Switch from SVCB to IDELEG(65280)

Cleaned up the code
Fixed memory error
2026-08-17 21:25:50 +02:00 · 2025-01-17 15:31:51 +01:00 · 2024-07-12 15:05:12 +02:00 · 2024-07-12 10:34:03 +02:00 · 2024-06-20 16:21:36 +02:00 · 2024-06-20 12:46:03 +02:00
570 changed files with 8257 additions and 64225 deletions
@@ -12,7 +12,6 @@ jobs:
  build:
    runs-on: ${{ matrix.os }}
    strategy:
-      fail-fast: false
      matrix:
        include:
          - name: GCC on Linux
@@ -49,6 +48,15 @@ jobs:
            os: ubuntu-latest
            config: 'CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=address" --disable-flto --disable-static'
            make_test: "yes"
+          - name: Apple iPhone on iOS, armv7
+            os: macos-latest
+            AUTOTOOLS_HOST: armv7-apple-ios
+            OPENSSL_HOST: ios-cross
+            IOS_SDK: iPhoneOS
+            IOS_CPU: armv7s
+            test_ios: "yes"
+            config: "no"
+            make: "no"
          - name: Apple iPhone on iOS, arm64
            os: macos-latest
            AUTOTOOLS_HOST: aarch64-apple-ios
@@ -76,6 +84,15 @@ jobs:
            test_ios: "yes"
            config: "no"
            make: "no"
+          - name: iPhoneSimulator on OS X, i386
+            os: macos-latest
+            AUTOTOOLS_HOST: i386-apple-ios
+            OPENSSL_HOST: iphoneos-cross
+            IOS_SDK: iPhoneSimulator
+            IOS_CPU: i386
+            test_ios: "yes"
+            config: "no"
+            make: "no"
          - name: iPhoneSimulator on OS X, x86_64
            os: macos-latest
            AUTOTOOLS_HOST: x86_64-apple-ios
@@ -144,44 +161,13 @@ jobs:
            test_windows: "yes"
            config: "no"
            make: "no"
-          - name: FreeBSD
-            os: ubuntu-latest
-            config: "no"
-            make: "no"
-            with_cross_platform_action: "yes"
-            cross_platform_os: "freebsd"
-            cross_platform_arch: "x86-64"
-            cross_platform_version: "14.1"
-            cross_platform_config: "--enable-debug --disable-flto --with-libevent --disable-static"
-          - name: OpenBSD
-            os: ubuntu-latest
-            config: "no"
-            make: "no"
-            with_cross_platform_action: "yes"
-            cross_platform_os: "openbsd"
-            cross_platform_arch: "x86-64"
-            cross_platform_version: "7.5"
-            cross_platform_config: "--enable-debug --disable-flto --with-libevent --disable-static"
-          - name: NetBSD
-            os: ubuntu-latest
-            config: "no"
-            make: "no"
-            with_cross_platform_action: "yes"
-            cross_platform_os: "netbsd"
-            cross_platform_arch: "x86-64"
-            cross_platform_version: "10.0"
-            cross_platform_config: "--enable-debug --disable-flto --with-libevent --disable-static"
 
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
        with:
          submodules: false
-          persist-credentials: false
      - name: test_windows
        if: ${{ matrix.test_windows == 'yes' }}
-        env:
-          LIBEXPAT_FNAME: expat-2.7.0
-          LIBEXPAT_VERSION_DIR: R_2_7_0
        shell: bash
        run: |
          export unboundpath=`pwd`
@@ -189,8 +175,6 @@ jobs:
          cd ..
          export prepath=`pwd`
          echo prepath=${prepath}
-          # parralel build option
-          export MINJ="-j4"
          echo "choco install winflexbison3"
          choco install winflexbison3
          echo 'LEX="win_flex"'
@@ -213,8 +197,8 @@ jobs:
          C:/msys64/usr/bin/perl ./Configure no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl" PERL="C:/msys64/usr/bin/perl"
          # make the libs only, build faster
          echo "make build_libs"
-          #make $MINJ
-          make $MINJ build_libs
+          #make
+          make build_libs
          mv Makefile Makefile.orig
          # fixup \\ in the installtop to /.
          echo "fixup INSTALLTOP"
@@ -226,9 +210,9 @@ jobs:
          cd ..
          mkdir expat
          echo "curl expat"
-          curl -L -k -s -S -o $LIBEXPAT_FNAME.tar.gz https://github.com/libexpat/libexpat/releases/download/$LIBEXPAT_VERSION_DIR/$LIBEXPAT_FNAME.tar.gz
-          tar xzf $LIBEXPAT_FNAME.tar.gz
-          cd $LIBEXPAT_FNAME
+          curl -L -k -s -S -o expat-2.2.10.tar.gz https://github.com/libexpat/libexpat/releases/download/R_2_2_10/expat-2.2.10.tar.gz
+          tar xzf expat-2.2.10.tar.gz
+          cd expat-2.2.10
          echo "./configure SHELL=/usr/bin/bash CONFIG_SHELL=/usr/bin/bash --prefix=\"$prepath/expat\" --exec-prefix=\"$prepath/expat\" --bindir=\"$prepath/expat/bin\" --includedir=\"$prepath/expat/include\" --mandir=\"$prepath/expat/man\" --libdir=\"$prepath/expat/lib\""
          ./configure SHELL=/usr/bin/bash CONFIG_SHELL=/usr/bin/bash --prefix="$prepath/expat" --exec-prefix="$prepath/expat" --bindir="$prepath/expat/bin" --includedir="$prepath/expat/include" --mandir="$prepath/expat/man" --libdir="$prepath/expat/lib"
          # fixup SHELL is treated specially, but SHELZZ is not by make.
@@ -246,7 +230,7 @@ jobs:
          mv xmlwf/Makefile xmlwf/Makefile.orig
          sed -e 's/SHELL/SHELLZZ/g' < xmlwf/Makefile.orig > xmlwf/Makefile
          echo "make"
-          make $MINJ
+          make
          echo "make install"
          make install
          cd ..
@@ -254,7 +238,7 @@ jobs:
          cd unbound
          echo "./configure --enable-debug --enable-static-exe --disable-flto \"--with-ssl=$prepath/openssl\" --with-libexpat=\"$prepath/expat\" --disable-shared"
          ./configure --enable-debug --enable-static-exe --disable-flto "--with-ssl=$prepath/openssl" --with-libexpat="$prepath/expat" --disable-shared
-          make $MINJ
+          make
          # specific test output
          #make testbound.exe; ./testbound.exe -s
          #make testbound; ./testbound.exe -p testdata/acl.rpl -o -vvvv
@@ -347,33 +331,6 @@ jobs:
          echo "::group::make install"
          make install
          echo "::endgroup::"
-      - name: cross-platform-action on ${{ matrix.cross_platform_os }} ${{ matrix.cross_platform_version }}
-        if: ${{ matrix.with_cross_platform_action == 'yes' }}
-        uses: cross-platform-actions/action@v1.0.0
-        env:
-          CROSS_PLATFORM_OS: ${{ matrix.cross_platform_os }}
-        with:
-          environment_variables: CROSS_PLATFORM_OS
-          operating_system: ${{ matrix.cross_platform_os }}
-          architecture: ${{ matrix.cross_platform_arch }}
-          version: ${{ matrix.cross_platform_version }}
-          shell: bash
-          memory: 4G
-          cpu_count: 2
-          run: |
-            set -e -x
-            if test "$CROSS_PLATFORM_OS" = "freebsd"; then sudo pkg install -y openssl libevent expat; fi
-            if test "$CROSS_PLATFORM_OS" = "openbsd"; then sudo pkg_add libevent; fi
-            if test "$CROSS_PLATFORM_OS" = "netbsd"; then sudo pkgin -y install libevent; fi
-            echo "::group::configure"
-            ./configure ${{ matrix.cross_platform_config }}
-            echo "::endgroup::"
-            echo "::group::make"
-            make
-            echo "::endgroup::"
-            echo "::group::make test"
-            make test
-            echo "::endgroup::"
      - name: install libevent
        if: ${{ matrix.install_libevent == 'yes' }}
        run: sudo apt-get install libevent-dev
@@ -12,9 +12,7 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-    - uses: actions/checkout@v6
-      with:
-        persist-credentials: false
+    - uses: actions/checkout@v4
    - name: configure
      run: ./configure --enable-debug
    - name: make
@@ -10,9 +10,6 @@
 /config.status
 /dnstap/dnstap_config.h
 /dnscrypt/dnscrypt_config.h
-/util/configlexer.c
-/util/configparser.c
-/util/configparser.h
 /clubsyms.def
 /doc/example.conf
 /doc/libunbound.3
@@ -36,7 +33,6 @@
 /asynclook
 /delayer
 /dohclient
-/doqclient
 /lock-verify
 /memstats
 /perf
@@ -59,7 +55,6 @@
 /pythonmod/unboundmodule.py
 /testdata/result.*
 /testdata/.done-*
-/testdata/.skip-*
 /testdata/.perfstats.txt
 /doc/html
 /doc/xml
@@ -4,7 +4,7 @@
 [![Packaging status](https://repology.org/badge/tiny-repos/unbound.svg)](https://repology.org/project/unbound/versions)
 [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/unbound.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:unbound)
 [![Documentation Status](https://readthedocs.org/projects/unbound/badge/?version=latest)](https://unbound.readthedocs.io/en/latest/?badge=latest)
-[![Mastodon Follow](https://img.shields.io/mastodon/follow/114692612288811644?domain=social.nlnetlabs.nl&style=social)](https://social.nlnetlabs.nl/@nlnetlabs)
+[![Mastodon Follow](https://img.shields.io/mastodon/follow/109262826617293067?domain=https%3A%2F%2Ffosstodon.org&style=social)](https://fosstodon.org/@nlnetlabs)

 Unbound is a validating, recursive, caching DNS resolver. It is designed to be
 fast and lean and incorporates modern features based on open standards. If you
@@ -25,21 +25,18 @@ Unbound can be compiled and installed using:
 ./configure && make && make install
 ```

-You can use libevent if you want. libevent is useful when using many (e.g.,
-10000) outgoing ports.
+You can use libevent if you want. libevent is useful when using many (10000)
+outgoing ports. By default max 256 ports are opened at the same time and the
+builtin alternative is equally capable and a little faster.
+
 Use the `--with-libevent` configure option to compile Unbound with libevent
 support.

-If not, the default builtin alternative opens max 256 ports at the same time
-and is equally capable and a little faster.
-
-
 ## Unbound configuration

-All of Unbound's configuration options are described in the `unbound.conf(5)`
-man page, which will be installed and is also available on the Unbound
-[documentation page](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html)
-for the latest version.
+All of Unbound's configuration options are described in the man pages, which
+will be installed and are available on the Unbound
+[documentation page](https://unbound.docs.nlnetlabs.nl/).

-An example configuration file, with minimal documentation, is located in
+An example configuration file is located in
 [doc/example.conf](https://github.com/NLnetLabs/unbound/blob/master/doc/example.conf.in).
@@ -2,12 +2,7 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 51
-# 2025-11-06 Fix ACX_CHECK_NONSTRING_ATTRIBUTE to reject clang, that prints
-#	     a warning for 'unknown attribute' when nonstring is used.
-# 2025-09-29 add ac_cv_func_malloc_0_nonnull as a cache value for the malloc(0)
-#            check by ACX_FUNC_MALLOC.
-# 2025-09-29 add ACX_CHECK_NONSTRING_ATTRIBUTE, AHX_CONFIG_NONSTRING_ATTRIBUTE.
+# Version 48
 # 2024-01-16 fix to add -l:libssp.a to -lcrypto link check.
 #	     and check for getaddrinfo with only header.
 # 2024-01-15 fix to add crypt32 to -lcrypto link check when checking for gdi32.
@@ -76,7 +71,6 @@
 # ACX_DEPFLAG			- find cc dependency flags.
 # ACX_DETERMINE_EXT_FLAGS_UNBOUND - find out which flags enable BSD and POSIX.
 # ACX_CHECK_FORMAT_ATTRIBUTE	- find cc printf format syntax.
-# ACX_CHECK_NONSTRING_ATTRIBUTE - find cc nonstring attribute syntax.
 # ACX_CHECK_UNUSED_ATTRIBUTE	- find cc variable unused syntax.
 # ACX_CHECK_FLTO		- see if cc supports -flto and use it if so.
 # ACX_LIBTOOL_C_ONLY		- create libtool for C only, improved.
@@ -98,7 +92,6 @@
 # ACX_FUNC_IOCTLSOCKET		- find ioctlsocket, portably.
 # ACX_FUNC_MALLOC		- check malloc, define replacement .
 # AHX_CONFIG_FORMAT_ATTRIBUTE	- config.h text for format.
-# AHX_CONFIG_NONSTRING_ATTRIBUTE - config.h text for nonstring.
 # AHX_CONFIG_UNUSED_ATTRIBUTE	- config.h text for unused.
 # AHX_CONFIG_FSEEKO		- define fseeko, ftello fallback.
 # AHX_CONFIG_RAND_MAX		- define RAND_MAX if needed.
@@ -497,7 +490,7 @@ AC_DEFUN([AHX_CONFIG_FORMAT_ATTRIBUTE],
 ])

 dnl Check how to mark function arguments as unused.
-dnl result in HAVE_ATTR_UNUSED.
+dnl result in HAVE_ATTR_UNUSED.  
 dnl Make sure you include AHX_CONFIG_UNUSED_ATTRIBUTE also.
 AC_DEFUN([ACX_CHECK_UNUSED_ATTRIBUTE],
 [AC_REQUIRE([AC_PROG_CC])
@@ -532,49 +525,6 @@ if test $ac_cv_c_unused_attribute = yes; then
 fi
 ])dnl

-dnl Check how to mark function arguments as nonstring.
-dnl result in HAVE_ATTR_NONSTRING.
-dnl Make sure you include AHX_CONFIG_NONSTRING_ATTRIBUTE also.
-AC_DEFUN([ACX_CHECK_NONSTRING_ATTRIBUTE],
-[AC_REQUIRE([AC_PROG_CC])
-AC_REQUIRE([ACX_CHECK_ERROR_FLAGS])
-BAKCFLAGS="$CFLAGS"
-CFLAGS="$CFLAGS $ERRFLAG"
-AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "nonstring" attribute)
-AC_CACHE_VAL(ac_cv_c_nonstring_attribute,
-[ac_cv_c_nonstring_attribute=no
-AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>
-struct test {
-    char __attribute__((nonstring)) s[1];
-};
-]], [[
-   struct test t = { "1" };
-   (void) t;
-]])],[ac_cv_c_nonstring_attribute="yes"],[ac_cv_c_nonstring_attribute="no"])
-CFLAGS="$BAKCFLAGS"
-])
-
-dnl Setup ATTR_NONSTRING config.h parts.
-dnl make sure you call ACX_CHECK_NONSTRING_ATTRIBUTE also.
-AC_DEFUN([AHX_CONFIG_NONSTRING_ATTRIBUTE],
-[
-#if defined(DOXYGEN)
-#  define ATTR_NONSTRING(x)  x
-#elif defined(__cplusplus)
-#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
-#elif defined(HAVE_ATTR_NONSTRING)
-#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
-#else /* !HAVE_ATTR_NONSTRING */
-#  define ATTR_NONSTRING(x)  x
-#endif /* !HAVE_ATTR_NONSTRING */
-])
-
-AC_MSG_RESULT($ac_cv_c_nonstring_attribute)
-if test $ac_cv_c_nonstring_attribute = yes; then
-  AC_DEFINE(HAVE_ATTR_NONSTRING, 1, [Whether the C compiler accepts the "nonstring" attribute])
-fi
-])dnl
-
 dnl Pre-fun for ACX_LIBTOOL_C_ONLY
 AC_DEFUN([ACX_LIBTOOL_C_PRE], [
 # skip these tests, we do not need them.
@@ -1240,9 +1190,8 @@ dnl detect malloc and provide malloc compat prototype.
 dnl $1: unique name for compat code
 AC_DEFUN([ACX_FUNC_MALLOC],
 [
-	AC_CACHE_CHECK([for GNU libc compatible malloc],[ac_cv_func_malloc_0_nonnull],
-	[
-		AC_RUN_IFELSE([AC_LANG_PROGRAM(
+	AC_MSG_CHECKING([for GNU libc compatible malloc])
+	AC_RUN_IFELSE([AC_LANG_PROGRAM(
 [[#if defined STDC_HEADERS || defined HAVE_STDLIB_H
 #include <stdlib.h>
 #else
@@ -1250,16 +1199,14 @@ char *malloc ();
 #endif
 ]], [ if(malloc(0) != 0) return 1;])
 ],
-		[ac_cv_func_malloc_0_nonnull=no],
-		[ac_cv_func_malloc_0_nonnull=yes],
-		[ac_cv_func_malloc_0_nonnull="no (crosscompile)"])
-	])
-	AS_IF([test "$ac_cv_func_malloc_0_nonnull" = yes],
-		[AC_DEFINE([HAVE_MALLOC], 1, [If have GNU libc compatible malloc])],
-	[
-		AC_LIBOBJ(malloc)
-		AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])
-	])
+	[AC_MSG_RESULT([no])
+	AC_LIBOBJ(malloc)
+	AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])] ,
+	[AC_MSG_RESULT([yes])
+	AC_DEFINE([HAVE_MALLOC], 1, [If have GNU libc compatible malloc])],
+	[AC_MSG_RESULT([no (crosscompile)])
+	AC_LIBOBJ(malloc)
+	AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])] )
 ])

 dnl Define fallback for fseeko and ftello if needed.
@@ -9,7 +9,7 @@ AC_DEFUN([AC_PYTHON_DEVEL],[

        AC_PATH_PROG([PYTHON],[python[$PYTHON_VERSION]])
        if test -z "$PYTHON"; then
-           AC_MSG_ERROR([Cannot find 'python$PYTHON_VERSION' in your system path. You can use the environment variable 'PYTHON_VERSION=version_number' for an explicit version.])
+           AC_MSG_ERROR([Cannot find python$PYTHON_VERSION in your system path])
           PYTHON_VERSION=""
        fi

@@ -1,70 +0,0 @@
-# ===========================================================================
-#   https://www.gnu.org/software/autoconf-archive/ax_build_date_epoch.html
-# ===========================================================================
-#
-# SYNOPSIS
-#
-#   AX_BUILD_DATE_EPOCH(VARIABLE[, FORMAT[, ACTION-IF-FAIL]])
-#
-# DESCRIPTION
-#
-#   Sets VARIABLE to a string representing the current time.  It is
-#   formatted according to FORMAT if specified, otherwise it is formatted as
-#   the number of seconds (excluding leap seconds) since the UNIX epoch (01
-#   Jan 1970 00:00:00 UTC).
-#
-#   If the SOURCE_DATE_EPOCH environment variable is set, it uses the value
-#   of that variable instead of the current time.  See
-#   https://reproducible-builds.org/specs/source-date-epoch).  If
-#   SOURCE_DATE_EPOCH is set but cannot be properly interpreted as a UNIX
-#   timestamp, then execute ACTION-IF-FAIL if specified, otherwise error.
-#
-#   VARIABLE is AC_SUBST-ed.
-#
-# LICENSE
-#
-#   Copyright (c) 2016 Eric Bavier <bavier@member.fsf.org>
-#
-#   This program is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by the
-#   Free Software Foundation, either version 3 of the License, or (at your
-#   option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
-#   Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <https://www.gnu.org/licenses/>.
-#
-#   As a special exception, the respective Autoconf Macro's copyright owner
-#   gives unlimited permission to copy, distribute and modify the configure
-#   scripts that are the output of Autoconf when processing the Macro. You
-#   need not follow the terms of the GNU General Public License when using
-#   or distributing such scripts, even though portions of the text of the
-#   Macro appear in them. The GNU General Public License (GPL) does govern
-#   all other use of the material that constitutes the Autoconf Macro.
-#
-#   This special exception to the GPL applies to versions of the Autoconf
-#   Macro released by the Autoconf Archive. When you make and distribute a
-#   modified version of the Autoconf Macro, you may extend this special
-#   exception to the GPL to apply to your modified version as well.
-
-#serial 2
-
-AC_DEFUN([AX_BUILD_DATE_EPOCH],
-[dnl
-AC_MSG_CHECKING([for build time])
-ax_date_fmt="m4_default($2,%s)"
-AS_IF([test x"$SOURCE_DATE_EPOCH" = x],
- [$1=`date "+$ax_date_fmt"`],
- [ax_build_date=`date -u -d "@$SOURCE_DATE_EPOCH" "+$ax_date_fmt" 2>/dev/null \
-                 || date -u -r "$SOURCE_DATE_EPOCH" "+$ax_date_fmt" 2>/dev/null`
-  AS_IF([test x"$ax_build_date" = x],
-   [m4_ifval([$3],
-      [$3],
-      [AC_MSG_ERROR([malformed SOURCE_DATE_EPOCH])])],
-   [$1=$ax_build_date])])
-AC_MSG_RESULT([$$1])
-])dnl AX_BUILD_DATE_EPOCH
@@ -47,7 +47,6 @@
 #include "util/regional.h"
 #include "util/net_help.h"
 #include "util/config_file.h"
-#include "util/data/dname.h"
 #include "util/data/msgreply.h"
 #include "util/data/msgencode.h"
 #include "services/cache/dns.h"
@@ -342,7 +341,6 @@ calc_hash(struct query_info* qinfo, struct module_env* env, char* buf,
 	/* copy the hash info into the clear buffer */
 	if(clen + qinfo->qname_len < sizeof(clear)) {
 		memmove(clear+clen, qinfo->qname, qinfo->qname_len);
-		query_dname_tolower(clear+clen);
 		clen += qinfo->qname_len;
 	}
 	if(clen + 4 < sizeof(clear)) {
@@ -401,9 +399,12 @@ prep_data(struct module_qstate* qstate, struct sldns_buffer* buf)
 	   FLAGS_GET_RCODE(qstate->return_msg->rep->flags) !=
 		LDNS_RCODE_YXDOMAIN)
 		return 0;
-	/* We don't store the reply if its TTL is 0. This is probably coming
-	 * from upstream and it is not meant to be stored. */
-	if(qstate->return_msg->rep->ttl == 0)
+	/* We don't store the reply if its TTL is 0 unless serve-expired is
+	 * enabled.  Such a reply won't be reusable and simply be a waste for
+	 * the backend.  It's also compatible with the default behavior of
+	 * dns_cache_store_msg(). */
+	if(qstate->return_msg->rep->ttl == 0 &&
+		!qstate->env->cfg->serve_expired)
 		return 0;

 	/* The EDE is added to the out-list so it is encoded in the cached message */
@@ -457,7 +458,7 @@ good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
 	 * - serve_expired needs to be set
 	 * - if SERVE_EXPIRED_TTL is set make sure that the record is not older
 	 *   than that. */
-	if(TTL_IS_EXPIRED((time_t)expiry, *qstate->env->now) &&
+	if((time_t)expiry < *qstate->env->now &&
 		(!qstate->env->cfg->serve_expired ||
 			(SERVE_EXPIRED_TTL &&
 			*qstate->env->now - (time_t)expiry > SERVE_EXPIRED_TTL)))
@@ -469,8 +470,7 @@ good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
 /* Adjust the TTL of the given RRset by 'subtract'.  If 'subtract' is
 * negative, set the TTL to 0. */
 static void
-packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract,
-	time_t timestamp)
+packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract)
 {
 	size_t i;
 	size_t total = data->count + data->rrsig_count;
@@ -482,13 +482,13 @@ packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract,
 			data->rr_ttl[i] -= subtract;
 		else	data->rr_ttl[i] = 0;
 	}
-	data->ttl_add = timestamp;
+	data->ttl_add = (subtract < data->ttl_add) ? (data->ttl_add - subtract) : 0;
 }

 /* Adjust the TTL of a DNS message and its RRs by 'adjust'.  If 'adjust' is
 * negative, set the TTLs to 0. */
 static void
-adjust_msg_ttl(struct dns_msg* msg, time_t adjust, time_t timestamp)
+adjust_msg_ttl(struct dns_msg* msg, time_t adjust)
 {
 	size_t i;
 	if(adjust >= 0 && msg->rep->ttl > adjust)
@@ -500,13 +500,13 @@ adjust_msg_ttl(struct dns_msg* msg, time_t adjust, time_t timestamp)

 	for(i=0; i<msg->rep->rrset_count; i++) {
 		packed_rrset_ttl_subtract((struct packed_rrset_data*)msg->
-			rep->rrsets[i]->entry.data, adjust, timestamp);
+			rep->rrsets[i]->entry.data, adjust);
 	}
 }

 /* Set the TTL of the given RRset to fixed value. */
 static void
-packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl, time_t timestamp)
+packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl)
 {
 	size_t i;
 	size_t total = data->count + data->rrsig_count;
@@ -514,12 +514,12 @@ packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl, time_t timestam
 	for(i=0; i<total; i++) {
 		data->rr_ttl[i] = ttl;
 	}
-	data->ttl_add = timestamp;
+	data->ttl_add = 0;
 }

 /* Set the TTL of a DNS message and its RRs by to a fixed value. */
 static void
-set_msg_ttl(struct dns_msg* msg, time_t ttl, time_t timestamp)
+set_msg_ttl(struct dns_msg* msg, time_t ttl)
 {
 	size_t i;
 	msg->rep->ttl = ttl;
@@ -528,14 +528,14 @@ set_msg_ttl(struct dns_msg* msg, time_t ttl, time_t timestamp)

 	for(i=0; i<msg->rep->rrset_count; i++) {
 		packed_rrset_ttl_set((struct packed_rrset_data*)msg->
-			rep->rrsets[i]->entry.data, ttl, timestamp);
+			rep->rrsets[i]->entry.data, ttl);
 	}
 }

 /** convert dns message in buffer to return_msg */
 static int
 parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
-	int* msg_expired, time_t* msg_timestamp, time_t* msg_expiry)
+	int* msg_expired)
 {
 	struct msg_parse* prs;
 	struct edns_data edns;
@@ -552,9 +552,6 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 		&timestamp, sizeof(timestamp));
 	expiry = be64toh(expiry);
 	timestamp = be64toh(timestamp);
-	log_assert(timestamp <= expiry);
-	*msg_expiry = (time_t)expiry;
-	*msg_timestamp = (time_t)timestamp;

 	/* parse DNS packet */
 	regional_free_all(qstate->env->scratch);
@@ -606,9 +603,11 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 		return 1; /* message from the future (clock skew?) */
 	}
 	adjust = *qstate->env->now - (time_t)timestamp;
-	if(TTL_IS_EXPIRED((time_t)expiry, *qstate->env->now)) {
+	if(qstate->return_msg->rep->ttl < adjust) {
 		verbose(VERB_ALGO, "cachedb msg expired");
 		*msg_expired = 1;
+		/* If serve-expired is enabled, we still use an expired message
+		 * setting the TTL to 0. */
 		if(!qstate->env->cfg->serve_expired ||
 			(FLAGS_GET_RCODE(qstate->return_msg->rep->flags)
 			!= LDNS_RCODE_NOERROR &&
@@ -617,21 +616,20 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 			FLAGS_GET_RCODE(qstate->return_msg->rep->flags)
 			!= LDNS_RCODE_YXDOMAIN))
 			return 0; /* message expired */
-		/* If serve-expired is enabled, we still use an expired message.
-		 * Set the TTL to 0 now and it will be handled specially later
-		 * when we need to store it internally. */
-		adjust = -1;
+		else
+			adjust = -1;
 	}
-	adjust_msg_ttl(qstate->return_msg, adjust, timestamp);
 	verbose(VERB_ALGO, "cachedb msg adjusted down by %d", (int)adjust);
-	if(qstate->env->cfg->aggressive_nsec) {
-		limit_nsec_ttl(qstate->return_msg);
-	}
+	adjust_msg_ttl(qstate->return_msg, adjust);

 	/* Similar to the unbound worker, if serve-expired is enabled and
 	 * the msg would be considered to be expired, mark the state so a
-	 * refetch will be scheduled. */
-	if(*msg_expired && !qstate->env->cfg->serve_expired_client_timeout) {
+	 * refetch will be scheduled.  The comparison between 'expiry' and
+	 * 'now' should be redundant given how these values were calculated,
+	 * but we check it just in case as does good_expiry_and_qinfo(). */
+	if(qstate->env->cfg->serve_expired &&
+		!qstate->env->cfg->serve_expired_client_timeout &&
+		(adjust == -1 || (time_t)expiry < *qstate->env->now)) {
 		qstate->need_refetch = 1;
 	}

@@ -644,7 +642,7 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 */
 static int
 cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie,
-	int* msg_expired, time_t* msg_timestamp, time_t* msg_expiry)
+	int* msg_expired)
 {
 	char key[(CACHEDB_HASHSIZE/8)*2+1];
 	calc_hash(&qstate->qinfo, qstate->env, key, sizeof(key));
@@ -661,8 +659,7 @@ cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie,
 	}

 	/* parse dns message into return_msg */
-	if( !parse_data(qstate, qstate->env->scratch_buffer, msg_expired,
-		msg_timestamp, msg_expiry) ) {
+	if( !parse_data(qstate, qstate->env->scratch_buffer, msg_expired) ) {
 		return 0;
 	}
 	return 1;
@@ -734,35 +731,28 @@ cachedb_intcache_lookup(struct module_qstate* qstate, struct cachedb_env* cde)
 * Store query into the internal cache of unbound.
 */
 static void
-cachedb_intcache_store(struct module_qstate* qstate, int msg_expired,
-	time_t msg_timestamp, time_t msg_expiry)
+cachedb_intcache_store(struct module_qstate* qstate, int msg_expired)
 {
 	uint32_t store_flags = qstate->query_flags;
 	int serve_expired = qstate->env->cfg->serve_expired;
+
+	if(qstate->env->cfg->serve_expired)
+		store_flags |= DNSCACHE_STORE_ZEROTTL;
 	if(!qstate->return_msg)
 		return;
 	if(serve_expired && msg_expired) {
-		time_t original_ttl = msg_expiry - msg_timestamp;
-		store_flags |= DNSCACHE_STORE_EXPIRED_MSG_CACHEDB;
-		/* Pass the original TTL of the expired message and signal with
-		 * the DNSCACHE_STORE_EXPIRED_MSG_CACHEDB flag that
-		 * dns_cache_store_msg() needs to set absolute expired TTLs
-		 * based on the original message TTL.
-		 * Results as expired message in the cache */
-		set_msg_ttl(qstate->return_msg, original_ttl, 0);
-		verbose(VERB_ALGO, "cachedb expired msg set to be expired now "
-			"(original ttl: %d)", (int)original_ttl);
+		/* Set TTLs to a value such that value + *env->now is
+		 * going to be now-3 seconds. Making it expired
+		 * in the cache. */
+		set_msg_ttl(qstate->return_msg, (time_t)-3);
 		/* The expired entry does not get checked by the validator
 		 * and we need a validation value for it. */
-		/* By setting this to unchecked, bogus data is not returned
-		 * as non-bogus. */
 		if(qstate->env->cfg->cachedb_check_when_serve_expired)
-			qstate->return_msg->rep->security = sec_status_unchecked;
+			qstate->return_msg->rep->security = sec_status_insecure;
 	}
 	(void)dns_cache_store(qstate->env, &qstate->qinfo,
 		qstate->return_msg->rep, 0, qstate->prefetch_leeway, 0,
-		qstate->region, store_flags, qstate->qstarttime,
-		qstate->is_valrec);
+		qstate->region, store_flags, qstate->qstarttime);
 	if(serve_expired && msg_expired) {
 		if(qstate->env->cfg->serve_expired_client_timeout) {
 			/* No expired response from the query state, the
@@ -771,14 +761,12 @@ cachedb_intcache_store(struct module_qstate* qstate, int msg_expired,
 			 * of cache. */
 			return;
 		}
+		/* set TTLs to zero again */
+		adjust_msg_ttl(qstate->return_msg, -1);
 		/* Send serve expired responses based on the cachedb
 		 * returned message, that was just stored in the cache.
 		 * It can then continue to work on this query. */
 		mesh_respond_serve_expired(qstate->mesh_info);
-		/* set TTLs as expired for this return_msg in case it is used
-		 * later on */
-		set_msg_ttl(qstate->return_msg,
-			EXPIRED_REPLY_TTL_CALC(msg_expiry, msg_timestamp), 0);
 	}
 }

@@ -796,7 +784,6 @@ cachedb_handle_query(struct module_qstate* qstate,
 	struct cachedb_env* ie, int id)
 {
 	int msg_expired = 0;
-	time_t msg_timestamp, msg_expiry;
 	qstate->is_cachedb_answer = 0;
 	/* check if we are enabled, and skip if so */
 	if(!ie->enabled) {
@@ -805,11 +792,8 @@ cachedb_handle_query(struct module_qstate* qstate,
 		return;
 	}

-	if(qstate->blacklist || qstate->no_cache_lookup
-		|| iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL,
-		NULL, 0)) {
-		/* cache is blacklisted or we are instructed from edns to not
-		 * look or a forwarder/stub forbids it */
+	if(qstate->blacklist || qstate->no_cache_lookup) {
+		/* cache is blacklisted or we are instructed from edns to not look */
 		/* pass request to next module */
 		qstate->ext_state[id] = module_wait_module;
 		return;
@@ -834,18 +818,18 @@ cachedb_handle_query(struct module_qstate* qstate,
 	}

 	/* ask backend cache to see if we have data */
-	if(cachedb_extcache_lookup(qstate, ie, &msg_expired, &msg_timestamp,
-		&msg_expiry)) {
+	if(cachedb_extcache_lookup(qstate, ie, &msg_expired)) {
 		if(verbosity >= VERB_ALGO)
 			log_dns_msg(ie->backend->name,
 				&qstate->return_msg->qinfo,
 				qstate->return_msg->rep);
 		/* store this result in internal cache */
-		cachedb_intcache_store(qstate,
-			msg_expired, msg_timestamp, msg_expiry);
+		cachedb_intcache_store(qstate, msg_expired);
 		/* In case we have expired data but there is a client timer for expired
 		 * answers, pass execution to next module in order to try updating the
 		 * data first.
+		 * TODO: this needs revisit. The expired data stored from cachedb has
+		 * 0 TTL which is picked up by iterator later when looking in the cache.
 		 */
 		if(qstate->env->cfg->serve_expired && msg_expired) {
 			qstate->return_msg = NULL;
@@ -862,8 +846,6 @@ cachedb_handle_query(struct module_qstate* qstate,
 				qstate->ext_state[id] = module_wait_module;
 				return;
 		}
-		/* No 0TTL answers escaping from external cache. */
-		log_assert(qstate->return_msg->rep->ttl > 0);
 		qstate->is_cachedb_answer = 1;
 		/* we are done with the query */
 		qstate->ext_state[id] = module_finished;
@@ -897,9 +879,7 @@ cachedb_handle_response(struct module_qstate* qstate,
 {
 	qstate->is_cachedb_answer = 0;
 	/* check if we are not enabled or instructed to not cache, and skip */
-	if(!ie->enabled || qstate->no_cache_store
-		|| iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL,
-		NULL, 0)) {
+	if(!ie->enabled || qstate->no_cache_store) {
 		/* we are done with the query */
 		qstate->ext_state[id] = module_finished;
 		return;
@@ -1003,7 +983,7 @@ cachedb_get_mem(struct module_env* env, int id)
 */
 static struct module_func_block cachedb_block = {
 	"cachedb",
-	NULL, NULL, &cachedb_init, &cachedb_deinit, &cachedb_operate,
+	&cachedb_init, &cachedb_deinit, &cachedb_operate,
 	&cachedb_inform_super, &cachedb_clear, &cachedb_get_mem
 };

@@ -46,62 +46,24 @@
 #include "cachedb/cachedb.h"
 #include "util/alloc.h"
 #include "util/config_file.h"
-#include "util/locks.h"
-#include "util/timeval_func.h"
 #include "sldns/sbuffer.h"

 #ifdef USE_REDIS
 #include "hiredis/hiredis.h"

 struct redis_moddata {
-	/* thread-specific redis contexts */
-	redisContext** ctxs;
-	redisContext** replica_ctxs;
-	/* number of ctx entries */
-	int numctxs;
-	/* server's IP address or host name */
-	const char* server_host;
-	const char* replica_server_host;
-	/* server's TCP port */
-	int server_port;
-	int replica_server_port;
-	/* server's unix path, or "", NULL if unused */
-	const char* server_path;
-	const char* replica_server_path;
-	/* server's AUTH password, or "", NULL if unused */
-	const char* server_password;
-	const char* replica_server_password;
-	/* timeout for commands */
-	struct timeval command_timeout;
-	struct timeval replica_command_timeout;
-	/* timeout for connection setup */
-	struct timeval connect_timeout;
-	struct timeval replica_connect_timeout;
-	/* the reconnect interval time. */
-	struct timeval reconnect_interval;
-	struct timeval replica_reconnect_interval;
-	/* reconnect attempts, 0 if connected, counts up failed reconnects. */
-	int reconnect_attempts;
-	int replica_reconnect_attempts;
-	/* Lock on reconnect_wait time. */
-	lock_basic_type wait_lock;
-	lock_basic_type replica_wait_lock;
-	/* reconnect wait time, wait until it has passed before reconnect. */
-	struct timeval reconnect_wait;
-	struct timeval replica_reconnect_wait;
-	/* the redis logical database to use */
-	int logical_db;
-	int replica_logical_db;
-	/* if the SET with EX command is supported */
-	int set_with_ex_available;
+	redisContext** ctxs;	/* thread-specific redis contexts */
+	int numctxs;		/* number of ctx entries */
+	const char* server_host; /* server's IP address or host name */
+	int server_port;	 /* server's TCP port */
+	const char* server_path; /* server's unix path, or "", NULL if unused */
+	const char* server_password; /* server's AUTH password, or "", NULL if unused */
+	struct timeval timeout;	 /* timeout for connection setup and commands */
+	int logical_db;		/* the redis logical database to use */
 };

-/** The limit on the number of redis connect attempts. After failure if
- * the number is exceeded, the reconnects are throttled by the wait time. */
-#define REDIS_RECONNECT_ATTEMPT_LIMIT 3
-
 static redisReply* redis_command(struct module_env*, struct cachedb_env*,
-	const char*, const uint8_t*, size_t, int);
+	const char*, const uint8_t*, size_t);

 static void
 moddata_clean(struct redis_moddata** moddata) {
@@ -115,145 +77,63 @@ moddata_clean(struct redis_moddata** moddata) {
 		}
 		free((*moddata)->ctxs);
 	}
-	if((*moddata)->replica_ctxs) {
-		int i;
-		for(i = 0; i < (*moddata)->numctxs; i++) {
-			if((*moddata)->replica_ctxs[i])
-				redisFree((*moddata)->replica_ctxs[i]);
-		}
-		free((*moddata)->replica_ctxs);
-	}
-	lock_basic_destroy(&(*moddata)->wait_lock);
-	lock_basic_destroy(&(*moddata)->replica_wait_lock);
 	free(*moddata);
 	*moddata = NULL;
 }

 static redisContext*
-redis_connect(const char* host, int port, const char* path,
-	const char* password, int logical_db,
-	const struct timeval connect_timeout,
-	const struct timeval command_timeout,
-	const struct timeval* reconnect_interval,
-	int* reconnect_attempts,
-	struct timeval* reconnect_wait,
-	lock_basic_type* wait_lock,
-	struct timeval* now_tv,
-	const char* infostr)
+redis_connect(const struct redis_moddata* moddata)
 {
-	struct timeval now_val;
 	redisContext* ctx;
-#ifdef THREADS_DISABLED
-	/* Fix attribute unused warning.
-	 * wait_lock is only used with lock_basic_* functions that are nop'ed
-	 * when compiled without thread support. */
-	(void)wait_lock;
-#endif /* THREADS_DISABLED */

-	/* See if the redis server is down, and reconnect has to wait. */
-	if(*reconnect_attempts > REDIS_RECONNECT_ATTEMPT_LIMIT) {
-		/* Acquire lock to look at timeval, the integer has atomic
-		 * integrity. */
-		struct timeval wait_tv;
-		if(now_tv) {
-			now_val = *now_tv;
-		} else {
-			if(gettimeofday(&now_val, NULL) < 0)
-				log_err("redis: gettimeofday: %s",
-					strerror(errno));
-		}
-		lock_basic_lock(wait_lock);
-		wait_tv = *reconnect_wait;
-		lock_basic_unlock(wait_lock);
-		if(timeval_smaller(&now_val, &wait_tv)) {
-			verbose(VERB_ALGO, "redis %sdown, reconnect wait",
-				infostr);
-			return NULL;
-		}
-	}
-
-	if(path && path[0]!=0) {
-		ctx = redisConnectUnixWithTimeout(path, connect_timeout);
+	if(moddata->server_path && moddata->server_path[0]!=0) {
+		ctx = redisConnectUnixWithTimeout(moddata->server_path,
+			moddata->timeout);
 	} else {
-		ctx = redisConnectWithTimeout(host, port, connect_timeout);
+		ctx = redisConnectWithTimeout(moddata->server_host,
+			moddata->server_port, moddata->timeout);
 	}
 	if(!ctx || ctx->err) {
 		const char *errstr = "out of memory";
 		if(ctx)
 			errstr = ctx->errstr;
-		log_err("failed to connect to redis %sserver: %s", infostr, errstr);
+		log_err("failed to connect to redis server: %s", errstr);
 		goto fail;
 	}
-	if(redisSetTimeout(ctx, command_timeout) != REDIS_OK) {
-		log_err("failed to set redis %stimeout, %s", infostr, ctx->errstr);
+	if(redisSetTimeout(ctx, moddata->timeout) != REDIS_OK) {
+		log_err("failed to set redis timeout");
 		goto fail;
 	}
-	if(password && password[0]!=0) {
+	if(moddata->server_password && moddata->server_password[0]!=0) {
 		redisReply* rep;
-		rep = redisCommand(ctx, "AUTH %s", password);
+		rep = redisCommand(ctx, "AUTH %s", moddata->server_password);
 		if(!rep || rep->type == REDIS_REPLY_ERROR) {
-			log_err("failed to authenticate %swith password", infostr);
+			log_err("failed to authenticate with password");
 			freeReplyObject(rep);
 			goto fail;
 		}
 		freeReplyObject(rep);
 	}
-	if(logical_db > 0) {
+	if(moddata->logical_db > 0) {
 		redisReply* rep;
-		rep = redisCommand(ctx, "SELECT %d", logical_db);
+		rep = redisCommand(ctx, "SELECT %d", moddata->logical_db);
 		if(!rep || rep->type == REDIS_REPLY_ERROR) {
-			log_err("failed %sto set logical database (%d)",
-				infostr, logical_db);
+			log_err("failed to set logical database (%d)",
+				moddata->logical_db);
 			freeReplyObject(rep);
 			goto fail;
 		}
 		freeReplyObject(rep);
 	}
-	*reconnect_attempts = 0;
-	if(verbosity >= VERB_OPS) {
-		char port_str[6+1];
-		port_str[0] = ' ';
-		(void)snprintf(port_str+1, sizeof(port_str)-1, "%d", port);
-		verbose(VERB_OPS, "Connection to Redis %sestablished (%s%s)",
-			infostr,
-			path&&path[0]!=0?path:host,
-			path&&path[0]!=0?"":port_str);
-	}
+	verbose(VERB_OPS, "Connection to Redis established");
 	return ctx;

 fail:
 	if(ctx)
 		redisFree(ctx);
-	(*reconnect_attempts)++;
-	if(*reconnect_attempts > REDIS_RECONNECT_ATTEMPT_LIMIT) {
-		/* Wait for the reconnect interval before trying again. */
-		struct timeval tv;
-		if(now_tv) {
-			now_val = *now_tv;
-		} else {
-			if(gettimeofday(&now_val, NULL) < 0)
-				log_err("redis: gettimeofday: %s",
-					strerror(errno));
-		}
-		tv = now_val;
-		timeval_add(&tv, reconnect_interval);
-		lock_basic_lock(wait_lock);
-		*reconnect_wait = tv;
-		lock_basic_unlock(wait_lock);
-		verbose(VERB_ALGO, "redis %sreconnect wait until %d.%6.6d",
-			infostr, (int)tv.tv_sec, (int)tv.tv_usec);
-	}
 	return NULL;
 }

-static void
-set_timeout(struct timeval* timeout, int value, int explicit_value)
-{
-	int v = explicit_value != 0 ? explicit_value : value;
-	timeout->tv_sec = v / 1000;
-	timeout->tv_usec = (v % 1000) * 1000;
-}
-
 static int
 redis_init(struct module_env* env, struct cachedb_env* cachedb_env)
 {
@@ -267,120 +147,42 @@ redis_init(struct module_env* env, struct cachedb_env* cachedb_env)
 		log_err("out of memory");
 		goto fail;
 	}
-	lock_basic_init(&moddata->wait_lock);
-	lock_protect(&moddata->wait_lock, &moddata->reconnect_wait,
-		sizeof(moddata->reconnect_wait));
-	lock_basic_init(&moddata->replica_wait_lock);
-	lock_protect(&moddata->replica_wait_lock,
-		&moddata->replica_reconnect_wait,
-		sizeof(moddata->replica_reconnect_wait));
 	moddata->numctxs = env->cfg->num_threads;
-	/* note: server_host and similar string configuration options are
-	 * shallow references to configured strings; we don't have to free them
-	 * in this module. */
-	moddata->server_host = env->cfg->redis_server_host;
-	moddata->replica_server_host = env->cfg->redis_replica_server_host;
-
-	moddata->server_port = env->cfg->redis_server_port;
-	moddata->replica_server_port = env->cfg->redis_replica_server_port;
-
-	moddata->server_path = env->cfg->redis_server_path;
-	moddata->replica_server_path = env->cfg->redis_replica_server_path;
-
-	moddata->server_password = env->cfg->redis_server_password;
-	moddata->replica_server_password = env->cfg->redis_replica_server_password;
-
-	set_timeout(&moddata->command_timeout,
-		env->cfg->redis_timeout,
-		env->cfg->redis_command_timeout);
-	set_timeout(&moddata->replica_command_timeout,
-		env->cfg->redis_replica_timeout,
-		env->cfg->redis_replica_command_timeout);
-	set_timeout(&moddata->connect_timeout,
-		env->cfg->redis_timeout,
-		env->cfg->redis_connect_timeout);
-	set_timeout(&moddata->replica_connect_timeout,
-		env->cfg->redis_replica_timeout,
-		env->cfg->redis_replica_connect_timeout);
-	set_timeout(&moddata->reconnect_interval, 1000, 0);
-	set_timeout(&moddata->replica_reconnect_interval, 1000, 0);
-
-	moddata->logical_db = env->cfg->redis_logical_db;
-	moddata->replica_logical_db = env->cfg->redis_replica_logical_db;
-
 	moddata->ctxs = calloc(env->cfg->num_threads, sizeof(redisContext*));
 	if(!moddata->ctxs) {
 		log_err("out of memory");
 		goto fail;
 	}
-	if((moddata->replica_server_host && moddata->replica_server_host[0]!=0)
-		|| (moddata->replica_server_path && moddata->replica_server_path[0]!=0)) {
-		/* There is a replica configured, allocate ctxs */
-		moddata->replica_ctxs = calloc(env->cfg->num_threads, sizeof(redisContext*));
-		if(!moddata->replica_ctxs) {
-			log_err("out of memory");
-			goto fail;
-		}
-	}
+	/* note: server_host is a shallow reference to configured string.
+	 * we don't have to free it in this module. */
+	moddata->server_host = env->cfg->redis_server_host;
+	moddata->server_port = env->cfg->redis_server_port;
+	moddata->server_path = env->cfg->redis_server_path;
+	moddata->server_password = env->cfg->redis_server_password;
+	moddata->timeout.tv_sec = env->cfg->redis_timeout / 1000;
+	moddata->timeout.tv_usec = (env->cfg->redis_timeout % 1000) * 1000;
+	moddata->logical_db = env->cfg->redis_logical_db;
 	for(i = 0; i < moddata->numctxs; i++) {
-		redisContext* ctx = redis_connect(
-			moddata->server_host,
-			moddata->server_port,
-			moddata->server_path,
-			moddata->server_password,
-			moddata->logical_db,
-			moddata->connect_timeout,
-			moddata->command_timeout,
-			&moddata->reconnect_interval,
-			&moddata->reconnect_attempts,
-			&moddata->reconnect_wait,
-			&moddata->wait_lock,
-			env->now_tv,
-			"");
+		redisContext* ctx = redis_connect(moddata);
 		if(!ctx) {
-			log_err("redis_init: failed to init redis "
-				"(for thread %d)", i);
-			/* And continue, the context can be established
-			 * later, just like after a disconnect. */
+			log_err("redis_init: failed to init redis");
+			goto fail;
 		}
 		moddata->ctxs[i] = ctx;
 	}
-	if(moddata->replica_ctxs) {
-		for(i = 0; i < moddata->numctxs; i++) {
-			redisContext* ctx = redis_connect(
-				moddata->replica_server_host,
-				moddata->replica_server_port,
-				moddata->replica_server_path,
-				moddata->replica_server_password,
-				moddata->replica_logical_db,
-				moddata->replica_connect_timeout,
-				moddata->replica_command_timeout,
-				&moddata->replica_reconnect_interval,
-				&moddata->replica_reconnect_attempts,
-				&moddata->replica_reconnect_wait,
-				&moddata->replica_wait_lock,
-				env->now_tv,
-				"replica ");
-			if(!ctx) {
-				log_err("redis_init: failed to init redis "
-					"replica (for thread %d)", i);
-				/* And continue, the context can be established
-				* later, just like after a disconnect. */
-			}
-			moddata->replica_ctxs[i] = ctx;
-		}
-	}
 	cachedb_env->backend_data = moddata;
-	if(env->cfg->redis_expire_records &&
-		moddata->ctxs[env->alloc->thread_num] != NULL) {
+	if(env->cfg->redis_expire_records) {
 		redisReply* rep = NULL;
 		int redis_reply_type = 0;
-		/** check if set with ex command is supported */
+		/** check if setex command is supported */
 		rep = redis_command(env, cachedb_env,
-			"SET __UNBOUND_REDIS_CHECK__ none EX 1", NULL, 0, 1);
+			"SETEX __UNBOUND_REDIS_CHECK__ 1 none", NULL, 0);
 		if(!rep) {
 			/** init failed, no response from redis server*/
-			goto set_with_ex_fail;
+			log_err("redis_init: failed to init redis, the "
+				"redis-expire-records option requires the SETEX command "
+				"(redis >= 2.0.0)");
+			goto fail;
 		}
 		redis_reply_type = rep->type;
 		freeReplyObject(rep);
@@ -388,18 +190,15 @@ redis_init(struct module_env* env, struct cachedb_env* cachedb_env)
 		case REDIS_REPLY_STATUS:
 			break;
 		default:
-			/** init failed, set_with_ex command not supported */
-			goto set_with_ex_fail;
+			/** init failed, setex command not supported */
+			log_err("redis_init: failed to init redis, the "
+				"redis-expire-records option requires the SETEX command "
+				"(redis >= 2.0.0)");
+			goto fail;
 		}
-		moddata->set_with_ex_available = 1;
 	}
 	return 1;

-set_with_ex_fail:
-	log_err("redis_init: failure during redis_init, the "
-		"redis-expire-records option requires the SET with EX command "
-		"(redis >= 2.6.12)");
-	return 1;
 fail:
 	moddata_clean(&moddata);
 	return 0;
@@ -430,9 +229,9 @@ redis_deinit(struct module_env* env, struct cachedb_env* cachedb_env)
 */
 static redisReply*
 redis_command(struct module_env* env, struct cachedb_env* cachedb_env,
-	const char* command, const uint8_t* data, size_t data_len, int write)
+	const char* command, const uint8_t* data, size_t data_len)
 {
-	redisContext* ctx, **ctx_selector;
+	redisContext* ctx;
 	redisReply* rep;
 	struct redis_moddata* d = (struct redis_moddata*)
 		cachedb_env->backend_data;
@@ -443,50 +242,17 @@ redis_command(struct module_env* env, struct cachedb_env* cachedb_env,
 	 * assumption throughout the unbound architecture, so we simply assert
 	 * it. */
 	log_assert(env->alloc->thread_num < d->numctxs);
-
-	ctx_selector = !write && d->replica_ctxs
-		?d->replica_ctxs
-		:d->ctxs;
-	ctx = ctx_selector[env->alloc->thread_num];
+	ctx = d->ctxs[env->alloc->thread_num];

 	/* If we've not established a connection to the server or we've closed
 	 * it on a failure, try to re-establish a new one.   Failures will be
 	 * logged in redis_connect(). */
 	if(!ctx) {
-		if(!write && d->replica_ctxs) {
-			ctx = redis_connect(
-				d->replica_server_host,
-				d->replica_server_port,
-				d->replica_server_path,
-				d->replica_server_password,
-				d->replica_logical_db,
-				d->replica_connect_timeout,
-				d->replica_command_timeout,
-				&d->replica_reconnect_interval,
-				&d->replica_reconnect_attempts,
-				&d->replica_reconnect_wait,
-				&d->replica_wait_lock,
-				env->now_tv,
-				"replica ");
-		} else {
-			ctx = redis_connect(
-				d->server_host,
-				d->server_port,
-				d->server_path,
-				d->server_password,
-				d->logical_db,
-				d->connect_timeout,
-				d->command_timeout,
-				&d->reconnect_interval,
-				&d->reconnect_attempts,
-				&d->reconnect_wait,
-				&d->wait_lock,
-				env->now_tv,
-				"");
-		}
-		ctx_selector[env->alloc->thread_num] = ctx;
+		ctx = redis_connect(d);
+		d->ctxs[env->alloc->thread_num] = ctx;
 	}
-	if(!ctx) return NULL;
+	if(!ctx)
+		return NULL;

 	/* Send the command and get a reply, synchronously. */
 	rep = (redisReply*)redisCommand(ctx, command, data, data_len);
@@ -496,7 +262,7 @@ redis_command(struct module_env* env, struct cachedb_env* cachedb_env,
 		log_err("redis_command: failed to receive a reply, "
 			"closing connection: %s", ctx->errstr);
 		redisFree(ctx);
-		ctx_selector[env->alloc->thread_num] = NULL;
+		d->ctxs[env->alloc->thread_num] = NULL;
 		return NULL;
 	}

@@ -514,14 +280,7 @@ redis_lookup(struct module_env* env, struct cachedb_env* cachedb_env,
 	char* key, struct sldns_buffer* result_buffer)
 {
 	redisReply* rep;
-	/* Supported commands:
-	 * - "GET " + key
-	 */
-#define REDIS_LOOKUP_MAX_BUF_LEN			\
-	4				/* "GET " */	\
-	+(CACHEDB_HASHSIZE/8)*2		/* key hash */	\
-	+ 1				/* \0 */
-	char cmdbuf[REDIS_LOOKUP_MAX_BUF_LEN];
+	char cmdbuf[4+(CACHEDB_HASHSIZE/8)*2+1]; /* "GET " + key */
 	int n;
 	int ret = 0;

@@ -533,7 +292,7 @@ redis_lookup(struct module_env* env, struct cachedb_env* cachedb_env,
 		return 0;
 	}

-	rep = redis_command(env, cachedb_env, cmdbuf, NULL, 0, 0);
+	rep = redis_command(env, cachedb_env, cmdbuf, NULL, 0);
 	if(!rep)
 		return 0;
 	switch(rep->type) {
@@ -570,45 +329,26 @@ redis_store(struct module_env* env, struct cachedb_env* cachedb_env,
 {
 	redisReply* rep;
 	int n;
-	struct redis_moddata* moddata = (struct redis_moddata*)
-		cachedb_env->backend_data;
-	int set_ttl = (moddata->set_with_ex_available &&
-		env->cfg->redis_expire_records &&
+	int set_ttl = (env->cfg->redis_expire_records &&
 		(!env->cfg->serve_expired || env->cfg->serve_expired_ttl > 0));
 	/* Supported commands:
 	 * - "SET " + key + " %b"
-	 * - "SET " + key + " %b EX " + ttl
-	 *   older redis 2.0.0 was "SETEX " + key + " " + ttl + " %b"
-	 * - "EXPIRE " + key + " 0"
+	 * - "SETEX " + key + " " + ttl + " %b"
 	 */
-#define REDIS_STORE_MAX_BUF_LEN				\
-	7			/* "EXPIRE " */		\
-	+(CACHEDB_HASHSIZE/8)*2	/* key hash */		\
-	+ 7			/* " %b EX " */		\
-	+ 20			/* ttl (uint64_t) */	\
-	+ 1			/* \0 */
-	char cmdbuf[REDIS_STORE_MAX_BUF_LEN];
+	char cmdbuf[6+(CACHEDB_HASHSIZE/8)*2+11+3+1];

 	if (!set_ttl) {
 		verbose(VERB_ALGO, "redis_store %s (%d bytes)", key, (int)data_len);
 		/* build command to set to a binary safe string */
 		n = snprintf(cmdbuf, sizeof(cmdbuf), "SET %s %%b", key);
-	} else if(ttl == 0) {
-		/* use the EXPIRE command, SET with EX 0 is an invalid time. */
-		/* Replies with REDIS_REPLY_INTEGER of 1. */
-		verbose(VERB_ALGO, "redis_store expire %s (%d bytes)",
-			key, (int)data_len);
-		n = snprintf(cmdbuf, sizeof(cmdbuf), "EXPIRE %s 0", key);
-		data = NULL;
-		data_len = 0;
 	} else {
 		/* add expired ttl time to redis ttl to avoid premature eviction of key */
 		ttl += env->cfg->serve_expired_ttl;
 		verbose(VERB_ALGO, "redis_store %s (%d bytes) with ttl %u",
-			key, (int)data_len, (unsigned)(uint32_t)ttl);
+			key, (int)data_len, (uint32_t)ttl);
 		/* build command to set to a binary safe string */
-		n = snprintf(cmdbuf, sizeof(cmdbuf), "SET %s %%b EX %u", key,
-			(unsigned)(uint32_t)ttl);
+		n = snprintf(cmdbuf, sizeof(cmdbuf), "SETEX %s %u %%b", key,
+			(uint32_t)ttl);
 	}


@@ -617,12 +357,11 @@ redis_store(struct module_env* env, struct cachedb_env* cachedb_env,
 		return;
 	}

-	rep = redis_command(env, cachedb_env, cmdbuf, data, data_len, 1);
+	rep = redis_command(env, cachedb_env, cmdbuf, data, data_len);
 	if(rep) {
 		verbose(VERB_ALGO, "redis_store set completed");
 		if(rep->type != REDIS_REPLY_STATUS &&
-			rep->type != REDIS_REPLY_ERROR &&
-			rep->type != REDIS_REPLY_INTEGER) {
+			rep->type != REDIS_REPLY_ERROR) {
 			log_err("redis_store: unexpected type of reply (%d)",
 				rep->type);
 		}
@@ -38,9 +38,6 @@
 #ifndef UB_ON_WINDOWS
 #include <sys/mman.h>
 #endif
-#ifdef __QNX__
-#include "util/log.h"
-#endif /* __QNX__ */

 #define KEYSTREAM_ONLY
 #include "chacha_private.h"
@@ -190,11 +187,7 @@ _rs_stir(void)
 		if(errno != ENOSYS ||
 			fallback_getentropy_urandom(rnd, sizeof rnd) == -1) {
 #ifdef SIGKILL
-#ifndef __QNX__
 			raise(SIGKILL);
-#else /* !__QNX__ */
-			fatal_exit("failed to getentropy");
-#endif /* __QNX__ */
 #else
 			exit(9); /* windows */
 #endif
@@ -48,8 +48,8 @@ typedef struct
  a = PLUS(a,b); d = ROTATE(XOR(d,a), 8); \
  c = PLUS(c,d); b = ROTATE(XOR(b,c), 7);

-static const char ATTR_NONSTRING(sigma[16]) = "expand 32-byte k";
-static const char ATTR_NONSTRING(tau[16]) = "expand 16-byte k";
+static const char sigma[16] = "expand 32-byte k";
+static const char tau[16] = "expand 16-byte k";

 static void
 chacha_keysetup(chacha_ctx *x,const u8 *k,u32 kbits,u32 ATTR_UNUSED(ivbits))
@@ -57,7 +57,7 @@ int getnameinfo(const struct sockaddr *sa, size_t ATTR_UNUSED(salen), char *host
 	}

 	if (host != NULL) {
-		if ((flags & NI_NUMERICHOST)) {
+		if (flags & NI_NUMERICHOST) {
 			if (strlcpy(host, inet_ntoa(sin->sin_addr),
 			    hostlen) >= hostlen)
 				return (EAI_MEMORY);
@@ -168,7 +168,7 @@ getaddrinfo(const char *hostname, const char *servname,
 			port = 0;
 	}

-	if (hints && (hints->ai_flags & AI_PASSIVE)) {
+	if (hints && hints->ai_flags & AI_PASSIVE) {
 		addr = htonl(0x00000000);
 		if (hostname && inet_aton(hostname, &in) != 0)
 			addr = in.s_addr;
@@ -193,7 +193,7 @@ getaddrinfo(const char *hostname, const char *servname,
 	}
 	
 	/* Don't try DNS if AI_NUMERICHOST is set */
-	if (hints && (hints->ai_flags & AI_NUMERICHOST))
+	if (hints && hints->ai_flags & AI_NUMERICHOST)
 		return (EAI_NONAME);
 	
 	hp = gethostbyname(hostname);
@@ -29,9 +29,7 @@
 #include <sys/param.h>
 #include <sys/ioctl.h>
 #include <sys/resource.h>
-#ifndef __QNX__
 #include <sys/syscall.h>
-#endif /* !__QNX__ */
 #ifdef SYS__sysctl
 #include <linux/sysctl.h>
 #endif
@@ -44,9 +42,7 @@
 #include <stdlib.h>
 #include <stdint.h>
 #include <stdio.h>
-#ifndef __QNX__
 #include <link.h>
-#endif /* __QNX__ */
 #include <termios.h>
 #include <fcntl.h>
 #include <signal.h>
@@ -64,14 +60,12 @@
 #define SHA512_Final(r, c)	sha512_digest(c, SHA512_DIGEST_SIZE, r)
 #endif

-#ifndef __QNX__
 #include <linux/types.h>
 #include <linux/random.h>
 #ifdef HAVE_GETAUXVAL
 #include <sys/auxv.h>
 #endif
 #include <sys/vfs.h>
-#endif /* !__QNX__ */
 #ifndef MAP_ANON
 #define MAP_ANON MAP_ANONYMOUS
 #endif
@@ -100,10 +94,8 @@ static int getentropy_urandom(void *buf, size_t len);
 #ifdef SYS__sysctl
 static int getentropy_sysctl(void *buf, size_t len);
 #endif
-#ifndef __QNX__
 static int getentropy_fallback(void *buf, size_t len);
 static int getentropy_phdr(struct dl_phdr_info *info, size_t size, void *data);
-#endif /* !__QNX__ */

 int
 getentropy(void *buf, size_t len)
@@ -186,7 +178,6 @@ getentropy(void *buf, size_t len)
 	 * sysctl ABI, or consider providing a new failsafe API which
 	 * works in a chroot or when file descriptors are exhausted.
 	 */
-#ifndef __QNX__
 #undef FAIL_INSTEAD_OF_TRYING_FALLBACK
 #ifdef FAIL_INSTEAD_OF_TRYING_FALLBACK
 	raise(SIGKILL);
@@ -194,9 +185,6 @@ getentropy(void *buf, size_t len)
 	ret = getentropy_fallback(buf, len);
 	if (ret != -1)
 		return (ret);
-#else /* !__QNX__ */
-	fatal_exit("failed to read from /dev/urandom");
-#endif /* __QNX__ */

 	errno = EIO;
 	return (ret);
@@ -226,11 +214,7 @@ getentropy_urandom(void *buf, size_t len)
 {
 	struct stat st;
 	size_t i;
-#ifndef __QNX__
 	int fd, cnt, flags;
-#else /* !__QNX__ */
-	int fd, flags;
-#endif /* __QNX__ */
 	int save_errno = errno;

 start:
@@ -257,12 +241,10 @@ start:
 		close(fd);
 		goto nodevrandom;
 	}
-#ifndef __QNX__
 	if (ioctl(fd, RNDGETENTCNT, &cnt) == -1) {
 		close(fd);
 		goto nodevrandom;
 	}
-#endif /* !__QNX__ */
 	for (i = 0; i < len; ) {
 		size_t wanted = len - i;
 		ssize_t ret = read(fd, (char *)buf + i, wanted);
@@ -283,7 +265,6 @@ nodevrandom:
 	return (-1);
 }

-#ifndef __QNX__
 #ifdef SYS__sysctl
 static int
 getentropy_sysctl(void *buf, size_t len)
@@ -556,4 +537,3 @@ getentropy_fallback(void *buf, size_t len)
 	errno = save_errno;
 	return (0);		/* satisfied */
 }
-#endif /* !__QNX__ */
@@ -42,7 +42,10 @@ static const int	year_lengths[2] = {
 };

 static void
-timesub(const time_t * const timep, const long offset, struct tm * const tmp)
+timesub(timep, offset, tmp)
+const time_t * const			timep;
+const long				offset;
+struct tm * const		tmp;
 {
 	long			days;
 	long			rem;
@@ -5,8 +5,12 @@
 #undef malloc
 #include <sys/types.h>

+#ifndef USE_WINSOCK
+void *malloc ();
+#else
 /* provide a prototype */
 void *malloc (size_t n);
+#endif

 /* Allocate an N-byte block of memory from the heap.
   If N is zero, allocate a 1-byte block.  */
@@ -1,8 +1,5 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */

-/* apply the fallthrough attribute. */
-#undef ATTR_FALLTHROUGH
-
 /* apply the noreturn attribute to a function that exits the program */
 #undef ATTR_NORETURN

@@ -60,15 +57,9 @@
 /* Define to 1 if you have the <arpa/inet.h> header file. */
 #undef HAVE_ARPA_INET_H

-/* Whether the C compiler accepts the "fallthrough" attribute */
-#undef HAVE_ATTR_FALLTHROUGH
-
 /* Whether the C compiler accepts the "format" attribute */
 #undef HAVE_ATTR_FORMAT

-/* Whether the C compiler accepts the "nonstring" attribute */
-#undef HAVE_ATTR_NONSTRING
-
 /* Whether the C compiler accepts the "noreturn" attribute */
 #undef HAVE_ATTR_NORETURN

@@ -132,14 +123,6 @@
   and to 0 if you don't. */
 #undef HAVE_DECL_NGHTTP2_SESSION_SERVER_NEW

-/* Define to 1 if you have the declaration of `ngtcp2_conn_server_new', and to
-   0 if you don't. */
-#undef HAVE_DECL_NGTCP2_CONN_SERVER_NEW
-
-/* Define to 1 if you have the declaration of `ngtcp2_crypto_encrypt_cb', and
-   to 0 if you don't. */
-#undef HAVE_DECL_NGTCP2_CRYPTO_ENCRYPT_CB
-
 /* Define to 1 if you have the declaration of `NID_ED25519', and to 0 if you
   don't. */
 #undef HAVE_DECL_NID_ED25519
@@ -176,10 +159,6 @@
   0 if you don't. */
 #undef HAVE_DECL_SSL_CTX_SET_ECDH_AUTO

-/* Define to 1 if you have the declaration of `SSL_CTX_set_tmp_ecdh', and to 0
-   if you don't. */
-#undef HAVE_DECL_SSL_CTX_SET_TMP_ECDH
-
 /* Define to 1 if you have the declaration of `strlcat', and to 0 if you
   don't. */
 #undef HAVE_DECL_STRLCAT
@@ -385,9 +364,6 @@
 /* Define if we have LibreSSL */
 #undef HAVE_LIBRESSL

-/* If we have atomic_store */
-#undef HAVE_LINK_ATOMIC_STORE
-
 /* Define to 1 if you have the <linux/net_tstamp.h> header file. */
 #undef HAVE_LINUX_NET_TSTAMP_H

@@ -430,80 +406,12 @@
 /* Define to 1 if you have the <net/if.h> header file. */
 #undef HAVE_NET_IF_H

-/* Define to 1 if you have the <net/pfvar.h> header file. */
-#undef HAVE_NET_PFVAR_H
-
 /* Define this to use nghttp2 client. */
 #undef HAVE_NGHTTP2

 /* Define to 1 if you have the <nghttp2/nghttp2.h> header file. */
 #undef HAVE_NGHTTP2_NGHTTP2_H

-/* Define this to use ngtcp2. */
-#undef HAVE_NGTCP2
-
-/* Define to 1 if you have the `ngtcp2_ccerr_default' function. */
-#undef HAVE_NGTCP2_CCERR_DEFAULT
-
-/* Define to 1 if you have the `ngtcp2_conn_encode_0rtt_transport_params'
-   function. */
-#undef HAVE_NGTCP2_CONN_ENCODE_0RTT_TRANSPORT_PARAMS
-
-/* Define to 1 if you have the `ngtcp2_conn_get_max_local_streams_uni'
-   function. */
-#undef HAVE_NGTCP2_CONN_GET_MAX_LOCAL_STREAMS_UNI
-
-/* Define to 1 if you have the `ngtcp2_conn_get_num_scid' function. */
-#undef HAVE_NGTCP2_CONN_GET_NUM_SCID
-
-/* Define to 1 if you have the `ngtcp2_conn_in_closing_period' function. */
-#undef HAVE_NGTCP2_CONN_IN_CLOSING_PERIOD
-
-/* Define to 1 if you have the `ngtcp2_conn_in_draining_period' function. */
-#undef HAVE_NGTCP2_CONN_IN_DRAINING_PERIOD
-
-/* Define if ngtcp2_conn_shutdown_stream has 4 arguments. */
-#undef HAVE_NGTCP2_CONN_SHUTDOWN_STREAM4
-
-/* Define to 1 if you have the `ngtcp2_conn_tls_early_data_rejected' function.
-   */
-#undef HAVE_NGTCP2_CONN_TLS_EARLY_DATA_REJECTED
-
-/* Define to 1 if you have the `ngtcp2_crypto_encrypt_cb' function. */
-#undef HAVE_NGTCP2_CRYPTO_ENCRYPT_CB
-
-/* Define to 1 if you have the
-   `ngtcp2_crypto_quictls_configure_client_context' function. */
-#undef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_CLIENT_CONTEXT
-
-/* Define to 1 if you have the
-   `ngtcp2_crypto_quictls_configure_server_context' function. */
-#undef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_SERVER_CONTEXT
-
-/* Define to 1 if you have the
-   `ngtcp2_crypto_quictls_from_ossl_encryption_level' function. */
-#undef HAVE_NGTCP2_CRYPTO_QUICTLS_FROM_OSSL_ENCRYPTION_LEVEL
-
-/* Define to 1 if you have the `ngtcp2_crypto_quictls_init' function. */
-#undef HAVE_NGTCP2_CRYPTO_QUICTLS_INIT
-
-/* Define to 1 if the system has the type `ngtcp2_encryption_level'. */
-#undef HAVE_NGTCP2_ENCRYPTION_LEVEL
-
-/* Define to 1 if you have the <ngtcp2/ngtcp2_crypto_openssl.h> header file.
-   */
-#undef HAVE_NGTCP2_NGTCP2_CRYPTO_OPENSSL_H
-
-/* Define to 1 if you have the <ngtcp2/ngtcp2_crypto_ossl.h> header file. */
-#undef HAVE_NGTCP2_NGTCP2_CRYPTO_OSSL_H
-
-/* Define to 1 if you have the <ngtcp2/ngtcp2_crypto_quictls.h> header file.
