the mesh has space for more queries. You can allocate queries
@@ -265,7 +265,7 @@ modstack_call_init(struct module_stack* stack, const char* module_conf,
        int i, changed = 0;
        env->need_to_validate = 0; /* set by module init below */
        for(i=0; i<stack->num; i++) {
-		while(*module_conf && isspace((unsigned char)*module_conf))
+		while(*module_conf && isspace(*module_conf))
 			module_conf++;
                if(strncmp(stack->mod[i]->name, module_conf,
 			strlen(stack->mod[i]->name))) {
@@ -3466,10 +3466,7 @@ outnet_serviced_query(struct outside_network* outnet,
 			timenow = *env->now;
 			if(!infra_ratelimit_inc(env->infra_cache, zone,
 				zonelen, timenow, env->cfg->ratelimit_backoff,
-				&qstate->qinfo,
-				qstate->mesh_info->reply_list
-					?&qstate->mesh_info->reply_list->query_reply
-					:NULL)) {
+				&qstate->qinfo, qstate->reply)) {
 				/* Can we pass through with slip factor? */
 				if(env->cfg->ratelimit_factor == 0 ||
 					ub_random_max(env->rnd,
@@ -242,14 +242,10 @@ rpz_action_to_localzone_type(enum rpz_action a)
 	case RPZ_NODATA_ACTION: return local_zone_always_nodata;
 	case RPZ_DROP_ACTION: return local_zone_always_deny;
 	case RPZ_PASSTHRU_ACTION: return local_zone_always_transparent;
-	case RPZ_LOCAL_DATA_ACTION:
-		ATTR_FALLTHROUGH
-		/* fallthrough */
+	case RPZ_LOCAL_DATA_ACTION:	/* fallthrough */
 	case RPZ_CNAME_OVERRIDE_ACTION: return local_zone_redirect;
 	case RPZ_TCP_ONLY_ACTION: return local_zone_truncate;
-	case RPZ_INVALID_ACTION:
-		ATTR_FALLTHROUGH
-		/* fallthrough */
+	case RPZ_INVALID_ACTION: /* fallthrough */
 	default: return local_zone_invalid;
 	}
 }
@@ -262,14 +258,10 @@ rpz_action_to_respip_action(enum rpz_action a)
 	case RPZ_NODATA_ACTION: return respip_always_nodata;
 	case RPZ_DROP_ACTION: return respip_always_deny;
 	case RPZ_PASSTHRU_ACTION: return respip_always_transparent;
-	case RPZ_LOCAL_DATA_ACTION:
-		ATTR_FALLTHROUGH
-		/* fallthrough */
+	case RPZ_LOCAL_DATA_ACTION: /* fallthrough */
 	case RPZ_CNAME_OVERRIDE_ACTION: return respip_redirect;
 	case RPZ_TCP_ONLY_ACTION: return respip_truncate;
-	case RPZ_INVALID_ACTION:
-		ATTR_FALLTHROUGH
-		/* fallthrough */
+	case RPZ_INVALID_ACTION: /* fallthrough */
 	default: return respip_invalid;
 	}
 }
@@ -284,9 +276,7 @@ localzone_type_to_rpz_action(enum localzone_type lzt)
 	case local_zone_always_transparent: return RPZ_PASSTHRU_ACTION;
 	case local_zone_redirect: return RPZ_LOCAL_DATA_ACTION;
 	case local_zone_truncate: return RPZ_TCP_ONLY_ACTION;
-	case local_zone_invalid:
-		ATTR_FALLTHROUGH
-		/* fallthrough */
+	case local_zone_invalid: /* fallthrough */
 	default: return RPZ_INVALID_ACTION;
 	}
 }
@@ -301,9 +291,7 @@ respip_action_to_rpz_action(enum respip_action a)
 	case respip_always_transparent: return RPZ_PASSTHRU_ACTION;
 	case respip_redirect: return RPZ_LOCAL_DATA_ACTION;
 	case respip_truncate: return RPZ_TCP_ONLY_ACTION;
-	case respip_invalid:
-		ATTR_FALLTHROUGH
-		/* fallthrough */
+	case respip_invalid: /* fallthrough */
 	default: return RPZ_INVALID_ACTION;
 	}
 }
@@ -1969,7 +1957,6 @@ rpz_synthesize_nodata(struct rpz* ATTR_UNUSED(r), struct module_qstate* ms,
 					     0, /* ttl */
 					     0, /* prettl */
 					     0, /* expttl */
-					     0, /* norecttl */
 					     0, /* an */
 					     0, /* ns */
 					     0, /* ar */
@@ -2000,7 +1987,6 @@ rpz_synthesize_nxdomain(struct rpz* r, struct module_qstate* ms,
 					     0, /* ttl */
 					     0, /* prettl */
 					     0, /* expttl */
-					     0, /* norecttl */
 					     0, /* an */
 					     0, /* ns */
 					     0, /* ar */
@@ -2033,7 +2019,6 @@ rpz_synthesize_localdata_from_rrset(struct rpz* ATTR_UNUSED(r), struct module_qs
                                                   0, /* ttl */
                                                   0, /* prettl */
                                                   0, /* expttl */
-                                                   0, /* norecttl */
                                                   1, /* an */
                                                   0, /* ns */
                                                   0, /* ar */
@@ -2179,7 +2164,6 @@ rpz_synthesize_cname_override_msg(struct rpz* r, struct module_qstate* ms,
                                                   0, /* ttl */
                                                   0, /* prettl */
                                                   0, /* expttl */
-                                                   0, /* norecttl */
                                                   1, /* an */
                                                   0, /* ns */
                                                   0, /* ar */
@@ -2292,18 +2276,15 @@ rpz_apply_nsip_trigger(struct module_qstate* ms, struct query_info* qchase,
 	if(action == RPZ_LOCAL_DATA_ACTION && raddr->data == NULL) {
 		verbose(VERB_ALGO, "rpz: bug: nsip local data action but no local data");
 		ret = rpz_synthesize_nodata(r, ms, qchase, az);
-		ms->rpz_applied = 1;
 		goto done;
 	}

 	switch(action) {
 	case RPZ_NXDOMAIN_ACTION:
 		ret = rpz_synthesize_nxdomain(r, ms, qchase, az);
-		ms->rpz_applied = 1;
 		break;
 	case RPZ_NODATA_ACTION:
 		ret = rpz_synthesize_nodata(r, ms, qchase, az);
-		ms->rpz_applied = 1;
 		break;
 	case RPZ_TCP_ONLY_ACTION:
 		/* basically a passthru here but the tcp-only will be
@@ -2313,13 +2294,11 @@ rpz_apply_nsip_trigger(struct module_qstate* ms, struct query_info* qchase,
 		break;
 	case RPZ_DROP_ACTION:
 		ret = rpz_synthesize_nodata(r, ms, qchase, az);
-		ms->rpz_applied = 1;
 		ms->is_drop = 1;
 		break;
 	case RPZ_LOCAL_DATA_ACTION:
 		ret = rpz_synthesize_nsip_localdata(r, ms, qchase, raddr, az);
 		if(ret == NULL) { ret = rpz_synthesize_nodata(r, ms, qchase, az); }
-		ms->rpz_applied = 1;
 		break;
 	case RPZ_PASSTHRU_ACTION:
 		ret = NULL;
@@ -2327,7 +2306,6 @@ rpz_apply_nsip_trigger(struct module_qstate* ms, struct query_info* qchase,
 		break;
 	case RPZ_CNAME_OVERRIDE_ACTION:
 		ret = rpz_synthesize_cname_override_msg(r, ms, qchase);
-		ms->rpz_applied = 1;
 		break;
 	default:
 		verbose(VERB_ALGO, "rpz: nsip: bug: unhandled or invalid action: '%s'",
@@ -2362,11 +2340,9 @@ rpz_apply_nsdname_trigger(struct module_qstate* ms, struct query_info* qchase,
 	switch(action) {
 	case RPZ_NXDOMAIN_ACTION:
 		ret = rpz_synthesize_nxdomain(r, ms, qchase, az);
-		ms->rpz_applied = 1;
 		break;
 	case RPZ_NODATA_ACTION:
 		ret = rpz_synthesize_nodata(r, ms, qchase, az);
-		ms->rpz_applied = 1;
 		break;
 	case RPZ_TCP_ONLY_ACTION:
 		/* basically a passthru here but the tcp-only will be
@@ -2376,13 +2352,11 @@ rpz_apply_nsdname_trigger(struct module_qstate* ms, struct query_info* qchase,
 		break;
 	case RPZ_DROP_ACTION:
 		ret = rpz_synthesize_nodata(r, ms, qchase, az);
-		ms->rpz_applied = 1;
 		ms->is_drop = 1;
 		break;
 	case RPZ_LOCAL_DATA_ACTION:
 		ret = rpz_synthesize_nsdname_localdata(r, ms, qchase, z, match, az);
 		if(ret == NULL) { ret = rpz_synthesize_nodata(r, ms, qchase, az); }
-		ms->rpz_applied = 1;
 		break;
 	case RPZ_PASSTHRU_ACTION:
 		ret = NULL;
@@ -2390,7 +2364,6 @@ rpz_apply_nsdname_trigger(struct module_qstate* ms, struct query_info* qchase,
 		break;
 	case RPZ_CNAME_OVERRIDE_ACTION:
 		ret = rpz_synthesize_cname_override_msg(r, ms, qchase);
-		ms->rpz_applied = 1;
 		break;
 	default:
 		verbose(VERB_ALGO, "rpz: nsdname: bug: unhandled or invalid action: '%s'",
@@ -2594,11 +2567,9 @@ struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* ms,
 	switch(localzone_type_to_rpz_action(lzt)) {
 	case RPZ_NXDOMAIN_ACTION:
 		ret = rpz_synthesize_nxdomain(r, ms, &is->qchase, a);
-		ms->rpz_applied = 1;
 		break;
 	case RPZ_NODATA_ACTION:
 		ret = rpz_synthesize_nodata(r, ms, &is->qchase, a);
-		ms->rpz_applied = 1;
 		break;
 	case RPZ_TCP_ONLY_ACTION:
 		/* basically a passthru here but the tcp-only will be
@@ -2608,13 +2579,11 @@ struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* ms,
 		break;
 	case RPZ_DROP_ACTION:
 		ret = rpz_synthesize_nodata(r, ms, &is->qchase, a);
-		ms->rpz_applied = 1;
 		ms->is_drop = 1;
 		break;
 	case RPZ_LOCAL_DATA_ACTION:
 		ret = rpz_synthesize_qname_localdata_msg(r, ms, &is->qchase, z, a);
 		if(ret == NULL) { ret = rpz_synthesize_nodata(r, ms, &is->qchase, a); }
-		ms->rpz_applied = 1;
 		break;
 	case RPZ_PASSTHRU_ACTION:
 		ret = NULL;
@@ -436,13 +436,11 @@ sldns_b32_ntop_base(const uint8_t* src, size_t src_sz, char* dst, size_t dst_sz,

