Disallow $INCLUDE for secondary zones. This matches the change

in the code repository, and is meant for after merge of the simdzone change.
- rpz-zone-load, fix comment for the rrset_insert_rr_wol function.
2026-08-17 21:25:50 +02:00 · 2026-06-16 09:32:24 +02:00 · 2026-01-28 14:35:40 +01:00 · 2026-01-28 14:13:13 +01:00 · 2026-01-28 13:58:09 +01:00 · 2026-01-28 12:47:03 +01:00
31 changed files with 1072 additions and 54312 deletions
@@ -175,8 +175,38 @@ jobs:
    steps:
      - uses: actions/checkout@v4
        with:
-          submodules: false
+          submodules: recursive
          persist-credentials: false
+      - name: test_windows_configure
+        if: ${{ matrix.test_windows == 'yes' }}
+        shell: bash
+        run: |
+          # The run starts with mount points for /c, /d, and
+          # C:/Program Files/Git on /
+          # C:/Program Files/Git/usr/bin on /bin
+          # C:/Users/RUNNER~1/AppData/Local/Temp on /tmp
+          echo "mount"
+          mount || echo "ignored"
+          echo "mount -o bind /c/msys64/usr /usr"
+          mount -o bind /c/msys64/usr /usr || echo "ignored"
+          # Now there is:
+          # C:/msys64 on /
+          # C:/msys64/usr/bin on /bin
+          # And those mount points should go away for the next 'run:' shell.
+          echo "mount"
+          mount || echo "ignored"
+          # probably installs to C:\msys64\usr\bin\bash.exe
+          echo "pacman -S --noconfirm autotools"
+          C:/msys64/usr/bin/pacman -S --noconfirm autotools
+          echo "rm -f aclocal.m4"
+          rm -f aclocal.m4
+          # The paths are mounted, so that /c/msys64/usr/share/autoconf-..,
+          # /c/msys64/usr/share/aclocal-.., /c/msys64/usr/share/automake-..
+          # are in /usr. Also for /usr/bin, autoreconf is from
+          # /c/msys64/usr/bin.
+          echo "autoreconf -fi"
+          #PATH="/c/msys64/usr/bin:$PATH" autoreconf -fi || echo "ignored"
+          autoreconf -fi
      - name: test_windows
        if: ${{ matrix.test_windows == 'yes' }}
        env:
@@ -189,6 +219,9 @@ jobs:
          cd ..
          export prepath=`pwd`
          echo prepath=${prepath}
+          # The mount should have the git directories.
+          echo "mount"
+          mount || echo "ignored"
          echo "choco install winflexbison3"
          choco install winflexbison3
          echo 'LEX="win_flex"'
@@ -206,7 +239,7 @@ jobs:
          #sed -e 's/use Pod::Usage//' < Configure > Configure.fix
          # ./Configure.fix no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl"
          # pacman is used to install for msys2, with
-          # C:/msys64/usr/bin/pacman -S perl
+          # C:/msys64/usr/bin/pacman -S --noconfirm perl
          echo "C:/msys64/usr/bin/perl ./Configure no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix=\""$prepath/openssl"\" PERL=\"C:/msys64/usr/bin/perl\""
          C:/msys64/usr/bin/perl ./Configure no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl" PERL="C:/msys64/usr/bin/perl"
          # make the libs only, build faster
@@ -295,6 +328,8 @@ jobs:
          ./contrib/android/install_expat.sh
          echo "::endgroup::"
          echo "::group::configure"
+          echo "autoreconf -fi"
+          autoreconf -fi
          echo "./configure ${CONFIG_OPTS}"
          ./configure ${CONFIG_OPTS}
          echo "::endgroup::"
@@ -314,6 +349,7 @@ jobs:
          IOS_CPU: ${{ matrix.IOS_CPU }}
        run: |
          #(already installed) ./contrib/ios/install_tools.sh
+          brew install autoconf automake libtool make
          export AUTOTOOLS_BUILD="$(./config.guess)"
          echo AUTOTOOLS_BUILD=${AUTOTOOLS_BUILD}
          export IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
@@ -335,6 +371,8 @@ jobs:
          ./contrib/ios/install_expat.sh
          echo "::endgroup::"
          echo "::group::configure"
+          echo "autoreconf -fi"
+          autoreconf -fi
          echo "./configure ${CONFIG_OPTS}"
          ./configure ${CONFIG_OPTS}
          echo "::endgroup::"
@@ -360,10 +398,12 @@ jobs:
          cpu_count: 2
          run: |
            set -e -x
-            if test "$CROSS_PLATFORM_OS" = "freebsd"; then sudo pkg install -y openssl libevent expat; fi
-            if test "$CROSS_PLATFORM_OS" = "openbsd"; then sudo pkg_add libevent; fi
-            if test "$CROSS_PLATFORM_OS" = "netbsd"; then sudo pkgin -y install libevent; fi
+            if test "$CROSS_PLATFORM_OS" = "freebsd"; then sudo pkg install -y autoconf automake libtool pkgconf openssl libevent expat; fi
+            if test "$CROSS_PLATFORM_OS" = "openbsd"; then sudo pkg_add autoconf-2.71 automake-1.16.5 libtool pkgconf libevent; export AUTOCONF_VERSION="2.71"; export AUTOMAKE_VERSION="1.16"; fi
+            if test "$CROSS_PLATFORM_OS" = "netbsd"; then sudo pkgin -y install autoconf automake libtool pkgconf libevent; export LDFLAGS="-Wl,--rpath=/usr/pkg/lib"; fi
            echo "::group::configure"
+            rm -f aclocal.m4
+            autoreconf -fi
            ./configure ${{ matrix.cross_platform_config }}
            echo "::endgroup::"
            echo "::group::make"
@@ -377,10 +417,15 @@ jobs:
        run: sudo apt-get install libevent-dev
      - name: install expat
        if: ${{ matrix.install_expat == 'yes' }}
-        run: brew install expat
+        run: |
+          brew install expat
+          brew install autoconf automake libtool make
      - name: configure
        if: ${{ matrix.config != 'no' }}
-        run: ./configure ${{ matrix.config }}
+        run: |
+          if test `uname` = "Linux"; then sudo apt-get install autoconf automake libtool make; fi
+          autoreconf -fi
+          ./configure ${{ matrix.config }}
      - name: make
        if: ${{ matrix.make != 'no' }}
        run: make
@@ -14,9 +14,14 @@ jobs:
    steps:
    - uses: actions/checkout@v4
      with:
+        submodules: recursive
        persist-credentials: false
+    - name: install packages
+      run: sudo apt-get install autoconf automake libtool make
    - name: configure
-      run: ./configure --enable-debug
+      run: |
+        autoreconf -fi
+        ./configure --enable-debug
    - name: make
      run: make
    - name: make test
@@ -3,11 +3,17 @@
 /.libs/
 /.source
 /Makefile
+/aclocal.m4
 /autom4te.cache/
+/config.guess
 /config.h
+/config.h.in
 /config.h.in~
 /config.log
 /config.status
+/config.sub
+/configure
+/configure~
 /dnstap/dnstap_config.h
 /dnscrypt/dnscrypt_config.h
 /util/configlexer.c
@@ -22,8 +28,10 @@
 /doc/unbound-host.1
 /doc/unbound.8
 /doc/unbound.conf.5
+/install-sh
 /libtool
 /libunbound.la
+/ltmain.sh
 /_unbound.la
 /smallapp/unbound-control-setup.sh
 /unbound
@@ -0,0 +1,3 @@
+[submodule "simdzone"]
+	path = simdzone
+	url = https://github.com/NLnetLabs/simdzone.git
@@ -56,7 +56,7 @@ YACC=@YACC@
 LEX=@LEX@
 STRIP=@STRIP@
 CC=@CC@
-CPPFLAGS=-I. @CPPFLAGS@
+CPPFLAGS=-I. @CPPFLAGS@ -Isimdzone/include -I@srcdir@/simdzone/include
 PYTHON_CPPFLAGS=-I. -I$(srcdir) @PYTHON_CPPFLAGS@
 CFLAGS=-DSRCDIR=$(srcdir) @CFLAGS@
 LDFLAGS=@LDFLAGS@
@@ -267,6 +267,7 @@ LIBUNBOUND_SRC=libunbound/context.c libunbound/libunbound.c \
 libunbound/libworker.c
 LIBUNBOUND_OBJ=context.lo libunbound.lo libworker.lo ub_event_pluggable.lo
 LIBUNBOUND_OBJ_LINK=$(LIBUNBOUND_OBJ) $(COMMON_OBJ_WITHOUT_UB_EVENT) $(SLDNS_OBJ) $(COMPAT_OBJ)
+SIMDZONE_OBJ=@SIMDZONE_OBJ@

 # win apps or "" if not on windows
 WINAPPS=@WINAPPS@
@@ -364,19 +365,24 @@ longtest:	tests
 	if test ! $(srcdir)/testdata -ef ./testdata; then rm -rf testcode testdata; mkdir testcode testdata; cp -R $(srcdir)/testdata/*.sh $(srcdir)/testdata/*.tdir $(srcdir)/testdata/*.rpl $(srcdir)/testdata/*.crpl testdata; cp $(srcdir)/testcode/*.sh testcode; if test ! -d util; then mkdir util; fi; cp $(srcdir)/util/iana_ports.inc util; fi
 	if test -x "`which bash`"; then bash testcode/do-tests.sh; else sh testcode/do-tests.sh; fi

+simdzone/libzone.la:
+	$(MAKE) -C simdzone
+
+simdzone/include/zone/export.h: simdzone/libzone.la
+
 lib:	libunbound.la unbound.h

-libunbound.la:	$(LIBUNBOUND_OBJ_LINK)
-	$(LINK_LIB) $(UBSYMS) -o $@ $(LIBUNBOUND_OBJ_LINK) -rpath $(libdir) $(SSLLIB) $(LIBS)
+libunbound.la:	simdzone/libzone.la $(LIBUNBOUND_OBJ_LINK)
+	$(LINK_LIB) $(UBSYMS) -o $@ $(LIBUNBOUND_OBJ_LINK) $(SIMDZONE_OBJ) -rpath $(libdir) $(SSLLIB) $(LIBS)

 unbound$(EXEEXT):	$(DAEMON_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(DAEMON_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
+	$(LINK) -o $@ $(DAEMON_OBJ_LINK) $(EXTRALINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)

 unbound-checkconf$(EXEEXT):	$(CHECKCONF_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)

 unbound-control$(EXEEXT):	$(CONTROL_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(CONTROL_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(CONTROL_OBJ_LINK) $(EXTRALINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)

 unbound-host$(EXEEXT):	$(HOST_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(HOST_OBJ_LINK) libunbound.la $(SSLLIB) $(LIBS)
@@ -394,43 +400,43 @@ anchor-update$(EXEEXT):  $(ANCHORUPD_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(ANCHORUPD_OBJ_LINK) libunbound.la $(LIBS)

 unittest$(EXEEXT):	$(UNITTEST_OBJ_LINK)
-	$(LINK) -o $@ $(UNITTEST_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(UNITTEST_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)

 testbound$(EXEEXT):	$(TESTBOUND_OBJ_LINK)
-	$(LINK) -o $@ $(TESTBOUND_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(TESTBOUND_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)

 lock-verify$(EXEEXT):	$(LOCKVERIFY_OBJ_LINK)
-	$(LINK) -o $@ $(LOCKVERIFY_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(LOCKVERIFY_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)

 petal$(EXEEXT):	$(PETAL_OBJ_LINK)
 	$(LINK) -o $@ $(PETAL_OBJ_LINK) $(SSLLIB) $(LIBS)

 pktview$(EXEEXT):	$(PKTVIEW_OBJ_LINK)
-	$(LINK) -o $@ $(PKTVIEW_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(PKTVIEW_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)

 memstats$(EXEEXT):	$(MEMSTATS_OBJ_LINK)
-	$(LINK) -o $@ $(MEMSTATS_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(MEMSTATS_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)

 asynclook$(EXEEXT):	$(ASYNCLOOK_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(ASYNCLOOK_OBJ_LINK) libunbound.la $(SSLLIB) $(LIBS)

 streamtcp$(EXEEXT):	$(STREAMTCP_OBJ_LINK)
-	$(LINK) -o $@ $(STREAMTCP_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(STREAMTCP_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)

 dohclient$(EXEEXT):	$(DOHCLIENT_OBJ_LINK)
-	$(LINK) -o $@ $(DOHCLIENT_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(DOHCLIENT_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)

 doqclient$(EXEEXT):	$(DOQCLIENT_OBJ_LINK)
-	$(LINK) -o $@ $(DOQCLIENT_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(DOQCLIENT_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)

 perf$(EXEEXT):	$(PERF_OBJ_LINK)
-	$(LINK) -o $@ $(PERF_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(PERF_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)

 delayer$(EXEEXT):	$(DELAYER_OBJ_LINK)
-	$(LINK) -o $@ $(DELAYER_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(DELAYER_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)

 readzone$(EXEEXT):	$(READZONE_OBJ_LINK)
-	$(LINK) -o $@ $(READZONE_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(READZONE_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)

 signit$(EXEEXT):	testcode/signit.c
 	$(CC) $(CPPFLAGS) $(CFLAGS) @PTHREAD_CFLAGS_ONLY@ -o $@ testcode/signit.c $(LDFLAGS) -lldns $(SSLLIB) $(LIBS)
@@ -458,7 +464,7 @@ dnstap/dnstap.pb-c.h: dnstap/dnstap.pb-c.c
 	touch $@

 unbound-dnstap-socket$(EXEEXT):	$(DNSTAP_SOCKET_OBJ_LINK)
-	$(LINK) -o $@ $(DNSTAP_SOCKET_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(DNSTAP_SOCKET_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)

 dnstap.pb-c.lo dnstap.pb-c.o: dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h
 dtstream.lo dtstream.o: $(srcdir)/dnstap/dtstream.c config.h $(srcdir)/dnstap/dtstream.h
@@ -522,7 +528,9 @@ util/configparser.c:  $(srcdir)/util/configparser.y
 util/configparser.h: util/configparser.c
 	touch $@

-clean:
+.PHONY: .clean .distclean .maintainer-clean .realclean .devclean
+
+.clean:
 	rm -f *.o *.d *.lo *~ tags
 	rm -f unbound$(EXEEXT) unbound-checkconf$(EXEEXT) unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup libunbound.la unbound.h
 	rm -f $(ALL_SRC:.c=.lint)
@@ -530,19 +538,37 @@ clean:
 	rm -f libunbound.a
 	rm -rf autom4te.cache .libs build doc/html doc/xml

-distclean: clean
+.distclean: .clean
 	rm -f config.status config.log config.h
 	rm -f doc/example.conf doc/libunbound.3 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound-control.8 doc/unbound.8 doc/unbound.conf.5 doc/unbound-host.1
 	rm -f smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service
 	rm -f $(TEST_BIN)
 	rm -f Makefile

-maintainer-clean: distclean
+.maintainer-clean: .distclean
 	rm -f util/configlexer.c util/configparser.c util/configparser.h

-realclean: maintainer-clean
+.realclean: .maintainer-clean
 	rm -f configure config.h.in config.sub config.guess ltmain.sh aclocal.m4 libtool