-   */
-#undef HAVE_NGTCP2_NGTCP2_CRYPTO_QUICTLS_H
-
-/* Define to 1 if you have the <ngtcp2/ngtcp2.h> header file. */
-#undef HAVE_NGTCP2_NGTCP2_H
-
 /* Use libnss for crypto */
 #undef HAVE_NSS

@@ -564,27 +472,12 @@
 /* Define if you have POSIX threads libraries and header files. */
 #undef HAVE_PTHREAD

-/* Define to 1 if you have the <pthread_np.h> header file. */
-#undef HAVE_PTHREAD_NP_H
-
 /* Have PTHREAD_PRIO_INHERIT. */
 #undef HAVE_PTHREAD_PRIO_INHERIT

 /* Define to 1 if the system has the type `pthread_rwlock_t'. */
 #undef HAVE_PTHREAD_RWLOCK_T

-/* Define if pthread_setname_np has the common 2 arguments. */
-#undef HAVE_PTHREAD_SETNAME_NP
-
-/* Define if pthread_setname_np has only 1 argument. */
-#undef HAVE_PTHREAD_SETNAME_NP1
-
-/* Define if pthread_setname_np has 3 arguments. */
-#undef HAVE_PTHREAD_SETNAME_NP3
-
-/* Define if pthread_setname_np exists as pthread_set_name_np instead. */
-#undef HAVE_PTHREAD_SET_NAME_NP
-
 /* Define to 1 if the system has the type `pthread_spinlock_t'. */
 #undef HAVE_PTHREAD_SPINLOCK_T

@@ -682,18 +575,12 @@
 /* Define to 1 if you have the `SSL_get1_peer_certificate' function. */
 #undef HAVE_SSL_GET1_PEER_CERTIFICATE

-/* Define to 1 if you have the `SSL_is_quic' function. */
-#undef HAVE_SSL_IS_QUIC
-
 /* Define to 1 if you have the `SSL_set1_host' function. */
 #undef HAVE_SSL_SET1_HOST

 /* Define to 1 if you have the <stdarg.h> header file. */
 #undef HAVE_STDARG_H

-/* Define to 1 if you have the <stdatomic.h> header file. */
-#undef HAVE_STDATOMIC_H
-
 /* Define to 1 if you have the <stdbool.h> header file. */
 #undef HAVE_STDBOOL_H

@@ -730,32 +617,9 @@
 /* Define to 1 if `ipi_spec_dst' is a member of `struct in_pktinfo'. */
 #undef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST

-/* Define to 1 if `tokenlen' is a member of `struct ngtcp2_pkt_hd'. */
-#undef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN
-
-/* Define to 1 if `max_tx_udp_payload_size' is a member of `struct
-   ngtcp2_settings'. */
-#undef HAVE_STRUCT_NGTCP2_SETTINGS_MAX_TX_UDP_PAYLOAD_SIZE
-
-/* Define to 1 if `tokenlen' is a member of `struct ngtcp2_settings'. */
-#undef HAVE_STRUCT_NGTCP2_SETTINGS_TOKENLEN
-
-/* Define to 1 if `original_dcid_present' is a member of `struct
-   ngtcp2_transport_params'. */
-#undef HAVE_STRUCT_NGTCP2_TRANSPORT_PARAMS_ORIGINAL_DCID_PRESENT
-
-/* Define to 1 if the system has the type `struct ngtcp2_version_cid'. */
-#undef HAVE_STRUCT_NGTCP2_VERSION_CID
-
 /* Define to 1 if `sun_len' is a member of `struct sockaddr_un'. */
 #undef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN

-/* Define to 1 if `st_mtimensec' is a member of `struct stat'. */
-#undef HAVE_STRUCT_STAT_ST_MTIMENSEC
-
-/* Define to 1 if `st_mtim.tv_nsec' is a member of `struct stat'. */
-#undef HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC
-
 /* Define if you have Swig libraries and header files. */
 #undef HAVE_SWIG

@@ -1054,9 +918,6 @@
 /* Define this to enable client TCP Fast Open. */
 #undef USE_MSG_FASTOPEN

-/* Define this to use ngtcp2_crypto_ossl. */
-#undef USE_NGTCP2_CRYPTO_OSSL
-
 /* Define this to enable client TCP Fast Open. */
 #undef USE_OSX_MSG_FASTOPEN

@@ -1405,17 +1266,6 @@
 #endif /* !HAVE_ATTR_UNUSED */


-#if defined(DOXYGEN)
-#  define ATTR_NONSTRING(x)  x
-#elif defined(__cplusplus)
-#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
-#elif defined(HAVE_ATTR_NONSTRING)
-#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
-#else /* !HAVE_ATTR_NONSTRING */
-#  define ATTR_NONSTRING(x)  x
-#endif /* !HAVE_ATTR_NONSTRING */
-
-
 #ifndef HAVE_FSEEKO
 #define fseeko fseek
 #define ftello ftell
@@ -1634,10 +1484,6 @@ struct sockaddr_storage;
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
 #  define free(p) unbound_stat_free_log(p, __FILE__, __LINE__, __func__)
 #  define realloc(p,s) unbound_stat_realloc_log(p, s, __FILE__, __LINE__, __func__)
-#  define strdup(s) unbound_stat_strdup_log(s, __FILE__, __LINE__, __func__)
-#ifdef HAVE_REALLOCARRAY
-#  define reallocarray(p,n,s) unbound_stat_reallocarray_log(p, n, s, __FILE__, __LINE__, __func__)
-#endif
 void *unbound_stat_malloc(size_t size);
 void *unbound_stat_calloc(size_t nmemb, size_t size);
 void unbound_stat_free(void *ptr);
@@ -1650,10 +1496,6 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-void *unbound_stat_reallocarray_log(void *ptr, size_t nmemb, size_t size,
-	const char* file, int line, const char* func);
-char *unbound_stat_strdup_log(const char *s, const char* file, int line,
-	const char* func);
 #elif defined(UNBOUND_ALLOC_LITE)
 #  include "util/alloc.h"
 #endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */
@@ -1664,8 +1506,6 @@ char *unbound_stat_strdup_log(const char *s, const char* file, int line,
 #define UNBOUND_DNS_OVER_TLS_PORT 853
 /** default port for DNS over HTTPS traffic. */
 #define UNBOUND_DNS_OVER_HTTPS_PORT 443
-/** default port for DNS over QUIC traffic. */
-#define UNBOUND_DNS_OVER_QUIC_PORT 853
 /** default port for unbound control traffic, registered port with IANA,
    ub-dns-control  8953/tcp    unbound dns nameserver control */
 #define UNBOUND_CONTROL_PORT 8953
@@ -2,7 +2,6 @@
 # Process this file with autoconf to produce a configure script.
 AC_PREREQ([2.56])
 sinclude(acx_nlnetlabs.m4)
-sinclude(ax_build_date_epoch.m4)
 sinclude(ax_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ax_pkg_swig.m4)
@@ -11,7 +10,7 @@ sinclude(dnscrypt/dnscrypt.m4)

 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[25])
+m4_define([VERSION_MINOR],[20])
 m4_define([VERSION_MICRO],[1])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
@@ -19,7 +18,7 @@ AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])

 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=37
+LIBUNBOUND_REVISION=28
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -114,16 +113,7 @@ LIBUNBOUND_AGE=1
 # 1.19.2 had 9:25:1
 # 1.19.3 had 9:26:1
 # 1.20.0 had 9:27:1
-# 1.21.0 had 9:28:1
-# 1.21.1 had 9:29:1
-# 1.22.0 had 9:30:1
-# 1.23.0 had 9:31:1
-# 1.23.1 had 9:32:1
-# 1.24.0 had 9:33:1
-# 1.24.1 had 9:34:1
-# 1.24.2 had 9:35:1
-# 1.25.0 had 9:36:1
-# 1.25.1 had 9:37:1
+# 1.20.1 had 9:28:1

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -332,7 +322,6 @@ fi
 AC_C_INLINE
 ACX_CHECK_FORMAT_ATTRIBUTE
 ACX_CHECK_UNUSED_ATTRIBUTE
-ACX_CHECK_NONSTRING_ATTRIBUTE

 AC_DEFUN([CHECK_WEAK_ATTRIBUTE],
 [AC_REQUIRE([AC_PROG_CC])
@@ -350,8 +339,6 @@ AC_MSG_RESULT($ac_cv_c_weak_attribute)
 if test $ac_cv_c_weak_attribute = yes; then
  AC_DEFINE(HAVE_ATTR_WEAK, 1, [Whether the C compiler accepts the "weak" attribute])
  AC_DEFINE(ATTR_WEAK, [__attribute__((weak))], [apply the weak attribute to a symbol])
-else
-  AC_DEFINE(ATTR_WEAK,[], [apply the weak attribute to a symbol])
 fi
 ])dnl End of CHECK_WEAK_ATTRIBUTE

@@ -363,14 +350,7 @@ AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "noreturn" attribu
 AC_CACHE_VAL(ac_cv_c_noreturn_attribute,
 [ac_cv_c_noreturn_attribute=no
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h>
-#ifdef STDC_HEADERS
-# include <stdlib.h>
-#else
-# ifdef HAVE_STDLIB_H
-#  include <stdlib.h>
-# endif
-#endif
-__attribute__((noreturn)) void f(int x) { printf("%d", x); exit(1); }
+__attribute__((noreturn)) void f(int x) { printf("%d", x); }
 ]], [[
   f(1);
 ]])],[ac_cv_c_noreturn_attribute="yes"],[ac_cv_c_noreturn_attribute="no"])
@@ -380,54 +360,11 @@ AC_MSG_RESULT($ac_cv_c_noreturn_attribute)
 if test $ac_cv_c_noreturn_attribute = yes; then
  AC_DEFINE(HAVE_ATTR_NORETURN, 1, [Whether the C compiler accepts the "noreturn" attribute])
  AC_DEFINE(ATTR_NORETURN, [__attribute__((__noreturn__))], [apply the noreturn attribute to a function that exits the program])
-else
-  AC_DEFINE(ATTR_NORETURN,[], [apply the noreturn attribute to a function that exits the program])
 fi
 ])dnl End of CHECK_NORETURN_ATTRIBUTE

 CHECK_NORETURN_ATTRIBUTE

-AC_DEFUN([CHECK_FALLTHROUGH_ATTRIBUTE],
-[AC_REQUIRE([AC_PROG_CC])
-AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "fallthrough" attribute)
-BAKCFLAGS="$CFLAGS"
-CFLAGS="$CFLAGS -Werror"
-AC_CACHE_VAL(ac_cv_c_fallthrough_attribute,
-[ac_cv_c_fallthrough_attribute=no
-AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h>
-void f(int x) {
-	int y = 0;
-	switch(x) {
-	case 1:
-		y = 1;
-		__attribute__((fallthrough));
-		/* fallthrough */
-	case 2:
-		y++;
-		break;
-	case 3:
-		y = 3;
-		break;
-	}
-	printf("%d", y);
-}
-]], [[
-   f(1);
-]])],[ac_cv_c_fallthrough_attribute="yes"],[ac_cv_c_fallthrough_attribute="no"])
-])
-CFLAGS="$BAKCFLAGS"
-
-AC_MSG_RESULT($ac_cv_c_fallthrough_attribute)
-if test $ac_cv_c_fallthrough_attribute = yes; then
-  AC_DEFINE(HAVE_ATTR_FALLTHROUGH, 1, [Whether the C compiler accepts the "fallthrough" attribute])
-  AC_DEFINE(ATTR_FALLTHROUGH, [__attribute__((fallthrough));], [apply the fallthrough attribute.])
-else
-  AC_DEFINE(ATTR_FALLTHROUGH,[], [apply the fallthrough attribute.])
-fi
-])dnl End of CHECK_FALLTHROUGH_ATTRIBUTE
-
-CHECK_FALLTHROUGH_ATTRIBUTE
-
 if test "$srcdir" != "."; then
 	CPPFLAGS="$CPPFLAGS -I$srcdir"
 fi
@@ -538,7 +475,6 @@ AC_CHECK_HEADERS([netioapi.h],,, [AC_INCLUDES_DEFAULT

 # Check for Linux timestamping headers
 AC_CHECK_HEADERS([linux/net_tstamp.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_HEADERS([stdatomic.h],,, [AC_INCLUDES_DEFAULT])

 # check for types.  
 # Using own tests for int64* because autoconf builtin only give 32bit.
@@ -645,19 +581,19 @@ AC_ARG_ENABLE(alloc-nonregional, AS_HELP_STRING([--enable-alloc-nonregional],[ e
 if test x_$enable_alloc_nonregional = x_yes; then
 	AC_DEFINE(UNBOUND_ALLOC_NONREGIONAL, 1, [use malloc not regions, for debug use])
 fi
-AS_IF([test x_$enable_alloc_checks = x_yes],[
+if test x_$enable_alloc_checks = x_yes; then
 	AC_DEFINE(UNBOUND_ALLOC_STATS, 1, [use statistics for allocs and frees, for debug use])
 	SLDNS_ALLOCCHECK_EXTRA_OBJ="alloc.lo log.lo"
 	AC_SUBST(SLDNS_ALLOCCHECK_EXTRA_OBJ)
 	ASYNCLOOK_ALLOCCHECK_EXTRA_OBJ="alloc.lo"
 	AC_SUBST(ASYNCLOOK_ALLOCCHECK_EXTRA_OBJ)
-],[
-	AS_IF([test x_$enable_alloc_lite = x_yes],[
+else
+	if test x_$enable_alloc_lite = x_yes; then
 		AC_DEFINE(UNBOUND_ALLOC_LITE, 1, [use to enable lightweight alloc assertions, for debug use])
-	],[
+	else
 		ACX_FUNC_MALLOC([unbound])
-	])
-])
+	fi
+fi

 # check windows threads (we use them, not pthreads, on windows).
 if test "$on_mingw" = "yes"; then
@@ -732,76 +668,6 @@ int main(void) {return 0;}
 		])
 fi

-if test x_$ub_have_pthreads != x_no; then
-	# Long checks to support pthread_setname_np().
-	# Some OSes have the extra non-portable functions in a specific
-	# header file.
-	AC_CHECK_HEADERS([pthread_np.h],,, [AC_INCLUDES_DEFAULT])
-	BAKCFLAGS="$CFLAGS"
-	CFLAGS="$CFLAGS -Werror"
-	# MacOS only has 1 argument, the name.
-	AC_MSG_CHECKING([whether pthread_setname_np has only 1 argument])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <pthread.h>
-#ifdef HAVE_PTHREAD_NP_H
-#include <pthread_np.h>
-#endif
-	],[
-	    (void)pthread_setname_np("");
-	])],[
-	    AC_MSG_RESULT(yes)
-	    AC_DEFINE(HAVE_PTHREAD_SETNAME_NP1, 1, [Define if pthread_setname_np has only 1 argument.])
-	],[
-	    AC_MSG_RESULT(no)
-	])
-	# NetBSD has 3 arguments to allow for formatting of the name.
-	AC_MSG_CHECKING([whether pthread_setname_np has 3 arguments])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <pthread.h>
-#ifdef HAVE_PTHREAD_NP_H
-#include <pthread_np.h>
-#endif
-	],[
-	    (void)pthread_setname_np(0, "", NULL);
-	])],[
-	    AC_MSG_RESULT(yes)
-	    AC_DEFINE(HAVE_PTHREAD_SETNAME_NP3, 1, [Define if pthread_setname_np has 3 arguments.])
-	],[
-	    AC_MSG_RESULT(no)
-	])
-	# Most OSes have the common 2 arguments, thread and name.
-	AC_MSG_CHECKING([whether pthread_setname_np has the common 2 arguments])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <pthread.h>
-#ifdef HAVE_PTHREAD_NP_H
-#include <pthread_np.h>
-#endif
-	],[
-	    (void)pthread_setname_np(0, "");
-	])],[
-	    AC_MSG_RESULT(yes)
-	    AC_DEFINE(HAVE_PTHREAD_SETNAME_NP, 1, [Define if pthread_setname_np has the common 2 arguments.])
-	],[
-	    AC_MSG_RESULT(no)
-	])
-	# FreeBSD/OpenBSD use a slightly different function name.
-	AC_MSG_CHECKING([whether pthread_setname_np exists as pthread_set_name_np instead])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <pthread.h>
-#ifdef HAVE_PTHREAD_NP_H
-#include <pthread_np.h>
-#endif
-	],[
-	    (void)pthread_set_name_np(0, "");
-	])],[
-	    AC_MSG_RESULT(yes)
-	    AC_DEFINE(HAVE_PTHREAD_SET_NAME_NP, 1, [Define if pthread_setname_np exists as pthread_set_name_np instead.])
-	],[
-	    AC_MSG_RESULT(no)
-	])
-	CFLAGS="$BAKCFLAGS"
-fi
-
 # check solaris thread library
 AC_ARG_WITH(solaris-threads, AS_HELP_STRING([--with-solaris-threads],[use solaris native thread library.]), [ ],[ withval="no" ])
 ub_have_sol_threads=no
@@ -994,8 +860,7 @@ if test "`uname`" = "Linux"; then
 	GCC_DOCKER_LINTFLAGS='-syntax'
 	AC_SUBST(GCC_DOCKER_LINTFLAGS)
 fi
-AX_BUILD_DATE_EPOCH(CONFIG_DATE, [%Y%m%d])
-AC_ARG_VAR(SOURCE_DATE_EPOCH, [If it is set, it uses the value of that variable instead of the current time as the build timestamp. The format is a unix timestamp. This enables reproducible build output.])
+CONFIG_DATE=`date +%Y%m%d`
 AC_SUBST(CONFIG_DATE)

 # Checks for libraries.
@@ -1087,7 +952,7 @@ LIBS="-lssl $LIBS"
 AC_CHECK_FUNCS([OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername X509_VERIFY_PARAM_set1_host SSL_CTX_set_ciphersuites SSL_CTX_set_tlsext_ticket_key_evp_cb SSL_CTX_set_alpn_select_cb SSL_get0_alpn_selected SSL_CTX_set_alpn_protos SSL_get1_peer_certificate])
 LIBS="$BAKLIBS"

-AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free,SSL_CTX_set_ecdh_auto,SSL_CTX_set_tmp_ecdh], [], [], [
+AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free,SSL_CTX_set_ecdh_auto], [], [], [
 AC_INCLUDES_DEFAULT
 #ifdef HAVE_OPENSSL_ERR_H
 #include <openssl/err.h>
@@ -1316,24 +1181,15 @@ case "$enable_ecdsa" in
      ;;
    *)
      if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
-	      AC_CHECK_FUNC(EVP_PKEY_fromdata, [
-	          # with EVP_PKEY_fromdata, check if EC is not disabled
-	          AC_CHECK_DECL([OPENSSL_NO_EC], [AC_MSG_ERROR([OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa])
-		  ], [], [AC_INCLUDES_DEFAULT
-#include <openssl/evp.h>
-		  ])
-		], [
-		  # without EVP_PKEY_fromdata, older openssl, check for support
-		  AC_CHECK_FUNC(ECDSA_sign, [], [AC_MSG_ERROR([OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa])])
-		  AC_CHECK_FUNC(SHA384_Init, [], [AC_MSG_ERROR([OpenSSL does not support SHA384: please upgrade or rerun with --disable-ecdsa])])
-		])
+	      AC_CHECK_FUNC(ECDSA_sign, [], [AC_MSG_ERROR([OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa])])
+	      AC_CHECK_FUNC(SHA384_Init, [], [AC_MSG_ERROR([OpenSSL does not support SHA384: please upgrade or rerun with --disable-ecdsa])])
 	      AC_CHECK_DECLS([NID_X9_62_prime256v1, NID_secp384r1], [], [AC_MSG_ERROR([OpenSSL does not support the ECDSA curves: please upgrade or rerun with --disable-ecdsa])], [AC_INCLUDES_DEFAULT
 #include <openssl/evp.h>
 	      ])
 	      # see if OPENSSL 1.0.0 or later (has EVP MD and Verify independency)
 	      AC_MSG_CHECKING([if openssl supports SHA2 and ECDSA with EVP])
 	      if grep OPENSSL_VERSION_TEXT $ssldir_include/openssl/opensslv.h | grep "OpenSSL" >/dev/null; then
-		if grep OPENSSL_VERSION_TEXT $ssldir_include/openssl/opensslv.h | grep "OpenSSL 0\." >/dev/null; then
+		if grep OPENSSL_VERSION_NUMBER $ssldir_include/openssl/opensslv.h | grep 0x0 >/dev/null; then
 		  AC_MSG_RESULT([no])
 		  AC_DEFINE_UNQUOTED([USE_ECDSA_EVP_WORKAROUND], [1], [Define this to enable an EVP workaround for older openssl])
 		else
@@ -1667,76 +1523,6 @@ if test x_$withval = x_yes -o x_$withval != x_no; then
    ])
 fi

-# ngtcp2
-AC_ARG_WITH(libngtcp2, AS_HELP_STRING([--with-libngtcp2=path],[specify explicit path for libngtcp2, for QUIC.]),
-    [ ],[ withval="no" ])
-found_libngtcp2="no"
-if test x_$withval = x_yes -o x_$withval != x_no; then
-   AC_MSG_CHECKING(for libngtcp2)
-   if test x_$withval = x_ -o x_$withval = x_yes; then
-            withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
-   fi
-   for dir in $withval ; do
-            if test -f "$dir/include/ngtcp2/ngtcp2.h"; then
-		found_libngtcp2="yes"
-		dnl assume /usr is in default path.
-		if test "$dir" != "/usr"; then
-                    CPPFLAGS="$CPPFLAGS -I$dir/include"
-		    LDFLAGS="$LDFLAGS -L$dir/lib"
-		fi
-		AC_MSG_RESULT(found in $dir)
-		AC_DEFINE([HAVE_NGTCP2], [1], [Define this to use ngtcp2.])
-		LIBS="$LIBS -lngtcp2"
-                break;
-            fi
-    done
-    if test x_$found_libngtcp2 != x_yes; then
-	AC_MSG_ERROR([Could not find libngtcp2, ngtcp2.h])
-    fi
-    AC_CHECK_HEADERS([ngtcp2/ngtcp2.h ngtcp2/ngtcp2_crypto_ossl.h ngtcp2/ngtcp2_crypto_openssl.h ngtcp2/ngtcp2_crypto_quictls.h],,, [AC_INCLUDES_DEFAULT])
-    AC_CHECK_DECLS([ngtcp2_conn_server_new], [], [], [AC_INCLUDES_DEFAULT
-    #include <ngtcp2/ngtcp2.h>
-    ])
-    AC_CHECK_DECLS([ngtcp2_crypto_encrypt_cb], [], [], [AC_INCLUDES_DEFAULT
-    #include <ngtcp2/ngtcp2_crypto.h>
-    ])
-    AC_CHECK_LIB([ngtcp2_crypto_ossl], [ngtcp2_crypto_encrypt_cb], [
-	LIBS="$LIBS -lngtcp2_crypto_ossl"
-	AC_DEFINE(USE_NGTCP2_CRYPTO_OSSL, 1, [Define this to use ngtcp2_crypto_ossl.])
-    ], [
-        AC_CHECK_LIB([ngtcp2_crypto_openssl], [ngtcp2_crypto_encrypt_cb], [ LIBS="$LIBS -lngtcp2_crypto_openssl" ], [
-            AC_CHECK_LIB([ngtcp2_crypto_quictls], [ngtcp2_crypto_encrypt_cb], [ LIBS="$LIBS -lngtcp2_crypto_quictls" ])
-	])
-    ])
-    AC_CHECK_FUNCS([ngtcp2_crypto_encrypt_cb ngtcp2_ccerr_default ngtcp2_conn_in_closing_period ngtcp2_conn_in_draining_period ngtcp2_conn_get_max_local_streams_uni ngtcp2_crypto_quictls_from_ossl_encryption_level ngtcp2_crypto_quictls_configure_server_context ngtcp2_crypto_quictls_configure_client_context ngtcp2_crypto_quictls_init ngtcp2_conn_get_num_scid ngtcp2_conn_tls_early_data_rejected ngtcp2_conn_encode_0rtt_transport_params])
-
-    # these check_funcs need -lssl
-    BAKLIBS="$LIBS"
-    LIBS="-lssl $LIBS"
-    AC_CHECK_FUNCS([SSL_is_quic], [], [AC_MSG_ERROR([No QUIC support detected in OpenSSL. Need OpenSSL version with QUIC support to enable DNS over QUIC with libngtcp2.])])
-    LIBS="$BAKLIBS"
-
-    AC_CHECK_TYPES([struct ngtcp2_version_cid, ngtcp2_encryption_level],,,[AC_INCLUDES_DEFAULT
-    #include <ngtcp2/ngtcp2.h>
-    ])
-    AC_CHECK_MEMBERS([struct ngtcp2_pkt_hd.tokenlen, struct ngtcp2_settings.tokenlen, struct ngtcp2_settings.max_tx_udp_payload_size, struct ngtcp2_transport_params.original_dcid_present],,,[AC_INCLUDES_DEFAULT
-    #include <ngtcp2/ngtcp2.h>
-    ])
-
-    AC_MSG_CHECKING([whether ngtcp2_conn_shutdown_stream has 4 arguments])
-    AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <ngtcp2/ngtcp2.h>
-    ],[
-	(void)ngtcp2_conn_shutdown_stream(NULL, 0, 0, 0);
-    ])],[
-	AC_MSG_RESULT(yes)
-	AC_DEFINE(HAVE_NGTCP2_CONN_SHUTDOWN_STREAM4, 1, [Define if ngtcp2_conn_shutdown_stream has 4 arguments.])
-    ],[
-	AC_MSG_RESULT(no)
-    ])
-
-fi
-
 # set static linking for uninstalled libraries if requested
 AC_SUBST(staticexe)
 staticexe=""
@@ -1753,12 +1539,10 @@ if test x_$enable_static_exe = x_yes; then
 			LIBS="$LIBS -lgdi32"
 		fi
 		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
-		if echo "$host" | $GREP -i -e linux >/dev/null; then
-			if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
-				:
-			else
-				LIBS="$LIBS -l:libssp.a"
-			fi
+		if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
+			:
+		else
+			LIBS="$LIBS -l:libssp.a"
 		fi
 	fi
 fi
@@ -1776,12 +1560,10 @@ if test x_$enable_fully_static = x_yes; then
 			LIBS="$LIBS -lgdi32"
 		fi
 		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
-		if echo "$host" | $GREP -i -e linux >/dev/null; then
-			if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
-				:
-			else
-				LIBS="$LIBS -l:libssp.a"
-			fi
+		if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
+			:
+		else
+			LIBS="$LIBS -l:libssp.a"
 		fi
 	fi
 fi
@@ -1840,7 +1622,6 @@ if test $ac_cv_func_daemon = yes; then
 ])
 fi

-AC_CHECK_MEMBERS([struct stat.st_mtimensec, struct stat.st_mtim.tv_nsec])
 AC_CHECK_MEMBERS([struct sockaddr_un.sun_len],,,[
 AC_INCLUDES_DEFAULT
 #ifdef HAVE_SYS_UN_H
@@ -1919,25 +1700,6 @@ AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])
 if echo $host_os | grep darwin8 > /dev/null; then
 	AC_DEFINE(DARWIN_BROKEN_SETREUID, 1, [Define this if on macOSX10.4-darwin8 and setreuid and setregid do not work])
 fi
-
-AC_MSG_CHECKING([for atomic_store])
-AC_LINK_IFELSE([AC_LANG_PROGRAM(AC_INCLUDES_DEFAULT [[
-#ifdef HAVE_STDATOMIC_H
-#include <stdatomic.h>
-#endif
-]], [[
-	int newvar = 5, var = 0;
-	atomic_store((_Atomic int*)&var, newvar);
-	newvar = 0;
-	/* condition to use the variables. */
-	if(var == newvar) return 1;
-]])], [
-	AC_MSG_RESULT(yes)
-	AC_DEFINE(HAVE_LINK_ATOMIC_STORE, 1, [If we have atomic_store])
-], [
-	AC_MSG_RESULT([no])
-])
-
 AC_CHECK_DECLS([inet_pton,inet_ntop], [], [], [
 AC_INCLUDES_DEFAULT
 #ifdef HAVE_NETINET_IN_H
@@ -2076,12 +1838,10 @@ if test x_$enable_lock_checks = x_yes; then
 	UBSYMS="-export-symbols clubsyms.def"
 	cp ${srcdir}/libunbound/ubsyms.def clubsyms.def
 	echo lock_protect >> clubsyms.def
-	echo lock_protect_place >> clubsyms.def
 	echo lock_unprotect >> clubsyms.def
 	echo lock_get_mem >> clubsyms.def
 	echo checklock_start >> clubsyms.def
 	echo checklock_stop >> clubsyms.def
-	echo checklock_set_output_name >> clubsyms.def
 	echo checklock_lock >> clubsyms.def
 	echo checklock_unlock >> clubsyms.def
 	echo checklock_init >> clubsyms.def
@@ -2162,17 +1922,15 @@ case "$enable_ipset" in
 		IPSET_OBJ="ipset.lo"
 		AC_SUBST(IPSET_OBJ)

-		# BSD's pf
-		AC_CHECK_HEADERS([net/pfvar.h], [], [
-		    # mnl
-		    AC_ARG_WITH(libmnl, AS_HELP_STRING([--with-libmnl=path],[specify explicit path for libmnl.]),
+		# mnl
+		AC_ARG_WITH(libmnl, AS_HELP_STRING([--with-libmnl=path],[specify explicit path for libmnl.]),
 			[ ],[ withval="yes" ])
-		    found_libmnl="no"
-		    AC_MSG_CHECKING(for libmnl)
-		    if test x_$withval = x_ -o x_$withval = x_yes; then
+		found_libmnl="no"
+		AC_MSG_CHECKING(for libmnl)
+		if test x_$withval = x_ -o x_$withval = x_yes; then
 			withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
-		    fi
-		    for dir in $withval ; do
+		fi
+		for dir in $withval ; do
 			if test -f "$dir/include/libmnl/libmnl.h" -o -f "$dir/include/libmnl/libmnl/libmnl.h"; then
 				found_libmnl="yes"
 				dnl assume /usr is in default path.
@@ -2190,14 +1948,10 @@ case "$enable_ipset" in
 				LIBS="$LIBS -lmnl"
 				break;
 			fi
-		    done
-		    if test x_$found_libmnl != x_yes; then
-			  AC_MSG_ERROR([Could not find libmnl, libmnl.h])
-		    fi
-		], [
-		  #include <netinet/in.h>
-		  #include <net/if.h>
-		])
+		done
+		if test x_$found_libmnl != x_yes; then
+			AC_MSG_ERROR([Could not find libmnl, libmnl.h])
+		fi
 		;;
    no|*)
    	# nothing
@@ -2378,7 +2132,6 @@ dnl includes

 AHX_CONFIG_FORMAT_ATTRIBUTE
 AHX_CONFIG_UNUSED_ATTRIBUTE
-AHX_CONFIG_NONSTRING_ATTRIBUTE
 AHX_CONFIG_FSEEKO
 AHX_CONFIG_MAXHOSTNAMELEN
 #if !defined(HAVE_SNPRINTF) || defined(SNPRINTF_RET_BROKEN)
@@ -2516,10 +2269,6 @@ struct sockaddr_storage;
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
 #  define free(p) unbound_stat_free_log(p, __FILE__, __LINE__, __func__)
 #  define realloc(p,s) unbound_stat_realloc_log(p, s, __FILE__, __LINE__, __func__)
-#  define strdup(s) unbound_stat_strdup_log(s, __FILE__, __LINE__, __func__)
-#ifdef HAVE_REALLOCARRAY
-#  define reallocarray(p,n,s) unbound_stat_reallocarray_log(p, n, s, __FILE__, __LINE__, __func__)
-#endif
 void *unbound_stat_malloc(size_t size);
 void *unbound_stat_calloc(size_t nmemb, size_t size);
 void unbound_stat_free(void *ptr);
@@ -2532,10 +2281,6 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-void *unbound_stat_reallocarray_log(void *ptr, size_t nmemb, size_t size,
-	const char* file, int line, const char* func);
-char *unbound_stat_strdup_log(const char *s, const char* file, int line,
-	const char* func);
 #elif defined(UNBOUND_ALLOC_LITE)
 #  include "util/alloc.h"
 #endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */
@@ -2546,8 +2291,6 @@ char *unbound_stat_strdup_log(const char *s, const char* file, int line,
 #define UNBOUND_DNS_OVER_TLS_PORT 853
 /** default port for DNS over HTTPS traffic. */
 #define UNBOUND_DNS_OVER_HTTPS_PORT 443
-/** default port for DNS over QUIC traffic. */
-#define UNBOUND_DNS_OVER_QUIC_PORT 853
 /** default port for unbound control traffic, registered port with IANA,
    ub-dns-control  8953/tcp    unbound dns nameserver control */
 #define UNBOUND_CONTROL_PORT 8953
@@ -2559,8 +2302,7 @@ char *unbound_stat_strdup_log(const char *s, const char* file, int line,
 dnl if we build from source tree, the man pages need @date@ and @version@
 dnl if this is a distro tarball, that was already done by makedist.sh
 AC_SUBST(version, [VERSION_MAJOR.VERSION_MINOR.VERSION_MICRO])
-AX_BUILD_DATE_EPOCH(date, [[%b %e, %Y]])
-AC_SUBST(date)
+AC_SUBST(date, [`date +'%b %e, %Y'`])

 AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service contrib/unbound_portable.service])
 AC_CONFIG_HEADERS([config.h])
@@ -58,5 +58,3 @@ distribution but may be helpful.
 * unbound.init_yocto: An init script to start and stop the server. Put it
  in /etc/init.d/unbound to use it. It is for the Yocto Project, in
  embedded systems, contributed by beni-sandu.
-* gost12.patch: adds ECC-GOST12 support for the informational RFC9558.
-  Contributed by Igor V. Ruzanov.
@@ -1,10 +1,10 @@
 diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
-index 172eb26c..2921c87f 100644
+index 5a75e319..c6c6dbe2 100644
 --- a/doc/unbound.conf.5.in
 +++ b/doc/unbound.conf.5.in
-@@ -2146,6 +2146,13 @@ Default: no
- .UNINDENT
- .INDENT 0.0
+@@ -970,6 +970,13 @@ potentially broken nameservers. A lot of domains will not be resolvable when
+ this option in enabled. Only use if you know what you are doing.
+ This option only has effect when qname-minimisation is enabled. Default is no.
 .TP
 +.B aaaa\-filter: \fI<yes or no>
 +Activate behavior similar to BIND's AAAA-filter.
@@ -13,14 +13,14 @@ index 172eb26c..2921c87f 100644
 +This also causes an additional A query to be sent for each AAAA query.
 +This breaks DNSSEC!
 +.TP
- .B aggressive\-nsec: \fI<yes or no>\fP 
- Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN and other
- denials, using information from previous NXDOMAINs answers.
+ .B aggressive\-nsec: \fI<yes or no>
+ Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN
+ and other denials, using information from previous NXDOMAINs answers.
 diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c
-index 49a5f5da..fbe434fa 100644
+index f093c1bf..e55a2246 100644
 --- a/iterator/iter_scrub.c
 +++ b/iterator/iter_scrub.c
-@@ -849,6 +849,32 @@ scrub_sanitize_rr_length(sldns_buffer* pkt, struct msg_parse* msg,
+@@ -679,6 +679,32 @@ static int sanitize_nsec_is_overreach(sldns_buffer* pkt,
 	return 0;
 }
 
@@ -53,15 +53,15 @@ index 49a5f5da..fbe434fa 100644
 /**
  * Given a response event, remove suspect RRsets from the response.
  * "Suspect" rrsets are potentially poison. Note that this routine expects
-@@ -869,6 +895,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
+@@ -698,6 +724,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
- 	struct iter_env* ie, struct module_qstate* qstate)
+ 	struct iter_env* ie)
 {
 +	int found_a_record = 0; /* ASN: do we have a A record? */
 	int del_addi = 0; /* if additional-holding rrsets are deleted, we
 		do not trust the normalized additional-A-AAAA any more */
- 	uint8_t* ns_rrset_dname = NULL;
-@@ -906,6 +933,13 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
+ 	struct rrset_parse* rrset, *prev;
+@@ -733,6 +760,13 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 		rrset = rrset->rrset_all_next;
 	}
 
@@ -75,9 +75,9 @@ index 49a5f5da..fbe434fa 100644
 	/* At this point, we brutally remove ALL rrsets that aren't 
 	 * children of the originating zone. The idea here is that, 
 	 * as far as we know, the server that we contacted is ONLY 
-@@ -925,6 +959,24 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
- 				continue;
- 		}
+@@ -744,6 +778,24 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
+ 	rrset = msg->rrset_first;
+ 	while(rrset) {
 
 +		/* ASN: For AAAA records only... */
 +		if((ie->aaaa_filter) && (rrset->type == LDNS_RR_TYPE_AAAA)) {
@@ -101,10 +101,10 @@ index 49a5f5da..fbe434fa 100644
 		if( (rrset->type == LDNS_RR_TYPE_A || 
 			rrset->type == LDNS_RR_TYPE_AAAA)) {
 diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c
-index 1da21896..6583dd0e 100644
+index 2482a1f4..bd5ba243 100644
 --- a/iterator/iter_utils.c
 +++ b/iterator/iter_utils.c
-@@ -250,6 +250,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
+@@ -177,6 +177,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 	iter_env->outbound_msg_retry = cfg->outbound_msg_retry;
 	iter_env->max_sent_count = cfg->max_sent_count;
 	iter_env->max_query_restarts = cfg->max_query_restarts;
@@ -113,12 +113,12 @@ index 1da21896..6583dd0e 100644
 }
 
 diff --git a/iterator/iterator.c b/iterator/iterator.c
-index 71e64655..735f4ca0 100644
+index 54006940..768fe202 100644
 --- a/iterator/iterator.c
 +++ b/iterator/iterator.c
-@@ -2412,6 +2412,53 @@ check_waiting_queries(struct iter_qstate* iq, struct module_qstate* qstate,
- 		qstate->ext_state[id] = module_wait_reply;
- 	}
+@@ -2155,6 +2155,53 @@ processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id)
+ 
+ 	return 0;
 }
 +
 +/**
@@ -170,8 +170,8 @@ index 71e64655..735f4ca0 100644
 	
 /** 
  * This is the request event state where the request will be sent to one of
-@@ -2554,6 +2601,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
- 		}
+@@ -2216,6 +2263,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
+ 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 	
 +	/* ASN: If we have a AAAA query, then also query for A records */
@@ -184,7 +184,7 @@ index 71e64655..735f4ca0 100644
 	/* Make sure we have a delegation point, otherwise priming failed
 	 * or another failure occurred */
 	if(!iq->dp) {
-@@ -4178,6 +4232,61 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -3648,6 +3702,61 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 	return 0;
 }
 
@@ -236,7 +236,7 @@ index 71e64655..735f4ca0 100644
 +		/* see if the failure did get (parent-lame) info */
 +		if(!cache_fill_missing(super->env,
 +			super_iq->qchase.qclass, super->region,
-+			super_iq->dp, 0))
+			super_iq->dp))
 +		log_err("ASN-AAAA-filter: out of memory adding missing");
 +		dpns->resolved = 1; /* mark as failed */
 +	}
@@ -246,7 +246,7 @@ index 71e64655..735f4ca0 100644
 /*
  * Return priming query results to interested super querystates.
  * 
-@@ -4197,6 +4306,9 @@ iter_inform_super(struct module_qstate* qstate, int id,
+@@ -3667,6 +3776,9 @@ iter_inform_super(struct module_qstate* qstate, int id,
 	else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
 		super->minfo[id])->state == DSNS_FIND_STATE)
 		processDSNSResponse(qstate, id, super);
@@ -256,7 +256,7 @@ index 71e64655..735f4ca0 100644
 	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
 		error_supers(qstate, id, super);
 	else if(qstate->is_priming)
-@@ -4234,6 +4346,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -3704,6 +3816,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
 			case INIT_REQUEST_3_STATE:
 				cont = processInitRequest3(qstate, iq, id);
 				break;
@@ -266,7 +266,7 @@ index 71e64655..735f4ca0 100644
 			case QUERYTARGETS_STATE:
 				cont = processQueryTargets(qstate, iq, ie, id);
 				break;
-@@ -4578,6 +4693,8 @@ iter_state_to_string(enum iter_state state)
+@@ -4040,6 +4155,8 @@ iter_state_to_string(enum iter_state state)
 		return "INIT REQUEST STATE (stage 2)";
 	case INIT_REQUEST_3_STATE:
 		return "INIT REQUEST STATE (stage 3)";
@@ -275,7 +275,7 @@ index 71e64655..735f4ca0 100644
 	case QUERYTARGETS_STATE :
 		return "QUERY TARGETS STATE";
 	case PRIME_RESP_STATE :
-@@ -4602,6 +4719,7 @@ iter_state_is_responsestate(enum iter_state s)
+@@ -4064,6 +4181,7 @@ iter_state_is_responsestate(enum iter_state s)
 		case INIT_REQUEST_STATE :
 		case INIT_REQUEST_2_STATE :
 		case INIT_REQUEST_3_STATE :
@@ -284,10 +284,10 @@ index 71e64655..735f4ca0 100644
 		case COLLECT_CLASS_STATE :
 			return 0;
 diff --git a/iterator/iterator.h b/iterator/iterator.h
-index ae4b4e45..a44f9d27 100644
+index 8b840528..a61c4195 100644
 --- a/iterator/iterator.h
 +++ b/iterator/iterator.h
-@@ -157,6 +157,9 @@ struct iter_env {
+@@ -133,6 +133,9 @@ struct iter_env {
 	 */
 	int* target_fetch_policy;
 
@@ -297,7 +297,7 @@ index ae4b4e45..a44f9d27 100644
 	/** lock on ratelimit counter */
 	lock_basic_type queries_ratelimit_lock;
 	/** number of queries that have been ratelimited */
-@@ -217,6 +220,14 @@ enum iter_state {
+@@ -187,6 +190,14 @@ enum iter_state {
 	 */
 	INIT_REQUEST_3_STATE,
 
@@ -312,9 +312,9 @@ index ae4b4e45..a44f9d27 100644
 	/**
 	 * Each time a delegation point changes for a given query or a 
 	 * query times out and/or wakes up, this state is (re)visited. 
-@@ -434,6 +445,13 @@ struct iter_qstate {
- 	 * already so that it is accepted later. */
- 	int empty_nodata_found;
+@@ -376,6 +387,13 @@ struct iter_qstate {
+ 	 */
+ 	int refetch_glue;
 
 +	/**
 +	 * ASN: This is a flag that, if true, means that this query is
@@ -327,10 +327,10 @@ index ae4b4e45..a44f9d27 100644
 	struct outbound_list outlist;
 
 diff --git a/pythonmod/interface.i b/pythonmod/interface.i
-index 2040fb9e..f073c3dc 100644
+index 1ca8686a..d91b19ec 100644
 --- a/pythonmod/interface.i
 +++ b/pythonmod/interface.i
-@@ -1013,6 +1013,7 @@ struct config_file {
+@@ -995,6 +995,7 @@ struct config_file {
    int harden_dnssec_stripped;
    int harden_referral_path;
    int use_caps_bits_for_id;
@@ -339,23 +339,23 @@ index 2040fb9e..f073c3dc 100644
    struct config_strlist* private_domain;
    size_t unwanted_threshold;
 diff --git a/util/config_file.c b/util/config_file.c
-index b1e767b3..5eb3c099 100644
+index 969d664b..8d94b008 100644
 --- a/util/config_file.c
 +++ b/util/config_file.c
-@@ -247,6 +247,7 @@ config_create(void)
+@@ -231,6 +231,7 @@ config_create(void)
+ 	cfg->harden_referral_path = 0;
 	cfg->harden_algo_downgrade = 0;
- 	cfg->harden_unknown_additional = 0;
 	cfg->use_caps_bits_for_id = 0;
 +	cfg->aaaa_filter = 0; /* ASN: default is disabled */
 	cfg->caps_whitelist = NULL;
 	cfg->private_address = NULL;
 	cfg->private_domain = NULL;
 diff --git a/util/config_file.h b/util/config_file.h
-index 44ac036b..1e59ab07 100644
+index c7c9a0a4..e3aa15b0 100644
 --- a/util/config_file.h
 +++ b/util/config_file.h
-@@ -311,6 +311,8 @@ struct config_file {
- 	int harden_unknown_additional;
+@@ -285,6 +285,8 @@ struct config_file {
+ 	int harden_algo_downgrade;
 	/** use 0x20 bits in query as random ID bits */
 	int use_caps_bits_for_id;
 +	/** ASN: enable AAAA filter? */
@@ -364,10 +364,10 @@ index 44ac036b..1e59ab07 100644
 	struct config_strlist* caps_whitelist;
 	/** strip away these private addrs from answers, no DNS Rebinding */
 diff --git a/util/configlexer.lex b/util/configlexer.lex
-index bc258673..76aab170 100644
+index 34a0e5dd..c890be2a 100644
 --- a/util/configlexer.lex
 +++ b/util/configlexer.lex
-@@ -327,6 +327,7 @@ use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
+@@ -317,6 +317,7 @@ use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
 caps-whitelist{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
 caps-exempt{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
 unwanted-reply-threshold{COLON}	{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
@@ -376,10 +376,10 @@ index bc258673..76aab170 100644
 private-domain{COLON}		{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
 prefetch-key{COLON}		{ YDVAR(1, VAR_PREFETCH_KEY) }
 diff --git a/util/configparser.y b/util/configparser.y
-index 82e1d878..dc19bed5 100644
+index d4f965f9..8cc237c6 100644
 --- a/util/configparser.y
 +++ b/util/configparser.y
-@@ -100,6 +100,7 @@ extern struct config_parser_state* cfg_parser;
+@@ -97,6 +97,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT
 %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
 %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
@@ -387,7 +387,7 @@ index 82e1d878..dc19bed5 100644
 %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
 %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
 %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
-@@ -276,6 +277,7 @@ content_server: server_num_threads | server_verbosity | server_port |
+@@ -247,6 +248,7 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size |
 	server_harden_referral_path | server_private_address |
 	server_private_domain | server_extended_statistics |
@@ -395,7 +395,7 @@ index 82e1d878..dc19bed5 100644
 	server_local_data_ptr | server_jostle_timeout |
 	server_unwanted_reply_threshold | server_log_time_ascii |
 	server_domain_insecure | server_val_sig_skew_min |
-@@ -1932,6 +1934,15 @@ server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG
+@@ -1754,6 +1756,15 @@ server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG
 			yyerror("out of memory");
 	}
 	;
@@ -1,24 +1,21 @@
 #!/usr/bin/env bash

-LIBEXPAT_FNAME=expat-2.7.0
-LIBEXPAT_VERSION_DIR=R_2_7_0
-
 echo "Downloading Expat"
-if ! curl -L -k -s -o $LIBEXPAT_FNAME.tar.gz https://github.com/libexpat/libexpat/releases/download/$LIBEXPAT_VERSION_DIR/$LIBEXPAT_FNAME.tar.gz;
+if ! curl -L -k -s -o expat-2.2.9.tar.gz https://github.com/libexpat/libexpat/releases/download/R_2_2_9/expat-2.2.9.tar.gz;
 then
    echo "Failed to download Expat"
    exit 1
 fi

 echo "Unpacking Expat"
-rm -rf ./$LIBEXPAT_FNAME
-if ! tar -xf $LIBEXPAT_FNAME.tar.gz;
+rm -rf ./expat-2.2.9
+if ! tar -xf expat-2.2.9.tar.gz;
 then
    echo "Failed to unpack Expat"
    exit 1
 fi

-cd $LIBEXPAT_FNAME || exit 1
+cd expat-2.2.9 || exit 1

 echo "Configuring Expat"
 if ! ./configure --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST" --prefix="$ANDROID_PREFIX"; then
@@ -1,325 +0,0 @@
-diff --git a/sldns/keyraw.c b/sldns/keyraw.c
-index 42a9262a3..cc6406a56 100644
--- a/sldns/keyraw.c
-+++ b/sldns/keyraw.c
-@@ -85,7 +85,7 @@ sldns_rr_dnskey_key_size_raw(const unsigned char* keydata,
- 		}
- 		break;
- #ifdef USE_GOST
-	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 		return 512;
- #endif
- #ifdef USE_ECDSA
-@@ -146,7 +146,7 @@ sldns_key_EVP_load_gost_id(void)
- 	if(gost_id) return gost_id;
- 
- 	/* see if configuration loaded gost implementation from other engine*/
-	meth = EVP_PKEY_asn1_find_str(NULL, "gost2001", -1);
-+	meth = EVP_PKEY_asn1_find_str(NULL, "gost2012_256", -1);
- 	if(meth) {
- 		EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
- 		return gost_id;
-@@ -170,7 +170,7 @@ sldns_key_EVP_load_gost_id(void)
- 		return 0;
- 	}
- 
-	meth = EVP_PKEY_asn1_find_str(&e, "gost2001", -1);
-+	meth = EVP_PKEY_asn1_find_str(&e, "gost2012_256", -1);
- 	if(!meth) {
- 		/* algo not found */
- 		ENGINE_finish(e);
-@@ -536,12 +536,17 @@ EVP_PKEY* sldns_key_rsa2pkey_raw(unsigned char* key, size_t len)
- EVP_PKEY*
- sldns_gost2pkey_raw(unsigned char* key, size_t keylen)
- {
-	/* prefix header for X509 encoding */
-	uint8_t asn[37] = { 0x30, 0x63, 0x30, 0x1c, 0x06, 0x06, 0x2a, 0x85, 
-		0x03, 0x02, 0x02, 0x13, 0x30, 0x12, 0x06, 0x07, 0x2a, 0x85, 
-		0x03, 0x02, 0x02, 0x23, 0x01, 0x06, 0x07, 0x2a, 0x85, 0x03, 
-		0x02, 0x02, 0x1e, 0x01, 0x03, 0x43, 0x00, 0x04, 0x40};
-	unsigned char encoded[37+64];
-+	/* prefix header for X509 encoding
-+	 *
-+	 * note: based on draft-makarenko-gost2012-dnssec-01 (pre-RFC9558 and it DOES work!)
-+	 * ASN1 header described in RFC9558 is not suitable due to d2i_PUBKEY() works with
-+	 * non-compressed public keys (two additional bytes 0x04, 0x40 at the end of header)
-+	 */
-+	uint8_t asn[32] = { 0x30, 0x5e, 0x30, 0x17, 0x06, 0x08, 0x2a, 0x85,
-+			    0x03, 0x07, 0x01, 0x01, 0x01, 0x01, 0x30, 0x0b,
-+			    0x06, 0x09, 0x2a, 0x85, 0x03, 0x07, 0x01, 0x02,
-+			    0x01, 0x01, 0x01, 0x03, 0x43, 0x00, 0x04, 0x40 };
-+	unsigned char encoded[32+64];
- 	const unsigned char* pp;
- 	if(keylen != 64) {
- 		/* key wrong size */
-@@ -549,8 +554,8 @@ sldns_gost2pkey_raw(unsigned char* key, size_t keylen)
- 	}
- 
- 	/* create evp_key */
-	memmove(encoded, asn, 37);
-	memmove(encoded+37, key, 64);
-+	memmove(encoded, asn, 32);
-+	memmove(encoded+32, key, 64);
- 	pp = (unsigned char*)&encoded[0];
- 
- 	return d2i_PUBKEY(NULL, &pp, (int)sizeof(encoded));
-diff --git a/sldns/rrdef.h b/sldns/rrdef.h
-index bbc3d5b86..7d5f3c057 100644
--- a/sldns/rrdef.h
-+++ b/sldns/rrdef.h
-@@ -384,11 +384,12 @@ enum sldns_enum_algorithm
-         LDNS_RSASHA1_NSEC3      = 7,
-         LDNS_RSASHA256          = 8,   /* RFC 5702 */
-         LDNS_RSASHA512          = 10,  /* RFC 5702 */
-        LDNS_ECC_GOST           = 12,  /* RFC 5933 */
-+        LDNS_ECC_GOST           = 12,  /* RFC 5933, deprecated */
-         LDNS_ECDSAP256SHA256    = 13,  /* RFC 6605 */
-         LDNS_ECDSAP384SHA384    = 14,  /* RFC 6605 */
- 	LDNS_ED25519		= 15,  /* RFC 8080 */
- 	LDNS_ED448		= 16,  /* RFC 8080 */
-+	LDNS_ECC_GOST12		= 23,  /* RFC 9558 */
-         LDNS_INDIRECT           = 252,
-         LDNS_PRIVATEDNS         = 253,
-         LDNS_PRIVATEOID         = 254
-@@ -402,8 +403,9 @@ enum sldns_enum_hash
- {
-         LDNS_SHA1               = 1,  /* RFC 4034 */
-         LDNS_SHA256             = 2,  /* RFC 4509 */
-        LDNS_HASH_GOST          = 3,  /* RFC 5933 */
-        LDNS_SHA384             = 4   /* RFC 6605 */
-+        LDNS_HASH_GOST          = 3,  /* RFC 5933, deprecated */
-+        LDNS_SHA384             = 4,  /* RFC 6605 */
-+        LDNS_HASH_GOST12        = 5   /* RFC 9558 */
- };
- typedef enum sldns_enum_hash sldns_hash;
- 
-diff --git a/sldns/wire2str.c b/sldns/wire2str.c
-index 75b8f37b0..b4c4755e6 100644
--- a/sldns/wire2str.c
-+++ b/sldns/wire2str.c
-@@ -45,11 +45,12 @@ static sldns_lookup_table sldns_algorithms_data[] = {
- 	{ LDNS_RSASHA1_NSEC3, "RSASHA1-NSEC3-SHA1" },
- 	{ LDNS_RSASHA256, "RSASHA256"},
- 	{ LDNS_RSASHA512, "RSASHA512"},
-	{ LDNS_ECC_GOST, "ECC-GOST"},
-+	{ LDNS_ECC_GOST, "ECC-GOST"}, /* deprecated */
- 	{ LDNS_ECDSAP256SHA256, "ECDSAP256SHA256"},
- 	{ LDNS_ECDSAP384SHA384, "ECDSAP384SHA384"},
- 	{ LDNS_ED25519, "ED25519"},
- 	{ LDNS_ED448, "ED448"},
-+	{ LDNS_ECC_GOST12, "ECC-GOST12"},
- 	{ LDNS_INDIRECT, "INDIRECT" },
- 	{ LDNS_PRIVATEDNS, "PRIVATEDNS" },
- 	{ LDNS_PRIVATEOID, "PRIVATEOID" },
-@@ -61,8 +62,9 @@ sldns_lookup_table* sldns_algorithms = sldns_algorithms_data;
- static sldns_lookup_table sldns_hashes_data[] = {
- 	{ LDNS_SHA1, "SHA1" },
- 	{ LDNS_SHA256, "SHA256" },
-	{ LDNS_HASH_GOST, "HASH-GOST" },
-+	{ LDNS_HASH_GOST, "HASH-GOST" }, /* deprecated */
- 	{ LDNS_SHA384, "SHA384" },
-+	{ LDNS_HASH_GOST12, "HASH-GOST12" },
- 	{ 0, NULL }
- };
- sldns_lookup_table* sldns_hashes = sldns_hashes_data;
-diff --git a/testcode/unitverify.c b/testcode/unitverify.c
-index fcf2e2ffe..4a33e9f6a 100644
--- a/testcode/unitverify.c
-+++ b/testcode/unitverify.c
-@@ -696,7 +696,7 @@ verify_test(void)
- #endif
- #ifdef USE_GOST
- 	if(sldns_key_EVP_load_gost_id())
-	  verifytest_file(SRCDIRSTR "/testdata/test_sigs.gost", "20090807060504");
-+	  verifytest_file(SRCDIRSTR "/testdata/test_sigs.gost12", "20251226060504");
- 	else printf("Warning: skipped GOST, openssl does not provide gost.\n");
- #endif
- #ifdef USE_ECDSA
-diff --git a/testdata/test_sigs.gost12 b/testdata/test_sigs.gost12
-new file mode 100644
-index 000000000..72a250cff
--- /dev/null
-+++ b/testdata/test_sigs.gost12
-@@ -0,0 +1,39 @@
-+; Signature test file
-+
-+; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification.
-+; later entries are verified with it.
-+
-+; Test GOST signatures using algo number 23.
-+
-+ENTRY_BEGIN
-+SECTION QUESTION
-+nlnetlabs.nl.	IN DNSKEY
-+SECTION ANSWER
-+nlnetlabs.nl.   3600    IN      DNSKEY  256 3 23 cdOtkEcb6NhcdOpIbPYtWyWxdlUiKgtKQbYg3lIjtG7i3fYjUID9zyOgoQEiV9wuGCfrw5cNsnvNw+8HiVFK4g== ;{id = 12301 (zsk), size = 512b}
-+ENTRY_END
-+
-+; entry to test
-+ENTRY_BEGIN
-+SECTION QUESTION
-+open.nlnetlabs.nl. IN A
-+SECTION ANSWER
-+open.nlnetlabs.nl.      600     IN      A       213.154.224.1
-+open.nlnetlabs.nl.      600     IN      RRSIG   A 23 3 600 20260122084903 20251225084903 12301 nlnetlabs.nl. I12wYNs96DxMy26CWx296/sWMJAFg4nNXBo0sw7PnuMbJW5NFAmZYtFWhUdOWn4umaiodYOAmKG8Zg/OKvEtAQ==
-+ENTRY_END
-+
-+ENTRY_BEGIN
-+SECTION QUESTION
-+open.nlnetlabs.nl. IN AAAA
-+SECTION ANSWER
-+open.nlnetlabs.nl.      600     IN      AAAA    2001:7b8:206:1::1
-+open.nlnetlabs.nl.      600     IN      AAAA    2001:7b8:206:1::53
-+open.nlnetlabs.nl.      600     IN      RRSIG   AAAA 23 3 600 20260122084903 20251225084903 12301 nlnetlabs.nl. J0jHa+CP8HM6UDa2+uYgaze2mfpJTh2hkZ2KwMTYb5sfL6iBmxxql0c/403Itk4fMfYBMGn7zfzDQ+CxnCgSWw==
-+ENTRY_END
-+
-+ENTRY_BEGIN
-+SECTION QUESTION
-+open.nlnetlabs.nl. IN NSEC
-+SECTION ANSWER
-+open.nlnetlabs.nl.      86400   IN      NSEC    nlnetlabs.nl. A AAAA RRSIG NSEC
-+open.nlnetlabs.nl.      86400   IN      RRSIG   NSEC 23 3 86400 20260122084903 20251225084903 12301 nlnetlabs.nl. INCLYe9vAaNYaYx5Ay3Q6QdX+wPW9sMRvVlGt/jUEGgCi+88QlV80CT1oHrhRI66I14Wk6NRAGZRNx1tUPSHSg==
-+ENTRY_END
-diff --git a/validator/val_secalgo.c b/validator/val_secalgo.c
-index be8347b1b..4f621a309 100644
--- a/validator/val_secalgo.c
-+++ b/validator/val_secalgo.c
-@@ -246,10 +246,10 @@ ds_digest_size_supported(int algo)
- 			return SHA256_DIGEST_LENGTH;
- #endif
- #ifdef USE_GOST
-		case LDNS_HASH_GOST:
-+		case LDNS_HASH_GOST12:
- 			/* we support GOST if it can be loaded */
- 			(void)sldns_key_EVP_load_gost_id();
-			if(EVP_get_digestbyname("md_gost94"))
-+			if(EVP_get_digestbyname("md_gost12_256"))
- 				return 32;
- 			else	return 0;
- #endif
-@@ -265,9 +265,9 @@ ds_digest_size_supported(int algo)
- #ifdef USE_GOST
- /** Perform GOST hash */
- static int
-do_gost94(unsigned char* data, size_t len, unsigned char* dest)
-+do_gost12(unsigned char* data, size_t len, unsigned char* dest)
- {
-	const EVP_MD* md = EVP_get_digestbyname("md_gost94");
-+	const EVP_MD* md = EVP_get_digestbyname("md_gost12_256");
- 	if(!md) 
- 		return 0;
- 	return sldns_digest_evp(data, (unsigned int)len, dest, md);
-@@ -302,8 +302,8 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
- 			return 1;
- #endif
- #ifdef USE_GOST
-		case LDNS_HASH_GOST:
-			if(do_gost94(buf, len, res))
-+		case LDNS_HASH_GOST12:
-+			if(do_gost12(buf, len, res))
- 				return 1;
- 			break;
- #endif
-@@ -384,7 +384,7 @@ dnskey_algo_id_is_supported(int id)
- #endif
- 
- #ifdef USE_GOST
-	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 		/* we support GOST if it can be loaded */
- 		return sldns_key_EVP_load_gost_id();
- #endif
-@@ -612,17 +612,17 @@ setup_key_digest(int algo, EVP_PKEY** evp_key, const EVP_MD** digest_type,
- 
- 			break;
- #ifdef USE_GOST
-		case LDNS_ECC_GOST:
-+		case LDNS_ECC_GOST12:
- 			*evp_key = sldns_gost2pkey_raw(key, keylen);
- 			if(!*evp_key) {
- 				verbose(VERB_QUERY, "verify: "
- 					"sldns_gost2pkey_raw failed");
- 				return 0;
- 			}
-			*digest_type = EVP_get_digestbyname("md_gost94");
-+			*digest_type = EVP_get_digestbyname("md_gost12_256");
- 			if(!*digest_type) {
- 				verbose(VERB_QUERY, "verify: "
-					"EVP_getdigest md_gost94 failed");
-+					"EVP_getdigest md_gost12_256 failed");
- 				return 0;
- 			}
- 			break;
-@@ -964,7 +964,7 @@ ds_digest_size_supported(int algo)
- 			return SHA384_LENGTH;
- #endif
- 		/* GOST not supported in NSS */
-		case LDNS_HASH_GOST:
-+		case LDNS_HASH_GOST12:
- 		default: break;
- 	}
- 	return 0;
-@@ -991,7 +991,7 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
- 			return HASH_HashBuf(HASH_AlgSHA384, res, buf, len)
- 				== SECSuccess;
- #endif
-		case LDNS_HASH_GOST:
-+		case LDNS_HASH_GOST12:
- 		default: 
- 			verbose(VERB_QUERY, "unknown DS digest algorithm %d", 
- 				algo);
-@@ -1031,7 +1031,7 @@ dnskey_algo_id_is_supported(int id)
- 	case LDNS_ECDSAP384SHA384:
- 		return PK11_TokenExists(CKM_ECDSA);
- #endif
-	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 	default:
- 		return 0;
- 	}
-@@ -1352,7 +1352,7 @@ nss_setup_key_digest(int algo, SECKEYPublicKey** pubkey, HASH_HashType* htype,
- 			/* no prefix for DSA verification */
- 			break;
- #endif /* USE_ECDSA */
-		case LDNS_ECC_GOST:
-+		case LDNS_ECC_GOST12:
- 		default:
- 			verbose(VERB_QUERY, "verify: unknown algorithm %d", 
- 				algo);
-@@ -1675,7 +1675,7 @@ ds_digest_size_supported(int algo)
- 			return SHA384_DIGEST_SIZE;
- #endif
- 		/* GOST not supported */
-		case LDNS_HASH_GOST:
-+		case LDNS_ECC_GOST12:
- 		default:
- 			break;
- 	}
-@@ -1700,7 +1700,7 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
- 			return _digest_nettle(SHA384_DIGEST_SIZE, buf, len, res);
- 
- #endif
-		case LDNS_HASH_GOST:
-+		case LDNS_ECC_GOST12:
- 		default:
- 			verbose(VERB_QUERY, "unknown DS digest algorithm %d",
- 				algo);
-@@ -1744,7 +1744,7 @@ dnskey_algo_id_is_supported(int id)
- 		return 1;
- #endif
- 	case LDNS_RSAMD5: /* RFC 6725 deprecates RSAMD5 */
-	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 	default:
- 		return 0;
- 	}
-@@ -2103,7 +2103,7 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
- 			return sec_status_secure;
- #endif
- 	case LDNS_RSAMD5:
-	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 	default:
- 		*reason = "unable to verify signature, unknown algorithm";
- 		return sec_status_bogus;
@@ -1,32 +1,28 @@
 #!/usr/bin/env bash

-LIBEXPAT_FNAME=expat-2.7.0
-LIBEXPAT_VERSION_DIR=R_2_7_0
-
 echo "Downloading Expat"
-if ! curl -L -k -s -o $LIBEXPAT_FNAME.tar.gz https://github.com/libexpat/libexpat/releases/download/$LIBEXPAT_VERSION_DIR/$LIBEXPAT_FNAME.tar.gz;
+if ! curl -L -k -s -o expat-2.2.9.tar.gz https://github.com/libexpat/libexpat/releases/download/R_2_2_9/expat-2.2.9.tar.gz;
 then
    echo "Failed to download Expat"
    exit 1
 fi

 echo "Unpacking Expat"
-rm -rf ./$LIBEXPAT_FNAME
-if ! tar -xf $LIBEXPAT_FNAME.tar.gz;
+rm -rf ./expat-2.2.9
+if ! tar -xf expat-2.2.9.tar.gz;
 then
    echo "Failed to unpack Expat"
    exit 1
 fi

-cd $LIBEXPAT_FNAME || exit 1
+cd expat-2.2.9 || exit 1

 export PKG_CONFIG_PATH="$IOS_PREFIX/lib/pkgconfig"

 echo "Configuring Expat"
-if ! ./configure --without-tests				\
-       --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST"	\
-       --prefix="$IOS_PREFIX" ;
-then
+if ! ./configure \
+       --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST" \
+       --prefix="$IOS_PREFIX" ; then
    echo "Error: Failed to configure Expat"
    cat config.log
    exit 1
@@ -1,22 +1,21 @@
 #!/usr/bin/env bash
-OPENSSL_VERSION=1.1.1d

 echo "Downloading OpenSSL"
-if ! curl -L -k -s -o openssl-$OPENSSL_VERSION.tar.gz https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz;
+if ! curl -L -k -s -o openssl-1.1.1d.tar.gz https://www.openssl.org/source/openssl-1.1.1d.tar.gz;
 then
    echo "Failed to download OpenSSL"
    exit 1
 fi

 echo "Unpacking OpenSSL"
-rm -rf ./openssl-$OPENSSL_VERSION
-if ! tar -xf openssl-$OPENSSL_VERSION.tar.gz;
+rm -rf ./openssl-1.1.1d
+if ! tar -xf openssl-1.1.1d.tar.gz;
 then
    echo "Failed to unpack OpenSSL"
    exit 1
 fi

-cd openssl-$OPENSSL_VERSION || exit 1
+cd openssl-1.1.1d || exit 1

 if ! cp ../contrib/ios/15-ios.conf Configurations/; then
    echo "Failed to copy OpenSSL ios config"
@@ -28,8 +27,7 @@ fi
 # Also see https://github.com/openssl/openssl/issues/7607.
 if ! patch -u -p0 < ../contrib/ios/openssl.patch; then
    echo "Failed to patch OpenSSL"
-    # the partial patch may be useful.
-    #exit 1
+    exit 1
 fi

 echo "Configuring OpenSSL"
@@ -175,7 +175,6 @@ fi
 # For example, remove 4.3, 6.2, and 6.1 if they are not installed. We go back to
 # the 1.0 SDKs because Apple WatchOS uses low numbers, like 2.0 and 2.1.
 XCODE_SDK=
-if test -z "$SDK_VERSION"; then
 for i in $(seq -f "%.1f" 30.0 -0.1 1.0)
 do
    if [ -d "$XCODE_DEVELOPER_SDK/Developer/SDKs/$IOS_SDK$i.sdk" ]; then
@@ -183,10 +182,6 @@ do
        break
    fi
 done
-else
-    i="$SDK_VERSION"
-    XCODE_SDK="$IOS_SDK$i.sdk"
-fi

 # Error checking
 if [ -z "$XCODE_SDK" ]; then
@@ -38,18 +38,12 @@
 ;   - `LockPersonality=yes` locks down the personality system call so that the
 ;     kernel execution domain may not be changed from the default.
 ;
-;   - With /etc/systemd/network/*.network a setting to make sure the network
-;     is not considered online too early, can reduce network unreachable
-;     errors on server start:
-;     [Link]
-;     RequiredForOnline=routable
 ;
 [Unit]
 Description=Validating, recursive, and caching DNS resolver
 Documentation=man:unbound(8)
-After=network-online.target
-Wants=network-online.target
-Before=nss-lookup.target
+After=network.target
+Before=network-online.target nss-lookup.target

 [Install]
 WantedBy=multi-user.target
@@ -59,7 +53,7 @@ ExecReload=+/bin/kill -HUP $MAINPID
 ExecStart=@UNBOUND_SBIN_DIR@/unbound -d -p
 NotifyAccess=main
 Type=notify
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_ADMIN
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true
@@ -14,8 +14,8 @@
 [Unit]
 Description=Validating, recursive, and caching DNS resolver
 Documentation=man:unbound(8)
-After=network-online.target
-Before=nss-lookup.target
+After=network.target
+Before=network-online.target nss-lookup.target
 Wants=nss-lookup.target

 [Install]
@@ -26,7 +26,7 @@ ExecReload=+/bin/kill -HUP $MAINPID
 ExecStart=@UNBOUND_SBIN_DIR@/unbound -d -p
 NotifyAccess=main
 Type=notify
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_ADMIN
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true
@@ -221,9 +221,7 @@ acl_interface_insert(struct acl_list* acl_interface,
 	struct sockaddr_storage* addr, socklen_t addrlen,
 	enum acl_access control)
 {
-	struct acl_addr* node = acl_find_or_create(acl_interface, addr, addrlen, control);
-	node->is_interface = 1;
-	return node;
+	return acl_find_or_create(acl_interface, addr, addrlen, control);
 }

 /** apply acl_tag string */
@@ -553,6 +551,17 @@ acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg,
 	return 1;
 }

+int
+acl_interface_compare(const void* k1, const void* k2)
+{
+	struct addr_tree_node* n1 = (struct addr_tree_node*)k1;
+	struct addr_tree_node* n2 = (struct addr_tree_node*)k2;
+	return sockaddr_cmp(&n1->addr, n1->addrlen, &n2->addr,
+		n2->addrlen);
+	/* We don't care about comparing node->net. All addresses in the
+	 * acl_interface tree have either 32 (ipv4) or 128 (ipv6). */
+}
+
 void
 acl_interface_init(struct acl_list* acl_interface)
 {
@@ -807,23 +816,10 @@ log_acl_action(const char* action, struct sockaddr_storage* addr,
 		addr_to_str(&acladdr->node.addr, acladdr->node.addrlen,
 			n, sizeof(n));
 		verbose(VERB_ALGO, "%s query from %s port %d because of "
-			"%s/%d %s%s", action, a, (int)port, n,
-			acladdr->node.net,
-			acladdr->is_interface?"(ACL on interface IP) ":"",
+			"%s/%d %s", action, a, (int)port, n, acladdr->node.net,
 			acl_access_to_str(acl));
 	} else {
 		verbose(VERB_ALGO, "%s query from %s port %d", action, a,
 			(int)port);
 	}
 }
-
-void acl_list_swap_tree(struct acl_list* acl, struct acl_list* data)
-{
-	/* swap tree and region */
-	rbtree_type oldtree = acl->tree;
-	struct regional* oldregion = acl->region;
-	acl->tree = data->tree;
-	acl->region = data->region;
-	data->tree = oldtree;
-	data->region = oldregion;
-}
@@ -107,8 +107,6 @@ struct acl_addr {
 	struct config_strlist** tag_datas;
 	/** size of the tag_datas array */
 	size_t tag_datas_size;
-	/* If the acl node is for an interface */
-	int is_interface;
 	/* view element, NULL if none */
 	struct view* view;
 };
@@ -149,6 +147,9 @@ acl_interface_insert(struct acl_list* acl_interface,
 int acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg,
 	struct views* v);

+/** compare ACL interface "addr_tree" nodes (+port) */
+int acl_interface_compare(const void* k1, const void* k2);
+
 /**
 * Initialise (also clean) the acl_interface struct.
 * @param acl_interface: where to store.
@@ -201,12 +202,4 @@ const char* acl_access_to_str(enum acl_access acl);
 void log_acl_action(const char* action, struct sockaddr_storage* addr,
 	socklen_t addrlen, enum acl_access acl, struct acl_addr* acladdr);

-/**
- * Swap internal tree with preallocated entries.
- * @param acl: the acl structure.
- * @param data: the data structure used to take elements from. This contains
- * 	the old elements on return.