 		/* ........ ........ ....4444 4....... ........ */
 			 c =  src[3]         >> 7 ;
-		ATTR_FALLTHROUGH
 		/* fallthrough */
 	case 3: dst[4] = b32[(src[2] & 0x0f) << 1 | c];

 		/* ........ .......3 3333.... ........ ........ */
 			 c =  src[2]         >> 4 ;
-		ATTR_FALLTHROUGH
 		/* fallthrough */
 	case 2:	dst[3] = b32[(src[1] & 0x01) << 4 | c];

@@ -451,7 +449,6 @@ sldns_b32_ntop_base(const uint8_t* src, size_t src_sz, char* dst, size_t dst_sz,

 		/* .....111 11...... ........ ........ ........ */
 			 c =  src[1]         >> 6 ;
-		ATTR_FALLTHROUGH
 		/* fallthrough */
 	case 1:	dst[1] = b32[(src[0] & 0x07) << 2 | c];

@@ -463,14 +460,11 @@ sldns_b32_ntop_base(const uint8_t* src, size_t src_sz, char* dst, size_t dst_sz,
 		switch (src_sz) {
 			case 1: dst[2] = '=';
 				dst[3] = '=';
-				ATTR_FALLTHROUGH
 				/* fallthrough */
 			case 2: dst[4] = '=';
-				ATTR_FALLTHROUGH
 				/* fallthrough */
 			case 3: dst[5] = '=';
 				dst[6] = '=';
-				ATTR_FALLTHROUGH
 				/* fallthrough */
 			case 4: dst[7] = '=';
 		}
@@ -583,20 +577,17 @@ sldns_b32_pton_base(const char* src, size_t src_sz, uint8_t* dst, size_t dst_sz,
 			/* ........ ........ ........ .55555.. ........ */
 			/* ........ ........ ....4444 4....... ........ */
 			dst[3] = buf[4] << 7 | buf[5] << 2 | buf[6] >> 3;
-			ATTR_FALLTHROUGH
 			/* fallthrough */

 		case 5: /* ........ ........ ....4444 4....... ........ */
 			/* ........ .......3 3333.... ........ ........ */
 			dst[2] = buf[3] << 4 | buf[4] >> 1;
-			ATTR_FALLTHROUGH
 			/* fallthrough */

 		case 4: /* ........ .......3 3333.... ........ ........ */
 			/* ........ ..22222. ........ ........ ........ */
 			/* .....111 11...... ........ ........ ........ */
 			dst[1] = buf[1] << 6 | buf[2] << 1 | buf[3] >> 4;
-			ATTR_FALLTHROUGH
 			/* fallthrough */

 		case 2: /* .....111 11...... ........ ........ ........ */
@@ -474,7 +474,8 @@ enum sldns_enum_ede_code
 	LDNS_EDE_TOO_EARLY = 26,
 	LDNS_EDE_UNSUPPORTED_NSEC3_ITERATIONS = 27,
 	LDNS_EDE_BADPROXYPOLICY = 28,
-	LDNS_EDE_SYNTHESIZED = 29
+	LDNS_EDE_SYNTHESIZED = 29,
+	LDNS_EDE_INVALID_QUERY_TYPE = 30
 };
 typedef enum sldns_enum_ede_code sldns_ede_code;

@@ -1241,7 +1241,6 @@ int sldns_wire2str_svcparam_scan(uint8_t** d, size_t* dlen, char** s, size_t* sl
 		r = sldns_wire2str_svcparam_ech2str(s, slen, data_len, *d);
 		break;
 	case SVCB_KEY_DOHPATH:
-		ATTR_FALLTHROUGH
 		/* fallthrough */
 	default:
 		r = sldns_str_print(s, slen, "=\"");
@@ -183,9 +183,7 @@ static const char DS_TRUST_ANCHOR[] =
 	/* The anchors must start on a new line with ". IN DS and end with \n"[;]
 	 * because the makedist script greps on the source here */
 	/* anchor 20326 is from 2017 */
-". IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D\n"
-	/* anchor 38696 is from 2024 */
-". IN DS 38696 8 2 683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16\n";
+". IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D\n";

 /** verbosity for this application */
 static int verb = 0;
@@ -104,7 +104,7 @@ while getopts 'd:hr' arg; do
 done
 shift $((OPTIND - 1))

-if ! openssl version </dev/null >/dev/null 2>&1; then
+if ! openssl >/dev/null 2>&1; then
    echo "$0 requires openssl to be installed for keys/certificates generation." >&2
    exit 1
 fi
@@ -186,10 +186,6 @@ usage(void)
 	printf("  rpz_enable zone		Enable the RPZ zone if it had previously\n");
 	printf("  				been disabled\n");
 	printf("  rpz_disable zone		Disable the RPZ zone\n");
-	printf("  add_cookie_secret <secret>	add (or replace) a new cookie secret <secret>\n");
-	printf("  drop_cookie_secret		drop a staging cookie secret\n");
-	printf("  activate_cookie_secret	make a staging cookie secret active\n");
-	printf("  print_cookie_secrets		show all cookie secrets with their status\n");
 	printf("Version %s\n", PACKAGE_VERSION);
 	printf("BSD licensed, see LICENSE in source package for details.\n");
 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
@@ -293,9 +289,6 @@ static void print_mem(struct ub_shm_stat_info* shm_stat,
 	PR_LL("mem.streamwait", s->svr.mem_stream_wait);
 	PR_LL("mem.http.query_buffer", s->svr.mem_http2_query_buffer);
 	PR_LL("mem.http.response_buffer", s->svr.mem_http2_response_buffer);
-#ifdef HAVE_NGTCP2
-	PR_LL("mem.quic", s->svr.mem_quic);
-#endif
 }

 /** print histogram */
@@ -362,9 +355,6 @@ static void print_extended(struct ub_stats_info* s, int inhibit_zero)
 	PR_UL("num.query.tls_resume", s->svr.qtls_resume);
 	PR_UL("num.query.ipv6", s->svr.qipv6);
 	PR_UL("num.query.https", s->svr.qhttps);
-#ifdef HAVE_NGTCP2
-	PR_UL("num.query.quic", s->svr.qquic);
-#endif

 	/* flags */
 	PR_UL("num.query.flags.QR", s->svr.qbit_QR);
@@ -50,8 +50,6 @@
 #undef calloc
 #undef free
 #undef realloc
-#undef reallocarray
-#undef strdup
 #endif
 #ifdef UNBOUND_ALLOC_LITE
 #undef malloc
@@ -494,11 +492,7 @@ int main(int argc, char* argv[])
 		if(strcmp(use_syslog, "yes") == 0) /* disable use-syslog */
 			check_ub_res(ub_ctx_set_option(ctx, 
 				"use-syslog:", "no"));
-#ifdef UNBOUND_ALLOC_STATS
-		unbound_stat_free_log(use_syslog, __FILE__, __LINE__, __func__);
-#else
 		free(use_syslog);
-#endif
 	}
 	argc -= optind;
 	argv += optind;
@@ -255,19 +255,3 @@ void dtio_mainfdcallback(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
 	log_assert(0);
 }
 #endif
-
-#ifdef HAVE_NGTCP2
-void doq_client_event_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
-
-#ifdef HAVE_NGTCP2
-void doq_client_timer_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
@@ -68,8 +68,6 @@ static struct thr_check* thread_infos[THRDEBUG_MAX_THREADS];
 int check_locking_order = 1;
 /** the pid of this runset, reasonably unique. */
 static pid_t check_lock_pid;
-/** the name of the output file */
-static const char* output_name = "ublocktrace";
 /**
 * Should checklocks print a trace of the lock and unlock calls.
 * It uses fprintf for that because the log function uses a lock and that
@@ -144,8 +142,7 @@ acquire_locklock(struct checked_lock* lock,

 /** add protected region */
 void 
-lock_protect_place(void* p, void* area, size_t size, const char* def_func,
-	const char* def_file, int def_line, const char* def_area)
+lock_protect(void *p, void* area, size_t size)
 {
 	struct checked_lock* lock = *(struct checked_lock**)p;
 	struct protected_area* e = (struct protected_area*)malloc(
@@ -154,10 +151,6 @@ lock_protect_place(void* p, void* area, size_t size, const char* def_func,
 		fatal_exit("lock_protect: out of memory");
 	e->region = area;
 	e->size = size;
-	e->def_func = def_func;
-	e->def_file = def_file;
-	e->def_line = def_line;
-	e->def_area = def_area;
 	e->hold = malloc(size);
 	if(!e->hold)
 		fatal_exit("lock_protect: out of memory");
@@ -210,9 +203,6 @@ prot_check(struct checked_lock* lock,
 		if(memcmp(p->hold, p->region, p->size) != 0) {
 			log_hex("memory prev", p->hold, p->size);
 			log_hex("memory here", p->region, p->size);
-			log_err("lock_protect on %s %s:%d %s failed",
-				p->def_func, p->def_file, p->def_line,
-				p->def_area);
 			lock_error(lock, func, file, line, 
 				"protected area modified");
 		}
@@ -685,19 +675,13 @@ checklock_unlock(enum check_lock_type type, struct checked_lock* lock,
 	}
 }

-void
-checklock_set_output_name(const char* name)
-{
-	output_name = name;
-}
-
 /** open order info debug file, thr->num must be valid */
 static void 
 open_lockorder(struct thr_check* thr)
 {
 	char buf[24];
 	time_t t;
-	snprintf(buf, sizeof(buf), "%s.%d", output_name, thr->num);
+	snprintf(buf, sizeof(buf), "ublocktrace.%d", thr->num);
 	thr->order_info = fopen(buf, "w");
 	if(!thr->order_info)
 		fatal_exit("could not open %s: %s", buf, strerror(errno));
@@ -90,14 +90,6 @@ struct protected_area {
 	void* hold;
 	/** next protected area in list */
 	struct protected_area* next;
-	/** the place where the lock_protect is made, at init. */
-	const char* def_func;
-	/** the file where the lock_protect is made */
-	const char* def_file;
-	/** the line number where the lock_protect is made */
-	int def_line;
-	/** the text string for the area that is protected, at init call. */
-	const char* def_area;
 };

 /**
@@ -189,19 +181,12 @@ struct checked_lock {
 *	It demangles the lock itself (struct checked_lock**).
 * @param area: ptr to mem.
 * @param size: length of area.
- * @param def_func: function where the lock_protect() line is.
- * @param def_file: file where the lock_protect() line is.
- * @param def_line: line where the lock_protect() line is.
- * @param def_area: area string
 * You can call it multiple times with the same lock to give several areas.
 * Call it when you are done initializing the area, since it will be copied
 * at this time and protected right away against unauthorised changes until 
 * the next lock() call is done.
 */
-void lock_protect_place(void* lock, void* area, size_t size,
-	const char* def_func, const char* def_file, int def_line,
-	const char* def_area);
-#define lock_protect(lock, area, size) lock_protect_place(lock, area, size, __func__, __FILE__, __LINE__, #area)
+void lock_protect(void* lock, void* area, size_t size);

