Expose symbols

Plumming for ub_send and ub_send_async
Funcion prototypes for ub_send and ub_send_async
2026-08-17 21:25:50 +02:00 · 2022-11-05 19:34:51 +01:00 · 2022-11-05 18:50:57 +01:00 · 2022-11-05 12:51:20 +01:00
628 changed files with 28763 additions and 71042 deletions
@@ -31,13 +31,13 @@ jobs:
            clang_analysis: "yes"
          - name: OS X
            os: macos-latest
-            install_expat: "no"
-            config: "--enable-debug --disable-flto --with-ssl=/opt/homebrew/opt/openssl --with-libexpat=/opt/homebrew/opt/expat"
+            install_expat: "yes"
+            config: "--enable-debug --disable-flto --with-ssl=/usr/local/opt/openssl --with-libexpat=/usr/local/opt/expat"
            make_test: "yes"
          - name: Clang on OS X
            os: macos-latest
-            install_expat: "no"
-            config: "CC=clang --enable-debug --disable-flto --with-ssl=/opt/homebrew/opt/openssl --with-libexpat=/opt/homebrew/opt/expat --disable-static"
+            install_expat: "yes"
+            config: "CC=clang --enable-debug --disable-flto --with-ssl=/usr/local/opt/openssl --with-libexpat=/usr/local/opt/expat --disable-static"
            make_test: "yes"
            clang_analysis: "yes"
          - name: ubsan (gcc undefined behaviour sanitizer)
@@ -161,44 +161,13 @@ jobs:
            test_windows: "yes"
            config: "no"
            make: "no"
-          - name: FreeBSD
-            os: ubuntu-latest
-            config: "no"
-            make: "no"
-            with_cross_platform_action: "yes"
-            cross_platform_os: "freebsd"
-            cross_platform_arch: "x86-64"
-            cross_platform_version: "14.1"
-            cross_platform_config: "--enable-debug --disable-flto --with-libevent --disable-static"
-          - name: OpenBSD
-            os: ubuntu-latest
-            config: "no"
-            make: "no"
-            with_cross_platform_action: "yes"
-            cross_platform_os: "openbsd"
-            cross_platform_arch: "x86-64"
-            cross_platform_version: "7.5"
-            cross_platform_config: "--enable-debug --disable-flto --with-libevent --disable-static"
-          - name: NetBSD
-            os: ubuntu-latest
-            config: "no"
-            make: "no"
-            with_cross_platform_action: "yes"
-            cross_platform_os: "netbsd"
-            cross_platform_arch: "x86-64"
-            cross_platform_version: "10.0"
-            cross_platform_config: "--enable-debug --disable-flto --with-libevent --disable-static"
 
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v2
        with:
          submodules: false
-          persist-credentials: false
      - name: test_windows
        if: ${{ matrix.test_windows == 'yes' }}
-        env:
-          LIBEXPAT_FNAME: expat-2.7.0
-          LIBEXPAT_VERSION_DIR: R_2_7_0
        shell: bash
        run: |
          export unboundpath=`pwd`
@@ -206,26 +175,21 @@ jobs:
          cd ..
          export prepath=`pwd`
          echo prepath=${prepath}
-          echo "choco install winflexbison3"
-          choco install winflexbison3
-          echo 'LEX="win_flex"'
-          export LEX="win_flex"
-          echo 'YACC="win_bison -y"'
-          export YACC="win_bison -y"
+          #echo "curl cpanm"
+          #curl -L -k -s -S -o cpanm https://cpanmin.us/
+          #echo "perl cpanm Pod::Usage"
+          #perl cpanm Pod::Usage
          mkdir openssl
          echo "curl openssl"
-          curl -L -k -s -S -o openssl-3.2.0.tar.gz https://www.openssl.org/source/openssl-3.2.0.tar.gz
-          tar xzf openssl-3.2.0.tar.gz
-          cd openssl-3.2.0
+          curl -L -k -s -S -o openssl-1.1.1j.tar.gz https://www.openssl.org/source/openssl-1.1.1j.tar.gz
+          tar xzf openssl-1.1.1j.tar.gz
+          cd openssl-1.1.1j
          # remove pod::Usage because we do not need -help or -man output
-          # from the Configure script, this fixes it for openssl 1.1.1
-          #echo "Fixup ./Configure by removing use Pod::Usage require"
-          #sed -e 's/use Pod::Usage//' < Configure > Configure.fix
-          # ./Configure.fix no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl"
-          # pacman is used to install for msys2, with
-          # C:/msys64/usr/bin/pacman -S perl
-          echo "C:/msys64/usr/bin/perl ./Configure no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix=\""$prepath/openssl"\" PERL=\"C:/msys64/usr/bin/perl\""
-          C:/msys64/usr/bin/perl ./Configure no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl" PERL="C:/msys64/usr/bin/perl"
+          # from the Configure script
+          echo "Fixup ./Configure by removing use Pod::Usage require"
+          sed -e 's/use Pod::Usage//' < Configure > Configure.fix
+          echo "./Configure.fix no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix=\""$prepath/openssl\"""
+          ./Configure.fix no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl"
          # make the libs only, build faster
          echo "make build_libs"
          #make
@@ -241,9 +205,9 @@ jobs:
          cd ..
          mkdir expat
          echo "curl expat"
-          curl -L -k -s -S -o $LIBEXPAT_FNAME.tar.gz https://github.com/libexpat/libexpat/releases/download/$LIBEXPAT_VERSION_DIR/$LIBEXPAT_FNAME.tar.gz
-          tar xzf $LIBEXPAT_FNAME.tar.gz
-          cd $LIBEXPAT_FNAME
+          curl -L -k -s -S -o expat-2.2.10.tar.gz https://github.com/libexpat/libexpat/releases/download/R_2_2_10/expat-2.2.10.tar.gz
+          tar xzf expat-2.2.10.tar.gz
+          cd expat-2.2.10
          echo "./configure SHELL=/usr/bin/bash CONFIG_SHELL=/usr/bin/bash --prefix=\"$prepath/expat\" --exec-prefix=\"$prepath/expat\" --bindir=\"$prepath/expat/bin\" --includedir=\"$prepath/expat/include\" --mandir=\"$prepath/expat/man\" --libdir=\"$prepath/expat/lib\""
          ./configure SHELL=/usr/bin/bash CONFIG_SHELL=/usr/bin/bash --prefix="$prepath/expat" --exec-prefix="$prepath/expat" --bindir="$prepath/expat/bin" --includedir="$prepath/expat/include" --mandir="$prepath/expat/man" --libdir="$prepath/expat/lib"
          # fixup SHELL is treated specially, but SHELZZ is not by make.
@@ -362,33 +326,6 @@ jobs:
          echo "::group::make install"
          make install
          echo "::endgroup::"
-      - name: cross-platform-action on ${{ matrix.cross_platform_os }} ${{ matrix.cross_platform_version }}
-        if: ${{ matrix.with_cross_platform_action == 'yes' }}
-        uses: cross-platform-actions/action@v0.25.0
-        env:
-          CROSS_PLATFORM_OS: ${{ matrix.cross_platform_os }}
-        with:
-          environment_variables: CROSS_PLATFORM_OS
-          operating_system: ${{ matrix.cross_platform_os }}
-          architecture: ${{ matrix.cross_platform_arch }}
-          version: ${{ matrix.cross_platform_version }}
-          shell: bash
-          memory: 4G
-          cpu_count: 2
-          run: |
-            set -e -x
-            if test "$CROSS_PLATFORM_OS" = "freebsd"; then sudo pkg install -y openssl libevent expat; fi
-            if test "$CROSS_PLATFORM_OS" = "openbsd"; then sudo pkg_add libevent; fi
-            if test "$CROSS_PLATFORM_OS" = "netbsd"; then sudo pkgin -y install libevent; fi
-            echo "::group::configure"
-            ./configure ${{ matrix.cross_platform_config }}
-            echo "::endgroup::"
-            echo "::group::make"
-            make
-            echo "::endgroup::"
-            echo "::group::make test"
-            make test
-            echo "::endgroup::"
      - name: install libevent
        if: ${{ matrix.install_libevent == 'yes' }}
        run: sudo apt-get install libevent-dev
@@ -12,9 +12,7 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-    - uses: actions/checkout@v4
-      with:
-        persist-credentials: false
+    - uses: actions/checkout@v2
    - name: configure
      run: ./configure --enable-debug
    - name: make
@@ -10,10 +10,6 @@
 /config.status
 /dnstap/dnstap_config.h
 /dnscrypt/dnscrypt_config.h
-/util/configlexer.c
-/util/configparser.c
-/util/configparser.h
-/clubsyms.def
 /doc/example.conf
 /doc/libunbound.3
 /doc/unbound-anchor.8
@@ -36,7 +32,6 @@
 /asynclook
 /delayer
 /dohclient
-/doqclient
 /lock-verify
 /memstats
 /perf
@@ -59,7 +54,6 @@
 /pythonmod/unboundmodule.py
 /testdata/result.*
 /testdata/.done-*
-/testdata/.skip-*
 /testdata/.perfstats.txt
 /doc/html
 /doc/xml
@@ -122,15 +122,15 @@ iterator/iter_delegpt.c iterator/iter_donotq.c iterator/iter_fwd.c \
 iterator/iter_hints.c iterator/iter_priv.c iterator/iter_resptype.c \
 iterator/iter_scrub.c iterator/iter_utils.c services/listen_dnsport.c \
 services/localzone.c services/mesh.c services/modstack.c services/view.c \
-services/rpz.c util/rfc_1982.c \
+services/rpz.c \
 services/outbound_list.c services/outside_network.c util/alloc.c \
 util/config_file.c util/configlexer.c util/configparser.c \
 util/shm_side/shm_main.c services/authzone.c \
 util/fptr_wlist.c util/locks.c util/log.c util/mini_event.c util/module.c \
 util/netevent.c util/net_help.c util/random.c util/rbtree.c util/regional.c \
-util/rtt.c util/siphash.c util/edns.c util/storage/dnstree.c util/storage/lookup3.c \
+util/rtt.c util/edns.c util/storage/dnstree.c util/storage/lookup3.c \
 util/storage/lruhash.c util/storage/slabhash.c util/tcp_conn_limit.c \
-util/timehist.c util/tube.c util/proxy_protocol.c util/timeval_func.c \
+util/timehist.c util/tube.c util/proxy_protocol.c \
 util/ub_event.c util/ub_event_pluggable.c util/winsock_event.c \
 validator/autotrust.c validator/val_anchor.c validator/validator.c \
 validator/val_kcache.c validator/val_kentry.c validator/val_neg.c \
@@ -145,14 +145,14 @@ as112.lo msgparse.lo msgreply.lo packed_rrset.lo iterator.lo iter_delegpt.lo \
 iter_donotq.lo iter_fwd.lo iter_hints.lo iter_priv.lo iter_resptype.lo \
 iter_scrub.lo iter_utils.lo localzone.lo mesh.lo modstack.lo view.lo \
 outbound_list.lo alloc.lo config_file.lo configlexer.lo configparser.lo \
-fptr_wlist.lo siphash.lo edns.lo locks.lo log.lo mini_event.lo module.lo net_help.lo \
+fptr_wlist.lo edns.lo locks.lo log.lo mini_event.lo module.lo net_help.lo \
 random.lo rbtree.lo regional.lo rtt.lo dnstree.lo lookup3.lo lruhash.lo \
 slabhash.lo tcp_conn_limit.lo timehist.lo tube.lo winsock_event.lo \
-autotrust.lo val_anchor.lo rpz.lo rfc_1982.lo proxy_protocol.lo \
+autotrust.lo val_anchor.lo rpz.lo proxy_protocol.lo \
 validator.lo val_kcache.lo val_kentry.lo val_neg.lo val_nsec3.lo val_nsec.lo \
 val_secalgo.lo val_sigcrypt.lo val_utils.lo dns64.lo $(CACHEDB_OBJ) authzone.lo \
 $(SUBNET_OBJ) $(PYTHONMOD_OBJ) $(CHECKLOCK_OBJ) $(DNSTAP_OBJ) $(DNSCRYPT_OBJ) \
-$(IPSECMOD_OBJ) $(IPSET_OBJ) $(DYNLIBMOD_OBJ) respip.lo timeval_func.lo
+$(IPSECMOD_OBJ) $(IPSET_OBJ) $(DYNLIBMOD_OBJ) respip.lo
 COMMON_OBJ_WITHOUT_UB_EVENT=$(COMMON_OBJ_WITHOUT_NETCALL) netevent.lo listen_dnsport.lo \
 outside_network.lo
 COMMON_OBJ=$(COMMON_OBJ_WITHOUT_UB_EVENT) ub_event.lo
@@ -179,11 +179,11 @@ testcode/unitlruhash.c testcode/unitmain.c testcode/unitmsgparse.c \
 testcode/unitneg.c testcode/unitregional.c testcode/unitslabhash.c \
 testcode/unitverify.c testcode/readhex.c testcode/testpkts.c testcode/unitldns.c \
 testcode/unitecs.c testcode/unitauth.c testcode/unitzonemd.c \
-testcode/unittcpreuse.c testcode/unitdoq.c testcode/unitinfra.c
+testcode/unittcpreuse.c
 UNITTEST_OBJ=unitanchor.lo unitdname.lo unitlruhash.lo unitmain.lo \
 unitmsgparse.lo unitneg.lo unitregional.lo unitslabhash.lo unitverify.lo \
 readhex.lo testpkts.lo unitldns.lo unitecs.lo unitauth.lo unitzonemd.lo \
-unittcpreuse.lo unitdoq.lo unitinfra.lo
+unittcpreuse.lo
 UNITTEST_OBJ_LINK=$(UNITTEST_OBJ) worker_cb.lo $(COMMON_OBJ) $(SLDNS_OBJ) \
 $(COMPAT_OBJ)
 DAEMON_SRC=daemon/acl_list.c daemon/cachedump.c daemon/daemon.c \
@@ -198,7 +198,7 @@ CHECKCONF_OBJ=unbound-checkconf.lo worker_cb.lo
 CHECKCONF_OBJ_LINK=$(CHECKCONF_OBJ) $(COMMON_OBJ_ALL_SYMBOLS) $(SLDNS_OBJ) \
 $(COMPAT_OBJ) @WIN_CHECKCONF_OBJ_LINK@
 CONTROL_SRC=smallapp/unbound-control.c
-CONTROL_OBJ=unbound-control.lo
+CONTROL_OBJ=unbound-control.lo 
 CONTROL_OBJ_LINK=$(CONTROL_OBJ) worker_cb.lo $(COMMON_OBJ_ALL_SYMBOLS) \
 $(SLDNS_OBJ) $(COMPAT_OBJ) @WIN_CONTROL_OBJ_LINK@
 HOST_SRC=smallapp/unbound-host.c
@@ -242,10 +242,6 @@ DOHCLIENT_SRC=testcode/dohclient.c
 DOHCLIENT_OBJ=dohclient.lo
 DOHCLIENT_OBJ_LINK=$(DOHCLIENT_OBJ) worker_cb.lo $(COMMON_OBJ) $(COMPAT_OBJ) \
 $(SLDNS_OBJ)
-DOQCLIENT_SRC=testcode/doqclient.c
-DOQCLIENT_OBJ=doqclient.lo
-DOQCLIENT_OBJ_LINK=$(DOQCLIENT_OBJ) $(COMMON_OBJ) $(COMPAT_OBJ) \
-$(SLDNS_OBJ)
 PERF_SRC=testcode/perf.c
 PERF_OBJ=perf.lo
 PERF_OBJ_LINK=$(PERF_OBJ) worker_cb.lo $(COMMON_OBJ) $(COMPAT_OBJ) $(SLDNS_OBJ)
@@ -292,7 +288,7 @@ ALL_SRC=$(COMMON_SRC) $(UNITTEST_SRC) $(DAEMON_SRC) \
 	$(CONTROL_SRC) $(UBANCHOR_SRC) $(PETAL_SRC) $(DNSTAP_SOCKET_SRC)\
 	$(PYTHONMOD_SRC) $(PYUNBOUND_SRC) $(WIN_DAEMON_THE_SRC) \
 	$(SVCINST_SRC) $(SVCUNINST_SRC) $(ANCHORUPD_SRC) $(SLDNS_SRC) \
-	$(DOHCLIENT_SRC) $(DOQCLIENT_SRC) $(READZONE_SRC)
+	$(DOHCLIENT_SRC) $(READZONE_SRC)

 ALL_OBJ=$(COMMON_OBJ) $(UNITTEST_OBJ) $(DAEMON_OBJ) \
 	$(TESTBOUND_OBJ) $(LOCKVERIFY_OBJ) $(PKTVIEW_OBJ) \
@@ -301,7 +297,7 @@ ALL_OBJ=$(COMMON_OBJ) $(UNITTEST_OBJ) $(DAEMON_OBJ) \
 	$(CONTROL_OBJ) $(UBANCHOR_OBJ) $(PETAL_OBJ) $(DNSTAP_SOCKET_OBJ)\
 	$(COMPAT_OBJ) $(PYUNBOUND_OBJ) \
 	$(SVCINST_OBJ) $(SVCUNINST_OBJ) $(ANCHORUPD_OBJ) $(SLDNS_OBJ) \
-	$(DOHCLIENT_OBJ) $(DOQCLIENT_OBJ) $(READZONE_OBJ)
+	$(DOHCLIENT_OBJ) $(READZONE_OBJ)

 COMPILE=$(LIBTOOL) --tag=CC --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS) @PTHREAD_CFLAGS_ONLY@
 LINK=$(LIBTOOL) --tag=CC --mode=link $(CC) $(staticexe) $(RUNTIME_PATH) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS)
@@ -338,7 +334,7 @@ rsrc_unbound_checkconf.o:	$(srcdir)/winrc/rsrc_unbound_checkconf.rc config.h
 TEST_BIN=asynclook$(EXEEXT) delayer$(EXEEXT) \
 	lock-verify$(EXEEXT) memstats$(EXEEXT) perf$(EXEEXT) \
 	petal$(EXEEXT) pktview$(EXEEXT) streamtcp$(EXEEXT) \
-	$(DNSTAP_SOCKET_TESTBIN) dohclient$(EXEEXT) doqclient$(EXEEXT) \
+	$(DNSTAP_SOCKET_TESTBIN) dohclient$(EXEEXT) \
 	testbound$(EXEEXT) unittest$(EXEEXT) readzone$(EXEEXT)
 tests:	all $(TEST_BIN)

@@ -420,9 +416,6 @@ streamtcp$(EXEEXT):	$(STREAMTCP_OBJ_LINK)
 dohclient$(EXEEXT):	$(DOHCLIENT_OBJ_LINK)
 	$(LINK) -o $@ $(DOHCLIENT_OBJ_LINK) $(SSLLIB) $(LIBS)

-doqclient$(EXEEXT):	$(DOQCLIENT_OBJ_LINK)
-	$(LINK) -o $@ $(DOQCLIENT_OBJ_LINK) $(SSLLIB) $(LIBS)
-
 perf$(EXEEXT):	$(PERF_OBJ_LINK)
 	$(LINK) -o $@ $(PERF_OBJ_LINK) $(SSLLIB) $(LIBS)

@@ -446,8 +439,7 @@ unbound-control-setup:	smallapp/unbound-control-setup.sh
 dnstap.lo dnstap.o: $(srcdir)/dnstap/dnstap.c config.h dnstap/dnstap_config.h \
 	dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h $(srcdir)/dnstap/dnstap.h \
 	$(srcdir)/util/config_file.h $(srcdir)/util/log.h \
-	$(srcdir)/util/netevent.h $(srcdir)/util/net_help.h \
-	$(srcdir)/util/locks.h
+	$(srcdir)/util/netevent.h $(srcdir)/util/net_help.h

 dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h: $(srcdir)/dnstap/dnstap.proto
 	@-if test ! -d dnstap; then $(INSTALL) -d dnstap; fi
@@ -463,7 +455,6 @@ unbound-dnstap-socket.lo unbound-dnstap-socket.o: $(srcdir)/dnstap/unbound-dnsta
 dynlibmod.lo dynlibdmod.o: $(srcdir)/dynlibmod/dynlibmod.c config.h $(srcdir)/dynlibmod/dynlibmod.h
 cachedb.lo cachedb.o: $(srcdir)/cachedb/cachedb.c config.h $(srcdir)/cachedb/cachedb.h
 redis.lo redis.o: $(srcdir)/cachedb/redis.c config.h $(srcdir)/cachedb/redis.h
-timeval_func.lo timeval_func.o: $(srcdir)/util/timeval_func.c $(srcdir)/util/timeval_func.h

 # dnscrypt
 dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h \
@@ -507,17 +498,11 @@ util/configlexer.c:  $(srcdir)/util/configlexer.lex util/configparser.h
 		echo "#include \"util/configyyrename.h\"" >> $@ ;\
 		$(LEX) -t $(srcdir)/util/configlexer.lex >> $@ ;\
 	fi
-	@if test ! -f $@; then echo "No $@ : need flex and bison to compile from source repository"; exit 1; fi

-# Builds both util/configparser.c and util/configparser.h.
-# To avoid double-building we split one target out.
-util/configparser.c:  $(srcdir)/util/configparser.y
+util/configparser.c util/configparser.h:  $(srcdir)/util/configparser.y
 	@-if test ! -d util; then $(INSTALL) -d util; fi
 	$(YACC) -d -o util/configparser.c $(srcdir)/util/configparser.y

-util/configparser.h: util/configparser.c
-	touch $@
-
 clean:
 	rm -f *.o *.d *.lo *~ tags
 	rm -f unbound$(EXEEXT) unbound-checkconf$(EXEEXT) unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup libunbound.la unbound.h
@@ -531,7 +516,7 @@ distclean: clean
 	rm -f doc/example.conf doc/libunbound.3 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound-control.8 doc/unbound.8 doc/unbound.conf.5 doc/unbound-host.1
 	rm -f smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service
 	rm -f $(TEST_BIN)
-	rm -f Makefile
+	rm -f Makefile 

 maintainer-clean: distclean
 	rm -f util/configlexer.c util/configparser.c util/configparser.h
@@ -631,7 +616,7 @@ install-all:	all $(PYTHONMOD_INSTALL) $(PYUNBOUND_INSTALL) $(UNBOUND_EVENT_INSTA
 	$(INSTALL) -c -m 644 doc/unbound.conf.5 $(DESTDIR)$(mandir)/man5
 	$(INSTALL) -c -m 644 doc/unbound-host.1 $(DESTDIR)$(mandir)/man1
 	$(INSTALL) -c -m 755 unbound-control-setup $(DESTDIR)$(sbindir)/unbound-control-setup
-	if test ! -e "$(DESTDIR)$(configfile)"; then $(INSTALL) -d `dirname "$(DESTDIR)$(configfile)"`; $(INSTALL) -c -m 644 doc/example.conf "$(DESTDIR)$(configfile)"; fi
+	if test ! -e $(DESTDIR)$(configfile); then $(INSTALL) -d `dirname $(DESTDIR)$(configfile)`; $(INSTALL) -c -m 644 doc/example.conf $(DESTDIR)$(configfile); fi

 pythonmod-uninstall:
 	rm -f -- $(DESTDIR)$(PYTHON_SITE_PKG)/unboundmodule.py
@@ -660,11 +645,11 @@ uninstall:	$(PYTHONMOD_UNINSTALL) $(PYUNBOUND_UNINSTALL) $(UNBOUND_EVENT_UNINSTA
 	rm -f -- $(DESTDIR)$(includedir)/unbound.h
 	$(LIBTOOL) --mode=uninstall rm -f $(DESTDIR)$(libdir)/libunbound.la
 	@echo
-	@echo "You still need to remove "`dirname "$(DESTDIR)$(configfile)"`" , $(DESTDIR)$(configfile) by hand"
+	@echo "You still need to remove "`dirname $(DESTDIR)$(configfile)`" , $(DESTDIR)$(configfile) by hand"

 iana_update:
 	curl -o port-numbers.tmp https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml --compressed
-	if file port-numbers.tmp | grep 'gzip' >/dev/null; then zcat port-numbers.tmp; else cat port-numbers.tmp; fi | awk '/<record>/ {p=0;} /<protocol>udp/ {p=1;} /<protocol>[^u]/ {p=0;} /Decomissioned|Decommissioned|Removed|De-registered|unassigned|Unassigned|Reserved/ {u=1;} /<number>/ { if(u==1) {u=0;} else { if(p==1) { match($$0,/[0-9]+/); print substr($$0, RSTART, RLENGTH) ","}}}' | sort -nu > util/iana_ports.inc
+	if file port-numbers.tmp | grep 'gzip' >/dev/null; then zcat port-numbers.tmp; else cat port-numbers.tmp; fi | awk '/<record>/ {p=0;} /<protocol>udp/ {p=1;} /<protocol>[^u]/ {p=0;} /Decomissioned|Decommissioned|Removed|De-registered|unassigned|Unassigned|Reserved/ {u=1;} /<number>/ { if(u==1) {u=0;} else { if(p==1) { match($$0,/[0-9]+/); print substr($$0, RSTART, RLENGTH) ","}}}' | sort -nu > util/iana_ports.inc  
 	rm -f port-numbers.tmp

 # dependency generation
@@ -715,8 +700,6 @@ depend:

 # build rules
 ipset.lo ipset.o: $(srcdir)/ipset/ipset.c
-doqclient.lo doqclient.o: $(srcdir)/testcode/doqclient.c
-unitdoq.lo unitdoq.o: $(srcdir)/testcode/unitdoq.c

 # Dependencies
 dns.lo dns.o: $(srcdir)/services/cache/dns.c config.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/util/log.h \
@@ -753,7 +736,7 @@ msgencode.lo msgencode.o: $(srcdir)/util/data/msgencode.c config.h $(srcdir)/uti
 msgparse.lo msgparse.o: $(srcdir)/util/data/msgparse.c config.h $(srcdir)/util/data/msgparse.h \
 $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/sldns/pkthdr.h \
 $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
- $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h $(srcdir)/util/net_help.h $(srcdir)/sldns/sbuffer.h \
+ $(srcdir)/util/data/dname.h $(srcdir)/util/storage/lookup3.h $(srcdir)/util/regional.h $(srcdir)/sldns/sbuffer.h \
 $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h
 msgreply.lo msgreply.o: $(srcdir)/util/data/msgreply.c config.h $(srcdir)/util/data/msgreply.h \
 $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h \
@@ -808,7 +791,7 @@ iter_priv.lo iter_priv.o: $(srcdir)/iterator/iter_priv.c config.h $(srcdir)/iter
 $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h \
 $(srcdir)/util/storage/dnstree.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/sbuffer.h
 iter_resptype.lo iter_resptype.o: $(srcdir)/iterator/iter_resptype.c config.h \
- $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iterator.h $(srcdir)/util/log.h \
+ $(srcdir)/iterator/iter_resptype.h $(srcdir)/iterator/iter_delegpt.h $(srcdir)/util/log.h \
 $(srcdir)/services/cache/dns.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
 $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/net_help.h \
 $(srcdir)/util/data/dname.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h
@@ -881,7 +864,7 @@ view.lo view.o: $(srcdir)/services/view.c config.h $(srcdir)/services/view.h $(s
 $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/localzone.h $(srcdir)/util/storage/dnstree.h \
 $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
 $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
- $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/respip/respip.h
+ $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h
 rpz.lo rpz.o: $(srcdir)/services/rpz.c config.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h \
 $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/storage/dnstree.h \
 $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/msgreply.h \
@@ -894,7 +877,7 @@ rpz.lo rpz.o: $(srcdir)/services/rpz.c config.h $(srcdir)/services/rpz.h $(srcdi
 outbound_list.lo outbound_list.o: $(srcdir)/services/outbound_list.c config.h \
 $(srcdir)/services/outbound_list.h $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h \
 $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
-
+ 
 outside_network.lo outside_network.o: $(srcdir)/services/outside_network.c config.h \
 $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h $(srcdir)/util/netevent.h \
 $(srcdir)/dnscrypt/dnscrypt.h   \
@@ -932,8 +915,7 @@ config_file.lo config_file.o: $(srcdir)/util/config_file.c config.h $(srcdir)/ut
 configlexer.lo configlexer.o: util/configlexer.c config.h $(srcdir)/util/configyyrename.h \
 $(srcdir)/util/config_file.h util/configparser.h
 configparser.lo configparser.o: util/configparser.c config.h $(srcdir)/util/configyyrename.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/sldns/str2wire.h \
- $(srcdir)/sldns/rrdef.h
+ $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h
 shm_main.lo shm_main.o: $(srcdir)/util/shm_side/shm_main.c config.h $(srcdir)/util/shm_side/shm_main.h \
 $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
 $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
@@ -946,7 +928,7 @@ shm_main.lo shm_main.o: $(srcdir)/util/shm_side/shm_main.c config.h $(srcdir)/ut
 $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h \
 $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h \
 $(srcdir)/util/rtt.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/util/fptr_wlist.h \
- $(srcdir)/util/tube.h $(srcdir)/util/timeval_func.h
+ $(srcdir)/util/tube.h
 authzone.lo authzone.o: $(srcdir)/services/authzone.c config.h $(srcdir)/services/authzone.h \
 $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \
 $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/util/data/msgparse.h \
@@ -977,7 +959,7 @@ fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/
 $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h \
 $(srcdir)/validator/val_neg.h $(srcdir)/validator/autotrust.h $(srcdir)/libunbound/libworker.h \
 $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/libunbound/unbound-event.h \
- $(srcdir)/libunbound/worker.h $(srcdir)/daemon/remote.h
+ $(srcdir)/libunbound/worker.h
 locks.lo locks.o: $(srcdir)/util/locks.c config.h $(srcdir)/util/locks.h $(srcdir)/util/log.h
 log.lo log.o: $(srcdir)/util/log.c config.h $(srcdir)/util/log.h $(srcdir)/util/locks.h $(srcdir)/sldns/sbuffer.h
 mini_event.lo mini_event.o: $(srcdir)/util/mini_event.c config.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h \
@@ -1001,7 +983,7 @@ netevent.lo netevent.o: $(srcdir)/util/netevent.c config.h $(srcdir)/util/neteve
 $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
 $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \
 $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/sldns/str2wire.h \
- $(srcdir)/dnstap/dnstap.h  $(srcdir)/services/listen_dnsport.h $(srcdir)/util/timeval_func.h
+ $(srcdir)/dnstap/dnstap.h  $(srcdir)/services/listen_dnsport.h
 proxy_protocol.lo proxy_protocol.o: $(srcdir)/util/proxy_protocol.c config.h \
 $(srcdir)/util/proxy_protocol.h $(srcdir)/sldns/sbuffer.h
 net_help.lo net_help.o: $(srcdir)/util/net_help.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
@@ -1024,8 +1006,6 @@ rtt.lo rtt.o: $(srcdir)/util/rtt.c config.h $(srcdir)/util/rtt.h $(srcdir)/itera
 $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
 $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h \
 $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h
-siphash.lo siphash.o: $(srcdir)/util/siphash.c
-rfc_1982.lo rfc_1982.o: $(srcdir)/util/rfc_1982.c
 edns.lo edns.o: $(srcdir)/util/edns.c config.h $(srcdir)/util/edns.h $(srcdir)/util/storage/dnstree.h \
 $(srcdir)/util/rbtree.h $(srcdir)/util/config_file.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
  $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/regional.h \
@@ -1064,7 +1044,7 @@ tube.lo tube.o: $(srcdir)/util/tube.c config.h $(srcdir)/util/tube.h $(srcdir)/u
 $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/util/ub_event.h
 ub_event.lo ub_event.o: $(srcdir)/util/ub_event.c config.h $(srcdir)/util/ub_event.h $(srcdir)/util/log.h \
 $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- $(srcdir)/util/tube.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h $(srcdir)/daemon/remote.h
+ $(srcdir)/util/tube.h $(srcdir)/util/mini_event.h $(srcdir)/util/rbtree.h
 ub_event_pluggable.lo ub_event_pluggable.o: $(srcdir)/util/ub_event_pluggable.c config.h $(srcdir)/util/ub_event.h \
 $(srcdir)/libunbound/unbound-event.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
  $(srcdir)/util/log.h $(srcdir)/util/fptr_wlist.h \
@@ -1206,7 +1186,7 @@ unitmain.lo unitmain.o: $(srcdir)/testcode/unitmain.c config.h $(srcdir)/sldns/r
 $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
  $(srcdir)/util/random.h $(srcdir)/respip/respip.h \
 $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/services/outside_network.h
+ $(srcdir)/services/outside_network.h 
 unitmsgparse.lo unitmsgparse.o: $(srcdir)/testcode/unitmsgparse.c config.h $(srcdir)/util/log.h \
 $(srcdir)/testcode/unitmain.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h \
 $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
@@ -1261,7 +1241,6 @@ unitzonemd.lo unitzonemd.o: $(srcdir)/testcode/unitzonemd.c config.h $(srcdir)/u
 $(srcdir)/validator/val_anchor.h
 unittcpreuse.lo unittcpreuse.o: $(srcdir)/testcode/unittcpreuse.c config.h $(srcdir)/services/outside_network.h \
 $(srcdir)/util/random.h
-unitinfra.lo unitinfra.o: $(srcdir)/testcode/unitinfra.c config.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/iterator/iterator.h
 acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/acl_list.h \
 $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/locks.h \
 $(srcdir)/util/log.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h \
@@ -1294,8 +1273,7 @@ daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h $(srcdir)/daemon/daemon.h
 $(srcdir)/util/edns.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
 $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/services/localzone.h \
 $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/respip/respip.h \
- $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h \
- $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h
+ $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h
 remote.lo remote.o: $(srcdir)/daemon/remote.c config.h $(srcdir)/daemon/remote.h $(srcdir)/daemon/worker.h \
 $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h $(srcdir)/util/data/packed_rrset.h \
 $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/netevent.h \
@@ -1313,10 +1291,7 @@ remote.lo remote.o: $(srcdir)/daemon/remote.c config.h $(srcdir)/daemon/remote.h
 $(srcdir)/validator/val_anchor.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
 $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/iterator/iter_delegpt.h \
 $(srcdir)/services/outside_network.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/parseutil.h \
- $(srcdir)/sldns/wire2str.h $(srcdir)/util/edns.h \
- $(srcdir)/util/locks.h $(srcdir)/util/ub_event.h \
- $(srcdir)/util/tcp_conn_limit.h $(srcdir)/util/edns.h $(srcdir)/validator/val_neg.h \
- $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_donotq.h $(srcdir)/iterator/iter_priv.h
+ $(srcdir)/sldns/wire2str.h
 stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
 $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
 $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
@@ -1346,7 +1321,7 @@ unbound.lo unbound.o: $(srcdir)/daemon/unbound.c config.h $(srcdir)/util/log.h $
 worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
 $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
 $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/timeval_func.h \
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
 $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
 $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
@@ -1368,21 +1343,21 @@ testbound.lo testbound.o: $(srcdir)/testcode/testbound.c config.h $(srcdir)/test
 $(srcdir)/daemon/remote.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
 $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
 $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/daemon/unbound.c $(srcdir)/daemon/daemon.h \
- $(srcdir)/util/alloc.h $(srcdir)/util/timeval_func.h $(srcdir)/services/modstack.h  \
+ $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
 $(srcdir)/util/storage/slabhash.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \
 $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \
 $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
 $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/tube.h \
 $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
 $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
- $(srcdir)/respip/respip.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h $(srcdir)/daemon/worker.h
+ $(srcdir)/respip/respip.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h
 testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcode/testpkts.h \
 $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/pkthdr.h \
 $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
 worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
 $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
 $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \
- $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/timeval_func.h \
+ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \
 $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
 $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h  $(srcdir)/daemon/daemon.h \
@@ -1434,7 +1409,7 @@ stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(s
 $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h
 replay.lo replay.o: $(srcdir)/testcode/replay.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
 $(srcdir)/util/config_file.h $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
-  $(srcdir)/testcode/testpkts.h $(srcdir)/util/rbtree.h $(srcdir)/util/timeval_func.h \
+  $(srcdir)/testcode/testpkts.h $(srcdir)/util/rbtree.h \
 $(srcdir)/testcode/fake_event.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h
 fake_event.lo fake_event.o: $(srcdir)/testcode/fake_event.c config.h $(srcdir)/testcode/fake_event.h \
 $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
@@ -1442,13 +1417,13 @@ fake_event.lo fake_event.o: $(srcdir)/testcode/fake_event.c config.h $(srcdir)/t
 $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
 $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \
 $(srcdir)/util/edns.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/config_file.h \
- $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h $(srcdir)/util/timeval_func.h \
+ $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \
  $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
 $(srcdir)/testcode/replay.h $(srcdir)/testcode/testpkts.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \
 $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \
 $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/services/authzone.h \
 $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h \
- $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/daemon/remote.h $(srcdir)/util/storage/slabhash.h $(srcdir)/daemon/daemon.h
+ $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/str2wire.h $(srcdir)/daemon/remote.h
 lock_verify.lo lock_verify.o: $(srcdir)/testcode/lock_verify.c config.h $(srcdir)/util/log.h $(srcdir)/util/rbtree.h \
 $(srcdir)/util/locks.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
  $(srcdir)/util/storage/lruhash.h $(srcdir)/util/module.h \
@@ -1504,8 +1479,7 @@ context.lo context.o: $(srcdir)/libunbound/context.c config.h $(srcdir)/libunbou
 $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
 $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/daemon/stats.h \
- $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h $(srcdir)/util/edns.h \
- $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h
+ $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h $(srcdir)/util/edns.h
 libunbound.lo libunbound.o: $(srcdir)/libunbound/libunbound.c $(srcdir)/libunbound/unbound.h \
 $(srcdir)/libunbound/unbound-event.h config.h $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h \
 $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
@@ -1517,8 +1491,7 @@ libunbound.lo libunbound.o: $(srcdir)/libunbound/libunbound.c $(srcdir)/libunbou
 $(srcdir)/sldns/sbuffer.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h \
 $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/services/cache/rrset.h \
 $(srcdir)/util/storage/slabhash.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h \
- $(srcdir)/services/rpz.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h \
- $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h
+ $(srcdir)/services/rpz.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h
 libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h $(srcdir)/libunbound/libworker.h \
 $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
 $(srcdir)/libunbound/context.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
@@ -1532,7 +1505,8 @@ libworker.lo libworker.o: $(srcdir)/libunbound/libworker.c config.h $(srcdir)/li
 $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/outbound_list.h \
 $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/regional.h $(srcdir)/util/random.h \
 $(srcdir)/util/storage/lookup3.h $(srcdir)/util/net_help.h $(srcdir)/util/data/dname.h \
- $(srcdir)/util/data/msgencode.h $(srcdir)/sldns/str2wire.h
+ $(srcdir)/util/data/msgencode.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
+ $(srcdir)/sldns/str2wire.h
 unbound-host.lo unbound-host.o: $(srcdir)/smallapp/unbound-host.c config.h $(srcdir)/libunbound/unbound.h \
 $(srcdir)/sldns/rrdef.h $(srcdir)/sldns/wire2str.h
 asynclook.lo asynclook.o: $(srcdir)/testcode/asynclook.c config.h $(srcdir)/libunbound/unbound.h \
@@ -1,10 +1,9 @@
 # Unbound

-[![Github Build Status](https://github.com/NLnetLabs/unbound/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/NLnetLabs/unbound/actions)
+[![Travis Build Status](https://travis-ci.org/NLnetLabs/unbound.svg?branch=master)](https://travis-ci.org/NLnetLabs/unbound)
 [![Packaging status](https://repology.org/badge/tiny-repos/unbound.svg)](https://repology.org/project/unbound/versions)
 [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/unbound.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:unbound)
 [![Documentation Status](https://readthedocs.org/projects/unbound/badge/?version=latest)](https://unbound.readthedocs.io/en/latest/?badge=latest)
-[![Mastodon Follow](https://img.shields.io/mastodon/follow/109262826617293067?domain=https%3A%2F%2Ffosstodon.org&style=social)](https://fosstodon.org/@nlnetlabs)

 Unbound is a validating, recursive, caching DNS resolver. It is designed to be
 fast and lean and incorporates modern features based on open standards. If you
@@ -17,9 +16,7 @@ You can learn more about Unbound by reading our
 ## Compiling