- */
-void acl_list_swap_tree(struct acl_list* acl, struct acl_list* data);
-
 #endif /* DAEMON_ACL_LIST_H */
@@ -62,231 +62,84 @@
 #include "sldns/wire2str.h"
 #include "sldns/str2wire.h"

-static void spool_txt_printf(struct config_strlist_head* txt,
-	const char* format, ...) ATTR_FORMAT(printf, 2, 3);
-
-/** Append to strlist at end, and log error if out of memory. */
-static void
-spool_txt_string(struct config_strlist_head* txt, char* str)
-{
-	if(!cfg_strlist_append(txt, strdup(str))) {
-		log_err("out of memory in spool text");
-	}
-}
-
-/** Spool txt to spool list. */
-static void
-spool_txt_vmsg(struct config_strlist_head* txt, const char* format,
-	va_list args)
-{
-	char msg[65535];
-	vsnprintf(msg, sizeof(msg), format, args);
-	spool_txt_string(txt, msg);
-}
-
-/** Print item to spool list. On alloc failure the list is as before. */
-static void
-spool_txt_printf(struct config_strlist_head* txt, const char* format, ...)
-{
-	va_list args;
-	va_start(args, format);
-	spool_txt_vmsg(txt, format, args);
-	va_end(args);
-}
-
 /** dump one rrset zonefile line */
-static void
-dump_rrset_line(struct config_strlist_head* txt, struct ub_packed_rrset_key* k,
-	time_t now, size_t i)
+static int
+dump_rrset_line(RES* ssl, struct ub_packed_rrset_key* k, time_t now, size_t i)
 {
 	char s[65535];
 	if(!packed_rr_to_string(k, i, now, s, sizeof(s))) {
-		spool_txt_string(txt, "BADRR\n");
-		return;
+		return ssl_printf(ssl, "BADRR\n");
 	}
-	spool_txt_string(txt, s);
+	return ssl_printf(ssl, "%s", s);
 }

 /** dump rrset key and data info */
-static void
-dump_rrset(struct config_strlist_head* txt, struct ub_packed_rrset_key* k,
+static int
+dump_rrset(RES* ssl, struct ub_packed_rrset_key* k, 
 	struct packed_rrset_data* d, time_t now)
 {
 	size_t i;
 	/* rd lock held by caller */
-	if(!k || !d) return;
-	if(k->id == 0) return; /* deleted */
-	if(d->ttl < now) return; /* expired */
+	if(!k || !d) return 1;
+	if(k->id == 0) return 1; /* deleted */
+	if(d->ttl < now) return 1; /* expired */

 	/* meta line */
-	spool_txt_printf(txt, ";rrset%s " ARG_LL "d %u %u %d %d\n",
+	if(!ssl_printf(ssl, ";rrset%s " ARG_LL "d %u %u %d %d\n",
 		(k->rk.flags & PACKED_RRSET_NSEC_AT_APEX)?" nsec_apex":"",
 		(long long)(d->ttl - now),
 		(unsigned)d->count, (unsigned)d->rrsig_count,
 		(int)d->trust, (int)d->security
-		);
+		)) 
+		return 0;
 	for(i=0; i<d->count + d->rrsig_count; i++) {
-		dump_rrset_line(txt, k, now, i);
-	}
-}
-
-/** Spool strlist to the output. */
-static int
-spool_strlist(RES* ssl, struct config_strlist* list)
-{
-	struct config_strlist* s;
-	for(s=list; s; s=s->next) {
-		if(!ssl_printf(ssl, "%s", s->str))
+		if(!dump_rrset_line(ssl, k, now, i))
 			return 0;
 	}
 	return 1;
 }

-/** dump lruhash cache and call callback for every item. */
+/** dump lruhash rrset cache */
 static int
-dump_lruhash(struct lruhash* table,
-	void (*func)(struct lruhash_entry*, struct config_strlist_head*, void*),
-	RES* ssl, void* arg)
+dump_rrset_lruhash(RES* ssl, struct lruhash* h, time_t now)
 {
-	int just_started = 1;
-	int not_done = 1;
-	hashvalue_type hash;
-	size_t num = 0; /* number of entries processed. */
-	size_t max = 2; /* number of entries after which it unlocks. */
-	struct config_strlist_head txt; /* Text strings spooled. */
-	memset(&txt, 0, sizeof(txt));
-
-	while(not_done) {
-		size_t i; /* hash bin. */
-		/* Process a number of items. */
-		num = 0;
-		lock_quick_lock(&table->lock);
-		if(just_started) {
-			i = 0;
-		} else {
-			i = hash&table->size_mask;
-		}
-		while(num < max) {
-			/* Process bin. */
-			int found = 0;
-			size_t num_bin = 0;
-			struct lruhash_bin* bin = &table->array[i];
-			struct lruhash_entry* e;
-			lock_quick_lock(&bin->lock);
-			for(e = bin->overflow_list; e; e = e->overflow_next) {
-				/* Entry e is locked by the func. */
-				func(e, &txt, arg);
-				num_bin++;
-			}
-			lock_quick_unlock(&bin->lock);
-			/* This addition of bin number of entries may take
-			 * it over the max. */
-			num += num_bin;
-
-			/* Move to next bin. */
-			/* Find one with an entry, with a  hash value, so we
-			 * can continue from the hash value. The hash value
-			 * can be indexed also if the array changes size. */
-			i++;
-			while(i < table->size) {
-				bin = &table->array[i];
-				lock_quick_lock(&bin->lock);
-				if(bin->overflow_list) {
-					hash = bin->overflow_list->hash;
-					lock_quick_unlock(&bin->lock);
-					found = 1;
-					just_started = 0;
-					break;
-				}
-				lock_quick_unlock(&bin->lock);
-				i++;
-			}
-			if(!found) {
-				not_done = 0;
-				break;
-			}
-		}
-		lock_quick_unlock(&table->lock);
-		/* Print the spooled items, that are collected while the
-		 * locks are locked. The print happens while they are not
-		 * locked. */
-		if(txt.first) {
-			if(!spool_strlist(ssl, txt.first)) {
-				config_delstrlist(txt.first);
-				return 0;
-			}
-			config_delstrlist(txt.first);
-			memset(&txt, 0, sizeof(txt));
-		}
-	}
-	/* Print the final spooled items. */
-	if(txt.first) {
-		if(!spool_strlist(ssl, txt.first)) {
-			config_delstrlist(txt.first);
+	struct lruhash_entry* e;
+	/* lruhash already locked by caller */
+	/* walk in order of lru; best first */
+	for(e=h->lru_start; e; e = e->lru_next) {
+		lock_rw_rdlock(&e->lock);
+		if(!dump_rrset(ssl, (struct ub_packed_rrset_key*)e->key,
+			(struct packed_rrset_data*)e->data, now)) {
+			lock_rw_unlock(&e->lock);
 			return 0;
 		}
-		config_delstrlist(txt.first);
+		lock_rw_unlock(&e->lock);
 	}
 	return 1;
 }

-/** dump slabhash cache and call callback for every item. */
-static int
-dump_slabhash(struct slabhash* sh,
-	void (*func)(struct lruhash_entry*, struct config_strlist_head*, void*),
-	RES* ssl, void* arg)
-{
-	/* Process a number of items at a time, then unlock the cache,
-	 * so that ordinary processing can continue. Keep an iteration marker
-	 * to continue the loop. That means the cache can change, items
-	 * could be inserted and deleted. And, for example, the hash table
-	 * can grow. */
-	size_t slab;
-	for(slab=0; slab<sh->size; slab++) {
-		if(!dump_lruhash(sh->array[slab], func, ssl, arg))
-			return 0;
-	}
-	return 1;
-}
-
-/** Struct for dump information. */
-struct dump_info {
-	/** The worker. */
-	struct worker* worker;
-	/** The printout connection. */
-	RES* ssl;
-};
-
-/** Dump the rrset cache entry */
-static void
-dump_rrset_entry(struct lruhash_entry* e, struct config_strlist_head* txt,
-	void* arg)
-{
-	struct dump_info* dump_info = (struct dump_info*)arg;
-	lock_rw_rdlock(&e->lock);
-	dump_rrset(txt, (struct ub_packed_rrset_key*)e->key,
-		(struct packed_rrset_data*)e->data,
-		*dump_info->worker->env.now);
-	lock_rw_unlock(&e->lock);
-}
-
 /** dump rrset cache */
 static int
 dump_rrset_cache(RES* ssl, struct worker* worker)
 {
 	struct rrset_cache* r = worker->env.rrset_cache;
-	struct dump_info dump_info;
-	dump_info.worker = worker;
-	dump_info.ssl = ssl;
+	size_t slab;
 	if(!ssl_printf(ssl, "START_RRSET_CACHE\n")) return 0;
-	if(!dump_slabhash(&r->table, &dump_rrset_entry, ssl, &dump_info))
-		return 0;
+	for(slab=0; slab<r->table.size; slab++) {
+		lock_quick_lock(&r->table.array[slab]->lock);
+		if(!dump_rrset_lruhash(ssl, r->table.array[slab],
+			*worker->env.now)) {
+			lock_quick_unlock(&r->table.array[slab]->lock);
+			return 0;
+		}
+		lock_quick_unlock(&r->table.array[slab]->lock);
+	}
 	return ssl_printf(ssl, "END_RRSET_CACHE\n");
 }

 /** dump message to rrset reference */
-static void
-dump_msg_ref(struct config_strlist_head* txt, struct ub_packed_rrset_key* k)
+static int
+dump_msg_ref(RES* ssl, struct ub_packed_rrset_key* k)
 {
 	char* nm, *tp, *cl;
 	nm = sldns_wire2str_dname(k->rk.dname, k->rk.dname_len);
@@ -296,25 +149,30 @@ dump_msg_ref(struct config_strlist_head* txt, struct ub_packed_rrset_key* k)
 		free(nm);
 		free(tp);
 		free(cl);
-		spool_txt_string(txt, "BADREF\n");
-		return;
+		return ssl_printf(ssl, "BADREF\n");
+	}
+	if(!ssl_printf(ssl, "%s %s %s %d\n", nm, cl, tp, (int)k->rk.flags)) {
+		free(nm);
+		free(tp);
+		free(cl);
+		return 0;
 	}
-	spool_txt_printf(txt, "%s %s %s %d\n", nm, cl, tp, (int)k->rk.flags);
 	free(nm);
 	free(tp);
 	free(cl);
+
+	return 1;
 }

 /** dump message entry */
-static void
-dump_msg(struct config_strlist_head* txt, struct query_info* k,
-	struct reply_info* d, time_t now)
+static int
+dump_msg(RES* ssl, struct query_info* k, struct reply_info* d, time_t now)
 {
 	size_t i;
 	char* nm, *tp, *cl;
-	if(!k || !d) return;
-	if(d->ttl < now) return; /* expired */
-
+	if(!k || !d) return 1;
+	if(d->ttl < now) return 1; /* expired */
+	
 	nm = sldns_wire2str_dname(k->qname, k->qname_len);
 	tp = sldns_wire2str_type(k->qtype);
 	cl = sldns_wire2str_class(k->qclass);
@@ -322,35 +180,45 @@ dump_msg(struct config_strlist_head* txt, struct query_info* k,
 		free(nm);
 		free(tp);
 		free(cl);
-		return; /* skip this entry */
+		return 1; /* skip this entry */
 	}
 	if(!rrset_array_lock(d->ref, d->rrset_count, now)) {
 		/* rrsets have timed out or do not exist */
 		free(nm);
 		free(tp);
 		free(cl);
-		return; /* skip this entry */
+		return 1; /* skip this entry */
 	}
-
+	
 	/* meta line */
-	spool_txt_printf(txt,
-		"msg %s %s %s %d %d " ARG_LL "d %d %u %u %u %d %s\n",
-		nm, cl, tp,
-		(int)d->flags, (int)d->qdcount,
-		(long long)(d->ttl-now), (int)d->security,
-		(unsigned)d->an_numrrsets,
-		(unsigned)d->ns_numrrsets,
-		(unsigned)d->ar_numrrsets,
-		(int)d->reason_bogus,
-		d->reason_bogus_str?d->reason_bogus_str:"");
+	if(!ssl_printf(ssl, "msg %s %s %s %d %d " ARG_LL "d %d %u %u %u %d %s\n",
+			nm, cl, tp,
+			(int)d->flags, (int)d->qdcount, 
+			(long long)(d->ttl-now), (int)d->security,
+			(unsigned)d->an_numrrsets,
+			(unsigned)d->ns_numrrsets,
+			(unsigned)d->ar_numrrsets,
+			(int)d->reason_bogus,
+			d->reason_bogus_str?d->reason_bogus_str:"")) {
+		free(nm);
+		free(tp);
+		free(cl);
+		rrset_array_unlock(d->ref, d->rrset_count);
+		return 0;
+	}
 	free(nm);
 	free(tp);
 	free(cl);
 	
 	for(i=0; i<d->rrset_count; i++) {
-		dump_msg_ref(txt, d->rrsets[i]);
+		if(!dump_msg_ref(ssl, d->rrsets[i])) {
+			rrset_array_unlock(d->ref, d->rrset_count);
+			return 0;
+		}
 	}
 	rrset_array_unlock(d->ref, d->rrset_count);
+
+	return 1;
 }

 /** copy msg to worker pad */
@@ -379,40 +247,49 @@ copy_msg(struct regional* region, struct lruhash_entry* e,
 	return (*k)->qname != NULL;
 }

-/** Dump the msg entry. */
-static void
-dump_msg_entry(struct lruhash_entry* e, struct config_strlist_head* txt,
-	void* arg)
+/** dump lruhash msg cache */
+static int
+dump_msg_lruhash(RES* ssl, struct worker* worker, struct lruhash* h)
 {
-	struct dump_info* dump_info = (struct dump_info*)arg;
+	struct lruhash_entry* e;
 	struct query_info* k;
 	struct reply_info* d;

-	regional_free_all(dump_info->worker->scratchpad);
-	/* Make copy of rrset in worker buffer. */
-	lock_rw_rdlock(&e->lock);
-	if(!copy_msg(dump_info->worker->scratchpad, e, &k, &d)) {
+	/* lruhash already locked by caller */
+	/* walk in order of lru; best first */
+	for(e=h->lru_start; e; e = e->lru_next) {
+		regional_free_all(worker->scratchpad);
+		lock_rw_rdlock(&e->lock);
+		/* make copy of rrset in worker buffer */
+		if(!copy_msg(worker->scratchpad, e, &k, &d)) {
+			lock_rw_unlock(&e->lock);
+			return 0;
+		}
 		lock_rw_unlock(&e->lock);
-		log_err("out of memory in dump_msg_entry");
-		return;
+		/* release lock so we can lookup the rrset references 
+		 * in the rrset cache */
+		if(!dump_msg(ssl, k, d, *worker->env.now)) {
+			return 0;
+		}
 	}
-	lock_rw_unlock(&e->lock);
-	/* Release lock so we can lookup the rrset references
-	 * in the rrset cache. */
-	dump_msg(txt, k, d, *dump_info->worker->env.now);
+	return 1;
 }

 /** dump msg cache */
 static int
 dump_msg_cache(RES* ssl, struct worker* worker)
 {
-	struct dump_info dump_info;
-	dump_info.worker = worker;
-	dump_info.ssl = ssl;
+	struct slabhash* sh = worker->env.msg_cache;
+	size_t slab;
 	if(!ssl_printf(ssl, "START_MSG_CACHE\n")) return 0;
-	if(!dump_slabhash(worker->env.msg_cache, &dump_msg_entry, ssl,
-		&dump_info))
-		return 0;
+	for(slab=0; slab<sh->size; slab++) {
+		lock_quick_lock(&sh->array[slab]->lock);
+		if(!dump_msg_lruhash(ssl, worker, sh->array[slab])) {
+			lock_quick_unlock(&sh->array[slab]->lock);
+			return 0;
+		}
+		lock_quick_unlock(&sh->array[slab]->lock);
+	}
 	return ssl_printf(ssl, "END_MSG_CACHE\n");
 }

@@ -815,7 +692,7 @@ load_msg(RES* ssl, sldns_buffer* buf, struct worker* worker)
 		return 1; /* skip this one, not all references satisfied */

 	if(!dns_cache_store(&worker->env, &qinf, &rep, 0, 0, 0, NULL, flags,
-		*worker->env.now, 1)) {
+		*worker->env.now)) {
 		log_warn("error out of memory");
 		return 0;
 	}
@@ -934,18 +811,12 @@ print_dp_main(RES* ssl, struct delegpt* dp, struct dns_msg* msg)
 		struct ub_packed_rrset_key* k = msg->rep->rrsets[i];
 		struct packed_rrset_data* d = 
 			(struct packed_rrset_data*)k->entry.data;
-		struct config_strlist_head txt;
-		memset(&txt, 0, sizeof(txt));
 		if(d->security == sec_status_bogus) {
 			if(!ssl_printf(ssl, "Address is BOGUS:\n"))
 				return;
 		}
-		dump_rrset(&txt, k, d, 0);
-		if(!spool_strlist(ssl, txt.first)) {
-			config_delstrlist(txt.first);
+		if(!dump_rrset(ssl, k, d, 0))
 			return;
-		}
-		config_delstrlist(txt.first);
 	    }
 	delegpt_count_ns(dp, &n_ns, &n_miss);
 	delegpt_count_addr(dp, &n_addr, &n_res, &n_avail);
@@ -965,7 +836,7 @@ int print_deleg_lookup(RES* ssl, struct worker* worker, uint8_t* nm,
 	struct delegpt* dp;
 	struct dns_msg* msg;
 	struct regional* region = worker->scratchpad;
-	char b[LDNS_MAX_DOMAINLEN];
+	char b[260];
 	struct query_info qinfo;
 	struct iter_hints_stub* stub;
 	int nolock = 0;
@@ -199,255 +199,6 @@ signal_handling_playback(struct worker* wrk)
 	sig_record_reload = 0;
 }

-#ifdef HAVE_SSL
-/* setup a listening ssl context, fatal_exit() on any failure */
-static void
-setup_listen_sslctx(void** ctx, int is_dot, int is_doh,
-	struct config_file* cfg, char* chroot)
-{
-	char* key = cfg->ssl_service_key;
-	char* pem = cfg->ssl_service_pem;
-	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-		key += strlen(chroot);
-	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-		pem += strlen(chroot);
-	if(!(*ctx = listen_sslctx_create(key, pem, NULL,
-		cfg->tls_ciphers, cfg->tls_ciphersuites,
-		(cfg->tls_session_ticket_keys.first &&
-		cfg->tls_session_ticket_keys.first->str[0] != 0),
-		is_dot, is_doh, cfg->tls_protocols))) {
-		fatal_exit("could not set up listen SSL_CTX");
-	}
-}
-#endif /* HAVE_SSL */
-
-#ifdef HAVE_SSL
-void* daemon_setup_listen_dot_sslctx(struct daemon* daemon,
-	struct config_file* cfg)
-{
-	void* ctx;
-	(void)setup_listen_sslctx(&ctx, 1, 0, cfg, daemon->chroot);
-	return ctx;
-}
-#endif /* HAVE_SSL */
-
-#ifdef HAVE_SSL
-#ifdef HAVE_NGHTTP2_NGHTTP2_H
-void* daemon_setup_listen_doh_sslctx(struct daemon* daemon,
-	struct config_file* cfg)
-{
-	void* ctx;
-	(void)setup_listen_sslctx(&ctx, 0, 1, cfg, daemon->chroot);
-	return ctx;
-}
-#endif /* HAVE_NGHTTP2_NGHTTP2_H */
-#endif /* HAVE_SSL */
-
-#ifdef HAVE_SSL
-#ifdef HAVE_NGTCP2
-void* daemon_setup_listen_quic_sslctx(struct daemon* daemon,
-	struct config_file* cfg)
-{
-	void* ctx;
-	char* chroot = daemon->chroot;
-	char* key = cfg->ssl_service_key;
-	char* pem = cfg->ssl_service_pem;
-	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-		key += strlen(chroot);
-	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-		pem += strlen(chroot);
-
-	if(!(ctx = quic_sslctx_create(key, pem, NULL))) {
-		fatal_exit("could not set up quic SSL_CTX");
-	}
-	return ctx;
-}
-#endif /* HAVE_NGTCP2 */
-#endif /* HAVE_SSL */
-
-#ifdef HAVE_SSL
-void* daemon_setup_connect_dot_sslctx(struct daemon* daemon,
-	struct config_file* cfg)
-{
-	void* ctx;
-	char* bundle, *chroot = daemon->chroot;
-	bundle = cfg->tls_cert_bundle;
-	if(chroot && bundle && strncmp(bundle, chroot, strlen(chroot)) == 0)
-		bundle += strlen(chroot);
-
-	if(!(ctx = connect_sslctx_create(NULL, NULL, bundle,
-		cfg->tls_win_cert)))
-		fatal_exit("could not set up connect SSL_CTX");
-	return ctx;
-}
-#endif /* HAVE_SSL */
-
-/* setups the needed ssl contexts, fatal_exit() on any failure */
-void
-daemon_setup_sslctxs(struct daemon* daemon, struct config_file* cfg)
-{
-#ifdef HAVE_SSL
-	char* chroot = daemon->chroot;
-	if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
-		char* key = cfg->ssl_service_key;
-		char* pem = cfg->ssl_service_pem;
-		if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-			key += strlen(chroot);
-		if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-			pem += strlen(chroot);
-
-		/* setup the session keys; the callback to use them will be
-		 * attached to each sslctx separately */
-		if(cfg->tls_session_ticket_keys.first &&
-			cfg->tls_session_ticket_keys.first->str[0] != 0) {
-			if(!listen_sslctx_setup_ticket_keys(
-				cfg->tls_session_ticket_keys.first, chroot)) {
-				fatal_exit("could not set session ticket SSL_CTX");
-			}
-		}
-		daemon->listen_dot_sslctx = daemon_setup_listen_dot_sslctx(
-			daemon, cfg);
-#ifdef HAVE_NGHTTP2_NGHTTP2_H
-		if(cfg_has_https(cfg)) {
-			daemon->listen_doh_sslctx =
-				daemon_setup_listen_doh_sslctx(daemon, cfg);
-		}
-#endif
-#ifdef HAVE_NGTCP2
-		if(cfg_has_quic(cfg)) {
-			daemon->listen_quic_sslctx =
-				daemon_setup_listen_quic_sslctx(daemon, cfg);
-		}
-#endif /* HAVE_NGTCP2 */
-
-		/* Store the file name and mtime to detect changes later. */
-		daemon->ssl_service_key = strdup(cfg->ssl_service_key);
-		if(!daemon->ssl_service_key)
-			fatal_exit("could not setup ssl ctx: out of memory");
-		if(cfg->ssl_service_pem) {
-			daemon->ssl_service_pem = strdup(cfg->ssl_service_pem);
-			if(!daemon->ssl_service_pem)
-				fatal_exit("could not setup ssl ctx: out of memory");
-		} else {
-			daemon->ssl_service_pem = NULL;
-		}
-		if(!file_get_mtime(key,
-			&daemon->mtime_ssl_service_key,
-			&daemon->mtime_ns_ssl_service_key, NULL))
-			log_err("Could not stat(%s): %s",
-				key, strerror(errno));
-		if(pem) {
-			if(!file_get_mtime(pem,
-				&daemon->mtime_ssl_service_pem,
-				&daemon->mtime_ns_ssl_service_pem, NULL))
-				log_err("Could not stat(%s): %s",
-					pem, strerror(errno));
-		} else {
-			daemon->mtime_ssl_service_pem = 0;
-			daemon->mtime_ns_ssl_service_pem = 0;
-		}
-	}
-	daemon->connect_dot_sslctx = daemon_setup_connect_dot_sslctx(
-		daemon, cfg);
-#else /* HAVE_SSL */
-	(void)daemon;(void)cfg;
-#endif /* HAVE_SSL */
-}
-
-/** Delete the ssl ctxs */
-static void
-daemon_delete_sslctxs(struct daemon* daemon)
-{
-#ifdef HAVE_SSL
-	listen_sslctx_delete_ticket_keys();
-	SSL_CTX_free((SSL_CTX*)daemon->listen_dot_sslctx);
-	daemon->listen_dot_sslctx = NULL;
-	SSL_CTX_free((SSL_CTX*)daemon->listen_doh_sslctx);
-	daemon->listen_doh_sslctx = NULL;
-	SSL_CTX_free((SSL_CTX*)daemon->connect_dot_sslctx);
-	daemon->connect_dot_sslctx = NULL;
-	free(daemon->ssl_service_key);
-	daemon->ssl_service_key = NULL;
-	free(daemon->ssl_service_pem);
-	daemon->ssl_service_pem = NULL;
-#else
-	(void)daemon;
-#endif
-#ifdef HAVE_NGTCP2
-	SSL_CTX_free((SSL_CTX*)daemon->listen_quic_sslctx);
-	daemon->listen_quic_sslctx = NULL;
-#endif
-}
-
-int
-ssl_cert_changed(struct daemon* daemon, struct config_file* cfg)
-{
-	time_t mtime = 0;
-	long ns = 0;
-	char* chroot = daemon->chroot;
-	char* key = cfg->ssl_service_key;
-	char* pem = cfg->ssl_service_pem;
-	log_assert(daemon->ssl_service_key && cfg->ssl_service_key);
-	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-		key += strlen(chroot);
-	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-		pem += strlen(chroot);
-
-	if(strcmp(daemon->ssl_service_key, cfg->ssl_service_key) != 0)
-		return 1;
-	if(daemon->ssl_service_pem && cfg->ssl_service_pem &&
-	   strcmp(daemon->ssl_service_pem, cfg->ssl_service_pem) != 0)
-		return 1;
-	if(!file_get_mtime(key, &mtime, &ns, NULL)) {
-		log_err("Could not stat(%s): %s",
-			key, strerror(errno));
-		/* It has probably changed, but file read is likely going to
-		 * fail. */
-		return 0;
-	}
-	if(mtime != daemon->mtime_ssl_service_key ||
-		ns != daemon->mtime_ns_ssl_service_key)
-		return 1;
-	if(pem) {
-		if(!file_get_mtime(pem, &mtime, &ns, NULL)) {
-			log_err("Could not stat(%s): %s",
-				pem, strerror(errno));
-			/* It has probably changed, but file read is likely going to
-			 * fail. */
-			return 0;
-		}
-		if(mtime != daemon->mtime_ssl_service_pem ||
-			ns != daemon->mtime_ns_ssl_service_pem)
-			return 1;
-	}
-	return 0;
-}
-
-/** Reload the sslctxs if they have changed */
-static void
-daemon_reload_sslctxs(struct daemon* daemon)
-{
-#ifdef HAVE_SSL
-	if(daemon->cfg->ssl_service_key && daemon->cfg->ssl_service_key[0]) {
-		/* See if changed */
-		if(!daemon->ssl_service_key ||
-			ssl_cert_changed(daemon,daemon->cfg)) {
-			verbose(VERB_ALGO, "Reloading certificates");
-			daemon_delete_sslctxs(daemon);
-			daemon_setup_sslctxs(daemon, daemon->cfg);
-		}
-	} else {
-		/* See if sslctxs are removed from config. */
-		if(daemon->ssl_service_key) {
-			verbose(VERB_ALGO, "Removing certificates");
-			daemon_delete_sslctxs(daemon);
-		}
-	}
-#else
-	(void)daemon;
-#endif
-}
-
 struct daemon* 
 daemon_init(void)
 {
@@ -484,11 +235,7 @@ daemon_init(void)
 #  else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#    if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#    endif
-		, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #  endif
 #  if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
 	/* grab the COMP method ptr because openssl leaks it */
@@ -497,11 +244,7 @@ daemon_init(void)
 #  if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #  else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#    if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#    endif
-		, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #  endif
 #  if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
 	if(!ub_openssl_lock_init())
@@ -580,7 +323,8 @@ daemon_init(void)
 	return daemon;	
 }

-int setup_acl_for_ports(struct acl_list* list, struct listen_port* port_list)
+static int setup_acl_for_ports(struct acl_list* list,
+	struct listen_port* port_list)
 {
 	struct acl_addr* acl_node;
 	for(; port_list; port_list=port_list->next) {
@@ -600,7 +344,7 @@ int setup_acl_for_ports(struct acl_list* list, struct listen_port* port_list)
 	return 1;
 }

-int
+int 
 daemon_open_shared_ports(struct daemon* daemon)
 {
 	log_assert(daemon);
@@ -700,19 +444,6 @@ daemon_open_shared_ports(struct daemon* daemon)
 	return 1;
 }

-int
-daemon_privileged(struct daemon* daemon)
-{
-	daemon->env->cfg = daemon->cfg;
-	daemon->env->alloc = &daemon->superalloc;
-	daemon->env->worker = NULL;
-	if(!modstack_call_startup(&daemon->mods, daemon->cfg->module_conf,
-		daemon->env)) {
-		fatal_exit("failed to startup modules");
-	}
-	return 1;
-}
-
 /**
 * Setup modules. setup module stack.
 * @param daemon: the daemon
@@ -722,15 +453,11 @@ static void daemon_setup_modules(struct daemon* daemon)
 	daemon->env->cfg = daemon->cfg;
 	daemon->env->alloc = &daemon->superalloc;
 	daemon->env->worker = NULL;
-	if(daemon->mods_inited) {
-		modstack_call_deinit(&daemon->mods, daemon->env);
-	}
 	daemon->env->need_to_validate = 0; /* set by module init below */
-	if(!modstack_call_init(&daemon->mods, daemon->cfg->module_conf,
+	if(!modstack_setup(&daemon->mods, daemon->cfg->module_conf, 
 		daemon->env)) {
-		fatal_exit("failed to init modules");
+		fatal_exit("failed to setup modules");
 	}
-	daemon->mods_inited = 1;
 	log_edns_known_options(VERB_ALGO, daemon->env);
 }

@@ -776,10 +503,7 @@ daemon_clear_allocs(struct daemon* daemon)
 {
 	int i;

-	/* daemon->num may be different during reloads (after configuration
-	 * read). Use old_num which has the correct value used to setup the
-	 * worker_allocs */
-	for(i=0; i<daemon->old_num; i++) {
+	for(i=0; i<daemon->num; i++) {
 		alloc_clear(daemon->worker_allocs[i]);
 		free(daemon->worker_allocs[i]);
 	}
@@ -813,14 +537,6 @@ daemon_create_workers(struct daemon* daemon)
 		fatal_exit("out of memory during daemon init");
 	numport = daemon_get_shufport(daemon, shufport);
 	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
-
-#ifdef HAVE_NGTCP2
-	if (cfg_has_quic(daemon->cfg)) {
-		daemon->doq_table = doq_table_create(daemon->cfg, daemon->rand);
-		if(!daemon->doq_table)
-			fatal_exit("could not create doq_table: out of memory");
-	}
-#endif
 	
 	daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1);
 	if(daemon->reuseport && (int)daemon->num < (int)daemon->num_ports) {
@@ -890,25 +606,6 @@ static void close_other_pipes(struct daemon* daemon, int thr)
 }
 #endif /* THREADS_DISABLED */

-/**
- * Function to set the thread local log ID.
- * Either the internal thread number, or the LWP ID on Linux based on
- * configuration.
- */
-static void
-set_log_thread_id(struct worker* worker, struct config_file* cfg)
-{
-	(void)cfg;
-	log_assert(worker);
-#if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
-	worker->thread_tid = gettid();
-	if(cfg->log_thread_id)
-		log_thread_set(&worker->thread_tid);
-	else
-#endif
-		log_thread_set(&worker->thread_num);
-}
-
 /**
 * Function to start one thread. 
 * @param arg: user argument.
@@ -919,14 +616,7 @@ thread_start(void* arg)
 {
 	struct worker* worker = (struct worker*)arg;
 	int port_num = 0;
-	log_assert(worker->thr_id);
-	set_log_thread_id(worker, worker->daemon->cfg);
-	{
-		char name[16]; /* seems to be the safest size between
-				  different OSes */
-		snprintf(name, sizeof(name), "unbound/%u", worker->thread_num);
-		ub_thread_setname(worker->thr_id, name);
-	}
+	log_thread_set(&worker->thread_num);
 	ub_thread_blocksigs();
 #ifdef THREADS_DISABLED
 	/* close pipe ends used by main */
@@ -1001,17 +691,16 @@ daemon_fork(struct daemon* daemon)
 #endif

 	log_assert(daemon);
-	daemon_reload_sslctxs(daemon);
-	if(!(daemon->env->views = views_create()))
+	if(!(daemon->views = views_create()))
 		fatal_exit("Could not create views: out of memory");
 	/* create individual views and their localzone/data trees */
-	if(!views_apply_cfg(daemon->env->views, daemon->cfg))
+	if(!views_apply_cfg(daemon->views, daemon->cfg))
 		fatal_exit("Could not set up views");

-	if(!acl_list_apply_cfg(daemon->acl, daemon->cfg, daemon->env->views))
+	if(!acl_list_apply_cfg(daemon->acl, daemon->cfg, daemon->views))
 		fatal_exit("Could not setup access control list");
 	if(!acl_interface_apply_cfg(daemon->acl_interface, daemon->cfg,
-		daemon->env->views))
+		daemon->views))
 		fatal_exit("Could not setup interface control list");
 	if(!tcl_list_apply_cfg(daemon->tcl, daemon->cfg))
 		fatal_exit("Could not setup TCP connection limits");
@@ -1026,14 +715,6 @@ daemon_fork(struct daemon* daemon)
 				   "dnscrypt support");
 #endif
 	}
-	if(daemon->cfg->cookie_secret_file &&
-		daemon->cfg->cookie_secret_file[0]) {
-		if(!(daemon->cookie_secrets = cookie_secrets_create()))
-			fatal_exit("Could not create cookie_secrets: out of memory");
-		if(!cookie_secrets_apply_cfg(daemon->cookie_secrets,
-			daemon->cfg->cookie_secret_file))
-			fatal_exit("Could not setup cookie_secrets");
-	}
 	/* create global local_zones */
 	if(!(daemon->local_zones = local_zones_create()))
 		fatal_exit("Could not create local zones: out of memory");
@@ -1047,15 +728,15 @@ daemon_fork(struct daemon* daemon)
 		fatal_exit("Could not set root or stub hints");

 	/* process raw response-ip configuration data */
-	if(!(daemon->env->respip_set = respip_set_create()))
+	if(!(daemon->respip_set = respip_set_create()))
 		fatal_exit("Could not create response IP set");
-	if(!respip_global_apply_cfg(daemon->env->respip_set, daemon->cfg))
+	if(!respip_global_apply_cfg(daemon->respip_set, daemon->cfg))
 		fatal_exit("Could not set up response IP set");
-	if(!respip_views_apply_cfg(daemon->env->views, daemon->cfg,
+	if(!respip_views_apply_cfg(daemon->views, daemon->cfg,
 		&have_view_respip_cfg))
 		fatal_exit("Could not set up per-view response IP sets");
-	daemon->use_response_ip = !respip_set_is_empty(
-		daemon->env->respip_set) || have_view_respip_cfg;
+	daemon->use_response_ip = !respip_set_is_empty(daemon->respip_set) ||
+		have_view_respip_cfg;

 	/* setup modules */
 	daemon_setup_modules(daemon);
@@ -1087,19 +768,9 @@ daemon_fork(struct daemon* daemon)
 		fatal_exit("RPZ requires the respip module");

 	/* first create all the worker structures, so we can pass
-	 * them to the newly created threads.
+	 * them to the newly created threads. 
 	 */
 	daemon_create_workers(daemon);
-	/* Set it for the first (main) worker since it does not take part in
-	 * the thread_start() procedure.
-	 */
-	set_log_thread_id(daemon->workers[0], daemon->cfg);
-	/* If shm stats need an offset, calculate it */
-	if(daemon->cfg->shm_enable && daemon->cfg->stat_interval > 0) {
-		daemon->stat_time_specific = 1;
-		daemon->stat_time_offset =
-			((int)time(NULL))%daemon->cfg->stat_interval;
-	}

 #if defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
 	/* in libev the first inited base gets signals */
@@ -1181,18 +852,14 @@ daemon_cleanup(struct daemon* daemon)
 	daemon->env->hints = NULL;
 	local_zones_delete(daemon->local_zones);
 	daemon->local_zones = NULL;
-	respip_set_delete(daemon->env->respip_set);
-	daemon->env->respip_set = NULL;
-	views_delete(daemon->env->views);
-	daemon->env->views = NULL;
+	respip_set_delete(daemon->respip_set);
+	daemon->respip_set = NULL;
+	views_delete(daemon->views);
+	daemon->views = NULL;
 	if(daemon->env->auth_zones)
 		auth_zones_cleanup(daemon->env->auth_zones);
-	/* key cache is cleared by module deinit during next daemon_fork() */
+	/* key cache is cleared by module desetup during next daemon_fork() */
 	daemon_remote_clear(daemon->rc);
-	if(daemon->fast_reload_thread)
-		fast_reload_thread_stop(daemon->fast_reload_thread);
-	if(daemon->fast_reload_printq_list)
-		fast_reload_printq_list_delete(daemon->fast_reload_printq_list);
 	for(i=0; i<daemon->num; i++)
 		worker_delete(daemon->workers[i]);
 	free(daemon->workers);
@@ -1211,12 +878,6 @@ daemon_cleanup(struct daemon* daemon)
 #ifdef USE_DNSCRYPT
 	dnsc_delete(daemon->dnscenv);
 	daemon->dnscenv = NULL;
-#endif
-#ifdef HAVE_NGTCP2
-	if (daemon->doq_table) {
-		doq_table_delete(daemon->doq_table);
-		daemon->doq_table = NULL;
-	}
 #endif
 	daemon->cfg = NULL;
 }
@@ -1227,9 +888,7 @@ daemon_delete(struct daemon* daemon)
 	size_t i;
 	if(!daemon)
 		return;
-	modstack_call_deinit(&daemon->mods, daemon->env);
-	modstack_call_destartup(&daemon->mods, daemon->env);
-	modstack_free(&daemon->mods);
+	modstack_desetup(&daemon->mods, daemon->env);
 	daemon_remote_delete(daemon->rc);
 	for(i = 0; i < daemon->num_ports; i++)
 		listening_ports_free(daemon->ports[i]);
@@ -1248,13 +907,15 @@ daemon_delete(struct daemon* daemon)
 	acl_list_delete(daemon->acl);
 	acl_list_delete(daemon->acl_interface);
 	tcl_list_delete(daemon->tcl);
-	cookie_secrets_delete(daemon->cookie_secrets);
 	listen_desetup_locks();
 	free(daemon->chroot);
 	free(daemon->pidfile);
-	free(daemon->cfgfile);
 	free(daemon->env);
-	daemon_delete_sslctxs(daemon);
+#ifdef HAVE_SSL
+	listen_sslctx_delete_ticket_keys();
+	SSL_CTX_free((SSL_CTX*)daemon->listen_sslctx);
+	SSL_CTX_free((SSL_CTX*)daemon->connect_sslctx);
+#endif
 	free(daemon);
 	/* lex cleanup */
 	ub_c_lex_destroy();
@@ -58,10 +58,6 @@ struct ub_randstate;
 struct daemon_remote;
 struct respip_set;
 struct shm_main_info;
-struct doq_table;
-struct cookie_secrets;
-struct fast_reload_thread;
-struct fast_reload_printq;

 #include "dnstap/dnstap_config.h"
 #ifdef USE_DNSTAP
@@ -99,26 +95,8 @@ struct daemon {
 	struct listen_port* rc_ports;
 	/** remote control connections management (for first worker) */
 	struct daemon_remote* rc;
-	/** ssl context for listening to dnstcp over ssl */
-	void* listen_dot_sslctx;
-	/** ssl context for connecting to dnstcp over ssl */
-	void* connect_dot_sslctx;
-	/** ssl context for listening to DoH */
-	void* listen_doh_sslctx;
-	/** ssl context for listening to quic */
-	void* listen_quic_sslctx;
-	/** the file name that the ssl context is made with, private key. */
-	char* ssl_service_key;
-	/** the file name that the ssl context is made with, certificate. */
-	char* ssl_service_pem;
-	/** modification time for ssl_service_key, in sec and ns. Like
-	 * in a struct timespec, but without that for portability. */
-	time_t mtime_ssl_service_key;
-	long mtime_ns_ssl_service_key;
-	/** modification time for ssl_service_pem, in sec and ns. Like
-	 * in a struct timespec, but without that for portability. */
-	time_t mtime_ssl_service_pem;
-	long mtime_ns_ssl_service_pem;
+	/** ssl context for listening to dnstcp over ssl, and connecting ssl */
+	void* listen_sslctx, *connect_sslctx;
 	/** num threads allocated */
 	int num;
 	/** num threads allocated in the previous config or 0 at first */
@@ -137,8 +115,6 @@ struct daemon {
 	struct module_env* env;
 	/** stack of module callbacks */
 	struct module_stack mods;
-	/** The module stack has been inited */
-	int mods_inited;
 	/** access control, which client IPs are allowed to connect */
 	struct acl_list* acl;
 	/** access control, which interfaces are allowed to connect */
@@ -151,18 +127,15 @@ struct daemon {
 	struct timeval time_last_stat;
 	/** time when daemon started */
 	struct timeval time_boot;
+	/** views structure containing view tree */
+	struct views* views;
 #ifdef USE_DNSTAP
 	/** the dnstap environment master value, copied and changed by threads*/
 	struct dt_env* dtenv;
 #endif
-	/** The SHM info for shared memory stats. */
 	struct shm_main_info* shm_info;
-	/** if the timeout for statistics is attempted at specific offset.
-	 * If it is true, the stat timeout is the interval+offset, and that
-	 * picks (roughly) the same time offset every time period. */
-	int stat_time_specific;
-	/** if the timeout is specific, what offset in the period. */
-	int stat_time_offset;
+	/** response-ip set with associated actions and tags. */
+	struct respip_set* respip_set;
 	/** some response-ip tags or actions are configured if true */
 	int use_response_ip;
 	/** some RPZ policies are configured */
@@ -171,23 +144,8 @@ struct daemon {
 	/** the dnscrypt environment */
 	struct dnsc_env* dnscenv;
 #endif
-	/** the doq connection table */
-	struct doq_table* doq_table;
 	/** reuse existing cache on reload if other conditions allow it. */
 	int reuse_cache;
-	/** the EDNS cookie secrets from the cookie-secret-file */
-	struct cookie_secrets* cookie_secrets;
-	/** the fast reload thread, or NULL */
-	struct fast_reload_thread* fast_reload_thread;
-	/** the fast reload printq list */
-	struct fast_reload_printq* fast_reload_printq_list;
-	/** the fast reload option to drop mesh queries, true if so. */
-	int fast_reload_drop_mesh;
-	/** for fast reload, if the tcl, tcp connection limits, has
-	 * changes for workers */
-	int fast_reload_tcl_has_changes;
-	/** config file name */
-	char* cfgfile;
 };

 /**
@@ -204,15 +162,6 @@ struct daemon* daemon_init(void);
 */
 int daemon_open_shared_ports(struct daemon* daemon);

-/**
- * Do daemon setup that needs privileges
- * like opening privileged ports or opening device files.
- * The cfg member pointer must have been set for the daemon.
- * @param daemon: the daemon.
- * @return: false on error.
- */
-int daemon_privileged(struct daemon* daemon);
-
 /**
 * Fork workers and start service.
 * When the routine exits, it is no longer forked.
@@ -240,34 +189,4 @@ void daemon_delete(struct daemon* daemon);
 */
 void daemon_apply_cfg(struct daemon* daemon, struct config_file* cfg);

-/**
- * Setup acl list to have entries for the port list.
- * @param list: the acl interface
- * @param port_list: list of open ports, or none.
- * @return false on failure
- */
-int setup_acl_for_ports(struct acl_list* list, struct listen_port* port_list);
-
-/* setups the needed ssl contexts, fatal_exit() on any failure */
-void daemon_setup_sslctxs(struct daemon* daemon, struct config_file* cfg);
-
-/** See if the SSL cert files have changed */
-int ssl_cert_changed(struct daemon* daemon, struct config_file* cfg);
-
-/** Setup the listening DoT SSL_CTX, returns the ssl ctx. */
-void* daemon_setup_listen_dot_sslctx(struct daemon* daemon,
-	struct config_file* cfg);
-
-/** Setup the listening DoH SSL_CTX, returns the ssl ctx. */
-void* daemon_setup_listen_doh_sslctx(struct daemon* daemon,
-	struct config_file* cfg);
-
-/** Setup the listening Quic SSL_CTX, returns the ssl ctx */
-void* daemon_setup_listen_quic_sslctx(struct daemon* daemon,
-	struct config_file* cfg);
-
-/** Setup the connect DoT SSL_CTX, returns the ssl ctx */
-void* daemon_setup_connect_dot_sslctx(struct daemon* daemon,
-	struct config_file* cfg);
-
 #endif /* DAEMON_H */
@@ -48,7 +48,6 @@
 #ifdef HAVE_OPENSSL_SSL_H
 #include <openssl/ssl.h>
 #endif
-#include "util/locks.h"
 struct config_file;
 struct listen_list;
 struct listen_port;
@@ -56,7 +55,6 @@ struct worker;
 struct comm_reply;
 struct comm_point;
 struct daemon_remote;
-struct config_strlist_head;

 /** number of milliseconds timeout on incoming remote control handshake */
 #define REMOTE_CONTROL_TCP_TIMEOUT 120000
@@ -120,145 +118,6 @@ struct remote_stream {
 };
 typedef struct remote_stream RES;

-/**
- * Notification status. This is exchanged between the fast reload thread
- * and the server thread, over the commpair sockets.
- */
-enum fast_reload_notification {
-	/** nothing, not used */
-	fast_reload_notification_none = 0,
-	/** the fast reload thread is done */
-	fast_reload_notification_done = 1,
-	/** the fast reload thread is done but with an error, it failed */
-	fast_reload_notification_done_error = 2,
-	/** the fast reload thread is told to exit by the server thread.
-	 * Sent on server quit while the reload is running. */
-	fast_reload_notification_exit = 3,
-	/** the fast reload thread has exited, after being told to exit */
-	fast_reload_notification_exited = 4,
-	/** the fast reload thread has information to print out */
-	fast_reload_notification_printout = 5,
-	/** stop as part of the reload the thread and other threads */
-	fast_reload_notification_reload_stop = 6,
-	/** ack the stop as part of the reload, and also ack start */
-	fast_reload_notification_reload_ack = 7,
-	/** resume from stop as part of the reload */
-	fast_reload_notification_reload_start = 8,
-	/** the fast reload thread wants the mainthread to poll workers,
-	 * after the reload, sent when nopause is used */
-	fast_reload_notification_reload_nopause_poll = 9
-};
-
-/**
- * Fast reload printout queue. Contains a list of strings, that need to be
- * printed over the file descriptor.
- */
-struct fast_reload_printq {
-	/** if this item is in a list, the previous and next */
-	struct fast_reload_printq *prev, *next;
-	/** if this item is in a list, it is true. */
-	int in_list;
-	/** list of strings to printout */
-	struct config_strlist_head* to_print;
-	/** the current item to print. It is malloced. NULL if none. */
-	char* client_item;
-	/** The length, strlen, of the client_item, that has to be sent. */
-	int client_len;
-	/** The number of bytes sent of client_item. */
-	int client_byte_count;
-	/** the comm point for the client connection, the remote control
-	 * client. */
-	struct comm_point* client_cp;
-	/** the remote control connection to print output to. */
-	struct remote_stream remote;
-	/** the worker that the event is added in */
-	struct worker* worker;
-};
-
-/**
- * Fast reload auth zone change. Keeps track if an auth zone was removed,
- * added or changed. This is needed because workers can have events for
- * dealing with auth zones, like transfers, and those have to be removed
- * too, not just the auth zone structure from the tree. */
-struct fast_reload_auth_change {
-	/** next in the list of auth zone changes. */
-	struct fast_reload_auth_change* next;
-	/** the zone in the old config */
-	struct auth_zone* old_z;
-	/** the zone in the new config */
-	struct auth_zone* new_z;
-	/** if the zone was deleted */
-	int is_deleted;
-	/** if the zone was added */
-	int is_added;
-	/** if the zone has been changed */
-	int is_changed;
-};
-
-/**
- * Fast reload thread structure
- */
-struct fast_reload_thread {
-	/** the thread number for the dtio thread,
-	 * must be first to cast thread arg to int* in checklock code. */
-	int threadnum;
-	/** communication socket pair, that sends commands */
-	int commpair[2];
-	/** thread id, of the io thread */
-	ub_thread_type tid;
-#ifdef HAVE_GETTID
-	/** thread tid, the LWP id */
-	pid_t thread_tid;
-	/** if logging should include the LWP id */
-	int thread_tid_log;
-#endif
-	/** if the io processing has started */
-	int started;
-	/** if the thread has to quit */
-	int need_to_quit;
-	/** verbosity of the fast_reload command, the number of +v options */
-	int fr_verb;
-	/** option to not pause threads during reload */
-	int fr_nopause;
-	/** option to drop mesh queries */
-	int fr_drop_mesh;
-
-	/** the event that listens on the remote service worker to the
-	 * commpair, it receives content from the fast reload thread. */
-	void* service_event;
-	/** if the event that listens on the remote service worker has
-	 * been added to the comm base. */
-	int service_event_is_added;
-	/** the service event can read a cmd, nonblocking, so it can
-	 * save the partial read cmd here */
-	uint32_t service_read_cmd;
-	/** the number of bytes in service_read_cmd */
-	int service_read_cmd_count;
-	/** the worker that the service_event is added in */
-	struct worker* worker;
-
-	/** the printout of output to the remote client. */
-	struct fast_reload_printq *printq;
-
-	/** lock on fr_output, to stop race when both remote control thread
-	 * and fast reload thread use fr_output list. */
-	lock_basic_type fr_output_lock;
-	/** list of strings, that the fast reload thread produces that have
-	 * to be printed. The remote control thread can pick them up with
-	 * the lock. */
-	struct config_strlist_head* fr_output;
-
-	/** communication socket pair, to respond to the reload request */
-	int commreload[2];
-
-	/** the list of auth zone changes. */
-	struct fast_reload_auth_change* auth_zone_change_list;
-	/** the old tree of auth zones, to lookup. */
-	struct auth_zones* old_auth_zones;
-	/** If the ssl ctxs have changed. */
-	int sslctxs_changed;
-};
-
 /**
 * Create new remote control state for the daemon.
 * @param cfg: config file with key file settings.
@@ -344,38 +203,4 @@ int ssl_printf(RES* ssl, const char* format, ...)
 int ssl_read_line(RES* ssl, char* buf, size_t max);
 #endif /* HAVE_SSL */

-/**
- * Start fast reload thread
- * @param ssl: the RES connection to print to.
- * @param worker: the remote servicing worker.
- * @param s: the rc_state that is servicing the remote control connection to
- *	the remote control client. It needs to be moved away to stay connected
- *	while the fast reload is running.
- * @param fr_verb: verbosity to print output at. 0 is nothing, 1 is some
- *	and 2 is more detail.
- * @param fr_nopause: option to not pause threads during reload.
- * @param fr_drop_mesh: option to drop mesh queries.
- */
-void fast_reload_thread_start(RES* ssl, struct worker* worker,
-	struct rc_state* s, int fr_verb, int fr_nopause, int fr_drop_mesh);
-
-/**
- * Stop fast reload thread
- * @param fast_reload_thread: the thread struct.
- */
-void fast_reload_thread_stop(struct fast_reload_thread* fast_reload_thread);
-
-/** fast reload thread commands to remote service thread event callback */
-void fast_reload_service_cb(int fd, short bits, void* arg);
-
-/** fast reload callback for the remote control client connection */
-int fast_reload_client_callback(struct comm_point* c, void* arg, int err,
-	struct comm_reply* rep);
-
-/** fast reload printq delete list */
-void fast_reload_printq_list_delete(struct fast_reload_printq* list);
-
-/** Pick up per worker changes after a fast reload. */
-void fast_reload_worker_pickup_changes(struct worker* worker);
-
 #endif /* DAEMON_REMOTE_H */
@@ -262,7 +262,6 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 	s->svr = worker->stats;
 	s->mesh_num_states = (long long)worker->env.mesh->all.count;
 	s->mesh_num_reply_states = (long long)worker->env.mesh->num_reply_states;
-	s->mesh_num_reply_addrs = (long long)worker->env.mesh->num_reply_addrs;
 	s->mesh_jostled = (long long)worker->env.mesh->stats_jostled;
 	s->mesh_dropped = (long long)worker->env.mesh->stats_dropped;
 	s->mesh_replies_sent = (long long)worker->env.mesh->replies_sent;
@@ -274,7 +273,6 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 	/* add in the values from the mesh */
 	s->svr.ans_secure += (long long)worker->env.mesh->ans_secure;
 	s->svr.ans_bogus += (long long)worker->env.mesh->ans_bogus;
-	s->svr.val_ops += (long long)worker->env.mesh->val_ops;
 	s->svr.ans_rcode_nodata += (long long)worker->env.mesh->ans_nodata;
 	s->svr.ans_expired += (long long)worker->env.mesh->ans_expired;
 	for(i=0; i<UB_STATS_RCODE_NUM; i++)
@@ -283,14 +281,6 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 		s->svr.rpz_action[i] += (long long)worker->env.mesh->rpz_action[i];
 	timehist_export(worker->env.mesh->histogram, s->svr.hist,
 		NUM_BUCKETS_HIST);
-	s->svr.num_queries_discard_timeout +=
-		(long long)worker->env.mesh->num_queries_discard_timeout;
-	s->svr.num_queries_replyaddr_limit +=
-		(long long)worker->env.mesh->num_queries_replyaddr_limit;
-	s->svr.num_queries_wait_limit +=
-		(long long)worker->env.mesh->num_queries_wait_limit;
-	s->svr.num_dns_error_reports +=
-		(long long)worker->env.mesh->num_dns_error_reports;
 	/* values from outside network */
 	s->svr.unwanted_replies = (long long)worker->back->unwanted_replies;
 	s->svr.qtcp_outgoing = (long long)worker->back->num_tcp_outgoing;
@@ -335,8 +325,20 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 	s->svr.num_query_dnscrypt_replay = 0;
 #endif /* USE_DNSCRYPT */
 	if(worker->env.auth_zones) {
-		s->svr.num_query_authzone_up += (long long)worker->env.mesh->num_query_authzone_up;
-		s->svr.num_query_authzone_down += (long long)worker->env.mesh->num_query_authzone_down;
+		if(reset && !worker->env.cfg->stat_cumulative) {
+			lock_rw_wrlock(&worker->env.auth_zones->lock);
+		} else {
+			lock_rw_rdlock(&worker->env.auth_zones->lock);
+		}
+		s->svr.num_query_authzone_up = (long long)worker->env.
+			auth_zones->num_query_up;
+		s->svr.num_query_authzone_down = (long long)worker->env.
+			auth_zones->num_query_down;
+		if(reset && !worker->env.cfg->stat_cumulative) {
+			worker->env.auth_zones->num_query_up = 0;
+			worker->env.auth_zones->num_query_down = 0;
+		}
+		lock_rw_unlock(&worker->env.auth_zones->lock);
 	}
 	s->svr.mem_stream_wait =
 		(long long)tcp_req_info_get_stream_buffer_size();
@@ -344,12 +346,6 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 		(long long)http2_get_query_buffer_size();
 	s->svr.mem_http2_response_buffer =
 		(long long)http2_get_response_buffer_size();
-#ifdef HAVE_NGTCP2
-	s->svr.mem_quic = (long long)doq_table_quic_size_get(
-		worker->daemon->doq_table);
-#else
-	s->svr.mem_quic = 0;
-#endif /* HAVE_NGTCP2 */

 	/* Set neg cache usage numbers */
 	set_neg_cache_stats(worker, &s->svr, reset);
@@ -395,13 +391,6 @@ void server_stats_obtain(struct worker* worker, struct worker* who,
 	else 	worker_send_cmd(who, worker_cmd_stats_noreset);
 	verbose(VERB_ALGO, "wait for stats reply");
 	if(tube_wait_timeout(worker->cmd, STATS_THREAD_WAIT) == 0) {
-#if defined(HAVE_PTHREAD) && defined(SIZEOF_PTHREAD_T) && defined(SIZEOF_UNSIGNED_LONG)
-#  if SIZEOF_PTHREAD_T == SIZEOF_UNSIGNED_LONG
-		unsigned long pthid = 0;
-		if(verbosity >= VERB_OPS)
-			memcpy(&pthid, &who->thr_id, sizeof(unsigned long));
-#  endif
-#endif
 		verbose(VERB_OPS, "no response from thread %d"
 #ifdef HAVE_GETTID
 			" LWP %u"
@@ -418,7 +407,7 @@ void server_stats_obtain(struct worker* worker, struct worker* who,
 #endif
 #if defined(HAVE_PTHREAD) && defined(SIZEOF_PTHREAD_T) && defined(SIZEOF_UNSIGNED_LONG)
 #  if SIZEOF_PTHREAD_T == SIZEOF_UNSIGNED_LONG
-			, pthid
+			, (unsigned long)*((unsigned long*)&who->thr_id)
 #  endif
 #endif
 			);
@@ -449,17 +438,9 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 	total->svr.num_queries_cookie_valid += a->svr.num_queries_cookie_valid;
 	total->svr.num_queries_cookie_client += a->svr.num_queries_cookie_client;
 	total->svr.num_queries_cookie_invalid += a->svr.num_queries_cookie_invalid;
-	total->svr.num_queries_discard_timeout +=
-		a->svr.num_queries_discard_timeout;
-	total->svr.num_queries_replyaddr_limit +=
-		a->svr.num_queries_replyaddr_limit;
-	total->svr.num_queries_wait_limit += a->svr.num_queries_wait_limit;
-	total->svr.num_dns_error_reports += a->svr.num_dns_error_reports;
 	total->svr.num_queries_missed_cache += a->svr.num_queries_missed_cache;
 	total->svr.num_queries_prefetch += a->svr.num_queries_prefetch;
 	total->svr.num_queries_timed_out += a->svr.num_queries_timed_out;
-	total->svr.num_query_authzone_up += a->svr.num_query_authzone_up;
-	total->svr.num_query_authzone_down += a->svr.num_query_authzone_down;
 	if (total->svr.max_query_time_us < a->svr.max_query_time_us)
 		total->svr.max_query_time_us = a->svr.max_query_time_us;
 	total->svr.sum_query_list_size += a->svr.sum_query_list_size;
@@ -467,9 +448,9 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 #ifdef USE_DNSCRYPT
 	total->svr.num_query_dnscrypt_crypted += a->svr.num_query_dnscrypt_crypted;
 	total->svr.num_query_dnscrypt_cert += a->svr.num_query_dnscrypt_cert;
-	total->svr.num_query_dnscrypt_cleartext +=
+	total->svr.num_query_dnscrypt_cleartext += \
 		a->svr.num_query_dnscrypt_cleartext;
-	total->svr.num_query_dnscrypt_crypted_malformed +=
+	total->svr.num_query_dnscrypt_crypted_malformed += \
 		a->svr.num_query_dnscrypt_crypted_malformed;
 #endif /* USE_DNSCRYPT */
 	/* the max size reached is upped to higher of both */
@@ -486,7 +467,6 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 		total->svr.qtls += a->svr.qtls;
 		total->svr.qtls_resume += a->svr.qtls_resume;
 		total->svr.qhttps += a->svr.qhttps;
-		total->svr.qquic += a->svr.qquic;
 		total->svr.qipv6 += a->svr.qipv6;
 		total->svr.qbit_QR += a->svr.qbit_QR;
 		total->svr.qbit_AA += a->svr.qbit_AA;
@@ -501,7 +481,6 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 		total->svr.ans_rcode_nodata += a->svr.ans_rcode_nodata;
 		total->svr.ans_secure += a->svr.ans_secure;
 		total->svr.ans_bogus += a->svr.ans_bogus;
-		total->svr.val_ops += a->svr.val_ops;
 		total->svr.unwanted_replies += a->svr.unwanted_replies;
 		total->svr.unwanted_queries += a->svr.unwanted_queries;
 		total->svr.tcp_accept_usage += a->svr.tcp_accept_usage;
@@ -524,7 +503,6 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)

 	total->mesh_num_states += a->mesh_num_states;
 	total->mesh_num_reply_states += a->mesh_num_reply_states;
-	total->mesh_num_reply_addrs += a->mesh_num_reply_addrs;
 	total->mesh_jostled += a->mesh_jostled;
 	total->mesh_dropped += a->mesh_dropped;
 	total->mesh_replies_sent += a->mesh_replies_sent;
@@ -548,8 +526,7 @@ void server_stats_insquery(struct ub_server_stats* stats, struct comm_point* c,
 	else	stats->qclass_big++;
 	stats->qopcode[ LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) ]++;
 	if(c->type != comm_udp) {
-		if(c->type != comm_doq)
-			stats->qtcp++;
+		stats->qtcp++;
 		if(c->ssl != NULL) {
 			stats->qtls++;
 #ifdef HAVE_SSL
@@ -558,10 +535,6 @@ void server_stats_insquery(struct ub_server_stats* stats, struct comm_point* c,
 #endif
 			if(c->type == comm_http)
 				stats->qhttps++;
-#ifdef HAVE_NGTCP2
-			else if(c->type == comm_doq)
-				stats->qquic++;
-#endif
 		}
 	}
 	if(repinfo && addr_is_ip6(&repinfo->remote_addr, repinfo->remote_addrlen))
@@ -174,7 +174,7 @@ static void
 checkrlimits(struct config_file* cfg)
 {
 #ifndef S_SPLINT_S
-#if defined(HAVE_GETRLIMIT) && !defined(unbound_testbound)
+#ifdef HAVE_GETRLIMIT
 	/* list has number of ports to listen to, ifs number addresses */
 	int list = ((cfg->do_udp?1:0) + (cfg->do_tcp?1 + 
 			(int)cfg->incoming_num_tcp:0));
@@ -463,18 +463,6 @@ detach(void)
 #endif /* HAVE_DAEMON */
 }

-/** setup the remote and ticket keys */
-static void
-setup_sslctx_remote(struct daemon* daemon, struct config_file* cfg)
-{
-#ifdef HAVE_SSL
-	if(!(daemon->rc = daemon_remote_create(cfg)))
-		fatal_exit("could not set up remote-control");
-#else /* HAVE_SSL */
-	(void)daemon;(void)cfg;
-#endif /* HAVE_SSL */
-}
-
 /** daemonize, drop user privileges and chroot if needed */
 static void
 perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
@@ -485,11 +473,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #endif
 #ifdef HAVE_GETPWNAM
 	struct passwd *pwd = NULL;
-#endif

-	if(!daemon_privileged(daemon))
-		fatal_exit("could not do privileged setup");
-#ifdef HAVE_GETPWNAM
 	if(cfg->username && cfg->username[0]) {
 		if((pwd = getpwnam(cfg->username)) == NULL)
 			fatal_exit("user '%s' does not exist.", cfg->username);
@@ -501,8 +485,36 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #endif

 	/* read ssl keys while superuser and outside chroot */
-	setup_sslctx_remote(daemon, cfg);
-	daemon_setup_sslctxs(daemon, cfg);
+#ifdef HAVE_SSL
+	if(!(daemon->rc = daemon_remote_create(cfg)))
+		fatal_exit("could not set up remote-control");
+	if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
+		if(!(daemon->listen_sslctx = listen_sslctx_create(
+			cfg->ssl_service_key, cfg->ssl_service_pem, NULL)))
+			fatal_exit("could not set up listen SSL_CTX");
+		if(cfg->tls_ciphers && cfg->tls_ciphers[0]) {
+			if (!SSL_CTX_set_cipher_list(daemon->listen_sslctx, cfg->tls_ciphers)) {
+				fatal_exit("failed to set tls-cipher %s", cfg->tls_ciphers);
+			}
+		}
+#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
+		if(cfg->tls_ciphersuites && cfg->tls_ciphersuites[0]) {
+			if (!SSL_CTX_set_ciphersuites(daemon->listen_sslctx, cfg->tls_ciphersuites)) {
+				fatal_exit("failed to set tls-ciphersuites %s", cfg->tls_ciphersuites);
+			}
+		}
+#endif
+		if(cfg->tls_session_ticket_keys.first &&
+			cfg->tls_session_ticket_keys.first->str[0] != 0) {
+			if(!listen_sslctx_setup_ticket_keys(daemon->listen_sslctx, cfg->tls_session_ticket_keys.first)) {
+				fatal_exit("could not set session ticket SSL_CTX");
+			}
+		}
+	}
+	if(!(daemon->connect_sslctx = connect_sslctx_create(NULL, NULL,
+		cfg->tls_cert_bundle, cfg->tls_win_cert)))
+		fatal_exit("could not set up connect SSL_CTX");
+#endif

 	/* init syslog (as root) if needed, before daemonize, otherwise
 	 * a fork error could not be printed since daemonize closed stderr.*/
@@ -665,9 +677,6 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 	 * it would succeed on SIGHUP as well */
 	if(!cfg->use_syslog)
 		log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
-	daemon->cfgfile = strdup(*cfgfile);
-	if(!daemon->cfgfile)
-		fatal_exit("out of memory in daemon cfgfile strdup");
 }

 /**
@@ -702,7 +711,6 @@ run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode, int need_pi
 					"the commandline to see more errors, "
 					"or unbound-checkconf", cfgfile);
 			log_warn("Continuing with default config settings");
-			config_auto_slab_values(cfg);
 		}
 		apply_settings(daemon, cfg, cmdline_verbose, debug_mode);
 		if(!done_setup)
@@ -160,11 +160,9 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 		+ sizeof(worker->rndstate)
 		+ regional_get_mem(worker->scratchpad)
 		+ sizeof(*worker->env.scratch_buffer)
-		+ sldns_buffer_capacity(worker->env.scratch_buffer);
-	if(worker->daemon->env->fwds)
-		log_info("forwards=%u", (unsigned)forwards_get_mem(worker->env.fwds));
-	if(worker->daemon->env->hints)
-		log_info("hints=%u", (unsigned)hints_get_mem(worker->env.hints));
+		+ sldns_buffer_capacity(worker->env.scratch_buffer)
+		+ forwards_get_mem(worker->env.fwds)
+		+ hints_get_mem(worker->env.hints);
 	if(worker->thread_num == 0)
 		me += acl_list_get_mem(worker->daemon->acl);
 	if(cur_serv) {
@@ -255,8 +253,7 @@ worker_handle_service_reply(struct comm_point* c, void* arg, int error,
 		return 0;
 	}
 	/* sanity check. */
-	if(sldns_buffer_limit(c->buffer) < LDNS_HEADER_SIZE
-		|| !LDNS_QR_WIRE(sldns_buffer_begin(c->buffer))
+	if(!LDNS_QR_WIRE(sldns_buffer_begin(c->buffer))
 		|| LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) !=
 			LDNS_PACKET_QUERY
 		|| LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) > 1) {
@@ -293,44 +290,6 @@ worker_err_ratelimit(struct worker* worker, int err)
 	return err;
 }

-/**
- * Reply with an error.
- * This reply includes the qname if it has been parsed.
- * For error ratelimiting, the err ratelimit routine should be checked
- * beforehand. The reply is without EDNS, and copies RD and sets QR flag.
- * @param pkt: the packet buffer from the comm point.
- * @param err: the error code that would be wanted.
- * @param qname_len: 0 if not parsed, and the qname length in packet.
- */
-static void
-query_error(sldns_buffer* pkt, int err, size_t qname_len)
-{
-	/* Preserve the RD flag.
-	 * The CD flag must be cleared in authoritative answers,
-	 * also the AD flag need not be copied into answers.
-	 * The other flags need not be copied into the answer. */
-	sldns_buffer_write_u16_at(pkt, 2,
-		sldns_buffer_read_u16_at(pkt, 2)&0x0100U);
-	LDNS_QR_SET(sldns_buffer_begin(pkt)); /* Set QR flag. */
-	LDNS_RCODE_SET(sldns_buffer_begin(pkt), err); /* Set rcode */
-
-	if(qname_len && LDNS_QDCOUNT(sldns_buffer_begin(pkt))>=1 &&
-		qname_len <= LDNS_MAX_DOMAINLEN) {
-		/* Copy query into the answer. */
-		LDNS_QDCOUNT_SET(sldns_buffer_begin(pkt), 1);
-		sldns_buffer_set_position(pkt, LDNS_HEADER_SIZE +
-			qname_len + 2 /* type */ + 2 /* class */ );
-	} else {
-		/* No query section in answer. */
-		LDNS_QDCOUNT_SET(sldns_buffer_begin(pkt), 0);
-		sldns_buffer_set_position(pkt, LDNS_HEADER_SIZE);
-	}
-	LDNS_ANCOUNT_SET(sldns_buffer_begin(pkt), 0);
-	LDNS_NSCOUNT_SET(sldns_buffer_begin(pkt), 0);
-	LDNS_ARCOUNT_SET(sldns_buffer_begin(pkt), 0);
-	sldns_buffer_flip(pkt);
-}
-
 /**
 * Structure holding the result of the worker_check_request function.
 * Based on configuration it could be called up to four times; ideally should
@@ -368,6 +327,7 @@ worker_check_request(sldns_buffer* pkt, struct worker* worker,
 		return;
 	}
 	if(LDNS_TC_WIRE(sldns_buffer_begin(pkt))) {
+		LDNS_TC_CLR(sldns_buffer_begin(pkt));
 		verbose(VERB_QUERY, "request bad, has TC bit on");
 		out->value = worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 		return;
@@ -409,84 +369,6 @@ worker_check_request(sldns_buffer* pkt, struct worker* worker,
 	return;
 }

-/**
- * Send fast-reload acknowledgement to the mainthread in one byte.
- * This signals that this worker has received the previous command.
- * The worker is waiting if that is after a reload_stop command.
- * Or the worker has briefly processed the event itself, and in doing so
- * released data pointers to old config, after a reload_poll command.
- */
-static void
-worker_send_reload_ack(struct worker* worker)
-{
-	/* If this is clipped to 8 bits because thread_num>255, then that
-	 * is not a problem, the receiver counts the number of bytes received.