 /**
 * Remove protected area from lock.
@@ -218,13 +203,6 @@ void lock_unprotect(void* lock, void* area);
 */
 size_t lock_get_mem(void* lock);

-/**
- * Set the output name, prefix, of the lock check output file(s).
- * Call it before the checklock_start or thread creation. Pass a fixed string.
- * @param name: string to use for output data file names.
- */
-void checklock_set_output_name(const char* name);
-
 /**
 * Initialise checklock. Sets up internal debug structures.
 */
@@ -939,11 +939,6 @@ listen_create(struct comm_base* base, struct listen_port* ATTR_UNUSED(ports),
 	int ATTR_UNUSED(http_notls),
 	struct tcl_list* ATTR_UNUSED(tcp_conn_limit),
 	void* ATTR_UNUSED(sslctx), struct dt_env* ATTR_UNUSED(dtenv),
-	struct doq_table* ATTR_UNUSED(table),
-	struct ub_randstate* ATTR_UNUSED(rnd),
-	const char* ATTR_UNUSED(ssl_service_key),
-	const char* ATTR_UNUSED(ssl_service_pem),
-	struct config_file* ATTR_UNUSED(cfg),
 	comm_point_callback_type* cb, void *cb_arg)
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)base;
@@ -220,7 +220,7 @@ perfsetup(struct perfinfo* info)
 #endif
 		signal(SIGTERM, perf_sigh) == SIG_ERR)
 		fatal_exit("could not bind to signal");
-	info->io = (struct perfio*)calloc(info->io_num, sizeof(struct perfio));
+	info->io = (struct perfio*)calloc(sizeof(struct perfio), info->io_num);
 	if(!info->io) fatal_exit("out of memory");
 #ifndef S_SPLINT_S
 	FD_ZERO(&info->rset);
@@ -501,8 +501,8 @@ qlist_grow_capacity(struct perfinfo* info)
 {
 	size_t newcap = (size_t)((info->qlist_capacity==0)?16:
 		info->qlist_capacity*2);
-	uint8_t** d = (uint8_t**)calloc(newcap, sizeof(uint8_t*));
-	size_t* l = (size_t*)calloc(newcap, sizeof(size_t));
+	uint8_t** d = (uint8_t**)calloc(sizeof(uint8_t*), newcap);
+	size_t* l = (size_t*)calloc(sizeof(size_t), newcap);
 	if(!d || !l) fatal_exit("out of memory");
 	if(info->qlist_data && info->qlist_capacity)
 		memcpy(d, info->qlist_data, sizeof(uint8_t*)*
@@ -72,6 +72,23 @@ int daemon_main(int argc, char* argv[]);
 /** config files (removed at exit) */
 static struct config_strlist* cfgfiles = NULL;

+#ifdef UNBOUND_ALLOC_STATS
+#  define strdup(s) unbound_stat_strdup_log(s, __FILE__, __LINE__, __func__)
+char* unbound_stat_strdup_log(char* s, const char* file, int line,
+	const char* func);
+char* unbound_stat_strdup_log(char* s, const char* file, int line,
+        const char* func) {
+	char* result;
+	size_t len;
+	if(!s) return NULL;
+	len = strlen(s);
+	log_info("%s:%d %s strdup(%u)", file, line, func, (unsigned)len+1);
+	result = unbound_stat_malloc(len+1);
+	memmove(result, s, len+1);
+	return result;
+}
+#endif /* UNBOUND_ALLOC_STATS */
+
 /** give commandline usage for testbound. */
 static void
 testbound_usage(void)
@@ -502,7 +519,7 @@ struct listen_port* daemon_remote_open_ports(struct config_file*

 struct daemon_remote* daemon_remote_create(struct config_file* ATTR_UNUSED(cfg))
 {
-	return (struct daemon_remote*)calloc(1, sizeof(struct daemon_remote));
+	return (struct daemon_remote*)calloc(1,1);
 }

 void daemon_remote_delete(struct daemon_remote* rc)
@@ -600,52 +617,3 @@ void listen_desetup_locks(void)
 {
 	/* nothing */
 }
-
-#ifdef HAVE_NGTCP2
-void comm_point_doq_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(event),
-	void* ATTR_UNUSED(arg))
-{
-	/* nothing */
-}
-
-int doq_conn_cmp(const void* ATTR_UNUSED(key1), const void* ATTR_UNUSED(key2))
-{
-	return 0;
-}
-
-int doq_conid_cmp(const void* ATTR_UNUSED(key1), const void* ATTR_UNUSED(key2))
-{
-	return 0;
-}
-
-int doq_timer_cmp(const void* ATTR_UNUSED(key1), const void* ATTR_UNUSED(key2))
-{
-	return 0;
-}
-
-int doq_stream_cmp(const void* ATTR_UNUSED(key1), const void* ATTR_UNUSED(key2))
-{
-	return 0;
-}
-
-struct doq_table* doq_table_create(struct config_file* ATTR_UNUSED(cfg),
-	struct ub_randstate* ATTR_UNUSED(rnd))
-{
-	return calloc(1, sizeof(struct doq_table));
-}
-
-void doq_table_delete(struct doq_table* table)
-{
-	free(table);
-}
-
-void doq_timer_cb(void* ATTR_UNUSED(arg))
-{
-	/* nothing */
-}
-
-size_t doq_table_quic_size_get(struct doq_table* ATTR_UNUSED(table))
-{
-	return 0;
-}
-#endif
@@ -1,84 +0,0 @@
-/*
- * testcode/unitdoq.c - unit test for doq routines.
- *
- * Copyright (c) 2022, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- *
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- *
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- *
- */
-
-/**
- * \file
- * Calls doq related unit tests. Exits with code 1 on a failure.
- */
-
-#include "config.h"
-
-#ifdef HAVE_NGTCP2
-
-#include "util/netevent.h"
-#include "services/listen_dnsport.h"
-#include "testcode/unitmain.h"
-
-/** check the size of a connection for doq */
-static void
-doq_size_conn_check()
-{
-	/* Printout the size of one doq connection, in memory usage.
-	 * A connection with a couple cids, of type doq_conid, and
-	 * it has one stream, and that has a query and an answer. */
-	size_t answer_size = 233; /* size of www.nlnetlabs.nl minimal answer
-		with dnssec and one A record. The unsigned answer is 176 with
-		additional data, 61 bytes minimal response one A record. */
-	size_t query_size = 45; /* size of query for www.nlnetlabs.nl, with
-		an EDNS record with DO flag. */
-	size_t conn_size = sizeof(struct doq_conn);
-	size_t conid_size = sizeof(struct doq_conid);
-	size_t stream_size = sizeof(struct doq_stream);
-
-	conn_size += 16; /* DCID len in the conn key */
-	conn_size += 0; /* the size of the ngtcp2_conn */
-	conn_size += 0; /* the size of the SSL record */
-	conn_size += 0; /* size of the close pkt,
-		but we do not count it here. Only if the conn gets closed. */
-	conid_size += 16; /* the dcid of the conn key */
-	conid_size += 16; /* the cid */
-	stream_size += query_size; /* size of in buffer */
-	stream_size += answer_size; /* size of out buffer */
-	printf("doq connection size %u bytes\n", (unsigned)(conn_size +
-		conid_size*3 + stream_size));
-}
-
-void doq_test(void)
-{
-	unit_show_feature("doq");
-	doq_size_conn_check();
-}
-#endif /* HAVE_NGTCP2 */
@@ -1117,7 +1117,7 @@ static void edns_ede_encode_encodedecode(struct query_info* qinfo,
 	sldns_buffer_skip(pkt, 2 + 2);
 	/* decode */
 	unit_assert(parse_edns_from_query_pkt(pkt, edns, NULL, NULL, NULL, 0,
-		region, NULL) == 0);
+		region) == 0);
 }

 static void edns_ede_encode_check(struct edns_data* edns, int* found_ede,
@@ -1232,7 +1232,7 @@ static void edns_ede_answer_encode_test(void)
 	unit_assert(region);
 	rep = construct_reply_info_base(region,
 		LDNS_RCODE_NOERROR | BIT_QR, 1,
-		3600, 3600, 3600, 0,
+		3600, 3600, 3600,
 		0, 0, 0, 0,
 		sec_status_unchecked, LDNS_EDE_NONE);
 	unit_assert(rep);
@@ -1432,9 +1432,6 @@ main(int argc, char* argv[])
 #ifdef CLIENT_SUBNET
 	ecs_test();
 #endif /* CLIENT_SUBNET */
-#ifdef HAVE_NGTCP2
-	doq_test();
-#endif /* HAVE_NGTCP2 */
 	if(log_get_lock()) {
 		lock_basic_destroy((lock_basic_type*)log_get_lock());
 	}
@@ -84,7 +84,5 @@ void authzone_test(void);
 void zonemd_test(void);
 /** unit test for tcp_reuse functions */
 void tcpreuse_test(void);
-/** unit test for doq functions */
-void doq_test(void);

 #endif /* TESTCODE_UNITMAIN_H */
@@ -108,7 +108,7 @@ static void zonemd_generate_test(const char* zname, char* zfile,
 	digestdup = strdup(digest);
 	unit_assert(digestdup);
 	for(i=0; i<strlen(digestdup); i++) {
-		digestdup[i] = toupper((unsigned char)digestdup[i]);
+		digestdup[i] = toupper(digestdup[i]);
 	}
 	if(verbosity >= VERB_ALGO) {
 		char zname[255+1];
@@ -165,10 +165,9 @@ static void zonemd_generate_tests(void)
 		1, 1, "1291b78ddf7669b1a39d014d87626b709b55774c5d7d58fadc556439889a10eaf6f11d615900a4f996bd46279514e473");

 	/* https://tools.ietf.org/html/draft-ietf-dnsop-dns-zone-digest-12
-	 * from section A.5.
-	 * Adjusted with renumbered B.root. */
+	 * from section A.5 */
 	zonemd_generate_test("root-servers.net", SRCDIRSTR "/testdata/zonemd.example_a5.zone",
-		1, 1, "5a9521d88984ee123d9626191e2a327a43a16fd4339dd4ecc13d8672d5bae527d066d33645e35778677800005247d199");
+		1, 1, "f1ca0ccd91bd5573d9f431c00ee0101b2545c97602be0a978a3b11dbfc1c776d5b3e86ae3d973d6b5349ba7f04340f79");
 }

 /** test the zonemd check routine */
@@ -73,53 +73,12 @@ control_command () {
 	$PRE/unbound-control $@ > outfile
 }