 Make sure you have the C toolchain, OpenSSL and its include files, and libexpat
-installed.
-If building from the repository source you also need flex and bison installed.
-Unbound can be compiled and installed using:
+installed. Unbound can be compiled and installed using:

 ```
 ./configure && make && make install
@@ -29,7 +26,7 @@ You can use libevent if you want. libevent is useful when using many (10000)
 outgoing ports. By default max 256 ports are opened at the same time and the
 builtin alternative is equally capable and a little faster.

-Use the `--with-libevent` configure option to compile Unbound with libevent
+Use the `--with-libevent=dir` configure option to compile Unbound with libevent
 support.

 ## Unbound configuration
@@ -1,43 +1,39 @@
 # ===========================================================================
-#       https://www.gnu.org/software/autoconf-archive/ax_pkg_swig.html
+#              http://autoconf-archive.cryp.to/ac_pkg_swig.html
 # ===========================================================================
 #
 # SYNOPSIS
 #
-#   AX_PKG_SWIG([major.minor.micro], [action-if-found], [action-if-not-found])
+#   AC_PROG_SWIG([major.minor.micro])
 #
 # DESCRIPTION
 #
-#   This macro searches for a SWIG installation on your system. If found,
-#   then SWIG is AC_SUBST'd; if not found, then $SWIG is empty.  If SWIG is
-#   found, then SWIG_LIB is set to the SWIG library path, and AC_SUBST'd.
+#   This macro searches for a SWIG installation on your system. If found you
+#   should call SWIG via $(SWIG). You can use the optional first argument to
+#   check if the version of the available SWIG is greater than or equal to
+#   the value of the argument. It should have the format: N[.N[.N]] (N is a
+#   number between 0 and 999. Only the first N is mandatory.)
 #
-#   You can use the optional first argument to check if the version of the
-#   available SWIG is greater than or equal to the value of the argument. It
-#   should have the format: N[.N[.N]] (N is a number between 0 and 999. Only
-#   the first N is mandatory.) If the version argument is given (e.g.
-#   1.3.17), AX_PKG_SWIG checks that the swig package is this version number
-#   or higher.
-#
-#   As usual, action-if-found is executed if SWIG is found, otherwise
-#   action-if-not-found is executed.
+#   If the version argument is given (e.g. 1.3.17), AC_PROG_SWIG checks that
+#   the swig package is this version number or higher.
 #
 #   In configure.in, use as:
 #
-#     AX_PKG_SWIG(1.3.17, [], [ AC_MSG_ERROR([SWIG is required to build..]) ])
-#     AX_SWIG_ENABLE_CXX
-#     AX_SWIG_MULTI_MODULE_SUPPORT
-#     AX_SWIG_PYTHON
+#     AC_PROG_SWIG(1.3.17)
+#     SWIG_ENABLE_CXX
+#     SWIG_MULTI_MODULE_SUPPORT
+#     SWIG_PYTHON
 #
-# LICENSE
+# LAST MODIFICATION
+#
+#   2008-04-12
+#
+# COPYLEFT
 #
 #   Copyright (c) 2008 Sebastian Huber <sebastian-huber@web.de>
-#   Copyright (c) 2008 Alan W. Irwin
+#   Copyright (c) 2008 Alan W. Irwin <irwin@beluga.phys.uvic.ca>
 #   Copyright (c) 2008 Rafael Laboissiere <rafael@laboissiere.net>
-#   Copyright (c) 2008 Andrew Collier
-#   Copyright (c) 2011 Murray Cumming <murrayc@openismus.com>
-#   Copyright (c) 2018 Reini Urban <rurban@cpan.org>
-#   Copyright (c) 2021 Vincent Danjean <Vincent.Danjean@ens-lyon.org>
+#   Copyright (c) 2008 Andrew Collier <colliera@ukzn.ac.za>
 #
 #   This program is free software; you can redistribute it and/or modify it
 #   under the terms of the GNU General Public License as published by the
@@ -50,7 +46,7 @@
 #   Public License for more details.
 #
 #   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <https://www.gnu.org/licenses/>.
+#   with this program. If not, see <http://www.gnu.org/licenses/>.
 #
 #   As a special exception, the respective Autoconf Macro's copyright owner
 #   gives unlimited permission to copy, distribute and modify the configure
@@ -61,21 +57,17 @@
 #   all other use of the material that constitutes the Autoconf Macro.
 #
 #   This special exception to the GPL applies to versions of the Autoconf
-#   Macro released by the Autoconf Archive. When you make and distribute a
-#   modified version of the Autoconf Macro, you may extend this special
-#   exception to the GPL to apply to your modified version as well.
+#   Macro released by the Autoconf Macro Archive. When you make and
+#   distribute a modified version of the Autoconf Macro, you may extend this
+#   special exception to the GPL to apply to your modified version as well.

-#serial 15
-
-AC_DEFUN([AX_PKG_SWIG],[
-        # Find path to the "swig" executable.
-        AC_PATH_PROGS([SWIG],[swig swig3.0 swig2.0])
+AC_DEFUN([AC_PROG_SWIG],[
+        AC_PATH_PROG([SWIG],[swig])
        if test -z "$SWIG" ; then
-                m4_ifval([$3],[$3],[:])
-        elif test -z "$1" ; then
-                m4_ifval([$2],[$2],[:])
-	else
-                AC_MSG_CHECKING([SWIG version])
+                AC_MSG_WARN([cannot find 'swig' program. You should look at http://www.swig.org])
+                SWIG='echo "Error: SWIG is not installed. You should look at http://www.swig.org" ; false'
+        elif test -n "$1" ; then
+                AC_MSG_CHECKING([for SWIG version])
                [swig_version=`$SWIG -version 2>&1 | grep 'SWIG Version' | sed 's/.*\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\).*/\1/g'`]
                AC_MSG_RESULT([$swig_version])
                if test -n "$swig_version" ; then
@@ -85,12 +77,12 @@ AC_DEFUN([AX_PKG_SWIG],[
                        if test -z "$required_major" ; then
                                [required_major=0]
                        fi
-                        [required=`echo $required. | sed 's/[0-9]*[^0-9]//'`]
+                        [required=`echo $required | sed 's/[0-9]*[^0-9]//'`]
                        [required_minor=`echo $required | sed 's/[^0-9].*//'`]
                        if test -z "$required_minor" ; then
                                [required_minor=0]
                        fi
-                        [required=`echo $required. | sed 's/[0-9]*[^0-9]//'`]
+                        [required=`echo $required | sed 's/[0-9]*[^0-9]//'`]
                        [required_patch=`echo $required | sed 's/[^0-9].*//'`]
                        if test -z "$required_patch" ; then
                                [required_patch=0]
@@ -111,28 +103,30 @@ AC_DEFUN([AX_PKG_SWIG],[
                        if test -z "$available_patch" ; then
                                [available_patch=0]
                        fi
-                        # Convert the version tuple into a single number for easier comparison.
-                        # Using base 100 should be safe since SWIG internally uses BCD values
-                        # to encode its version number.
-                        required_swig_vernum=`expr $required_major \* 10000 \
-                            \+ $required_minor \* 100 \+ $required_patch`
-                        available_swig_vernum=`expr $available_major \* 10000 \
-                            \+ $available_minor \* 100 \+ $available_patch`
-
-                        if test $available_swig_vernum -lt $required_swig_vernum; then
-                                AC_MSG_WARN([SWIG version >= $1 is required.  You have $swig_version.])
-                                SWIG=''
-                                m4_ifval([$3],[$3],[])
+			[badversion=0]
+			if test $available_major -lt $required_major ; then
+				[badversion=1]
+			fi
+                        if test $available_major -eq $required_major \
+                                -a $available_minor -lt $required_minor ; then
+				[badversion=1]
+			fi
+                        if test $available_major -eq $required_major \
+                                -a $available_minor -eq $required_minor \
+                                -a $available_patch -lt $required_patch ; then
+				[badversion=1]
+			fi
+			if test $badversion -eq 1 ; then
+                                AC_MSG_WARN([SWIG version >= $1 is required.  You have $swig_version.  You should look at http://www.swig.org])
+                                SWIG='echo "Error: SWIG version >= $1 is required.  You have '"$swig_version"'.  You should look at http://www.swig.org" ; false'
                        else
-                                AC_MSG_CHECKING([for SWIG library])
-                                SWIG_LIB=`$SWIG -swiglib | tr '\r\n' '  '`
-                                AC_MSG_RESULT([$SWIG_LIB])
-                                m4_ifval([$2],[$2],[])
+                                AC_MSG_NOTICE([SWIG executable is '$SWIG'])
+                                SWIG_LIB=`$SWIG -swiglib`
+                                AC_MSG_NOTICE([SWIG library directory is '$SWIG_LIB'])
                        fi
                else
                        AC_MSG_WARN([cannot determine SWIG version])
-                        SWIG=''
-                        m4_ifval([$3],[$3],[])
+                        SWIG='echo "Error: Cannot determine SWIG version.  You should look at http://www.swig.org" ; false'
                fi
        fi
        AC_SUBST([SWIG_LIB])
@@ -2,12 +2,7 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 48
-# 2024-01-16 fix to add -l:libssp.a to -lcrypto link check.
-#	     and check for getaddrinfo with only header.
-# 2024-01-15 fix to add crypt32 to -lcrypto link check when checking for gdi32.
-# 2023-05-04 fix to remove unused whitespace.
-# 2023-01-26 fix -Wstrict-prototypes.
+# Version 44
 # 2022-09-01 fix checking if nonblocking sockets work on OpenBSD.
 # 2021-08-17 fix sed script in ssldir split handling.
 # 2021-08-17 fix for openssl to detect split version, with ssldir_include
@@ -192,7 +187,7 @@ dnl cache=`echo $1 | sed 'y%.=/+- %___p__%'`
 AC_CACHE_VAL(cv_prog_cc_flag_needed_$cache,
 [
 echo '$2' > conftest.c
-echo 'void f(void){}' >>conftest.c
+echo 'void f(){}' >>conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
 eval "cv_prog_cc_flag_needed_$cache=no"
 else
@@ -238,7 +233,7 @@ dnl DEPFLAG: set to flag that generates dependencies.
 AC_DEFUN([ACX_DEPFLAG],
 [
 AC_MSG_CHECKING([$CC dependency flag])
-echo 'void f(void){}' >conftest.c
+echo 'void f(){}' >conftest.c
 if test "`$CC -MM conftest.c 2>&1`" = "conftest.o: conftest.c"; then
 	DEPFLAG="-MM"
 else 
@@ -277,7 +272,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAUL
 #include <getopt.h>
 #endif

-int test(void) {
+int test() {
 	int a;
 	char **opts = NULL;
 	struct timeval tv;
@@ -314,7 +309,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAUL
 #include <getopt.h>
 #endif

-int test(void) {
+int test() {
 	int a;
 	char **opts = NULL;
 	struct timeval tv;
@@ -340,7 +335,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG,
 [
 #include <stdbool.h>
 #include <ctype.h>
-int test(void) {
+int test() {
        int a = 0;
        return a;
 }
@@ -350,7 +345,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED(-D_BSD_SOURCE -D_DEFAULT_SOURCE,
 [
 #include <ctype.h>

-int test(void) {
+int test() {
        int a;
        a = isascii(32);
        return a;
@@ -361,7 +356,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED(-D_GNU_SOURCE,
 [
 #include <netinet/in.h>

-int test(void) {
+int test() {
        struct in6_pktinfo inf;
 	int a = (int)sizeof(inf);
        return a;
@@ -375,7 +370,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED(-D_GNU_SOURCE -D_FRSRESGID,
 [
 #include <unistd.h>

-int test(void) {
+int test() {
 	int a = setresgid(0,0,0);
 	a = setresuid(0,0,0);
        return a;
@@ -390,7 +385,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED(-D_POSIX_C_SOURCE=200112,
 #endif
 #include <netdb.h>

-int test(void) {
+int test() {
        int a = 0;
        char *t;
        time_t time = 0;
@@ -418,7 +413,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED(-D__EXTENSIONS__,
 #include <getopt.h>
 #endif

-int test(void) {
+int test() {
        int a;
        char **opts = NULL;
        struct timeval tv;
@@ -480,7 +475,7 @@ fi
 dnl Setup ATTR_FORMAT config.h parts.
 dnl make sure you call ACX_CHECK_FORMAT_ATTRIBUTE also.
 AC_DEFUN([AHX_CONFIG_FORMAT_ATTRIBUTE],
-[
+[ 
 #ifdef HAVE_ATTR_FORMAT
 #  define ATTR_FORMAT(archetype, string_index, first_to_check) \
    __attribute__ ((format (archetype, string_index, first_to_check)))
@@ -710,7 +705,7 @@ AC_DEFUN([ACX_SSL_CHECKS], [
 		    LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir_lib"
 	    	    ACX_RUNTIME_PATH_ADD([$ssldir_lib])
 	    fi
-
+        
            AC_MSG_CHECKING([for EVP_sha256 in -lcrypto])
            LIBS="$LIBS -lcrypto"
            LIBSSL_LIBS="$LIBSSL_LIBS -lcrypto"
@@ -735,73 +730,40 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                  ]])],[
                    AC_DEFINE([HAVE_EVP_SHA256], 1,
                        [If you have EVP_sha256])
-                    AC_MSG_RESULT(yes)
+                    AC_MSG_RESULT(yes) 
                  ],[
                    AC_MSG_RESULT(no)
                    LIBS="$BAKLIBS"
                    LIBSSL_LIBS="$BAKSSLLIBS"
-
-		    LIBS="$LIBS -lgdi32 -lws2_32 -lcrypt32"
-		    LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32 -lws2_32 -lcrypt32"
-                    AC_MSG_CHECKING([if -lcrypto needs -lgdi32 -lws2_32 -lcrypt32])
-		    AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
-			int EVP_sha256(void);
-			(void)EVP_sha256();
-		      ]])],[
-			AC_DEFINE([HAVE_EVP_SHA256], 1,
-			    [If you have EVP_sha256])
-			AC_MSG_RESULT(yes)
-		      ],[
-			AC_MSG_RESULT(no)
-			LIBS="$BAKLIBS"
-			LIBSSL_LIBS="$BAKSSLLIBS"
-
-			LIBS="$LIBS -lgdi32 -lws2_32 -lcrypt32 -l:libssp.a"
-			LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32 -lws2_32 -lcrypt32 -l:libssp.a"
-			AC_MSG_CHECKING([if -lcrypto needs -lgdi32 -lws2_32 -lcrypt32 -l:libssp.a])
-			AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
-			    int EVP_sha256(void);
-			    (void)EVP_sha256();
-			  ]])],[
-			    AC_DEFINE([HAVE_EVP_SHA256], 1,
-				[If you have EVP_sha256])
-			    AC_MSG_RESULT(yes)
-			  ],[
-			    AC_MSG_RESULT(no)
-			    LIBS="$BAKLIBS"
-			    LIBSSL_LIBS="$BAKSSLLIBS"
-
-			    LIBS="$LIBS -ldl"
-			    LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
-			    AC_MSG_CHECKING([if -lcrypto needs -ldl])
-			    AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
-				int EVP_sha256(void);
-				(void)EVP_sha256();
-			      ]])],[
-				AC_DEFINE([HAVE_EVP_SHA256], 1,
-				    [If you have EVP_sha256])
-				AC_MSG_RESULT(yes)
-			      ],[
-				AC_MSG_RESULT(no)
-				LIBS="$BAKLIBS"
-				LIBSSL_LIBS="$BAKSSLLIBS"
-				LIBS="$LIBS -ldl -pthread"
-				LIBSSL_LIBS="$LIBSSL_LIBS -ldl -pthread"
-				AC_MSG_CHECKING([if -lcrypto needs -ldl -pthread])
-				AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
-				    int EVP_sha256(void);
-				    (void)EVP_sha256();
-				  ]])],[
-				    AC_DEFINE([HAVE_EVP_SHA256], 1,
-					[If you have EVP_sha256])
-				    AC_MSG_RESULT(yes)
-				  ],[
-				    AC_MSG_RESULT(no)
-				    AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required])
-				])
-			    ])
+                    LIBS="$LIBS -ldl"
+                    LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
+                    AC_MSG_CHECKING([if -lcrypto needs -ldl])
+                    AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
+                        int EVP_sha256(void);
+                        (void)EVP_sha256();
+                      ]])],[
+                        AC_DEFINE([HAVE_EVP_SHA256], 1,
+                            [If you have EVP_sha256])
+                        AC_MSG_RESULT(yes) 
+                      ],[
+                        AC_MSG_RESULT(no)
+                        LIBS="$BAKLIBS"
+                        LIBSSL_LIBS="$BAKSSLLIBS"
+                        LIBS="$LIBS -ldl -pthread"
+                        LIBSSL_LIBS="$LIBSSL_LIBS -ldl -pthread"
+                        AC_MSG_CHECKING([if -lcrypto needs -ldl -pthread])
+                        AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
+                            int EVP_sha256(void);
+                            (void)EVP_sha256();
+                          ]])],[
+                            AC_DEFINE([HAVE_EVP_SHA256], 1,
+                                [If you have EVP_sha256])
+                            AC_MSG_RESULT(yes) 
+                          ],[
+                            AC_MSG_RESULT(no)
+                            AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required])
 			])
-		    ])
+                    ])
                ])
            ])
        fi
@@ -815,7 +777,7 @@ AC_CHECK_HEADERS([openssl/rand.h],,, [AC_INCLUDES_DEFAULT])

 dnl Check for SSL, where SSL is mandatory
 dnl Adds --with-ssl option, searches for openssl and defines HAVE_SSL if found
-dnl Setup of CPPFLAGS, CFLAGS.  Adds -lcrypto to LIBS.
+dnl Setup of CPPFLAGS, CFLAGS.  Adds -lcrypto to LIBS. 
 dnl Checks main header files of SSL.
 dnl
 AC_DEFUN([ACX_WITH_SSL],
@@ -872,7 +834,7 @@ dnl try to see if an additional _LARGEFILE_SOURCE 1 is needed to get fseeko
 ACX_CHECK_COMPILER_FLAG_NEEDED(-D_LARGEFILE_SOURCE=1,
 [
 #include <stdio.h>
-int test(void) {
+int test() {
        int a = fseeko(stdin, 0, 0);
        return a;
 }
@@ -897,7 +859,7 @@ char* (*f) () = getaddrinfo;
 #ifdef __cplusplus
 }
 #endif
-int main(void) {
+int main() {
        ;
        return 0;
 }
@@ -908,7 +870,7 @@ dnl see if on windows
 if test "$ac_cv_header_windows_h" = "yes"; then
 	AC_DEFINE(USE_WINSOCK, 1, [Whether the windows socket API is used])
 	USE_WINSOCK="1"
-	if echo "$LIBS" | grep 'lws2_32' >/dev/null; then
+	if echo $LIBS | grep 'lws2_32' >/dev/null; then
 		:
 	else
 		LIBS="$LIBS -lws2_32"
@@ -916,24 +878,6 @@ if test "$ac_cv_header_windows_h" = "yes"; then
 fi
 ],
 dnl no quick getaddrinfo, try mingw32 and winsock2 library.
-dnl perhaps getaddrinfo needs only the include
-AC_LINK_IFELSE(
-[AC_LANG_PROGRAM(
-[
-#ifdef HAVE_WS2TCPIP_H
-#include <ws2tcpip.h>
-#endif
-],
-[
-        (void)getaddrinfo(NULL, NULL, NULL, NULL);
-]
-)],
-[
-ac_cv_func_getaddrinfo="yes"
-AC_DEFINE(USE_WINSOCK, 1, [Whether the windows socket API is used])
-USE_WINSOCK="1"
-],
-
 ORIGLIBS="$LIBS"
 LIBS="$LIBS -lws2_32"
 AC_LINK_IFELSE(
@@ -958,7 +902,6 @@ ac_cv_func_getaddrinfo="no"
 LIBS="$ORIGLIBS"
 ])
 )
-)

 AC_MSG_RESULT($ac_cv_func_getaddrinfo)
 if test $ac_cv_func_getaddrinfo = yes; then
@@ -980,7 +923,7 @@ cache=`echo $1 | sed 'y%.=/+-%___p_%'`
 AC_CACHE_VAL(cv_cc_deprecated_$cache,
 [
 echo '$3' >conftest.c
-echo 'void f(void){ $2 }' >>conftest.c
+echo 'void f(){ $2 }' >>conftest.c
 if test -z "`$CC $CPPFLAGS $CFLAGS -c conftest.c 2>&1 | grep -e deprecated -e unavailable`"; then
 eval "cv_cc_deprecated_$cache=no"
 else
@@ -1374,7 +1317,7 @@ AC_DEFUN([AHX_CONFIG_W32_FD_SET_T],
 #ifdef HAVE_WINSOCK2_H
 #define FD_SET_T (u_int)
 #else
-#define FD_SET_T
+#define FD_SET_T 
 #endif
 ])

@@ -1412,7 +1355,7 @@ dnl $3: define value, 1
 AC_DEFUN([AHX_CONFIG_FLAG_OMITTED],
 [#if defined($1) && !defined($2)
 #define $2 $3
-[#]endif])
+[#]endif ])

 dnl Wrapper for AHX_CONFIG_FLAG_OMITTED for -D style flags
 dnl $1: the -DNAME or -DNAME=value string.
@@ -9,7 +9,7 @@ AC_DEFUN([AC_PYTHON_DEVEL],[

        AC_PATH_PROG([PYTHON],[python[$PYTHON_VERSION]])
        if test -z "$PYTHON"; then
-           AC_MSG_ERROR([Cannot find 'python$PYTHON_VERSION' in your system path. You can use the environment variable 'PYTHON_VERSION=version_number' for an explicit version.])
+           AC_MSG_ERROR([Cannot find python$PYTHON_VERSION in your system path])
           PYTHON_VERSION=""
        fi

@@ -17,62 +17,33 @@ AC_DEFUN([AC_PYTHON_DEVEL],[
 		PYTHON_VERSION=`$PYTHON -c "import sys; \
 			print(sys.version.split()[[0]])"`
 	fi
-	# calculate the version number components.
-	[
-	v="$PYTHON_VERSION"
-	PYTHON_VERSION_MAJOR=`echo $v | sed 's/[^0-9].*//'`
-	if test -z "$PYTHON_VERSION_MAJOR"; then PYTHON_VERSION_MAJOR="0"; fi
-	v=`echo $v | sed -e 's/^[0-9]*$//' -e 's/[0-9]*[^0-9]//'`
-	PYTHON_VERSION_MINOR=`echo $v | sed 's/[^0-9].*//'`
-	if test -z "$PYTHON_VERSION_MINOR"; then PYTHON_VERSION_MINOR="0"; fi
-	v=`echo $v | sed -e 's/^[0-9]*$//' -e 's/[0-9]*[^0-9]//'`
-	PYTHON_VERSION_PATCH=`echo $v | sed 's/[^0-9].*//'`
-	if test -z "$PYTHON_VERSION_PATCH"; then PYTHON_VERSION_PATCH="0"; fi
-	]

-	# For some systems, sysconfig exists, but has the wrong paths,
-	# on Debian 10, for python 2.7 and 3.7. So, we check the version,
-	# and for older versions try distutils.sysconfig first. For newer
-	# versions>=3.10, where distutils.sysconfig is deprecated, use
-	# sysconfig first and then attempt the other one.
-	py_distutils_first="no"
-	if test $PYTHON_VERSION_MAJOR -lt 3; then
-		py_distutils_first="yes"
-	fi
-	if test $PYTHON_VERSION_MAJOR -eq 3 -a $PYTHON_VERSION_MINOR -lt 10; then
-		py_distutils_first="yes"
-	fi
-
-	# Check if you have the first module
-	if test "$py_distutils_first" = "yes"; then m="distutils"; else m="sysconfig"; fi
-	sysconfig_module=""
-	AC_MSG_CHECKING([for the $m Python module])
-        if ac_modulecheck_result1=`$PYTHON -c "import $m" 2>&1`; then
+	# Check if you have sysconfig
+	AC_MSG_CHECKING([for the sysconfig Python module])
+        if ac_sysconfig_result=`$PYTHON -c "import sysconfig" 2>&1`; then
                AC_MSG_RESULT([yes])
-		sysconfig_module="$m"
+		sysconfig_module="sysconfig"
+		# if yes, use sysconfig, because distutils is deprecated.
 	else
                AC_MSG_RESULT([no])
-	fi
+		# if no, try to use distutils

-	# if not found, try the other one.
-	if test -z "$sysconfig_module"; then
-		if test "$py_distutils_first" = "yes"; then m2="sysconfig"; else m2="distutils"; fi
-		AC_MSG_CHECKING([for the $m2 Python module])
-		if ac_modulecheck_result2=`$PYTHON -c "import $m2" 2>&1`; then
+		#
+		# Check if you have distutils, else fail
+		#
+		AC_MSG_CHECKING([for the distutils Python package])
+		if ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`; then
 			AC_MSG_RESULT([yes])
-			sysconfig_module="$m2"
 		else
 			AC_MSG_RESULT([no])
-			AC_MSG_ERROR([cannot import Python module "$m", or "$m2".
-	Please check your Python installation. The errors are:
-	$m
-	$ac_modulecheck_result1
-	$m2
-	$ac_modulecheck_result2])
+			AC_MSG_ERROR([cannot import Python module "distutils".
+	Please check your Python installation. The error was:
+	$ac_distutils_result])
 			PYTHON_VERSION=""
 		fi
+
+		sysconfig_module="distutils.sysconfig"
 	fi
-	if test "$sysconfig_module" = "distutils"; then sysconfig_module="distutils.sysconfig"; fi

        #
        # Check for Python include path
@@ -1,70 +0,0 @@
-# ===========================================================================
-#   https://www.gnu.org/software/autoconf-archive/ax_build_date_epoch.html
-# ===========================================================================
-#
-# SYNOPSIS
-#
-#   AX_BUILD_DATE_EPOCH(VARIABLE[, FORMAT[, ACTION-IF-FAIL]])
-#
-# DESCRIPTION
-#
-#   Sets VARIABLE to a string representing the current time.  It is
-#   formatted according to FORMAT if specified, otherwise it is formatted as
-#   the number of seconds (excluding leap seconds) since the UNIX epoch (01
-#   Jan 1970 00:00:00 UTC).
-#
-#   If the SOURCE_DATE_EPOCH environment variable is set, it uses the value
-#   of that variable instead of the current time.  See
-#   https://reproducible-builds.org/specs/source-date-epoch).  If
-#   SOURCE_DATE_EPOCH is set but cannot be properly interpreted as a UNIX
-#   timestamp, then execute ACTION-IF-FAIL if specified, otherwise error.
-#
-#   VARIABLE is AC_SUBST-ed.
-#
-# LICENSE
-#
-#   Copyright (c) 2016 Eric Bavier <bavier@member.fsf.org>
-#
-#   This program is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by the
-#   Free Software Foundation, either version 3 of the License, or (at your
-#   option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
-#   Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <https://www.gnu.org/licenses/>.
-#
-#   As a special exception, the respective Autoconf Macro's copyright owner
-#   gives unlimited permission to copy, distribute and modify the configure
-#   scripts that are the output of Autoconf when processing the Macro. You
-#   need not follow the terms of the GNU General Public License when using
-#   or distributing such scripts, even though portions of the text of the
-#   Macro appear in them. The GNU General Public License (GPL) does govern
-#   all other use of the material that constitutes the Autoconf Macro.
-#
-#   This special exception to the GPL applies to versions of the Autoconf
-#   Macro released by the Autoconf Archive. When you make and distribute a
-#   modified version of the Autoconf Macro, you may extend this special
-#   exception to the GPL to apply to your modified version as well.
-
-#serial 2
-
-AC_DEFUN([AX_BUILD_DATE_EPOCH],
-[dnl
-AC_MSG_CHECKING([for build time])
-ax_date_fmt="m4_default($2,%s)"
-AS_IF([test x"$SOURCE_DATE_EPOCH" = x],
- [$1=`date "+$ax_date_fmt"`],
- [ax_build_date=`date -u -d "@$SOURCE_DATE_EPOCH" "+$ax_date_fmt" 2>/dev/null \
-                 || date -u -r "$SOURCE_DATE_EPOCH" "+$ax_date_fmt" 2>/dev/null`
-  AS_IF([test x"$ax_build_date" = x],
-   [m4_ifval([$3],
-      [$3],
-      [AC_MSG_ERROR([malformed SOURCE_DATE_EPOCH])])],
-   [$1=$ax_build_date])])
-AC_MSG_RESULT([$$1])
-])dnl AX_BUILD_DATE_EPOCH
@@ -1,5 +1,5 @@
 # ===========================================================================
-#        https://www.gnu.org/software/autoconf-archive/ax_pthread.html
+#        http://www.gnu.org/software/autoconf-archive/ax_pthread.html
 # ===========================================================================
 #
 # SYNOPSIS
@@ -14,28 +14,24 @@
 #   flags that are needed. (The user can also force certain compiler
 #   flags/libs to be tested by setting these environment variables.)
 #
-#   Also sets PTHREAD_CC and PTHREAD_CXX to any special C compiler that is
-#   needed for multi-threaded programs (defaults to the value of CC
-#   respectively CXX otherwise). (This is necessary on e.g. AIX to use the
-#   special cc_r/CC_r compiler alias.)
+#   Also sets PTHREAD_CC to any special C compiler that is needed for
+#   multi-threaded programs (defaults to the value of CC otherwise). (This
+#   is necessary on AIX to use the special cc_r compiler alias.)
 #
 #   NOTE: You are assumed to not only compile your program with these flags,
-#   but also to link with them as well. For example, you might link with
+#   but also link it with them as well. e.g. you should link with
 #   $PTHREAD_CC $CFLAGS $PTHREAD_CFLAGS $LDFLAGS ... $PTHREAD_LIBS $LIBS
-#   $PTHREAD_CXX $CXXFLAGS $PTHREAD_CFLAGS $LDFLAGS ... $PTHREAD_LIBS $LIBS
 #
-#   If you are only building threaded programs, you may wish to use these
+#   If you are only building threads programs, you may wish to use these
 #   variables in your default LIBS, CFLAGS, and CC:
 #
 #     LIBS="$PTHREAD_LIBS $LIBS"
 #     CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
-#     CXXFLAGS="$CXXFLAGS $PTHREAD_CFLAGS"
 #     CC="$PTHREAD_CC"
-#     CXX="$PTHREAD_CXX"
 #
 #   In addition, if the PTHREAD_CREATE_JOINABLE thread-attribute constant
-#   has a nonstandard name, this macro defines PTHREAD_CREATE_JOINABLE to
-#   that name (e.g. PTHREAD_CREATE_UNDETACHED on AIX).
+#   has a nonstandard name, defines PTHREAD_CREATE_JOINABLE to that name
+#   (e.g. PTHREAD_CREATE_UNDETACHED on AIX).
 #
 #   Also HAVE_PTHREAD_PRIO_INHERIT is defined if pthread is found and the
 #   PTHREAD_PRIO_INHERIT symbol is defined when compiling with
@@ -59,7 +55,6 @@
 #
 #   Copyright (c) 2008 Steven G. Johnson <stevenj@alum.mit.edu>
 #   Copyright (c) 2011 Daniel Richard G. <skunk@iSKUNK.ORG>
-#   Copyright (c) 2019 Marc Stevens <marc.stevens@cwi.nl>
 #
 #   This program is free software: you can redistribute it and/or modify it
 #   under the terms of the GNU General Public License as published by the
@@ -72,7 +67,7 @@
 #   Public License for more details.
 #
 #   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <https://www.gnu.org/licenses/>.
+#   with this program. If not, see <http://www.gnu.org/licenses/>.
 #
 #   As a special exception, the respective Autoconf Macro's copyright owner
 #   gives unlimited permission to copy, distribute and modify the configure
@@ -87,41 +82,35 @@
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.

-#serial 31
+#serial 21

 AU_ALIAS([ACX_PTHREAD], [AX_PTHREAD])
 AC_DEFUN([AX_PTHREAD], [
 AC_REQUIRE([AC_CANONICAL_HOST])
-AC_REQUIRE([AC_PROG_CC])
-AC_REQUIRE([AC_PROG_SED])
 AC_LANG_PUSH([C])
 ax_pthread_ok=no

 # We used to check for pthread.h first, but this fails if pthread.h
-# requires special compiler flags (e.g. on Tru64 or Sequent).
+# requires special compiler flags (e.g. on True64 or Sequent).
 # It gets checked for in the link test anyway.

 # First of all, check if the user has set any of the PTHREAD_LIBS,
 # etcetera environment variables, and if threads linking works using
 # them:
-if test "x$PTHREAD_CFLAGS$PTHREAD_LIBS" != "x"; then
-        ax_pthread_save_CC="$CC"
-        ax_pthread_save_CFLAGS="$CFLAGS"
-        ax_pthread_save_LIBS="$LIBS"
-        AS_IF([test "x$PTHREAD_CC" != "x"], [CC="$PTHREAD_CC"])
-        AS_IF([test "x$PTHREAD_CXX" != "x"], [CXX="$PTHREAD_CXX"])
+if test x"$PTHREAD_LIBS$PTHREAD_CFLAGS" != x; then
+        save_CFLAGS="$CFLAGS"
        CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+        save_LIBS="$LIBS"
        LIBS="$PTHREAD_LIBS $LIBS"
-        AC_MSG_CHECKING([for pthread_join using $CC $PTHREAD_CFLAGS $PTHREAD_LIBS])
-        AC_LINK_IFELSE([AC_LANG_CALL([], [pthread_join])], [ax_pthread_ok=yes])
+        AC_MSG_CHECKING([for pthread_join in LIBS=$PTHREAD_LIBS with CFLAGS=$PTHREAD_CFLAGS])
+        AC_TRY_LINK_FUNC([pthread_join], [ax_pthread_ok=yes])
        AC_MSG_RESULT([$ax_pthread_ok])
-        if test "x$ax_pthread_ok" = "xno"; then
+        if test x"$ax_pthread_ok" = xno; then
                PTHREAD_LIBS=""
                PTHREAD_CFLAGS=""
        fi
-        CC="$ax_pthread_save_CC"
-        CFLAGS="$ax_pthread_save_CFLAGS"
-        LIBS="$ax_pthread_save_LIBS"
+        LIBS="$save_LIBS"
+        CFLAGS="$save_CFLAGS"
 fi

 # We must check for the threads library under a number of different
@@ -129,14 +118,12 @@ fi
 # (e.g. DEC) have both -lpthread and -lpthreads, where one of the
 # libraries is broken (non-POSIX).

-# Create a list of thread flags to try. Items with a "," contain both
-# C compiler flags (before ",") and linker flags (after ","). Other items
-# starting with a "-" are C compiler flags, and remaining items are
-# library names, except for "none" which indicates that we try without
-# any flags at all, and "pthread-config" which is a program returning
-# the flags for the Pth emulation library.
+# Create a list of thread flags to try.  Items starting with a "-" are
+# C compiler flags, and other items are library names, except for "none"
+# which indicates that we try without any flags at all, and "pthread-config"
+# which is a program returning the flags for the Pth emulation library.

-ax_pthread_flags="pthreads none -Kthread -pthread -pthreads -mthreads pthread --thread-safe -mt pthread-config"
+ax_pthread_flags="pthreads none -Kthread -kthread lthread -pthread -pthreads -mthreads pthread --thread-safe -mt pthread-config"

 # The ordering *is* (sometimes) important.  Some notes on the
 # individual items follow:
@@ -145,163 +132,82 @@ ax_pthread_flags="pthreads none -Kthread -pthread -pthreads -mthreads pthread --
 # none: in case threads are in libc; should be tried before -Kthread and
 #       other compiler flags to prevent continual compiler warnings
 # -Kthread: Sequent (threads in libc, but -Kthread needed for pthread.h)
-# -pthread: Linux/gcc (kernel threads), BSD/gcc (userland threads), Tru64
-#           (Note: HP C rejects this with "bad form for `-t' option")
-# -pthreads: Solaris/gcc (Note: HP C also rejects)
-# -mt: Sun Workshop C (may only link SunOS threads [-lthread], but it
-#      doesn't hurt to check since this sometimes defines pthreads and
-#      -D_REENTRANT too), HP C (must be checked before -lpthread, which
-#      is present but should not be used directly; and before -mthreads,
-#      because the compiler interprets this as "-mt" + "-hreads")
+# -kthread: FreeBSD kernel threads (preferred to -pthread since SMP-able)
+# lthread: LinuxThreads port on FreeBSD (also preferred to -pthread)
+# -pthread: Linux/gcc (kernel threads), BSD/gcc (userland threads)
+# -pthreads: Solaris/gcc
 # -mthreads: Mingw32/gcc, Lynx/gcc
+# -mt: Sun Workshop C (may only link SunOS threads [-lthread], but it
+#      doesn't hurt to check since this sometimes defines pthreads too;
+#      also defines -D_REENTRANT)
+#      ... -mt is also the pthreads flag for HP/aCC
 # pthread: Linux, etcetera
 # --thread-safe: KAI C++
 # pthread-config: use pthread-config program (for GNU Pth library)

-case $host_os in
-
-        freebsd*)
-
-        # -kthread: FreeBSD kernel threads (preferred to -pthread since SMP-able)
-        # lthread: LinuxThreads port on FreeBSD (also preferred to -pthread)
-
-        ax_pthread_flags="-kthread lthread $ax_pthread_flags"
-        ;;
-
-        hpux*)
-
-        # From the cc(1) man page: "[-mt] Sets various -D flags to enable
-        # multi-threading and also sets -lpthread."
-
-        ax_pthread_flags="-mt -pthread pthread $ax_pthread_flags"
-        ;;
-
-        openedition*)
-
-        # IBM z/OS requires a feature-test macro to be defined in order to
-        # enable POSIX threads at all, so give the user a hint if this is
-        # not set. (We don't define these ourselves, as they can affect
-        # other portions of the system API in unpredictable ways.)
-
-        AC_EGREP_CPP([AX_PTHREAD_ZOS_MISSING],
-            [
-#            if !defined(_OPEN_THREADS) && !defined(_UNIX03_THREADS)
-             AX_PTHREAD_ZOS_MISSING
-#            endif
-            ],
-            [AC_MSG_WARN([IBM z/OS requires -D_OPEN_THREADS or -D_UNIX03_THREADS to enable pthreads support.])])
-        ;;
-
+case ${host_os} in
        solaris*)

        # On Solaris (at least, for some versions), libc contains stubbed
        # (non-functional) versions of the pthreads routines, so link-based
-        # tests will erroneously succeed. (N.B.: The stubs are missing
-        # pthread_cleanup_push, or rather a function called by this macro,
-        # so we could check for that, but who knows whether they'll stub
-        # that too in a future libc.)  So we'll check first for the
-        # standard Solaris way of linking pthreads (-mt -lpthread).
+        # tests will erroneously succeed.  (We need to link with -pthreads/-mt/
+        # -lpthread.)  (The stubs are missing pthread_cleanup_push, or rather
+        # a function called by this macro, so we could check for that, but
+        # who knows whether they'll stub that too in a future libc.)  So,
+        # we'll just look for -pthreads and -lpthread first:

-        ax_pthread_flags="-mt,-lpthread pthread $ax_pthread_flags"
+        ax_pthread_flags="-pthreads pthread -mt -pthread $ax_pthread_flags"
+        ;;
+
+        darwin*)
+        ax_pthread_flags="-pthread $ax_pthread_flags"
        ;;
 esac

-# Are we compiling with Clang?
+# Clang doesn't consider unrecognized options an error unless we specify
+# -Werror. We throw in some extra Clang-specific options to ensure that
+# this doesn't happen for GCC, which also accepts -Werror.

-AC_CACHE_CHECK([whether $CC is Clang],
-    [ax_cv_PTHREAD_CLANG],
-    [ax_cv_PTHREAD_CLANG=no
-     # Note that Autoconf sets GCC=yes for Clang as well as GCC
-     if test "x$GCC" = "xyes"; then
-        AC_EGREP_CPP([AX_PTHREAD_CC_IS_CLANG],
-            [/* Note: Clang 2.7 lacks __clang_[a-z]+__ */
-#            if defined(__clang__) && defined(__llvm__)
-             AX_PTHREAD_CC_IS_CLANG
-#            endif
-            ],
-            [ax_cv_PTHREAD_CLANG=yes])
-     fi
-    ])
-ax_pthread_clang="$ax_cv_PTHREAD_CLANG"
+AC_MSG_CHECKING([if compiler needs -Werror to reject unknown flags])
+save_CFLAGS="$CFLAGS"
+ax_pthread_extra_flags="-Werror"
+CFLAGS="$CFLAGS $ax_pthread_extra_flags -Wunknown-warning-option -Wsizeof-array-argument"
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([int foo(void);],[foo()])],
+                  [AC_MSG_RESULT([yes])],
+                  [ax_pthread_extra_flags=
+                   AC_MSG_RESULT([no])])
+CFLAGS="$save_CFLAGS"

+if test x"$ax_pthread_ok" = xno; then
+for flag in $ax_pthread_flags; do

-# GCC generally uses -pthread, or -pthreads on some platforms (e.g. SPARC)
-
-# Note that for GCC and Clang -pthread generally implies -lpthread,
-# except when -nostdlib is passed.
-# This is problematic using libtool to build C++ shared libraries with pthread:
-# [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=25460
-# [2] https://bugzilla.redhat.com/show_bug.cgi?id=661333
-# [3] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=468555
-# To solve this, first try -pthread together with -lpthread for GCC
-
-AS_IF([test "x$GCC" = "xyes"],
-      [ax_pthread_flags="-pthread,-lpthread -pthread -pthreads $ax_pthread_flags"])
-
-# Clang takes -pthread (never supported any other flag), but we'll try with -lpthread first
-
-AS_IF([test "x$ax_pthread_clang" = "xyes"],
-      [ax_pthread_flags="-pthread,-lpthread -pthread"])
-
-
-# The presence of a feature test macro requesting re-entrant function
-# definitions is, on some systems, a strong hint that pthreads support is
-# correctly enabled
-
-case $host_os in
-        darwin* | hpux* | linux* | osf* | solaris*)
-        ax_pthread_check_macro="_REENTRANT"
-        ;;
-
-        aix*)
-        ax_pthread_check_macro="_THREAD_SAFE"
-        ;;
-
-        *)
-        ax_pthread_check_macro="--"
-        ;;
-esac
-AS_IF([test "x$ax_pthread_check_macro" = "x--"],
-      [ax_pthread_check_cond=0],
-      [ax_pthread_check_cond="!defined($ax_pthread_check_macro)"])
-
-
-if test "x$ax_pthread_ok" = "xno"; then
-for ax_pthread_try_flag in $ax_pthread_flags; do
-
-        case $ax_pthread_try_flag in
+        case $flag in
                none)
                AC_MSG_CHECKING([whether pthreads work without any flags])
                ;;

-                *,*)
-                PTHREAD_CFLAGS=`echo $ax_pthread_try_flag | sed "s/^\(.*\),\(.*\)$/\1/"`
-                PTHREAD_LIBS=`echo $ax_pthread_try_flag | sed "s/^\(.*\),\(.*\)$/\2/"`
-                AC_MSG_CHECKING([whether pthreads work with "$PTHREAD_CFLAGS" and "$PTHREAD_LIBS"])
-                ;;
-
                -*)
-                AC_MSG_CHECKING([whether pthreads work with $ax_pthread_try_flag])
-                PTHREAD_CFLAGS="$ax_pthread_try_flag"
+                AC_MSG_CHECKING([whether pthreads work with $flag])
+                PTHREAD_CFLAGS="$flag"
                ;;

                pthread-config)
                AC_CHECK_PROG([ax_pthread_config], [pthread-config], [yes], [no])
-                AS_IF([test "x$ax_pthread_config" = "xno"], [continue])
+                if test x"$ax_pthread_config" = xno; then continue; fi
                PTHREAD_CFLAGS="`pthread-config --cflags`"
                PTHREAD_LIBS="`pthread-config --ldflags` `pthread-config --libs`"
                ;;

                *)
-                AC_MSG_CHECKING([for the pthreads library -l$ax_pthread_try_flag])
-                PTHREAD_LIBS="-l$ax_pthread_try_flag"
+                AC_MSG_CHECKING([for the pthreads library -l$flag])
+                PTHREAD_LIBS="-l$flag"
                ;;
        esac

-        ax_pthread_save_CFLAGS="$CFLAGS"
-        ax_pthread_save_LIBS="$LIBS"
-        CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+        save_LIBS="$LIBS"
+        save_CFLAGS="$CFLAGS"
        LIBS="$PTHREAD_LIBS $LIBS"
+        CFLAGS="$CFLAGS $PTHREAD_CFLAGS $ax_pthread_extra_flags"

        # Check for various functions.  We must include pthread.h,
        # since some functions may be macros.  (On the Sequent, we
@@ -312,18 +218,8 @@ for ax_pthread_try_flag in $ax_pthread_flags; do
        # pthread_cleanup_push because it is one of the few pthread
        # functions on Solaris that doesn't have a non-functional libc stub.
        # We try pthread_create on general principles.
-
        AC_LINK_IFELSE([AC_LANG_PROGRAM([#include <pthread.h>
-#                       if $ax_pthread_check_cond
-#                        error "$ax_pthread_check_macro must be defined"
-#                       endif
-                        static void *some_global = NULL;
-                        static void routine(void *a)
-                          {
-                             /* To avoid any unused-parameter or
-                                unused-but-set-parameter warning.  */
-                             some_global = a;
-                          }
+                        static void routine(void *a) { *((int*)a) = 0; }
                        static void *start_routine(void *a) { return a; }],
                       [pthread_t th; pthread_attr_t attr;
                        pthread_create(&th, 0, start_routine, 0);
@@ -331,187 +227,101 @@ for ax_pthread_try_flag in $ax_pthread_flags; do
                        pthread_attr_init(&attr);
                        pthread_cleanup_push(routine, 0);
                        pthread_cleanup_pop(0) /* ; */])],
-            [ax_pthread_ok=yes],
-            [])
+                [ax_pthread_ok=yes],
+                [])

-        CFLAGS="$ax_pthread_save_CFLAGS"
-        LIBS="$ax_pthread_save_LIBS"
+        LIBS="$save_LIBS"
+        CFLAGS="$save_CFLAGS"

        AC_MSG_RESULT([$ax_pthread_ok])
-        AS_IF([test "x$ax_pthread_ok" = "xyes"], [break])
+        if test "x$ax_pthread_ok" = xyes; then
+                break;
+        fi

        PTHREAD_LIBS=""
        PTHREAD_CFLAGS=""
 done
 fi

-
-# Clang needs special handling, because older versions handle the -pthread
-# option in a rather... idiosyncratic way
-
-if test "x$ax_pthread_clang" = "xyes"; then
-
-        # Clang takes -pthread; it has never supported any other flag
-
-        # (Note 1: This will need to be revisited if a system that Clang
-        # supports has POSIX threads in a separate library.  This tends not
-        # to be the way of modern systems, but it's conceivable.)
-
-        # (Note 2: On some systems, notably Darwin, -pthread is not needed
-        # to get POSIX threads support; the API is always present and
-        # active.  We could reasonably leave PTHREAD_CFLAGS empty.  But
-        # -pthread does define _REENTRANT, and while the Darwin headers
-        # ignore this macro, third-party headers might not.)
-
-        # However, older versions of Clang make a point of warning the user
-        # that, in an invocation where only linking and no compilation is
-        # taking place, the -pthread option has no effect ("argument unused
-        # during compilation").  They expect -pthread to be passed in only
-        # when source code is being compiled.
-        #
-        # Problem is, this is at odds with the way Automake and most other
-        # C build frameworks function, which is that the same flags used in
-        # compilation (CFLAGS) are also used in linking.  Many systems
-        # supported by AX_PTHREAD require exactly this for POSIX threads
-        # support, and in fact it is often not straightforward to specify a
-        # flag that is used only in the compilation phase and not in
-        # linking.  Such a scenario is extremely rare in practice.
-        #
-        # Even though use of the -pthread flag in linking would only print
-        # a warning, this can be a nuisance for well-run software projects
-        # that build with -Werror.  So if the active version of Clang has
-        # this misfeature, we search for an option to squash it.
-
-        AC_CACHE_CHECK([whether Clang needs flag to prevent "argument unused" warning when linking with -pthread],
-            [ax_cv_PTHREAD_CLANG_NO_WARN_FLAG],
-            [ax_cv_PTHREAD_CLANG_NO_WARN_FLAG=unknown
-             # Create an alternate version of $ac_link that compiles and
-             # links in two steps (.c -> .o, .o -> exe) instead of one
-             # (.c -> exe), because the warning occurs only in the second
-             # step
-             ax_pthread_save_ac_link="$ac_link"
-             ax_pthread_sed='s/conftest\.\$ac_ext/conftest.$ac_objext/g'
-             ax_pthread_link_step=`AS_ECHO(["$ac_link"]) | sed "$ax_pthread_sed"`
-             ax_pthread_2step_ac_link="($ac_compile) && (echo ==== >&5) && ($ax_pthread_link_step)"
-             ax_pthread_save_CFLAGS="$CFLAGS"
-             for ax_pthread_try in '' -Qunused-arguments -Wno-unused-command-line-argument unknown; do
-                AS_IF([test "x$ax_pthread_try" = "xunknown"], [break])
-                CFLAGS="-Werror -Wunknown-warning-option $ax_pthread_try -pthread $ax_pthread_save_CFLAGS"
-                ac_link="$ax_pthread_save_ac_link"
-                AC_LINK_IFELSE([AC_LANG_SOURCE([[int main(void){return 0;}]])],
-                    [ac_link="$ax_pthread_2step_ac_link"
-                     AC_LINK_IFELSE([AC_LANG_SOURCE([[int main(void){return 0;}]])],
-                         [break])
-                    ])
-             done
-             ac_link="$ax_pthread_save_ac_link"
-             CFLAGS="$ax_pthread_save_CFLAGS"
-             AS_IF([test "x$ax_pthread_try" = "x"], [ax_pthread_try=no])
-             ax_cv_PTHREAD_CLANG_NO_WARN_FLAG="$ax_pthread_try"
-            ])
-
-        case "$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG" in
-                no | unknown) ;;
-                *) PTHREAD_CFLAGS="$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG $PTHREAD_CFLAGS" ;;
-        esac
-
-fi # $ax_pthread_clang = yes
-
-
-
 # Various other checks:
-if test "x$ax_pthread_ok" = "xyes"; then
-        ax_pthread_save_CFLAGS="$CFLAGS"
-        ax_pthread_save_LIBS="$LIBS"
-        CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+if test "x$ax_pthread_ok" = xyes; then
+        save_LIBS="$LIBS"
        LIBS="$PTHREAD_LIBS $LIBS"
+        save_CFLAGS="$CFLAGS"
+        CFLAGS="$CFLAGS $PTHREAD_CFLAGS"

        # Detect AIX lossage: JOINABLE attribute is called UNDETACHED.
-        AC_CACHE_CHECK([for joinable pthread attribute],
-            [ax_cv_PTHREAD_JOINABLE_ATTR],
-            [ax_cv_PTHREAD_JOINABLE_ATTR=unknown
-             for ax_pthread_attr in PTHREAD_CREATE_JOINABLE PTHREAD_CREATE_UNDETACHED; do
-                 AC_LINK_IFELSE([AC_LANG_PROGRAM([#include <pthread.h>],
-                                                 [int attr = $ax_pthread_attr; return attr /* ; */])],
-                                [ax_cv_PTHREAD_JOINABLE_ATTR=$ax_pthread_attr; break],
-                                [])
-             done
-            ])
-        AS_IF([test "x$ax_cv_PTHREAD_JOINABLE_ATTR" != "xunknown" && \
-               test "x$ax_cv_PTHREAD_JOINABLE_ATTR" != "xPTHREAD_CREATE_JOINABLE" && \
-               test "x$ax_pthread_joinable_attr_defined" != "xyes"],
-              [AC_DEFINE_UNQUOTED([PTHREAD_CREATE_JOINABLE],
-                                  [$ax_cv_PTHREAD_JOINABLE_ATTR],
-                                  [Define to necessary symbol if this constant
-                                   uses a non-standard name on your system.])
-               ax_pthread_joinable_attr_defined=yes
-              ])
+        AC_MSG_CHECKING([for joinable pthread attribute])
+        attr_name=unknown
+        for attr in PTHREAD_CREATE_JOINABLE PTHREAD_CREATE_UNDETACHED; do
+            AC_LINK_IFELSE([AC_LANG_PROGRAM([#include <pthread.h>],
+                           [int attr = $attr; return attr /* ; */])],
+                [attr_name=$attr; break],
+                [])
+        done
+        AC_MSG_RESULT([$attr_name])
+        if test "$attr_name" != PTHREAD_CREATE_JOINABLE; then
+            AC_DEFINE_UNQUOTED([PTHREAD_CREATE_JOINABLE], [$attr_name],
+                               [Define to necessary symbol if this constant
+                                uses a non-standard name on your system.])
+        fi

-        AC_CACHE_CHECK([whether more special flags are required for pthreads],
-            [ax_cv_PTHREAD_SPECIAL_FLAGS],
-            [ax_cv_PTHREAD_SPECIAL_FLAGS=no
-             case $host_os in
-             solaris*)
-             ax_cv_PTHREAD_SPECIAL_FLAGS="-D_POSIX_PTHREAD_SEMANTICS"
-             ;;
-             esac
-            ])
-        AS_IF([test "x$ax_cv_PTHREAD_SPECIAL_FLAGS" != "xno" && \
-               test "x$ax_pthread_special_flags_added" != "xyes"],
-              [PTHREAD_CFLAGS="$ax_cv_PTHREAD_SPECIAL_FLAGS $PTHREAD_CFLAGS"
-               ax_pthread_special_flags_added=yes])
+        AC_MSG_CHECKING([if more special flags are required for pthreads])
+        flag=no
+        case ${host_os} in
+            aix* | freebsd* | darwin*) flag="-D_THREAD_SAFE";;
+            osf* | hpux*) flag="-D_REENTRANT";;
+            solaris*)
+            if test "$GCC" = "yes"; then
+                flag="-D_REENTRANT"
+            else
+                # TODO: What about Clang on Solaris?
+                flag="-mt -D_REENTRANT"
+            fi
+            ;;
+        esac
+        AC_MSG_RESULT([$flag])
+        if test "x$flag" != xno; then
+            PTHREAD_CFLAGS="$flag $PTHREAD_CFLAGS"
+        fi

        AC_CACHE_CHECK([for PTHREAD_PRIO_INHERIT],
-            [ax_cv_PTHREAD_PRIO_INHERIT],
-            [AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <pthread.h>]],
-                                             [[int i = PTHREAD_PRIO_INHERIT;
-                                               return i;]])],
-                            [ax_cv_PTHREAD_PRIO_INHERIT=yes],
-                            [ax_cv_PTHREAD_PRIO_INHERIT=no])
+            [ax_cv_PTHREAD_PRIO_INHERIT], [
+                AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <pthread.h>]],
+                                                [[int i = PTHREAD_PRIO_INHERIT;]])],
+                    [ax_cv_PTHREAD_PRIO_INHERIT=yes],
+                    [ax_cv_PTHREAD_PRIO_INHERIT=no])
            ])
-        AS_IF([test "x$ax_cv_PTHREAD_PRIO_INHERIT" = "xyes" && \
-               test "x$ax_pthread_prio_inherit_defined" != "xyes"],
-              [AC_DEFINE([HAVE_PTHREAD_PRIO_INHERIT], [1], [Have PTHREAD_PRIO_INHERIT.])
-               ax_pthread_prio_inherit_defined=yes
-              ])
+        AS_IF([test "x$ax_cv_PTHREAD_PRIO_INHERIT" = "xyes"],
+            [AC_DEFINE([HAVE_PTHREAD_PRIO_INHERIT], [1], [Have PTHREAD_PRIO_INHERIT.])])

-        CFLAGS="$ax_pthread_save_CFLAGS"
-        LIBS="$ax_pthread_save_LIBS"
+        LIBS="$save_LIBS"
+        CFLAGS="$save_CFLAGS"

        # More AIX lossage: compile with *_r variant
-        if test "x$GCC" != "xyes"; then
+        if test "x$GCC" != xyes; then
            case $host_os in
                aix*)
                AS_CASE(["x/$CC"],
-                    [x*/c89|x*/c89_128|x*/c99|x*/c99_128|x*/cc|x*/cc128|x*/xlc|x*/xlc_v6|x*/xlc128|x*/xlc128_v6],
-                    [#handle absolute path differently from PATH based program lookup
-                     AS_CASE(["x$CC"],
-                         [x/*],
-                         [
-			   AS_IF([AS_EXECUTABLE_P([${CC}_r])],[PTHREAD_CC="${CC}_r"])
-			   AS_IF([test "x${CXX}" != "x"], [AS_IF([AS_EXECUTABLE_P([${CXX}_r])],[PTHREAD_CXX="${CXX}_r"])])
-			 ],
-                         [
-			   AC_CHECK_PROGS([PTHREAD_CC],[${CC}_r],[$CC])
-			   AS_IF([test "x${CXX}" != "x"], [AC_CHECK_PROGS([PTHREAD_CXX],[${CXX}_r],[$CXX])])
-			 ]
-                     )
-                    ])
+                  [x*/c89|x*/c89_128|x*/c99|x*/c99_128|x*/cc|x*/cc128|x*/xlc|x*/xlc_v6|x*/xlc128|x*/xlc128_v6],
+                  [#handle absolute path differently from PATH based program lookup
+                   AS_CASE(["x$CC"],
+                     [x/*],
+                     [AS_IF([AS_EXECUTABLE_P([${CC}_r])],[PTHREAD_CC="${CC}_r"])],
+                     [AC_CHECK_PROGS([PTHREAD_CC],[${CC}_r],[$CC])])])
                ;;
            esac
        fi
 fi

 test -n "$PTHREAD_CC" || PTHREAD_CC="$CC"
-test -n "$PTHREAD_CXX" || PTHREAD_CXX="$CXX"

 AC_SUBST([PTHREAD_LIBS])
 AC_SUBST([PTHREAD_CFLAGS])
 AC_SUBST([PTHREAD_CC])
-AC_SUBST([PTHREAD_CXX])

 # Finally, execute ACTION-IF-FOUND/ACTION-IF-NOT-FOUND:
-if test "x$ax_pthread_ok" = "xyes"; then
+if test x"$ax_pthread_ok" = xyes; then
        ifelse([$1],,[AC_DEFINE([HAVE_PTHREAD],[1],[Define if you have POSIX threads libraries and header files.])],[$1])
        :
 else
@@ -47,12 +47,9 @@
 #include "util/regional.h"
 #include "util/net_help.h"
 #include "util/config_file.h"
-#include "util/data/dname.h"
 #include "util/data/msgreply.h"
 #include "util/data/msgencode.h"
 #include "services/cache/dns.h"
-#include "services/mesh.h"
-#include "services/modstack.h"
 #include "validator/val_neg.h"
 #include "validator/val_secalgo.h"
 #include "iterator/iter_utils.h"
@@ -105,6 +102,7 @@ static int
 testframe_init(struct module_env* env, struct cachedb_env* cachedb_env)
 {
 	struct testframe_moddata* d;
+	(void)env;
 	verbose(VERB_ALGO, "testframe_init");
 	d = (struct testframe_moddata*)calloc(1,
 		sizeof(struct testframe_moddata));
@@ -113,15 +111,6 @@ testframe_init(struct module_env* env, struct cachedb_env* cachedb_env)
 		log_err("out of memory");
 		return 0;
 	}
-	/* Register an EDNS option (65534) to bypass the worker cache lookup
-	 * for testing */
-	if(!edns_register_option(LDNS_EDNS_UNBOUND_CACHEDB_TESTFRAME_TEST,
-		1 /* bypass cache */,
-		0 /* no aggregation */, env)) {
-		log_err("testframe_init, could not register test opcode");
-		free(d);
-		return 0;
-	}
 	lock_basic_init(&d->lock);
 	lock_protect(&d->lock, d, sizeof(*d));
 	return 1;
@@ -229,8 +218,6 @@ static int
 cachedb_apply_cfg(struct cachedb_env* cachedb_env, struct config_file* cfg)
 {
 	const char* backend_str = cfg->cachedb_backend;
-	if(!backend_str || *backend_str==0)
-		return 1;
 	cachedb_env->backend = cachedb_find_backend(backend_str);
 	if(!cachedb_env->backend) {
 		log_err("cachedb: cannot find backend name '%s'", backend_str);
@@ -241,7 +228,7 @@ cachedb_apply_cfg(struct cachedb_env* cachedb_env, struct config_file* cfg)
 	return 1;
 }

-int
+int 
 cachedb_init(struct module_env* env, int id)
 {
 	struct cachedb_env* cachedb_env = (struct cachedb_env*)calloc(1,
@@ -268,19 +255,31 @@ cachedb_init(struct module_env* env, int id)
 		return 0;
 	}
 	cachedb_env->enabled = 1;
+	if(env->cfg->serve_expired_reply_ttl)
+		log_warn(
+			"cachedb: serve-expired-reply-ttl is set but not working for data "
+			"originating from the external cache; 0 TLL is used for those.");
+	if(env->cfg->serve_expired_client_timeout)
+		log_warn(
+			"cachedb: serve-expired-client-timeout is set but not working for "
+			"data originating from the external cache; expired data are used "
+			"in the reply without first trying to refresh the data.");
 	return 1;
 }

-void
+void 
 cachedb_deinit(struct module_env* env, int id)
 {
 	struct cachedb_env* cachedb_env;
 	if(!env || !env->modinfo[id])
 		return;
 	cachedb_env = (struct cachedb_env*)env->modinfo[id];
+	/* free contents */
+	/* TODO */
 	if(cachedb_env->enabled) {
 		(*cachedb_env->backend->deinit)(env, cachedb_env);
 	}
+
 	free(cachedb_env);
 	env->modinfo[id] = NULL;
 }
@@ -323,31 +322,30 @@ error_response(struct module_qstate* qstate, int id, int rcode)

 /**
 * Hash the query name, type, class and dbacess-secret into lookup buffer.
- * @param qinfo: query info
- * @param env: with env->cfg with secret.
+ * @param qstate: query state with query info
+ * 	and env->cfg with secret.
 * @param buf: returned buffer with hash to lookup
 * @param len: length of the buffer.
 */
 static void
-calc_hash(struct query_info* qinfo, struct module_env* env, char* buf,
-	size_t len)
+calc_hash(struct module_qstate* qstate, char* buf, size_t len)
 {
 	uint8_t clear[1024];
 	size_t clen = 0;
 	uint8_t hash[CACHEDB_HASHSIZE/8];
 	const char* hex = "0123456789ABCDEF";
-	const char* secret = env->cfg->cachedb_secret;
+	const char* secret = qstate->env->cfg->cachedb_secret;
 	size_t i;

 	/* copy the hash info into the clear buffer */
-	if(clen + qinfo->qname_len < sizeof(clear)) {
-		memmove(clear+clen, qinfo->qname, qinfo->qname_len);
-		query_dname_tolower(clear+clen);
-		clen += qinfo->qname_len;
+	if(clen + qstate->qinfo.qname_len < sizeof(clear)) {
+		memmove(clear+clen, qstate->qinfo.qname,
+			qstate->qinfo.qname_len);
+		clen += qstate->qinfo.qname_len;
 	}
 	if(clen + 4 < sizeof(clear)) {
-		uint16_t t = htons(qinfo->qtype);
-		uint16_t c = htons(qinfo->qclass);
+		uint16_t t = htons(qstate->qinfo.qtype);
+		uint16_t c = htons(qstate->qinfo.qclass);
 		memmove(clear+clen, &t, 2);
 		memmove(clear+clen+2, &c, 2);
 		clen += 4;
@@ -408,14 +406,6 @@ prep_data(struct module_qstate* qstate, struct sldns_buffer* buf)
 	if(qstate->return_msg->rep->ttl == 0 &&
 		!qstate->env->cfg->serve_expired)
 		return 0;
-
-	/* The EDE is added to the out-list so it is encoded in the cached message */
-	if (qstate->env->cfg->ede && qstate->return_msg->rep->reason_bogus != LDNS_EDE_NONE) {
-		edns_opt_list_append_ede(&edns.opt_list_out, qstate->env->scratch,
-					qstate->return_msg->rep->reason_bogus,
-					qstate->return_msg->rep->reason_bogus_str);
-	}
-
 	if(verbosity >= VERB_ALGO)
 		log_dns_msg("cachedb encoding", &qstate->return_msg->qinfo,
 	                qstate->return_msg->rep);
@@ -506,42 +496,12 @@ adjust_msg_ttl(struct dns_msg* msg, time_t adjust)
 	}
 }

-/* Set the TTL of the given RRset to fixed value. */
-static void
-packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl)
-{
-	size_t i;
-	size_t total = data->count + data->rrsig_count;
-	data->ttl = ttl;
-	for(i=0; i<total; i++) {
-		data->rr_ttl[i] = ttl;
-	}
-	data->ttl_add = 0;
-}
-
-/* Set the TTL of a DNS message and its RRs by to a fixed value. */
-static void
-set_msg_ttl(struct dns_msg* msg, time_t ttl)
-{
-	size_t i;
-	msg->rep->ttl = ttl;
-	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
-	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
-
-	for(i=0; i<msg->rep->rrset_count; i++) {
-		packed_rrset_ttl_set((struct packed_rrset_data*)msg->
-			rep->rrsets[i]->entry.data, ttl);
-	}
-}
-
 /** convert dns message in buffer to return_msg */
 static int
-parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
-	int* msg_expired)
+parse_data(struct module_qstate* qstate, struct sldns_buffer* buf)
 {
 	struct msg_parse* prs;
 	struct edns_data edns;
-	struct edns_option* ede;
 	uint64_t timestamp, expiry;
 	time_t adjust;
 	size_t lim = sldns_buffer_limit(buf);
@@ -579,24 +539,6 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 	if(!qstate->return_msg)
 		return 0;
 	
-	/* We find the EDE in the in-list after parsing */
-	if(qstate->env->cfg->ede &&
-		(ede = edns_opt_list_find(edns.opt_list_in, LDNS_EDNS_EDE))) {
-		if(ede->opt_len >= 2) {
-			qstate->return_msg->rep->reason_bogus =
-				sldns_read_uint16(ede->opt_data);
-		}
-		/* allocate space and store the error string and it's size */
-		if(ede->opt_len > 2) {
-			size_t ede_len = ede->opt_len - 2;
-			qstate->return_msg->rep->reason_bogus_str = regional_alloc(
-				qstate->region, sizeof(char) * (ede_len+1));
-			memcpy(qstate->return_msg->rep->reason_bogus_str,
-				ede->opt_data+2, ede_len);
-			qstate->return_msg->rep->reason_bogus_str[ede_len] = 0;
-		}
-	}
-
 	qstate->return_rcode = LDNS_RCODE_NOERROR;

 	/* see how much of the TTL expired, and remove it */
@@ -607,25 +549,15 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 	adjust = *qstate->env->now - (time_t)timestamp;
 	if(qstate->return_msg->rep->ttl < adjust) {
 		verbose(VERB_ALGO, "cachedb msg expired");
-		*msg_expired = 1;
 		/* If serve-expired is enabled, we still use an expired message
 		 * setting the TTL to 0. */
-		if(!qstate->env->cfg->serve_expired ||
-			(FLAGS_GET_RCODE(qstate->return_msg->rep->flags)
-			!= LDNS_RCODE_NOERROR &&
-			FLAGS_GET_RCODE(qstate->return_msg->rep->flags)
-			!= LDNS_RCODE_NXDOMAIN &&
-			FLAGS_GET_RCODE(qstate->return_msg->rep->flags)
-			!= LDNS_RCODE_YXDOMAIN))
-			return 0; /* message expired */
-		else
+		if(qstate->env->cfg->serve_expired)
 			adjust = -1;
+		else
+			return 0; /* message expired */
 	}
 	verbose(VERB_ALGO, "cachedb msg adjusted down by %d", (int)adjust);
 	adjust_msg_ttl(qstate->return_msg, adjust);
-	if(qstate->env->cfg->aggressive_nsec) {
-		limit_nsec_ttl(qstate->return_msg);
-	}

 	/* Similar to the unbound worker, if serve-expired is enabled and
 	 * the msg would be considered to be expired, mark the state so a
@@ -633,7 +565,6 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 	 * 'now' should be redundant given how these values were calculated,
 	 * but we check it just in case as does good_expiry_and_qinfo(). */
 	if(qstate->env->cfg->serve_expired &&
-		!qstate->env->cfg->serve_expired_client_timeout &&
 		(adjust == -1 || (time_t)expiry < *qstate->env->now)) {
 		qstate->need_refetch = 1;
 	}
@@ -646,11 +577,10 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 * return true if lookup was successful.
 */
 static int
-cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie,
-	int* msg_expired)
+cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie)
 {
 	char key[(CACHEDB_HASHSIZE/8)*2+1];
-	calc_hash(&qstate->qinfo, qstate->env, key, sizeof(key));
+	calc_hash(qstate, key, sizeof(key));

 	/* call backend to fetch data for key into scratch buffer */
 	if( !(*ie->backend->lookup)(qstate->env, ie, key,
@@ -664,7 +594,7 @@ cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie,
 	}

 	/* parse dns message into return_msg */
-	if( !parse_data(qstate, qstate->env->scratch_buffer, msg_expired) ) {
+	if( !parse_data(qstate, qstate->env->scratch_buffer) ) {
 		return 0;
 	}
 	return 1;
@@ -677,7 +607,7 @@ static void
 cachedb_extcache_store(struct module_qstate* qstate, struct cachedb_env* ie)
 {
 	char key[(CACHEDB_HASHSIZE/8)*2+1];
-	calc_hash(&qstate->qinfo, qstate->env, key, sizeof(key));
+	calc_hash(qstate, key, sizeof(key));

 	/* prepare data in scratch buffer */
 	if(!prep_data(qstate, qstate->env->scratch_buffer))
@@ -694,18 +624,13 @@ cachedb_extcache_store(struct module_qstate* qstate, struct cachedb_env* ie)
 * See if unbound's internal cache can answer the query
 */
 static int
-cachedb_intcache_lookup(struct module_qstate* qstate, struct cachedb_env* cde)
+cachedb_intcache_lookup(struct module_qstate* qstate)
 {
-	uint8_t dpname_storage[LDNS_MAX_DOMAINLEN+1];
 	uint8_t* dpname=NULL;
 	size_t dpnamelen=0;
 	struct dns_msg* msg;
-	/* for testframe bypass this lookup */
-	if(cde->backend == &testframe_backend) {
-		return 0;
-	}
 	if(iter_stub_fwd_no_cache(qstate, &qstate->qinfo,
-		&dpname, &dpnamelen, dpname_storage, sizeof(dpname_storage)))
+		&dpname, &dpnamelen))
 		return 0; /* no cache for these queries */
 	msg = dns_cache_lookup(qstate->env, qstate->qinfo.qname,
 		qstate->qinfo.qname_len, qstate->qinfo.qtype,
@@ -736,44 +661,17 @@ cachedb_intcache_lookup(struct module_qstate* qstate, struct cachedb_env* cde)
 * Store query into the internal cache of unbound.
 */
 static void
-cachedb_intcache_store(struct module_qstate* qstate, int msg_expired)
+cachedb_intcache_store(struct module_qstate* qstate)
 {
 	uint32_t store_flags = qstate->query_flags;
-	int serve_expired = qstate->env->cfg->serve_expired;

 	if(qstate->env->cfg->serve_expired)
 		store_flags |= DNSCACHE_STORE_ZEROTTL;
 	if(!qstate->return_msg)
 		return;
-	if(serve_expired && msg_expired) {
-		/* Set TTLs to a value such that value + *env->now is
-		 * going to be now-3 seconds. Making it expired
-		 * in the cache. */
-		set_msg_ttl(qstate->return_msg, (time_t)-3);
-		/* The expired entry does not get checked by the validator
-		 * and we need a validation value for it. */
-		if(qstate->env->cfg->cachedb_check_when_serve_expired)
-			qstate->return_msg->rep->security = sec_status_insecure;
-	}
 	(void)dns_cache_store(qstate->env, &qstate->qinfo,
 		qstate->return_msg->rep, 0, qstate->prefetch_leeway, 0,
-		qstate->region, store_flags, qstate->qstarttime,
-		qstate->is_valrec);
-	if(serve_expired && msg_expired) {
-		if(qstate->env->cfg->serve_expired_client_timeout) {
-			/* No expired response from the query state, the
-			 * query resolution needs to continue and it can
-			 * pick up the expired result after the timer out
-			 * of cache. */
-			return;
-		}
-		/* set TTLs to zero again */
-		adjust_msg_ttl(qstate->return_msg, -1);
-		/* Send serve expired responses based on the cachedb
-		 * returned message, that was just stored in the cache.
-		 * It can then continue to work on this query. */
-		mesh_respond_serve_expired(qstate->mesh_info);
-	}
+		qstate->region, store_flags, qstate->qstarttime);
 }

 /**
@@ -789,8 +687,6 @@ cachedb_handle_query(struct module_qstate* qstate,
 	struct cachedb_qstate* ATTR_UNUSED(iq),
 	struct cachedb_env* ie, int id)
 {
-	int msg_expired = 0;
-	qstate->is_cachedb_answer = 0;
 	/* check if we are enabled, and skip if so */
 	if(!ie->enabled) {
 		/* pass request to next module */
@@ -807,7 +703,7 @@ cachedb_handle_query(struct module_qstate* qstate,

 	/* lookup inside unbound's internal cache.
 	 * This does not look for expired entries. */
-	if(cachedb_intcache_lookup(qstate, ie)) {
+	if(cachedb_intcache_lookup(qstate)) {
 		if(verbosity >= VERB_ALGO) {
 			if(qstate->return_msg->rep)
 				log_dns_msg("cachedb internal cache lookup",
@@ -824,46 +720,31 @@ cachedb_handle_query(struct module_qstate* qstate,
 	}

 	/* ask backend cache to see if we have data */
-	if(cachedb_extcache_lookup(qstate, ie, &msg_expired)) {
+	if(cachedb_extcache_lookup(qstate, ie)) {
 		if(verbosity >= VERB_ALGO)
 			log_dns_msg(ie->backend->name,
 				&qstate->return_msg->qinfo,
 				qstate->return_msg->rep);
 		/* store this result in internal cache */
-		cachedb_intcache_store(qstate, msg_expired);
+		cachedb_intcache_store(qstate);
 		/* In case we have expired data but there is a client timer for expired
 		 * answers, pass execution to next module in order to try updating the
 		 * data first.
-		 */
-		if(qstate->env->cfg->serve_expired && msg_expired) {
-			qstate->return_msg = NULL;
-			qstate->ext_state[id] = module_wait_module;
-			/* The expired reply is sent with
-			 * mesh_respond_serve_expired, and so
-			 * the need_refetch is not used. */
-			qstate->need_refetch = 0;
-			return;
-		}
+		 * TODO: this needs revisit. The expired data stored from cachedb has
+		 * 0 TTL which is picked up by iterator later when looking in the cache.
+		 * Document that ext cachedb does not work properly with
+		 * serve_stale_reply_ttl yet. */
 		if(qstate->need_refetch && qstate->serve_expired_data &&
 			qstate->serve_expired_data->timer) {
 				qstate->return_msg = NULL;
 				qstate->ext_state[id] = module_wait_module;
 				return;
 		}
-		qstate->is_cachedb_answer = 1;
 		/* we are done with the query */
 		qstate->ext_state[id] = module_finished;
 		return;
 	}

-	if(qstate->serve_expired_data &&
-		qstate->env->cfg->cachedb_check_when_serve_expired &&
-		!qstate->env->cfg->serve_expired_client_timeout) {
-		/* Reply with expired data if any to client, because cachedb
-		 * also has no useful, current data */
-		mesh_respond_serve_expired(qstate->mesh_info);
-	}
-
 	/* no cache fetches */
 	/* pass request to next module */
 	qstate->ext_state[id] = module_wait_module;
@@ -881,18 +762,12 @@ static void
 cachedb_handle_response(struct module_qstate* qstate,
 	struct cachedb_qstate* ATTR_UNUSED(iq), struct cachedb_env* ie, int id)
 {
-	qstate->is_cachedb_answer = 0;
 	/* check if we are not enabled or instructed to not cache, and skip */
 	if(!ie->enabled || qstate->no_cache_store) {
 		/* we are done with the query */
 		qstate->ext_state[id] = module_finished;
 		return;
 	}
-	if(qstate->env->cfg->cachedb_no_store) {
-		/* do not store the item in the external cache */
-		qstate->ext_state[id] = module_finished;
-		return;
-	}

 	/* store the item into the backend cache */
 	cachedb_extcache_store(qstate, ie);
@@ -987,7 +862,7 @@ cachedb_get_mem(struct module_env* env, int id)
 */
 static struct module_func_block cachedb_block = {
 	"cachedb",
-	NULL, NULL, &cachedb_init, &cachedb_deinit, &cachedb_operate,
+	&cachedb_init, &cachedb_deinit, &cachedb_operate,
 	&cachedb_inform_super, &cachedb_clear, &cachedb_get_mem
 };

@@ -996,41 +871,4 @@ cachedb_get_funcblock(void)
 {
 	return &cachedb_block;
 }
-
-int
-cachedb_is_enabled(struct module_stack* mods, struct module_env* env)
-{
-	struct cachedb_env* ie;
-	int id = modstack_find(mods, "cachedb");
-	if(id == -1)
-		return 0;
-	ie = (struct cachedb_env*)env->modinfo[id];
-	if(ie && ie->enabled)
-		return 1;
-	return 0;
-}
-
-void cachedb_msg_remove(struct module_qstate* qstate)
-{
-	cachedb_msg_remove_qinfo(qstate->env, &qstate->qinfo);
-}
-
-void cachedb_msg_remove_qinfo(struct module_env* env, struct query_info* qinfo)
-{
-	char key[(CACHEDB_HASHSIZE/8)*2+1];
-	int id = modstack_find(env->modstack, "cachedb");
-	struct cachedb_env* ie = (struct cachedb_env*)env->modinfo[id];
-
-	log_query_info(VERB_ALGO, "cachedb msg remove", qinfo);
-	calc_hash(qinfo, env, key, sizeof(key));
-	sldns_buffer_clear(env->scratch_buffer);
-	sldns_buffer_write_u32(env->scratch_buffer, 0);
-	sldns_buffer_flip(env->scratch_buffer);
-
-	/* call backend */
-	(*ie->backend->store)(env, ie, key,
-		sldns_buffer_begin(env->scratch_buffer),
-		sldns_buffer_limit(env->scratch_buffer),
-		0);
-}
 #endif /* USE_CACHEDB */
@@ -41,7 +41,6 @@
 */
 #include "util/module.h"
 struct cachedb_backend;
-struct module_stack;

 /**
 * The global variable environment contents for the cachedb
@@ -111,26 +110,3 @@ size_t cachedb_get_mem(struct module_env* env, int id);
 */
 struct module_func_block* cachedb_get_funcblock(void);

-/**
- * See if the cachedb is enabled.
- * @param mods: module stack. It finds the cachedb module environment.
- * @param env: module environment.
- * @return true if exists and enabled.
- */
-int cachedb_is_enabled(struct module_stack* mods, struct module_env* env);
-
-/**
- * Remove a message from the global cache. Because edns subnet has a more
- * specific entry, and if not removed when everything expires, the global
- * entry is used, instead of a fresh lookup of the edns subnet entry.
- * @param qstate: query state.
- */
-void cachedb_msg_remove(struct module_qstate* qstate);
-
-/**
- * Remove message from the cachedb cache, by query info.
- * @param env: module environment to look up cachedb state.
- * @param qinfo: the message to remove.
- */
-void cachedb_msg_remove_qinfo(struct module_env* env,
-	struct query_info* qinfo);
@@ -52,76 +52,23 @@
 #include "hiredis/hiredis.h"

 struct redis_moddata {
-	/* thread-specific redis contexts */
-	redisContext** ctxs;
-	redisContext** replica_ctxs;
-	/* number of ctx entries */
-	int numctxs;
-	/* server's IP address or host name */
-	const char* server_host;
-	const char* replica_server_host;
-	/* server's TCP port */
-	int server_port;
-	int replica_server_port;
-	/* server's unix path, or "", NULL if unused */
-	const char* server_path;
-	const char* replica_server_path;
-	/* server's AUTH password, or "", NULL if unused */
-	const char* server_password;
-	const char* replica_server_password;
-	/* timeout for commands */
-	struct timeval command_timeout;
-	struct timeval replica_command_timeout;
-	/* timeout for connection setup */
-	struct timeval connect_timeout;
-	struct timeval replica_connect_timeout;
-	/* the redis logical database to use */
-	int logical_db;
-	int replica_logical_db;
-	/* if the SET with EX command is supported */
-	int set_with_ex_available;
+	redisContext** ctxs;	/* thread-specific redis contexts */
+	int numctxs;		/* number of ctx entries */
+	const char* server_host; /* server's IP address or host name */
+	int server_port;	 /* server's TCP port */
+	struct timeval timeout;	 /* timeout for connection setup and commands */
 };

 static redisReply* redis_command(struct module_env*, struct cachedb_env*,
-	const char*, const uint8_t*, size_t, int);
-
-static void
-moddata_clean(struct redis_moddata** moddata) {
-	if(!moddata || !*moddata)
-		return;
-	if((*moddata)->ctxs) {
-		int i;
-		for(i = 0; i < (*moddata)->numctxs; i++) {
-			if((*moddata)->ctxs[i])
-				redisFree((*moddata)->ctxs[i]);
-		}
-		free((*moddata)->ctxs);
-	}
-	if((*moddata)->replica_ctxs) {
-		int i;
-		for(i = 0; i < (*moddata)->numctxs; i++) {
-			if((*moddata)->replica_ctxs[i])
-				redisFree((*moddata)->replica_ctxs[i]);
-		}
-		free((*moddata)->replica_ctxs);
-	}
-	free(*moddata);
-	*moddata = NULL;
-}
+	const char*, const uint8_t*, size_t);

 static redisContext*
-redis_connect(const char* host, int port, const char* path,
-	const char* password, int logical_db,