-	 * The number is informative only. */
-	uint8_t c = (uint8_t)worker->thread_num;
-	ssize_t ret;
-	while(1) {
-		ret = send(worker->daemon->fast_reload_thread->commreload[1],
-			(void*)&c, 1, 0);
-		if(ret == -1) {
-			if(
-#ifndef USE_WINSOCK
-				errno == EINTR || errno == EAGAIN
-#  ifdef EWOULDBLOCK
-				|| errno == EWOULDBLOCK
-#  endif
-#else
-				WSAGetLastError() == WSAEINTR ||
-				WSAGetLastError() == WSAEINPROGRESS ||
-				WSAGetLastError() == WSAEWOULDBLOCK
-#endif
-				)
-				continue; /* Try again. */
-			log_err("worker reload ack reply: send failed: %s",
-				sock_strerror(errno));
-			break;
-		}
-		break;
-	}
-}
-
-/** stop and wait to resume the worker */
-static void
-worker_stop_and_wait(struct worker* worker)
-{
-	uint8_t* buf = NULL;
-	uint32_t len = 0, cmd;
-	worker_send_reload_ack(worker);
-	/* wait for reload */
-	if(!tube_read_msg(worker->cmd, &buf, &len, 0)) {
-		log_err("worker reload read reply failed");
-		return;
-	}
-	if(len != sizeof(uint32_t)) {
-		log_err("worker reload reply, bad control msg length %d",
-			(int)len);
-		free(buf);
-		return;
-	}
-	cmd = sldns_read_uint32(buf);
-	free(buf);
-	if(cmd == worker_cmd_quit) {
-		/* quit anyway */
-		verbose(VERB_ALGO, "reload reply, control cmd quit");
-		comm_base_exit(worker->base);
-		return;
-	}
-	if(cmd != worker_cmd_reload_start) {
-		log_err("worker reload reply, wrong reply command");
-	}
-	if(worker->daemon->fast_reload_drop_mesh) {
-		verbose(VERB_ALGO, "worker: drop mesh queries after reload");
-		mesh_delete_all(worker->env.mesh);
-	}
-	fast_reload_worker_pickup_changes(worker);
-	worker_send_reload_ack(worker);
-	verbose(VERB_ALGO, "worker resume after reload");
-}
-
 void
 worker_handle_control_cmd(struct tube* ATTR_UNUSED(tube), uint8_t* msg,
 	size_t len, int error, void* arg)
@@ -522,15 +404,6 @@ worker_handle_control_cmd(struct tube* ATTR_UNUSED(tube), uint8_t* msg,
 		verbose(VERB_ALGO, "got control cmd remote");
 		daemon_remote_exec(worker);
 		break;
-	case worker_cmd_reload_stop:
-		verbose(VERB_ALGO, "got control cmd reload_stop");
-		worker_stop_and_wait(worker);
-		break;
-	case worker_cmd_reload_poll:
-		verbose(VERB_ALGO, "got control cmd reload_poll");
-		fast_reload_worker_pickup_changes(worker);
-		worker_send_reload_ack(worker);
-		break;
 	default:
 		log_err("bad command %d", (int)cmd);
 		break;
@@ -725,8 +598,7 @@ apply_respip_action(struct worker* worker, const struct query_info* qinfo,
 		return 1;

 	if(!respip_rewrite_reply(qinfo, cinfo, rep, encode_repp, &actinfo,
-		alias_rrset, 0, worker->scratchpad, az, NULL,
-		worker->env.views, worker->env.respip_set))
+		alias_rrset, 0, worker->scratchpad, az, NULL))
 		return 0;

 	/* xxx_deny actions mean dropping the reply, unless the original reply
@@ -784,21 +656,25 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	*partial_repp = NULL;  /* avoid accidental further pass */

 	/* Check TTL */
-	if(TTL_IS_EXPIRED(rep->ttl, timenow)) {
+	if(rep->ttl < timenow) {
 		/* Check if we need to serve expired now */
 		if(worker->env.cfg->serve_expired &&
-			/* if serve-expired-client-timeout is set, serve
-			 * an expired record without attempting recursion
-			 * if the serve_expired_norec_ttl is set for the record
-			 * as we know that recursion is currently failing. */
-			(!worker->env.cfg->serve_expired_client_timeout ||
-			 timenow < rep->serve_expired_norec_ttl)
+			!worker->env.cfg->serve_expired_client_timeout
 #ifdef USE_CACHEDB
 			&& !(worker->env.cachedb_enabled &&
 			  worker->env.cfg->cachedb_check_when_serve_expired)
 #endif
 			) {
-				if(!reply_info_can_answer_expired(rep, timenow))
+				if(worker->env.cfg->serve_expired_ttl &&
+					rep->serve_expired_ttl < timenow)
+					return 0;
+				/* Ignore expired failure answers */
+				if(FLAGS_GET_RCODE(rep->flags) !=
+					LDNS_RCODE_NOERROR &&
+					FLAGS_GET_RCODE(rep->flags) !=
+					LDNS_RCODE_NXDOMAIN &&
+					FLAGS_GET_RCODE(rep->flags) !=
+					LDNS_RCODE_YXDOMAIN)
 					return 0;
 				if(!rrset_array_lock(rep->ref, rep->rrset_count, 0))
 					return 0;
@@ -887,8 +763,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	} else if(partial_rep &&
 		!respip_merge_cname(partial_rep, qinfo, rep, cinfo,
 		must_validate, &encode_rep, worker->scratchpad,
-		worker->env.auth_zones, worker->env.views,
-		worker->env.respip_set)) {
+		worker->env.auth_zones)) {
 		goto bail_out;
 	}
 	if(encode_rep != rep) {
@@ -1009,7 +884,6 @@ chaos_replystr(sldns_buffer* pkt, char** str, int num, struct edns_data* edns,
 	size_t udpsize = edns->udp_size;
 	edns->edns_version = EDNS_ADVERTISED_VERSION;
 	edns->udp_size = EDNS_ADVERTISED_SIZE;
-	edns->ext_rcode = 0;
 	edns->bits &= EDNS_DO;
 	if(!inplace_cb_reply_local_call(&worker->env, NULL, NULL, NULL,
 		LDNS_RCODE_NOERROR, edns, repinfo, worker->scratchpad,
@@ -1210,7 +1084,7 @@ answer_notify(struct worker* w, struct query_info* qinfo,

 	if(verbosity >= VERB_DETAIL) {
 		char buf[380];
-		char zname[LDNS_MAX_DOMAINLEN];
+		char zname[255+1];
 		char sr[25];
 		dname_str(qinfo->qname, zname);
 		sr[0]=0;
@@ -1268,7 +1142,9 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		worker_check_request(c->buffer, worker, check_result);
 		if(check_result->value != 0) {
 			if(check_result->value != -1) {
-				query_error(c->buffer, check_result->value, 0);
+				LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+					check_result->value);
 				return 1;
 			}
 			comm_point_drop_reply(repinfo);
@@ -1285,17 +1161,41 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		/* check additional section is present and that we respond with EDEs */
 		if(LDNS_ARCOUNT(sldns_buffer_begin(c->buffer)) != 1
 			|| !ede) {
-			query_error(c->buffer, LDNS_RCODE_REFUSED, 0);
+			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				LDNS_RCODE_REFUSED);
+			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+			sldns_buffer_flip(c->buffer);
 			return 1;
 		}

 		if (!query_dname_len(c->buffer)) {
-			query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
+			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				LDNS_RCODE_FORMERR);
+			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+			sldns_buffer_flip(c->buffer);
 			return 1;
 		}
 		/* space available for query type and class? */
 		if (sldns_buffer_remaining(c->buffer) < 2 * sizeof(uint16_t)) {
-			query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
+                        LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+                        LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				 LDNS_RCODE_FORMERR);
+			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+                        sldns_buffer_flip(c->buffer);
 			return 1;
 		}
 		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
@@ -1317,27 +1217,35 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 			if(!skip_pkt_rrs(c->buffer,
 				((int)LDNS_ANCOUNT(sldns_buffer_begin(c->buffer)))+
 				((int)LDNS_NSCOUNT(sldns_buffer_begin(c->buffer))))) {
-				query_error(c->buffer, LDNS_RCODE_FORMERR,
-					opt_rr_mark - LDNS_HEADER_SIZE
-					- 2 /* qtype */ - 2 /* qclass */);
+				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+					LDNS_RCODE_FORMERR);
+				LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+				LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+				LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+				sldns_buffer_set_position(c->buffer, opt_rr_mark);
+				sldns_buffer_flip(c->buffer);
 				return 1;
 			}
 		}
 		/* Do we have a valid OPT RR here? If not return REFUSED (could be a valid TSIG or something so no FORMERR) */
 		/* domain name must be the root of length 1. */
 		if(sldns_buffer_remaining(c->buffer) < 1 || *sldns_buffer_current(c->buffer) != 0) {
-			query_error(c->buffer, LDNS_RCODE_REFUSED,
-				opt_rr_mark - LDNS_HEADER_SIZE
-				- 2 /* qtype */ - 2 /* qclass */);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			sldns_buffer_set_position(c->buffer, opt_rr_mark);
+			sldns_buffer_flip(c->buffer);
 			return 1;
 		} else {
 			sldns_buffer_skip(c->buffer, 1); /* skip root label */
 		}
 		if(sldns_buffer_remaining(c->buffer) < 2 ||
 			sldns_buffer_read_u16(c->buffer) != LDNS_RR_TYPE_OPT) {
-			query_error(c->buffer, LDNS_RCODE_REFUSED,
-				opt_rr_mark - LDNS_HEADER_SIZE
-				- 2 /* qtype */ - 2 /* qclass */);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			sldns_buffer_set_position(c->buffer, opt_rr_mark);
+			sldns_buffer_flip(c->buffer);
 			return 1;
 		}
 		/* Write OPT RR directly after the query,
@@ -1449,24 +1357,6 @@ check_ip_ratelimit(struct worker* worker, struct sockaddr_storage* addr,
 	return 1;
 }

-/*
- * This is the callback function when a request arrives. It is passed
- * the packet and user argument. Return true to send a reply.
- * This is of type comm_point_callback_type. The struct comm_point contains
- * more comments on the comm_point.callback member about the function.
- * @param c: the comm_point where the request arrives on.
- * @param arg: the user argument for the callback, the worker.
- * @param error: This can be NETEVENT_NOERROR, NETEVENT_TIMEOUT,
- *	NETEVENT_CLOSED or other comm point callback error values.
- * @param repinfo: The reply info, use it to send a reply. If the reply
- *	is immediate, return 1. If the reply is later on return 0 and save
- *	the repinfo, to call comm_point_send_reply on.
- * @return 1 to sent a reply straight away, for like cache response so that
- *	no allocation needs to be done. And only internal preallocated buffers
- *	are used. Return 0 and save the repinfo to reply later, for responses
- *	that need to be looked up. Return 0 and call comm_point_drop_reply on
- *	the repinfo to drop the response.
- */
 int
 worker_handle_request(struct comm_point* c, void* arg, int error,
 	struct comm_reply* repinfo)
@@ -1525,7 +1415,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		return 0;
 	}
 	if(c->dnscrypt && !repinfo->is_dnscrypted) {
-		char buf[LDNS_MAX_DOMAINLEN];
+		char buf[LDNS_MAX_DOMAINLEN+1];
 		/* Check if this is unencrypted and asking for certs */
 		worker_check_request(c->buffer, worker, &check_result);
 		if(check_result.value != 0) {
@@ -1533,10 +1423,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 				"dnscrypt: worker check request: bad query.");
 			log_addr(VERB_CLIENT,"from",&repinfo->client_addr,
 				repinfo->client_addrlen);
-			if(check_result.value != -1) {
-				query_error(c->buffer, check_result.value, 0);
-				return 1;
-			}
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
@@ -1545,12 +1431,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 				"dnscrypt: worker parse request: formerror.");
 			log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 				repinfo->client_addrlen);
-			if(worker_err_ratelimit(worker, LDNS_RCODE_FORMERR) == -1) {
-				comm_point_drop_reply(repinfo);
-				return 0;
-			}
-			query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
-			return 1;
+			comm_point_drop_reply(repinfo);
+			return 0;
 		}
 		dname_str(qinfo.qname, buf);
 		if(!(qinfo.qtype == LDNS_RR_TYPE_TXT &&
@@ -1561,14 +1443,9 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 				worker->daemon->dnscenv->provider_name,
 				sldns_rr_descript(qinfo.qtype)->_name,
 				buf);
-			if(worker_err_ratelimit(worker, LDNS_RCODE_SERVFAIL) == -1) {
-				comm_point_drop_reply(repinfo);
-				return 0;
-			}
-			query_error(c->buffer, LDNS_RCODE_SERVFAIL,
-				qinfo.qname_len);
+			comm_point_drop_reply(repinfo);
 			worker->stats.num_query_dnscrypt_cleartext++;
-			return 1;
+			return 0;
 		}
 		worker->stats.num_query_dnscrypt_cert++;
 		sldns_buffer_rewind(c->buffer);
@@ -1608,7 +1485,9 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		verbose(VERB_ALGO, "worker check request: bad query.");
 		log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
 		if(check_result.value != -1) {
-			query_error(c->buffer, check_result.value, 0);
+			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				check_result.value);
 			return 1;
 		}
 		comm_point_drop_reply(repinfo);
@@ -1642,7 +1521,10 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
-		query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
+		sldns_buffer_rewind(c->buffer);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_FORMERR);
 		goto send_reply;
 	}
 	if(worker->env.cfg->log_queries) {
@@ -1655,11 +1537,10 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		verbose(VERB_ALGO, "worker request: refused zone transfer.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
-		if(worker_err_ratelimit(worker, LDNS_RCODE_REFUSED) == -1) {
-			comm_point_drop_reply(repinfo);
-			return 0;
-		}
-		query_error(c->buffer, LDNS_RCODE_REFUSED, qinfo.qname_len);
+		sldns_buffer_rewind(c->buffer);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_REFUSED);
 		if(worker->stats.extended) {
 			worker->stats.qtype[qinfo.qtype]++;
 		}
@@ -1678,7 +1559,10 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
-		query_error(c->buffer, LDNS_RCODE_FORMERR, qinfo.qname_len);
+		sldns_buffer_rewind(c->buffer);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_FORMERR);
 		if(worker->stats.extended) {
 			worker->stats.qtype[qinfo.qtype]++;
 		}
@@ -1686,17 +1570,12 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	}
 	if((ret=parse_edns_from_query_pkt(
 			c->buffer, &edns, worker->env.cfg, c, repinfo,
-			*worker->env.now, worker->scratchpad,
-			worker->daemon->cookie_secrets)) != 0) {
+			(worker->env.now ? *worker->env.now : time(NULL)),
+			worker->scratchpad)) != 0) {
 		struct edns_data reply_edns;
 		verbose(VERB_ALGO, "worker parse edns: formerror.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
-		if(worker_err_ratelimit(worker, ret) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
 		memset(&reply_edns, 0, sizeof(reply_edns));
 		reply_edns.edns_present = 1;
 		error_encode(c->buffer, ret, &qinfo,
@@ -1713,11 +1592,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			verbose(VERB_ALGO, "query with bad edns version.");
 			log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 				repinfo->client_addrlen);
-			if(worker_err_ratelimit(worker, EDNS_RCODE_BADVERS) == -1) {
-				comm_point_drop_reply(repinfo);
-				regional_free_all(worker->scratchpad);
-				return 0;
-			}
 			extended_error_encode(c->buffer, EDNS_RCODE_BADVERS, &qinfo,
 				*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 				sldns_buffer_read_u16_at(c->buffer, 2), 0, &edns);
@@ -1745,7 +1619,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			repinfo->client_addrlen, edns.cookie_valid,
 			c->buffer)) {
 			worker->stats.num_queries_ip_ratelimited++;
-			regional_free_all(worker->scratchpad);
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
@@ -1763,11 +1636,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,

 	else if(edns.cookie_present) {
 		/* Cookie present, but not valid: Cookie was bad! */
-		if(worker_err_ratelimit(worker, LDNS_EXT_RCODE_BADCOOKIE) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
 		extended_error_encode(c->buffer,
 			LDNS_EXT_RCODE_BADCOOKIE, &qinfo,
 			*(uint16_t*)(void *)
@@ -1782,11 +1650,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			"need cookie or stateful transport");
 		log_addr(VERB_ALGO, "from",&repinfo->remote_addr
 		                          , repinfo->remote_addrlen);
-		if(worker_err_ratelimit(worker, LDNS_RCODE_REFUSED) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
 		EDNS_OPT_LIST_APPEND_EDE(&edns.opt_list_out,
 			worker->scratchpad, LDNS_EDE_OTHER,
 			"DNS Cookie needed for UDP replies");
@@ -1813,14 +1676,14 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		verbose(VERB_ALGO, "worker request: edns is too small.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
-		if(worker_err_ratelimit(worker, LDNS_RCODE_SERVFAIL) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
-		/* A small error without qname, and TC flag on. */
-		query_error(c->buffer, LDNS_RCODE_SERVFAIL, 0);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 		LDNS_TC_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_SERVFAIL);
+		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+		sldns_buffer_write_at(c->buffer, 4,
+			(uint8_t*)"\0\0\0\0\0\0\0\0", 8);
+		sldns_buffer_flip(c->buffer);
 		regional_free_all(worker->scratchpad);
 		goto send_reply;
 	}
@@ -1867,9 +1730,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		goto send_reply;
 	}
 	if(worker->env.auth_zones &&
-		auth_zones_downstream_answer(worker->env.auth_zones,
-		&worker->env, &qinfo, &edns, repinfo, c->buffer,
-		worker->scratchpad)) {
+		auth_zones_answer(worker->env.auth_zones, &worker->env,
+		&qinfo, &edns, repinfo, c->buffer, worker->scratchpad)) {
 		regional_free_all(worker->scratchpad);
 		if(sldns_buffer_limit(c->buffer) == 0) {
 			comm_point_drop_reply(repinfo);
@@ -1905,15 +1767,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	 * ACLs allow the snooping. */
 	if(!(LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) &&
 		acl != acl_allow_snoop ) {
-		log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
-			&repinfo->client_addr, repinfo->client_addrlen);
-		/* This ratelimited error query is accounted in the stats,
-		 * as an incoming query. */
-		if(worker_err_ratelimit(worker, LDNS_RCODE_REFUSED) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
 		if(worker->env.cfg->ede) {
 			EDNS_OPT_LIST_APPEND_EDE(&edns.opt_list_out,
 				worker->scratchpad, LDNS_EDE_NOT_AUTHORITATIVE, "");
@@ -1922,17 +1775,29 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 			sldns_buffer_read_u16_at(c->buffer, 2), &edns);
 		regional_free_all(worker->scratchpad);
+		log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
+			&repinfo->client_addr, repinfo->client_addrlen);
+
 		goto send_reply;
 	}

 	/* If we've found a local alias, replace the qname with the alias
 	 * target before resolving it. */
 	if(qinfo.local_alias) {
-		if(!local_alias_shallow_copy_qname(qinfo.local_alias, &qinfo.qname,
-			&qinfo.qname_len)) {
+		struct ub_packed_rrset_key* rrset = qinfo.local_alias->rrset;
+		struct packed_rrset_data* d = rrset->entry.data;
+
+		/* Sanity check: our current implementation only supports
+		 * a single CNAME RRset as a local alias. */
+		if(qinfo.local_alias->next ||
+			rrset->rk.type != htons(LDNS_RR_TYPE_CNAME) ||
+			d->count != 1) {
+			log_err("assumption failure: unexpected local alias");
 			regional_free_all(worker->scratchpad);
 			return 0; /* drop it */
 		}
+		qinfo.qname = d->rr_data[0] + 2;
+		qinfo.qname_len = d->rr_len[0] - 2;
 	}

 	/* If we may apply IP-based actions to the answer, build the client
@@ -1949,7 +1814,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		cinfo_tmp.tag_datas = acladdr->tag_datas;
 		cinfo_tmp.tag_datas_size = acladdr->tag_datas_size;
 		cinfo_tmp.view = acladdr->view;
-		cinfo_tmp.view_name = NULL;
+		cinfo_tmp.respip_set = worker->daemon->respip_set;
 		cinfo = &cinfo_tmp;
 	}

@@ -1981,13 +1846,13 @@ lookup_cache:
 				 * its qname must be that used for cache
 				 * lookup. */
 				if((worker->env.cfg->prefetch &&
-					rep->prefetch_ttl <= *worker->env.now) ||
+					*worker->env.now >= rep->prefetch_ttl) ||
 					(worker->env.cfg->serve_expired &&
-					TTL_IS_EXPIRED(rep->ttl, *worker->env.now) &&
-					!(*worker->env.now < rep->serve_expired_norec_ttl))) {
-					time_t leeway =
-						TTL_IS_EXPIRED(rep->ttl, *worker->env.now)
-						? 0 : rep->ttl - *worker->env.now;
+					*worker->env.now > rep->ttl)) {
+
+					time_t leeway = rep->ttl - *worker->env.now;
+					if(rep->ttl < *worker->env.now)
+						leeway = 0;
 					lock_rw_unlock(&e->lock);

 					reply_and_prefetch(worker, lookup_qinfo,
@@ -2102,13 +1967,13 @@ send_reply_rc:
 				&repinfo->client_addr, repinfo->client_addrlen,
 				tv, 1, c->buffer,
 				(worker->env.cfg->log_destaddr?(void*)repinfo->c->socket->addr:NULL),
-				c->type, c->ssl);
+				c->type);
 		} else {
 			log_reply_info(NO_VERBOSE, &qinfo,
 				&repinfo->client_addr, repinfo->client_addrlen,
 				tv, 1, c->buffer,
 				(worker->env.cfg->log_destaddr?(void*)repinfo->c->socket->addr:NULL),
-				c->type, c->ssl);
+				c->type);
 		}
 	}
 #ifdef USE_DNSCRYPT
@@ -2160,37 +2025,10 @@ worker_restart_timer(struct worker* worker)
 {
 	if(worker->env.cfg->stat_interval > 0) {
 		struct timeval tv;
-		if(worker->daemon->stat_time_specific) {
-			struct timeval dest, now;
-			int interval = worker->env.cfg->stat_interval;
-			int offset = worker->daemon->stat_time_offset;
-			int nows, spec;
-			if(gettimeofday(&now, NULL) < 0)
-				log_err("gettimeofday: %s", strerror(errno));
 #ifndef S_SPLINT_S
-			nows = (int)now.tv_sec;
-			/* The next time is on the timer interval, at the
-			 * specific offset, time value % interval = offset. */
-			/* It relies on the integer division below to drop the
-			 * remainder in order to calculate the expected
-			 * result. */
-			spec = ((nows-offset)/interval+1)*interval+offset;
-			/* This is instead of an assertion, and should not
-			 * be needed. So assert(spec > nows), tv is going to
-			 * be positive. */
-			if(spec<=nows) spec += interval;
-			dest.tv_sec = spec;
-			dest.tv_usec = 0;
+		tv.tv_sec = worker->env.cfg->stat_interval;
+		tv.tv_usec = 0;
 #endif
-			/* Subtract in timeval, so the fractions of a second
-			 * are rounded to the whole specific time. */
-			timeval_subtract(&tv, &dest, &now);
-		} else {
-#ifndef S_SPLINT_S
-			tv.tv_sec = worker->env.cfg->stat_interval;
-			tv.tv_usec = 0;
-#endif
-		}
 		comm_timer_set(worker->stat_timer, &tv);
 	}
 }
@@ -2265,6 +2103,9 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	struct dt_env* dtenv = &worker->dtenv;
 #else
 	void* dtenv = NULL;
+#endif
+#ifdef HAVE_GETTID
+	worker->thread_tid = gettid();
 #endif
 	worker->need_to_exit = 0;
 	worker->base = comm_base_create(do_sigs);
@@ -2333,11 +2174,8 @@ worker_init(struct worker* worker, struct config_file *cfg,
 			: cfg->tcp_idle_timeout,
 		cfg->harden_large_queries, cfg->http_max_streams,
 		cfg->http_endpoint, cfg->http_notls_downstream,
-		worker->daemon->tcl, worker->daemon->listen_dot_sslctx,
-		worker->daemon->listen_doh_sslctx,
-		worker->daemon->listen_quic_sslctx,
-		dtenv, worker->daemon->doq_table, worker->env.rnd,
-		cfg, worker_handle_request, worker);
+		worker->daemon->tcl, worker->daemon->listen_sslctx,
+		dtenv, worker_handle_request, worker);
 	if(!worker->front) {
 		log_err("could not create listening sockets");
 		worker_delete(worker);
@@ -2352,7 +2190,7 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		cfg->unwanted_threshold, cfg->outgoing_tcp_mss,
 		&worker_alloc_cleanup, worker,
 		cfg->do_udp || cfg->udp_upstream_without_downstream,
-		worker->daemon->connect_dot_sslctx, cfg->delay_close,
+		worker->daemon->connect_sslctx, cfg->delay_close,
 		cfg->tls_use_sni, dtenv, cfg->udp_connect,
 		cfg->max_reuse_tcp_queries, cfg->tcp_reuse_timeout,
 		cfg->tcp_auth_query_timeout);
@@ -2671,19 +2509,3 @@ void dtio_mainfdcallback(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
 	log_assert(0);
 }
 #endif
-
-#ifdef HAVE_NGTCP2
-void doq_client_event_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
-
-#ifdef HAVE_NGTCP2
-void doq_client_timer_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
@@ -72,13 +72,7 @@ enum worker_commands {
 	/** obtain statistics without statsclear */
 	worker_cmd_stats_noreset,
 	/** execute remote control command */
-	worker_cmd_remote,
-	/** for fast-reload, perform stop */
-	worker_cmd_reload_stop,
-	/** for fast-reload, start again */
-	worker_cmd_reload_start,
-	/** for fast-reload, poll to make sure worker has released data */
-	worker_cmd_reload_poll
+	worker_cmd_remote
 };

 /**
@@ -366,23 +366,22 @@ static int
 dns64_apply_cfg(struct dns64_env* dns64_env, struct config_file* cfg)
 {
    struct config_strlist* s;
-    const char* dns64_prefix = cfg->dns64_prefix ?
-	cfg->dns64_prefix : DEFAULT_DNS64_PREFIX;
-    verbose(VERB_ALGO, "dns64-prefix: %s", dns64_prefix);
-    if (!netblockstrtoaddr(dns64_prefix, 0, &dns64_env->prefix_addr,
+    verbose(VERB_ALGO, "dns64-prefix: %s", cfg->dns64_prefix);
+    if (!netblockstrtoaddr(cfg->dns64_prefix ? cfg->dns64_prefix :
+                DEFAULT_DNS64_PREFIX, 0, &dns64_env->prefix_addr,
                &dns64_env->prefix_addrlen, &dns64_env->prefix_net)) {
-        log_err("cannot parse dns64-prefix netblock: %s", dns64_prefix);
+        log_err("cannot parse dns64-prefix netblock: %s", cfg->dns64_prefix);
        return 0;
    }
    if (!addr_is_ip6(&dns64_env->prefix_addr, dns64_env->prefix_addrlen)) {
-        log_err("dns64_prefix is not IPv6: %s", dns64_prefix);
+        log_err("dns64_prefix is not IPv6: %s", cfg->dns64_prefix);
        return 0;
    }
    if (dns64_env->prefix_net != 32 && dns64_env->prefix_net != 40 &&
            dns64_env->prefix_net != 48 && dns64_env->prefix_net != 56 &&
            dns64_env->prefix_net != 64 && dns64_env->prefix_net != 96 ) {
-        log_err("dns64-prefix length is not 32, 40, 48, 56, 64 or 96: %s",
-                dns64_prefix);
+        log_err("dns64-prefix length it not 32, 40, 48, 56, 64 or 96: %s",
+                cfg->dns64_prefix);
        return 0;
    }
    for(s = cfg->dns64_ignore_aaaa; s; s = s->next) {
@@ -497,8 +496,8 @@ handle_ipv6_ptr(struct module_qstate* qstate, int id)

    /* Create the new sub-query. */
    fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-    if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->client_info,
-	    qstate->query_flags, 0, 0, &subq))
+    if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0, 0,
+                &subq))
        return module_error;
    if (subq) {
        subq->curmod = id;
@@ -523,8 +522,8 @@ generate_type_A_query(struct module_qstate* qstate, int id)

 	/* Start the sub-query. */
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->client_info,
-		qstate->query_flags, 0, 0, &subq))
+	if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0,
+				       0, &subq))
 	{
 		verbose(VERB_ALGO, "dns64: sub-query creation failed");
 		return module_error;
@@ -632,7 +631,7 @@ handle_event_moddone(struct module_qstate* qstate, int id)

 	/* When an AAAA query completes check if we want to perform DNS64
 	 * synthesis. We skip queries with DNSSEC enabled (!CD) and
-	 * ones generated by us to retrieve the A/PTR record to use for
+	 * ones generated by us to retrive the A/PTR record to use for
 	 * synth. */
 	int could_synth =
 		qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA &&
@@ -658,9 +657,8 @@ handle_event_moddone(struct module_qstate* qstate, int id)
 		qstate->return_msg->rep &&
 		!dns_cache_store(
 			qstate->env, &qstate->qinfo, qstate->return_msg->rep,
-			0, qstate->prefetch_leeway, 0, NULL,
-			qstate->query_flags, qstate->qstarttime,
-			qstate->is_valrec))
+			0, 0, 0, NULL,
+			qstate->query_flags, qstate->qstarttime))
 		log_err("out of memory");

 	/* do nothing */
@@ -703,7 +701,6 @@ dns64_operate(struct module_qstate* qstate, enum module_ev event, int id,
 			iq->state = DNS64_NEW_QUERY;
 			iq->started_no_cache_store = qstate->no_cache_store;
 			qstate->no_cache_store = 1;
-			ATTR_FALLTHROUGH
  			/* fallthrough */
 		case module_event_pass:
 			qstate->ext_state[id] = handle_event_pass(qstate, id);
@@ -849,7 +846,6 @@ dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate
 	 */
 	cp = construct_reply_info_base(super->region, rep->flags, rep->qdcount,
 		rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl,
-		rep->serve_expired_norec_ttl,
 		rep->an_numrrsets, rep->ns_numrrsets, rep->ar_numrrsets,
 		rep->rrset_count, rep->security, LDNS_EDE_NONE);
 	if(!cp)
@@ -1010,8 +1006,7 @@ dns64_inform_super(struct module_qstate* qstate, int id,
 	/* Store the generated response in cache. */
 	if ( (!super_dq || !super_dq->started_no_cache_store) &&
 		!dns_cache_store(super->env, &super->qinfo, super->return_msg->rep,
-		0, super->prefetch_leeway, 0, NULL, super->query_flags,
-		qstate->qstarttime, qstate->is_valrec))
+		0, 0, 0, NULL, super->query_flags, qstate->qstarttime))
 		log_err("out of memory");
 }

@@ -1049,8 +1044,8 @@ dns64_get_mem(struct module_env* env, int id)
 */
 static struct module_func_block dns64_block = {
 	"dns64",
-	NULL, NULL, &dns64_init, &dns64_deinit, &dns64_operate,
-	&dns64_inform_super, &dns64_clear, &dns64_get_mem
+	&dns64_init, &dns64_deinit, &dns64_operate, &dns64_inform_super,
+	&dns64_clear, &dns64_get_mem
 };

 /**
@@ -361,7 +361,7 @@ dnscrypt_server_uncurve(struct dnsc_env* env,

    len -= DNSCRYPT_QUERY_HEADER_SIZE;

-    while (len>0 && *sldns_buffer_at(buffer, --len) == 0)
+    while (*sldns_buffer_at(buffer, --len) == 0)
        ;

    if (*sldns_buffer_at(buffer, len) != 0x80) {
@@ -86,31 +86,6 @@ dt_pack(const Dnstap__Dnstap *d, void **buf, size_t *sz)
 	return 1;
 }

-/** See if the message is sent due to dnstap sample rate */
-static int
-dt_sample_rate_limited(struct dt_env* env)
-{
-	lock_basic_lock(&env->sample_lock);
-	/* Sampling is every [n] packets. Where n==1, every packet is sent */
-	if(env->sample_rate > 1) {
-		int submit = 0;
-		/* if sampling is engaged... */
-		if (env->sample_rate_count > env->sample_rate) {
-			/* once the count passes the limit */
-			/* submit the message */
-			submit = 1;
-			/* and reset the count */
-			env->sample_rate_count = 0;
-		}
-		/* increment count regardless */
-		env->sample_rate_count++;
-		lock_basic_unlock(&env->sample_lock);
-		return !submit;
-	}
-	lock_basic_unlock(&env->sample_lock);
-	return 0;
-}
-
 static void
 dt_send(const struct dt_env *env, void *buf, size_t len_buf)
 {
@@ -171,7 +146,6 @@ dt_create(struct config_file* cfg)
 	env = (struct dt_env *) calloc(1, sizeof(struct dt_env));
 	if (!env)
 		return NULL;
-	lock_basic_init(&env->sample_lock);

 	env->dtio = dt_io_thread_create();
 	if(!env->dtio) {
@@ -192,11 +166,8 @@ static void
 dt_apply_identity(struct dt_env *env, struct config_file *cfg)
 {
 	char buf[MAXHOSTNAMELEN+1];
-	if (!cfg->dnstap_send_identity) {
-		free(env->identity);
-		env->identity = NULL;
+	if (!cfg->dnstap_send_identity)
 		return;
-	}
 	free(env->identity);
 	if (cfg->dnstap_identity == NULL || cfg->dnstap_identity[0] == 0) {
 		if (gethostname(buf, MAXHOSTNAMELEN) == 0) {
@@ -218,11 +189,8 @@ dt_apply_identity(struct dt_env *env, struct config_file *cfg)
 static void
 dt_apply_version(struct dt_env *env, struct config_file *cfg)
 {
-	if (!cfg->dnstap_send_version) {
-		free(env->version);
-		env->version = NULL;
+	if (!cfg->dnstap_send_version)
 		return;
-	}
 	free(env->version);
 	if (cfg->dnstap_version == NULL || cfg->dnstap_version[0] == 0)
 		env->version = strdup(PACKAGE_STRING);
@@ -236,8 +204,13 @@ dt_apply_version(struct dt_env *env, struct config_file *cfg)
 }

 void
-dt_apply_logcfg(struct dt_env *env, struct config_file *cfg)
+dt_apply_cfg(struct dt_env *env, struct config_file *cfg)
 {
+	if (!cfg->dnstap)
+		return;
+
+	dt_apply_identity(env, cfg);
+	dt_apply_version(env, cfg);
 	if ((env->log_resolver_query_messages = (unsigned int)
 	     cfg->dnstap_log_resolver_query_messages))
 	{
@@ -268,23 +241,6 @@ dt_apply_logcfg(struct dt_env *env, struct config_file *cfg)
 	{
 		verbose(VERB_OPS, "dnstap Message/FORWARDER_RESPONSE enabled");
 	}
-	lock_basic_lock(&env->sample_lock);
-	if((env->sample_rate = (unsigned int)cfg->dnstap_sample_rate))
-	{
-		verbose(VERB_OPS, "dnstap SAMPLE_RATE enabled and set to \"%d\"", (int)env->sample_rate);
-	}
-	lock_basic_unlock(&env->sample_lock);
-}
-
-void
-dt_apply_cfg(struct dt_env *env, struct config_file *cfg)
-{
-	if (!cfg->dnstap)
-		return;
-
-	dt_apply_identity(env, cfg);
-	dt_apply_version(env, cfg);
-	dt_apply_logcfg(env, cfg);
 }

 int
@@ -317,7 +273,6 @@ dt_delete(struct dt_env *env)
 	if (!env)
 		return;
 	dt_io_thread_delete(env->dtio);
-	lock_basic_destroy(&env->sample_lock);
 	free(env->identity);
 	free(env->version);
 	free(env);
@@ -454,9 +409,6 @@ dt_msg_send_client_query(struct dt_env *env,
 	struct dt_msg dm;
 	struct timeval qtime;

-	if(dt_sample_rate_limited(env))
-		return;
-
 	if(tstamp)
 		memcpy(&qtime, tstamp, sizeof(qtime));
 	else 	gettimeofday(&qtime, NULL);
@@ -495,9 +447,6 @@ dt_msg_send_client_response(struct dt_env *env,
 	struct dt_msg dm;
 	struct timeval rtime;

-	if(dt_sample_rate_limited(env))
-		return;
-
 	gettimeofday(&rtime, NULL);

 	/* type */
@@ -535,14 +484,11 @@ dt_msg_send_outside_query(struct dt_env *env,
 	struct timeval qtime;
 	uint16_t qflags;

-	if(dt_sample_rate_limited(env))
-		return;
-
 	gettimeofday(&qtime, NULL);
 	qflags = sldns_buffer_read_u16_at(qmsg, 2);

 	/* type */
-	if ((qflags & BIT_RD)) {
+	if (qflags & BIT_RD) {
 		if (!env->log_forwarder_query_messages)
 			return;
 		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_QUERY);
@@ -591,15 +537,12 @@ dt_msg_send_outside_response(struct dt_env *env,
 	struct dt_msg dm;
 	uint16_t qflags;

-	if(dt_sample_rate_limited(env))
-		return;
-
 	(void)qbuf_len; log_assert(qbuf_len >= sizeof(qflags));
 	memcpy(&qflags, qbuf, sizeof(qflags));
 	qflags = ntohs(qflags);

 	/* type */
-	if ((qflags & BIT_RD)) {
+	if (qflags & BIT_RD) {
 		if (!env->log_forwarder_response_messages)
 			return;
 		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_RESPONSE);
@@ -39,7 +39,6 @@

 #ifdef USE_DNSTAP

-#include "util/locks.h"
 struct config_file;
 struct sldns_buffer;
 struct dt_msg_queue;
@@ -76,13 +75,6 @@ struct dt_env {
 	unsigned log_forwarder_query_messages : 1;
 	/** whether to log Message/FORWARDER_RESPONSE */
 	unsigned log_forwarder_response_messages : 1;
-
-	/** lock on sample count */
-	lock_basic_type sample_lock;
-	/** rate limit value from config, samples 1/N messages */
-	unsigned int sample_rate;
-	/** rate limit counter */
-	unsigned int sample_rate_count;
 };

 /**
@@ -106,13 +98,6 @@ dt_create(struct config_file* cfg);
 void
 dt_apply_cfg(struct dt_env *env, struct config_file *cfg);

-/**
- * Apply config settings for log enable for message types.
- * @param env: dnstap environment object.
- * @param cfg: new config settings.
- */
-void dt_apply_logcfg(struct dt_env *env, struct config_file *cfg);
-
 /**
 * Initialize per-worker state in dnstap environment object.
 * @param env: dnstap environment object to initialize, created with dt_create().
@@ -18,41 +18,10 @@ AC_DEFUN([dt_DNSTAP],
        [opt_dnstap_socket_path="$1"])

    if test "x$opt_dnstap" != "xno"; then
-	AC_PATH_PROG([PROTOC], [protoc])
-	# 'protoc-c' is deprecated. We use 'protoc' instead. If it can not be
-	# found, try 'protoc-c'.
-	if test -z "$PROTOC"; then
-	    AC_PATH_PROG([PROTOC_C], [protoc-c])
-	else
-	    PROTOC_C="$PROTOC"
-	fi
-	if test -z "$PROTOC_C"; then
-	  AC_MSG_ERROR([[The protoc or protoc-c program was not found. It is needed for dnstap, use --disable-dnstap, or install protobuf-c to provide protoc or protoc-c]])
-	fi
-
-	# Check for protoc-gen-c plugin
-	AC_PATH_PROG([PROTOC_GEN_C], [protoc-gen-c])
-	if test -z "$PROTOC_GEN_C"; then
-	  AC_MSG_ERROR([[The protoc-gen-c plugin was not found. It is needed for dnstap, use --disable-dnstap, or install protobuf-c-compiler to provide protoc-gen-c]])
-	fi
-
-	# Test that protoc-gen-c actually works
-	AC_MSG_CHECKING([if protoc-gen-c plugin works])
-	cat > conftest.proto << EOF
-syntax = "proto2";
-message TestMessage {
-  optional string test_field = 1;
-}
-EOF
-	if $PROTOC_C --c_out=. conftest.proto >/dev/null 2>&1; then
-	  AC_MSG_RESULT([yes])
-	  rm -f conftest.proto conftest.pb-c.c conftest.pb-c.h
-	else
-	  AC_MSG_RESULT([no])
-	  rm -f conftest.proto conftest.pb-c.c conftest.pb-c.h
-	  AC_MSG_ERROR([[The protoc-gen-c plugin is not working properly. Please ensure protobuf-c-compiler is properly installed]])
-	fi
-
+        AC_PATH_PROG([PROTOC_C], [protoc-c])
+        if test -z "$PROTOC_C"; then
+          AC_MSG_ERROR([The protoc-c program was not found. Please install protobuf-c!])
+        fi
        AC_ARG_WITH([protobuf-c],
            AS_HELP_STRING([--with-protobuf-c=path], [Path where protobuf-c is installed, for dnstap]),
            [
@@ -65,38 +34,41 @@ EOF
                LDFLAGS="$LDFLAGS -L$withval/lib"
            ],
            [
-                if test -n "$PKG_CONFIG"; then
-                    PKG_CHECK_MODULES([PROTOBUFC], [libprotobuf-c],
-                        [
-                            CFLAGS="$CFLAGS $PROTOBUFC_CFLAGS"
-                            LIBS="$LIBS $PROTOBUFC_LIBS"
-                        ],
-                        [
-                            # pkg-config failed; try falling back to known values
-                            # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
-                            if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
-                                CFLAGS="$CFLAGS -I/usr/include/google"
-                            else
-                                if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
-                                    CFLAGS="$CFLAGS -I/usr/local/include/google"
-                                    LDFLAGS="$LDFLAGS -L/usr/local/lib"
+                ifdef([PKG_CHECK_MODULES],
+                    [
+                        PKG_CHECK_MODULES([PROTOBUFC], [libprotobuf-c],
+                            [
+                                CFLAGS="$CFLAGS $PROTOBUFC_CFLAGS"
+                                LIBS="$LIBS $PROTOBUFC_LIBS"
+                            ],
+                            [
+                                # pkg-config failed; try falling back to known values
+                                # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
+                                if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
+                                    CFLAGS="$CFLAGS -I/usr/include/google"
                                else
-                                    AC_MSG_ERROR([The protobuf-c package was not found with pkg-config. Please install protobuf-c!])
+                                    if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
+                                        CFLAGS="$CFLAGS -I/usr/local/include/google"
+                                        LDFLAGS="$LDFLAGS -L/usr/local/lib"
+                                    else
+                                        AC_MSG_ERROR([The protobuf-c package was not found with pkg-config. Please install protobuf-c!])
+                                    fi
                                fi
+                            ]
+                        )
+                    ],
+                    [
+                        # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
+                        if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
+                            CFLAGS="$CFLAGS -I/usr/include/google"
+                        else
+                            if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
+                                CFLAGS="$CFLAGS -I/usr/local/include/google"
+                                LDFLAGS="$LDFLAGS -L/usr/local/lib"
                            fi
-                        ]
-                    )
-                else
-                    # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
-                    if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
-                        CFLAGS="$CFLAGS -I/usr/include/google"
-                    else
-                        if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
-                            CFLAGS="$CFLAGS -I/usr/local/include/google"
-                            LDFLAGS="$LDFLAGS -L/usr/local/lib"
                        fi
-                    fi
-                fi
+                    ]
+                )
            ]
        )
        AC_SEARCH_LIBS([protobuf_c_message_pack], [protobuf-c], [],
@@ -98,7 +98,7 @@ message Policy {
    // rule: the rule matched by the message.
    //
    // In a RPZ context, this is the owner name of the rule in
-    // the Response Policy Zone in wire format.
+    // the Reponse Policy Zone in wire format.
    optional bytes rule = 2;

    // action: the policy action taken in response to the
@@ -176,7 +176,10 @@ void
 mq_wakeup_cb(void* arg)
 {
 	struct dt_msg_queue* mq = (struct dt_msg_queue*)arg;
-
+	/* even if the dtio is already active, because perhaps much
+	 * traffic suddenly, we leave the timer running to save on
+	 * managing it, the once a second timer is less work then
+	 * starting and stopping the timer frequently */
 	lock_basic_lock(&mq->dtio->wakeup_timer_lock);
 	mq->dtio->wakeup_timer_enabled = 0;
 	lock_basic_unlock(&mq->dtio->wakeup_timer_lock);
@@ -207,8 +210,6 @@ dt_msg_queue_start_timer(struct dt_msg_queue* mq, int wakeupnow)
 	lock_basic_lock(&mq->dtio->wakeup_timer_lock);
 	if(mq->dtio->wakeup_timer_enabled) {
 		if(wakeupnow) {
-			tv.tv_sec = 0;
-			tv.tv_usec = 0;
 			comm_timer_set(mq->wakeup_timer, &tv);
 		}
 		lock_basic_unlock(&mq->dtio->wakeup_timer_lock);
@@ -220,14 +221,8 @@ dt_msg_queue_start_timer(struct dt_msg_queue* mq, int wakeupnow)
 	if(!wakeupnow) {
 		tv.tv_sec = 1;
 		tv.tv_usec = 0;
-		/* If it is already set, keep it running. */
-		if(!comm_timer_is_set(mq->wakeup_timer))
-			comm_timer_set(mq->wakeup_timer, &tv);
-	} else {
-		tv.tv_sec = 0;
-		tv.tv_usec = 0;
-		comm_timer_set(mq->wakeup_timer, &tv);
 	}
+	comm_timer_set(mq->wakeup_timer, &tv);
 	lock_basic_unlock(&mq->dtio->wakeup_timer_lock);
 }

@@ -265,9 +260,8 @@ dt_msg_queue_submit(struct dt_msg_queue* mq, void* buf, size_t len)

 	/* acquire lock */
 	lock_basic_lock(&mq->lock);
-	/* if list was empty, start timer for (eventual) wakeup,
-	 * or if dtio is not writing now an eventual wakeup is needed. */
-	if(mq->first == NULL || !mq->dtio->event_added_is_write)
+	/* if list was empty, start timer for (eventual) wakeup */
+	if(mq->first == NULL)
 		wakeupstarttimer = 1;
 	/* if list contains more than wakeupnum elements, wakeup now,
 	 * or if list is (going to be) almost full */
@@ -448,9 +442,6 @@ int dt_io_thread_apply_cfg(struct dt_io_thread* dtio, struct config_file *cfg)
 		dtio->tls_use_sni = cfg->tls_use_sni;
 #endif /* HAVE_SSL */
 	}
-#ifdef HAVE_GETTID
-	dtio->thread_tid_log = cfg->log_thread_id;
-#endif
 	return 1;
 }

@@ -1268,13 +1259,6 @@ static void dtio_sleep(struct dt_io_thread* dtio)
 	/* unregister the event polling for write, because there is
 	 * nothing to be written */
 	(void)dtio_add_output_event_read(dtio);
-
-	/* Set wakeuptimer enabled off; so that the next worker thread that
-	 * wants to log starts a timer if needed, since the writer thread
-	 * has gone to sleep. */
-	lock_basic_lock(&dtio->wakeup_timer_lock);
-	dtio->wakeup_timer_enabled = 0;
-	lock_basic_unlock(&dtio->wakeup_timer_lock);
 }

 #ifdef HAVE_SSL
@@ -1338,11 +1322,7 @@ static int dtio_ssl_check_peer(struct dt_io_thread* dtio)
 	if((SSL_get_verify_mode(dtio->ssl)&SSL_VERIFY_PEER)) {
 		/* verification */
 		if(SSL_get_verify_result(dtio->ssl) == X509_V_OK) {
-#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
-			X509* x = SSL_get1_peer_certificate(dtio->ssl);
-#else
 			X509* x = SSL_get_peer_certificate(dtio->ssl);
-#endif
 			if(!x) {
 				verbose(VERB_ALGO, "dnstap io, %s, SSL "
 					"connection failed no certificate",
@@ -1367,11 +1347,7 @@ static int dtio_ssl_check_peer(struct dt_io_thread* dtio)
 #endif
 			X509_free(x);
 		} else {
-#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
-			X509* x = SSL_get1_peer_certificate(dtio->ssl);
-#else
 			X509* x = SSL_get_peer_certificate(dtio->ssl);
-#endif
 			if(x) {
 				log_cert(VERB_ALGO, "dnstap io, peer "
 					"certificate", x);
@@ -1512,11 +1488,9 @@ void dtio_output_cb(int ATTR_UNUSED(fd), short bits, void* arg)
 	}
 #endif

-	if((bits&UB_EV_READ) || dtio->ssl_brief_write) {
-#ifdef HAVE_SSL
+	if((bits&UB_EV_READ || dtio->ssl_brief_write)) {
 		if(dtio->ssl_brief_write)
 			(void)dtio_disable_brief_write(dtio);
-#endif
 		if(dtio->ready_frame_sent && !dtio->accept_frame_received) {
 			if(dtio_read_accept_frame(dtio) <= 0)
 				return;
@@ -1539,22 +1513,8 @@ void dtio_output_cb(int ATTR_UNUSED(fd), short bits, void* arg)
 					/* no messages on the first iteration,
 					 * the queues are all empty */
 					dtio_sleep(dtio);
-					/* After putting to sleep, see if
-					 * a message is in a message queue,
-					 * if so, resume service. Stops a
-					 * race condition where a thread could
-					 * have one message but the dtio
-					 * also just went to sleep. With the
-					 * message queued between the
-					 * dtio_find_msg and dtio_sleep
-					 * calls. */
-					if(dtio_find_msg(dtio)) {
-						if(!dtio_add_output_event_write(dtio))
-							return;
-					}
 				}
-				if(!dtio->cur_msg)
-					return; /* nothing to do */
+				return; /* nothing to do */
 			}
 		}

@@ -2133,18 +2093,7 @@ static void* dnstap_io(void* arg)
 	struct dt_io_thread* dtio = (struct dt_io_thread*)arg;
 	time_t secs = 0;
 	struct timeval now;
-	const char name[16] = "unbound/dnstap"; /* seems to be the safest size
-						   between different OSes */
-
-#if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
-	dtio->thread_tid = gettid();
-	if(dtio->thread_tid_log)
-		log_thread_set(&dtio->thread_tid);
-	else
-#endif
-		log_thread_set(&dtio->threadnum);
-
-	ub_thread_setname(dtio->tid, name);
+	log_thread_set(&dtio->threadnum);

 	/* setup */
 	verbose(VERB_ALGO, "start dnstap io thread");
@@ -131,12 +131,6 @@ struct dt_io_thread {
 	struct dt_io_list_item* io_list_iter;
 	/** thread id, of the io thread */
 	ub_thread_type tid;
-#ifdef HAVE_GETTID
-	/** thread tid, the LWP id */
-	pid_t thread_tid;
-	/** if logging should include the LWP id */
-	int thread_tid_log;
-#endif
 	/** if the io processing has started */
 	int started;
 	/** ssl context for the io thread, for tls connections. type SSL_CTX* */
@@ -75,18 +75,17 @@
 static void usage(char* argv[])
 {
 	printf("usage: %s [options]\n", argv[0]);
-	printf("	Listen to dnstap messages\n");
+	printf(" 	Listen to dnstap messages\n");
 	printf("stdout has dnstap log, stderr has verbose server log\n");
-	printf("-u <socketpath>		listen to unix socket with this file name\n");
-	printf("-s <serverip[@port]>	listen for TCP on the IP and port\n");
-	printf("-t <serverip[@port]>	listen for TLS on IP and port\n");
-	printf("-x <server.key>		server key file for TLS service\n");
-	printf("-y <server.pem>		server cert file for TLS service\n");
-	printf("-z <verify.pem>		cert file to verify client connections\n");
-	printf("-l			long format for DNS printout\n");
-	printf("-v			more verbose log output\n");
-	printf("-c			internal unit test and exit\n");
-	printf("-h			this help text\n");
+	printf("-u <socketpath> listen to unix socket with this file name\n");
+	printf("-s <serverip[@port]> listen for TCP on the IP and port\n");
+	printf("-t <serverip[@port]> listen for TLS on IP and port\n");
+	printf("-x <server.key> server key file for TLS service\n");
+	printf("-y <server.pem> server cert file for TLS service\n");
+	printf("-z <verify.pem> cert file to verify client connections\n");
+	printf("-l 		long format for DNS printout\n");
+	printf("-v 		more verbose log output\n");
+	printf("-h 		this help text\n");
 	exit(1);
 }

@@ -103,14 +102,6 @@ struct main_tap_data {
 	struct tap_socket_list* acceptlist;
 };

-/* list of data */
-struct tap_data_list {
-	/** next in list */
-	struct tap_data_list* next;
-	/** the data */
-	struct tap_data* d;
-};
-
 /** tap callback variables */
 struct tap_data {
 	/** the fd */
@@ -137,10 +128,6 @@ struct tap_data {
 	uint8_t* frame;
 	/** length of this frame */
 	size_t len;
-	/** back pointer to the tap_data_list entry;
-	 * used to NULL the forward pointer to this data
-	 * when this data is freed. */
-	struct tap_data_list* data_list;
 };

 /** list of sockets */
@@ -169,89 +156,8 @@ struct tap_socket {
 	char* ip;
 	/** for a TLS socket, the tls context */
 	SSL_CTX* sslctx;
-	/** dumb way to deal with memory leaks:
-	 * tap_data was only freed on errors and not during exit leading to
-	 * false positives when testing for memory leaks. */
-	struct tap_data_list* data_list;
 };

-/** try to delete tail entries from the list if all of them have no data */
-static void tap_data_list_try_to_free_tail(struct tap_data_list* list)
-{
-	struct tap_data_list* current = list;
-	log_assert(!list->d);
-	if(!list->next) /* we are the last, we can't remove ourselves */
-		return;
-	list = list->next;
-	while(list) {
-		if(list->d) /* a tail entry still has data; return */
-			return;
-		list = list->next;
-	}
-	/* keep the next */
-	list = current->next;
-	/* the tail will be removed; but not ourselves */
-	current->next = NULL;
-	while(list) {
-		current = list;
-		list = list->next;
-		free(current);
-	}
-}
-
-/** delete the tap structure */
-static void tap_data_free(struct tap_data* data, int free_tail)
-{
-	if(!data)
-		return;
-	if(data->ev) {
-		ub_event_del(data->ev);
-		ub_event_free(data->ev);
-	}
-#ifdef HAVE_SSL
-	SSL_free(data->ssl);
-#endif
-	sock_close(data->fd);
-	free(data->id);
-	free(data->frame);
-	if(data->data_list) {
-		data->data_list->d = NULL;
-		if(free_tail)
-			tap_data_list_try_to_free_tail(data->data_list);
-	}
-	free(data);
-}
-
-/** insert tap_data in the tap_data_list */
-static int tap_data_list_insert(struct tap_data_list** liststart,
-	struct tap_data* d)
-{
-	struct tap_data_list* entry = (struct tap_data_list*)
-		malloc(sizeof(*entry));
-	if(!entry)
-		return 0;
-	entry->next = *liststart;
-	entry->d = d;
-	d->data_list = entry;
-	*liststart = entry;
-	return 1;
-}
-
-/** delete the tap_data_list and free any remaining tap_data */
-static void tap_data_list_delete(struct tap_data_list* list)
-{
-	struct tap_data_list* e = list, *next;
-	while(e) {
-		next = e->next;
-		if(e->d) {
-			tap_data_free(e->d, 0);
-			e->d = NULL;
-		}
-		free(e);
-		e = next;
-	}
-}
-
 /** del the tap event */
 static void tap_socket_delev(struct tap_socket* s)
 {
@@ -267,7 +173,7 @@ static void tap_socket_close(struct tap_socket* s)
 {
 	if(!s) return;
 	if(s->fd == -1) return;
-	sock_close(s->fd);
+	close(s->fd);
 	s->fd = -1;
 }

@@ -278,7 +184,6 @@ static void tap_socket_delete(struct tap_socket* s)
 #ifdef HAVE_SSL
 	SSL_CTX_free(s->sslctx);
 #endif
-	tap_data_list_delete(s->data_list);
 	ub_event_free(s->ev);
 	free(s->socketpath);
 	free(s->ip);
@@ -330,7 +235,7 @@ static struct tap_socket* tap_socket_new_tcpaccept(char* ip,
 /** create new socket (unconnected, not base-added), or NULL malloc fail */
 static struct tap_socket* tap_socket_new_tlsaccept(char* ip,
 	void (*ev_cb)(int, short, void*), void* data, char* server_key,
-	char* server_cert, char* verifypem, char* tls_protocols)
+	char* server_cert, char* verifypem)
 {
 	struct tap_socket* s = calloc(1, sizeof(*s));
 	if(!s) {
@@ -346,8 +251,7 @@ static struct tap_socket* tap_socket_new_tlsaccept(char* ip,
 	s->fd = -1;
 	s->ev_cb = ev_cb;
 	s->data = data;
-	s->sslctx = listen_sslctx_create(server_key, server_cert, verifypem,
-		NULL, NULL, 0, 0, 0, tls_protocols);
+	s->sslctx = listen_sslctx_create(server_key, server_cert, verifypem);
 	if(!s->sslctx) {
 		log_err("could not create ssl context");
 		free(s->ip);
@@ -824,12 +728,27 @@ static ssize_t tap_receive(struct tap_data* data, void* buf, size_t len)
 	return receive_bytes(data, data->fd, buf, len);
 }

+/** delete the tap structure */
+static void tap_data_free(struct tap_data* data)
+{
+	ub_event_del(data->ev);
+	ub_event_free(data->ev);
+#ifdef HAVE_SSL
+	SSL_free(data->ssl);
+#endif
+	close(data->fd);
+	free(data->id);
+	free(data->frame);
+	free(data);
+}
+
 /** reply with ACCEPT control frame to bidirectional client,
 * returns 0 on error */
 static int reply_with_accept(struct tap_data* data)
 {
 #ifdef USE_DNSTAP
 	/* len includes the escape and framelength */
+	int r;
 	size_t len = 0;
 	void* acceptframe = fstrm_create_control_frame_accept(
 		DNSTAP_CONTENT_TYPE, &len);
@@ -840,8 +759,6 @@ static int reply_with_accept(struct tap_data* data)

 	fd_set_block(data->fd);
 	if(data->ssl) {
-#ifdef HAVE_SSL
-		int r;
 		if((r=SSL_write(data->ssl, acceptframe, len)) <= 0) {
 			int r2;
 			if((r2=SSL_get_error(data->ssl, r)) == SSL_ERROR_ZERO_RETURN)
@@ -852,7 +769,6 @@ static int reply_with_accept(struct tap_data* data)
 			free(acceptframe);
 			return 0;
 		}
-#endif
 	} else {
 		if(send(data->fd, acceptframe, len, 0) == -1) {
 			log_err("send failed: %s", sock_strerror(errno));
@@ -888,7 +804,6 @@ static int reply_with_finish(struct tap_data* data)

 	fd_set_block(data->fd);
 	if(data->ssl) {
-#ifdef HAVE_SSL
 		int r;
 		if((r=SSL_write(data->ssl, finishframe, len)) <= 0) {
 			int r2;
@@ -900,7 +815,6 @@ static int reply_with_finish(struct tap_data* data)
 			free(finishframe);
 			return 0;
 		}
-#endif
 	} else {
 		if(send(data->fd, finishframe, len, 0) == -1) {
 			log_err("send failed: %s", sock_strerror(errno));
@@ -928,11 +842,7 @@ static int tap_check_peer(struct tap_data* data)
 	if((SSL_get_verify_mode(data->ssl)&SSL_VERIFY_PEER)) {
 		/* verification */
 		if(SSL_get_verify_result(data->ssl) == X509_V_OK) {
-#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
-			X509* x = SSL_get1_peer_certificate(data->ssl);
-#else
 			X509* x = SSL_get_peer_certificate(data->ssl);
-#endif
 			if(!x) {
 				if(verbosity) log_info("SSL connection %s"
 					" failed no certificate", data->id);
@@ -954,11 +864,7 @@ static int tap_check_peer(struct tap_data* data)
 #endif
 			X509_free(x);
 		} else {
-#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
-			X509* x = SSL_get1_peer_certificate(data->ssl);
-#else
 			X509* x = SSL_get_peer_certificate(data->ssl);
-#endif
 			if(x) {
 				if(verbosity)
 					log_cert(VERB_ALGO, "peer certificate", x);
@@ -1000,7 +906,7 @@ static int tap_handshake(struct tap_data* data)
 			return 0;
 		} else if(r == 0) {
 			/* closed */
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return 0;
 		} else if(want == SSL_ERROR_SYSCALL) {
 			/* SYSCALL and errno==0 means closed uncleanly */
@@ -1018,7 +924,7 @@ static int tap_handshake(struct tap_data* data)
 			if(!silent)
 				log_err("SSL_handshake syscall: %s",
 					strerror(errno));
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return 0;
 		} else {
 			unsigned long err = ERR_get_error();
@@ -1028,7 +934,7 @@ static int tap_handshake(struct tap_data* data)
 				verbose(VERB_OPS, "ssl handshake failed "
 					"from %s", data->id);
 			}
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return 0;
 		}
 	}
@@ -1036,7 +942,7 @@ static int tap_handshake(struct tap_data* data)
 	data->ssl_handshake_done = 1;
 	if(!tap_check_peer(data)) {
 		/* closed */
-		tap_data_free(data, 1);
+		tap_data_free(data);
 		return 0;
 	}
 	return 1;
@@ -1062,7 +968,7 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 		if(verbosity>=4) log_info("s recv %d", (int)ret);
 		if(ret == 0) {
 			/* closed or error */
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return;
 		} else if(ret == -1) {
 			/* continue later */
@@ -1084,7 +990,7 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 			data->frame = calloc(1, data->len);
 			if(!data->frame) {
 				log_err("out of memory");
-				tap_data_free(data, 1);
+				tap_data_free(data);
 				return;
 			}
 		}
@@ -1097,7 +1003,7 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 		if(verbosity>=4) log_info("f recv %d", (int)r);
 		if(r == 0) {
 			/* closed or error */
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return;
 		} else if(r == -1) {
 			/* continue later */
@@ -1122,13 +1028,13 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 		data->is_bidirectional = 1;
 		if(verbosity) log_info("bidirectional stream");
 		if(!reply_with_accept(data)) {
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return;
 		}
 	} else if(data->len >= 4 && sldns_read_uint32(data->frame) ==
 		FSTRM_CONTROL_FRAME_STOP && data->is_bidirectional) {
 		if(!reply_with_finish(data)) {
-			tap_data_free(data, 1);
+			tap_data_free(data);
 			return;
 		}
 	}
@@ -1140,6 +1046,7 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 	data->len = 0;
 	data->len_done = 0;
 	data->data_done = 0;
+
 }

 /** callback for main listening file descriptor */
@@ -1152,9 +1059,7 @@ void dtio_mainfdcallback(int fd, short ATTR_UNUSED(bits), void* arg)
 	char* id = NULL;
 	struct sockaddr_storage addr;
 	socklen_t addrlen = (socklen_t)sizeof(addr);
-	int s;
-	memset(&addr, 0, sizeof(addr));
-	s = accept(fd, (struct sockaddr*)&addr, &addrlen);
+	int s = accept(fd, (struct sockaddr*)&addr, &addrlen);
 	if(s == -1) {
 #ifndef USE_WINSOCK
 		/* EINTR is signal interrupt. others are closed connection. */
@@ -1224,8 +1129,6 @@ void dtio_mainfdcallback(int fd, short ATTR_UNUSED(bits), void* arg)
 		&dtio_tap_callback, data);
 	if(!data->ev) fatal_exit("could not ub_event_new");
 	if(ub_event_add(data->ev, NULL) != 0) fatal_exit("could not ub_event_add");
-	if(!tap_data_list_insert(&tap_sock->data_list, data))
-		fatal_exit("could not tap_data_list_insert");
 }

 /** setup local accept sockets */
@@ -1261,13 +1164,13 @@ static void setup_tcp_list(struct main_tap_data* maindata,
 /** setup tls accept sockets */
 static void setup_tls_list(struct main_tap_data* maindata,
 	struct config_strlist_head* tls_list, char* server_key,
-	char* server_cert, char* verifypem, char* tls_protocols)
+	char* server_cert, char* verifypem)
 {
 	struct config_strlist* item;
 	for(item = tls_list->first; item; item = item->next) {
 		struct tap_socket* s;
 		s = tap_socket_new_tlsaccept(item->str, &dtio_mainfdcallback,
-			maindata, server_key, server_cert, verifypem, tls_protocols);
+			maindata, server_key, server_cert, verifypem);
 		if(!s) fatal_exit("out of memory");
 		if(!tap_socket_list_insert(&maindata->acceptlist, s))
 			fatal_exit("out of memory");
@@ -1300,7 +1203,7 @@ static void
 setup_and_run(struct config_strlist_head* local_list,
 	struct config_strlist_head* tcp_list,
 	struct config_strlist_head* tls_list, char* server_key,
-	char* server_cert, char* verifypem, char* tls_protocols)
+	char* server_cert, char* verifypem)
 {
 	time_t secs = 0;
 	struct timeval now;
@@ -1326,7 +1229,7 @@ setup_and_run(struct config_strlist_head* local_list,
 	setup_local_list(maindata, local_list);
 	setup_tcp_list(maindata, tcp_list);
 	setup_tls_list(maindata, tls_list, server_key, server_cert,
-		verifypem, tls_protocols);
+		verifypem);
 	if(!tap_socket_list_addevs(maindata->acceptlist, base))
 		fatal_exit("could not setup accept events");
 	if(verbosity) log_info("start of service");
@@ -1340,114 +1243,6 @@ setup_and_run(struct config_strlist_head* local_list,
 	free(maindata);
 }

-/* internal unit tests */
-static int internal_unittest()
-{
-	/* unit test tap_data_list_try_to_free_tail() */
-#define unit_tap_datas_max 5
-	struct tap_data* datas[unit_tap_datas_max];
-	struct tap_data_list* list;
-	struct tap_socket* socket = calloc(1, sizeof(*socket));
-	size_t i = 0;
-	log_assert(socket);
-	log_assert(unit_tap_datas_max>2); /* needed for the test */
-	for(i=0; i<unit_tap_datas_max; i++) {
-		datas[i] = calloc(1, sizeof(struct tap_data));
-		log_assert(datas[i]);
-		log_assert(tap_data_list_insert(&socket->data_list, datas[i]));
-	}
-	/* sanity base check */
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==unit_tap_datas_max);
-
-	/* Free the last data, tail cannot be erased */
-	list = socket->data_list;
-	while(list->next) list = list->next;
-	free(list->d);
-	list->d = NULL;
-	tap_data_list_try_to_free_tail(list);
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==unit_tap_datas_max);
-
-	/* Free the third to last data, tail cannot be erased */
-	list = socket->data_list;
-	for(i=0; i<unit_tap_datas_max-3; i++) list = list->next;
-	free(list->d);
-	list->d = NULL;
-	tap_data_list_try_to_free_tail(list);
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==unit_tap_datas_max);
-
-	/* Free the second to last data, try to remove tail from the third
-	 * again, tail (last 2) should be removed */
-	list = socket->data_list;
-	for(i=0; i<unit_tap_datas_max-2; i++) list = list->next;
-	free(list->d);
-	list->d = NULL;
-	list = socket->data_list;
-	while(list->d) list = list->next;
-	tap_data_list_try_to_free_tail(list);
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==unit_tap_datas_max-2);
-
-	/* Free all the remaining data, try to remove tail from the start,
-	 * only the start should remain */
-	list = socket->data_list;
-	while(list) {
-		free(list->d);
-		list->d = NULL;
-		list = list->next;
-	}
-	tap_data_list_try_to_free_tail(socket->data_list);
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==1);
-
-	/* clean up */
-	tap_data_list_delete(socket->data_list);
-	free(socket);
-
-	/* Start again. Add two elements */
-	socket = calloc(1, sizeof(*socket));
-	log_assert(socket);
-	for(i=0; i<2; i++) {
-		datas[i] = calloc(1, sizeof(struct tap_data));
-		log_assert(datas[i]);
-		log_assert(tap_data_list_insert(&socket->data_list, datas[i]));
-	}
-	/* sanity base check */
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==2);
-
-	/* Free the last data, tail cannot be erased */
-	list = socket->data_list;
-	while(list->next) list = list->next;
-	free(list->d);
-	list->d = NULL;
-	tap_data_list_try_to_free_tail(list);
-	list = socket->data_list;
-	for(i=0; list; i++) list = list->next;
-	log_assert(i==2);
-
-	/* clean up */
-	tap_data_list_delete(socket->data_list);
-	free(socket);
-
-	if(log_get_lock()) {
-		lock_basic_destroy((lock_basic_type*)log_get_lock());
-	}
-	checklock_stop();
-#ifdef USE_WINSOCK
-	WSACleanup();
-#endif
-	return 0;
-}
-
 /** getopt global, in case header files fail to declare it. */
 extern int optind;
 /** getopt global, in case header files fail to declare it. */
@@ -1462,8 +1257,6 @@ int main(int argc, char** argv)
 	struct config_strlist_head tcp_list;
 	struct config_strlist_head tls_list;
 	char* server_key = NULL, *server_cert = NULL, *verifypem = NULL;
-
-	char* tls_protocols = "TLSv1.2 TLSv1.3";
 #ifdef USE_WINSOCK
 	WSADATA wsa_data;
 	if(WSAStartup(MAKEWORD(2,2), &wsa_data) != 0) {
@@ -1500,7 +1293,7 @@ int main(int argc, char** argv)
 #endif

 	/* command line options */
-	while( (c=getopt(argc, argv, "hcls:t:u:vx:y:z:")) != -1) {
+	while( (c=getopt(argc, argv, "hls:t:u:vx:y:z:")) != -1) {
 		switch(c) {
 			case 'u':
 				if(!cfg_strlist_append(&local_list,
@@ -1536,20 +1329,14 @@ int main(int argc, char** argv)
 			case 'v':
 				verbosity++;
 				break;
-			case 'c':
-#ifndef UNBOUND_DEBUG
-				fatal_exit("-c option needs compilation with "
-					"--enable-debug");
-#endif
-				return internal_unittest();
 			case 'h':
 			case '?':
 			default:
 				usage(argv);
 		}
 	}
-	/* argc -= optind; not using further arguments */
-	/* argv += optind; not using further arguments */
+	argc -= optind;
+	argv += optind;

 	if(usessl) {
 #ifdef HAVE_SSL
@@ -1563,32 +1350,21 @@ int main(int argc, char** argv)
 #else
 		OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 			| OPENSSL_INIT_ADD_ALL_DIGESTS
-			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-			| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-			, NULL);
+			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 		(void)SSL_library_init();
 #else
-		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-			| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-			, NULL);
+		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 #endif /* HAVE_SSL */
 	}
 	setup_and_run(&local_list, &tcp_list, &tls_list, server_key,
-		server_cert, verifypem, tls_protocols);
+		server_cert, verifypem);
 	config_delstrlist(local_list.first);
 	config_delstrlist(tcp_list.first);
 	config_delstrlist(tls_list.first);

-	if(log_get_lock()) {
-		lock_basic_destroy((lock_basic_type*)log_get_lock());
-	}
 	checklock_stop();
 #ifdef USE_WINSOCK
 	WSACleanup();
@@ -1796,33 +1572,3 @@ void remote_get_opt_ssl(char* ATTR_UNUSED(str), void* ATTR_UNUSED(arg))
 {
        log_assert(0);
 }
-
-void fast_reload_service_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
-int fast_reload_client_callback(struct comm_point* ATTR_UNUSED(c),
-	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
-        struct comm_reply* ATTR_UNUSED(repinfo))
-{
-	log_assert(0);
-	return 0;
-}
-
-#ifdef HAVE_NGTCP2
-void doq_client_event_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
-
-#ifdef HAVE_NGTCP2
-void doq_client_timer_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
@@ -13,7 +13,7 @@ If you're not using DNSSEC then you may remove "validator".

 2. The "dns64-prefix" directive indicates your DNS64 prefix. For example:

-    dns64-prefix: 64:ff9b::/96
+    dns64-prefix: 64:FF9B::/96

 The prefix must be a /96 or shorter.

@@ -42,9 +42,9 @@ To enable NAT64 in Unbound, add to unbound.conf's "server" section:
    do-nat64: yes

 The NAT64 prefix defaults to the DNS64 prefix, which in turn defaults to the
-standard 64:ff9b::/96 prefix.  You can reconfigure it with:
+standard 64:FF9B::/96 prefix.  You can reconfigure it with:

-    nat64-prefix: 64:ff9b::/96
+    nat64-prefix: 64:FF9B::/96

 To test NAT64 operation, pick a domain that only has IPv4 reachability for its
 nameservers and try resolving any names in that domain.
@@ -1,21 +0,0 @@
-After Unbound 1.23.0, the source of the man pages is in reStructuredText format.
-
-This helps with the online documentation at https://unbound.docs.nlnetlabs.nl
-and makes it easier to maintain and contribute to the documentation.
-
-The templated man pages (*.in) are still part of the code repository as to not
-alter current procedures that could be in place by users/packagers.
-
-These man pages (*.in) are still the ones being used when
-configuring/installing Unbound.
-Packagers/users do not have to generate any man pages themselves, this is done
-by the core developers during development and upon releasing new versions.
-
-The templated man pages (*.in) are generated by Sphinx (used for the online
-documentation).
-The online documentation has its own repository at
-https://github.com/NLnetLabs/unbound-manual.
-
-In that README.md (https://github.com/NLnetLabs/unbound-manual/README.md)
-there are further simple instructions on how to generate the templated man
-pages there and update them in this repository.
@@ -54,7 +54,7 @@ server:
 	# interface: 192.0.2.153
 	# interface: 192.0.2.154
 	# interface: 192.0.2.154@5003
-	# interface: 2001:db8::5
+	# interface: 2001:DB8::5
 	# interface: eth0@5003

 	# enable this feature to copy the source address of queries to reply.
@@ -72,12 +72,12 @@ server:
 	# server from by ip-address. If none, the default (all) interface
 	# is used. Specify every interface on a 'outgoing-interface:' line.
 	# outgoing-interface: 192.0.2.153
-	# outgoing-interface: 2001:db8::5
-	# outgoing-interface: 2001:db8::6
+	# outgoing-interface: 2001:DB8::5
+	# outgoing-interface: 2001:DB8::6

 	# Specify a netblock to use remainder 64 bits as random bits for
 	# upstream queries.  Uses freebind option (Linux).
-	# outgoing-interface: 2001:db8::/64
+	# outgoing-interface: 2001:DB8::/64
 	# Also (Linux:) ip -6 addr add 2001:db8::/64 dev lo
 	# And: ip -6 route add local 2001:db8::/64 dev lo
 	# And set prefer-ip6: yes to use the ip6 randomness from a netblock.
@@ -116,8 +116,8 @@ server:
 	# so-rcvbuf: 0

 	# buffer size for UDP port 53 outgoing (SO_SNDBUF socket option).
-	# 0 is system default. Set larger to handle spikes on very busy servers.