-# Reload the server and check the reload has finished processing
-# when a lot of debug is enabled, a lot of log needs to be printed.
-control_reload () {
-	prelines=`wc -l unbound.log | awk '{print $1;}'`
-	cmd="$1"
-	if test -z "$cmd"; then cmd="reload"; fi
-	control_command -c ub.conf $cmd
-	expect_exit_value 0
-	# see if the reload has completed.
-	lines1=`wc -l unbound.log | awk '{print $1;}'`
-	count=0
-	lines2=`wc -l unbound.log | awk '{print $1;}'`
-	# See if the log finishes up without sleeping too long.
-	while test "$lines1" -ne "$lines2"; do
-		lines1=`wc -l unbound.log | awk '{print $1;}'`
-		# There is no sleep here. The add and compare are a
-		# brief wait.
-		count=`expr "$count" + 1`
-		if test "$count" -gt 30; then
-			break;
-		fi
-		lines2=`wc -l unbound.log | awk '{print $1;}'`
-	done
-	if test "$lines1" -ne "$lines2"; then
-		count=0
-		while test "$lines1" -ne "$lines2"; do
-			tail -1 unbound.log
-			lines1=`wc -l unbound.log | awk '{print $1;}'`
-			sleep 1
-			count=`expr "$count" + 1`
-			if test "$count" -gt 30; then
-				echo "reload is taking too long"
-				exit 1
-			fi
-			lines2=`wc -l unbound.log | awk '{print $1;}'`
-		done
-		if test "$count" -ne "0"; then
-			echo "reload done with $count sec"
-		fi
-	fi
-}
-
 # Reload the server for a clean state
 clean_reload () {
 	echo "> Reloading the server for a clean state"
 	cp main.conf ub.conf
-	control_reload
+	control_command -c ub.conf reload
+	expect_exit_value 0
 }

 # Reload the server for a clean state and populate the cache
@@ -216,7 +175,8 @@ expect_exit_value 1
 # local-data element in the server.
 teststep "reload the server"
 echo "server: local-data: 'afterreload. IN A 5.6.7.8'" >> ub.conf
-control_reload
+control_command -c ub.conf reload
+expect_exit_value 0
 query afterreload.
 expect_answer "5.6.7.8"

@@ -376,14 +336,16 @@ fi
 clean_reload_and_fill_cache

 teststep "reload and check cache - should be empty"
-control_reload
+control_command -c ub.conf reload
+expect_exit_value 0
 query www.example.com +nordflag
 fail_answer "10.20.30.40"

 clean_reload_and_fill_cache

 teststep "reload_keep_cache and check cache - should not be empty"
-control_reload reload_keep_cache
+control_command -c ub.conf reload_keep_cache
+expect_exit_value 0
 query www.example.com +nordflag
 expect_answer "10.20.30.40"

@@ -391,7 +353,8 @@ clean_reload_and_fill_cache

 teststep "change msg-cache-size and reload_keep_cache - should be empty"
 echo "server: msg-cache-size: 2m" >> ub.conf
-control_reload reload_keep_cache
+control_command -c ub.conf reload_keep_cache
+expect_exit_value 0
 query www.example.com +nordflag
 fail_answer "10.20.30.40"

@@ -399,7 +362,8 @@ clean_reload_and_fill_cache

 teststep "change rrset-cache-size and reload_keep_cache - should be empty"
 echo "server: rrset-cache-size: 2m" >> ub.conf
-control_reload reload_keep_cache
+control_command -c ub.conf reload_keep_cache
+expect_exit_value 0
 query www.example.com +nordflag
 fail_answer "10.20.30.40"

@@ -411,7 +375,8 @@ clean_reload_and_fill_cache

 teststep "change num-threads and reload_keep_cache - should be empty"
 echo "server: num-threads: 2" >> ub.conf
-control_reload reload_keep_cache
+control_command -c ub.conf reload_keep_cache
+expect_exit_value 0
 query www.example.com +nordflag
 fail_answer "10.20.30.40"

@@ -419,7 +384,8 @@ clean_reload_and_fill_cache

 teststep "change minimal-responses and reload_keep_cache - should not be empty"
 echo "server: minimal-responses: no" >> ub.conf
-control_reload reload_keep_cache
+control_command -c ub.conf reload_keep_cache
+expect_exit_value 0
 query www.example.com +nordflag
 expect_answer "10.20.30.40"