-	const struct timeval connect_timeout,
-	const struct timeval command_timeout)
+redis_connect(const struct redis_moddata* moddata)
 {
 	redisContext* ctx;

-	if(path && path[0]!=0) {
-		ctx = redisConnectUnixWithTimeout(path, connect_timeout);
-	} else {
-		ctx = redisConnectWithTimeout(host, port, connect_timeout);
-	}
+	ctx = redisConnectWithTimeout(moddata->server_host,
+		moddata->server_port, moddata->timeout);
 	if(!ctx || ctx->err) {
 		const char *errstr = "out of memory";
 		if(ctx)
@@ -129,161 +76,59 @@ redis_connect(const char* host, int port, const char* path,
 		log_err("failed to connect to redis server: %s", errstr);
 		goto fail;
 	}
-	if(redisSetTimeout(ctx, command_timeout) != REDIS_OK) {
-		log_err("failed to set redis timeout, %s", ctx->errstr);
+	if(redisSetTimeout(ctx, moddata->timeout) != REDIS_OK) {
+		log_err("failed to set redis timeout");
 		goto fail;
 	}
-	if(password && password[0]!=0) {
-		redisReply* rep;
-		rep = redisCommand(ctx, "AUTH %s", password);
-		if(!rep || rep->type == REDIS_REPLY_ERROR) {
-			log_err("failed to authenticate with password");
-			freeReplyObject(rep);
-			goto fail;
-		}
-		freeReplyObject(rep);
-	}
-	if(logical_db > 0) {
-		redisReply* rep;
-		rep = redisCommand(ctx, "SELECT %d", logical_db);
-		if(!rep || rep->type == REDIS_REPLY_ERROR) {
-			log_err("failed to set logical database (%d)",
-				logical_db);
-			freeReplyObject(rep);
-			goto fail;
-		}
-		freeReplyObject(rep);
-	}
-	if(verbosity >= VERB_OPS) {
-		char port_str[6+1];
-		port_str[0] = ' ';
-		(void)snprintf(port_str+1, sizeof(port_str)-1, "%d", port);
-		verbose(VERB_OPS, "Connection to Redis established (%s%s)",
-			path&&path[0]!=0?path:host,
-			path&&path[0]!=0?"":port_str);
-	}
 	return ctx;

-fail:
+  fail:
 	if(ctx)
 		redisFree(ctx);
 	return NULL;
 }

-static void
-set_timeout(struct timeval* timeout, int value, int explicit_value)
-{
-	int v = explicit_value != 0 ? explicit_value : value;
-	timeout->tv_sec = v / 1000;
-	timeout->tv_usec = (v % 1000) * 1000;
-}
-
 static int
 redis_init(struct module_env* env, struct cachedb_env* cachedb_env)
 {
 	int i;
 	struct redis_moddata* moddata = NULL;

-	verbose(VERB_OPS, "Redis initialization");
+	verbose(VERB_ALGO, "redis_init");

 	moddata = calloc(1, sizeof(struct redis_moddata));
 	if(!moddata) {
 		log_err("out of memory");
-		goto fail;
+		return 0;
 	}
 	moddata->numctxs = env->cfg->num_threads;
-	/* note: server_host and similar string configuration options are
-	 * shallow references to configured strings; we don't have to free them
-	 * in this module. */
-	moddata->server_host = env->cfg->redis_server_host;
-	moddata->replica_server_host = env->cfg->redis_replica_server_host;
-
-	moddata->server_port = env->cfg->redis_server_port;
-	moddata->replica_server_port = env->cfg->redis_replica_server_port;
-
-	moddata->server_path = env->cfg->redis_server_path;
-	moddata->replica_server_path = env->cfg->redis_replica_server_path;
-
-	moddata->server_password = env->cfg->redis_server_password;
-	moddata->replica_server_password = env->cfg->redis_replica_server_password;
-
-	set_timeout(&moddata->command_timeout,
-		env->cfg->redis_timeout,
-		env->cfg->redis_command_timeout);
-	set_timeout(&moddata->replica_command_timeout,
-		env->cfg->redis_replica_timeout,
-		env->cfg->redis_replica_command_timeout);
-	set_timeout(&moddata->connect_timeout,
-		env->cfg->redis_timeout,
-		env->cfg->redis_connect_timeout);
-	set_timeout(&moddata->replica_connect_timeout,
-		env->cfg->redis_replica_timeout,
-		env->cfg->redis_replica_connect_timeout);
-
-	moddata->logical_db = env->cfg->redis_logical_db;
-	moddata->replica_logical_db = env->cfg->redis_replica_logical_db;
-
 	moddata->ctxs = calloc(env->cfg->num_threads, sizeof(redisContext*));
 	if(!moddata->ctxs) {
 		log_err("out of memory");
-		goto fail;
-	}
-	if((moddata->replica_server_host && moddata->replica_server_host[0]!=0)
-		|| (moddata->replica_server_path && moddata->replica_server_path[0]!=0)) {
-		/* There is a replica configured, allocate ctxs */
-		moddata->replica_ctxs = calloc(env->cfg->num_threads, sizeof(redisContext*));
-		if(!moddata->replica_ctxs) {
-			log_err("out of memory");
-			goto fail;
-		}
-	}
-	for(i = 0; i < moddata->numctxs; i++) {
-		redisContext* ctx = redis_connect(
-			moddata->server_host,
-			moddata->server_port,
-			moddata->server_path,
-			moddata->server_password,
-			moddata->logical_db,
-			moddata->connect_timeout,
-			moddata->command_timeout);
-		if(!ctx) {
-			log_err("redis_init: failed to init redis "
-				"(for thread %d)", i);
-			/* And continue, the context can be established
-			 * later, just like after a disconnect. */
-		}
-		moddata->ctxs[i] = ctx;
-	}
-	if(moddata->replica_ctxs) {
-		for(i = 0; i < moddata->numctxs; i++) {
-			redisContext* ctx = redis_connect(
-				moddata->replica_server_host,
-				moddata->replica_server_port,
-				moddata->replica_server_path,
-				moddata->replica_server_password,
-				moddata->replica_logical_db,
-				moddata->replica_connect_timeout,
-				moddata->replica_command_timeout);
-			if(!ctx) {
-				log_err("redis_init: failed to init redis "
-					"replica (for thread %d)", i);
-				/* And continue, the context can be established
-				* later, just like after a disconnect. */
-			}
-			moddata->replica_ctxs[i] = ctx;
-		}
+		free(moddata);
+		return 0;
 	}
+	/* note: server_host is a shallow reference to configured string.
+	 * we don't have to free it in this module. */
+	moddata->server_host = env->cfg->redis_server_host;
+	moddata->server_port = env->cfg->redis_server_port;
+	moddata->timeout.tv_sec = env->cfg->redis_timeout / 1000;
+	moddata->timeout.tv_usec = (env->cfg->redis_timeout % 1000) * 1000;
+	for(i = 0; i < moddata->numctxs; i++)
+		moddata->ctxs[i] = redis_connect(moddata);
 	cachedb_env->backend_data = moddata;
-	if(env->cfg->redis_expire_records &&
-		moddata->ctxs[env->alloc->thread_num] != NULL) {
+	if(env->cfg->redis_expire_records) {
 		redisReply* rep = NULL;
 		int redis_reply_type = 0;
-		/** check if set with ex command is supported */
+		/** check if setex command is supported */
 		rep = redis_command(env, cachedb_env,
-			"SET __UNBOUND_REDIS_CHECK__ none EX 1", NULL, 0, 1);
+			"SETEX __UNBOUND_REDIS_CHECK__ 1 none", NULL, 0);
 		if(!rep) {
 			/** init failed, no response from redis server*/
-			goto set_with_ex_fail;
+			log_err("redis_init: failed to init redis, the "
+				"redis-expire-records option requires the SETEX command "
+				"(redis >= 2.0.0)");
+			return 0;
 		}
 		redis_reply_type = rep->type;
 		freeReplyObject(rep);
@@ -291,21 +136,15 @@ redis_init(struct module_env* env, struct cachedb_env* cachedb_env)
 		case REDIS_REPLY_STATUS:
 			break;
 		default:
-			/** init failed, set_with_ex command not supported */
-			goto set_with_ex_fail;
+			/** init failed, setex command not supported */
+			log_err("redis_init: failed to init redis, the "
+				"redis-expire-records option requires the SETEX command "
+				"(redis >= 2.0.0)");
+			return 0;
 		}
-		moddata->set_with_ex_available = 1;
 	}
-	return 1;

-set_with_ex_fail:
-	log_err("redis_init: failure during redis_init, the "
-		"redis-expire-records option requires the SET with EX command "
-		"(redis >= 2.6.2)");
 	return 1;
-fail:
-	moddata_clean(&moddata);
-	return 0;
 }

 static void
@@ -315,8 +154,19 @@ redis_deinit(struct module_env* env, struct cachedb_env* cachedb_env)
 		cachedb_env->backend_data;
 	(void)env;

-	verbose(VERB_OPS, "Redis deinitialization");
-	moddata_clean(&moddata);
+	verbose(VERB_ALGO, "redis_deinit");
+
+	if(!moddata)
+		return;
+	if(moddata->ctxs) {
+		int i;
+		for(i = 0; i < moddata->numctxs; i++) {
+			if(moddata->ctxs[i])
+				redisFree(moddata->ctxs[i]);
+		}
+		free(moddata->ctxs);
+	}
+	free(moddata);
 }

 /*
@@ -333,9 +183,9 @@ redis_deinit(struct module_env* env, struct cachedb_env* cachedb_env)
 */
 static redisReply*
 redis_command(struct module_env* env, struct cachedb_env* cachedb_env,
-	const char* command, const uint8_t* data, size_t data_len, int write)
+	const char* command, const uint8_t* data, size_t data_len)
 {
-	redisContext* ctx, **ctx_selector;
+	redisContext* ctx;
 	redisReply* rep;
 	struct redis_moddata* d = (struct redis_moddata*)
 		cachedb_env->backend_data;
@@ -346,38 +196,17 @@ redis_command(struct module_env* env, struct cachedb_env* cachedb_env,
 	 * assumption throughout the unbound architecture, so we simply assert
 	 * it. */
 	log_assert(env->alloc->thread_num < d->numctxs);
-
-	ctx_selector = !write && d->replica_ctxs
-		?d->replica_ctxs
-		:d->ctxs;
-	ctx = ctx_selector[env->alloc->thread_num];
+	ctx = d->ctxs[env->alloc->thread_num];

 	/* If we've not established a connection to the server or we've closed
 	 * it on a failure, try to re-establish a new one.   Failures will be
 	 * logged in redis_connect(). */
 	if(!ctx) {
-		if(!write && d->replica_ctxs) {
-			ctx = redis_connect(
-				d->replica_server_host,
-				d->replica_server_port,
-				d->replica_server_path,
-				d->replica_server_password,
-				d->replica_logical_db,
-				d->replica_connect_timeout,
-				d->replica_command_timeout);
-		} else {
-			ctx = redis_connect(
-				d->server_host,
-				d->server_port,
-				d->server_path,
-				d->server_password,
-				d->logical_db,
-				d->connect_timeout,
-				d->command_timeout);
-		}
-		ctx_selector[env->alloc->thread_num] = ctx;
+		ctx = redis_connect(d);
+		d->ctxs[env->alloc->thread_num] = ctx;
 	}
-	if(!ctx) return NULL;
+	if(!ctx)
+		return NULL;

 	/* Send the command and get a reply, synchronously. */
 	rep = (redisReply*)redisCommand(ctx, command, data, data_len);
@@ -387,7 +216,7 @@ redis_command(struct module_env* env, struct cachedb_env* cachedb_env,
 		log_err("redis_command: failed to receive a reply, "
 			"closing connection: %s", ctx->errstr);
 		redisFree(ctx);
-		ctx_selector[env->alloc->thread_num] = NULL;
+		d->ctxs[env->alloc->thread_num] = NULL;
 		return NULL;
 	}

@@ -417,7 +246,7 @@ redis_lookup(struct module_env* env, struct cachedb_env* cachedb_env,
 		return 0;
 	}

-	rep = redis_command(env, cachedb_env, cmdbuf, NULL, 0, 0);
+	rep = redis_command(env, cachedb_env, cmdbuf, NULL, 0);
 	if(!rep)
 		return 0;
 	switch(rep->type) {
@@ -454,16 +283,11 @@ redis_store(struct module_env* env, struct cachedb_env* cachedb_env,
 {
 	redisReply* rep;
 	int n;
-	struct redis_moddata* moddata = (struct redis_moddata*)
-		cachedb_env->backend_data;
-	int set_ttl = (moddata->set_with_ex_available &&
-		env->cfg->redis_expire_records &&
+	int set_ttl = (env->cfg->redis_expire_records &&
 		(!env->cfg->serve_expired || env->cfg->serve_expired_ttl > 0));
 	/* Supported commands:
 	 * - "SET " + key + " %b"
-	 * - "SET " + key + " %b EX " + ttl
-	 *   older redis 2.0.0 was "SETEX " + key + " " + ttl + " %b"
-	 * - "EXPIRE " + key + " 0"
+	 * - "SETEX " + key + " " + ttl + " %b"
 	 */
 	char cmdbuf[6+(CACHEDB_HASHSIZE/8)*2+11+3+1];

@@ -471,22 +295,14 @@ redis_store(struct module_env* env, struct cachedb_env* cachedb_env,
 		verbose(VERB_ALGO, "redis_store %s (%d bytes)", key, (int)data_len);
 		/* build command to set to a binary safe string */
 		n = snprintf(cmdbuf, sizeof(cmdbuf), "SET %s %%b", key);
-	} else if(ttl == 0) {
-		/* use the EXPIRE command, SET with EX 0 is an invalid time. */
-		/* Replies with REDIS_REPLY_INTEGER of 1. */
-		verbose(VERB_ALGO, "redis_store expire %s (%d bytes)",
-			key, (int)data_len);
-		n = snprintf(cmdbuf, sizeof(cmdbuf), "EXPIRE %s 0", key);
-		data = NULL;
-		data_len = 0;
 	} else {
 		/* add expired ttl time to redis ttl to avoid premature eviction of key */
 		ttl += env->cfg->serve_expired_ttl;
 		verbose(VERB_ALGO, "redis_store %s (%d bytes) with ttl %u",
-			key, (int)data_len, (unsigned)(uint32_t)ttl);
+			key, (int)data_len, (uint32_t)ttl);
 		/* build command to set to a binary safe string */
-		n = snprintf(cmdbuf, sizeof(cmdbuf), "SET %s %%b EX %u", key,
-			(unsigned)(uint32_t)ttl);
+		n = snprintf(cmdbuf, sizeof(cmdbuf), "SETEX %s %u %%b", key,
+			(uint32_t)ttl);
 	}


@@ -495,12 +311,11 @@ redis_store(struct module_env* env, struct cachedb_env* cachedb_env,
 		return;
 	}

-	rep = redis_command(env, cachedb_env, cmdbuf, data, data_len, 1);
+	rep = redis_command(env, cachedb_env, cmdbuf, data, data_len);
 	if(rep) {
 		verbose(VERB_ALGO, "redis_store set completed");
 		if(rep->type != REDIS_REPLY_STATUS &&
-			rep->type != REDIS_REPLY_ERROR &&
-			rep->type != REDIS_REPLY_INTEGER) {
+			rep->type != REDIS_REPLY_ERROR) {
 			log_err("redis_store: unexpected type of reply (%d)",
 				rep->type);
 		}
@@ -47,7 +47,7 @@
 #define SHA512_Update SHA512Update
 #define SHA512_Final SHA512Final
 #else
-#include <openssl/sha.h>
+#include "openssl/sha.h"
 #endif

 #include <sys/vfs.h>
@@ -5,8 +5,12 @@
 #undef malloc
 #include <sys/types.h>

+#ifndef USE_WINSOCK
+void *malloc ();
+#else
 /* provide a prototype */
 void *malloc (size_t n);
+#endif

 /* Allocate an N-byte block of memory from the heap.
   If N is zero, allocate a 1-byte block.  */
@@ -1,8 +1,5 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */

-/* apply the fallthrough attribute. */
-#undef ATTR_FALLTHROUGH
-
 /* apply the noreturn attribute to a function that exits the program */
 #undef ATTR_NORETURN

@@ -60,9 +57,6 @@
 /* Define to 1 if you have the <arpa/inet.h> header file. */
 #undef HAVE_ARPA_INET_H

-/* Whether the C compiler accepts the "fallthrough" attribute */
-#undef HAVE_ATTR_FALLTHROUGH
-
 /* Whether the C compiler accepts the "format" attribute */
 #undef HAVE_ATTR_FORMAT

@@ -129,14 +123,6 @@
   and to 0 if you don't. */
 #undef HAVE_DECL_NGHTTP2_SESSION_SERVER_NEW

-/* Define to 1 if you have the declaration of `ngtcp2_conn_server_new', and to
-   0 if you don't. */
-#undef HAVE_DECL_NGTCP2_CONN_SERVER_NEW
-
-/* Define to 1 if you have the declaration of `ngtcp2_crypto_encrypt_cb', and
-   to 0 if you don't. */
-#undef HAVE_DECL_NGTCP2_CRYPTO_ENCRYPT_CB
-
 /* Define to 1 if you have the declaration of `NID_ED25519', and to 0 if you
   don't. */
 #undef HAVE_DECL_NID_ED25519
@@ -378,12 +364,6 @@
 /* Define if we have LibreSSL */
 #undef HAVE_LIBRESSL

-/* If we have atomic_store */
-#undef HAVE_LINK_ATOMIC_STORE
-
-/* Define to 1 if you have the <linux/net_tstamp.h> header file. */
-#undef HAVE_LINUX_NET_TSTAMP_H
-
 /* Define to 1 if you have the `localtime_r' function. */
 #undef HAVE_LOCALTIME_R

@@ -396,8 +376,8 @@
 /* Define to 1 if you have the `memmove' function. */
 #undef HAVE_MEMMOVE

-/* Define to 1 if you have the <minix/config.h> header file. */
-#undef HAVE_MINIX_CONFIG_H
+/* Define to 1 if you have the <memory.h> header file. */
+#undef HAVE_MEMORY_H

 /* Define to 1 if you have the <netdb.h> header file. */
 #undef HAVE_NETDB_H
@@ -423,74 +403,12 @@
 /* Define to 1 if you have the <net/if.h> header file. */
 #undef HAVE_NET_IF_H

-/* Define to 1 if you have the <net/pfvar.h> header file. */
-#undef HAVE_NET_PFVAR_H
-
 /* Define this to use nghttp2 client. */
 #undef HAVE_NGHTTP2

 /* Define to 1 if you have the <nghttp2/nghttp2.h> header file. */
 #undef HAVE_NGHTTP2_NGHTTP2_H

-/* Define this to use ngtcp2. */
-#undef HAVE_NGTCP2
-
-/* Define to 1 if you have the `ngtcp2_ccerr_default' function. */
-#undef HAVE_NGTCP2_CCERR_DEFAULT
-
-/* Define to 1 if you have the `ngtcp2_conn_encode_0rtt_transport_params'
-   function. */
-#undef HAVE_NGTCP2_CONN_ENCODE_0RTT_TRANSPORT_PARAMS
-
-/* Define to 1 if you have the `ngtcp2_conn_get_max_local_streams_uni'
-   function. */
-#undef HAVE_NGTCP2_CONN_GET_MAX_LOCAL_STREAMS_UNI
-
-/* Define to 1 if you have the `ngtcp2_conn_get_num_scid' function. */
-#undef HAVE_NGTCP2_CONN_GET_NUM_SCID
-
-/* Define to 1 if you have the `ngtcp2_conn_in_closing_period' function. */
-#undef HAVE_NGTCP2_CONN_IN_CLOSING_PERIOD
-
-/* Define to 1 if you have the `ngtcp2_conn_in_draining_period' function. */
-#undef HAVE_NGTCP2_CONN_IN_DRAINING_PERIOD
-
-/* Define if ngtcp2_conn_shutdown_stream has 4 arguments. */
-#undef HAVE_NGTCP2_CONN_SHUTDOWN_STREAM4
-
-/* Define to 1 if you have the `ngtcp2_conn_tls_early_data_rejected' function.
-   */
-#undef HAVE_NGTCP2_CONN_TLS_EARLY_DATA_REJECTED
-
-/* Define to 1 if you have the `ngtcp2_crypto_encrypt_cb' function. */
-#undef HAVE_NGTCP2_CRYPTO_ENCRYPT_CB
-
-/* Define to 1 if you have the
-   `ngtcp2_crypto_quictls_configure_client_context' function. */
-#undef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_CLIENT_CONTEXT
-
-/* Define to 1 if you have the
-   `ngtcp2_crypto_quictls_configure_server_context' function. */
-#undef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_SERVER_CONTEXT
-
-/* Define to 1 if you have the
-   `ngtcp2_crypto_quictls_from_ossl_encryption_level' function. */
-#undef HAVE_NGTCP2_CRYPTO_QUICTLS_FROM_OSSL_ENCRYPTION_LEVEL
-
-/* Define to 1 if the system has the type `ngtcp2_encryption_level'. */
-#undef HAVE_NGTCP2_ENCRYPTION_LEVEL
-
-/* Define to 1 if you have the <ngtcp2/ngtcp2_crypto_openssl.h> header file.
-   */
-#undef HAVE_NGTCP2_NGTCP2_CRYPTO_OPENSSL_H
-
-/* Define to 1 if you have the <ngtcp2/ngtcp2_crypto_quictls.h> header file.
-   */
-#undef HAVE_NGTCP2_NGTCP2_CRYPTO_QUICTLS_H
-
-/* Define to 1 if you have the <ngtcp2/ngtcp2.h> header file. */
-#undef HAVE_NGTCP2_NGTCP2_H
-
 /* Use libnss for crypto */
 #undef HAVE_NSS

@@ -645,9 +563,6 @@
   function. */
 #undef HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_EVP_CB

-/* Define to 1 if you have the `SSL_CTX_set_tmp_ecdh' function. */
-#undef HAVE_SSL_CTX_SET_TMP_ECDH
-
 /* Define to 1 if you have the `SSL_get0_alpn_selected' function. */
 #undef HAVE_SSL_GET0_ALPN_SELECTED

@@ -657,27 +572,18 @@
 /* Define to 1 if you have the `SSL_get1_peer_certificate' function. */
 #undef HAVE_SSL_GET1_PEER_CERTIFICATE

-/* Define to 1 if you have the `SSL_is_quic' function. */
-#undef HAVE_SSL_IS_QUIC
-
 /* Define to 1 if you have the `SSL_set1_host' function. */
 #undef HAVE_SSL_SET1_HOST

 /* Define to 1 if you have the <stdarg.h> header file. */
 #undef HAVE_STDARG_H

-/* Define to 1 if you have the <stdatomic.h> header file. */
-#undef HAVE_STDATOMIC_H
-
 /* Define to 1 if you have the <stdbool.h> header file. */
 #undef HAVE_STDBOOL_H

 /* Define to 1 if you have the <stdint.h> header file. */
 #undef HAVE_STDINT_H

-/* Define to 1 if you have the <stdio.h> header file. */
-#undef HAVE_STDIO_H
-
 /* Define to 1 if you have the <stdlib.h> header file. */
 #undef HAVE_STDLIB_H

@@ -705,23 +611,6 @@
 /* Define to 1 if `ipi_spec_dst' is a member of `struct in_pktinfo'. */
 #undef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST

-/* Define to 1 if `tokenlen' is a member of `struct ngtcp2_pkt_hd'. */
-#undef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN
-
-/* Define to 1 if `max_tx_udp_payload_size' is a member of `struct
-   ngtcp2_settings'. */
-#undef HAVE_STRUCT_NGTCP2_SETTINGS_MAX_TX_UDP_PAYLOAD_SIZE
-
-/* Define to 1 if `tokenlen' is a member of `struct ngtcp2_settings'. */
-#undef HAVE_STRUCT_NGTCP2_SETTINGS_TOKENLEN
-
-/* Define to 1 if `original_dcid_present' is a member of `struct
-   ngtcp2_transport_params'. */
-#undef HAVE_STRUCT_NGTCP2_TRANSPORT_PARAMS_ORIGINAL_DCID_PRESENT
-
-/* Define to 1 if the system has the type `struct ngtcp2_version_cid'. */
-#undef HAVE_STRUCT_NGTCP2_VERSION_CID
-
 /* Define to 1 if `sun_len' is a member of `struct sockaddr_un'. */
 #undef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN

@@ -797,9 +686,6 @@
 /* Define to 1 if you have the <vfork.h> header file. */
 #undef HAVE_VFORK_H

-/* Define to 1 if you have the <wchar.h> header file. */
-#undef HAVE_WCHAR_H
-
 /* Define to 1 if you have the <windows.h> header file. */
 #undef HAVE_WINDOWS_H

@@ -941,9 +827,7 @@
 /* Define to 1 if libsodium supports sodium_set_misuse_handler */
 #undef SODIUM_MISUSE_HANDLER

-/* Define to 1 if all of the C90 standard headers exist (not just the ones
-   required in a freestanding environment). This macro is provided for
-   backward compatibility; new code need not use it. */
+/* Define to 1 if you have the ANSI C header files. */
 #undef STDC_HEADERS

 /* use default strptime. */
@@ -1039,87 +923,21 @@
 #ifndef _ALL_SOURCE
 # undef _ALL_SOURCE
 #endif
-/* Enable general extensions on macOS.  */
-#ifndef _DARWIN_C_SOURCE
-# undef _DARWIN_C_SOURCE
-#endif
-/* Enable general extensions on Solaris.  */
-#ifndef __EXTENSIONS__
-# undef __EXTENSIONS__
-#endif
 /* Enable GNU extensions on systems that have them.  */
 #ifndef _GNU_SOURCE
 # undef _GNU_SOURCE
 #endif
-/* Enable X/Open compliant socket functions that do not require linking
-   with -lxnet on HP-UX 11.11.  */
-#ifndef _HPUX_ALT_XOPEN_SOCKET_API
-# undef _HPUX_ALT_XOPEN_SOCKET_API
-#endif
-/* Identify the host operating system as Minix.
-   This macro does not affect the system headers' behavior.
-   A future release of Autoconf may stop defining this macro.  */
-#ifndef _MINIX
-# undef _MINIX
-#endif
-/* Enable general extensions on NetBSD.
-   Enable NetBSD compatibility extensions on Minix.  */
-#ifndef _NETBSD_SOURCE
-# undef _NETBSD_SOURCE
-#endif
-/* Enable OpenBSD compatibility extensions on NetBSD.
-   Oddly enough, this does nothing on OpenBSD.  */
-#ifndef _OPENBSD_SOURCE
-# undef _OPENBSD_SOURCE
-#endif
-/* Define to 1 if needed for POSIX-compatible behavior.  */
-#ifndef _POSIX_SOURCE
-# undef _POSIX_SOURCE
-#endif
-/* Define to 2 if needed for POSIX-compatible behavior.  */
-#ifndef _POSIX_1_SOURCE
-# undef _POSIX_1_SOURCE
-#endif
-/* Enable POSIX-compatible threading on Solaris.  */
+/* Enable threading extensions on Solaris.  */
 #ifndef _POSIX_PTHREAD_SEMANTICS
 # undef _POSIX_PTHREAD_SEMANTICS
 #endif
-/* Enable extensions specified by ISO/IEC TS 18661-5:2014.  */
-#ifndef __STDC_WANT_IEC_60559_ATTRIBS_EXT__
-# undef __STDC_WANT_IEC_60559_ATTRIBS_EXT__
-#endif
-/* Enable extensions specified by ISO/IEC TS 18661-1:2014.  */
-#ifndef __STDC_WANT_IEC_60559_BFP_EXT__
-# undef __STDC_WANT_IEC_60559_BFP_EXT__
-#endif
-/* Enable extensions specified by ISO/IEC TS 18661-2:2015.  */
-#ifndef __STDC_WANT_IEC_60559_DFP_EXT__
-# undef __STDC_WANT_IEC_60559_DFP_EXT__
-#endif
-/* Enable extensions specified by ISO/IEC TS 18661-4:2015.  */
-#ifndef __STDC_WANT_IEC_60559_FUNCS_EXT__
-# undef __STDC_WANT_IEC_60559_FUNCS_EXT__
-#endif
-/* Enable extensions specified by ISO/IEC TS 18661-3:2015.  */
-#ifndef __STDC_WANT_IEC_60559_TYPES_EXT__
-# undef __STDC_WANT_IEC_60559_TYPES_EXT__
-#endif
-/* Enable extensions specified by ISO/IEC TR 24731-2:2010.  */
-#ifndef __STDC_WANT_LIB_EXT2__
-# undef __STDC_WANT_LIB_EXT2__
-#endif
-/* Enable extensions specified by ISO/IEC 24747:2009.  */
-#ifndef __STDC_WANT_MATH_SPEC_FUNCS__
-# undef __STDC_WANT_MATH_SPEC_FUNCS__
-#endif
 /* Enable extensions on HP NonStop.  */
 #ifndef _TANDEM_SOURCE
 # undef _TANDEM_SOURCE
 #endif
-/* Enable X/Open extensions.  Define to 500 only if necessary
-   to make mbstate_t available.  */
-#ifndef _XOPEN_SOURCE
-# undef _XOPEN_SOURCE
+/* Enable general extensions on Solaris.  */
+#ifndef __EXTENSIONS__
+# undef __EXTENSIONS__
 #endif


@@ -1145,6 +963,11 @@
   `char[]'. */
 #undef YYTEXT_POINTER

+/* Enable large inode numbers on Mac OS X 10.5.  */
+#ifndef _DARWIN_USE_64_BIT_INODE
+# define _DARWIN_USE_64_BIT_INODE 1
+#endif
+
 /* Number of bits in a file offset, on hosts where this is settable. */
 #undef _FILE_OFFSET_BITS

@@ -1154,9 +977,19 @@
 /* Define for large files, on AIX-style hosts. */
 #undef _LARGE_FILES

+/* Define to 1 if on MINIX. */
+#undef _MINIX
+
 /* Enable for compile on Minix */
 #undef _NETBSD_SOURCE

+/* Define to 2 if the system does not provide POSIX.1 features except with
+   this defined. */
+#undef _POSIX_1_SOURCE
+
+/* Define to 1 if you need to in order for `stat' and other things to work. */
+#undef _POSIX_SOURCE
+
 /* defined to use gcc ansi snprintf and sscanf that understands %lld when
   compiled for windows. */
 #undef __USE_MINGW_ANSI_STDIO
@@ -1197,7 +1030,7 @@
 /* Define to `long int' if <sys/types.h> does not define. */
 #undef off_t

-/* Define as a signed integer type capable of holding a process identifier. */
+/* Define to `int' if <sys/types.h> does not define. */
 #undef pid_t

 /* Define to 'int' if not defined */
@@ -1235,39 +1068,39 @@

 #if defined(OMITTED__D_GNU_SOURCE) && !defined(_GNU_SOURCE)
 #define _GNU_SOURCE 1
-#endif
+#endif 

 #if defined(OMITTED__D_BSD_SOURCE) && !defined(_BSD_SOURCE)
 #define _BSD_SOURCE 1
-#endif
+#endif 

 #if defined(OMITTED__D_DEFAULT_SOURCE) && !defined(_DEFAULT_SOURCE)
 #define _DEFAULT_SOURCE 1
-#endif
+#endif 

 #if defined(OMITTED__D__EXTENSIONS__) && !defined(__EXTENSIONS__)
 #define __EXTENSIONS__ 1
-#endif
+#endif 

 #if defined(OMITTED__D_POSIX_C_SOURCE_200112) && !defined(_POSIX_C_SOURCE)
 #define _POSIX_C_SOURCE 200112
-#endif
+#endif 

 #if defined(OMITTED__D_XOPEN_SOURCE_600) && !defined(_XOPEN_SOURCE)
 #define _XOPEN_SOURCE 600
-#endif
+#endif 

 #if defined(OMITTED__D_XOPEN_SOURCE_EXTENDED_1) && !defined(_XOPEN_SOURCE_EXTENDED)
 #define _XOPEN_SOURCE_EXTENDED 1
-#endif
+#endif 

 #if defined(OMITTED__D_ALL_SOURCE) && !defined(_ALL_SOURCE)
 #define _ALL_SOURCE 1
-#endif
+#endif 

 #if defined(OMITTED__D_LARGEFILE_SOURCE_1) && !defined(_LARGEFILE_SOURCE)
 #define _LARGEFILE_SOURCE 1
-#endif
+#endif 



@@ -1351,7 +1184,7 @@
 #endif


-
+ 
 #ifdef HAVE_ATTR_FORMAT
 #  define ATTR_FORMAT(archetype, string_index, first_to_check) \
    __attribute__ ((format (archetype, string_index, first_to_check)))
@@ -1461,7 +1294,7 @@ void* reallocarray(void *ptr, size_t nmemb, size_t size);
 #ifdef HAVE_WINSOCK2_H
 #define FD_SET_T (u_int)
 #else
-#define FD_SET_T
+#define FD_SET_T 
 #endif


@@ -1589,10 +1422,6 @@ struct sockaddr_storage;
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
 #  define free(p) unbound_stat_free_log(p, __FILE__, __LINE__, __func__)
 #  define realloc(p,s) unbound_stat_realloc_log(p, s, __FILE__, __LINE__, __func__)
-#  define strdup(s) unbound_stat_strdup_log(s, __FILE__, __LINE__, __func__)
-#ifdef HAVE_REALLOCARRAY
-#  define reallocarray(p,n,s) unbound_stat_reallocarray_log(p, n, s, __FILE__, __LINE__, __func__)
-#endif
 void *unbound_stat_malloc(size_t size);
 void *unbound_stat_calloc(size_t nmemb, size_t size);
 void unbound_stat_free(void *ptr);
@@ -1605,10 +1434,6 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-void *unbound_stat_reallocarray_log(void *ptr, size_t nmemb, size_t size,
-	const char* file, int line, const char* func);
-char *unbound_stat_strdup_log(const char *s, const char* file, int line,
-	const char* func);
 #elif defined(UNBOUND_ALLOC_LITE)
 #  include "util/alloc.h"
 #endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */
@@ -1619,8 +1444,6 @@ char *unbound_stat_strdup_log(const char *s, const char* file, int line,
 #define UNBOUND_DNS_OVER_TLS_PORT 853
 /** default port for DNS over HTTPS traffic. */
 #define UNBOUND_DNS_OVER_HTTPS_PORT 443
-/** default port for DNS over QUIC traffic. */
-#define UNBOUND_DNS_OVER_QUIC_PORT 853
 /** default port for unbound control traffic, registered port with IANA,
    ub-dns-control  8953/tcp    unbound dns nameserver control */
 #define UNBOUND_CONTROL_PORT 8953
@@ -2,24 +2,23 @@
 # Process this file with autoconf to produce a configure script.
 AC_PREREQ([2.56])
 sinclude(acx_nlnetlabs.m4)
-sinclude(ax_build_date_epoch.m4)
 sinclude(ax_pthread.m4)
 sinclude(acx_python.m4)
-sinclude(ax_pkg_swig.m4)
+sinclude(ac_pkg_swig.m4)
 sinclude(dnstap/dnstap.m4)
 sinclude(dnscrypt/dnscrypt.m4)

 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[23])
-m4_define([VERSION_MICRO],[0])
+m4_define([VERSION_MINOR],[17])
+m4_define([VERSION_MICRO],[1])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])

 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=31
+LIBUNBOUND_REVISION=21
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -108,16 +107,6 @@ LIBUNBOUND_AGE=1
 # 1.16.3 had 9:19:1
 # 1.17.0 had 9:20:1
 # 1.17.1 had 9:21:1
-# 1.18.0 had 9:22:1
-# 1.19.0 had 9:23:1
-# 1.19.1 had 9:24:1
-# 1.19.2 had 9:25:1
-# 1.19.3 had 9:26:1
-# 1.20.0 had 9:27:1
-# 1.21.0 had 9:28:1
-# 1.21.1 had 9:29:1
-# 1.22.0 had 9:30:1
-# 1.23.0 had 9:31:1

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -167,7 +156,7 @@ esac

 # are we on MinGW?
 if uname -s 2>&1 | grep MINGW >/dev/null; then on_mingw="yes"
-else
+else 
 	if echo $host | grep mingw >/dev/null; then on_mingw="yes"
 	else on_mingw="no"; fi
 fi
@@ -196,9 +185,9 @@ ub_conf_dir=`AS_DIRNAME(["$ub_conf_file"])`
 AC_SUBST(ub_conf_dir)

 # Determine run, chroot directory and pidfile locations
-AC_ARG_WITH(run-dir,
-    AS_HELP_STRING([--with-run-dir=path],[set default directory to chdir to (by default dir part of cfg file)]),
-    UNBOUND_RUN_DIR="$withval",
+AC_ARG_WITH(run-dir, 
+    AS_HELP_STRING([--with-run-dir=path],[set default directory to chdir to (by default dir part of cfg file)]), 
+    UNBOUND_RUN_DIR="$withval", 
 if test $on_mingw = no; then
    UNBOUND_RUN_DIR=`dirname "$ub_conf_file"`
 else
@@ -209,9 +198,9 @@ AC_SUBST(UNBOUND_RUN_DIR)
 ACX_ESCAPE_BACKSLASH($UNBOUND_RUN_DIR, hdr_run)
 AC_DEFINE_UNQUOTED(RUN_DIR, ["$hdr_run"], [Directory to chdir to])

-AC_ARG_WITH(chroot-dir,
-    AS_HELP_STRING([--with-chroot-dir=path],[set default directory to chroot to (by default same as run-dir)]),
-    UNBOUND_CHROOT_DIR="$withval",
+AC_ARG_WITH(chroot-dir, 
+    AS_HELP_STRING([--with-chroot-dir=path],[set default directory to chroot to (by default same as run-dir)]), 
+    UNBOUND_CHROOT_DIR="$withval", 
 if test $on_mingw = no; then
    UNBOUND_CHROOT_DIR="$UNBOUND_RUN_DIR"
 else
@@ -229,9 +218,9 @@ AC_ARG_WITH(share-dir,
 AC_SUBST(UNBOUND_SHARE_DIR)
 AC_DEFINE_UNQUOTED(SHARE_DIR, ["$UNBOUND_SHARE_DIR"], [Shared data])

-AC_ARG_WITH(pidfile,
-    AS_HELP_STRING([--with-pidfile=filename],[set default pathname to unbound pidfile (default run-dir/unbound.pid)]),
-    UNBOUND_PIDFILE="$withval",
+AC_ARG_WITH(pidfile, 
+    AS_HELP_STRING([--with-pidfile=filename],[set default pathname to unbound pidfile (default run-dir/unbound.pid)]), 
+    UNBOUND_PIDFILE="$withval", 
 if test $on_mingw = no; then
    UNBOUND_PIDFILE="$UNBOUND_RUN_DIR/unbound.pid"
 else
@@ -242,9 +231,9 @@ AC_SUBST(UNBOUND_PIDFILE)
 ACX_ESCAPE_BACKSLASH($UNBOUND_PIDFILE, hdr_pid)
 AC_DEFINE_UNQUOTED(PIDFILE, ["$hdr_pid"], [default pidfile location])

-AC_ARG_WITH(rootkey-file,
-    AS_HELP_STRING([--with-rootkey-file=filename],[set default pathname to root key file (default run-dir/root.key). This file is read and written.]),
-    UNBOUND_ROOTKEY_FILE="$withval",
+AC_ARG_WITH(rootkey-file, 
+    AS_HELP_STRING([--with-rootkey-file=filename],[set default pathname to root key file (default run-dir/root.key). This file is read and written.]), 
+    UNBOUND_ROOTKEY_FILE="$withval", 
 if test $on_mingw = no; then
    UNBOUND_ROOTKEY_FILE="$UNBOUND_RUN_DIR/root.key"
 else
@@ -255,9 +244,9 @@ AC_SUBST(UNBOUND_ROOTKEY_FILE)
 ACX_ESCAPE_BACKSLASH($UNBOUND_ROOTKEY_FILE, hdr_rkey)
 AC_DEFINE_UNQUOTED(ROOT_ANCHOR_FILE, ["$hdr_rkey"], [default rootkey location])

-AC_ARG_WITH(rootcert-file,
-    AS_HELP_STRING([--with-rootcert-file=filename],[set default pathname to root update certificate file (default run-dir/icannbundle.pem).  This file need not exist if you are content with the builtin.]),
-    UNBOUND_ROOTCERT_FILE="$withval",
+AC_ARG_WITH(rootcert-file, 
+    AS_HELP_STRING([--with-rootcert-file=filename],[set default pathname to root update certificate file (default run-dir/icannbundle.pem).  This file need not exist if you are content with the builtin.]), 
+    UNBOUND_ROOTCERT_FILE="$withval", 
 if test $on_mingw = no; then
    UNBOUND_ROOTCERT_FILE="$UNBOUND_RUN_DIR/icannbundle.pem"
 else
@@ -268,9 +257,9 @@ AC_SUBST(UNBOUND_ROOTCERT_FILE)
 ACX_ESCAPE_BACKSLASH($UNBOUND_ROOTCERT_FILE, hdr_rpem)
 AC_DEFINE_UNQUOTED(ROOT_CERT_FILE, ["$hdr_rpem"], [default rootcert location])

-AC_ARG_WITH(username,
-    AS_HELP_STRING([--with-username=user],[set default user that unbound changes to (default user is unbound)]),
-    UNBOUND_USERNAME="$withval",
+AC_ARG_WITH(username, 
+    AS_HELP_STRING([--with-username=user],[set default user that unbound changes to (default user is unbound)]), 
+    UNBOUND_USERNAME="$withval", 
    UNBOUND_USERNAME="unbound")
 AC_SUBST(UNBOUND_USERNAME)
 AC_DEFINE_UNQUOTED(UB_USERNAME, ["$UNBOUND_USERNAME"], [default username])
@@ -279,9 +268,6 @@ AC_DEFINE(WINVER, 0x0502, [the version of the windows API enabled])
 ACX_RSRC_VERSION(wnvs)
 AC_DEFINE_UNQUOTED(RSRC_PACKAGE_VERSION, [$wnvs], [version number for resource files])

-# Check for 'grep -e' program, here, since ACX_CHECK_FLTO needs that.
-AC_PROG_GREP
-
 # Checks for typedefs, structures, and compiler characteristics.
 AC_C_CONST
 AC_LANG([C])
@@ -292,14 +278,14 @@ ACX_CHECK_COMPILER_FLAG(g, [CFLAGS="$CFLAGS -g"])
 ACX_CHECK_COMPILER_FLAG(O2, [CFLAGS="$CFLAGS -O2"])
 default_cflags=yes
 fi
-m4_version_prereq([2.70], [AC_PROG_CC], [AC_PROG_CC_STDC])
+AC_PROG_CC
 ACX_DEPFLAG
 ACX_DETERMINE_EXT_FLAGS_UNBOUND

 # debug mode flags warnings
 AC_ARG_ENABLE(checking, AS_HELP_STRING([--enable-checking],[Enable warnings, asserts, makefile-dependencies]))
 AC_ARG_ENABLE(debug, AS_HELP_STRING([--enable-debug],[same as enable-checking]))
-if test "$enable_debug" = "yes"; then debug_enabled="$enable_debug";
+if test "$enable_debug" = "yes"; then debug_enabled="$enable_debug"; 
 else debug_enabled="$enable_checking"; fi
 AC_SUBST(debug_enabled)
 case "$debug_enabled" in
@@ -343,8 +329,6 @@ AC_MSG_RESULT($ac_cv_c_weak_attribute)
 if test $ac_cv_c_weak_attribute = yes; then
  AC_DEFINE(HAVE_ATTR_WEAK, 1, [Whether the C compiler accepts the "weak" attribute])
  AC_DEFINE(ATTR_WEAK, [__attribute__((weak))], [apply the weak attribute to a symbol])
-else
-  AC_DEFINE(ATTR_WEAK,[], [apply the weak attribute to a symbol])
 fi
 ])dnl End of CHECK_WEAK_ATTRIBUTE

@@ -366,54 +350,11 @@ AC_MSG_RESULT($ac_cv_c_noreturn_attribute)
 if test $ac_cv_c_noreturn_attribute = yes; then
  AC_DEFINE(HAVE_ATTR_NORETURN, 1, [Whether the C compiler accepts the "noreturn" attribute])
  AC_DEFINE(ATTR_NORETURN, [__attribute__((__noreturn__))], [apply the noreturn attribute to a function that exits the program])
-else
-  AC_DEFINE(ATTR_NORETURN,[], [apply the noreturn attribute to a function that exits the program])
 fi
 ])dnl End of CHECK_NORETURN_ATTRIBUTE

 CHECK_NORETURN_ATTRIBUTE

-AC_DEFUN([CHECK_FALLTHROUGH_ATTRIBUTE],
-[AC_REQUIRE([AC_PROG_CC])
-AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "fallthrough" attribute)
-BAKCFLAGS="$CFLAGS"
-CFLAGS="$CFLAGS -Werror"
-AC_CACHE_VAL(ac_cv_c_fallthrough_attribute,
-[ac_cv_c_fallthrough_attribute=no
-AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h>
-void f(int x) {
-	int y = 0;
-	switch(x) {
-	case 1:
-		y = 1;
-		__attribute__((fallthrough));
-		/* fallthrough */
-	case 2:
-		y++;
-		break;
-	case 3:
-		y = 3;
-		break;
-	}
-	printf("%d", y);
-}
-]], [[
-   f(1);
-]])],[ac_cv_c_fallthrough_attribute="yes"],[ac_cv_c_fallthrough_attribute="no"])
-])
-CFLAGS="$BAKCFLAGS"
-
-AC_MSG_RESULT($ac_cv_c_fallthrough_attribute)
-if test $ac_cv_c_fallthrough_attribute = yes; then
-  AC_DEFINE(HAVE_ATTR_FALLTHROUGH, 1, [Whether the C compiler accepts the "fallthrough" attribute])
-  AC_DEFINE(ATTR_FALLTHROUGH, [__attribute__((fallthrough));], [apply the fallthrough attribute.])
-else
-  AC_DEFINE(ATTR_FALLTHROUGH,[], [apply the fallthrough attribute.])
-fi
-])dnl End of CHECK_FALLTHROUGH_ATTRIBUTE
-
-CHECK_FALLTHROUGH_ATTRIBUTE
-
 if test "$srcdir" != "."; then
 	CPPFLAGS="$CPPFLAGS -I$srcdir"
 fi
@@ -447,23 +388,13 @@ fi
 if test "$LEX" != "" -a "$LEX" != ":"; then
 ACX_YYLEX_OPTION
 fi
-if test "$LEX" = "" -o "$LEX" = ":"; then
-	if test ! -f util/configlexer.c; then
-		AC_MSG_ERROR([no lex and no util/configlexer.c: need flex and bison to compile from source repository.])
-	fi
-fi
 AC_PROG_YACC
-if test "$YACC" = "" -o "$YACC" = ":"; then
-	if test ! -f util/configparser.c; then
-		AC_MSG_ERROR([no yacc and no util/configparser.c: need flex and bison to compile from source repository.])
-	fi
-fi
 AC_CHECK_PROG(doxygen, doxygen, doxygen)
 AC_CHECK_TOOL(STRIP, strip)
 ACX_LIBTOOL_C_ONLY

 # pkg-config is only needed for these options, do not require it otherwise
-if test "$enable_systemd" = "yes" -o "$enable_dnstap" = "yes" -o "$with_pyunbound" = "yes" -o "$with_pythonmod" = "yes"; then
+if test "$enable_systemd" = "yes" -o "$with_pyunbound" = "yes" -o "$with_pythonmod" = "yes"; then
 PKG_PROG_PKG_CONFIG
 fi

@@ -522,10 +453,6 @@ AC_CHECK_HEADERS([netioapi.h],,, [AC_INCLUDES_DEFAULT
 #endif
 ])

-# Check for Linux timestamping headers
-AC_CHECK_HEADERS([linux/net_tstamp.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_HEADERS([stdatomic.h],,, [AC_INCLUDES_DEFAULT])
-
 # check for types.  
 # Using own tests for int64* because autoconf builtin only give 32bit.
 AC_CHECK_TYPE(int8_t, signed char)
@@ -584,8 +511,7 @@ res = strptime("2010-07-15T00:00:00+00:00", "%t%Y%t-%t%m%t-%t%d%tT%t%H%t:%t%M%t:
 if (!res) return 2;
 res = strptime("20070207111842", "%Y%m%d%H%M%S", &tm);
 if (!res) return 1; return 0; }
-]])] , [eval "ac_cv_c_strptime_works=yes"], [eval "ac_cv_c_strptime_works=no"],
-[eval "ac_cv_c_strptime_works=maybe"])
+]])] , [eval "ac_cv_c_strptime_works=yes"], [eval "ac_cv_c_strptime_works=no"])
 else
 eval "ac_cv_c_strptime_works=maybe"
 fi
@@ -622,11 +548,11 @@ sinclude(systemd.m4)
 # Include systemd.m4 - end

 # set memory allocation checking if requested
-AC_ARG_ENABLE(alloc-checks, AS_HELP_STRING([--enable-alloc-checks],[ enable to memory allocation statistics, for debug purposes ]),
+AC_ARG_ENABLE(alloc-checks, AS_HELP_STRING([--enable-alloc-checks],[ enable to memory allocation statistics, for debug purposes ]), 
 	, )
-AC_ARG_ENABLE(alloc-lite, AS_HELP_STRING([--enable-alloc-lite],[ enable for lightweight alloc assertions, for debug purposes ]),
+AC_ARG_ENABLE(alloc-lite, AS_HELP_STRING([--enable-alloc-lite],[ enable for lightweight alloc assertions, for debug purposes ]), 
 	, )
-AC_ARG_ENABLE(alloc-nonregional, AS_HELP_STRING([--enable-alloc-nonregional],[ enable nonregional allocs, slow but exposes regional allocations to other memory purifiers, for debug purposes ]),
+AC_ARG_ENABLE(alloc-nonregional, AS_HELP_STRING([--enable-alloc-nonregional],[ enable nonregional allocs, slow but exposes regional allocations to other memory purifiers, for debug purposes ]), 
 	, )
 if test x_$enable_alloc_nonregional = x_yes; then
 	AC_DEFINE(UNBOUND_ALLOC_NONREGIONAL, 1, [use malloc not regions, for debug use])
@@ -659,7 +585,7 @@ if test "$on_mingw" = "yes"; then
 ])],
 	AC_MSG_RESULT(yes)
 	AC_DEFINE(HAVE_WINDOWS_THREADS, 1, [Using Windows threads])
-,
+,	
 	AC_MSG_RESULT(no)
 )

@@ -670,7 +596,7 @@ else
 # check this first, so that the pthread lib does not get linked in via
 # libssl or libpython, and thus distorts the tests, and we end up using
 # the non-threadsafe C libraries.
-AC_ARG_WITH(pthreads, AS_HELP_STRING([--with-pthreads],[use pthreads library, or --without-pthreads to disable threading support.]),
+AC_ARG_WITH(pthreads, AS_HELP_STRING([--with-pthreads],[use pthreads library, or --without-pthreads to disable threading support.]), 
 [ ],[ withval="yes" ])
 ub_have_pthreads=no
 if test x_$withval != x_no; then
@@ -697,7 +623,7 @@ int main(void) {return 0;}
 		# first compile
 		echo "$CC $CFLAGS -c conftest.c -o conftest.o" >&AS_MESSAGE_LOG_FD
 		$CC $CFLAGS -c conftest.c -o conftest.o 2>&AS_MESSAGE_LOG_FD >&AS_MESSAGE_LOG_FD
-		if test $? = 0; then
+		if test $? = 0; then 
 			# then link
 			echo "$CC $CFLAGS -Werror $LDFLAGS $LIBS -o conftest contest.o" >&AS_MESSAGE_LOG_FD
 			$CC $CFLAGS -Werror $LDFLAGS $LIBS -o conftest conftest.o 2>&AS_MESSAGE_LOG_FD >&AS_MESSAGE_LOG_FD
@@ -718,7 +644,7 @@ int main(void) {return 0;}
 		])
 fi

-# check solaris thread library
+# check solaris thread library 
 AC_ARG_WITH(solaris-threads, AS_HELP_STRING([--with-solaris-threads],[use solaris native thread library.]), [ ],[ withval="no" ])
 ub_have_sol_threads=no
 if test x_$withval != x_no; then
@@ -732,8 +658,8 @@ if test x_$withval != x_no; then
 		ACX_CHECK_COMPILER_FLAG(mt, [CFLAGS="$CFLAGS -mt"],
 			[CFLAGS="$CFLAGS -D_REENTRANT"])
 		ub_have_sol_threads=yes
-	] , [
-		AC_MSG_ERROR([no solaris threads found.])
+	] , [ 
+		AC_MSG_ERROR([no solaris threads found.]) 
 	])
 	fi
 fi
@@ -808,14 +734,7 @@ if test x_$ub_test_python != x_no; then
   ac_save_LIBS="$LIBS" dnl otherwise AC_PYTHON_DEVEL thrashes $LIBS
   AC_PYTHON_DEVEL
   if test ! -z "$PYTHON_VERSION"; then
-	badversion="no"
-	if test "$PYTHON_VERSION_MAJOR" -lt 2; then
-		badversion="yes"
-	fi
-	if test "$PYTHON_VERSION_MAJOR" -eq 2 -a "$PYTHON_VERSION_MINOR" -lt 4; then
-		badversion="yes"
-	fi
-	if test "$badversion" = "yes"; then
+	if test `$PYTHON -c "print('$PYTHON_VERSION' >= '2.4.0')"` = "False"; then
 		AC_MSG_ERROR([Python version >= 2.4.0 is required])
 	fi

@@ -850,9 +769,9 @@ if test x_$ub_test_python != x_no; then
      ub_have_swig=no
      AC_ARG_ENABLE(swig-version-check, AS_HELP_STRING([--disable-swig-version-check],[Disable swig version check to build python modules with older swig even though that is unreliable]))
      if test "$enable_swig_version_check" = "yes"; then
-      	AX_PKG_SWIG(2.0.1)
+      	AC_PROG_SWIG(2.0.1)
      else
-      	AX_PKG_SWIG
+      	AC_PROG_SWIG
      fi
      AC_MSG_CHECKING(SWIG)
      if test ! -x "$SWIG"; then
@@ -910,8 +829,7 @@ if test "`uname`" = "Linux"; then
 	GCC_DOCKER_LINTFLAGS='-syntax'
 	AC_SUBST(GCC_DOCKER_LINTFLAGS)
 fi
-AX_BUILD_DATE_EPOCH(CONFIG_DATE, [%Y%m%d])
-AC_ARG_VAR(SOURCE_DATE_EPOCH, [If it is set, it uses the value of that variable instead of the current time as the build timestamp. The format is a unix timestamp. This enables reproducible build output.])
+CONFIG_DATE=`date +%Y%m%d`
 AC_SUBST(CONFIG_DATE)

 # Checks for libraries.
@@ -995,7 +913,7 @@ else
 	AC_MSG_RESULT([no])
 fi
 AC_CHECK_HEADERS([openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h openssl/core_names.h openssl/param_build.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_default_properties_is_fips_enabled EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params OSSL_PARAM_BLD_new BIO_set_callback_ex SSL_CTX_set_tmp_ecdh])
+AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_default_properties_is_fips_enabled EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params OSSL_PARAM_BLD_new BIO_set_callback_ex])

 # these check_funcs need -lssl
 BAKLIBS="$LIBS"
@@ -1167,7 +1085,7 @@ int load_gost_id(void)
 	EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
 	return gost_id;
 }
-int main(void) {
+int main(void) { 
 	EVP_MD_CTX* ctx;
 	const EVP_MD* md;
 	unsigned char digest[64]; /* its a 256-bit digest, so uses 32 bytes */
@@ -1198,8 +1116,7 @@ int main(void) {
 		return 6;
 	return 0;
 }
-]])] , [eval "ac_cv_c_gost_works=yes"], [eval "ac_cv_c_gost_works=no"],
-[eval "ac_cv_c_gost_works=maybe"])
+]])] , [eval "ac_cv_c_gost_works=yes"], [eval "ac_cv_c_gost_works=no"])
 CFLAGS="$BAKCFLAGS"
 else
 eval "ac_cv_c_gost_works=maybe"
@@ -1232,17 +1149,8 @@ case "$enable_ecdsa" in
      ;;
    *)
      if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
-	      AC_CHECK_FUNC(EVP_PKEY_fromdata, [
-	          # with EVP_PKEY_fromdata, check if EC is not disabled
-	          AC_CHECK_DECL([OPENSSL_NO_EC], [AC_MSG_ERROR([OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa])
-		  ], [], [AC_INCLUDES_DEFAULT
-#include <openssl/evp.h>
-		  ])
-		], [
-		  # without EVP_PKEY_fromdata, older openssl, check for support
-		  AC_CHECK_FUNC(ECDSA_sign, [], [AC_MSG_ERROR([OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa])])
-		  AC_CHECK_FUNC(SHA384_Init, [], [AC_MSG_ERROR([OpenSSL does not support SHA384: please upgrade or rerun with --disable-ecdsa])])
-		])
+	      AC_CHECK_FUNC(ECDSA_sign, [], [AC_MSG_ERROR([OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa])])
+	      AC_CHECK_FUNC(SHA384_Init, [], [AC_MSG_ERROR([OpenSSL does not support SHA384: please upgrade or rerun with --disable-ecdsa])])
 	      AC_CHECK_DECLS([NID_X9_62_prime256v1, NID_secp384r1], [], [AC_MSG_ERROR([OpenSSL does not support the ECDSA curves: please upgrade or rerun with --disable-ecdsa])], [AC_INCLUDES_DEFAULT
 #include <openssl/evp.h>
 	      ])
@@ -1583,64 +1491,6 @@ if test x_$withval = x_yes -o x_$withval != x_no; then
    ])
 fi

-# ngtcp2
-AC_ARG_WITH(libngtcp2, AS_HELP_STRING([--with-libngtcp2=path],[specify explicit path for libngtcp2, for QUIC.]),
-    [ ],[ withval="no" ])
-found_libngtcp2="no"
-if test x_$withval = x_yes -o x_$withval != x_no; then
-   AC_MSG_CHECKING(for libngtcp2)
-   if test x_$withval = x_ -o x_$withval = x_yes; then
-            withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
-   fi
-   for dir in $withval ; do
-            if test -f "$dir/include/ngtcp2/ngtcp2.h"; then
-		found_libngtcp2="yes"
-		dnl assume /usr is in default path.
-		if test "$dir" != "/usr"; then
-                    CPPFLAGS="$CPPFLAGS -I$dir/include"
-		    LDFLAGS="$LDFLAGS -L$dir/lib"
-		fi
-		AC_MSG_RESULT(found in $dir)
-		AC_DEFINE([HAVE_NGTCP2], [1], [Define this to use ngtcp2.])
-		LIBS="$LIBS -lngtcp2"
-                break;
-            fi
-    done
-    if test x_$found_libngtcp2 != x_yes; then
-	AC_MSG_ERROR([Could not find libngtcp2, ngtcp2.h])
-    fi
-    AC_CHECK_HEADERS([ngtcp2/ngtcp2.h ngtcp2/ngtcp2_crypto_openssl.h ngtcp2/ngtcp2_crypto_quictls.h],,, [AC_INCLUDES_DEFAULT])
-    AC_CHECK_DECLS([ngtcp2_conn_server_new], [], [], [AC_INCLUDES_DEFAULT
-    #include <ngtcp2/ngtcp2.h>
-    ])
-    AC_CHECK_DECLS([ngtcp2_crypto_encrypt_cb], [], [], [AC_INCLUDES_DEFAULT
-    #include <ngtcp2/ngtcp2_crypto.h>
-    ])
-    AC_CHECK_LIB([ngtcp2_crypto_openssl], [ngtcp2_crypto_encrypt_cb], [ LIBS="$LIBS -lngtcp2_crypto_openssl" ])
-    AC_CHECK_LIB([ngtcp2_crypto_quictls], [ngtcp2_crypto_encrypt_cb], [ LIBS="$LIBS -lngtcp2_crypto_quictls" ])
-    AC_CHECK_FUNCS([ngtcp2_crypto_encrypt_cb ngtcp2_ccerr_default ngtcp2_conn_in_closing_period ngtcp2_conn_in_draining_period ngtcp2_conn_get_max_local_streams_uni ngtcp2_crypto_quictls_from_ossl_encryption_level ngtcp2_crypto_quictls_configure_server_context ngtcp2_crypto_quictls_configure_client_context ngtcp2_conn_get_num_scid ngtcp2_conn_tls_early_data_rejected ngtcp2_conn_encode_0rtt_transport_params])
-    AC_CHECK_FUNCS([SSL_is_quic], [], [AC_MSG_ERROR([No QUIC support detected in OpenSSL. Need OpenSSL version with QUIC support to enable DNS over QUIC with libngtcp2.])])
-    AC_CHECK_TYPES([struct ngtcp2_version_cid, ngtcp2_encryption_level],,,[AC_INCLUDES_DEFAULT
-    #include <ngtcp2/ngtcp2.h>
-    ])
-    AC_CHECK_MEMBERS([struct ngtcp2_pkt_hd.tokenlen, struct ngtcp2_settings.tokenlen, struct ngtcp2_settings.max_tx_udp_payload_size, struct ngtcp2_transport_params.original_dcid_present],,,[AC_INCLUDES_DEFAULT
-    #include <ngtcp2/ngtcp2.h>
-    ])
-
-    AC_MSG_CHECKING([whether ngtcp2_conn_shutdown_stream has 4 arguments])
-    AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <ngtcp2/ngtcp2.h>
-    ],[
-	(void)ngtcp2_conn_shutdown_stream(NULL, 0, 0, 0);
-    ])],[
-	AC_MSG_RESULT(yes)
-	AC_DEFINE(HAVE_NGTCP2_CONN_SHUTDOWN_STREAM4, 1, [Define if ngtcp2_conn_shutdown_stream has 4 arguments.])
-    ],[
-	AC_MSG_RESULT(no)
-    ])
-
-fi
-
 # set static linking for uninstalled libraries if requested
 AC_SUBST(staticexe)
 staticexe=""
@@ -1651,17 +1501,13 @@ if test x_$enable_static_exe = x_yes; then
 	if test "$on_mingw" = yes; then
 		staticexe="-all-static"
 		# for static compile, include gdi32 and zlib here.
-		if echo "$LIBS" | grep 'lgdi32' >/dev/null; then
+		if echo $LIBS | grep 'lgdi32' >/dev/null; then
 			:
 		else
 			LIBS="$LIBS -lgdi32"
 		fi
 		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
-		if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
-			:
-		else
-			LIBS="$LIBS -l:libssp.a"
-		fi
+		LIBS="$LIBS -l:libssp.a"
 	fi
 fi

@@ -1678,16 +1524,12 @@ if test x_$enable_fully_static = x_yes; then
 			LIBS="$LIBS -lgdi32"
 		fi
 		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
-		if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
-			:
-		else
-			LIBS="$LIBS -l:libssp.a"
-		fi
+		LIBS="$LIBS -l:libssp.a"
 	fi
 fi

 # set lock checking if requested
-AC_ARG_ENABLE(lock_checks, AS_HELP_STRING([--enable-lock-checks],[ enable to check lock and unlock calls, for debug purposes ]),
+AC_ARG_ENABLE(lock_checks, AS_HELP_STRING([--enable-lock-checks],[ enable to check lock and unlock calls, for debug purposes ]), 
 	, )
 if test x_$enable_lock_checks = x_yes; then
 	AC_DEFINE(ENABLE_LOCK_CHECKS, 1, [Define if you want to use debug lock checking (slow).])
@@ -1702,11 +1544,7 @@ if test "$USE_WINSOCK" = 1; then
 #include <windows.h>
 	])
 	AC_CHECK_TOOL(WINDRES, windres)
-	if echo "$LIBS" | grep crypt32 >/dev/null; then
-		LIBS="$LIBS -liphlpapi"
-	else
-		LIBS="$LIBS -liphlpapi -lcrypt32"
-	fi
+	LIBS="$LIBS -liphlpapi -lcrypt32"
 	WINAPPS="unbound-service-install.exe unbound-service-remove.exe anchor-update.exe"
 	AC_SUBST(WINAPPS)
 	WIN_DAEMON_SRC="winrc/win_svc.c winrc/w_inst.c"
@@ -1818,25 +1656,6 @@ AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])
 if echo $host_os | grep darwin8 > /dev/null; then
 	AC_DEFINE(DARWIN_BROKEN_SETREUID, 1, [Define this if on macOSX10.4-darwin8 and setreuid and setregid do not work])
 fi
-
-AC_MSG_CHECKING([for atomic_store])
-AC_LINK_IFELSE([AC_LANG_PROGRAM(AC_INCLUDES_DEFAULT [[
-#ifdef HAVE_STDATOMIC_H
-#include <stdatomic.h>
-#endif
-]], [[
-	int newvar = 5, var = 0;
-	atomic_store((_Atomic int*)&var, newvar);
-	newvar = 0;
-	/* condition to use the variables. */
-	if(var == newvar) return 1;
-]])], [
-	AC_MSG_RESULT(yes)
-	AC_DEFINE(HAVE_LINK_ATOMIC_STORE, 1, [If we have atomic_store])
-], [
-	AC_MSG_RESULT([no])
-])
-
 AC_CHECK_DECLS([inet_pton,inet_ntop], [], [], [
 AC_INCLUDES_DEFAULT
 #ifdef HAVE_NETINET_IN_H
@@ -1874,7 +1693,7 @@ int main(void) { return !(snprintf(NULL, 0, "test") == 4); }
 		AC_MSG_RESULT(no)
 		AC_DEFINE([SNPRINTF_RET_BROKEN], [], [define if (v)snprintf does not return length needed, (but length used)])
 		AC_LIBOBJ(snprintf)
-	  ], [AC_MSG_RESULT(maybe)])
+	  ])
    fi
 fi
 AC_REPLACE_FUNCS(strlcat)
@@ -1975,12 +1794,10 @@ if test x_$enable_lock_checks = x_yes; then
 	UBSYMS="-export-symbols clubsyms.def"
 	cp ${srcdir}/libunbound/ubsyms.def clubsyms.def
 	echo lock_protect >> clubsyms.def
-	echo lock_protect_place >> clubsyms.def
 	echo lock_unprotect >> clubsyms.def
 	echo lock_get_mem >> clubsyms.def
 	echo checklock_start >> clubsyms.def
 	echo checklock_stop >> clubsyms.def
-	echo checklock_set_output_name >> clubsyms.def
 	echo checklock_lock >> clubsyms.def
 	echo checklock_unlock >> clubsyms.def
 	echo checklock_init >> clubsyms.def
@@ -2061,17 +1878,15 @@ case "$enable_ipset" in
 		IPSET_OBJ="ipset.lo"
 		AC_SUBST(IPSET_OBJ)

-		# BSD's pf
-		AC_CHECK_HEADERS([net/pfvar.h], [], [
-		    # mnl
-		    AC_ARG_WITH(libmnl, AS_HELP_STRING([--with-libmnl=path],[specify explicit path for libmnl.]),
+		# mnl
+		AC_ARG_WITH(libmnl, AS_HELP_STRING([--with-libmnl=path],[specify explicit path for libmnl.]),
 			[ ],[ withval="yes" ])
-		    found_libmnl="no"
-		    AC_MSG_CHECKING(for libmnl)
-		    if test x_$withval = x_ -o x_$withval = x_yes; then
+		found_libmnl="no"
+		AC_MSG_CHECKING(for libmnl)
+		if test x_$withval = x_ -o x_$withval = x_yes; then
 			withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
-		    fi
-		    for dir in $withval ; do
+		fi
+		for dir in $withval ; do
 			if test -f "$dir/include/libmnl/libmnl.h" -o -f "$dir/include/libmnl/libmnl/libmnl.h"; then
 				found_libmnl="yes"
 				dnl assume /usr is in default path.
@@ -2089,14 +1904,10 @@ case "$enable_ipset" in
 				LIBS="$LIBS -lmnl"
 				break;
 			fi
-		    done
-		    if test x_$found_libmnl != x_yes; then
-			  AC_MSG_ERROR([Could not find libmnl, libmnl.h])
-		    fi
-		], [
-		  #include <netinet/in.h>
-		  #include <net/if.h>
-		])
+		done
+		if test x_$found_libmnl != x_yes; then
+			AC_MSG_ERROR([Could not find libmnl, libmnl.h])
+		fi
 		;;
    no|*)
    	# nothing
@@ -2112,7 +1923,7 @@ case "$enable_explicit_port_randomisation" in
 esac

 if echo "$host" | $GREP -i -e linux >/dev/null; then
-	AC_ARG_ENABLE(linux-ip-local-port-range, AS_HELP_STRING([--enable-linux-ip-local-port-range], [Define this to enable use of /proc/sys/net/ipv4/ip_local_port_range as a default outgoing port range. This is only for the libunbound on Linux and does not affect unbound resolving daemon itself. This may severely limit the number of available outgoing ports and thus decrease randomness. Define this only when the target system restricts (e.g. some of SELinux enabled distributions) the use of non-ephemeral ports.]))
+	AC_ARG_ENABLE(linux-ip-local-port-range, AC_HELP_STRING([--enable-linux-ip-local-port-range], [Define this to enable use of /proc/sys/net/ipv4/ip_local_port_range as a default outgoing port range. This is only for the libunbound on Linux and does not affect unbound resolving daemon itself. This may severely limit the number of available outgoing ports and thus decrease randomness. Define this only when the target system restricts (e.g. some of SELinux enabled distributions) the use of non-ephemeral ports.]))
 	case "$enable_linux_ip_local_port_range" in
 		yes)
 			AC_DEFINE([USE_LINUX_IP_LOCAL_PORT_RANGE], [1], [Define this to enable use of /proc/sys/net/ipv4/ip_local_port_range as a default outgoing port range. This is only for the libunbound on Linux and does not affect unbound resolving daemon itself. This may severely limit the number of available outgoing ports and thus decrease randomness. Define this only when the target system restricts (e.g. some of SELinux enabled distributions) the use of non-ephemeral ports.])
@@ -2169,11 +1980,11 @@ AC_ARG_WITH(libunbound-only, AS_HELP_STRING([--with-libunbound-only],[do not bui
 	fi
 ])
 if test $ALLTARGET = "alltargets"; then
-	if test $USE_NSS = "yes"; then
-		AC_MSG_ERROR([--with-nss can only be used in combination with --with-libunbound-only.])
+	if test $USE_NSS = "yes"; then 
+		AC_MSG_ERROR([--with-nss can only be used in combination with --with-libunbound-only.])	
 	fi
 	if test $USE_NETTLE = "yes"; then
-		AC_MSG_ERROR([--with-nettle can only be used in combination with --with-libunbound-only.])
+		AC_MSG_ERROR([--with-nettle can only be used in combination with --with-libunbound-only.])	
 	fi
 fi

@@ -2184,7 +1995,7 @@ ACX_STRIP_EXT_FLAGS
 if test -n "$LATE_LDFLAGS"; then
  LDFLAGS="$LATE_LDFLAGS $LDFLAGS"
 fi
-# remove start spaces
+# remove start spaces 
 LDFLAGS=`echo "$LDFLAGS"|sed -e 's/^ *//'`
 LIBS=`echo "$LIBS"|sed -e 's/^ *//'`

@@ -2414,10 +2225,6 @@ struct sockaddr_storage;
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
 #  define free(p) unbound_stat_free_log(p, __FILE__, __LINE__, __func__)
 #  define realloc(p,s) unbound_stat_realloc_log(p, s, __FILE__, __LINE__, __func__)
-#  define strdup(s) unbound_stat_strdup_log(s, __FILE__, __LINE__, __func__)
-#ifdef HAVE_REALLOCARRAY
-#  define reallocarray(p,n,s) unbound_stat_reallocarray_log(p, n, s, __FILE__, __LINE__, __func__)
-#endif
 void *unbound_stat_malloc(size_t size);
 void *unbound_stat_calloc(size_t nmemb, size_t size);
 void unbound_stat_free(void *ptr);
@@ -2430,10 +2237,6 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-void *unbound_stat_reallocarray_log(void *ptr, size_t nmemb, size_t size,
-	const char* file, int line, const char* func);
-char *unbound_stat_strdup_log(const char *s, const char* file, int line,
-	const char* func);
 #elif defined(UNBOUND_ALLOC_LITE)
 #  include "util/alloc.h"
 #endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */
@@ -2444,8 +2247,6 @@ char *unbound_stat_strdup_log(const char *s, const char* file, int line,
 #define UNBOUND_DNS_OVER_TLS_PORT 853
 /** default port for DNS over HTTPS traffic. */
 #define UNBOUND_DNS_OVER_HTTPS_PORT 443
-/** default port for DNS over QUIC traffic. */
-#define UNBOUND_DNS_OVER_QUIC_PORT 853
 /** default port for unbound control traffic, registered port with IANA,
    ub-dns-control  8953/tcp    unbound dns nameserver control */
 #define UNBOUND_CONTROL_PORT 8953
@@ -2457,8 +2258,7 @@ char *unbound_stat_strdup_log(const char *s, const char* file, int line,
 dnl if we build from source tree, the man pages need @date@ and @version@
 dnl if this is a distro tarball, that was already done by makedist.sh
 AC_SUBST(version, [VERSION_MAJOR.VERSION_MINOR.VERSION_MICRO])
-AX_BUILD_DATE_EPOCH(date, [[%b %e, %Y]])
-AC_SUBST(date)
+AC_SUBST(date, [`date +'%b %e, %Y'`])

 AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service contrib/unbound_portable.service])
 AC_CONFIG_HEADERS([config.h])
@@ -1,8 +1,10 @@
 FROM gcc:latest
 WORKDIR /usr/src/unbound
+RUN apt-get update
 # install semantic parser & lexical analyzer
+RUN apt-get install -y bison flex
 # install packages used in tests
-RUN apt-get update && apt-get install -y bison flex ldnsutils dnsutils xxd splint doxygen netcat-openbsd
+RUN apt-get install -y ldnsutils dnsutils xxd splint doxygen netcat
 # accept short rsa keys, which are used in tests
 RUN sed -i 's/SECLEVEL=2/SECLEVEL=1/g' /usr/lib/ssl/openssl.cnf

@@ -55,6 +55,3 @@ distribution but may be helpful.
  contributed by Andreas Schulze.
 * metrics.awk: awk script that can convert unbound-control stats to
  Prometheus metrics format output.
-* unbound.init_yocto: An init script to start and stop the server. Put it
-  in /etc/init.d/unbound to use it. It is for the Yocto Project, in
-  embedded systems, contributed by beni-sandu.
@@ -105,9 +105,9 @@ index 2482a1f4..bd5ba243 100644
 --- a/iterator/iter_utils.c
 +++ b/iterator/iter_utils.c
@@ -177,6 +177,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
+ 	iter_env->supports_ipv6 = cfg->do_ip6;
+ 	iter_env->supports_ipv4 = cfg->do_ip4;
 	iter_env->outbound_msg_retry = cfg->outbound_msg_retry;
- 	iter_env->max_sent_count = cfg->max_sent_count;
- 	iter_env->max_query_restarts = cfg->max_query_restarts;
 +	iter_env->aaaa_filter = cfg->aaaa_filter;
 	return 1;
 }
@@ -236,7 +236,7 @@ index 54006940..768fe202 100644
 +		/* see if the failure did get (parent-lame) info */
 +		if(!cache_fill_missing(super->env,
 +			super_iq->qchase.qclass, super->region,
-+			super_iq->dp, 0))
+			super_iq->dp))
 +		log_err("ASN-AAAA-filter: out of memory adding missing");
 +		dpns->resolved = 1; /* mark as failed */
 +	}
@@ -1,24 +1,21 @@
 #!/usr/bin/env bash

-LIBEXPAT_FNAME=expat-2.7.0
-LIBEXPAT_VERSION_DIR=R_2_7_0
-
 echo "Downloading Expat"
-if ! curl -L -k -s -o $LIBEXPAT_FNAME.tar.gz https://github.com/libexpat/libexpat/releases/download/$LIBEXPAT_VERSION_DIR/$LIBEXPAT_FNAME.tar.gz;
+if ! curl -L -k -s -o expat-2.2.9.tar.gz https://github.com/libexpat/libexpat/releases/download/R_2_2_9/expat-2.2.9.tar.gz;
 then
    echo "Failed to download Expat"
    exit 1
 fi

 echo "Unpacking Expat"
-rm -rf ./$LIBEXPAT_FNAME
-if ! tar -xf $LIBEXPAT_FNAME.tar.gz;
+rm -rf ./expat-2.2.9
+if ! tar -xf expat-2.2.9.tar.gz;
 then
    echo "Failed to unpack Expat"
    exit 1
 fi

-cd $LIBEXPAT_FNAME || exit 1
+cd expat-2.2.9 || exit 1

 echo "Configuring Expat"
 if ! ./configure --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST" --prefix="$ANDROID_PREFIX"; then
@@ -1,32 +1,28 @@
 #!/usr/bin/env bash

-LIBEXPAT_FNAME=expat-2.7.0
-LIBEXPAT_VERSION_DIR=R_2_7_0
-
 echo "Downloading Expat"
-if ! curl -L -k -s -o $LIBEXPAT_FNAME.tar.gz https://github.com/libexpat/libexpat/releases/download/$LIBEXPAT_VERSION_DIR/$LIBEXPAT_FNAME.tar.gz;
+if ! curl -L -k -s -o expat-2.2.9.tar.gz https://github.com/libexpat/libexpat/releases/download/R_2_2_9/expat-2.2.9.tar.gz;
 then
    echo "Failed to download Expat"
    exit 1
 fi

 echo "Unpacking Expat"
-rm -rf ./$LIBEXPAT_FNAME
-if ! tar -xf $LIBEXPAT_FNAME.tar.gz;
+rm -rf ./expat-2.2.9
+if ! tar -xf expat-2.2.9.tar.gz;
 then
    echo "Failed to unpack Expat"
    exit 1
 fi

-cd $LIBEXPAT_FNAME || exit 1
+cd expat-2.2.9 || exit 1

 export PKG_CONFIG_PATH="$IOS_PREFIX/lib/pkgconfig"

 echo "Configuring Expat"
-if ! ./configure --without-tests				\
-       --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST"	\
-       --prefix="$IOS_PREFIX" ;
-then
+if ! ./configure \
+       --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST" \
+       --prefix="$IOS_PREFIX" ; then
    echo "Error: Failed to configure Expat"
    cat config.log
    exit 1
@@ -22,13 +22,4 @@ pidfile=${unbound_pidfile:-"/usr/local/etc/unbound/unbound.pid"}
 command_args=${unbound_flags:-"-c /usr/local/etc/unbound/unbound.conf"}
 extra_commands="reload"

-if test "$1" = "stop" ; then
-	run_rc_command "$1"
-	ret=$?
-	if test $ret -eq 0; then
-		rm -f "$pidfile"
-	fi
-	exit $ret
-fi
-
 run_rc_command "$1"
@@ -75,7 +75,6 @@ stop() {
    retval=$?
    echo
    [ $retval -eq 0 ] && rm -f $lockfile
-    [ $retval -eq 0 ] && rm -f $pidfile
    if egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/log' /proc/mounts; then
 	umount ${rootdir}/dev/log >/dev/null 2>&1
    fi;
@@ -58,7 +58,6 @@ stop() {
    killproc -p $pidfile unbound
    retval=$?
    [ $retval -eq 0 ] && rm -f $lockfile
-    [ $retval -eq 0 ] && rm -f $pidfile
    for mountfile in /dev/log /dev/urandom /etc/localtime /etc/resolv.conf /var/run/unbound
    do
    if egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}''${mountfile}'' /proc/mounts; then
@@ -1,140 +0,0 @@
-#!/bin/sh
-#
-# unbound	This shell script takes care of starting and stopping
-#		unbound (DNS server).
-#
-# chkconfig:   - 14 86
-# description:	unbound is a Domain Name Server (DNS) \
-#		that is used to resolve host names to IP addresses.
-
-### BEGIN INIT INFO
-# Provides: $named unbound
-# Required-Start: $network $local_fs
-# Required-Stop: $network $local_fs
-# Should-Start: $syslog
-# Should-Stop: $syslog
-# Short-Description: unbound recursive Domain Name Server.
-# Description:  unbound is a Domain Name Server (DNS) 
-#		that is used to resolve host names to IP addresses.
-### END INIT INFO
-
-# Source function library.
-. /etc/init.d/functions
-
-exec="/usr/sbin/unbound"
-prog="unbound"
-config="/etc/unbound/unbound.conf"
-pidfile="/var/unbound/unbound.pid"
-rootdir="/var/unbound"
-
-[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
-
-lockfile=/var/lock/subsys/$prog
-
-start() {
-    [ -x $exec ] || exit 5
-    [ -f $config ] || exit 6
-    echo -n $"Starting $prog: "
-
-    # setup root jail
-    if [ -s /etc/localtime ]; then 
-	[ -d ${rootdir}/etc ] || mkdir -p ${rootdir}/etc ;
-	if [ ! -e ${rootdir}/etc/localtime ] || ! /usr/bin/cmp -s /etc/localtime ${rootdir}/etc/localtime; then
-	    cp -fp /etc/localtime ${rootdir}/etc/localtime
-	fi;
-    fi;
-    if [ -s /etc/resolv.conf ]; then
-	[ -d ${rootdir}/etc ] || mkdir -p ${rootdir}/etc ;
-	if [ ! -e ${rootdir}/etc/resolv.conf ] || ! /usr/bin/cmp -s /etc/resolv.conf ${rootdir}/etc/resolv.conf; then
-	    cp -fp /etc/resolv.conf ${rootdir}/etc/resolv.conf
-	fi;
-    fi;
-    if ! egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/log' /proc/mounts; then
-	[ -d ${rootdir}/dev ] || mkdir -p ${rootdir}/dev ;
-	[ -e ${rootdir}/dev/log ] || touch ${rootdir}/dev/log
-	mount --bind -n /dev/log ${rootdir}/dev/log >/dev/null 2>&1;
-    fi;
-    if ! egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/random' /proc/mounts; then
-	[ -d ${rootdir}/dev ] || mkdir -p ${rootdir}/dev ;
-	[ -e ${rootdir}/dev/random ] || touch ${rootdir}/dev/random
-	mount --bind -n /dev/random ${rootdir}/dev/random >/dev/null 2>&1;
-    fi;
-
-    # if not running, start it up here
-    daemonize $exec
-    retval=$?
-    echo
-    [ $retval -eq 0 ] && touch $lockfile
-    return $retval
-}
-
-stop() {
-    echo -n $"Stopping $prog: "
-    # stop it here, often "killproc $prog"
-    killproc $prog
-    retval=$?
-    echo
-    [ $retval -eq 0 ] && rm -f $lockfile
-    [ $retval -eq 0 ] && rm -f $pidfile
-    if egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/log' /proc/mounts; then
-	umount ${rootdir}/dev/log >/dev/null 2>&1
-    fi;
-    if egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/random' /proc/mounts; then
-	umount ${rootdir}/dev/random >/dev/null 2>&1
-    fi;
-    return $retval
-}
-
-restart() {
-    stop
-    start
-}
-
-reload() {
-    kill -HUP `cat $pidfile`
-}
-
-force_reload() {
-    restart
-}
-
-rh_status() {
-    # run checks to determine if the service is running or use generic status
-    status $prog
-}
-
-rh_status_q() {
-    rh_status -p $pidfile >/dev/null 2>&1
-}
-
-case "$1" in
-    start)
-        rh_status_q && exit 0
-        $1
-        ;;
-    stop)
-        rh_status_q || exit 0
-        $1
-        ;;
-    restart)
-        $1
-        ;;
-    reload)
-        rh_status_q || exit 7
-        $1
-        ;;
-    force-reload)
-        force_reload
-        ;;
-    status)
-        rh_status
-        ;;
-    condrestart|try-restart)
-        rh_status_q || exit 0
-        restart
-        ;;
-    *)
-        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
-        exit 2
-esac
-exit $?
@@ -44,6 +44,7 @@ Description=Validating, recursive, and caching DNS resolver
 Documentation=man:unbound(8)
 After=network-online.target
 Before=nss-lookup.target
+Wants=network-online.target nss-lookup.target

 [Install]
 WantedBy=multi-user.target
@@ -14,8 +14,8 @@
 [Unit]
 Description=Validating, recursive, and caching DNS resolver
 Documentation=man:unbound(8)
-After=network-online.target
-Before=nss-lookup.target
+After=network.target
+Before=network-online.target nss-lookup.target
 Wants=nss-lookup.target

 [Install]
@@ -109,8 +109,6 @@ parse_acl_access(const char* str, enum acl_access* control)
 		*control = acl_allow_snoop;
 	else if(strcmp(str, "allow_setrd") == 0)
 		*control = acl_allow_setrd;
-	else if (strcmp(str, "allow_cookie") == 0)
-		*control = acl_allow_cookie;
 	else {
 		log_err("access control type %s unknown", str);
 		return 0;
@@ -221,9 +219,7 @@ acl_interface_insert(struct acl_list* acl_interface,
 	struct sockaddr_storage* addr, socklen_t addrlen,
 	enum acl_access control)
 {
-	struct acl_addr* node = acl_find_or_create(acl_interface, addr, addrlen, control);
-	node->is_interface = 1;
-	return node;
+	return acl_find_or_create(acl_interface, addr, addrlen, control);
 }

 /** apply acl_tag string */
@@ -553,6 +549,17 @@ acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg,
 	return 1;
 }

+int
+acl_interface_compare(const void* k1, const void* k2)
+{
+	struct addr_tree_node* n1 = (struct addr_tree_node*)k1;
+	struct addr_tree_node* n2 = (struct addr_tree_node*)k2;
+	return sockaddr_cmp(&n1->addr, n1->addrlen, &n2->addr,
+		n2->addrlen);
+	/* We don't care about comparing node->net. All addresses in the
+	 * acl_interface tree have either 32 (ipv4) or 128 (ipv6). */
+}
+
 void
 acl_interface_init(struct acl_list* acl_interface)
 {
@@ -807,23 +814,10 @@ log_acl_action(const char* action, struct sockaddr_storage* addr,
 		addr_to_str(&acladdr->node.addr, acladdr->node.addrlen,
 			n, sizeof(n));
 		verbose(VERB_ALGO, "%s query from %s port %d because of "
-			"%s/%d %s%s", action, a, (int)port, n,
-			acladdr->node.net,
-			acladdr->is_interface?"(ACL on interface IP) ":"",
+			"%s/%d %s", action, a, (int)port, n, acladdr->node.net,
 			acl_access_to_str(acl));
 	} else {
 		verbose(VERB_ALGO, "%s query from %s port %d", action, a,
 			(int)port);
 	}
 }
-
-void acl_list_swap_tree(struct acl_list* acl, struct acl_list* data)
-{
-	/* swap tree and region */
-	rbtree_type oldtree = acl->tree;
-	struct regional* oldregion = acl->region;
-	acl->tree = data->tree;
-	acl->region = data->region;
-	data->tree = oldtree;
-	data->region = oldregion;
-}
@@ -64,12 +64,8 @@ enum acl_access {
 	acl_allow,
 	/** allow full access for all queries, recursion and cache snooping */
 	acl_allow_snoop,
-	/** allow full access for recursion queries and set RD flag regardless
-	 *  of request */
-	acl_allow_setrd,
-	/** allow full access for recursion (+RD) queries if valid cookie
-	 *  present or stateful transport */
-	acl_allow_cookie
+	/** allow full access for recursion queries and set RD flag regardless of request */
+	acl_allow_setrd
 };

 /**
@@ -107,8 +103,6 @@ struct acl_addr {
 	struct config_strlist** tag_datas;
 	/** size of the tag_datas array */
 	size_t tag_datas_size;
-	/* If the acl node is for an interface */
-	int is_interface;
 	/* view element, NULL if none */
 	struct view* view;
 };
@@ -149,6 +143,9 @@ acl_interface_insert(struct acl_list* acl_interface,
 int acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg,
 	struct views* v);

+/** compare ACL interface "addr_tree" nodes (+port) */
+int acl_interface_compare(const void* k1, const void* k2);
+
 /**
 * Initialise (also clean) the acl_interface struct.
 * @param acl_interface: where to store.
@@ -201,12 +198,4 @@ const char* acl_access_to_str(enum acl_access acl);
 void log_acl_action(const char* action, struct sockaddr_storage* addr,
 	socklen_t addrlen, enum acl_access acl, struct acl_addr* acladdr);

-/**
- * Swap internal tree with preallocated entries.
- * @param acl: the acl structure.
- * @param data: the data structure used to take elements from. This contains
- * 	the old elements on return.
- */
-void acl_list_swap_tree(struct acl_list* acl, struct acl_list* data);
-
 #endif /* DAEMON_ACL_LIST_H */
@@ -166,7 +166,8 @@ dump_msg_ref(RES* ssl, struct ub_packed_rrset_key* k)

 /** dump message entry */
 static int
-dump_msg(RES* ssl, struct query_info* k, struct reply_info* d, time_t now)
+dump_msg(RES* ssl, struct query_info* k, struct reply_info* d, 
+	time_t now)
 {
 	size_t i;
 	char* nm, *tp, *cl;
@@ -191,15 +192,13 @@ dump_msg(RES* ssl, struct query_info* k, struct reply_info* d, time_t now)
 	}
 	
 	/* meta line */
-	if(!ssl_printf(ssl, "msg %s %s %s %d %d " ARG_LL "d %d %u %u %u %d %s\n",
+	if(!ssl_printf(ssl, "msg %s %s %s %d %d " ARG_LL "d %d %u %u %u\n",
 			nm, cl, tp,
 			(int)d->flags, (int)d->qdcount, 
 			(long long)(d->ttl-now), (int)d->security,
-			(unsigned)d->an_numrrsets,
+			(unsigned)d->an_numrrsets, 
 			(unsigned)d->ns_numrrsets,
-			(unsigned)d->ar_numrrsets,
-			(int)d->reason_bogus,
-			d->reason_bogus_str?d->reason_bogus_str:"")) {
+			(unsigned)d->ar_numrrsets)) {
 		free(nm);
 		free(tp);
 		free(cl);
@@ -388,7 +387,7 @@ move_into_cache(struct ub_packed_rrset_key* k,
 	struct rrset_ref ref;
 	uint8_t* p;

-	ak = alloc_special_obtain(worker->alloc);
+	ak = alloc_special_obtain(&worker->alloc);
 	if(!ak) {
 		log_warn("error out of memory");
 		return 0;
@@ -399,7 +398,7 @@ move_into_cache(struct ub_packed_rrset_key* k,
 	ak->rk.dname = (uint8_t*)memdup(k->rk.dname, k->rk.dname_len);
 	if(!ak->rk.dname) {
 		log_warn("error out of memory");
-		ub_packed_rrset_parsedelete(ak, worker->alloc);
+		ub_packed_rrset_parsedelete(ak, &worker->alloc);
 		return 0;
 	}
 	s = sizeof(*ad) + (sizeof(size_t) + sizeof(uint8_t*) + 
@@ -409,7 +408,7 @@ move_into_cache(struct ub_packed_rrset_key* k,
 	ad = (struct packed_rrset_data*)malloc(s);
 	if(!ad) {
 		log_warn("error out of memory");
-		ub_packed_rrset_parsedelete(ak, worker->alloc);
+		ub_packed_rrset_parsedelete(ak, &worker->alloc);
 		return 0;
 	}
 	p = (uint8_t*)ad;
@@ -432,8 +431,7 @@ move_into_cache(struct ub_packed_rrset_key* k,
 	ref.key = ak;
 	ref.id = ak->id;
 	(void)rrset_cache_update(worker->env.rrset_cache, &ref,
-		worker->alloc, *worker->env.now);
-
+		&worker->alloc, *worker->env.now);
 	return 1;
 }

@@ -634,9 +632,6 @@ load_msg(RES* ssl, sldns_buffer* buf, struct worker* worker)
 	long long ttl;
 	size_t i;
 	int go_on = 1;
-	int ede;
-	int consumed = 0;
-	char* ede_str = NULL;

 	regional_free_all(region);

@@ -651,16 +646,11 @@ load_msg(RES* ssl, sldns_buffer* buf, struct worker* worker)
 	}

 	/* read remainder of line */
-	/* note the last space before any possible EDE text */
-	if(sscanf(s, " %u %u " ARG_LL "d %u %u %u %u %d %n", &flags, &qdcount, &ttl,
-		&security, &an, &ns, &ar, &ede, &consumed) != 8) {
+	if(sscanf(s, " %u %u " ARG_LL "d %u %u %u %u", &flags, &qdcount, &ttl, 
+		&security, &an, &ns, &ar) != 7) {
 		log_warn("error cannot parse numbers: %s", s);
 		return 0;
 	}
-	/* there may be EDE text after the numbers */
-	if(consumed > 0 && (size_t)consumed < strlen(s))
-		ede_str = s + consumed;
-	memset(&rep, 0, sizeof(rep));
 	rep.flags = (uint16_t)flags;
 	rep.qdcount = (uint16_t)qdcount;
 	rep.ttl = (time_t)ttl;
@@ -675,8 +665,6 @@ load_msg(RES* ssl, sldns_buffer* buf, struct worker* worker)
 	rep.ns_numrrsets = (size_t)ns;
 	rep.ar_numrrsets = (size_t)ar;
 	rep.rrset_count = (size_t)an+(size_t)ns+(size_t)ar;
-	rep.reason_bogus = (sldns_ede_code)ede;
-	rep.reason_bogus_str = ede_str?(char*)regional_strdup(region, ede_str):NULL;
 	rep.rrsets = (struct ub_packed_rrset_key**)regional_alloc_zero(
 		region, sizeof(struct ub_packed_rrset_key*)*rep.rrset_count);

@@ -692,7 +680,7 @@ load_msg(RES* ssl, sldns_buffer* buf, struct worker* worker)
 		return 1; /* skip this one, not all references satisfied */

 	if(!dns_cache_store(&worker->env, &qinf, &rep, 0, 0, 0, NULL, flags,