-	# so-sndbuf: 4m
+	# 0 is system default.  Use 4m to handle spikes on very busy servers.
+	# so-sndbuf: 0

 	# use SO_REUSEPORT to distribute queries over threads.
 	# at extreme load it could be better to turn it off to distribute even.
@@ -163,7 +163,7 @@ server:
 	# msg-cache-slabs: 4

 	# the number of queries that a thread gets to service.
-	# num-queries-per-thread: 2048
+	# num-queries-per-thread: 1024

 	# if very busy, 50% queries run to completion, 50% get timeout in msec
 	# jostle-timeout: 200
@@ -187,22 +187,6 @@ server:
 	# query upon encountering a CNAME record.
 	# max-query-restarts: 11

-	# Limit on number of NS records in NS RRset for incoming packets.
-	# iter-scrub-ns: 20
-
-	# Limit on number of CNAME, DNAME records for incoming packets.
-	# iter-scrub-cname: 11
-
-	# Limit on number of RRSIGs for an RRset for incoming packets.
-	# iter-scrub-rrsig: 8
-
-	# Limit on upstream queries for an incoming query and its recursion.
-	# max-global-quota: 200
-
-	# Should the scrubber remove promiscuous NS from positive answers,
-	# protects against poison attempts.
-	# iter-scrub-promiscuous: yes
-
 	# msec for waiting for an unknown server to reply.  Increase if you
 	# are behind a slow satellite link, to eg. 1128.
 	# unknown-server-time-limit: 376
@@ -222,12 +206,6 @@ server:
 	# Apart from the default, the wait limit with cookie can be adjusted.
 	# wait-limit-cookie-netblock: 192.0.2.0/24 50000

-	# Defaults for loopback, it has no wait limit.
-	# wait-limit-netblock: 127.0.0.0/8 -1
-	# wait-limit-netblock: ::1/128 -1
-	# wait-limit-cookie-netblock: 127.0.0.0/8 -1
-	# wait-limit-cookie-netblock: ::1/128 -1
-
 	# the amount of memory to use for the RRset cache.
 	# plain value in bytes or you can append k, m or G. default is "4Mb".
 	# rrset-cache-size: 4m
@@ -250,7 +228,7 @@ server:

 	# the time to live (TTL) value lower bound, in seconds. Default 0.
 	# For negative responses in the cache. If disabled, default,
-	# cache-min-ttl applies if configured.
+	# cache-min-tll applies if configured.
 	# cache-min-negative-ttl: 0

 	# the time to live (TTL) value for cached roundtrip times, lameness and
@@ -286,7 +264,7 @@ server:
 	# do-ip6: yes

 	# If running unbound on an IPv6-only host, domains that only have
-	# IPv4 servers would become unresolvable.  If NAT64 is available in
+	# IPv4 servers would become unresolveable.  If NAT64 is available in
 	# the network, unbound can use NAT64 to reach these servers with
 	# the following option.  This is NOT needed for enabling DNS64 on a
 	# system that has IPv4 connectivity.
@@ -382,7 +360,7 @@ server:
 	# interface-action: 192.0.2.153 allow
 	# interface-action: 192.0.2.154 allow
 	# interface-action: 192.0.2.154@5003 allow
-	# interface-action: 2001:db8::5 allow
+	# interface-action: 2001:DB8::5 allow
 	# interface-action: eth0@5003 allow

 	# Similar to 'access-control-tag:' but for interfaces.
@@ -474,10 +452,6 @@ server:
 	# print UTC timestamp in ascii to logfile, default is epoch in seconds.
 	# log-time-ascii: no

-	# log timestamp in ISO8601 format if also log-time-ascii is enabled.
-	# (y-m-dTh:m:s.msec[+-]tzhours:tzminutes)
-	# log-time-iso: no
-
 	# print one line with time, IP, name, type, class for every query.
 	# log-queries: no

@@ -499,10 +473,6 @@ server:
 	# print log lines that say why queries return SERVFAIL to clients.
 	# log-servfail: no

-	# log system-wide Linux thread ID, insted of Unbound's internal thread
-	# counter. Only on Linux and only when threads are available.
-	# log-thread-id: no
-
 	# the pid file. Can be an absolute path outside of chroot/work dir.
 	# pidfile: "@UNBOUND_PIDFILE@"

@@ -554,9 +524,6 @@ server:
 	# Harden against out of zone rrsets, to avoid spoofing attempts.
 	# harden-glue: yes

-	# Harden against unverified (outside-zone, including sibling zone) glue rrsets
-	# harden-unverified-glue: no
-
 	# Harden against receiving dnssec-stripped data. If you turn it
 	# off, failing to validate dnskey data for a trustanchor will
 	# trigger insecure mode for that zone (like without a trustanchor).
@@ -573,9 +540,8 @@ server:
 	# harden-referral-path: no

 	# Harden against algorithm downgrade when multiple algorithms are
-	# advertised in the DS record.  If no, allows any algorithm
-	# to validate the zone which is the standard behavior for validators.
-	# Check the manpage for detailed information.
+	# advertised in the DS record.  If no, allows the weakest algorithm
+	# to validate the zone.
 	# harden-algo-downgrade: no

 	# Harden against unknown records in the authority section and the
@@ -665,7 +631,7 @@ server:
 	# or, just before the iterator).
 	# module-config: "validator iterator"

-	# File with trusted keys, kept up-to-date using RFC5011 probes,
+	# File with trusted keys, kept uptodate using RFC5011 probes,
 	# initial file like trust-anchor-file, then it stores metadata.
 	# Use several entries, one per domain name, to track multiple zones.
 	#
@@ -725,7 +691,7 @@ server:
 	# val-max-restart: 5

 	# Should additional section of secure message also be kept clean of
-	# non-secure data. Useful to shield the users of this validator from
+	# unsecure data. Useful to shield the users of this validator from
 	# potential bogus data in the additional section. All unsigned data
 	# in the additional section is removed from secure messages.
 	# val-clean-additional: yes
@@ -748,13 +714,12 @@ server:
 	# disable-edns-do: no

 	# Serve expired responses from cache, with serve-expired-reply-ttl in
-	# the response. By default it first tries to refresh an expired answer.
-	# Can be configured with serve-expired-client-timeout.
+	# the response, and then attempt to fetch the data afresh.
 	# serve-expired: no
 	#
 	# Limit serving of expired responses to configured seconds after
 	# expiration. 0 disables the limit.
-	# serve-expired-ttl: 86400
+	# serve-expired-ttl: 0
 	#
 	# Set the TTL of expired records to the serve-expired-ttl value after a
 	# failed attempt to retrieve the record from upstream. This makes sure
@@ -763,14 +728,14 @@ server:
 	# serve-expired-ttl-reset: no
 	#
 	# TTL value to use when replying with expired data.
-	# Capped by the original TTL of the record.
 	# serve-expired-reply-ttl: 30
 	#
 	# Time in milliseconds before replying to the client with expired data.
 	# This essentially enables the serve-stale behavior as specified in
-	# RFC 8767 that first tries to resolve before immediately responding
-	# with expired data.  0 disables this behavior.
-	# serve-expired-client-timeout: 1800
+	# RFC 8767 that first tries to resolve before
+	# immediately responding with expired data.  0 disables this behavior.
+	# A recommended value is 1800.
+	# serve-expired-client-timeout: 0

 	# Return the original TTL as received from the upstream name server rather
 	# than the decrementing TTL as stored in the cache.  Enabling this feature
@@ -829,8 +794,6 @@ server:
 	# local-zone: "127.in-addr.arpa." nodefault
 	# local-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." nodefault
 	# local-zone: "home.arpa." nodefault
-	# local-zone: "resolver.arpa." nodefault
-	# local-zone: "service.arpa." nodefault
 	# local-zone: "onion." nodefault
 	# local-zone: "test." nodefault
 	# local-zone: "invalid." nodefault
@@ -933,22 +896,6 @@ server:
 	# add a netblock specific override to a localzone, with zone type
 	# local-zone-override: "example.com" 192.0.2.0/24 refuse

-	# Action to apply when the IP address in an AAAA or A RR in the answer
-	# section of a response matches the specified IP netblock.
-	# Requires use of the respip module.
-	# response-ip: 192.0.2.0/24 redirect
-
-	# Redirect as specified by the "resource record string" when the IP
-	# address in an AAAA or A RR in the answer section of a response
-	# matches the specified IP netblock.
-	# Requires use of the respip module.
-	# response-ip-data: 192.0.2.0/24 "example. A 192.0.2.1"
-
-	# Apply tag(s) when the IP address in an AAAA or A RR in the answer
-	# section of a response matches the specified IP netblock.
-	# Requires use of the respip module.
-	# response-ip-tag: 192.0.2.0/24 "tag1 tag2"
-
 	# service clients over TLS (on the TCP sockets) with plain DNS inside
 	# the TLS stream, and over HTTPS using HTTP/2 as specified in RFC8484.
 	# Give the certificate to use and private key.
@@ -957,23 +904,21 @@ server:
 	# tls-service-pem: "path/to/publiccertfile.pem"
 	# tls-port: 853
 	# https-port: 443
-	# quic-port: 853
-
-	# Also serve tls on these port numbers (eg. 443, ...), by listing
-	# tls-additional-port: portno for each of the port numbers.

 	# cipher setting for TLSv1.2
 	# tls-ciphers: "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256"
 	# cipher setting for TLSv1.3
 	# tls-ciphersuites: "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_8_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"

-	# Use the SNI extension for TLS connections.  Default is yes.
-	# Changing the value requires a restart.
-	# tls-use-sni: yes
+	# Pad responses to padded queries received over TLS
+	# pad-responses: yes

-	# TLS protocols.
-	# Changing the value requires a restart.
-	# tls-protocols: "TLSv1.2 TLSv1.3"
+	# Padded responses will be padded to the closest multiple of this size.
+	# pad-responses-block-size: 468
+
+	# Use the SNI extension for TLS connections.  Default is yes.
+	# Changing the value requires a reload.
+	# tls-use-sni: yes

 	# Add the secret file for TLS Session Ticket.
 	# Secret file must be 80 bytes of random data.
@@ -995,18 +940,15 @@ server:
 	# and on other systems, the default openssl certificates
 	# tls-system-cert: no

-	# Pad responses to padded queries received over TLS
-	# pad-responses: yes
-
-	# Padded responses will be padded to the closest multiple of this size.
-	# pad-responses-block-size: 468
-
 	# Pad queries over TLS upstreams
 	# pad-queries: yes

 	# Padded queries will be padded to the closest multiple of this size.
 	# pad-queries-block-size: 128

+	# Also serve tls on these port numbers (eg. 443, ...), by listing
+	# tls-additional-port: portno for each of the port numbers.
+
 	# HTTP endpoint to provide DNS-over-HTTPS service on.
 	# http-endpoint: "/dns-query"

@@ -1026,9 +968,6 @@ server:
 	# Disable TLS for DNS-over-HTTP downstream service.
 	# http-notls-downstream: no

-	# Maximum number of bytes used for QUIC buffers.
-	# quic-size: 8m
-
 	# The interfaces that use these listed port numbers will support and
 	# expect PROXYv2. For UDP and TCP/TLS interfaces.
 	# proxy-protocol-port: portno for each of the port numbers.
@@ -1105,11 +1044,6 @@ server:
 	# example value "000102030405060708090a0b0c0d0e0f".
 	# cookie-secret: <128 bit random hex string>

-	# File with cookie secrets, the 'cookie-secret:' option is ignored
-	# and the file can be managed to have staging and active secrets
-	# with remote control commands. Disabled with "". Default is "".
-	# cookie-secret-file: "/usr/local/etc/unbound_cookiesecrets.txt"
-
 	# Enable to attach Extended DNS Error codes (RFC8914) to responses.
 	# ede: no

@@ -1118,11 +1052,6 @@ server:
 	# Note that the ede option above needs to be enabled for this to work.
 	# ede-serve-expired: no

-	# Enable DNS Error Reporting (RFC9567).
-	# qname-minimisation is advised to be turned on as well to increase
-	# privacy on the outgoing reports.
-	# dns-error-reporting: no
-
 	# Specific options for ipsecmod. Unbound needs to be configured with
 	# --enable-ipsecmod for these to take effect.
 	#
@@ -1289,11 +1218,10 @@ remote-control:
 #	zonefile: "example.org.zone"

 # Views
-# Create named views. Name must be unique.
-# Map views to requests using the access-control-view/interface-view options.
-# Views can contain zero or more local-zone and local-data options.
-# Options from matching views will override global options.
-# Global options will be used if no matching view is found.
+# Create named views. Name must be unique. Map views to requests using
+# the access-control-view option. Views can contain zero or more local-zone
+# and local-data options. Options from matching views will override global
+# options. Global options will be used if no matching view is found.
 # With view-first yes, it will try to answer using the global local-zone and
 # local-data elements if there is no view specific match.
 # view:
@@ -1301,8 +1229,6 @@ remote-control:
 #	local-zone: "example.com" redirect
 #	local-data: "example.com A 192.0.2.3"
 #	local-data-ptr: "192.0.2.3 www.example.com"
-#	response-ip: 192.0.2.0/24 redirect
-#	response-ip-data: 192.0.2.0/24 "example. A 192.0.2.1"
 #	view-first: no
 # view:
 #	name: "anotherview"
@@ -1353,35 +1279,15 @@ remote-control:
 #     # redis server's TCP port
 #     redis-server-port: 6379
 #     # if the server uses a unix socket, set its path, or "" when not used.
-#     redis-server-path: "/var/lib/redis/redis-server.sock"
+#     # redis-server-path: "/var/lib/redis/redis-server.sock"
 #     # if the server uses an AUTH password, specify here, or "" when not used.
-#     redis-server-password: ""
+#     # redis-server-password: ""
 #     # timeout (in ms) for communication with the redis server
 #     redis-timeout: 100
-#     # timeout (in ms) for commands, if 0, uses redis-timeout.
-#     redis-command-timeout: 0
-#     # timeout (in ms) for connection set up, if 0, uses redis-timeout.
-#     redis-connect-timeout: 0
 #     # set timeout on redis records based on DNS response TTL
 #     redis-expire-records: no
 #     # redis logical database to use, 0 is the default database.
 #     redis-logical-db: 0
-#     # redis replica server's IP address or host name
-#     redis-replica-server-host: 127.0.0.1
-#     # redis replica server's TCP port
-#     redis-replica-server-port: 6379
-#     # if the replica server uses a unix socket, set its path, or "" when not used.
-#     redis-replica-server-path: "/var/lib/redis/redis-server.sock"
-#     # if the replica server uses an AUTH password, specify here, or "" when not used.
-#     redis-replica-server-password: ""
-#     # timeout (in ms) for communication with the redis replica server
-#     redis-replica-timeout: 100
-#     # timeout (in ms) for redis replica commands, if 0, uses redis-replica-timeout.
-#     redis-replica-command-timeout: 0
-#     # timeout (in ms) for redis replica connection set up, if 0, uses redis-replica-timeout.
-#     redis-replica-connect-timeout: 0
-#     # redis logical database to use for the replica server, 0 is the default database.
-#     redis-replica-logical-db: 0

 # IPSet
 # Add specify domain into set via ipset.
@@ -1423,8 +1329,6 @@ remote-control:
 # 	dnstap-identity: ""
 # 	# if "" it uses the package version.
 # 	dnstap-version: ""
-# 	# log only 1/N messages, if 0 it is disabled. default 0.
-# 	dnstap-sample-rate: 0
 # 	dnstap-log-resolver-query-messages: no
 # 	dnstap-log-resolver-response-messages: no
 # 	dnstap-log-client-query-messages: no
@@ -1433,8 +1337,7 @@ remote-control:
 # 	dnstap-log-forwarder-response-messages: no

 # Response Policy Zones
-# RPZ policies. Applied in order of configuration. Any match from an earlier
-# RPZ zone will terminate the RPZ lookup. QNAME, Response IP
+# RPZ policies. Applied in order of configuration. QNAME, Response IP
 # Address, nsdname, nsip and clientip triggers are supported. Supported
 # actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp-only
 # and drop.  Policies can be loaded from a file, or using zone
@@ -1,306 +1,335 @@
-.\" Man page generated from reStructuredText.
-.
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.TH "LIBUNBOUND" "3" "@date@" "@version@" "Unbound"
-.SH NAME
-libunbound \- Unbound DNS validating resolver @version@ functions.
-.SH SYNOPSIS
-.sp
-\fB#include <unbound.h>\fP
-.sp
-struct ub_ctx * \fBub_ctx_create\fP(void);
-.sp
-void \fBub_ctx_delete\fP(struct ub_ctx* ctx);
-.sp
-int \fBub_ctx_set_option\fP(struct ub_ctx* ctx, char* opt, char* val);
-.sp
-int \fBub_ctx_get_option\fP(struct ub_ctx* ctx, char* opt, char** val);
-.sp
-int \fBub_ctx_config\fP(struct ub_ctx* ctx, char* fname);
-.sp
-int \fBub_ctx_set_fwd\fP(struct ub_ctx* ctx, char* addr);
-.INDENT 0.0
-.TP
-int \fBub_ctx_set_stub\fP(struct ub_ctx* ctx, char* zone, char* addr,
-int isprime);
-.UNINDENT
-.sp
-int \fBub_ctx_set_tls\fP(struct ub_ctx* ctx, int tls);
-.sp
-int \fBub_ctx_resolvconf\fP(struct ub_ctx* ctx, char* fname);
-.sp
-int \fBub_ctx_hosts\fP(struct ub_ctx* ctx, char* fname);
-.sp
-int \fBub_ctx_add_ta\fP(struct ub_ctx* ctx, char* ta);
-.sp
-int \fBub_ctx_add_ta_autr\fP(struct ub_ctx* ctx, char* fname);
-.sp
-int \fBub_ctx_add_ta_file\fP(struct ub_ctx* ctx, char* fname);
-.sp
-int \fBub_ctx_trustedkeys\fP(struct ub_ctx* ctx, char* fname);
-.sp
-int \fBub_ctx_debugout\fP(struct ub_ctx* ctx, FILE* out);
-.sp
-int \fBub_ctx_debuglevel\fP(struct ub_ctx* ctx, int d);
-.sp
-int \fBub_ctx_async\fP(struct ub_ctx* ctx, int dothread);
-.sp
-int \fBub_poll\fP(struct ub_ctx* ctx);
-.sp
-int \fBub_wait\fP(struct ub_ctx* ctx);
-.sp
-int \fBub_fd\fP(struct ub_ctx* ctx);
-.sp
-int \fBub_process\fP(struct ub_ctx* ctx);
-.INDENT 0.0
-.TP
-int \fBub_resolve\fP(struct ub_ctx* ctx, char* name,
-int rrtype, int rrclass, struct ub_result** result);
-.TP
-int \fBub_resolve_async\fP(struct ub_ctx* ctx, char* name,
-int rrtype, int rrclass, void* mydata,
-ub_callback_type* callback, int* async_id);
-.UNINDENT
-.sp
-int \fBub_cancel\fP(struct ub_ctx* ctx, int async_id);
-.sp
-void \fBub_resolve_free\fP(struct ub_result* result);
-.sp
-const char * \fBub_strerror\fP(int err);
-.sp
-int \fBub_ctx_print_local_zones\fP(struct ub_ctx* ctx);
-.sp
-int \fBub_ctx_zone_add\fP(struct ub_ctx* ctx, char* zone_name, char* zone_type);
-.sp
-int \fBub_ctx_zone_remove\fP(struct ub_ctx* ctx, char* zone_name);
-.sp
-int \fBub_ctx_data_add\fP(struct ub_ctx* ctx, char* data);
-.sp
-int \fBub_ctx_data_remove\fP(struct ub_ctx* ctx, char* data);
-.SH DESCRIPTION
-.sp
-Unbound is an implementation of a DNS resolver, that does caching and DNSSEC
-validation.
-This is the library API, for using the \fB\-lunbound\fP library.
-The server daemon is described in \fI\%unbound(8)\fP\&.
-The library works independent from a running unbound server, and can be used to
-convert hostnames to ip addresses, and back, and obtain other information from
-the DNS.
-The library performs public\-key validation of results with DNSSEC.
-.sp
-The library uses a variable of type \fIstruct ub_ctx\fP to keep context between
-calls.
-The user must maintain it, creating it with \fBub_ctx_create\fP and deleting it
-with \fBub_ctx_delete\fP\&.
-It can be created and deleted at any time.
-Creating it anew removes any previous configuration (such as trusted keys) and
-clears any cached results.
-.sp
-The functions are thread\-safe, and a context can be used in a threaded (as well
-as in a non\-threaded) environment.
-Also resolution (and validation) can be performed blocking and non\-blocking
-(also called asynchronous).
-The async method returns from the call immediately, so that processing can go
-on, while the results become available later.
-.sp
+.TH "libunbound" "3" "@date@" "NLnet Labs" "unbound @version@"
+.\"
+.\" libunbound.3 -- unbound library functions manual
+.\"
+.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
+.\"
+.\" See LICENSE for the license.
+.\"
+.\"
+.SH "NAME"
+.B libunbound,
+.B unbound.h,
+.B ub_ctx,
+.B ub_result,
+.B ub_callback_type,
+.B ub_ctx_create,
+.B ub_ctx_delete,
+.B ub_ctx_set_option,
+.B ub_ctx_get_option,
+.B ub_ctx_config,
+.B ub_ctx_set_fwd,
+.B ub_ctx_set_stub,
+.B ub_ctx_set_tls,
+.B ub_ctx_resolvconf,
+.B ub_ctx_hosts,
+.B ub_ctx_add_ta,
+.B ub_ctx_add_ta_autr,
+.B ub_ctx_add_ta_file,
+.B ub_ctx_trustedkeys,
+.B ub_ctx_debugout,
+.B ub_ctx_debuglevel,
+.B ub_ctx_async,
+.B ub_poll,
+.B ub_wait,
+.B ub_fd,
+.B ub_process,
+.B ub_resolve,
+.B ub_resolve_async,
+.B ub_cancel,
+.B ub_resolve_free,
+.B ub_strerror,
+.B ub_ctx_print_local_zones,
+.B ub_ctx_zone_add,
+.B ub_ctx_zone_remove,
+.B ub_ctx_data_add,
+.B ub_ctx_data_remove
+\- Unbound DNS validating resolver @version@ functions.
+.SH "SYNOPSIS"
+.B #include <unbound.h>
+.LP
+\fIstruct ub_ctx *\fR
+\fBub_ctx_create\fR(\fIvoid\fR);
+.LP
+\fIvoid\fR
+\fBub_ctx_delete\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_ctx_set_option\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR opt, \fIchar*\fR val);
+.LP
+\fIint\fR
+\fBub_ctx_get_option\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR opt, \fIchar**\fR val);
+.LP
+\fIint\fR
+\fBub_ctx_config\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_set_fwd\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR addr);
+.LP
+\fIint\fR
+\fBub_ctx_set_stub\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR zone,
+\fIchar*\fR addr,
+.br
+		\fIint\fR isprime);
+.LP
+\fIint\fR
+\fBub_ctx_set_tls\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR tls);
+.LP
+\fIint\fR
+\fBub_ctx_resolvconf\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_hosts\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_add_ta\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR ta);
+.LP
+\fIint\fR
+\fBub_ctx_add_ta_autr\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_add_ta_file\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_trustedkeys\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_debugout\fR(\fIstruct ub_ctx*\fR ctx, \fIFILE*\fR out);
+.LP
+\fIint\fR
+\fBub_ctx_debuglevel\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR d);
+.LP
+\fIint\fR
+\fBub_ctx_async\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR dothread);
+.LP
+\fIint\fR
+\fBub_poll\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_wait\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_fd\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_process\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_resolve\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR name, 
+.br
+           \fIint\fR rrtype, \fIint\fR rrclass, \fIstruct ub_result**\fR result);
+.LP
+\fIint\fR
+\fBub_resolve_async\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR name, 
+.br
+                 \fIint\fR rrtype, \fIint\fR rrclass, \fIvoid*\fR mydata, 
+.br
+                 \fIub_callback_type\fR callback, \fIint*\fR async_id);
+.LP
+\fIint\fR
+\fBub_cancel\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR async_id);
+.LP
+\fIvoid\fR
+\fBub_resolve_free\fR(\fIstruct ub_result*\fR result);
+.LP
+\fIconst char *\fR
+\fBub_strerror\fR(\fIint\fR err);
+.LP
+\fIint\fR
+\fBub_ctx_print_local_zones\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_ctx_zone_add\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR zone_name, \fIchar*\fR zone_type);
+.LP
+\fIint\fR
+\fBub_ctx_zone_remove\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR zone_name);
+.LP
+\fIint\fR
+\fBub_ctx_data_add\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR data);
+.LP
+\fIint\fR
+\fBub_ctx_data_remove\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR data);
+.SH "DESCRIPTION"
+.B Unbound 
+is an implementation of a DNS resolver, that does caching and 
+DNSSEC validation. This is the library API, for using the \-lunbound library.
+The server daemon is described in \fIunbound\fR(8).
+The library works independent from a running unbound server, and
+can be used to convert hostnames to ip addresses, and back,
+and obtain other information from the DNS. The library performs public\-key
+validation of results with DNSSEC.
+.P
+The library uses a variable of type \fIstruct ub_ctx\fR to keep context
+between calls. The user must maintain it, creating it with
+.B ub_ctx_create
+and deleting it with
+.B ub_ctx_delete\fR.
+It can be created and deleted at any time. Creating it anew removes any 
+previous configuration (such as trusted keys) and clears any cached results.
+.P
+The functions are thread\-safe, and a context can be used in a threaded (as 
+well as in a non\-threaded) environment. Also resolution (and validation) 
+can be performed blocking and non\-blocking (also called asynchronous). 
+The async method returns from the call immediately, so that processing 
+can go on, while the results become available later. 
+.P
 The functions are discussed in turn below.
-.SH FUNCTIONS
-.INDENT 0.0
-.TP
+.SH "FUNCTIONS"
+.TP 
 .B ub_ctx_create
 Create a new context, initialised with defaults.
-The information from \fB/etc/resolv.conf\fP and \fB/etc/hosts\fP is
-not utilised by default.
-Use \fBub_ctx_resolvconf\fP and \fBub_ctx_hosts\fP to read them.
-Before you call this, use the openssl functions
-\fBCRYPTO_set_id_callback\fP and \fBCRYPTO_set_locking_callback\fP to set
-up asynchronous operation if you use lib openssl (the application calls
-these functions once for initialisation).
-Openssl 1.0.0 or later uses the \fBCRYPTO_THREADID_set_callback\fP
-function.
+The information from /etc/resolv.conf and /etc/hosts is not utilised 
+by default. Use 
+.B ub_ctx_resolvconf
+and
+.B ub_ctx_hosts
+to read them.
+Before you call this, use the openssl functions CRYPTO_set_id_callback and
+CRYPTO_set_locking_callback to set up asynchronous operation if you use
+lib openssl (the application calls these functions once for initialisation).
+Openssl 1.0.0 or later uses the CRYPTO_THREADID_set_callback function.
 .TP
 .B ub_ctx_delete
 Delete validation context and free associated resources.
-Outstanding async queries are killed and callbacks are not called for
-them.
+Outstanding async queries are killed and callbacks are not called for them.
 .TP
 .B ub_ctx_set_option
-A power\-user interface that lets you specify one of the options from
-the config file format, see \fI\%unbound.conf(5)\fP\&.
-Not all options are relevant.
-For some specific options, such as adding trust anchors, special
-routines exist.
-Pass the option name with the trailing \fB\(aq:\(aq\fP\&.
+A power\-user interface that lets you specify one of the options from the
+config file format, see \fIunbound.conf\fR(5). Not all options are
+relevant. For some specific options, such as adding trust anchors, special
+routines exist. Pass the option name with the trailing ':'.
 .TP
 .B ub_ctx_get_option
-A power\-user interface that gets an option value.
-Some options cannot be gotten, and others return a newline separated
-list.
-Pass the option name without trailing \fB\(aq:\(aq\fP\&.
-The returned value must be free(2)d by the caller.
+A power\-user interface that gets an option value.  Some options cannot be
+gotten, and others return a newline separated list.  Pass the option name
+without trailing ':'.  The returned value must be free(2)d by the caller.
 .TP
 .B ub_ctx_config
-A power\-user interface that lets you specify an unbound config file,
-see \fI\%unbound.conf(5)\fP, which is read for
-configuration.
-Not all options are relevant.
-For some specific options, such as adding trust anchors, special
-routines exist.
-This function is thread\-safe only if a single instance of \fBub_ctx\fP*
-exists in the application.
-If several instances exist the application has to ensure that
-\fBub_ctx_config\fP is not called in parallel by the different instances.
+A power\-user interface that lets you specify an unbound config file, see
+\fIunbound.conf\fR(5), which is read for configuration. Not all options are
+relevant. For some specific options, such as adding trust anchors, special
+routines exist.  This function is thread\-safe only if a single instance of
+ub_ctx* exists in the application.  If several instances exist the
+application has to ensure that ub_ctx_config is not called in parallel by
+the different instances.
 .TP
 .B ub_ctx_set_fwd
-Set machine to forward DNS queries to, the caching resolver to use.
-IP4 or IP6 address.
-Forwards all DNS requests to that machine, which is expected to run a
-recursive resolver.
-If the proxy is not DNSSEC capable, validation may fail.
-Can be called several times, in that case the addresses are used as
-backup servers.
-At this time it is only possible to set configuration before the first
-resolve is done.
+Set machine to forward DNS queries to, the caching resolver to use. 
+IP4 or IP6 address. Forwards all DNS requests to that machine, which 
+is expected to run a recursive resolver. If the proxy is not 
+DNSSEC capable, validation may fail. Can be called several times, in 
+that case the addresses are used as backup servers.
+At this time it is only possible to set configuration before the
+first resolve is done.
 .TP
 .B ub_ctx_set_stub
-Set a stub zone, authoritative dns servers to use for a particular
-zone.
-IP4 or IP6 address.
-If the address is NULL the stub entry is removed.
-Set isprime true if you configure root hints with it.
-Otherwise similar to the stub zone item from unbound\(aqs config file.
-Can be called several times, for different zones, or to add multiple
-addresses for a particular zone.
-At this time it is only possible to set configuration before the first
-resolve is done.
+Set a stub zone, authoritative dns servers to use for a particular zone.
+IP4 or IP6 address.  If the address is NULL the stub entry is removed.
+Set isprime true if you configure root hints with it.  Otherwise similar to
+the stub zone item from unbound's config file.  Can be called several times,
+for different zones, or to add multiple addresses for a particular zone.
+At this time it is only possible to set configuration before the
+first resolve is done.
 .TP
 .B ub_ctx_set_tls
-Enable DNS over TLS (DoT) for machines set with \fBub_ctx_set_fwd\fP\&.
-At this time it is only possible to set configuration before the first
-resolve is done.
+Enable DNS over TLS (DoT) for machines set with 
+.B ub_ctx_set_fwd.
+At this time it is only possible to set configuration before the
+first resolve is done.
 .TP
 .B ub_ctx_resolvconf
-By default the root servers are queried and full resolver mode is used,
-but you can use this call to read the list of nameservers to use from
-the filename given.
-Usually \fB\(dq/etc/resolv.conf\(dq\fP\&.
-Uses those nameservers as caching proxies.
+By default the root servers are queried and full resolver mode is used, but
+you can use this call to read the list of nameservers to use from the
+filename given.
+Usually "/etc/resolv.conf". Uses those nameservers as caching proxies.
 If they do not support DNSSEC, validation may fail.
 Only nameservers are picked up, the searchdomain, ndots and other
-settings from \fIresolv.conf(5)\fP are ignored.
-If fname NULL is passed, \fB\(dq/etc/resolv.conf\(dq\fP is used (if on
-Windows, the system\-wide configured nameserver is picked instead).
-At this time it is only possible to set configuration before the first
-resolve is done.
+settings from \fIresolv.conf\fR(5) are ignored.
+If fname NULL is passed, "/etc/resolv.conf" is used (if on Windows, 
+the system\-wide configured nameserver is picked instead).
+At this time it is only possible to set configuration before the
+first resolve is done.
 .TP
 .B ub_ctx_hosts
 Read list of hosts from the filename given.
-Usually \fB\(dq/etc/hosts\(dq\fP\&.
-When queried for, these addresses are not marked DNSSEC secure.
-If fname NULL is passed, \fB\(dq/etc/hosts\(dq\fP is used (if on Windows,
-\fBetc/hosts\fP from WINDIR is picked instead).
-At this time it is only possible to set configuration before the first
-resolve is done.
+Usually "/etc/hosts". When queried for, these addresses are not marked 
+DNSSEC secure. If fname NULL is passed, "/etc/hosts" is used 
+(if on Windows, etc/hosts from WINDIR is picked instead).
+At this time it is only possible to set configuration before the
+first resolve is done.
 .TP
-.B ub_ctx_add_ta
+.B
+ub_ctx_add_ta
 Add a trust anchor to the given context.
-At this time it is only possible to add trusted keys before the first
-resolve is done.
+At this time it is only possible to add trusted keys before the
+first resolve is done.
 The format is a string, similar to the zone\-file format,
-\fB[domainname]\fP \fB[type]\fP \fB[rdata contents]\fP\&.
-Both DS and DNSKEY records are accepted.
+[domainname] [type] [rdata contents]. Both DS and DNSKEY records are accepted.
 .TP
 .B ub_ctx_add_ta_autr
-Add filename with automatically tracked trust anchor to the given
-context.
-Pass name of a file with the managed trust anchor.
-You can create this file with
-\fI\%unbound\-anchor(8)\fP for the root anchor.
-You can also create it with an initial file with one line with a DNSKEY
-or DS record.
+Add filename with automatically tracked trust anchor to the given context.
+Pass name of a file with the managed trust anchor.  You can create this
+file with \fIunbound\-anchor\fR(8) for the root anchor.  You can also
+create it with an initial file with one line with a DNSKEY or DS record.
 If the file is writable, it is updated when the trust anchor changes.
-At this time it is only possible to add trusted keys before the first
-resolve is done.
+At this time it is only possible to add trusted keys before the
+first resolve is done.
 .TP
 .B ub_ctx_add_ta_file
 Add trust anchors to the given context.
 Pass name of a file with DS and DNSKEY records in zone file format.
-At this time it is only possible to add trusted keys before the first
-resolve is done.
+At this time it is only possible to add trusted keys before the
+first resolve is done.
 .TP
 .B ub_ctx_trustedkeys
 Add trust anchors to the given context.
-Pass the name of a bind\-style config file with \fBtrusted\-keys{}\fP\&.
-At this time it is only possible to add trusted keys before the first
-resolve is done.
+Pass the name of a bind\-style config file with trusted\-keys{}.
+At this time it is only possible to add trusted keys before the
+first resolve is done.
 .TP
 .B ub_ctx_debugout
-Set debug and error log output to the given stream.
-Pass NULL to disable output.
-Default is stderr.
-File\-names or using syslog can be enabled using config options, this
-routine is for using your own stream.
+Set debug and error log output to the given stream. Pass NULL to disable
+output. Default is stderr. File\-names or using syslog can be enabled
+using config options, this routine is for using your own stream.
 .TP
 .B ub_ctx_debuglevel
-Set debug verbosity for the context.
-Output is directed to stderr.
+Set debug verbosity for the context. Output is directed to stderr.
 Higher debug level gives more output.
 .TP
 .B ub_ctx_async
 Set a context behaviour for asynchronous action.
-if set to true, enables threading and a call to \fBub_resolve_async\fP
+if set to true, enables threading and a call to 
+.B ub_resolve_async 
 creates a thread to handle work in the background.
 If false, a process is forked to handle work in the background.
-Changes to this setting after \fBub_resolve_async\fP calls have been made
-have no effect (delete and re\-create the context to change).
+Changes to this setting after 
+.B ub_resolve_async 
+calls have been made have no effect (delete and re\-create the context 
+to change).
 .TP
 .B ub_poll
 Poll a context to see if it has any new results.
-Do not poll in a loop, instead extract the \fBfd\fP below to poll for
-readiness, and then check, or wait using the wait routine.
+Do not poll in a loop, instead extract the fd below to poll for readiness,
+and then check, or wait using the wait routine.
 Returns 0 if nothing to read, or nonzero if a result is available.
-If nonzero, call \fBub_process\fP to do callbacks.
+If nonzero, call 
+.B ub_process 
+to do callbacks.
 .TP
 .B ub_wait
-Wait for a context to finish with results.
-Calls \fBub_process\fP after the wait for you.
-After the wait, there are no more outstanding asynchronous queries.
+Wait for a context to finish with results. Calls 
+.B ub_process 
+after the wait for you. After the wait, there are no more outstanding 
+asynchronous queries.
 .TP
 .B ub_fd
-Get file descriptor.
-Wait for it to become readable, at this point answers are returned from
-the asynchronous validating resolver.
-Then call the \fBub_process\fP to continue processing.
+Get file descriptor. Wait for it to become readable, at this point
+answers are returned from the asynchronous validating resolver.
+Then call the \fBub_process\fR to continue processing.
 .TP
 .B ub_process
 Call this routine to continue processing results from the validating
-resolver (when the \fBfd\fP becomes readable).
+resolver (when the fd becomes readable).
 Will perform necessary callbacks.
 .TP
 .B ub_resolve
@@ -311,111 +340,95 @@ The result structure is newly allocated with the resulting data.
 .TP
 .B ub_resolve_async
 Perform asynchronous resolution and validation of the target name.
-Arguments mean the same as for \fBub_resolve\fP except no data is
-returned immediately, instead a callback is called later.
-The callback receives a copy of the mydata pointer, that you can use to
-pass information to the callback.
-The callback type is a function pointer to a function declared as:
-.INDENT 7.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-void my_callback_function(void* my_arg, int err,
-                struct ub_result* result);
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-The \fBasync_id\fP is returned so you can (at your option) decide to
-track it and cancel the request if needed.
-If you pass a NULL pointer the \fBasync_id\fP is not returned.
+Arguments mean the same as for \fBub_resolve\fR except no
+data is returned immediately, instead a callback is called later.
+The callback receives a copy of the mydata pointer, that you can use to pass
+information to the callback. The callback type is a function pointer to
+a function declared as
+.IP
+void my_callback_function(void* my_arg, int err, 
+.br
+                  struct ub_result* result);
+.IP
+The async_id is returned so you can (at your option) decide to track it
+and cancel the request if needed.  If you pass a NULL pointer the async_id
+is not returned. 
 .TP
 .B ub_cancel
-Cancel an async query in progress.
-This may return an error if the query does not exist, or the query is
-already being delivered, in that case you may still get a callback for
-the query.
+Cancel an async query in progress.  This may return an error if the query
+does not exist, or the query is already being delivered, in that case you 
+may still get a callback for the query.
 .TP
 .B ub_resolve_free
-Free struct \fBub_result\fP contents after use.
+Free struct ub_result contents after use.
 .TP
 .B ub_strerror
-Convert error value from one of the unbound library functions to a
-human readable string.
+Convert error value from one of the unbound library functions 
+to a human readable string.
 .TP
 .B ub_ctx_print_local_zones
 Debug printout the local authority information to debug output.
 .TP
 .B ub_ctx_zone_add
-Add new zone to local authority info, like local\-zone
-\fI\%unbound.conf(5)\fP statement.
+Add new zone to local authority info, like local\-zone \fIunbound.conf\fR(5) 
+statement.
 .TP
 .B ub_ctx_zone_remove
 Delete zone from local authority info.
 .TP
 .B ub_ctx_data_add
 Add resource record data to local authority info, like local\-data
-\fI\%unbound.conf(5)\fP statement.
+\fIunbound.conf\fR(5) statement.
 .TP
 .B ub_ctx_data_remove
 Delete local authority data from the name given.
-.UNINDENT
-.SH RESULT DATA STRUCTURE
-.sp
-The result of the DNS resolution and validation is returned as \fIstruct
-ub_result\fP\&.
-The result structure contains the following entries:
-.INDENT 0.0
-.INDENT 3.5
-.sp
+.SH "RESULT DATA STRUCTURE"
+The result of the DNS resolution and validation is returned as 
+\fIstruct ub_result\fR. The result structure contains the following entries.
+.P
 .nf
-.ft C
-struct ub_result {
-     char* qname;         /* text string, original question */
-     int qtype;           /* type code asked for */
-     int qclass;          /* class code asked for */
-     char** data;         /* array of rdata items, NULL terminated*/
-     int* len;            /* array with lengths of rdata items */
-     char* canonname;     /* canonical name of result */
-     int rcode;           /* additional error code in case of no data */
-     void* answer_packet; /* full network format answer packet */
-     int answer_len;      /* length of packet in octets */
-     int havedata;        /* true if there is data */
-     int nxdomain;        /* true if nodata because name does not exist */
-     int secure;          /* true if result is secure */
-     int bogus;           /* true if a security failure happened */
-     char* why_bogus;     /* string with error if bogus */
-     int was_ratelimited; /* true if the query was ratelimited (SERVFAIL) by unbound */
-     int ttl;             /* number of seconds the result is valid */
-};
-.ft P
+	struct ub_result {
+		char* qname; /* text string, original question */
+		int qtype;   /* type code asked for */
+		int qclass;  /* class code asked for */
+		char** data; /* array of rdata items, NULL terminated*/
+		int* len;    /* array with lengths of rdata items */
+		char* canonname; /* canonical name of result */
+		int rcode;   /* additional error code in case of no data */
+		void* answer_packet; /* full network format answer packet */
+		int answer_len;  /* length of packet in octets */
+		int havedata; /* true if there is data */
+		int nxdomain; /* true if nodata because name does not exist */
+		int secure;   /* true if result is secure */
+		int bogus;    /* true if a security failure happened */
+		char* why_bogus; /* string with error if bogus */
+		int was_ratelimited; /* true if the query was ratelimited (SERVFAIL) by unbound */
+		int ttl;     /* number of seconds the result is valid */
+	};
 .fi
-.UNINDENT
-.UNINDENT
-.sp
-If both secure and bogus are false, security was not enabled for the domain of
-the query.
-Else, they are not both true, one of them is true.
-.SH RETURN VALUES
-.sp
-Many routines return an error code.
-The value 0 (zero) denotes no error happened.
-Other values can be passed to \fBub_strerror\fP to obtain a readable error
-string.
-\fBub_strerror\fP returns a zero terminated string.
-\fBub_ctx_create\fP returns NULL on an error (a malloc failure).
-\fBub_poll\fP returns true if some information may be available, false otherwise.
-\fBub_fd\fP returns a file descriptor or \-1 on error.
-\fBub_ctx_config\fP and \fBub_ctx_resolvconf\fP attempt to leave errno informative
-on a function return with file read failure.
-.SH SEE ALSO
-.sp
-\fI\%unbound.conf(5)\fP, \fI\%unbound(8)\fP\&.
-.SH AUTHOR
-Unbound developers are mentioned in the CREDITS file in the distribution.
-.SH COPYRIGHT
-1999-2026, NLnet Labs
-.\" Generated by docutils manpage writer.
-.
+.P
+If both secure and bogus are false, security was not enabled for the 
+domain of the query.  Else, they are not both true, one of them is true.
+.SH "RETURN VALUES"
+Many routines return an error code. The value 0 (zero) denotes no error
+happened. Other values can be passed to
+.B ub_strerror
+to obtain a readable error string.
+.B ub_strerror
+returns a zero terminated string.
+.B ub_ctx_create
+returns NULL on an error (a malloc failure).
+.B ub_poll
+returns true if some information may be available, false otherwise.
+.B ub_fd
+returns a file descriptor or \-1 on error.
+.B ub_ctx_config
+and
+.B ub_ctx_resolvconf
+attempt to leave errno informative on a function return with file read failure.
+.SH "SEE ALSO"
+\fIunbound.conf\fR(5), 
+\fIunbound\fR(8).
+.SH "AUTHORS"
+.B Unbound
+developers are mentioned in the CREDITS file in the distribution.
@@ -1,491 +0,0 @@
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-libunbound(3)
-=============
-
-Synopsis
--------
-
-.. only:: html
-
-    .. code-block:: c
-
-        #include <unbound.h>
-
-        struct ub_ctx * ub_ctx_create(void);
-
-        void ub_ctx_delete(struct ub_ctx* ctx);
-
-        int ub_ctx_set_option(struct ub_ctx* ctx, char* opt, char* val);
-
-        int ub_ctx_get_option(struct ub_ctx* ctx, char* opt, char** val);
-
-        int ub_ctx_config(struct ub_ctx* ctx, char* fname);
-
-        int ub_ctx_set_fwd(struct ub_ctx* ctx, char* addr);
-
-        int ub_ctx_set_stub(struct ub_ctx* ctx, char* zone, char* addr,
-                            int isprime);
-
-        int ub_ctx_set_tls(struct ub_ctx* ctx, int tls);
-
-        int ub_ctx_resolvconf(struct ub_ctx* ctx, char* fname);
-
-        int ub_ctx_hosts(struct ub_ctx* ctx, char* fname);
-
-        int ub_ctx_add_ta(struct ub_ctx* ctx, char* ta);
-
-        int ub_ctx_add_ta_autr(struct ub_ctx* ctx, char* fname);
-
-        int ub_ctx_add_ta_file(struct ub_ctx* ctx, char* fname);
-
-        int ub_ctx_trustedkeys(struct ub_ctx* ctx, char* fname);
-
-        int ub_ctx_debugout(struct ub_ctx* ctx, FILE* out);
-
-        int ub_ctx_debuglevel(struct ub_ctx* ctx, int d);
-
-        int ub_ctx_async(struct ub_ctx* ctx, int dothread);
-
-        int ub_poll(struct ub_ctx* ctx);
-
-        int ub_wait(struct ub_ctx* ctx);
-
-        int ub_fd(struct ub_ctx* ctx);
-
-        int ub_process(struct ub_ctx* ctx);
-
-        int ub_resolve(struct ub_ctx* ctx, char* name, int rrtype,
-                       int rrclass, struct ub_result** result);
-
-        int ub_resolve_async(struct ub_ctx* ctx, char* name, int rrtype,
-                             int rrclass, void* mydata, ub_callback_type callback,
-                             int* async_id);
-
-        int ub_cancel(struct ub_ctx* ctx, int async_id);
-
-        void ub_resolve_free(struct ub_result* result);
-
-        const char * ub_strerror(int err);
-
-        int ub_ctx_print_local_zones(struct ub_ctx* ctx);
-
-        int ub_ctx_zone_add(struct ub_ctx* ctx, char* zone_name, char* zone_type);
-
-        int ub_ctx_zone_remove(struct ub_ctx* ctx, char* zone_name);
-
-        int ub_ctx_data_add(struct ub_ctx* ctx, char* data);
-
-        int ub_ctx_data_remove(struct ub_ctx* ctx, char* data);
-
-.. only:: man
-
-    **#include <unbound.h>**
-
-    struct ub_ctx \* **ub_ctx_create**\ (void);
-
-    void **ub_ctx_delete**\ (struct ub_ctx\* ctx);
-
-    int **ub_ctx_set_option**\ (struct ub_ctx\* ctx, char\* opt, char\* val);
-
-    int **ub_ctx_get_option**\ (struct ub_ctx\* ctx, char\* opt, char\*\* val);
-
-    int **ub_ctx_config**\ (struct ub_ctx\* ctx, char* fname);
-
-    int **ub_ctx_set_fwd**\ (struct ub_ctx\* ctx, char\* addr);
-
-    int **ub_ctx_set_stub**\ (struct ub_ctx\* ctx, char\* zone, char\* addr,
-        int isprime);
-
-    int **ub_ctx_set_tls**\ (struct ub_ctx\* ctx, int tls);
-
-    int **ub_ctx_resolvconf**\ (struct ub_ctx\* ctx, char\* fname);
-
-    int **ub_ctx_hosts**\ (struct ub_ctx\* ctx, char\* fname);
-
-    int **ub_ctx_add_ta**\ (struct ub_ctx\* ctx, char\* ta);
-
-    int **ub_ctx_add_ta_autr**\ (struct ub_ctx\* ctx, char\* fname);
-
-    int **ub_ctx_add_ta_file**\ (struct ub_ctx\* ctx, char\* fname);
-
-    int **ub_ctx_trustedkeys**\ (struct ub_ctx\* ctx, char\* fname);
-
-    int **ub_ctx_debugout**\ (struct ub_ctx\* ctx, FILE\* out);
-
-    int **ub_ctx_debuglevel**\ (struct ub_ctx\* ctx, int d);
-
-    int **ub_ctx_async**\ (struct ub_ctx\* ctx, int dothread);
-
-    int **ub_poll**\ (struct ub_ctx\* ctx);
-
-    int **ub_wait**\ (struct ub_ctx\* ctx);
-
-    int **ub_fd**\ (struct ub_ctx\* ctx);
-
-    int **ub_process**\ (struct ub_ctx\* ctx);
-
-    int **ub_resolve**\ (struct ub_ctx\* ctx, char\* name,
-        int rrtype, int rrclass, struct ub_result\*\* result);
-
-    int **ub_resolve_async**\ (struct ub_ctx\* ctx, char\* name,
-        int rrtype, int rrclass, void\* mydata,
-        ub_callback_type\* callback, int\* async_id);
-
-    int **ub_cancel**\ (struct ub_ctx\* ctx, int async_id);
-
-    void **ub_resolve_free**\ (struct ub_result\* result);
-
-    const char \* **ub_strerror**\ (int err);
-
-    int **ub_ctx_print_local_zones**\ (struct ub_ctx\* ctx);
-
-    int **ub_ctx_zone_add**\ (struct ub_ctx\* ctx, char\* zone_name, char\* zone_type);
-
-    int **ub_ctx_zone_remove**\ (struct ub_ctx\* ctx, char\* zone_name);
-
-    int **ub_ctx_data_add**\ (struct ub_ctx\* ctx, char\* data);
-
-    int **ub_ctx_data_remove**\ (struct ub_ctx\* ctx, char\* data);
-
-Description
-----------
-
-Unbound is an implementation of a DNS resolver, that does caching and DNSSEC
-validation.
-This is the library API, for using the ``-lunbound`` library.
-The server daemon is described in :doc:`unbound(8)</manpages/unbound>`.
-The library works independent from a running unbound server, and can be used to
-convert hostnames to ip addresses, and back, and obtain other information from
-the DNS.
-The library performs public-key validation of results with DNSSEC.
-
-The library uses a variable of type *struct ub_ctx* to keep context between
-calls.
-The user must maintain it, creating it with **ub_ctx_create** and deleting it
-with **ub_ctx_delete**.
-It can be created and deleted at any time.
-Creating it anew removes any previous configuration (such as trusted keys) and
-clears any cached results.
-
-The functions are thread-safe, and a context can be used in a threaded (as well
-as in a non-threaded) environment.
-Also resolution (and validation) can be performed blocking and non-blocking
-(also called asynchronous).
-The async method returns from the call immediately, so that processing can go
-on, while the results become available later.
-
-The functions are discussed in turn below.
-
-Functions
---------
-
-.. glossary::
-
-    ub_ctx_create
-        Create a new context, initialised with defaults.
-        The information from :file:`/etc/resolv.conf` and :file:`/etc/hosts` is
-        not utilised by default.
-        Use **ub_ctx_resolvconf** and **ub_ctx_hosts** to read them.
-        Before you call this, use the openssl functions
-        **CRYPTO_set_id_callback** and **CRYPTO_set_locking_callback** to set
-        up asynchronous operation if you use lib openssl (the application calls
-        these functions once for initialisation).
-        Openssl 1.0.0 or later uses the **CRYPTO_THREADID_set_callback**
-        function.
-
-    ub_ctx_delete
-        Delete validation context and free associated resources.
-        Outstanding async queries are killed and callbacks are not called for
-        them.
-
-    ub_ctx_set_option
-        A power-user interface that lets you specify one of the options from
-        the config file format, see :doc:`unbound.conf(5)</manpages/unbound.conf>`.
-        Not all options are relevant.
-        For some specific options, such as adding trust anchors, special
-        routines exist.
-        Pass the option name with the trailing ``':'``.
-
-    ub_ctx_get_option
-        A power-user interface that gets an option value.
-        Some options cannot be gotten, and others return a newline separated
-        list.
-        Pass the option name without trailing ``':'``.
-        The returned value must be free(2)d by the caller.
-
-    ub_ctx_config
-        A power-user interface that lets you specify an unbound config file,
-        see :doc:`unbound.conf(5)</manpages/unbound.conf>`, which is read for
-        configuration.
-        Not all options are relevant.
-        For some specific options, such as adding trust anchors, special
-        routines exist.
-        This function is thread-safe only if a single instance of **ub_ctx**\*
-        exists in the application.
-        If several instances exist the application has to ensure that
-        **ub_ctx_config** is not called in parallel by the different instances.
-
-    ub_ctx_set_fwd
-        Set machine to forward DNS queries to, the caching resolver to use.
-        IP4 or IP6 address.
-        Forwards all DNS requests to that machine, which is expected to run a
-        recursive resolver.
-        If the proxy is not DNSSEC capable, validation may fail.
-        Can be called several times, in that case the addresses are used as
-        backup servers.
-        At this time it is only possible to set configuration before the first
-        resolve is done.
-
-    ub_ctx_set_stub
-        Set a stub zone, authoritative dns servers to use for a particular
-        zone.
-        IP4 or IP6 address.
-        If the address is NULL the stub entry is removed.
-        Set isprime true if you configure root hints with it.
-        Otherwise similar to the stub zone item from unbound's config file.
-        Can be called several times, for different zones, or to add multiple
-        addresses for a particular zone.
-        At this time it is only possible to set configuration before the first
-        resolve is done.
-
-    ub_ctx_set_tls
-        Enable DNS over TLS (DoT) for machines set with **ub_ctx_set_fwd**.
-        At this time it is only possible to set configuration before the first
-        resolve is done.
-
-    ub_ctx_resolvconf
-        By default the root servers are queried and full resolver mode is used,
-        but you can use this call to read the list of nameservers to use from
-        the filename given.
-        Usually :file:`"/etc/resolv.conf"`.
-        Uses those nameservers as caching proxies.
-        If they do not support DNSSEC, validation may fail.
-        Only nameservers are picked up, the searchdomain, ndots and other
-        settings from *resolv.conf(5)* are ignored.
-        If fname NULL is passed, :file:`"/etc/resolv.conf"` is used (if on
-        Windows, the system-wide configured nameserver is picked instead).
-        At this time it is only possible to set configuration before the first
-        resolve is done.
-
-    ub_ctx_hosts
-        Read list of hosts from the filename given.
-        Usually :file:`"/etc/hosts"`.
-        When queried for, these addresses are not marked DNSSEC secure.
-        If fname NULL is passed, :file:`"/etc/hosts"` is used (if on Windows,
-        :file:`etc/hosts` from WINDIR is picked instead).
-        At this time it is only possible to set configuration before the first
-        resolve is done.
-
-    ub_ctx_add_ta
-        Add a trust anchor to the given context.
-        At this time it is only possible to add trusted keys before the first
-        resolve is done.
-        The format is a string, similar to the zone-file format,
-        **[domainname]** **[type]** **[rdata contents]**.
-        Both DS and DNSKEY records are accepted.
-
-    ub_ctx_add_ta_autr
-        Add filename with automatically tracked trust anchor to the given
-        context.
-        Pass name of a file with the managed trust anchor.
-        You can create this file with
-        :doc:`unbound-anchor(8)</manpages/unbound-anchor>` for the root anchor.
-        You can also create it with an initial file with one line with a DNSKEY
-        or DS record.
-        If the file is writable, it is updated when the trust anchor changes.
-        At this time it is only possible to add trusted keys before the first
-        resolve is done.
-
-    ub_ctx_add_ta_file
-        Add trust anchors to the given context.
-        Pass name of a file with DS and DNSKEY records in zone file format.
-        At this time it is only possible to add trusted keys before the first
-        resolve is done.
-
-    ub_ctx_trustedkeys
-        Add trust anchors to the given context.
-        Pass the name of a bind-style config file with ``trusted-keys{}``.
-        At this time it is only possible to add trusted keys before the first
-        resolve is done.
-
-    ub_ctx_debugout
-        Set debug and error log output to the given stream.
-        Pass NULL to disable output.
-        Default is stderr.
-        File-names or using syslog can be enabled using config options, this
-        routine is for using your own stream.
-
-    ub_ctx_debuglevel
-        Set debug verbosity for the context.
-        Output is directed to stderr.
-        Higher debug level gives more output.
-
-    ub_ctx_async
-        Set a context behaviour for asynchronous action.
-        if set to true, enables threading and a call to **ub_resolve_async**
-        creates a thread to handle work in the background.
-        If false, a process is forked to handle work in the background.
-        Changes to this setting after **ub_resolve_async** calls have been made
-        have no effect (delete and re-create the context to change).
-
-    ub_poll
-        Poll a context to see if it has any new results.
-        Do not poll in a loop, instead extract the **fd** below to poll for
-        readiness, and then check, or wait using the wait routine.
-        Returns 0 if nothing to read, or nonzero if a result is available.
-        If nonzero, call **ub_process** to do callbacks.
-
-    ub_wait
-        Wait for a context to finish with results.
-        Calls **ub_process** after the wait for you.
-        After the wait, there are no more outstanding asynchronous queries.
-
-    ub_fd 
-        Get file descriptor.
-        Wait for it to become readable, at this point answers are returned from
-        the asynchronous validating resolver.
-        Then call the **ub_process** to continue processing.
-
-    ub_process
-        Call this routine to continue processing results from the validating
-        resolver (when the **fd** becomes readable).
-        Will perform necessary callbacks.
-
-    ub_resolve
-        Perform resolution and validation of the target name.
-        The name is a domain name in a zero terminated text string.
-        The rrtype and rrclass are DNS type and class codes.
-        The result structure is newly allocated with the resulting data.
-
-    ub_resolve_async
-        Perform asynchronous resolution and validation of the target name.
-        Arguments mean the same as for **ub_resolve** except no data is
-        returned immediately, instead a callback is called later.
-        The callback receives a copy of the mydata pointer, that you can use to
-        pass information to the callback.
-        The callback type is a function pointer to a function declared as:
-
-        .. code-block:: c
-
-            void my_callback_function(void* my_arg, int err,
-                            struct ub_result* result);
-
-        The **async_id** is returned so you can (at your option) decide to
-        track it and cancel the request if needed.
-        If you pass a NULL pointer the **async_id** is not returned.
-
-    ub_cancel
-        Cancel an async query in progress.
-        This may return an error if the query does not exist, or the query is
-        already being delivered, in that case you may still get a callback for
-        the query.
-
-    ub_resolve_free
-        Free struct **ub_result** contents after use.
-
-    ub_strerror
-        Convert error value from one of the unbound library functions to a
-        human readable string.
-
-    ub_ctx_print_local_zones
-        Debug printout the local authority information to debug output.
-
-    ub_ctx_zone_add
-        Add new zone to local authority info, like local-zone
-        :doc:`unbound.conf(5)</manpages/unbound.conf>` statement.
-
-    ub_ctx_zone_remove
-        Delete zone from local authority info.
-
-    ub_ctx_data_add
-        Add resource record data to local authority info, like local-data
-        :doc:`unbound.conf(5)</manpages/unbound.conf>` statement.
-
-    ub_ctx_data_remove
-        Delete local authority data from the name given.
-
-Result Data structure
---------------------
-
-The result of the DNS resolution and validation is returned as *struct
-ub_result*.
-The result structure contains the following entries:
-
-.. code-block:: c
-
-    struct ub_result {
-         char* qname;         /* text string, original question */
-         int qtype;           /* type code asked for */
-         int qclass;          /* class code asked for */
-         char** data;         /* array of rdata items, NULL terminated*/
-         int* len;            /* array with lengths of rdata items */
-         char* canonname;     /* canonical name of result */
-         int rcode;           /* additional error code in case of no data */
-         void* answer_packet; /* full network format answer packet */
-         int answer_len;      /* length of packet in octets */
-         int havedata;        /* true if there is data */
-         int nxdomain;        /* true if nodata because name does not exist */
-         int secure;          /* true if result is secure */
-         int bogus;           /* true if a security failure happened */
-         char* why_bogus;     /* string with error if bogus */
-         int was_ratelimited; /* true if the query was ratelimited (SERVFAIL) by unbound */
-         int ttl;             /* number of seconds the result is valid */
-    };
-
-If both secure and bogus are false, security was not enabled for the domain of
-the query.
-Else, they are not both true, one of them is true.
-
-Return Values
-------------
-
-Many routines return an error code.
-The value 0 (zero) denotes no error happened.
-Other values can be passed to **ub_strerror** to obtain a readable error
-string.
-**ub_strerror** returns a zero terminated string.
-**ub_ctx_create** returns NULL on an error (a malloc failure).
-**ub_poll** returns true if some information may be available, false otherwise.
-**ub_fd** returns a file descriptor or -1 on error.
-**ub_ctx_config** and **ub_ctx_resolvconf** attempt to leave errno informative
-on a function return with file read failure.
-
-See Also
--------
-
-:doc:`unbound.conf(5)</manpages/unbound.conf>`, :doc:`unbound(8)</manpages/unbound>`.
@@ -1,309 +1,189 @@
-.\" Man page generated from reStructuredText.
-.
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.TH "UNBOUND-ANCHOR" "8" "@date@" "@version@" "Unbound"
-.SH NAME
-unbound-anchor \- Unbound @version@ anchor utility.
-.SH SYNOPSIS
-.sp
-\fBunbound\-anchor\fP [\fBopts\fP]
-.SH DESCRIPTION
-.sp
-\fBunbound\-anchor\fP performs setup or update of the root trust anchor for DNSSEC
-validation.
-The program fetches the trust anchor with the method from \fI\%RFC 7958\fP when
-regular \fI\%RFC 5011\fP update fails to bring it up to date.
-It can be run from the commandline, or run as part of startup scripts before
-you start the \fI\%unbound(8)\fP DNS server.
-.sp
-Note that if you want to use \fI\%RFC 5011\fP with Unbound (i.e., the
-\fI\%auto\-trust\-anchor\-file\fP option) so
-that trust anchor information is automatically tracked by Unbound during
-operation, the user that Unbound runs under (by default \(aqunbound\(aq) must have
-write permissions to the file and the directory the file lives in (for creating
-temporary files).
-In this case you would probably want to run this program as the designated
-Unbound user.
-.sp
+.TH "unbound-anchor" "8" "@date@" "NLnet Labs" "unbound @version@"
+.\"
+.\" unbound-anchor.8 -- unbound anchor maintenance utility manual
+.\"
+.\" Copyright (c) 2008, NLnet Labs. All rights reserved.
+.\"
+.\" See LICENSE for the license.
+.\"
+.\"
+.SH "NAME"
+.B unbound\-anchor
+\- Unbound anchor utility.
+.SH "SYNOPSIS"
+.B unbound\-anchor
+.RB [ opts ]
+.SH "DESCRIPTION"
+.B Unbound\-anchor
+performs setup or update of the root trust anchor for DNSSEC validation.
+The program fetches the trust anchor with the method from RFC7958 when
+regular RFC5011 update fails to bring it up to date.
+It can be run (as root) from the commandline, or run as part of startup
+scripts.  Before you start the \fIunbound\fR(8) DNS server.
+.P
 Suggested usage:
-.INDENT 0.0
-.INDENT 3.5
-.sp
+.P
 .nf
-.ft C
-# in the init scripts.
-# provide or update the root anchor (if necessary)
-unbound\-anchor \-a \(dq@UNBOUND_ROOTKEY_FILE@\(dq
-
-# Please note usage of this root anchor is at your own risk
-# and under the terms of our LICENSE (see source).
-#
-# start validating resolver
-# the unbound.conf contains:
-# auto\-trust\-anchor\-file: \(dq@UNBOUND_ROOTKEY_FILE@\(dq
-unbound \-c unbound.conf
-.ft P
+	# in the init scripts.
+	# provide or update the root anchor (if necessary)
+	unbound-anchor \-a "@UNBOUND_ROOTKEY_FILE@"
+	# Please note usage of this root anchor is at your own risk
+	# and under the terms of our LICENSE (see source).
+	#
+	# start validating resolver
+	# the unbound.conf contains:
+	#   auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
+	unbound \-c unbound.conf
 .fi
-.UNINDENT
-.UNINDENT
-.sp
-This tool provides builtin default contents for the root anchor and root update
-certificate files.
-.sp
+.P
+This tool provides builtin default contents for the root anchor and root
+update certificate files.
+.P
 It tests if the root anchor file works, and if not, and an update is possible,
 attempts to update the root anchor using the root update certificate.
-It performs a https fetch of
-\fI\%root\-anchors.xml\fP
-and checks the results (\fI\%RFC 7958\fP); if all checks are successful, it updates
-the root anchor file.
-Otherwise the root anchor file is unchanged.
-It performs \fI\%RFC 5011\fP tracking if the DNSSEC information available via the
-DNS makes that possible.
-.sp
-It does not perform an update if the certificate is expired, if the network is
-down or other errors occur.
-.sp
+It performs a https fetch of root-anchors.xml and checks the results (RFC7958),
+if all checks are successful, it updates the root anchor file.  Otherwise
+the root anchor file is unchanged.  It performs RFC5011 tracking if the
+DNSSEC information available via the DNS makes that possible.
+.P
+It does not perform an update if the certificate is expired, if the network
+is down or other errors occur.
+.P
 The available options are:
-.INDENT 0.0
 .TP
-.B \-a <file>
+.B \-a \fIfile
 The root anchor key file, that is read in and written out.
-Default is \fB@UNBOUND_ROOTKEY_FILE@\fP\&.
-If the file does not exist, or is empty, a builtin root key is written
-to it.
-.UNINDENT
-.INDENT 0.0
+Default is @UNBOUND_ROOTKEY_FILE@.
+If the file does not exist, or is empty, a builtin root key is written to it.
 .TP
-.B \-c <file>
+.B \-c \fIfile
 The root update certificate file, that is read in.
-Default is \fB@UNBOUND_ROOTCERT_FILE@\fP\&.
+Default is @UNBOUND_ROOTCERT_FILE@.
 If the file does not exist, or is empty, a builtin certificate is used.
-.UNINDENT
-.INDENT 0.0
 .TP
 .B \-l
 List the builtin root key and builtin root update certificate on stdout.
-.UNINDENT
-.INDENT 0.0
 .TP
-.B \-u <name>
-The server name, it connects to \fBhttps://name\fP\&.
-Specify without \fBhttps://\fP prefix.
-The default is \fB\(dqdata.iana.org\(dq\fP\&.
-It connects to the port specified with \fI\%\-P\fP\&.
+.B \-u \fIname
+The server name, it connects to https://name.  Specify without https:// prefix.
+The default is "data.iana.org".  It connects to the port specified with \-P.
 You can pass an IPv4 address or IPv6 address (no brackets) if you want.
-.UNINDENT
-.INDENT 0.0
 .TP
 .B \-S
-Do not use SNI for the HTTPS connection.
-Default is to use SNI.
-.UNINDENT
-.INDENT 0.0
+Do not use SNI for the HTTPS connection.  Default is to use SNI.
 .TP
-.B \-b <address>
-The source address to bind to for domain resolution and contacting the
-server on https.
-May be either an IPv4 address or IPv6 address (no brackets).
-.UNINDENT
-.INDENT 0.0
+.B \-b \fIaddress
+The source address to bind to for domain resolution and contacting the server
+on https.  May be either an IPv4 address or IPv6 address (no brackets).
 .TP
-.B \-x <path>
-The pathname to the root\-anchors.xml file on the server.
-(forms URL with \fI\%\-u\fP).
-The default is \fB/root\-anchors/root\-anchors.xml\fP\&.
-.UNINDENT
-.INDENT 0.0
+.B \-x \fIpath
+The pathname to the root\-anchors.xml file on the server. (forms URL with \-u).
+The default is /root\-anchors/root\-anchors.xml.
 .TP
-.B \-s <path>
-The pathname to the root\-anchors.p7s file on the server.
-(forms URL with \fI\%\-u\fP).
-The default is \fB/root\-anchors/root\-anchors.p7s\fP\&.
-This file has to be a PKCS7 signature over the xml file, using the pem
-file (\fI\%\-c\fP) as trust anchor.
-.UNINDENT
-.INDENT 0.0
+.B \-s \fIpath
+The pathname to the root\-anchors.p7s file on the server. (forms URL with \-u).
+The default is /root\-anchors/root\-anchors.p7s.  This file has to be a PKCS7
+signature over the xml file, using the pem file (\-c) as trust anchor.
 .TP
-.B \-n <name>
-The emailAddress for the Subject of the signer\(aqs certificate from the
-p7s signature file.
-Only signatures from this name are allowed.
-The default is \fBdnssec@iana.org\fP\&.
-If you pass \fB\(dq\(dq\fP then the emailAddress is not checked.
-.UNINDENT
-.INDENT 0.0
+.B \-n \fIname
+The emailAddress for the Subject of the signer's certificate from the p7s
+signature file.  Only signatures from this name are allowed.  default is
+dnssec@iana.org.  If you pass "" then the emailAddress is not checked.
 .TP
 .B \-4
-Use IPv4 for domain resolution and contacting the server on
-https.
-Default is to use IPv4 and IPv6 where appropriate.
-.UNINDENT
-.INDENT 0.0
+Use IPv4 for domain resolution and contacting the server on https.  Default is
+to use IPv4 and IPv6 where appropriate.
 .TP
 .B \-6
-Use IPv6 for domain resolution and contacting the server on https.
-Default is to use IPv4 and IPv6 where appropriate.
-.UNINDENT
-.INDENT 0.0
+Use IPv6 for domain resolution and contacting the server on https.  Default is
+to use IPv4 and IPv6 where appropriate.
 .TP
-.B \-f <resolv.conf>
-Use the given resolv.conf file.
-Not enabled by default, but you could try to pass
-\fB/etc/resolv.conf\fP on some systems.
-It contains the IP addresses of the recursive nameservers to use.
-However, since this tool could be used to bootstrap that very recursive
-nameserver, it would not be useful (since that server is not up yet,
-since we are bootstrapping it).
-It could be useful in a situation where you know an upstream cache is
-deployed (and running) and in captive portal situations.
-.UNINDENT
-.INDENT 0.0
+.B \-f \fIresolv.conf
+Use the given resolv.conf file.  Not enabled by default, but you could try to
+pass /etc/resolv.conf on some systems.  It contains the IP addresses of the
+recursive nameservers to use.  However, since this tool could be used to
+bootstrap that very recursive nameserver, it would not be useful (since
+that server is not up yet, since we are bootstrapping it).  It could be
+useful in a situation where you know an upstream cache is deployed (and
+running) and in captive portal situations.
 .TP
-.B \-r <root.hints>
-Use the given root.hints file (same syntax as the BIND and Unbound root
-hints file) to bootstrap domain resolution.
-By default a list of builtin root hints is used.
-unbound\-anchor goes to the network itself for these roots, to resolve
-the server (\fI\%\-u\fP option) and to check the root DNSKEY records.
+.B \-r \fIroot.hints
+Use the given root.hints file (same syntax as the BIND and Unbound root hints
+file) to bootstrap domain resolution.  By default a list of builtin root
+hints is used.  Unbound\-anchor goes to the network itself for these roots,
+to resolve the server (\-u option) and to check the root DNSKEY records.
 It does so, because the tool when used for bootstrapping the recursive
-resolver, cannot use that recursive resolver itself because it is
-bootstrapping that server.
-.UNINDENT
-.INDENT 0.0
+resolver, cannot use that recursive resolver itself because it is bootstrapping
+that server.
 .TP
 .B \-R
-Allow fallback from \fI\%\-f\fP \fB<resolv.conf>\fP file to direct root
-servers query.
-It allows you to prefer local resolvers, but fallback automatically to
-direct root query if they do not respond or do not support DNSSEC.
-.UNINDENT
-.INDENT 0.0
+Allow fallback from \-f resolv.conf file to direct root servers query.
+It allows you to prefer local resolvers, but fallback automatically
+to direct root query if they do not respond or do not support DNSSEC.
 .TP
 .B \-v
-More verbose.
-Once prints informational messages, multiple times may enable large
-debug amounts (such as full certificates or byte\-dumps of downloaded
-files).
-By default it prints almost nothing.