+.devclean: .realclean
+	rm -f config.h.in configure
+
+clean: .clean
+	$(MAKE) -C simdzone clean
+
+distclean: .distclean
+	$(MAKE) -C simdzone distclean
+
+realclean: .realclean
+	$(MAKE) -C simdzone realclean
+
+maintainer-clean: .maintainer-clean
+	$(MAKE) -C simdzone maintainer-clean
+
+devclean: .devclean
+	$(MAKE) -C simdzone devclean
+
 .SUFFIXES: .lint
 .c.lint:
 	$(LINT) $(LINTFLAGS) -I. -I$(srcdir) $<
@@ -703,6 +729,7 @@ depend:
 			-e 's?$$(srcdir)/edns-subnet/subnetmod.h $$(srcdir)/edns-subnet/subnet-whitelist.h $$(srcdir)/edns-subnet/edns-subnet.h $$(srcdir)/edns-subnet/addrtree.h?$$(SUBNET_HEADER)?g' \
 			-e 's?$$(srcdir)/ipsecmod/ipsecmod.h $$(srcdir)/ipsecmod/ipsecmod-whitelist.h?$$(IPSECMOD_HEADER)?g' \
 			-e 's?$$(srcdir)/dynlibmod/dynlibmod.h?$$(DYNLIBMOD_HEADER)?g' \
+			-e 's?$$(srcdir)/simdzone/include/zone/export.h?simdzone/include/zone/export.h?g' \
 			-e 's!\(.*\)\.o[ :]*!\1.lo \1.o: !g' \
 			> $(DEPEND_TMP)
 	cp $(DEPEND_TARGET) $(DEPEND_TMP2)
@@ -1000,7 +1027,9 @@ authzone.lo authzone.o: $(srcdir)/services/authzone.c config.h $(srcdir)/service
 $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h \
 $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/keyraw.h \
 $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_nsec.h $(srcdir)/validator/val_secalgo.h \
- $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_utils.h
+ $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_utils.h \
+ $(srcdir)/simdzone/include/zone.h $(srcdir)/simdzone/include/zone/attributes.h \
+ simdzone/include/zone/export.h
 fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/fptr_wlist.h \
 $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
@@ -1,4 +1,5 @@
 Unbound README
+* From source repository: git submodule update --init && autoreconf -fi
 * ./configure && make && make install
 * You can use libevent if you want. libevent is useful when using 
  many (10000) outgoing ports. By default max 256 ports are opened at
@@ -19,6 +19,14 @@ You can learn more about Unbound by reading our
 Make sure you have the C toolchain, OpenSSL and its include files, and libexpat
 installed.
 If building from the repository source you also need flex and bison installed.
+If building from the repository source, also init the git submodule and
+create the configure script with:
+
+```
+git submodule update --init
+autoreconf -fi
+```
+
 Unbound can be compiled and installed using:

 ```
@@ -177,6 +177,12 @@ else
 	else on_mingw="no"; fi
 fi

+dnl install the install-sh file with libtoolize -ci, and autoreconf -fi.
+AC_REQUIRE_AUX_FILE([install-sh])
+if test ! -f install-sh; then
+    AC_MSG_WARN([./install-sh is missing, use `libtoolize -ci` or `autoreconf -fi` to add it])
+fi
+
 #
 # Determine configuration file
 # the eval is to evaluate shell expansion twice
@@ -2036,6 +2042,9 @@ dt_DNSTAP([$UNBOUND_RUN_DIR/dnstap.sock],
        AC_SUBST([ENABLE_DNSTAP], [0])
    ]
 )
+dnstap_config="dnstap/dnstap_config.h.tmp:dnstap/dnstap_config.h.in"
+dnstap_config_tmp="dnstap/dnstap_config.h.tmp"
+dnstap_config_out="dnstap/dnstap_config.h"

 # check for dnscrypt if requested
 dnsc_DNSCRYPT([
@@ -2490,6 +2499,34 @@ AC_SUBST(version, [VERSION_MAJOR.VERSION_MINOR.VERSION_MICRO])
 AX_BUILD_DATE_EPOCH(date, [[%b %e, %Y]])
 AC_SUBST(date)

-AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service contrib/unbound_portable.service])
+AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh $dnstap_config dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service contrib/unbound_portable.service])
 AC_CONFIG_HEADERS([config.h])
+
+# Arguments introduced specifically for simdzone.
+AC_ARG_ENABLE(westmere, AS_HELP_STRING([--disable-westmere], [Disable Westmere (SSE4.2) parser kernel]))
+AC_ARG_ENABLE(haswell, AS_HELP_STRING([--disable-haswell], [Disable Haswell (AVX2) parser kernel]))
+if test ! -f simdzone/configure.ac; then AC_MSG_ERROR([There is no "simdzone/configure.ac" file. The simdzone directory has not been fetched, perhaps get it with 'git submodule update --init'.]); fi
+if test ! -f simdzone/configure; then AC_MSG_ERROR([There is no "simdzone/configure" file. The simdzone directory has no configure script file, perhaps run 'autoreconf -fi'.]); fi
+AC_CONFIG_SUBDIRS([simdzone])
+
 AC_OUTPUT
+# Pick up the objects for simdzone.
+SIMDZONE_OBJ=`(cd simdzone; make list_objs) | sed -e 's?src?simdzone/src?g'`
+AC_SUBST(SIMDZONE_OBJ)
+sed -e 's?^SIMDZONE_OBJ=.*$?SIMDZONE_OBJ='"$SIMDZONE_OBJ"'?' < Makefile > Makefile.tmp.$$
+mv -f Makefile.tmp.$$ Makefile
+# If dnstap config has changed, overwrite it.
+if test -n "$dnstap_config"; then
+	if test ! -f "$dnstap_config_out"; then
+		mv "$dnstap_config_tmp" "$dnstap_config_out" || AC_MSG_ERROR([Could not create $dnstap_config_out])
+	else if diff "$dnstap_config_out" "$dnstap_config_tmp" >/dev/null 2>&1; then
+		if test "x$opt_dnstap" != "xno"; then
+		  AC_MSG_NOTICE([In $srcdir: $dnstap_config_out is unchanged])
+		fi
+		rm -f "$dnstap_config_tmp"
+	else
+		rm -f "$dnstap_config_out"
+		mv "$dnstap_config_tmp" "$dnstap_config_out" || AC_MSG_ERROR([Could not create $dnstap_config_out])
+	  fi
+	fi
+fi
@@ -1339,7 +1339,7 @@ perform_zone_add(RES* ssl, struct local_zones* zones, char* arg)
 		return 1;
 	}
 	if(!local_zones_add_zone(zones, nm, nmlen,
-		nmlabs, LDNS_RR_CLASS_IN, t)) {
+		nmlabs, LDNS_RR_CLASS_IN, t, NULL)) {
 		lock_rw_unlock(&zones->lock);
 		ssl_printf(ssl, "error out of memory\n");
 		return 0;
@@ -1007,6 +1007,7 @@ EXCLUDE                = ./build \
                         libunbound/python/doc \
                         libunbound/python/examples \
                         ./ldns-src \
+                         ./simdzone \
                         README.md \
                         doc/control_proto_spec.txt \
                         doc/requirements.txt
@@ -1,501 +0,0 @@
-#!/usr/bin/sh
-# install - install a program, script, or datafile
-
-scriptversion=2013-12-25.23; # UTC
-
-# This originates from X11R5 (mit/util/scripts/install.sh), which was
-# later released in X11R6 (xc/config/util/install.sh) with the
-# following copyright and license.
-#
-# Copyright (C) 1994 X Consortium
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to
-# deal in the Software without restriction, including without limitation the
-# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
-# sell copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in
-# all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
-# X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
-# AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNEC-
-# TION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-#
-# Except as contained in this notice, the name of the X Consortium shall not
-# be used in advertising or otherwise to promote the sale, use or other deal-
-# ings in this Software without prior written authorization from the X Consor-
-# tium.
-#
-#
-# FSF changes to this file are in the public domain.
-#
-# Calling this script install-sh is preferred over install.sh, to prevent
-# 'make' implicit rules from creating a file called install from it
-# when there is no Makefile.
-#
-# This script is compatible with the BSD install script, but was written
-# from scratch.
-
-tab='	'
-nl='
-'
-IFS=" $tab$nl"
-
-# Set DOITPROG to "echo" to test this script.
-
-doit=${DOITPROG-}
-doit_exec=${doit:-exec}
-
-# Put in absolute file names if you don't have them in your path;
-# or use environment vars.
-
-chgrpprog=${CHGRPPROG-chgrp}
-chmodprog=${CHMODPROG-chmod}
-chownprog=${CHOWNPROG-chown}
-cmpprog=${CMPPROG-cmp}
-cpprog=${CPPROG-cp}
-mkdirprog=${MKDIRPROG-mkdir}
-mvprog=${MVPROG-mv}
-rmprog=${RMPROG-rm}
-stripprog=${STRIPPROG-strip}
-
-posix_mkdir=
-
-# Desired mode of installed file.
-mode=0755
-
-chgrpcmd=
-chmodcmd=$chmodprog
-chowncmd=
-mvcmd=$mvprog
-rmcmd="$rmprog -f"
-stripcmd=
-
-src=
-dst=
-dir_arg=
-dst_arg=
-
-copy_on_change=false
-is_target_a_directory=possibly
-
-usage="\
-Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE
-   or: $0 [OPTION]... SRCFILES... DIRECTORY
-   or: $0 [OPTION]... -t DIRECTORY SRCFILES...
-   or: $0 [OPTION]... -d DIRECTORIES...
-
-In the 1st form, copy SRCFILE to DSTFILE.
-In the 2nd and 3rd, copy all SRCFILES to DIRECTORY.
-In the 4th, create DIRECTORIES.
-
-Options:
-     --help     display this help and exit.
-     --version  display version info and exit.
-
-  -c            (ignored)
-  -C            install only if different (preserve the last data modification time)
-  -d            create directories instead of installing files.
-  -g GROUP      $chgrpprog installed files to GROUP.
-  -m MODE       $chmodprog installed files to MODE.
-  -o USER       $chownprog installed files to USER.
-  -s            $stripprog installed files.
-  -t DIRECTORY  install into DIRECTORY.
-  -T            report an error if DSTFILE is a directory.
-
-Environment variables override the default commands:
-  CHGRPPROG CHMODPROG CHOWNPROG CMPPROG CPPROG MKDIRPROG MVPROG
-  RMPROG STRIPPROG
-"
-
-while test $# -ne 0; do
-  case $1 in
-    -c) ;;
-
-    -C) copy_on_change=true;;
-
-    -d) dir_arg=true;;
-
-    -g) chgrpcmd="$chgrpprog $2"
-        shift;;
-
-    --help) echo "$usage"; exit $?;;
-
-    -m) mode=$2
-        case $mode in
-          *' '* | *"$tab"* | *"$nl"* | *'*'* | *'?'* | *'['*)
-            echo "$0: invalid mode: $mode" >&2
-            exit 1;;
-        esac
-        shift;;
-
-    -o) chowncmd="$chownprog $2"
-        shift;;
-
-    -s) stripcmd=$stripprog;;
-
-    -t)
-        is_target_a_directory=always
-        dst_arg=$2
-        # Protect names problematic for 'test' and other utilities.
-        case $dst_arg in
-          -* | [=\(\)!]) dst_arg=./$dst_arg;;
-        esac
-        shift;;
-
-    -T) is_target_a_directory=never;;
-
-    --version) echo "$0 $scriptversion"; exit $?;;
-
-    --) shift
-        break;;
-
-    -*) echo "$0: invalid option: $1" >&2
-        exit 1;;
-
-    *)  break;;
-  esac
-  shift
-done
-
-# We allow the use of options -d and -T together, by making -d
-# take the precedence; this is for compatibility with GNU install.
-
-if test -n "$dir_arg"; then
-  if test -n "$dst_arg"; then
-    echo "$0: target directory not allowed when installing a directory." >&2
-    exit 1
-  fi
-fi
-
-if test $# -ne 0 && test -z "$dir_arg$dst_arg"; then
-  # When -d is used, all remaining arguments are directories to create.
-  # When -t is used, the destination is already specified.
-  # Otherwise, the last argument is the destination.  Remove it from $@.
-  for arg
-  do
-    if test -n "$dst_arg"; then
-      # $@ is not empty: it contains at least $arg.
-      set fnord "$@" "$dst_arg"
-      shift # fnord
-    fi
-    shift # arg
-    dst_arg=$arg
-    # Protect names problematic for 'test' and other utilities.
-    case $dst_arg in
-      -* | [=\(\)!]) dst_arg=./$dst_arg;;
-    esac
-  done
-fi
-
-if test $# -eq 0; then
-  if test -z "$dir_arg"; then
-    echo "$0: no input file specified." >&2
-    exit 1
-  fi
-  # It's OK to call 'install-sh -d' without argument.
-  # This can happen when creating conditional directories.
-  exit 0
-fi
-
-if test -z "$dir_arg"; then
-  if test $# -gt 1 || test "$is_target_a_directory" = always; then
-    if test ! -d "$dst_arg"; then
-      echo "$0: $dst_arg: Is not a directory." >&2
-      exit 1
-    fi
-  fi
-fi
-
-if test -z "$dir_arg"; then
-  do_exit='(exit $ret); exit $ret'
-  trap "ret=129; $do_exit" 1
-  trap "ret=130; $do_exit" 2
-  trap "ret=141; $do_exit" 13
-  trap "ret=143; $do_exit" 15
-
-  # Set umask so as not to create temps with too-generous modes.
-  # However, 'strip' requires both read and write access to temps.
-  case $mode in
-    # Optimize common cases.
-    *644) cp_umask=133;;
-    *755) cp_umask=22;;
-
-    *[0-7])
-      if test -z "$stripcmd"; then
-        u_plus_rw=
-      else
-        u_plus_rw='% 200'
-      fi
-      cp_umask=`expr '(' 777 - $mode % 1000 ')' $u_plus_rw`;;
-    *)
-      if test -z "$stripcmd"; then
-        u_plus_rw=
-      else
-        u_plus_rw=,u+rw
-      fi
-      cp_umask=$mode$u_plus_rw;;
-  esac
-fi
-
-for src
-do
-  # Protect names problematic for 'test' and other utilities.
-  case $src in
-    -* | [=\(\)!]) src=./$src;;
-  esac
-
-  if test -n "$dir_arg"; then
-    dst=$src
-    dstdir=$dst
-    test -d "$dstdir"
-    dstdir_status=$?
-  else
-
-    # Waiting for this to be detected by the "$cpprog $src $dsttmp" command
-    # might cause directories to be created, which would be especially bad
-    # if $src (and thus $dsttmp) contains '*'.
-    if test ! -f "$src" && test ! -d "$src"; then
-      echo "$0: $src does not exist." >&2
-      exit 1
-    fi
-
-    if test -z "$dst_arg"; then
-      echo "$0: no destination specified." >&2
-      exit 1
-    fi
-    dst=$dst_arg
-
-    # If destination is a directory, append the input filename; won't work
-    # if double slashes aren't ignored.
-    if test -d "$dst"; then
-      if test "$is_target_a_directory" = never; then
-        echo "$0: $dst_arg: Is a directory" >&2
-        exit 1
-      fi
-      dstdir=$dst
-      dst=$dstdir/`basename "$src"`
-      dstdir_status=0
-    else
-      dstdir=`dirname "$dst"`
-      test -d "$dstdir"
-      dstdir_status=$?
-    fi
-  fi
-
-  obsolete_mkdir_used=false
-
-  if test $dstdir_status != 0; then
-    case $posix_mkdir in
-      '')
-        # Create intermediate dirs using mode 755 as modified by the umask.
-        # This is like FreeBSD 'install' as of 1997-10-28.
-        umask=`umask`
-        case $stripcmd.$umask in
-          # Optimize common cases.
-          *[2367][2367]) mkdir_umask=$umask;;
-          .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;;
-
-          *[0-7])
-            mkdir_umask=`expr $umask + 22 \
-              - $umask % 100 % 40 + $umask % 20 \
-              - $umask % 10 % 4 + $umask % 2
-            `;;
-          *) mkdir_umask=$umask,go-w;;
-        esac
-