-		*worker->env.now, 1)) {
+		*worker->env.now)) {
 		log_warn("error out of memory");
 		return 0;
 	}
@@ -836,10 +824,9 @@ int print_deleg_lookup(RES* ssl, struct worker* worker, uint8_t* nm,
 	struct delegpt* dp;
 	struct dns_msg* msg;
 	struct regional* region = worker->scratchpad;
-	char b[LDNS_MAX_DOMAINLEN];
+	char b[260];
 	struct query_info qinfo;
 	struct iter_hints_stub* stub;
-	int nolock = 0;
 	regional_free_all(region);
 	qinfo.qname = nm;
 	qinfo.qname_len = nmlen;
@@ -851,16 +838,13 @@ int print_deleg_lookup(RES* ssl, struct worker* worker, uint8_t* nm,
 	if(!ssl_printf(ssl, "The following name servers are used for lookup "
 		"of %s\n", b)) 
 		return 0;
-
-	dp = forwards_lookup(worker->env.fwds, nm, qinfo.qclass, nolock);
+	
+	dp = forwards_lookup(worker->env.fwds, nm, qinfo.qclass);
 	if(dp) {
-		if(!ssl_printf(ssl, "forwarding request:\n")) {
-			lock_rw_unlock(&worker->env.fwds->lock);
+		if(!ssl_printf(ssl, "forwarding request:\n"))
 			return 0;
-		}
 		print_dp_main(ssl, dp, NULL);
 		print_dp_details(ssl, worker, dp);
-		lock_rw_unlock(&worker->env.fwds->lock);
 		return 1;
 	}
 	
@@ -875,8 +859,7 @@ int print_deleg_lookup(RES* ssl, struct worker* worker, uint8_t* nm,
 		/* go up? */
 		if(iter_dp_is_useless(&qinfo, BIT_RD, dp,
 			(worker->env.cfg->do_ip4 && worker->back->num_ip4 != 0),
-			(worker->env.cfg->do_ip6 && worker->back->num_ip6 != 0),
-			worker->env.cfg->do_nat64)) {
+			(worker->env.cfg->do_ip6 && worker->back->num_ip6 != 0))) {
 			print_dp_main(ssl, dp, msg);
 			print_dp_details(ssl, worker, dp);
 			if(!ssl_printf(ssl, "cache delegation was "
@@ -896,26 +879,21 @@ int print_deleg_lookup(RES* ssl, struct worker* worker, uint8_t* nm,
 					return 0;
 				continue;
 			}
-		}
+		} 
 		stub = hints_lookup_stub(worker->env.hints, nm, qinfo.qclass,
-			dp, nolock);
+			dp);
 		if(stub) {
 			if(stub->noprime) {
 				if(!ssl_printf(ssl, "The noprime stub servers "
-					"are used:\n")) {
-					lock_rw_unlock(&worker->env.hints->lock);
+					"are used:\n"))
 					return 0;
-				}
 			} else {
 				if(!ssl_printf(ssl, "The stub is primed "
-						"with servers:\n")) {
-					lock_rw_unlock(&worker->env.hints->lock);
+						"with servers:\n"))
 					return 0;
-				}
 			}
 			print_dp_main(ssl, stub->dp, NULL);
 			print_dp_details(ssl, worker, stub->dp);
-			lock_rw_unlock(&worker->env.hints->lock);
 		} else {
 			print_dp_main(ssl, dp, msg);
 			print_dp_details(ssl, worker, dp);
@@ -91,8 +91,6 @@
 #include "util/net_help.h"
 #include "sldns/keyraw.h"
 #include "respip/respip.h"
-#include "iterator/iter_fwd.h"
-#include "iterator/iter_hints.h"
 #include <signal.h>

 #ifdef HAVE_SYSTEMD
@@ -101,9 +99,6 @@
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
-#ifdef USE_CACHEDB
-#include "cachedb/cachedb.h"
-#endif

 /** How many quit requests happened. */
 static int sig_record_quit = 0;
@@ -265,7 +260,6 @@ daemon_init(void)
 		free(daemon);
 		return NULL;
 	}
-	daemon->env->modstack = &daemon->mods;
 	/* init edns_known_options */
 	if(!edns_known_options_init(daemon->env)) {
 		free(daemon->env);
@@ -323,18 +317,21 @@ daemon_init(void)
 	return daemon;	
 }

-int setup_acl_for_ports(struct acl_list* list, struct listen_port* port_list)
+static int setup_acl_for_ports(struct acl_list* list,
+	struct listen_port* port_list)
 {
 	struct acl_addr* acl_node;
+	struct addrinfo* addr;
 	for(; port_list; port_list=port_list->next) {
 		if(!port_list->socket) {
 			/* This is mainly for testbound where port_list is
 			 * empty. */
 			continue;
 		}
+		addr = port_list->socket->addr;
 		if(!(acl_node = acl_interface_insert(list,
-			(struct sockaddr_storage*)port_list->socket->addr,
-			port_list->socket->addrlen,
+			(struct sockaddr_storage*)addr->ai_addr,
+			(socklen_t)addr->ai_addrlen,
 			acl_refuse))) {
 			return 0;
 		}
@@ -343,7 +340,7 @@ int setup_acl_for_ports(struct acl_list* list, struct listen_port* port_list)
 	return 1;
 }

-int
+int 
 daemon_open_shared_ports(struct daemon* daemon)
 {
 	log_assert(daemon);
@@ -443,19 +440,6 @@ daemon_open_shared_ports(struct daemon* daemon)
 	return 1;
 }

-int
-daemon_privileged(struct daemon* daemon)
-{
-	daemon->env->cfg = daemon->cfg;
-	daemon->env->alloc = &daemon->superalloc;
-	daemon->env->worker = NULL;
-	if(!modstack_call_startup(&daemon->mods, daemon->cfg->module_conf,
-		daemon->env)) {
-		fatal_exit("failed to startup modules");
-	}
-	return 1;
-}
-
 /**
 * Setup modules. setup module stack.
 * @param daemon: the daemon
@@ -465,15 +449,11 @@ static void daemon_setup_modules(struct daemon* daemon)
 	daemon->env->cfg = daemon->cfg;
 	daemon->env->alloc = &daemon->superalloc;
 	daemon->env->worker = NULL;
-	if(daemon->mods_inited) {
-		modstack_call_deinit(&daemon->mods, daemon->env);
-	}
 	daemon->env->need_to_validate = 0; /* set by module init below */
-	if(!modstack_call_init(&daemon->mods, daemon->cfg->module_conf,
+	if(!modstack_setup(&daemon->mods, daemon->cfg->module_conf, 
 		daemon->env)) {
-		fatal_exit("failed to init modules");
+		fatal_exit("failed to setup modules");
 	}
-	daemon->mods_inited = 1;
 	log_edns_known_options(VERB_ALGO, daemon->env);
 }

@@ -508,30 +488,6 @@ static int daemon_get_shufport(struct daemon* daemon, int* shufport)
 	return avail;
 }

-/**
- * Clear and delete per-worker alloc caches, and free memory maintained in
- * superalloc.
- * The rrset and message caches must be empty at the time of call.
- * @param daemon: the daemon that maintains the alloc caches to be cleared.
- */
-static void
-daemon_clear_allocs(struct daemon* daemon)
-{
-	int i;
-
-	/* daemon->num may be different during reloads (after configuration
-	 * read). Use old_num which has the correct value used to setup the
-	 * worker_allocs */
-	for(i=0; i<daemon->old_num; i++) {
-		alloc_clear(daemon->worker_allocs[i]);
-		free(daemon->worker_allocs[i]);
-	}
-	free(daemon->worker_allocs);
-	daemon->worker_allocs = NULL;
-
-	alloc_clear_special(&daemon->superalloc);
-}
-
 /**
 * Allocate empty worker structures. With backptr and thread-number,
 * from 0..numthread initialised. Used as user arguments to new threads.
@@ -556,12 +512,6 @@ daemon_create_workers(struct daemon* daemon)
 		fatal_exit("out of memory during daemon init");
 	numport = daemon_get_shufport(daemon, shufport);
 	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
-
-#ifdef HAVE_NGTCP2
-	daemon->doq_table = doq_table_create(daemon->cfg, daemon->rand);
-	if(!daemon->doq_table)
-		fatal_exit("could not create doq_table: out of memory");
-#endif
 	
 	daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1);
 	if(daemon->reuseport && (int)daemon->num < (int)daemon->num_ports) {
@@ -590,21 +540,6 @@ daemon_create_workers(struct daemon* daemon)
 			/* the above is not ports/numthr, due to rounding */
 			fatal_exit("could not create worker");
 	}
-	/* create per-worker alloc caches if not reusing existing ones. */
-	if(!daemon->worker_allocs) {
-		daemon->worker_allocs = (struct alloc_cache**)calloc(
-			(size_t)daemon->num, sizeof(struct alloc_cache*));
-		if(!daemon->worker_allocs)
-			fatal_exit("could not allocate worker allocs");
-		for(i=0; i<daemon->num; i++) {
-			struct alloc_cache* alloc = calloc(1,
-				sizeof(struct alloc_cache));
-			if (!alloc)
-				fatal_exit("could not allocate worker alloc");
-			alloc_init(alloc, &daemon->superalloc, i);
-			daemon->worker_allocs[i] = alloc;
-		}
-	}
 	free(shufport);
 }

@@ -716,16 +651,16 @@ daemon_fork(struct daemon* daemon)
 #endif

 	log_assert(daemon);
-	if(!(daemon->env->views = views_create()))
+	if(!(daemon->views = views_create()))
 		fatal_exit("Could not create views: out of memory");
 	/* create individual views and their localzone/data trees */
-	if(!views_apply_cfg(daemon->env->views, daemon->cfg))
+	if(!views_apply_cfg(daemon->views, daemon->cfg))
 		fatal_exit("Could not set up views");

-	if(!acl_list_apply_cfg(daemon->acl, daemon->cfg, daemon->env->views))
+	if(!acl_list_apply_cfg(daemon->acl, daemon->cfg, daemon->views))
 		fatal_exit("Could not setup access control list");
 	if(!acl_interface_apply_cfg(daemon->acl_interface, daemon->cfg,
-		daemon->env->views))
+		daemon->views))
 		fatal_exit("Could not setup interface control list");
 	if(!tcl_list_apply_cfg(daemon->tcl, daemon->cfg))
 		fatal_exit("Could not setup TCP connection limits");
@@ -740,36 +675,22 @@ daemon_fork(struct daemon* daemon)
 				   "dnscrypt support");
 #endif
 	}
-	if(daemon->cfg->cookie_secret_file &&
-		daemon->cfg->cookie_secret_file[0]) {
-		if(!(daemon->cookie_secrets = cookie_secrets_create()))
-			fatal_exit("Could not create cookie_secrets: out of memory");
-		if(!cookie_secrets_apply_cfg(daemon->cookie_secrets,
-			daemon->cfg->cookie_secret_file))
-			fatal_exit("Could not setup cookie_secrets");
-	}
 	/* create global local_zones */
 	if(!(daemon->local_zones = local_zones_create()))
 		fatal_exit("Could not create local zones: out of memory");
 	if(!local_zones_apply_cfg(daemon->local_zones, daemon->cfg))
 		fatal_exit("Could not set up local zones");
-	if(!(daemon->env->fwds = forwards_create()) ||
-		!forwards_apply_cfg(daemon->env->fwds, daemon->cfg))
-		fatal_exit("Could not set forward zones");
-	if(!(daemon->env->hints = hints_create()) ||
-		!hints_apply_cfg(daemon->env->hints, daemon->cfg))
-		fatal_exit("Could not set root or stub hints");

 	/* process raw response-ip configuration data */
-	if(!(daemon->env->respip_set = respip_set_create()))
+	if(!(daemon->respip_set = respip_set_create()))
 		fatal_exit("Could not create response IP set");
-	if(!respip_global_apply_cfg(daemon->env->respip_set, daemon->cfg))
+	if(!respip_global_apply_cfg(daemon->respip_set, daemon->cfg))
 		fatal_exit("Could not set up response IP set");
-	if(!respip_views_apply_cfg(daemon->env->views, daemon->cfg,
+	if(!respip_views_apply_cfg(daemon->views, daemon->cfg,
 		&have_view_respip_cfg))
 		fatal_exit("Could not set up per-view response IP sets");
-	daemon->use_response_ip = !respip_set_is_empty(
-		daemon->env->respip_set) || have_view_respip_cfg;
+	daemon->use_response_ip = !respip_set_is_empty(daemon->respip_set) ||
+		have_view_respip_cfg;

 	/* setup modules */
 	daemon_setup_modules(daemon);
@@ -783,10 +704,6 @@ daemon_fork(struct daemon* daemon)
 	if(!edns_strings_apply_cfg(daemon->env->edns_strings, daemon->cfg))
 		fatal_exit("Could not set up EDNS strings");

-#ifdef USE_CACHEDB
-	daemon->env->cachedb_enabled = cachedb_is_enabled(&daemon->mods,
-		daemon->env);
-#endif
 	/* response-ip-xxx options don't work as expected without the respip
 	 * module.  To avoid run-time operational surprise we reject such
 	 * configuration. */
@@ -854,7 +771,6 @@ daemon_fork(struct daemon* daemon)
 	/* Shutdown SHM */
 	shm_main_shutdown(daemon);

-	daemon->reuse_cache = daemon->workers[0]->reuse_cache;
 	daemon->need_to_exit = daemon->workers[0]->need_to_exit;
 }

@@ -869,45 +785,25 @@ daemon_cleanup(struct daemon* daemon)
 	log_thread_set(NULL);
 	/* clean up caches because
 	 * a) RRset IDs will be recycled after a reload, causing collisions
-	 * b) validation config can change, thus rrset, msg, keycache clear
-	 *
-	 * If we are trying to keep the cache as long as possible, we should
-	 * defer the cleanup until we know whether the new configuration allows
-	 * the reuse.  (If we're exiting, cleanup should be done here). */
-	if(!daemon->reuse_cache || daemon->need_to_exit) {
-		slabhash_clear(&daemon->env->rrset_cache->table);
-		slabhash_clear(daemon->env->msg_cache);
-	}
-	daemon->old_num = daemon->num; /* save the current num */
-	forwards_delete(daemon->env->fwds);
-	daemon->env->fwds = NULL;
-	hints_delete(daemon->env->hints);
-	daemon->env->hints = NULL;
+	 * b) validation config can change, thus rrset, msg, keycache clear */
+	slabhash_clear(&daemon->env->rrset_cache->table);
+	slabhash_clear(daemon->env->msg_cache);
 	local_zones_delete(daemon->local_zones);
 	daemon->local_zones = NULL;
-	respip_set_delete(daemon->env->respip_set);
-	daemon->env->respip_set = NULL;
-	views_delete(daemon->env->views);
-	daemon->env->views = NULL;
+	respip_set_delete(daemon->respip_set);
+	daemon->respip_set = NULL;
+	views_delete(daemon->views);
+	daemon->views = NULL;
 	if(daemon->env->auth_zones)
 		auth_zones_cleanup(daemon->env->auth_zones);
-	/* key cache is cleared by module deinit during next daemon_fork() */
+	/* key cache is cleared by module desetup during next daemon_fork() */
 	daemon_remote_clear(daemon->rc);
-	if(daemon->fast_reload_thread)
-		fast_reload_thread_stop(daemon->fast_reload_thread);
-	if(daemon->fast_reload_printq_list)
-		fast_reload_printq_list_delete(daemon->fast_reload_printq_list);
 	for(i=0; i<daemon->num; i++)
 		worker_delete(daemon->workers[i]);
 	free(daemon->workers);
 	daemon->workers = NULL;
-	/* Unless we're trying to keep the cache, worker alloc_caches should be
-	 * cleared and freed here. We do this after deleting workers to
-	 * guarantee that the alloc caches are valid throughout the lifetime
-	 * of workers. */
-	if(!daemon->reuse_cache || daemon->need_to_exit)
-		daemon_clear_allocs(daemon);
 	daemon->num = 0;
+	alloc_clear_special(&daemon->superalloc);
 #ifdef USE_DNSTAP
 	dt_delete(daemon->dtenv);
 	daemon->dtenv = NULL;
@@ -915,10 +811,6 @@ daemon_cleanup(struct daemon* daemon)
 #ifdef USE_DNSCRYPT
 	dnsc_delete(daemon->dnscenv);
 	daemon->dnscenv = NULL;
-#endif
-#ifdef HAVE_NGTCP2
-	doq_table_delete(daemon->doq_table);
-	daemon->doq_table = NULL;
 #endif
 	daemon->cfg = NULL;
 }
@@ -929,9 +821,7 @@ daemon_delete(struct daemon* daemon)
 	size_t i;
 	if(!daemon)
 		return;
-	modstack_call_deinit(&daemon->mods, daemon->env);
-	modstack_call_destartup(&daemon->mods, daemon->env);
-	modstack_free(&daemon->mods);
+	modstack_desetup(&daemon->mods, daemon->env);
 	daemon_remote_delete(daemon->rc);
 	for(i = 0; i < daemon->num_ports; i++)
 		listening_ports_free(daemon->ports[i]);
@@ -950,20 +840,14 @@ daemon_delete(struct daemon* daemon)
 	acl_list_delete(daemon->acl);
 	acl_list_delete(daemon->acl_interface);
 	tcl_list_delete(daemon->tcl);
-	cookie_secrets_delete(daemon->cookie_secrets);
 	listen_desetup_locks();
 	free(daemon->chroot);
 	free(daemon->pidfile);
-	free(daemon->cfgfile);
 	free(daemon->env);
 #ifdef HAVE_SSL
 	listen_sslctx_delete_ticket_keys();
-	SSL_CTX_free((SSL_CTX*)daemon->listen_dot_sslctx);
-	SSL_CTX_free((SSL_CTX*)daemon->listen_doh_sslctx);
-	SSL_CTX_free((SSL_CTX*)daemon->connect_dot_sslctx);
-#endif
-#ifdef HAVE_NGTCP2
-	SSL_CTX_free((SSL_CTX*)daemon->listen_quic_sslctx);
+	SSL_CTX_free((SSL_CTX*)daemon->listen_sslctx);
+	SSL_CTX_free((SSL_CTX*)daemon->connect_sslctx);
 #endif
 	free(daemon);
 	/* lex cleanup */
@@ -1016,42 +900,8 @@ daemon_delete(struct daemon* daemon)

 void daemon_apply_cfg(struct daemon* daemon, struct config_file* cfg)
 {
-	int new_num = cfg->num_threads?cfg->num_threads:1;
-
        daemon->cfg = cfg;
 	config_apply(cfg);
-
-	/* If this is a reload and we deferred the decision on whether to
-	 * reuse the alloc, RRset, and message caches, then check to see if
-	 * it's safe to keep the caches:
-	 * - changing the number of threads is obviously incompatible with
-	 *   keeping the per-thread alloc caches. It also means we have to
-	 *   clear RRset and message caches. (note that 'new_num' may be
-	 *   adjusted in daemon_create_workers, but for our purpose we can
-	 *   simply compare it with 'old_num'; if they are equal here,
-	 *   'new_num' won't be adjusted to a different value than 'old_num').
-	 * - changing RRset cache size effectively clears any remaining cache
-	 *   entries. We could keep their keys in alloc caches, but it would
-	 *   be more consistent with the sense of the change to clear allocs
-	 *   and free memory. To do so we also have to clear message cache.
-	 * - only changing message cache size does not necessarily affect
-	 *   RRset or alloc cache. But almost all new subsequent queries will
-	 *   require recursive resolution anyway, so it doesn't help much to
-	 *   just keep RRset and alloc caches. For simplicity we clear/free
-	 *   the other two, too. */
-	if(daemon->worker_allocs &&
-		(new_num != daemon->old_num ||
-		 !slabhash_is_size(daemon->env->msg_cache, cfg->msg_cache_size,
-			cfg->msg_cache_slabs) ||
-		 !slabhash_is_size(&daemon->env->rrset_cache->table,
-			cfg->rrset_cache_size, cfg->rrset_cache_slabs)))
-	{
-		log_warn("cannot reuse caches due to critical config change");
-		slabhash_clear(&daemon->env->rrset_cache->table);
-		slabhash_clear(daemon->env->msg_cache);
-		daemon_clear_allocs(daemon);
-	}
-
 	if(!slabhash_is_size(daemon->env->msg_cache, cfg->msg_cache_size,
 	   	cfg->msg_cache_slabs)) {
 		slabhash_delete(daemon->env->msg_cache);
@@ -58,10 +58,6 @@ struct ub_randstate;
 struct daemon_remote;
 struct respip_set;
 struct shm_main_info;
-struct doq_table;
-struct cookie_secrets;
-struct fast_reload_thread;
-struct fast_reload_printq;

 #include "dnstap/dnstap_config.h"
 #ifdef USE_DNSTAP
@@ -99,22 +95,12 @@ struct daemon {
 	struct listen_port* rc_ports;
 	/** remote control connections management (for first worker) */
 	struct daemon_remote* rc;
-	/** ssl context for listening to dnstcp over ssl */
-	void* listen_dot_sslctx;
-	/** ssl context for connecting to dnstcp over ssl */
-	void* connect_dot_sslctx;
-	/** ssl context for listening to DoH */
-	void* listen_doh_sslctx;
-	/** ssl context for listening to quic */
-	void* listen_quic_sslctx;
+	/** ssl context for listening to dnstcp over ssl, and connecting ssl */
+	void* listen_sslctx, *connect_sslctx;
 	/** num threads allocated */
 	int num;
-	/** num threads allocated in the previous config or 0 at first */
-	int old_num;
 	/** the worker entries */
 	struct worker** workers;
-	/** per-worker allocation cache */
-	struct alloc_cache **worker_allocs;
 	/** do we need to exit unbound (or is it only a reload?) */
 	int need_to_exit;
 	/** master random table ; used for port div between threads on reload*/
@@ -125,8 +111,6 @@ struct daemon {
 	struct module_env* env;
 	/** stack of module callbacks */
 	struct module_stack mods;
-	/** The module stack has been inited */
-	int mods_inited;
 	/** access control, which client IPs are allowed to connect */
 	struct acl_list* acl;
 	/** access control, which interfaces are allowed to connect */
@@ -139,11 +123,15 @@ struct daemon {
 	struct timeval time_last_stat;
 	/** time when daemon started */
 	struct timeval time_boot;
+	/** views structure containing view tree */
+	struct views* views;
 #ifdef USE_DNSTAP
 	/** the dnstap environment master value, copied and changed by threads*/
 	struct dt_env* dtenv;
 #endif
 	struct shm_main_info* shm_info;
+	/** response-ip set with associated actions and tags. */
+	struct respip_set* respip_set;
 	/** some response-ip tags or actions are configured if true */
 	int use_response_ip;
 	/** some RPZ policies are configured */
@@ -152,23 +140,6 @@ struct daemon {
 	/** the dnscrypt environment */
 	struct dnsc_env* dnscenv;
 #endif
-	/** the doq connection table */
-	struct doq_table* doq_table;
-	/** reuse existing cache on reload if other conditions allow it. */
-	int reuse_cache;
-	/** the EDNS cookie secrets from the cookie-secret-file */
-	struct cookie_secrets* cookie_secrets;
-	/** the fast reload thread, or NULL */
-	struct fast_reload_thread* fast_reload_thread;
-	/** the fast reload printq list */
-	struct fast_reload_printq* fast_reload_printq_list;
-	/** the fast reload option to drop mesh queries, true if so. */
-	int fast_reload_drop_mesh;
-	/** for fast reload, if the tcl, tcp connection limits, has
-	 * changes for workers */
-	int fast_reload_tcl_has_changes;
-	/** config file name */
-	char* cfgfile;
 };

 /**
@@ -185,15 +156,6 @@ struct daemon* daemon_init(void);
 */
 int daemon_open_shared_ports(struct daemon* daemon);

-/**
- * Do daemon setup that needs privileges
- * like opening privileged ports or opening device files.
- * The cfg member pointer must have been set for the daemon.
- * @param daemon: the daemon.
- * @return: false on error.
- */
-int daemon_privileged(struct daemon* daemon);
-
 /**
 * Fork workers and start service.
 * When the routine exits, it is no longer forked.
@@ -221,12 +183,4 @@ void daemon_delete(struct daemon* daemon);
 */
 void daemon_apply_cfg(struct daemon* daemon, struct config_file* cfg);

-/**
- * Setup acl list to have entries for the port list.
- * @param list: the acl interface
- * @param port_list: list of open ports, or none.
- * @return false on failure
- */
-int setup_acl_for_ports(struct acl_list* list, struct listen_port* port_list);
-
 #endif /* DAEMON_H */
@@ -46,9 +46,8 @@
 #ifndef DAEMON_REMOTE_H
 #define DAEMON_REMOTE_H
 #ifdef HAVE_OPENSSL_SSL_H
-#include <openssl/ssl.h>
+#include "openssl/ssl.h"
 #endif
-#include "util/locks.h"
 struct config_file;
 struct listen_list;
 struct listen_port;
@@ -56,7 +55,6 @@ struct worker;
 struct comm_reply;
 struct comm_point;
 struct daemon_remote;
-struct config_strlist_head;

 /** number of milliseconds timeout on incoming remote control handshake */
 #define REMOTE_CONTROL_TCP_TIMEOUT 120000
@@ -120,137 +118,6 @@ struct remote_stream {
 };
 typedef struct remote_stream RES;

-/**
- * Notification status. This is exchanged between the fast reload thread
- * and the server thread, over the commpair sockets.
- */
-enum fast_reload_notification {
-	/** nothing, not used */
-	fast_reload_notification_none = 0,
-	/** the fast reload thread is done */
-	fast_reload_notification_done = 1,
-	/** the fast reload thread is done but with an error, it failed */
-	fast_reload_notification_done_error = 2,
-	/** the fast reload thread is told to exit by the server thread.
-	 * Sent on server quit while the reload is running. */
-	fast_reload_notification_exit = 3,
-	/** the fast reload thread has exited, after being told to exit */
-	fast_reload_notification_exited = 4,
-	/** the fast reload thread has information to print out */
-	fast_reload_notification_printout = 5,
-	/** stop as part of the reload the thread and other threads */
-	fast_reload_notification_reload_stop = 6,
-	/** ack the stop as part of the reload, and also ack start */
-	fast_reload_notification_reload_ack = 7,
-	/** resume from stop as part of the reload */
-	fast_reload_notification_reload_start = 8,
-	/** the fast reload thread wants the mainthread to poll workers,
-	 * after the reload, sent when nopause is used */
-	fast_reload_notification_reload_nopause_poll = 9
-};
-
-/**
- * Fast reload printout queue. Contains a list of strings, that need to be
- * printed over the file descriptor.
- */
-struct fast_reload_printq {
-	/** if this item is in a list, the previous and next */
-	struct fast_reload_printq *prev, *next;
-	/** if this item is in a list, it is true. */
-	int in_list;
-	/** list of strings to printout */
-	struct config_strlist_head* to_print;
-	/** the current item to print. It is malloced. NULL if none. */
-	char* client_item;
-	/** The length, strlen, of the client_item, that has to be sent. */
-	int client_len;
-	/** The number of bytes sent of client_item. */
-	int client_byte_count;
-	/** the comm point for the client connection, the remote control
-	 * client. */
-	struct comm_point* client_cp;
-	/** the remote control connection to print output to. */
-	struct remote_stream remote;
-	/** the worker that the event is added in */
-	struct worker* worker;
-};
-
-/**
- * Fast reload auth zone change. Keeps track if an auth zone was removed,
- * added or changed. This is needed because workers can have events for
- * dealing with auth zones, like transfers, and those have to be removed
- * too, not just the auth zone structure from the tree. */
-struct fast_reload_auth_change {
-	/** next in the list of auth zone changes. */
-	struct fast_reload_auth_change* next;
-	/** the zone in the old config */
-	struct auth_zone* old_z;
-	/** the zone in the new config */
-	struct auth_zone* new_z;
-	/** if the zone was deleted */
-	int is_deleted;
-	/** if the zone was added */
-	int is_added;
-	/** if the zone has been changed */
-	int is_changed;
-};
-
-/**
- * Fast reload thread structure
- */
-struct fast_reload_thread {
-	/** the thread number for the dtio thread,
-	 * must be first to cast thread arg to int* in checklock code. */
-	int threadnum;
-	/** communication socket pair, that sends commands */
-	int commpair[2];
-	/** thread id, of the io thread */
-	ub_thread_type tid;
-	/** if the io processing has started */
-	int started;
-	/** if the thread has to quit */
-	int need_to_quit;
-	/** verbosity of the fast_reload command, the number of +v options */
-	int fr_verb;
-	/** option to not pause threads during reload */
-	int fr_nopause;
-	/** option to drop mesh queries */
-	int fr_drop_mesh;
-
-	/** the event that listens on the remote service worker to the
-	 * commpair, it receives content from the fast reload thread. */
-	void* service_event;
-	/** if the event that listens on the remote service worker has
-	 * been added to the comm base. */
-	int service_event_is_added;
-	/** the service event can read a cmd, nonblocking, so it can
-	 * save the partial read cmd here */
-	uint32_t service_read_cmd;
-	/** the number of bytes in service_read_cmd */
-	int service_read_cmd_count;
-	/** the worker that the service_event is added in */
-	struct worker* worker;
-
-	/** the printout of output to the remote client. */
-	struct fast_reload_printq *printq;
-
-	/** lock on fr_output, to stop race when both remote control thread
-	 * and fast reload thread use fr_output list. */
-	lock_basic_type fr_output_lock;
-	/** list of strings, that the fast reload thread produces that have
-	 * to be printed. The remote control thread can pick them up with
-	 * the lock. */
-	struct config_strlist_head* fr_output;
-
-	/** communication socket pair, to respond to the reload request */
-	int commreload[2];
-
-	/** the list of auth zone changes. */
-	struct fast_reload_auth_change* auth_zone_change_list;
-	/** the old tree of auth zones, to lookup. */
-	struct auth_zones* old_auth_zones;
-};
-
 /**
 * Create new remote control state for the daemon.
 * @param cfg: config file with key file settings.
@@ -336,38 +203,4 @@ int ssl_printf(RES* ssl, const char* format, ...)
 int ssl_read_line(RES* ssl, char* buf, size_t max);
 #endif /* HAVE_SSL */

-/**
- * Start fast reload thread
- * @param ssl: the RES connection to print to.
- * @param worker: the remote servicing worker.
- * @param s: the rc_state that is servicing the remote control connection to
- *	the remote control client. It needs to be moved away to stay connected
- *	while the fast reload is running.
- * @param fr_verb: verbosity to print output at. 0 is nothing, 1 is some
- *	and 2 is more detail.
- * @param fr_nopause: option to not pause threads during reload.
- * @param fr_drop_mesh: option to drop mesh queries.
- */
-void fast_reload_thread_start(RES* ssl, struct worker* worker,
-	struct rc_state* s, int fr_verb, int fr_nopause, int fr_drop_mesh);
-
-/**
- * Stop fast reload thread
- * @param fast_reload_thread: the thread struct.
- */
-void fast_reload_thread_stop(struct fast_reload_thread* fast_reload_thread);
-
-/** fast reload thread commands to remote service thread event callback */
-void fast_reload_service_cb(int fd, short bits, void* arg);
-
-/** fast reload callback for the remote control client connection */
-int fast_reload_client_callback(struct comm_point* c, void* arg, int err,
-	struct comm_reply* rep);
-
-/** fast reload printq delete list */
-void fast_reload_printq_list_delete(struct fast_reload_printq* list);
-
-/** Pick up per worker changes after a fast reload. */
-void fast_reload_worker_pickup_changes(struct worker* worker);
-
 #endif /* DAEMON_REMOTE_H */
@@ -4,22 +4,22 @@
 * Copyright (c) 2007, NLnet Labs. All rights reserved.
 *
 * This software is open source.
- *
+ * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
- *
+ * 
 * Redistributions of source code must retain the above copyright notice,
 * this list of conditions and the following disclaimer.
- *
+ * 
 * Redistributions in binary form must reproduce the above copyright notice,
 * this list of conditions and the following disclaimer in the documentation
 * and/or other materials provided with the distribution.
- *
+ * 
 * Neither the name of the NLNET LABS nor the names of its contributors may
 * be used to endorse or promote products derived from this software without
 * specific prior written permission.
- *
+ * 
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -116,8 +116,8 @@ void server_stats_log(struct ub_server_stats* stats, struct worker* worker,
 	log_info("server stats for thread %d: %u queries, "
 		"%u answers from cache, %u recursions, %u prefetch, %u rejected by "
 		"ip ratelimiting",
-		threadnum, (unsigned)stats->num_queries,
-		(unsigned)(stats->num_queries -
+		threadnum, (unsigned)stats->num_queries, 
+		(unsigned)(stats->num_queries - 
 			stats->num_queries_missed_cache),
 		(unsigned)stats->num_queries_missed_cache,
 		(unsigned)stats->num_queries_prefetch,
@@ -279,14 +279,8 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 		s->svr.ans_rcode[i] += (long long)worker->env.mesh->ans_rcode[i];
 	for(i=0; i<UB_STATS_RPZ_ACTION_NUM; i++)
 		s->svr.rpz_action[i] += (long long)worker->env.mesh->rpz_action[i];
-	timehist_export(worker->env.mesh->histogram, s->svr.hist,
+	timehist_export(worker->env.mesh->histogram, s->svr.hist, 
 		NUM_BUCKETS_HIST);
-	s->svr.num_queries_discard_timeout +=
-		(long long)worker->env.mesh->num_queries_discard_timeout;
-	s->svr.num_queries_wait_limit +=
-		(long long)worker->env.mesh->num_queries_wait_limit;
-	s->svr.num_dns_error_reports +=
-		(long long)worker->env.mesh->num_dns_error_reports;
 	/* values from outside network */
 	s->svr.unwanted_replies = (long long)worker->back->unwanted_replies;
 	s->svr.qtcp_outgoing = (long long)worker->back->num_tcp_outgoing;
@@ -299,10 +293,8 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 	s->svr.queries_ratelimited = (long long)get_queries_ratelimit(worker, reset);

 	/* get cache sizes */
-	get_slabhash_stats(worker->env.msg_cache,
-		&s->svr.msg_cache_count, &s->svr.msg_cache_max_collisions);
-	get_slabhash_stats(&worker->env.rrset_cache->table,
-		&s->svr.rrset_cache_count, &s->svr.rrset_cache_max_collisions);
+	s->svr.msg_cache_count = (long long)count_slabhash_entries(worker->env.msg_cache);
+	s->svr.rrset_cache_count = (long long)count_slabhash_entries(&worker->env.rrset_cache->table);
 	s->svr.infra_cache_count = (long long)count_slabhash_entries(worker->env.infra_cache->hosts);
 	if(worker->env.key_cache)
 		s->svr.key_cache_count = (long long)count_slabhash_entries(worker->env.key_cache->slab);
@@ -331,8 +323,20 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 	s->svr.num_query_dnscrypt_replay = 0;
 #endif /* USE_DNSCRYPT */
 	if(worker->env.auth_zones) {
-		s->svr.num_query_authzone_up += (long long)worker->env.mesh->num_query_authzone_up;
-		s->svr.num_query_authzone_down += (long long)worker->env.mesh->num_query_authzone_down;
+		if(reset && !worker->env.cfg->stat_cumulative) {
+			lock_rw_wrlock(&worker->env.auth_zones->lock);
+		} else {
+			lock_rw_rdlock(&worker->env.auth_zones->lock);
+		}
+		s->svr.num_query_authzone_up = (long long)worker->env.
+			auth_zones->num_query_up;
+		s->svr.num_query_authzone_down = (long long)worker->env.
+			auth_zones->num_query_down;
+		if(reset && !worker->env.cfg->stat_cumulative) {
+			worker->env.auth_zones->num_query_up = 0;
+			worker->env.auth_zones->num_query_down = 0;
+		}
+		lock_rw_unlock(&worker->env.auth_zones->lock);
 	}
 	s->svr.mem_stream_wait =
 		(long long)tcp_req_info_get_stream_buffer_size();
@@ -340,12 +344,6 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 		(long long)http2_get_query_buffer_size();
 	s->svr.mem_http2_response_buffer =
 		(long long)http2_get_response_buffer_size();
-#ifdef HAVE_NGTCP2
-	s->svr.mem_quic = (long long)doq_table_quic_size_get(
-		worker->daemon->doq_table);
-#else
-	s->svr.mem_quic = 0;
-#endif /* HAVE_NGTCP2 */

 	/* Set neg cache usage numbers */
 	set_neg_cache_stats(worker, &s->svr, reset);
@@ -356,11 +354,6 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 	s->svr.num_query_subnet = 0;
 	s->svr.num_query_subnet_cache = 0;
 #endif
-#ifdef USE_CACHEDB
-	s->svr.num_query_cachedb = (long long)worker->env.mesh->ans_cachedb;
-#else
-	s->svr.num_query_cachedb = 0;
-#endif

 	/* get tcp accept usage */
 	s->svr.tcp_accept_usage = 0;
@@ -391,13 +384,6 @@ void server_stats_obtain(struct worker* worker, struct worker* who,
 	else 	worker_send_cmd(who, worker_cmd_stats_noreset);
 	verbose(VERB_ALGO, "wait for stats reply");
 	if(tube_wait_timeout(worker->cmd, STATS_THREAD_WAIT) == 0) {
-#if defined(HAVE_PTHREAD) && defined(SIZEOF_PTHREAD_T) && defined(SIZEOF_UNSIGNED_LONG)
-#  if SIZEOF_PTHREAD_T == SIZEOF_UNSIGNED_LONG
-		unsigned long pthid = 0;
-		if(verbosity >= VERB_OPS)
-			memcpy(&pthid, &who->thr_id, sizeof(unsigned long));
-#  endif
-#endif
 		verbose(VERB_OPS, "no response from thread %d"
 #ifdef HAVE_GETTID
 			" LWP %u"
@@ -414,7 +400,7 @@ void server_stats_obtain(struct worker* worker, struct worker* who,
 #endif
 #if defined(HAVE_PTHREAD) && defined(SIZEOF_PTHREAD_T) && defined(SIZEOF_UNSIGNED_LONG)
 #  if SIZEOF_PTHREAD_T == SIZEOF_UNSIGNED_LONG
-			, pthid
+			, (unsigned long)*((unsigned long*)&who->thr_id)
 #  endif
 #endif
 			);
@@ -433,7 +419,7 @@ void server_stats_reply(struct worker* worker, int reset)
 	struct ub_stats_info s;
 	server_stats_compile(worker, &s, reset);
 	verbose(VERB_ALGO, "write stats replymsg");
-	if(!tube_write_msg(worker->daemon->workers[0]->cmd,
+	if(!tube_write_msg(worker->daemon->workers[0]->cmd, 
 		(uint8_t*)&s, sizeof(s), 0))
 		fatal_exit("could not write stat values over cmd channel");
 }
@@ -442,28 +428,16 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 {
 	total->svr.num_queries += a->svr.num_queries;
 	total->svr.num_queries_ip_ratelimited += a->svr.num_queries_ip_ratelimited;
-	total->svr.num_queries_cookie_valid += a->svr.num_queries_cookie_valid;
-	total->svr.num_queries_cookie_client += a->svr.num_queries_cookie_client;
-	total->svr.num_queries_cookie_invalid += a->svr.num_queries_cookie_invalid;
-	total->svr.num_queries_discard_timeout +=
-		a->svr.num_queries_discard_timeout;
-	total->svr.num_queries_wait_limit += a->svr.num_queries_wait_limit;
-	total->svr.num_dns_error_reports += a->svr.num_dns_error_reports;
 	total->svr.num_queries_missed_cache += a->svr.num_queries_missed_cache;
 	total->svr.num_queries_prefetch += a->svr.num_queries_prefetch;
-	total->svr.num_queries_timed_out += a->svr.num_queries_timed_out;
-	total->svr.num_query_authzone_up += a->svr.num_query_authzone_up;
-	total->svr.num_query_authzone_down += a->svr.num_query_authzone_down;
-	if (total->svr.max_query_time_us < a->svr.max_query_time_us)
-		total->svr.max_query_time_us = a->svr.max_query_time_us;
 	total->svr.sum_query_list_size += a->svr.sum_query_list_size;
 	total->svr.ans_expired += a->svr.ans_expired;
 #ifdef USE_DNSCRYPT
 	total->svr.num_query_dnscrypt_crypted += a->svr.num_query_dnscrypt_crypted;
 	total->svr.num_query_dnscrypt_cert += a->svr.num_query_dnscrypt_cert;
-	total->svr.num_query_dnscrypt_cleartext +=
+	total->svr.num_query_dnscrypt_cleartext += \
 		a->svr.num_query_dnscrypt_cleartext;
-	total->svr.num_query_dnscrypt_crypted_malformed +=
+	total->svr.num_query_dnscrypt_crypted_malformed += \
 		a->svr.num_query_dnscrypt_crypted_malformed;
 #endif /* USE_DNSCRYPT */
 	/* the max size reached is upped to higher of both */
@@ -480,7 +454,6 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 		total->svr.qtls += a->svr.qtls;
 		total->svr.qtls_resume += a->svr.qtls_resume;
 		total->svr.qhttps += a->svr.qhttps;
-		total->svr.qquic += a->svr.qquic;
 		total->svr.qipv6 += a->svr.qipv6;
 		total->svr.qbit_QR += a->svr.qbit_QR;
 		total->svr.qbit_AA += a->svr.qbit_AA;
@@ -498,9 +471,6 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 		total->svr.unwanted_replies += a->svr.unwanted_replies;
 		total->svr.unwanted_queries += a->svr.unwanted_queries;
 		total->svr.tcp_accept_usage += a->svr.tcp_accept_usage;
-#ifdef USE_CACHEDB
-		total->svr.num_query_cachedb += a->svr.num_query_cachedb;
-#endif
 		for(i=0; i<UB_STATS_QTYPE_NUM; i++)
 			total->svr.qtype[i] += a->svr.qtype[i];
 		for(i=0; i<UB_STATS_QCLASS_NUM; i++)
@@ -540,20 +510,15 @@ void server_stats_insquery(struct ub_server_stats* stats, struct comm_point* c,
 	else	stats->qclass_big++;
 	stats->qopcode[ LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) ]++;
 	if(c->type != comm_udp) {
-		if(c->type != comm_doq)
-			stats->qtcp++;
+		stats->qtcp++;
 		if(c->ssl != NULL) {
 			stats->qtls++;
 #ifdef HAVE_SSL
-			if(SSL_session_reused(c->ssl))
+			if(SSL_session_reused(c->ssl)) 
 				stats->qtls_resume++;
 #endif
 			if(c->type == comm_http)
 				stats->qhttps++;
-#ifdef HAVE_NGTCP2
-			else if(c->type == comm_doq)
-				stats->qquic++;
-#endif
 		}
 	}
 	if(repinfo && addr_is_ip6(&repinfo->remote_addr, repinfo->remote_addrlen))
@@ -590,16 +555,3 @@ void server_stats_insrcode(struct ub_server_stats* stats, sldns_buffer* buf)
 			stats->ans_rcode_nodata ++;
 	}
 }
-
-void server_stats_downstream_cookie(struct ub_server_stats* stats,
-	struct edns_data* edns)
-{
-	if(!(edns->edns_present && edns->cookie_present)) return;
-	if(edns->cookie_valid) {
-		stats->num_queries_cookie_valid++;
-	} else if(edns->cookie_client) {
-		stats->num_queries_cookie_client++;
-	} else {
-		stats->num_queries_cookie_invalid++;
-	}
-}
@@ -126,11 +126,4 @@ void server_stats_insquery(struct ub_server_stats* stats, struct comm_point* c,
 */
 void server_stats_insrcode(struct ub_server_stats* stats, struct sldns_buffer* buf);

-/**
- * Add DNS Cookie stats for this query
- * @param stats: the stats
- * @param edns: edns record
- */
-void server_stats_downstream_cookie(struct ub_server_stats* stats,
-	struct edns_data* edns);
 #endif /* DAEMON_STATS_H */
@@ -366,8 +366,9 @@ readpid (const char* file)
 /** write pid to file. 
 * @param pidfile: file name of pid file.
 * @param pid: pid to write to file.
+ * @return false on failure
 */
-static void
+static int
 writepid (const char* pidfile, pid_t pid)
 {
 	int fd;
@@ -382,7 +383,7 @@ writepid (const char* pidfile, pid_t pid)
 		, 0644)) == -1) {
 		log_err("cannot open pidfile %s: %s", 
 			pidfile, strerror(errno));
-		return;
+		return 0;
 	}
 	while(count < strlen(pidbuf)) {
 		ssize_t r = write(fd, pidbuf+count, strlen(pidbuf)-count);
@@ -392,16 +393,17 @@ writepid (const char* pidfile, pid_t pid)
 			log_err("cannot write to pidfile %s: %s",
 				pidfile, strerror(errno));
 			close(fd);
-			return;
+			return 0;
 		} else if(r == 0) {
 			log_err("cannot write any bytes to pidfile %s: "
 				"write returns 0 bytes written", pidfile);
 			close(fd);
-			return;
+			return 0;
 		}
 		count += r;
 	}
 	close(fd);
+	return 1;
 }

 /**
@@ -463,64 +465,6 @@ detach(void)
 #endif /* HAVE_DAEMON */
 }

-/* setup a listening ssl context, fatal_exit() on any failure */
-static void
-setup_listen_sslctx(void** ctx, int is_dot, int is_doh, struct config_file* cfg)
-{
-#ifdef HAVE_SSL
-	if(!(*ctx = listen_sslctx_create(
-		cfg->ssl_service_key, cfg->ssl_service_pem, NULL,
-		cfg->tls_ciphers, cfg->tls_ciphersuites,
-		(cfg->tls_session_ticket_keys.first &&
-		cfg->tls_session_ticket_keys.first->str[0] != 0),
-		is_dot, is_doh))) {
-		fatal_exit("could not set up listen SSL_CTX");
-	}
-#else /* HAVE_SSL */
-	(void)ctx;(void)is_dot;(void)is_doh;(void)cfg;
-#endif /* HAVE_SSL */
-}
-
-/* setups the needed ssl contexts, fatal_exit() on any failure */
-static void
-setup_sslctxs(struct daemon* daemon, struct config_file* cfg)
-{
-#ifdef HAVE_SSL
-	if(!(daemon->rc = daemon_remote_create(cfg)))
-		fatal_exit("could not set up remote-control");
-	if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
-		/* setup the session keys; the callback to use them will be
-		 * attached to each sslctx separately */
-		if(cfg->tls_session_ticket_keys.first &&
-			cfg->tls_session_ticket_keys.first->str[0] != 0) {
-			if(!listen_sslctx_setup_ticket_keys(
-				cfg->tls_session_ticket_keys.first)) {
-				fatal_exit("could not set session ticket SSL_CTX");
-			}
-		}
-		(void)setup_listen_sslctx(&daemon->listen_dot_sslctx, 1, 0, cfg);
-#ifdef HAVE_NGHTTP2_NGHTTP2_H
-		if(cfg_has_https(cfg)) {
-			(void)setup_listen_sslctx(&daemon->listen_doh_sslctx, 0, 1, cfg);
-		}
-#endif
-#ifdef HAVE_NGTCP2
-		if(cfg_has_quic(cfg)) {
-			if(!(daemon->listen_quic_sslctx = quic_sslctx_create(
-				cfg->ssl_service_key, cfg->ssl_service_pem, NULL))) {
-				fatal_exit("could not set up quic SSL_CTX");
-			}
-		}
-#endif /* HAVE_NGTCP2 */
-	}
-	if(!(daemon->connect_dot_sslctx = connect_sslctx_create(NULL, NULL,
-		cfg->tls_cert_bundle, cfg->tls_win_cert)))
-		fatal_exit("could not set up connect SSL_CTX");
-#else /* HAVE_SSL */
-	(void)daemon;(void)cfg;
-#endif /* HAVE_SSL */
-}
-
 /** daemonize, drop user privileges and chroot if needed */
 static void
 perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
@@ -531,11 +475,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #endif
 #ifdef HAVE_GETPWNAM
 	struct passwd *pwd = NULL;
-#endif

-	if(!daemon_privileged(daemon))
-		fatal_exit("could not do privileged setup");
-#ifdef HAVE_GETPWNAM
 	if(cfg->username && cfg->username[0]) {
 		if((pwd = getpwnam(cfg->username)) == NULL)
 			fatal_exit("user '%s' does not exist.", cfg->username);
@@ -547,7 +487,36 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #endif

 	/* read ssl keys while superuser and outside chroot */
-	(void)setup_sslctxs(daemon, cfg);
+#ifdef HAVE_SSL
+	if(!(daemon->rc = daemon_remote_create(cfg)))
+		fatal_exit("could not set up remote-control");
+	if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
+		if(!(daemon->listen_sslctx = listen_sslctx_create(
+			cfg->ssl_service_key, cfg->ssl_service_pem, NULL)))
+			fatal_exit("could not set up listen SSL_CTX");
+		if(cfg->tls_ciphers && cfg->tls_ciphers[0]) {
+			if (!SSL_CTX_set_cipher_list(daemon->listen_sslctx, cfg->tls_ciphers)) {
+				fatal_exit("failed to set tls-cipher %s", cfg->tls_ciphers);
+			}
+		}
+#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
+		if(cfg->tls_ciphersuites && cfg->tls_ciphersuites[0]) {
+			if (!SSL_CTX_set_ciphersuites(daemon->listen_sslctx, cfg->tls_ciphersuites)) {
+				fatal_exit("failed to set tls-ciphersuites %s", cfg->tls_ciphersuites);
+			}
+		}
+#endif
+		if(cfg->tls_session_ticket_keys.first &&
+			cfg->tls_session_ticket_keys.first->str[0] != 0) {
+			if(!listen_sslctx_setup_ticket_keys(daemon->listen_sslctx, cfg->tls_session_ticket_keys.first)) {
+				fatal_exit("could not set session ticket SSL_CTX");
+			}
+		}
+	}
+	if(!(daemon->connect_sslctx = connect_sslctx_create(NULL, NULL,
+		cfg->tls_cert_bundle, cfg->tls_win_cert)))
+		fatal_exit("could not set up connect SSL_CTX");
+#endif

 	/* init syslog (as root) if needed, before daemonize, otherwise
 	 * a fork error could not be printed since daemonize closed stderr.*/
@@ -576,15 +545,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 				cfg, 1);
 		if(!daemon->pidfile)
 			fatal_exit("pidfile alloc: out of memory");
-		/* Check old pid if there is no username configured.
-		 * With a username, the assumption is that the privilege
-		 * drop makes a pidfile not removed when the server stopped
-		 * last time. The server does not chown the pidfile for it,
-		 * because that creates privilege escape problems, with the
-		 * pidfile writable by unprivileged users, but used by
-		 * privileged users. */
-		if(!(cfg->username && cfg->username[0]))
-			checkoldpid(daemon->pidfile, pidinchroot);
+		checkoldpid(daemon->pidfile, pidinchroot);
 	}
 #endif

@@ -596,7 +557,18 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 	/* write new pidfile (while still root, so can be outside chroot) */
 #ifdef HAVE_KILL
 	if(cfg->pidfile && cfg->pidfile[0] && need_pidfile) {
-		writepid(daemon->pidfile, getpid());
+		if(writepid(daemon->pidfile, getpid())) {
+			if(cfg->username && cfg->username[0] && cfg_uid != (uid_t)-1 &&
+				pidinchroot) {
+#  ifdef HAVE_CHOWN
+				if(chown(daemon->pidfile, cfg_uid, cfg_gid) == -1) {
+					verbose(VERB_QUERY, "cannot chown %u.%u %s: %s",
+						(unsigned)cfg_uid, (unsigned)cfg_gid,
+						daemon->pidfile, strerror(errno));
+				}
+#  endif /* HAVE_CHOWN */
+			}
+		}
 	}
 #else
 	(void)daemon;
@@ -710,9 +682,6 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 	 * it would succeed on SIGHUP as well */
 	if(!cfg->use_syslog)
 		log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
-	daemon->cfgfile = strdup(*cfgfile);
-	if(!daemon->cfgfile)
-		fatal_exit("out of memory in daemon cfgfile strdup");
 }

 /**
@@ -777,11 +746,7 @@ run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode, int need_pi
 	if(daemon->pidfile) {
 		int fd;
 		/* truncate pidfile */
-		fd = open(daemon->pidfile, O_WRONLY | O_TRUNC
-#ifdef O_NOFOLLOW
-			| O_NOFOLLOW
-#endif
-			, 0644);
+		fd = open(daemon->pidfile, O_WRONLY | O_TRUNC, 0644);
 		if(fd != -1)
 			close(fd);
 		/* delete pidfile */
@@ -72,13 +72,7 @@ enum worker_commands {
 	/** obtain statistics without statsclear */
 	worker_cmd_stats_noreset,
 	/** execute remote control command */
-	worker_cmd_remote,
-	/** for fast-reload, perform stop */
-	worker_cmd_reload_stop,
-	/** for fast-reload, start again */
-	worker_cmd_reload_start,
-	/** for fast-reload, poll to make sure worker has released data */
-	worker_cmd_reload_poll
+	worker_cmd_remote
 };

 /**
@@ -124,7 +118,7 @@ struct worker {
 	/** do we need to restart or quit (on signal) */
 	int need_to_exit;
 	/** allocation cache for this thread */
-	struct alloc_cache *alloc;
+	struct alloc_cache alloc;
 	/** per thread statistics */
 	struct ub_server_stats stats;
 	/** thread scratch regional */
@@ -137,8 +131,6 @@ struct worker {
 	/** dnstap environment, changed for this thread */
 	struct dt_env dtenv;
 #endif
-	/** reuse existing cache on reload if other conditions allow it. */
-	int reuse_cache;
 };

 /**
@@ -59,7 +59,7 @@
 ******************************************************************************/

 /**
- * This is the default DNS64 prefix that is used when the dns64 module is listed
+ * This is the default DNS64 prefix that is used whent he dns64 module is listed
 * in module-config but when the dns64-prefix variable is not present.
 */
 static const char DEFAULT_DNS64_PREFIX[] = "64:ff9b::/96";
@@ -573,29 +573,28 @@ static enum module_ext_state
 handle_event_pass(struct module_qstate* qstate, int id)
 {
 	struct dns64_qstate* iq = (struct dns64_qstate*)qstate->minfo[id];
-	int synth_all_cfg = qstate->env->cfg->dns64_synthall;
-	int synth_qname = 0;
+	if (iq && iq->state == DNS64_NEW_QUERY
+            && qstate->qinfo.qtype == LDNS_RR_TYPE_PTR
+            && qstate->qinfo.qname_len == 74
+            && !strcmp((char*)&qstate->qinfo.qname[64], "\03ip6\04arpa"))
+        /* Handle PTR queries for IPv6 addresses. */
+        return handle_ipv6_ptr(qstate, id);

-	if(iq && iq->state == DNS64_NEW_QUERY
-		&& qstate->qinfo.qtype == LDNS_RR_TYPE_PTR
-		&& qstate->qinfo.qname_len == 74
-		&& !strcmp((char*)&qstate->qinfo.qname[64], "\03ip6\04arpa")) {
-		/* Handle PTR queries for IPv6 addresses. */
-		return handle_ipv6_ptr(qstate, id);
-	}
+	if (qstate->env->cfg->dns64_synthall &&
+	    iq && iq->state == DNS64_NEW_QUERY
+	    && qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA)
+		return generate_type_A_query(qstate, id);

-	if(iq && iq->state == DNS64_NEW_QUERY &&
-		qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA &&
-		(synth_all_cfg ||
-		(synth_qname=(dns64_always_synth_for_qname(qstate, id)
-			&& !(qstate->query_flags & BIT_CD))))) {
-		if(synth_qname)
-			verbose(VERB_ALGO, "dns64: ignore-aaaa and synthesize anyway");
+	if(dns64_always_synth_for_qname(qstate, id) &&
+	    iq && iq->state == DNS64_NEW_QUERY
+	    && !(qstate->query_flags & BIT_CD)
+	    && qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA) {
+		verbose(VERB_ALGO, "dns64: ignore-aaaa and synthesize anyway");
 		return generate_type_A_query(qstate, id);
 	}

 	/* We are finished when our sub-query is finished. */
-	if(iq && iq->state == DNS64_SUBQUERY_FINISHED)
+	if (iq && iq->state == DNS64_SUBQUERY_FINISHED)
 		return module_finished;

 	/* Otherwise, pass request to next module. */
@@ -628,38 +627,32 @@ handle_event_moddone(struct module_qstate* qstate, int id)
     *        synthesize in (sec 5.1.2 of RFC6147).
     *   - A successful AAAA query with an answer.
     */
+	if((!iq || iq->state != DNS64_INTERNAL_QUERY)
+            && qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA
+	    && !(qstate->query_flags & BIT_CD)
+	    && !(qstate->return_msg &&
+		    qstate->return_msg->rep &&
+		    reply_find_answer_rrset(&qstate->qinfo,
+			    qstate->return_msg->rep)))
+		/* not internal, type AAAA, not CD, and no answer RRset,
+		 * So, this is a AAAA noerror/nodata answer */
+		return generate_type_A_query(qstate, id);

-	/* When an AAAA query completes check if we want to perform DNS64
-	 * synthesis. We skip queries with DNSSEC enabled (!CD) and
-	 * ones generated by us to retrive the A/PTR record to use for
-	 * synth. */
-	int could_synth =
-		qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA &&
-		(!iq || iq->state != DNS64_INTERNAL_QUERY) &&
-		!(qstate->query_flags & BIT_CD);
-	int has_data = /* whether query returned non-empty rrset */
-		qstate->return_msg &&
-		qstate->return_msg->rep &&
-		reply_find_answer_rrset(&qstate->qinfo, qstate->return_msg->rep);
-	int synth_qname = 0;
-
-	if(could_synth &&
-		(!has_data ||
-		(synth_qname=dns64_always_synth_for_qname(qstate, id)))) {
-		if(synth_qname)
-			verbose(VERB_ALGO, "dns64: ignore-aaaa and synthesize anyway");
+	if((!iq || iq->state != DNS64_INTERNAL_QUERY)
+	    && qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA
+	    && !(qstate->query_flags & BIT_CD)
+	    && dns64_always_synth_for_qname(qstate, id)) {
+		/* if it is not internal, AAAA, not CD and listed domain,
+		 * generate from A record and ignore AAAA */
+		verbose(VERB_ALGO, "dns64: ignore-aaaa and synthesize anyway");
 		return generate_type_A_query(qstate, id);
 	}

 	/* Store the response in cache. */
-	if( (!iq || !iq->started_no_cache_store) &&
-		qstate->return_msg &&
-		qstate->return_msg->rep &&
-		!dns_cache_store(
-			qstate->env, &qstate->qinfo, qstate->return_msg->rep,
-			0, qstate->prefetch_leeway, 0, NULL,
-			qstate->query_flags, qstate->qstarttime,
-			qstate->is_valrec))
+	if ( (!iq || !iq->started_no_cache_store) &&
+		qstate->return_msg && qstate->return_msg->rep &&
+		!dns_cache_store(qstate->env, &qstate->qinfo, qstate->return_msg->rep,
+		0, 0, 0, NULL, qstate->query_flags, qstate->qstarttime))
 		log_err("out of memory");

 	/* do nothing */
@@ -702,7 +695,6 @@ dns64_operate(struct module_qstate* qstate, enum module_ev event, int id,
 			iq->state = DNS64_NEW_QUERY;
 			iq->started_no_cache_store = qstate->no_cache_store;
 			qstate->no_cache_store = 1;
-			ATTR_FALLTHROUGH
  			/* fallthrough */
 		case module_event_pass:
 			qstate->ext_state[id] = handle_event_pass(qstate, id);
@@ -848,9 +840,8 @@ dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate
 	 */
 	cp = construct_reply_info_base(super->region, rep->flags, rep->qdcount,
 		rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl,
-		rep->serve_expired_norec_ttl,
 		rep->an_numrrsets, rep->ns_numrrsets, rep->ar_numrrsets,
-		rep->rrset_count, rep->security, LDNS_EDE_NONE);
+		rep->rrset_count, rep->security);
 	if(!cp)
 		return;

@@ -978,19 +969,10 @@ dns64_inform_super(struct module_qstate* qstate, int id,
 	}
 	super_dq->state = DNS64_SUBQUERY_FINISHED;

-	/* If there is no successful answer, we're done.
-	 * Guarantee that we have at least a NOERROR reply further on. */
-	if(qstate->return_rcode != LDNS_RCODE_NOERROR
-		|| !qstate->return_msg
-		|| !qstate->return_msg->rep) {
-		return;
-	}
-
-	/* When no A record is found for synthesis fall back to AAAA again. */
-	if(qstate->qinfo.qtype == LDNS_RR_TYPE_A &&
-		!reply_find_answer_rrset(&qstate->qinfo,
-			qstate->return_msg->rep)) {
-		super_dq->state = DNS64_INTERNAL_QUERY;
+	/* If there is no successful answer, we're done. */
+	if (qstate->return_rcode != LDNS_RCODE_NOERROR
+	    || !qstate->return_msg
+	    || !qstate->return_msg->rep) {
 		return;
 	}

@@ -1009,8 +991,7 @@ dns64_inform_super(struct module_qstate* qstate, int id,
 	/* Store the generated response in cache. */
 	if ( (!super_dq || !super_dq->started_no_cache_store) &&
 		!dns_cache_store(super->env, &super->qinfo, super->return_msg->rep,
-		0, super->prefetch_leeway, 0, NULL, super->query_flags,
-		qstate->qstarttime, qstate->is_valrec))
+		0, 0, 0, NULL, super->query_flags, qstate->qstarttime))
 		log_err("out of memory");
 }

@@ -1048,8 +1029,8 @@ dns64_get_mem(struct module_env* env, int id)
 */
 static struct module_func_block dns64_block = {
 	"dns64",
-	NULL, NULL, &dns64_init, &dns64_deinit, &dns64_operate,
-	&dns64_inform_super, &dns64_clear, &dns64_get_mem
+	&dns64_init, &dns64_deinit, &dns64_operate, &dns64_inform_super,
+	&dns64_clear, &dns64_get_mem
 };

 /**
@@ -86,31 +86,6 @@ dt_pack(const Dnstap__Dnstap *d, void **buf, size_t *sz)
 	return 1;
 }

-/** See if the message is sent due to dnstap sample rate */
-static int
-dt_sample_rate_limited(struct dt_env* env)
-{
-	lock_basic_lock(&env->sample_lock);
-	/* Sampling is every [n] packets. Where n==1, every packet is sent */
-	if(env->sample_rate > 1) {
-		int submit = 0;
-		/* if sampling is engaged... */
-		if (env->sample_rate_count > env->sample_rate) {
-			/* once the count passes the limit */
-			/* submit the message */
-			submit = 1;
-			/* and reset the count */
-			env->sample_rate_count = 0;
-		}
-		/* increment count regardless */
-		env->sample_rate_count++;
-		lock_basic_unlock(&env->sample_lock);
-		return !submit;
-	}
-	lock_basic_unlock(&env->sample_lock);
-	return 0;
-}
-
 static void
 dt_send(const struct dt_env *env, void *buf, size_t len_buf)
 {
@@ -171,7 +146,6 @@ dt_create(struct config_file* cfg)
 	env = (struct dt_env *) calloc(1, sizeof(struct dt_env));
 	if (!env)
 		return NULL;
-	lock_basic_init(&env->sample_lock);

 	env->dtio = dt_io_thread_create();
 	if(!env->dtio) {
@@ -192,11 +166,8 @@ static void
 dt_apply_identity(struct dt_env *env, struct config_file *cfg)
 {
 	char buf[MAXHOSTNAMELEN+1];
-	if (!cfg->dnstap_send_identity) {
-		free(env->identity);
-		env->identity = NULL;
+	if (!cfg->dnstap_send_identity)
 		return;
-	}
 	free(env->identity);
 	if (cfg->dnstap_identity == NULL || cfg->dnstap_identity[0] == 0) {
 		if (gethostname(buf, MAXHOSTNAMELEN) == 0) {
@@ -218,11 +189,8 @@ dt_apply_identity(struct dt_env *env, struct config_file *cfg)
 static void
 dt_apply_version(struct dt_env *env, struct config_file *cfg)
 {
-	if (!cfg->dnstap_send_version) {
-		free(env->version);
-		env->version = NULL;
+	if (!cfg->dnstap_send_version)
 		return;
-	}
 	free(env->version);
 	if (cfg->dnstap_version == NULL || cfg->dnstap_version[0] == 0)
 		env->version = strdup(PACKAGE_STRING);
@@ -236,8 +204,13 @@ dt_apply_version(struct dt_env *env, struct config_file *cfg)
 }

 void
-dt_apply_logcfg(struct dt_env *env, struct config_file *cfg)
+dt_apply_cfg(struct dt_env *env, struct config_file *cfg)
 {
+	if (!cfg->dnstap)
+		return;
+
+	dt_apply_identity(env, cfg);
+	dt_apply_version(env, cfg);
 	if ((env->log_resolver_query_messages = (unsigned int)
 	     cfg->dnstap_log_resolver_query_messages))
 	{
@@ -268,23 +241,6 @@ dt_apply_logcfg(struct dt_env *env, struct config_file *cfg)
 	{
 		verbose(VERB_OPS, "dnstap Message/FORWARDER_RESPONSE enabled");
 	}
-	lock_basic_lock(&env->sample_lock);
-	if((env->sample_rate = (unsigned int)cfg->dnstap_sample_rate))
-	{
-		verbose(VERB_OPS, "dnstap SAMPLE_RATE enabled and set to \"%d\"", (int)env->sample_rate);
-	}
-	lock_basic_unlock(&env->sample_lock);
-}
-
-void
-dt_apply_cfg(struct dt_env *env, struct config_file *cfg)
-{
-	if (!cfg->dnstap)
-		return;
-
-	dt_apply_identity(env, cfg);
-	dt_apply_version(env, cfg);
-	dt_apply_logcfg(env, cfg);
 }

 int
@@ -317,7 +273,6 @@ dt_delete(struct dt_env *env)
 	if (!env)
 		return;
 	dt_io_thread_delete(env->dtio);
-	lock_basic_destroy(&env->sample_lock);
 	free(env->identity);
 	free(env->version);
 	free(env);
@@ -350,7 +305,6 @@ dt_msg_fill_net(struct dt_msg *dm,
 		struct sockaddr_storage *qs,
 		struct sockaddr_storage *rs,
 		enum comm_point_type cptype,
-		void *cpssl,
 		ProtobufCBinaryData *qaddr, protobuf_c_boolean *has_qaddr,
 		uint32_t *qport, protobuf_c_boolean *has_qport,
 		ProtobufCBinaryData *raddr, protobuf_c_boolean *has_raddr,
@@ -417,26 +371,13 @@ dt_msg_fill_net(struct dt_msg *dm,
                *has_rport = 1;
        }

+	log_assert(cptype == comm_udp || cptype == comm_tcp);
 	if (cptype == comm_udp) {
 		/* socket_protocol */
 		dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__UDP;
 		dm->m.has_socket_protocol = 1;
 	} else if (cptype == comm_tcp) {
-		if (cpssl == NULL) {
-			/* socket_protocol */
-			dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__TCP;
-			dm->m.has_socket_protocol = 1;
-		} else {
-			/* socket_protocol */
-			dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__DOT;
-			dm->m.has_socket_protocol = 1;
-		}
-	} else if (cptype == comm_http) {
 		/* socket_protocol */
-		dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__DOH;
-		dm->m.has_socket_protocol = 1;
-	} else {
-		/* other socket protocol */
 		dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__TCP;
 		dm->m.has_socket_protocol = 1;
 	}
@@ -447,19 +388,12 @@ dt_msg_send_client_query(struct dt_env *env,
 			 struct sockaddr_storage *qsock,
 			 struct sockaddr_storage *rsock,
 			 enum comm_point_type cptype,
-			 void *cpssl,
-			 sldns_buffer *qmsg,
-			 struct timeval* tstamp)
+			 sldns_buffer *qmsg)
 {
 	struct dt_msg dm;
 	struct timeval qtime;

-	if(dt_sample_rate_limited(env))
-		return;
-
-	if(tstamp)
-		memcpy(&qtime, tstamp, sizeof(qtime));
-	else 	gettimeofday(&qtime, NULL);
+	gettimeofday(&qtime, NULL);

 	/* type */
 	dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_QUERY);
@@ -473,7 +407,8 @@ dt_msg_send_client_query(struct dt_env *env,
 	dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message);

 	/* socket_family, socket_protocol, query_address, query_port, response_address, response_port */
-	dt_msg_fill_net(&dm, qsock, rsock, cptype, cpssl,
+	log_assert(cptype == comm_udp || cptype == comm_tcp);
+	dt_msg_fill_net(&dm, qsock, rsock, cptype,
 			&dm.m.query_address, &dm.m.has_query_address,
 			&dm.m.query_port, &dm.m.has_query_port,
 			&dm.m.response_address, &dm.m.has_response_address,
@@ -489,15 +424,11 @@ dt_msg_send_client_response(struct dt_env *env,
 			    struct sockaddr_storage *qsock,
 			    struct sockaddr_storage *rsock,
 			    enum comm_point_type cptype,
-			    void *cpssl,
 			    sldns_buffer *rmsg)
 {
 	struct dt_msg dm;
 	struct timeval rtime;

-	if(dt_sample_rate_limited(env))
-		return;
-
 	gettimeofday(&rtime, NULL);

 	/* type */
@@ -512,7 +443,8 @@ dt_msg_send_client_response(struct dt_env *env,
 	dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message);

 	/* socket_family, socket_protocol, query_address, query_port, response_address, response_port */
-	dt_msg_fill_net(&dm, qsock, rsock, cptype, cpssl,
+	log_assert(cptype == comm_udp || cptype == comm_tcp);
+	dt_msg_fill_net(&dm, qsock, rsock, cptype,
 			&dm.m.query_address, &dm.m.has_query_address,
 			&dm.m.query_port, &dm.m.has_query_port,
                        &dm.m.response_address, &dm.m.has_response_address,
@@ -527,7 +459,6 @@ dt_msg_send_outside_query(struct dt_env *env,
 			  struct sockaddr_storage *rsock,
 			  struct sockaddr_storage *qsock,
 			  enum comm_point_type cptype,
-			  void *cpssl,
 			  uint8_t *zone, size_t zone_len,
 			  sldns_buffer *qmsg)
 {
@@ -535,9 +466,6 @@ dt_msg_send_outside_query(struct dt_env *env,
 	struct timeval qtime;
 	uint16_t qflags;

-	if(dt_sample_rate_limited(env))
-		return;
-
 	gettimeofday(&qtime, NULL);
 	qflags = sldns_buffer_read_u16_at(qmsg, 2);

@@ -566,7 +494,8 @@ dt_msg_send_outside_query(struct dt_env *env,
 	dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message);

 	/* socket_family, socket_protocol, response_address, response_port, query_address, query_port */
-	dt_msg_fill_net(&dm, rsock, qsock, cptype, cpssl,
+	log_assert(cptype == comm_udp || cptype == comm_tcp);
+	dt_msg_fill_net(&dm, rsock, qsock, cptype,
 			&dm.m.response_address, &dm.m.has_response_address,
 			&dm.m.response_port, &dm.m.has_response_port,
 			&dm.m.query_address, &dm.m.has_query_address,
@@ -581,7 +510,6 @@ dt_msg_send_outside_response(struct dt_env *env,
 	struct sockaddr_storage *rsock,
 	struct sockaddr_storage *qsock,
 	enum comm_point_type cptype,
-	void *cpssl,
 	uint8_t *zone, size_t zone_len,
 	uint8_t *qbuf, size_t qbuf_len,
 	const struct timeval *qtime,
@@ -591,9 +519,6 @@ dt_msg_send_outside_response(struct dt_env *env,
 	struct dt_msg dm;
 	uint16_t qflags;

-	if(dt_sample_rate_limited(env))
-		return;
-
 	(void)qbuf_len; log_assert(qbuf_len >= sizeof(qflags));
 	memcpy(&qflags, qbuf, sizeof(qflags));
 	qflags = ntohs(qflags);
@@ -628,7 +553,8 @@ dt_msg_send_outside_response(struct dt_env *env,
 	dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message);

 	/* socket_family, socket_protocol, response_address, response_port, query_address, query_port */
-	dt_msg_fill_net(&dm, rsock, qsock, cptype, cpssl,
+	log_assert(cptype == comm_udp || cptype == comm_tcp);
+	dt_msg_fill_net(&dm, rsock, qsock, cptype,
 			&dm.m.response_address, &dm.m.has_response_address,
 			&dm.m.response_port, &dm.m.has_response_port,
 			&dm.m.query_address, &dm.m.has_query_address,
@@ -39,7 +39,6 @@

 #ifdef USE_DNSTAP

-#include "util/locks.h"
 struct config_file;
 struct sldns_buffer;
 struct dt_msg_queue;
@@ -76,13 +75,6 @@ struct dt_env {
 	unsigned log_forwarder_query_messages : 1;
 	/** whether to log Message/FORWARDER_RESPONSE */
 	unsigned log_forwarder_response_messages : 1;
-
-	/** lock on sample count */
-	lock_basic_type sample_lock;
-	/** rate limit value from config, samples 1/N messages */
-	unsigned int sample_rate;
-	/** rate limit counter */
-	unsigned int sample_rate_count;
 };

 /**
@@ -106,13 +98,6 @@ dt_create(struct config_file* cfg);
 void
 dt_apply_cfg(struct dt_env *env, struct config_file *cfg);

-/**
- * Apply config settings for log enable for message types.
- * @param env: dnstap environment object.
- * @param cfg: new config settings.
- */
-void dt_apply_logcfg(struct dt_env *env, struct config_file *cfg);
-
 /**
 * Initialize per-worker state in dnstap environment object.
 * @param env: dnstap environment object to initialize, created with dt_create().
@@ -141,16 +126,13 @@ dt_delete(struct dt_env *env);
 * @param rsock: local (service) address/port.
 * @param cptype: comm_udp or comm_tcp.
 * @param qmsg: query message.
- * @param tstamp: timestamp or NULL if none provided.
 */
 void
 dt_msg_send_client_query(struct dt_env *env,
 			 struct sockaddr_storage *qsock,
 			 struct sockaddr_storage *rsock,
 			 enum comm_point_type cptype,
-			 void *cpssl,
-			 struct sldns_buffer *qmsg,
-			 struct timeval* tstamp);
+			 struct sldns_buffer *qmsg);

 /**
 * Create and send a new dnstap "Message" event of type CLIENT_RESPONSE.
@@ -165,7 +147,6 @@ dt_msg_send_client_response(struct dt_env *env,
 			    struct sockaddr_storage *qsock,
 			    struct sockaddr_storage *rsock,
 			    enum comm_point_type cptype,
-			    void *cpssl,
 			    struct sldns_buffer *rmsg);

 /**
@@ -185,7 +166,6 @@ dt_msg_send_outside_query(struct dt_env *env,
 			  struct sockaddr_storage *rsock,
 			  struct sockaddr_storage *qsock,
 			  enum comm_point_type cptype,
-			  void *cpssl,
 			  uint8_t *zone, size_t zone_len,
 			  struct sldns_buffer *qmsg);

@@ -210,7 +190,6 @@ dt_msg_send_outside_response(struct dt_env *env,
 			     struct sockaddr_storage *rsock,
 			     struct sockaddr_storage *qsock,
 			     enum comm_point_type cptype,
-			     void *cpssl,
 			     uint8_t *zone, size_t zone_len,
 			     uint8_t *qbuf, size_t qbuf_len,
 			     const struct timeval *qtime,
@@ -5,73 +5,45 @@
 # Check for required dnstap libraries and add dnstap configure args.
 AC_DEFUN([dt_DNSTAP],
 [
-    AC_ARG_ENABLE([dnstap],
-        AS_HELP_STRING([--enable-dnstap],
-            [Enable dnstap support (requires protobuf-c)]),
-        [opt_dnstap=$enableval],
-        [opt_dnstap=no])
+  AC_ARG_ENABLE([dnstap],
+    AS_HELP_STRING([--enable-dnstap],
+                   [Enable dnstap support (requires protobuf-c)]),
+    [opt_dnstap=$enableval], [opt_dnstap=no])

-    AC_ARG_WITH([dnstap-socket-path],
-        AS_HELP_STRING([--with-dnstap-socket-path=pathname],
-            [set default dnstap socket path]),
-        [opt_dnstap_socket_path=$withval],
-        [opt_dnstap_socket_path="$1"])
+  AC_ARG_WITH([dnstap-socket-path],
+    AS_HELP_STRING([--with-dnstap-socket-path=pathname],
+                   [set default dnstap socket path]),
+    [opt_dnstap_socket_path=$withval], [opt_dnstap_socket_path="$1"])

-    if test "x$opt_dnstap" != "xno"; then
-        AC_PATH_PROG([PROTOC_C], [protoc-c])
-        if test -z "$PROTOC_C"; then
-          AC_MSG_ERROR([The protoc-c program was not found. Please install protobuf-c!])
-        fi
-        AC_ARG_WITH([protobuf-c],
-            AS_HELP_STRING([--with-protobuf-c=path], [Path where protobuf-c is installed, for dnstap]),
-            [
-                # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
-                if test -f $withval/include/google/protobuf-c/protobuf-c.h; then
-                    CFLAGS="$CFLAGS -I$withval/include/google"
-                else
-                    CFLAGS="$CFLAGS -I$withval/include"
-                fi
-                LDFLAGS="$LDFLAGS -L$withval/lib"
-            ],
-            [
-                if test -n "$PKG_CONFIG"; then
-                    PKG_CHECK_MODULES([PROTOBUFC], [libprotobuf-c],
-                        [
-                            CFLAGS="$CFLAGS $PROTOBUFC_CFLAGS"
-                            LIBS="$LIBS $PROTOBUFC_LIBS"
-                        ],
-                        [
-                            # pkg-config failed; try falling back to known values
-                            # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
-                            if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
-                                CFLAGS="$CFLAGS -I/usr/include/google"
-                            else
-                                if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
-                                    CFLAGS="$CFLAGS -I/usr/local/include/google"
-                                    LDFLAGS="$LDFLAGS -L/usr/local/lib"
-                                else
-                                    AC_MSG_ERROR([The protobuf-c package was not found with pkg-config. Please install protobuf-c!])
-                                fi
-                            fi
-                        ]
-                    )
-                else
-                    # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
-                    if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
-                        CFLAGS="$CFLAGS -I/usr/include/google"
-                    else
-                        if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
-                            CFLAGS="$CFLAGS -I/usr/local/include/google"
-                            LDFLAGS="$LDFLAGS -L/usr/local/lib"
-                        fi
-                    fi
-                fi
-            ]
-        )
-        AC_SEARCH_LIBS([protobuf_c_message_pack], [protobuf-c], [],
-            AC_MSG_ERROR([The protobuf-c library was not found. Please install the development libraries for protobuf-c!]))
-        $2
-    else
-        $3
+  if test "x$opt_dnstap" != "xno"; then
+    AC_PATH_PROG([PROTOC_C], [protoc-c])
+    if test -z "$PROTOC_C"; then
+      AC_MSG_ERROR([The protoc-c program was not found. Please install protobuf-c!])
    fi
+    AC_ARG_WITH([protobuf-c], AS_HELP_STRING([--with-protobuf-c=path],
+    	[Path where protobuf-c is installed, for dnstap]), [
+	  # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
+	  if test -f $withval/include/google/protobuf-c/protobuf-c.h; then
+	    CFLAGS="$CFLAGS -I$withval/include/google"
+	  else
+	    CFLAGS="$CFLAGS -I$withval/include"
+	  fi
+	  LDFLAGS="$LDFLAGS -L$withval/lib"
+	], [
+	  # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
+	  if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
+	    CFLAGS="$CFLAGS -I/usr/include/google"
+	  else
+	    if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
+	      CFLAGS="$CFLAGS -I/usr/local/include/google"
+	      LDFLAGS="$LDFLAGS -L/usr/local/lib"
+	    fi
+	  fi
+    ])
+    AC_SEARCH_LIBS([protobuf_c_message_pack], [protobuf-c], [],
+      AC_MSG_ERROR([The protobuf-c library was not found. Please install protobuf-c!]))
+    $2
+  else
+    $3
+  fi
 ])
@@ -13,8 +13,8 @@
 // with this file. If not, see:
 //
 // <http://creativecommons.org/publicdomain/zero/1.0/>.
-
 syntax = "proto2";
+
 package dnstap;

 // "Dnstap": this is the top-level dnstap type, which is a "union" type that
@@ -56,60 +56,11 @@ enum SocketFamily {
    INET6 = 2;  // IPv6 (RFC 2460)
 }

-// SocketProtocol: the protocol used to transport a DNS message.
+// SocketProtocol: the transport protocol of a socket. This specifies how to
+// interpret "transport port" fields.
 enum SocketProtocol {
-    UDP = 1;         // DNS over UDP transport (RFC 1035 section 4.2.1)
-    TCP = 2;         // DNS over TCP transport (RFC 1035 section 4.2.2)
-    DOT = 3;         // DNS over TLS (RFC 7858)
-    DOH = 4;         // DNS over HTTPS (RFC 8484)
-    DNSCryptUDP = 5; // DNSCrypt over UDP (https://dnscrypt.info/protocol)
-    DNSCryptTCP = 6; // DNSCrypt over TCP (https://dnscrypt.info/protocol)
-    DOQ = 7;         // DNS over QUIC (RFC 9250)
-}
-
-// Policy: information about any name server operator policy
-// applied to the processing of a DNS message.
-message Policy {
-
-    // Match: what aspect of the message or message exchange
-    // triggered the application of the Policy.
-    enum Match {
-        QNAME = 1;       // Name in question section of query
-        CLIENT_IP = 2;   // Client IP address
-        RESPONSE_IP = 3; // Address in A/AAAA RRSet
-        NS_NAME = 4;     // Authoritative name server, by name
-        NS_IP = 5;       // Authoritative name server, by IP address
-    }
-
-    // The Action taken to implement the Policy.
-    enum Action {
-        NXDOMAIN = 1;   // Respond with NXDOMAIN
-        NODATA = 2;     // Respond with empty answer section
-        PASS = 3;       // Do not alter the response (passthrough)
-        DROP = 4;       // Do not respond.
-        TRUNCATE = 5;   // Truncate UDP response, forcing TCP retry
-        LOCAL_DATA = 6; // Respond with local data from policy
-    }
-
-    // type: the type of policy applied, e.g. "RPZ" for a
-    // policy from a Response Policy Zone.
-    optional string type = 1;
-
-    // rule: the rule matched by the message.
-    //
-    // In a RPZ context, this is the owner name of the rule in
-    // the Reponse Policy Zone in wire format.
-    optional bytes rule = 2;
-
-    // action: the policy action taken in response to the
-    // rule match.
-    optional Action action = 3;
-
-    // match: the feature of the message exchange which matched the rule.
-    optional Match match = 4;
-
-    // The matched value. Format depends on the matched feature .
-    optional bytes value = 5;
+    UDP = 1;    // User Datagram Protocol (RFC 768)
+    TCP = 2;    // Transmission Control Protocol (RFC 793)
 }

 // Message: a wire-format (RFC 1035 section 4) DNS message and associated
@@ -207,24 +158,6 @@ message Message {
        // STUB_RESPONSE is a DNS response message sent from a DNS server to a
        // stub resolver, from the perspective of the stub resolver.
        STUB_RESPONSE = 10;
-
-        // TOOL_QUERY is a DNS query message sent from a DNS software tool to a
-        // DNS server, from the perspective of the tool.
-        TOOL_QUERY = 11;
-
-        // TOOL_RESPONSE is a DNS response message received by a DNS software
-        // tool from a DNS server, from the perspective of the tool.
-        TOOL_RESPONSE = 12;
-
-        // UPDATE_QUERY is a Dynamic DNS Update request (RFC 2136) received
-        // by an authoritative name server, from the perspective of the
-        // authoritative name server.
-        UPDATE_QUERY = 13;
-
-        // UPDATE_RESPONSE is a Dynamic DNS Update response (RFC 2136) sent
-        // from an authoritative name server, from the perspective of the
-        // authoritative name server.