-It also prints nothing on errors by default; in that case the original
-root anchor file is simply left undisturbed, so that a recursive server
-can start right after it.
-.UNINDENT
-.INDENT 0.0
+More verbose. Once prints informational messages, multiple times may enable
+large debug amounts (such as full certificates or byte\-dumps of downloaded
+files).  By default it prints almost nothing.  It also prints nothing on
+errors by default; in that case the original root anchor file is simply
+left undisturbed, so that a recursive server can start right after it.
 .TP
-.B \-C <unbound.conf>
-Debug option to read \fB<unbound.conf>\fP into the resolver process
-used.
-.UNINDENT
-.INDENT 0.0
+.B \-C \fIunbound.conf
+Debug option to read unbound.conf into the resolver process used.
 .TP
-.B \-P <port>
-Set the port number to use for the https connection.
-The default is 443.
-.UNINDENT
-.INDENT 0.0
+.B \-P \fIport
+Set the port number to use for the https connection.  The default is 443.
 .TP
 .B \-F
-Debug option to force update of the root anchor through downloading the
-xml file and verifying it with the certificate.
-By default it first tries to update by contacting the DNS, which uses
-much less bandwidth, is much faster (200 msec not 2 sec), and is nicer
-to the deployed infrastructure.
-With this option, it still attempts to do so (and may verbosely tell
-you), but then ignores the result and goes on to use the xml fallback
-method.
-.UNINDENT
-.INDENT 0.0
+Debug option to force update of the root anchor through downloading the xml
+file and verifying it with the certificate.  By default it first tries to
+update by contacting the DNS, which uses much less bandwidth, is much
+faster (200 msec not 2 sec), and is nicer to the deployed infrastructure.
+With this option, it still attempts to do so (and may verbosely tell you),
+but then ignores the result and goes on to use the xml fallback method.
 .TP
 .B \-h
 Show the version and commandline option help.
-.UNINDENT
-.SH EXIT CODE
-.sp
+.SH "EXIT CODE"
 This tool exits with value 1 if the root anchor was updated using the
-certificate or if the builtin root\-anchor was used.
-It exits with code 0 if no update was necessary, if the update was possible
-with \fI\%RFC 5011\fP tracking, or if an error occurred.
-.sp
+certificate or if the builtin root-anchor was used.  It exits with code
+0 if no update was necessary, if the update was possible with RFC5011
+tracking, or if an error occurred.
+.P
 You can check the exit value in this manner:
-.INDENT 0.0
-.INDENT 3.5
-.sp
 .nf
-.ft C
-unbound\-anchor \-a \(dqroot.key\(dq || logger \(dqPlease check root.key\(dq
-.ft P
+	unbound-anchor \-a "root.key" || logger "Please check root.key"
 .fi
-.UNINDENT
-.UNINDENT
-.sp
 Or something more suitable for your operational environment.
-.SH TRUST
-.sp
-The root keys and update certificate included in this tool are provided for
-convenience and under the terms of our license (see the LICENSE file in the
-source distribution or \fI\%https://github.com/NLnetLabs/unbound/blob/master/LICENSE\fP
-and might be stale or not suitable to your purpose.
-.sp
-By running \fI\%unbound\-anchor \-l\fP the keys and certificate that are
+.SH "TRUST"
+The root keys and update certificate included in this tool
+are provided for convenience and under the terms of our
+license (see the LICENSE file in the source distribution or
+https://github.com/NLnetLabs/unbound/blob/master/LICENSE) and might be stale or
+not suitable to your purpose.
+.P
+By running "unbound\-anchor \-l" the  keys and certificate that are
 configured in the code are printed for your convenience.
-.sp
-The built\-in configuration can be overridden by providing a root\-cert file and
-a rootkey file.
-.SH FILES
-.INDENT 0.0
+.P
+The build\-in configuration can be overridden by providing a root\-cert
+file and a rootkey file.
+.SH "FILES"
 .TP
-.B @UNBOUND_ROOTKEY_FILE@
-The root anchor file, updated with 5011 tracking, and read and written
-to.
+.I @UNBOUND_ROOTKEY_FILE@
+The root anchor file, updated with 5011 tracking, and read and written to.
 The file is created if it does not exist.
 .TP
-.B @UNBOUND_ROOTCERT_FILE@
-The trusted self\-signed certificate that is used to verify the
-downloaded DNSSEC root trust anchor.
-You can update it by fetching it from
-\fI\%https://data.iana.org/root\-anchors/icannbundle.pem\fP (and validate it).
+.I @UNBOUND_ROOTCERT_FILE@
+The trusted self\-signed certificate that is used to verify the downloaded
+DNSSEC root trust anchor.  You can update it by fetching it from
+https://data.iana.org/root\-anchors/icannbundle.pem (and validate it).
 If the file does not exist or is empty, a builtin version is used.
 .TP
-.B \fI\%https://data.iana.org/root\-anchors/root\-anchors.xml\fP
+.I https://data.iana.org/root\-anchors/root\-anchors.xml
 Source for the root key information.
 .TP
-.B \fI\%https://data.iana.org/root\-anchors/root\-anchors.p7s\fP
+.I https://data.iana.org/root\-anchors/root\-anchors.p7s
 Signature on the root key information.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fI\%unbound.conf(5)\fP,
-\fI\%unbound(8)\fP\&.
-.SH AUTHOR
-Unbound developers are mentioned in the CREDITS file in the distribution.
-.SH COPYRIGHT
-1999-2026, NLnet Labs
-.\" Generated by docutils manpage writer.
-.
+.SH "SEE ALSO"
+\fIunbound.conf\fR(5),
+\fIunbound\fR(8).
@@ -1,290 +0,0 @@
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-.. program:: unbound-anchor
-
-unbound-anchor(8)
-=================
-
-Synopsis
--------
-
-**unbound-anchor** [``opts``]
-
-Description
-----------
-
-``unbound-anchor`` performs setup or update of the root trust anchor for DNSSEC
-validation.
-The program fetches the trust anchor with the method from :rfc:`7958` when
-regular :rfc:`5011` update fails to bring it up to date.
-It can be run from the commandline, or run as part of startup scripts before
-you start the :doc:`unbound(8)</manpages/unbound>` DNS server.
-
-Note that if you want to use :rfc:`5011` with Unbound (i.e., the
-:ref:`auto-trust-anchor-file<unbound.conf.auto-trust-anchor-file>` option) so
-that trust anchor information is automatically tracked by Unbound during
-operation, the user that Unbound runs under (by default 'unbound') must have
-write permissions to the file and the directory the file lives in (for creating
-temporary files).
-In this case you would probably want to run this program as the designated
-Unbound user.
-
-Suggested usage:
-
-.. code-block:: text
-
-   # in the init scripts.
-   # provide or update the root anchor (if necessary)
-   unbound-anchor -a "@UNBOUND_ROOTKEY_FILE@"
-
-   # Please note usage of this root anchor is at your own risk
-   # and under the terms of our LICENSE (see source).
-   #
-   # start validating resolver
-   # the unbound.conf contains:
-   # auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
-   unbound -c unbound.conf
-
-This tool provides builtin default contents for the root anchor and root update
-certificate files.
-
-It tests if the root anchor file works, and if not, and an update is possible,
-attempts to update the root anchor using the root update certificate.
-It performs a https fetch of
-`root-anchors.xml <http://data.iana.org/root-anchors/root-anchors.xml>`__
-and checks the results (:rfc:`7958`); if all checks are successful, it updates
-the root anchor file.
-Otherwise the root anchor file is unchanged.
-It performs :rfc:`5011` tracking if the DNSSEC information available via the
-DNS makes that possible.
-
-It does not perform an update if the certificate is expired, if the network is
-down or other errors occur.
-
-The available options are:
-
-.. option:: -a <file>
-
-       The root anchor key file, that is read in and written out.
-       Default is :file:`@UNBOUND_ROOTKEY_FILE@`.
-       If the file does not exist, or is empty, a builtin root key is written
-       to it.
-
-.. option:: -c <file>
-
-       The root update certificate file, that is read in.
-       Default is :file:`@UNBOUND_ROOTCERT_FILE@`.
-       If the file does not exist, or is empty, a builtin certificate is used.
-
-.. option:: -l
-
-       List the builtin root key and builtin root update certificate on stdout.
-
-.. option:: -u <name>
-
-       The server name, it connects to ``https://name``.
-       Specify without ``https://`` prefix.
-       The default is ``"data.iana.org"``.
-       It connects to the port specified with :option:`-P`.
-       You can pass an IPv4 address or IPv6 address (no brackets) if you want.
-
-.. option:: -S
-
-       Do not use SNI for the HTTPS connection.
-       Default is to use SNI.
-
-.. option:: -b <address>
-
-       The source address to bind to for domain resolution and contacting the
-       server on https.
-       May be either an IPv4 address or IPv6 address (no brackets).
-
-.. option:: -x <path>
-
-       The pathname to the root-anchors.xml file on the server.
-       (forms URL with :option:`-u`).
-       The default is :file:`/root-anchors/root-anchors.xml`.
-
-.. option:: -s <path>
-
-       The pathname to the root-anchors.p7s file on the server.
-       (forms URL with :option:`-u`).
-       The default is :file:`/root-anchors/root-anchors.p7s`.
-       This file has to be a PKCS7 signature over the xml file, using the pem
-       file (:option:`-c`) as trust anchor.
-
-.. option:: -n <name>
-
-       The emailAddress for the Subject of the signer's certificate from the
-       p7s signature file.
-       Only signatures from this name are allowed.
-       The default is ``dnssec@iana.org``.
-       If you pass ``""`` then the emailAddress is not checked.
-
-.. option:: -4
-
-       Use IPv4 for domain resolution and contacting the server on
-       https.
-       Default is to use IPv4 and IPv6 where appropriate.
-
-.. option:: -6
-
-       Use IPv6 for domain resolution and contacting the server on https.
-       Default is to use IPv4 and IPv6 where appropriate.
-
-.. option:: -f <resolv.conf>
-
-       Use the given resolv.conf file.
-       Not enabled by default, but you could try to pass
-       :file:`/etc/resolv.conf` on some systems.
-       It contains the IP addresses of the recursive nameservers to use.
-       However, since this tool could be used to bootstrap that very recursive
-       nameserver, it would not be useful (since that server is not up yet,
-       since we are bootstrapping it).
-       It could be useful in a situation where you know an upstream cache is
-       deployed (and running) and in captive portal situations.
-
-.. option:: -r <root.hints>
-
-       Use the given root.hints file (same syntax as the BIND and Unbound root
-       hints file) to bootstrap domain resolution.
-       By default a list of builtin root hints is used.
-       unbound-anchor goes to the network itself for these roots, to resolve
-       the server (:option:`-u` option) and to check the root DNSKEY records.
-       It does so, because the tool when used for bootstrapping the recursive
-       resolver, cannot use that recursive resolver itself because it is
-       bootstrapping that server.
-
-.. option:: -R
-
-       Allow fallback from :option:`-f` ``<resolv.conf>`` file to direct root
-       servers query.
-       It allows you to prefer local resolvers, but fallback automatically to
-       direct root query if they do not respond or do not support DNSSEC.
-
-.. option:: -v
-
-       More verbose.
-       Once prints informational messages, multiple times may enable large
-       debug amounts (such as full certificates or byte-dumps of downloaded
-       files).
-       By default it prints almost nothing.
-       It also prints nothing on errors by default; in that case the original
-       root anchor file is simply left undisturbed, so that a recursive server
-       can start right after it.
-
-.. option:: -C <unbound.conf>
-
-       Debug option to read :file:`<unbound.conf>` into the resolver process
-       used.
-
-.. option:: -P <port>
-
-       Set the port number to use for the https connection.
-       The default is 443.
-
-.. option:: -F
-
-       Debug option to force update of the root anchor through downloading the
-       xml file and verifying it with the certificate.
-       By default it first tries to update by contacting the DNS, which uses
-       much less bandwidth, is much faster (200 msec not 2 sec), and is nicer
-       to the deployed infrastructure.
-       With this option, it still attempts to do so (and may verbosely tell
-       you), but then ignores the result and goes on to use the xml fallback
-       method.
-
-.. option:: -h
-
-       Show the version and commandline option help.
-
-Exit Code
---------
-
-This tool exits with value 1 if the root anchor was updated using the
-certificate or if the builtin root-anchor was used.
-It exits with code 0 if no update was necessary, if the update was possible
-with :rfc:`5011` tracking, or if an error occurred.
-
-You can check the exit value in this manner:
-
-.. code-block:: text
-
-       unbound-anchor -a "root.key" || logger "Please check root.key"
-
-Or something more suitable for your operational environment.
-
-Trust
-----
-
-The root keys and update certificate included in this tool are provided for
-convenience and under the terms of our license (see the LICENSE file in the
-source distribution or https://github.com/NLnetLabs/unbound/blob/master/LICENSE
-and might be stale or not suitable to your purpose.
-
-By running :option:`unbound-anchor -l` the keys and certificate that are
-configured in the code are printed for your convenience.
-
-The built-in configuration can be overridden by providing a root-cert file and
-a rootkey file.
-
-Files
-----
-
-@UNBOUND_ROOTKEY_FILE@
-       The root anchor file, updated with 5011 tracking, and read and written
-       to.
-       The file is created if it does not exist.
-
-@UNBOUND_ROOTCERT_FILE@
-       The trusted self-signed certificate that is used to verify the
-       downloaded DNSSEC root trust anchor.
-       You can update it by fetching it from
-       https://data.iana.org/root-anchors/icannbundle.pem (and validate it).
-       If the file does not exist or is empty, a builtin version is used.
-
-https://data.iana.org/root-anchors/root-anchors.xml
-       Source for the root key information.
-
-https://data.iana.org/root-anchors/root-anchors.p7s
-       Signature on the root key information.
-
-See Also
--------
-
-:doc:`unbound.conf(5)</manpages/unbound.conf>`,
-:doc:`unbound(8)</manpages/unbound>`.
@@ -1,93 +1,56 @@
-.\" Man page generated from reStructuredText.
-.
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.TH "UNBOUND-CHECKCONF" "8" "@date@" "@version@" "Unbound"
-.SH NAME
-unbound-checkconf \- Check Unbound @version@ configuration file for errors.
-.SH SYNOPSIS
-.sp
-\fBunbound\-checkconf\fP [\fB\-hf\fP] [\fB\-o option\fP] [cfgfile]
-.SH DESCRIPTION
-.sp
-\fBunbound\-checkconf\fP checks the configuration file for the
-\fI\%unbound(8)\fP DNS resolver for syntax and other errors.
+.TH "unbound-checkconf" "8" "@date@" "NLnet Labs" "unbound @version@"
+.\"
+.\" unbound-checkconf.8 -- unbound configuration checker manual
+.\"
+.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
+.\"
+.\" See LICENSE for the license.
+.\"
+.\"
+.SH "NAME"
+unbound\-checkconf
+\- Check Unbound configuration file for errors.
+.SH "SYNOPSIS"
+.B unbound\-checkconf
+.RB [ \-h ]
+.RB [ \-f ]
+.RB [ \-q ]
+.RB [ \-o
+.IR option ]
+.RI [ cfgfile ]
+.SH "DESCRIPTION"
+.B Unbound\-checkconf
+checks the configuration file for the
+\fIunbound\fR(8)
+DNS resolver for syntax and other errors.
 The config file syntax is described in
-\fI\%unbound.conf(5)\fP\&.
-.sp
+\fIunbound.conf\fR(5).
+.P
 The available options are:
-.INDENT 0.0
 .TP
 .B \-h
 Show the version and commandline option help.
-.UNINDENT
-.INDENT 0.0
 .TP
 .B \-f
-Print full pathname, with chroot applied to it.
-Use with the \fI\%\-o\fP option.
-.UNINDENT
-.INDENT 0.0
+Print full pathname, with chroot applied to it.  Use with the \-o option.
+.TP
+.B \-o\fI option
+If given, after checking the config file the value of this option is
+printed to stdout.  For "" (disabled) options an empty line is printed.
 .TP
 .B \-q
 Make the operation quiet, suppress output on success.
-.UNINDENT
-.INDENT 0.0
 .TP
-.B \-o <option>
-If given, after checking the config file the value of this option is
-printed to stdout.
-For \fB\(dq\(dq\fP (disabled) options an empty line is printed.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B cfgfile
-The config file to read with settings for Unbound.
-It is checked.
+.I cfgfile
+The config file to read with settings for Unbound. It is checked.
 If omitted, the config file at the default location is checked.
-.UNINDENT
-.SH EXIT CODE
-.sp
-The \fBunbound\-checkconf\fP program exits with status code 1 on error, 0 for a
-correct config file.
-.SH FILES
-.INDENT 0.0
+.SH "EXIT CODE"
+The unbound\-checkconf program exits with status code 1 on error,
+0 for a correct config file.
+.SH "FILES"
 .TP
-.B @ub_conf_file@
+.I @ub_conf_file@
 Unbound configuration file.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fI\%unbound.conf(5)\fP,
-\fI\%unbound(8)\fP\&.
-.SH AUTHOR
-Unbound developers are mentioned in the CREDITS file in the distribution.
-.SH COPYRIGHT
-1999-2026, NLnet Labs
-.\" Generated by docutils manpage writer.
-.
+.SH "SEE ALSO"
+\fIunbound.conf\fR(5),
+\fIunbound\fR(8).
@@ -1,98 +0,0 @@
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-.. program:: unbound-checkconf
-
-unbound-checkconf(8)
-====================
-
-Synopsis
--------
-
-**unbound-checkconf** [``-hf``] [``-o option``] [cfgfile]
-
-Description
-----------
-
-``unbound-checkconf`` checks the configuration file for the
-:doc:`unbound(8)</manpages/unbound>` DNS resolver for syntax and other errors.
-The config file syntax is described in
-:doc:`unbound.conf(5)</manpages/unbound.conf>`.
-
-The available options are:
-
-.. option:: -h
-
-    Show the version and commandline option help.
-
-.. option:: -f
-
-    Print full pathname, with chroot applied to it.
-    Use with the :option:`-o` option.
-
-.. option:: -q
-
-    Make the operation quiet, suppress output on success.
-
-.. option:: -o <option>
-
-    If given, after checking the config file the value of this option is
-    printed to stdout.
-    For ``""`` (disabled) options an empty line is printed.
-
-.. option:: cfgfile
-
-    The config file to read with settings for Unbound.
-    It is checked.
-    If omitted, the config file at the default location is checked.
-
-Exit Code
---------
-
-The ``unbound-checkconf`` program exits with status code 1 on error, 0 for a
-correct config file.
-
-Files
-----
-
-@ub_conf_file@
-    Unbound configuration file.
-
-See Also
--------
-
-:doc:`unbound.conf(5)</manpages/unbound.conf>`,
-:doc:`unbound(8)</manpages/unbound>`.
@@ -1,190 +1,118 @@
-.\" Man page generated from reStructuredText.
-.
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.TH "UNBOUND-HOST" "1" "@date@" "@version@" "Unbound"
-.SH NAME
-unbound-host \- Unbound @version@ DNS lookup utility.
-.SH SYNOPSIS
-.sp
-\fBunbound\-host\fP [\fB\-C configfile\fP] [\fB\-vdhr46D\fP] [\fB\-c class\fP]
-[\fB\-t type\fP] [\fB\-y key\fP] [\fB\-f keyfile\fP] [\fB\-F namedkeyfile\fP] hostname
-.SH DESCRIPTION
-.sp
-\fBunbound\-host\fP uses the Unbound validating resolver to query for the hostname
-and display results.
-With the \fI\%\-v\fP option it displays validation status: secure, insecure,
-bogus (security failure).
-.sp
-By default it reads no configuration file whatsoever.
-It attempts to reach the internet root servers.
-With \fI\%\-C\fP an unbound config file and with \fI\%\-r\fP \fBresolv.conf\fP
-can be read.
-.sp
+.TH "unbound\-host" "1" "@date@" "NLnet Labs" "unbound @version@"
+.\"
+.\" unbound-host.1 -- unbound DNS lookup utility
+.\"
+.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
+.\"
+.\" See LICENSE for the license.
+.\"
+.\"
+.SH "NAME"
+.B unbound\-host
+\- unbound DNS lookup utility
+.SH "SYNOPSIS"
+.B unbound\-host
+.RB [ \-C
+.IR configfile ]
+.RB [ \-vdhr46D ]
+.RB [ \-c
+.IR class ]
+.RB [ \-t
+.IR type ]
+.RB [ \-y
+.IR key ]
+.RB [ \-f
+.IR keyfile ]
+.RB [ \-F
+.IR namedkeyfile ]
+.I hostname
+.SH "DESCRIPTION"
+.B Unbound\-host
+uses the Unbound validating resolver to query for the hostname and display
+results. With the \fB\-v\fR option it displays validation
+status: secure, insecure, bogus (security failure).
+.P
+By default it reads no configuration file whatsoever.  It attempts to reach
+the internet root servers.  With \fB\-C\fR an Unbound config file and with
+\fB\-r\fR resolv.conf can be read.
+.P
 The available options are:
-.INDENT 0.0
 .TP
-.B hostname
+.I hostname
 This name is resolved (looked up in the DNS).
 If a IPv4 or IPv6 address is given, a reverse lookup is performed.
-.UNINDENT
-.INDENT 0.0
 .TP
 .B \-h
 Show the version and commandline option help.
-.UNINDENT
-.INDENT 0.0
 .TP
 .B \-v
 Enable verbose output and it shows validation results, on every line.
-Secure means that the NXDOMAIN (no such domain name), nodata (no such
-data) or positive data response validated correctly with one of the
-keys.
+Secure means that the NXDOMAIN (no such domain name), nodata (no such data)
+or positive data response validated correctly with one of the keys.
 Insecure means that that domain name has no security set up for it.
-Bogus (security failure) means that the response failed one or more
-checks, it is likely wrong, outdated, tampered with, or broken.
-.UNINDENT
-.INDENT 0.0
+Bogus (security failure) means that the response failed one or more checks,
+it is likely wrong, outdated, tampered with, or broken.
 .TP
 .B \-d
-Enable debug output to stderr.
-One \fI\%\-d\fP shows what the resolver and validator are doing and may
-tell you what is going on.
-More times, \fI\%\-d\fP \fI\%\-d\fP, gives a lot of output, with every
-packet sent and received.
-.UNINDENT
-.INDENT 0.0
+Enable debug output to stderr. One \-d shows what the resolver and validator
+are doing and may tell you what is going on. More times, \-d \-d, gives a
+lot of output, with every packet sent and received.
 .TP
-.B \-c <class>
-Specify the class to lookup for, the default is IN the internet
-class.
-.UNINDENT
-.INDENT 0.0
+.B \-c \fIclass
+Specify the class to lookup for, the default is IN the internet class.
 .TP
-.B \-t <type>
-Specify the type of data to lookup.
-The default looks for IPv4, IPv6 and mail handler data, or domain name
-pointers for reverse queries.
-.UNINDENT
-.INDENT 0.0
+.B \-t \fItype
+Specify the type of data to lookup. The default looks for IPv4, IPv6 and
+mail handler data, or domain name pointers for reverse queries.
 .TP
-.B \-y <key>
-Specify a public key to use as trust anchor.
-This is the base for a chain of trust that is built up from the trust
-anchor to the response, in order to validate the response message.
-Can be given as a DS or DNSKEY record.
-For example:
-.INDENT 7.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-\-y \(dqexample.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD\(dq
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.UNINDENT
-.INDENT 0.0
+.B \-y \fIkey
+Specify a public key to use as trust anchor. This is the base for a chain
+of trust that is built up from the trust anchor to the response, in order
+to validate the response message. Can be given as a DS or DNSKEY record.
+For example \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD".
 .TP
 .B \-D
-Enables DNSSEC validation.
-Reads the root anchor from the default configured root anchor at the
-default location, \fB@UNBOUND_ROOTKEY_FILE@\fP\&.
-.UNINDENT
-.INDENT 0.0
+Enables DNSSEC validation.  Reads the root anchor from the default configured
+root anchor at the default location, \fI@UNBOUND_ROOTKEY_FILE@\fR.
 .TP
-.B \-f <keyfile>
-Reads keys from a file.
-Every line has a DS or DNSKEY record, in the format as for \fI\%\-y\fP\&.
-The zone file format, the same as \fBdig\fP and \fBdrill\fP produce.
-.UNINDENT
-.INDENT 0.0
+.B \-f \fIkeyfile
+Reads keys from a file. Every line has a DS or DNSKEY record, in the format
+as for \-y. The zone file format, the same as dig and drill produce.
 .TP
-.B \-F <namedkeyfile>
-Reads keys from a BIND\-style \fBnamed.conf\fP file.
-Only the \fBtrusted\-key {};\fP entries are read.
-.UNINDENT
-.INDENT 0.0
+.B \-F \fInamedkeyfile
+Reads keys from a BIND\-style named.conf file. Only the trusted\-key {}; entries
+are read.
 .TP
-.B \-C <configfile>
-Uses the specified unbound.conf to prime \fI\%libunbound(3)\fP\&.
+.B \-C \fIconfigfile
+Uses the specified unbound.conf to prime
+.IR libunbound (3).
 Pass it as first argument if you want to override some options from the
 config file with further arguments on the commandline.
-.UNINDENT
-.INDENT 0.0
 .TP
 .B \-r
-Read \fB/etc/resolv.conf\fP, and use the forward DNS servers from
-there (those could have been set by DHCP).
-More info in \fIresolv.conf(5)\fP\&.
+Read /etc/resolv.conf, and use the forward DNS servers from there (those could
+have been set by DHCP).  More info in
+.IR resolv.conf (5).
 Breaks validation if those servers do not support DNSSEC.
-.UNINDENT
-.INDENT 0.0
 .TP
 .B \-4
 Use solely the IPv4 network for sending packets.
-.UNINDENT
-.INDENT 0.0
 .TP
 .B \-6
 Use solely the IPv6 network for sending packets.
-.UNINDENT
-.SH EXAMPLES
-.sp
-Some examples of use.
-The keys shown below are fakes, thus a security failure is encountered.
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
+.SH "EXAMPLES"
+Some examples of use. The keys shown below are fakes, thus a security failure
+is encountered.
+.P
 $ unbound\-host www.example.com
-
-$ unbound\-host \-v \-y \(dqexample.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD\(dq www.example.com
-
-$ unbound\-host \-v \-y \(dqexample.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD\(dq 192.0.2.153
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SH EXIT CODE
-.sp
-The \fBunbound\-host\fP program exits with status code 1 on error, 0 on no error.
-The data may not be available on exit code 0, exit code 1 means the lookup
-encountered a fatal error.
-.SH SEE ALSO
-.sp
-\fI\%unbound.conf(5)\fP,
-\fI\%unbound(8)\fP\&.
-.SH AUTHOR
-Unbound developers are mentioned in the CREDITS file in the distribution.
-.SH COPYRIGHT
-1999-2026, NLnet Labs
-.\" Generated by docutils manpage writer.
-.
+.P
+$ unbound\-host \-v \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" www.example.com
+.P
+$ unbound\-host \-v \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" 192.0.2.153
+.SH "EXIT CODE"
+The unbound\-host program exits with status code 1 on error,
+0 on no error. The data may not be available on exit code 0, exit code 1
+means the lookup encountered a fatal error.
+.SH "SEE ALSO"
+\fIunbound.conf\fR(5),
+\fIunbound\fR(8).
@@ -1,176 +0,0 @@
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-.. program:: unbound-host
-
-unbound-host(1)
-===============
-
-Synopsis
--------
-
-**unbound-host** [``-C configfile``] [``-vdhr46D``] [``-c class``]
-[``-t type``] [``-y key``] [``-f keyfile``] [``-F namedkeyfile``] hostname
-
-Description
-----------
-
-``unbound-host`` uses the Unbound validating resolver to query for the hostname
-and display results.
-With the :option:`-v` option it displays validation status: secure, insecure,
-bogus (security failure).
-
-By default it reads no configuration file whatsoever.
-It attempts to reach the internet root servers.
-With :option:`-C` an unbound config file and with :option:`-r` ``resolv.conf``
-can be read.
-
-The available options are:
-
-.. option:: hostname
-
-       This name is resolved (looked up in the DNS).
-       If a IPv4 or IPv6 address is given, a reverse lookup is performed.
-
-.. option:: -h
-
-       Show the version and commandline option help.
-
-.. option:: -v
-
-       Enable verbose output and it shows validation results, on every line.
-       Secure means that the NXDOMAIN (no such domain name), nodata (no such
-       data) or positive data response validated correctly with one of the
-       keys.
-       Insecure means that that domain name has no security set up for it.
-       Bogus (security failure) means that the response failed one or more
-       checks, it is likely wrong, outdated, tampered with, or broken.
-
-.. option:: -d
-
-       Enable debug output to stderr.
-       One :option:`-d` shows what the resolver and validator are doing and may
-       tell you what is going on.
-       More times, :option:`-d` :option:`-d`, gives a lot of output, with every
-       packet sent and received.
-
-.. option:: -c <class>
-
-       Specify the class to lookup for, the default is IN the internet
-       class.
-
-.. option:: -t <type>
-
-       Specify the type of data to lookup.
-       The default looks for IPv4, IPv6 and mail handler data, or domain name
-       pointers for reverse queries.
-
-.. option:: -y <key>
-
-       Specify a public key to use as trust anchor.
-       This is the base for a chain of trust that is built up from the trust
-       anchor to the response, in order to validate the response message.
-       Can be given as a DS or DNSKEY record.
-       For example:
-
-       .. code-block:: text
-
-            -y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD"
-
-.. option:: -D
-
-       Enables DNSSEC validation.
-       Reads the root anchor from the default configured root anchor at the
-       default location, :file:`@UNBOUND_ROOTKEY_FILE@`.
-
-.. option:: -f <keyfile>
-
-       Reads keys from a file.
-       Every line has a DS or DNSKEY record, in the format as for :option:`-y`.
-       The zone file format, the same as ``dig`` and ``drill`` produce.
-
-.. option:: -F <namedkeyfile>
-
-       Reads keys from a BIND-style :file:`named.conf` file.
-       Only the ``trusted-key {};`` entries are read.
-
-.. option:: -C <configfile>
-
-       Uses the specified unbound.conf to prime :doc:`libunbound(3)</manpages/libunbound>`.
-       Pass it as first argument if you want to override some options from the
-       config file with further arguments on the commandline.
-
-.. option:: -r
-
-       Read :file:`/etc/resolv.conf`, and use the forward DNS servers from
-       there (those could have been set by DHCP).
-       More info in *resolv.conf(5)*.
-       Breaks validation if those servers do not support DNSSEC.
-
-.. option:: -4
-
-       Use solely the IPv4 network for sending packets.
-
-.. option:: -6
-
-       Use solely the IPv6 network for sending packets.
-
-Examples
--------
-
-Some examples of use.
-The keys shown below are fakes, thus a security failure is encountered.
-
-.. code-block:: text
-
-       $ unbound-host www.example.com
-
-       $ unbound-host -v -y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" www.example.com
-
-       $ unbound-host -v -y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" 192.0.2.153
-
-Exit Code
---------
-
-The ``unbound-host`` program exits with status code 1 on error, 0 on no error.
-The data may not be available on exit code 0, exit code 1 means the lookup
-encountered a fatal error.
-
-See Also
--------
-
-:doc:`unbound.conf(5)</manpages/unbound.conf>`,
-:doc:`unbound(8)</manpages/unbound>`.
@@ -1,123 +1,88 @@
-.\" Man page generated from reStructuredText.
-.
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.TH "UNBOUND" "8" "@date@" "@version@" "Unbound"
-.SH NAME
-unbound \- Unbound DNS validating resolver @version@.
-.SH SYNOPSIS
-.sp
-\fBunbound\fP [\fB\-hdpVv\fP] [\fB\-c <cfgfile>\fP]
-.SH DESCRIPTION
-.sp
-\fBunbound\fP is a caching DNS resolver.
-.sp
-It uses a built in list of authoritative nameservers for the root zone (\fB\&.\fP),
+.TH "unbound" "8" "@date@" "NLnet Labs" "unbound @version@"
+.\"
+.\" unbound.8 -- unbound manual
+.\"
+.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
+.\"
+.\" See LICENSE for the license.
+.\"
+.\"
+.SH "NAME"
+.B unbound
+\- Unbound DNS validating resolver @version@.
+.SH "SYNOPSIS"
+.B unbound
+.RB [ \-h ]
+.RB [ \-d ]
+.RB [ \-p ]
+.RB [ \-v ]
+.RB [ \-c
+.IR cfgfile ]
+.SH "DESCRIPTION"
+.B Unbound
+is a caching DNS resolver.
+.P
+It uses a built in list of authoritative nameservers for the root zone (.),
 the so called root hints.
-On receiving a DNS query it will ask the root nameservers for an answer and
-will in almost all cases receive a delegation to a top level domain (TLD)
-authoritative nameserver.
+On receiving a DNS query it will ask the root nameservers for
+an answer and will in almost all cases receive a delegation to a top level
+domain (TLD) authoritative nameserver.
 It will then ask that nameserver for an answer.
-It will recursively continue until an answer is found or no answer is available
-(NXDOMAIN).
-For performance and efficiency reasons that answer is cached for a certain time
-(the answer\(aqs time\-to\-live or TTL).
+It will recursively continue until an answer is found or no answer is
+available (NXDOMAIN).
+For performance and efficiency reasons that answer is cached for a
+certain time (the answer's time\-to\-live or TTL).
 A second query for the same name will then be answered from the cache.
 Unbound can also do DNSSEC validation.
+.P
+To use a locally running
+.B Unbound
+for resolving put
 .sp
-To use a locally running Unbound for resolving put:
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
+.RS 6n
 nameserver 127.0.0.1
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-into \fIresolv.conf(5)\fP\&.
-.sp
-If authoritative DNS is needed as well using \fI\%nsd(8)\fP,
-careful setup is required because authoritative nameservers and resolvers are
-using the same port number (53).
+.RE
 .sp
+into
+.IR resolv.conf (5).
+.P
+If authoritative DNS is needed as well using
+.IR nsd (8),
+careful setup is required because authoritative nameservers and
+resolvers are using the same port number (53).
+.P
 The available options are:
-.INDENT 0.0
 .TP
 .B \-h
 Show the version number and commandline option help, and exit.
-.UNINDENT
-.INDENT 0.0
 .TP
-.B \-c <cfgfile>
-Set the config file with settings for unbound to read instead of reading the
-file at the default location, \fB@ub_conf_file@\fP\&.
-The syntax is described in \fI\%unbound.conf(5)\fP\&.
-.UNINDENT
-.INDENT 0.0
+.B \-c\fI cfgfile
+Set the config file with settings for Unbound to read instead of reading the
+file at the default location, @ub_conf_file@. The syntax is
+described in \fIunbound.conf\fR(5).
 .TP
 .B \-d
-Debug flag: do not fork into the background, but stay attached to the
-console.
-This flag will also delay writing to the log file until the thread\-spawn
-time, so that most config and setup errors appear on stderr.
-If given twice or more, logging does not switch to the log file or to
-syslog, but the log messages are printed to stderr all the time.
-.UNINDENT
-.INDENT 0.0
+Debug flag: do not fork into the background, but stay attached to
+the console.  This flag will also delay writing to the log file until
+the thread\-spawn time, so that most config and setup errors appear on
+stderr. If given twice or more, logging does not switch to the log file
+or to syslog, but the log messages are printed to stderr all the time.
 .TP
 .B \-p
-Don\(aqt use a pidfile.
-This argument should only be used by supervision systems which can ensure
-that only one instance of Unbound will run concurrently.
-.UNINDENT
-.INDENT 0.0
+Don't use a pidfile.  This argument should only be used by supervision
+systems which can ensure that only one instance of Unbound will run
+concurrently.
 .TP
 .B \-v
-Increase verbosity.
-If given multiple times, more information is logged.
-This is in addition to the verbosity (if any) from the config file.
-.UNINDENT
-.INDENT 0.0
+Increase verbosity. If given multiple times, more information is logged.
+This is added to the verbosity (if any) from the config file.
 .TP
 .B \-V
 Show the version number and build options, and exit.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fI\%unbound.conf(5)\fP,
-\fI\%unbound\-checkconf(8)\fP,
-\fI\%nsd(8)\fP\&.
-.SH AUTHOR
-Unbound developers are mentioned in the CREDITS file in the distribution.
-.SH COPYRIGHT
-1999-2026, NLnet Labs
-.\" Generated by docutils manpage writer.
-.
+.SH "SEE ALSO"
+\fIunbound.conf\fR(5),
+\fIunbound\-checkconf\fR(8),
+\fInsd\fR(8).
+.SH "AUTHORS"
+.B Unbound
+developers are mentioned in the CREDITS file in the distribution.
@@ -1226,7 +1226,7 @@ VERBATIM_HEADERS       = NO
 # generated with the -Duse_libclang=ON option for CMake.
 # The default value is: NO.

-#CLANG_ASSISTED_PARSING = NO
+CLANG_ASSISTED_PARSING = NO

 # If the CLANG_ASSISTED_PARSING tag is set to YES and the CLANG_ADD_INC_PATHS
 # tag is set to YES then doxygen will add the directory of each input to the
@@ -1234,7 +1234,7 @@ VERBATIM_HEADERS       = NO
 # The default value is: YES.
 # This tag requires that the tag CLANG_ASSISTED_PARSING is set to YES.

-#CLANG_ADD_INC_PATHS    = YES
+CLANG_ADD_INC_PATHS    = YES

 # If clang assisted parsing is enabled you can provide the compiler with command
 # line options that you would normally use when invoking the compiler. Note that
@@ -1242,7 +1242,7 @@ VERBATIM_HEADERS       = NO
 # specified with INPUT and INCLUDE_PATH.
 # This tag requires that the tag CLANG_ASSISTED_PARSING is set to YES.

-#CLANG_OPTIONS          =
+CLANG_OPTIONS          =

 # If clang assisted parsing is enabled you can provide the clang parser with the
 # path to the directory containing a file called compile_commands.json. This
@@ -1255,7 +1255,7 @@ VERBATIM_HEADERS       = NO
 # Note: The availability of this option depends on whether or not doxygen was
 # generated with the -Duse_libclang=ON option for CMake.

-#CLANG_DATABASE_PATH    =
+CLANG_DATABASE_PATH    =

 #---------------------------------------------------------------------------
 # Configuration options related to the alphabetical class index
@@ -1,119 +0,0 @@
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-..
-    WHEN EDITING MAKE SURE EACH SENTENCE STARTS ON A NEW LINE
-
-..
-    IT HELPS RENDERERS TO DO THE RIGHT THING WRT SPACE
-
-..
-    IT HELPS PEOPLE DIFFING THE CHANGES
-
-.. program:: unbound
-
-unbound(8)
-==========
-
-Synopsis
--------
-
-**unbound** [``-hdpVv``] [``-c <cfgfile>``]
-
-Description
-----------
-
-``unbound`` is a caching DNS resolver.
-
-It uses a built in list of authoritative nameservers for the root zone (``.``),
-the so called root hints.
-On receiving a DNS query it will ask the root nameservers for an answer and
-will in almost all cases receive a delegation to a top level domain (TLD)
-authoritative nameserver.
-It will then ask that nameserver for an answer.
-It will recursively continue until an answer is found or no answer is available
-(NXDOMAIN).
-For performance and efficiency reasons that answer is cached for a certain time
-(the answer's time-to-live or TTL).
-A second query for the same name will then be answered from the cache.
-Unbound can also do DNSSEC validation.
-
-To use a locally running Unbound for resolving put:
-
-.. code-block:: text
-
-   nameserver 127.0.0.1
-
-into *resolv.conf(5)*.
-
-If authoritative DNS is needed as well using :external+nsd:doc:`manpages/nsd`,
-careful setup is required because authoritative nameservers and resolvers are
-using the same port number (53).
-
-The available options are:
-
-.. option:: -h
-
- Show the version number and commandline option help, and exit.
-
-.. option:: -c <cfgfile>
-
-   Set the config file with settings for unbound to read instead of reading the
-   file at the default location, :file:`@ub_conf_file@`.
-   The syntax is described in :doc:`unbound.conf(5)</manpages/unbound.conf>`.
-
-.. option:: -d
-
-   Debug flag: do not fork into the background, but stay attached to the
-   console.
-   This flag will also delay writing to the log file until the thread-spawn
-   time, so that most config and setup errors appear on stderr.
-   If given twice or more, logging does not switch to the log file or to
-   syslog, but the log messages are printed to stderr all the time.
-
-.. option:: -p
-
-   Don't use a pidfile.
-   This argument should only be used by supervision systems which can ensure
-   that only one instance of Unbound will run concurrently.
-
-.. option:: -v
-
-   Increase verbosity.
-   If given multiple times, more information is logged.
-   This is in addition to the verbosity (if any) from the config file.
-
-.. option:: -V
-
-   Show the version number and build options, and exit.
-
-See Also
--------
-
-:doc:`unbound.conf(5)</manpages/unbound.conf>`,
-:doc:`unbound-checkconf(8)</manpages/unbound-checkconf>`,
-:external+nsd:doc:`manpages/nsd`.
@@ -297,8 +297,8 @@ inplace_cb_delete_wrapped(struct module_env* env, enum inplace_cb_list_type type
 */
 static struct module_func_block dynlibmod_block = {
   "dynlib",
-   NULL, NULL, &dynlibmod_init, &dynlibmod_deinit, &dynlibmod_operate,
-   &dynlibmod_inform_super, &dynlibmod_clear, &dynlibmod_get_mem
+   &dynlibmod_init, &dynlibmod_deinit, &dynlibmod_operate, &dynlibmod_inform_super,
+   &dynlibmod_clear, &dynlibmod_get_mem
 };

 struct module_func_block* dynlibmod_get_funcblock(void)
@@ -116,7 +116,7 @@ struct addredge {
 	addrlen_t len;
 	/** child node this edge is connected to */
 	struct addrnode *node;
-	/** Parent node this edge is connected to */
+	/** Parent node this ege is connected to */
 	struct addrnode *parent_node;
 	/** Index of this edge in parent_node */
 	int parent_index;
@@ -51,7 +51,6 @@
 #include "services/cache/dns.h"
 #include "util/module.h"
 #include "util/regional.h"
-#include "util/fptr_wlist.h"
 #include "util/storage/slabhash.h"
 #include "util/config_file.h"
 #include "util/data/msgreply.h"
@@ -70,7 +69,6 @@ subnet_data_delete(void *d, void *ATTR_UNUSED(arg))
 	r = (struct subnet_msg_cache_data*)d;
 	addrtree_delete(r->tree4);
 	addrtree_delete(r->tree6);
-	free(r->reason_fail);
 	free(r);
 }

@@ -85,8 +83,6 @@ msg_cache_sizefunc(void *k, void *d)
 		+ q->key.qname_len + lock_get_mem(&q->entry.lock);
 	s += addrtree_size(r->tree4);
 	s += addrtree_size(r->tree6);
-	if(r->reason_fail)
-		s += strlen(r->reason_fail)+1;
 	return s;
 }

@@ -157,32 +153,9 @@ int ecs_whitelist_check(struct query_info* qinfo,
 		return 1;
 	sn_env = (struct subnet_env*)qstate->env->modinfo[id];

-	if(sq->is_subquery_nonsubnet) {
-		if(sq->is_subquery_scopezero) {
-			/* Check if the result can be stored in the global cache,
-			 * this is okay if the address and name are not configured
-			 * as subnet address and subnet zone. */
-			if(!ecs_is_whitelisted(sn_env->whitelist,
-				addr, addrlen, qinfo->qname, qinfo->qname_len,
-				qinfo->qclass)) {
-				/* The stub or forward can have no_cache set.*/
-				if(iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL, NULL, 0)) {
-					verbose(VERB_ALGO, "subnet subquery is not stored globally, stuborfwd is no_cache");
-				} else {
-					verbose(VERB_ALGO, "subnet store subquery global, name and addr have no subnet treatment.%s",
-						(sq->started_no_cache_store?
-						" But the subnet module was started with no_cache_store for the super query, and that is still applied to this query":""));
-					qstate->no_cache_store = sq->started_no_cache_store;
-				}
-			}
-		}
-		return 1;
-	}
-
 	/* Cache by default, might be disabled after parsing EDNS option
 	 * received from nameserver. */
-	if(!iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL, NULL, 0)
-		&& sq->ecs_client_in.subnet_validdata) {
+	if(!iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL, NULL, 0)) {
 		qstate->no_cache_store = 0;
 	}

@@ -203,18 +176,12 @@ int ecs_whitelist_check(struct query_info* qinfo,
 			if(sq->ecs_server_out.subnet_source_mask == 0) {
 				sq->subnet_sent_no_subnet = 1;
 				sq->subnet_sent = 0;
-				/* The result should end up in subnet cache,
-				 * not in global cache. */
-				qstate->no_cache_store = 1;
 				return 1;
 			}
 			subnet_ecs_opt_list_append(&sq->ecs_server_out,
 				&qstate->edns_opts_back_out, qstate, region);
 		}
 		sq->subnet_sent = 1;
-		/* Do not store servfails in global cache, since the subnet
-		 * option is sent out. */
-		qstate->no_cache_store = 1;
 	}
 	else {
 		/* Outgoing ECS option is set, but we don't want to sent it to
@@ -265,13 +232,13 @@ subnetmod_init(struct module_env *env, int id)
 		HASH_DEFAULT_STARTARRAY, env->cfg->msg_cache_size,
 		msg_cache_sizefunc, query_info_compare, query_entry_delete,
 		subnet_data_delete, NULL);
+	slabhash_setmarkdel(sn_env->subnet_msg_cache, &subnet_markdel);
 	if(!sn_env->subnet_msg_cache) {
 		log_err("subnetcache: could not create cache");
 		free(sn_env);
 		env->modinfo[id] = NULL;
 		return 0;
 	}
-	slabhash_setmarkdel(sn_env->subnet_msg_cache, &subnet_markdel);
 	/* whitelist for edns subnet capable servers */
 	sn_env->whitelist = ecs_whitelist_create();
 	if(!sn_env->whitelist ||
@@ -436,35 +403,6 @@ update_cache(struct module_qstate *qstate, int id)
 	}
 	/* lru_entry->lock is locked regardless of how we got here,
 	 * either from the slabhash_lookup, or above in the new allocated */
-	if(!qstate->return_msg && qstate->error_response_cache) {
-		struct subnet_msg_cache_data *data =
-			(struct subnet_msg_cache_data*)lru_entry->data;
-		data->ttl_servfail = *qstate->env->now + NORR_TTL;
-		data->ede_fail = errinf_to_reason_bogus(qstate);
-		diff_size = (data->reason_fail?strlen(data->reason_fail)+1:0);
-		if(qstate->errinf) {
-			char* str = errinf_to_str_misc(qstate);
-			free(data->reason_fail);
-			data->reason_fail = NULL;
-			if(str)
-				data->reason_fail = strdup(str);
-		}
-		diff_size = (data->reason_fail?strlen(data->reason_fail)+1:0)
-			- diff_size;
-		lock_rw_unlock(&lru_entry->lock);
-		if (need_to_insert) {
-			slabhash_insert(subnet_msg_cache, h, lru_entry,
-				lru_entry->data, NULL);
-		} else {
-			slabhash_update_space_used(subnet_msg_cache, h, NULL,
-				diff_size);
-		}
-		return;
-	}
-	if(!qstate->return_msg) {
-		lock_rw_unlock(&lru_entry->lock);
-		return;
-	}
 	/* Step 2, find the correct tree */
 	if (!(tree = get_tree(lru_entry->data, edns, sne, qstate->env->cfg))) {
 		lock_rw_unlock(&lru_entry->lock);
@@ -508,21 +446,6 @@ update_cache(struct module_qstate *qstate, int id)
 	}
 }

-/** See if there is a stored servfail, returns true if so, and sets reply. */
-static int
-lookup_check_servfail(struct module_qstate *qstate,
-	struct subnet_msg_cache_data *data)
-{
-	struct module_env *env = qstate->env;
-	if(!data)
-		return 0;
-	if(!data->ttl_servfail || TTL_IS_EXPIRED(data->ttl_servfail, *env->now))
-		return 0;
-	qstate->return_rcode = LDNS_RCODE_SERVFAIL;
-	errinf_ede(qstate, data->reason_fail, data->ede_fail);
-	return 1;
-}
-
 /** Lookup in cache and reply true iff reply is sent. */
 static int
 lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq, int prefetch)
@@ -536,8 +459,6 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq,
 	struct addrtree *tree;
 	struct addrnode *node;
 	uint8_t scope;
-	int must_validate = (!(qstate->query_flags&BIT_CD)
-		|| qstate->env->cfg->ignore_cd) && qstate->env->need_to_validate;

 	memset(&sq->ecs_client_out, 0, sizeof(sq->ecs_client_out));

@@ -551,20 +472,12 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq,
 	tree = (ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4)?
 		data->tree4 : data->tree6;
 	if (!tree) { /* qinfo in cache but not for this family */
-		if(lookup_check_servfail(qstate, data)) {
-			lock_rw_unlock(&e->lock);
-			return 1;
-		}
 		lock_rw_unlock(&e->lock);
 		return 0;
 	}
 	node = addrtree_find(tree, (addrkey_t*)ecs->subnet_addr, 
 		ecs->subnet_source_mask, *env->now);
 	if (!node) { /* plain old cache miss */
-		if(lookup_check_servfail(qstate, data)) {
-			lock_rw_unlock(&e->lock);
-			return 1;
-		}
 		lock_rw_unlock(&e->lock);
 		return 0;
 	}
@@ -573,24 +486,12 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq,
 		(struct reply_info *)node->elem, qstate->region, *env->now, 0,
 		env->scratch);
 	scope = (uint8_t)node->scope;
+	lock_rw_unlock(&e->lock);
 	
 	if (!qstate->return_msg) { /* Failed allocation or expired TTL */
-		if(lookup_check_servfail(qstate, data)) {
-			lock_rw_unlock(&e->lock);
-			return 1;
-		}
-		lock_rw_unlock(&e->lock);
 		return 0;
 	}
-	lock_rw_unlock(&e->lock);
-	if(qstate->return_msg->rep->security == sec_status_unchecked
-		&& must_validate) {
-		/* The message has to be validated first. */
-		verbose(VERB_ALGO, "subnet: unchecked cache entry needs "
-			"validation");
-		return 0;
-	}
-
+	
 	if (sq->subnet_downstream) { /* relay to interested client */
 		sq->ecs_client_out.subnet_scope_mask = scope;
 		sq->ecs_client_out.subnet_addr_fam = ecs->subnet_addr_fam;
@@ -621,87 +522,6 @@ common_prefix(uint8_t *a, uint8_t *b, uint8_t net)
 	return !memcmp(a, b, n) && ((net % 8) == 0 || a[n] == b[n]);
 }

-/**
- * Create sub request that looks up the query.
- * @param qstate: query state
- * @param id: module id.
- * @param sq: subnet qstate
- * @return false on failure.
- */
-static int
-generate_sub_request(struct module_qstate *qstate, int id, struct subnet_qstate* sq)
-{
-	struct module_qstate* subq = NULL;
-	uint16_t qflags = 0; /* OPCODE QUERY, no flags */
-	int prime = 0;
-	int valrec = 0;
-	struct query_info qinf;
-	qinf.qname = qstate->qinfo.qname;
-	qinf.qname_len = qstate->qinfo.qname_len;
-	qinf.qtype = qstate->qinfo.qtype;
-	qinf.qclass = qstate->qinfo.qclass;
-	qinf.local_alias = NULL;
-
-	qflags |= BIT_RD;
-	if((qstate->query_flags & BIT_CD)!=0) {
-		qflags |= BIT_CD;
-		/* The valrec is left off. Leave out: valrec = 1;
-		 * So that the cache is protected with DNSSEC validation.
-		 * Just like the global cache. DNSSEC validation is performed
-		 * regardless of the setting of the querier's CD flag. */
-	}
-
-	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &qinf, qstate->client_info,
-		qflags, prime, valrec, &subq)) {
-		return 0;
-	}
-	if(subq) {
-		/* It is possible to access the subquery module state. */
-		struct subnet_qstate* subsq;
-		if(!subnet_new_qstate(subq, id)) {
-			verbose(VERB_ALGO, "Could not allocate new subnet qstate");
-			return 0;
-		}
-		subsq = (struct subnet_qstate*)subq->minfo[id];
-		subsq->is_subquery_nonsubnet = 1;
-		subsq->started_no_cache_store = sq->started_no_cache_store;
-
-		/* When the client asks 0.0.0.0/0 and the name is not treated
-		 * as subnet, it is to be stored in the global cache.
-		 * Store that the client asked for that, if so. */
-		if(sq->ecs_client_in.subnet_source_mask == 0 &&
-			edns_opt_list_find(qstate->edns_opts_front_in,
-				qstate->env->cfg->client_subnet_opcode)) {
-			subq->no_cache_store = 1;
-			subsq->is_subquery_scopezero = 1;
-		}
-	}
-	return 1;
-}
-
-/**
- * Perform the query without subnet
- * @param qstate: query state
- * @param id: module id.
- * @param sq: subnet qstate
- * @return module state
- */
-static enum module_ext_state
-generate_lookup_without_subnet(struct module_qstate *qstate, int id,
-	struct subnet_qstate* sq)
-{
-	verbose(VERB_ALGO, "subnetcache: make subquery to look up without subnet");
-	if(!generate_sub_request(qstate, id, sq)) {
-		verbose(VERB_ALGO, "Could not generate sub query");
-		qstate->return_rcode = LDNS_RCODE_SERVFAIL;
-		qstate->return_msg = NULL;
-		return module_finished;
-	}
-	sq->wait_subquery = 1;
-	return module_wait_subquery;
-}
-
 static enum module_ext_state
 eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 {
@@ -718,12 +538,6 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		/* already an answer and its not a message, but retain
 		 * the actual rcode, instead of module_error, so send
 		 * module_finished */
-		if(qstate->error_response_cache) {
-			verbose(VERB_ALGO, "subnet: store error response");
-			lock_rw_wrlock(&sne->biglock);
-			update_cache(qstate, id);
-			lock_rw_unlock(&sne->biglock);
-		}
 		return module_finished;
 	}

@@ -743,7 +557,14 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		 * is still useful to put it in the edns subnet cache for
 		 * when a client explicitly asks for subnet specific answer. */
 		verbose(VERB_QUERY, "subnetcache: Authority indicates no support");
-		return generate_lookup_without_subnet(qstate, id, sq);
+		if(!sq->started_no_cache_store) {
+			lock_rw_wrlock(&sne->biglock);
+			update_cache(qstate, id);
+			lock_rw_unlock(&sne->biglock);
+		}
+		if (sq->subnet_downstream)
+			cp_edns_bad_response(c_out, c_in);
+		return module_finished;
 	}

 	/* Purposefully there was no sent subnet, and there is consequently
@@ -768,14 +589,14 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		!common_prefix(s_out->subnet_addr, s_in->subnet_addr, 
 			s_out->subnet_source_mask))
 	{
-		/* we can not accept, perform query without option */
+		/* we can not accept, restart query without option */
 		verbose(VERB_QUERY, "subnetcache: forged data");
 		s_out->subnet_validdata = 0;
 		(void)edns_opt_list_remove(&qstate->edns_opts_back_out,
 			qstate->env->cfg->client_subnet_opcode);
 		sq->subnet_sent = 0;
 		sq->subnet_sent_no_subnet = 0;
-		return generate_lookup_without_subnet(qstate, id, sq);
+		return module_restart_next;
 	}

 	lock_rw_wrlock(&sne->biglock);
@@ -973,11 +794,6 @@ ecs_edns_back_parsed(struct module_qstate* qstate, int id,
 				sq->max_scope = sq->ecs_server_in.subnet_scope_mask;
 	} else if(sq->subnet_sent_no_subnet) {
 		/* The answer can be stored as scope 0, not in global cache. */
-		/* This was already set in ecs_whitelist_check */
-		qstate->no_cache_store = 1;
-	} else if(sq->subnet_sent) {
-		/* Need another query to be able to store in global cache. */
-		/* This was already set in ecs_whitelist_check */
 		qstate->no_cache_store = 1;
 	}

@@ -996,32 +812,6 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 		strmodulevent(event));
 	log_query_info(VERB_QUERY, "subnetcache operate: query", &qstate->qinfo);

-	if(sq && sq->wait_subquery_done) {
-		/* The subquery lookup returned. */
-		if(sq->ecs_client_in.subnet_source_mask == 0 &&
-			edns_opt_list_find(qstate->edns_opts_front_in,
-				qstate->env->cfg->client_subnet_opcode)) {
-			if(!sq->started_no_cache_store &&
-				qstate->return_msg) {
-				lock_rw_wrlock(&sne->biglock);
-				update_cache(qstate, id);
-				lock_rw_unlock(&sne->biglock);
-			}
-			if (sq->subnet_downstream)
-				cp_edns_bad_response(&sq->ecs_client_out,
-					&sq->ecs_client_in);
-			/* It is a scope zero lookup, append edns subnet
-			 * option to the querier. */
-			subnet_ecs_opt_list_append(&sq->ecs_client_out,
-				&qstate->edns_opts_front_out, qstate,
-				qstate->region);
-		}
-		sq->wait_subquery_done = 0;
-		qstate->ext_state[id] = module_finished;
-		qstate->no_cache_store = sq->started_no_cache_store;
-		qstate->no_cache_lookup = sq->started_no_cache_lookup;
-		return;
-	}
 	if((event == module_event_new || event == module_event_pass) &&
 		sq == NULL) {
 		struct edns_option* ecs_opt;
@@ -1032,8 +822,6 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 		}

 		sq = (struct subnet_qstate*)qstate->minfo[id];
-		if(sq->wait_subquery)
-			return; /* Wait for that subquery to return */

 		if((ecs_opt = edns_opt_list_find(
 			qstate->edns_opts_front_in,
@@ -1063,14 +851,6 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 			/* No clients are interested in result or we could not
 			 * parse it, we don't do client subnet */
 			sq->ecs_server_out.subnet_validdata = 0;
-			if(edns_opt_list_find(qstate->edns_opts_front_in,
-				qstate->env->cfg->client_subnet_opcode)) {
-				/* aggregated this deaggregated state */
-				qstate->ext_state[id] =
-					generate_lookup_without_subnet(
-					qstate, id, sq);
-				return;
-			}
 			verbose(VERB_ALGO, "subnetcache: pass to next module");
 			qstate->ext_state[id] = module_wait_module;
 			return;
@@ -1111,14 +891,6 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 			}
 			lock_rw_unlock(&sne->biglock);
 		}
-		if(sq->ecs_client_in.subnet_source_mask == 0 &&
-			edns_opt_list_find(qstate->edns_opts_front_in,
-				qstate->env->cfg->client_subnet_opcode)) {
-			/* client asked for resolution without edns subnet */
-			qstate->ext_state[id] = generate_lookup_without_subnet(
-				qstate, id, sq);
-			return;
-		}
 		
 		sq->ecs_server_out.subnet_addr_fam =
 			sq->ecs_client_in.subnet_addr_fam;
@@ -1155,8 +927,6 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 		qstate->ext_state[id] = module_wait_module;
 		return;
 	}
-	if(sq && sq->wait_subquery)
-		return; /* Wait for that subquery to return */
 	/* Query handed back by next module, we have a 'final' answer */
 	if(sq && event == module_event_moddone) {
 		qstate->ext_state[id] = eval_response(qstate, id, sq);
@@ -1205,27 +975,10 @@ subnetmod_clear(struct module_qstate *ATTR_UNUSED(qstate),
 }

 void
-subnetmod_inform_super(struct module_qstate *qstate, int id,
-	struct module_qstate *super)
+subnetmod_inform_super(struct module_qstate *ATTR_UNUSED(qstate),
+	int ATTR_UNUSED(id), struct module_qstate *ATTR_UNUSED(super))
 {
-	struct subnet_qstate* super_sq =
-		(struct subnet_qstate*)super->minfo[id];
-	log_query_info(VERB_ALGO, "subnetcache inform_super: query",
-		&super->qinfo);
-	super_sq->wait_subquery = 0;
-	super_sq->wait_subquery_done = 1;
-	if(qstate->return_rcode != LDNS_RCODE_NOERROR ||
-		!qstate->return_msg) {
-		super->return_msg = NULL;
-		super->return_rcode = LDNS_RCODE_SERVFAIL;
-		return;
-	}
-	super->return_rcode = LDNS_RCODE_NOERROR;
-	super->return_msg = dns_copy_msg(qstate->return_msg, super->region);
-	if(!super->return_msg) {
-		log_err("subnetcache: copy response, out of memory");
-		super->return_rcode = LDNS_RCODE_SERVFAIL;
-	}
+	/* Not used */
 }

 size_t
@@ -1242,8 +995,7 @@ subnetmod_get_mem(struct module_env *env, int id)
 * The module function block 
 */
 static struct module_func_block subnetmod_block = {
-	"subnetcache",
-	NULL, NULL, &subnetmod_init, &subnetmod_deinit, &subnetmod_operate,
+	"subnetcache", &subnetmod_init, &subnetmod_deinit, &subnetmod_operate,
 	&subnetmod_inform_super, &subnetmod_clear, &subnetmod_get_mem
 };

@@ -69,18 +69,8 @@ struct subnet_env {
 };

 struct subnet_msg_cache_data {
-	/** Tree for nodes with IPv4 subnets. */
 	struct addrtree* tree4;
-	/** Tree for nodes with IPv6 subnets. */
 	struct addrtree* tree6;
-	/** If servfail is stored, for how long. Abs time in seconds.
-	 * This protects against too much recusion on the item when
-	 * resolution fails, for a couple of seconds. */
-	time_t ttl_servfail;
-	/** servfail ede */
-	sldns_ede_code ede_fail;
-	/** servfail reason */
-	char* reason_fail;
 };

 struct subnet_qstate {
@@ -112,14 +102,6 @@ struct subnet_qstate {
 	int started_no_cache_store;
 	/** has the subnet module been started with no_cache_lookup? */
 	int started_no_cache_lookup;
-	/** Wait for subquery that has been started for nonsubnet lookup. */
-	int wait_subquery;
-	/** The subquery waited for is done. */
-	int wait_subquery_done;
-	/** The subnet state is a subquery state for nonsubnet lookup. */
-	int is_subquery_nonsubnet;
-	/** This is a subquery, and it is made due to a scope zero request. */
-	int is_subquery_scopezero;
 };

 void subnet_data_delete(void* d, void* ATTR_UNUSED(arg));
@@ -163,7 +163,7 @@ generate_request(struct module_qstate* qstate, int id, uint8_t* name,
 	}

 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &ask, NULL,
+	if(!(*qstate->env->attach_sub)(qstate, &ask,
 		(uint16_t)(BIT_RD|flags), 0, 0, &newq)){
 		log_err("Could not generate request: out of memory");
 		return 0;
@@ -456,8 +456,7 @@ ipsecmod_handle_query(struct module_qstate* qstate,
 	/* Store A/AAAA in cache. */
 	if(!dns_cache_store(qstate->env, &qstate->qinfo,
 		qstate->return_msg->rep, 0, qstate->prefetch_leeway,
-		0, qstate->region, qstate->query_flags, qstate->qstarttime,
-		qstate->is_valrec)) {
+		0, qstate->region, qstate->query_flags, qstate->qstarttime)) {
 		log_err("ipsecmod: out of memory caching record");
 	}
 	qstate->ext_state[id] = module_finished;
@@ -616,7 +615,7 @@ ipsecmod_get_mem(struct module_env* env, int id)
 */
 static struct module_func_block ipsecmod_block = {
 	"ipsecmod",
-	NULL, NULL, &ipsecmod_init, &ipsecmod_deinit, &ipsecmod_operate,
+	&ipsecmod_init, &ipsecmod_deinit, &ipsecmod_operate,
 	&ipsecmod_inform_super, &ipsecmod_clear, &ipsecmod_get_mem
 };

@@ -17,19 +17,9 @@
 #include "sldns/wire2str.h"
 #include "sldns/parseutil.h"

-#ifdef HAVE_NET_PFVAR_H
-#include <fcntl.h>
-#include <sys/ioctl.h>
-#include <netinet/in.h>
-#include <net/if.h>
-#include <net/pfvar.h>
-typedef intptr_t filter_dev;
-#else
 #include <libmnl/libmnl.h>
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/ipset/ip_set.h>
-typedef struct mnl_socket * filter_dev;
-#endif

 #define BUFF_LEN 256

@@ -51,95 +41,24 @@ static int error_response(struct module_qstate* qstate, int id, int rcode) {
 	return 0;
 }

-#ifdef HAVE_NET_PFVAR_H
-static void * open_filter() {
-	filter_dev dev;
+static struct mnl_socket * open_mnl_socket() {
+	struct mnl_socket *mnl;

-	dev = open("/dev/pf", O_RDWR);
-	if (dev == -1) {
-		log_err("open(\"/dev/pf\") failed: %s", strerror(errno));
-		return NULL;
-	}
-	else
-		return (void *)dev;
-}
-#else
-static void * open_filter() {
-	filter_dev dev;
-
-	dev = mnl_socket_open(NETLINK_NETFILTER);
-	if (!dev) {
+	mnl = mnl_socket_open(NETLINK_NETFILTER);
+	if (!mnl) {
 		log_err("ipset: could not open netfilter.");
 		return NULL;
 	}

-	if (mnl_socket_bind(dev, 0, MNL_SOCKET_AUTOPID) < 0) {
-		mnl_socket_close(dev);
+	if (mnl_socket_bind(mnl, 0, MNL_SOCKET_AUTOPID) < 0) {
+		mnl_socket_close(mnl);
 		log_err("ipset: could not bind netfilter.");
 		return NULL;
 	}
-	return (void *)dev;
+	return mnl;
 }
-#endif

-#ifdef HAVE_NET_PFVAR_H
-static int add_to_ipset(filter_dev dev, const char *setname, const void *ipaddr, int af) {
-	struct pfioc_table io;
-	struct pfr_addr addr;
-	const char *p;
-	int i;
-
-	bzero(&io, sizeof(io));
-	bzero(&addr, sizeof(addr));
-
-	p = strrchr(setname, '/');
-	if (p) {
-		i = p - setname;
-		if (i >= PATH_MAX) {
-			errno = ENAMETOOLONG;
-			return -1;
-		}
-		memcpy(io.pfrio_table.pfrt_anchor, setname, i);
-		if (i < PATH_MAX)
-			io.pfrio_table.pfrt_anchor[i] = '\0';
-		p++;
-	}
-	else
-		p = setname;
-
-	if (strlen(p) >= PF_TABLE_NAME_SIZE) {
-		errno = ENAMETOOLONG;
-		return -1;
-	}
-	strlcpy(io.pfrio_table.pfrt_name, p, PF_TABLE_NAME_SIZE);
-
-	io.pfrio_buffer = &addr;
-	io.pfrio_size = 1;
-	io.pfrio_esize = sizeof(addr);
-
-	switch (af) {
-		case AF_INET:
-			addr.pfra_ip4addr = *(struct in_addr *)ipaddr;
-			addr.pfra_net = 32;
-			break;
-		case AF_INET6:
-			addr.pfra_ip6addr = *(struct in6_addr *)ipaddr;
-			addr.pfra_net = 128;
-			break;
-		default:
-		errno = EAFNOSUPPORT;
-		return -1;
-	}
-	addr.pfra_af = af;
-
-	if (ioctl(dev, DIOCRADDADDRS, &io) == -1) {
-		log_err("ioctl failed: %s", strerror(errno));
-		return -1;
-	}
-	return 0;
-}
-#else
-static int add_to_ipset(filter_dev dev, const char *setname, const void *ipaddr, int af) {
+static int add_to_ipset(struct mnl_socket *mnl, const char *setname, const void *ipaddr, int af) {
 	struct nlmsghdr *nlh;
 	struct nfgenmsg *nfg;
 	struct nlattr *nested[2];
@@ -172,15 +91,14 @@ static int add_to_ipset(filter_dev dev, const char *setname, const void *ipaddr,
 	mnl_attr_nest_end(nlh, nested[1]);
 	mnl_attr_nest_end(nlh, nested[0]);

-	if (mnl_socket_sendto(dev, nlh, nlh->nlmsg_len) < 0) {
+	if (mnl_socket_sendto(mnl, nlh, nlh->nlmsg_len) < 0) {
 		return -1;
 	}
 	return 0;
 }
-#endif

 static void
-ipset_add_rrset_data(struct ipset_env *ie,
+ipset_add_rrset_data(struct ipset_env *ie, struct mnl_socket *mnl,
 	struct packed_rrset_data *d, const char* setname, int af,
 	const char* dname)
 {
@@ -205,16 +123,12 @@ ipset_add_rrset_data(struct ipset_env *ie,
 					snprintf(ip, sizeof(ip), "(inet_ntop_error)");
 				verbose(VERB_QUERY, "ipset: add %s to %s for %s", ip, setname, dname);
 			}
-			ret = add_to_ipset((filter_dev)ie->dev, setname, rr_data + 2, af);
+			ret = add_to_ipset(mnl, setname, rr_data + 2, af);
 			if (ret < 0) {
 				log_err("ipset: could not add %s into %s", dname, setname);

-#if HAVE_NET_PFVAR_H
-				/* don't close as we might not be able to open again due to dropped privs */
-#else
-				mnl_socket_close((filter_dev)ie->dev);
-				ie->dev = NULL;
-#endif
+				mnl_socket_close(mnl);
+				ie->mnl = NULL;
 				break;
 			}
 		}
@@ -223,8 +137,8 @@ ipset_add_rrset_data(struct ipset_env *ie,

 static int
 ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
-	struct ub_packed_rrset_key *rrset, const char *qname, int qlen,
-	const char *setname, int af)
+	struct mnl_socket *mnl, struct ub_packed_rrset_key *rrset,
+	const char *qname, const int qlen, const char *setname, int af)
 {
 	static char dname[BUFF_LEN];
 	const char *ds, *qs;
@@ -238,20 +152,11 @@ ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
 		log_err("bad domain name");
 		return -1;
 	}
-	if (dname[dlen - 1] == '.') {
-		dlen--;
-	}
-	if (qname[qlen - 1] == '.') {
-		qlen--;
-	}

 	for (p = env->cfg->local_zones_ipset; p; p = p->next) {
 		ds = NULL;
 		qs = NULL;
 		plen = strlen(p->str);
-		if (p->str[plen - 1] == '.') {
-			plen--;
-		}

 		if (dlen == plen || (dlen > plen && dname[dlen - plen - 1] == '.' )) {
 			ds = dname + (dlen - plen);
@@ -262,7 +167,8 @@ ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
 		if ((ds && strncasecmp(p->str, ds, plen) == 0)
 			|| (qs && strncasecmp(p->str, qs, plen) == 0)) {
 			d = (struct packed_rrset_data*)rrset->entry.data;
-			ipset_add_rrset_data(ie, d, setname, af, dname);
+			ipset_add_rrset_data(ie, mnl, d, setname,
+				af, dname);
 			break;
 		}
 	}
@@ -272,6 +178,7 @@ ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
 static int ipset_update(struct module_env *env, struct dns_msg *return_msg,
 	struct query_info qinfo, struct ipset_env *ie)
 {
+	struct mnl_socket *mnl;
 	size_t i;
 	const char *setname;
 	struct ub_packed_rrset_key *rrset;
@@ -279,17 +186,15 @@ static int ipset_update(struct module_env *env, struct dns_msg *return_msg,
 	static char qname[BUFF_LEN];
 	int qlen;

-#ifdef HAVE_NET_PFVAR_H
-#else
-	if (!ie->dev) {
+	mnl = (struct mnl_socket *)ie->mnl;
+	if (!mnl) {
 		/* retry to create mnl socket */
-		ie->dev = open_filter();
-		if (!ie->dev) {
-			log_warn("ipset open_filter failed");
+		mnl = open_mnl_socket();
+		if (!mnl) {
 			return -1;
 		}
+		ie->mnl = mnl;
 	}
-#endif

 	qlen = sldns_wire2str_dname_buf(qinfo.qname, qinfo.qname_len,
 		qname, BUFF_LEN);
@@ -312,8 +217,8 @@ static int ipset_update(struct module_env *env, struct dns_msg *return_msg,
 		}

 		if (setname) {
-			if(ipset_check_zones_for_rrset(env, ie, rrset, qname,
-				qlen, setname, af) == -1)
+			if(ipset_check_zones_for_rrset(env, ie, mnl, rrset,
+				qname, qlen, setname, af) == -1)
 				return -1;
 		}
 	}
@@ -321,7 +226,7 @@ static int ipset_update(struct module_env *env, struct dns_msg *return_msg,
 	return 0;
 }

-int ipset_startup(struct module_env* env, int id) {
+int ipset_init(struct module_env* env, int id) {
 	struct ipset_env *ipset_env;

 	ipset_env = (struct ipset_env *)calloc(1, sizeof(struct ipset_env));
@@ -332,43 +237,7 @@ int ipset_startup(struct module_env* env, int id) {

 	env->modinfo[id] = (void *)ipset_env;

-#ifdef HAVE_NET_PFVAR_H
-	ipset_env->dev = open_filter();
-	if (!ipset_env->dev) {
-		log_err("ipset open_filter failed");
-		return 0;
-	}
-#else
-	ipset_env->dev = NULL;
-#endif
-	return 1;
-}
-
-void ipset_destartup(struct module_env* env, int id) {
-	filter_dev dev;
-	struct ipset_env *ipset_env;
-
-	if (!env || !env->modinfo[id]) {
-		return;
-	}
-	ipset_env = (struct ipset_env*)env->modinfo[id];
-
-	dev = (filter_dev)ipset_env->dev;
-	if (dev) {
-#if HAVE_NET_PFVAR_H
-		close(dev);
-#else
-		mnl_socket_close(dev);
-#endif
-		ipset_env->dev = NULL;
-	}
-
-	free(ipset_env);
-	env->modinfo[id] = NULL;
-}
-
-int ipset_init(struct module_env* env, int id) {
-	struct ipset_env *ipset_env = env->modinfo[id];
+	ipset_env->mnl = NULL;

 	ipset_env->name_v4 = env->cfg->ipset_name_v4;
 	ipset_env->name_v6 = env->cfg->ipset_name_v6;
@@ -384,8 +253,24 @@ int ipset_init(struct module_env* env, int id) {
 	return 1;
 }

-void ipset_deinit(struct module_env *ATTR_UNUSED(env), int ATTR_UNUSED(id)) {
-	/* nothing */
+void ipset_deinit(struct module_env *env, int id) {
+	struct mnl_socket *mnl;
+	struct ipset_env *ipset_env;
+
+	if (!env || !env->modinfo[id]) {
+		return;
+	}
+
+	ipset_env = (struct ipset_env *)env->modinfo[id];
+
+	mnl = (struct mnl_socket *)ipset_env->mnl;
+	if (mnl) {
+		mnl_socket_close(mnl);
+		ipset_env->mnl = NULL;
+	}
+
+	free(ipset_env);
+	env->modinfo[id] = NULL;
 }

 static int ipset_new(struct module_qstate* qstate, int id) {
@@ -491,8 +376,8 @@ size_t ipset_get_mem(struct module_env *env, int id) {
 */
 static struct module_func_block ipset_block = {
 	"ipset",
-	&ipset_startup, &ipset_destartup, &ipset_init, &ipset_deinit,
-	&ipset_operate, &ipset_inform_super, &ipset_clear, &ipset_get_mem
+	&ipset_init, &ipset_deinit, &ipset_operate,
+	&ipset_inform_super, &ipset_clear, &ipset_get_mem
 };

 struct module_func_block * ipset_get_funcblock(void) {
@@ -37,7 +37,7 @@ extern "C" {
 #endif

 struct ipset_env {
-	void* dev;
+    void* mnl;

 	int v4_enabled;
 	int v6_enabled;
@@ -50,10 +50,6 @@ struct ipset_qstate {
 	int dummy;
 };

-/** Startup the ipset module */
-int ipset_startup(struct module_env* env, int id);
-/** Destartup the ipset module */
-void ipset_destartup(struct module_env* env, int id);
 /** Init the ipset module */
 int ipset_init(struct module_env* env, int id);
 /** Deinit the ipset module */
@@ -278,7 +278,7 @@ delegpt_count_addr(struct delegpt* dp, size_t* numaddr, size_t* numres,

 void delegpt_log(enum verbosity_value v, struct delegpt* dp)
 {
-	char buf[LDNS_MAX_DOMAINLEN];
+	char buf[LDNS_MAX_DOMAINLEN+1];
 	struct delegpt_ns* ns;
 	struct delegpt_addr* a;
 	size_t missing=0, numns=0, numaddr=0, numres=0, numavail=0;
@@ -408,6 +408,34 @@ find_NS(struct reply_info* rep, size_t from, size_t to)
 	return NULL;
 }

+struct delegpt* delegpt_from_deleg(struct dns_msg*, struct regional* region, uint8_t* ipv4, uint8_t* ipv6, uint8_t* ns_name, size_t ns_name_len) {
+	struct delegpt* dp;
+	dp = delegpt_create(region);
+	delegpt_set_name(dp, region, ns_name);
+    delegpt_add_ns(dp, region,  ns_name, 0, NULL, 53);
+	// delegpt_rrset_add_ns(dp, region, ns_rrset, 0);
+    if (ipv4 != NULL) {
+        struct sockaddr_in sa4;
+        socklen_t lenv4 = (socklen_t)sizeof(sa4);
+        memset(&sa4, 0, lenv4);
+        sa4.sin_family = AF_INET;
+        memmove(&sa4.sin_addr, ipv4, INET_SIZE);
+        delegpt_add_target(dp, region, ns_name, ns_name_len, (struct sockaddr_storage*)&sa4, lenv4, 0, 0, NULL);
+        }
+    if (ipv6 != NULL) {
+        struct sockaddr_in6 sa6;
+        socklen_t lenv6 = (socklen_t)sizeof(sa6);
+        memset(&sa6, 0, lenv6);
+        sa6.sin6_family = AF_INET6;
+        memmove(&sa6.sin6_addr, ipv6, INET6_SIZE);
+        delegpt_add_target(dp, region, ns_name, ns_name_len, (struct sockaddr_storage*)&sa6, lenv6, 0, 0, NULL);
+    }
+    return dp;
+// delegpt_add_addr(struct delegpt* dp, struct regional* region,
+// 	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t bogus,
+// 	uint8_t lame, char* tls_auth_name, int port, int* additions)
+}
+
 struct delegpt* 
 delegpt_from_message(struct dns_msg* msg, struct regional* region)
 {
@@ -79,16 +79,6 @@ struct delegpt {
 	 * Also true if the delegationpoint was created from a delegation
 	 * message and thus contains the parent-side-info already. */
 	uint8_t has_parent_side_NS;
-	/** if true, the delegation point has reached last resort processing
-	 *  and the parent side information has been possibly added to the
-	 *  delegation point.