@@ -1,16 +0,0 @@
-BaseName: auth_tls
-Version: 1.0
-Description: Perform AXFR over tls for authority zone
-CreationDate: Thu 29 Aug 09:35:40 CEST 2024
-Maintainer: dr. W.C.A. Wijngaards
-Category: 
-Component:
-CmdDepends: 
-Depends: 
-Help:
-Pre: auth_tls.pre
-Post: auth_tls.post
-Test: auth_tls.test
-AuxFiles: 
-Passed:
-Failure:
@@ -1,21 +0,0 @@
-server:
-        logfile: "/dev/stderr"
-        xfrdfile: xfrd.state
-	username: ""
-	chroot: ""
-        zonesdir: ""
-	pidfile: "nsd.pid"
-        zonelistfile: "zone.list"
-	verbosity: 5
-	port: @NSD_PORT@
-        interface: 127.0.0.1@@NSD_PORT@
-
-	tls-port: @NSD_PORT@
-	tls-service-key: "nsd_server.key"
-	tls-service-pem: "nsd_server.pem"
-
-zone:
-	name: "example.com"
-	zonefile: "example.com.zone"
-	provide-xfr: 0.0.0.0/0 NOKEY
-	provide-xfr: ::0/0 NOKEY
@@ -1,14 +0,0 @@
-# #-- auth_tls.post --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# source the test var file when it's there
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-#
-# do your teardown here
-. ../common.sh
-kill_pid $NSD_PID
-kill_pid $UNBOUND_PID
-echo "nsd.log"
-cat nsd.log
-echo "unbound.log"
-cat unbound.log
@@ -1,47 +0,0 @@
-# #-- auth_tls.pre--#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-. ../common.sh
-PRE="../.."
-if test -n "$NSD"; then
-	:
-else
-	if `which nsd >/dev/null 2>&1`; then
-		# need nsd >= 4.2.0
-		NSD="nsd"
-	else
-		if test -f $PRE/../nsd/nsd; then
-			NSD="$PRE/../nsd/nsd"
-		else
-			skip_test "need nsd"
-		fi
-	fi
-fi
-echo "NSD=$NSD"
-
-get_random_port 2
-UNBOUND_PORT=$RND_PORT
-NSD_PORT=$(($RND_PORT + 1))
-echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
-echo "NSD_PORT=$NSD_PORT" >> .tpkg.var.test
-
-# make config file
-sed -e 's/@UNBOUND_PORT\@/'$UNBOUND_PORT'/' -e 's/@NSD_PORT\@/'$NSD_PORT'/' < auth_tls.ub.conf > ub.conf
-sed -e 's/@UNBOUND_PORT\@/'$UNBOUND_PORT'/' -e 's/@NSD_PORT\@/'$NSD_PORT'/' < auth_tls.nsd.conf > nsd.conf
-
-# start nsd
-$NSD -d -c nsd.conf >nsd.log 2>&1 &
-NSD_PID=$!
-echo "NSD_PID=$NSD_PID" >> .tpkg.var.test
-
-# start unbound in the background
-$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
-UNBOUND_PID=$!
-echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
-
-cat .tpkg.var.test
-wait_nsd_up nsd.log
-wait_unbound_up unbound.log
@@ -1,48 +0,0 @@
-# #-- auth_tls.test --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-# do the test
-echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
-fi
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
-fi
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
-fi
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
-fi
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	sleep 10
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
-fi
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	sleep 10
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
-fi
-echo "> check answer"
-if grep "1.2.3.4" outfile; then
-	echo "OK"
-else
-	echo "Not OK"
-	exit 1
-fi
-
-exit 0
@@ -1,22 +0,0 @@
-server:
-	verbosity: 7
-	# num-threads: 1
-	interface: 127.0.0.1
-	port: @UNBOUND_PORT@
-	use-syslog: no
-	directory: ""
-	pidfile: "unbound.pid"
-	chroot: ""
-	username: ""
-	do-not-query-localhost: no
-	tls-service-key: "unbound_server.key"
-	tls-service-pem: "unbound_server.pem"
-	tls-cert-bundle: "nsd_server.pem"
-
-auth-zone:
-	name: "example.com"
-	for-upstream: yes
-	for-downstream: yes
-	primary: "127.0.0.1@@NSD_PORT@#nsd"
-	allow-notify: "127.0.0.2@@NSD_PORT@"
-	allow-notify: 127.0.0.1
@@ -1,4 +0,0 @@
-example.com.		240	IN	SOA	ns.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2024082400 28800 7200 604800 240
-example.com. NS ns.example.com.
-ns.example.com. IN A 192.0.2.1
-www.example.com. A 1.2.3.4
@@ -1,39 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIG5QIBAAKCAYEAxLy5fFUI1OjXXbPcQ13303/K5AliTq6bCnS57edzQIbmPZj7
-XbGZ0RnU47cZ11GSAI9ptDIrSidNTsHzaqWZn431/IVjwrIkRgz95/aOWRov4fwm
-cS5qvbYV60l384NZLqmF4BDDxSt2MLT2+jWxFEK2iUm2YXZewifQ8zaHmjfAWlo8
-TlK5jzt0Qc0qPv5nCC6mwtjb7OHul3N3QolW6hZOc1KZVEeBdELedoU9TyMyzhPB
-vkqAXWoti/CwWj3YMTj/L7zNfQ9F1HW6n67Y+ltO8IadILPiZiiAVIrLqUh3EL2X
-fq+BcJ3QvADjyL9F5TH3AaWoi6iYgMGcgdqK9k6hj+ziuMxX6OsgzfzxTEzZCHhP
-Er39SX6j/fHzJP4aGQxAAHLAmv2p9P/oEZeZsvWPsBWYpULKgMZ0JDZhf26ddrB1
-mpTaqRQsG384dUZR9f/iyzTszwgc2PQ7JG6gVg723KoBhlD0g+DlC8XdxiRyaDbJ
-PXzSoXgLWumx02OhAgMBAAECggGBAMS7MARriBRX7hzuYaEgE1V0oe+cjqi9o542
-EUMcQjzRaOVJ2HrdwUG+wgsgKwAMuqJCxuIBlRZm7MCH5CDODivmKohk3thviSRf
-k3tlKv1g2Wby3YIqd2TT82FAK2nf+8tUi+H/AbVl+59DJwIXtMbc22m3w1/8nU8r
-v5+l9L27aGcxesKbqKDZRC0Uu10YyvD8rZeEgY+EcjESrrxjV/1nZvWdMGR9yK74
-uzrri95aBVDbos7l8yz2oysf+UmUMp5U9rWwuU4M/34pFSGeo7CHjtliwbBF4FHn
-uyompXaOr7Qrgeg4fc9NbZNaB4OAOV2d1sI202q6j3kEkhG4pD8LAG/RRnugCj7D
-PKGJL3iZKxknjA+tAKkgq50EbMpLHHv1qSiKWy8p+bR5FyBYPSheOSkOKTywpqnd
-OU+VDTi4iLDvkENt6E0TghSyhncl8yIcomYPktqepaNekCHquK5sX8NUhOzRe3WH
-gX7l3e/o8JRvbwXJ8UWfQlKhPO/hvQKBwQDiLXVMf+Hjl/OoXHtF6huerNBux5CS
-KYha5BLARs9W74kd9mTJ9F5IflenpzQJc1b/PnvvlcDDlniUvlgk463EA2th4qWp
-50jFniq/l4rUMFk1vZBXldvuUaL6f+Ihi8WmoUAyguEVAB9G/EJ1bXqHKdJtxuz+
-/TXGBsXrF5+sZOTjfq96CgQtBmbPXMncPto0NndoMqcEB0bjsFywQXGCk6ZZZ3Ac
-vwnZFqVwqro3aTwD+xllzVz+xBNK8GU+zW8CgcEA3q2EepAT7dlZAveC7VSLnFF/
-w86ziynGEuhoJly+zedDPkFIGxYje1SPaKhpMH2jOdCajyHPOGuWEeVfKMbzCrHP
-GdFyiTQDk3Pq0JRXpUUJSPGPusAQnPruE68XccDb+eBiJR6y+0vXHd1J3F8B4BMQ
-AloZZtlx9BkEZaaRjROxM7Ilbev4IjOcScTREb2GL8gU3vnI2FJjBMy6fI5cm4QK
-XEgiLcxGniM77bAZTeoVFbpd4SSICDXVn/NM/XfvAoHBAMHbjKphAc/9MY6gldg6
-7Cl4nb4VtshQaNremWPMTXKKJNBVm9WtahJgl+jO2z8uaOalO70CchIyKm/zJcGY
-lBtpguSHSs7xueIHy0QkM43jUtNJAyrO+46s0jA65Cs0jdhgZZHls944GJbTKHNV
-vquTIRWOZxu3FBwDOihiOy2b3MNQlj7XzvR4hC4/rZTlGkmeVYItyBEf25bUVt2L
-eisdOntuuR0qcNptGqgS7UEJJbOTyRUEjCyhCpg0q9LEaQKBwDF7N1wQ1gzdZlUt
-cO+SAO/8gDqfnPAImVYsRLB5nYCdqiiUUxSJx9qpALEN80nuMS4wt5ekuKpd5dwW
-Lx4dj3ZJ6q5fB2eLolvKv1wYCp3UCGsoGnsyIL7xV6QSHVCOvZL6FHURLE6BHM0r
-FjWc+wqy0bTkFo7vNM48HOkFqYRC4vaM2JpjfCEFfO47iQW7Kq1FdbXSpZnEPPKd
-F7eD3vpDzhWRhd7NbMfJJpD7t7PDl2nbnu7fska4x76iTvJoCwKBwQCcqj2yhl69
-1GfpzsOtfzh9rECrnKjAhmVbwRfKB1ivwe8G2tobgQjOUajBqkCYKpZgTy3wyhWn
-0D4AdwonGu1XYLZWX+Hw/ZWhNEg/6Ju2wfiMJfFWmy5pvTSvmOlNWvYKwmH/TDjX
-tEctSVj6D67xE5v6s3donTI0NFa1u7i1hwoGu4POCockbau52YN4n20R5K7enu2+
-YYpXfcUOmCi91Hpv+X1YbmY1tOo0m1ItYqupbuRFXnHVXJhKxsYXqlA=
-----END RSA PRIVATE KEY-----
@@ -1,22 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIDozCCAgsCFCAZislHgIerlrBBkLFt/ZOkKYVZMA0GCSqGSIb3DQEBCwUAMA4x
-DDAKBgNVBAMMA25zZDAeFw0xOTA0MjUxNTEzMjdaFw0yOTA0MjIxNTEzMjdaMA4x
-DDAKBgNVBAMMA25zZDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAMS8
-uXxVCNTo112z3ENd99N/yuQJYk6umwp0ue3nc0CG5j2Y+12xmdEZ1OO3GddRkgCP
-abQyK0onTU7B82qlmZ+N9fyFY8KyJEYM/ef2jlkaL+H8JnEuar22FetJd/ODWS6p
-heAQw8UrdjC09vo1sRRCtolJtmF2XsIn0PM2h5o3wFpaPE5SuY87dEHNKj7+Zwgu
-psLY2+zh7pdzd0KJVuoWTnNSmVRHgXRC3naFPU8jMs4Twb5KgF1qLYvwsFo92DE4
-/y+8zX0PRdR1up+u2PpbTvCGnSCz4mYogFSKy6lIdxC9l36vgXCd0LwA48i/ReUx
-9wGlqIuomIDBnIHaivZOoY/s4rjMV+jrIM388UxM2Qh4TxK9/Ul+o/3x8yT+GhkM
-QABywJr9qfT/6BGXmbL1j7AVmKVCyoDGdCQ2YX9unXawdZqU2qkULBt/OHVGUfX/
-4ss07M8IHNj0OyRuoFYO9tyqAYZQ9IPg5QvF3cYkcmg2yT180qF4C1rpsdNjoQID
-AQABMA0GCSqGSIb3DQEBCwUAA4IBgQB+WGMopDqNkv7yDAO8Ik2EWieDqxTshqR4
-bT1do9zsC9WDrIVxoVcn+dtlIpEQl8MN9U5DTKBbRgk3grOwUsg2kC0Gujv3vAyQ
-bF+jxjHWd1xzrbQ+QUgz07P1OMFWxMzECL2L2078UZbawFqKqlmNv5avUk27G8nB
-GrujT/pUOIpRXC+rao8e14R84dPJLZuGm9IAeEBQIIdhY9sjFRyoQdCUubyKPpkm
-/fpcDMkt7PzZ4nTovj4NUxnnoUGonpXuj0pHA/RDDJkPYaRrND4OGldQXdZ9LJNM
-pROL6aCZ5iog74OY8yutVzCgGge9vZLkysceVP7Lyks9/fEAtIuozmulp9TUQAeR
-MVdDOcREWRd0vFNtAC9xSloRqV+66CzrFHwkSMpLo+gdgcAZ8s33rgQk+I4gfavU
-jPWMZVcZHXevtWuTRnxfOpMkbwiRyr2J8m549K7OKZgr+JRhdJTev4lvXVyfFia4
-zr6UOK4exZWP6VDXb4IyZbJh+LMjmws=
-----END CERTIFICATE-----
@@ -1,39 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
-0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
-GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
-uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
-WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
-FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
-q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
-A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
-7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
-XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
-iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
-2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
-MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
-WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
-O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
-IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
-qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
-dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
-bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
-YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
-7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
-gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
-5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
-ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
-oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
-s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
-zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
-ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
-oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
-BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
-mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
-kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
-7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
-RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
-jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
-O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
-MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
-----END RSA PRIVATE KEY-----
@@ -1,22 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
-EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
-WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
-igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
-a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
-4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
-aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
-TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
-uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
-+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
-XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
-dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
-84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
-JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
-fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
-XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
-qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
-sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
-yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
-CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
-----END CERTIFICATE-----
@@ -1,16 +0,0 @@
-BaseName: auth_tls_failcert
-Version: 1.0