-        # With -d, create the new directory with the user-specified mode.
-        # Otherwise, rely on $mkdir_umask.
-        if test -n "$dir_arg"; then
-          mkdir_mode=-m$mode
-        else
-          mkdir_mode=
-        fi
-
-        posix_mkdir=false
-        case $umask in
-          *[123567][0-7][0-7])
-            # POSIX mkdir -p sets u+wx bits regardless of umask, which
-            # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
-            ;;
-          *)
-            tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
-            trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0
-
-            if (umask $mkdir_umask &&
-                exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
-            then
-              if test -z "$dir_arg" || {
-                   # Check for POSIX incompatibilities with -m.
-                   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
-                   # other-writable bit of parent directory when it shouldn't.
-                   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
-                   ls_ld_tmpdir=`ls -ld "$tmpdir"`
-                   case $ls_ld_tmpdir in
-                     d????-?r-*) different_mode=700;;
-                     d????-?--*) different_mode=755;;
-                     *) false;;
-                   esac &&
-                   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
-                     ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
-                     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
-                   }
-                 }
-              then posix_mkdir=:
-              fi
-              rmdir "$tmpdir/d" "$tmpdir"
-            else
-              # Remove any dirs left behind by ancient mkdir implementations.
-              rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
-            fi
-            trap '' 0;;
-        esac;;
-    esac
-
-    if
-      $posix_mkdir && (
-        umask $mkdir_umask &&
-        $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir"
-      )
-    then :
-    else
-
-      # The umask is ridiculous, or mkdir does not conform to POSIX,
-      # or it failed possibly due to a race condition.  Create the
-      # directory the slow way, step by step, checking for races as we go.
-
-      case $dstdir in
-        /*) prefix='/';;
-        [-=\(\)!]*) prefix='./';;
-        *)  prefix='';;
-      esac
-
-      oIFS=$IFS
-      IFS=/
-      set -f
-      set fnord $dstdir
-      shift
-      set +f
-      IFS=$oIFS
-
-      prefixes=
-
-      for d
-      do
-        test X"$d" = X && continue
-
-        prefix=$prefix$d
-        if test -d "$prefix"; then
-          prefixes=
-        else
-          if $posix_mkdir; then
-            (umask=$mkdir_umask &&
-             $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
-            # Don't fail if two instances are running concurrently.
-            test -d "$prefix" || exit 1
-          else
-            case $prefix in
-              *\'*) qprefix=`echo "$prefix" | sed "s/'/'\\\\\\\\''/g"`;;
-              *) qprefix=$prefix;;
-            esac
-            prefixes="$prefixes '$qprefix'"
-          fi
-        fi
-        prefix=$prefix/
-      done
-
-      if test -n "$prefixes"; then
-        # Don't fail if two instances are running concurrently.
-        (umask $mkdir_umask &&
-         eval "\$doit_exec \$mkdirprog $prefixes") ||
-          test -d "$dstdir" || exit 1
-        obsolete_mkdir_used=true
-      fi
-    fi
-  fi
-
-  if test -n "$dir_arg"; then
-    { test -z "$chowncmd" || $doit $chowncmd "$dst"; } &&
-    { test -z "$chgrpcmd" || $doit $chgrpcmd "$dst"; } &&
-    { test "$obsolete_mkdir_used$chowncmd$chgrpcmd" = false ||
-      test -z "$chmodcmd" || $doit $chmodcmd $mode "$dst"; } || exit 1
-  else
-
-    # Make a couple of temp file names in the proper directory.
-    dsttmp=$dstdir/_inst.$$_
-    rmtmp=$dstdir/_rm.$$_
-
-    # Trap to clean up those temp files at exit.
-    trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
-
-    # Copy the file name to the temp name.
-    (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") &&
-
-    # and set any options; do chmod last to preserve setuid bits.
-    #
-    # If any of these fail, we abort the whole thing.  If we want to
-    # ignore errors from any of these, just make sure not to ignore
-    # errors from the above "$doit $cpprog $src $dsttmp" command.
-    #
-    { test -z "$chowncmd" || $doit $chowncmd "$dsttmp"; } &&
-    { test -z "$chgrpcmd" || $doit $chgrpcmd "$dsttmp"; } &&
-    { test -z "$stripcmd" || $doit $stripcmd "$dsttmp"; } &&
-    { test -z "$chmodcmd" || $doit $chmodcmd $mode "$dsttmp"; } &&
-
-    # If -C, don't bother to copy if it wouldn't change the file.
-    if $copy_on_change &&
-       old=`LC_ALL=C ls -dlL "$dst"     2>/dev/null` &&
-       new=`LC_ALL=C ls -dlL "$dsttmp"  2>/dev/null` &&
-       set -f &&
-       set X $old && old=:$2:$4:$5:$6 &&
-       set X $new && new=:$2:$4:$5:$6 &&
-       set +f &&
-       test "$old" = "$new" &&
-       $cmpprog "$dst" "$dsttmp" >/dev/null 2>&1
-    then
-      rm -f "$dsttmp"
-    else
-      # Rename the file to the real destination.
-      $doit $mvcmd -f "$dsttmp" "$dst" 2>/dev/null ||
-
-      # The rename failed, perhaps because mv can't rename something else
-      # to itself, or perhaps because mv is so ancient that it does not
-      # support -f.
-      {
-        # Now remove or move aside any old file at destination location.
-        # We try this two ways since rm can't unlink itself on some
-        # systems and the destination file might be busy for other
-        # reasons.  In this case, the final cleanup might fail but the new
-        # file should still install successfully.
-        {
-          test ! -f "$dst" ||
-          $doit $rmcmd -f "$dst" 2>/dev/null ||
-          { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
-            { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
-          } ||
-          { echo "$0: cannot unlink or rename $dst" >&2
-            (exit 1); exit 1
-          }
-        } &&
-
-        # Now rename the file to the real destination.
-        $doit $mvcmd "$dsttmp" "$dst"
-      }
-    fi || exit 1
-
-    trap '' 0
-  fi
-done
-
-# Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
-# time-stamp-start: "scriptversion="
-# time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC"
-# time-stamp-end: "; # UTC"
-# End:
@@ -1385,7 +1385,7 @@ int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name,
 		return UB_NOERROR;
 	}
 	if(!local_zones_add_zone(ctx->local_zones, nm, nmlen, nmlabs, 
-		LDNS_RR_CLASS_IN, t)) {
+		LDNS_RR_CLASS_IN, t, NULL)) {
 		lock_rw_unlock(&ctx->local_zones->lock);
 		return UB_NOMEM;
 	}
@@ -142,7 +142,7 @@ check_git_repo () {
 create_temp_dir () {
    # Creating temp directory
    info "Creating temporary working directory"
-    temp_dir=`mktemp -d unbound-dist-XXXXXX`
+    temp_dir=`mktemp -t -d unbound-dist-XXXXXX`
    info "Directory '$temp_dir' created."
    cd $temp_dir
 }
@@ -409,7 +409,14 @@ if [ "$DOWIN" = "yes" ]; then
 	info "git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound"
 	git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound || error_cleanup "git clone failed"
 	cd unbound || error_cleanup "Unbound not exported correctly from git"
-	rm -rf .git .travis.yml .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
+	git submodule update --init || error_cleanup "Could not fetch submodule"
+	rm -rf .git .travis.yml .gitattributes .gitmodules .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
+	rm -rf simdzone/.git simdzone/.github simdzone/.gitignore \
+	       simdzone/configure~ simdzone/config.h.in~ simdzone/autom4te.cache \
+	       simdzone/cmake simdzone/CMakeLists.txt simdzone/simdzoneConfig.cmake.in \
+	       simdzone/conanfile.txt simdzone/tests simdzone/.readthedocs.yaml \
+	       simdzone/doc simdzone/scripts || \
+	       error_cleanup "Failed to remove simdzone .git tracking and ci information"

 	# on a re-configure the cache may no longer be valid...
 	if test -f mingw32-config.cache; then rm mingw32-config.cache; fi
@@ -436,11 +443,14 @@ if [ "$DOWIN" = "yes" ]; then
 	replace_version "configure.ac" "$version" "$version2"
    	version="$version2"
    	info "Rebuilding configure script (autoconf) snapshot."
-	autoconf -f || error_cleanup "Autoconf failed."
+	autoreconf -fi || error_cleanup "Autoconf failed."
 	autoheader -f || error_cleanup "Autoheader failed."
    	rm -r autom4te* || echo "ignored"
 	rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
 	rm -f configure~ || echo "ignore absence of configure~ file."
+	rm -r simdzone/autom4te* || echo "ignored"
+	rm -f simdzone/config.h.in~ || echo "ignore absence of simdzone/config.h.in~ file."
+	rm -f simdzone/configure~ || echo "ignore absence of simdzone/configure~ file."
    fi

    if test "`uname`" = "Linux"; then 
@@ -598,7 +608,15 @@ info "git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound"
 git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound || error_cleanup "git clone failed"

 cd unbound || error_cleanup "Unbound not exported correctly from git"
-rm -rf .git .travis.yml .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
+git submodule update --init || error_cleanup "Could not fetch submodule"
+rm -rf .git .travis.yml .gitattributes .gitmodules .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
+rm -rf simdzone/.git simdzone/.github simdzone/.gitignore \
+       simdzone/configure~ simdzone/config.h.in~ simdzone/autom4te.cache \
+       simdzone/cmake simdzone/CMakeLists.txt simdzone/simdzoneConfig.cmake.in \
+       simdzone/conanfile.txt simdzone/tests simdzone/.readthedocs.yaml \
+       simdzone/doc simdzone/scripts || \
+       error_cleanup "Failed to remove simdzone .git tracking and ci information"
+

 info "Adding libtool utils (libtoolize)."
 libtoolize -c --install || libtoolize -c || error_cleanup "Libtoolize failed."
@@ -618,11 +636,14 @@ if [ `uname -s | grep -i -c darwin` -ne 0 ]; then
 fi

 info "Building configure script (autoreconf)."
-autoreconf -f || error_cleanup "Autoconf failed."
+autoreconf -fi || error_cleanup "Autoconf failed."

 rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
 rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
 rm -f configure~ || echo "ignore absence of configure~ file."
+rm -r simdzone/autom4te* || echo "ignored"
+rm -f simdzone/config.h.in~ || echo "ignore absence of simdzone/config.h.in~ file."
+rm -f simdzone/configure~ || echo "ignore absence of simdzone/configure~ file."

 info "Building lexer and parser."
 echo "#include \"config.h\"" > util/configlexer.c || error_cleanup "Failed to create configlexer"
@@ -665,10 +686,13 @@ fi

 if [ "$RECONFIGURE" = "yes" ]; then
    info "Rebuilding configure script (autoconf) snapshot."
-    autoreconf -f || error_cleanup "Autoconf failed."
+    autoreconf -fi || error_cleanup "Autoconf failed."
    rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
    rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
    rm -f configure~ || echo "ignore absence of configure~ file."
+    rm -r simdzone/autom4te* || echo "ignored"
+    rm -f simdzone/config.h.in~ || echo "ignore absence of simdzone/config.h.in~ file."
+    rm -f simdzone/configure~ || echo "ignore absence of simdzone/configure~ file."
 fi

 replace_all doc/README
@@ -685,7 +709,7 @@ info "Renaming Unbound directory to unbound-$version."
 cd ..
 mv unbound unbound-$version || error_cleanup "Failed to rename unbound directory."

-tarfile="../unbound-$version.tar.gz"
+tarfile="$cwd/unbound-$version.tar.gz"

 if [ -f $tarfile ]; then
    (question "The file $tarfile already exists.  Overwrite?" \
@@ -693,7 +717,7 @@ if [ -f $tarfile ]; then
 fi

 info "Creating tar unbound-$version.tar.gz"
-tar czf ../unbound-$version.tar.gz unbound-$version || error_cleanup "Failed to create tar file."
+tar czf $tarfile unbound-$version || error_cleanup "Failed to create tar file."

 cleanup

@@ -102,7 +102,7 @@ respip_set_get_tree(struct respip_set* set)

 struct resp_addr*
 respip_sockaddr_find_or_create(struct respip_set* set, struct sockaddr_storage* addr,
-		socklen_t addrlen, int net, int create, const char* ipstr)
+		socklen_t addrlen, int net, int create)
 {
 	struct resp_addr* node;
 	log_assert(set);
@@ -119,7 +119,10 @@ respip_sockaddr_find_or_create(struct respip_set* set, struct sockaddr_storage*
 			addrlen, net)) {
 			/* We know we didn't find it, so this should be
 			 * impossible. */
-			log_warn("unexpected: duplicate address: %s", ipstr);
+			char a[128];
+			addr_to_str(addr, addrlen, a, sizeof(a));
+			log_warn("unexpected: duplicate address: %s/%d",
+				a, net);
 		}
 	}
 	return node;
@@ -154,8 +157,7 @@ respip_find_or_create(struct respip_set* set, const char* ipstr, int create)
 		log_err("cannot parse netblock: '%s'", ipstr);
 		return NULL;
 	}
-	return respip_sockaddr_find_or_create(set, &addr, addrlen, net, create,
-		ipstr);
+	return respip_sockaddr_find_or_create(set, &addr, addrlen, net, create);
 }

 static int
@@ -291,6 +293,49 @@ respip_enter_rr(struct regional* region, struct resp_addr* raddr,
 	return rrset_insert_rr(region, pd, rdata, rdata_len, ttl, rrstr);
 }

+int
+respip_enter_rr_wol(struct regional* region, struct resp_addr* raddr,
+	uint16_t rrtype, uint16_t rrclass, time_t ttl, uint8_t* rdata_wol,
+	size_t rdata_len, const char* netblockstr)
+{
+	struct packed_rrset_data* pd;
+	struct sockaddr* sa;
+	sa = (struct sockaddr*)&raddr->node.addr;
+	if (rrtype == LDNS_RR_TYPE_CNAME && raddr->data) {
+		char* rrstr = dname_rdata_to_str(NULL, 0, rrtype,
+			rrclass, ttl, rdata_wol, rdata_len);
+		log_err("CNAME response-ip data (%s) can not co-exist with other "
+			"response-ip data for netblock %s", (rrstr?rrstr:"<out of memory>"), netblockstr);
+		free(rrstr);
+		return 0;
+	} else if (raddr->data &&
+		raddr->data->rk.type == htons(LDNS_RR_TYPE_CNAME)) {