-	 *  For now this signals that further target lookups will ignore
-	 *  the configured target-fetch-policy and only resolve on
-	 *  demand to try and avoid triggering limits at this stage (.i.e, it
-	 *  is very likely that the A/AAAA queries for the newly added name
-	 *  servers will not yield new IP addresses and trigger NXNS
-	 *  countermeasures. */
-	uint8_t fallback_to_parent_side_NS;
 	/** for assertions on type of delegpt */
 	uint8_t dp_type_mlc;
 	/** use SSL for upstream query */
@@ -371,6 +361,7 @@ size_t delegpt_count_targets(struct delegpt* dp);
 struct delegpt* delegpt_from_message(struct dns_msg* msg, 
 	struct regional* regional);

+struct delegpt* delegpt_from_deleg(struct dns_msg*, struct regional* region, uint8_t* ipv4, uint8_t* pv6, uint8_t* ns_name, size_t ns_name_len);
 /**
 * Mark negative return in delegation point for specific nameserver.
 * sets the got4 or got6 to negative, updates the ns->resolved.
@@ -129,7 +129,7 @@ forwards_insert_data(struct iter_forwards* fwd, uint16_t c, uint8_t* nm,
 	node->namelabs = nmlabs;
 	node->dp = dp;
 	if(!rbtree_insert(fwd->tree, &node->node)) {
-		char buf[LDNS_MAX_DOMAINLEN];
+		char buf[257];
 		dname_str(nm, buf);
 		log_err("duplicate forward zone %s ignored.", buf);
 		delegpt_free_mlc(dp);
@@ -139,17 +139,6 @@ forwards_insert_data(struct iter_forwards* fwd, uint16_t c, uint8_t* nm,
 	return 1;
 }

-static struct iter_forward_zone*
-fwd_zone_find(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
-{
-	struct iter_forward_zone key;
-	key.node.key = &key;
-	key.dclass = c;
-	key.name = nm;
-	key.namelabs = dname_count_size_labels(nm, &key.namelen);
-	return (struct iter_forward_zone*)rbtree_search(fwd->tree, &key);
-}
-
 /** insert new info into forward structure given dp */
 static int
 forwards_insert(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp)
@@ -228,11 +217,6 @@ read_fwds_host(struct config_stub* s, struct delegpt* dp)
 				s->name, p->str);
 			return 0;
 		}
-		if(dname_subdomain_c(dname, dp->name)) {
-			log_warn("forward-host '%s' may have a circular "
-				"dependency on forward-zone '%s'",
-				p->str, s->name);
-		}
 #if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
 		if(tls_auth_name)
 			log_err("no name verification functionality in "
@@ -337,40 +321,6 @@ make_stub_holes(struct iter_forwards* fwd, struct config_file* cfg)
 			log_err("cannot parse stub name '%s'", s->name);
 			return 0;
 		}
-		if(fwd_zone_find(fwd, LDNS_RR_CLASS_IN, dname) != NULL) {
-			/* Already a forward zone there. */
-			free(dname);
-			continue;
-		}
-		if(!fwd_add_stub_hole(fwd, LDNS_RR_CLASS_IN, dname)) {
-			free(dname);
-			log_err("out of memory");
-			return 0;
-		}
-		free(dname);
-	}
-	return 1;
-}
-
-/** make NULL entries for auths */
-static int
-make_auth_holes(struct iter_forwards* fwd, struct config_file* cfg)
-{
-	struct config_auth* a;
-	uint8_t* dname;
-	size_t dname_len;
-	for(a = cfg->auths; a; a = a->next) {
-		if(!a->name) continue;
-		dname = sldns_str2wire_dname(a->name, &dname_len);
-		if(!dname) {
-			log_err("cannot parse auth name '%s'", a->name);
-			return 0;
-		}
-		if(fwd_zone_find(fwd, LDNS_RR_CLASS_IN, dname) != NULL) {
-			/* Already a forward zone there. */
-			free(dname);
-			continue;
-		}
 		if(!fwd_add_stub_hole(fwd, LDNS_RR_CLASS_IN, dname)) {
 			free(dname);
 			log_err("out of memory");
@@ -403,16 +353,6 @@ forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg)
 		lock_rw_unlock(&fwd->lock);
 		return 0;
 	}
-	/* TODO: Now we punch holes for auth zones as well so that in
-	 *       iterator:forward_request() we see the configured
-	 *       delegation point, but code flow/naming is hard to follow.
-	 *       Consider having a single tree with configured
-	 *       delegation points for all categories
-	 *       (stubs, forwards, auths). */
-	if(!make_auth_holes(fwd, cfg)) {
-		lock_rw_unlock(&fwd->lock);
-		return 0;
-	}
 	fwd_init_parents(fwd);
 	lock_rw_unlock(&fwd->lock);
 	return 1;
@@ -563,6 +503,17 @@ forwards_get_mem(struct iter_forwards* fwd)
 	return s;
 }

+static struct iter_forward_zone*
+fwd_zone_find(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
+{
+	struct iter_forward_zone key;
+	key.node.key = &key;
+	key.dclass = c;
+	key.name = nm;
+	key.namelabs = dname_count_size_labels(nm, &key.namelen);
+	return (struct iter_forward_zone*)rbtree_search(fwd->tree, &key);
+}
+
 int 
 forwards_add_zone(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp,
 	int nolock)
@@ -639,19 +590,3 @@ forwards_delete_stub_hole(struct iter_forwards* fwd, uint16_t c,
 	fwd_init_parents(fwd);
 	if(!nolock) { lock_rw_unlock(&fwd->lock); }
 }
-
-void
-forwards_swap_tree(struct iter_forwards* fwd, struct iter_forwards* data)
-{
-	rbtree_type* oldtree = fwd->tree;
-	if(oldtree) {
-		lock_unprotect(&fwd->lock, oldtree);
-	}
-	if(data->tree) {
-		lock_unprotect(&data->lock, data->tree);
-	}
-	fwd->tree = data->tree;
-	data->tree = oldtree;
-	lock_protect(&fwd->lock, fwd->tree, sizeof(*fwd->tree));
-	lock_protect(&data->lock, data->tree, sizeof(*data->tree));
-}
@@ -234,13 +234,4 @@ int forwards_add_stub_hole(struct iter_forwards* fwd, uint16_t c,
 void forwards_delete_stub_hole(struct iter_forwards* fwd, uint16_t c,
 	uint8_t* nm, int nolock);

-/**
- * Swap internal tree with preallocated entries. Caller should manage
- * the locks.
- * @param fwd: the forward data structure.
- * @param data: the data structure used to take elements from. This contains
- * 	the old elements on return.
- */
-void forwards_swap_tree(struct iter_forwards* fwd, struct iter_forwards* data);
-
 #endif /* ITERATOR_ITER_FWD_H */
@@ -181,7 +181,7 @@ hints_insert(struct iter_hints* hints, uint16_t c, struct delegpt* dp,
 	node->noprime = (uint8_t)noprime;
 	if(!name_tree_insert(&hints->tree, &node->node, dp->name, dp->namelen,
 		dp->namelabs, c)) {
-		char buf[LDNS_MAX_DOMAINLEN];
+		char buf[257];
 		dname_str(dp->name, buf);
 		log_err("second hints for zone %s ignored.", buf);
 		delegpt_free_mlc(dp);
@@ -231,11 +231,6 @@ read_stubs_host(struct config_stub* s, struct delegpt* dp)
 				s->name, p->str);
 			return 0;
 		}
-		if(dname_subdomain_c(dname, dp->name)) {
-			log_warn("stub-host '%s' may have a circular "
-				"dependency on stub-zone '%s'",
-				p->str, s->name);
-		}
 #if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
 		if(tls_auth_name)
 			log_err("no name verification functionality in "
@@ -616,14 +611,3 @@ hints_delete_stub(struct iter_hints* hints, uint16_t c, uint8_t* nm,
 	name_tree_init_parents(&hints->tree);
 	if(!nolock) { lock_rw_unlock(&hints->lock); }
 }
-
-void
-hints_swap_tree(struct iter_hints* hints, struct iter_hints* data)
-{
-	rbnode_type* oldroot = hints->tree.root;
-	size_t oldcount = hints->tree.count;
-	hints->tree.root = data->tree.root;
-	hints->tree.count = data->tree.count;
-	data->tree.root = oldroot;
-	data->tree.count = oldcount;
-}
@@ -198,13 +198,4 @@ int hints_add_stub(struct iter_hints* hints, uint16_t c, struct delegpt* dp,
 void hints_delete_stub(struct iter_hints* hints, uint16_t c,
 	uint8_t* nm, int nolock);

-/**
- * Swap internal tree with preallocated entries. Caller should manage
- * the locks.
- * @param hints: the hints data structure.
- * @param data: the data structure used to take elements from. This contains
- * 	the old elements on return.
- */
-void hints_swap_tree(struct iter_hints* hints, struct iter_hints* data);
-
 #endif /* ITERATOR_ITER_HINTS_H */
@@ -207,168 +207,6 @@ size_t priv_get_mem(struct iter_priv* priv)
 	return sizeof(*priv) + regional_get_mem(priv->region);
 }

-/**
- * Check if svcparam ipv4hint contains a private address.
- * @param priv: private address lookup struct.
- * @param d: the data bytes.
- * @param data_len: number of data bytes in the svcparam.
- * @param addr: address to return the private address to log in to.
- *	It has space for IPv4 and IPv6 addresses.
- * @param addrlen: length of the addr. Returns the correct size for the addr.
- * @return true if the rdata contains a private address.
- */
-static int svcb_ipv4hint_contains_priv_addr(struct iter_priv* priv,
-	uint8_t* d, uint16_t data_len, struct sockaddr_storage* addr,
-	socklen_t* addrlen)
-{
-	struct sockaddr_in sa;
-	*addrlen = (socklen_t)sizeof(struct sockaddr_in);
-	memset(&sa, 0, sizeof(struct sockaddr_in));
-	sa.sin_family = AF_INET;
-	sa.sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
-
-	while(data_len >= LDNS_IP4ADDRLEN) {
-		memmove(&sa.sin_addr, d, LDNS_IP4ADDRLEN);
-		memmove(addr, &sa, *addrlen);
-		if(priv_lookup_addr(priv, addr, *addrlen))
-			return 1;
-
-		d += LDNS_IP4ADDRLEN;
-		data_len -= LDNS_IP4ADDRLEN;
-	}
-	/* if data_len != 0 here, then the svcparam is malformed. */
-	return 0;
-}
-
-/**
- * Check if svcparam ipv6hint contains a private address.
- * @param priv: private address lookup struct.
- * @param d: the data bytes.
- * @param data_len: number of data bytes in the svcparam.
- * @param addr: address to return the private address to log in to.
- *	It has space for IPv4 and IPv6 addresses.
- * @param addrlen: length of the addr. Returns the correct size for the addr.
- * @return true if the rdata contains a private address.
- */
-static int svcb_ipv6hint_contains_priv_addr(struct iter_priv* priv,
-	uint8_t* d, uint16_t data_len, struct sockaddr_storage* addr,
-	socklen_t* addrlen)
-{
-	struct sockaddr_in6 sa;
-	*addrlen = (socklen_t)sizeof(struct sockaddr_in6);
-	memset(&sa, 0, sizeof(struct sockaddr_in6));
-	sa.sin6_family = AF_INET6;
-	sa.sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
-
-	while(data_len >= LDNS_IP6ADDRLEN) {
-		memmove(&sa.sin6_addr, d, LDNS_IP6ADDRLEN);
-		memmove(addr, &sa, *addrlen);
-		if(priv_lookup_addr(priv, addr, *addrlen))
-			return 1;
-
-		d += LDNS_IP6ADDRLEN;
-		data_len -= LDNS_IP6ADDRLEN;
-	}
-	/* if data_len != 0 here, then the svcparam is malformed. */
-	return 0;
-}
-
-/**
- * Check if type SVCB and HTTPS rdata contains a private address.
- * @param priv: private address lookup struct.
- * @param pkt: the packet.
- * @param rr: the rr with rdata to check.
- * @param addr: address to return the private address to log in to.
- * @param addrlen: length of the addr. Initially the total size, on
- *	return the correct size for the addr.
- * @return true if the rdata contains a private address.
- */
-static int svcb_rr_contains_priv_addr(struct iter_priv* priv,
-	sldns_buffer* pkt, struct rr_parse* rr, struct sockaddr_storage* addr,
-	socklen_t* addrlen)
-{
-	uint8_t* d = rr->ttl_data;
-	uint16_t svcparamkey, data_len, rdatalen;
-	size_t oldpos, dname_len, dname_start, dname_compr_len;
-	d += 4; /* skip TTL */
-	rdatalen = sldns_read_uint16(d); /* read rdata length */
-	d += 2;
-
-	if(rdatalen < 2 /* priority */ + 1 /* 1 length target */)
-		return 0; /* malformed, too short */
-	d += 2; /* skip priority */
-	rdatalen -= 2;
-	oldpos = sldns_buffer_position(pkt);
-	sldns_buffer_set_position(pkt, (size_t)(d - sldns_buffer_begin(pkt)));
-	dname_start = sldns_buffer_position(pkt);
-	dname_len = pkt_dname_len(pkt);
-	dname_compr_len = sldns_buffer_position(pkt) - dname_start;
-	sldns_buffer_set_position(pkt, oldpos);
-	if(dname_len == 0)
-		return 0; /* dname malformed */
-	if(dname_compr_len > rdatalen)
-		return 0; /* malformed */
-	d += dname_compr_len; /* skip target */
-	rdatalen -= dname_compr_len;
-
-	while(rdatalen >= 4) {
-		svcparamkey = sldns_read_uint16(d);
-		data_len = sldns_read_uint16(d+2);
-		d += 4;
-		rdatalen -= 4;
-
-		/* verify that we have data_len data */
-		if(data_len > rdatalen) {
-			/* It is malformed, but if there are addresses
-			 * in there it can be rejected. */
-			data_len = rdatalen;
-		}
-
-		if(!data_len)
-			continue; /* no data for the svcparamkey */
-
-		if(svcparamkey == SVCB_KEY_IPV4HINT) {
-			if(svcb_ipv4hint_contains_priv_addr(priv, d, data_len,
-				addr, addrlen))
-				return 1;
-		} else if(svcparamkey == SVCB_KEY_IPV6HINT) {
-			if(svcb_ipv6hint_contains_priv_addr(priv, d, data_len,
-				addr, addrlen))
-				return 1;
-		}
-		d += data_len;
-		rdatalen -= data_len;
-	}
-	/* If rdatalen != 0 here, then the svcb rdata is malformed. */
-	return 0;
-}
-
-/**
- * Check if the SVCB and HTTPS rrset is bad.
- * @param priv: private address lookup struct.
- * @param pkt: the packet.
- * @param rrset: the rrset to check.
- * @return 1 if the entire rrset has to be removed. 0 if not.
- * It removes RRs if they have private addresses, and log that.
- */
-static int priv_svcb_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
-	struct rrset_parse* rrset)
-{
-	struct rr_parse* rr, *prev = NULL;
-	struct sockaddr_storage addr;
-	socklen_t addrlen = (socklen_t)sizeof(addr);
-	for(rr = rrset->rr_first; rr; rr = rr->next) {
-		if(svcb_rr_contains_priv_addr(priv, pkt, rr, &addr,
-			&addrlen)) {
-			if(msgparse_rrset_remove_rr("sanitize: removing public name with private address", pkt, rrset, prev, rr, &addr, addrlen))
-				return 1;
-			continue;
-		}
-		prev = rr;
-	}
-	return 0;
-}
-
 int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 	struct rrset_parse* rrset)
 {
@@ -430,11 +268,7 @@ int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 				}
 				prev = rr;
 			}
-		} else if(rrset->type == LDNS_RR_TYPE_SVCB ||
-			rrset->type == LDNS_RR_TYPE_HTTPS) {
-			if(priv_svcb_rrset_bad(priv, pkt, rrset))
-				return 1;
-		}
+		} 
 	}
 	return 0;
 }
@@ -285,17 +285,6 @@ synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
 		return NULL;
 	memmove(cn->rr_first->ttl_data, rrset->rr_first->ttl_data,
 		sizeof(uint32_t)); /* RFC6672: synth CNAME TTL == DNAME TTL */
-	/* Apply cache TTL policy so DNAME and synthesized CNAME stay equal
-	 * and respect cache-min-ttl/cache-max-ttl (same as rdata_copy path). */
-	if(!SERVE_ORIGINAL_TTL) {
-		uint32_t ttl = sldns_read_uint32(cn->rr_first->ttl_data);
-		time_t ttl_t = (time_t)ttl;
-		if(ttl_t < MIN_TTL) ttl_t = MIN_TTL;
-		if(ttl_t > MAX_TTL) ttl_t = MAX_TTL;
-		ttl = (uint32_t)ttl_t;
-		sldns_write_uint32(cn->rr_first->ttl_data, ttl);
-		sldns_write_uint32(rrset->rr_first->ttl_data, ttl);
-	}
 	sldns_write_uint16(cn->rr_first->ttl_data+4, aliaslen);
 	memmove(cn->rr_first->ttl_data+6, alias, aliaslen);
 	cn->rr_first->size = sizeof(uint16_t)+aliaslen;
@@ -378,84 +367,6 @@ type_allowed_in_additional_section(uint16_t tp)
 	return 0;
 }

-/** Shorten RRset */
-static void
-shorten_rrset(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
-{
-	/* The too large NS RRset is shortened. This is so that too large
-	 * content does not overwhelm the cache. It may make the rrset
-	 * bogus if it was signed, and then the domain is not resolved any
-	 * more, that is okay, the NS RRset was too large. During a referral
-	 * it can be shortened and then the first part of the list could
-	 * be used to resolve. The scrub continues to disallow glue for the
-	 * removed nameserver RRs and removes that too. Because the glue
-	 * is not marked as okay, since the RRs have been removed here. */
-	int i;
-	struct rr_parse* rr = rrset->rr_first, *prev = NULL;
-	if(!rr)
-		return;
-	for(i=0; i<count; i++) {
-		prev = rr;
-		rr = rr->next;
-		if(!rr)
-			return; /* The RRset is already short. */
-	}
-	if(verbosity >= VERB_QUERY
-		&& rrset->dname_len <= LDNS_MAX_DOMAINLEN) {
-		uint8_t buf[LDNS_MAX_DOMAINLEN+1];
-		dname_pkt_copy(pkt, buf, rrset->dname);
-		log_nametypeclass(VERB_QUERY, "normalize: shorten RRset:", buf,
-			rrset->type, ntohs(rrset->rrset_class));
-	}
-	/* remove further rrs */
-	rrset->rr_last = prev;
-	rrset->rr_count = count;
-	while(rr) {
-		rrset->size -= rr->size;
-		rr = rr->next;
-	}
-	if(rrset->rr_last)
-		rrset->rr_last->next = NULL;
-	else	rrset->rr_first = NULL;
-}
-
-/** Shorten RRSIGs list */
-static void
-shorten_rrsig(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
-{
-	/* The too large list of RRSIGs on the RRset is shortened.
-	 * This is so that too large content does not overwhelm the cache.
-	 * The validator does not validate more than a max number of
-	 * RRSIGs as well. */
-	int i;
-	struct rr_parse* rr = rrset->rrsig_first, *prev = NULL;
-	if(!rr)
-		return;
-	for(i=0; i<count; i++) {
-		prev = rr;
-		rr = rr->next;
-		if(!rr)
-			return; /* The RRSIG list is already short. */
-	}
-	if(verbosity >= VERB_QUERY
-		&& rrset->dname_len <= LDNS_MAX_DOMAINLEN) {
-		uint8_t buf[LDNS_MAX_DOMAINLEN+1];
-		dname_pkt_copy(pkt, buf, rrset->dname);
-		log_nametypeclass(VERB_QUERY, "normalize: shorten RRSIGs:",
-			buf, rrset->type, ntohs(rrset->rrset_class));
-	}
-	/* remove further rrsigs */
-	rrset->rrsig_last = prev;
-	rrset->rrsig_count = count;
-	while(rr) {
-		rrset->size -= rr->size;
-		rr = rr->next;
-	}
-	if(rrset->rrsig_last)
-		rrset->rrsig_last->next = NULL;
-	else	rrset->rrsig_first = NULL;
-}
-
 /**
 * This routine normalizes a response. This includes removing "irrelevant"
 * records from the answer and additional sections and (re)synthesizing
@@ -466,22 +377,19 @@ shorten_rrsig(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
 * @param qinfo: original query.
 * @param region: where to allocate synthesized CNAMEs.
 * @param env: module env with config options.
- * @param zonename: name of server zone.
 * @return 0 on error.
 */
 static int
 scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, 
 	struct query_info* qinfo, struct regional* region,
-	struct module_env* env, uint8_t* zonename)
+	struct module_env* env)
 {
 	uint8_t* sname = qinfo->qname;
 	size_t snamelen = qinfo->qname_len;
 	struct rrset_parse* rrset, *prev, *nsset=NULL;
-	int cname_length = 0; /* number of CNAMEs, or DNAMEs */

 	if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR &&
-		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN &&
-		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_YXDOMAIN)
+		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN)
 		return 1;

 	/* For the ANSWER section, remove all "irrelevant" records and add
@@ -493,21 +401,8 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 	prev = NULL;
 	rrset = msg->rrset_first;
 	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
-		if((int)rrset->rrsig_count > env->cfg->iter_scrub_rrsig)
-			shorten_rrsig(pkt, rrset, env->cfg->iter_scrub_rrsig);
-		if(cname_length > env->cfg->iter_scrub_cname) {
-			/* Too many CNAMEs, or DNAMEs, from the authority
-			 * server, scrub down the length to something
-			 * shorter. This deletes everything after the limit
-			 * is reached. The iterator is going to look up
-			 * the content one by one anyway. */
-			remove_rrset("normalize: removing because too many cnames:",
-				pkt, msg, prev, &rrset);
-			continue;
-		}
-		if(rrset->type == LDNS_RR_TYPE_DNAME &&
-			pkt_strict_sub(pkt, sname, rrset->dname) &&
-			pkt_sub(pkt, rrset->dname, zonename)) {
+		if(rrset->type == LDNS_RR_TYPE_DNAME && 
+			pkt_strict_sub(pkt, sname, rrset->dname)) {
 			/* check if next rrset is correct CNAME. else,
 			 * synthesize a CNAME */
 			struct rrset_parse* nx = rrset->rrset_all_next;
@@ -523,14 +418,8 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				&aliaslen, pkt)) {
 				verbose(VERB_ALGO, "synthesized CNAME "
 					"too long");
-				if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_YXDOMAIN) {
-					prev = rrset;
-					rrset = rrset->rrset_all_next;
-					continue;
-				}
 				return 0;
 			}
-			cname_length++;
 			if(nx && nx->type == LDNS_RR_TYPE_CNAME && 
 			   dname_pkt_compare(pkt, sname, nx->dname) == 0) {
 				/* check next cname */
@@ -553,6 +442,8 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				log_err("out of memory synthesizing CNAME");
 				return 0;
 			}
+			/* FIXME: resolve the conflict between synthesized 
+			 * CNAME ttls and the cache. */
 			rrset = nx;
 			continue;

@@ -569,13 +460,11 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 		if(rrset->type == LDNS_RR_TYPE_CNAME) {
 			struct rrset_parse* nx = rrset->rrset_all_next;
 			uint8_t* oldsname = sname;
-			cname_length++;
 			/* see if the next one is a DNAME, if so, swap them */
 			if(nx && nx->section == LDNS_SECTION_ANSWER &&
 				nx->type == LDNS_RR_TYPE_DNAME &&
 				nx->rr_count == 1 &&
-				pkt_strict_sub(pkt, sname, nx->dname) &&
-				pkt_sub(pkt, nx->dname, zonename)) {
+				pkt_strict_sub(pkt, sname, nx->dname)) {
 				/* there is a DNAME after this CNAME, it 
 				 * is in the ANSWER section, and the DNAME
 				 * applies to the name we cover */
@@ -618,10 +507,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					LDNS_SECTION_ANSWER &&
 					dname_pkt_compare(pkt, oldsname,
 					rrset->dname) == 0) {
-					if(rrset->type == LDNS_RR_TYPE_NS &&
-						rrset->rr_count > env->cfg->iter_scrub_ns) {
-						shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
-					}
 					prev = rrset;
 					rrset = rrset->rrset_all_next;
 				}
@@ -637,11 +522,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 			continue;
 		}

-		if(rrset->type == LDNS_RR_TYPE_NS &&
-			rrset->rr_count > env->cfg->iter_scrub_ns) {
-			shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
-		}
-
 		/* Mark the additional names from relevant rrset as OK. */
 		/* only for RRsets that match the query name, other ones
 		 * will be removed by sanitize, so no additional for them */
@@ -670,8 +550,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
-		if((int)rrset->rrsig_count > env->cfg->iter_scrub_rrsig)
-			shorten_rrsig(pkt, rrset, env->cfg->iter_scrub_rrsig);
 		/* only one NS set allowed in authority section */
 		if(rrset->type==LDNS_RR_TYPE_NS) {
 			/* NS set must be pertinent to the query */
@@ -693,45 +571,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					"RRset:", pkt, msg, prev, &rrset);
 				continue;
 			}
-			/* If the NS set is a promiscuous NS set, scrub that
-			 * to remove potential for poisonous contents that
-			 * affects other names in the same zone. Remove
-			 * promiscuous NS sets in positive answers, that
-			 * thus have records in the answer section. Nodata
-			 * and nxdomain promiscuous NS sets have been removed
-			 * already. Since the NS rrset is scrubbed, its
-			 * address records are also not marked to be allowed
-			 * and are removed later. */
-			if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR &&
-				msg->an_rrsets != 0 &&
-				env->cfg->iter_scrub_promiscuous) {
-				remove_rrset("normalize: removing promiscuous "
-					"RRset:", pkt, msg, prev, &rrset);
-				continue;
-			}
-			/* Also delete promiscuous NS for other RCODEs */
-			if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR
-				&& env->cfg->iter_scrub_promiscuous) {
-				remove_rrset("normalize: removing promiscuous "
-					"RRset:", pkt, msg, prev, &rrset);
-				continue;
-			}
-			/* Also delete promiscuous NS for NOERROR with nodata
-			 * for authoritative answers, not for delegations.
-			 * NOERROR with an_rrsets!=0 already handled.
-			 * Also NOERROR and soa_in_auth already handled.
-			 * NOERROR with an_rrsets==0, and not a referral.
-			 * referral is (NS not the zonename, noSOA).
-			 */
-			if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR
-				&& msg->an_rrsets == 0
-				&& !(dname_pkt_compare(pkt, rrset->dname,
-				     zonename) != 0 && !soa_in_auth(msg))
-				&& env->cfg->iter_scrub_promiscuous) {
-				remove_rrset("normalize: removing promiscuous "
-					"RRset:", pkt, msg, prev, &rrset);
-				continue;
-			}
 			if(nsset == NULL) {
 				nsset = rrset;
 			} else {
@@ -739,25 +578,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					"RRset:", pkt, msg, prev, &rrset);
 				continue;
 			}
-			if(rrset->rr_count > env->cfg->iter_scrub_ns) {
-				/* If this is not a referral, and the NS RRset
-				 * is signed, then remove it entirely, so
-				 * that when it becomes bogus it does not
-				 * make the message that is otherwise fine
-				 * into a bogus message. */
-				if(!(msg->an_rrsets == 0 &&
-					FLAGS_GET_RCODE(msg->flags) ==
-					LDNS_RCODE_NOERROR &&
-					!soa_in_auth(msg) &&
-					!(msg->flags & BIT_AA)) &&
-					rrset->rrsig_count != 0) {
-					remove_rrset("normalize: removing too large NS "
-						"RRset:", pkt, msg, prev, &rrset);
-					continue;
-				} else {
-					shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
-				}
-			}
 		}
 		/* if this is type DS and we query for type DS we just got
 		 * a referral answer for our type DS query, fix packet */
@@ -777,13 +597,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 			rrset->rrset_all_next = NULL;
 			return 1;
 		}
-		/* Only mark glue as allowed for type NS in the authority
-		 * section. Other RR types do not get glue for them, it
-		 * is allowed from the answer section, but not authority
-		 * so that a message can not have address records cached
-		 * as a side effect to the query. */
-		if(rrset->type==LDNS_RR_TYPE_NS)
-			mark_additional_rrset(pkt, msg, rrset);
+		mark_additional_rrset(pkt, msg, rrset);
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -820,8 +634,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
-		if((int)rrset->rrsig_count > env->cfg->iter_scrub_rrsig)
-			shorten_rrsig(pkt, rrset, env->cfg->iter_scrub_rrsig);
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -977,7 +789,6 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 {
 	int del_addi = 0; /* if additional-holding rrsets are deleted, we
 		do not trust the normalized additional-A-AAAA any more */
-	uint8_t* ns_rrset_dname = NULL;
 	int added_rrlen_ede = 0;
 	struct rrset_parse* rrset, *prev;
 	prev = NULL;
@@ -1032,10 +843,8 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 		}

 		/* remove private addresses */
-		if(rrset->type == LDNS_RR_TYPE_A ||
-			rrset->type == LDNS_RR_TYPE_AAAA ||
-			rrset->type == LDNS_RR_TYPE_SVCB ||
-			rrset->type == LDNS_RR_TYPE_HTTPS) {
+		if( (rrset->type == LDNS_RR_TYPE_A || 
+			rrset->type == LDNS_RR_TYPE_AAAA)) {

 			/* do not set servfail since this leads to too
 			 * many drops of other people using rfc1918 space */
@@ -1085,16 +894,6 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 				continue;
 			}
 		}
-		if(rrset->type == LDNS_RR_TYPE_NS &&
-			(rrset->section == LDNS_SECTION_AUTHORITY ||
-			rrset->section == LDNS_SECTION_ANSWER)) {
-			/* If the type is NS, and we're in the
-			 * answer or authority section, then
-			 * store the dname so we can check
-			 * against the glue records
-			 * further down	*/
-			ns_rrset_dname = rrset->dname;
-		}
 		if(del_addi && rrset->section == LDNS_SECTION_ADDITIONAL) {
 			remove_rrset("sanitize: removing potential "
 			"poison reference RRset:", pkt, msg, prev, &rrset);
@@ -1107,26 +906,6 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
-		if(env->cfg->harden_unverified_glue && ns_rrset_dname &&
-			rrset->section == LDNS_SECTION_ADDITIONAL &&
-			(rrset->type == LDNS_RR_TYPE_A || rrset->type == LDNS_RR_TYPE_AAAA) &&
-			!pkt_strict_sub(pkt, rrset->dname, ns_rrset_dname)) {
-			/* We're in the additional section, looking
-			 * at an A/AAAA rrset, have a previous
-			 * delegation point and we notice that
-			 * the glue records are NOT for strict
-			 * subdomains of the delegation. So set a
-			 * flag, recompute the hash for the rrset
-			 * and write the A/AAAA record to cache.
-			 * It'll be retrieved if we can't separately
-			 * resolve the glue	*/
-			rrset->flags = PACKED_RRSET_UNVERIFIED_GLUE;
-			rrset->hash = pkt_hash_rrset(pkt, rrset->dname, rrset->type, rrset->rrset_class, rrset->flags);
-			store_rrset(pkt, msg, env, rrset);
-			remove_rrset("sanitize: storing potential "
-			"unverified glue reference RRset:", pkt, msg, prev, &rrset);
-			continue;
-		}
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -1152,8 +931,7 @@ scrub_message(sldns_buffer* pkt, struct msg_parse* msg,
 	/* this is not required for basic operation but is a forgery 
 	 * resistance (security) feature */
 	if((FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR ||
-		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN ||
-		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_YXDOMAIN) &&
+		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN) &&
 		msg->qdcount == 0)
 		return 0;

@@ -1167,7 +945,7 @@ scrub_message(sldns_buffer* pkt, struct msg_parse* msg,
 	}

 	/* normalize the response, this cleans up the additional.  */
-	if(!scrub_normalize(pkt, msg, qinfo, region, env, zonename))
+	if(!scrub_normalize(pkt, msg, qinfo, region, env))
 		return 0;
 	/* delete all out-of-zone information */
 	if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie, qstate))
@@ -77,73 +77,41 @@
 static const char DEFAULT_NAT64_PREFIX[] = "64:ff9b::/96";

 /** fillup fetch policy array */
-static int
-fetch_fill(int* target_fetch_policy, int max_dependency_depth, const char* str)
+static void
+fetch_fill(struct iter_env* ie, const char* str)
 {
 	char* s = (char*)str, *e;
 	int i;
-	for(i=0; i<max_dependency_depth+1; i++) {
-		target_fetch_policy[i] = strtol(s, &e, 10);
-		if(s == e) {
-			log_err("cannot parse fetch policy number %s", s);
-			return 0;
-		}
+	for(i=0; i<ie->max_dependency_depth+1; i++) {
+		ie->target_fetch_policy[i] = strtol(s, &e, 10);
+		if(s == e)
+			fatal_exit("cannot parse fetch policy number %s", s);
 		s = e;
 	}
-	return 1;
 }

 /** Read config string that represents the target fetch policy */
-int
-read_fetch_policy(int** target_fetch_policy, int* max_dependency_depth,
-	const char* str)
+static int
+read_fetch_policy(struct iter_env* ie, const char* str)
 {
 	int count = cfg_count_numbers(str);
 	if(count < 1) {
 		log_err("Cannot parse target fetch policy: \"%s\"", str);
 		return 0;
 	}
-	*max_dependency_depth = count - 1;
-	*target_fetch_policy = (int*)calloc(
-		(size_t)(*max_dependency_depth)+1, sizeof(int));
-	if(!*target_fetch_policy) {
+	ie->max_dependency_depth = count - 1;
+	ie->target_fetch_policy = (int*)calloc(
+		(size_t)ie->max_dependency_depth+1, sizeof(int));
+	if(!ie->target_fetch_policy) {
 		log_err("alloc fetch policy: out of memory");
 		return 0;
 	}
-	if(!fetch_fill(*target_fetch_policy, *max_dependency_depth, str))
-		return 0;
+	fetch_fill(ie, str);
 	return 1;
 }

-struct rbtree_type*
-caps_white_create(void)
-{
-	struct rbtree_type* caps_white = rbtree_create(name_tree_compare);
-	if(!caps_white)
-		log_err("out of memory");
-	return caps_white;
-}
-
-/** delete caps_whitelist element */
-static void
-caps_free(struct rbnode_type* n, void* ATTR_UNUSED(d))
-{
-	if(n) {
-		free(((struct name_tree_node*)n)->name);
-		free(n);
-	}
-}
-
-void
-caps_white_delete(struct rbtree_type* caps_white)
-{
-	if(!caps_white)
-		return;
-	traverse_postorder(caps_white, caps_free, NULL);
-	free(caps_white);
-}
-
-int
+/** apply config caps whitelist items to name tree */
+static int
 caps_white_apply_cfg(rbtree_type* ntree, struct config_file* cfg)
 {
 	struct config_strlist* p;
@@ -176,42 +144,13 @@ caps_white_apply_cfg(rbtree_type* ntree, struct config_file* cfg)
 	return 1;
 }

-int
-nat64_apply_cfg(struct iter_nat64* nat64, struct config_file* cfg)
-{
-	const char *nat64_prefix;
-
-	nat64_prefix = cfg->nat64_prefix;
-	if(!nat64_prefix)
-		nat64_prefix = cfg->dns64_prefix;
-	if(!nat64_prefix)
-		nat64_prefix = DEFAULT_NAT64_PREFIX;
-	if(!netblockstrtoaddr(nat64_prefix, 0, &nat64->nat64_prefix_addr,
-		&nat64->nat64_prefix_addrlen, &nat64->nat64_prefix_net)) {
-		log_err("cannot parse nat64-prefix netblock: %s", nat64_prefix);
-		return 0;
-	}
-	if(!addr_is_ip6(&nat64->nat64_prefix_addr,
-		nat64->nat64_prefix_addrlen)) {
-		log_err("nat64-prefix is not IPv6: %s", cfg->nat64_prefix);
-		return 0;
-	}
-	if(!prefixnet_is_nat64(nat64->nat64_prefix_net)) {
-		log_err("nat64-prefix length it not 32, 40, 48, 56, 64 or 96: %s",
-			nat64_prefix);
-		return 0;
-	}
-	nat64->use_nat64 = cfg->do_nat64;
-	return 1;
-}
-
 int
 iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 {
+	const char *nat64_prefix;
 	int i;
 	/* target fetch policy */
-	if(!read_fetch_policy(&iter_env->target_fetch_policy,
-		&iter_env->max_dependency_depth, cfg->target_fetch_policy))
+	if(!read_fetch_policy(iter_env, cfg->target_fetch_policy))
 		return 0;
 	for(i=0; i<iter_env->max_dependency_depth+1; i++)
 		verbose(VERB_QUERY, "target fetch policy for level %d is %d",
@@ -231,7 +170,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 	}
 	if(cfg->caps_whitelist) {
 		if(!iter_env->caps_white)
-			iter_env->caps_white = caps_white_create();
+			iter_env->caps_white = rbtree_create(name_tree_compare);
 		if(!iter_env->caps_white || !caps_white_apply_cfg(
 			iter_env->caps_white, cfg)) {
 			log_err("Could not set capsforid whitelist");
@@ -240,22 +179,38 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)

 	}

-	if(!nat64_apply_cfg(&iter_env->nat64, cfg)) {
-		log_err("Could not setup nat64");
+	nat64_prefix = cfg->nat64_prefix;
+	if(!nat64_prefix)
+		nat64_prefix = cfg->dns64_prefix;
+	if(!nat64_prefix)
+		nat64_prefix = DEFAULT_NAT64_PREFIX;
+	if(!netblockstrtoaddr(nat64_prefix, 0, &iter_env->nat64_prefix_addr,
+		&iter_env->nat64_prefix_addrlen,
+		&iter_env->nat64_prefix_net)) {
+		log_err("cannot parse nat64-prefix netblock: %s", nat64_prefix);
+		return 0;
+	}
+	if(!addr_is_ip6(&iter_env->nat64_prefix_addr,
+		iter_env->nat64_prefix_addrlen)) {
+		log_err("nat64-prefix is not IPv6: %s", cfg->nat64_prefix);
+		return 0;
+	}
+	if(!prefixnet_is_nat64(iter_env->nat64_prefix_net)) {
+		log_err("nat64-prefix length it not 32, 40, 48, 56, 64 or 96: %s",
+			nat64_prefix);
 		return 0;
 	}

 	iter_env->supports_ipv6 = cfg->do_ip6;
 	iter_env->supports_ipv4 = cfg->do_ip4;
+	iter_env->use_nat64 = cfg->do_nat64;
 	iter_env->outbound_msg_retry = cfg->outbound_msg_retry;
 	iter_env->max_sent_count = cfg->max_sent_count;
 	iter_env->max_query_restarts = cfg->max_query_restarts;
 	return 1;
 }

-/** filter out unsuitable targets.
- * Applies NAT64 if needed as well by replacing the IPv4 with the synthesized
- * IPv6 address.
+/** filter out unsuitable targets
 * @param iter_env: iterator environment with ipv6-support flag.
 * @param env: module environment with infra cache.
 * @param name: zone name
@@ -308,52 +263,17 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	if(a->bogus)
 		return -1; /* address of server is bogus */
 	if(donotq_lookup(iter_env->donotq, &a->addr, a->addrlen)) {
-		if(iter_env->nat64.use_nat64 &&
-			addr_is_ip6(&a->addr, a->addrlen) &&
-			a->addrlen == iter_env->nat64.nat64_prefix_addrlen &&
-			addr_in_common(&a->addr, 128,
-				&iter_env->nat64.nat64_prefix_addr,
-				iter_env->nat64.nat64_prefix_net,
-				iter_env->nat64.nat64_prefix_addrlen) ==
-				iter_env->nat64.nat64_prefix_net) {
-			/* The NAT64 is enabled, and address is IPv6, it is
-			 * in the NAT64 prefix. It is allowed.
-			 * So that in an IPv6-only cluster without internet
-			 * access, that makes the NAT64 translation continue
-			 * to work. The NAT64 prefix is allowed. */
-			/* Otherwise, after a timeout, the already NAT64
-			 * translated address would be treated differently,
-			 * and that causes confusion. */
-			log_addr(VERB_ALGO, "the addr is on the donotquery "
-				"list, but allowed because it is NAT64",
-				&a->addr, a->addrlen);
-		} else {
-			log_addr(VERB_ALGO, "skip addr on the donotquery list",
-				&a->addr, a->addrlen);
-			return -1; /* server is on the donotquery list */
-		}
+		log_addr(VERB_ALGO, "skip addr on the donotquery list",
+			&a->addr, a->addrlen);
+		return -1; /* server is on the donotquery list */
 	}
 	if(!iter_env->supports_ipv6 && addr_is_ip6(&a->addr, a->addrlen)) {
 		return -1; /* there is no ip6 available */
 	}
-	if(!iter_env->supports_ipv4 && !iter_env->nat64.use_nat64 &&
+	if(!iter_env->supports_ipv4 && !iter_env->use_nat64 &&
 	   !addr_is_ip6(&a->addr, a->addrlen)) {
 		return -1; /* there is no ip4 available */
 	}
-	if(iter_env->nat64.use_nat64 && !addr_is_ip6(&a->addr, a->addrlen)) {
-		struct sockaddr_storage real_addr;
-		socklen_t real_addrlen;
-		addr_to_nat64(&a->addr, &iter_env->nat64.nat64_prefix_addr,
-			iter_env->nat64.nat64_prefix_addrlen,
-			iter_env->nat64.nat64_prefix_net,
-			&real_addr, &real_addrlen);
-		log_name_addr(VERB_QUERY, "NAT64 apply: from: ",
-			name, &a->addr, a->addrlen);
-		log_name_addr(VERB_QUERY, "NAT64 apply:   to: ",
-			name, &real_addr, real_addrlen);
-		a->addr = real_addr;
-		a->addrlen = real_addrlen;
-	}
 	/* check lameness - need zone , class info */
 	if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen,
 		name, namelen, qtype, &lame, &dnsseclame, &reclame,
@@ -773,11 +693,10 @@ dns_copy_msg(struct dns_msg* from, struct regional* region)
 void
 iter_dns_store(struct module_env* env, struct query_info* msgqinf,
 	struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
-	struct regional* region, uint16_t flags, time_t qstarttime,
-	int is_valrec)
+	struct regional* region, uint16_t flags, time_t qstarttime)
 {
 	if(!dns_cache_store(env, msgqinf, msgrep, is_referral, leeway,
-		pside, region, flags, qstarttime, is_valrec))
+		pside, region, flags, qstarttime))
 		log_err("out of memory: cannot store data in cache");
 }

@@ -1548,11 +1467,6 @@ iter_stub_fwd_no_cache(struct module_qstate *qstate, struct query_info *qinf,
 	struct delegpt *dp;
 	int nolock = 1;

-	log_assert((retdpname && retdpnamelen
-		&& dpname_storage && dpname_storage_len > 0) ||
-		(retdpname == NULL && retdpnamelen == NULL
-		 && dpname_storage == NULL && dpname_storage_len == 0));
-
 	/* Check for stub. */
 	/* Lock both forwards and hints for atomic read. */
 	lock_rw_rdlock(&qstate->env->fwds->lock);
@@ -1574,15 +1488,14 @@ iter_stub_fwd_no_cache(struct module_qstate *qstate, struct query_info *qinf,

 	/* check stub */
 	if (stub != NULL && stub->dp != NULL) {
-		enum verbosity_value level = VERB_ALGO;
 		int stub_no_cache = stub->dp->no_cache;
 		lock_rw_unlock(&qstate->env->fwds->lock);
-		if(verbosity >= level && stub_no_cache) {
-			char qname[LDNS_MAX_DOMAINLEN];
-			char dpname[LDNS_MAX_DOMAINLEN];
+		if(stub_no_cache) {
+			char qname[255+1];
+			char dpname[255+1];
 			dname_str(qinf->qname, qname);
 			dname_str(stub->dp->name, dpname);
-			verbose(level, "stub for %s %s has no_cache", qname, dpname);
+			verbose(VERB_ALGO, "stub for %s %s has no_cache", qname, dpname);
 		}
 		if(retdpname) {
 			if(stub->dp->namelen > dpname_storage_len) {
@@ -1603,15 +1516,14 @@ iter_stub_fwd_no_cache(struct module_qstate *qstate, struct query_info *qinf,

 	/* Check for forward. */
 	if (dp) {
-		enum verbosity_value level = VERB_ALGO;
 		int dp_no_cache = dp->no_cache;
 		lock_rw_unlock(&qstate->env->hints->lock);
-		if(verbosity >= level && dp_no_cache) {
-			char qname[LDNS_MAX_DOMAINLEN];
-			char dpname[LDNS_MAX_DOMAINLEN];
+		if(dp_no_cache) {
+			char qname[255+1];
+			char dpname[255+1];
 			dname_str(qinf->qname, qname);
 			dname_str(dp->name, dpname);
-			verbose(level, "forward for %s %s has no_cache", qname, dpname);
+			verbose(VERB_ALGO, "forward for %s %s has no_cache", qname, dpname);
 		}
 		if(retdpname) {
 			if(dp->namelen > dpname_storage_len) {
@@ -1652,54 +1564,3 @@ void iterator_set_ip46_support(struct module_stack* mods,
 	if(outnet->num_ip6 == 0)
 		ie->supports_ipv6 = 0;
 }
-
-void
-limit_nsec_ttl(struct dns_msg* msg)
-{
-	/* Limit NSEC and NSEC3 TTL in response, RFC9077 */
-	size_t i;
-	int found = 0;
-	time_t soa_ttl = 0;
-	/* Limit the NSEC and NSEC3 TTL values to the SOA TTL and SOA minimum
-	 * TTL. That has already been applied to the SOA record ttl. */
-	for(i=0; i<msg->rep->rrset_count; i++) {
-		struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
-		if(ntohs(s->rk.type) == LDNS_RR_TYPE_SOA) {
-			struct packed_rrset_data* soadata = (struct packed_rrset_data*)s->entry.data;
-			found = 1;
-			soa_ttl = soadata->ttl;
-			break;
-		}
-	}
-	if(!found)
-		return;
-	for(i=0; i<msg->rep->rrset_count; i++) {
-		struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
-		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC ||
-			ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
-			struct packed_rrset_data* data = (struct packed_rrset_data*)s->entry.data;
-			/* Limit the negative TTL. */
-			if(data->ttl > soa_ttl) {
-				if(verbosity >= VERB_ALGO) {
-					char buf[256];
-					snprintf(buf, sizeof(buf),
-						"limiting TTL %d of %s record to the SOA TTL of %d for",
-						(int)data->ttl, ((ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC)?"NSEC":"NSEC3"), (int)soa_ttl);
-					log_nametypeclass(VERB_ALGO, buf,
-						s->rk.dname, ntohs(s->rk.type),
-						ntohs(s->rk.rrset_class));
-				}
-				data->ttl = soa_ttl;
-			}
-		}
-	}
-}
-
-void
-iter_make_minimal(struct reply_info* rep)
-{
-	size_t rem = rep->ns_numrrsets + rep->ar_numrrsets;
-	rep->ns_numrrsets = 0;
-	rep->ar_numrrsets = 0;
-	rep->rrset_count -= rem;
-}
@@ -61,7 +61,6 @@ struct sock_list;
 struct ub_packed_rrset_key;
 struct module_stack;
 struct outside_network;
-struct iter_nat64;

 /* max number of lookups in the cache for target nameserver names.
 * This stops, for large delegations, N*N lookups in the cache. */
@@ -84,7 +83,6 @@ int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);
 /**
 * Select a valid, nice target to send query to.
 * Sorting and removing unsuitable targets is combined.
- * Adds records to the infra cache if not already there.
 *
 * @param iter_env: iterator module global state, with ip6 enabled and 
 *	do-not-query-addresses.
@@ -144,7 +142,6 @@ struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);
 * @param region: to copy modified (cache is better) rrs back to.
 * @param flags: with BIT_CD for dns64 AAAA translated queries.
 * @param qstarttime: time of query start.
- * @param is_valrec: if the query is validation recursion and does not get
 * return void, because we are not interested in alloc errors,
 * 	the iterator and validator can operate on the results in their
 * 	scratch space (the qstate.region) and are not dependent on the cache.
@@ -153,8 +150,7 @@ struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);
 */
 void iter_dns_store(struct module_env* env, struct query_info* qinf,
 	struct reply_info* rep, int is_referral, time_t leeway, int pside,
-	struct regional* region, uint16_t flags, time_t qstarttime,
-	int is_valrec);
+	struct regional* region, uint16_t flags, time_t qstarttime);

 /**
 * Select randomly with n/m probability.
@@ -432,55 +428,4 @@ int iter_stub_fwd_no_cache(struct module_qstate *qstate,
 void iterator_set_ip46_support(struct module_stack* mods,
 	struct module_env* env, struct outside_network* outnet);

-/**
- * Read config string that represents the target fetch policy.
- * @param target_fetch_policy: alloced on return.
- * @param max_dependency_depth: set on return.
- * @param str: the config string
- * @return false on failure.
- */
-int read_fetch_policy(int** target_fetch_policy, int* max_dependency_depth,
-	const char* str);
-
-/**
- * Create caps exempt data structure.
- * @return NULL on failure.
- */
-struct rbtree_type* caps_white_create(void);
-
-/**
- * Delete caps exempt data structure.
- * @param caps_white: caps exempt tree.
- */
-void caps_white_delete(struct rbtree_type* caps_white);
-
-/**
- * Apply config caps whitelist items to name tree
- * @param ntree: caps exempt tree.
- * @param cfg: config with options.
- */
-int caps_white_apply_cfg(struct rbtree_type* ntree, struct config_file* cfg);
-
-/**
- * Apply config for nat64
- * @param nat64: the nat64 state.
- * @param cfg: config with options.
- * @return false on failure.
- */
-int nat64_apply_cfg(struct iter_nat64* nat64, struct config_file* cfg);
-
-/**
- * Limit NSEC and NSEC3 TTL in response, RFC9077
- * @param msg: dns message, the SOA record ttl is used to restrict ttls
- *	of NSEC and NSEC3 RRsets. If no SOA record, nothing happens.
- */
-void limit_nsec_ttl(struct dns_msg* msg);
-
-/**
- * Make the response minimal. Removed authority and additional section,
- * that works when there is an answer in the answer section.
- * @param rep: reply to modify.
- */
-void iter_make_minimal(struct reply_info* rep);
-
 #endif /* ITERATOR_ITER_UTILS_H */
@@ -32,7 +32,33 @@
 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
+// @JESSE: Iterator (this file) is the module that does all the needed DNS
+//         iterations and walking the DNS tree to try and find an answer.
+//         It includes but not limited to:
+//              1. Finding the closest known delegation point
+//                 (root at startup, or configured zones)
+//              2. Sends a query (the original query if no qname-minimisation)
+//                 to that and gets either an answer or a referral answer.
+//              3. In case of referral answer goes back to 1.
+//
+//          A lot more is happening here, like fallbacks and retries. Don't try
+//          to understand everything at once, it's better to go with the flow
+//          and see what is relevant for you.

+// @JESSE: We do not use '//' comments in the Unbound code base. I explicitly
+//         use them to identify non-relevant parts or WIP comments.
+
+// @JESSE: Some tips:
+//         - For printf kind of debug logging it's easier to use log_err();
+//           these are printed on all verbosity levels.
+//         - For domain name manipulation methods you can have a look at
+//           dname.c/h.
+//         - If you need to do allocations; for your case everything should
+//           have the lifetime of the query state (qstate); you can use
+//           qstate->region as your arena allocator and pass that region to
+//           functions that require one. You can then alloc items there and
+//           forget about them. The whole region is freed when the qstate is
+//           no more.
 /**
 * \file
 *
@@ -70,16 +96,13 @@
 #include "sldns/parseutil.h"
 #include "sldns/sbuffer.h"

-/* number of packets */
-int MAX_GLOBAL_QUOTA = 200;
+
 /* in msec */
 int UNKNOWN_SERVER_NICENESS = 376;
 /* in msec */
 int USEFUL_SERVER_TOP_TIMEOUT = 120000;
 /* Equals USEFUL_SERVER_TOP_TIMEOUT*4 */
 int BLACKLIST_PENALTY = (120000*4);
-/** Timeout when only a single probe query per IP is allowed. */
-int PROBE_MAXRTO = PROBE_MAXRTO_DEFAULT; /* in msec */

 static void target_count_increase_nx(struct iter_qstate* iq, int num);

@@ -107,6 +130,16 @@ iter_init(struct module_env* env, int id)
 	return 1;
 }

+/** delete caps_whitelist element */
+static void
+caps_free(struct rbnode_type* n, void* ATTR_UNUSED(d))
+{
+	if(n) {
+		free(((struct name_tree_node*)n)->name);
+		free(n);
+	}
+}
+
 void 
 iter_deinit(struct module_env* env, int id)
 {
@@ -118,7 +151,10 @@ iter_deinit(struct module_env* env, int id)
 	free(iter_env->target_fetch_policy);
 	priv_delete(iter_env->priv);
 	donotq_delete(iter_env->donotq);
-	caps_white_delete(iter_env->caps_white);
+	if(iter_env->caps_white) {
+		traverse_postorder(iter_env->caps_white, caps_free, NULL);
+		free(iter_env->caps_white);
+	}
 	free(iter_env);
 	env->modinfo[id] = NULL;
 }
@@ -127,6 +163,8 @@ iter_deinit(struct module_env* env, int id)
 static int
 iter_new(struct module_qstate* qstate, int id)
 {
+    // @JESSE: each module can have its own query state. The iter_qstate
+	//         struct below is the state for the iterator.
 	struct iter_qstate* iq = (struct iter_qstate*)regional_alloc(
 		qstate->region, sizeof(struct iter_qstate));
 	qstate->minfo[id] = iq;
@@ -155,7 +193,13 @@ iter_new(struct module_qstate* qstate, int id)
 	iq->dnssec_lame_query = 0;
 	iq->chase_flags = qstate->query_flags;
 	/* Start with the (current) qname. */
+    	// @JESSE: iq->qchase will be the qinfo iterator will be working on and
+	//         updating through the iteration process. It is set here to
+	//         the initial query (qstate->qinfo) that started all this.
 	iq->qchase = qstate->qinfo;
+    iq->deleg_state = 2;
+    iq->deleg_original_qname_len = 0;
+    iq->deleg_original_qname = NULL;
 	outbound_list_init(&iq->outlist);
 	iq->minimise_count = 0;
 	iq->timeout_count = 0;
@@ -163,7 +207,7 @@ iter_new(struct module_qstate* qstate, int id)
 		iq->minimisation_state = INIT_MINIMISE_STATE;
 	else
 		iq->minimisation_state = DONOT_MINIMISE_STATE;
-	
+    // @JESSE: iq->qinfo_out is the qinfo that will be sent out.
 	memset(&iq->qinfo_out, 0, sizeof(struct query_info));
 	return 1;
 }
@@ -243,11 +287,11 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 		} else {
 			/* see if the failure did get (parent-lame) info */
 			if(!cache_fill_missing(super->env, super_iq->qchase.qclass,
-				super->region, super_iq->dp, 0))
+				super->region, super_iq->dp))
 				log_err("out of memory adding missing");
 		}
 		delegpt_mark_neg(dpns, qstate->qinfo.qtype);
-		if((dpns->got4 == 2 || (!ie->supports_ipv4 && !ie->nat64.use_nat64)) &&
+		if((dpns->got4 == 2 || (!ie->supports_ipv4 && !ie->use_nat64)) &&
 			(dpns->got6 == 2 || !ie->supports_ipv6)) {
 			dpns->resolved = 1; /* mark as failed */
 			target_count_increase_nx(super_iq, 1);
@@ -297,7 +341,6 @@ error_response_cache(struct module_qstate* qstate, int id, int rcode)
 	struct reply_info err;
 	struct msgreply_entry* msg;
 	if(qstate->no_cache_store) {
-		qstate->error_response_cache = 1;
 		return error_response(qstate, id, rcode);
 	}
 	if(qstate->prefetch_leeway > NORR_TTL) {
@@ -312,21 +355,16 @@ error_response_cache(struct module_qstate* qstate, int id, int rcode)
 		qstate->qinfo.qname, qstate->qinfo.qname_len,
 		qstate->qinfo.qtype, qstate->qinfo.qclass,
 		qstate->query_flags, 0,
-		qstate->env->cfg->serve_expired)) != NULL) {
+		qstate->env->cfg->serve_expired_ttl_reset)) != NULL) {
 		struct reply_info* rep = (struct reply_info*)msg->entry.data;
-		if(qstate->env->cfg->serve_expired && rep) {
-			if(qstate->env->cfg->serve_expired_ttl_reset &&
-				*qstate->env->now + qstate->env->cfg->serve_expired_ttl
-				> rep->serve_expired_ttl) {
-				verbose(VERB_ALGO, "reset serve-expired-ttl for "
-					"response in cache");
-				rep->serve_expired_ttl = *qstate->env->now +
-					qstate->env->cfg->serve_expired_ttl;
-			}
-			verbose(VERB_ALGO, "set serve-expired-norec-ttl for "
+		if(qstate->env->cfg->serve_expired &&
+			qstate->env->cfg->serve_expired_ttl_reset && rep &&
+			*qstate->env->now + qstate->env->cfg->serve_expired_ttl
+			> rep->serve_expired_ttl) {
+			verbose(VERB_ALGO, "reset serve-expired-ttl for "
 				"response in cache");
-			rep->serve_expired_norec_ttl = NORR_TTL +
-				*qstate->env->now;
+			rep->serve_expired_ttl = *qstate->env->now +
+				qstate->env->cfg->serve_expired_ttl;
 		}
 		if(rep && (FLAGS_GET_RCODE(rep->flags) ==
 			LDNS_RCODE_NOERROR ||
@@ -358,7 +396,7 @@ error_response_cache(struct module_qstate* qstate, int id, int rcode)
 	err.security = sec_status_indeterminate;
 	verbose(VERB_ALGO, "store error response in message cache");
 	iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL,
-		qstate->query_flags, qstate->qstarttime, qstate->is_valrec);
+		qstate->query_flags, qstate->qstarttime);
 	return error_response(qstate, id, rcode);
 }

@@ -404,11 +442,8 @@ iter_prepend(struct iter_qstate* iq, struct dns_msg* msg,
 	num_an = 0;
 	for(p = iq->an_prepend_list; p; p = p->next) {
 		sets[num_an++] = p->rrset;
-		if(ub_packed_rrset_ttl(p->rrset) < msg->rep->ttl) {
+		if(ub_packed_rrset_ttl(p->rrset) < msg->rep->ttl)
 			msg->rep->ttl = ub_packed_rrset_ttl(p->rrset);
-			msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
-			msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
-		}
 	}
 	memcpy(sets+num_an, msg->rep->rrsets, msg->rep->an_numrrsets *
 		sizeof(struct ub_packed_rrset_key*));
@@ -421,11 +456,8 @@ iter_prepend(struct iter_qstate* iq, struct dns_msg* msg,
 			msg->rep->ns_numrrsets, p->rrset))
 			continue;
 		sets[msg->rep->an_numrrsets + num_an + num_ns++] = p->rrset;
-		if(ub_packed_rrset_ttl(p->rrset) < msg->rep->ttl) {
+		if(ub_packed_rrset_ttl(p->rrset) < msg->rep->ttl)
 			msg->rep->ttl = ub_packed_rrset_ttl(p->rrset);
-			msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
-			msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
-		}
 	}
 	memcpy(sets + num_an + msg->rep->an_numrrsets + num_ns, 
 		msg->rep->rrsets + msg->rep->an_numrrsets, 
@@ -763,14 +795,6 @@ target_count_increase_nx(struct iter_qstate* iq, int num)
 		iq->target_count[TARGET_COUNT_NX] += num;
 }

-static void
-target_count_increase_global_quota(struct iter_qstate* iq, int num)
-{
-	target_count_create(iq);
-	if(iq->target_count)
-		iq->target_count[TARGET_COUNT_GLOBAL_QUOTA] += num;
-}
-
 /**
 * Generate a subrequest.
 * Generate a local request event. Local events are tied to this module, and
@@ -830,7 +854,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		struct mesh_state* sub = NULL;
 		fptr_ok(fptr_whitelist_modenv_add_sub(
 			qstate->env->add_sub));
-		if(!(*qstate->env->add_sub)(qstate, &qinf, NULL,
+		if(!(*qstate->env->add_sub)(qstate, &qinf,
 			qflags, prime, valrec, &subq, &sub)){
 			return 0;
 		}
@@ -839,8 +863,8 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		/* attach subquery, lookup existing or make a new one */
 		fptr_ok(fptr_whitelist_modenv_attach_sub(
 			qstate->env->attach_sub));
-		if(!(*qstate->env->attach_sub)(qstate, &qinf, NULL, qflags,
-			prime, valrec, &subq)) {
+		if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime,
+			valrec, &subq)) {
 			return 0;
 		}
 	}
@@ -1082,7 +1106,7 @@ auth_zone_delegpt(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* cache is blacklisted and fallback, and we
 			 * already have an auth_zone dp */
 			if(verbosity>=VERB_ALGO) {
-				char buf[LDNS_MAX_DOMAINLEN];
+				char buf[255+1];
 				dname_str(z->name, buf);
 				verbose(VERB_ALGO, "auth_zone %s "
 				  "fallback because cache blacklisted",
@@ -1099,7 +1123,7 @@ auth_zone_delegpt(struct module_qstate* qstate, struct iter_qstate* iq,
 				 * validation failure, and the zone allows
 				 * fallback to the internet, query there. */
 				if(verbosity>=VERB_ALGO) {
-					char buf[LDNS_MAX_DOMAINLEN];
+					char buf[255+1];
 					dname_str(z->name, buf);
 					verbose(VERB_ALGO, "auth_zone %s "
 					  "fallback because cache blacklisted",
@@ -1571,11 +1595,6 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			errinf(qstate, "malloc failure for forward zone");
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
-		if(!cache_fill_missing(qstate->env, iq->qchase.qclass,
-			qstate->region, iq->dp, 0)) {
-			errinf(qstate, "malloc failure, copy extra info into delegation point");
-			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
-		}
 		if((qstate->query_flags&BIT_RD)==0) {
 			/* If the server accepts RD=0 queries and forwards
 			 * with RD=1, then if the server is listed as an NS
@@ -1612,8 +1631,10 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		delname = iq->dp->name;
 		delnamelen = iq->dp->namelen;
 	} else {
-		delname = iq->qchase.qname;
-		delnamelen = iq->qchase.qname_len;
+        		// @JESSE: Here we set the delegation name to be the original
+		//         one ...