-        UPDATE_RESPONSE = 14;
    }

    // One of the Type values described above.
@@ -282,9 +215,6 @@ message Message {

    // The responder's original wire-format DNS response message, verbatim.
    optional bytes              response_message = 14;
-
-    // Operator policy applied to the processing of this message, if any.
-    optional Policy             policy = 15;
 }

 // All fields except for 'type' in the Message schema are optional.
@@ -306,6 +236,7 @@ message Message {

 // RESOLVER_QUERY:
 //      socket_family, socket_protocol
+//      query_name, query_type, query_class
 //      query_message
 //      query_time_sec, query_time_nsec
 //      query_zone
@@ -313,6 +244,7 @@ message Message {

 // RESOLVER_RESPONSE:
 //      socket_family, socket_protocol
+//      query_name, query_type, query_class
 //      query_time_sec, query_time_nsec
 //      query_zone
 //      response_address, response_port
@@ -176,7 +176,10 @@ void
 mq_wakeup_cb(void* arg)
 {
 	struct dt_msg_queue* mq = (struct dt_msg_queue*)arg;
-
+	/* even if the dtio is already active, because perhaps much
+	 * traffic suddenly, we leave the timer running to save on
+	 * managing it, the once a second timer is less work then
+	 * starting and stopping the timer frequently */
 	lock_basic_lock(&mq->dtio->wakeup_timer_lock);
 	mq->dtio->wakeup_timer_enabled = 0;
 	lock_basic_unlock(&mq->dtio->wakeup_timer_lock);
@@ -207,8 +210,6 @@ dt_msg_queue_start_timer(struct dt_msg_queue* mq, int wakeupnow)
 	lock_basic_lock(&mq->dtio->wakeup_timer_lock);
 	if(mq->dtio->wakeup_timer_enabled) {
 		if(wakeupnow) {
-			tv.tv_sec = 0;
-			tv.tv_usec = 0;
 			comm_timer_set(mq->wakeup_timer, &tv);
 		}
 		lock_basic_unlock(&mq->dtio->wakeup_timer_lock);
@@ -220,14 +221,8 @@ dt_msg_queue_start_timer(struct dt_msg_queue* mq, int wakeupnow)
 	if(!wakeupnow) {
 		tv.tv_sec = 1;
 		tv.tv_usec = 0;
-		/* If it is already set, keep it running. */
-		if(!comm_timer_is_set(mq->wakeup_timer))
-			comm_timer_set(mq->wakeup_timer, &tv);
-	} else {
-		tv.tv_sec = 0;
-		tv.tv_usec = 0;
-		comm_timer_set(mq->wakeup_timer, &tv);
 	}
+	comm_timer_set(mq->wakeup_timer, &tv);
 	lock_basic_unlock(&mq->dtio->wakeup_timer_lock);
 }

@@ -265,9 +260,8 @@ dt_msg_queue_submit(struct dt_msg_queue* mq, void* buf, size_t len)

 	/* acquire lock */
 	lock_basic_lock(&mq->lock);
-	/* if list was empty, start timer for (eventual) wakeup,
-	 * or if dtio is not writing now an eventual wakeup is needed. */
-	if(mq->first == NULL || !mq->dtio->event_added_is_write)
+	/* if list was empty, start timer for (eventual) wakeup */
+	if(mq->first == NULL)
 		wakeupstarttimer = 1;
 	/* if list contains more than wakeupnum elements, wakeup now,
 	 * or if list is (going to be) almost full */
@@ -794,7 +788,7 @@ static int dtio_write_ssl(struct dt_io_thread* dtio, uint8_t* buf,
 			}
 			return -1;
 		}
-		log_crypto_err_io("dnstap io, could not SSL_write", want);
+		log_crypto_err("dnstap io, could not SSL_write");
 		return -1;
 	}
 	return r;
@@ -1035,7 +1029,7 @@ static int ssl_read_bytes(struct dt_io_thread* dtio, void* buf, size_t len)
 				"other side");
 			return 0;
 		}
-		log_crypto_err_io("could not SSL_read", want);
+		log_crypto_err("could not SSL_read");
 		verbose(VERB_DETAIL, "dnstap io: output closed by the "
 				"other side");
 		return 0;
@@ -1265,13 +1259,6 @@ static void dtio_sleep(struct dt_io_thread* dtio)
 	/* unregister the event polling for write, because there is
 	 * nothing to be written */
 	(void)dtio_add_output_event_read(dtio);
-
-	/* Set wakeuptimer enabled off; so that the next worker thread that
-	 * wants to log starts a timer if needed, since the writer thread
-	 * has gone to sleep. */
-	lock_basic_lock(&dtio->wakeup_timer_lock);
-	dtio->wakeup_timer_enabled = 0;
-	lock_basic_unlock(&dtio->wakeup_timer_lock);
 }

 #ifdef HAVE_SSL
@@ -1335,11 +1322,7 @@ static int dtio_ssl_check_peer(struct dt_io_thread* dtio)
 	if((SSL_get_verify_mode(dtio->ssl)&SSL_VERIFY_PEER)) {
 		/* verification */
 		if(SSL_get_verify_result(dtio->ssl) == X509_V_OK) {
-#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
-			X509* x = SSL_get1_peer_certificate(dtio->ssl);
-#else
 			X509* x = SSL_get_peer_certificate(dtio->ssl);
-#endif
 			if(!x) {
 				verbose(VERB_ALGO, "dnstap io, %s, SSL "
 					"connection failed no certificate",
@@ -1364,11 +1347,7 @@ static int dtio_ssl_check_peer(struct dt_io_thread* dtio)
 #endif
 			X509_free(x);
 		} else {
-#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
-			X509* x = SSL_get1_peer_certificate(dtio->ssl);
-#else
 			X509* x = SSL_get_peer_certificate(dtio->ssl);
-#endif
 			if(x) {
 				log_cert(VERB_ALGO, "dnstap io, peer "
 					"certificate", x);
@@ -1452,8 +1431,8 @@ static int dtio_ssl_handshake(struct dt_io_thread* dtio,
 		} else {
 			unsigned long err = ERR_get_error();
 			if(!squelch_err_ssl_handshake(err)) {
-				log_crypto_err_io_code("dnstap io, ssl handshake failed",
-					want, err);
+				log_crypto_err_code("dnstap io, ssl handshake failed",
+					err);
 				verbose(VERB_OPS, "dnstap io, ssl handshake failed "
 					"from %s", dtio->ip_str);
 			}
@@ -1510,10 +1489,8 @@ void dtio_output_cb(int ATTR_UNUSED(fd), short bits, void* arg)
 #endif

 	if((bits&UB_EV_READ || dtio->ssl_brief_write)) {
-#ifdef HAVE_SSL
 		if(dtio->ssl_brief_write)
 			(void)dtio_disable_brief_write(dtio);
-#endif
 		if(dtio->ready_frame_sent && !dtio->accept_frame_received) {
 			if(dtio_read_accept_frame(dtio) <= 0)
 				return;
@@ -1536,22 +1513,8 @@ void dtio_output_cb(int ATTR_UNUSED(fd), short bits, void* arg)
 					/* no messages on the first iteration,
 					 * the queues are all empty */
 					dtio_sleep(dtio);
-					/* After putting to sleep, see if
-					 * a message is in a message queue,
-					 * if so, resume service. Stops a
-					 * race condition where a thread could
-					 * have one message but the dtio
-					 * also just went to sleep. With the
-					 * message queued between the
-					 * dtio_find_msg and dtio_sleep
-					 * calls. */
-					if(dtio_find_msg(dtio)) {
-						if(!dtio_add_output_event_write(dtio))
-							return;
-					}
 				}
-				if(!dtio->cur_msg)
-					return; /* nothing to do */
+				return; /* nothing to do */
 			}
 		}

@@ -61,7 +61,6 @@
 #include "services/listen_dnsport.h"
 #include "sldns/sbuffer.h"
 #include "sldns/wire2str.h"
-#include "sldns/pkthdr.h"
 #ifdef USE_DNSTAP
 #include <protobuf-c/protobuf-c.h>
 #include "dnstap/dnstap.pb-c.h"
@@ -75,18 +74,17 @@
 static void usage(char* argv[])
 {
 	printf("usage: %s [options]\n", argv[0]);
-	printf("	Listen to dnstap messages\n");
+	printf(" 	Listen to dnstap messages\n");
 	printf("stdout has dnstap log, stderr has verbose server log\n");
-	printf("-u <socketpath>		listen to unix socket with this file name\n");
-	printf("-s <serverip[@port]>	listen for TCP on the IP and port\n");
-	printf("-t <serverip[@port]>	listen for TLS on IP and port\n");
-	printf("-x <server.key>		server key file for TLS service\n");
-	printf("-y <server.pem>		server cert file for TLS service\n");
-	printf("-z <verify.pem>		cert file to verify client connections\n");
-	printf("-l			long format for DNS printout\n");
-	printf("-v			more verbose log output\n");
-	printf("-c			internal unit test and exit\n");
-	printf("-h			this help text\n");
+	printf("-u <socketpath> listen to unix socket with this file name\n");
+	printf("-s <serverip[@port]> listen for TCP on the IP and port\n");
+	printf("-t <serverip[@port]> listen for TLS on IP and port\n");
+	printf("-x <server.key> server key file for TLS service\n");
+	printf("-y <server.pem> server cert file for TLS service\n");
+	printf("-z <verify.pem> cert file to verify client connections\n");
+	printf("-l 		long format for DNS printout\n");
+	printf("-v 		more verbose log output\n");
+	printf("-h 		this help text\n");
 	exit(1);
 }

@@ -103,14 +101,6 @@ struct main_tap_data {
 	struct tap_socket_list* acceptlist;
 };

-/* list of data */
-struct tap_data_list {
-	/** next in list */
-	struct tap_data_list* next;
-	/** the data */
-	struct tap_data* d;
-};
-
 /** tap callback variables */
 struct tap_data {
 	/** the fd */
@@ -137,10 +127,6 @@ struct tap_data {
 	uint8_t* frame;
 	/** length of this frame */
 	size_t len;
-	/** back pointer to the tap_data_list entry;
-	 * used to NULL the forward pointer to this data
-	 * when this data is freed. */
-	struct tap_data_list* data_list;
 };

 /** list of sockets */
@@ -169,89 +155,8 @@ struct tap_socket {
 	char* ip;
 	/** for a TLS socket, the tls context */
 	SSL_CTX* sslctx;
-	/** dumb way to deal with memory leaks:
-	 * tap_data was only freed on errors and not during exit leading to
-	 * false positives when testing for memory leaks. */
-	struct tap_data_list* data_list;
 };

-/** try to delete tail entries from the list if all of them have no data */
-static void tap_data_list_try_to_free_tail(struct tap_data_list* list)
-{
-	struct tap_data_list* current = list;
-	log_assert(!list->d);
-	if(!list->next) /* we are the last, we can't remove ourselves */
-		return;
-	list = list->next;
-	while(list) {
-		if(list->d) /* a tail entry still has data; return */
-			return;
-		list = list->next;
-	}
-	/* keep the next */
-	list = current->next;
-	/* the tail will be removed; but not ourselves */
-	current->next = NULL;
-	while(list) {
-		current = list;
-		list = list->next;
-		free(current);
-	}
-}
-
-/** delete the tap structure */
-static void tap_data_free(struct tap_data* data, int free_tail)
-{
-	if(!data)
-		return;
-	if(data->ev) {
-		ub_event_del(data->ev);
-		ub_event_free(data->ev);
-	}
-#ifdef HAVE_SSL
-	SSL_free(data->ssl);
-#endif
-	sock_close(data->fd);
-	free(data->id);
-	free(data->frame);
-	if(data->data_list) {
-		data->data_list->d = NULL;
-		if(free_tail)
-			tap_data_list_try_to_free_tail(data->data_list);
-	}
-	free(data);
-}
-
-/** insert tap_data in the tap_data_list */
-static int tap_data_list_insert(struct tap_data_list** liststart,
-	struct tap_data* d)
-{
-	struct tap_data_list* entry = (struct tap_data_list*)
-		malloc(sizeof(*entry));
-	if(!entry)
-		return 0;
-	entry->next = *liststart;
-	entry->d = d;
-	d->data_list = entry;
-	*liststart = entry;
-	return 1;
-}
-
-/** delete the tap_data_list and free any remaining tap_data */
-static void tap_data_list_delete(struct tap_data_list* list)
-{
-	struct tap_data_list* e = list, *next;
-	while(e) {
-		next = e->next;
-		if(e->d) {
-			tap_data_free(e->d, 0);
-			e->d = NULL;
-		}
-		free(e);
-		e = next;
-	}
-}
-
 /** del the tap event */
 static void tap_socket_delev(struct tap_socket* s)
 {
@@ -267,7 +172,7 @@ static void tap_socket_close(struct tap_socket* s)
 {
 	if(!s) return;
 	if(s->fd == -1) return;
-	sock_close(s->fd);
+	close(s->fd);
 	s->fd = -1;
 }

@@ -278,7 +183,6 @@ static void tap_socket_delete(struct tap_socket* s)
 #ifdef HAVE_SSL
 	SSL_CTX_free(s->sslctx);
 #endif
-	tap_data_list_delete(s->data_list);
 	ub_event_free(s->ev);
 	free(s->socketpath);
 	free(s->ip);
@@ -346,8 +250,7 @@ static struct tap_socket* tap_socket_new_tlsaccept(char* ip,
 	s->fd = -1;
 	s->ev_cb = ev_cb;
 	s->data = data;
-	s->sslctx = listen_sslctx_create(server_key, server_cert, verifypem,
-		NULL, NULL, 0, 0, 0);
+	s->sslctx = listen_sslctx_create(server_key, server_cert, verifypem);
 	if(!s->sslctx) {
 		log_err("could not create ssl context");
 		free(s->ip);
@@ -545,7 +448,6 @@ static char* q_of_msg(ProtobufCBinaryData message)
 	char buf[300];
 	/* header, name, type, class minimum to get the query tuple */
 	if(message.len < 12 + 1 + 4 + 4) return NULL;
-	if(LDNS_QDCOUNT(message.data) < 1) return NULL;
 	if(sldns_wire2str_rrquestion_buf(message.data+12, message.len-12,
 		buf, sizeof(buf)) != 0) {
 		/* remove trailing newline, tabs to spaces */
@@ -600,7 +502,7 @@ static char* tv_to_str(protobuf_c_boolean has_time_sec, uint64_t time_sec,
 	time_t time_t_sec;
 	memset(&tv, 0, sizeof(tv));
 	if(has_time_sec) tv.tv_sec = time_sec;
-	if(has_time_nsec) tv.tv_usec = time_nsec/1000;
+	if(has_time_nsec) tv.tv_usec = time_nsec;

 	buf[0]=0;
 	time_t_sec = tv.tv_sec;
@@ -804,7 +706,7 @@ static ssize_t ssl_read_bytes(struct tap_data* data, void* buf, size_t len)
 				(data->id?data->id:""));
 			return 0;
 		}
-		log_crypto_err_io("could not SSL_read", want);
+		log_crypto_err("could not SSL_read");
 		if(verbosity) log_info("dnstap client stream closed from %s",
 			(data->id?data->id:""));
 		return 0;
@@ -824,12 +726,27 @@ static ssize_t tap_receive(struct tap_data* data, void* buf, size_t len)
 	return receive_bytes(data, data->fd, buf, len);
 }

+/** delete the tap structure */
+static void tap_data_free(struct tap_data* data)
+{
+	ub_event_del(data->ev);
+	ub_event_free(data->ev);
+#ifdef HAVE_SSL
+	SSL_free(data->ssl);
+#endif
+	close(data->fd);
+	free(data->id);
+	free(data->frame);
+	free(data);
+}
+
 /** reply with ACCEPT control frame to bidirectional client,
 * returns 0 on error */
 static int reply_with_accept(struct tap_data* data)
 {
 #ifdef USE_DNSTAP
 	/* len includes the escape and framelength */
+	int r;
 	size_t len = 0;
 	void* acceptframe = fstrm_create_control_frame_accept(
 		DNSTAP_CONTENT_TYPE, &len);
@@ -840,19 +757,15 @@ static int reply_with_accept(struct tap_data* data)

 	fd_set_block(data->fd);
 	if(data->ssl) {
-#ifdef HAVE_SSL
-		int r;
 		if((r=SSL_write(data->ssl, acceptframe, len)) <= 0) {
-			int r2;
-			if((r2=SSL_get_error(data->ssl, r)) == SSL_ERROR_ZERO_RETURN)
+			if(SSL_get_error(data->ssl, r) == SSL_ERROR_ZERO_RETURN)
 				log_err("SSL_write, peer closed connection");
 			else
-				log_crypto_err_io("could not SSL_write", r2);
+				log_err("could not SSL_write");
 			fd_set_nonblock(data->fd);
 			free(acceptframe);
 			return 0;
 		}
-#endif
 	} else {
 		if(send(data->fd, acceptframe, len, 0) == -1) {
 			log_err("send failed: %s", sock_strerror(errno));
@@ -876,7 +789,7 @@ static int reply_with_accept(struct tap_data* data)

 /** reply with FINISH control frame to bidirectional client,
 * returns 0 on error */
-static int reply_with_finish(struct tap_data* data)
+static int reply_with_finish(int fd)
 {
 #ifdef USE_DNSTAP
 	size_t len = 0;
@@ -886,37 +799,21 @@ static int reply_with_finish(struct tap_data* data)
 		return 0;
 	}

-	fd_set_block(data->fd);
-	if(data->ssl) {
-#ifdef HAVE_SSL
-		int r;
-		if((r=SSL_write(data->ssl, finishframe, len)) <= 0) {
-			int r2;
-			if((r2=SSL_get_error(data->ssl, r)) == SSL_ERROR_ZERO_RETURN)
-				log_err("SSL_write, peer closed connection");
-			else
-				log_crypto_err_io("could not SSL_write", r2);
-			fd_set_nonblock(data->fd);
-			free(finishframe);
-			return 0;
-		}
-#endif
-	} else {
-		if(send(data->fd, finishframe, len, 0) == -1) {
-			log_err("send failed: %s", sock_strerror(errno));
-			fd_set_nonblock(data->fd);
-			free(finishframe);
-			return 0;
-		}
+	fd_set_block(fd);
+	if(send(fd, finishframe, len, 0) == -1) {
+		log_err("send failed: %s", sock_strerror(errno));
+		fd_set_nonblock(fd);
+		free(finishframe);
+		return 0;
 	}
 	if(verbosity) log_info("sent control frame(finish)");

-	fd_set_nonblock(data->fd);
+	fd_set_nonblock(fd);
 	free(finishframe);
 	return 1;
 #else
 	log_err("no dnstap compiled, no reply");
-	(void)data;
+	(void)fd;
 	return 0;
 #endif
 }
@@ -928,11 +825,7 @@ static int tap_check_peer(struct tap_data* data)
 	if((SSL_get_verify_mode(data->ssl)&SSL_VERIFY_PEER)) {
 		/* verification */
 		if(SSL_get_verify_result(data->ssl) == X509_V_OK) {
-#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
-			X509* x = SSL_get1_peer_certificate(data->ssl);
-#else
 			X509* x = SSL_get_peer_certificate(data->ssl);
-#endif
 			if(!x) {
 				if(verbosity) log_info("SSL connection %s"
 					" failed no certificate", data->id);
@@ -954,11 +847,7 @@ static int tap_check_peer(struct tap_data* data)
 #endif
 			X509_free(x);
 		} else {
-#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
-			X509* x = SSL_get1_peer_certificate(data->ssl);
-#else
 			X509* x = SSL_get_peer_certificate(data->ssl);
-#endif
 			if(x) {
 				if(verbosity)
 					log_cert(VERB_ALGO, "peer certificate", x);
@@ -1000,7 +889,7 @@ static int tap_handshake(struct tap_data* data)
 			return 0;
 		} else if(r == 0) {
 			/* closed */
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return 0;
 		} else if(want == SSL_ERROR_SYSCALL) {
 			/* SYSCALL and errno==0 means closed uncleanly */
@@ -1018,7 +907,7 @@ static int tap_handshake(struct tap_data* data)
 			if(!silent)
 				log_err("SSL_handshake syscall: %s",
 					strerror(errno));
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return 0;
 		} else {
 			unsigned long err = ERR_get_error();
@@ -1028,7 +917,7 @@ static int tap_handshake(struct tap_data* data)
 				verbose(VERB_OPS, "ssl handshake failed "
 					"from %s", data->id);
 			}
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return 0;
 		}
 	}
@@ -1036,7 +925,7 @@ static int tap_handshake(struct tap_data* data)
 	data->ssl_handshake_done = 1;
 	if(!tap_check_peer(data)) {
 		/* closed */
-		tap_data_free(data, 1);
+		tap_data_free(data);
 		return 0;
 	}
 	return 1;
@@ -1044,7 +933,7 @@ static int tap_handshake(struct tap_data* data)
 #endif /* HAVE_SSL */

 /** callback for dnstap listener */
-void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
+void dtio_tap_callback(int fd, short ATTR_UNUSED(bits), void* arg)
 {
 	struct tap_data* data = (struct tap_data*)arg;
 	if(verbosity>=3) log_info("tap callback");
@@ -1062,7 +951,7 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 		if(verbosity>=4) log_info("s recv %d", (int)ret);
 		if(ret == 0) {
 			/* closed or error */
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return;
 		} else if(ret == -1) {
 			/* continue later */
@@ -1084,7 +973,7 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 			data->frame = calloc(1, data->len);
 			if(!data->frame) {
 				log_err("out of memory");
-				tap_data_free(data, 1);
+				tap_data_free(data);
 				return;
 			}
 		}
@@ -1097,7 +986,7 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 		if(verbosity>=4) log_info("f recv %d", (int)r);
 		if(r == 0) {
 			/* closed or error */
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return;
 		} else if(r == -1) {
 			/* continue later */
@@ -1122,13 +1011,13 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 		data->is_bidirectional = 1;
 		if(verbosity) log_info("bidirectional stream");
 		if(!reply_with_accept(data)) {
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return;
 		}
 	} else if(data->len >= 4 && sldns_read_uint32(data->frame) ==
 		FSTRM_CONTROL_FRAME_STOP && data->is_bidirectional) {
-		if(!reply_with_finish(data)) {
-			tap_data_free(data, 1);
+		if(!reply_with_finish(fd)) {
+			tap_data_free(data);
 			return;
 		}
 	}
@@ -1140,6 +1029,7 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 	data->len = 0;
 	data->len_done = 0;
 	data->data_done = 0;
+
 }

 /** callback for main listening file descriptor */
@@ -1152,9 +1042,7 @@ void dtio_mainfdcallback(int fd, short ATTR_UNUSED(bits), void* arg)
 	char* id = NULL;
 	struct sockaddr_storage addr;
 	socklen_t addrlen = (socklen_t)sizeof(addr);
-	int s;
-	memset(&addr, 0, sizeof(addr));
-	s = accept(fd, (struct sockaddr*)&addr, &addrlen);
+	int s = accept(fd, (struct sockaddr*)&addr, &addrlen);
 	if(s == -1) {
 #ifndef USE_WINSOCK
 		/* EINTR is signal interrupt. others are closed connection. */
@@ -1224,8 +1112,6 @@ void dtio_mainfdcallback(int fd, short ATTR_UNUSED(bits), void* arg)
 		&dtio_tap_callback, data);
 	if(!data->ev) fatal_exit("could not ub_event_new");
 	if(ub_event_add(data->ev, NULL) != 0) fatal_exit("could not ub_event_add");
-	if(!tap_data_list_insert(&tap_sock->data_list, data))
-		fatal_exit("could not tap_data_list_insert");
 }

 /** setup local accept sockets */
@@ -1340,114 +1226,6 @@ setup_and_run(struct config_strlist_head* local_list,
 	free(maindata);
 }

-/* internal unit tests */
-static int internal_unittest()
-{
-	/* unit test tap_data_list_try_to_free_tail() */
-#define unit_tap_datas_max 5
-	struct tap_data* datas[unit_tap_datas_max];
-	struct tap_data_list* list;
-	struct tap_socket* socket = calloc(1, sizeof(*socket));
-	size_t i = 0;
-	log_assert(socket);
-	log_assert(unit_tap_datas_max>2); /* needed for the test */
-	for(i=0; i<unit_tap_datas_max; i++) {
-		datas[i] = calloc(1, sizeof(struct tap_data));
-		log_assert(datas[i]);
-		log_assert(tap_data_list_insert(&socket->data_list, datas[i]));
-	}
-	/* sanity base check */
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==unit_tap_datas_max);
-
-	/* Free the last data, tail cannot be erased */
-	list = socket->data_list;
-	while(list->next) list = list->next;
-	free(list->d);
-	list->d = NULL;
-	tap_data_list_try_to_free_tail(list);
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==unit_tap_datas_max);
-
-	/* Free the third to last data, tail cannot be erased */
-	list = socket->data_list;
-	for(i=0; i<unit_tap_datas_max-3; i++) list = list->next;
-	free(list->d);
-	list->d = NULL;
-	tap_data_list_try_to_free_tail(list);
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==unit_tap_datas_max);
-
-	/* Free the second to last data, try to remove tail from the third
-	 * again, tail (last 2) should be removed */
-	list = socket->data_list;
-	for(i=0; i<unit_tap_datas_max-2; i++) list = list->next;
-	free(list->d);
-	list->d = NULL;
-	list = socket->data_list;
-	while(list->d) list = list->next;
-	tap_data_list_try_to_free_tail(list);
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==unit_tap_datas_max-2);
-
-	/* Free all the remaining data, try to remove tail from the start,
-	 * only the start should remain */
-	list = socket->data_list;
-	while(list) {
-		free(list->d);
-		list->d = NULL;
-		list = list->next;
-	}
-	tap_data_list_try_to_free_tail(socket->data_list);
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==1);
-
-	/* clean up */
-	tap_data_list_delete(socket->data_list);
-	free(socket);
-
-	/* Start again. Add two elements */
-	socket = calloc(1, sizeof(*socket));
-	log_assert(socket);
-	for(i=0; i<2; i++) {
-		datas[i] = calloc(1, sizeof(struct tap_data));
-		log_assert(datas[i]);
-		log_assert(tap_data_list_insert(&socket->data_list, datas[i]));
-	}
-	/* sanity base check */
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==2);
-
-	/* Free the last data, tail cannot be erased */
-	list = socket->data_list;
-	while(list->next) list = list->next;
-	free(list->d);
-	list->d = NULL;
-	tap_data_list_try_to_free_tail(list);
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==2);
-
-	/* clean up */
-	tap_data_list_delete(socket->data_list);
-	free(socket);
-
-	if(log_get_lock()) {
-		lock_basic_destroy((lock_basic_type*)log_get_lock());
-	}
-	checklock_stop();
-#ifdef USE_WINSOCK
-	WSACleanup();
-#endif
-	return 0;
-}
-
 /** getopt global, in case header files fail to declare it. */
 extern int optind;
 /** getopt global, in case header files fail to declare it. */
@@ -1498,7 +1276,7 @@ int main(int argc, char** argv)
 #endif

 	/* command line options */
-	while( (c=getopt(argc, argv, "hcls:t:u:vx:y:z:")) != -1) {
+	while( (c=getopt(argc, argv, "hls:t:u:vx:y:z:")) != -1) {
 		switch(c) {
 			case 'u':
 				if(!cfg_strlist_append(&local_list,
@@ -1534,20 +1312,14 @@ int main(int argc, char** argv)
 			case 'v':
 				verbosity++;
 				break;
-			case 'c':
-#ifndef UNBOUND_DEBUG
-				fatal_exit("-c option needs compilation with "
-					"--enable-debug");
-#endif
-				return internal_unittest();
 			case 'h':
 			case '?':
 			default:
 				usage(argv);
 		}
 	}
-	/* argc -= optind; not using further arguments */
-	/* argv += optind; not using further arguments */
+	argc -= optind;
+	argv += optind;

 	if(usessl) {
 #ifdef HAVE_SSL
@@ -1576,9 +1348,6 @@ int main(int argc, char** argv)
 	config_delstrlist(tcp_list.first);
 	config_delstrlist(tls_list.first);

-	if(log_get_lock()) {
-		lock_basic_destroy((lock_basic_type*)log_get_lock());
-	}
 	checklock_stop();
 #ifdef USE_WINSOCK
 	WSACleanup();
@@ -1786,33 +1555,3 @@ void remote_get_opt_ssl(char* ATTR_UNUSED(str), void* ATTR_UNUSED(arg))
 {
        log_assert(0);
 }
-
-void fast_reload_service_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
-int fast_reload_client_callback(struct comm_point* ATTR_UNUSED(c),
-	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
-        struct comm_reply* ATTR_UNUSED(repinfo))
-{
-	log_assert(0);
-	return 0;
-}
-
-#ifdef HAVE_NGTCP2
-void doq_client_event_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
-
-#ifdef HAVE_NGTCP2
-void doq_client_timer_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
@@ -19,10 +19,11 @@ The DNSTAP code has BSD license in dnstap/dnstap.c.
 * Make and install: ./configure; make; make install
  * --with-libevent=/path/to/libevent
  	Can be set to either the system install or the build directory.
-	--with-libevent=no gives a builtin alternative implementation.
-	Libevent is enabled by default, it is useful when having many
-	(thousands) of outgoing ports. This improves randomization and spoof
-	resistance. It also allows a higher number of outgoing queries.
+	--with-libevent=no (default) gives a builtin alternative 
+	implementation. libevent is useful when having many (thousands) 
+	of outgoing ports. This improves randomization and spoof 
+	resistance. For the default of 16 ports the builtin alternative 
+	works well and is a little faster.
  * --with-libexpat=/path/to/libexpat
  	Can be set to the install directory of libexpat.
  * --without-pthreads 
@@ -28,23 +28,3 @@ prefix. For example:
    ;; ANSWER SECTION:
    jazz-v4.viagenie.ca.        86400   IN      AAAA    64:ff9b::ce7b:1f02

-
-NAT64 support was added by David Lamparter in 2022; license(s) of the
-surrounding code apply.  Note that NAT64 is closely related but functionally
-orthogonal to DNS64;  it allows Unbound to send outgoing queries to IPv4-only
-servers over IPv6 through the configured NAT64 prefix.  This allows running
-an Unbound instance on an IPv6-only host without breaking every single domain
-that only has IPv4 servers.  Whether that Unbound instance also does DNS64 is
-an independent choice.
-
-To enable NAT64 in Unbound, add to unbound.conf's "server" section:
-
-    do-nat64: yes
-
-The NAT64 prefix defaults to the DNS64 prefix, which in turn defaults to the
-standard 64:FF9B::/96 prefix.  You can reconfigure it with:
-
-    nat64-prefix: 64:FF9B::/96
-
-To test NAT64 operation, pick a domain that only has IPv4 reachability for its
-nameservers and try resolving any names in that domain.
@@ -35,14 +35,9 @@ server:
 	# statistics-cumulative: no

 	# enable extended statistics (query types, answer codes, status)
-	# printed from unbound-control. Default off, because of speed.
+	# printed from unbound-control. default off, because of speed.
 	# extended-statistics: no

-	# Inhibits selected extended statistics (qtype, qclass, qopcode, rcode,
-	# rpz-actions) from printing if their value is 0.
-	# Default on.
-	# statistics-inhibit-zero: yes
-
 	# number of threads to create. 1 disables threading.
 	# num-threads: 1

@@ -143,8 +138,8 @@ server:
 	# edns-buffer-size: 1232

 	# Maximum UDP response size (not applied to TCP response).
-	# Suggested values are 512 to 4096. Default is 1232. 65536 disables it.
-	# max-udp-size: 1232
+	# Suggested values are 512 to 4096. Default is 4096. 65536 disables it.
+	# max-udp-size: 4096

 	# max memory to use for stream(tcp and tls) waiting result buffers.
 	# stream-wait-size: 4m
@@ -178,49 +173,10 @@ server:
 	# a throwaway response (also timeouts) is received.
 	# outbound-msg-retry: 5

-	# Hard limit on the number of outgoing queries Unbound will make while
-	# resolving a name, making sure large NS sets do not loop.
-	# It resets on query restarts (e.g., CNAME) and referrals.
-	# max-sent-count: 32
-
-	# Hard limit on the number of times Unbound is allowed to restart a
-	# query upon encountering a CNAME record.
-	# max-query-restarts: 11
-
-	# Limit on number of NS records in NS RRset for incoming packets.
-	# iter-scrub-ns: 20
-
-	# Limit on number of CNAME, DNAME records for incoming packets.
-	# iter-scrub-cname: 11
-
-	# Limit on upstream queries for an incoming query and its recursion.
-	# max-global-quota: 200
-
 	# msec for waiting for an unknown server to reply.  Increase if you
 	# are behind a slow satellite link, to eg. 1128.
 	# unknown-server-time-limit: 376

-	# msec before recursion replies are dropped. The work item continues.
-	# discard-timeout: 1900
-
-	# Max number of replies waiting for recursion per IP address.
-	# wait-limit: 1000
-
-	# Max replies waiting for recursion for IP address with cookie.
-	# wait-limit-cookie: 10000
-
-	# Apart from the default, the wait limit can be set for a netblock.
-	# wait-limit-netblock: 192.0.2.0/24 50000
-
-	# Apart from the default, the wait limit with cookie can be adjusted.
-	# wait-limit-cookie-netblock: 192.0.2.0/24 50000
-
-	# Defaults for loopback, it has no wait limit.
-	# wait-limit-netblock: 127.0.0.0/8 -1
-	# wait-limit-netblock: ::1/128 -1
-	# wait-limit-cookie-netblock: 127.0.0.0/8 -1
-	# wait-limit-cookie-netblock: ::1/128 -1
-
 	# the amount of memory to use for the RRset cache.
 	# plain value in bytes or you can append k, m or G. default is "4Mb".
 	# rrset-cache-size: 4m
@@ -241,11 +197,6 @@ server:
 	# the time to live (TTL) value cap for negative responses in the cache
 	# cache-max-negative-ttl: 3600

-	# the time to live (TTL) value lower bound, in seconds. Default 0.
-	# For negative responses in the cache. If disabled, default,
-	# cache-min-ttl applies if configured.
-	# cache-min-negative-ttl: 0
-
 	# the time to live (TTL) value for cached roundtrip times, lameness and
 	# EDNS version information for hosts. In seconds.
 	# infra-host-ttl: 900
@@ -278,18 +229,6 @@ server:
 	# Enable IPv6, "yes" or "no".
 	# do-ip6: yes

-	# If running unbound on an IPv6-only host, domains that only have
-	# IPv4 servers would become unresolveable.  If NAT64 is available in
-	# the network, unbound can use NAT64 to reach these servers with
-	# the following option.  This is NOT needed for enabling DNS64 on a
-	# system that has IPv4 connectivity.
-	# Consider also enabling prefer-ip6 to prefer native IPv6 connections
-	# to nameservers.
-	# do-nat64: no
-
-	# NAT64 prefix.  Defaults to using dns64-prefix value.
-	# nat64-prefix: 64:ff9b::0/96
-
 	# Enable UDP, "yes" or "no".
 	# do-udp: yes

@@ -318,14 +257,9 @@ server:
 	# Enable EDNS TCP keepalive option.
 	# edns-tcp-keepalive: no

-	# Timeout for EDNS TCP keepalive, in msec. Overrides tcp-idle-timeout
-	# if edns-tcp-keepalive is set.
+	# Timeout for EDNS TCP keepalive, in msec.
 	# edns-tcp-keepalive-timeout: 120000

-	# UDP queries that have waited in the socket buffer for a long time
-	# can be dropped. Default is 0, disabled. In seconds, such as 3.
-	# sock-queue-timeout: 0
-
 	# Use systemd socket activation for UDP, TCP, and control sockets.
 	# use-systemd: no

@@ -339,7 +273,6 @@ server:
 	# Choose deny (drop message), refuse (polite error reply),
 	# allow (recursive ok), allow_setrd (recursive ok, rd bit is forced on),
 	# allow_snoop (recursive and nonrecursive ok)
-	# allow_cookie (allow UDP with valid cookie or stateful transport)
 	# deny_non_local (drop queries unless can be answered from local-data)
 	# refuse_non_local (like deny_non_local but polite error reply).
 	# access-control: 127.0.0.0/8 allow
@@ -467,10 +400,6 @@ server:
 	# print UTC timestamp in ascii to logfile, default is epoch in seconds.
 	# log-time-ascii: no

-	# log timestamp in ISO8601 format if also log-time-ascii is enabled.
-	# (y-m-dTh:m:s.msec[+-]tzhours:tzminutes)
-	# log-time-iso: no
-
 	# print one line with time, IP, name, type, class for every query.
 	# log-queries: no

@@ -482,9 +411,6 @@ server:
 	# filtering log-queries and log-replies from the log.
 	# log-tag-queryreply: no

-	# log with destination address, port and type for log-replies.
-	# log-destaddr: no
-
 	# log the local-zone actions, like local-zone type inform is enabled
 	# also for the other local zone types.
 	# log-local-actions: no
@@ -543,9 +469,6 @@ server:
 	# Harden against out of zone rrsets, to avoid spoofing attempts.
 	# harden-glue: yes

-	# Harden against unverified (outside-zone, including sibling zone) glue rrsets
-	# harden-unverified-glue: no
-
 	# Harden against receiving dnssec-stripped data. If you turn it
 	# off, failing to validate dnskey data for a trustanchor will
 	# trigger insecure mode for that zone (like without a trustanchor).
@@ -562,15 +485,10 @@ server:
 	# harden-referral-path: no

 	# Harden against algorithm downgrade when multiple algorithms are
-	# advertised in the DS record.  If no, allows any algorithm
-	# to validate the zone which is the standard behavior for validators.
-	# Check the manpage for detailed information.
+	# advertised in the DS record.  If no, allows the weakest algorithm
+	# to validate the zone.
 	# harden-algo-downgrade: no

-	# Harden against unknown records in the authority section and the
-	# additional section.
-	# harden-unknown-additional: no
-
 	# Sent minimum amount of information to upstream servers to enhance
 	# privacy. Only sent minimum required labels of the QNAME and set QTYPE
 	# to A when possible.
@@ -731,19 +649,13 @@ server:
 	# that set CD but cannot validate themselves.
 	# ignore-cd-flag: no

-	# Disable the DO flag in outgoing requests. It is helpful for upstream
-	# devices that cannot handle DNSSEC information. But do not enable it
-	# otherwise, because it would stop DNSSEC validation.
-	# disable-edns-do: no
-
 	# Serve expired responses from cache, with serve-expired-reply-ttl in
-	# the response. By default it first tries to refresh an expired answer.
-	# Can be configured with serve-expired-client-timeout.
+	# the response, and then attempt to fetch the data afresh.
 	# serve-expired: no
 	#
 	# Limit serving of expired responses to configured seconds after
 	# expiration. 0 disables the limit.
-	# serve-expired-ttl: 86400
+	# serve-expired-ttl: 0
 	#
 	# Set the TTL of expired records to the serve-expired-ttl value after a
 	# failed attempt to retrieve the record from upstream. This makes sure
@@ -756,9 +668,10 @@ server:
 	#
 	# Time in milliseconds before replying to the client with expired data.
 	# This essentially enables the serve-stale behavior as specified in
-	# RFC 8767 that first tries to resolve before immediately responding
-	# with expired data.  0 disables this behavior.
-	# serve-expired-client-timeout: 1800
+	# RFC 8767 that first tries to resolve before
+	# immediately responding with expired data.  0 disables this behavior.
+	# A recommended value is 1800.
+	# serve-expired-client-timeout: 0

 	# Return the original TTL as received from the upstream name server rather
 	# than the decrementing TTL as stored in the cache.  Enabling this feature
@@ -817,8 +730,6 @@ server:
 	# local-zone: "127.in-addr.arpa." nodefault
 	# local-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." nodefault
 	# local-zone: "home.arpa." nodefault
-	# local-zone: "resolver.arpa." nodefault
-	# local-zone: "service.arpa." nodefault
 	# local-zone: "onion." nodefault
 	# local-zone: "test." nodefault
 	# local-zone: "invalid." nodefault
@@ -885,8 +796,6 @@ server:
 	# o always_transparent, always_refuse, always_nxdomain, always_nodata,
 	#   always_deny resolve in that way but ignore local data for
 	#   that name
-	# o block_a resolves all records normally but returns
-	#   NODATA for A queries and ignores local data for that name
 	# o always_null returns 0.0.0.0 or ::0 for any name in the zone.
 	# o noview breaks out of that view towards global local-zones.
 	#
@@ -929,7 +838,6 @@ server:
 	# tls-service-pem: "path/to/publiccertfile.pem"
 	# tls-port: 853
 	# https-port: 443
-	# quic-port: 853

 	# cipher setting for TLSv1.2
 	# tls-ciphers: "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256"
@@ -994,9 +902,6 @@ server:
 	# Disable TLS for DNS-over-HTTP downstream service.
 	# http-notls-downstream: no

-	# Maximum number of bytes used for QUIC buffers.
-	# quic-size: 8m
-
 	# The interfaces that use these listed port numbers will support and
 	# expect PROXYv2. For UDP and TCP/TLS interfaces.
 	# proxy-protocol-port: portno for each of the port numbers.
@@ -1037,13 +942,6 @@ server:
 	# if 0(default) it is disabled, otherwise states qps allowed per ip address
 	# ip-ratelimit: 0

-	# global query ratelimit for all ip addresses with a valid DNS Cookie.
-	# feature is experimental.
-	# if 0(default) it is disabled, otherwise states qps allowed per ip address
-	# useful in combination with 'allow_cookie'.
-	# If used, suggested to be higher than ip-ratelimit, tenfold.
-	# ip-ratelimit-cookie: 0
-
 	# ip ratelimits are tracked in a cache, size in bytes of cache (or k,m).
 	# ip-ratelimit-size: 4m
 	# ip ratelimit cache slabs, reduces lock contention if equal to cpucount.
@@ -1065,19 +963,6 @@ server:
 	# the number of servers that will be used in the fast server selection.
 	# fast-server-num: 3

-	# reply to requests containing DNS Cookies as specified in RFC 7873 and RFC 9018.
-	# answer-cookie: no
-
-	# secret for DNS Cookie generation.
-	# useful for anycast deployments.
-	# example value "000102030405060708090a0b0c0d0e0f".
-	# cookie-secret: <128 bit random hex string>
-
-	# File with cookie secrets, the 'cookie-secret:' option is ignored
-	# and the file can be managed to have staging and active secrets
-	# with remote control commands. Disabled with "". Default is "".
-	# cookie-secret-file: "/usr/local/etc/unbound_cookiesecrets.txt"
-
 	# Enable to attach Extended DNS Error codes (RFC8914) to responses.
 	# ede: no

@@ -1086,11 +971,6 @@ server:
 	# Note that the ede option above needs to be enabled for this to work.
 	# ede-serve-expired: no

-	# Enable DNS Error Reporting (RFC9567).
-	# qname-minimisation is advised to be turned on as well to increase
-	# privacy on the outgoing reports.
-	# dns-error-reporting: no
-
 	# Specific options for ipsecmod. Unbound needs to be configured with
 	# --enable-ipsecmod for these to take effect.
 	#
@@ -1229,7 +1109,7 @@ remote-control:
 # sources of notifies.
 # auth-zone:
 #	name: "."
-#	primary: 170.247.170.2        # b.root-servers.net
+#	primary: 199.9.14.201         # b.root-servers.net
 #	primary: 192.33.4.12          # c.root-servers.net
 #	primary: 199.7.91.13          # d.root-servers.net
 #	primary: 192.5.5.241          # f.root-servers.net
@@ -1237,7 +1117,7 @@ remote-control:
 #	primary: 193.0.14.129         # k.root-servers.net
 #	primary: 192.0.47.132         # xfr.cjr.dns.icann.org
 #	primary: 192.0.32.132         # xfr.lax.dns.icann.org
-#	primary: 2801:1b8:10::b       # b.root-servers.net
+#	primary: 2001:500:200::b      # b.root-servers.net
 #	primary: 2001:500:2::c        # c.root-servers.net
 #	primary: 2001:500:2d::d       # d.root-servers.net
 #	primary: 2001:500:2f::f       # f.root-servers.net
@@ -1305,11 +1185,6 @@ remote-control:
 #     backend: "testframe"
 #     # secret seed string to calculate hashed keys
 #     secret-seed: "default"
-#     # if the backend should be read from, but not written to.
-#     cachedb-no-store: no
-#     # if the cachedb should be checked before a serve-expired response is
-#     # given, when serve-expired is enabled.
-#     cachedb-check-when-serve-expired: yes
 #
 #     # For "redis" backend:
 #     # (to enable, use --with-libhiredis to configure before compiling)
@@ -1317,36 +1192,10 @@ remote-control:
 #     redis-server-host: 127.0.0.1
 #     # redis server's TCP port
 #     redis-server-port: 6379
-#     # if the server uses a unix socket, set its path, or "" when not used.
-#     redis-server-path: "/var/lib/redis/redis-server.sock"
-#     # if the server uses an AUTH password, specify here, or "" when not used.
-#     redis-server-password: ""
 #     # timeout (in ms) for communication with the redis server
 #     redis-timeout: 100
-#     # timeout (in ms) for commands, if 0, uses redis-timeout.
-#     redis-command-timeout: 0
-#     # timeout (in ms) for connection set up, if 0, uses redis-timeout.
-#     redis-connect-timeout: 0
 #     # set timeout on redis records based on DNS response TTL
 #     redis-expire-records: no
-#     # redis logical database to use, 0 is the default database.
-#     redis-logical-db: 0
-#     # redis replica server's IP address or host name
-#     redis-replica-server-host: 127.0.0.1
-#     # redis replica server's TCP port
-#     redis-replica-server-port: 6379
-#     # if the replica server uses a unix socket, set its path, or "" when not used.
-#     redis-replica-server-path: "/var/lib/redis/redis-server.sock"
-#     # if the replica server uses an AUTH password, specify here, or "" when not used.
-#     redis-replica-server-password: ""
-#     # timeout (in ms) for communication with the redis replica server
-#     redis-replica-timeout: 100
-#     # timeout (in ms) for redis replica commands, if 0, uses redis-replica-timeout.
-#     redis-replica-command-timeout: 0
-#     # timeout (in ms) for redis replica connection set up, if 0, uses redis-replica-timeout.
-#     redis-replica-connect-timeout: 0
-#     # redis logical database to use for the replica server, 0 is the default database.
-#     redis-replica-logical-db: 0

 # IPSet
 # Add specify domain into set via ipset.
@@ -1388,8 +1237,6 @@ remote-control:
 # 	dnstap-identity: ""
 # 	# if "" it uses the package version.
 # 	dnstap-version: ""
-# 	# log only 1/N messages, if 0 it is disabled. default 0.
-# 	dnstap-sample-rate: 0
 # 	dnstap-log-resolver-query-messages: no
 # 	dnstap-log-resolver-response-messages: no
 # 	dnstap-log-client-query-messages: no
@@ -1398,8 +1245,7 @@ remote-control:
 # 	dnstap-log-forwarder-response-messages: no

 # Response Policy Zones
-# RPZ policies. Applied in order of configuration. Any match from an earlier
-# RPZ zone will terminate the RPZ lookup. QNAME, Response IP
+# RPZ policies. Applied in order of configuration. QNAME, Response IP
 # Address, nsdname, nsip and clientip triggers are supported. Supported
 # actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp-only
 # and drop.  Policies can be loaded from a file, or using zone
@@ -14,7 +14,6 @@ unbound\-checkconf
 .B unbound\-checkconf
 .RB [ \-h ]
 .RB [ \-f ]
-.RB [ \-q ]
 .RB [ \-o
 .IR option ]
 .RI [ cfgfile ]
@@ -38,9 +37,6 @@ Print full pathname, with chroot applied to it.  Use with the \-o option.
 If given, after checking the config file the value of this option is
 printed to stdout.  For "" (disabled) options an empty line is printed.
 .TP
-.B \-q
-Make the operation quiet, suppress output on success.
-.TP
 .I cfgfile
 The config file to read with settings for Unbound. It is checked.
 If omitted, the config file at the default location is checked.
@@ -54,161 +54,6 @@ Stop the server. The server daemon exits.
 .B reload
 Reload the server. This flushes the cache and reads the config file fresh.
 .TP
-.B reload_keep_cache
-Reload the server but try to keep the RRset and message cache if
-(re)configuration allows for it.
-That means the caches sizes and the number of threads must not change between
-reloads.
-.TP
-.B fast_reload \fR[\fI+dpv\fR]
-Reload the server, but keep downtime to a minimum, so that user queries
-keep seeing service. This needs the code compiled with threads. The config
-is loaded in a thread, and prepared, then it briefly pauses the existing
-server and updates config options. The intent is that the pause does not
-impact the service of user queries. The cache is kept. Also user queries
-worked on are kept and continue, but with the new config options.
-.IP
-This command is experimental at this time.
-.IP
-The amount of temporal memory needed during a fast_reload is twice the
-amount needed for configuration.
-This is because Unbound temporarily needs to store both current configuration
-values and new ones while trying to fast_reload.
-Zones loaded from disk (authority zones and RPZ zones) are included in such
-memory needs.
-.IP
-Options that can be changed are for
-forwards,
-stubs,
-views,
-authority zones,
-RPZ zones and
-local zones.
-.IP
-Also
-access-control and similar options,
-interface-action and similar options and
-tcp-connection-limit.
-It can reload some
-define-tag
-changes, more on that below.
-Further options include
-insecure-lan-zones,
-domain-insecure,
-trust-anchor-file,
-trust-anchor,
-trusted-keys-file,
-auto-trust-anchor-file,
-edns-client-string,
-ipset,
-log-identity,
-infra-cache-numhosts,
-msg-cache-size,
-rrset-cache-size,
-key-cache-size,
-ratelimit-size,
-neg-cache-size,
-num-queries-per-thread,
-jostle-timeout,
-use-caps-for-id,
-unwanted-reply-threshold,
-tls-use-sni,
-outgoing-tcp-mss,
-ip-dscp,
-max-reuse-tcp-queries,
-tcp-reuse-timeout,
-tcp-auth-query-timeout,
-delay-close.
-.IP
-It does not work with
-interface and
-outgoing-interface changes,
-also not with
-remote control,
-outgoing-port-permit,
-outgoing-port-avoid,
-msg-buffer-size,
-any **\*-slabs** options and
-statistics-interval changes.
-.IP
-For dnstap these options can be changed:
-dnstap-log-resolver-query-messages,
-dnstap-log-resolver-response-messages,
-dnstap-log-client-query-messages,
-dnstap-log-client-response-messages,
-dnstap-log-forwarder-query-messages and
-dnstap-log-forwarder-response-messages.
-.IP
-It does not work with these options:
-dnstap-enable,
-dnstap-bidirectional,
-dnstap-socket-path,
-dnstap-ip,
-dnstap-tls,
-dnstap-tls-server-name,
-dnstap-tls-cert-bundle,
-dnstap-tls-client-key-file and
-dnstap-tls-client-cert-file.
-.IP
-The options
-dnstap-send-identity,
-dnstap-send-version,
-dnstap-identity, and
-dnstap-version can be loaded
-when ``+p`` is not used.
-.IP
-The '+v' option makes the output verbose which includes the time it took to do
-the reload.
-With '+vv' it is more verbose which includes the amount of memory that was
-allocated temporarily to perform the reload; this amount of memory can be big
-if the config has large contents.
-In the timing output the 'reload' time is the time during which the server was
-paused.
-.IP
-The '+p' option makes the reload not pause threads, they keep running.
-Locks are acquired, but items are updated in sequence, so it is possible
-for threads to see an inconsistent state with some options from the old
-and some options from the new config, such as cache TTL parameters from the
-old config and forwards from the new config. The stubs and forwards are
-updated at the same time, so that they are viewed consistently, either old
-or new values together. The option makes the reload time take eg. 3
-microseconds instead of 0.3 milliseconds during which the worker threads are
-interrupted. So, the interruption is much shorter, at the expense of some
-inconsistency. After the reload itself, every worker thread is briefly
-contacted to make them release resources, this makes the delete timing
-a little longer, and takes up time from the remote control servicing
-worker thread.
-.IP
-With the nopause option, the reload does not work to reload some options,
-that fast reload works on without the nopause option: val-bogus-ttl,
-val-override-date, val-sig-skew-min, val-sig-skew-max, val-max-restart,
-val-nsec3-keysize-iterations, target-fetch-policy, outbound-msg-retry,
-max-sent-count, max-query-restarts, do-not-query-address,
-do-not-query-localhost, private-address, private-domain, caps-exempt,
-nat64-prefix, do-nat64, infra-host-ttl, infra-keep-probing, ratelimit,
-ip-ratelimit, ip-ratelimit-cookie, wait-limit-netblock,
-wait-limit-cookie-netblock, ratelimit-below-domain, ratelimit-for-domain.
-.IP
-The '+d' option makes the reload drop queries that the worker threads are
-working on. This is like flush_requestlist. Without it the queries are kept
-so that users keep getting answers for those queries that are currently
-processed. The drop makes it so that queries during the life time of the
-query processing see only old, or only new config options.
-.IP
-When there are changes to the config tags, from the \fBdefine\-tag\fR option,
-then the '+d' option is implicitly turned on with a warning printout, and
-queries are dropped.
-This is to stop references to the old tag information, by the old
-queries. If the number of tags is increased in the newly loaded config, by
-adding tags at the end, then the implicit '+d' option is not needed.
-.IP
-For response ip, that is actions associated with IP addresses, and perhaps
-intersected with access control tag and action information, those settings
-are stored with a query when it comes in based on its source IP address.
-The old information is kept with the query until the queries are done.
-This is gone when those queries are resolved and finished, or it is possible
-to flush the requestlist with '+d'.
-.TP
 .B verbosity \fInumber
 Change verbosity value for logging. Same values as \fBverbosity\fR keyword in
 \fIunbound.conf\fR(5).  This new setting lasts until the server is issued
@@ -270,38 +115,31 @@ Remove local data RRs read from stdin of unbound\-control. Input is one name per
 line. For bulk removals.
 .TP
 .B dump_cache
-The content of the cache is printed in a text format to stdout.
-You can redirect it to a file to store the cache in a file.
-Not supported in remote Unbounds in multi-process operation.
+The contents of the cache is printed in a text format to stdout. You can
+redirect it to a file to store the cache in a file.
 .TP
 .B load_cache
-The content of the cache is loaded from stdin.
-Uses the same format as dump_cache uses.
-Loading the cache with old, or wrong data can result in old or wrong data
-returned to clients.
-Loading data into the cache in this way is supported in order to aid with
-debugging.
-Not supported in remote Unbounds in multi-process operation.
+The contents of the cache is loaded from stdin.  Uses the same format as
+dump_cache uses.  Loading the cache with old, or wrong data can result
+in old or wrong data returned to clients.  Loading data into the cache
+in this way is supported in order to aid with debugging.
 .TP
 .B lookup \fIname
 Print to stdout the name servers that would be used to look up the
 name specified.
 .TP
-.B flush \fR[\fI+c\fR] \fIname
+.B flush \fIname
 Remove the name from the cache. Removes the types
-A, AAAA, NS, SOA, CNAME, DNAME, MX, PTR, SRV, NAPTR, SVCB and HTTPS.
+A, AAAA, NS, SOA, CNAME, DNAME, MX, PTR, SRV and NAPTR.
 Because that is fast to do. Other record types can be removed using
 .B flush_type
 or
 .B flush_zone\fR.
-.IP
-The '+c' option removes the items also from the cachedb cache. If
-cachedb is in use.
 .TP
-.B flush_type \fR[\fI+c\fR] \fIname\fR \fItype
+.B flush_type \fIname\fR \fItype
 Remove the name, type information from the cache.
 .TP
-.B flush_zone \fR[\fI+c\fR] \fIname
+.B flush_zone \fIname
 Remove all information at or below the name from the cache.
 The rrsets and key entries are removed so that new lookups will be performed.
 This needs to walk and inspect the entire cache, and is a slow operation.
@@ -309,10 +147,10 @@ The entries are set to expired in the implementation of this command (so,
 with serve\-expired enabled, it'll serve that information but schedule a
 prefetch for new information).
 .TP
-.B flush_bogus \fR[\fI+c\fR]
+.B flush_bogus
 Remove all bogus data from the cache.
 .TP
-.B flush_negative \fR[\fI+c\fR]
+.B flush_negative
 Remove all negative data from the cache.  This is nxdomain answers,
 nodata answers and servfail answers.  Also removes bad key entries
 (which could be due to failed lookups) from the dnssec key cache, and
@@ -395,24 +233,22 @@ still be bogus, use \fBflush_zone\fR to remove it), does not affect the config f
 .B insecure_remove \fIzone
 Removes domain\-insecure for the given zone.
 .TP
-.B forward_add \fR[\fI+it\fR] \fIzone addr ...
+.B forward_add \fR[\fI+i\fR] \fIzone addr ...
 Add a new forward zone to running Unbound.  With +i option also adds a
 \fIdomain\-insecure\fR for the zone (so it can resolve insecurely if you have
 a DNSSEC root trust anchor configured for other names).
 The addr can be IP4, IP6 or nameserver names, like \fIforward-zone\fR config
 in unbound.conf.
-The +t option sets it to use tls upstream, like \fIforward\-tls\-upstream\fR: yes.
 .TP
 .B forward_remove \fR[\fI+i\fR] \fIzone
 Remove a forward zone from running Unbound.  The +i also removes a
 \fIdomain\-insecure\fR for the zone.
 .TP
-.B stub_add \fR[\fI+ipt\fR] \fIzone addr ...
+.B stub_add \fR[\fI+ip\fR] \fIzone addr ...
 Add a new stub zone to running Unbound.  With +i option also adds a
 \fIdomain\-insecure\fR for the zone.  With +p the stub zone is set to prime,
 without it it is set to notprime.  The addr can be IP4, IP6 or nameserver
 names, like the \fIstub-zone\fR config in unbound.conf.
-The +t option sets it to use tls upstream, like \fIstub\-tls\-upstream\fR: yes.
 .TP
 .B stub_remove \fR[\fI+i\fR] \fIzone
 Remove a stub zone from running Unbound.  The +i also removes a
@@ -499,41 +335,6 @@ Remove a list of \fIlocal_data\fR for given view from stdin. Like local_datas_re
 .TP
 .B view_local_datas \fIview\fR
 Add a list of \fIlocal_data\fR for given view from stdin.  Like local_datas.
-.TP
-.B add_cookie_secret <secret>
-Add or replace a cookie secret persistently. <secret> needs to be an 128 bit
-hex string.
-.IP
-Cookie secrets can be either \fIactive\fR or \fIstaging\fR. \fIActive\fR cookie
-secrets are used to create DNS Cookies, but verification of a DNS Cookie
-succeeds with any of the \fIactive\fR or \fIstaging\fR cookie secrets. The
-state of the current cookie secrets can be printed with the
-\fBprint_cookie_secrets\fR command.
-.IP
-When there are no cookie secrets configured yet, the <secret> is added as
-\fIactive\fR. If there is already an \fIactive\fR cookie secret, the <secret>
-is added as \fIstaging\fR or replacing an existing \fIstaging\fR secret.
-.IP
-To "roll" a cookie secret used in an anycast set. The new secret has to be
-added as staging secret to \fBall\fR nodes in the anycast set. When \fBall\fR
-nodes can verify DNS Cookies with the new secret, the new secret can be
-activated with the \fBactivate_cookie_secret\fR command. After \fBall\fR nodes
-have the new secret \fIactive\fR for at least one hour, the previous secret can
-be dropped with the \fBdrop_cookie_secret\fR command.
-.IP
-Persistence is accomplished by writing to a file which if configured with the
-\fBcookie\-secret\-file\fR option in the server section of the config file.
-This is disabled by default, "".
-.TP
-.B drop_cookie_secret
-Drop the \fIstaging\fR cookie secret.
-.TP
-.B activate_cookie_secret
-Make the current \fIstaging\fR cookie secret \fIactive\fR, and the current
-\fIactive\fR cookie secret \fIstaging\fR.
-.TP
-.B print_cookie_secrets
-Show the current configured cookie secrets with their status.
 .SH "EXIT CODE"
 The unbound\-control program exits with status code 1 on error, 0 on success.
 .SH "SET UP"
@@ -562,21 +363,6 @@ number of queries received by thread
 .I threadX.num.queries_ip_ratelimited
 number of queries rate limited by thread
 .TP
-.I threadX.num.queries_cookie_valid
-number of queries with a valid DNS Cookie by thread
-.TP
-.I threadX.num.queries_cookie_client
-number of queries with a client part only DNS Cookie by thread
-.TP
-.I threadX.num.queries_cookie_invalid
-number of queries with an invalid DNS Cookie by thread
-.TP
-.I threadX.num.queries_discard_timeout
-number of queries removed due to discard-timeout by thread
-.TP
-.I threadX.num.queries_wait_limit
-number of queries removed due to wait-limit by thread
-.TP
 .I threadX.num.cachehits
 number of queries that were successfully answered using a cache lookup
 .TP
@@ -596,9 +382,6 @@ request for certificates.
 .I threadX.num.dnscrypt.malformed
 number of request that were neither cleartext, not valid dnscrypt messages.
 .TP
-.I threadX.num.dns_error_reports
-number of DNS Error Reports generated by thread
-.TP
 .I threadX.num.prefetch
 number of cache prefetches performed.  This number is included in
 cachehits, as the original query had the unprefetched answer from cache,
@@ -609,14 +392,6 @@ as a cache response was sent.
 .I threadX.num.expired
 number of replies that served an expired cache entry.
 .TP
-.I threadX.num.queries_timed_out
-number of queries that are dropped because they waited in the UDP socket buffer
-for too long.
-.TP
-.I threadX.query.queue_time_us.max
-The maximum wait time for packets in the socket buffer, in microseconds. This
-is only reported when sock-queue-timeout is enabled.
-.TP
 .I threadX.num.recursivereplies
 The number of replies sent to queries that needed recursive processing. Could be smaller than threadX.num.cachemiss if due to timeouts no replies were sent for some queries.
 .TP
@@ -657,24 +432,6 @@ buffers are full.
 .I total.num.queries
 summed over threads.
 .TP
-.I total.num.queries_ip_ratelimited
-summed over threads.
-.TP
-.I total.num.queries_cookie_valid
-summed over threads.
-.TP
-.I total.num.queries_cookie_client
-summed over threads.
-.TP
-.I total.num.queries_cookie_invalid
-summed over threads.
-.TP
-.I total.num.queries_discard_timeout
-summed over threads.
-.TP
-.I total.num.queries_wait_limit
-summed over threads.
-.TP
 .I total.num.cachehits
 summed over threads.
 .TP
@@ -693,21 +450,12 @@ summed over threads.
 .I total.num.dnscrypt.malformed
 summed over threads.
 .TP
-.I total.num.dns_error_reports
-summed over threads.
-.TP
 .I total.num.prefetch
 summed over threads.
 .TP
 .I total.num.expired
 summed over threads.
 .TP
-.I total.num.queries_timed_out
-summed over threads.
-.TP
-.I total.query.queue_time_us.max
-the maximum of the thread values.
-.TP
 .I total.num.recursivereplies
 summed over threads.
 .TP
@@ -773,10 +521,6 @@ queries waiting for request stream completion.
 Memory in bytes used by the HTTP/2 response buffers. Containing DNS responses
 waiting to be written back to the clients.
 .TP
-.I mem.quic
-Memory in bytes used by QUIC. Containing connection information, stream
-information, queries read and responses written back to the clients.
-.TP
 .I histogram.<sec>.<usec>.to.<sec>.<usec>
 Shows a histogram, summed over all threads. Every element counts the
 recursive queries whose reply time fit between the lower and upper bound.
@@ -825,10 +569,6 @@ Number of queries that were made using HTTPS towards the Unbound server.
 These are also counted in num.query.tcp and num.query.tls, because HTTPS
 uses TLS and TCP.
 .TP
-.I num.query.quic
-Number of queries that were made using QUIC towards the Unbound server.
-These are also counted in num.query.tls, because TLS is used for these queries.
-.TP
 .I num.query.ipv6
 Number of queries that were made using IPv6 towards the Unbound server.
 .TP
@@ -851,7 +591,7 @@ ratelimiting.
 .TP
 .I num.query.dnscrypt.shared_secret.cachemiss
 The number of dnscrypt queries that did not find a shared secret in the cache.
-This can be used to compute the shared secret hitrate.
+The can be use to compute the shared secret hitrate.
 .TP
 .I num.query.dnscrypt.replay
 The number of dnscrypt queries that found a nonce hit in the nonce cache and
@@ -907,18 +647,6 @@ timing and protocol support information.
 The number of items in the key cache.  These are DNSSEC keys, one item
 per delegation point, and their validation status.
 .TP
-.I msg.cache.max_collisions
-The maximum number of hash table collisions in the msg cache. This is the
-number of hashes that are identical when a new element is inserted in the
-hash table. If the value is very large, like hundreds, something is wrong
-with the performance of the hash table, hash values are incorrect or malicious.
-.TP
-.I rrset.cache.max_collisions
-The maximum number of hash table collisions in the rrset cache. This is the
-number of hashes that are identical when a new element is inserted in the
-hash table. If the value is very large, like hundreds, something is wrong
-with the performance of the hash table, hash values are incorrect or malicious.
-.TP
 .I dnscrypt_shared_secret.cache.count
 The number of items in the shared secret cache. These are precomputed shared
 secrets for a given client public key/server secret key pair. Shared secrets
@@ -958,12 +686,7 @@ Number of queries that got an answer that contained EDNS client subnet data.
 .I num.query.subnet_cache
 Number of queries answered from the edns client subnet cache.  These are
 counted as cachemiss by the main counters, but hit the client subnet
-specific cache after getting processed by the edns client subnet module.
-.TP
-.I num.query.cachedb
-Number of queries answered from the external cache of cachedb.
-These are counted as cachemiss by the main counters, but hit the cachedb
-external cache after getting processed by the cachedb module.
+specific cache, after getting processed by the edns client subnet module.
 .TP
 .I num.rpz.action.<rpz_action>
 Number of queries answered using configured RPZ policy, per RPZ action type.
@@ -112,14 +112,6 @@ If enabled, extended statistics are printed from \fIunbound\-control\fR(8).
 Default is off, because keeping track of more statistics takes time.  The
 counters are listed in \fIunbound\-control\fR(8).
 .TP
-.B statistics\-inhibit\-zero: \fI<yes or no>
-If enabled, selected extended statistics with a value of 0 are inhibited from
-printing with \fIunbound\-control\fR(8).
-These are query types, query classes, query opcodes, answer rcodes
-(except NOERROR, FORMERR, SERVFAIL, NXDOMAIN, NOTIMPL, REFUSED) and
-RPZ actions.
-Default is on.
-.TP
 .B num\-threads: \fI<number>
 The number of threads to create to serve clients. Use 1 for no threading.
 .TP
@@ -233,8 +225,7 @@ number).
 .B max\-udp\-size: \fI<number>
 Maximum UDP response size (not applied to TCP response).  65536 disables the
 udp response size maximum, and uses the choice from the client, always.
-Suggested values are 512 to 4096. Default is 1232. The default value is the
-same as the default for edns\-buffer\-size.
+Suggested values are 512 to 4096. Default is 4096.
 .TP
 .B stream\-wait\-size: \fI<number>
 Number of bytes size maximum to use for waiting stream buffers.  Default is
@@ -302,40 +293,6 @@ Increase this if you are behind a slow satellite link, to eg. 1128.
 That would then avoid re\-querying every initial query because it times out.
 Default is 376 msec.
 .TP
-.B discard\-timeout: \fI<msec>
-The wait time in msec where recursion requests are dropped. This is
-to stop a large number of replies from accumulating. They receive
-no reply, the work item continues to recurse. It is nice to be a bit
-larger than serve\-expired\-client\-timeout if that is enabled.
-A value of 1900 msec is suggested. The value 0 disables it.
-Default 1900 msec.
-.TP
-.B wait\-limit: \fI<number>
-The number of replies that can wait for recursion, for an IP address.
-This makes a ratelimit per IP address of waiting replies for recursion.
-It stops very large amounts of queries waiting to be returned to one
-destination. The value 0 disables wait limits. Default is 1000.
-.TP
-.B wait\-limit\-cookie: \fI<number>
-The number of replies that can wait for recursion, for an IP address
-that sent the query with a valid DNS cookie. Since the cookie validates
-the client address, the limit can be higher. Default is 10000.
-.TP
-.B wait\-limit\-netblock: \fI<netblock> <number>
-The wait limit for the netblock. If not given the wait\-limit value is
-used. The most specific netblock is used to determine the limit. Useful for
-overriding the default for a specific, group or individual, server.
-The value -1 disables wait limits for the netblock.
-By default the loopback has a wait limit netblock of -1, it is not limited,
-because it is separated from the rest of network for spoofed packets.
-The loopback addresses 127.0.0.0/8 and ::1/128 are default at -1.
-.TP
-.B wait\-limit\-cookie\-netblock: \fI<netblock> <number>
-The wait limit for the netblock, when the query has a DNS cookie.
-If not given, the wait\-limit\-cookie value is used.
-The value -1 disables wait limits for the netblock.
-The loopback addresses 127.0.0.0/8 and ::1/128 are default at -1.
-.TP
 .B so\-rcvbuf: \fI<number>
 If not 0, then set the SO_RCVBUF socket option to get more buffer
 space on UDP port 53 incoming queries.  So that short spikes on busy
@@ -422,15 +379,6 @@ Time to live maximum for negative responses, these have a SOA in the
 authority section that is limited in time.  Default is 3600.
 This applies to nxdomain and nodata answers.
 .TP
-.B cache\-min\-negative\-ttl: \fI<seconds>
-Time to live minimum for negative responses, these have a SOA in the
-authority section that is limited in time.
-Default is 0 (disabled).
-If this is disabled and \fBcache-min-ttl\fR is configured, it will take effect
-instead.
-In that case you can set this to 1 to honor the upstream TTL.
-This applies to nxdomain and nodata answers.
-.TP
 .B infra\-host\-ttl: \fI<seconds>
 Time to live for entries in the host cache. The host cache contains
 roundtrip timing, lameness and EDNS support information. Default is 900.
@@ -515,8 +463,6 @@ configured value if the number of free buffers falls below 35% of the
 total number configured, and finally to 0 if the number of free buffers
 falls below 20% of the total number configured. A minimum timeout of
 200 milliseconds is observed regardless of the option value used.
-It will be overridden by \fBedns\-tcp\-keepalive\-timeout\fR if
-\fBedns\-tcp\-keepalive\fR is enabled.
 .TP
 .B tcp-reuse-timeout: \fI<msec>\fR
 The period Unbound will keep TCP persistent connections open to
@@ -535,19 +481,20 @@ This option defaults to 3000 milliseconds.
 Enable or disable EDNS TCP Keepalive. Default is no.
 .TP
 .B edns-tcp-keepalive-timeout: \fI<msec>\fR
-Overrides \fBtcp\-idle\-timeout\fR when \fBedns\-tcp\-keepalive\fR is enabled.
-If the client supports the EDNS TCP Keepalive option,
+The period Unbound will wait for a query on a TCP connection when
+EDNS TCP Keepalive is active. If this timeout expires Unbound closes
+the connection. If the client supports the EDNS TCP Keepalive option,
 Unbound sends the timeout value to the client to encourage it to
 close the connection before the server times out.
 This option defaults to 120000 milliseconds.
-.TP
-.B sock\-queue\-timeout: \fI<sec>\fR
-UDP queries that have waited in the socket buffer for a long time can be
-dropped. Default is 0, disabled. The time is set in seconds, 3 could be a
-good value to ignore old queries that likely the client does not need a reply
-for any more. This could happen if the host has not been able to service
-the queries for a while, i.e. Unbound is not running, and then is enabled
-again. It uses timestamp socket options.
+When the number of free incoming TCP buffers falls below 50% of
+the total number configured, the advertised timeout is progressively
+reduced to 1% of the configured value, then to 0.2% of the configured
+value if the number of free buffers falls below 35% of the total number
+configured, and finally to 0 if the number of free buffers falls below
+20% of the total number configured.
+A minimum actual timeout of 200 milliseconds is observed regardless of the
+advertised timeout.
 .TP
 .B tcp\-upstream: \fI<yes or no>
 Enable or disable whether the upstream queries use TCP only for transport.
@@ -570,9 +517,6 @@ tls\-system\-cert to load CA certs, otherwise the connections cannot be
 authenticated. This option enables TLS for all of them, but if you do not set
 this you can configure TLS specifically for some forward zones with
 forward\-tls\-upstream.  And also with stub\-tls\-upstream.
-If the tls\-upstream option is enabled, it is for all the forwards and stubs,
-where the forward\-tls\-upstream and stub\-tls\-upstream options are ignored,
-as if they had been set to yes.
 .TP
 .B ssl\-upstream: \fI<yes or no>
 Alternate syntax for \fBtls\-upstream\fR.  If both are present in the config
@@ -720,21 +664,9 @@ and initial ACL (check if the proxy itself is denied/refused by configuration).
 The proxied address (if any) will then be used as the true client address and
 will be used where applicable for logging, ACL, DNSTAP, RPZ and IP ratelimiting.
 PROXYv2 is supported for UDP and TCP/TLS listening interfaces.
-There is no support for PROXYv2 on a DoH, DoQ or DNSCrypt listening interface.
+There is no support for PROXYv2 on a DoH or DNSCrypt listening interface.
 Can list multiple, each on a new statement.
 .TP
-.B quic\-port: \fI<number>
-The port number on which to provide DNS-over-QUIC service, default 853, only
-interfaces configured with that port number as @number get the QUIC service.
-The interface uses QUIC for the UDP traffic on that port number.
-.TP
-.B quic\-size: \fI<size in bytes>
-Maximum number of bytes for all QUIC buffers and data combined. Default is 8
-megabytes. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes,
-megabytes or gigabytes (1024*1024 bytes in a megabyte). New connections receive
-connection refused when the limit is exceeded. New streams are reset when the
-limit is exceeded.
-.TP
 .B use\-systemd: \fI<yes or no>
 Enable or disable systemd socket activation.
 Default is no.
@@ -750,25 +682,19 @@ When at the limit, further connections are accepted but closed immediately.
 This option is experimental at this time.
 .TP
 .B access\-control: \fI<IP netblock> <action>
-Specify treatment of incoming queries from their originating IP address.
-Queries can be allowed to have access to this server that gives DNS
-answers, or refused, with other actions possible. The IP address range
-can be specified as a netblock, it is possible to give the statement
-several times in order to specify the treatment of different netblocks.
-.IP
 The netblock is given as an IP4 or IP6 address with /size appended for a
 classless network block. The action can be \fIdeny\fR, \fIrefuse\fR,
-\fIallow\fR, \fIallow_setrd\fR, \fIallow_snoop\fR, \fIallow_cookie\fR,
-\fIdeny_non_local\fR or \fIrefuse_non_local\fR.
+\fIallow\fR, \fIallow_setrd\fR, \fIallow_snoop\fR, \fIdeny_non_local\fR or
+\fIrefuse_non_local\fR.
 The most specific netblock match is used, if none match \fIrefuse\fR is used.
 The order of the access\-control statements therefore does not matter.
 .IP
-The \fIdeny\fR action stops queries from hosts from that netblock.
+The action \fIdeny\fR stops queries from hosts from that netblock.
 .IP
-The \fIrefuse\fR action stops queries too, but sends a DNS rcode REFUSED
+The action \fIrefuse\fR stops queries too, but sends a DNS rcode REFUSED
 error message back.
 .IP
-The \fIallow\fR action gives access to clients from that netblock.
+The action \fIallow\fR gives access to clients from that netblock.
 It gives only access for recursion clients (which is
 what almost all clients need).  Nonrecursive queries are refused.
 .IP
@@ -788,27 +714,14 @@ may be useful if another DNS server must forward requests for specific
 zones to a resolver DNS server, but only supports stub domains and
 sends queries to the resolver DNS server with the RD bit cleared.
 .IP
-The \fIallow_snoop\fR action gives nonrecursive access too.  This give
+The action \fIallow_snoop\fR gives nonrecursive access too.  This give
 both recursive and non recursive access.  The name \fIallow_snoop\fR refers
 to cache snooping, a technique to use nonrecursive queries to examine
 the cache contents (for malicious acts).  However, nonrecursive queries can
 also be a valuable debugging tool (when you want to examine the cache
 contents). In that case use \fIallow_snoop\fR for your administration host.
 .IP
-The \fIallow_cookie\fR action allows access only to UDP queries that contain a
-valid DNS Cookie as specified in RFC 7873 and RFC 9018, when the
-\fBanswer\-cookie\fR option is enabled.
-UDP queries containing only a DNS Client Cookie and no Server Cookie, or an
-invalid DNS Cookie, will receive a BADCOOKIE response including a newly
-generated DNS Cookie, allowing clients to retry with that DNS Cookie.
-The \fIallow_cookie\fR action will also accept requests over stateful
-transports, regardless of the presence of an DNS Cookie and regardless of the
-\fBanswer\-cookie\fR setting.
-UDP queries without a DNS Cookie receive REFUSED responses with the TC flag set,
-that may trigger fall back to TCP for those clients.
-.IP
-By default only localhost (the 127.0.0.0/8 IP netblock, not the loopback
-interface) is implicitly \fIallow\fRed, the rest is \fIrefuse\fRd.
+By default only localhost is \fIallow\fRed, the rest is \fIrefuse\fRd.
 The default is \fIrefuse\fRd, because that is protocol\-friendly. The DNS
 protocol is not designed to handle dropped packets due to policy, and
 dropping may result in (possibly excessive) retried queries.
@@ -844,12 +757,8 @@ Similar to \fBaccess\-control:\fR but for interfaces.
 .IP
 The action is the same as the ones defined under \fBaccess\-control:\fR.
 Interfaces are \fIrefuse\fRd by default.