+		char* rrstr = dname_rdata_to_str(NULL, 0, rrtype,
+			rrclass, ttl, rdata_wol, rdata_len);
+		log_err("response-ip data (%s) can not be added; CNAME response-ip "
+			"data already in place for netblock %s", (rrstr?rrstr:"<out of memory>"), netblockstr);
+		free(rrstr);
+		return 0;
+	} else if((rrtype != LDNS_RR_TYPE_CNAME) &&
+		((sa->sa_family == AF_INET && rrtype != LDNS_RR_TYPE_A) ||
+		(sa->sa_family == AF_INET6 && rrtype != LDNS_RR_TYPE_AAAA))) {
+		char* rrstr = dname_rdata_to_str(NULL, 0, rrtype,
+			rrclass, ttl, rdata_wol, rdata_len);
+		log_err("response-ip data %s record type does not correspond "
+			"to netblock %s address family", (rrstr?rrstr:"<out of memory>"), netblockstr);
+		free(rrstr);
+		return 0;
+	}
+
+	if(!raddr->data) {
+		raddr->data = new_rrset(region, rrtype, rrclass);
+		if(!raddr->data)
+			return 0;
+	}
+	pd = raddr->data->entry.data;
+	return rrset_insert_rr_wol(region, pd, rdata_wol, rdata_len, ttl);
+}
+
 static int
 respip_enter_rrstr(struct regional* region, struct resp_addr* raddr,
 		const char* rrstr, const char* netblock)
@@ -276,12 +276,11 @@ void respip_inform_print(struct respip_action_info* respip_actinfo,
 * @param addrlen: length of addr.
 * @param net: netblock to lookup.
 * @param create: create node if it does not exist when 1.
- * @param ipstr: human readable ip string, for logging.
 * @return newly created of found node, not holding lock.
 */
 struct resp_addr*
 respip_sockaddr_find_or_create(struct respip_set* set, struct sockaddr_storage* addr,
-		socklen_t addrlen, int net, int create, const char* ipstr);
+		socklen_t addrlen, int net, int create);

 /**
 * Add RR to resp_addr's RRset. Create RRset if not existing.
@@ -301,6 +300,22 @@ respip_enter_rr(struct regional* region, struct resp_addr* raddr,
 	uint16_t rrtype, uint16_t rrclass, time_t ttl, uint8_t* rdata,
 	size_t rdata_len, const char* rrstr, const char* netblockstr);

+/**
+ * Add RR to resp_addr's RRset. Create RRset if not existing.
+ * @param region: region to alloc RR(set).
+ * @param raddr: resp_addr containing RRset. Must hold write lock.
+ * @param rrtype: RR type.
+ * @param rrclass: RR class.
+ * @param ttl: TTL.
+ * @param rdata: RDATA. Without prefix len.
+ * @param rdata_len: length of rdata.
+ * @param netblockstr: netblock as string, for logging
+ * @return 0 on error
+ */
+int respip_enter_rr_wol(struct regional* region, struct resp_addr* raddr,
+	uint16_t rrtype, uint16_t rrclass, time_t ttl, uint8_t* rdata,
+	size_t rdata_len, const char* netblockstr);
+
 /**
 * Delete resp_addr node from tree.
 * @param set: struct containing tree. Must hold write lock.
@@ -72,7 +72,11 @@
 #include "validator/val_sigcrypt.h"
 #include "validator/val_anchor.h"
 #include "validator/val_utils.h"
+#include "zone.h"
 #include <ctype.h>
+#ifdef HAVE_SYS_STAT_H
+#include <sys/stat.h>
+#endif

 /** bytes to use for NSEC3 hash buffer. 20 for sha1 */
 #define N3HASHBUFLEN 32
@@ -702,13 +706,15 @@ az_rrset_find_rrsig(struct packed_rrset_data* d, uint8_t* rdata, size_t len,

 /** see if rdata is duplicate */
 static int
-rdata_duplicate(struct packed_rrset_data* d, uint8_t* rdata, size_t len)
+rdata_duplicate(struct packed_rrset_data* d, uint8_t* rdata_wol, size_t len)
 {
-	size_t i;
+	size_t i, rdatawl_len = len+2;
+	uint16_t len16 = htons(len);
 	for(i=0; i<d->count + d->rrsig_count; i++) {
-		if(d->rr_len[i] != len)
+		if(d->rr_len[i] != rdatawl_len)
 			continue;
-		if(memcmp(d->rr_data[i], rdata, len) == 0)
+		if(memcmp(d->rr_data[i], &len16, 2) == 0 &&
+		   memcmp(d->rr_data[i]+2, rdata_wol, len) == 0)
 			return 1;
 	}
 	return 0;
@@ -727,6 +733,19 @@ rrsig_rdata_get_type_covered(uint8_t* rdata, size_t rdatalen)
 	return sldns_read_uint16(rdata+2);
 }

+/** get rrsig type covered from rdata.
+ * @param rdata_wol: rdata in wireformat, without the prefix rdlength.
+ * @param rdatalen: length of rdata buffer.
+ * @return type covered (or 0).
+ */
+static uint16_t
+rrsig_rdata_get_type_covered_wol(uint8_t* rdata_wol, size_t rdatalen)
+{
+	if(rdatalen < 2)
+		return 0;
+	return sldns_read_uint16(rdata_wol);
+}
+
 /** remove RR from existing RRset. Also sig, if it is a signature.
 * reallocates the packed rrset for a new one, false on alloc failure */
 static int
@@ -792,7 +811,7 @@ rrset_remove_rr(struct auth_rrset* rrset, size_t index)
 /** add RR to existing RRset. If insert_sig is true, add to rrsigs. 
 * This reallocates the packed rrset for a new one */
 static int
-rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
+rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata_wol,
 	size_t rdatalen, int insert_sig)
 {
 	struct packed_rrset_data* d, *old = rrset->data;
@@ -800,7 +819,7 @@ rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,

 	d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old)
 		+ sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t)
-		+ rdatalen);
+		+ 2 /* rdlen */ + rdatalen);
 	if(!d) {
 		log_err("out of memory");
 		return 0;
@@ -823,8 +842,8 @@ rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
 		memmove(d->rr_len+d->count, old->rr_len+old->count,
 			old->rrsig_count*sizeof(size_t));
 	if(!insert_sig)
-		d->rr_len[d->count-1] = rdatalen;
-	else	d->rr_len[total-1] = rdatalen;
+		d->rr_len[d->count-1] = rdatalen + 2;
+	else	d->rr_len[total-1] = rdatalen + 2;
 	packed_rrset_ptr_fixup(d);
 	if((time_t)rr_ttl < d->ttl)
 		d->ttl = rr_ttl;
@@ -849,10 +868,12 @@ rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
 	/* insert new value */
 	if(!insert_sig) {
 		d->rr_ttl[d->count-1] = rr_ttl;
-		memmove(d->rr_data[d->count-1], rdata, rdatalen);
+		sldns_write_uint16(d->rr_data[d->count-1], rdatalen);
+		memmove(d->rr_data[d->count-1]+2, rdata_wol, rdatalen);
 	} else {
 		d->rr_ttl[total-1] = rr_ttl;
-		memmove(d->rr_data[total-1], rdata, rdatalen);
+		sldns_write_uint16(d->rr_data[total-1], rdatalen);
+		memmove(d->rr_data[total-1]+2, rdata_wol, rdatalen);
 	}

 	rrset->data = d;
@@ -860,10 +881,11 @@ rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
 	return 1;
 }

-/** Create new rrset for node with packed rrset with one RR element */
+/** Create new rrset for node with packed rrset with one RR element.
+ * rdata_wol is the rdata without prefixed rdlength. */
 static struct auth_rrset*
 rrset_create(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
-	uint8_t* rdata, size_t rdatalen)
+	uint8_t* rdata_wol, size_t rdatalen)
 {
 	struct auth_rrset* rrset = (struct auth_rrset*)calloc(1,
 		sizeof(*rrset));
@@ -878,7 +900,7 @@ rrset_create(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
 	/* the rrset data structure, with one RR */
 	d = (struct packed_rrset_data*)calloc(1,
 		sizeof(struct packed_rrset_data) + sizeof(size_t) +
-		sizeof(uint8_t*) + sizeof(time_t) + rdatalen);
+		sizeof(uint8_t*) + sizeof(time_t) + 2 /* rdlen*/ + rdatalen);
 	if(!d) {
 		free(rrset);
 		log_err("out of memory");
@@ -893,9 +915,10 @@ rrset_create(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
 	d->rr_data[0] = (uint8_t*)&(d->rr_ttl[1]);

 	/* insert the RR */
-	d->rr_len[0] = rdatalen;
+	d->rr_len[0] = rdatalen + 2;
 	d->rr_ttl[0] = rr_ttl;
-	memmove(d->rr_data[0], rdata, rdatalen);
+	sldns_write_uint16(d->rr_data[0], rdatalen);
+	memmove(d->rr_data[0]+2, rdata_wol, rdatalen);
 	d->count++;

 	/* insert rrset into linked list for domain */
@@ -1079,14 +1102,14 @@ rrsigs_copy_from_rrset_to_rrsigset(struct auth_rrset* rrset,
 	 * duplicates are ignored */
 	for(i=rrset->data->count;
 		i<rrset->data->count+rrset->data->rrsig_count; i++) {
-		uint8_t* rdata = rrset->data->rr_data[i];
-		size_t rdatalen = rrset->data->rr_len[i];
+		uint8_t* rdata_wol = rrset->data->rr_data[i]+2;
+		size_t rdatalen = rrset->data->rr_len[i]-2;
 		time_t rr_ttl  = rrset->data->rr_ttl[i];

-		if(rdata_duplicate(rrsigset->data, rdata, rdatalen)) {
+		if(rdata_duplicate(rrsigset->data, rdata_wol, rdatalen)) {
 			continue;
 		}
-		if(!rrset_add_rr(rrsigset, rr_ttl, rdata, rdatalen, 0))
+		if(!rrset_add_rr(rrsigset, rr_ttl, rdata_wol, rdatalen, 0))
 			return 0;
 	}
 	return 1;
@@ -1096,32 +1119,35 @@ rrsigs_copy_from_rrset_to_rrsigset(struct auth_rrset* rrset,
 * rdata points to buffer with rdatalen octets, starts with 2bytelength. */
 static int
 az_domain_add_rr(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
-	uint8_t* rdata, size_t rdatalen, int* duplicate)
+	uint8_t* rdata_wol, size_t rdatalen, int* duplicate)
 {
 	struct auth_rrset* rrset;
 	/* packed rrsets have their rrsigs along with them, sort them out */
 	if(rr_type == LDNS_RR_TYPE_RRSIG) {
-		uint16_t ctype = rrsig_rdata_get_type_covered(rdata, rdatalen);
+		uint16_t ctype = rrsig_rdata_get_type_covered_wol(rdata_wol,
+			rdatalen);
 		if((rrset=az_domain_rrset(node, ctype))!= NULL) {
 			/* a node of the correct type exists, add the RRSIG
 			 * to the rrset of the covered data type */
-			if(rdata_duplicate(rrset->data, rdata, rdatalen)) {
+			if(rdata_duplicate(rrset->data, rdata_wol, rdatalen)) {
 				if(duplicate) *duplicate = 1;
 				return 1;
 			}
-			if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 1))
+			if(!rrset_add_rr(rrset, rr_ttl, rdata_wol, rdatalen,
+				1))
 				return 0;
 		} else if((rrset=az_domain_rrset(node, rr_type))!= NULL) {
 			/* add RRSIG to rrset of type RRSIG */
-			if(rdata_duplicate(rrset->data, rdata, rdatalen)) {
+			if(rdata_duplicate(rrset->data, rdata_wol, rdatalen)) {
 				if(duplicate) *duplicate = 1;
 				return 1;
 			}
-			if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 0))
+			if(!rrset_add_rr(rrset, rr_ttl, rdata_wol, rdatalen,
+				0))
 				return 0;
 		} else {
 			/* create rrset of type RRSIG */
-			if(!rrset_create(node, rr_type, rr_ttl, rdata,
+			if(!rrset_create(node, rr_type, rr_ttl, rdata_wol,
 				rdatalen))
 				return 0;
 		}
@@ -1129,17 +1155,18 @@ az_domain_add_rr(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
 		/* normal RR type */
 		if((rrset=az_domain_rrset(node, rr_type))!= NULL) {
 			/* add data to existing node with data type */
-			if(rdata_duplicate(rrset->data, rdata, rdatalen)) {
+			if(rdata_duplicate(rrset->data, rdata_wol, rdatalen)) {
 				if(duplicate) *duplicate = 1;
 				return 1;
 			}
-			if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 0))
+			if(!rrset_add_rr(rrset, rr_ttl, rdata_wol, rdatalen,
+				0))
 				return 0;
 		} else {
 			struct auth_rrset* rrsig;
 			/* create new node with data type */
-			if(!(rrset=rrset_create(node, rr_type, rr_ttl, rdata,
-				rdatalen)))
+			if(!(rrset=rrset_create(node, rr_type, rr_ttl,
+				rdata_wol, rdatalen)))
 				return 0;

 			/* see if node of type RRSIG has signatures that
@@ -1156,21 +1183,15 @@ az_domain_add_rr(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
 	return 1;
 }

-/** insert RR into zone, ignore duplicates */
+/** insert RR as name,rdata into zone, ignore duplicates.
+ * The rdata_wol is the rdata without the prefix rdlength, because simdzone
+ * returns that as the parsed rdata byte string. */
 static int
-az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
-	size_t dname_len, int* duplicate)
+az_insert_rr_as_rdata(struct auth_zone* z, uint8_t* dname, size_t dname_len,
+	uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl,
+	uint8_t* rdata_wol, size_t rdatalen, int* duplicate)
 {
 	struct auth_data* node;
-	uint8_t* dname = rr;
-	uint16_t rr_type = sldns_wirerr_get_type(rr, rr_len, dname_len);
-	uint16_t rr_class = sldns_wirerr_get_class(rr, rr_len, dname_len);
-	uint32_t rr_ttl = sldns_wirerr_get_ttl(rr, rr_len, dname_len);
-	size_t rdatalen = ((size_t)sldns_wirerr_get_rdatalen(rr, rr_len,
-		dname_len))+2;
-	/* rdata points to rdata prefixed with uint16 rdatalength */
-	uint8_t* rdata = sldns_wirerr_get_rdatawl(rr, rr_len, dname_len);
-
 	if(rr_class != z->dclass) {
 		log_err("wrong class for RR");
 		return 0;
@@ -1179,20 +1200,38 @@ az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
 		log_err("cannot create domain");
 		return 0;
 	}
-	if(!az_domain_add_rr(node, rr_type, rr_ttl, rdata, rdatalen,
+	if(!az_domain_add_rr(node, rr_type, rr_ttl, rdata_wol, rdatalen,
 		duplicate)) {
 		log_err("cannot add RR to domain");
 		return 0;
 	}
 	if(z->rpz) {
 		if(!(rpz_insert_rr(z->rpz, z->name, z->namelen, dname,
-			dname_len, rr_type, rr_class, rr_ttl, rdata, rdatalen,
-			rr, rr_len)))
+			dname_len, rr_type, rr_class, rr_ttl, rdata_wol,
+			rdatalen)))
 			return 0;
 	}
 	return 1;
 }

+/** insert RR into zone, ignore duplicates */
+static int
+az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
+	size_t dname_len, int* duplicate)
+{
+	uint8_t* dname = rr;
+	uint16_t rr_type = sldns_wirerr_get_type(rr, rr_len, dname_len);
+	uint16_t rr_class = sldns_wirerr_get_class(rr, rr_len, dname_len);
+	uint32_t rr_ttl = sldns_wirerr_get_ttl(rr, rr_len, dname_len);
+	size_t rdatalen = ((size_t)sldns_wirerr_get_rdatalen(rr, rr_len,
+		dname_len));
+	/* rdata points to rdata without prefix rdlength. */
+	uint8_t* rdata_wol = sldns_wirerr_get_rdata(rr, rr_len, dname_len);
+
+	return az_insert_rr_as_rdata(z, dname, dname_len, rr_type, rr_class,
+		rr_ttl, rdata_wol, rdatalen, duplicate);
+}
+
 /** Remove rr from node, ignores nonexisting RRs,
 * rdata points to buffer with rdatalen octets, starts with 2bytelength. */
 static int
@@ -1563,13 +1602,157 @@ az_parse_file(struct auth_zone* z, FILE* in, uint8_t* rr, size_t rrbuflen,
 	return 1;
 }

+/** Structure for simdzone parse state */
+struct az_parse_state {
+	/** The zone that is processed. */
+	struct auth_zone* z;
+	/** number of errors, if 0 it was read successfully. */
+	int errors;
+	/** for http parse, chunk iterator. */
+	struct auth_chunk* chunk;
+	/** for http parse, position in chunk. */
+	size_t chunk_pos;
+};
+
+/** Callback for simdzone parse, log an error */
+static void
+az_parse_log(zone_parser_t *parser, uint32_t category,
+	const char *file, size_t line, const char *message, void *user_data)
+{
+	struct az_parse_state* state = (struct az_parse_state*)user_data;