+        delname = iq->qchase.qname;
+        delnamelen = iq->qchase.qname_len;
 	}
 	if(iq->qchase.qtype == LDNS_RR_TYPE_DS || iq->refetch_glue ||
 	   (iq->qchase.qtype == LDNS_RR_TYPE_NS && qstate->prefetch_leeway
@@ -1634,8 +1655,10 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		
 		/* Lookup the delegation in the cache. If null, then the 
 		 * cache needs to be primed for the qclass. */
+        	// @JESSE: ... and here we'll try to get the closest delegation
+		//         from cache.
 		if(delname)
-		     iq->dp = dns_cache_find_delegation(qstate->env, delname, 
+		    iq->dp = dns_cache_find_delegation(qstate->env, delname, 
 			delnamelen, iq->qchase.qtype, iq->qchase.qclass, 
 			qstate->region, &iq->deleg_msg,
 			*qstate->env->now+qstate->prefetch_leeway, 1,
@@ -1713,7 +1736,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		 */
 		if(iter_dp_is_useless(&qstate->qinfo, qstate->query_flags,
 			iq->dp, ie->supports_ipv4, ie->supports_ipv6,
-			ie->nat64.use_nat64)) {
+			ie->use_nat64)) {
 			int have_dp = 0;
 			if(!can_have_last_resort(qstate->env, iq->dp->name, iq->dp->namelen, iq->qchase.qclass, &have_dp, &iq->dp, qstate->region)) {
 				if(have_dp) {
@@ -2023,7 +2046,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 		return 1;
 	if(iq->depth > 0 && iq->target_count &&
 		iq->target_count[TARGET_COUNT_QUERIES] > MAX_TARGET_COUNT) {
-		char s[LDNS_MAX_DOMAINLEN];
+		char s[LDNS_MAX_DOMAINLEN+1];
 		dname_str(qstate->qinfo.qname, s);
 		verbose(VERB_QUERY, "request %s has exceeded the maximum "
 			"number of glue fetches %d", s,
@@ -2031,7 +2054,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 		return 2;
 	}
 	if(iq->dp_target_count > MAX_DP_TARGET_COUNT) {
-		char s[LDNS_MAX_DOMAINLEN];
+		char s[LDNS_MAX_DOMAINLEN+1];
 		dname_str(qstate->qinfo.qname, s);
 		verbose(VERB_QUERY, "request %s has exceeded the maximum "
 			"number of glue fetches %d to a single delegation point",
@@ -2077,7 +2100,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 			if(mesh_jostle_exceeded(qstate->env->mesh)) {
 				/* If no ip4 query is possible, that makes
 				 * this ns resolved. */
-				if(!((ie->supports_ipv4 || ie->nat64.use_nat64) &&
+				if(!((ie->supports_ipv4 || ie->use_nat64) &&
 					((ns->lame && !ns->done_pside4) ||
 					(!ns->lame && !ns->got4)))) {
 					ns->resolved = 1;
@@ -2086,7 +2109,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 			}
 		}
 		/* Send the A request. */
-		if((ie->supports_ipv4 || ie->nat64.use_nat64) &&
+		if((ie->supports_ipv4 || ie->use_nat64) &&
 			((ns->lame && !ns->done_pside4) ||
 			(!ns->lame && !ns->got4))) {
 			if(!generate_target_query(qstate, iq, id, 
@@ -2153,16 +2176,6 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		verbose(VERB_QUERY, "configured stub or forward servers failed -- returning SERVFAIL");
 		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
-	iq->dp->fallback_to_parent_side_NS = 1;
-	if(qstate->env->cfg->harden_unverified_glue) {
-		if(!cache_fill_missing(qstate->env, iq->qchase.qclass,
-			qstate->region, iq->dp, PACKED_RRSET_UNVERIFIED_GLUE))
-			log_err("out of memory in cache_fill_missing");
-		if(iq->dp->usable_list) {
-			verbose(VERB_ALGO, "try unverified glue from cache");
-			return next_state(iq, QUERYTARGETS_STATE);
-		}
-	}
 	if(!iq->dp->has_parent_side_NS && dname_is_root(iq->dp->name)) {
 		struct delegpt* dp;
 		int nolock = 0;
@@ -2182,10 +2195,6 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 					a->lame, a->tls_auth_name, -1, NULL);
 			}
 			lock_rw_unlock(&qstate->env->hints->lock);
-			/* copy over some configuration since we update the
-			 * delegation point in place */
-			iq->dp->tcp_upstream = dp->tcp_upstream;
-			iq->dp->ssl_upstream = dp->ssl_upstream;
 		}
 		iq->dp->has_parent_side_NS = 1;
 	} else if(!iq->dp->has_parent_side_NS) {
@@ -2209,7 +2218,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 	/* see if that makes new names available */
 	if(!cache_fill_missing(qstate->env, iq->qchase.qclass, 
-		qstate->region, iq->dp, 0))
+		qstate->region, iq->dp))
 		log_err("out of memory in cache_fill_missing");
 	if(iq->dp->usable_list) {
 		verbose(VERB_ALGO, "try parent-side-name, w. glue from cache");
@@ -2247,7 +2256,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 	if(iq->depth > 0 && iq->target_count &&
 		iq->target_count[TARGET_COUNT_QUERIES] > MAX_TARGET_COUNT) {
-		char s[LDNS_MAX_DOMAINLEN];
+		char s[LDNS_MAX_DOMAINLEN+1];
 		dname_str(qstate->qinfo.qname, s);
 		verbose(VERB_QUERY, "request %s has exceeded the maximum "
 			"number of glue fetches %d", s,
@@ -2263,14 +2272,14 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* if this nameserver is at a delegation point, but that
 		 * delegation point is a stub and we cannot go higher, skip*/
 		if( ((ie->supports_ipv6 && !ns->done_pside6) ||
-		    ((ie->supports_ipv4 || ie->nat64.use_nat64) && !ns->done_pside4)) &&
+		    ((ie->supports_ipv4 || ie->use_nat64) && !ns->done_pside4)) &&
 		    !can_have_last_resort(qstate->env, ns->name, ns->namelen,
 			iq->qchase.qclass, NULL, NULL, NULL)) {
 			log_nametypeclass(VERB_ALGO, "cannot pside lookup ns "
 				"because it is also a stub/forward,",
 				ns->name, LDNS_RR_TYPE_NS, iq->qchase.qclass);
 			if(ie->supports_ipv6) ns->done_pside6 = 1;
-			if(ie->supports_ipv4 || ie->nat64.use_nat64) ns->done_pside4 = 1;
+			if(ie->supports_ipv4 || ie->use_nat64) ns->done_pside4 = 1;
 			continue;
 		}
 		/* query for parent-side A and AAAA for nameservers */
@@ -2295,7 +2304,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 				return 0;
 			}
 		}
-		if((ie->supports_ipv4 || ie->nat64.use_nat64) && !ns->done_pside4) {
+		if((ie->supports_ipv4 || ie->use_nat64) && !ns->done_pside4) {
 			/* Send the A request. */
 			if(!generate_parentside_target_query(qstate, iq, id, 
 				ns->name, ns->namelen, 
@@ -2414,6 +2423,7 @@ check_waiting_queries(struct iter_qstate* iq, struct module_qstate* qstate,
 	}
 }
 	
+// @JESSE: This is where most of the iteration time will be spent.
 /** 
 * This is the request event state where the request will be sent to one of
 * its current query targets. This state also handles issuing target lookup
@@ -2437,6 +2447,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	int tf_policy;
 	struct delegpt_addr* target;
 	struct outbound_entry* outq;
+	struct sockaddr_storage real_addr;
+	socklen_t real_addrlen;
 	int auth_fallback = 0;
 	uint8_t* qout_orig = NULL;
 	size_t qout_orig_len = 0;
@@ -2562,9 +2574,80 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 	if(!ie->supports_ipv6)
 		delegpt_no_ipv6(iq->dp);
-	if(!ie->supports_ipv4 && !ie->nat64.use_nat64)
+	if(!ie->supports_ipv4 && !ie->use_nat64)
 		delegpt_no_ipv4(iq->dp);
 	delegpt_log(VERB_ALGO, iq->dp);
+    log_err("Tes Test jesse jess", iq->deleg_original_qname);
+
+    uint8_t root_len = iq->qchase.qname[0];
+    //todo have to remove this from iq when query has been resolved
+    if (iq->deleg_original_qname == NULL) {
+        iq->deleg_original_qname = (uint8_t *)regional_alloc(qstate->region, iq->qchase.qname_len + 1);
+        memcpy(iq->deleg_original_qname, qstate->qinfo.qname, iq->qchase.qname_len);
+        iq->deleg_original_qname_len = iq->qchase.qname_len;
+        iq->original_query = iq->qchase.qtype;
+    } else {
+        //restore qname to original to put _deleg in correct point
+        memcpy(qstate->qinfo.qname, iq->deleg_original_qname, iq->deleg_original_qname_len);
+        memcpy(iq->qchase.qname, iq->deleg_original_qname, iq->deleg_original_qname_len);
+        iq->qchase.qname_len = iq->deleg_original_qname_len;
+        iq->qchase.qtype = iq->original_query;
+        iq->qinfo_out.qtype = iq->original_query;
+    }
+    if (iq->deleg_state == 0 && root_len > 0) {
+        iq->deleg_original_qname_len = iq->qchase.qname_len;
+        iq->deleg_state = 1;
+
+        int qchase_label_len = dname_count_labels(iq->qchase.qname);
+        size_t labdiff =  qchase_label_len - iq->dp->namelabs - 1;
+        dname_remove_labels(&iq->qchase.qname, &iq->qchase.qname_len, labdiff);
+
+        //we have to add _deleg after the first label
+        //for ex. jesse.nlnetlabs.nl becomes jesse._deleg.nlnetlabs.nl
+        uint8_t deleg_wireformat[] = {6, 95, 100, 101, 108, 101, 103}; //{06}_deleg
+        size_t delnamelen = iq->qchase.qname_len + sizeof(deleg_wireformat);
+        uint8_t *delname = (uint8_t *)regional_alloc(qstate->region, delnamelen);
+        //put first label of original qname
+        uint8_t first_label_len = iq->qchase.qname[0];
+        uint8_t *qname_minus_first_label = iq->qchase.qname + first_label_len + 1;
+        uint8_t leftover_len = iq->qchase.qname_len - first_label_len - 1;
+
+        memcpy(delname, iq->qchase.qname, first_label_len + 1); //memcpy 1st label into delname
+        memcpy(delname + first_label_len + 1, deleg_wireformat, sizeof(deleg_wireformat)); //memcpy _deleg label in delname
+        memcpy(delname + first_label_len + sizeof(deleg_wireformat) + 1, qname_minus_first_label, leftover_len); //memcpy other labels in delname
+
+
+        iq->dp->namelen = delnamelen;
+        iq->qchase.qtype = LDNS_RR_TYPE_IDELEG;
+		iq->qchase.qname = delname;
+        iq->qchase.qname_len = delnamelen;
+
+        iq->qinfo_out.qtype = LDNS_RR_TYPE_IDELEG;
+        iq->qinfo_out.qname = delname;
+        iq->qinfo_out.qname_len = delnamelen;
+    } else if (root_len > 0 && iq->deleg_state == 2) { //in this state create deleg prime query
+        int qchase_label_len = dname_count_labels(iq->qchase.qname);
+        size_t labdiff =  qchase_label_len - iq->dp->namelabs;
+        dname_remove_labels(&iq->qchase.qname, &iq->qchase.qname_len, labdiff);
+
+
+        uint8_t deleg_wireformat[] = {6, 95, 100, 101, 108, 101, 103}; //{06}_deleg
+        size_t deleg_len = sizeof(deleg_wireformat);
+
+        size_t delnamelen = iq->qchase.qname_len + deleg_len;
+        uint8_t *delname = (uint8_t *)regional_alloc(qstate->region, delnamelen);
+
+        memcpy(delname, deleg_wireformat, deleg_len);
+        memcpy(delname+deleg_len, iq->qchase.qname, iq->qchase.qname_len); 
+
+        iq->qchase.qtype = LDNS_RR_TYPE_IDELEG;
+		iq->qchase.qname = delname;
+        iq->qchase.qname_len = delnamelen;
+
+        iq->qinfo_out.qtype = LDNS_RR_TYPE_IDELEG;
+        iq->qinfo_out.qname = delname;
+        iq->qinfo_out.qname_len = delnamelen;
+    }

 	if(iq->num_current_queries>0) {
 		/* already busy answering a query, this restart is because
@@ -2575,6 +2658,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		return 0;
 	}

+    //DELEG first check if _deleg in delegation point
+    //if no _deleg let unbound handle it
+// @JESSE: The following ifs is where most qname-minimisation happens.
+	//         We need something similar (adding a label at a time) but
+	//         without the best-effort nature of qname-minimisation and its
+	//         fallback. You can take inspiration from here on how to
+	//         correctly set iq->qinfo_out.
 	if(iq->minimisation_state == INIT_MINIMISE_STATE
 		&& !(iq->chase_flags & BIT_RD)) {
 		/* (Re)set qinfo_out to (new) delegation point, except when
@@ -2734,7 +2824,9 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		if((iq->chase_flags&BIT_RD) && !(iq->response->rep->flags&BIT_AA)) {
 			verbose(VERB_ALGO, "forwarder, ignoring referral from auth zone");
 		} else {
-			qstate->env->mesh->num_query_authzone_up++;
+			lock_rw_wrlock(&qstate->env->auth_zones->lock);
+			qstate->env->auth_zones->num_query_up++;
+			lock_rw_unlock(&qstate->env->auth_zones->lock);
 			iq->num_current_queries++;
 			iq->chase_to_rd = 0;
 			iq->dnssec_lame_query = 0;
@@ -2772,8 +2864,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 	/* if the mesh query list is full, then do not waste cpu and sockets to
 	 * fetch promiscuous targets. They can be looked up when needed. */
-	if(!iq->dp->fallback_to_parent_side_NS && can_do_promisc
-		&& !mesh_jostle_exceeded(qstate->env->mesh)) {
+	if(can_do_promisc && !mesh_jostle_exceeded(qstate->env->mesh)) {
 		tf_policy = ie->target_fetch_policy[iq->depth];
 	}

@@ -3035,17 +3126,6 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 	}

-	target_count_increase_global_quota(iq, 1);
-	if(iq->target_count && iq->target_count[TARGET_COUNT_GLOBAL_QUOTA]
-		> MAX_GLOBAL_QUOTA) {
-		char s[LDNS_MAX_DOMAINLEN];
-		dname_str(qstate->qinfo.qname, s);
-		verbose(VERB_QUERY, "request %s has exceeded the maximum "
-			"global quota on number of upstream queries %d", s,
-			iq->target_count[TARGET_COUNT_GLOBAL_QUOTA]);
-		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
-	}
-
 	/* Do not check ratelimit for forwarding queries or if we already got a
 	 * pass. */
 	sq_check_ratelimit = (!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok);
@@ -3059,6 +3139,17 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->dnssec_lame_query?" but lame_query anyway": "");
 	}

+	real_addr = target->addr;
+	real_addrlen = target->addrlen;
+
+	if(ie->use_nat64 && target->addr.ss_family == AF_INET) {
+		addr_to_nat64(&target->addr, &ie->nat64_prefix_addr,
+			ie->nat64_prefix_addrlen, ie->nat64_prefix_net,
+			&real_addr, &real_addrlen);
+		log_name_addr(VERB_QUERY, "applied NAT64:",
+			iq->dp->name, &real_addr, real_addrlen);
+	}
+	// @JESSE: This is where a query is finally going out, hopefully.
 	fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query));
 	outq = (*qstate->env->send_query)(&iq->qinfo_out,
 		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0),
@@ -3070,7 +3161,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		!qstate->blacklist&&(!iter_qname_indicates_dnssec(qstate->env,
 		&iq->qinfo_out)||target->attempts==1)?0:BIT_CD),
 		iq->dnssec_expected, iq->caps_fallback || is_caps_whitelisted(
-		ie, iq), sq_check_ratelimit, &target->addr, target->addrlen,
+		ie, iq), sq_check_ratelimit, &real_addr, real_addrlen,
 		iq->dp->name, iq->dp->namelen,
 		(iq->dp->tcp_upstream || qstate->env->cfg->tcp_upstream),
 		(iq->dp->ssl_upstream || qstate->env->cfg->ssl_upstream),
@@ -3087,7 +3178,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		log_addr(VERB_QUERY, "error sending query to auth server",
-			&target->addr, target->addrlen);
+			&real_addr, real_addrlen);
 		if(qstate->env->cfg->qname_minimisation)
 			iq->minimisation_state = SKIP_MINIMISE_STATE;
 		return next_state(iq, QUERYTARGETS_STATE);
@@ -3112,7 +3203,7 @@ find_NS(struct reply_info* rep, size_t from, size_t to)
 	return NULL;
 }

-
+// @JESSE: This is where responses are read.
 /** 
 * Process the query response. All queries end up at this state first. This
 * process generally consists of analyzing the response and routing the
@@ -3207,8 +3298,114 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			dnsseclame = 1;
 		}
 	} else iq->dnssec_lame_query = 0;
+    // @JESSE: Answers to _deleg queries would end up here. You need to
+	//         make sure you identify those answers correclty and treat
+	//         them the same way as referrals below.
+	/* handle each of the type cases */
+    // uint16_t SVCB_QTYPE = LDNS_RR_TYPE_IDELEG;
+
+    //check wether it was a deleg query
+    uint8_t deleg_wireformat[] = {6, 95, 100, 101, 108, 101, 103}; //{06}_deleg
+    uint8_t first_label_len = iq->qchase.qname[0]; 
+    int is_deleg_query = memcmp(iq->qchase.qname + first_label_len + 1, deleg_wireformat, 7);
+    int is_deleg_prime_query = memcmp(iq->qchase.qname, deleg_wireformat, 7);
+
+    if (iq->deleg_state == 1 && type == RESPONSE_TYPE_ANSWER && iq->qchase.qtype == 64 && is_deleg_query == 0) {
+        //result of a deleg refferal
+        if (FLAGS_GET_RCODE(iq->response->rep->flags) == LDNS_RCODE_NXDOMAIN) {
+            //whem _deleg return NXDOMAIN
+
+            //turns all values back to normal when no _deleg (NXDOMAIN)
+            iq->qchase.qname = iq->deleg_original_qname;
+            iq->qchase.qtype = iq->original_query;
+            iq->qchase.qname_len = iq->deleg_original_qname_len;
+
+            iq->qinfo_out.qtype = iq->original_query;
+            iq->qinfo_out.qname = iq->deleg_original_qname;
+            iq->qinfo_out.qname_len = iq->deleg_original_qname_len;
+            return next_state(iq, QUERYTARGETS_STATE);
+        }
+        //In this scenario _deleg exists
+        iq->deleg_state = 2;
+	    struct ub_packed_rrset_key* rrset_key;
+        rrset_key = reply_find_answer_rrset(&iq->qchase, iq->response->rep);
+        if(rrset_key) {
+            struct packed_rrset_data* rrset_data = (struct packed_rrset_data*) rrset_key->entry.data;
+
+            size_t data_len = rrset_data->rr_len[0];
+            uint8_t* svcb_data = rrset_data->rr_data[0];
+
+            size_t index = 4; //index of 4 to start at first label (skip message length(2 octet) and priority(2 octet))
+            while(svcb_data[index] != 0) { //loop through dns labels, label length 0 means root so stop looping though labels
+               index = index + svcb_data[index] + 1; 
+            }
+            index = index + 1;//add 1 for the root label
+            //Reference https://datatracker.ietf.org/doc/rfc9460/ section 2.2
+            uint8_t *ipv4 = NULL;
+            uint8_t *ipv6 = NULL;
+            while(index < data_len && (ipv4 == NULL || ipv6 == NULL)) {
+                uint16_t svcParamkey    = (svcb_data[index] << 8)   | svcb_data[index+1];
+                uint16_t svcParamValLen = (svcb_data[index+2] << 8) | svcb_data[index+3];
+                index = index + 4;
+                if (svcParamkey == 4) { //parse IPv4
+                    ipv4 = (uint8_t *)regional_alloc(qstate->region, 4 * sizeof(uint8_t));
+                    memcpy(ipv4, svcb_data + index, 4);
+                } else if (svcParamkey == 6) { //parse ipv6
+                    ipv6 = (uint8_t *)regional_alloc(qstate->region, 16 * sizeof(uint8_t));
+                    memcpy(ipv6, svcb_data + index, 16);
+                }
+                index = index + svcParamValLen;
+            }
+            //to get the new delegation name, we have to remove the second label, which is the _deleg label
+            //count labels with dname_count_labels()
+            size_t new_delegation_label_count = dname_count_labels(rrset_key->rk.dname);
+            size_t old_label_count = dname_count_labels(iq->deleg_original_qname);
+            size_t diff_label_len = old_label_count - new_delegation_label_count + 1;
+
+            uint8_t *new_delegation_name = (uint8_t *)regional_alloc(qstate->region, iq->deleg_original_qname_len);
+            size_t new_delegation_name_len = iq->deleg_original_qname_len;
+            memcpy(new_delegation_name, iq->deleg_original_qname, iq->deleg_original_qname_len);
+            dname_remove_labels(&new_delegation_name, &new_delegation_name_len, diff_label_len);
+            
+            iq->dp = delegpt_from_deleg(iq->response, qstate->region, ipv4, ipv6, new_delegation_name, new_delegation_name_len);
+            iq->referral_count++;
+            iq->sent_count = 0;
+            iq->dp_target_count = 0;
+            if(qstate->env->cfg->harden_referral_path)
+                generate_ns_check(qstate, iq, id);
+
+            /* stop current outstanding queries. 
+             * FIXME: should the outstanding queries be waited for and
+             * handled? Say by a subquery that inherits the outbound_entry.
+             */
+            outbound_list_clear(&iq->outlist);
+            iq->num_current_queries = 0;
+            fptr_ok(fptr_whitelist_modenv_detach_subs(
+                qstate->env->detach_subs));
+            (*qstate->env->detach_subs)(qstate);
+            iq->num_target_queries = 0;
+            iq->response = NULL;
+            iq->fail_addr_type = 0;
+            verbose(VERB_ALGO, "cleared outbound list for next round");
+
+            return next_state(iq, QUERYTARGETS_STATE);
+        } 
+    } else if (is_deleg_prime_query == 0) {
+        if (FLAGS_GET_RCODE(iq->response->rep->flags) == LDNS_RCODE_NXDOMAIN) {
+            //NX DOMAIN mean deleg not supported (no error and answer count = 0)
+            iq->deleg_state = 1;
+            return next_state(iq, QUERYTARGETS_STATE);
+        } else if (FLAGS_GET_RCODE(iq->response->rep->flags) == LDNS_RCODE_NOERROR && iq->response->rep->an_numrrsets == 0) {
+            //no data means _deleg supported
+            iq->deleg_state = 0;
+            return next_state(iq, QUERYTARGETS_STATE);
+        }
+    }
+
 	/* see if referral brings us close to the target */
-	if(type == RESPONSE_TYPE_REFERRAL) {
+	if(type == RESPONSE_TYPE_REFERRAL){
+        //deleg: go to state 2 when normal refferal found, to try deleg again for child
+        iq->deleg_state = 2;
 		struct ub_packed_rrset_key* ns = find_NS(
 			iq->response->rep, iq->response->rep->an_numrrsets,
 			iq->response->rep->an_numrrsets 
@@ -3224,19 +3421,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 	} else iter_scrub_ds(iq->response, NULL, NULL);
 	if(type == RESPONSE_TYPE_THROWAWAY &&
 		FLAGS_GET_RCODE(iq->response->rep->flags) == LDNS_RCODE_YXDOMAIN) {
-		/* YXDOMAIN is a permanent error for DNAME expansion overflow
-		 * (RFC 6672 Section 2.2). Only accept if the response
-		 * contains a DNAME record in the answer section; otherwise
-		 * treat as invalid, to make sure the authoritative answer
-		 * make sense. */
-		size_t i;
-		for(i=0; i<iq->response->rep->an_numrrsets; i++) {
-			if(ntohs(iq->response->rep->rrsets[i]->rk.type)
-				== LDNS_RR_TYPE_DNAME) {
-				type = RESPONSE_TYPE_ANSWER;
-				break;
-			}
-		}
+		/* YXDOMAIN is a permanent error, no need to retry */
+		type = RESPONSE_TYPE_ANSWER;
 	}
 	if(type == RESPONSE_TYPE_CNAME)
 		origtypecname = 1;
@@ -3252,24 +3438,24 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 	}
 	if(type == RESPONSE_TYPE_CNAME &&
-		(iq->qchase.qtype == LDNS_RR_TYPE_CNAME ||
-		  iq->qchase.qtype == LDNS_RR_TYPE_ANY) &&
+		iq->qchase.qtype == LDNS_RR_TYPE_CNAME &&
 		iq->minimisation_state == MINIMISE_STATE &&
 		query_dname_compare(iq->qchase.qname, iq->qinfo_out.qname) == 0) {
 		/* The minimised query for full QTYPE and hidden QTYPE can be
 		 * classified as CNAME response type, even when the original
 		 * QTYPE=CNAME. This should be treated as answer response type.
 		 */
-		/* For QTYPE=ANY, it is also considered the response, that
-		 * is what the classifier would say, if it saw qtype ANY,
-		 * and this same response was returned for that. The response
-		 * can already be treated as such an answer, without having
-		 * to send another query with a new qtype. */
 		type = RESPONSE_TYPE_ANSWER;
 	}

-	/* handle each of the type cases */
-	if(type == RESPONSE_TYPE_ANSWER) {
+	if(type == RESPONSE_TYPE_ANSWER ){
+        //set original qname to NULL after query has been resolved, to handle new queries
+        if (iq->deleg_original_qname != NULL) {
+            iq->deleg_original_qname = NULL;
+            iq->deleg_original_qname_len = 0;
+            iq->original_query = 0;
+        log_err("en hier ook nog wel??");
+        }
 		/* ANSWER type responses terminate the query algorithm, 
 		 * so they sent on their */
 		if(verbosity >= VERB_DETAIL) {
@@ -3279,6 +3465,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 				(iq->response->rep->an_numrrsets?"ANSWER":
 				"nodata ANSWER"));
 		}
+
 		/* if qtype is DS, check we have the right level of answer,
 		 * like grandchild answer but we need the middle, reject it */
 		if(iq->qchase.qtype == LDNS_RR_TYPE_DS && !iq->dsns_point
@@ -3294,16 +3481,6 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->num_target_queries = 0;
 			return processDSNSFind(qstate, iq, id);
 		}
-		if(iq->qchase.qtype == LDNS_RR_TYPE_DNSKEY && SERVE_EXPIRED
-			&& qstate->is_valrec &&
-			reply_find_answer_rrset(&iq->qchase, iq->response->rep) != NULL) {
-			/* clean out the authority section, if any, so it
-			 * does not overwrite dnssec valid data in the
-			 * validation recursion lookup. */
-			verbose(VERB_ALGO, "make DNSKEY minimal for serve "
-				"expired");
-			iter_make_minimal(iq->response->rep);
-		}
 		if(!qstate->no_cache_store)
 			iter_dns_store(qstate->env, &iq->response->qinfo,
 				iq->response->rep,
@@ -3311,7 +3488,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 				qstate->prefetch_leeway,
 				iq->dp&&iq->dp->has_parent_side_NS,
 				qstate->region, qstate->query_flags,
-				qstate->qstarttime, qstate->is_valrec);
+				qstate->qstarttime);
 		/* close down outstanding requests to be discarded */
 		outbound_list_clear(&iq->outlist);
 		iq->num_current_queries = 0;
@@ -3377,8 +3554,13 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			return next_state(iq, QUERYTARGETS_STATE);
 		}
 		return final_state(iq);
+        	// @JESSE: I guess for the test environemnt we mostly don't care about
+	//         referrals; these are traditional DNS referral responses.
 	} else if(type == RESPONSE_TYPE_REFERRAL) {
+        //added code
+        // iq->deleg_state = 0; 
 		struct delegpt* old_dp = NULL;
+
 		/* REFERRAL type responses get a reset of the 
 		 * delegation point, and back to the QUERYTARGETS_STATE. */
 		verbose(VERB_DETAIL, "query response was REFERRAL");
@@ -3405,7 +3587,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* no prefetch-leeway, since its not the answer */
 			iter_dns_store(qstate->env, &iq->response->qinfo,
 				iq->response->rep, 1, 0, 0, NULL, 0,
-				qstate->qstarttime, qstate->is_valrec);
+				qstate->qstarttime);
 			if(iq->store_parent_NS)
 				iter_store_parentside_NS(qstate->env, 
 					iq->response->rep);
@@ -3454,7 +3636,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 				old_dp->name, old_dp->namelen);
 		}
 		if(!cache_fill_missing(qstate->env, iq->qchase.qclass, 
-			qstate->region, iq->dp, 0)) {
+			qstate->region, iq->dp)) {
 			errinf(qstate, "malloc failure, copy extra info into delegation point");
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
@@ -3521,15 +3703,6 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->num_target_queries = 0;
 			return processDSNSFind(qstate, iq, id);
 		}
-		if(iq->minimisation_state == MINIMISE_STATE &&
-			query_dname_compare(iq->qchase.qname,
-			iq->qinfo_out.qname) != 0) {
-			verbose(VERB_ALGO, "continue query minimisation, "
-				"downwards, after CNAME response for "
-				"intermediate label");
-			/* continue query minimisation, downwards */
-			return next_state(iq, QUERYTARGETS_STATE);
-		}
 		/* Process the CNAME response. */
 		if(!handle_cname_response(qstate, iq, iq->response, 
 			&sname, &snamelen)) {
@@ -3544,8 +3717,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			iter_dns_store(qstate->env, &iq->response->qinfo,
 				iq->response->rep, 1, qstate->prefetch_leeway,
 				iq->dp&&iq->dp->has_parent_side_NS, NULL,
-				qstate->query_flags, qstate->qstarttime,
-				qstate->is_valrec);
+				qstate->query_flags, qstate->qstarttime);
 		/* set the current request's qname to the new value. */
 		iq->qchase.qname = sname;
 		iq->qchase.qname_len = snamelen;
@@ -3592,7 +3764,10 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		iq->auth_zone_response = 0;
 		iq->sent_count = 0;
 		iq->dp_target_count = 0;
-		iq->query_restart_count++;
+		if(iq->minimisation_state != MINIMISE_STATE)
+			/* Only count as query restart when it is not an extra
+			 * query as result of qname minimisation. */
+			iq->query_restart_count++;
 		if(qstate->env->cfg->qname_minimisation)
 			iq->minimisation_state = INIT_MINIMISE_STATE;

@@ -3615,7 +3790,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		return next_state(iq, INIT_REQUEST_STATE);
 	} else if(type == RESPONSE_TYPE_LAME) {
 		/* Cache the LAMEness. */
-		verbose(VERB_DETAIL, "query response was categorized as %sLAME",
+		verbose(VERB_DETAIL, "query response was %sLAME",
 			dnsseclame?"DNSSEC ":"");
 		if(!dname_subdomain_c(iq->qchase.qname, iq->dp->name)) {
 			log_err("mark lame: mismatch in qname and dpname");
@@ -3654,7 +3829,15 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * In this case, the event is just sent directly back to 
 		 * the QUERYTARGETS_STATE without resetting anything, 
 		 * because, clearly, the next target must be tried. */
-		verbose(VERB_DETAIL, "query response was categorized as THROWAWAY");
+        iq->qchase.qname = iq->deleg_original_qname;
+        iq->qchase.qtype = iq->original_query;
+        iq->qchase.qname_len = iq->deleg_original_qname_len;
+
+        iq->qinfo_out.qtype = iq->original_query;
+        iq->qinfo_out.qname = iq->deleg_original_qname;
+        iq->qinfo_out.qname_len = iq->deleg_original_qname_len;
+
+		verbose(VERB_DETAIL, "query response was THROWAWAY");
 	} else {
 		log_warn("A query response came back with an unknown type: %d",
 			(int)type);
@@ -3886,7 +4069,7 @@ processTargetResponse(struct module_qstate* qstate, int id,
 	} else {
 		verbose(VERB_ALGO, "iterator TargetResponse failed");
 		delegpt_mark_neg(dpns, qstate->qinfo.qtype);
-		if((dpns->got4 == 2 || (!ie->supports_ipv4 && !ie->nat64.use_nat64)) &&
+		if((dpns->got4 == 2 || (!ie->supports_ipv4 && !ie->use_nat64)) &&
 			(dpns->got6 == 2 || !ie->supports_ipv6)) {
 			dpns->resolved = 1; /* fail the target */
 			/* do not count cached answers */
@@ -4030,8 +4213,6 @@ processClassResponse(struct module_qstate* qstate, int id,
 			to->rep->prefetch_ttl = from->rep->prefetch_ttl;
 		if(from->rep->serve_expired_ttl < to->rep->serve_expired_ttl)
 			to->rep->serve_expired_ttl = from->rep->serve_expired_ttl;
-		if(from->rep->serve_expired_norec_ttl < to->rep->serve_expired_norec_ttl)
-			to->rep->serve_expired_norec_ttl = from->rep->serve_expired_norec_ttl;
 	}
 	/* are we done? */
 	foriq->num_current_queries --;
@@ -4164,12 +4345,12 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* store message with the finished prepended items,
 		 * but only if we did recursion. The nonrecursion referral
 		 * from cache does not need to be stored in the msg cache. */
-		if(!qstate->no_cache_store && (qstate->query_flags&BIT_RD)) {
+		if(!qstate->no_cache_store && qstate->query_flags&BIT_RD) {
 			iter_dns_store(qstate->env, &qstate->qinfo, 
 				iq->response->rep, 0, qstate->prefetch_leeway,
 				iq->dp&&iq->dp->has_parent_side_NS,
 				qstate->region, qstate->query_flags,
-				qstate->qstarttime, qstate->is_valrec);
+				qstate->qstarttime);
 		}
 	}
 	qstate->return_rcode = LDNS_RCODE_NOERROR;
@@ -4203,6 +4384,12 @@ iter_inform_super(struct module_qstate* qstate, int id,
 	else	processTargetResponse(qstate, id, super);
 }

+// @JESSE: These are all the available states the iterator could be for a given
+//         query. You should not worry about the following cases:
+//              - COLLECT_CLASS_STATE (it has to do with ANY queries)
+//              - DSNS_FIND_STATE (it tries to find the correct parent for a DS
+//                                 query; I think it is not relevant since the
+//                                 _deleg stuff always live at the parent)
 /**
 * Handle iterator state.
 * Handle events. This is the real processing loop for events, responsible
@@ -4349,7 +4536,6 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 	}

 	/* Copy the edns options we may got from the back end */
-	qstate->edns_opts_back_in = NULL;
 	if(edns.opt_list_in) {
 		qstate->edns_opts_back_in = edns_opt_copy_region(edns.opt_list_in,
 			qstate->region);
@@ -4395,10 +4581,7 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 	if(verbosity >= VERB_ALGO)
 		log_dns_msg("incoming scrubbed packet:", &iq->response->qinfo, 
 			iq->response->rep);
-
-	if(qstate->env->cfg->aggressive_nsec) {
-		limit_nsec_ttl(iq->response);
-	}
+	
 	if(event == module_event_capsfail || iq->caps_fallback) {
 		if(qstate->env->cfg->qname_minimisation &&
 			iq->minimisation_state != DONOT_MINIMISE_STATE) {
@@ -4556,8 +4739,8 @@ iter_get_mem(struct module_env* env, int id)
 */
 static struct module_func_block iter_block = {
 	"iterator",
-	NULL, NULL, &iter_init, &iter_deinit, &iter_operate,
-	&iter_inform_super, &iter_clear, &iter_get_mem
+	&iter_init, &iter_deinit, &iter_operate, &iter_inform_super, 
+	&iter_clear, &iter_get_mem
 };

 struct module_func_block* 
@@ -46,6 +46,8 @@
 #include "util/data/msgreply.h"
 #include "util/module.h"
 struct delegpt;
+struct iter_hints;
+struct iter_forwards;
 struct iter_donotq;
 struct iter_prep_list;
 struct iter_priv;
@@ -53,9 +55,6 @@ struct rbtree_type;

 /** max number of targets spawned for a query and its subqueries */
 #define MAX_TARGET_COUNT	64
-/** max number of upstream queries for a query and its subqueries, it is
- * never reset. */
-extern int MAX_GLOBAL_QUOTA;
 /** max number of target lookups per qstate, per delegation point */
 #define MAX_DP_TARGET_COUNT	16
 /** max number of nxdomains allowed for target lookups for a query and
@@ -106,9 +105,15 @@ extern int BLACKLIST_PENALTY;
 #define EMPTY_NODATA_RETRY_COUNT 2

 /**
- * Iterator global state for nat64.
+ * Global state for the iterator.
 */
-struct iter_nat64 {
+struct iter_env {
+	/** A flag to indicate whether or not we have an IPv6 route */
+	int supports_ipv6;
+
+	/** A flag to indicate whether or not we have an IPv4 route */
+	int supports_ipv4;
+
 	/** A flag to locally apply NAT64 to make IPv4 addrs into IPv6 */
 	int use_nat64;

@@ -120,20 +125,6 @@ struct iter_nat64 {

 	/** CIDR mask length of NAT64 prefix */
 	int nat64_prefix_net;
-};
-
-/**
- * Global state for the iterator.
- */
-struct iter_env {
-	/** A flag to indicate whether or not we have an IPv6 route */
-	int supports_ipv6;
-
-	/** A flag to indicate whether or not we have an IPv4 route */
-	int supports_ipv4;
-
-	/** State for nat64 */
-	struct iter_nat64 nat64;

 	/** A set of inetaddrs that should never be queried. */
 	struct iter_donotq* donotq;
@@ -257,9 +248,6 @@ enum target_count_variables {
 	TARGET_COUNT_QUERIES,
 	/** Number of nxdomain responses encountered. */
 	TARGET_COUNT_NX,
-	/** Global quota on number of queries to upstream servers per
-	 * client request, that is never reset. */
-	TARGET_COUNT_GLOBAL_QUOTA,

 	/** This should stay last here, it is used for the allocation */
 	TARGET_COUNT_MAX,
@@ -443,6 +431,12 @@ struct iter_qstate {
 	/** State for capsfail: QNAME minimisation state for comparisons. */
 	enum minimisation_state caps_minimisation_state;

+    //DELEG added code
+    int deleg_state;
+    uint8_t* deleg_original_qname;
+    size_t deleg_original_qname_len;
+    uint16_t original_query;
+
 	/**
 	 * The query info that is sent upstream. Will be a subset of qchase
 	 * when qname minimisation is enabled.
@@ -75,9 +75,7 @@ context_finalize(struct ub_ctx* ctx)
 	ctx->pipe_pid = getpid();
 	cfg_apply_local_port_policy(cfg, 65536);
 	config_apply(cfg);
-	if(!modstack_call_startup(&ctx->mods, cfg->module_conf, ctx->env))
-		return UB_INITFAIL;
-	if(!modstack_call_init(&ctx->mods, cfg->module_conf, ctx->env))
+	if(!modstack_setup(&ctx->mods, cfg->module_conf, ctx->env))
 		return UB_INITFAIL;
 	listen_setup_locks();
 	log_edns_known_options(VERB_ALGO, ctx->env);
@@ -395,7 +393,7 @@ context_serialize_cancel(struct ctx_query* q, uint32_t* len)
 	/* format of cancel:
 	 * 	o uint32 cmd
 	 * 	o uint32 async-id */
-	uint8_t* p = (uint8_t*)reallocarray(NULL, 2, sizeof(uint32_t));
+	uint8_t* p = (uint8_t*)reallocarray(NULL, sizeof(uint32_t), 2);
 	if(!p) return NULL;
 	*len = 2*sizeof(uint32_t);
 	sldns_write_uint32(p, UB_LIBCMD_CANCEL);
@@ -188,9 +188,7 @@ ub_ctx_create(void)
 		int e = errno;
 		ub_randfree(ctx->seed_rnd);
 		config_delete(ctx->env->cfg);
-		modstack_call_deinit(&ctx->mods, ctx->env);
-		modstack_call_destartup(&ctx->mods, ctx->env);
-		modstack_free(&ctx->mods);
+		modstack_desetup(&ctx->mods, ctx->env);
 		listen_desetup_locks();
 		edns_known_options_delete(ctx->env);
 		edns_strings_delete(ctx->env->edns_strings);
@@ -204,9 +202,7 @@ ub_ctx_create(void)
 		tube_delete(ctx->qq_pipe);
 		ub_randfree(ctx->seed_rnd);
 		config_delete(ctx->env->cfg);
-		modstack_call_deinit(&ctx->mods, ctx->env);
-		modstack_call_destartup(&ctx->mods, ctx->env);
-		modstack_free(&ctx->mods);
+		modstack_desetup(&ctx->mods, ctx->env);
 		listen_desetup_locks();
 		edns_known_options_delete(ctx->env);
 		edns_strings_delete(ctx->env->edns_strings);
@@ -364,9 +360,7 @@ ub_ctx_delete(struct ub_ctx* ctx)
 	}
 	libworker_delete_event(ctx->event_worker);

-	modstack_call_deinit(&ctx->mods, ctx->env);
-	modstack_call_destartup(&ctx->mods, ctx->env);
-	modstack_free(&ctx->mods);
+	modstack_desetup(&ctx->mods, ctx->env);
 	a = ctx->alloc_list;
 	while(a) {
 		na = a->super;
@@ -292,7 +292,6 @@ libworker_do_cmd(struct libworker* w, uint8_t* msg, uint32_t len)
 			log_err("unknown command for bg worker %d", 
 				(int)context_serial_getcmd(msg, len));
 			/* and fall through to quit */
-			ATTR_FALLTHROUGH
 			/* fallthrough */
 		case UB_LIBCMD_QUIT:
 			free(msg);
@@ -423,7 +422,7 @@ int libworker_bg(struct ub_ctx* ctx)
 static int
 fill_canon(struct ub_result* res, uint8_t* s)
 {
-	char buf[LDNS_MAX_DOMAINLEN];
+	char buf[255+2];
 	dname_str(s, buf);
 	res->canonname = strdup(buf);
 	return res->canonname != 0;
@@ -630,9 +629,8 @@ int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q)
 		free(qinfo.qname);
 		return UB_NOERROR;
 	}
-	if(ctx->env->auth_zones && auth_zones_downstream_answer(
-		ctx->env->auth_zones, w->env, &qinfo, &edns, NULL,
-		w->back->udp_buff, w->env->scratch)) {
+	if(ctx->env->auth_zones && auth_zones_answer(ctx->env->auth_zones,
+		w->env, &qinfo, &edns, NULL, w->back->udp_buff, w->env->scratch)) {
 		regional_free_all(w->env->scratch);
 		libworker_fillup_fg(q, LDNS_RCODE_NOERROR, 
 			w->back->udp_buff, sec_status_insecure, NULL, 0);
@@ -710,9 +708,8 @@ int libworker_attach_mesh(struct ub_ctx* ctx, struct ctx_query* q,
 			w->back->udp_buff, sec_status_insecure, NULL, 0);
 		return UB_NOERROR;
 	}
-	if(ctx->env->auth_zones && auth_zones_downstream_answer(
-		ctx->env->auth_zones, w->env, &qinfo, &edns, NULL,
-		w->back->udp_buff, w->env->scratch)) {
+	if(ctx->env->auth_zones && auth_zones_answer(ctx->env->auth_zones,
+		w->env, &qinfo, &edns, NULL, w->back->udp_buff, w->env->scratch)) {
 		regional_free_all(w->env->scratch);
 		free(qinfo.qname);
 		libworker_event_done_cb(q, LDNS_RCODE_NOERROR,
@@ -849,9 +846,8 @@ handle_newq(struct libworker* w, uint8_t* buf, uint32_t len)
 		free(qinfo.qname);
 		return;
 	}
-	if(w->ctx->env->auth_zones && auth_zones_downstream_answer(
-		w->ctx->env->auth_zones, w->env, &qinfo, &edns, NULL,
-		w->back->udp_buff, w->env->scratch)) {
+	if(w->ctx->env->auth_zones && auth_zones_answer(w->ctx->env->auth_zones,
+		w->env, &qinfo, &edns, NULL, w->back->udp_buff, w->env->scratch)) {
 		regional_free_all(w->env->scratch);
 		q->msg_security = sec_status_insecure;
 		add_bg_result(w, q, w->back->udp_buff, UB_NOERROR, NULL, 0);
@@ -1061,33 +1057,3 @@ void dtio_mainfdcallback(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
 	log_assert(0);
 }
 #endif
-
-void fast_reload_service_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
-int fast_reload_client_callback(struct comm_point* ATTR_UNUSED(c),
-	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
-        struct comm_reply* ATTR_UNUSED(repinfo))
-{
-	log_assert(0);
-	return 0;
-}
-
-#ifdef HAVE_NGTCP2
-void doq_client_event_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
-
-#ifdef HAVE_NGTCP2
-void doq_client_timer_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
-	void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-#endif
@@ -30,7 +30,6 @@ def dnssecParse(domain, rrType=RR_TYPE_A):
 resolver = ub_ctx()
 resolver.add_ta(".   IN DS   19036 8 2 49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5")
 resolver.add_ta(".   IN DS   20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D")
-resolver.add_ta(".   IN DS   38696 8 2 683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16")

 dnssecParse("nic.cz")
 dnssecParse("nonexistent-domain-blablabla.cz")
@@ -853,7 +853,7 @@ Result: ['74.125.43.147', '74.125.43.99', '74.125.43.103', '74.125.43.104']
 %{ 
  //printf("resolve_start(%lX)\n",(long unsigned int)arg1);
  Py_BEGIN_ALLOW_THREADS 
-  $action
+  $function 
  Py_END_ALLOW_THREADS 
  //printf("resolve_stop()\n");
 %} 
@@ -772,8 +772,6 @@ struct ub_server_stats {
 	long long ans_bogus;
 	/** rrsets marked bogus by validator */
 	long long rrset_bogus;
-	/** number of signature validation operations performed by validator */
-	long long val_ops;
 	/** number of queries that have been ratelimited by domain recursion. */
 	long long queries_ratelimited;
 	/** unwanted traffic received on server-facing ports */
@@ -847,18 +845,6 @@ struct ub_server_stats {
 	long long qtls_resume;
 	/** RPZ action stats */
 	long long rpz_action[UB_STATS_RPZ_ACTION_NUM];
-	/** number of bytes in QUIC buffers */
-	long long mem_quic;
-	/** number of queries over (DNS over) QUIC */
-	long long qquic;
-	/** number of queries removed due to discard-timeout */
-	long long num_queries_discard_timeout;
-	/** number of queries removed due to replyaddr limit */
-	long long num_queries_replyaddr_limit;
-	/** number of queries removed due to wait-limit */
-	long long num_queries_wait_limit;
-	/** number of dns error reports generated */
-	long long num_dns_error_reports;
 };

 /**
@@ -874,8 +860,6 @@ struct ub_stats_info {
 	long long mesh_num_states;
 	/** mesh stats: current number of reply (user) states */
 	long long mesh_num_reply_states;
-	/** mesh stats: current number of reply entries */
-	long long mesh_num_reply_addrs;
 	/** mesh stats: number of reply states overwritten with a new one */
 	long long mesh_jostled;
 	/** mesh stats: number of incoming queries dropped */
@@ -53,13 +53,13 @@ Generate a distribution tar file for unbound.
                        (which will then be unbound-<version>rc<number>)
    -u git_url          Retrieve the source from the specified repository url.
                        Detected from the working copy if not specified.
-    -b git_branch       Retrieve the specified branch or tag.
+    -b git_branch       Retrieve the the specified branch or tag.
                        Detected from the working copy if not specified.
    -wssl openssl.xx.tar.gz Also build openssl from tarball for windows dist.
    -wxp expat.xx.tar.gz Also build expat from tarball for windows dist.
    -wdir directory     Build openssl and expat in a persistent directory for
                        windows dist. If builds are already in that directory
-                        they are used right away. Useful when debugging windows
+                        they are used right away. Useful when debuggin windows
                        builds.
    -w32                32bit windows compile.
    -w ...              Build windows binary dist. last args passed to configure.
@@ -440,7 +440,6 @@ if [ "$DOWIN" = "yes" ]; then
 	autoheader -f || error_cleanup "Autoheader failed."
    	rm -r autom4te* || echo "ignored"
 	rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
-	rm -f configure~ || echo "ignore absence of configure~ file."
    fi

    if test "`uname`" = "Linux"; then 
@@ -540,12 +539,6 @@ if [ "$DOWIN" = "yes" ]; then
    if test -f "$sspdll"; then
 	    cp "$sspdll" libunbound/.
    fi
-    if test "$W64" = "no"; then
-	# This could be solved with -static -static-libgcc -static-libstdc++.
-	# The dependency on c++ is probably due to libexpat. But the copy
-	# of the dll should work too. It may be needed for the libunbound.dll.
-	cp /usr/i686-w64-mingw32/sys-root/mingw/bin/libgcc_s_dw2-1.dll libunbound/.
-    fi
    # zipfile
    zip -r ../$file LICENSE README.txt unbound.exe unbound-anchor.exe unbound-host.exe unbound-control.exe unbound-checkconf.exe unbound-service-install.exe unbound-service-remove.exe unbound-control-setup.cmd example.conf service.conf root.key unbound-website.url create_unbound_ad_servers.cmd warmup.cmd unbound_cache.cmd Changelog libunbound
    info "Testing $file"
@@ -622,7 +615,6 @@ autoreconf -f || error_cleanup "Autoconf failed."

 rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
 rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
-rm -f configure~ || echo "ignore absence of configure~ file."

 info "Building lexer and parser."
 echo "#include \"config.h\"" > util/configlexer.c || error_cleanup "Failed to create configlexer"
@@ -668,7 +660,6 @@ if [ "$RECONFIGURE" = "yes" ]; then
    autoreconf -f || error_cleanup "Autoconf failed."
    rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
    rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
-    rm -f configure~ || echo "ignore absence of configure~ file."
 fi

 replace_all doc/README
@@ -700,5 +691,7 @@ cleanup
 storehash unbound-$version.tar.gz
 echo "create unbound-$version.tar.gz.asc with:"
 echo "  gpg --armor --detach-sign --digest-algo SHA256 unbound-$version.tar.gz"
+echo "  gpg --armor --detach-sign --digest-algo SHA256 unbound-$version.zip"
+echo "  gpg --armor --detach-sign --digest-algo SHA256 unbound_setup_$version.exe"

 info "Unbound distribution created successfully."
@@ -176,10 +176,6 @@ config_file
   
      Harden against spoofed glue (out of zone data).
   
-   .. attribute:: harden_unverified_glue
-
-      Harden against unverified glue.
-
   .. attribute:: harden_dnssec_stripped
   
      Harden against receiving no DNSSEC data for trust anchor.
@@ -38,14 +38,12 @@ import os
 def dataHex(data, prefix=""):
    """Converts binary string data to display representation form"""
    res = ""
-    for i in range(0, int((len(data)+15)/16)):
+    for i in range(0, (len(data)+15)/16):
        res += "%s0x%02X | " % (prefix, i*16)
-        d = map(lambda x:x, data[i*16:i*16+17])
-        count=0
+        d = map(lambda x:ord(x), data[i*16:i*16+17])
        for ch in d:
            res += "%02X " % ch
-            count+=1
-        for i in range(0,17-count):
+        for i in range(0,17-len(d)):
            res += "   "
        res += "| "
        for ch in d:
@@ -62,31 +60,31 @@ def logDnsMsg(qstate):
    r  = qstate.return_msg.rep
    q  = qstate.return_msg.qinfo

-    print("-"*100)
+    print "-"*100
    print("Query: %s, type: %s (%d), class: %s (%d) " % (
            qstate.qinfo.qname_str, qstate.qinfo.qtype_str, qstate.qinfo.qtype,
            qstate.qinfo.qclass_str, qstate.qinfo.qclass))
-    print("-"*100)
-    print("Return    reply :: flags: %04X, QDcount: %d, Security:%d, TTL=%d" % (r.flags, r.qdcount, r.security, r.ttl))
-    print("          qinfo :: qname: %s %s, qtype: %s, qclass: %s" % (str(q.qname_list), q.qname_str, q.qtype_str, q.qclass_str))
+    print "-"*100
+    print "Return    reply :: flags: %04X, QDcount: %d, Security:%d, TTL=%d" % (r.flags, r.qdcount, r.security, r.ttl)
+    print "          qinfo :: qname: %s %s, qtype: %s, qclass: %s" % (str(q.qname_list), q.qname_str, q.qtype_str, q.qclass_str)

    if (r):
-        print("Reply:")
+        print "Reply:"
        for i in range(0, r.rrset_count):
            rr = r.rrsets[i]

            rk = rr.rk
-            print(i,":",rk.dname_list, rk.dname_str, "flags: %04X" % rk.flags,)
-            print("type:",rk.type_str,"(%d)" % ntohs(rk.type), "class:",rk.rrset_class_str,"(%d)" % ntohs(rk.rrset_class))
+            print i,":",rk.dname_list, rk.dname_str, "flags: %04X" % rk.flags,
+            print "type:",rk.type_str,"(%d)" % ntohs(rk.type), "class:",rk.rrset_class_str,"(%d)" % ntohs(rk.rrset_class)

            d = rr.entry.data
            for j in range(0,d.count+d.rrsig_count):
-                print("  ",j,":","TTL=",d.rr_ttl[j],)
-                if (j >= d.count): print("rrsig",)
-                print()
-                print(dataHex(d.rr_data[j],"       "))
+                print "  ",j,":","TTL=",d.rr_ttl[j],
+                if (j >= d.count): print "rrsig",
+                print 
+                print dataHex(d.rr_data[j],"       ")

-    print("-"*100)
+    print "-"*100

 def init(id, cfg):
   log_info("pythonmod: init called, module id is %d port: %d script: %s" % (id, cfg.port, mod_env['script']))
@@ -204,7 +204,7 @@ struct query_info {

 %inline %{
   PyObject* dnameAsStr(PyObject* dname) {
-       char buf[LDNS_MAX_DOMAINLEN];
+       char buf[LDNS_MAX_DOMAINLEN+1];
       buf[0] = '\0';
       dname_str((uint8_t*)PyBytes_AsString(dname), buf);
       return PyString_FromString(buf);
@@ -732,8 +732,8 @@ struct module_env {
        char* tls_auth_name, struct module_qstate* q, int* was_ratelimited);
    void (*detach_subs)(struct module_qstate* qstate);
    int (*attach_sub)(struct module_qstate* qstate,
-        struct query_info* qinfo, struct respip_client_info* cinfo,
-        uint16_t qflags, int prime, int valrec, struct module_qstate** newq);
+        struct query_info* qinfo, uint16_t qflags, int prime,
+        int valrec, struct module_qstate** newq);
    void (*kill_sub)(struct module_qstate* newq);
    int (*detect_cycle)(struct module_qstate* qstate,
        struct query_info* qinfo, uint16_t flags, int prime,
@@ -1009,7 +1009,6 @@ struct config_file {
   int harden_short_bufsize;
   int harden_large_queries;
   int harden_glue;
-   int harden_unverified_glue;
   int harden_dnssec_stripped;
   int harden_referral_path;
   int use_caps_bits_for_id;
@@ -454,7 +454,7 @@ int pythonmod_init(struct module_env* env, int id)
   if(PyDict_SetItemString(pe->data, "script", fname) < 0) {
 	log_err("pythonmod: could not add item to dictionary");
 	Py_XDECREF(fname);
-	goto fail_close_file;
+	goto python_init_fail;
   }
   Py_XDECREF(fname);
   Py_XINCREF(pe->data);  /* reference will be stolen below */
@@ -462,7 +462,7 @@ int pythonmod_init(struct module_env* env, int id)
 	log_err("pythonmod: could not add mod_env object");
 	Py_XDECREF(pe->data);  /* 2 times, here and on python_init_fail; */
 	                       /* on failure the reference is not stolen */
-	goto fail_close_file;
+	goto python_init_fail;
   }

   if (PyRun_SimpleFile(script_py, pe->fname) < 0) {
@@ -493,15 +493,31 @@ int pythonmod_init(struct module_env* env, int id)
      flen = (size_t)ftell(script_py);
      fstr = malloc(flen+1);
      if(!fstr) {
-		log_err("malloc failure to print parse error");
-		goto fail_close_file;
+	      log_err("malloc failure to print parse error");
+
+/* close the file */
+#if PY_MAJOR_VERSION < 3
+	      Py_XDECREF(PyFileObject);
+#else
+	      fclose(script_py);
+#endif
+
+	      goto python_init_fail;
      }
      fseek(script_py, 0, SEEK_SET);
      if(fread(fstr, flen, 1, script_py) < 1) {
-		log_err("file read failed to print parse error: %s: %s",
+	      log_err("file read failed to print parse error: %s: %s",
 		pe->fname, strerror(errno));
-		free(fstr);
-		goto fail_close_file;
+	      free(fstr);
+
+/* close the file */
+#if PY_MAJOR_VERSION < 3
+	      Py_XDECREF(PyFileObject);
+#else
+	      fclose(script_py);
+#endif
+
+	      goto python_init_fail;
      }
      fstr[flen] = 0;
      /* we compile the string, but do not run it, to stop side-effects */
@@ -511,13 +527,21 @@ int pythonmod_init(struct module_env* env, int id)
 #endif

      log_py_err();
+
+/* close the file */
+#if PY_MAJOR_VERSION < 3
+      Py_XDECREF(PyFileObject);
+#else
+      fclose(script_py);
+#endif
+
 #if PY_MAJOR_VERSION <= 2 || (PY_MAJOR_VERSION == 3 && PY_MINOR_VERSION < 9)
      /* no cleanup needed for python before 3.9 */
 #else
      /* cleanup for python 3.9 and newer */
      free(fstr);
 #endif
-      goto fail_close_file;
+      goto python_init_fail;
   }

 /* close the file */
@@ -578,13 +602,6 @@ int pythonmod_init(struct module_env* env, int id)
   PyGILState_Release(gil);
   return 1;

-fail_close_file:
-#if PY_MAJOR_VERSION < 3
-   Py_XDECREF(PyFileObject);
-#else
-   fclose(script_py);
-#endif
-
 python_init_fail:
   Py_XDECREF(pe->module);
   Py_XDECREF(pe->dict);
@@ -760,8 +777,8 @@ size_t pythonmod_get_mem(struct module_env* env, int id)
 */
 static struct module_func_block pythonmod_block = {
   "python",
-   NULL, NULL, &pythonmod_init, &pythonmod_deinit, &pythonmod_operate,
-   &pythonmod_inform_super, &pythonmod_clear, &pythonmod_get_mem
+   &pythonmod_init, &pythonmod_deinit, &pythonmod_operate, &pythonmod_inform_super,
+   &pythonmod_clear, &pythonmod_get_mem
 };

 struct module_func_block* pythonmod_get_funcblock(void)
@@ -73,7 +73,7 @@ int storeQueryInCache(struct module_qstate* qstate, struct query_info* qinfo,

 	return dns_cache_store(qstate->env, qinfo, msgrep, is_referral,
 		qstate->prefetch_leeway, 0, NULL, qstate->query_flags,
-		qstate->qstarttime, qstate->is_valrec);
+		qstate->qstarttime);
 }

 /* Invalidate the message associated with query_info stored in message cache */
@@ -105,7 +105,6 @@ respip_sockaddr_find_or_create(struct respip_set* set, struct sockaddr_storage*
 		socklen_t addrlen, int net, int create, const char* ipstr)
 {
 	struct resp_addr* node;
-	log_assert(set);
 	node = (struct resp_addr*)addr_tree_find(&set->ip_tree, addr, addrlen, net);
 	if(!node && create) {
 		node = regional_alloc_zero(set->region, sizeof(*node));
@@ -129,7 +128,6 @@ void
 respip_sockaddr_delete(struct respip_set* set, struct resp_addr* node)
 {
 	struct resp_addr* prev;
-	log_assert(set);
 	prev = (struct resp_addr*)rbtree_previous((struct rbnode_type*)node);	
 	lock_rw_destroy(&node->lock);
 	(void)rbtree_delete(&set->ip_tree, node);
@@ -148,7 +146,6 @@ respip_find_or_create(struct respip_set* set, const char* ipstr, int create)
 	struct sockaddr_storage addr;
 	int net;
 	socklen_t addrlen;
-	log_assert(set);

 	if(!netblockstrtoaddr(ipstr, 0, &addr, &addrlen, &net)) {
 		log_err("cannot parse netblock: '%s'", ipstr);
@@ -163,7 +160,6 @@ respip_tag_cfg(struct respip_set* set, const char* ipstr,
 	const uint8_t* taglist, size_t taglen)
 {
 	struct resp_addr* node;
-	log_assert(set);

 	if(!(node=respip_find_or_create(set, ipstr, 1)))
 		return 0;
@@ -187,7 +183,6 @@ respip_action_cfg(struct respip_set* set, const char* ipstr,
 {
 	struct resp_addr* node;
 	enum respip_action action;
-	log_assert(set);

 	if(!(node=respip_find_or_create(set, ipstr, 1)))
 		return 0;
@@ -330,7 +325,6 @@ static int
 respip_data_cfg(struct respip_set* set, const char* ipstr, const char* rrstr)
 {
 	struct resp_addr* node;
-	log_assert(set);

 	node=respip_find_or_create(set, ipstr, 0);
 	if(!node || node->action == respip_none) {
@@ -350,7 +344,6 @@ respip_set_apply_cfg(struct respip_set* set, char* const* tagname, int num_tags,
 	struct config_strbytelist* p;
 	struct config_str2list* pa;
 	struct config_str2list* pd;
-	log_assert(set);

 	set->tagname = tagname;
 	set->num_tags = num_tags;
@@ -616,7 +609,6 @@ respip_addr_lookup(const struct reply_info *rep, struct respip_set* rs,
 	struct resp_addr* ra;
 	struct sockaddr_storage ss;
 	socklen_t addrlen;
-	log_assert(rs);

 	lock_rw_rdlock(&rs->lock);
 	for(i=0; i<rep->an_numrrsets; i++) {
@@ -875,8 +867,7 @@ respip_rewrite_reply(const struct query_info* qinfo,
 	const struct respip_client_info* cinfo, const struct reply_info* rep,
 	struct reply_info** new_repp, struct respip_action_info* actinfo,
 	struct ub_packed_rrset_key** alias_rrset, int search_only,
-	struct regional* region, struct auth_zones* az, int* rpz_passthru,
-	struct views* views, struct respip_set* ipset)
+	struct regional* region, struct auth_zones* az, int* rpz_passthru)
 {
 	const uint8_t* ctaglist;
 	size_t ctaglen;
@@ -885,6 +876,7 @@ respip_rewrite_reply(const struct query_info* qinfo,
 	struct config_strlist** tag_datas;
 	size_t tag_datas_size;
 	struct view* view = NULL;
+	struct respip_set* ipset = NULL;
 	size_t rrset_id = 0, rr_id = 0;
 	enum respip_action action = respip_none;
 	int tag = -1;
@@ -907,20 +899,8 @@ respip_rewrite_reply(const struct query_info* qinfo,
 	tag_actions_size = cinfo->tag_actions_size;
 	tag_datas = cinfo->tag_datas;
 	tag_datas_size = cinfo->tag_datas_size;
-	if(cinfo->view) {
-		view = cinfo->view;
-		lock_rw_rdlock(&view->lock);
-	} else if(cinfo->view_name) {
-		view = views_find_view(views, cinfo->view_name, 0);
-		if(!view) {
-			/* If the view no longer exists, the rewrite can not
-			 * be processed further. */
-			verbose(VERB_ALGO, "respip: failed because view %s no "
-				"longer exists", cinfo->view_name);
-			return 0;
-		}
-		/* The view is rdlocked by views_find_view. */
-	}
+	view = cinfo->view;
+	ipset = cinfo->respip_set;

 	log_assert(ipset);

@@ -935,6 +915,7 @@ respip_rewrite_reply(const struct query_info* qinfo,
 	  * Note also that we assume 'view' is valid in this function, which
 	  * should be safe (see unbound bug #1191) */
 	if(view) {
+		lock_rw_rdlock(&view->lock);
 		if(view->respip_set) {
 			if((raddr = respip_addr_lookup(rep,
 				view->respip_set, &rrset_id, &rr_id))) {
@@ -973,9 +954,6 @@ respip_rewrite_reply(const struct query_info* qinfo,
 					lock_rw_unlock(&raddr->lock);
 					lock_rw_unlock(&a->lock);
 					lock_rw_unlock(&az->rpz_lock);
-					if(view) {
-                    	lock_rw_unlock(&view->lock);
-					}
 					return 0;
 				}
 				if(rpz_used) {
@@ -983,7 +961,7 @@ respip_rewrite_reply(const struct query_info* qinfo,
 						struct sockaddr_storage ss;
 						socklen_t ss_len = 0;
 						char nm[256], ip[256];
-						char qn[LDNS_MAX_DOMAINLEN];
+						char qn[255+1];
 						if(!rdata2sockaddr(rep->rrsets[rrset_id]->entry.data, ntohs(rep->rrsets[rrset_id]->rk.type), rr_id, &ss, &ss_len))
 							snprintf(ip, sizeof(ip), "invalidRRdata");
 						else
@@ -1077,8 +1055,7 @@ generate_cname_request(struct module_qstate* qstate,
 	subqi.qtype = qstate->qinfo.qtype;
 	subqi.qclass = qstate->qinfo.qclass;
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	return (*qstate->env->attach_sub)(qstate, &subqi,
-		qstate->client_info, BIT_RD, 0, 0, &subq);
+	return (*qstate->env->attach_sub)(qstate, &subqi, BIT_RD, 0, 0, &subq);
 }

 void
@@ -1124,8 +1101,7 @@ respip_operate(struct module_qstate* qstate, enum module_ev event, int id,
 				qstate->client_info, qstate->return_msg->rep,
 				&new_rep, &actinfo, &alias_rrset, 0,
 				qstate->region, qstate->env->auth_zones,
-				&qstate->rpz_passthru, qstate->env->views,
-				qstate->env->respip_set)) {
+				&qstate->rpz_passthru)) {
 				goto servfail;
 			}
 			if(actinfo.action != respip_none) {
@@ -1173,8 +1149,7 @@ respip_merge_cname(struct reply_info* base_rep,
 	const struct query_info* qinfo, const struct reply_info* tgt_rep,
 	const struct respip_client_info* cinfo, int must_validate,
 	struct reply_info** new_repp, struct regional* region,
-	struct auth_zones* az, struct views* views,
-	struct respip_set* respip_set)
+	struct auth_zones* az)
 {
 	struct reply_info* new_rep;
 	struct reply_info* tmp_rep = NULL; /* just a placeholder */
@@ -1201,7 +1176,7 @@ respip_merge_cname(struct reply_info* base_rep,

 	/* see if the target reply would be subject to a response-ip action. */
 	if(!respip_rewrite_reply(qinfo, cinfo, tgt_rep, &tmp_rep, &actinfo,
-		&alias_rrset, 1, region, az, NULL, views, respip_set))
+		&alias_rrset, 1, region, az, NULL))
 		return 0;
 	if(actinfo.action != respip_none) {
 		log_info("CNAME target of redirect response-ip action would "
@@ -1237,8 +1212,7 @@ respip_inform_super(struct module_qstate* qstate, int id,
 	struct respip_qstate* rq = (struct respip_qstate*)super->minfo[id];
 	struct reply_info* new_rep = NULL;

-	if(rq)
-		rq->state = RESPIP_SUBQUERY_FINISHED;
+	rq->state = RESPIP_SUBQUERY_FINISHED;

 	/* respip subquery should have always been created with a valid reply
 	 * in super. */
@@ -1255,8 +1229,7 @@ respip_inform_super(struct module_qstate* qstate, int id,
 	if(!respip_merge_cname(super->return_msg->rep, &qstate->qinfo,
 		qstate->return_msg->rep, super->client_info,
 		super->env->need_to_validate, &new_rep, super->region,
-		qstate->env->auth_zones, qstate->env->views,
-		qstate->env->respip_set))
+		qstate->env->auth_zones))
 		goto fail;
 	super->return_msg->rep = new_rep;
 	return;
@@ -1286,8 +1259,8 @@ respip_get_mem(struct module_env* env, int id)
 */
 static struct module_func_block respip_block = {
 	"respip",
-	NULL, NULL, &respip_init, &respip_deinit, &respip_operate,
-	&respip_inform_super, &respip_clear, &respip_get_mem
+	&respip_init, &respip_deinit, &respip_operate, &respip_inform_super,
+	&respip_clear, &respip_get_mem
 };

 struct module_func_block*
@@ -1353,35 +1326,3 @@ respip_inform_print(struct respip_action_info* respip_actinfo, uint8_t* qname,
 		(actionstr) ? actionstr : "inform", srcip, port);
 	log_nametypeclass(NO_VERBOSE, txt, qname, qtype, qclass);
 }
-
-size_t respip_set_get_mem(struct respip_set* set)
-{
-	size_t m;
-	if(!set) return 0;
-	m = sizeof(*set);
-	lock_rw_rdlock(&set->lock);
-	m += regional_get_mem(set->region);
-	lock_rw_unlock(&set->lock);
-	return m;
-}
-
-void
-respip_set_swap_tree(struct respip_set* respip_set,
-	struct respip_set* data)
-{
-	rbnode_type* oldroot = respip_set->ip_tree.root;
-	size_t oldcount = respip_set->ip_tree.count;
-	struct regional* oldregion = respip_set->region;
-	char* const* oldtagname = respip_set->tagname;
-	int oldnum_tags = respip_set->num_tags;
-	respip_set->ip_tree.root = data->ip_tree.root;
-	respip_set->ip_tree.count = data->ip_tree.count;
-	respip_set->region = data->region;
-	respip_set->tagname = data->tagname;
-	respip_set->num_tags = data->num_tags;
-	data->ip_tree.root = oldroot;
-	data->ip_tree.count = oldcount;
-	data->region = oldregion;
-	data->tagname = oldtagname;
-	data->num_tags = oldnum_tags;
-}
@@ -23,8 +23,7 @@
 struct respip_set {
 	struct regional* region;
 	struct rbtree_type ip_tree;
-	lock_rw_type lock;	/* lock on the respip tree. It is ordered
-		after views and before hints, stubs and local zones. */
+	lock_rw_type lock;	/* lock on the respip tree */
 	char* const* tagname;	/* shallow copy of tag names, for logging */
 	int num_tags;		/* number of tagname entries */
 };
@@ -60,6 +59,7 @@ struct respip_addr_info;
 * This is essentially a subset of acl_addr (except for respip_set) but
 * defined as a separate structure to avoid dependency on the daemon-specific
 * structure.
+ * respip_set is supposed to refer to the response-ip set for the global view.
 */
 struct respip_client_info {
 	uint8_t* taglist;
@@ -68,12 +68,8 @@ struct respip_client_info {
 	size_t tag_actions_size;
 	struct config_strlist** tag_datas;
 	size_t tag_datas_size;
-	/** The view for the action, during cache callback that is by
-	 * pointer. */
 	struct view* view;
-	/** If from module query state, the view pointer is NULL, but the
-	 * name is stored in reference to the view. */
-	char* view_name;
+	struct respip_set* respip_set;
 };

 /**
@@ -153,16 +149,13 @@ int respip_views_apply_cfg(struct views* vs, struct config_file* cfg,
 *   on error.
 * @param region: allocator to build *new_repp.
 * @param az: auth zones containing RPZ information.
- * @param views: views tree to lookup view used.
- * @param respip_set: the respip set for the global view.
 * @return 1 on success, 0 on error.
 */
 int respip_merge_cname(struct reply_info* base_rep,
 	const struct query_info* qinfo, const struct reply_info* tgt_rep,
 	const struct respip_client_info* cinfo, int must_validate,
 	struct reply_info** new_repp, struct regional* region,
-	struct auth_zones* az, struct views* views,
-	struct respip_set* respip_set);
+	struct auth_zones* az);

 /**
 * See if any IP-based action should apply to any IP address of AAAA/A answer
@@ -185,8 +178,6 @@ int respip_merge_cname(struct reply_info* base_rep,
 * @param region: allocator to build *new_repp.
 * @param rpz_passthru: keeps track of query state can have passthru that
 *   stops further rpz processing. Or NULL for cached answer processing.
- * @param views: views tree to lookup view used.
- * @param ipset: the respip set for the global view.
 * @return 1 on success, 0 on error.
 */
 int respip_rewrite_reply(const struct query_info* qinfo,
@@ -195,7 +186,7 @@ int respip_rewrite_reply(const struct query_info* qinfo,
 	struct respip_action_info* actinfo,
 	struct ub_packed_rrset_key** alias_rrset,
 	int search_only, struct regional* region, struct auth_zones* az,
-	int* rpz_passthru, struct views* views, struct respip_set* ipset);
+	int* rpz_passthru);

 /**
 * Get the response-ip function block.
@@ -276,7 +267,7 @@ void respip_inform_print(struct respip_action_info* respip_actinfo,
 * @param addrlen: length of addr.
 * @param net: netblock to lookup.
 * @param create: create node if it does not exist when 1.
- * @param ipstr: human readable ip string, for logging.
+ * @param ipstr: human redable ip string, for logging.
 * @return newly created of found node, not holding lock.
 */
 struct resp_addr*
@@ -311,18 +302,4 @@ respip_sockaddr_delete(struct respip_set* set, struct resp_addr* node);

 struct ub_packed_rrset_key*
 respip_copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region);
-
-/** Get memory usage of respip set tree. The routine locks and unlocks the
- * set for reading. */
-size_t respip_set_get_mem(struct respip_set* set);
-
-/**
- * Swap internal tree with preallocated entries. Caller should manage
- * the locks.
- * @param respip_set: response ip tree
- * @param data: preallocated information.
- */
-void respip_set_swap_tree(struct respip_set* respip_set,
-	struct respip_set* data);
-
 #endif	/* RESPIP_RESPIP_H */
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Philip Homburg	4d384333ae	Switch from SVCB to IDELEG(65280)	2025-01-17 15:31:51 +01:00
jessevz	c3c54f04b4	Cleaned up the code	2024-07-12 15:05:12 +02:00
jessevz	fe919666ac	Fixed memory error	2024-07-12 10:34:03 +02:00
jessevz	35847e3be1	added _deleg query to apex to check if deleg capable	2024-06-20 16:21:36 +02:00
jessevz	6fe6f673ad	Fixed bug where lame delegation was returned	2024-06-20 12:46:03 +02:00
jessevz	c6ce5d9652	Works now for every situation	2024-06-19 16:02:38 +02:00
jessevz	b8607195b0	Can now query for stuff that is not at apex	2024-06-19 14:35:09 +02:00
jessevz	98b899608e	made deleg work with all resource records (not only A records)	2024-06-19 12:28:44 +02:00
jessevz	8f51ec4ce2	made _deleg work when multiple _deleg domains need to be tracked	2024-06-18 15:54:54 +02:00
jessevz	d050ff923e	rewrote some logic	2024-06-13 11:41:04 +02:00
jessevz	3c347e345c	changed malloc to regional allocs	2024-06-13 10:40:03 +02:00
jessevz	42b7ce9c41	Made a first rough working version for _deleg	2024-06-13 10:04:37 +02:00
jessevz	011c5a0e0f	Made it possible to change queries into _deleg queries	2024-06-12 09:26:32 +02:00