-Description: Perform AXFR over tls for authority zone where the cert fails
-CreationDate: Thu 29 Aug 10:35:40 CEST 2024
-Maintainer: dr. W.C.A. Wijngaards
-Category: 
-Component:
-CmdDepends: 
-Depends: 
-Help:
-Pre: auth_tls_failcert.pre
-Post: auth_tls_failcert.post
-Test: auth_tls_failcert.test
-AuxFiles: 
-Passed:
-Failure:
@@ -1,21 +0,0 @@
-server:
-        logfile: "/dev/stderr"
-        xfrdfile: xfrd.state
-	username: ""
-	chroot: ""
-        zonesdir: ""
-	pidfile: "nsd.pid"
-        zonelistfile: "zone.list"
-	verbosity: 5
-	port: @NSD_PORT@
-        interface: 127.0.0.1@@NSD_PORT@
-
-	tls-port: @NSD_PORT@
-	tls-service-key: "nsd_server.key"
-	tls-service-pem: "nsd_server.pem"
-
-zone:
-	name: "example.com"
-	zonefile: "example.com.zone"
-	provide-xfr: 0.0.0.0/0 NOKEY
-	provide-xfr: ::0/0 NOKEY
@@ -1,14 +0,0 @@
-# #-- auth_tls_failcert.post --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# source the test var file when it's there
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-#
-# do your teardown here
-. ../common.sh
-kill_pid $NSD_PID
-kill_pid $UNBOUND_PID
-echo "nsd.log"
-cat nsd.log
-echo "unbound.log"
-cat unbound.log
@@ -1,47 +0,0 @@
-# #-- auth_tls_failcert.pre--#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-. ../common.sh
-PRE="../.."
-if test -n "$NSD"; then
-	:
-else
-	if `which nsd >/dev/null 2>&1`; then
-		# need nsd >= 4.2.0
-		NSD="nsd"
-	else
-		if test -f $PRE/../nsd/nsd; then
-			NSD="$PRE/../nsd/nsd"
-		else
-			skip_test "need nsd"
-		fi
-	fi
-fi
-echo "NSD=$NSD"
-
-get_random_port 2
-UNBOUND_PORT=$RND_PORT
-NSD_PORT=$(($RND_PORT + 1))
-echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
-echo "NSD_PORT=$NSD_PORT" >> .tpkg.var.test
-
-# make config file
-sed -e 's/@UNBOUND_PORT\@/'$UNBOUND_PORT'/' -e 's/@NSD_PORT\@/'$NSD_PORT'/' < auth_tls_failcert.ub.conf > ub.conf
-sed -e 's/@UNBOUND_PORT\@/'$UNBOUND_PORT'/' -e 's/@NSD_PORT\@/'$NSD_PORT'/' < auth_tls_failcert.nsd.conf > nsd.conf
-
-# start nsd
-$NSD -d -c nsd.conf >nsd.log 2>&1 &
-NSD_PID=$!
-echo "NSD_PID=$NSD_PID" >> .tpkg.var.test
-
-# start unbound in the background
-$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
-UNBOUND_PID=$!
-echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
-
-cat .tpkg.var.test
-wait_nsd_up nsd.log
-wait_unbound_up unbound.log
@@ -1,56 +0,0 @@
-# #-- auth_tls_failcert.test --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-# do the test
-echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
-fi
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
-fi
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
-fi
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
-fi
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
-fi
-if grep SERVFAIL outfile; then
-	echo "> try again"
-	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
-fi
-echo "> check answer"
-if grep "1.2.3.4" outfile; then
-	echo "Not OK"
-	exit 1
-else
-	echo "OK not present"
-fi
-
-# But the server should be up
-if grep "SERVFAIL" outfile; then
-	echo "OK"
-else
-	echo "Not OK"
-	exit 1
-fi
-
-exit 0
@@ -1,23 +0,0 @@
-server:
-	verbosity: 7
-	# num-threads: 1
-	interface: 127.0.0.1
-	port: @UNBOUND_PORT@
-	use-syslog: no
-	directory: ""
-	pidfile: "unbound.pid"
-	chroot: ""
-	username: ""
-	do-not-query-localhost: no
-	tls-service-key: "unbound_server.key"
-	tls-service-pem: "unbound_server.pem"
-	tls-cert-bundle: "nsd_server.pem"
-
-auth-zone:
-	name: "example.com"
-	for-upstream: yes
-	for-downstream: yes
-	# actual working primary: "127.0.0.1@@NSD_PORT@#nsd"
-	primary: "127.0.0.1@@NSD_PORT@#wrongname"
-	allow-notify: "127.0.0.2@@NSD_PORT@"
-	allow-notify: 127.0.0.1
@@ -1,4 +0,0 @@
-example.com.		240	IN	SOA	ns.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2024082400 28800 7200 604800 240
-example.com. NS ns.example.com.
-ns.example.com. IN A 192.0.2.1
-www.example.com. A 1.2.3.4
@@ -1,39 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIG5QIBAAKCAYEAxLy5fFUI1OjXXbPcQ13303/K5AliTq6bCnS57edzQIbmPZj7
-XbGZ0RnU47cZ11GSAI9ptDIrSidNTsHzaqWZn431/IVjwrIkRgz95/aOWRov4fwm
-cS5qvbYV60l384NZLqmF4BDDxSt2MLT2+jWxFEK2iUm2YXZewifQ8zaHmjfAWlo8
-TlK5jzt0Qc0qPv5nCC6mwtjb7OHul3N3QolW6hZOc1KZVEeBdELedoU9TyMyzhPB
-vkqAXWoti/CwWj3YMTj/L7zNfQ9F1HW6n67Y+ltO8IadILPiZiiAVIrLqUh3EL2X
-fq+BcJ3QvADjyL9F5TH3AaWoi6iYgMGcgdqK9k6hj+ziuMxX6OsgzfzxTEzZCHhP
-Er39SX6j/fHzJP4aGQxAAHLAmv2p9P/oEZeZsvWPsBWYpULKgMZ0JDZhf26ddrB1
-mpTaqRQsG384dUZR9f/iyzTszwgc2PQ7JG6gVg723KoBhlD0g+DlC8XdxiRyaDbJ
-PXzSoXgLWumx02OhAgMBAAECggGBAMS7MARriBRX7hzuYaEgE1V0oe+cjqi9o542
-EUMcQjzRaOVJ2HrdwUG+wgsgKwAMuqJCxuIBlRZm7MCH5CDODivmKohk3thviSRf
-k3tlKv1g2Wby3YIqd2TT82FAK2nf+8tUi+H/AbVl+59DJwIXtMbc22m3w1/8nU8r
-v5+l9L27aGcxesKbqKDZRC0Uu10YyvD8rZeEgY+EcjESrrxjV/1nZvWdMGR9yK74
-uzrri95aBVDbos7l8yz2oysf+UmUMp5U9rWwuU4M/34pFSGeo7CHjtliwbBF4FHn
-uyompXaOr7Qrgeg4fc9NbZNaB4OAOV2d1sI202q6j3kEkhG4pD8LAG/RRnugCj7D
-PKGJL3iZKxknjA+tAKkgq50EbMpLHHv1qSiKWy8p+bR5FyBYPSheOSkOKTywpqnd
-OU+VDTi4iLDvkENt6E0TghSyhncl8yIcomYPktqepaNekCHquK5sX8NUhOzRe3WH
-gX7l3e/o8JRvbwXJ8UWfQlKhPO/hvQKBwQDiLXVMf+Hjl/OoXHtF6huerNBux5CS
-KYha5BLARs9W74kd9mTJ9F5IflenpzQJc1b/PnvvlcDDlniUvlgk463EA2th4qWp
-50jFniq/l4rUMFk1vZBXldvuUaL6f+Ihi8WmoUAyguEVAB9G/EJ1bXqHKdJtxuz+
-/TXGBsXrF5+sZOTjfq96CgQtBmbPXMncPto0NndoMqcEB0bjsFywQXGCk6ZZZ3Ac
-vwnZFqVwqro3aTwD+xllzVz+xBNK8GU+zW8CgcEA3q2EepAT7dlZAveC7VSLnFF/
-w86ziynGEuhoJly+zedDPkFIGxYje1SPaKhpMH2jOdCajyHPOGuWEeVfKMbzCrHP
-GdFyiTQDk3Pq0JRXpUUJSPGPusAQnPruE68XccDb+eBiJR6y+0vXHd1J3F8B4BMQ
-AloZZtlx9BkEZaaRjROxM7Ilbev4IjOcScTREb2GL8gU3vnI2FJjBMy6fI5cm4QK
-XEgiLcxGniM77bAZTeoVFbpd4SSICDXVn/NM/XfvAoHBAMHbjKphAc/9MY6gldg6
-7Cl4nb4VtshQaNremWPMTXKKJNBVm9WtahJgl+jO2z8uaOalO70CchIyKm/zJcGY
-lBtpguSHSs7xueIHy0QkM43jUtNJAyrO+46s0jA65Cs0jdhgZZHls944GJbTKHNV
-vquTIRWOZxu3FBwDOihiOy2b3MNQlj7XzvR4hC4/rZTlGkmeVYItyBEf25bUVt2L
-eisdOntuuR0qcNptGqgS7UEJJbOTyRUEjCyhCpg0q9LEaQKBwDF7N1wQ1gzdZlUt
-cO+SAO/8gDqfnPAImVYsRLB5nYCdqiiUUxSJx9qpALEN80nuMS4wt5ekuKpd5dwW
-Lx4dj3ZJ6q5fB2eLolvKv1wYCp3UCGsoGnsyIL7xV6QSHVCOvZL6FHURLE6BHM0r
-FjWc+wqy0bTkFo7vNM48HOkFqYRC4vaM2JpjfCEFfO47iQW7Kq1FdbXSpZnEPPKd
-F7eD3vpDzhWRhd7NbMfJJpD7t7PDl2nbnu7fska4x76iTvJoCwKBwQCcqj2yhl69
-1GfpzsOtfzh9rECrnKjAhmVbwRfKB1ivwe8G2tobgQjOUajBqkCYKpZgTy3wyhWn
-0D4AdwonGu1XYLZWX+Hw/ZWhNEg/6Ju2wfiMJfFWmy5pvTSvmOlNWvYKwmH/TDjX
-tEctSVj6D67xE5v6s3donTI0NFa1u7i1hwoGu4POCockbau52YN4n20R5K7enu2+
-YYpXfcUOmCi91Hpv+X1YbmY1tOo0m1ItYqupbuRFXnHVXJhKxsYXqlA=
-----END RSA PRIVATE KEY-----
@@ -1,22 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIDozCCAgsCFCAZislHgIerlrBBkLFt/ZOkKYVZMA0GCSqGSIb3DQEBCwUAMA4x
-DDAKBgNVBAMMA25zZDAeFw0xOTA0MjUxNTEzMjdaFw0yOTA0MjIxNTEzMjdaMA4x
-DDAKBgNVBAMMA25zZDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAMS8
-uXxVCNTo112z3ENd99N/yuQJYk6umwp0ue3nc0CG5j2Y+12xmdEZ1OO3GddRkgCP
-abQyK0onTU7B82qlmZ+N9fyFY8KyJEYM/ef2jlkaL+H8JnEuar22FetJd/ODWS6p
-heAQw8UrdjC09vo1sRRCtolJtmF2XsIn0PM2h5o3wFpaPE5SuY87dEHNKj7+Zwgu
-psLY2+zh7pdzd0KJVuoWTnNSmVRHgXRC3naFPU8jMs4Twb5KgF1qLYvwsFo92DE4
-/y+8zX0PRdR1up+u2PpbTvCGnSCz4mYogFSKy6lIdxC9l36vgXCd0LwA48i/ReUx
-9wGlqIuomIDBnIHaivZOoY/s4rjMV+jrIM388UxM2Qh4TxK9/Ul+o/3x8yT+GhkM
-QABywJr9qfT/6BGXmbL1j7AVmKVCyoDGdCQ2YX9unXawdZqU2qkULBt/OHVGUfX/
-4ss07M8IHNj0OyRuoFYO9tyqAYZQ9IPg5QvF3cYkcmg2yT180qF4C1rpsdNjoQID
-AQABMA0GCSqGSIb3DQEBCwUAA4IBgQB+WGMopDqNkv7yDAO8Ik2EWieDqxTshqR4
-bT1do9zsC9WDrIVxoVcn+dtlIpEQl8MN9U5DTKBbRgk3grOwUsg2kC0Gujv3vAyQ
-bF+jxjHWd1xzrbQ+QUgz07P1OMFWxMzECL2L2078UZbawFqKqlmNv5avUk27G8nB
-GrujT/pUOIpRXC+rao8e14R84dPJLZuGm9IAeEBQIIdhY9sjFRyoQdCUubyKPpkm
-/fpcDMkt7PzZ4nTovj4NUxnnoUGonpXuj0pHA/RDDJkPYaRrND4OGldQXdZ9LJNM
-pROL6aCZ5iog74OY8yutVzCgGge9vZLkysceVP7Lyks9/fEAtIuozmulp9TUQAeR
-MVdDOcREWRd0vFNtAC9xSloRqV+66CzrFHwkSMpLo+gdgcAZ8s33rgQk+I4gfavU
-jPWMZVcZHXevtWuTRnxfOpMkbwiRyr2J8m549K7OKZgr+JRhdJTev4lvXVyfFia4
-zr6UOK4exZWP6VDXb4IyZbJh+LMjmws=
-----END CERTIFICATE-----
@@ -1,39 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
-0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
-GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
-uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
-WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
-FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
-q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
-A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
-7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
-XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
-iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
-2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
-MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
-WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
-O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
-IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
-qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
-dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
-bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
-YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
-7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
-gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
-5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
-ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
-oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
-s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
-zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
-ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
-oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
-BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
-mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
-kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
-7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
-RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
-jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
-O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
-MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
-----END RSA PRIVATE KEY-----
@@ -1,22 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
-EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
-WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
-igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
-a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
-4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
-aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
-TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
-uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
-+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
-XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
-dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
-84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
-JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
-fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
-XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
-qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
-sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
-yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
-CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