+	(void)parser;
+
+	switch (category) {
+	case ZONE_INFO:
+		if (file)
+			log_info("%s:%d: %s", file, (int)line, message);
+		else
+			log_info("%s", message);
+		break;
+	case ZONE_WARNING:
+		if (file)
+			log_warn("%s:%d: %s", file, (int)line, message);
+		else
+			log_warn("%s", message);
+		break;
+	default:
+		if (file)
+			log_err("%s:%d: %s", file, (int)line, message);
+		else
+			log_err("%s", message);
+		state->errors++;
+		break;
+	}
+}
+
+/** Callback for simdzone parse, accept an RR that has been read in. */
+int32_t
+az_parse_accept(zone_parser_t *parser, const zone_name_t *owner,
+	uint16_t type, uint16_t dclass, uint32_t ttl, uint16_t rdlength,
+	const uint8_t *rdata, void *user_data)
+{
+	struct az_parse_state* state = (struct az_parse_state*)user_data;
+	if(verbosity >= 7) {
+		char dname[LDNS_MAX_DOMAINLEN], t[16], c[16];
+		dname_str((uint8_t*)owner->octets, dname);
+		sldns_wire2str_type_buf(type, t, sizeof(t));
+		sldns_wire2str_class_buf(dclass, c, sizeof(c));
+		verbose(7, "zone parse record %s %s %s", dname, c, t);
+	}
+
+	/* Duplicates can be ignored, do not insert them twice. */
+	if(!az_insert_rr_as_rdata(state->z, (uint8_t*)owner->octets,
+		owner->length, type, dclass, ttl, (uint8_t*)rdata, rdlength,
+		NULL)) {
+		char dname[LDNS_MAX_DOMAINLEN], t[16], c[16];
+		dname_str((uint8_t*)owner->octets, dname);
+		sldns_wire2str_type_buf(type, t, sizeof(t));
+		sldns_wire2str_class_buf(dclass, c, sizeof(c));
+		log_err("record insert allocation failed, %s %s %s",
+			dname, c, t);
+		return ZONE_OUT_OF_MEMORY;
+	}
+	(void)parser;
+	return 0;
+}
+
+/**
+ * Callback for simdzone parse, include a zone file.
+ * It is called for every $INCLUDE entry. It could be used to save
+ * the file names, so that it can track if the files have changed, later.
+ */
+static int32_t
+az_parse_include(zone_parser_t *parser, const char *file,
+	const char *path, void *user_data)
+{
+	struct az_parse_state* state = (struct az_parse_state*)user_data;
+	(void)parser;
+	if(state->z->zone_is_slave) {
+		/* A $INCLUDE is not expected for a secondary zone. */
+		log_err("$INCLUDE not allowed for secondary zone");
+		return ZONE_SEMANTIC_ERROR;
+	}
+	verbose(6, "zone parse descended into include file %s (full path %s)",
+		file, path);
+	return 0;
+}
+
+/**
+ * Parse file with simdzone.
+ */
+static int
+az_parse_file_simdzone(struct auth_zone* z, char* zfilename,
+	struct config_file* cfg)
+{
+	zone_parser_t parser;
+	zone_options_t options;
+	zone_name_buffer_t name_buffer;
+	zone_rdata_buffer_t rdata_buffer;
+	zone_buffers_t buffers = { 1, &name_buffer, &rdata_buffer };
+	struct az_parse_state state;
+
+	memset(&options, 0, sizeof(options));
+	options.origin.octets = z->name;
+	options.origin.length = z->namelen;
+	options.default_ttl = 3600;
+	options.default_class = LDNS_RR_CLASS_IN;
+	options.secondary = z->zone_is_slave;
+	options.pretty_ttls = true; /* non-standard, for backwards compatibility */
+	if(cfg->chrootdir && cfg->chrootdir[0])
+		options.chrootdir = cfg->chrootdir;
+	else	options.chrootdir = NULL;
+	options.log.callback = &az_parse_log;
+	options.accept.callback = &az_parse_accept;
+	options.include.callback = &az_parse_include;
+
+	memset(&state, 0, sizeof(state));
+	state.z = z;
+
+	/* Parse and process all RRs.  */
+	if (zone_parse(&parser, &options, &buffers, zfilename, &state) != 0) {
+		return 0;
+	}
+	return 1;
+}
+
+/** See if the file can be accessed, or if it does not exist. Look at errno. */
+static int
+file_exists(char* filename)
+{
+	struct stat buf;
+	if(stat(filename, &buf) < 0) {
+		return 0;
+	}
+	return 1;
+}
+
 int
 auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg)
 {
+	int use_simdzone = 1;
 	uint8_t rr[LDNS_RR_BUF_SIZE];
 	struct sldns_file_parse_state state;
 	char* zfilename;
-	FILE* in;
 	if(!z || !z->zonefile || z->zonefile[0]==0)
 		return 1; /* no file, or "", nothing to read */
 	
@@ -1582,8 +1765,7 @@ auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg)
 		dname_str(z->name, nm);
 		verbose(VERB_ALGO, "read zonefile %s for %s", zfilename, nm);
 	}
-	in = fopen(zfilename, "r");
-	if(!in) {
+	if(!file_exists(zfilename)) {
 		char* n = sldns_wire2str_dname(z->name, z->namelen);
 		if(z->zone_is_slave && errno == ENOENT) {
 			/* we fetch the zone contents later, no file yet */
@@ -1614,15 +1796,36 @@ auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg)
 		state.origin_len = z->namelen;
 	}
 	/* parse the (toplevel) file */
-	if(!az_parse_file(z, in, rr, sizeof(rr), &state, zfilename, 0, cfg)) {
-		char* n = sldns_wire2str_dname(z->name, z->namelen);
-		log_err("error parsing zonefile %s for %s",
-			zfilename, n?n:"error");
-		free(n);
+	if(use_simdzone) {
+		/* Use simdzone. */
+		if(!az_parse_file_simdzone(z, zfilename, cfg)) {
+			char* n = sldns_wire2str_dname(z->name, z->namelen);
+			log_err("error parsing zonefile %s for %s",
+				zfilename, n?n:"error");
+			free(n);
+			return 0;
+		}
+	} else {
+		/* Read with sldns_str2wire functions. */
+		FILE* in;
+		in = fopen(zfilename, "r");
+		if(!in) {
+			char* n = sldns_wire2str_dname(z->name, z->namelen);
+			log_err("cannot open zonefile %s for %s: %s",
+				zfilename, n?n:"error", strerror(errno));
+			free(n);
+			return 0;
+		}
+		if(!az_parse_file(z, in, rr, sizeof(rr), &state, zfilename, 0, cfg)) {
+			char* n = sldns_wire2str_dname(z->name, z->namelen);
+			log_err("error parsing zonefile %s for %s",
+				zfilename, n?n:"error");
+			free(n);
+			fclose(in);
+			return 0;
+		}
 		fclose(in);
-		return 0;
 	}
-	fclose(in);

 	if(z->rpz)
 		rpz_finish_config(z->rpz);
@@ -5097,14 +5300,11 @@ apply_axfr(struct auth_xfer* xfr, struct auth_zone* z,
 	return 1;
 }

-/** apply HTTP to zone in memory. z is locked. false on failure(mallocfail) */
+/** parse http zone with sldns. */
 static int
-apply_http(struct auth_xfer* xfr, struct auth_zone* z,
+parse_http_sldns(struct auth_xfer* xfr, struct auth_zone* z,
 	struct sldns_buffer* scratch_buffer)
 {
-	/* parse data in chunks */
-	/* parse RR's and read into memory. ignore $INCLUDE from the
-	 * downloaded file*/
 	struct sldns_file_parse_state pstate;
 	struct auth_chunk* chunk;
 	size_t chunk_pos;
@@ -5116,6 +5316,184 @@ apply_http(struct auth_xfer* xfr, struct auth_zone* z,
 		memmove(pstate.origin, xfr->name, xfr->namelen);
 	}

+	chunk = xfr->task_transfer->chunks_first;
+	chunk_pos = 0;
+	pstate.lineno = 0;
+	while(chunkline_get_line_collated(&chunk, &chunk_pos, scratch_buffer)) {
+		/* process this line */
+		pstate.lineno++;
+		chunkline_newline_removal(scratch_buffer);
+		if(chunkline_is_comment_line_or_empty(scratch_buffer)) {
+			continue;
+		}
+		/* parse line and add RR */
+		if((ret=http_parse_origin(scratch_buffer, &pstate))!=0) {
+			if(ret == 2) {
+				verbose(VERB_ALGO, "error parsing ORIGIN on line [%s:%d] %s",
+					xfr->task_transfer->master->file,
+					pstate.lineno,
+					sldns_buffer_begin(scratch_buffer));
+				return 0;
+			}
+			continue; /* $ORIGIN has been handled */
+		}
+		if((ret=http_parse_ttl(scratch_buffer, &pstate))!=0) {
+			if(ret == 2) {
+				verbose(VERB_ALGO, "error parsing TTL on line [%s:%d] %s",
+					xfr->task_transfer->master->file,
+					pstate.lineno,
+					sldns_buffer_begin(scratch_buffer));
+				return 0;
+			}
+			continue; /* $TTL has been handled */
+		}
+		if(!http_parse_add_rr(xfr, z, scratch_buffer, &pstate)) {
+			verbose(VERB_ALGO, "error parsing line [%s:%d] %s",
+				xfr->task_transfer->master->file,
+				pstate.lineno,
+				sldns_buffer_begin(scratch_buffer));
+			return 0;
+		}
+	}
+	return 1;
+}
+
+/**
+ * Callback for simdzone parse of http, include a zone file.
+ * It is called for every $INCLUDE entry.
+ */
+static int32_t
+az_http_parse_include(zone_parser_t *parser, const char *file,
+	const char *path, void *user_data)
+{
+	struct az_parse_state* state = (struct az_parse_state*)user_data;
+	char dname[LDNS_MAX_DOMAINLEN];
+	(void)parser;
+	verbose(6, "zone parse has include file %s (full path %s)",
+		file, path);
+	dname_str(state->z->name, dname);
+	verbose(1, "zone parse for zonefile of %s has $INCLUDE %s, but $INCLUDE not followed",
+		dname, file);
+	/* Not expecting a secondary zone file with includes. */
+	return ZONE_SEMANTIC_ERROR;
+}
+
+int32_t az_http_read_data(zone_parser_t* parser, char* data, size_t len,
+	size_t* outlen, void* user_data)
+{
+	struct az_parse_state* state = (struct az_parse_state*)user_data;
+	size_t written = 0;
+	(void)parser;
+
+	if(state->chunk == NULL) {
+		/* End of the chunk list */
+		*outlen = 0;
+		return 0;
+	}
+	if(state->chunk_pos == state->chunk->len) {
+		/* The end of the chunk list is reached, with 0 data. */
+		state->chunk = NULL;
+		*outlen = 0;
+		return 0;
+	}
+	if(len == 0) {
+		*outlen = 0;
+		return 0;
+	}
+
+	/* Fill up the data buffer with the requested amount. */
+	while(written < len) {
+		/* The amount that is wanted. */
+		size_t wanted = len - written;
+		/* That amount that is in this chunk. */
+		size_t avail = state->chunk->len - state->chunk_pos;
+
+		if(wanted < avail) {
+			/* Write a piece of this chunk. */
+			memmove(data+written,
+				state->chunk->data+state->chunk_pos, wanted);
+			state->chunk_pos += wanted;
+			*outlen = len;
+			return 0;
+		}
+		/* Write the entire chunk and continue on. */
+		if(avail > 0)
+			memmove(data+written,
+				state->chunk->data+state->chunk_pos, avail);
+		written += avail;
+
+		/* move to next chunk */
+		state->chunk = state->chunk->next;
+		state->chunk_pos = 0;
+
+		/* Is this the exact amount requested. */
+		if(written == len) {
+			/* continue later. */
+			*outlen = len;
+			return 0;
+		}
+		/* Is there no more data. */
+		if(state->chunk == NULL) {
+			/* End of data. */
+			*outlen = written;
+			return 0;
+		}
+	}
+	*outlen = written;
+	return 0;
+}
+
+/** parse http zone with simdzone. */
+static int
+parse_http_simdzone(struct auth_xfer* xfr, struct auth_zone* z)
+{
+	zone_parser_t parser;
+	zone_options_t options;
+	zone_name_buffer_t name_buffer;
+	zone_rdata_buffer_t rdata_buffer;
+	zone_buffers_t buffers = { 1, &name_buffer, &rdata_buffer };
+	struct az_parse_state state;
+
+	memset(&options, 0, sizeof(options));
+	options.origin.octets = z->name;
+	options.origin.length = z->namelen;
+	options.default_ttl = 3600;
+	options.default_class = LDNS_RR_CLASS_IN;
+	options.secondary = z->zone_is_slave;
+	options.pretty_ttls = true; /* non-standard, for backwards compatibility */
+	options.no_includes = true; /* the secondary zone file transferred over https is not expected to have $INCLUDE files. */
+	/* The log callback for file read prints the error and can be used
+	 * here too. */
+	options.log.callback = &az_parse_log;
+	/* The parse accept callback for file inserts the RR, and can be
+	 * used here too. */
+	options.accept.callback = &az_parse_accept;
+	options.include.callback = &az_http_parse_include;
+
+	memset(&state, 0, sizeof(state));
+	state.z = z;
+	state.chunk = xfr->task_transfer->chunks_first;
+	state.chunk_pos = 0;
+
+	/* Parse and process all RRs.  */
+	if (zone_parse_from_callback(&parser, &options, &buffers,
+		az_http_read_data, &state) != 0) {
+		return 0;
+	}
+	return 1;
+}
+
+/** apply HTTP to zone in memory. z is locked. false on failure(mallocfail) */
+static int
+apply_http(struct auth_xfer* xfr, struct auth_zone* z,
+	struct sldns_buffer* scratch_buffer)
+{
+	int use_simdzone = 1;
+
+	/* parse data in chunks */
+	/* parse RR's and read into memory. ignore $INCLUDE from the
+	 * downloaded file*/
+
 	if(verbosity >= VERB_ALGO)
 		verbose(VERB_ALGO, "http download %s of size %d",
 		xfr->task_transfer->master->file,
@@ -5155,44 +5533,14 @@ apply_http(struct auth_xfer* xfr, struct auth_zone* z,
 	xfr->serial = 0;
 	xfr->soa_zone_acquired = 0;

-	chunk = xfr->task_transfer->chunks_first;
-	chunk_pos = 0;
-	pstate.lineno = 0;
-	while(chunkline_get_line_collated(&chunk, &chunk_pos, scratch_buffer)) {
-		/* process this line */
-		pstate.lineno++;
-		chunkline_newline_removal(scratch_buffer);
-		if(chunkline_is_comment_line_or_empty(scratch_buffer)) {
-			continue;
-		}
-		/* parse line and add RR */
-		if((ret=http_parse_origin(scratch_buffer, &pstate))!=0) {
-			if(ret == 2) {
-				verbose(VERB_ALGO, "error parsing ORIGIN on line [%s:%d] %s",
-					xfr->task_transfer->master->file,
-					pstate.lineno,
-					sldns_buffer_begin(scratch_buffer));
-				return 0;
-			}
-			continue; /* $ORIGIN has been handled */
-		}
-		if((ret=http_parse_ttl(scratch_buffer, &pstate))!=0) {
-			if(ret == 2) {
-				verbose(VERB_ALGO, "error parsing TTL on line [%s:%d] %s",
-					xfr->task_transfer->master->file,
-					pstate.lineno,
-					sldns_buffer_begin(scratch_buffer));
-				return 0;
-			}
-			continue; /* $TTL has been handled */
-		}
-		if(!http_parse_add_rr(xfr, z, scratch_buffer, &pstate)) {
-			verbose(VERB_ALGO, "error parsing line [%s:%d] %s",
-				xfr->task_transfer->master->file,
-				pstate.lineno,
-				sldns_buffer_begin(scratch_buffer));
+	if(use_simdzone) {
+		/* Use simdzone for parse. */
+		if(!parse_http_simdzone(xfr, z))
+			return 0;
+	} else {
+		/* Parse with sldns. */
+		if(!parse_http_sldns(xfr, z, scratch_buffer))
 			return 0;
-		}
 	}
 	return 1;
 }
@@ -41,6 +41,7 @@
 #include "config.h"
 #include "services/localzone.h"
 #include "sldns/str2wire.h"
+#include "sldns/wire2str.h"
 #include "util/regional.h"
 #include "util/config_file.h"
 #include "util/data/dname.h"
@@ -356,6 +357,22 @@ rr_is_duplicate(struct packed_rrset_data* pd, uint8_t* rdata, size_t rdata_len)
 	return 0;
 }

+/** see if rdata is duplicate */
+static int
+rr_is_duplicate_wol(struct packed_rrset_data* d, uint8_t* rdata_wol, size_t len)
+{
+	size_t i, rdatawl_len = len+2;
+	uint16_t len16 = htons(len);
+	for(i=0; i<d->count + d->rrsig_count; i++) {
+		if(d->rr_len[i] != rdatawl_len)
+			continue;
+		if(memcmp(d->rr_data[i], &len16, 2) == 0 &&
+		   memcmp(d->rr_data[i]+2, rdata_wol, len) == 0)
+			return 1;
+	}
+	return 0;
+}
+
 /** new local_rrset */
 static struct local_rrset*