-By default only localhost (the 127.0.0.0/8 IP netblock, not the loopback
-interface) is implicitly \fIallow\fRed through the default
-\fBaccess\-control:\fR behavior.
-This also means that any attempt to use the \fBinterface-*:\fR options for the
-loopback interface will not work as they will be overridden by the implicit
-default "\fBaccess\-control:\fR 127.0.0.0/8 allow" option.
+By default only localhost (the IP netblock, not the loopback interface) is
+\fIallow\fRed through the default \fBaccess\-control:\fR behavior.
 .IP
 Note that the interface needs to be already specified with \fBinterface:\fR
 and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR
@@ -906,8 +815,9 @@ outside of the chroot directory.
 Additionally, Unbound may need to access /dev/urandom (for entropy)
 from inside the chroot.
 .IP
-If given a chroot is done to the given directory. The chroot is by default 
-set to "@UNBOUND_CHROOT_DIR@". If you give "" no chroot is performed.
+If given a chroot is done to the given directory. By default chroot is
+enabled and the default is "@UNBOUND_CHROOT_DIR@". If you give "" no
+chroot is performed.
 .TP
 .B username: \fI<name>
 If given, after binding the port the user privileges are dropped. Default is
@@ -954,10 +864,6 @@ Sets logfile lines to use a timestamp in UTC ascii. Default is no, which
 prints the seconds since 1970 in brackets. No effect if using syslog, in
 that case syslog formats the timestamp printed into the log files.
 .TP
-.B log\-time\-iso:\fR <yes or no>
-Log time in ISO8601 format, if \fBlog\-time\-ascii:\fR yes is also set.
-Default is no.
-.TP
 .B log\-queries: \fI<yes or no>
 Prints one line per query to the log, with the log timestamp and IP address,
 name, type and class.  Default is no.  Note that it takes time to print these
@@ -976,11 +882,6 @@ Prints the word 'query' and 'reply' with log\-queries and log\-replies.
 This makes filtering logs easier.  The default is off (for backwards
 compatibility).
 .TP
-.B log\-destaddr: \fI<yes or no>
-Prints the destination address, port and type in the log\-replies output.
-This disambiguates what type of traffic, eg. udp or tcp, and to what local
-port the traffic was sent to.
-.TP
 .B log\-local\-actions: \fI<yes or no>
 Print log lines to inform about local zone actions.  These lines are like the
 local\-zone type inform prints out, but they are also printed for the other
@@ -1059,22 +960,17 @@ closer to that of BIND 9, while setting "\-1 \-1 \-1 \-1 \-1" gives behaviour
 rumoured to be closer to that of BIND 8.
 .TP
 .B harden\-short\-bufsize: \fI<yes or no>
-Very small EDNS buffer sizes from queries are ignored. Default is yes, as
+Very small EDNS buffer sizes from queries are ignored. Default is on, as
 described in the standard.
 .TP
 .B harden\-large\-queries: \fI<yes or no>
-Very large queries are ignored. Default is no, since it is legal protocol
+Very large queries are ignored. Default is off, since it is legal protocol
 wise to send these, and could be necessary for operation if TSIG or EDNS
 payload is very large.
 .TP
 .B harden\-glue: \fI<yes or no>
 Will trust glue only if it is within the servers authority. Default is yes.
 .TP
-.B harden\-unverified\-glue: \fI<yes or no>
-Will trust only in-zone glue. Will try to resolve all out of zone
-(\fI<unverfied>) glue. Will fallback to the original glue if unable to resolve.
-Default is no.
-.TP
 .B harden\-dnssec\-stripped: \fI<yes or no>
 Require DNSSEC data for trust\-anchored zones, if such data is absent,
 the zone becomes bogus. If turned off, and no DNSSEC data is received
@@ -1110,29 +1006,10 @@ to increase the max depth that is checked to.
 .TP
 .B harden\-algo\-downgrade: \fI<yes or no>
 Harden against algorithm downgrade when multiple algorithms are
-advertised in the DS record.
-This works by first choosing only the strongest DS digest type as per RFC 4509
-(Unbound treats the highest algorithm as the strongest) and then
-expecting signatures from all the advertised signing algorithms from the chosen
-DS(es) to be present.
-If no, allows any one supported algorithm to validate the zone, even if other advertised algorithms are broken.
-Default is no.
-RFC 6840 mandates that zone signers must produce zones signed with all
-advertised algorithms, but sometimes they do not.
-RFC 6840 also clarifies that this requirement is not for validators and
-validators should accept any single valid path.
-It should thus be explicitly noted that this option violates RFC 6840 for
-DNSSEC validation and should only be used to perform a signature
-completeness test to support troubleshooting.
-Using this option may break DNSSEC resolution with non-RFC6840-conforming
-signers and/or in multi-signer configurations that don't send all the
-advertised signatures.
-.TP
-.B harden\-unknown\-additional: \fI<yes or no>
-Harden against unknown records in the authority section and additional
-section. Default is no. If no, such records are copied from the upstream
-and presented to the client together with the answer. If yes, it could
-hamper future protocol developments that want to add records.
+advertised in the DS record.  If no, allows the weakest algorithm to
+validate the zone.  Default is no.  Zone signers must produce zones
+that allow this feature to work, but sometimes they do not, and turning
+this option off avoids that validation failure.
 .TP
 .B use\-caps\-for\-id: \fI<yes or no>
 Use 0x20\-encoded random bits in the query to foil spoof attempts.
@@ -1147,7 +1024,7 @@ queries.  For domains that do not support 0x20 and also fail with fallback
 because they keep sending different answers, like some load balancers.
 Can be given multiple times, for different domains.
 .TP
-.B caps\-whitelist: \fI<domain>
+.B caps\-whitelist: \fI<yes or no>
 Alternate syntax for \fBcaps\-exempt\fR.
 .TP
 .B qname\-minimisation: \fI<yes or no>
@@ -1211,11 +1088,10 @@ IP6 ::1 and IP4 127.0.0.1/8. If no, then localhost can be used to send
 queries to. Default is yes.
 .TP
 .B prefetch: \fI<yes or no>
-If yes, cache hits on message cache elements that are on their last 10 percent
-of their TTL value trigger a prefetch to keep the cache up to date.
-Default is no.
-Turning it on gives about 10 percent more traffic and load on the machine, but
-popular items do not expire from the cache.
+If yes, message cache elements are prefetched before they expire to
+keep the cache up to date.  Default is no.  Turning it on gives about
+10 percent more traffic and load on the machine, but popular items do
+not expire from the cache.
 .TP
 .B prefetch\-key: \fI<yes or no>
 If yes, fetch the DNSKEYs earlier in the validation process, when a DS
@@ -1235,13 +1111,12 @@ from the query ID, for speed and thread safety).  Default is yes.
 .B minimal-responses: \fI<yes or no>
 If yes, Unbound does not insert authority/additional sections into response
 messages when those sections are not required.  This reduces response
-size significantly, and may avoid TCP fallback for some responses which may
-cause a slight speedup.  The default is yes, even though the DNS
+size significantly, and may avoid TCP fallback for some responses.
+This may cause a slight speedup.  The default is yes, even though the DNS
 protocol RFCs mandate these sections, and the additional content could
-save roundtrips for clients that use the additional content.
-However these sections are hardly used by clients.
-Enabling prefetch can benefit clients that need the additional content
-by trying to keep that content fresh in the cache.
+be of use and save roundtrips for clients.  Because they are not used,
+and the saved roundtrips are easier saved with prefetch, whilst this is
+faster.
 .TP
 .B disable-dnssec-lame-check: \fI<yes or no>
 If true, disables the DNSSEC lameness check in the iterator.  This check
@@ -1264,6 +1139,9 @@ Adding \fIrespip\fR to the front will cause RPZ processing to be done on
 all queries.
 The default is "\fIvalidator iterator\fR".
 .IP
+When the server is built with
+EDNS client subnet support the default is "\fIsubnetcache validator
+iterator\fR".
 Most modules that need to be listed here have to be listed at the beginning
 of the line.  The subnetcachedb module has to be listed just before
 the iterator.
@@ -1387,33 +1265,17 @@ servers that set the CD flag but cannot validate DNSSEC themselves are
 the clients, and then Unbound provides them with DNSSEC protection.
 The default value is "no".
 .TP
-.B disable\-edns\-do: \fI<yes or no>
-Disable the EDNS DO flag in upstream requests.
-It breaks DNSSEC validation for Unbound's clients.
-This results in the upstream name servers to not include DNSSEC records in
-their replies and could be helpful for devices that cannot handle DNSSEC
-information.
-When the option is enabled, clients that set the DO flag receive no EDNS
-record in the response to indicate the lack of support to them.
-If this option is enabled but Unbound is already configured for DNSSEC
-validation (i.e., the validator module is enabled; default) this option is
-implicitly turned off with a warning as to not break DNSSEC validation in
-Unbound.
-Default is no.
-.TP
 .B serve\-expired: \fI<yes or no>
 If enabled, Unbound attempts to serve old responses from cache with a
-TTL of \fBserve\-expired\-reply\-ttl\fR in the response.
-By default the expired answer will be used after a resolution attempt errored
-out or is taking more than serve\-expired\-client\-timeout to resolve.
-Default is "no".
+TTL of \fBserve\-expired\-reply\-ttl\fR in the response without waiting for the
+actual resolution to finish.  The actual resolution answer ends up in the cache
+later on.  Default is "no".
 .TP
 .B serve\-expired\-ttl: \fI<seconds>
-Limit serving of expired responses to configured seconds after expiration.
-0 disables the limit.
-This option only applies when \fBserve\-expired\fR is enabled.
-A suggested value per RFC 8767 is between 86400 (1 day) and 259200 (3 days).
-The default is 86400.
+Limit serving of expired responses to configured seconds after expiration. 0
+disables the limit.  This option only applies when \fBserve\-expired\fR is
+enabled.  A suggested value per RFC 8767 is between
+86400 (1 day) and 259200 (3 days).  The default is 0.
 .TP
 .B serve\-expired\-ttl\-reset: \fI<yes or no>
 Set the TTL of expired records to the \fBserve\-expired\-ttl\fR value after a
@@ -1427,14 +1289,12 @@ TTL value to use when replying with expired data.  If
 use 30 as the value (RFC 8767).  The default is 30.
 .TP
 .B serve\-expired\-client\-timeout: \fI<msec>
-Time in milliseconds before replying to the client with expired data.
-This essentially enables the serve-stale behavior as specified in
+Time in milliseconds before replying to the client with expired data.  This
+essentially enables the serve-stale behavior as specified in
 RFC 8767 that first tries to resolve before immediately
-responding with expired data.
-Setting this to 0 will disable this behavior and instead serve the expired
-record immediately from the cache before attempting to refresh it via
-resolution.
-Default is 1800.
+responding with expired data.  A recommended value per
+RFC 8767 is 1800.  Setting this to 0 will disable this
+behavior.  Default is 0.
 .TP
 .B serve\-original\-ttl: \fI<yes or no>
 If enabled, Unbound will always return the original TTL as received from
@@ -1523,10 +1383,10 @@ address space are not validated.  This is usually required whenever
 Configure a local zone. The type determines the answer to give if
 there is no match from local\-data. The types are deny, refuse, static,
 transparent, redirect, nodefault, typetransparent, inform, inform_deny,
-inform_redirect, always_transparent, block_a, always_refuse, always_nxdomain,
-always_null, noview, and are explained below. After that the default settings
-are listed. Use local\-data: to enter data into the local zone. Answers for
-local zones are authoritative DNS answers. By default the zones are class IN.
+inform_redirect, always_transparent, always_refuse, always_nxdomain, always_null, noview,
+and are explained below. After that the default settings are listed. Use
+local\-data: to enter data into the local zone. Answers for local zones
+are authoritative DNS answers. By default the zones are class IN.
 .IP
 If you need more complicated authoritative data, with referrals, wildcards,
 CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for
@@ -1601,12 +1461,6 @@ Ie. answer queries with fixed data and also log the machines that ask.
 \h'5'\fIalways_transparent\fR
 Like transparent, but ignores local data and resolves normally.
 .TP 10
-\h'5'\fIblock_a\fR
-Like transparent, but ignores local data and resolves normally all query
-types excluding A. For A queries it unconditionally returns NODATA.
-Useful in cases when there is a need to explicitly force all apps to use
-IPv6 protocol and avoid any queries to IPv4.
-.TP 10
 \h'5'\fIalways_refuse\fR
 Like refuse, but ignores local data and refuses the query.
 .TP 10
@@ -1639,7 +1493,6 @@ given zone.  Use \fInodefault\fR if you use exactly that zone, if you want to
 use a subzone, use \fItransparent\fR.
 .P
 The default zones are localhost, reverse 127.0.0.1 and ::1, the home.arpa,
-the resolver.arpa, the service.arpa,
 the onion, test, invalid and the AS112 zones. The AS112 zones are reverse
 DNS zones for private use and reserved IP addresses for which the servers
 on the internet cannot provide correct answers. They are configured by
@@ -1695,24 +1548,6 @@ local\-data: "home.arpa. 10800 IN
    SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
 .fi
 .TP 10
-\h'5'\fIresolver.arpa (RFC 9462)\fR
-Default content:
-.nf
-local\-zone: "resolver.arpa." static
-local\-data: "resolver.arpa. 10800 IN NS localhost."
-local\-data: "resolver.arpa. 10800 IN
-    SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
-.fi
-.TP 10
-\h'5'\fIservice.arpa (draft-ietf-dnssd-srp-25)\fR
-Default content:
-.nf
-local\-zone: "service.arpa." static
-local\-data: "service.arpa. 10800 IN NS localhost."
-local\-data: "service.arpa. 10800 IN
-    SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
-.fi
-.TP 10
 \h'5'\fIonion (RFC 7686)\fR
 Default content:
 .nf
@@ -1942,30 +1777,11 @@ A value of 0 will disable ratelimiting for domain names that end in this name.
 .TP 5
 .B ip\-ratelimit: \fI<number or 0>
 Enable global ratelimiting of queries accepted per IP address.
-This option is experimental at this time.
+If 0, the default, it is disabled.  This option is experimental at this time.
 The ratelimit is in queries per second that are allowed.  More queries are
 completely dropped and will not receive a reply, SERVFAIL or otherwise.
 IP ratelimiting happens before looking in the cache. This may be useful for
 mitigating amplification attacks.
-Clients with a valid DNS Cookie will bypass the ratelimit.
-If a ratelimit for such clients is still needed, \fBip\-ratelimit\-cookie\fR
-can be used instead.
-Default is 0 (disabled).
-.TP 5
-.B ip\-ratelimit\-cookie: \fI<number or 0>
-Enable global ratelimiting of queries accepted per IP address with a valid DNS
-Cookie.
-This option is experimental at this time.
-The ratelimit is in queries per second that are allowed.
-More queries are completely dropped and will not receive a reply, SERVFAIL or
-otherwise.
-IP ratelimiting happens before looking in the cache.
-This option could be useful in combination with \fIallow_cookie\fR in an
-attempt to mitigate other amplification attacks than UDP reflections (e.g.,
-attacks targeting Unbound itself) which are already handled with DNS Cookies.
-If used, the value is suggested to be higher than \fBip\-ratelimit\fR e.g.,
-tenfold.
-Default is 0 (disabled).
 .TP 5
 .B ip\-ratelimit\-size: \fI<memory size>
 Give the size of the data structure in which the current ongoing rates are
@@ -2004,38 +1820,6 @@ If a forward/stub zone is used, this is the number of retries per nameserver in
 the zone.
 Default is 5.
 .TP 5
-.B max\-sent\-count: \fI<number>
-Hard limit on the number of outgoing queries Unbound will make while resolving
-a name, making sure large NS sets do not loop.
-Results in SERVFAIL when reached.
-It resets on query restarts (e.g., CNAME) and referrals.
-Default is 32.
-.TP 5
-.B max\-query\-restarts: \fI<number>
-Hard limit on the number of times Unbound is allowed to restart a query upon
-encountering a CNAME record.
-Results in SERVFAIL when reached.
-Changing this value needs caution as it can allow long CNAME chains to be
-accepted, where Unbound needs to verify (resolve) each link individually.
-Default is 11.
-.TP 5
-.B iter\-scrub\-ns: \fI<number>
-Limit on the number of NS records allowed in an rrset of type NS, from the
-iterator scrubber. This protects the internals of the resolver from overly
-large NS sets. Default is 20.
-.TP 5
-.B iter\-scrub\-cname: \fI<number>
-Limit on the number of CNAME, DNAME records in an answer, from the iterator
-scrubber. This protects the internals of the resolver from overly long
-indirection chains. Clips off the remainder of the reply packet at that point.
-Default is 11.
-.TP 5
-.B max\-global\-quota: \fI<number>
-Limit on the number of upstream queries sent out for an incoming query and
-its subqueries from recursion. It is not reset during the resolution. When
-it is exceeded the query is failed and the lookup process stops.
-Default is 200.
-.TP 5
 .B fast\-server\-permil: \fI<number>
 Specify how many times out of 1000 to pick from the set of fastest servers.
 0 turns the feature off.  A value of 900 would pick from the fastest
@@ -2051,32 +1835,6 @@ Set the number of servers that should be used for fast server selection. Only
 use the fastest specified number of servers with the fast\-server\-permil
 option, that turns this on or off. The default is to use the fastest 3 servers.
 .TP 5
-.B answer\-cookie: \fI<yes or no>
-If enabled, Unbound will answer to requests containing DNS Cookies as
-specified in RFC 7873 and RFC 9018.
-Default is no.
-.TP 5
-.B cookie\-secret: \fI<128 bit hex string>
-Server's secret for DNS Cookie generation.
-Useful to explicitly set for servers in an anycast deployment that need to
-share the secret in order to verify each other's Server Cookies.
-An example hex string would be "000102030405060708090a0b0c0d0e0f".
-Default is a 128 bits random secret generated at startup time.
-This option is ignored if a \fBcookie\-secret\-file\fR is
-present.  In that case the secrets from that file are used in DNS Cookie
-calculations.
-.TP 5
-.B cookie\-secret\-file: \fI<filename>
-File from which the secrets are read used in DNS Cookie calculations. When this
-file exists, the secrets in this file are used and the secret specified by the
-\fBcookie-secret\fR option is ignored.
-Enable it by setting a filename, like "/usr/local/etc/unbound_cookiesecrets.txt".
-The content of this file must be manipulated with the \fBadd_cookie_secret\fR,
-\fBdrop_cookie_secret\fR and \fBactivate_cookie_secret\fR commands to the
-\fIunbound\-control\fR(8) tool. Please see that manpage on how to perform a
-safe cookie secret rollover.
-Default is "" (disabled).
-.TP 5
 .B edns\-client\-string: \fI<IP netblock> <string>
 Include an EDNS0 option containing configured ascii string in queries with
 destination address matching the configured IP netblock.  This configuration
@@ -2089,30 +1847,17 @@ be used.  Default is 65001.
 .TP 5
 .B ede: \fI<yes or no>
 If enabled, Unbound will respond with Extended DNS Error codes (RFC8914).
-These EDEs provide additional information with a response mainly for, but not
-limited to, DNS and DNSSEC errors.
+These EDEs attach informative error messages to a response for various
+errors. Default is "no".

 When the \fBval-log-level\fR option is also set to \fB2\fR, responses with
-Extended DNS Errors concerning DNSSEC failures will also contain a descriptive
-text message about the reason for the failure.
-Default is "no".
-.TP 5
+Extended DNS Errors concerning DNSSEC failures that are not served from cache,
+will also contain a descriptive text message about the reason for the failure.
+.TP
 .B ede\-serve\-expired: \fI<yes or no>
 If enabled, Unbound will attach an Extended DNS Error (RFC8914) Code 3 - Stale
-Answer as EDNS0 option to the expired response.
-The \fBede\fR option needs to be enabled as well for this to work.
-Default is "no".
-.TP 5
-.B dns\-error\-reporting: \fI<yes or no>
-If enabled, Unbound will send DNS Error Reports (RFC9567).
-The name servers need to express support by attaching the Report-Channel EDNS0
-option on their replies specifying the reporting agent for the zone.
-Any errors encountered during resolution that would result in Unbound
-generating an Extended DNS Error (RFC8914) will be reported to the zone's
-reporting agent.
-The \fBede\fR option does not need to be enabled for this to work.
-It is advised that the \fBqname\-minimisation\fR option is also enabled to
-increase privacy on the outgoing reports.
+Answer as EDNS0 option to the expired response. Note that this will not attach
+the EDE code without setting the global \fBede\fR option to "yes" as well.
 Default is "no".
 .SS "Remote Control Options"
 In the
@@ -2323,32 +2068,13 @@ useful when you want immediate changes to be visible.
 Authority zones are configured with \fBauth\-zone:\fR, and each one must
 have a \fBname:\fR.  There can be multiple ones, by listing multiple auth\-zone clauses, each with a different name, pertaining to that part of the namespace.
 The authority zone with the name closest to the name looked up is used.
-Authority zones can be processed on two distinct, non-exclusive, configurable
-stages.
-.LP
-With \fBfor\-downstream:\fR \fIyes\fR (default), authority zones are processed
-after \fBlocal\-zones\fR and before cache.
-When used in this manner, Unbound responds like an authority server with no
-further processing other than returning an answer from the zone contents.
-A notable example, in this case, is CNAME records which are returned verbatim
-to downstream clients without further resolution.
-.LP
-With \fBfor\-upstream:\fR \fIyes\fR (default), authority zones are processed
-after the cache lookup, just before going to the network to fetch
-information for recursion.
-When used in this manner they provide a local copy of an authority server
-that speeds up lookups for that data during resolving.
-.LP
-If both options are enabled (default), client queries for an authority zone are
-answered authoritatively from Unbound, while internal queries that require data
-from the authority zone consult the local zone data instead of going to the
-network.
-.LP
-An interesting configuration is \fBfor\-downstream:\fR \fIno\fR,
-\fBfor\-upstream:\fR \fIyes\fR that allows for hyperlocal behavior where both
-client and internal queries consult the local zone data while resolving.
-In this case, the aforementioned CNAME example will result in a thoroughly
-resolved answer.
+Authority zones are processed after \fBlocal\-zones\fR and before
+cache (\fBfor\-downstream:\fR \fIyes\fR), and when used in this manner
+make Unbound respond like an authority server.  Authority zones are also
+processed after cache, just before going to the network to fetch
+information for recursion (\fBfor\-upstream:\fR \fIyes\fR), and when used
+in this manner provide a local copy of an authority server that speeds up
+lookups of that data.
 .LP
 Authority zones can be read from zonefile.  And can be kept updated via
 AXFR and IXFR.  After update the zonefile is rewritten.  The update mechanism
@@ -2525,8 +2251,8 @@ The dynamic library file to load. Repeat this option for every dynlib module
 instance added to the \fBmodule\-config:\fR option.
 .SS "DNS64 Module Options"
 .LP
-The dns64 module must be configured in the \fBmodule\-config:\fR directive
-e.g., "dns64 validator iterator" and be compiled into the daemon to be
+The dns64 module must be configured in the \fBmodule\-config:\fR "dns64
+validator iterator" directive and be compiled into the daemon to be
 enabled.  These settings go in the \fBserver:\fR section.
 .TP
 .B dns64\-prefix: \fI<IPv6 prefix>\fR
@@ -2542,21 +2268,6 @@ List domain for which the AAAA records are ignored and the A record is
 used by dns64 processing instead.  Can be entered multiple times, list a
 new domain for which it applies, one per line.  Applies also to names
 underneath the name given.
-.SS "NAT64 Operation"
-.LP
-NAT64 operation allows using a NAT64 prefix for outbound requests to IPv4-only
-servers.  It is controlled by two options in the \fBserver:\fR section:
-.TP
-.B do\-nat64: \fI<yes or no>\fR
-Use NAT64 to reach IPv4-only servers.
-Consider also enabling \fBprefer\-ip6\fR to prefer native IPv6 connections to
-nameservers.
-Default no.
-.TP
-.B nat64\-prefix: \fI<IPv6 prefix>\fR
-Use a specific NAT64 prefix to reach IPv4-only servers.  Defaults to using
-the prefix configured in \fBdns64\-prefix\fR, which in turn defaults to
-64:ff9b::/96.  The prefix length must be one of /32, /40, /48, /56, /64 or /96.
 .SS "DNSCrypt Options"
 .LP
 The
@@ -2626,8 +2337,8 @@ in the dnscrypt nonce cache.  Close to the number of cpus is
 a fairly good setting.
 .SS "EDNS Client Subnet Module Options"
 .LP
-The ECS module must be configured in the \fBmodule\-config:\fR directive e.g.,
-"subnetcache validator iterator" and be compiled into the daemon to be
+The ECS module must be configured in the \fBmodule\-config:\fR "subnetcache
+validator iterator" directive and be compiled into the daemon to be
 enabled.  These settings go in the \fBserver:\fR section.
 .LP
 If the destination address is allowed in the configuration Unbound will add the
@@ -2647,18 +2358,6 @@ The maximum size of the ECS cache is controlled by 'msg-cache-size' in the
 configuration file. On top of that, for each query only 100 different subnets
 are allowed to be stored for each address family. Exceeding that number, older
 entries will be purged from cache.
-.LP
-Note that due to the nature of how EDNS Client Subnet works, by segregating the
-client IP space in order to try and have tailored responses for prefixes of
-unknown sizes, resolution and cache response performance are impacted as a
-result.
-Usage of the subnetcache module should only be enabled in installations that
-require such functionality where the resolver and the clients belong to
-different networks.
-An example of that is an open resolver installation.
-.LP
-This module does not interact with the \fBserve\-expired*\fR and
-\fBprefetch:\fR options.
 .TP
 .B send\-client\-subnet: \fI<IP address>\fR
 Send client source address to this authority. Append /num to indicate a
@@ -2707,8 +2406,8 @@ Specifies the maximum number of subnets ECS answers kept in the ECS radix tree.
 This number applies for each qname/qclass/qtype tuple. Defaults to 100.
 .SS "Opportunistic IPsec Support Module Options"
 .LP
-The IPsec module must be configured in the \fBmodule\-config:\fR directive
-e.g., "ipsecmod validator iterator" and be compiled into Unbound by using
+The IPsec module must be configured in the \fBmodule\-config:\fR "ipsecmod
+validator iterator" directive and be compiled into Unbound by using
 \fB\-\-enable\-ipsecmod\fR to be enabled.
 These settings go in the \fBserver:\fR section.
 .LP
@@ -2773,12 +2472,12 @@ Allow the ipsecmod functionality for the domain so that the module logic will be
 executed.  Can be given multiple times, for different domains.  If the option is
 not specified, all domains are treated as being allowed (default).
 .TP
-.B ipsecmod\-whitelist: \fI<domain>
+.B ipsecmod\-whitelist: \fI<yes or no>
 Alternate syntax for \fBipsecmod\-allow\fR.
 .SS "Cache DB Module Options"
 .LP
-The Cache DB module must be configured in the \fBmodule\-config:\fR directive
-e.g., "validator cachedb iterator" and be compiled into the daemon
+The Cache DB module must be configured in the \fBmodule\-config:\fR
+"validator cachedb iterator" directive and be compiled into the daemon
 with \fB\-\-enable\-cachedb\fR.
 If this module is enabled and configured, the specified backend database
 works as a second level cache:
@@ -2790,7 +2489,11 @@ If Unbound cannot even find an answer in the backend, it resolves the
 query as usual, and stores the answer in the backend.
 .P
 This module interacts with the \fBserve\-expired\-*\fR options and will reply
-with expired data if Unbound is configured for that.
+with expired data if Unbound is configured for that.  Currently the use
+of \fBserve\-expired\-client\-timeout:\fR and
+\fBserve\-expired\-reply\-ttl:\fR is not consistent for data originating from
+the external cache as these will result in a reply with 0 TTL without trying to
+update the data first, ignoring the configured values.
 .P
 If Unbound was built with
 \fB\-\-with\-libhiredis\fR
@@ -2841,21 +2544,6 @@ operationally.
 If the backend database is shared by multiple Unbound instances,
 all instances must use the same secret seed.
 This option defaults to "default".
-.TP
-.B cachedb-no-store: \fI<yes or no>\fR
-If the backend should be read from, but not written to. This makes this
-instance not store dns messages in the backend. But if data is available it
-is retrieved. The default is no.
-.TP
-.B cachedb-check-when-serve-expired: \fI<yes or no>\fR
-If enabled, the cachedb is checked before an expired response is returned.
-When \fBserve\-expired\fR is enabled, without \fBserve\-expired\-client\-timeout\fR, it then
-does not immediately respond with an expired response from cache, but instead
-first checks the cachedb for valid contents, and if so returns it. If the
-cachedb also has no valid contents, the serve expired response is sent.
-If also \fBserve\-expired\-client\-timeout\fR is enabled, the expired response
-is delayed until the timeout expires. Unless the lookup succeeds within the
-timeout. The default is yes.
 .P
 The following
 .B cachedb
@@ -2872,16 +2560,6 @@ This option defaults to "127.0.0.1".
 The TCP port number of the Redis server.
 This option defaults to 6379.
 .TP
-.B redis-server-path: \fI<unix socket path>\fR
-The unix socket path to connect to the Redis server. Off by default, and it
-can be set to "" to turn this off. Unix sockets may have better throughput
-than the IP address option.
-.TP
-.B redis-server-password: \fI"<password>"\fR
-The Redis AUTH password to use for the Redis server.
-Only relevant if Redis is configured for client password authorisation.
-Off by default, and it can be set to "" to turn this off.
-.TP
 .B redis-timeout: \fI<msec>\fR
 The period until when Unbound waits for a response from the Redis sever.
 If this timeout expires Unbound closes the connection, treats it as
@@ -2889,16 +2567,6 @@ if the Redis server does not have the requested data, and will try to
 re-establish a new connection later.
 This option defaults to 100 milliseconds.
 .TP
-.B redis-command-timeout: \fI<msec>\fR
-The timeout to use for Redis commands, in milliseconds.
-If 0, it uses the \fBredis\-timeout\fR value.
-The default is 0.
-.TP
-.B redis-connect-timeout: \fI<msec>\fR
-The timeout to use for Redis connection set up, in milliseconds.
-If 0, it uses the \fBredis\-timeout\fR value.
-The default is 0.
-.TP
 .B redis-expire-records: \fI<yes or no>
 If Redis record expiration is enabled.  If yes, Unbound sets timeout for Redis
 records so that Redis can evict keys that have expired automatically.  If
@@ -2906,63 +2574,6 @@ Unbound is configured with \fBserve-expired\fR and \fBserve-expired-ttl\fR is 0,
 this option is internally reverted to "no".  Redis SETEX support is required
 for this option (Redis >= 2.0.0).
 This option defaults to no.
-.TP
-.B redis-logical-db: \fI<logical database index>
-The logical database in Redis to use.
-These are databases in the same Redis instance sharing the same configuration
-and persisted in the same RDB/AOF file.
-If unsure about using this option, Redis documentation
-(https://redis.io/commands/select/) suggests not to use a single Redis instance
-for multiple unrelated applications.
-The default database in Redis is 0 while other logical databases need to be
-explicitly SELECT'ed upon connecting.
-This option defaults to 0.
-.TP
-.B redis-replica-server-host: \fI<server address or name>\fR
-The IP (either v6 or v4) address or domain name of the Redis replica server.
-In general an IP address should be specified as otherwise Unbound will have to
-resolve the name of the server every time it establishes a connection
-to the server.
-This server is treated as a read-only replica server
-(https://redis.io/docs/management/replication/#read-only-replica).
-If specified, all Redis read commands will go to this replica server, while
-the write commands will go to the \fBredis-server-host\fR.
-This option defaults to "" (disabled).
-.TP
-.B redis-replica-server-port: \fI<port number>\fR
-The TCP port number of the Redis replica server.
-This option defaults to 6379.
-.TP
-.B redis-replica-server-path: \fI<unix socket path>\fR
-The unix socket path to connect to the Redis server. Off by default, and it
-can be set to "" to turn this off. Unix sockets may have better throughput
-than the IP address option.
-.TP
-.B redis-replica-server-password: \fI"<password>"\fR
-The Redis AUTH password to use for the Redis replica server.
-Only relevant if Redis is configured for client password authorisation.
-Off by default, and it can be set to "" to turn this off.
-.TP
-.B redis-replica-timeout: \fI<msec>\fR
-The period until when Unbound waits for a response from the Redis replica sever.
-If this timeout expires Unbound closes the connection, treats it as
-if the Redis replica server does not have the requested data, and will try to
-re-establish a new connection later.
-This option defaults to 100 milliseconds.
-.TP
-.B redis-replica-command-timeout: \fI<msec>\fR
-The timeout to use for Redis replica commands, in milliseconds.
-If 0, it uses the \fBredis\-replica\-timeout\fR value.
-The default is 0.
-.TP
-.B redis-replica-connect-timeout: \fI<msec>\fR
-The timeout to use for Redis replica connection set up, in milliseconds.
-If 0, it uses the \fBredis\-replica\-timeout\fR value.
-The default is 0.
-.TP
-.B redis-replica-logical-db: \fI<logical database index>
-Same as \fBredis-logical-db\fR but for the Redis replica server.
-This option defaults to 0.
 .SS DNSTAP Logging Options
 DNSTAP support, when compiled in by using \fB\-\-enable\-dnstap\fR, is enabled
 in the \fBdnstap:\fR section.
@@ -3023,13 +2634,6 @@ Default is "".
 The version to send with messages, if "" the package version is used.
 Default is "".
 .TP
-.B dnstap-sample-rate: \fI<number>
-The sample rate for log of messages, it logs only 1/N messages. With 0 it
-is disabled. Default is 0. This is useful in a high volume environment,
-where log functionality would otherwise not be reliable. For example 10
-would spend only 1/10th time on logging, and 100 would only spend a
-hundredth of the time on logging.
-.TP
 .B dnstap-log-resolver-query-messages: \fI<yes or no>
 Enable to log resolver query messages.  Default is no.
 These are messages from Unbound to upstream servers.
@@ -3054,11 +2658,9 @@ Enable to log forwarder response messages.  Default is no.
 .SS Response Policy Zone Options
 .LP
 Response Policy Zones are configured with \fBrpz:\fR, and each one must have a
-\fBname:\fR. There can be multiple ones, by listing multiple RPZ clauses, each
-with a different name. RPZ clauses are applied in order of configuration and
-any match from an earlier RPZ zone will terminate the RPZ lookup. Note that a
-PASSTHRU action is still considered a match.
-The \fBrespip\fR module needs to be added to the \fBmodule-config\fR, e.g.:
+\fBname:\fR. There can be multiple ones, by listing multiple rpz clauses, each
+with a different name. RPZ clauses are applied in order of configuration. The
+\fBrespip\fR module needs to be added to the \fBmodule-config\fR, e.g.:
 \fBmodule-config: "respip validator iterator"\fR.
 .P
 QNAME, Response IP Address, nsdname, nsip and clientip triggers are supported.
@@ -3066,13 +2668,12 @@ Supported actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp\-only
 and drop.  RPZ QNAME triggers are applied after \fBlocal\-zones\fR and
 before \fBauth\-zones\fR.
 .P
-The RPZ zone is a regular DNS zone formatted with a SOA start record as usual.
-The items in the zone are entries, that specify what to act on (the trigger)
-and what to do (the action).
-The trigger to act on is recorded in the name, the action to do is recorded as
-the resource record.
-The names all end in the zone name, so you could type the trigger names without
-a trailing dot in the zonefile.
+The rpz zone is formatted with a SOA start record as usual.  The items in
+the zone are entries, that specify what to act on (the trigger) and what to
+do (the action).  The trigger to act on is recorded in the name, the action
+to do is recorded as the resource record.  The names all end in the zone
+name, so you could type the trigger names without a trailing dot in the
+zonefile.
 .P
 An example RPZ record, that answers example.com with NXDOMAIN
 .nf
@@ -3172,7 +2773,7 @@ externally blocked. Default is no.
 If enabled the zone is authoritatively answered for and queries for the RPZ
 zone information are answered to downstream clients. This is useful for
 monitoring scripts, that can then access the SOA information to check if
-the RPZ information is up to date. Default is no.
+the rpz information is up to date. Default is no.
 .TP
 .B tags: \fI<list of tags>
 Limit the policies from this RPZ clause to clients with a matching tag. Tags
@@ -75,7 +75,6 @@ int dynlibmod_init(struct module_env* env, int id) {
    struct config_strlist* cfg_item = env->cfg->dynlib_file;
    struct dynlibmod_env* de = (struct dynlibmod_env*)calloc(1, sizeof(struct dynlibmod_env));
    __DYNMOD dynamic_library;
-    int i;
    if (!de)
    {
        log_err("dynlibmod[%d]: malloc failure", dynlib_mod_idx);
@@ -85,7 +84,7 @@ int dynlibmod_init(struct module_env* env, int id) {
    env->modinfo[id] = (void*) de;

    de->fname = NULL;
-    for(i = dynlib_mod_idx;
+    for(int i = dynlib_mod_idx;
        i != 0 && cfg_item != NULL;
        i--, cfg_item = cfg_item->next) {}

@@ -297,8 +296,8 @@ inplace_cb_delete_wrapped(struct module_env* env, enum inplace_cb_list_type type
 */
 static struct module_func_block dynlibmod_block = {
   "dynlib",
-   NULL, NULL, &dynlibmod_init, &dynlibmod_deinit, &dynlibmod_operate,
-   &dynlibmod_inform_super, &dynlibmod_clear, &dynlibmod_get_mem
+   &dynlibmod_init, &dynlibmod_deinit, &dynlibmod_operate, &dynlibmod_inform_super,
+   &dynlibmod_clear, &dynlibmod_get_mem
 };

 struct module_func_block* dynlibmod_get_funcblock(void)
@@ -57,9 +57,6 @@
 #include "sldns/sbuffer.h"
 #include "sldns/wire2str.h"
 #include "iterator/iter_utils.h"
-#ifdef USE_CACHEDB
-#include "cachedb/cachedb.h"
-#endif

 /** externally called */
 void 
@@ -155,11 +152,10 @@ int ecs_whitelist_check(struct query_info* qinfo,

 	/* Cache by default, might be disabled after parsing EDNS option
 	 * received from nameserver. */
-	if(!iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL, NULL, 0)) {
+	if(!iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL)) {
 		qstate->no_cache_store = 0;
 	}

-	sq->subnet_sent_no_subnet = 0;
 	if(sq->ecs_server_out.subnet_validdata && ((sq->subnet_downstream &&
 		qstate->env->cfg->client_subnet_always_forward) ||
 		ecs_is_whitelisted(sn_env->whitelist, 
@@ -170,14 +166,6 @@ int ecs_whitelist_check(struct query_info* qinfo,
 		 * set. */
 		if(!edns_opt_list_find(qstate->edns_opts_back_out,
 			qstate->env->cfg->client_subnet_opcode)) {
-			/* if the client is not wanting an EDNS subnet option,
-			 * omit it and store that we omitted it but actually
-			 * are doing EDNS subnet to the server. */
-			if(sq->ecs_server_out.subnet_source_mask == 0) {
-				sq->subnet_sent_no_subnet = 1;
-				sq->subnet_sent = 0;
-				return 1;
-			}
 			subnet_ecs_opt_list_append(&sq->ecs_server_out,
 				&qstate->edns_opts_back_out, qstate, region);
 		}
@@ -216,17 +204,6 @@ subnetmod_init(struct module_env *env, int id)
 	}
 	alloc_init(&sn_env->alloc, NULL, 0);
 	env->modinfo[id] = (void*)sn_env;
-
-	/* Warn that serve-expired and prefetch do not work with the subnet
-	 * module cache. */
-	if(env->cfg->serve_expired)
-		log_warn(
-			"subnetcache: serve-expired is set but not working "
-			"for data originating from the subnet module cache.");
-	if(env->cfg->prefetch)
-		log_warn(
-			"subnetcache: prefetch is set but not working "
-			"for data originating from the subnet module cache.");
 	/* Copy msg_cache settings */
 	sn_env->subnet_msg_cache = slabhash_create(env->cfg->msg_cache_slabs,
 		HASH_DEFAULT_STARTARRAY, env->cfg->msg_cache_size,
@@ -313,18 +290,9 @@ delfunc(void *envptr, void *elemptr) {
 static size_t
 sizefunc(void *elemptr) {
 	struct reply_info *elem  = (struct reply_info *)elemptr;
-	size_t s = sizeof (struct reply_info) - sizeof (struct rrset_ref)
+	return sizeof (struct reply_info) - sizeof (struct rrset_ref)
 		+ elem->rrset_count * sizeof (struct rrset_ref)
 		+ elem->rrset_count * sizeof (struct ub_packed_rrset_key *);
-	size_t i;
-	for (i = 0; i < elem->rrset_count; i++) {
-		struct ub_packed_rrset_key *key = elem->rrsets[i];
-		struct packed_rrset_data *data = key->entry.data;
-		s += ub_rrset_sizefunc(key, data);
-	}
-	if(elem->reason_bogus_str)
-		s += strlen(elem->reason_bogus_str)+1;
-	return s;
 }

 /**
@@ -364,7 +332,7 @@ update_cache(struct module_qstate *qstate, int id)
 	struct slabhash *subnet_msg_cache = sne->subnet_msg_cache;
 	struct ecs_data *edns = &sq->ecs_client_in;
 	size_t i;
-	int only_match_scope_zero, diff_size;
+	int only_match_scope_zero;

 	/* We already calculated hash upon lookup (lookup_and_reply) if we were
 	 * allowed to look in the ECS cache */
@@ -373,7 +341,7 @@ update_cache(struct module_qstate *qstate, int id)
 		((struct subnet_qstate*)qstate->minfo[id])->qinfo_hash :
 		query_info_hash(&qstate->qinfo, qstate->query_flags);
 	/* Step 1, general qinfo lookup */
-	struct lruhash_entry* lru_entry = slabhash_lookup(subnet_msg_cache, h,
+	struct lruhash_entry *lru_entry = slabhash_lookup(subnet_msg_cache, h,
 		&qstate->qinfo, 1);
 	int need_to_insert = (lru_entry == NULL);
 	if (!lru_entry) {
@@ -417,38 +385,32 @@ update_cache(struct module_qstate *qstate, int id)
 		log_err("subnetcache: cache insertion failed");
 		return;
 	}
-
+	
 	/* store RRsets */
 	for(i=0; i<rep->rrset_count; i++) {
 		rep->ref[i].key = rep->rrsets[i];
 		rep->ref[i].id = rep->rrsets[i]->id;
 	}
 	reply_info_set_ttls(rep, *qstate->env->now);
-	reply_info_sortref(rep);
 	rep->flags |= (BIT_RA | BIT_QR); /* fix flags to be sensible for */
 	rep->flags &= ~(BIT_AA | BIT_CD);/* a reply based on the cache   */
 	if(edns->subnet_source_mask == 0 && edns->subnet_scope_mask == 0)
 		only_match_scope_zero = 1;
 	else only_match_scope_zero = 0;
-	diff_size = (int)tree->size_bytes;
 	addrtree_insert(tree, (addrkey_t*)edns->subnet_addr, 
 		edns->subnet_source_mask, sq->max_scope, rep,
 		rep->ttl, *qstate->env->now, only_match_scope_zero);
-	diff_size = (int)tree->size_bytes - diff_size;

 	lock_rw_unlock(&lru_entry->lock);
 	if (need_to_insert) {
 		slabhash_insert(subnet_msg_cache, h, lru_entry, lru_entry->data,
 			NULL);
-	} else {
-		slabhash_update_space_used(subnet_msg_cache, h, NULL,
-			diff_size);
 	}
 }

 /** Lookup in cache and reply true iff reply is sent. */
 static int
-lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq, int prefetch)
+lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 {
 	struct lruhash_entry *e;
 	struct module_env *env = qstate->env;
@@ -500,10 +462,6 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq,
 			INET6_SIZE);
 		sq->ecs_client_out.subnet_validdata = 1;
 	}
-
-	if (prefetch && *qstate->env->now >= ((struct reply_info *)node->elem)->prefetch_ttl) {
-		qstate->need_refetch = 1;
-	}
 	return 1;
 }

@@ -540,18 +498,18 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		 * module_finished */
 		return module_finished;
 	}
-
+	
 	/* We have not asked for subnet data */
-	if (!sq->subnet_sent && !sq->subnet_sent_no_subnet) {
+	if (!sq->subnet_sent) {
 		if (s_in->subnet_validdata)
 			verbose(VERB_QUERY, "subnetcache: received spurious data");
 		if (sq->subnet_downstream) /* Copy back to client */
 			cp_edns_bad_response(c_out, c_in);
 		return module_finished;
 	}
-
+	
 	/* subnet sent but nothing came back */
-	if (!s_in->subnet_validdata && !sq->subnet_sent_no_subnet) {
+	if (!s_in->subnet_validdata) {
 		/* The authority indicated no support for edns subnet. As a
 		 * consequence the answer ended up in the regular cache. It
 		 * is still useful to put it in the edns subnet cache for
@@ -566,23 +524,11 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 			cp_edns_bad_response(c_out, c_in);
 		return module_finished;
 	}
-
-	/* Purposefully there was no sent subnet, and there is consequently
-	 * no subnet in the answer. If there was, use the subnet in the answer
-	 * anyway. But if there is not, treat it as a prefix 0 answer. */
-	if(sq->subnet_sent_no_subnet && !s_in->subnet_validdata) {
-		/* Fill in 0.0.0.0/0 scope 0, or ::0/0 scope 0, for caching. */
-		s_in->subnet_addr_fam = s_out->subnet_addr_fam;
-		s_in->subnet_source_mask = 0;
-		s_in->subnet_scope_mask = 0;
-		memset(s_in->subnet_addr, 0, INET6_SIZE);
-		s_in->subnet_validdata = 1;
-	}
-
+	
 	/* Being here means we have asked for and got a subnet specific 
 	 * answer. Also, the answer from the authority is not yet cached 
 	 * anywhere. */
-
+	
 	/* can we accept response? */
 	if(s_out->subnet_addr_fam != s_in->subnet_addr_fam ||
 		s_out->subnet_source_mask != s_in->subnet_source_mask ||
@@ -595,7 +541,6 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		(void)edns_opt_list_remove(&qstate->edns_opts_back_out,
 			qstate->env->cfg->client_subnet_opcode);
 		sq->subnet_sent = 0;
-		sq->subnet_sent_no_subnet = 0;
 		return module_restart_next;
 	}

@@ -605,21 +550,7 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 	}
 	sne->num_msg_nocache++;
 	lock_rw_unlock(&sne->biglock);
-
-	/* If there is an expired answer in the global cache, remove that,
-	 * because expired answers would otherwise resurface once the ecs data
-	 * expires, giving once in a while global data responses for ecs
-	 * domains, with serve expired enabled. */
-	if(qstate->env->cfg->serve_expired) {
-		msg_cache_remove(qstate->env, qstate->qinfo.qname,
-			qstate->qinfo.qname_len, qstate->qinfo.qtype,
-			qstate->qinfo.qclass, 0);
-#ifdef USE_CACHEDB
-		if(qstate->env->cachedb_enabled)
-			cachedb_msg_remove(qstate);
-#endif
-	}
-
+	
 	if (sq->subnet_downstream) {
 		/* Client wants to see the answer, echo option back
 		 * and adjust the scope. */
@@ -730,7 +661,6 @@ ecs_query_response(struct module_qstate* qstate, struct dns_msg* response,
 		edns_opt_list_remove(&qstate->edns_opts_back_out,
 			qstate->env->cfg->client_subnet_opcode);
 		sq->subnet_sent = 0;
-		sq->subnet_sent_no_subnet = 0;
 		memset(&sq->ecs_server_out, 0, sizeof(sq->ecs_server_out));
 	} else if (!sq->track_max_scope &&
 		FLAGS_GET_RCODE(response->rep->flags) == LDNS_RCODE_NOERROR &&
@@ -792,9 +722,6 @@ ecs_edns_back_parsed(struct module_qstate* qstate, int id,
 				sq->ecs_server_in.subnet_scope_mask >
 				sq->max_scope))
 				sq->max_scope = sq->ecs_server_in.subnet_scope_mask;
-	} else if(sq->subnet_sent_no_subnet) {
-		/* The answer can be stored as scope 0, not in global cache. */
-		qstate->no_cache_store = 1;
 	}

 	return 1;
@@ -841,11 +768,6 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 				&qstate->mesh_info->reply_list->query_reply.client_addr,
 				&sq->ecs_client_in, qstate->env->cfg);
 		}
-		else if(qstate->client_addr.ss_family != AF_UNSPEC) {
-			subnet_option_from_ss(
-				&qstate->client_addr,
-				&sq->ecs_client_in, qstate->env->cfg);
-		}
 		
 		if(sq->ecs_client_in.subnet_validdata == 0) {
 			/* No clients are interested in result or we could not
@@ -869,9 +791,7 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,

 		if(!sq->started_no_cache_lookup && !qstate->blacklist) {
 			lock_rw_wrlock(&sne->biglock);
-			if(qstate->mesh_info->reply_list &&
-				lookup_and_reply(qstate, id, sq,
-				qstate->env->cfg->prefetch)) {
+			if(lookup_and_reply(qstate, id, sq)) {
 				sne->num_msg_cache++;
 				lock_rw_unlock(&sne->biglock);
 				verbose(VERB_QUERY, "subnetcache: answered from cache");
@@ -995,8 +915,7 @@ subnetmod_get_mem(struct module_env *env, int id)
 * The module function block 
 */
 static struct module_func_block subnetmod_block = {
-	"subnetcache",
-	NULL, NULL, &subnetmod_init, &subnetmod_deinit, &subnetmod_operate,
+	"subnetcache", &subnetmod_init, &subnetmod_deinit, &subnetmod_operate,
 	&subnetmod_inform_super, &subnetmod_clear, &subnetmod_get_mem
 };

@@ -85,13 +85,6 @@ struct subnet_qstate {
 	struct ecs_data	ecs_server_out;
 	int subnet_downstream;
 	int subnet_sent;
-	/**
-	 * If there was no subnet sent because the client used source prefix
-	 * length 0 for omitting the information. Then the answer is cached
-	 * like subnet was a /0 scope. Like the subnet_sent flag, but when
-	 * the EDNS subnet option is omitted because the client asked.
-	 */
-	int subnet_sent_no_subnet;
 	/** keep track of longest received scope, set after receiving CNAME for
 	 * incoming QNAME. */
 	int track_max_scope;
@@ -456,8 +456,7 @@ ipsecmod_handle_query(struct module_qstate* qstate,
 	/* Store A/AAAA in cache. */
 	if(!dns_cache_store(qstate->env, &qstate->qinfo,
 		qstate->return_msg->rep, 0, qstate->prefetch_leeway,
-		0, qstate->region, qstate->query_flags, qstate->qstarttime,
-		qstate->is_valrec)) {
+		0, qstate->region, qstate->query_flags, qstate->qstarttime)) {
 		log_err("ipsecmod: out of memory caching record");
 	}
 	qstate->ext_state[id] = module_finished;
@@ -616,7 +615,7 @@ ipsecmod_get_mem(struct module_env* env, int id)
 */
 static struct module_func_block ipsecmod_block = {
 	"ipsecmod",
-	NULL, NULL, &ipsecmod_init, &ipsecmod_deinit, &ipsecmod_operate,
+	&ipsecmod_init, &ipsecmod_deinit, &ipsecmod_operate,
 	&ipsecmod_inform_super, &ipsecmod_clear, &ipsecmod_get_mem
 };

@@ -17,19 +17,9 @@
 #include "sldns/wire2str.h"
 #include "sldns/parseutil.h"

-#ifdef HAVE_NET_PFVAR_H
-#include <fcntl.h>
-#include <sys/ioctl.h>
-#include <netinet/in.h>
-#include <net/if.h>
-#include <net/pfvar.h>
-typedef intptr_t filter_dev;
-#else
 #include <libmnl/libmnl.h>
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/ipset/ip_set.h>
-typedef struct mnl_socket * filter_dev;
-#endif

 #define BUFF_LEN 256

@@ -51,95 +41,24 @@ static int error_response(struct module_qstate* qstate, int id, int rcode) {
 	return 0;
 }

-#ifdef HAVE_NET_PFVAR_H
-static void * open_filter() {
-	filter_dev dev;
+static struct mnl_socket * open_mnl_socket() {
+	struct mnl_socket *mnl;

-	dev = open("/dev/pf", O_RDWR);
-	if (dev == -1) {
-		log_err("open(\"/dev/pf\") failed: %s", strerror(errno));
-		return NULL;
-	}
-	else
-		return (void *)dev;
-}
-#else
-static void * open_filter() {
-	filter_dev dev;
-
-	dev = mnl_socket_open(NETLINK_NETFILTER);
-	if (!dev) {
+	mnl = mnl_socket_open(NETLINK_NETFILTER);
+	if (!mnl) {
 		log_err("ipset: could not open netfilter.");
 		return NULL;
 	}

-	if (mnl_socket_bind(dev, 0, MNL_SOCKET_AUTOPID) < 0) {
-		mnl_socket_close(dev);
+	if (mnl_socket_bind(mnl, 0, MNL_SOCKET_AUTOPID) < 0) {
+		mnl_socket_close(mnl);
 		log_err("ipset: could not bind netfilter.");
 		return NULL;
 	}
-	return (void *)dev;
+	return mnl;
 }
-#endif

-#ifdef HAVE_NET_PFVAR_H
-static int add_to_ipset(filter_dev dev, const char *setname, const void *ipaddr, int af) {
-	struct pfioc_table io;
-	struct pfr_addr addr;
-	const char *p;
-	int i;
-
-	bzero(&io, sizeof(io));
-	bzero(&addr, sizeof(addr));
-
-	p = strrchr(setname, '/');
-	if (p) {
-		i = p - setname;
-		if (i >= PATH_MAX) {
-			errno = ENAMETOOLONG;
-			return -1;
-		}
-		memcpy(io.pfrio_table.pfrt_anchor, setname, i);
-		if (i < PATH_MAX)
-			io.pfrio_table.pfrt_anchor[i] = '\0';
-		p++;
-	}
-	else
-		p = setname;
-
-	if (strlen(p) >= PF_TABLE_NAME_SIZE) {
-		errno = ENAMETOOLONG;
-		return -1;
-	}
-	strlcpy(io.pfrio_table.pfrt_name, p, PF_TABLE_NAME_SIZE);
-
-	io.pfrio_buffer = &addr;
-	io.pfrio_size = 1;
-	io.pfrio_esize = sizeof(addr);
-
-	switch (af) {
-		case AF_INET:
-			addr.pfra_ip4addr = *(struct in_addr *)ipaddr;
-			addr.pfra_net = 32;
-			break;
-		case AF_INET6:
-			addr.pfra_ip6addr = *(struct in6_addr *)ipaddr;
-			addr.pfra_net = 128;
-			break;
-		default:
-		errno = EAFNOSUPPORT;
-		return -1;
-	}
-	addr.pfra_af = af;
-
-	if (ioctl(dev, DIOCRADDADDRS, &io) == -1) {
-		log_err("ioctl failed: %s", strerror(errno));
-		return -1;
-	}
-	return 0;
-}
-#else
-static int add_to_ipset(filter_dev dev, const char *setname, const void *ipaddr, int af) {
+static int add_to_ipset(struct mnl_socket *mnl, const char *setname, const void *ipaddr, int af) {
 	struct nlmsghdr *nlh;
 	struct nfgenmsg *nfg;
 	struct nlattr *nested[2];
@@ -172,15 +91,14 @@ static int add_to_ipset(filter_dev dev, const char *setname, const void *ipaddr,
 	mnl_attr_nest_end(nlh, nested[1]);
 	mnl_attr_nest_end(nlh, nested[0]);

-	if (mnl_socket_sendto(dev, nlh, nlh->nlmsg_len) < 0) {
+	if (mnl_socket_sendto(mnl, nlh, nlh->nlmsg_len) < 0) {
 		return -1;
 	}
 	return 0;
 }
-#endif

 static void
-ipset_add_rrset_data(struct ipset_env *ie,
+ipset_add_rrset_data(struct ipset_env *ie, struct mnl_socket *mnl,
 	struct packed_rrset_data *d, const char* setname, int af,
 	const char* dname)
 {
@@ -205,16 +123,12 @@ ipset_add_rrset_data(struct ipset_env *ie,
 					snprintf(ip, sizeof(ip), "(inet_ntop_error)");
 				verbose(VERB_QUERY, "ipset: add %s to %s for %s", ip, setname, dname);
 			}
-			ret = add_to_ipset((filter_dev)ie->dev, setname, rr_data + 2, af);
+			ret = add_to_ipset(mnl, setname, rr_data + 2, af);
 			if (ret < 0) {
 				log_err("ipset: could not add %s into %s", dname, setname);

-#if HAVE_NET_PFVAR_H
-				/* don't close as we might not be able to open again due to dropped privs */
-#else
-				mnl_socket_close((filter_dev)ie->dev);
-				ie->dev = NULL;
-#endif
+				mnl_socket_close(mnl);
+				ie->mnl = NULL;
 				break;
 			}
 		}
@@ -223,8 +137,8 @@ ipset_add_rrset_data(struct ipset_env *ie,

 static int
 ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
-	struct ub_packed_rrset_key *rrset, const char *qname, int qlen,
-	const char *setname, int af)
+	struct mnl_socket *mnl, struct ub_packed_rrset_key *rrset,
+	const char *qname, const int qlen, const char *setname, int af)
 {
 	static char dname[BUFF_LEN];
 	const char *ds, *qs;
@@ -238,31 +152,23 @@ ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
 		log_err("bad domain name");
 		return -1;
 	}
-	if (dname[dlen - 1] == '.') {
-		dlen--;
-	}
-	if (qname[qlen - 1] == '.') {
-		qlen--;
-	}

 	for (p = env->cfg->local_zones_ipset; p; p = p->next) {
 		ds = NULL;
 		qs = NULL;
 		plen = strlen(p->str);
-		if (p->str[plen - 1] == '.') {
-			plen--;
-		}

-		if (dlen == plen || (dlen > plen && dname[dlen - plen - 1] == '.' )) {
+		if (dlen >= plen) {
 			ds = dname + (dlen - plen);
 		}
-		if (qlen == plen || (qlen > plen && qname[qlen - plen - 1] == '.' )) {
+		if (qlen >= plen) {
 			qs = qname + (qlen - plen);
 		}
 		if ((ds && strncasecmp(p->str, ds, plen) == 0)
 			|| (qs && strncasecmp(p->str, qs, plen) == 0)) {
 			d = (struct packed_rrset_data*)rrset->entry.data;
-			ipset_add_rrset_data(ie, d, setname, af, dname);
+			ipset_add_rrset_data(ie, mnl, d, setname,
+				af, dname);
 			break;
 		}
 	}
@@ -272,6 +178,7 @@ ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
 static int ipset_update(struct module_env *env, struct dns_msg *return_msg,
 	struct query_info qinfo, struct ipset_env *ie)
 {
+	struct mnl_socket *mnl;
 	size_t i;
 	const char *setname;
 	struct ub_packed_rrset_key *rrset;
@@ -279,17 +186,15 @@ static int ipset_update(struct module_env *env, struct dns_msg *return_msg,
 	static char qname[BUFF_LEN];
 	int qlen;

-#ifdef HAVE_NET_PFVAR_H
-#else
-	if (!ie->dev) {
+	mnl = (struct mnl_socket *)ie->mnl;
+	if (!mnl) {
 		/* retry to create mnl socket */
-		ie->dev = open_filter();
-		if (!ie->dev) {
-			log_warn("ipset open_filter failed");
+		mnl = open_mnl_socket();
+		if (!mnl) {
 			return -1;
 		}
+		ie->mnl = mnl;
 	}
-#endif

 	qlen = sldns_wire2str_dname_buf(qinfo.qname, qinfo.qname_len,
 		qname, BUFF_LEN);
@@ -312,8 +217,8 @@ static int ipset_update(struct module_env *env, struct dns_msg *return_msg,
 		}

 		if (setname) {
-			if(ipset_check_zones_for_rrset(env, ie, rrset, qname,
-				qlen, setname, af) == -1)
+			if(ipset_check_zones_for_rrset(env, ie, mnl, rrset,
+				qname, qlen, setname, af) == -1)
 				return -1;
 		}
 	}
@@ -321,7 +226,7 @@ static int ipset_update(struct module_env *env, struct dns_msg *return_msg,
 	return 0;
 }

-int ipset_startup(struct module_env* env, int id) {
+int ipset_init(struct module_env* env, int id) {
 	struct ipset_env *ipset_env;

 	ipset_env = (struct ipset_env *)calloc(1, sizeof(struct ipset_env));
@@ -332,43 +237,7 @@ int ipset_startup(struct module_env* env, int id) {

 	env->modinfo[id] = (void *)ipset_env;

-#ifdef HAVE_NET_PFVAR_H
-	ipset_env->dev = open_filter();
-	if (!ipset_env->dev) {
-		log_err("ipset open_filter failed");
-		return 0;
-	}
-#else
-	ipset_env->dev = NULL;
-#endif
-	return 1;
-}
-
-void ipset_destartup(struct module_env* env, int id) {
-	filter_dev dev;
-	struct ipset_env *ipset_env;
-
-	if (!env || !env->modinfo[id]) {
-		return;
-	}
-	ipset_env = (struct ipset_env*)env->modinfo[id];
-
-	dev = (filter_dev)ipset_env->dev;
-	if (dev) {
-#if HAVE_NET_PFVAR_H
-		close(dev);
-#else
-		mnl_socket_close(dev);
-#endif
-		ipset_env->dev = NULL;
-	}
-
-	free(ipset_env);
-	env->modinfo[id] = NULL;
-}
-
-int ipset_init(struct module_env* env, int id) {
-	struct ipset_env *ipset_env = env->modinfo[id];
+	ipset_env->mnl = NULL;

 	ipset_env->name_v4 = env->cfg->ipset_name_v4;
 	ipset_env->name_v6 = env->cfg->ipset_name_v6;
@@ -384,8 +253,24 @@ int ipset_init(struct module_env* env, int id) {
 	return 1;
 }

-void ipset_deinit(struct module_env *ATTR_UNUSED(env), int ATTR_UNUSED(id)) {
-	/* nothing */
+void ipset_deinit(struct module_env *env, int id) {
+	struct mnl_socket *mnl;
+	struct ipset_env *ipset_env;
+
+	if (!env || !env->modinfo[id]) {
+		return;
+	}
+
+	ipset_env = (struct ipset_env *)env->modinfo[id];
+
+	mnl = (struct mnl_socket *)ipset_env->mnl;
+	if (mnl) {
+		mnl_socket_close(mnl);
+		ipset_env->mnl = NULL;
+	}
+
+	free(ipset_env);
+	env->modinfo[id] = NULL;
 }

 static int ipset_new(struct module_qstate* qstate, int id) {
@@ -491,8 +376,8 @@ size_t ipset_get_mem(struct module_env *env, int id) {
 */
 static struct module_func_block ipset_block = {
 	"ipset",
-	&ipset_startup, &ipset_destartup, &ipset_init, &ipset_deinit,
-	&ipset_operate, &ipset_inform_super, &ipset_clear, &ipset_get_mem
+	&ipset_init, &ipset_deinit, &ipset_operate,
+	&ipset_inform_super, &ipset_clear, &ipset_get_mem
 };

 struct module_func_block * ipset_get_funcblock(void) {
@@ -37,7 +37,7 @@ extern "C" {
 #endif

 struct ipset_env {
-	void* dev;
+    void* mnl;

 	int v4_enabled;
 	int v6_enabled;
@@ -50,10 +50,6 @@ struct ipset_qstate {
 	int dummy;
 };

-/** Startup the ipset module */
-int ipset_startup(struct module_env* env, int id);
-/** Destartup the ipset module */
-void ipset_destartup(struct module_env* env, int id);
 /** Init the ipset module */
 int ipset_init(struct module_env* env, int id);
 /** Deinit the ipset module */
@@ -278,7 +278,7 @@ delegpt_count_addr(struct delegpt* dp, size_t* numaddr, size_t* numres,

 void delegpt_log(enum verbosity_value v, struct delegpt* dp)
 {
-	char buf[LDNS_MAX_DOMAINLEN];
+	char buf[LDNS_MAX_DOMAINLEN+1];
 	struct delegpt_ns* ns;
 	struct delegpt_addr* a;
 	size_t missing=0, numns=0, numaddr=0, numres=0, numavail=0;
@@ -321,45 +321,6 @@ void delegpt_log(enum verbosity_value v, struct delegpt* dp)
 	}
 }

-int
-delegpt_addr_on_result_list(struct delegpt* dp, struct delegpt_addr* find)
-{
-	struct delegpt_addr* a = dp->result_list;
-	while(a) {
-		if(a == find)
-			return 1;
-		a = a->next_result;
-	}
-	return 0;
-}
-
-void
-delegpt_usable_list_remove_addr(struct delegpt* dp, struct delegpt_addr* del)
-{
-	struct delegpt_addr* usa = dp->usable_list, *prev = NULL;
-	while(usa) {
-		if(usa == del) {
-			/* snip off the usable list */
-			if(prev)
-				prev->next_usable = usa->next_usable;
-			else	dp->usable_list = usa->next_usable;
-			return;
-		}
-		prev = usa;
-		usa = usa->next_usable;
-	}
-}
-
-void
-delegpt_add_to_result_list(struct delegpt* dp, struct delegpt_addr* a)
-{
-	if(delegpt_addr_on_result_list(dp, a))
-		return;
-	delegpt_usable_list_remove_addr(dp, a);
-	a->next_result = dp->result_list;
-	dp->result_list = a;
-}
-
 void 
 delegpt_add_unused_targets(struct delegpt* dp)
 {
@@ -457,29 +457,4 @@ int delegpt_add_target_mlc(struct delegpt* dp, uint8_t* name, size_t namelen,
 /** get memory in use by dp */
 size_t delegpt_get_mem(struct delegpt* dp);

-/**
- * See if the addr is on the result list.
- * @param dp: delegation point.
- * @param find: the pointer is searched for on the result list.
- * @return 1 if found, 0 if not found.
- */
-int delegpt_addr_on_result_list(struct delegpt* dp, struct delegpt_addr* find);
-
-/**
- * Remove the addr from the usable list.
- * @param dp: the delegation point.
- * @param del: the addr to remove from the list, the pointer is searched for.
- */
-void delegpt_usable_list_remove_addr(struct delegpt* dp,
-	struct delegpt_addr* del);
-
-/**
- * Add the delegpt_addr back to the result list, if it is not already on
- * the result list. Also removes it from the usable list.
- * @param dp: delegation point.
- * @param a: addr to add, nothing happens if it is already on the result list.
- *	It is removed from the usable list.
- */
-void delegpt_add_to_result_list(struct delegpt* dp, struct delegpt_addr* a);
-
 #endif /* ITERATOR_ITER_DELEGPT_H */
@@ -71,7 +71,6 @@ forwards_create(void)
 		sizeof(struct iter_forwards));
 	if(!fwd)
 		return NULL;
-	lock_rw_init(&fwd->lock);
 	return fwd;
 }

@@ -101,7 +100,6 @@ forwards_delete(struct iter_forwards* fwd)
 {
 	if(!fwd) 
 		return;
-	lock_rw_destroy(&fwd->lock);
 	fwd_del_tree(fwd);
 	free(fwd);
 }
@@ -129,7 +127,7 @@ forwards_insert_data(struct iter_forwards* fwd, uint16_t c, uint8_t* nm,
 	node->namelabs = nmlabs;
 	node->dp = dp;
 	if(!rbtree_insert(fwd->tree, &node->node)) {
-		char buf[LDNS_MAX_DOMAINLEN];
+		char buf[257];
 		dname_str(nm, buf);
 		log_err("duplicate forward zone %s ignored.", buf);
 		delegpt_free_mlc(dp);
@@ -331,101 +329,48 @@ make_stub_holes(struct iter_forwards* fwd, struct config_file* cfg)
 	return 1;
 }

-/** make NULL entries for auths */
-static int
-make_auth_holes(struct iter_forwards* fwd, struct config_file* cfg)
-{
-	struct config_auth* a;
-	uint8_t* dname;
-	size_t dname_len;
-	for(a = cfg->auths; a; a = a->next) {
-		if(!a->name) continue;
-		dname = sldns_str2wire_dname(a->name, &dname_len);
-		if(!dname) {
-			log_err("cannot parse auth name '%s'", a->name);
-			return 0;
-		}
-		if(!fwd_add_stub_hole(fwd, LDNS_RR_CLASS_IN, dname)) {
-			free(dname);
-			log_err("out of memory");
-			return 0;
-		}
-		free(dname);
-	}
-	return 1;
-}
-
 int 
 forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg)
 {
-	if(fwd->tree) {
-		lock_unprotect(&fwd->lock, fwd->tree);
-	}
 	fwd_del_tree(fwd);
 	fwd->tree = rbtree_create(fwd_cmp);
 	if(!fwd->tree)
 		return 0;
-	lock_protect(&fwd->lock, fwd->tree, sizeof(*fwd->tree));

-	lock_rw_wrlock(&fwd->lock);
 	/* read forward zones */
-	if(!read_forwards(fwd, cfg)) {
-		lock_rw_unlock(&fwd->lock);
+	if(!read_forwards(fwd, cfg))
 		return 0;
-	}
-	if(!make_stub_holes(fwd, cfg)) {
-		lock_rw_unlock(&fwd->lock);
+	if(!make_stub_holes(fwd, cfg))
 		return 0;
-	}
-	/* TODO: Now we punch holes for auth zones as well so that in
-	 *       iterator:forward_request() we see the configured
-	 *       delegation point, but code flow/naming is hard to follow.
-	 *       Consider having a single tree with configured
-	 *       delegation points for all categories
-	 *       (stubs, forwards, auths). */
-	if(!make_auth_holes(fwd, cfg)) {
-		lock_rw_unlock(&fwd->lock);
-		return 0;
-	}
 	fwd_init_parents(fwd);
-	lock_rw_unlock(&fwd->lock);
 	return 1;
 }

 struct delegpt* 
-forwards_find(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass,
-	int nolock)
+forwards_find(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass)
 {
-	struct iter_forward_zone* res;
+	rbnode_type* res = NULL;
 	struct iter_forward_zone key;
-	int has_dp;
 	key.node.key = &key;
 	key.dclass = qclass;
 	key.name = qname;
 	key.namelabs = dname_count_size_labels(qname, &key.namelen);
-	/* lock_() calls are macros that could be nothing, surround in {} */
-	if(!nolock) { lock_rw_rdlock(&fwd->lock); }
-	res = (struct iter_forward_zone*)rbtree_search(fwd->tree, &key);
-	has_dp = res && res->dp;
-	if(!has_dp && !nolock) { lock_rw_unlock(&fwd->lock); }
-	return has_dp?res->dp:NULL;
+	res = rbtree_search(fwd->tree, &key);
+	if(res) return ((struct iter_forward_zone*)res)->dp;
+	return NULL;
 }

 struct delegpt* 
-forwards_lookup(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass,
-	int nolock)
+forwards_lookup(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass)
 {
 	/* lookup the forward zone in the tree */
 	rbnode_type* res = NULL;
 	struct iter_forward_zone *result;
 	struct iter_forward_zone key;
-	int has_dp;
 	key.node.key = &key;
 	key.dclass = qclass;
 	key.name = qname;
 	key.namelabs = dname_count_size_labels(qname, &key.namelen);
-	/* lock_() calls are macros that could be nothing, surround in {} */
-	if(!nolock) { lock_rw_rdlock(&fwd->lock); }
 	if(rbtree_find_less_equal(fwd->tree, &key, &res)) {
 		/* exact */
 		result = (struct iter_forward_zone*)res;
@@ -433,10 +378,8 @@ forwards_lookup(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass,
 		/* smaller element (or no element) */
 		int m;
 		result = (struct iter_forward_zone*)res;
-		if(!result || result->dclass != qclass) {
-			if(!nolock) { lock_rw_unlock(&fwd->lock); }
+		if(!result || result->dclass != qclass)
 			return NULL;
-		}
 		/* count number of labels matched */
 		(void)dname_lab_cmp(result->name, result->namelabs, key.name,
 			key.namelabs, &m);
@@ -446,22 +389,20 @@ forwards_lookup(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass,
 			result = result->parent;
 		}
 	}
-	has_dp = result && result->dp;
-	if(!has_dp && !nolock) { lock_rw_unlock(&fwd->lock); }
-	return has_dp?result->dp:NULL;
+	if(result)
+		return result->dp;
+	return NULL;
 }

 struct delegpt* 
-forwards_lookup_root(struct iter_forwards* fwd, uint16_t qclass, int nolock)
+forwards_lookup_root(struct iter_forwards* fwd, uint16_t qclass)
 {
 	uint8_t root = 0;
-	return forwards_lookup(fwd, &root, qclass, nolock);
+	return forwards_lookup(fwd, &root, qclass);
 }

-/* Finds next root item in forwards lookup tree.
- * Caller needs to handle locking of the forwards structure. */
-static int
-next_root_locked(struct iter_forwards* fwd, uint16_t* dclass)
+int
+forwards_next_root(struct iter_forwards* fwd, uint16_t* dclass)
 {
 	struct iter_forward_zone key;
 	rbnode_type* n;
@@ -478,7 +419,7 @@ next_root_locked(struct iter_forwards* fwd, uint16_t* dclass)
 		}
 		/* root not first item? search for higher items */
 		*dclass = p->dclass + 1;
-		return next_root_locked(fwd, dclass);
+		return forwards_next_root(fwd, dclass);
 	}
 	/* find class n in tree, we may get a direct hit, or if we don't
 	 * this is the last item of the previous class so rbtree_next() takes
@@ -506,21 +447,10 @@ next_root_locked(struct iter_forwards* fwd, uint16_t* dclass)
 		}
 		/* not a root node, return next higher item */
 		*dclass = p->dclass+1;
-		return next_root_locked(fwd, dclass);
+		return forwards_next_root(fwd, dclass);
 	}
 }

-int
-forwards_next_root(struct iter_forwards* fwd, uint16_t* dclass, int nolock)
-{
-	int ret;
-	/* lock_() calls are macros that could be nothing, surround in {} */
-	if(!nolock) { lock_rw_rdlock(&fwd->lock); }
-	ret = next_root_locked(fwd, dclass);
-	if(!nolock) { lock_rw_unlock(&fwd->lock); }
-	return ret;
-}
-
 size_t 
 forwards_get_mem(struct iter_forwards* fwd)
 {
@@ -528,12 +458,10 @@ forwards_get_mem(struct iter_forwards* fwd)
 	size_t s;
 	if(!fwd)
 		return 0;
-	lock_rw_rdlock(&fwd->lock);
 	s = sizeof(*fwd) + sizeof(*fwd->tree);
 	RBTREE_FOR(p, struct iter_forward_zone*, fwd->tree) {
 		s += sizeof(*p) + p->namelen + delegpt_get_mem(p->dp);
 	}
-	lock_rw_unlock(&fwd->lock);
 	return s;
 }

@@ -549,94 +477,50 @@ fwd_zone_find(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
 }

 int 
-forwards_add_zone(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp,
-	int nolock)
+forwards_add_zone(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp)
 {
 	struct iter_forward_zone *z;
-	/* lock_() calls are macros that could be nothing, surround in {} */
-	if(!nolock) { lock_rw_wrlock(&fwd->lock); }
 	if((z=fwd_zone_find(fwd, c, dp->name)) != NULL) {
 		(void)rbtree_delete(fwd->tree, &z->node);
 		fwd_zone_free(z);
 	}
-	if(!forwards_insert(fwd, c, dp)) {
-		if(!nolock) { lock_rw_unlock(&fwd->lock); }
+	if(!forwards_insert(fwd, c, dp))
 		return 0;
-	}
 	fwd_init_parents(fwd);
-	if(!nolock) { lock_rw_unlock(&fwd->lock); }
 	return 1;
 }

 void 
-forwards_delete_zone(struct iter_forwards* fwd, uint16_t c, uint8_t* nm,
-	int nolock)
+forwards_delete_zone(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
 {
 	struct iter_forward_zone *z;
-	/* lock_() calls are macros that could be nothing, surround in {} */
-	if(!nolock) { lock_rw_wrlock(&fwd->lock); }
-	if(!(z=fwd_zone_find(fwd, c, nm))) {
-		if(!nolock) { lock_rw_unlock(&fwd->lock); }
+	if(!(z=fwd_zone_find(fwd, c, nm)))
 		return; /* nothing to do */
-	}
 	(void)rbtree_delete(fwd->tree, &z->node);
 	fwd_zone_free(z);
 	fwd_init_parents(fwd);
-	if(!nolock) { lock_rw_unlock(&fwd->lock); }
 }

 int
-forwards_add_stub_hole(struct iter_forwards* fwd, uint16_t c, uint8_t* nm,
-	int nolock)
+forwards_add_stub_hole(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
 {
-	/* lock_() calls are macros that could be nothing, surround in {} */
-	if(!nolock) { lock_rw_wrlock(&fwd->lock); }
-	if(fwd_zone_find(fwd, c, nm) != NULL) {
-		if(!nolock) { lock_rw_unlock(&fwd->lock); }
-		return 1; /* already a stub zone there */
-	}
 	if(!fwd_add_stub_hole(fwd, c, nm)) {
-		if(!nolock) { lock_rw_unlock(&fwd->lock); }
 		return 0;
 	}
 	fwd_init_parents(fwd);
-	if(!nolock) { lock_rw_unlock(&fwd->lock); }
 	return 1;
 }

 void
-forwards_delete_stub_hole(struct iter_forwards* fwd, uint16_t c,
-	uint8_t* nm, int nolock)
+forwards_delete_stub_hole(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
 {
 	struct iter_forward_zone *z;
-	/* lock_() calls are macros that could be nothing, surround in {} */
-	if(!nolock) { lock_rw_wrlock(&fwd->lock); }
-	if(!(z=fwd_zone_find(fwd, c, nm))) {
-		if(!nolock) { lock_rw_unlock(&fwd->lock); }
+	if(!(z=fwd_zone_find(fwd, c, nm)))
 		return; /* nothing to do */
-	}
-	if(z->dp != NULL) {
-		if(!nolock) { lock_rw_unlock(&fwd->lock); }
+	if(z->dp != NULL)
 		return; /* not a stub hole */
-	}
 	(void)rbtree_delete(fwd->tree, &z->node);
 	fwd_zone_free(z);
 	fwd_init_parents(fwd);
-	if(!nolock) { lock_rw_unlock(&fwd->lock); }
 }

-void
-forwards_swap_tree(struct iter_forwards* fwd, struct iter_forwards* data)
-{
-	rbtree_type* oldtree = fwd->tree;
-	if(oldtree) {
-		lock_unprotect(&fwd->lock, oldtree);
-	}
-	if(data->tree) {
-		lock_unprotect(&data->lock, data->tree);
-	}
-	fwd->tree = data->tree;
-	data->tree = oldtree;
-	lock_protect(&fwd->lock, fwd->tree, sizeof(*fwd->tree));
-	lock_protect(&data->lock, data->tree, sizeof(*data->tree));
-}
@@ -43,7 +43,6 @@
 #ifndef ITERATOR_ITER_FWD_H
 #define ITERATOR_ITER_FWD_H
 #include "util/rbtree.h"
-#include "util/locks.h"
 struct config_file;
 struct delegpt;

@@ -51,11 +50,6 @@ struct delegpt;
 * Iterator forward zones structure
 */
 struct iter_forwards {
-	/** lock on the forwards tree.
-	 * When grabbing both this lock and the anchors.lock, this lock
-	 * is grabbed first. When grabbing both this lock and the hints.lock
-	 * this lock is grabbed first. */
-	lock_rw_type lock;
 	/** 
 	 * Zones are stored in this tree. Sort order is specially chosen.
 	 * first sorted on qclass. Then on dname in nsec-like order, so that
@@ -112,65 +106,47 @@ int forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg);

 /**
 * Find forward zone exactly by name
- * The return value is contents of the forwards structure.
- * Caller should lock and unlock a readlock on the forwards structure if nolock
- * is set.
- * Otherwise caller should unlock the readlock on the forwards structure if a
- * value was returned.
 * @param fwd: forward storage.
 * @param qname: The qname of the query.
 * @param qclass: The qclass of the query.