-----END CERTIFICATE-----
@@ -1,19 +0,0 @@
-server:
-	verbosity: 7
-	use-syslog: no
-	directory: ""
-	pidfile: "unbound.pid"
-	chroot: ""
-	username: ""
-	do-not-query-localhost: no
-	use-caps-for-id: no
-	port: @SERVER_PORT@
-	interface: 127.0.0.1
-	cookie-secret-file: "cookie_secrets.txt"
-	answer-cookie: yes
-	access-control: 127.0.0.0/8 allow_cookie  # BADCOOKIE for incomplete/invalid cookies
-
-remote-control:
-	control-enable: yes
-	control-port: @CONTROL_PORT@
-	control-use-cert: no
@@ -1,16 +0,0 @@
-BaseName: cookie_file
-Version: 1.0
-Description: Check the cookie rollover
-CreationDate: Fri 14 Jun 11:00:00 CEST 2024
-Maintainer:
-Category:
-Component:
-CmdDepends:
-Depends:
-Help:
-Pre: cookie_file.pre
-Post: cookie_file.post
-Test: cookie_file.test
-AuxFiles:
-Passed:
-Failure:
@@ -1,10 +0,0 @@
-# #-- cookie_file.post --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# source the test var file when it's there
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-#
-# do your teardown here
-. ../common.sh
-kill_from_pidfile "unbound.pid"
-cat unbound.log
@@ -1,24 +0,0 @@
-# #-- cookie_file.pre--#
-PRE="../.."
-. ../common.sh
-
-get_random_port 2
-SERVER_PORT=$RND_PORT
-CONTROL_PORT=$(($RND_PORT + 1))
-echo "SERVER_PORT=$SERVER_PORT" >> .tpkg.var.test
-echo "CONTROL_PORT=$CONTROL_PORT" >> .tpkg.var.test
-
-# make config file
-sed \
-	-e 's/@SERVER_PORT\@/'$SERVER_PORT'/' \
-	-e 's/@CONTROL_PORT\@/'$CONTROL_PORT'/' \
-	< cookie_file.conf > ub.conf
-
-# empty cookie file
-touch cookie_secrets.txt
-
-# start unbound in the background
-$PRE/unbound -d -c ub.conf > unbound.log 2>&1 &
-
-cat .tpkg.var.test
-wait_unbound_up unbound.log
@@ -1,250 +0,0 @@
-# #-- cookie_file.test --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-PRE="../.."
-. ../common.sh
-
-first_secret=dd3bdf9344b678b185a6f5cb60fca715
-second_secret=445536bcd2513298075a5d379663c962
-
-
-teststep "Add first secret"
-echo ">> add_cookie_secret $first_secret"
-$PRE/unbound-control -c ub.conf add_cookie_secret $first_secret
-# check secret is persisted
-outfile=cookie_secrets.1
-$PRE/unbound-control -c ub.conf print_cookie_secrets > $outfile
-if ! grep -q "$first_secret" $outfile
-then
-	sleep 1
-	$PRE/unbound-control -c ub.conf print_cookie_secrets > $outfile
-fi
-if ! grep -q "$first_secret" $outfile
-then
-	sleep 1
-	$PRE/unbound-control -c ub.conf print_cookie_secrets > $outfile
-fi
-if ! grep -q "$first_secret" $outfile
-then
-	sleep 1
-	$PRE/unbound-control -c ub.conf print_cookie_secrets > $outfile
-fi
-if ! grep -q "^active.*$first_secret" $outfile
-then
-	cat $outfile
-	echo "First secret was not provisioned"
-	exit 1
-fi
-echo ">> print_cookie_secrets"
-cat $outfile
-
-
-teststep "Get a valid cookie for this secret"
-outfile=dig.output.1
-dig version.server ch txt @127.0.0.1 -p $SERVER_PORT +cookie=3132333435363738 > $outfile
-if ! grep -q "BADCOOKIE" $outfile
-then
-	cat $outfile
-	echo "Did not get a BADCOOKIE response for a client-only cookie"
-	exit 1
-fi
-if ! grep -q "COOKIE: 3132333435363738" $outfile
-then
-	cat $outfile
-	echo "Did not get a cookie in the response"
-	exit 1
-fi
-first_cookie=$(grep "; COOKIE:" $outfile | cut -d ' ' -f 3)
-cat $outfile
-echo "first cookie: $first_cookie"
-
-
-teststep "Verify the first cookie can be reused"
-outfile=dig.output.2
-dig version.server ch txt @127.0.0.1 -p $SERVER_PORT +cookie=$first_cookie > $outfile
-if grep -q "BADCOOKIE" $outfile
-then
-	cat $outfile
-	echo "Got BADCOOKIE response for a valid cookie"
-	exit 1
-fi
-if ! grep -q "COOKIE: $first_cookie" $outfile
-then
-	cat $outfile
-	echo "Did not get the same first cookie in the response"
-	exit 1
-fi
-
-
-teststep "Add second secret"
-outfile=cookie_secrets.2
-echo ">> add_cookie_secret $second_secret"
-$PRE/unbound-control -c ub.conf add_cookie_secret $second_secret
-$PRE/unbound-control -c ub.conf print_cookie_secrets > $outfile
-if ! grep -q "$second_secret" $outfile
-then
-	sleep 1
-	$PRE/unbound-control -c ub.conf print_cookie_secrets > $outfile
-fi
-if ! grep -q "$second_secret" $outfile
-then
-	sleep 1
-	$PRE/unbound-control -c ub.conf print_cookie_secrets > $outfile
-fi
-if ! grep -q "$second_secret" $outfile
-then
-	sleep 1
-	$PRE/unbound-control -c ub.conf print_cookie_secrets > $outfile
-fi
-if ! grep -q "^staging.*$second_secret" $outfile \
-	|| ! grep -q "^active.*$first_secret" $outfile
-then
-		cat $outfile
-		echo "Secrets were not provisioned"
-		exit 1
-fi
-echo ">> print_cookie_secrets"
-cat $outfile
-echo ">> cookie_secrets.txt"
-cat cookie_secrets.txt
-
-
-teststep "Verify the first cookie can be reused"
-outfile=dig.output.3
-dig version.server ch txt @127.0.0.1 -p $SERVER_PORT +cookie=$first_cookie > $outfile
-if grep -q "BADCOOKIE" $outfile
-then
-	cat $outfile
-	echo "Got BADCOOKIE response for a valid cookie"
-	exit 1
-fi
-if ! grep -q "COOKIE: $first_cookie" $outfile
-then
-	cat $outfile
-	echo "Did not get the same first cookie in the response"
-	exit 1
-fi
-
-
-teststep "Secret rollover"
-outfile=cookie_secrets.3
-$PRE/unbound-control -c ub.conf activate_cookie_secret
-$PRE/unbound-control -c ub.conf print_cookie_secrets > $outfile
-if ! grep -q "^active.*$second_secret" $outfile
-then
-	sleep 1
-	$PRE/unbound-control -c ub.conf print_cookie_secrets > $outfile
-fi
-if ! grep -q "^active.*$second_secret" $outfile
-then
-	sleep 1
-	$PRE/unbound-control -c ub.conf print_cookie_secrets > $outfile
-fi
-if ! grep -q "^active.*$second_secret" $outfile
-then
-	sleep 1
-	$PRE/unbound-control -c ub.conf print_cookie_secrets > $outfile
-fi
-if ! grep -q "^active.*$second_secret" $outfile \
-	|| ! grep -q "^staging.*$first_secret" $outfile
-then
-	cat $outfile
-	echo "Second secret was not activated"
-	exit 1
-fi
-echo ">> activate cookie secret, printout"
-cat $outfile
-echo ">> cookie_secrets.txt"
-cat cookie_secrets.txt
-
-
-teststep "Verify the first cookie can be reused but a new cookie is returned from the second secret"
-outfile=dig.output.4
-dig version.server ch txt @127.0.0.1 -p $SERVER_PORT +cookie=$first_cookie > $outfile
-if grep -q "BADCOOKIE" $outfile
-then
-	cat $outfile
-	echo "Got BADCOOKIE response for a valid cookie"
-	exit 1
-fi
-if ! grep -q "COOKIE: 3132333435363738" $outfile
-then
-	cat $outfile
-	echo "Did not get a cookie in the response"
-	exit 1
-fi
-if grep -q "COOKIE: $first_cookie" $outfile
-then
-	cat $outfile
-	echo "Got the same first cookie in the response while the second secret is active"
-	exit 1
-fi
-second_cookie=$(grep "; COOKIE:" $outfile | cut -d ' ' -f 3)
-cat $outfile
-echo "second cookie: $second_cookie"
-
-
-teststep "Drop cookie secret"
-outfile=cookie_secrets.4
-$PRE/unbound-control -c ub.conf drop_cookie_secret
-$PRE/unbound-control -c ub.conf print_cookie_secrets > $outfile
-if grep -q "^staging.*$first_secret" $outfile
-then
-	sleep 1
-	$PRE/unbound-control -c ub.conf print_cookie_secrets > $outfile
-fi
-if grep -q "^staging.*$first_secret" $outfile
-then
-	sleep 1
-	$PRE/unbound-control -c ub.conf print_cookie_secrets > $outfile
-fi
-if grep -q "^staging.*$first_secret" $outfile
-then
-	sleep 1
-	$PRE/unbound-control -c ub.conf print_cookie_secrets > $outfile
-fi
-if grep -q "^staging.*$first_secret" $outfile
-then
-	cat $outfile
-	echo "First secret was not dropped"
-	exit 1
-fi
-echo ">> drop cookie secret, printout"
-cat $outfile
-echo ">> cookie_secrets.txt"
-cat cookie_secrets.txt
-
-
-teststep "Verify the first cookie can not be reused and the second cookie is returned instead"
-outfile=dig.output.4
-dig version.server ch txt @127.0.0.1 -p $SERVER_PORT +cookie=$first_cookie > $outfile
-if ! grep -q "BADCOOKIE" $outfile
-then
-	cat $outfile
-	echo "Did not get BADCOOKIE response for an invalid cookie"
-	exit 1
-fi
-if ! grep -q "COOKIE: 3132333435363738" $outfile
-then
-	cat $outfile
-	echo "Did not get a cookie in the response"
-	exit 1
-fi
-if grep -q "COOKIE: $first_cookie" $outfile
-then
-	cat $outfile
-	echo "Got the same first cookie in the response while the second secret is active"
-	exit 1
-fi
-if ! grep -q "COOKIE: .* (good)$" $outfile
-then
-	# dig can generate a different cookie value here than previous cookies.
-	# but make sure the output contains a valid cookie
-	cat $outfile
-	echo "Did not get a valid cookie in the response"
-	exit 1
-fi
-
-exit 0
@@ -1,195 +0,0 @@
-; config options
-server:
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	module-config: "dns64 iterator"
-	dns64-prefix: 64:ff9b::0/96
-	minimal-responses: no
-	prefetch: yes
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test dns64 with prefetch and cache store.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 200
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET. IN A 193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION AUTHORITY
-com. IN NS a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net. IN A 192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 200
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com. IN NS a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net. IN A 192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION AUTHORITY
-example.com. IN NS ns.example.com.
-SECTION ADDITIONAL
-ns.example.com. IN A 1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com. IN NS ns.example.com.
-SECTION ADDITIONAL
-ns.example.com. IN A 1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	10.20.30.40
-SECTION AUTHORITY
-example.com. IN NS ns.example.com.
-SECTION ADDITIONAL
-ns.example.com. IN A 1.2.3.4
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. 3600 IN A	10.20.30.40
-SECTION AUTHORITY
-example.com. 3600 IN NS ns.example.com.
-SECTION ADDITIONAL
-ns.example.com. 3600 IN A 1.2.3.4
-ENTRY_END
-
-STEP 20 TIME_PASSES ELAPSE 3500
-
-STEP 30 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-; the prefetch is started, the older cache reply is returned.
-STEP 40 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. 100 IN A	10.20.30.40
-SECTION AUTHORITY
-example.com. 100 IN NS ns.example.com.
-SECTION ADDITIONAL
-ns.example.com. 100 IN A 1.2.3.4
-ENTRY_END
-
-; check what is in the cache
-STEP 42 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-STEP 43 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. 3600 IN A	10.20.30.40
-SECTION AUTHORITY
-example.com. 3600 IN NS ns.example.com.
-SECTION ADDITIONAL
-ns.example.com. 3600 IN A 1.2.3.4
-ENTRY_END
-
-STEP 50 TIME_PASSES ELAPSE 300
-
-; now the upstream is offline, the prefetched answer should be in the cache.
-STEP 110 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-STEP 120 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. 3300 IN A	10.20.30.40
-SECTION AUTHORITY
-example.com. 3300 IN NS ns.example.com.
-SECTION ADDITIONAL
-ns.example.com. 3300 IN A 1.2.3.4
-ENTRY_END
-
-SCENARIO_END
@@ -12,6 +12,4 @@ kill_pid $FWD_PID
 kill $UNBOUND_PID
 kill $UNBOUND_PID >/dev/null 2>&1
 cat unbound.log
-cat tap.log
-cat tap.errlog
 exit 0
@@ -122,6 +122,8 @@ if test $num_responses -gt 2; then
 fi