 new_local_rrset(struct regional* region, struct local_data* node,
@@ -393,6 +410,49 @@ new_local_rrset(struct regional* region, struct local_data* node,
 	return rrset;
 }

+/** insert RR into RRset data structure; Wastes a couple of bytes */
+int
+rrset_insert_rr_wol(struct regional* region, struct packed_rrset_data* pd,
+	uint8_t* rdata_wol, size_t rdata_len, time_t ttl)
+{
+	size_t* oldlen = pd->rr_len;
+	time_t* oldttl = pd->rr_ttl;
+	uint8_t** olddata = pd->rr_data;
+
+	/* add RR to rrset */
+	if(pd->count > LOCALZONE_RRSET_COUNT_MAX) {
+		log_warn("RRset has more than %d records, record ignored",
+			LOCALZONE_RRSET_COUNT_MAX);
+		return 1;
+	}
+	pd->count++;
+	pd->rr_len = regional_alloc(region, sizeof(*pd->rr_len)*pd->count);
+	pd->rr_ttl = regional_alloc(region, sizeof(*pd->rr_ttl)*pd->count);
+	pd->rr_data = regional_alloc(region, sizeof(*pd->rr_data)*pd->count);
+	if(!pd->rr_len || !pd->rr_ttl || !pd->rr_data) {
+		log_err("out of memory");
+		return 0;
+	}
+	if(pd->count > 1) {
+		memcpy(pd->rr_len+1, oldlen,
+			sizeof(*pd->rr_len)*(pd->count-1));
+		memcpy(pd->rr_ttl+1, oldttl,
+			sizeof(*pd->rr_ttl)*(pd->count-1));
+		memcpy(pd->rr_data+1, olddata,
+			sizeof(*pd->rr_data)*(pd->count-1));
+	}
+	pd->rr_len[0] = rdata_len+2;
+	pd->rr_ttl[0] = ttl;
+	pd->rr_data[0] = regional_alloc(region, rdata_len+2);
+	if(!pd->rr_data[0]) {
+		log_err("out of memory");
+		return 0;
+	}
+	sldns_write_uint16(pd->rr_data[0], rdata_len);
+	memmove(pd->rr_data[0]+2, rdata_wol, rdata_len);
+	return 1;
+}
+
 /** insert RR into RRset data structure; Wastes a couple of bytes */
 int
 rrset_insert_rr(struct regional* region, struct packed_rrset_data* pd,
@@ -503,6 +563,48 @@ lz_find_create_node(struct local_zone* z, uint8_t* nm, size_t nmlen,
 	return 1;
 }

+/* Mark the SOA record for the zone. This only marks the SOA rrset; the data
+ * for the RR is entered later on local_zone_enter_rr() as with the other
+ * records. An artificial soa_negative record with a modified TTL (minimum of
+ * the TTL and the SOA.MINIMUM) is also created and marked for usage with
+ * negative answers and to avoid allocations during those answers. */
+static int
+lz_mark_soa_for_zone_wol(struct local_zone* z, struct ub_packed_rrset_key* soa_rrset,
+	uint8_t* rdata_wol, size_t rdata_len, time_t ttl)
+{
+	struct packed_rrset_data* pd = (struct packed_rrset_data*)
+		regional_alloc_zero(z->region, sizeof(*pd));
+	struct ub_packed_rrset_key* rrset_negative = (struct ub_packed_rrset_key*)
+		regional_alloc_zero(z->region, sizeof(*rrset_negative));
+	time_t minimum;
+	if(!rrset_negative||!pd) {
+		log_err("out of memory");
+		return 0;
+	}
+	/* Mark the original SOA record and then continue with the negative one. */
+	z->soa = soa_rrset;
+	rrset_negative->entry.key = rrset_negative;
+	pd->trust = rrset_trust_prim_noglue;
+	pd->security = sec_status_insecure;
+	rrset_negative->entry.data = pd;
+	rrset_negative->rk.dname = soa_rrset->rk.dname;
+	rrset_negative->rk.dname_len = soa_rrset->rk.dname_len;
+	rrset_negative->rk.type = soa_rrset->rk.type;
+	rrset_negative->rk.rrset_class = soa_rrset->rk.rrset_class;
+	if(!rrset_insert_rr_wol(z->region, pd, rdata_wol, rdata_len, ttl))
+		return 0;
+	/* last 4 bytes are minimum ttl in network format */
+	if(pd->count == 0 || pd->rr_len[0] < 2+4)
+		return 0;
+	minimum = (time_t)sldns_read_uint32(pd->rr_data[0]+(pd->rr_len[0]-4));
+	minimum = ttl<minimum?ttl:minimum;
+	pd->ttl = minimum;
+	pd->rr_ttl[0] = minimum;
+
+	z->soa_negative = rrset_negative;
+	return 1;
+}
+
 /* Mark the SOA record for the zone. This only marks the SOA rrset; the data
 * for the RR is entered later on local_zone_enter_rr() as with the other
 * records. An artificial soa_negative record with a modified TTL (minimum of
@@ -545,6 +647,96 @@ lz_mark_soa_for_zone(struct local_zone* z, struct ub_packed_rrset_key* soa_rrset
 	return 1;
 }

+/**
+ * Convert dname, type, class, ttl, rdata to an rr string.
+ * rdata without prefixed length. returned string is malloced.
+ */
+char* dname_rdata_to_str(uint8_t* dname, size_t dnamelen, uint16_t rrtype,
+	uint16_t rrclass, uint32_t ttl, uint8_t* rdata, size_t rdata_len)
+{
+	char buf[65536], t[32], c[32], d[1024], result[65536+32+32+1024+1024];
+	buf[0]=0; buf[sizeof(buf)-1]=0;
+	d[0]=0; d[sizeof(d)-1]=0;
+	(void)sldns_wire2str_rdata_buf(rdata, rdata_len, buf, sizeof(buf),
+		rrtype);
+	(void)sldns_wire2str_type_buf(rrtype, t, sizeof(t));
+	(void)sldns_wire2str_class_buf(rrclass, c, sizeof(c));
+	if(dname)
+		(void)sldns_wire2str_dname_buf(dname, dnamelen, d, sizeof(d));
+	snprintf(result, sizeof(result), "%s%s%u %s %s %s",
+		dname, (dname?" ":""), (unsigned)ttl, c, t, d);
+	return strdup(result);
+}
+
+int
+local_zone_enter_rr_wol(struct local_zone* z, uint8_t* nm, size_t nmlen,
+	int nmlabs, uint16_t rrtype, uint16_t rrclass, time_t ttl,
+	uint8_t* rdata_wol, size_t rdata_len)
+{
+	struct local_data* node;
+	struct local_rrset* rrset;
+	struct packed_rrset_data* pd;
+
+	if(!lz_find_create_node(z, nm, nmlen, nmlabs, &node)) {
+		return 0;
+	}
+	log_assert(node);
+
+	/* Reject it if we would end up having CNAME and other data (including
+	 * another CNAME) for a redirect zone. */
+	if((z->type == local_zone_redirect ||
+		z->type == local_zone_inform_redirect) && node->rrsets) {
+		const char* othertype = NULL;
+		if (rrtype == LDNS_RR_TYPE_CNAME)
+			othertype = "other";
+		else if (node->rrsets->rrset->rk.type ==
+			 htons(LDNS_RR_TYPE_CNAME)) {
+			othertype = "CNAME";
+		}
+		if(othertype) {
+			char* rrstr = dname_rdata_to_str(nm, nmlen, rrtype,
+				rrclass, ttl, rdata_wol, rdata_len);
+			log_err("local-data '%s' in redirect zone must not "
+				"coexist with %s local-data", (rrstr?rrstr:"<out of memory>"), othertype);
+			free(rrstr);
+			return 0;
+		}
+	}
+	rrset = local_data_find_type(node, rrtype, 0);
+	if(!rrset) {
+		rrset = new_local_rrset(z->region, node, rrtype, rrclass);
+		if(!rrset)
+			return 0;
+		if(query_dname_compare(node->name, z->name) == 0) {
+			if(rrtype == LDNS_RR_TYPE_NSEC)
+			  rrset->rrset->rk.flags = PACKED_RRSET_NSEC_AT_APEX;
+			if(rrtype == LDNS_RR_TYPE_SOA &&
+				!lz_mark_soa_for_zone_wol(z, rrset->rrset, rdata_wol, rdata_len, ttl))
+				return 0;
+		}
+	}
+	pd = (struct packed_rrset_data*)rrset->rrset->entry.data;
+	log_assert(rrset && pd);
+
+	/* check for duplicate RR */
+	if(rr_is_duplicate_wol(pd, rdata_wol, rdata_len)) {
+		char* rrstr = dname_rdata_to_str(nm, nmlen, rrtype,
+			rrclass, ttl, rdata_wol, rdata_len);
+		verbose(VERB_ALGO, "ignoring duplicate RR: %s", (rrstr?rrstr:"<out of memory>"));
+		free(rrstr);
+		return 1;
+	}
+	if(pd->count > LOCALZONE_RRSET_COUNT_MAX) {
+		char* rrstr = dname_rdata_to_str(nm, nmlen, rrtype,
+			rrclass, ttl, rdata_wol, rdata_len);
+		log_warn("RRset %s has more than %d records, record ignored",
+			(rrstr?rrstr:"<out of memory>"), LOCALZONE_RRSET_COUNT_MAX);
+		free(rrstr);
+		return 1;
+	}
+	return rrset_insert_rr_wol(z->region, pd, rdata_wol, rdata_len, ttl);
+}
+
 int
 local_zone_enter_rr(struct local_zone* z, uint8_t* nm, size_t nmlen,
 	int nmlabs, uint16_t rrtype, uint16_t rrclass, time_t ttl,
@@ -2039,7 +2231,7 @@ set_kiddo_parents(struct local_zone* z, struct local_zone* match,

 struct local_zone* local_zones_add_zone(struct local_zones* zones,
 	uint8_t* name, size_t len, int labs, uint16_t dclass,
-	enum localzone_type tp)
+	enum localzone_type tp, int* duplicate)
 {
 	int exact;
 	/* create */
@@ -2047,6 +2239,7 @@ struct local_zone* local_zones_add_zone(struct local_zones* zones,
 	struct local_zone* z = local_zone_create(name, len, labs, tp, dclass);
 	if(!z) {
 		free(name);
+		if(duplicate) *duplicate = 0;
 		return NULL;
 	}
 	lock_rw_wrlock(&z->lock);
@@ -2060,8 +2253,14 @@ struct local_zone* local_zones_add_zone(struct local_zones* zones,
 	if(exact||!rbtree_insert(&zones->ztree, &z->node)) {
 		/* duplicate entry! */
 		lock_rw_unlock(&z->lock);
+		if(duplicate) {
+			*duplicate = 1;
+			z->name = NULL; /* Do not delete the name in
+				local_zone_delete. */
+		}
 		local_zone_delete(z);
-		log_err("internal: duplicate entry in local_zones_add_zone");
+		if(duplicate == NULL)
+			log_err("internal: duplicate entry in local_zones_add_zone");
 		return NULL;
 	}

@@ -2105,7 +2304,7 @@ local_zones_add_RR(struct local_zones* zones, const char* rr)
 	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type);
 	if(!z) {
 		z = local_zones_add_zone(zones, rr_name, len, labs, rr_class,
-			local_zone_transparent);
+			local_zone_transparent, NULL);
 		if(!z) {
 			lock_rw_unlock(&zones->lock);
 			return 0;
@@ -403,11 +403,17 @@ local_zones_find_le(struct local_zones* zones,
 * @param labs: labelcount of name.
 * @param dclass: class to add.
 * @param tp: type.
+ * @param duplicate: Allows to check if a NULL return from the function is a
+ *	memory error, or a duplicate entry. Pass NULL to have it not returned,
+ *	the name is freed on errors, and for a duplicate a log message is
+ *	printed. Pass not NULL, and when the error is a duplicate, the function
+ *	returns NULL, and the variable is set true. The name is not freed
+ *	when there is a duplicate, no error is printed by this function.
 * @return local_zone or NULL on error, caller must printout memory error.
 */
 struct local_zone* local_zones_add_zone(struct local_zones* zones, 
 	uint8_t* name, size_t len, int labs, uint16_t dclass, 
-	enum localzone_type tp);
+	enum localzone_type tp, int* duplicate);

 /**
 * Delete a zone. Caller must hold the zones lock.
@@ -526,6 +532,18 @@ int rrstr_get_rr_content(const char* str, uint8_t** nm, uint16_t* type,
 int rrset_insert_rr(struct regional* region, struct packed_rrset_data* pd,
 	uint8_t* rdata, size_t rdata_len, time_t ttl, const char* rrstr);

+/**
+  * Insert specified rdata into the specified resource record.
+  * @param region: allocator
+  * @param pd: data portion of the destination resource record
+  * @param rdata_wol: source rdata, without prefix len.
+  * @param rdata_len: source rdata length
+  * @param ttl: time to live
+  * @return 1 on success; 0 otherwise.
+  */
+int rrset_insert_rr_wol(struct regional* region, struct packed_rrset_data* pd,
+	uint8_t* rdata_wol, size_t rdata_len, time_t ttl);
+
 /**
 * Remove RR from rrset that is created using localzone's rrset_insert_rr.
 * @param pd: the RRset containing the RR to remove
@@ -631,6 +649,24 @@ local_zone_enter_rr(struct local_zone* z, uint8_t* nm, size_t nmlen,
 	int nmlabs, uint16_t rrtype, uint16_t rrclass, time_t ttl,
 	uint8_t* rdata, size_t rdata_len, const char* rrstr);

+/**
+ * Add RR to local zone. Without prefix length on rdata.
+ * @param z: local zone to add RR to
+ * @param nm: dname of RR
+ * @param nmlen: length of nm
+ * @param nmlabs: number of labels of nm
+ * @param rrtype: RR type
+ * @param rrclass: RR class
+ * @param ttl: TTL of RR to add
+ * @param rdata_wol: RDATA of RR to add, without prefix length.
+ * @param rdata_len: length of rdata, without prefix length.
+ * @return: 1 on success
+ */
+int
+local_zone_enter_rr_wol(struct local_zone* z, uint8_t* nm, size_t nmlen,
+	int nmlabs, uint16_t rrtype, uint16_t rrclass, time_t ttl,
+	uint8_t* rdata_wol, size_t rdata_len);
+
 /**
 * Find a data node by exact name for a local zone
 * @param z: local_zone containing data tree
@@ -674,4 +710,12 @@ lz_enter_zone(struct local_zones* zones, const char* name, const char* type,
 */
 void
 lz_init_parents(struct local_zones* zones);
+
+/**
+ * Convert dname, type, class, ttl, rdata to an rr string.
+ * rdata without prefixed length. returned string is malloced.
+ */
+char* dname_rdata_to_str(uint8_t* dname, size_t dnamelen, uint16_t rrtype,
+	uint16_t rrclass, uint32_t ttl, uint8_t* rdata, size_t rdata_len);
+
 #endif /* SERVICES_LOCALZONE_H */
@@ -170,15 +170,14 @@ rpz_type_ignored(uint16_t rr_type)
 /**
 * Classify RPZ action for RR type/rdata
 * @param rr_type: the RR type
- * @param rdatawl: RDATA with 2 bytes length
- * @param rdatalen: the length of rdatawl (including its 2 bytes length)
+ * @param rdata: RDATA without 2 bytes length
+ * @param rdatalen: the length of rdatawl (not including its 2 bytes length)
 * @return: the RPZ action
 */
 static enum rpz_action
-rpz_rr_to_action(uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
+rpz_rr_to_action_wol(uint16_t rr_type, uint8_t* rdata, size_t rdatalen)
 {
 	char* endptr;
-	uint8_t* rdata;
 	int rdatalabs;
 	uint8_t* tldlab = NULL;

@@ -202,11 +201,10 @@ rpz_rr_to_action(uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)

 	/* use CNAME target to determine RPZ action */
 	log_assert(rr_type == LDNS_RR_TYPE_CNAME);
-	if(rdatalen < 3)
+	if(rdatalen < 1)
 		return RPZ_INVALID_ACTION;

-	rdata = rdatawl + 2; /* 2 bytes of rdata length */
-	if(dname_valid(rdata, rdatalen-2) != rdatalen-2)
+	if(dname_valid(rdata, rdatalen) != rdatalen)
 		return RPZ_INVALID_ACTION;

 	rdatalabs = dname_count_labels(rdata);
@@ -226,7 +224,7 @@ rpz_rr_to_action(uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
 	}

 	/* all other TLDs starting with "rpz-" are invalid */
-	tldlab = get_tld_label(rdata, rdatalen-2);
+	tldlab = get_tld_label(rdata, rdatalen);
 	if(tldlab && dname_lab_startswith(tldlab, "rpz-", &endptr))
 		return RPZ_INVALID_ACTION;

@@ -234,6 +232,21 @@ rpz_rr_to_action(uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
 	return RPZ_LOCAL_DATA_ACTION;
 }

+/**
+ * Classify RPZ action for RR type/rdata
+ * @param rr_type: the RR type
+ * @param rdatawl: RDATA with 2 bytes length
+ * @param rdatalen: the length of rdatawl (including its 2 bytes length)
+ * @return: the RPZ action
+ */
+static enum rpz_action
+rpz_rr_to_action(uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
+{
+	if(rdatalen < 2)
+		return RPZ_INVALID_ACTION;
+	return rpz_rr_to_action_wol(rr_type, rdatawl+2, rdatalen-2);
+}
+
 static enum localzone_type 
 rpz_action_to_localzone_type(enum rpz_action a)
 {
@@ -658,7 +671,7 @@ strip_dname_origin(uint8_t* dname, size_t dnamelen, size_t originlen,
 static void