- * @param nolock: Skip locking, locking is handled by the caller.
 * @return: A delegation point or null.
 */
 struct delegpt* forwards_find(struct iter_forwards* fwd, uint8_t* qname,
-	uint16_t qclass, int nolock);
+	uint16_t qclass);

 /**
 * Find forward zone information
 * For this qname/qclass find forward zone information, returns delegation
 * point with server names and addresses, or NULL if no forwarding is needed.
- * The return value is contents of the forwards structure.
- * Caller should lock and unlock a readlock on the forwards structure if nolock
- * is set.
- * Otherwise caller should unlock the readlock on the forwards structure if a
- * value was returned.
 *
 * @param fwd: forward storage.
 * @param qname: The qname of the query.
 * @param qclass: The qclass of the query.
- * @param nolock: Skip locking, locking is handled by the caller.
 * @return: A delegation point if the query has to be forwarded to that list,
 *         otherwise null.
 */
-struct delegpt* forwards_lookup(struct iter_forwards* fwd,
-	uint8_t* qname, uint16_t qclass, int nolock);
+struct delegpt* forwards_lookup(struct iter_forwards* fwd, 
+	uint8_t* qname, uint16_t qclass);

 /**
 * Same as forwards_lookup, but for the root only
 * @param fwd: forward storage.
 * @param qclass: The qclass of the query.
- * @param nolock: Skip locking, locking is handled by the caller.
 * @return: A delegation point if root forward exists, otherwise null.
 */
-struct delegpt* forwards_lookup_root(struct iter_forwards* fwd,
-	uint16_t qclass, int nolock);
+struct delegpt* forwards_lookup_root(struct iter_forwards* fwd, 
+	uint16_t qclass);

 /**
 * Find next root item in forwards lookup tree.
- * Handles its own locking unless nolock is set. In that case the caller
- * should lock and unlock a readlock on the forwards structure.
 * @param fwd: the forward storage
 * @param qclass: class to look at next, or higher.
- * @param nolock: Skip locking, locking is handled by the caller.
 * @return false if none found, or if true stored in qclass.
 */
-int forwards_next_root(struct iter_forwards* fwd, uint16_t* qclass,
-	int nolock);
+int forwards_next_root(struct iter_forwards* fwd, uint16_t* qclass);

 /**
 * Get memory in use by forward storage
- * Locks and unlocks the structure.
 * @param fwd: forward storage.
 * @return bytes in use
 */
@@ -182,65 +158,42 @@ int fwd_cmp(const void* k1, const void* k2);
 /**
 * Add zone to forward structure. For external use since it recalcs 
 * the tree parents.
- * Handles its own locking unless nolock is set. In that case the caller
- * should lock and unlock a writelock on the forwards structure.
 * @param fwd: the forward data structure
 * @param c: class of zone
 * @param dp: delegation point with name and target nameservers for new
 *	forward zone. malloced.
- * @param nolock: Skip locking, locking is handled by the caller.
 * @return false on failure (out of memory);
 */
-int forwards_add_zone(struct iter_forwards* fwd, uint16_t c,
-	struct delegpt* dp, int nolock);
+int forwards_add_zone(struct iter_forwards* fwd, uint16_t c, 
+	struct delegpt* dp);

 /**
 * Remove zone from forward structure. For external use since it 
 * recalcs the tree parents.
- * Handles its own locking unless nolock is set. In that case the caller
- * should lock and unlock a writelock on the forwards structure.
 * @param fwd: the forward data structure
 * @param c: class of zone
 * @param nm: name of zone (in uncompressed wireformat).
- * @param nolock: Skip locking, locking is handled by the caller.
 */
-void forwards_delete_zone(struct iter_forwards* fwd, uint16_t c,
-	uint8_t* nm, int nolock);
+void forwards_delete_zone(struct iter_forwards* fwd, uint16_t c, uint8_t* nm);

 /**
 * Add stub hole (empty entry in forward table, that makes resolution skip
 * a forward-zone because the stub zone should override the forward zone).
 * Does not add one if not necessary.
- * Handles its own locking unless nolock is set. In that case the caller
- * should lock and unlock a writelock on the forwards structure.
 * @param fwd: the forward data structure
 * @param c: class of zone
 * @param nm: name of zone (in uncompressed wireformat).
- * @param nolock: Skip locking, locking is handled by the caller.
 * @return false on failure (out of memory);
 */
-int forwards_add_stub_hole(struct iter_forwards* fwd, uint16_t c,
-	uint8_t* nm, int nolock);
+int forwards_add_stub_hole(struct iter_forwards* fwd, uint16_t c, uint8_t* nm);

 /**
 * Remove stub hole, if one exists.
- * Handles its own locking unless nolock is set. In that case the caller
- * should lock and unlock a writelock on the forwards structure.
 * @param fwd: the forward data structure
 * @param c: class of zone
 * @param nm: name of zone (in uncompressed wireformat).
- * @param nolock: Skip locking, locking is handled by the caller.
 */
 void forwards_delete_stub_hole(struct iter_forwards* fwd, uint16_t c,
-	uint8_t* nm, int nolock);
-
-/**
- * Swap internal tree with preallocated entries. Caller should manage
- * the locks.
- * @param fwd: the forward data structure.
- * @param data: the data structure used to take elements from. This contains
- * 	the old elements on return.
- */
-void forwards_swap_tree(struct iter_forwards* fwd, struct iter_forwards* data);
+	uint8_t* nm);

 #endif /* ITERATOR_ITER_FWD_H */
@@ -57,8 +57,6 @@ hints_create(void)
 		sizeof(struct iter_hints));
 	if(!hints)
 		return NULL;
-	lock_rw_init(&hints->lock);
-	lock_protect(&hints->lock, &hints->tree, sizeof(hints->tree));
 	return hints;
 }

@@ -85,7 +83,6 @@ hints_delete(struct iter_hints* hints)
 {
 	if(!hints) 
 		return;
-	lock_rw_destroy(&hints->lock);
 	hints_del_tree(hints);
 	free(hints);
 }
@@ -132,7 +129,7 @@ compile_time_root_prime(int do_ip4, int do_ip6)
 	dp->has_parent_side_NS = 1;
      if(do_ip4) {
 	if(!ah(dp, "A.ROOT-SERVERS.NET.", "198.41.0.4"))	goto failed;
-	if(!ah(dp, "B.ROOT-SERVERS.NET.", "170.247.170.2"))	goto failed;
+	if(!ah(dp, "B.ROOT-SERVERS.NET.", "199.9.14.201")) goto failed;
 	if(!ah(dp, "C.ROOT-SERVERS.NET.", "192.33.4.12"))	goto failed;
 	if(!ah(dp, "D.ROOT-SERVERS.NET.", "199.7.91.13"))	goto failed;
 	if(!ah(dp, "E.ROOT-SERVERS.NET.", "192.203.230.10")) goto failed;
@@ -147,7 +144,7 @@ compile_time_root_prime(int do_ip4, int do_ip6)
      }
      if(do_ip6) {
 	if(!ah(dp, "A.ROOT-SERVERS.NET.", "2001:503:ba3e::2:30")) goto failed;
-	if(!ah(dp, "B.ROOT-SERVERS.NET.", "2801:1b8:10::b")) goto failed;
+	if(!ah(dp, "B.ROOT-SERVERS.NET.", "2001:500:200::b")) goto failed;
 	if(!ah(dp, "C.ROOT-SERVERS.NET.", "2001:500:2::c")) goto failed;
 	if(!ah(dp, "D.ROOT-SERVERS.NET.", "2001:500:2d::d")) goto failed;
 	if(!ah(dp, "E.ROOT-SERVERS.NET.", "2001:500:a8::e")) goto failed;
@@ -181,7 +178,7 @@ hints_insert(struct iter_hints* hints, uint16_t c, struct delegpt* dp,
 	node->noprime = (uint8_t)noprime;
 	if(!name_tree_insert(&hints->tree, &node->node, dp->name, dp->namelen,
 		dp->namelabs, c)) {
-		char buf[LDNS_MAX_DOMAINLEN];
+		char buf[257];
 		dname_str(dp->name, buf);
 		log_err("second hints for zone %s ignored.", buf);
 		delegpt_free_mlc(dp);
@@ -441,70 +438,47 @@ read_root_hints_list(struct iter_hints* hints, struct config_file* cfg)
 int 
 hints_apply_cfg(struct iter_hints* hints, struct config_file* cfg)
 {
-	int nolock = 1;
-	lock_rw_wrlock(&hints->lock);
 	hints_del_tree(hints);
 	name_tree_init(&hints->tree);
-
+	
 	/* read root hints */
-	if(!read_root_hints_list(hints, cfg)) {
-		lock_rw_unlock(&hints->lock);
+	if(!read_root_hints_list(hints, cfg))
 		return 0;
-	}

 	/* read stub hints */
-	if(!read_stubs(hints, cfg)) {
-		lock_rw_unlock(&hints->lock);
+	if(!read_stubs(hints, cfg))
 		return 0;
-	}

 	/* use fallback compiletime root hints */
-	if(!hints_find_root(hints, LDNS_RR_CLASS_IN, nolock)) {
+	if(!hints_lookup_root(hints, LDNS_RR_CLASS_IN)) {
 		struct delegpt* dp = compile_time_root_prime(cfg->do_ip4,
 			cfg->do_ip6);
 		verbose(VERB_ALGO, "no config, using builtin root hints.");
-		if(!dp) {
-			lock_rw_unlock(&hints->lock);
+		if(!dp) 
 			return 0;
-		}
-		if(!hints_insert(hints, LDNS_RR_CLASS_IN, dp, 0)) {
-			lock_rw_unlock(&hints->lock);
+		if(!hints_insert(hints, LDNS_RR_CLASS_IN, dp, 0))
 			return 0;
-		}
 	}

 	name_tree_init_parents(&hints->tree);
-	lock_rw_unlock(&hints->lock);
 	return 1;
 }

-struct delegpt*
-hints_find(struct iter_hints* hints, uint8_t* qname, uint16_t qclass,
-	int nolock)
-{
-	struct iter_hints_stub *stub;
-	size_t len;
-	int has_dp;
-	int labs = dname_count_size_labels(qname, &len);
-	/* lock_() calls are macros that could be nothing, surround in {} */
-	if(!nolock) { lock_rw_rdlock(&hints->lock); }
-	stub = (struct iter_hints_stub*)name_tree_find(&hints->tree,
-		qname, len, labs, qclass);
-	has_dp = stub && stub->dp;
-	if(!has_dp && !nolock) { lock_rw_unlock(&hints->lock); }
-	return has_dp?stub->dp:NULL;
-}
-
-struct delegpt*
-hints_find_root(struct iter_hints* hints, uint16_t qclass, int nolock)
+struct delegpt* 
+hints_lookup_root(struct iter_hints* hints, uint16_t qclass)
 {
 	uint8_t rootlab = 0;
-	return hints_find(hints, &rootlab, qclass, nolock);
+	struct iter_hints_stub *stub;
+	stub = (struct iter_hints_stub*)name_tree_find(&hints->tree,
+		&rootlab, 1, 1, qclass);
+	if(!stub)
+		return NULL;
+	return stub->dp;
 }

 struct iter_hints_stub* 
-hints_lookup_stub(struct iter_hints* hints, uint8_t* qname,
-	uint16_t qclass, struct delegpt* cache_dp, int nolock)
+hints_lookup_stub(struct iter_hints* hints, uint8_t* qname, 
+	uint16_t qclass, struct delegpt* cache_dp)
 {
 	size_t len;
 	int labs;
@@ -512,20 +486,14 @@ hints_lookup_stub(struct iter_hints* hints, uint8_t* qname,

 	/* first lookup the stub */
 	labs = dname_count_size_labels(qname, &len);
-	/* lock_() calls are macros that could be nothing, surround in {} */
-	if(!nolock) { lock_rw_rdlock(&hints->lock); }
 	r = (struct iter_hints_stub*)name_tree_lookup(&hints->tree, qname,
 		len, labs, qclass);
-	if(!r) {
-		if(!nolock) { lock_rw_unlock(&hints->lock); }
-		return NULL;
-	}
+	if(!r) return NULL;

 	/* If there is no cache (root prime situation) */
 	if(cache_dp == NULL) {
 		if(r->dp->namelabs != 1)
 			return r; /* no cache dp, use any non-root stub */
-		if(!nolock) { lock_rw_unlock(&hints->lock); }
 		return NULL;
 	}

@@ -542,18 +510,12 @@ hints_lookup_stub(struct iter_hints* hints, uint8_t* qname,
 	if(dname_strict_subdomain(r->dp->name, r->dp->namelabs,
 		cache_dp->name, cache_dp->namelabs))
 		return r; /* need to prime this stub */
-	if(!nolock) { lock_rw_unlock(&hints->lock); }
 	return NULL;
 }

-int hints_next_root(struct iter_hints* hints, uint16_t* qclass, int nolock)
+int hints_next_root(struct iter_hints* hints, uint16_t* qclass)
 {
-	int ret;
-	/* lock_() calls are macros that could be nothing, surround in {} */
-	if(!nolock) { lock_rw_rdlock(&hints->lock); }
-	ret = name_tree_next_root(&hints->tree, qclass);
-	if(!nolock) { lock_rw_unlock(&hints->lock); }
-	return ret;
+	return name_tree_next_root(&hints->tree, qclass);
 }

 size_t 
@@ -562,63 +524,40 @@ hints_get_mem(struct iter_hints* hints)
 	size_t s;
 	struct iter_hints_stub* p;
 	if(!hints) return 0;
-	lock_rw_rdlock(&hints->lock);
 	s = sizeof(*hints);
 	RBTREE_FOR(p, struct iter_hints_stub*, &hints->tree) {
 		s += sizeof(*p) + delegpt_get_mem(p->dp);
 	}
-	lock_rw_unlock(&hints->lock);
 	return s;
 }

 int 
 hints_add_stub(struct iter_hints* hints, uint16_t c, struct delegpt* dp,
-	int noprime, int nolock)
+	int noprime)
 {
 	struct iter_hints_stub *z;
-	/* lock_() calls are macros that could be nothing, surround in {} */
-	if(!nolock) { lock_rw_wrlock(&hints->lock); }
 	if((z=(struct iter_hints_stub*)name_tree_find(&hints->tree,
 		dp->name, dp->namelen, dp->namelabs, c)) != NULL) {
 		(void)rbtree_delete(&hints->tree, &z->node);
 		hints_stub_free(z);
 	}
-	if(!hints_insert(hints, c, dp, noprime)) {
-		if(!nolock) { lock_rw_unlock(&hints->lock); }
+	if(!hints_insert(hints, c, dp, noprime))
 		return 0;
-	}
 	name_tree_init_parents(&hints->tree);
-	if(!nolock) { lock_rw_unlock(&hints->lock); }
 	return 1;
 }

 void 
-hints_delete_stub(struct iter_hints* hints, uint16_t c, uint8_t* nm,
-	int nolock)
+hints_delete_stub(struct iter_hints* hints, uint16_t c, uint8_t* nm)
 {
 	struct iter_hints_stub *z;
 	size_t len;
 	int labs = dname_count_size_labels(nm, &len);
-	/* lock_() calls are macros that could be nothing, surround in {} */
-	if(!nolock) { lock_rw_wrlock(&hints->lock); }
 	if(!(z=(struct iter_hints_stub*)name_tree_find(&hints->tree,
-		nm, len, labs, c))) {
-		if(!nolock) { lock_rw_unlock(&hints->lock); }
+		nm, len, labs, c)))
 		return; /* nothing to do */
-	}
 	(void)rbtree_delete(&hints->tree, &z->node);
 	hints_stub_free(z);
 	name_tree_init_parents(&hints->tree);
-	if(!nolock) { lock_rw_unlock(&hints->lock); }
 }

-void
-hints_swap_tree(struct iter_hints* hints, struct iter_hints* data)
-{
-	rbnode_type* oldroot = hints->tree.root;
-	size_t oldcount = hints->tree.count;
-	hints->tree.root = data->tree.root;
-	hints->tree.count = data->tree.count;
-	data->tree.root = oldroot;
-	data->tree.count = oldcount;
-}
@@ -43,7 +43,6 @@
 #ifndef ITERATOR_ITER_HINTS_H
 #define ITERATOR_ITER_HINTS_H
 #include "util/storage/dnstree.h"
-#include "util/locks.h"
 struct iter_env;
 struct config_file;
 struct delegpt;
@@ -52,10 +51,6 @@ struct delegpt;
 * Iterator hints structure
 */
 struct iter_hints {
-	/** lock on the forwards tree.
-	 * When grabbing both this lock and the anchors.lock, this lock
-	 * is grabbed first. */
-	lock_rw_type lock;
 	/** 
 	 * Hints are stored in this tree. Sort order is specially chosen.
 	 * first sorted on qclass. Then on dname in nsec-like order, so that
@@ -100,70 +95,42 @@ void hints_delete(struct iter_hints* hints);
 int hints_apply_cfg(struct iter_hints* hints, struct config_file* cfg);

 /**
- * Find hints for the given class.
- * The return value is contents of the hints structure.
- * Caller should lock and unlock a readlock on the hints structure if nolock
- * is set.
- * Otherwise caller should unlock the readlock on the hints structure if a
- * value was returned.
- * @param hints: hint storage.
- * @param qname: the qname that generated the delegation point.
- * @param qclass: class for which root hints are requested. host order.
- * @param nolock: Skip locking, locking is handled by the caller.
- * @return: NULL if no hints, or a ptr to stored hints.
- */
-struct delegpt* hints_find(struct iter_hints* hints, uint8_t* qname,
-	uint16_t qclass, int nolock);
-
-/**
- * Same as hints_lookup, but for the root only.
+ * Find root hints for the given class.
 * @param hints: hint storage.
 * @param qclass: class for which root hints are requested. host order.
- * @param nolock: Skip locking, locking is handled by the caller.
 * @return: NULL if no hints, or a ptr to stored hints.
 */
-struct delegpt* hints_find_root(struct iter_hints* hints,
-	uint16_t qclass, int nolock);
+struct delegpt* hints_lookup_root(struct iter_hints* hints, uint16_t qclass);

 /**
 * Find next root hints (to cycle through all root hints).
- * Handles its own locking unless nolock is set. In that case the caller
- * should lock and unlock a readlock on the hints structure.
 * @param hints: hint storage
 * @param qclass: class for which root hints are sought.
 * 	0 means give the first available root hints class.
 * 	x means, give class x or a higher class if any.
 * 	returns the found class in this variable.
- * @param nolock: Skip locking, locking is handled by the caller.
 * @return true if a root hint class is found.
 * 	false if not root hint class is found (qclass may have been changed).
 */
-int hints_next_root(struct iter_hints* hints, uint16_t* qclass, int nolock);
+int hints_next_root(struct iter_hints* hints, uint16_t* qclass);

 /**
 * Given a qname/qclass combination, and the delegation point from the cache
 * for this qname/qclass, determine if this combination indicates that a
 * stub hint exists and must be primed.
- * The return value is contents of the hints structure.
- * Caller should lock and unlock a readlock on the hints structure if nolock
- * is set.
- * Otherwise caller should unlock the readlock on the hints structure if a
- * value was returned.
 *
 * @param hints: hint storage.
 * @param qname: The qname that generated the delegation point.
 * @param qclass: The qclass that generated the delegation point.
 * @param dp: The cache generated delegation point.
- * @param nolock: Skip locking, locking is handled by the caller.
 * @return: A priming delegation point if there is a stub hint that must
 *         be primed, otherwise null.
 */
-struct iter_hints_stub* hints_lookup_stub(struct iter_hints* hints,
-	uint8_t* qname, uint16_t qclass, struct delegpt* dp, int nolock);
+struct iter_hints_stub* hints_lookup_stub(struct iter_hints* hints, 
+	uint8_t* qname, uint16_t qclass, struct delegpt* dp);

 /**
 * Get memory in use by hints
- * Locks and unlocks the structure.
 * @param hints: hint storage.
 * @return bytes in use
 */
@@ -172,39 +139,23 @@ size_t hints_get_mem(struct iter_hints* hints);
 /**
 * Add stub to hints structure. For external use since it recalcs 
 * the tree parents.
- * Handles its own locking unless nolock is set. In that case the caller
- * should lock and unlock a writelock on the hints structure.
 * @param hints: the hints data structure
 * @param c: class of zone
 * @param dp: delegation point with name and target nameservers for new
 *	hints stub. malloced.
 * @param noprime: set noprime option to true or false on new hint stub.
- * @param nolock: Skip locking, locking is handled by the caller.
 * @return false on failure (out of memory);
 */
 int hints_add_stub(struct iter_hints* hints, uint16_t c, struct delegpt* dp,
-	int noprime, int nolock);
+	int noprime);

 /**
 * Remove stub from hints structure. For external use since it 
 * recalcs the tree parents.
- * Handles its own locking unless nolock is set. In that case the caller
- * should lock and unlock a writelock on the hints structure.
 * @param hints: the hints data structure
 * @param c: class of stub zone
 * @param nm: name of stub zone (in uncompressed wireformat).
- * @param nolock: Skip locking, locking is handled by the caller.
 */
-void hints_delete_stub(struct iter_hints* hints, uint16_t c,
-	uint8_t* nm, int nolock);
-
-/**
- * Swap internal tree with preallocated entries. Caller should manage
- * the locks.
- * @param hints: the hints data structure.
- * @param data: the data structure used to take elements from. This contains
- * 	the old elements on return.
- */
-void hints_swap_tree(struct iter_hints* hints, struct iter_hints* data);
+void hints_delete_stub(struct iter_hints* hints, uint16_t c, uint8_t* nm);

 #endif /* ITERATOR_ITER_HINTS_H */
@@ -207,6 +207,28 @@ size_t priv_get_mem(struct iter_priv* priv)
 	return sizeof(*priv) + regional_get_mem(priv->region);
 }

+/** remove RR from msgparse RRset, return true if rrset is entirely bad */
+static int
+remove_rr(const char* str, sldns_buffer* pkt, struct rrset_parse* rrset,
+	struct rr_parse* prev, struct rr_parse** rr, struct sockaddr_storage* addr, socklen_t addrlen)
+{
+	if(verbosity >= VERB_QUERY && rrset->dname_len <= LDNS_MAX_DOMAINLEN && str) {
+		uint8_t buf[LDNS_MAX_DOMAINLEN+1];
+		dname_pkt_copy(pkt, buf, rrset->dname);
+		log_name_addr(VERB_QUERY, str, buf, addr, addrlen);
+	}
+	if(prev)
+		prev->next = (*rr)->next;
+	else	rrset->rr_first = (*rr)->next;
+	if(rrset->rr_last == *rr)
+		rrset->rr_last = prev;
+	rrset->rr_count --;
+	rrset->size -= (*rr)->size;
+	/* rr struct still exists, but is unlinked, so that in the for loop
+	 * the rr->next works fine to continue. */
+	return rrset->rr_count == 0;
+}
+
 int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 	struct rrset_parse* rrset)
 {
@@ -239,7 +261,7 @@ int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 					INET_SIZE);
 				memmove(&addr, &sa, len);
 				if(priv_lookup_addr(priv, &addr, len)) {
-					if(msgparse_rrset_remove_rr("sanitize: removing public name with private address", pkt, rrset, prev, rr, &addr, len))
+					if(remove_rr("sanitize: removing public name with private address", pkt, rrset, prev, &rr, &addr, len))
 						return 1;
 					continue;
 				}
@@ -262,7 +284,7 @@ int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 					INET6_SIZE);
 				memmove(&addr, &sa, len);
 				if(priv_lookup_addr(priv, &addr, len)) {
-					if(msgparse_rrset_remove_rr("sanitize: removing public name with private address", pkt, rrset, prev, rr, &addr, len))
+					if(remove_rr("sanitize: removing public name with private address", pkt, rrset, prev, &rr, &addr, len))
 						return 1;
 					continue;
 				}
@@ -42,7 +42,6 @@
 #include "config.h"
 #include "iterator/iter_resptype.h"
 #include "iterator/iter_delegpt.h"
-#include "iterator/iterator.h"
 #include "services/cache/dns.h"
 #include "util/net_help.h"
 #include "util/data/dname.h"
@@ -106,8 +105,7 @@ response_type_from_cache(struct dns_msg* msg,

 enum response_type 
 response_type_from_server(int rdset,
-	struct dns_msg* msg, struct query_info* request, struct delegpt* dp,
-	int* empty_nodata_found)
+	struct dns_msg* msg, struct query_info* request, struct delegpt* dp)
 {
 	uint8_t* origzone = (uint8_t*)"\000"; /* the default */
 	struct ub_packed_rrset_key* s;
@@ -286,22 +284,6 @@ response_type_from_server(int rdset,

 	/* If we've gotten this far, this is NOERROR/NODATA (which could 
 	 * be an entirely empty message) */
-	/* For entirely empty messages, try again, at first, then accept
-	 * it it happens more. A regular noerror/nodata response has a soa
-	 * negative ttl value in the authority section. This makes it try
-	 * again at another authority. And decides between storing a 5 second
-	 * empty message or a 5 second servfail response. */
-	if(msg->rep->an_numrrsets == 0 && msg->rep->ns_numrrsets == 0 &&
-		msg->rep->ar_numrrsets == 0) {
-		if(empty_nodata_found) {
-			/* detect as throwaway at first, but accept later. */
-			(*empty_nodata_found)++;
-			if(*empty_nodata_found < EMPTY_NODATA_RETRY_COUNT)
-				return RESPONSE_TYPE_THROWAWAY;
-			return RESPONSE_TYPE_ANSWER;
-		}
-		return RESPONSE_TYPE_ANSWER;
-	}
 	/* check if recursive answer; saying it has empty cache */
 	if( (msg->rep->flags&BIT_RA) && !(msg->rep->flags&BIT_AA) && !rdset)
 		return RESPONSE_TYPE_REC_LAME;
@@ -119,11 +119,9 @@ enum response_type response_type_from_cache(struct dns_msg* msg,
 * @param request: the request that generated the response.
 * @param dp: The delegation point that was being queried
 *          when the response was returned.
- * @param empty_nodata_found: flag to keep track of empty nodata detection.
 * @return the response type (CNAME or ANSWER).
 */
 enum response_type response_type_from_server(int rdset, 
-	struct dns_msg* msg, struct query_info* request, struct delegpt* dp,
-	int* empty_nodata_found);
+	struct dns_msg* msg, struct query_info* request, struct delegpt* dp);

 #endif /* ITERATOR_ITER_RESPTYPE_H */
@@ -283,8 +283,7 @@ synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
 		sizeof(uint32_t)+sizeof(uint16_t)+aliaslen);
 	if(!cn->rr_first->ttl_data)
 		return NULL;
-	memmove(cn->rr_first->ttl_data, rrset->rr_first->ttl_data,
-		sizeof(uint32_t)); /* RFC6672: synth CNAME TTL == DNAME TTL */
+	sldns_write_uint32(cn->rr_first->ttl_data, 0); /* TTL = 0 */
 	sldns_write_uint16(cn->rr_first->ttl_data+4, aliaslen);
 	memmove(cn->rr_first->ttl_data+6, alias, aliaslen);
 	cn->rr_first->size = sizeof(uint16_t)+aliaslen;
@@ -347,67 +346,6 @@ soa_in_auth(struct msg_parse* msg)
 	return 0;
 }

-/** Check if type is allowed in the authority section */
-static int
-type_allowed_in_authority_section(uint16_t tp)
-{
-	if(tp == LDNS_RR_TYPE_SOA || tp == LDNS_RR_TYPE_NS ||
-		tp == LDNS_RR_TYPE_DS || tp == LDNS_RR_TYPE_NSEC ||
-		tp == LDNS_RR_TYPE_NSEC3)
-		return 1;
-	return 0;
-}
-
-/** Check if type is allowed in the additional section */
-static int
-type_allowed_in_additional_section(uint16_t tp)
-{
-	if(tp == LDNS_RR_TYPE_A || tp == LDNS_RR_TYPE_AAAA)
-		return 1;
-	return 0;
-}
-
-/** Shorten RRset */
-static void
-shorten_rrset(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
-{
-	/* The too large NS RRset is shortened. This is so that too large
-	 * content does not overwhelm the cache. It may make the rrset
-	 * bogus if it was signed, and then the domain is not resolved any
-	 * more, that is okay, the NS RRset was too large. During a referral
-	 * it can be shortened and then the first part of the list could
-	 * be used to resolve. The scrub continues to disallow glue for the
-	 * removed nameserver RRs and removes that too. Because the glue
-	 * is not marked as okay, since the RRs have been removed here. */
-	int i;
-	struct rr_parse* rr = rrset->rr_first, *prev = NULL;
-	if(!rr)
-		return;
-	for(i=0; i<count; i++) {
-		prev = rr;
-		rr = rr->next;
-		if(!rr)
-			return; /* The RRset is already short. */
-	}
-	if(verbosity >= VERB_QUERY
-		&& rrset->dname_len <= LDNS_MAX_DOMAINLEN) {
-		uint8_t buf[LDNS_MAX_DOMAINLEN+1];
-		dname_pkt_copy(pkt, buf, rrset->dname);
-		log_nametypeclass(VERB_QUERY, "normalize: shorten RRset:", buf,
-			rrset->type, ntohs(rrset->rrset_class));
-	}
-	/* remove further rrs */
-	rrset->rr_last = prev;
-	rrset->rr_count = count;
-	while(rr) {
-		rrset->size -= rr->size;
-		rr = rr->next;
-	}
-	if(rrset->rr_last)
-		rrset->rr_last->next = NULL;
-	else	rrset->rr_first = NULL;
-}
-
 /**
 * This routine normalizes a response. This includes removing "irrelevant"
 * records from the answer and additional sections and (re)synthesizing
@@ -417,18 +355,15 @@ shorten_rrset(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
 * @param msg: msg to normalize.
 * @param qinfo: original query.
 * @param region: where to allocate synthesized CNAMEs.
- * @param env: module env with config options.
 * @return 0 on error.
 */
 static int
 scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, 
-	struct query_info* qinfo, struct regional* region,
-	struct module_env* env)
+	struct query_info* qinfo, struct regional* region)
 {
 	uint8_t* sname = qinfo->qname;
 	size_t snamelen = qinfo->qname_len;
 	struct rrset_parse* rrset, *prev, *nsset=NULL;
-	int cname_length = 0; /* number of CNAMEs, or DNAMEs */

 	if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR &&
 		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN)
@@ -443,16 +378,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 	prev = NULL;
 	rrset = msg->rrset_first;
 	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
-		if(cname_length > env->cfg->iter_scrub_cname) {
-			/* Too many CNAMEs, or DNAMEs, from the authority
-			 * server, scrub down the length to something
-			 * shorter. This deletes everything after the limit
-			 * is reached. The iterator is going to look up
-			 * the content one by one anyway. */
-			remove_rrset("normalize: removing because too many cnames:",
-				pkt, msg, prev, &rrset);
-			continue;
-		}
 		if(rrset->type == LDNS_RR_TYPE_DNAME && 
 			pkt_strict_sub(pkt, sname, rrset->dname)) {
 			/* check if next rrset is correct CNAME. else,
@@ -472,7 +397,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					"too long");
 				return 0;
 			}
-			cname_length++;
 			if(nx && nx->type == LDNS_RR_TYPE_CNAME && 
 			   dname_pkt_compare(pkt, sname, nx->dname) == 0) {
 				/* check next cname */
@@ -513,7 +437,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 		if(rrset->type == LDNS_RR_TYPE_CNAME) {
 			struct rrset_parse* nx = rrset->rrset_all_next;
 			uint8_t* oldsname = sname;
-			cname_length++;
 			/* see if the next one is a DNAME, if so, swap them */
 			if(nx && nx->section == LDNS_SECTION_ANSWER &&
 				nx->type == LDNS_RR_TYPE_DNAME &&
@@ -561,10 +484,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					LDNS_SECTION_ANSWER &&
 					dname_pkt_compare(pkt, oldsname,
 					rrset->dname) == 0) {
-					if(rrset->type == LDNS_RR_TYPE_NS &&
-						rrset->rr_count > env->cfg->iter_scrub_ns) {
-						shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
-					}
 					prev = rrset;
 					rrset = rrset->rrset_all_next;
 				}
@@ -580,11 +499,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 			continue;
 		}

-		if(rrset->type == LDNS_RR_TYPE_NS &&
-			rrset->rr_count > env->cfg->iter_scrub_ns) {
-			shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
-		}
-
 		/* Mark the additional names from relevant rrset as OK. */
 		/* only for RRsets that match the query name, other ones
 		 * will be removed by sanitize, so no additional for them */
@@ -597,7 +511,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,

 	/* Mark additional names from AUTHORITY */
 	while(rrset && rrset->section == LDNS_SECTION_AUTHORITY) {
-		/* protect internals of recursor by making sure to del these */
 		if(rrset->type==LDNS_RR_TYPE_DNAME ||
 			rrset->type==LDNS_RR_TYPE_CNAME ||
 			rrset->type==LDNS_RR_TYPE_A ||
@@ -606,13 +519,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
-		/* Allowed list of types in the authority section */
-		if(env->cfg->harden_unknown_additional &&
-			!type_allowed_in_authority_section(rrset->type)) {
-			remove_rrset("normalize: removing irrelevant "
-				"RRset:", pkt, msg, prev, &rrset);
-			continue;
-		}
 		/* only one NS set allowed in authority section */
 		if(rrset->type==LDNS_RR_TYPE_NS) {
 			/* NS set must be pertinent to the query */
@@ -641,25 +547,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					"RRset:", pkt, msg, prev, &rrset);
 				continue;
 			}
-			if(rrset->rr_count > env->cfg->iter_scrub_ns) {
-				/* If this is not a referral, and the NS RRset
-				 * is signed, then remove it entirely, so
-				 * that when it becomes bogus it does not
-				 * make the message that is otherwise fine
-				 * into a bogus message. */
-				if(!(msg->an_rrsets == 0 &&
-					FLAGS_GET_RCODE(msg->flags) ==
-					LDNS_RCODE_NOERROR &&
-					!soa_in_auth(msg) &&
-					!(msg->flags & BIT_AA)) &&
-					rrset->rrsig_count != 0) {
-					remove_rrset("normalize: removing too large NS "
-						"RRset:", pkt, msg, prev, &rrset);
-					continue;
-				} else {
-					shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
-				}
-			}
 		}
 		/* if this is type DS and we query for type DS we just got
 		 * a referral answer for our type DS query, fix packet */
@@ -689,6 +576,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 	 * found in ANSWER and AUTHORITY. */
 	/* These records have not been marked OK previously */
 	while(rrset && rrset->section == LDNS_SECTION_ADDITIONAL) {
+		/* FIXME: what about other types? */
 		if(rrset->type==LDNS_RR_TYPE_A || 
 			rrset->type==LDNS_RR_TYPE_AAAA) 
 		{
@@ -701,7 +589,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				continue;
 			}
 		}
-		/* protect internals of recursor by making sure to del these */
 		if(rrset->type==LDNS_RR_TYPE_DNAME || 
 			rrset->type==LDNS_RR_TYPE_CNAME ||
 			rrset->type==LDNS_RR_TYPE_NS) {
@@ -709,13 +596,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
-		/* Allowed list of types in the additional section */
-		if(env->cfg->harden_unknown_additional &&
-			!type_allowed_in_additional_section(rrset->type)) {
-			remove_rrset("normalize: removing irrelevant "
-				"RRset:", pkt, msg, prev, &rrset);
-			continue;
-		}
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -799,56 +679,6 @@ static int sanitize_nsec_is_overreach(sldns_buffer* pkt,
 	return 0;
 }

-/** Remove individual RRs, if the length is wrong. Returns true if the RRset
- * has been removed. */
-static int
-scrub_sanitize_rr_length(sldns_buffer* pkt, struct msg_parse* msg,
-	struct rrset_parse* prev, struct rrset_parse** rrset, int* added_ede,
-	struct module_qstate* qstate)
-{
-	struct rr_parse* rr, *rr_prev = NULL;
-	for(rr = (*rrset)->rr_first; rr; rr = rr->next) {
-
-		/* Sanity check for length of records
-		 * An A record should be 6 bytes only
-		 * (2 bytes for length and 4 for IPv4 addr)*/
-		if((*rrset)->type == LDNS_RR_TYPE_A && rr->size != 6 ) {
-			if(!*added_ede) {
-				*added_ede = 1;
-				errinf_ede(qstate, "sanitize: records of inappropriate length have been removed.",
-					LDNS_EDE_OTHER);
-			}
-			if(msgparse_rrset_remove_rr("sanitize: removing type A RR of inappropriate length:",
-				pkt, *rrset, rr_prev, rr, NULL, 0)) {
-				remove_rrset("sanitize: removing type A RRset of inappropriate length:",
-					pkt, msg, prev, rrset);
-				return 1;
-			}
-			continue;
-		}
-
-		/* Sanity check for length of records
-		 * An AAAA record should be 18 bytes only
-		 * (2 bytes for length and 16 for IPv6 addr)*/
-		if((*rrset)->type == LDNS_RR_TYPE_AAAA && rr->size != 18 ) {
-			if(!*added_ede) {
-				*added_ede = 1;
-				errinf_ede(qstate, "sanitize: records of inappropriate length have been removed.",
-					LDNS_EDE_OTHER);
-			}
-			if(msgparse_rrset_remove_rr("sanitize: removing type AAAA RR of inappropriate length:",
-				pkt, *rrset, rr_prev, rr, NULL, 0)) {
-				remove_rrset("sanitize: removing type AAAA RRset of inappropriate length:",
-					pkt, msg, prev, rrset);
-				return 1;
-			}
-			continue;
-		}
-		rr_prev = rr;
-	}
-	return 0;
-}
-
 /**
 * Given a response event, remove suspect RRsets from the response.
 * "Suspect" rrsets are potentially poison. Note that this routine expects
@@ -861,18 +691,15 @@ scrub_sanitize_rr_length(sldns_buffer* pkt, struct msg_parse* msg,
 * @param zonename: name of server zone.
 * @param env: module environment with config and cache.
 * @param ie: iterator environment with private address data.
- * @param qstate: for setting errinf for EDE error messages.
 * @return 0 on error.
 */
 static int
 scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg, 
 	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
-	struct iter_env* ie, struct module_qstate* qstate)
+	struct iter_env* ie)
 {
 	int del_addi = 0; /* if additional-holding rrsets are deleted, we
 		do not trust the normalized additional-A-AAAA any more */
-	uint8_t* ns_rrset_dname = NULL;
-	int added_rrlen_ede = 0;
 	struct rrset_parse* rrset, *prev;
 	prev = NULL;
 	rrset = msg->rrset_first;
@@ -917,14 +744,6 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	rrset = msg->rrset_first;
 	while(rrset) {

-		/* Sanity check for length of records */
-		if(rrset->type == LDNS_RR_TYPE_A ||
-			rrset->type == LDNS_RR_TYPE_AAAA) {
-			if(scrub_sanitize_rr_length(pkt, msg, prev, &rrset,
-				&added_rrlen_ede, qstate))
-				continue;
-		}
-
 		/* remove private addresses */
 		if( (rrset->type == LDNS_RR_TYPE_A || 
 			rrset->type == LDNS_RR_TYPE_AAAA)) {
@@ -977,16 +796,6 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 				continue;
 			}
 		}
-		if(rrset->type == LDNS_RR_TYPE_NS &&
-			(rrset->section == LDNS_SECTION_AUTHORITY ||
-			rrset->section == LDNS_SECTION_ANSWER)) {
-			/* If the type is NS, and we're in the
-			 * answer or authority section, then
-			 * store the dname so we can check
-			 * against the glue records
-			 * further down	*/
-			ns_rrset_dname = rrset->dname;
-		}
 		if(del_addi && rrset->section == LDNS_SECTION_ADDITIONAL) {
 			remove_rrset("sanitize: removing potential "
 			"poison reference RRset:", pkt, msg, prev, &rrset);
@@ -999,26 +808,6 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
-		if(env->cfg->harden_unverified_glue && ns_rrset_dname &&
-			rrset->section == LDNS_SECTION_ADDITIONAL &&
-			(rrset->type == LDNS_RR_TYPE_A || rrset->type == LDNS_RR_TYPE_AAAA) &&
-			!pkt_strict_sub(pkt, rrset->dname, ns_rrset_dname)) {
-			/* We're in the additional section, looking
-			 * at an A/AAAA rrset, have a previous
-			 * delegation point and we notice that
-			 * the glue records are NOT for strict
-			 * subdomains of the delegation. So set a
-			 * flag, recompute the hash for the rrset
-			 * and write the A/AAAA record to cache.
-			 * It'll be retrieved if we can't separately
-			 * resolve the glue	*/
-			rrset->flags = PACKED_RRSET_UNVERIFIED_GLUE;
-			rrset->hash = pkt_hash_rrset(pkt, rrset->dname, rrset->type, rrset->rrset_class, rrset->flags);
-			store_rrset(pkt, msg, env, rrset);
-			remove_rrset("sanitize: storing potential "
-			"unverified glue reference RRset:", pkt, msg, prev, &rrset);
-			continue;
-		}
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -1028,8 +817,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 int 
 scrub_message(sldns_buffer* pkt, struct msg_parse* msg, 
 	struct query_info* qinfo, uint8_t* zonename, struct regional* region,
-	struct module_env* env, struct module_qstate* qstate,
-	struct iter_env* ie)
+	struct module_env* env, struct iter_env* ie)
 {
 	/* basic sanity checks */
 	log_nametypeclass(VERB_ALGO, "scrub for", zonename, LDNS_RR_TYPE_NS, 
@@ -1058,10 +846,10 @@ scrub_message(sldns_buffer* pkt, struct msg_parse* msg,
 	}

 	/* normalize the response, this cleans up the additional.  */
-	if(!scrub_normalize(pkt, msg, qinfo, region, env))
+	if(!scrub_normalize(pkt, msg, qinfo, region))
 		return 0;
 	/* delete all out-of-zone information */
-	if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie, qstate))
+	if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie))
 		return 0;
 	return 1;
 }
@@ -48,7 +48,6 @@ struct query_info;
 struct regional;
 struct module_env;
 struct iter_env;
-struct module_qstate;

 /**
 * Cleanup the passed dns message.
@@ -60,13 +59,11 @@ struct module_qstate;
 *	Used to determine out of bailiwick information.
 * @param regional: where to allocate (new) parts of the message.
 * @param env: module environment with config settings and cache. 
- * @param qstate: for setting errinf for EDE error messages.
 * @param ie: iterator module environment data.
 * @return: false if the message is total waste. true if scrubbed with success.
 */
 int scrub_message(struct sldns_buffer* pkt, struct msg_parse* msg, 
 	struct query_info* qinfo, uint8_t* zonename, struct regional* regional,
-	struct module_env* env, struct module_qstate* qstate,
-	struct iter_env* ie);
+	struct module_env* env, struct iter_env* ie);

 #endif /* ITERATOR_ITER_SCRUB_H */
@@ -71,79 +71,42 @@
 /** time when nameserver glue is said to be 'recent' */
 #define SUSPICION_RECENT_EXPIRY 86400

-/** if NAT64 is enabled and no NAT64 prefix is configured, first fall back to
- * DNS64 prefix.  If that is not configured, fall back to this default value.
- */
-static const char DEFAULT_NAT64_PREFIX[] = "64:ff9b::/96";
-
 /** fillup fetch policy array */
-static int
-fetch_fill(int* target_fetch_policy, int max_dependency_depth, const char* str)
+static void
+fetch_fill(struct iter_env* ie, const char* str)
 {
 	char* s = (char*)str, *e;
 	int i;
-	for(i=0; i<max_dependency_depth+1; i++) {
-		target_fetch_policy[i] = strtol(s, &e, 10);
-		if(s == e) {
-			log_err("cannot parse fetch policy number %s", s);
-			return 0;
-		}
+	for(i=0; i<ie->max_dependency_depth+1; i++) {
+		ie->target_fetch_policy[i] = strtol(s, &e, 10);
+		if(s == e)
+			fatal_exit("cannot parse fetch policy number %s", s);
 		s = e;
 	}
-	return 1;
 }

 /** Read config string that represents the target fetch policy */
-int
-read_fetch_policy(int** target_fetch_policy, int* max_dependency_depth,
-	const char* str)
+static int
+read_fetch_policy(struct iter_env* ie, const char* str)
 {
 	int count = cfg_count_numbers(str);
 	if(count < 1) {
 		log_err("Cannot parse target fetch policy: \"%s\"", str);
 		return 0;
 	}
-	*max_dependency_depth = count - 1;
-	*target_fetch_policy = (int*)calloc(
-		(size_t)(*max_dependency_depth)+1, sizeof(int));
-	if(!*target_fetch_policy) {
+	ie->max_dependency_depth = count - 1;
+	ie->target_fetch_policy = (int*)calloc(
+		(size_t)ie->max_dependency_depth+1, sizeof(int));
+	if(!ie->target_fetch_policy) {
 		log_err("alloc fetch policy: out of memory");
 		return 0;
 	}
-	if(!fetch_fill(*target_fetch_policy, *max_dependency_depth, str))
-		return 0;
+	fetch_fill(ie, str);
 	return 1;
 }

-struct rbtree_type*
-caps_white_create(void)
-{
-	struct rbtree_type* caps_white = rbtree_create(name_tree_compare);
-	if(!caps_white)
-		log_err("out of memory");
-	return caps_white;
-}
-
-/** delete caps_whitelist element */
-static void
-caps_free(struct rbnode_type* n, void* ATTR_UNUSED(d))
-{
-	if(n) {
-		free(((struct name_tree_node*)n)->name);
-		free(n);
-	}
-}
-
-void
-caps_white_delete(struct rbtree_type* caps_white)
-{
-	if(!caps_white)
-		return;
-	traverse_postorder(caps_white, caps_free, NULL);
-	free(caps_white);
-}
-
-int
+/** apply config caps whitelist items to name tree */
+static int
 caps_white_apply_cfg(rbtree_type* ntree, struct config_file* cfg)
 {
 	struct config_strlist* p;
@@ -176,42 +139,12 @@ caps_white_apply_cfg(rbtree_type* ntree, struct config_file* cfg)
 	return 1;
 }

-int
-nat64_apply_cfg(struct iter_nat64* nat64, struct config_file* cfg)
-{
-	const char *nat64_prefix;
-
-	nat64_prefix = cfg->nat64_prefix;
-	if(!nat64_prefix)
-		nat64_prefix = cfg->dns64_prefix;
-	if(!nat64_prefix)
-		nat64_prefix = DEFAULT_NAT64_PREFIX;
-	if(!netblockstrtoaddr(nat64_prefix, 0, &nat64->nat64_prefix_addr,
-		&nat64->nat64_prefix_addrlen, &nat64->nat64_prefix_net)) {
-		log_err("cannot parse nat64-prefix netblock: %s", nat64_prefix);
-		return 0;
-	}
-	if(!addr_is_ip6(&nat64->nat64_prefix_addr,
-		nat64->nat64_prefix_addrlen)) {
-		log_err("nat64-prefix is not IPv6: %s", cfg->nat64_prefix);
-		return 0;
-	}
-	if(!prefixnet_is_nat64(nat64->nat64_prefix_net)) {
-		log_err("nat64-prefix length it not 32, 40, 48, 56, 64 or 96: %s",
-			nat64_prefix);
-		return 0;
-	}
-	nat64->use_nat64 = cfg->do_nat64;
-	return 1;
-}
-
 int
 iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 {
 	int i;
 	/* target fetch policy */
-	if(!read_fetch_policy(&iter_env->target_fetch_policy,
-		&iter_env->max_dependency_depth, cfg->target_fetch_policy))
+	if(!read_fetch_policy(iter_env, cfg->target_fetch_policy))
 		return 0;
 	for(i=0; i<iter_env->max_dependency_depth+1; i++)
 		verbose(VERB_QUERY, "target fetch policy for level %d is %d",
@@ -231,7 +164,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 	}
 	if(cfg->caps_whitelist) {
 		if(!iter_env->caps_white)
-			iter_env->caps_white = caps_white_create();
+			iter_env->caps_white = rbtree_create(name_tree_compare);
 		if(!iter_env->caps_white || !caps_white_apply_cfg(
 			iter_env->caps_white, cfg)) {
 			log_err("Could not set capsforid whitelist");
@@ -239,17 +172,9 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 		}

 	}
-
-	if(!nat64_apply_cfg(&iter_env->nat64, cfg)) {
-		log_err("Could not setup nat64");
-		return 0;
-	}
-
 	iter_env->supports_ipv6 = cfg->do_ip6;
 	iter_env->supports_ipv4 = cfg->do_ip4;
 	iter_env->outbound_msg_retry = cfg->outbound_msg_retry;
-	iter_env->max_sent_count = cfg->max_sent_count;
-	iter_env->max_query_restarts = cfg->max_query_restarts;
 	return 1;
 }

@@ -313,8 +238,7 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	if(!iter_env->supports_ipv6 && addr_is_ip6(&a->addr, a->addrlen)) {
 		return -1; /* there is no ip6 available */
 	}
-	if(!iter_env->supports_ipv4 && !iter_env->nat64.use_nat64 &&
-	   !addr_is_ip6(&a->addr, a->addrlen)) {
+	if(!iter_env->supports_ipv4 && !addr_is_ip6(&a->addr, a->addrlen)) {
 		return -1; /* there is no ip4 available */
 	}
 	/* check lameness - need zone , class info */
@@ -322,10 +246,9 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 		name, namelen, qtype, &lame, &dnsseclame, &reclame,
 		&rtt, now)) {
 		log_addr(VERB_ALGO, "servselect", &a->addr, a->addrlen);
-		verbose(VERB_ALGO, "   rtt=%d%s%s%s%s%s", rtt,
+		verbose(VERB_ALGO, "   rtt=%d%s%s%s%s", rtt,
 			lame?" LAME":"",
 			dnsseclame?" DNSSEC_LAME":"",
-			a->dnsseclame?" ADDR_DNSSEC_LAME":"",
 			reclame?" REC_LAME":"",
 			a->lame?" ADDR_LAME":"");
 		if(lame)
@@ -736,11 +659,10 @@ dns_copy_msg(struct dns_msg* from, struct regional* region)
 void
 iter_dns_store(struct module_env* env, struct query_info* msgqinf,
 	struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
-	struct regional* region, uint16_t flags, time_t qstarttime,
-	int is_valrec)
+	struct regional* region, uint16_t flags, time_t qstarttime)
 {
 	if(!dns_cache_store(env, msgqinf, msgrep, is_referral, leeway,
-		pside, region, flags, qstarttime, is_valrec))
+		pside, region, flags, qstarttime))
 		log_err("out of memory: cannot store data in cache");
 }

@@ -823,15 +745,10 @@ iter_mark_pside_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)

 int
 iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
-	struct delegpt* dp, int supports_ipv4, int supports_ipv6,
-	int use_nat64)
+	struct delegpt* dp, int supports_ipv4, int supports_ipv6)
 {
 	struct delegpt_ns* ns;
 	struct delegpt_addr* a;
-
-	if(supports_ipv6 && use_nat64)
-		supports_ipv4 = 1;
-
 	/* check:
 	 *      o RD qflag is on.
 	 *      o no addresses are provided.
@@ -1329,17 +1246,8 @@ iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd,
 	uint16_t* c)
 {
 	uint16_t c1 = *c, c2 = *c;
-	int r1, r2;
-	int nolock = 1;
-
-	/* prelock both forwards and hints for atomic read. */
-	lock_rw_rdlock(&fwd->lock);
-	lock_rw_rdlock(&hints->lock);
-	r1 = hints_next_root(hints, &c1, nolock);
-	r2 = forwards_next_root(fwd, &c2, nolock);
-	lock_rw_unlock(&fwd->lock);
-	lock_rw_unlock(&hints->lock);
-
+	int r1 = hints_next_root(hints, &c1);
+	int r2 = forwards_next_root(fwd, &c2);
 	if(!r1 && !r2) /* got none, end of list */
 		return 0;
 	else if(!r1) /* got one, return that */
@@ -1400,7 +1308,8 @@ void iter_dec_attempts(struct delegpt* dp, int d, int outbound_msg_retry)
 	for(a=dp->target_list; a; a = a->next_target) {
 		if(a->attempts >= outbound_msg_retry) {
 			/* add back to result list */
-			delegpt_add_to_result_list(dp, a);
+			a->next_result = dp->result_list;
+			dp->result_list = a;
 		}
 		if(a->attempts > d)
 			a->attempts -= d;
@@ -1504,21 +1413,15 @@ int iter_dp_cangodown(struct query_info* qinfo, struct delegpt* dp)

 int
 iter_stub_fwd_no_cache(struct module_qstate *qstate, struct query_info *qinf,
-	uint8_t** retdpname, size_t* retdpnamelen, uint8_t* dpname_storage,
-	size_t dpname_storage_len)
+	uint8_t** retdpname, size_t* retdpnamelen)
 {
 	struct iter_hints_stub *stub;
 	struct delegpt *dp;
-	int nolock = 1;

 	/* Check for stub. */
-	/* Lock both forwards and hints for atomic read. */
-	lock_rw_rdlock(&qstate->env->fwds->lock);
-	lock_rw_rdlock(&qstate->env->hints->lock);
 	stub = hints_lookup_stub(qstate->env->hints, qinf->qname,
-	    qinf->qclass, NULL, nolock);
-	dp = forwards_lookup(qstate->env->fwds, qinf->qname, qinf->qclass,
-		nolock);
+	    qinf->qclass, NULL);
+	dp = forwards_lookup(qstate->env->fwds, qinf->qname, qinf->qclass);

 	/* see if forward or stub is more pertinent */
 	if(stub && stub->dp && dp) {
@@ -1532,62 +1435,35 @@ iter_stub_fwd_no_cache(struct module_qstate *qstate, struct query_info *qinf,

 	/* check stub */
 	if (stub != NULL && stub->dp != NULL) {
-		enum verbosity_value level = VERB_ALGO;
-		int stub_no_cache = stub->dp->no_cache;
-		lock_rw_unlock(&qstate->env->fwds->lock);
-		if(verbosity >= level && stub_no_cache) {
-			char qname[LDNS_MAX_DOMAINLEN];
-			char dpname[LDNS_MAX_DOMAINLEN];
+		if(stub->dp->no_cache) {
+			char qname[255+1];
+			char dpname[255+1];
 			dname_str(qinf->qname, qname);
 			dname_str(stub->dp->name, dpname);
-			verbose(level, "stub for %s %s has no_cache", qname, dpname);
+			verbose(VERB_ALGO, "stub for %s %s has no_cache", qname, dpname);
 		}
 		if(retdpname) {
-			if(stub->dp->namelen > dpname_storage_len) {
-				verbose(VERB_ALGO, "no cache stub dpname too long");
-				lock_rw_unlock(&qstate->env->hints->lock);
-				*retdpname = NULL;
-				*retdpnamelen = 0;
-				return stub_no_cache;
-			}
-			memmove(dpname_storage, stub->dp->name,
-				stub->dp->namelen);
-			*retdpname = dpname_storage;
+			*retdpname = stub->dp->name;
 			*retdpnamelen = stub->dp->namelen;
 		}
-		lock_rw_unlock(&qstate->env->hints->lock);
-		return stub_no_cache;
+		return (stub->dp->no_cache);
 	}

 	/* Check for forward. */
 	if (dp) {
-		enum verbosity_value level = VERB_ALGO;
-		int dp_no_cache = dp->no_cache;
-		lock_rw_unlock(&qstate->env->hints->lock);
-		if(verbosity >= level && dp_no_cache) {
-			char qname[LDNS_MAX_DOMAINLEN];
-			char dpname[LDNS_MAX_DOMAINLEN];
+		if(dp->no_cache) {
+			char qname[255+1];
+			char dpname[255+1];
 			dname_str(qinf->qname, qname);
 			dname_str(dp->name, dpname);
-			verbose(level, "forward for %s %s has no_cache", qname, dpname);
+			verbose(VERB_ALGO, "forward for %s %s has no_cache", qname, dpname);
 		}
 		if(retdpname) {
-			if(dp->namelen > dpname_storage_len) {
-				verbose(VERB_ALGO, "no cache dpname too long");
-				lock_rw_unlock(&qstate->env->fwds->lock);
-				*retdpname = NULL;
-				*retdpnamelen = 0;
-				return dp_no_cache;
-			}
-			memmove(dpname_storage, dp->name, dp->namelen);
-			*retdpname = dpname_storage;
+			*retdpname = dp->name;
 			*retdpnamelen = dp->namelen;
 		}
-		lock_rw_unlock(&qstate->env->fwds->lock);
-		return dp_no_cache;
+		return (dp->no_cache);
 	}
-	lock_rw_unlock(&qstate->env->fwds->lock);
-	lock_rw_unlock(&qstate->env->hints->lock);
 	if(retdpname) {
 		*retdpname = NULL;
 		*retdpnamelen = 0;
@@ -1610,54 +1486,3 @@ void iterator_set_ip46_support(struct module_stack* mods,
 	if(outnet->num_ip6 == 0)
 		ie->supports_ipv6 = 0;
 }
-
-void
-limit_nsec_ttl(struct dns_msg* msg)
-{
-	/* Limit NSEC and NSEC3 TTL in response, RFC9077 */
-	size_t i;
-	int found = 0;
-	time_t soa_ttl = 0;
-	/* Limit the NSEC and NSEC3 TTL values to the SOA TTL and SOA minimum
-	 * TTL. That has already been applied to the SOA record ttl. */
-	for(i=0; i<msg->rep->rrset_count; i++) {
-		struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
-		if(ntohs(s->rk.type) == LDNS_RR_TYPE_SOA) {
-			struct packed_rrset_data* soadata = (struct packed_rrset_data*)s->entry.data;
-			found = 1;
-			soa_ttl = soadata->ttl;
-			break;
-		}
-	}
-	if(!found)
-		return;
-	for(i=0; i<msg->rep->rrset_count; i++) {
-		struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
-		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC ||
-			ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
-			struct packed_rrset_data* data = (struct packed_rrset_data*)s->entry.data;
-			/* Limit the negative TTL. */
-			if(data->ttl > soa_ttl) {
-				if(verbosity >= VERB_ALGO) {
-					char buf[256];
-					snprintf(buf, sizeof(buf),
-						"limiting TTL %d of %s record to the SOA TTL of %d for",
-						(int)data->ttl, ((ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC)?"NSEC":"NSEC3"), (int)soa_ttl);
-					log_nametypeclass(VERB_ALGO, buf,
-						s->rk.dname, ntohs(s->rk.type),
-						ntohs(s->rk.rrset_class));
-				}
-				data->ttl = soa_ttl;
-			}
-		}
-	}
-}
-
-void
-iter_make_minimal(struct reply_info* rep)
-{
-	size_t rem = rep->ns_numrrsets + rep->ar_numrrsets;
-	rep->ns_numrrsets = 0;
-	rep->ar_numrrsets = 0;
-	rep->rrset_count -= rem;
-}
@@ -61,7 +61,6 @@ struct sock_list;
 struct ub_packed_rrset_key;
 struct module_stack;
 struct outside_network;
-struct iter_nat64;

 /* max number of lookups in the cache for target nameserver names.
 * This stops, for large delegations, N*N lookups in the cache. */
@@ -143,7 +142,6 @@ struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);
 * @param region: to copy modified (cache is better) rrs back to.
 * @param flags: with BIT_CD for dns64 AAAA translated queries.
 * @param qstarttime: time of query start.
- * @param is_valrec: if the query is validation recursion and does not get
 * return void, because we are not interested in alloc errors,
 * 	the iterator and validator can operate on the results in their
 * 	scratch space (the qstate.region) and are not dependent on the cache.
@@ -152,8 +150,7 @@ struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);
 */
 void iter_dns_store(struct module_env* env, struct query_info* qinf,
 	struct reply_info* rep, int is_referral, time_t leeway, int pside,
-	struct regional* region, uint16_t flags, time_t qstarttime,
-	int is_valrec);
+	struct regional* region, uint16_t flags, time_t qstarttime);

 /**
 * Select randomly with n/m probability.
@@ -192,13 +189,10 @@ void iter_mark_pside_cycle_targets(struct module_qstate* qstate,
 * 	if not, then the IPv4 addresses are useless.
 * @param supports_ipv6: if we support ipv6 for lookups to the target.
 * 	if not, then the IPv6 addresses are useless.
- * @param use_nat64: if we support NAT64 for lookups to the target.
- *	if yes, IPv4 addresses are useful even if we don't support IPv4.
 * @return true if dp is useless.
 */
-int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
-	struct delegpt* dp, int supports_ipv4, int supports_ipv6,
-	int use_nat64);
+int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, 
+	struct delegpt* dp, int supports_ipv4, int supports_ipv6);

 /**
 * See if qname has DNSSEC needs.  This is true if there is a trust anchor above
@@ -410,14 +404,10 @@ int iter_dp_cangodown(struct query_info* qinfo, struct delegpt* dp);
 * 	Used for NXDOMAIN checks, above that it is an nxdomain from a
 * 	different server and zone. You can pass NULL to not get it.
 * @param retdpnamelen: returns the length of the dpname.
- * @param dpname_storage: this is where the dpname buf is stored, if any.
- * 	So that caller can manage the buffer.
- * @param dpname_storage_len: size of dpname_storage buffer.
 * @return true if no_cache is set in stub or fwd.
 */
 int iter_stub_fwd_no_cache(struct module_qstate *qstate,
-	struct query_info *qinf, uint8_t** retdpname, size_t* retdpnamelen,
-	uint8_t* dpname_storage, size_t dpname_storage_len);
+	struct query_info *qinf, uint8_t** retdpname, size_t* retdpnamelen);

 /**
 * Set support for IP4 and IP6 depending on outgoing interfaces
@@ -431,55 +421,4 @@ int iter_stub_fwd_no_cache(struct module_qstate *qstate,
 void iterator_set_ip46_support(struct module_stack* mods,
 	struct module_env* env, struct outside_network* outnet);

-/**
- * Read config string that represents the target fetch policy.
- * @param target_fetch_policy: alloced on return.
- * @param max_dependency_depth: set on return.
- * @param str: the config string
- * @return false on failure.
- */
-int read_fetch_policy(int** target_fetch_policy, int* max_dependency_depth,
-	const char* str);
-
-/**
- * Create caps exempt data structure.
- * @return NULL on failure.
- */
-struct rbtree_type* caps_white_create(void);
-
-/**
- * Delete caps exempt data structure.
- * @param caps_white: caps exempt tree.
- */
-void caps_white_delete(struct rbtree_type* caps_white);
-
-/**
- * Apply config caps whitelist items to name tree
- * @param ntree: caps exempt tree.
- * @param cfg: config with options.
- */
-int caps_white_apply_cfg(struct rbtree_type* ntree, struct config_file* cfg);
-
-/**
- * Apply config for nat64
- * @param nat64: the nat64 state.
- * @param cfg: config with options.
- * @return false on failure.
- */
-int nat64_apply_cfg(struct iter_nat64* nat64, struct config_file* cfg);
-
-/**
- * Limit NSEC and NSEC3 TTL in response, RFC9077
- * @param msg: dns message, the SOA record ttl is used to restrict ttls
- *	of NSEC and NSEC3 RRsets. If no SOA record, nothing happens.
- */
-void limit_nsec_ttl(struct dns_msg* msg);
-
-/**
- * Make the response minimal. Removed authority and additional section,
- * that works when there is an answer in the answer section.
- * @param rep: reply to modify.
- */
-void iter_make_minimal(struct reply_info* rep);
-
 #endif /* ITERATOR_ITER_UTILS_H */
@@ -46,6 +46,8 @@
 #include "util/data/msgreply.h"
 #include "util/module.h"
 struct delegpt;
+struct iter_hints;
+struct iter_forwards;
 struct iter_donotq;
 struct iter_prep_list;
 struct iter_priv;
@@ -53,9 +55,6 @@ struct rbtree_type;

 /** max number of targets spawned for a query and its subqueries */
 #define MAX_TARGET_COUNT	64
-/** max number of upstream queries for a query and its subqueries, it is
- * never reset. */
-extern int MAX_GLOBAL_QUOTA;
 /** max number of target lookups per qstate, per delegation point */
 #define MAX_DP_TARGET_COUNT	16
 /** max number of nxdomains allowed for target lookups for a query and
@@ -64,8 +63,13 @@ extern int MAX_GLOBAL_QUOTA;
 /** max number of nxdomains allowed for target lookups for a query and
 * its subqueries when fallback has kicked in */
 #define MAX_TARGET_NX_FALLBACK	(MAX_TARGET_NX*2)
+/** max number of query restarts. Determines max number of CNAME chain. */
+#define MAX_RESTART_COUNT	11
 /** max number of referrals. Makes sure resolver does not run away */
 #define MAX_REFERRAL_COUNT	130
+/** max number of queries-sent-out. Make sure large NS set does not loop.
+ *  Resets on query restarts (e.g., CNAMES) and referrals. */
+#define MAX_SENT_COUNT		32
 /** max number of queries for which to perform dnsseclameness detection,
 * (rrsigs missing detection) after that, just pick up that response */
 #define DNSSEC_LAME_DETECT_COUNT 4
@@ -102,28 +106,9 @@ extern int BLACKLIST_PENALTY;
 * Chosen so that the UNKNOWN_SERVER_NICENESS falls within the band of a 
 * fast server, this causes server exploration as a side benefit. msec. */
 #define RTT_BAND 400
-/** Number of retries for empty nodata packets before it is accepted. */
-#define EMPTY_NODATA_RETRY_COUNT 2

 /**
- * Iterator global state for nat64.
- */
-struct iter_nat64 {
-	/** A flag to locally apply NAT64 to make IPv4 addrs into IPv6 */
-	int use_nat64;
-
-	/** NAT64 prefix address, cf. dns64_env->prefix_addr */
-	struct sockaddr_storage nat64_prefix_addr;
-
-	/** sizeof(sockaddr_in6) */
-	socklen_t nat64_prefix_addrlen;
-
-	/** CIDR mask length of NAT64 prefix */
-	int nat64_prefix_net;
-};
-
-/**
- * Global state for the iterator.
+ * Global state for the iterator. 
 */
 struct iter_env {
 	/** A flag to indicate whether or not we have an IPv6 route */
@@ -132,9 +117,6 @@ struct iter_env {
 	/** A flag to indicate whether or not we have an IPv4 route */
 	int supports_ipv4;

-	/** State for nat64 */
-	struct iter_nat64 nat64;
-
 	/** A set of inetaddrs that should never be queried. */
 	struct iter_donotq* donotq;

@@ -164,12 +146,6 @@ struct iter_env {

 	/** number of retries on outgoing queries */
 	int outbound_msg_retry;
-
-	/** number of queries_sent */
-	int max_sent_count;
-
-	/** max number of query restarts to limit length of CNAME chain */
-	int max_query_restarts;
 };

 /**
@@ -257,9 +233,6 @@ enum target_count_variables {
 	TARGET_COUNT_QUERIES,
 	/** Number of nxdomain responses encountered. */
 	TARGET_COUNT_NX,
-	/** Global quota on number of queries to upstream servers per
-	 * client request, that is never reset. */
-	TARGET_COUNT_GLOBAL_QUOTA,

 	/** This should stay last here, it is used for the allocation */
 	TARGET_COUNT_MAX,
@@ -429,11 +402,6 @@ struct iter_qstate {
 	 */
 	int refetch_glue;

-	/**
-	 * This flag detects that a completely empty nodata was received,
-	 * already so that it is accepted later. */
-	int empty_nodata_found;
-
 	/** list of pending queries to authoritative servers. */
 	struct outbound_list outlist;

@@ -470,14 +438,7 @@ struct iter_qstate {
 	/** true if there have been parse failures of reply packets */
 	int parse_failures;
 	/** a failure printout address for last received answer */
-	union {
-		struct in_addr in;
-#ifdef AF_INET6
-		struct in6_addr in6;
-#endif
-	} fail_addr;
-	/** which fail_addr, 0 is nothing, 4 or 6 */
-	int fail_addr_type;
+	struct comm_reply* fail_reply;
 };

 /**
@@ -53,8 +53,7 @@
 #include "util/storage/slabhash.h"
 #include "util/edns.h"
 #include "sldns/sbuffer.h"
-#include "iterator/iter_fwd.h"
-#include "iterator/iter_hints.h"
+#include "sldns/wire2str.h"

 int 
 context_finalize(struct ub_ctx* ctx)
@@ -72,12 +71,9 @@ context_finalize(struct ub_ctx* ctx)
 	} else {
 		log_init(cfg->logfile, cfg->use_syslog, NULL);
 	}
-	ctx->pipe_pid = getpid();
 	cfg_apply_local_port_policy(cfg, 65536);
 	config_apply(cfg);
-	if(!modstack_call_startup(&ctx->mods, cfg->module_conf, ctx->env))
-		return UB_INITFAIL;
-	if(!modstack_call_init(&ctx->mods, cfg->module_conf, ctx->env))
+	if(!modstack_setup(&ctx->mods, cfg->module_conf, ctx->env))
 		return UB_INITFAIL;
 	listen_setup_locks();
 	log_edns_known_options(VERB_ALGO, ctx->env);
@@ -89,12 +85,6 @@ context_finalize(struct ub_ctx* ctx)
 	if(!auth_zones_apply_cfg(ctx->env->auth_zones, cfg, 1, &is_rpz,
 		ctx->env, &ctx->mods))
 		return UB_INITFAIL;
-	if(!(ctx->env->fwds = forwards_create()) ||
-		!forwards_apply_cfg(ctx->env->fwds, cfg))
-		return UB_INITFAIL;
-	if(!(ctx->env->hints = hints_create()) ||
-		!hints_apply_cfg(ctx->env->hints, cfg))
-		return UB_INITFAIL;
 	if(!edns_strings_apply_cfg(ctx->env->edns_strings, cfg))
 		return UB_INITFAIL;
 	if(!slabhash_is_size(ctx->env->msg_cache, cfg->msg_cache_size,
@@ -155,9 +145,17 @@ find_id(struct ub_ctx* ctx, int* id)

 struct ctx_query* 
 context_new(struct ub_ctx* ctx, const char* name, int rrtype, int rrclass, 
-	ub_callback_type cb, ub_event_callback_type cb_event, void* cbarg)
+	ub_callback_type cb, ub_event_callback_type cb_event, void* cbarg,
+	const uint8_t* qbuf, size_t qbuf_len)
 {
 	struct ctx_query* q = (struct ctx_query*)calloc(1, sizeof(*q));
+	char qname_str_buf[1024];
+	char *qname_str = qname_str_buf;
+	size_t qname_str_len = sizeof(qname_str_buf);
+	uint8_t *qname;
+	size_t qname_len;
+	int comprloop;
+
 	if(!q) return NULL;
 	lock_basic_lock(&ctx->cfglock);
 	if(!find_id(ctx, &q->querynum)) {
@@ -176,6 +174,32 @@ context_new(struct ub_ctx* ctx, const char* name, int rrtype, int rrclass,
 		free(q);
 		return NULL;
 	}
+	if(!name && qbuf) {
+		if(qbuf_len < 12) {
+			free(q->res);
+			free(q);
+			return NULL;
+		}
+		qname = (uint8_t* )qbuf + 12;
+		qname_len = qbuf_len - 12;
+		comprloop = 0;
+
+		/* get query name from the input buffer */
+		sldns_wire2str_dname_scan(
+				&qname, &qname_len,
+				&qname_str, &qname_str_len,
+				(uint8_t *)qbuf, qbuf_len,
+				&comprloop);
+		*qname_str = 0;
+		name = qname_str_buf;
+		if (qname_len < 4) {
+			free(q->res);
+			free(q);
+			return NULL;
+		}
+		rrtype = sldns_read_uint16(qname);
+		rrclass = sldns_read_uint16(qname + 2);
+	}
 	q->res->qname = strdup(name);
 	if(!q->res->qname) {
 		free(q->res);
@@ -395,7 +419,7 @@ context_serialize_cancel(struct ctx_query* q, uint32_t* len)
 	/* format of cancel:
 	 * 	o uint32 cmd
 	 * 	o uint32 async-id */
-	uint8_t* p = (uint8_t*)reallocarray(NULL, 2, sizeof(uint32_t));
+	uint8_t* p = (uint8_t*)reallocarray(NULL, sizeof(uint32_t), 2);
 	if(!p) return NULL;
 	*len = 2*sizeof(uint32_t);
 	sldns_write_uint32(p, UB_LIBCMD_CANCEL);
@@ -89,12 +89,6 @@ struct ub_ctx {
 	pid_t bg_pid;
 	/** tid of bg worker thread */
 	ub_thread_type bg_tid;
-	/** pid when pipes are created. This was the process when the
-	 * setup was called. Helps with clean up, so we can tell after a fork
-	 * which side of the fork the delete is on. */
-	pid_t pipe_pid;
-	/** when threaded, the worker that exists in the created thread. */
-	struct libworker* thread_worker;

 	/** do threading (instead of forking) for async resolution */
 	int dothread;
@@ -177,6 +171,11 @@ struct ctx_query {
 	/** store libworker that is handling this query */
 	struct libworker* w;

+	/** raw query packet */
+	const uint8_t *qbuf;
+	/** length of raw query packet */
+	size_t qbuf_len;
+
 	/** result structure, also contains original query, type, class.
 	 * malloced ptr ready to hand to the client. */
 	struct ub_result* res;
@@ -230,7 +229,7 @@ void context_query_delete(struct ctx_query* q);
 */
 struct ctx_query* context_new(struct ub_ctx* ctx, const char* name, int rrtype,
        int rrclass,  ub_callback_type cb, ub_event_callback_type cb_event,
-	void* cbarg);
+	void* cbarg, const uint8_t* qbuf, size_t qbuf_len);

 /**
 * Get a new alloc. Creates a new one or uses a cached one.
@@ -66,8 +66,6 @@
 #include "services/authzone.h"
 #include "services/listen_dnsport.h"
 #include "sldns/sbuffer.h"
-#include "iterator/iter_fwd.h"
-#include "iterator/iter_hints.h"
 #ifdef HAVE_PTHREAD
 #include <signal.h>
 #endif
@@ -173,7 +171,6 @@ static struct ub_ctx* ub_ctx_create_nopipe(void)
 	ctx->env->worker = NULL;
 	ctx->env->need_to_validate = 0;
 	modstack_init(&ctx->mods);
-	ctx->env->modstack = &ctx->mods;
 	rbtree_init(&ctx->queries, &context_query_cmp);
 	return ctx;
 }
@@ -188,9 +185,7 @@ ub_ctx_create(void)
 		int e = errno;
 		ub_randfree(ctx->seed_rnd);
 		config_delete(ctx->env->cfg);
-		modstack_call_deinit(&ctx->mods, ctx->env);
-		modstack_call_destartup(&ctx->mods, ctx->env);
-		modstack_free(&ctx->mods);
+		modstack_desetup(&ctx->mods, ctx->env);
 		listen_desetup_locks();
 		edns_known_options_delete(ctx->env);
 		edns_strings_delete(ctx->env->edns_strings);
@@ -204,9 +199,7 @@ ub_ctx_create(void)
 		tube_delete(ctx->qq_pipe);
 		ub_randfree(ctx->seed_rnd);
 		config_delete(ctx->env->cfg);
-		modstack_call_deinit(&ctx->mods, ctx->env);
-		modstack_call_destartup(&ctx->mods, ctx->env);
-		modstack_free(&ctx->mods);
+		modstack_desetup(&ctx->mods, ctx->env);
 		listen_desetup_locks();
 		edns_known_options_delete(ctx->env);
 		edns_strings_delete(ctx->env->edns_strings);
@@ -312,31 +305,11 @@ ub_ctx_delete(struct ub_ctx* ctx)
 	int do_stop = 1;
 	if(!ctx) return;

-	/* if the delete is called but it has forked, and before the fork
-	 * the context was finalized, then the bg worker is not stopped
-	 * from here. There is one worker, but two contexts that refer to
-	 * it and only one should clean up, the one with getpid == pipe_pid.*/
-	if(ctx->created_bg && ctx->pipe_pid != getpid()) {
-		do_stop = 0;
-#ifndef USE_WINSOCK
-		/* Stop events from getting deregistered, if the backend is
-		 * epoll, the epoll fd is the same as the other process.
-		 * That process should deregister them. */
-		if(ctx->qq_pipe->listen_com)
-			ctx->qq_pipe->listen_com->event_added = 0;
-		if(ctx->qq_pipe->res_com)
-			ctx->qq_pipe->res_com->event_added = 0;
-		if(ctx->rr_pipe->listen_com)
-			ctx->rr_pipe->listen_com->event_added = 0;
-		if(ctx->rr_pipe->res_com)
-			ctx->rr_pipe->res_com->event_added = 0;
-#endif
-	}
 	/* see if bg thread is created and if threads have been killed */
 	/* no locks, because those may be held by terminated threads */
 	/* for processes the read pipe is closed and we see that on read */
 #ifdef HAVE_PTHREAD
-	if(ctx->created_bg && ctx->dothread && do_stop) {
+	if(ctx->created_bg && ctx->dothread) {
 		if(pthread_kill(ctx->bg_tid, 0) == ESRCH) {
 			/* thread has been killed */
 			do_stop = 0;
@@ -345,28 +318,9 @@ ub_ctx_delete(struct ub_ctx* ctx)
 #endif /* HAVE_PTHREAD */
 	if(do_stop)
 		ub_stop_bg(ctx);
-	if(ctx->created_bg && ctx->pipe_pid != getpid() && ctx->thread_worker) {
-		/* This delete is happening from a different process. Delete
-		 * the thread worker from this process memory space. The
-		 * thread is not there to do so, so it is freed here. */
-		struct ub_event_base* evbase = comm_base_internal(
-			ctx->thread_worker->base);
-		libworker_delete_event(ctx->thread_worker);
-		ctx->thread_worker = NULL;
-#ifdef USE_MINI_EVENT
-		ub_event_base_free(evbase);
-#else
-		/* cannot event_base_free, because the epoll_fd cleanup
-		 * in libevent could stop the original event_base in the
-		 * other process from working. */
-		free(evbase);
-#endif
-	}
 	libworker_delete_event(ctx->event_worker);

-	modstack_call_deinit(&ctx->mods, ctx->env);
-	modstack_call_destartup(&ctx->mods, ctx->env);
-	modstack_free(&ctx->mods);
+	modstack_desetup(&ctx->mods, ctx->env);
 	a = ctx->alloc_list;
 	while(a) {
 		na = a->super;
@@ -388,8 +342,6 @@ ub_ctx_delete(struct ub_ctx* ctx)
 		config_delete(ctx->env->cfg);
 		edns_known_options_delete(ctx->env);
 		edns_strings_delete(ctx->env->edns_strings);
-		forwards_delete(ctx->env->fwds);
-		hints_delete(ctx->env->hints);
 		auth_zones_delete(ctx->env->auth_zones);
 		free(ctx->env);
 	}
@@ -762,7 +714,8 @@ ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype,
 	}
 	/* create new ctx_query and attempt to add to the list */
 	lock_basic_unlock(&ctx->cfglock);
-	q = context_new(ctx, name, rrtype, rrclass, NULL, NULL, NULL);
+	q = context_new(ctx, name, rrtype, rrclass,
+			NULL, NULL, NULL, NULL, 0);
 	if(!q)
 		return UB_NOMEM;
 	/* become a resolver thread for a bit */
@@ -819,7 +772,8 @@ ub_resolve_event(struct ub_ctx* ctx, const char* name, int rrtype,
 	ub_comm_base_now(ctx->event_worker->base);

 	/* create new ctx_query and attempt to add to the list */
-	q = context_new(ctx, name, rrtype, rrclass, NULL, callback, mydata);
+	q = context_new(ctx, name, rrtype, rrclass,
+			NULL, callback, mydata, NULL, 0);
 	if(!q)
 		return UB_NOMEM;

@@ -864,7 +818,8 @@ ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype,
 	}

 	/* create new ctx_query and attempt to add to the list */
-	q = context_new(ctx, name, rrtype, rrclass, callback, NULL, mydata);
+	q = context_new(ctx, name, rrtype, rrclass,
+			callback, NULL, mydata, NULL, 0);
 	if(!q)
 		return UB_NOMEM;

@@ -893,6 +848,116 @@ ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype,
 	return UB_NOERROR;
 }

+int
+ub_send(struct ub_ctx* ctx, const char* packet, int length,
+        struct ub_result** result)
+{
+	struct ctx_query* q;
+	int r;
+	*result = NULL;
+
+	lock_basic_lock(&ctx->cfglock);
+	if(!ctx->finalized) {
+		r = context_finalize(ctx);
+		if(r) {
+			lock_basic_unlock(&ctx->cfglock);
+			return r;
+		}
+	}
+	/* create new ctx_query and attempt to add to the list */
+	lock_basic_unlock(&ctx->cfglock);
+	q = context_new(ctx, NULL, 0, 0,
+			NULL, NULL, NULL, (const uint8_t *)packet, length);
+	if(!q)
+		return UB_NOMEM;
+	/* become a resolver thread for a bit */
+
+	r = libworker_fg(ctx, q);
+	if(r) {
+		lock_basic_lock(&ctx->cfglock);
+		(void)rbtree_delete(&ctx->queries, q->node.key);
+		context_query_delete(q);
+		lock_basic_unlock(&ctx->cfglock);
+		return r;
+	}
+	q->res->answer_packet = q->msg;
+	q->res->answer_len = (int)q->msg_len;
+	q->msg = NULL;
+	*result = q->res;
+	q->res = NULL;
+
+	lock_basic_lock(&ctx->cfglock);
+	(void)rbtree_delete(&ctx->queries, q->node.key);
+	context_query_delete(q);
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
+int 
+ub_send_async(struct ub_ctx* ctx, const char* packet, int length,
+		void* mydata, ub_callback_type callback, int* async_id)
+{
+	struct ctx_query* q;
+	uint8_t* msg = NULL;
+	uint32_t len = 0;
+
+	if(async_id)
+		*async_id = 0;
+	lock_basic_lock(&ctx->cfglock);
+	if(!ctx->finalized) {
+		int r = context_finalize(ctx);
+		if(r) {
+			lock_basic_unlock(&ctx->cfglock);
+			return r;
+		}
+	}
+	if(!ctx->created_bg) {
+		int r;
+		ctx->created_bg = 1;
+		lock_basic_unlock(&ctx->cfglock);
+		r = libworker_bg(ctx);
+		if(r) {
+			lock_basic_lock(&ctx->cfglock);
+			ctx->created_bg = 0;
+			lock_basic_unlock(&ctx->cfglock);
+			return r;
+		}
+	} else {
+		lock_basic_unlock(&ctx->cfglock);
+	}
+
+	/* create new ctx_query and attempt to add to the list */
+	q = context_new(ctx, NULL, 0, 0, callback, NULL,
+			mydata, (const uint8_t*)packet, length);
+	if(!q)
+		return UB_NOMEM;
+
+	/* write over pipe to background worker */
+	lock_basic_lock(&ctx->cfglock);
+	msg = context_serialize_new_query(q, &len);
+	if(!msg) {
+		(void)rbtree_delete(&ctx->queries, q->node.key);
+		ctx->num_async--;
+		context_query_delete(q);
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_NOMEM;
+	}
+	if(async_id)
+		*async_id = q->querynum;
+	lock_basic_unlock(&ctx->cfglock);
+	
+	lock_basic_lock(&ctx->qqpipe_lock);
+	if(!tube_write_msg(ctx->qq_pipe, msg, len, 0)) {
+		lock_basic_unlock(&ctx->qqpipe_lock);
+		free(msg);
+		return UB_PIPE;
+	}
+	lock_basic_unlock(&ctx->qqpipe_lock);
+	free(msg);
+	return UB_NOERROR;
+}
+
+
 int 
 ub_cancel(struct ub_ctx* ctx, int async_id)
 {
@@ -987,8 +1052,7 @@ ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr)
 	if(!addr) {
 		/* disable fwd mode - the root stub should be first. */
 		if(ctx->env->cfg->forwards &&
-			(ctx->env->cfg->forwards->name &&
-			strcmp(ctx->env->cfg->forwards->name, ".") == 0)) {
+			strcmp(ctx->env->cfg->forwards->name, ".") == 0) {
 			s = ctx->env->cfg->forwards;
 			ctx->env->cfg->forwards = s->next;
 			s->next = NULL;
@@ -1008,8 +1072,7 @@ ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr)
 	/* it parses, add root stub in front of list */
 	lock_basic_lock(&ctx->cfglock);
 	if(!ctx->env->cfg->forwards ||
-		(ctx->env->cfg->forwards->name &&
-		strcmp(ctx->env->cfg->forwards->name, ".") != 0)) {
+		strcmp(ctx->env->cfg->forwards->name, ".") != 0) {
 		s = calloc(1, sizeof(*s));
 		if(!s) {
 			lock_basic_unlock(&ctx->cfglock);
@@ -1027,7 +1090,6 @@ ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr)
 		ctx->env->cfg->forwards = s;
 	} else {
 		log_assert(ctx->env->cfg->forwards);
-		log_assert(ctx->env->cfg->forwards->name);
 		s = ctx->env->cfg->forwards;
 	}
 	dupl = strdup(addr);
@@ -62,7 +62,6 @@
 #include "util/random.h"
 #include "util/config_file.h"
 #include "util/netevent.h"
-#include "util/proxy_protocol.h"
 #include "util/storage/lookup3.h"
 #include "util/storage/slabhash.h"
 #include "util/net_help.h"
@@ -70,6 +69,8 @@
 #include "util/data/msgreply.h"