 echo "> cat logfiles"
+cat tap.log
+cat tap.errlog
 cat fwd.log
 echo "> OK"
 exit 0
@@ -33,7 +33,7 @@ echo "num answers $num and num write events $nummodew"
 if [ $num -eq 8 ]; then
 	echo "content OK"
 else
-    if [ "(" $num -eq 9 -o $num -eq 10 ")" -a "(" $nummodew -eq 2 -o $nummodew -eq 3 ")" ]; then
+    if [ "(" $num -eq 9 -o $num -eq 10 ")" -a $nummodew -eq 2 ]; then
 	echo "skip buffer emptied event"
    else
 	echo "result contents not OK"
@@ -1,21 +0,0 @@
-server:
-	verbosity: 2
-	# num-threads: 1
-	interface: 127.0.0.1@@PORT@
-	quic-port: @PORT@
-	tls-service-key: "unbound_server.key"
-	tls-service-pem: "unbound_server.pem"
-	use-syslog: no
-	directory: .
-	pidfile: "unbound.pid"
-	chroot: ""
-	username: ""
-	do-not-query-localhost: no
-
-	local-zone: "example.net" static
-	local-data: "www.example.net. IN A 1.2.3.4"
-	local-zone: "drop.net" deny
-
-forward-zone:
-	name: "."
-	forward-addr: "127.0.0.1@@TOPORT@"
@@ -1,16 +0,0 @@
-BaseName: doq_downstream
-Version: 1.0
-Description: Test DNS-over-QUIC query processing
-CreationDate: Mon Aug 01 16:00:00 CEST 2022
-Maintainer:
-Category: 
-Component:
-CmdDepends: 
-Depends: 
-Help:
-Pre: doq_downstream.pre
-Post: doq_downstream.post
-Test: doq_downstream.test
-AuxFiles: 
-Passed:
-Failure:
@@ -1,13 +0,0 @@
-# #-- doq_downstream.post --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# source the test var file when it's there
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-#
-# do your teardown here
-PRE="../.."
-. ../common.sh
-kill_pid $FWD_PID
-if test -f unbound.pid; then
-	kill_pid $UNBOUND_PID
-fi
@@ -1,44 +0,0 @@
-# #-- doq_downstream.pre--#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-. ../common.sh
-if grep "define HAVE_NGTCP2 1" $PRE/config.h; then echo test enabled; else skip_test "test skipped"; fi
-
-if test -f $PRE/unbound_do_valgrind_in_test; then
-	do_valgrind=yes
-else
-	do_valgrind=no
-fi
-VALGRIND_FLAGS="--leak-check=full --show-leak-kinds=all"
-
-get_random_port 2
-UNBOUND_PORT=$RND_PORT
-FWD_PORT=$(($RND_PORT + 1))
-echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
-echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
-
-# start forwarder
-get_ldns_testns
-$LDNS_TESTNS -p $FWD_PORT doq_downstream.testns >fwd.log 2>&1 &
-FWD_PID=$!
-echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
-
-# make config file
-sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < doq_downstream.conf > ub.conf
-# start unbound in the background
-if test $do_valgrind = "yes"; then
-valgrind $VALGRIND_FLAGS $PRE/unbound -vvvv -d -c ub.conf >unbound.log 2>&1 &
-else
-$PRE/unbound -vvvv -d -c ub.conf >unbound.log 2>&1 &
-fi
-UNBOUND_PID=$!
-echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
-
-cat .tpkg.var.test
-wait_ldns_testns_up fwd.log
-wait_unbound_up unbound.log
-
@@ -1,109 +0,0 @@
-# #-- doq_downstream.test --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-. ../common.sh
-get_make
-(cd $PRE; $MAKE doqclient)
-
-# test query from local-data, immediate like from cache
-echo "> query www.example.net."
-$PRE/doqclient -s 127.0.0.1 -p $UNBOUND_PORT www.example.net. A IN >outfile 2>&1
-cat outfile
-if test "$?" -ne 0; then
-	echo "exit status not OK"
-	echo "> cat logfiles"
-	cat outfile
-	cat fwd.log
-	cat unbound.log
-	echo "Not OK"
-	exit 1
-fi
-if grep "www.example.net" outfile | grep "1.2.3.4"; then
-	echo "content OK"
-else
-	echo "result contents not OK"
-	echo "> cat logfiles"
-	cat outfile
-	cat fwd.log
-	cat unbound.log
-	echo "result contents not OK"
-	exit 1
-fi
-echo "OK"
-
-# test query that is resolved
-echo "> query www.example.com."
-$PRE/doqclient -s 127.0.0.1 -p $UNBOUND_PORT www.example.com. A IN >outfile 2>&1
-cat outfile
-if test "$?" -ne 0; then
-	echo "exit status not OK"
-	echo "> cat logfiles"
-	cat outfile
-	cat fwd.log
-	cat unbound.log
-	echo "Not OK"
-	exit 1
-fi
-if grep "www.example.com" outfile | grep "10.20.30.40"; then
-	echo "content OK"
-else
-	echo "result contents not OK"
-	echo "> cat logfiles"
-	cat outfile
-	cat fwd.log
-	cat unbound.log
-	echo "result contents not OK"
-	exit 1
-fi
-echo "OK"
-
-# Perform the lock verify tests, stop the server first.
-kill_pid $UNBOUND_PID
-cat unbound.log
-# Remove pidfile so that the post script does not try to stop the server,
-# it is already stopped.
-rm -f unbound.pid
-if test -f ublocktrace-doqclient.0; then
-	if $PRE/lock-verify ublocktrace-doqclient.* 2>&1; then
-		echo "lock-verify test ublocktrace-doqclient worked."
-	else
-		echo "lock-verify test ublocktrace-doqclient failed."
-		exit 1
-	fi
-fi
-if test -f ublocktrace.0; then
-	if $PRE/lock-verify ublocktrace.* 2>&1; then
-		echo "lock-verify test ublocktrace worked."
-	else
-		echo "lock-verify test ublocktrace failed."
-		exit 1
-	fi
-	if grep "lock error" unbound.log >/dev/null; then
-		echo "lock error"
-		exit 1
-	fi
-fi
-# check valgrind output
-if test -f $PRE/unbound_do_valgrind_in_test; then
-	if grep "All heap blocks were freed -- no leaks are possible" unbound.log; then
-		:  # clean
-	else
-		grep "^==" unbound.log
-		echo "Memory leaked"
-		grep "in use at exit" unbound.log
-		exit 1
-	fi
-	if grep "ERROR SUMMARY: 0 errors from 0 contexts" unbound.log; then
-		:  # clean
-	else
-		grep "^==" unbound.log
-		echo "Errors"
-		grep "ERROR SUMMARY" unbound.log
-		exit 1
-	fi
-fi
-exit 0
@@ -1,13 +0,0 @@
-; nameserver test file
-$ORIGIN example.com.
-$TTL 3600
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-REPLY QR AA NOERROR
-ADJUST copy_id
-SECTION QUESTION
-www	IN	A
-SECTION ANSWER
-www	IN	A	10.20.30.40
-ENTRY_END
@@ -1,15 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC3F7Jsv2u01pLL9rFnjsMU/IaCFUIz/624DcaE84Z4gjMl5kWA
-3axQcqul1wlwSrbKwrony+d9hH/+MX0tZwvl8w3OmhmOAiaQ+SHCsIuOjVwQjX0s
-RLB61Pz5+PAiVvnPa9JIYB5QrK6DVEsxIHj8MOc5JKORrnESsFDh6yeMeQIDAQAB
-AoGAAuWoGBprTOA8UGfl5LqYkaNxSWumsYXxLMFjC8WCsjN1NbtQDDr1uAwodSZS
-6ujzvX+ZTHnofs7y64XC8k34HTOCD2zlW7kijWbT8YjRYFU6o9F5zUGD9RCan0ds
-sVscT2psLSzfdsmFAcbmnGdxYkXk2PC1FHtaqExxehralGUCQQDcqrg9uQKXlhQi
-XAaPr8SiWvtRm2a9IMMZkRfUWZclPHq6fCWNuUaCD+cTat4wAuqeknAz33VEosw3
-fXGsok//AkEA1GjIHXrOcSlpfVJb6NeOBugjRtZ7ZDT5gbtnMS9ob0qntKV6saaL
-CNmJwuD9Q3XkU5j1+uHvYGP2NzcJd2CjhwJACV0hNlVMe9w9fHvFN4Gw6WbM9ViP
-0oS6YrJafYNTu5vGZXVxLoNnL4u3NYa6aPUmuZXjNwBLfJ8f5VboZPf6RwJAINd2
-oYA8bSi/A755MX4qmozH74r4Fx1Nuq5UHTm8RwDe/0Javx8F/j9MWpJY9lZDEF3l
-In5OebPa/NyInSmW/wJAZuP9aRn0nDBkHYri++1A7NykMiJ/nH0mDECbnk+wxx0S
-LwqIetBhxb8eQwMg45+iAH7CHAMQ8BQuF/nFE6eotg==
-----END RSA PRIVATE KEY-----
--- a/Show More
+++ b/Show More