 rpz_insert_local_zones_trigger(struct local_zones* lz, uint8_t* dname,
 	size_t dnamelen, enum rpz_action a, uint16_t rrtype, uint16_t rrclass,
-	uint32_t ttl, uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
+	uint32_t ttl, uint8_t* rdata, size_t rdata_len)
 {
 	struct local_zone* z;
 	enum localzone_type tp = local_zone_always_transparent;
@@ -685,20 +698,41 @@ rpz_insert_local_zones_trigger(struct local_zones* lz, uint8_t* dname,
 		return;
 	}

+	/* For not a local-data action.
+	 * Insert the zone, then detect a duplicate, instead of find it first,
+	 * for speed of searching the tree once. */
+	if(a != RPZ_LOCAL_DATA_ACTION) {
+		int duplicate = 0;
+		lock_rw_wrlock(&lz->lock);
+		tp = rpz_action_to_localzone_type(a);
+		z = local_zones_add_zone(lz, dname, dnamelen,
+					 dnamelabs, rrclass, tp, &duplicate);
+		if(z == NULL) {
+			if(duplicate) {
+				char* rrstr = dname_rdata_to_str(dname, dnamelen, rrtype,
+					rrclass, ttl, rdata, rdata_len);
+				verbose(VERB_ALGO, "rpz: skipping duplicate record: %s", (rrstr?rrstr:"<out of memory>"));
+				free(rrstr);
+				free(dname);
+				lock_rw_unlock(&lz->lock);
+				return;
+			}
+			log_warn("rpz: create failed, out of memory");
+			lock_rw_unlock(&lz->lock);
+			/* dname will be free'd in failed local_zone_create() */
+			return;
+		}
+		lock_rw_unlock(&lz->lock);
+		return;
+	}
+
 	lock_rw_wrlock(&lz->lock);
 	/* exact match */
 	z = local_zones_find(lz, dname, dnamelen, dnamelabs, LDNS_RR_CLASS_IN);
 	if(z != NULL && a != RPZ_LOCAL_DATA_ACTION) {
-		char* rrstr = sldns_wire2str_rr(rr, rr_len);
-		if(rrstr == NULL) {
-			log_err("malloc error while inserting rpz nsdname trigger");
-			free(dname);
-			lock_rw_unlock(&lz->lock);
-			return;
-		}
-		if(rrstr[0])
-			rrstr[strlen(rrstr)-1]=0; /* remove newline */
-		verbose(VERB_ALGO, "rpz: skipping duplicate record: '%s'", rrstr);
+		char* rrstr = dname_rdata_to_str(dname, dnamelen, rrtype,
+			rrclass, ttl, rdata, rdata_len);
+		verbose(VERB_ALGO, "rpz: skipping duplicate record: %s", (rrstr?rrstr:"<out of memory>"));
 		free(rrstr);
 		free(dname);
 		lock_rw_unlock(&lz->lock);
@@ -707,7 +741,7 @@ rpz_insert_local_zones_trigger(struct local_zones* lz, uint8_t* dname,
 	if(z == NULL) {
 		tp = rpz_action_to_localzone_type(a);
 		z = local_zones_add_zone(lz, dname, dnamelen,
-					 dnamelabs, rrclass, tp);
+					 dnamelabs, rrclass, tp, NULL);
 		if(z == NULL) {
 			log_warn("rpz: create failed");
 			lock_rw_unlock(&lz->lock);
@@ -717,18 +751,10 @@ rpz_insert_local_zones_trigger(struct local_zones* lz, uint8_t* dname,
 		newzone = 1;
 	}
 	if(a == RPZ_LOCAL_DATA_ACTION) {
-		char* rrstr = sldns_wire2str_rr(rr, rr_len);
-		if(rrstr == NULL) {
-			log_err("malloc error while inserting rpz nsdname trigger");
-			free(dname);
-			lock_rw_unlock(&lz->lock);
-			return;
-		}
 		lock_rw_wrlock(&z->lock);
-		local_zone_enter_rr(z, dname, dnamelen, dnamelabs, rrtype,
-				    rrclass, ttl, rdata, rdata_len, rrstr);
+		local_zone_enter_rr_wol(z, dname, dnamelen, dnamelabs, rrtype,
+			rrclass, ttl, rdata, rdata_len);
 		lock_rw_unlock(&z->lock);
-		free(rrstr);
 	}
 	if(!newzone) {
 		free(dname);
@@ -748,7 +774,7 @@ rpz_log_dname(char const* msg, uint8_t* dname, size_t dname_len)
 static void
 rpz_insert_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 	enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
-	uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
+	uint8_t* rdata, size_t rdata_len)
 {
 	if(a == RPZ_INVALID_ACTION) {
 		verbose(VERB_ALGO, "rpz: skipping invalid action");
@@ -757,7 +783,7 @@ rpz_insert_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 	}

 	rpz_insert_local_zones_trigger(r->local_zones, dname, dnamelen, a, rrtype,
-				       rrclass, ttl, rdata, rdata_len, rr, rr_len);
+				       rrclass, ttl, rdata, rdata_len);
 }

 static int
@@ -799,7 +825,7 @@ rpz_strip_nsdname_suffix(uint8_t* dname, size_t maxdnamelen,
 static void
 rpz_insert_nsdname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 	enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
-	uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
+	uint8_t* rdata, size_t rdata_len)
 {
 	uint8_t* dname_stripped = NULL;
 	size_t dnamelen_stripped = 0;
@@ -814,32 +840,22 @@ rpz_insert_nsdname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,

 	/* dname_stripped is consumed or freed by the insert routine */
 	rpz_insert_local_zones_trigger(r->nsdname_zones, dname_stripped,
-		dnamelen_stripped, a, rrtype, rrclass, ttl, rdata, rdata_len,
-		rr, rr_len);
+		dnamelen_stripped, a, rrtype, rrclass, ttl, rdata, rdata_len);
 }

 static int
 rpz_insert_ipaddr_based_trigger(struct respip_set* set, struct sockaddr_storage* addr,
 	socklen_t addrlen, int net, enum rpz_action a, uint16_t rrtype,
-	uint16_t rrclass, uint32_t ttl, uint8_t* rdata, size_t rdata_len,
-	uint8_t* rr, size_t rr_len)
+	uint16_t rrclass, uint32_t ttl, uint8_t* rdata, size_t rdata_len)
 {
 	struct resp_addr* node;
-	char* rrstr;
 	enum respip_action respa = rpz_action_to_respip_action(a);

 	lock_rw_wrlock(&set->lock);
-	rrstr = sldns_wire2str_rr(rr, rr_len);
-	if(rrstr == NULL) {
-		log_err("malloc error while inserting rpz ipaddr based trigger");
-		lock_rw_unlock(&set->lock);
-		return 0;
-	}

-	node = respip_sockaddr_find_or_create(set, addr, addrlen, net, 1, rrstr);
+	node = respip_sockaddr_find_or_create(set, addr, addrlen, net, 1);
 	if(node == NULL) {
 		lock_rw_unlock(&set->lock);
-		free(rrstr);
 		return 0;
 	}

@@ -849,12 +865,11 @@ rpz_insert_ipaddr_based_trigger(struct respip_set* set, struct sockaddr_storage*
 	node->action = respa;

 	if(a == RPZ_LOCAL_DATA_ACTION) {
-		respip_enter_rr(set->region, node, rrtype,
-				rrclass, ttl, rdata, rdata_len, rrstr, "");
+		respip_enter_rr_wol(set->region, node, rrtype,
+				rrclass, ttl, rdata, rdata_len, "");
 	}

 	lock_rw_unlock(&node->lock);
-	free(rrstr);
 	return 1;
 }

@@ -890,17 +905,6 @@ rpz_clientip_ensure_entry(struct clientip_synthesized_rrset* set,
 	return node;
 }

-static void
-rpz_report_rrset_error(const char* msg, uint8_t* rr, size_t rr_len) {
-	char* rrstr = sldns_wire2str_rr(rr, rr_len);
-	if(rrstr == NULL) {
-		log_err("malloc error while inserting rpz clientip based record");
-		return;
-	}
-	log_err("rpz: unexpected: unable to insert %s: %s", msg, rrstr);
-	free(rrstr);
-}
-
 /* from localzone.c; difference is we don't have a dname */
 static struct local_rrset*
 rpz_clientip_new_rrset(struct regional* region,
@@ -958,14 +962,13 @@ rpz_clientip_enter_rr(struct regional* region, struct clientip_synthesized_rr* r
 		return 0;
 	}

-	return rrset_insert_rr(region, rrset->rrset->entry.data, rdata, rdata_len, ttl, "");
+	return rrset_insert_rr_wol(region, rrset->rrset->entry.data, rdata, rdata_len, ttl);
 }

 static int
 rpz_clientip_insert_trigger_rr(struct clientip_synthesized_rrset* set, struct sockaddr_storage* addr,
 	socklen_t addrlen, int net, enum rpz_action a, uint16_t rrtype,
-	uint16_t rrclass, uint32_t ttl, uint8_t* rdata, size_t rdata_len,
-	uint8_t* rr, size_t rr_len)
+	uint16_t rrclass, uint32_t ttl, uint8_t* rdata, size_t rdata_len)
 {
 	struct clientip_synthesized_rr* node;

@@ -973,8 +976,14 @@ rpz_clientip_insert_trigger_rr(struct clientip_synthesized_rrset* set, struct so

 	node = rpz_clientip_ensure_entry(set, addr, addrlen, net);
 	if(node == NULL) {
+		char as[64], *rrstr;
 		lock_rw_unlock(&set->lock);
-		rpz_report_rrset_error("client ip address", rr, rr_len);
+		addr_to_str(addr, addrlen, as, sizeof(as));
+		rrstr = dname_rdata_to_str(NULL, 0, rrtype, rrclass, ttl,
+			rdata, rdata_len);
+		log_err("rpz: unexpected: unable to insert %s: %s/%d %s",
+			"client ip address", as, net, (rrstr?rrstr:"<out of memory>"));
+		free(rrstr);
 		return 0;
 	}

@@ -1000,7 +1009,7 @@ rpz_clientip_insert_trigger_rr(struct clientip_synthesized_rrset* set, struct so
 static int
 rpz_insert_clientip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 	enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
-	uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
+	uint8_t* rdata, size_t rdata_len)
 {
 	struct sockaddr_storage addr;
 	socklen_t addrlen;
@@ -1016,13 +1025,13 @@ rpz_insert_clientip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 	}

 	return rpz_clientip_insert_trigger_rr(r->client_set, &addr, addrlen, net,
-			a, rrtype, rrclass, ttl, rdata, rdata_len, rr, rr_len);
+			a, rrtype, rrclass, ttl, rdata, rdata_len);
 }

 static int
 rpz_insert_nsip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 	enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
-	uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
+	uint8_t* rdata, size_t rdata_len)
 {
 	struct sockaddr_storage addr;
 	socklen_t addrlen;
@@ -1038,14 +1047,14 @@ rpz_insert_nsip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 	}

 	return rpz_clientip_insert_trigger_rr(r->ns_set, &addr, addrlen, net,
-			a, rrtype, rrclass, ttl, rdata, rdata_len, rr, rr_len);
+			a, rrtype, rrclass, ttl, rdata, rdata_len);
 }

 /** Insert RR into RPZ's respip_set */
 static int
 rpz_insert_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 	enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
-	uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
+	uint8_t* rdata, size_t rdata_len)
 {
 	struct sockaddr_storage addr;
 	socklen_t addrlen;
@@ -1070,13 +1079,13 @@ rpz_insert_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 	}

 	return rpz_insert_ipaddr_based_trigger(r->respip_set, &addr, addrlen, net,
-			a, rrtype, rrclass, ttl, rdata, rdata_len, rr, rr_len);
+			a, rrtype, rrclass, ttl, rdata, rdata_len);
 }

 int
 rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname,
 	size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl,
-	uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len)
+	uint8_t* rdatawol, size_t rdatalen)
 {
 	size_t policydnamelen;
 	/* name is free'd in local_zone delete */
@@ -1110,7 +1119,7 @@ rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname,
 		return 0;
 	}

-	a = rpz_rr_to_action(rr_type, rdatawl, rdatalen);
+	a = rpz_rr_to_action_wol(rr_type, rdatawol, rdatalen);
 	if(!(policydnamelen = strip_dname_origin(dname, dnamelen, aznamelen,
 		policydname, (dnamelen-aznamelen)+1))) {
 		free(policydname);
@@ -1125,27 +1134,22 @@ rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname,
 	if(t == RPZ_QNAME_TRIGGER) {
 		/* policydname will be consumed, no free */
 		rpz_insert_qname_trigger(r, policydname, policydnamelen,
-			a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
-			rr_len);
+			a, rr_type, rr_class, rr_ttl, rdatawol, rdatalen);
 	} else if(t == RPZ_RESPONSE_IP_TRIGGER) {
 		rpz_insert_response_ip_trigger(r, policydname, policydnamelen,
-			a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
-			rr_len);
+			a, rr_type, rr_class, rr_ttl, rdatawol, rdatalen);
 		free(policydname);
 	} else if(t == RPZ_CLIENT_IP_TRIGGER) {
 		rpz_insert_clientip_trigger(r, policydname, policydnamelen,
-			a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
-			rr_len);
+			a, rr_type, rr_class, rr_ttl, rdatawol, rdatalen);
 		free(policydname);
 	} else if(t == RPZ_NSIP_TRIGGER) {
 		rpz_insert_nsip_trigger(r, policydname, policydnamelen,
-			a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
-			rr_len);
+			a, rr_type, rr_class, rr_ttl, rdatawol, rdatalen);
 		free(policydname);
 	} else if(t == RPZ_NSDNAME_TRIGGER) {
 		rpz_insert_nsdname_trigger(r, policydname, policydnamelen,
-			a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
-			rr_len);
+			a, rr_type, rr_class, rr_ttl, rdatawol, rdatalen);
 		free(policydname);
 	} else {
 		free(policydname);
@@ -136,15 +136,13 @@ struct rpz {
 * @param rr_type: RR type of the RR
 * @param rr_class: RR class of the RR
 * @param rr_ttl: TTL of the RR
- * @param rdatawl: rdata of the RR, prepended with the rdata size
- * @param rdatalen: length if the RR, including the prepended rdata size
- * @param rr: the complete RR, for logging purposes
- * @param rr_len: the length of the complete RR
+ * @param rdatawol: rdata of the RR, not prepended with the rdata size
+ * @param rdatalen: length if the RR, not including the prepended rdata size
 * @return: 0 on error
 */
 int rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname,
 	size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl,
-	uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len);
+	uint8_t* rdatawol, size_t rdatalen);

 /**
 * Delete policy matching RR, used for IXFR.
@@ -1265,7 +1265,7 @@ static void localzone_parents_test(void)
 		nmlabs = dname_count_size_labels(nm, &nmlen);
 		lock_rw_wrlock(&z2->lock);
 		local_zones_add_zone(z2, nm, nmlen, nmlabs, LDNS_RR_CLASS_IN,
-			local_zone_always_nxdomain);
+			local_zone_always_nxdomain, NULL);
 		lock_rw_unlock(&z2->lock);
 	}
 	/* The trees should be the same, iterate and check the nodes */
@@ -40,6 +40,8 @@ grep -F -v -e "dnstap" hlist > ilist; mv ilist hlist
 grep -F -v -e "util/siphash.c" hlist > ilist; mv ilist hlist
 # filter out compat
 grep -F -v -e "compat/" hlist > ilist; mv ilist hlist
+# filter out simdzone
+grep -F -v -e "simdzone/" hlist > ilist; mv ilist hlist
 for h in `cat hlist`; do
 	if grep -F "`basename $h`" $PRE/doc/html/files.html >/dev/null; then
 		: # ok
@@ -24,7 +24,11 @@ example.      86400   IN  ZONEMD  2018031900 1 240 (
 example.      86400   IN  ZONEMD  2018031900 241 1 (
                                  e1846540e33a9e41
                                  89792d18d5d131f6
-                                  05fc283e )
+                                  05fc283e00000000
+                                  6792901f9f88e637
+                                  493daaf401c92c27
+                                  9dd10f0edb1c56f8
+				  )
 ns1.example.  3600    IN  A       203.0.113.63
 ns2.example.  86400   IN  TXT     "This example has multiple digests"
 ns2.example.  3600    IN  AAAA    2001:db8::63
@@ -100,6 +100,7 @@ int
 query_dname_compare(register uint8_t* d1, register uint8_t* d2)