 #include "util/data/msgencode.h"
 #include "util/tube.h"
+#include "iterator/iter_fwd.h"
+#include "iterator/iter_hints.h"
 #include "sldns/sbuffer.h"
 #include "sldns/str2wire.h"
 #ifdef USE_DNSTAP
@@ -98,6 +99,8 @@ libworker_delete_env(struct libworker* w)
 			!w->is_bg || w->is_bg_thread);
 		sldns_buffer_free(w->env->scratch_buffer);
 		regional_destroy(w->env->scratch);
+		forwards_delete(w->env->fwds);
+		hints_delete(w->env->hints);
 		ub_randfree(w->env->rnd);
 		free(w->env);
 	}
@@ -155,19 +158,30 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb)
 	}
 	w->env->scratch = regional_create_custom(cfg->msg_buffer_size);
 	w->env->scratch_buffer = sldns_buffer_new(cfg->msg_buffer_size);
-#ifdef HAVE_SSL
-	w->sslctx = connect_sslctx_create(NULL, NULL,
-		cfg->tls_cert_bundle, cfg->tls_win_cert);
-	if(!w->sslctx) {
-		/* to make the setup fail after unlock */
-		sldns_buffer_free(w->env->scratch_buffer);
-		w->env->scratch_buffer = NULL;
+	w->env->fwds = forwards_create();
+	if(w->env->fwds && !forwards_apply_cfg(w->env->fwds, cfg)) { 
+		forwards_delete(w->env->fwds);
+		w->env->fwds = NULL;
+	}
+	w->env->hints = hints_create();
+	if(w->env->hints && !hints_apply_cfg(w->env->hints, cfg)) { 
+		hints_delete(w->env->hints);
+		w->env->hints = NULL;
+	}
+	if(cfg->ssl_upstream || (cfg->tls_cert_bundle && cfg->tls_cert_bundle[0]) || cfg->tls_win_cert) {
+		w->sslctx = connect_sslctx_create(NULL, NULL,
+			cfg->tls_cert_bundle, cfg->tls_win_cert);
+		if(!w->sslctx) {
+			/* to make the setup fail after unlock */
+			hints_delete(w->env->hints);
+			w->env->hints = NULL;
+		}
 	}
-#endif
 	if(!w->is_bg || w->is_bg_thread) {
 		lock_basic_unlock(&ctx->cfglock);
 	}
-	if(!w->env->scratch || !w->env->scratch_buffer) {
+	if(!w->env->scratch || !w->env->scratch_buffer || !w->env->fwds ||
+		!w->env->hints) {
 		libworker_delete(w);
 		return NULL;
 	}
@@ -251,7 +265,6 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb)
 	w->env->kill_sub = &mesh_state_delete;
 	w->env->detect_cycle = &mesh_detect_cycle;
 	comm_base_timept(w->base, &w->env->now, &w->env->now_tv);
-	pp_init(&sldns_write_uint16, &sldns_write_uint32);
 	return w;
 }

@@ -292,7 +305,6 @@ libworker_do_cmd(struct libworker* w, uint8_t* msg, uint32_t len)
 			log_err("unknown command for bg worker %d", 
 				(int)context_serial_getcmd(msg, len));
 			/* and fall through to quit */
-			ATTR_FALLTHROUGH
 			/* fallthrough */
 		case UB_LIBCMD_QUIT:
 			free(msg);
@@ -383,7 +395,6 @@ int libworker_bg(struct ub_ctx* ctx)
 		w = libworker_setup(ctx, 1, NULL);
 		if(!w) return UB_NOMEM;
 		w->is_bg_thread = 1;
-		ctx->thread_worker = w;
 #ifdef ENABLE_LOCK_CHECKS
 		w->thread_num = 1; /* for nicer DEBUG checklocks */
 #endif
@@ -423,7 +434,7 @@ int libworker_bg(struct ub_ctx* ctx)
 static int
 fill_canon(struct ub_result* res, uint8_t* s)
 {
-	char buf[LDNS_MAX_DOMAINLEN];
+	char buf[255+2];
 	dname_str(s, buf);
 	res->canonname = strdup(buf);
 	return res->canonname != 0;
@@ -585,6 +596,8 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
 	if(!qinfo->qname) {
 		return 0;
 	}
+	qinfo->qbuf = q->qbuf;
+	qinfo->qbuf_len = q->qbuf_len;
 	edns->edns_present = 1;
 	edns->ext_rcode = 0;
 	edns->edns_version = 0;
@@ -593,8 +606,6 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
 	edns->opt_list_out = NULL;
 	edns->opt_list_inplace_cb_out = NULL;
 	edns->padding_block_size = 0;
-	edns->cookie_present = 0;
-	edns->cookie_valid = 0;
 	if(sldns_buffer_capacity(w->back->udp_buff) < 65535)
 		edns->udp_size = (uint16_t)sldns_buffer_capacity(
 			w->back->udp_buff);
@@ -1058,33 +1069,3 @@ void dtio_mainfdcallback(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
 	log_assert(0);
 }
 #endif
-
-void fast_reload_service_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
-int fast_reload_client_callback(struct comm_point* ATTR_UNUSED(c),
-	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
-        struct comm_reply* ATTR_UNUSED(repinfo))
-{
-	log_assert(0);
-	return 0;
-}
-
-#ifdef HAVE_NGTCP2
-void doq_client_event_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
-
-#ifdef HAVE_NGTCP2
-void doq_client_timer_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
@@ -30,7 +30,6 @@ def dnssecParse(domain, rrType=RR_TYPE_A):
 resolver = ub_ctx()
 resolver.add_ta(".   IN DS   19036 8 2 49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5")
 resolver.add_ta(".   IN DS   20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D")
-resolver.add_ta(".   IN DS   38696 8 2 683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16")

 dnssecParse("nic.cz")
 dnssecParse("nonexistent-domain-blablabla.cz")
@@ -36,9 +36,6 @@
 %begin %{
 /* store state of warning output, restored at later pop */
 #pragma GCC diagnostic push
-/* ignore warnings for pragma below, where for older GCC it can produce a
-   warning if the cast-function-type warning is absent. */
-#pragma GCC diagnostic ignored "-Wpragmas"
 /* ignore gcc8 METH_NOARGS function cast warnings for swig function pointers */
 #pragma GCC diagnostic ignored "-Wcast-function-type"
 %}
@@ -863,9 +860,6 @@ Result: ['74.125.43.147', '74.125.43.99', '74.125.43.103', '74.125.43.104']
 %inline %{
  //SWIG will see the ub_ctx as a class
  struct ub_ctx {
-          /* Dummy member, so the struct is not empty, MSVC complains about
-           * that. */
-          int dummy;
  };
 %}

@@ -31,6 +31,8 @@ ub_resolve
 ub_resolve_async
 ub_resolve_event
 ub_resolve_free
+ub_send
+ub_send_async
 ub_strerror
 ub_version
 ub_wait
@@ -52,8 +52,8 @@
 * unbound was compiled with, otherwise it wouldn't work, the event and
 * event_base structures would be different.
 */
-#ifndef UB_UNBOUND_EVENT_H
-#define UB_UNBOUND_EVENT_H
+#ifndef _UB_UNBOUND_EVENT_H
+#define _UB_UNBOUND_EVENT_H

 #ifdef __cplusplus
 extern "C" {
@@ -230,7 +230,7 @@ int ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base);
 * @param callback: this is called on completion of the resolution.
 * 	It is called as:
 * 	void callback(void* mydata, int rcode, void* packet, int packet_len,
- * 		int sec, char* why_bogus, int was_ratelimited)
+ * 		int sec, char* why_bogus)
 * 	with mydata: the same as passed here, you may pass NULL,
 * 	with rcode: 0 on no error, nonzero for mostly SERVFAIL situations,
 *		this is a DNS rcode.
@@ -241,7 +241,6 @@ int ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base);
 *	with packet_len: length in bytes of the packet buffer.
 *	with sec: 0 if insecure, 1 if bogus, 2 if DNSSEC secure.
 *	with why_bogus: text string explaining why it is bogus (or NULL).
- *	with was_ratelimited: if the query was ratelimited.
 *	These point to buffers inside unbound; do not deallocate the packet or
 *	error string.
 *
@@ -262,4 +261,4 @@ int ub_resolve_event(struct ub_ctx* ctx, const char* name, int rrtype,
 }
 #endif

-#endif /* UB_UNBOUND_EVENT_H */
+#endif /* _UB_UNBOUND_H */
@@ -4,22 +4,22 @@
 * Copyright (c) 2007, NLnet Labs. All rights reserved.
 *
 * This software is open source.
- *
+ * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
- *
+ * 
 * Redistributions of source code must retain the above copyright notice,
 * this list of conditions and the following disclaimer.
- *
+ * 
 * Redistributions in binary form must reproduce the above copyright notice,
 * this list of conditions and the following disclaimer in the documentation
 * and/or other materials provided with the distribution.
- *
+ * 
 * Neither the name of the NLNET LABS nor the names of its contributors may
 * be used to endorse or promote products derived from this software without
 * specific prior written permission.
- *
+ * 
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -36,7 +36,7 @@
 /**
 * \file
 *
- * This file contains functions to resolve DNS queries and
+ * This file contains functions to resolve DNS queries and 
 * validate the answers. Synchronously and asynchronously.
 *
 * Several ways to use this interface from an application wishing
@@ -65,7 +65,7 @@
 *	... or process() calls my_callback() with results.
 *
 *      ... if the application has nothing more to do, wait for answer
- *      ub_wait(ctx);
+ *      ub_wait(ctx); 
 *
 * Application threaded. Blocking.
 *	Blocking, same as above. The current thread does the work.
@@ -83,7 +83,7 @@
 * CRYPTO_set_id_callback and CRYPTO_set_locking_callback.
 *
 * If no threading is compiled in, the above async example uses fork(2) to
- * create a process to perform the work. The forked process exits when the
+ * create a process to perform the work. The forked process exits when the 
 * calling process exits, or ctx_delete() is called.
 * Otherwise, for asynchronous with threading, a worker thread is created.
 *
@@ -94,8 +94,8 @@
 * The second calls another worker thread (or process) to perform the work.
 * And no buffers need to be set up, but a context-switch happens.
 */
-#ifndef UB_UNBOUND_H
-#define UB_UNBOUND_H
+#ifndef _UB_UNBOUND_H
+#define _UB_UNBOUND_H

 #ifdef __cplusplus
 extern "C" {
@@ -128,10 +128,10 @@ struct ub_result {
 	/** the class asked for */
 	int qclass;

-	/**
-	 * a list of network order DNS rdata items, terminated with a
+	/** 
+	 * a list of network order DNS rdata items, terminated with a 
 	 * NULL pointer, so that data[0] is the first result entry,
-	 * data[1] the second, and the last entry is NULL.
+	 * data[1] the second, and the last entry is NULL. 
 	 * If there was no data, data[0] is NULL.
 	 */
 	char** data;
@@ -139,8 +139,8 @@ struct ub_result {
 	/** the length in bytes of the data items, len[i] for data[i] */
 	int* len;

-	/**
-	 * canonical name for the result (the final cname).
+	/** 
+	 * canonical name for the result (the final cname). 
 	 * zero terminated string.
 	 * May be NULL if no canonical name exists.
 	 */
@@ -165,9 +165,9 @@ struct ub_result {
 	 */
 	int havedata;

-	/**
+	/** 
 	 * If there was no data, and the domain did not exist, this is true.
-	 * If it is false, and there was no data, then the domain name
+	 * If it is false, and there was no data, then the domain name 
 	 * is purported to exist, but the requested data type is not available.
 	 */
 	int nxdomain;
@@ -182,19 +182,19 @@ struct ub_result {
 	 */
 	int secure;

-	/**
-	 * If the result was not secure (secure==0), and this result is due
+	/** 
+	 * If the result was not secure (secure==0), and this result is due 
 	 * to a security failure, bogus is true.
 	 * This means the data has been actively tampered with, signatures
-	 * failed, expected signatures were not present, timestamps on
+	 * failed, expected signatures were not present, timestamps on 
 	 * signatures were out of date and so on.
 	 *
-	 * If !secure and !bogus, this can happen if the data is not secure
-	 * because security is disabled for that domain name.
+	 * If !secure and !bogus, this can happen if the data is not secure 
+	 * because security is disabled for that domain name. 
 	 * This means the data is from a domain where data is not signed.
 	 */
 	int bogus;
-
+	
 	/**
 	 * If the result is bogus this contains a string (zero terminated)
 	 * that describes the failure.  There may be other errors as well
@@ -222,7 +222,7 @@ struct ub_result {
 * The readable function definition looks like:
 * void my_callback(void* my_arg, int err, struct ub_result* result);
 * It is called with
- *	void* my_arg: your pointer to a (struct of) data of your choice,
+ *	void* my_arg: your pointer to a (struct of) data of your choice, 
 *		or NULL.
 *	int err: if 0 all is OK, otherwise an error occurred and no results
 *	     are forthcoming.
@@ -301,8 +301,8 @@ int ub_ctx_set_option(struct ub_ctx* ctx, const char* opt, const char* val);
 * 	This is a power-users interface that lets you specify all sorts
 * 	of options.
 * @param str: the string is malloced and returned here. NULL on error.
- * 	The caller must free() the string.  In cases with multiple
- * 	entries (auto-trust-anchor-file), a newline delimited list is
+ * 	The caller must free() the string.  In cases with multiple 
+ * 	entries (auto-trust-anchor-file), a newline delimited list is 
 * 	returned in the string.
 * @return 0 if OK else an error code (malloc failure, syntax error).
 */
@@ -321,10 +321,10 @@ int ub_ctx_get_option(struct ub_ctx* ctx, const char* opt, char** str);
 int ub_ctx_config(struct ub_ctx* ctx, const char* fname);

 /**
- * Set machine to forward DNS queries to, the caching resolver to use.
- * IP4 or IP6 address. Forwards all DNS requests to that machine, which
- * is expected to run a recursive resolver. If the proxy is not
- * DNSSEC-capable, validation may fail. Can be called several times, in
+ * Set machine to forward DNS queries to, the caching resolver to use. 
+ * IP4 or IP6 address. Forwards all DNS requests to that machine, which 
+ * is expected to run a recursive resolver. If the proxy is not 
+ * DNSSEC-capable, validation may fail. Can be called several times, in 
 * that case the addresses are used as backup servers.
 *
 * To read the list of nameservers from /etc/resolv.conf (from DHCP or so),
@@ -389,7 +389,7 @@ int ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname);

 /**
 * Read list of hosts from the filename given.
- * Usually "/etc/hosts".
+ * Usually "/etc/hosts". 
 * These addresses are not flagged as DNSSEC secure when queried for.
 *
 * @param ctx: context.
@@ -403,7 +403,7 @@ int ub_ctx_hosts(struct ub_ctx* ctx, const char* fname);
 /**
 * Add a trust anchor to the given context.
 * The trust anchor is a string, on one line, that holds a valid DNSKEY or
- * DS RR.
+ * DS RR. 
 * @param ctx: context.
 *	At this time it is only possible to add trusted keys before the
 *	first resolve is done.
@@ -465,7 +465,7 @@ int ub_ctx_debugout(struct ub_ctx* ctx, void* out);
 * Set debug verbosity for the context
 * Output is directed to stderr.
 * @param ctx: context.
- * @param d: debug level, 0 is off, 1 is very minimal, 2 is detailed,
+ * @param d: debug level, 0 is off, 1 is very minimal, 2 is detailed, 
 *	and 3 is lots.
 * @return 0 if OK, else error.
 */
@@ -474,10 +474,10 @@ int ub_ctx_debuglevel(struct ub_ctx* ctx, int d);
 /**
 * Set a context behaviour for asynchronous action.
 * @param ctx: context.
- * @param dothread: if true, enables threading and a call to resolve_async()
+ * @param dothread: if true, enables threading and a call to resolve_async() 
 *	creates a thread to handle work in the background.
 *	If false, a process is forked to handle work in the background.
- *	Changes to this setting after async() calls have been made have
+ *	Changes to this setting after async() calls have been made have 
 *	no effect (delete and re-create the context to change).
 * @return 0 if OK, else error.
 */
@@ -495,7 +495,7 @@ int ub_poll(struct ub_ctx* ctx);

 /**
 * Wait for a context to finish with results. Calls ub_process() after
- * the wait for you. After the wait, there are no more outstanding
+ * the wait for you. After the wait, there are no more outstanding 
 * asynchronous queries.
 * @param ctx: context.
 * @return: 0 if OK, else error.
@@ -530,11 +530,11 @@ int ub_process(struct ub_ctx* ctx);
 * @param rrtype: type of RR in host order, 1 is A (address).
 * @param rrclass: class of RR in host order, 1 is IN (for internet).
 * @param result: the result data is returned in a newly allocated result
- * 	structure. May be NULL on return, return value is set to an error
+ * 	structure. May be NULL on return, return value is set to an error 
 * 	in that case (out of memory).
 * @return 0 if OK, else error.
 */
-int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype,
+int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype, 
 	int rrclass, struct ub_result** result);

 /**
@@ -561,13 +561,57 @@ int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype,
 * 	If an error happens during processing, your callback will be called
 * 	with error set to a nonzero value (and result==NULL).
 * @param async_id: if you pass a non-NULL value, an identifier number is
- *	returned for the query as it is in progress. It can be used to
+ *	returned for the query as it is in progress. It can be used to 
 *	cancel the query.
 * @return 0 if OK, else error.
 */
-int ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype,
+int ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype, 
 	int rrclass, void* mydata, ub_callback_type callback, int* async_id);

+/**
+* Transmit a wire-encoded query packet directly to a nameserver.
+* @param ctx: context.
+* 	The context is finalized, and can no longer accept config changes.
+* @param packet: wire-encoded query packet.
+* @param length: length of encoded query packet.
+* @param result: the reply packet, together with its validation status,
+* 	is returned in a newly allocated result structure.
+* 	May be NULL on return, in which case an error code is returned.
+* @return 0 if OK, else error.
+*/
+int ub_send(struct ub_ctx* ctx, const char* packet, int length,
+	struct ub_result** result);
+
+/**
+* Transmit a wire-encoded query packet directly to a nameserver.
+* Asynchronous, after a while, the callback will be called with your
+* data and the result.
+* @param ctx: context.
+* 	If no thread or process has been created yet to perform the
+* 	work in the background, it is created now.
+* 	The context is finalized, and can no longer accept config changes.
+* @param packet: wire-encoded query packet.
+* @param length: length of encoded query packet.
+* @param mydata: this data is your own data (you can pass NULL),
+* 	and is passed on to the callback function.
+* @param callback: this is called on completion of the resolution.
+* 	It is called as:
+* 	void callback(void* mydata, int err, struct ub_result* result)
+* 	with mydata: the same as passed here, you may pass NULL,
+* 	with err: is 0 when a result has been found.
+* 	with result: a newly allocated result structure.
+* 		The result may be NULL, in that case err is set.
+*
+* 	If an error happens during processing, your callback will be called
+* 	with error set to a nonzero value (and result==NULL).
+* @param async_id: if you pass a non-NULL value, an identifier number is
+* 	returned for the query as it is in progress. It can be used to
+* 	cancel the query.
+* @return 0 if OK, else error.
+*/
+int ub_send_async(struct ub_ctx* ctx, const char* packet, int length,
+	void* mydata, ub_callback_type callback, int* async_id);
+
 /**
 * Cancel an async query in progress.
 * Its callback will not be called.
@@ -589,7 +633,7 @@ int ub_cancel(struct ub_ctx* ctx, int async_id);
 */
 void ub_resolve_free(struct ub_result* result);

-/**
+/** 
 * Convert error value to a human readable string.
 * @param err: error code from one of the libunbound functions.
 * 	The error codes are from the type enum ub_ctx_err.
@@ -605,7 +649,7 @@ const char* ub_strerror(int err);
 int ub_ctx_print_local_zones(struct ub_ctx* ctx);

 /**
- * Add a new zone with the zonetype to the local authority info of the
+ * Add a new zone with the zonetype to the local authority info of the 
 * library.
 * @param ctx: context.  Is finalized by the routine.
 * @param zone_name: name of the zone in text, "example.com"
@@ -613,7 +657,7 @@ int ub_ctx_print_local_zones(struct ub_ctx* ctx);
 * @param zone_type: type of the zone (like for unbound.conf) in text.
 * @return 0 if OK, else error.
 */
-int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name,
+int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name, 
 	const char *zone_type);

 /**
@@ -649,7 +693,7 @@ int ub_ctx_data_remove(struct ub_ctx* ctx, const char *data);
 */
 const char* ub_version(void);

-/**
+/** 
 * Some global statistics that are not in struct stats_info,
 * this struct is shared on a shm segment (shm-key in unbound.conf)
 */
@@ -695,22 +739,13 @@ struct ub_server_stats {
 	long long num_queries;
 	/** number of queries that have been dropped/ratelimited by ip. */
 	long long num_queries_ip_ratelimited;
-	/** number of queries with a valid DNS Cookie. */
-	long long num_queries_cookie_valid;
-	/** number of queries with only the client part of the DNS Cookie. */
-	long long num_queries_cookie_client;
-	/** number of queries with invalid DNS Cookie. */
-	long long num_queries_cookie_invalid;
 	/** number of queries that had a cache-miss. */
 	long long num_queries_missed_cache;
 	/** number of prefetch queries - cachehits with prefetch */
 	long long num_queries_prefetch;
-	/** number of queries which are too late to process */
-	long long num_queries_timed_out;
-	/** the longest wait time in the queue */
-	long long max_query_time_us;
+
 	/**
-	 * Sum of the querylistsize of the worker for
+	 * Sum of the querylistsize of the worker for 
 	 * every query that missed cache. To calculate average.
 	 */
 	long long sum_query_list_size;
@@ -782,12 +817,12 @@ struct ub_server_stats {
 	long long tcp_accept_usage;
 	/** expired answers served from cache */
 	long long ans_expired;
-	/** histogram data exported to array
+	/** histogram data exported to array 
 	 * if the array is the same size, no data is lost, and
 	 * if all histograms are same size (is so by default) then
 	 * adding up works well. */
 	long long hist[UB_STATS_BUCKET_NUM];
-
+	
 	/** number of message cache entries */
 	long long msg_cache_count;
 	/** number of rrset cache entries */
@@ -797,11 +832,6 @@ struct ub_server_stats {
 	/** number of key cache entries */
 	long long key_cache_count;

-	/** maximum number of collisions in the msg cache */
-	long long msg_cache_max_collisions;
-	/** maximum number of collisions in the rrset cache */
-	long long rrset_cache_max_collisions;
-
 	/** number of queries that used dnscrypt */
 	long long num_query_dnscrypt_crypted;
 	/** number of queries that queried dnscrypt certificates */
@@ -833,8 +863,6 @@ struct ub_server_stats {
 	/** number of queries answered from edns-subnet specific data, and
 	 * the answer was from the edns-subnet cache. */
 	long long num_query_subnet_cache;
-	/** number of queries served from cachedb */
-	long long num_query_cachedb;
 	/** number of bytes in the stream wait buffers */
 	long long mem_stream_wait;
 	/** number of bytes in the HTTP2 query buffers */
@@ -845,19 +873,9 @@ struct ub_server_stats {
 	long long qtls_resume;
 	/** RPZ action stats */
 	long long rpz_action[UB_STATS_RPZ_ACTION_NUM];
-	/** number of bytes in QUIC buffers */
-	long long mem_quic;
-	/** number of queries over (DNS over) QUIC */
-	long long qquic;
-	/** number of queries removed due to discard-timeout */
-	long long num_queries_discard_timeout;
-	/** number of queries removed due to wait-limit */
-	long long num_queries_wait_limit;
-	/** number of dns error reports generated */
-	long long num_dns_error_reports;
 };

-/**
+/** 
 * Statistics to send over the control pipe when asked
 * This struct is made to be memcopied, sent in binary.
 * shm mapped with (number+1) at num_threads+1, with first as total
@@ -886,4 +904,4 @@ struct ub_stats_info {
 }
 #endif

-#endif /* UB_UNBOUND_H */
+#endif /* _UB_UNBOUND_H */
@@ -45,24 +45,20 @@ usage () {
 Usage $0: [-h] [-s] [-u git_url] [-b git_branch] [-w ...args...]
 Generate a distribution tar file for unbound.

-    -h                  This usage information.
-    -s                  Build a snapshot distribution file.  The current date is
-                        automatically appended to the current unbound version number.
-    -rc <nr>            Build a release candidate, the given string will be added
-                        to the version number
-                        (which will then be unbound-<version>rc<number>)
-    -u git_url          Retrieve the source from the specified repository url.
-                        Detected from the working copy if not specified.
-    -b git_branch       Retrieve the specified branch or tag.
-                        Detected from the working copy if not specified.
+    -h           This usage information.
+    -s           Build a snapshot distribution file.  The current date is
+                 automatically appended to the current unbound version number.
+    -rc <nr>     Build a release candidate, the given string will be added
+                 to the version number 
+                 (which will then be unbound-<version>rc<number>)
+    -u git_url   Retrieve the source from the specified repository url.
+                 Detected from the working copy if not specified.
+    -b git_branch Retrieve the the specified branch or tag.
+                 Detected from the working copy if not specified.
    -wssl openssl.xx.tar.gz Also build openssl from tarball for windows dist.
    -wxp expat.xx.tar.gz Also build expat from tarball for windows dist.
-    -wdir directory     Build openssl and expat in a persistent directory for
-                        windows dist. If builds are already in that directory
-                        they are used right away. Useful when debuggin windows
-                        builds.
-    -w32                32bit windows compile.
-    -w ...              Build windows binary dist. last args passed to configure.
+    -w32	 32bit windows compile.
+    -w ...       Build windows binary dist. last args passed to configure.
 EOF
    exit 1
 }
@@ -147,16 +143,6 @@ create_temp_dir () {
    cd $temp_dir
 }

-activate_windebug_dir () {
-    info "Activating persistent directory for windows build."
-    if test ! -d "$WINDIR"; then
-        mkdir -p "$WINDIR"
-        info "Created $WINDIR persistent directory."
-    fi
-    cd "$WINDIR"
-    WINDIR="`pwd`"
-}
-
 # pass filename as $1 arg.
 # creates file.sha1 and file.sha256
 storehash () {
@@ -201,9 +187,7 @@ DOWIN="no"
 W64="yes"
 WINSSL=""
 WINEXPAT=""
-WINDIR=""
-# Use environment if set otherwise null
-MINJ="${MINJ:+$MINJ}"
+MINJ=""

 # Parse the command line arguments.
 while [ "$1" ]; do
@@ -230,10 +214,6 @@ while [ "$1" ]; do
 	    WINEXPAT="$2"
 	    shift
 	    ;;
-        "-wdir")
-	    WINDIR="$2"
-	    shift
-	    ;;
 	"-w32")
 	    W64="no"
 	    ;;
@@ -273,27 +253,8 @@ if [ "$DOWIN" = "yes" ]; then
 	shared_cross_flag=""

 	check_git_repo
+	create_temp_dir

-	if test -n "$WINDIR"; then
-		activate_windebug_dir
-	else
-		create_temp_dir
-	fi
-
-	if test -n "$WINSSL" \
-		-a -n "$WINDIR" \
-		-a -d "$WINDIR" \
-		-a -d "${WINDIR}/sslinstall" \
-		-a -d "${WINDIR}/openssl_shared" \
-		-a -d "${WINDIR}/sslsharedinstall"; then
-		info "Found already compiled openssl at $WINDIR/sslinstall; using that."
-		WINSSL=""
-		# Variables needed later on.
-		sslinstall="${WINDIR}/sslinstall"
-		cross_flag="$cross_flag --with-ssl=$sslinstall"
-		sslsharedinstall="${WINDIR}/sslsharedinstall"
-		shared_cross_flag="$shared_cross_flag --with-ssl=$sslsharedinstall"
-	fi
 	# crosscompile openssl for windows.
 	if test -n "$WINSSL"; then
 		info "Cross compile $WINSSL"
@@ -306,10 +267,10 @@ if [ "$DOWIN" = "yes" ]; then
 		# cross-compilation and it is not used anyway
 		# before 1.0.1i need --cross-compile-prefix=i686-w64-mingw32-
 		if test "$mw64" = "mingw64"; then
-			sslflags="no-asm no-tests -DOPENSSL_NO_CAPIENG mingw64"
+			sslflags="no-asm -DOPENSSL_NO_CAPIENG mingw64"
 			sspdll="/usr/x86_64-w64-mingw32/sys-root/mingw/bin/libssp-0.dll"
 		else
-			sslflags="no-asm no-tests -DOPENSSL_NO_CAPIENG mingw"
+			sslflags="no-asm -DOPENSSL_NO_CAPIENG mingw"
 			sspdll="/usr/i686-w64-mingw32/sys-root/mingw/bin/libssp-0.dll"
 		fi
 		if test -f "$sspdll"; then
@@ -321,18 +282,9 @@ if [ "$DOWIN" = "yes" ]; then
 			SSPLIB=""
 		fi
 		info "winssl: Configure no-shared $sslflags"
-		if test "$W64" = "no"; then
-			# Disable stack-protector for 32-bit windows builds.
-			# mingw passes an LDFLAGS, so there is something
-			# passed in the LDFLAGS to stop -lssp passed in it.
-			set -x # echo the configure command
-			__CNF_LDLIBS=$SSPLIB __CNF_LDFLAGS="-fno-stack-protector" CC=${warch}-w64-mingw32-gcc AR=${warch}-w64-mingw32-ar RANLIB=${warch}-w64-mingw32-ranlib WINDRES=${warch}-w64-mingw32-windres ./Configure --prefix="$sslinstall" no-shared $sslflags || error_cleanup "OpenSSL Configure failed"
-			set +x
-		else
-			set -x # echo the configure command
-			__CNF_LDLIBS=$SSPLIB CC=${warch}-w64-mingw32-gcc AR=${warch}-w64-mingw32-ar RANLIB=${warch}-w64-mingw32-ranlib WINDRES=${warch}-w64-mingw32-windres ./Configure --prefix="$sslinstall" no-shared $sslflags || error_cleanup "OpenSSL Configure failed"
-			set +x
-		fi
+		set -x # echo the configure command
+		__CNF_LDLIBS=$SSPLIB CC=${warch}-w64-mingw32-gcc AR=${warch}-w64-mingw32-ar RANLIB=${warch}-w64-mingw32-ranlib WINDRES=${warch}-w64-mingw32-windres ./Configure --prefix="$sslinstall" no-shared $sslflags || error_cleanup "OpenSSL Configure failed"
+		set +x
 		info "winssl: make"
 		make $MINJ || error_cleanup "OpenSSL crosscompile failed"
 		# only install sw not docs, which take a long time.
@@ -345,15 +297,9 @@ if [ "$DOWIN" = "yes" ]; then
 		sslsharedinstall="`pwd`/sslsharedinstall"
 		cd openssl_shared
 		info "winssl: Configure shared $sslflags"
-		if test "$W64" = "no"; then
-			set -x # echo the configure command
-			__CNF_LDLIBS=$SSPLIB __CNF_LDFLAGS="-fno-stack-protector" CC=${warch}-w64-mingw32-gcc AR=${warch}-w64-mingw32-ar RANLIB=${warch}-w64-mingw32-ranlib WINDRES=${warch}-w64-mingw32-windres ./Configure --prefix="$sslsharedinstall" shared $sslflags || error_cleanup "OpenSSL Configure failed"
-			set +x
-		else
-			set -x # echo the configure command
-			__CNF_LDLIBS=$SSPLIB CC=${warch}-w64-mingw32-gcc AR=${warch}-w64-mingw32-ar RANLIB=${warch}-w64-mingw32-ranlib WINDRES=${warch}-w64-mingw32-windres ./Configure --prefix="$sslsharedinstall" shared $sslflags || error_cleanup "OpenSSL Configure failed"
-			set +x
-		fi
+		set -x # echo the configure command
+		__CNF_LDLIBS=$SSPLIB CC=${warch}-w64-mingw32-gcc AR=${warch}-w64-mingw32-ar RANLIB=${warch}-w64-mingw32-ranlib WINDRES=${warch}-w64-mingw32-windres ./Configure --prefix="$sslsharedinstall" shared $sslflags || error_cleanup "OpenSSL Configure failed"
+		set +x
 		info "winssl: make"
 		make $MINJ || error_cleanup "OpenSSL crosscompile failed"
 		info "winssl: make install_sw"
@@ -362,17 +308,6 @@ if [ "$DOWIN" = "yes" ]; then
 		cd ..
 	fi

-	if test -n "$WINEXPAT" \
-		-a -n "$WINDIR" \
-		-a -d "$WINDIR" \
-		-a -d "${WINDIR}/wxpinstall"; then
-		info "Found already compiled expat at $WINDIR/wxpinstall; using that."
-		WINEXPAT=""
-		# Variables needed later on.
-		wxpinstall="${WINDIR}/wxpinstall"
-		cross_flag="$cross_flag --with-libexpat=$wxpinstall"
-		shared_cross_flag="$shared_cross_flag --with-libexpat=$wxpinstall"
-	fi
 	if test -n "$WINEXPAT"; then
 		info "Cross compile $WINEXPAT"
 		info "wxp: tar unpack"
@@ -380,16 +315,7 @@ if [ "$DOWIN" = "yes" ]; then
 		wxpinstall="`pwd`/wxpinstall"
 		cd expat-* || error_cleanup "no expat-X dir in tarball"
 		info "wxp: configure"
-		if test "$W64" = "no"; then
-			# Disable stack-protector for 32-bit windows builds.
-			set -x # echo the configure command
-			$configure --prefix="$wxpinstall" --exec-prefix="$wxpinstall" --bindir="$wxpinstall/bin" --includedir="$wxpinstall/include" --mandir="$wxpinstall/man" --libdir="$wxpinstall/lib" LDFLAGS="-fno-stack-protector" || error_cleanup "libexpat configure failed"
-			set +x
-		else
-			set -x # echo the configure command
-			$configure --prefix="$wxpinstall" --exec-prefix="$wxpinstall" --bindir="$wxpinstall/bin" --includedir="$wxpinstall/include" --mandir="$wxpinstall/man" --libdir="$wxpinstall/lib"  || error_cleanup "libexpat configure failed"
-			set +x
-		fi
+		$configure --prefix="$wxpinstall" --exec-prefix="$wxpinstall" --bindir="$wxpinstall/bin" --includedir="$wxpinstall/include" --mandir="$wxpinstall/man" --libdir="$wxpinstall/lib"  || error_cleanup "libexpat configure failed"
 		info "wxp: make"
 		make $MINJ || error_cleanup "libexpat crosscompile failed"
 		info "wxp: make install"
@@ -399,12 +325,8 @@ if [ "$DOWIN" = "yes" ]; then
 		cd ..
 	fi

-	if test -n "$WINDIR"; then
-		cd "$cwd"
-		create_temp_dir
-	fi
-	info "GITREPO   is $GITREPO"
-	info "GITBRANCH is $GITBRANCH"
+        info "GITREPO   is $GITREPO"
+        info "GITBRANCH is $GITBRANCH"
 	info "Exporting source from git."
 	info "git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound"
 	git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound || error_cleanup "git clone failed"
@@ -436,17 +358,13 @@ if [ "$DOWIN" = "yes" ]; then
 	replace_version "configure.ac" "$version" "$version2"
    	version="$version2"
    	info "Rebuilding configure script (autoconf) snapshot."
-	autoconf -f || error_cleanup "Autoconf failed."
-	autoheader -f || error_cleanup "Autoheader failed."
+    	autoconf || error_cleanup "Autoconf failed."
+    	autoheader || error_cleanup "Autoheader failed."
    	rm -r autom4te* || echo "ignored"
-	rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
    fi

    if test "`uname`" = "Linux"; then 
-	    cd ..
-	    cp -r unbound unbound_shared
-	    unbound_shared="`pwd`/unbound_shared"
-	    cd unbound
+	    (cd ..; cp -r unbound unbound_shared)
    fi

    # procedure for making unbound installer on mingw. 
@@ -460,15 +378,13 @@ if [ "$DOWIN" = "yes" ]; then
    fi
    if test "$W64" = "no"; then
 		# Disable stack-protector for 32-bit windows builds.
-		set -x
-		$configure --enable-debug --enable-static-exe --disable-flto --disable-gost $* $cross_flag "$file_flag" "$file2_flag" "$file3_flag" CFLAGS='-O2 -g -fno-stack-protector' LDFLAGS="-fno-stack-protector" \
+		echo "$configure"' --enable-debug --enable-static-exe --disable-flto --disable-gost '"$* $cross_flag" "$file_flag" "$file2_flag" "$file3_flag" CFLAGS='-O2 -g -fno-stack-protector'
+		$configure --enable-debug --enable-static-exe --disable-flto --disable-gost $* $cross_flag "$file_flag" "$file2_flag" "$file3_flag" CFLAGS='-O2 -g -fno-stack-protector'\
 		|| error_cleanup "Could not configure"
-		set +x
    else
-		set -x
+		echo "$configure"' --enable-debug --enable-static-exe --disable-flto --disable-gost '"$* $cross_flag"
 		$configure --enable-debug --enable-static-exe --disable-flto --disable-gost $* $cross_flag \
 		|| error_cleanup "Could not configure"
-		set +x
    fi
    info "Calling make"
 	make $MINJ || error_cleanup "Could not make"
@@ -476,18 +392,16 @@ if [ "$DOWIN" = "yes" ]; then

    if test "`uname`" = "Linux"; then 
    info "Make DLL"
-    cd $unbound_shared
+    cd ../unbound_shared
    if test "$W64" = "no"; then
 	# Disable stack-protector for 32-bit windows builds.
-		set -x
-		$configure --enable-debug --disable-flto --disable-gost $* $shared_cross_flag "$file_flag" "$file2_flag" "$file3_flag" CFLAGS='-O2 -g -fno-stack-protector' LDFLAGS="-fno-stack-protector" \
+		echo "$configure"' --enable-debug --disable-flto --disable-gost '"$* $shared_cross_flag" "$file_flag" "$file2_flag" "$file3_flag" CFLAGS='-O2 -g -fno-stack-protector'
+		$configure --enable-debug --disable-flto --disable-gost $* $shared_cross_flag "$file_flag" "$file2_flag" "$file3_flag" CFLAGS='-O2 -g -fno-stack-protector'\
 		|| error_cleanup "Could not configure"
-		set +x
    else
-		set -x
-		$configure --enable-debug --disable-flto --disable-gost $* $shared_cross_flag \
+		echo "$configure"' --enable-debug --disable-flto --disable-gost '"$* $shared_cross_flag"
+        $configure --enable-debug --disable-flto --disable-gost $* $shared_cross_flag \
 		|| error_cleanup "Could not configure"
-		set +x
    fi
    info "Calling make for DLL"
 	make $MINJ || error_cleanup "Could not make DLL"
@@ -516,26 +430,17 @@ if [ "$DOWIN" = "yes" ]; then
    cp ../unbound.exe ../unbound-anchor.exe ../unbound-host.exe ../unbound-control.exe ../unbound-checkconf.exe ../unbound-service-install.exe ../unbound-service-remove.exe ../LICENSE ../winrc/unbound-control-setup.cmd ../winrc/unbound-website.url ../winrc/service.conf ../winrc/README.txt ../contrib/create_unbound_ad_servers.cmd ../contrib/warmup.cmd ../contrib/unbound_cache.cmd .
    mkdir libunbound
    # test to see if lib or lib64 (for openssl 3.0.0) needs to be used
-    if test -f $sslsharedinstall/lib/libcrypto.dll.a; then
-	cp $sslsharedinstall/lib/libcrypto.dll.a libunbound/.
+    if test -f ../../sslsharedinstall/lib/libcrypto.dll.a; then
+	cp ../../sslsharedinstall/lib/libcrypto.dll.a libunbound/.
    else
-	cp $sslsharedinstall/lib64/libcrypto.dll.a libunbound/.
+	cp ../../sslsharedinstall/lib64/libcrypto.dll.a libunbound/.
    fi
-    if test -f $sslsharedinstall/lib/libssl.dll.a; then
-	cp $sslsharedinstall/lib/libssl.dll.a libunbound/.
+    if test -f ../../sslsharedinstall/lib/libssl.dll.a; then
+	cp ../../sslsharedinstall/lib/libssl.dll.a libunbound/.
    else
-	cp $sslsharedinstall/lib64/libssl.dll.a libunbound/.
+	cp ../../sslsharedinstall/lib64/libssl.dll.a libunbound/.
    fi
-    cp $unbound_shared/unbound.h               \
-	$unbound_shared/.libs/libunbound*.dll  \
-	$unbound_shared/.libs/libunbound.dll.a \
-	$unbound_shared/.libs/libunbound.a     \
-	$unbound_shared/.libs/libunbound*.def  \
-	$sslsharedinstall/bin/libcrypto*.dll   \
-	$sslsharedinstall/bin/libssl*.dll      \
-	$wxpinstall/bin/libexpat*.dll          \
-	$wxpinstall/lib/libexpat.dll.a         \
-	libunbound/.
+    cp ../../unbound_shared/unbound.h ../../unbound_shared/.libs/libunbound*.dll ../../unbound_shared/.libs/libunbound.dll.a ../../unbound_shared/.libs/libunbound.a ../../unbound_shared/.libs/libunbound*.def ../../sslsharedinstall/bin/libcrypto*.dll ../../sslsharedinstall/bin/libssl*.dll ../../wxpinstall/bin/libexpat*.dll ../../wxpinstall/lib/libexpat.dll.a libunbound/.
    if test -f "$sspdll"; then
 	    cp "$sspdll" libunbound/.
    fi
@@ -565,11 +470,6 @@ if [ "$DOWIN" = "yes" ]; then
    storehash unbound-$version.zip
    ls -lG unbound_setup_$version.exe
    ls -lG unbound-$version.zip
-
-    echo "create signed versions with:"
-    echo "  gpg --armor --detach-sign --digest-algo SHA256 unbound_setup_$version.exe"
-    echo "  gpg --armor --detach-sign --digest-algo SHA256 unbound-$version.zip"
-
    info "Done"
    exit 0
 fi
@@ -611,10 +511,9 @@ if [ `uname -s | grep -i -c darwin` -ne 0 ]; then
 fi

 info "Building configure script (autoreconf)."
-autoreconf -f || error_cleanup "Autoconf failed."
+autoreconf || error_cleanup "Autoconf failed."

 rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
-rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."

 info "Building lexer and parser."
 echo "#include \"config.h\"" > util/configlexer.c || error_cleanup "Failed to create configlexer"
@@ -657,9 +556,8 @@ fi

 if [ "$RECONFIGURE" = "yes" ]; then
    info "Rebuilding configure script (autoconf) snapshot."
-    autoreconf -f || error_cleanup "Autoconf failed."
+    autoreconf || error_cleanup "Autoconf failed."
    rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
-    rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
 fi

 replace_all doc/README
@@ -1,9 +1,9 @@
 def init(id, cfg):
-   log_info("pythonmod: init called, module id is %d port: %d script: %s" % (id, cfg.port, mod_env['script']))
+   log_info("pythonmod: init called, module id is %d port: %d script: %s" % (id, cfg.port, cfg.python_script))
   return True

 def init_standard(id, env):
-   log_info("pythonmod: init called, module id is %d port: %d script: %s" % (id, env.cfg.port, mod_env['script']))
+   log_info("pythonmod: init called, module id is %d port: %d script: %s" % (id, env.cfg.port, env.cfg.python_script))
   return True

 def deinit(id):
@@ -50,7 +50,7 @@ Script file must contain four compulsory functions:
 ::

   def init(id, cfg):
-      log_info("pythonmod: init called, module id is %d port: %d script: %s" % (id, cfg.port, mod_env['script']))
+      log_info("pythonmod: init called, module id is %d port: %d script: %s" % (id, cfg.port, cfg.python_script))
      return True


@@ -69,7 +69,7 @@ Script file must contain four compulsory functions:
 ::

    def init_standard(id, env):
-       log_info("pythonmod: init called, module id is %d port: %d script: %s" % (id, env.cfg.port, mod_env['script']))
+       log_info("pythonmod: init called, module id is %d port: %d script: %s" % (id, env.cfg.port, env.cfg.python_script))
       return True


@@ -129,7 +129,7 @@ config_file
   
   .. attribute:: ifs
   
-      List of interface description strings (IP addresses).
+      Interface description strings (IP addresses).

   .. attribute:: num_out_ifs
   
@@ -138,7 +138,7 @@ config_file

   .. attribute:: out_ifs
   
-      List of outgoing interface description strings (IP addresses).
+      Outgoing interface description strings (IP addresses).
      
   .. attribute:: root_hints
   
@@ -176,10 +176,6 @@ config_file
   
      Harden against spoofed glue (out of zone data).
   
-   .. attribute:: harden_unverified_glue
-
-      Harden against unverified glue.
-
   .. attribute:: harden_dnssec_stripped
   
      Harden against receiving no DNSSEC data for trust anchor.
@@ -343,5 +339,4 @@ config_file

   .. attribute:: python_script
   
-      Linked list of Python script files.
-      Deprecated; `mod_env['script']` should be used instead.
+      Python script file.
@@ -6,11 +6,8 @@ Global variables

 .. envvar:: mod_env

-   Module environment, it is the 'data' pointer for module-specific data
-   in :class:`pythonmod_env`.
-   It is initialized as a dictionary with the 'script' key pointing to the
-   module's python script.
-   It can be further populated during runtime for module-specific data.
+   Module environment, contains data pointer for module-specific data.
+   See :class:`pythonmod_env`.


 Predefined constants
@@ -80,7 +80,7 @@ def init_standard(id, env):
    ..note:: The previously accessible configuration options can now be found in
             env.cfg.
    """
-    log_info("python: inited script {}".format(mod_env['script']))
+    log_info("python: inited script {}".format(env.cfg.python_script))

    # Register EDNS option 65001 as a known EDNS option.
    if not register_edns_option(env, 65001, bypass_cache_stage=True,
@@ -34,9 +34,6 @@
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.
 '''
-
-import os
-
 #Try:
 # - dig @localhost nlnetlabs.nl +ednsopt=65002:
 #       This query *could* be answered from cache. If so, unbound will reply
@@ -245,36 +242,6 @@ def inplace_query_callback(qinfo, flags, qstate, addr, zone, region, **kwargs):
    return True


-def inplace_query_response_callback(qstate, response, **kwargs):
-    """
-    Function that will be registered as an inplace callback function.
-    It will be called after receiving a reply from a backend server.
-
-    :param qstate: module qstate. opt_lists are available here;
-    :param response: struct dns_msg. The reply received from the backend server;
-    :param **kwargs: Dictionary that may contain parameters added in a future
-                     release.
-    """
-    log_dns_msg(
-        "python: incoming reply from {}{}".format(qstate.reply.addr, os.linesep),
-        response.qinfo, response.rep
-    )
-    return True
-
-
-def inplace_edns_back_parsed_call(qstate, **kwargs):
-    """
-    Function that will be registered as an inplace callback function.
-    It will be called after EDNS is parsed on a reply from a backend server..
-
-    :param qstate: module qstate. opt_lists are available here;
-    :param **kwargs: Dictionary that may contain parameters added in a future
-                     release.
-    """
-    log_info("python: edns parsed")
-    return True
-
-
 def init_standard(id, env):
    """
    New version of the init function.
@@ -287,7 +254,7 @@ def init_standard(id, env):
             env.cfg.

    """
-    log_info("python: inited script {}".format(mod_env['script']))
+    log_info("python: inited script {}".format(env.cfg.python_script))

    # Register the inplace_reply_callback function as an inplace callback
    # function when answering a resolved query.
@@ -314,16 +281,6 @@ def init_standard(id, env):
    if not register_inplace_cb_query(inplace_query_callback, env, id):
        return False

-    # Register the inplace_edns_back_parsed_call function as an inplace callback
-    # for when a reply is received from a backend server.
-    if not register_inplace_cb_query_response(inplace_query_response_callback, env, id):
-        return False
-
-    # Register the inplace_edns_back_parsed_call function as an inplace callback
-    # for when EDNS is parsed on a reply from a backend server.
-    if not register_inplace_cb_edns_back_parsed_call(inplace_edns_back_parsed_call, env, id):
-        return False
-
    return True


@@ -87,7 +87,7 @@ def logDnsMsg(qstate):
    print "-"*100

 def init(id, cfg):
-   log_info("pythonmod: init called, module id is %d port: %d script: %s" % (id, cfg.port, mod_env['script']))
+   log_info("pythonmod: init called, module id is %d port: %d script: %s" % (id, cfg.port, cfg.python_script))
   return True

 def deinit(id):
@@ -86,20 +86,6 @@
     }
     return list;
   }
-
-   /* converts an array of strings (char**) to a List of strings */
-   PyObject* CharArrayAsStringList(char** array, int len) {
-     PyObject* list;
-     int i;
-
-     if(!array||len==0) return PyList_New(0);
-
-     list = PyList_New(len);
-     for (i=0; i < len; i++) {
-            PyList_SET_ITEM(list, i, PyString_FromString(array[i]));
-     }
-     return list;
-   }
 %}

 /* ************************************************************************************ *
@@ -204,7 +190,7 @@ struct query_info {

 %inline %{
   PyObject* dnameAsStr(PyObject* dname) {
-       char buf[LDNS_MAX_DOMAINLEN];
+       char buf[LDNS_MAX_DOMAINLEN+1];
       buf[0] = '\0';
       dname_str((uint8_t*)PyBytes_AsString(dname), buf);
       return PyString_FromString(buf);
@@ -966,9 +952,6 @@ struct config_str2list {
 /* ************************************************************************************ *
   Structure config_file
 * ************************************************************************************ */
-%ignore config_file::ifs;
-%ignore config_file::out_ifs;
-%ignore config_file::python_script;
 struct config_file {
   int verbosity;
   int stat_interval;
@@ -1009,7 +992,6 @@ struct config_file {
   int harden_short_bufsize;
   int harden_large_queries;
   int harden_glue;
-   int harden_unverified_glue;
   int harden_dnssec_stripped;
   int harden_referral_path;
   int use_caps_bits_for_id;
@@ -1053,25 +1035,6 @@ struct config_file {
   struct config_strlist* python_script;
 };

-%inline %{
-   PyObject* _get_ifs_tuple(struct config_file* cfg) {
-      return CharArrayAsStringList(cfg->ifs, cfg->num_ifs);
-   }
-   PyObject* _get_ifs_out_tuple(struct config_file* cfg) {
-      return CharArrayAsStringList(cfg->out_ifs, cfg->num_out_ifs);
-   }
-%}
-
-%extend config_file {
-   %pythoncode %{
-        ifs = property(_unboundmodule._get_ifs_tuple)
-        out_ifs = property(_unboundmodule._get_ifs_out_tuple)
-
-        def _deprecated_python_script(self): return "cfg.python_script is deprecated, you can use `mod_env['script']` instead."
-        python_script = property(_deprecated_python_script)
-   %}
-}
-
 /* ************************************************************************************ *
   ASN: Adding structures related to forwards_lookup and dns_cache_find_delegation
 * ************************************************************************************ */
@@ -1415,9 +1378,9 @@ struct delegpt* dns_cache_find_delegation(struct module_env* env,
        struct regional* region, struct dns_msg** msg, uint32_t timenow,
        int noexpiredabove, uint8_t* expiretop, size_t expiretoplen);
 int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
-        struct delegpt* dp, int supports_ipv4, int supports_ipv6, int use_nat64);
+        struct delegpt* dp, int supports_ipv4, int supports_ipv6);
 struct iter_hints_stub* hints_lookup_stub(struct iter_hints* hints,
-        uint8_t* qname, uint16_t qclass, struct delegpt* dp, int nolock);
+        uint8_t* qname, uint16_t qclass, struct delegpt* dp);

 /* Custom function to perform logic similar to the one in daemon/cachedump.c */
 struct delegpt* find_delegation(struct module_qstate* qstate, char *nm, size_t nmlen);
@@ -1434,7 +1397,6 @@ struct delegpt* find_delegation(struct module_qstate* qstate, char *nm, size_t n
    struct query_info qinfo;
    struct iter_hints_stub* stub;
    uint32_t timenow = *qstate->env->now;
-    int nolock = 0;

    regional_free_all(region);
    qinfo.qname = (uint8_t*)nm;
@@ -1447,8 +1409,7 @@ struct delegpt* find_delegation(struct module_qstate* qstate, char *nm, size_t n
        if(!dp)
            return NULL;
        if(iter_dp_is_useless(&qinfo, BIT_RD, dp,
-                qstate->env->cfg->do_ip4, qstate->env->cfg->do_ip6,
-                qstate->env->cfg->do_nat64)) {
+                qstate->env->cfg->do_ip4, qstate->env->cfg->do_ip6)) {
            if (dname_is_root((uint8_t*)nm))
                return NULL;
            nm = (char*)dp->name;
@@ -1457,12 +1418,9 @@ struct delegpt* find_delegation(struct module_qstate* qstate, char *nm, size_t n
            dname_str((uint8_t*)nm, b);
            continue;
        }
-        stub = hints_lookup_stub(qstate->env->hints, qinfo.qname,
-            qinfo.qclass, dp, nolock);
+        stub = hints_lookup_stub(qstate->env->hints, qinfo.qname, qinfo.qclass, dp);
        if (stub) {
-            struct delegpt* stubdp = delegpt_copy(stub->dp, region);
-            lock_rw_unlock(&qstate->env->hints->lock);
-            return stubdp;
+            return stub->dp;
        } else {
            return dp;
        }
@@ -1592,15 +1550,13 @@ int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
        struct comm_reply* repinfo, struct regional* region,
        struct timeval* start_time, int id, void* python_callback)
    {
-        PyObject *func = NULL, *py_edns = NULL, *py_qstate = NULL;
-        PyObject *py_opt_list_out = NULL, *py_qinfo = NULL;
-        PyObject *py_rep = NULL, *py_repinfo = NULL, *py_region = NULL;
+        PyObject *func, *py_edns, *py_qstate, *py_opt_list_out, *py_qinfo;
+        PyObject *py_rep, *py_repinfo, *py_region;
        PyObject *py_args = NULL, *py_kwargs = NULL, *result = NULL;
        int res = 0;
        double py_start_time = ((double)start_time->tv_sec) + ((double)start_time->tv_usec) / 1.0e6;

        PyGILState_STATE gstate = PyGILState_Ensure();
-
        func = (PyObject *) python_callback;
        py_edns = SWIG_NewPointerObj((void*) edns, SWIGTYPE_p_edns_data, 0);
        py_qstate = SWIG_NewPointerObj((void*) qstate,
@@ -1611,24 +1567,20 @@ int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
        py_rep = SWIG_NewPointerObj((void*) rep, SWIGTYPE_p_reply_info, 0);
        py_repinfo = SWIG_NewPointerObj((void*) repinfo, SWIGTYPE_p_comm_reply, 0);
        py_region = SWIG_NewPointerObj((void*) region, SWIGTYPE_p_regional, 0);
-        if(!(py_qinfo && py_qstate && py_rep && py_edns && py_opt_list_out
-                && py_region && py_repinfo)) {
-                log_err("pythonmod: swig pointer failure in python_inplace_cb_reply_generic");
-                goto out;
+        if(py_qinfo && py_qstate && py_rep && py_edns && py_opt_list_out
+                && py_region && py_repinfo) {
+                py_args = Py_BuildValue("(OOOiOOO)", py_qinfo, py_qstate, py_rep,
+                        rcode, py_edns, py_opt_list_out, py_region);
+                py_kwargs = Py_BuildValue("{s:O,s:d}", "repinfo", py_repinfo, "start_time",
+                          py_start_time);
+                if(py_args && py_kwargs) {
+                        result = PyObject_Call(func, py_args, py_kwargs);
+                } else {
+                        log_err("pythonmod: malloc failure in python_inplace_cb_reply_generic");
+                }
+        } else {
+                log_err("pythonmod: malloc failure in python_inplace_cb_reply_generic");
        }
-        py_args = Py_BuildValue("(OOOiOOO)", py_qinfo, py_qstate, py_rep,
-                rcode, py_edns, py_opt_list_out, py_region);
-        py_kwargs = Py_BuildValue("{s:O,s:d}", "repinfo", py_repinfo, "start_time",
-                py_start_time);
-        if(!(py_args && py_kwargs)) {
-                log_err("pythonmod: BuildValue failure in python_inplace_cb_reply_generic");
-                goto out;
-        }
-        result = PyObject_Call(func, py_args, py_kwargs);
-        if (result) {
-            res = PyInt_AsLong(result);
-        }
-out:
        Py_XDECREF(py_edns);
        Py_XDECREF(py_qstate);
        Py_XDECREF(py_opt_list_out);
@@ -1638,6 +1590,9 @@ out:
        Py_XDECREF(py_region);
        Py_XDECREF(py_args);
        Py_XDECREF(py_kwargs);
+        if (result) {
+            res = PyInt_AsLong(result);
+        }
        Py_XDECREF(result);
        PyGILState_Release(gstate);
        return res;
@@ -1685,34 +1640,29 @@ out:
        int res = 0;
        PyObject *func = python_callback;
        PyObject *py_args = NULL, *py_kwargs = NULL, *result = NULL;
-        PyObject *py_qinfo = NULL;
-        PyObject *py_qstate = NULL;
-        PyObject *py_addr = NULL;
-        PyObject *py_zone = NULL;
-        PyObject *py_region = NULL;

        PyGILState_STATE gstate = PyGILState_Ensure();

-        py_qinfo = SWIG_NewPointerObj((void*) qinfo, SWIGTYPE_p_query_info, 0);
-        py_qstate = SWIG_NewPointerObj((void*) qstate, SWIGTYPE_p_module_qstate, 0);
-        py_addr = SWIG_NewPointerObj((void *) addr, SWIGTYPE_p_sockaddr_storage, 0);
-        py_zone = PyBytes_FromStringAndSize((const char *)zone, zonelen);
-        py_region = SWIG_NewPointerObj((void*) region, SWIGTYPE_p_regional, 0);
-        if(!(py_qinfo && py_qstate && py_addr && py_zone && py_region)) {
-                log_err("pythonmod: swig pointer failure in python_inplace_cb_query_generic");
-                goto out;
+        PyObject *py_qinfo = SWIG_NewPointerObj((void*) qinfo, SWIGTYPE_p_query_info, 0);
+        PyObject *py_qstate = SWIG_NewPointerObj((void*) qstate, SWIGTYPE_p_module_qstate, 0);
+        PyObject *py_addr = SWIG_NewPointerObj((void *) addr, SWIGTYPE_p_sockaddr_storage, 0);
+        PyObject *py_zone = PyBytes_FromStringAndSize((const char *)zone, zonelen);
+        PyObject *py_region = SWIG_NewPointerObj((void*) region, SWIGTYPE_p_regional, 0);
+        if(py_qinfo && py_qstate && py_addr && py_zone && py_region) {
+                py_args = Py_BuildValue("(OiOOOO)", py_qinfo, flags, py_qstate, py_addr, py_zone, py_region);
+                py_kwargs = Py_BuildValue("{}");
+                if(py_args && py_kwargs) {
+                        result = PyObject_Call(func, py_args, py_kwargs);
+                        if (result) {
+                            res = PyInt_AsLong(result);
+                        }
+                } else {
+                        log_err("pythonmod: malloc failure in python_inplace_cb_query_generic");
+                }
+        } else {
+                log_err("pythonmod: malloc failure in python_inplace_cb_query_generic");
        }
-        py_args = Py_BuildValue("(OiOOOO)", py_qinfo, flags, py_qstate, py_addr, py_zone, py_region);
-        py_kwargs = Py_BuildValue("{}");
-        if(!(py_args && py_kwargs)) {
-                log_err("pythonmod: BuildValue failure in python_inplace_cb_query_generic");
-                goto out;
-        }
-        result = PyObject_Call(func, py_args, py_kwargs);
-        if (result) {
-            res = PyInt_AsLong(result);
-        }
-out:
+
        Py_XDECREF(py_qinfo);
        Py_XDECREF(py_qstate);
        Py_XDECREF(py_addr);
@@ -1736,105 +1686,6 @@ out:
        if (ret) Py_INCREF(py_cb);
        return ret;
    }
-
-    int python_inplace_cb_query_response(struct module_qstate* qstate,
-        struct dns_msg* response, int id, void* python_callback)
-    {
-        int res = 0;
-        PyObject *func = python_callback;
-        PyObject *py_qstate = NULL;
-        PyObject *py_response = NULL;
-        PyObject *py_args = NULL;
-        PyObject *py_kwargs = NULL;
-        PyObject *result = NULL;
-
-        PyGILState_STATE gstate = PyGILState_Ensure();
-
-        py_qstate = SWIG_NewPointerObj((void*) qstate, SWIGTYPE_p_module_qstate, 0);
-        py_response = SWIG_NewPointerObj((void*) response, SWIGTYPE_p_dns_msg, 0);
-        if(!(py_qstate && py_response)) {
-                log_err("pythonmod: swig pointer failure in python_inplace_cb_query_response");
-                goto out;
-        }
-        py_args = Py_BuildValue("(OO)", py_qstate, py_response);
-        py_kwargs = Py_BuildValue("{}");
-        if(!(py_args && py_kwargs)) {
-                log_err("pythonmod: BuildValue failure in python_inplace_cb_query_response");
-                goto out;
-        }
-        result = PyObject_Call(func, py_args, py_kwargs);
-        if (result) {
-            res = PyInt_AsLong(result);
-        }
-out:
-        Py_XDECREF(py_qstate);
-        Py_XDECREF(py_response);
-
-        Py_XDECREF(py_args);
-        Py_XDECREF(py_kwargs);
-        Py_XDECREF(result);
-
-        PyGILState_Release(gstate);
-
-        return res;
-    }
-
-    static int register_inplace_cb_query_response(PyObject* py_cb,
-        struct module_env* env, int id)
-    {
-        int ret = inplace_cb_register(python_inplace_cb_query_response,
-            inplace_cb_query_response, (void*) py_cb, env, id);
-        if (ret) Py_INCREF(py_cb);
-        return ret;
-    }
-
-    int python_inplace_cb_edns_back_parsed_call(struct module_qstate* qstate,
-        int id, void* python_callback)
-    {
-        int res = 0;
-        PyObject *func = python_callback;
-        PyObject *py_qstate = NULL;
-        PyObject *py_args = NULL;
-        PyObject *py_kwargs = NULL;
-        PyObject *result = NULL;
-
-        PyGILState_STATE gstate = PyGILState_Ensure();
-
-        py_qstate = SWIG_NewPointerObj((void*) qstate, SWIGTYPE_p_module_qstate, 0);
-        if(!py_qstate) {
-                log_err("pythonmod: swig pointer failure in python_inplace_cb_edns_back_parsed_call");
-                goto out;
-        }
-        py_args = Py_BuildValue("(O)", py_qstate);
-        py_kwargs = Py_BuildValue("{}");
-        if(!(py_args && py_kwargs)) {
-                log_err("pythonmod: BuildValue failure in python_inplace_cb_edns_back_parsed_call");
-                goto out;
-        }
-        result = PyObject_Call(func, py_args, py_kwargs);
-        if (result) {
-            res = PyInt_AsLong(result);
-        }
-out:
-        Py_XDECREF(py_qstate);
-
-        Py_XDECREF(py_args);
-        Py_XDECREF(py_kwargs);
-        Py_XDECREF(result);
-
-        PyGILState_Release(gstate);
-
-        return res;
-    }
-
-    static int register_inplace_cb_edns_back_parsed_call(PyObject* py_cb,
-        struct module_env* env, int id)
-    {
-        int ret = inplace_cb_register(python_inplace_cb_edns_back_parsed_call,
-            inplace_cb_edns_back_parsed, (void*) py_cb, env, id);
-        if (ret) Py_INCREF(py_cb);
-        return ret;
-    }
 %}
 /* C declarations */
 int inplace_cb_register(void* cb, enum inplace_cb_list_type type, void* cbarg,
@@ -1851,7 +1702,3 @@ static int register_inplace_cb_reply_servfail(PyObject* py_cb,
    struct module_env* env, int id);
 static int register_inplace_cb_query(PyObject *py_cb,
    struct module_env* env, int id);
-static int register_inplace_cb_query_response(PyObject *py_cb,
-    struct module_env* env, int id);
-static int register_inplace_cb_edns_back_parsed_call(PyObject *py_cb,
-    struct module_env* env, int id);
@@ -112,34 +112,6 @@ struct pythonmod_qstate {
 	PyObject* data;
 };

-/* The dict from __main__ could have remnants from a previous script
- * invocation, in a multi python module setup. Usually this is fine since newer
- * scripts will update their values. The obvious erroneous case is when mixing
- * python scripts that make use of both 'init' and 'init_standard'. This
- * results in 'init_standard' to persist on following scripts that don't use it
- * (thus not replacing it). This is also problematic in case where a script
- * does not define a required function but a previously loaded script did. The
- * current solution is to make sure to clean offensive remnants that influence
- * further parsing of the individual scripts.
- */
-static void
-clean_python_function_objects(PyObject* dict) {
-	const char* function_names[] = {
-		"init",
-		"init_standard",
-		"deinit",
-		"operate",
-		"inform_super"
-	};
-	size_t i;
-
-	for(i=0; i<sizeof(function_names)/sizeof(function_names[0]); i++) {
-		if(PyDict_GetItemString(dict, function_names[i]) != NULL) {
-			PyDict_DelItemString(dict, function_names[i]);
-		}
-	}
-};
-
 /* Generated */
 #ifndef S_SPLINT_S
 #include "pythonmod/interface.h"
@@ -280,24 +252,13 @@ cleanup:
 	Py_XDECREF(exc_tb);
 }

-/* we only want to unwind Python once at exit */
-static void
-pythonmod_atexit(void)
-{
-   log_assert(py_mod_count == 0);
-   log_assert(mainthr != NULL);
- 
-   PyEval_RestoreThread(mainthr);
-   Py_Finalize();
-}
-
 int pythonmod_init(struct module_env* env, int id)
 {
   int py_mod_idx = py_mod_count++;
-
+    
   /* Initialize module */
   FILE* script_py = NULL;
-   PyObject* py_init_arg = NULL, *res = NULL, *fname = NULL;
+   PyObject* py_init_arg, *res;
   PyGILState_STATE gil;
   int init_standard = 1, i = 0;
 #if PY_MAJOR_VERSION < 3
@@ -331,98 +292,47 @@ int pythonmod_init(struct module_env* env, int id)
   /* Initialize Python libraries */
   if (py_mod_count==1 && !Py_IsInitialized()) 
   {
-#if PY_VERSION_HEX >= 0x03080000
-      PyStatus status;
-      PyPreConfig preconfig;
-      PyConfig config;
-#endif
 #if PY_MAJOR_VERSION >= 3
      wchar_t progname[8];
      mbstowcs(progname, "unbound", 8);
 #else
      char *progname = "unbound";
 #endif
-#if PY_VERSION_HEX < 0x03080000
      Py_SetProgramName(progname);
-#else
-      /* Python must be preinitialized, before the PyImport_AppendInittab
-       * call. */
-      PyPreConfig_InitPythonConfig(&preconfig);
-      status = Py_PreInitialize(&preconfig);
-      if(PyStatus_Exception(status)) {
-	log_err("python exception in Py_PreInitialize: %s%s%s",
-		(status.func?status.func:""), (status.func?": ":""),
-		(status.err_msg?status.err_msg:""));
-	return 0;
-      }
-#endif
+      Py_NoSiteFlag = 1;
 #if PY_MAJOR_VERSION >= 3
      PyImport_AppendInittab(SWIG_name, (void*)SWIG_init);
 #endif
-#if PY_VERSION_HEX < 0x03080000
-      Py_NoSiteFlag = 1;
      Py_Initialize();
-#else
-      PyConfig_InitPythonConfig(&config);
-      status = PyConfig_SetString(&config, &config.program_name, progname);
-      if(PyStatus_Exception(status)) {
-	log_err("python exception in PyConfig_SetString(.. program_name ..): %s%s%s",
-		(status.func?status.func:""), (status.func?": ":""),
-		(status.err_msg?status.err_msg:""));
-	PyConfig_Clear(&config);
-	return 0;
-      }
-      config.site_import = 0;
-      status = Py_InitializeFromConfig(&config);
-      if(PyStatus_Exception(status)) {
-	log_err("python exception in Py_InitializeFromConfig: %s%s%s",
-		(status.func?status.func:""), (status.func?": ":""),
-		(status.err_msg?status.err_msg:""));
-	PyConfig_Clear(&config);
-	return 0;
-      }
-      PyConfig_Clear(&config);
-#endif
 #if PY_MAJOR_VERSION <= 2 || (PY_MAJOR_VERSION == 3 && PY_MINOR_VERSION <= 6)
      /* initthreads only for python 3.6 and older */
      PyEval_InitThreads();
 #endif
      SWIG_init();
      mainthr = PyEval_SaveThread();
-
-      /* register callback to unwind Python at exit */
-      atexit(pythonmod_atexit);
   }

   gil = PyGILState_Ensure();

   if (py_mod_count==1) {
      /* Initialize Python */
-      if(PyRun_SimpleString("import sys \n") < 0 ) {
-         log_err("pythonmod: cannot initialize core module: unboundmodule.py");
-         goto python_init_fail;
-      }
+      PyRun_SimpleString("import sys \n");
      PyRun_SimpleString("sys.path.append('.') \n");
-      PyRun_SimpleString("sys.path.append('"RUN_DIR"') \n");
-      PyRun_SimpleString("sys.path.append('"SHARE_DIR"') \n");
      if(env->cfg->directory && env->cfg->directory[0]) {
         char wdir[1524];
         snprintf(wdir, sizeof(wdir), "sys.path.append('%s') \n",
         env->cfg->directory);
         PyRun_SimpleString(wdir);
      }
-      if(PyRun_SimpleString("import site\n") < 0) {
-         log_err("pythonmod: cannot initialize core module: unboundmodule.py");
-         goto python_init_fail;
-      }
-      if(PyRun_SimpleString("sys.path.extend(site.getsitepackages())\n") < 0) {
-         log_err("pythonmod: cannot initialize core module: unboundmodule.py");
-         goto python_init_fail;
-      }
-      if(PyRun_SimpleString("from unboundmodule import *\n") < 0)
+      PyRun_SimpleString("sys.path.append('"RUN_DIR"') \n");
+      PyRun_SimpleString("sys.path.append('"SHARE_DIR"') \n");
+      PyRun_SimpleString("import distutils.sysconfig \n");
+      PyRun_SimpleString("sys.path.append(distutils.sysconfig.get_python_lib(1,0)) \n");
+      if (PyRun_SimpleString("from unboundmodule import *\n") < 0)
      {
         log_err("pythonmod: cannot initialize core module: unboundmodule.py");
-         goto python_init_fail;
+         PyGILState_Release(gil);
+         return 0;
      }
   }

@@ -438,32 +348,18 @@ int pythonmod_init(struct module_env* env, int id)
   if (script_py == NULL)
   {
      log_err("pythonmod: can't open file %s for reading", pe->fname);
-      goto python_init_fail;
+      PyGILState_Release(gil);
+      return 0;
   }

   /* Load file */
   pe->module = PyImport_AddModule("__main__");
-   Py_XINCREF(pe->module);
   pe->dict = PyModule_GetDict(pe->module);
-   Py_XINCREF(pe->dict);
-   clean_python_function_objects(pe->dict);
-
   pe->data = PyDict_New();
-   /* add the script filename to the global "mod_env" for trivial access */
-   fname = PyString_FromString(pe->fname);
-   if(PyDict_SetItemString(pe->data, "script", fname) < 0) {
-	log_err("pythonmod: could not add item to dictionary");
-	Py_XDECREF(fname);
-	goto python_init_fail;
-   }
-   Py_XDECREF(fname);
-   Py_XINCREF(pe->data);  /* reference will be stolen below */
-   if(PyModule_AddObject(pe->module, "mod_env", pe->data) < 0) {
-	log_err("pythonmod: could not add mod_env object");
-	Py_XDECREF(pe->data);  /* 2 times, here and on python_init_fail; */
-	                       /* on failure the reference is not stolen */
-	goto python_init_fail;
-   }
+   Py_XINCREF(pe->data);
+   PyModule_AddObject(pe->module, "mod_env", pe->data);
+
+   /* TODO: deallocation of pe->... if an error occurs */

   if (PyRun_SimpleFile(script_py, pe->fname) < 0) {
 #if PY_MAJOR_VERSION <= 2 || (PY_MAJOR_VERSION == 3 && PY_MINOR_VERSION < 9)
@@ -494,30 +390,18 @@ int pythonmod_init(struct module_env* env, int id)
      fstr = malloc(flen+1);
      if(!fstr) {
 	      log_err("malloc failure to print parse error");
-
-/* close the file */
-#if PY_MAJOR_VERSION < 3
-	      Py_XDECREF(PyFileObject);
-#else
+	      PyGILState_Release(gil);
 	      fclose(script_py);
-#endif
-
-	      goto python_init_fail;
+	      return 0;
      }
      fseek(script_py, 0, SEEK_SET);
      if(fread(fstr, flen, 1, script_py) < 1) {
 	      log_err("file read failed to print parse error: %s: %s",
 		pe->fname, strerror(errno));
-	      free(fstr);
-
-/* close the file */
-#if PY_MAJOR_VERSION < 3
-	      Py_XDECREF(PyFileObject);
-#else
+	      PyGILState_Release(gil);
 	      fclose(script_py);
-#endif
-
-	      goto python_init_fail;
+	      free(fstr);
+	      return 0;
      }
      fstr[flen] = 0;
      /* we compile the string, but do not run it, to stop side-effects */
@@ -525,26 +409,17 @@ int pythonmod_init(struct module_env* env, int id)
       * that we are expecting */
      (void)Py_CompileString(fstr, pe->fname, Py_file_input);
 #endif
-
      log_py_err();
-
-/* close the file */
-#if PY_MAJOR_VERSION < 3
-      Py_XDECREF(PyFileObject);
-#else
+      PyGILState_Release(gil);
      fclose(script_py);
-#endif
-
 #if PY_MAJOR_VERSION <= 2 || (PY_MAJOR_VERSION == 3 && PY_MINOR_VERSION < 9)
      /* no cleanup needed for python before 3.9 */
 #else
      /* cleanup for python 3.9 and newer */
      free(fstr);
 #endif
-      goto python_init_fail;
+      return 0;
   }
-
-/* close the file */
 #if PY_MAJOR_VERSION < 3
   Py_XDECREF(PyFileObject);
 #else
@@ -557,28 +432,28 @@ int pythonmod_init(struct module_env* env, int id)
      if ((pe->func_init = PyDict_GetItemString(pe->dict, "init")) == NULL)
      {
         log_err("pythonmod: function init is missing in %s", pe->fname);
-         goto python_init_fail;
+         PyGILState_Release(gil);
+         return 0;
      }
   }
-   Py_XINCREF(pe->func_init);
   if ((pe->func_deinit = PyDict_GetItemString(pe->dict, "deinit")) == NULL)
   {
      log_err("pythonmod: function deinit is missing in %s", pe->fname);
-      goto python_init_fail;
+      PyGILState_Release(gil);
+      return 0;
   }
-   Py_XINCREF(pe->func_deinit);
   if ((pe->func_operate = PyDict_GetItemString(pe->dict, "operate")) == NULL)
   {
      log_err("pythonmod: function operate is missing in %s", pe->fname);
-      goto python_init_fail;
+      PyGILState_Release(gil);
+      return 0;
   }
-   Py_XINCREF(pe->func_operate);
   if ((pe->func_inform = PyDict_GetItemString(pe->dict, "inform_super")) == NULL)
   {
      log_err("pythonmod: function inform_super is missing in %s", pe->fname);
-      goto python_init_fail;
+      PyGILState_Release(gil);
+      return 0;
   }
-   Py_XINCREF(pe->func_inform);

   if (init_standard)
   {
@@ -594,31 +469,21 @@ int pythonmod_init(struct module_env* env, int id)
   {
      log_err("pythonmod: Exception occurred in function init");
      log_py_err();
-      goto python_init_fail;
+      Py_XDECREF(res);
+      Py_XDECREF(py_init_arg);
+      PyGILState_Release(gil);
+      return 0;
   }

   Py_XDECREF(res);
   Py_XDECREF(py_init_arg);
   PyGILState_Release(gil);
-   return 1;

-python_init_fail:
-   Py_XDECREF(pe->module);
-   Py_XDECREF(pe->dict);
-   Py_XDECREF(pe->data);
-   Py_XDECREF(pe->func_init);
-   Py_XDECREF(pe->func_deinit);
-   Py_XDECREF(pe->func_operate);
-   Py_XDECREF(pe->func_inform);
-   Py_XDECREF(res);
-   Py_XDECREF(py_init_arg);
-   PyGILState_Release(gil);
-   return 0;
+   return 1;
 }

 void pythonmod_deinit(struct module_env* env, int id)
 {
-   int cbtype;
   struct pythonmod_env* pe = env->modinfo[id];
   if(pe == NULL)
      return;
@@ -638,24 +503,18 @@ void pythonmod_deinit(struct module_env* env, int id)
      /* Free result if any */
      Py_XDECREF(res);
      /* Free shared data if any */
-      Py_XDECREF(pe->module);
-      Py_XDECREF(pe->dict);
      Py_XDECREF(pe->data);
-      Py_XDECREF(pe->func_init);
-      Py_XDECREF(pe->func_deinit);
-      Py_XDECREF(pe->func_inform);
-      Py_XDECREF(pe->func_operate);
      PyGILState_Release(gil);

-      py_mod_count--;
+      if(--py_mod_count==0) {
+         PyEval_RestoreThread(mainthr);
+         Py_Finalize();
+         mainthr = NULL;
+      }
   }
   pe->fname = NULL;
   free(pe);

-   /* iterate over all possible callback types and clean up each in turn */
-   for (cbtype = 0; cbtype < inplace_cb_types_total; cbtype++)
-      inplace_cb_delete(env, cbtype, id);
-
   /* Module is deallocated in Python */
   env->modinfo[id] = NULL;
 }
@@ -777,8 +636,8 @@ size_t pythonmod_get_mem(struct module_env* env, int id)
 */
 static struct module_func_block pythonmod_block = {
   "python",
-   NULL, NULL, &pythonmod_init, &pythonmod_deinit, &pythonmod_operate,
-   &pythonmod_inform_super, &pythonmod_clear, &pythonmod_get_mem
+   &pythonmod_init, &pythonmod_deinit, &pythonmod_operate, &pythonmod_inform_super,
+   &pythonmod_clear, &pythonmod_get_mem
 };

 struct module_func_block* pythonmod_get_funcblock(void)
@@ -82,12 +82,4 @@ int python_inplace_cb_query_generic(
        uint8_t* zone, size_t zonelen, struct regional* region, int id,
        void* python_callback);

-/** Declared here for fptr_wlist access. The definition is in interface.i. */
-int python_inplace_cb_query_response(struct module_qstate* qstate,
-    struct dns_msg* response, int id, void* python_callback);
-
-/** Declared here for fptr_wlist access. The definition is in interface.i. */
-int python_inplace_cb_edns_back_parsed_call(struct module_qstate* qstate,
-    int id, void* python_callback);
-
 #endif /* PYTHONMOD_H */
@@ -73,7 +73,7 @@ int storeQueryInCache(struct module_qstate* qstate, struct query_info* qinfo,

 	return dns_cache_store(qstate->env, qinfo, msgrep, is_referral,
 		qstate->prefetch_leeway, 0, NULL, qstate->query_flags,
-		qstate->qstarttime, qstate->is_valrec);
+		qstate->qstarttime);
 }

 /* Invalidate the message associated with query_info stored in message cache */
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Willem Toorop	4014e2aec4	Expose symbols	2022-11-05 19:34:51 +01:00
Willem Toorop	f3c9be889f	Plumming for ub_send and ub_send_async	2022-11-05 18:50:57 +01:00
Willem Toorop	cd3ebb7e72	Funcion prototypes for ub_send and ub_send_async	2022-11-05 12:51:20 +01:00