 {
 	register uint8_t lab1, lab2;
+	register uint8_t ld1, ld2;
 	log_assert(d1 && d2);
 	lab1 = *d1++;
 	lab2 = *d2++;
@@ -116,8 +117,8 @@ query_dname_compare(register uint8_t* d1, register uint8_t* d2)
 		while(lab1--) {
 			/* compare bytes first for speed */
 			if(*d1 != *d2 && 
-				tolower((unsigned char)*d1) != tolower((unsigned char)*d2)) {
-				if(tolower((unsigned char)*d1) < tolower((unsigned char)*d2))
+				(ld1=tolower((unsigned char)*d1)) != (ld2=tolower((unsigned char)*d2))) {
+				if(ld1 < ld2)
 					return -1;
 				return 1;
 			}
@@ -233,6 +234,7 @@ int
 dname_pkt_compare(sldns_buffer* pkt, uint8_t* d1, uint8_t* d2)
 {
 	uint8_t len1, len2;
+	register uint8_t ld1, ld2;
 	int count1 = 0, count2 = 0;
 	log_assert(pkt && d1 && d2);
 	len1 = *d1++;
@@ -269,8 +271,8 @@ dname_pkt_compare(sldns_buffer* pkt, uint8_t* d1, uint8_t* d2)
 		log_assert(len1 == len2 && len1 != 0);
 		/* compare labels */
 		while(len1--) {
-			if(tolower((unsigned char)*d1) != tolower((unsigned char)*d2)) {
-				if(tolower((unsigned char)*d1) < tolower((unsigned char)*d2))
+			if((ld1=tolower((unsigned char)*d1)) != (ld2=tolower((unsigned char)*d2))) {
+				if(ld1 < ld2)
 					return -1;
 				return 1;
 			}
@@ -470,9 +472,10 @@ dname_count_size_labels(uint8_t* dname, size_t* size)
 static int
 memlowercmp(uint8_t* p1, uint8_t* p2, uint8_t len)
 {
+	register uint8_t lp1, lp2;
 	while(len--) {
-		if(*p1 != *p2 && tolower((unsigned char)*p1) != tolower((unsigned char)*p2)) {
-			if(tolower((unsigned char)*p1) < tolower((unsigned char)*p2))
+		if(*p1 != *p2 && (lp1=tolower((unsigned char)*p1)) != (lp2=tolower((unsigned char)*p2))) {
+			if(lp1 < lp2)
 				return -1;
 			return 1;
 		}
@@ -523,15 +526,15 @@ dname_lab_cmp(uint8_t* d1, int labs1, uint8_t* d2, int labs2, int* mlabs)
 			d1 += len1;
 			d2 += len2;
 		} else {
+			register uint8_t ld1, ld2;
 			/* memlowercmp is inlined here; or just like
 			 * if((c=memlowercmp(d1, d2, len1)) != 0) { 
 			 *	lastdiff = c;
 			 *	lastmlabs = atlabel; } apart from d1++,d2++ */
 			while(len1) {
-				if(*d1 != *d2 && tolower((unsigned char)*d1) 
-					!= tolower((unsigned char)*d2)) {
-					if(tolower((unsigned char)*d1) < 
-						tolower((unsigned char)*d2)) {
+				if(*d1 != *d2 && (ld1=tolower((unsigned char)*d1))
+					!= (ld2=tolower((unsigned char)*d2))) {
+					if(ld1 < ld2) {
 						lastdiff = -1;
 						lastmlabs = atlabel;
 						d1 += len1;
Author	SHA1	Message	Date
W.C.A. Wijngaards	d67ca6bfed	Disallow $INCLUDE for secondary zones. This matches the change in the code repository, and is meant for after merge of the simdzone change.	2026-06-16 09:32:24 +02:00
W.C.A. Wijngaards	9735e34f89	- rpz-zone-load, fix comment for the rrset_insert_rr_wol function.	2026-01-28 14:35:40 +01:00
W.C.A. Wijngaards	ac9ca8c5af	- rpz-zone-load, fix signedness of name character comparisons.	2026-01-28 14:13:13 +01:00
W.C.A. Wijngaards	1d18f34c79	- rpz-zone-load, handle alloc failures from dname_rdata_to_str.	2026-01-28 13:58:09 +01:00
W.C.A. Wijngaards	17f64b818e	- rpz-zone-load, optimise canonical name compare tolower calls.	2026-01-28 12:47:03 +01:00
W.C.A. Wijngaards	9cf1344960	Merge branch 'master' into rpz-zone-load	2026-01-28 11:50:45 +01:00
W.C.A. Wijngaards	098200ba5a	- rpz-zone-load, optimise rpz_insert_local_zones_trigger to remove second local zones tree lookup for non local data cases.	2026-01-28 11:48:53 +01:00
W.C.A. Wijngaards	08a2734e91	- rpz-zone-load, rpz load does not pass unwanted string, and rr data.	2026-01-23 16:40:52 +01:00
W.C.A. Wijngaards	14264c9ed9	- rpz-zone-load, authzone changes to not spool data into rr from simdzone rdata, for rpz load.	2026-01-23 15:21:26 +01:00
W.C.A. Wijngaards	76f0bb8ba2	- simdzone-zone-load, use_simdzone variable to switch sldns and simdzone parse.	2026-01-23 11:33:27 +01:00
W.C.A. Wijngaards	051fef8456	- simdzone-zone-load, update simdzone version.	2026-01-22 14:46:07 +01:00
W.C.A. Wijngaards	b8c96862cb	Merge branch 'master' into simdzone-zone-load	2026-01-22 14:20:08 +01:00
W.C.A. Wijngaards	d99a4375bf	Merge branch 'master' into simdzone-zone-load	2026-01-21 14:55:50 +01:00
W.C.A. Wijngaards	5582fbc443	- simdzone-zone-load, update simdzone version.	2026-01-16 14:08:34 +01:00
W.C.A. Wijngaards	a72374000e	- simdzone-zone-load, fix to use chrootdir adjustment when dealing with $INCLUDE in a zonefile read.	2026-01-16 13:46:03 +01:00
W.C.A. Wijngaards	cea8f493b2	- simdzone-zone-load, update simdzone version.	2026-01-16 13:43:56 +01:00
W.C.A. Wijngaards	285b5aa461	- sidzone-zone-load, set no_includes option for http transferred files.	2026-01-16 13:43:16 +01:00
W.C.A. Wijngaards	a50dd4e407	- simdzone-zone-load, implement that the auth http transferred zone files are parsed with simdzone parse from callback.	2026-01-13 16:25:46 +01:00
W.C.A. Wijngaards	966801a984	- simdzone-zone-load, move sldns auth https download parse to another routine.	2026-01-13 15:35:17 +01:00
W.C.A. Wijngaards	6084171db7	Merge branch 'master' into simdzone-zone-load	2026-01-13 15:21:58 +01:00
W.C.A. Wijngaards	4baa2ccc9c	- simdzone-zone-load, update simdzone version.	2026-01-13 15:21:38 +01:00
W.C.A. Wijngaards	0793bb9835	- simdzone-zone-load, fix makedist to make a directory in /tmp, so that autoconf does not go up to the directory of the working copy for files.	2025-12-12 15:44:46 +01:00
W.C.A. Wijngaards	10b8398f02	- simdzone-zone-load, fix to have makedist remove unneeded simdzone autoconf temporary files.	2025-12-12 14:03:35 +01:00
W.C.A. Wijngaards	797d9569c3	- simdzone-zone-load, fix to remove double checks for simdzone and its configure script in configure.ac.	2025-12-12 13:35:38 +01:00
W.C.A. Wijngaards	dfa358dc8d	- simdzone-zone-load, remove config.h.in from the repository, it is generated by autoreconf, since that has to be called to initialise the simdzone repo. Add config.h.in to gitignore.	2025-12-11 08:50:15 +01:00
W.C.A. Wijngaards	6dd48dadc9	- simdzone-zone-load, remove install-sh from the repository, the configure.ac requires it, and it is pulled in with autoreconf -fi, the configure script checks and warns when it is missing, or if the simdzone module is missing. Add install-sh to gitignore.	2025-12-10 16:48:40 +01:00
W.C.A. Wijngaards	d34733a69b	- simdzone-zone-load, stat the zonefile, instead of opening it, and then clear the data.	2025-12-10 16:27:33 +01:00
W.C.A. Wijngaards	e1faea02de	- simdzone-zone-load, use cfg for _state struct in az_parse_file_simdzone function.	2025-12-10 16:12:21 +01:00
W.C.A. Wijngaards	fdd0ada3c9	- simdzone-zone-load, document to get git submodule and autoreconf, and add generated files to gitignore.	2025-12-10 16:09:35 +01:00
W.C.A. Wijngaards	ed3606d99d	- simdzone-zone-load, remove configure, aclocal.m4, ltmain.sh, config.guess, and config.sub from the repository. Because of the simdzone submodule, the repository needs to have autoreconf -fi for it.	2025-12-10 16:00:40 +01:00
W.C.A. Wijngaards	b9df07d8bb	- simdzone-zone-load, fix return value and variable name for rdata.	2025-12-10 11:56:40 +01:00
W.C.A. Wijngaards	ea9c957213	- simdzone-zone-load, remove copy of rdata from simdzone accept path for ordinary zone read.	2025-12-10 11:39:24 +01:00
W.C.A. Wijngaards	828b05c956	- simdzone-zone-load, fix doc unit test to omit simdzone source code warnings.	2025-12-08 15:19:42 +01:00
W.C.A. Wijngaards	3b2a2e2440	Merge branch 'master' into simdzone-zone-load	2025-12-08 14:59:56 +01:00
W.C.A. Wijngaards	0557fdb940	- simdzone-zone-load, use simdzone for auth-zone and rpz zone read. Fix unittest for ZONEMD to have correct digest length for test entry.	2025-12-08 14:51:37 +01:00
W.C.A. Wijngaards	fbed3f30b2	- simdzone-zone-load, fix ci, enable platforms.	2025-10-17 16:44:03 +02:00
W.C.A. Wijngaards	2001d9fd15	- simdzone-zone-load, ci change.	2025-10-17 16:12:39 +02:00
W.C.A. Wijngaards	b3be0fe943	- simdzone-zone-load, update simdzone version.	2025-10-17 16:11:24 +02:00
W.C.A. Wijngaards	f04ee9767e	- simdzone-zone-load, ci change.	2025-10-17 15:47:32 +02:00
W.C.A. Wijngaards	899ad30ad9	- simdzone-zone-load, ci change.	2025-10-17 15:20:40 +02:00
W.C.A. Wijngaards	6c501b9aa2	- simdzone-zone-load, ci change to fix windows.	2025-10-17 14:51:57 +02:00
W.C.A. Wijngaards	1cde7b2cbb	- simdzone-zone-load, ci change.	2025-10-17 14:46:34 +02:00
W.C.A. Wijngaards	72e2e711c2	- simdzone-zone-load, ci change.	2025-10-17 14:41:17 +02:00
W.C.A. Wijngaards	cdb4b7c3b0	- simdzone-zone-load, ci change.	2025-10-17 14:35:45 +02:00
W.C.A. Wijngaards	e6657ae284	- simdzone-zone-load, ci change.	2025-10-17 14:33:58 +02:00
W.C.A. Wijngaards	9cf702f09f	- simdzone-zone-load, ci change.	2025-10-17 14:32:45 +02:00
W.C.A. Wijngaards	a0e33aa77d	- simdzone-zone-load, ci change.	2025-10-17 14:19:30 +02:00
W.C.A. Wijngaards	ded06e8b60	- simdzone-zone-load, ci change.	2025-10-17 14:16:21 +02:00
W.C.A. Wijngaards	c0a06a5d24	- simdzone-zone-load, ci change.	2025-10-17 14:13:38 +02:00
W.C.A. Wijngaards	0fec18796a	- simdzone-zone-load, ci change.	2025-10-17 14:11:53 +02:00
W.C.A. Wijngaards	990b27550e	- simdzone-zone-load, ci change.	2025-10-17 13:26:09 +02:00
W.C.A. Wijngaards	7742270e39	- simdzone-zone-load, ci change.	2025-10-17 13:20:00 +02:00
W.C.A. Wijngaards	7021d91348	- simdzone-zone-load, ci change.	2025-10-17 13:13:19 +02:00
W.C.A. Wijngaards	150cf78ff2	- simdzone-zone-load, ci change.	2025-10-17 13:07:41 +02:00
W.C.A. Wijngaards	5e1a98027c	- simdzone-zone-load, ci change.	2025-10-17 12:00:20 +02:00
W.C.A. Wijngaards	1140e39a78	- simdzone-zone-load, ci change, bsd works, moving to windows.	2025-10-17 11:52:41 +02:00
W.C.A. Wijngaards	13f7893805	- simdzone-zone-load, ci change.	2025-10-17 11:36:47 +02:00
W.C.A. Wijngaards	87f5a51618	- simdzone-zone-load, fix ci to include pkg-config to build configure, since that is used for scanning for some of the dependencies.	2025-10-17 11:33:08 +02:00
W.C.A. Wijngaards	7672d9768b	- simdzone-zone-load, ci change.	2025-10-17 09:57:35 +02:00
W.C.A. Wijngaards	5b46b5a972	- simdzone-zone-load, ci change.	2025-10-17 09:33:21 +02:00
W.C.A. Wijngaards	0827064414	- simdzone-zone-load, ci change.	2025-10-17 09:31:16 +02:00
W.C.A. Wijngaards	8284af6690	- simdzone-zone-load, ci change.	2025-10-17 09:30:17 +02:00
W.C.A. Wijngaards	b89eed2902	- simdzone-zone-load, ci change.	2025-10-17 09:27:38 +02:00
W.C.A. Wijngaards	0dcaaf332d	- simdzone-zone-load, ci change.	2025-10-17 09:24:34 +02:00
W.C.A. Wijngaards	2bd88e8f70	- simdzone-zone-load, fix ci with automakedir for windows and aclocal for bsd.	2025-10-16 16:27:08 +02:00
W.C.A. Wijngaards	5d9cc00f0a	- simdzone-zone-load, fix ci, aclocal for windows, rm import file for bsd.	2025-10-16 16:06:31 +02:00
W.C.A. Wijngaards	2536b35d38	- simdzone-zone-load, fix ci, debug exclusions, lib path for automake for windows, automake version for openbsd, aclocal for freebsd, netbsd and openbsd.	2025-10-16 15:44:30 +02:00
W.C.A. Wijngaards	e312575b87	- simdzone-zone-load, fix ci, debug exclusions, separate lib path for windows, aclocal and autoconf rerun for freebsd, openbsd, netbsd.	2025-10-16 15:31:22 +02:00
W.C.A. Wijngaards	5cd0c63593	- simdzone-zone-load, fix ci, autoreconf on windows.	2025-10-16 15:11:04 +02:00
W.C.A. Wijngaards	152e4e9e63	- simdzone-zone-load, fix for autoconf 2.72 and no Makefile in simdzone.	2025-10-16 15:01:07 +02:00
W.C.A. Wijngaards	30bc4e5bd7	- simdzone-zone-load, fix ci, ignore working ones, autoreconf on windows, autoconf for freebsd, netbsd, openbsd.	2025-10-16 14:47:11 +02:00
W.C.A. Wijngaards	e70edac733	- simdzone-zone-load, fix ci, ignore working ones, autoreconf for ios, noconfirm for pacman on windows, autoconf-archive on freebsd, netbsd, openbsd, on openbsd also set the AUTOMAKE_VERSION.	2025-10-16 14:21:01 +02:00
W.C.A. Wijngaards	4e1f1db6c9	- simdzone-zone-load, fix ci, ignore working ones, install autotools for windows, install automake for aclocal for freebsd, openbsd, netbsd, install autoconf for macos.	2025-10-16 14:02:43 +02:00
W.C.A. Wijngaards	e45531d68f	- simdzone-zone-load, update simdzone version.	2025-10-16 13:46:19 +02:00
W.C.A. Wijngaards	1a898ff9bc	- simdzone-zone-load, fix makefile for disable-static build.	2025-10-16 12:55:59 +02:00
W.C.A. Wijngaards	f190903e3b	- simdzone-zone-load, add submodule to ci, and autoconf.	2025-10-16 12:28:48 +02:00
W.C.A. Wijngaards	f6b4582eec	Merge branch 'master' into simdzone-zone-load	2025-10-16 12:11:55 +02:00
W.C.A. Wijngaards	3e71cf89cb	- simdzone-zone-load, function call to simdzone and build fix for export.h.	2025-10-14 16:33:07 +02:00
W.C.A. Wijngaards	0929d0e2e4	- simdzone-zone-load, remove git information and autoconf temporaries from release tarball.	2025-10-10 14:27:11 +02:00
W.C.A. Wijngaards	0c3b3d00f9	- simdzone-zone-load, update simdzone version.	2025-10-10 13:35:52 +02:00
W.C.A. Wijngaards	3bb8888e9e	- simdzone-zone-load, fix dnstap/dnstap_config.h file from configure.	2025-10-09 14:39:39 +02:00
W.C.A. Wijngaards	d8c5dbd6d8	- simdzone-zone-load, update simdzone version.	2025-10-08 17:15:38 +02:00
W.C.A. Wijngaards	eef91474cd	- simdzone-zone-load, fix makedist.sh cross compile for simdzone.	2025-10-08 17:12:45 +02:00
W.C.A. Wijngaards	426d56795f	- simdzone-zone-load, configure checks that the simdzone directory has the submodule files and prints an error otherwise.	2025-10-08 16:40:50 +02:00
W.C.A. Wijngaards	54ac686476	- simdzone-zone-load, update simdzone version.	2025-10-07 15:57:49 +02:00
W.C.A. Wijngaards	09efa55f81	Merge branch 'master' into simdzone-zone-load	2025-10-02 15:36:31 +02:00
W.C.A. Wijngaards	3018f073d2	- simdzone-zone-load, update simdzone version.	2025-10-02 15:06:05 +02:00
W.C.A. Wijngaards	a489ad2b4f	- simdzone-zone-load, Add configure~ to gitignore.	2025-10-02 14:50:11 +02:00
W.C.A. Wijngaards	a48d1a51b5	- simdzone-zone-load, update simdzone version.	2025-10-02 14:47:50 +02:00
W.C.A. Wijngaards	25e7e6ec72	- simdzone-zone-load, modify configure and Makefile to link with simdzone.	2025-10-02 14:33:31 +02:00
W.C.A. Wijngaards	f2af8a3cd7	- simdzone-zone-load, add submodule with simdzone.	2025-09-18 13:49:05 +02:00