Fix function signature for compiling test

distribute can send out responses tsig signed
Forgot to include util/allow_response_list.[ch]
2026-08-17 21:25:50 +02:00 · 2025-11-03 11:15:11 +01:00 · 2025-11-01 14:32:09 +01:00 · 2025-11-01 13:12:35 +01:00 · 2025-11-01 12:52:48 +01:00 · 2025-10-31 15:45:34 +01:00
181 changed files with 3504 additions and 1521 deletions
@@ -12,6 +12,7 @@ jobs:
  build:
    runs-on: ${{ matrix.os }}
    strategy:
+      fail-fast: false
      matrix:
        include:
          - name: GCC on Linux
@@ -48,15 +49,6 @@ jobs:
            os: ubuntu-latest
            config: 'CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=address" --disable-flto --disable-static'
            make_test: "yes"
-          - name: Apple iPhone on iOS, armv7
-            os: macos-latest
-            AUTOTOOLS_HOST: armv7-apple-ios
-            OPENSSL_HOST: ios-cross
-            IOS_SDK: iPhoneOS
-            IOS_CPU: armv7s
-            test_ios: "yes"
-            config: "no"
-            make: "no"
          - name: Apple iPhone on iOS, arm64
            os: macos-latest
            AUTOTOOLS_HOST: aarch64-apple-ios
@@ -84,15 +76,6 @@ jobs:
            test_ios: "yes"
            config: "no"
            make: "no"
-          - name: iPhoneSimulator on OS X, i386
-            os: macos-latest
-            AUTOTOOLS_HOST: i386-apple-ios
-            OPENSSL_HOST: iphoneos-cross
-            IOS_SDK: iPhoneSimulator
-            IOS_CPU: i386
-            test_ios: "yes"
-            config: "no"
-            make: "no"
          - name: iPhoneSimulator on OS X, x86_64
            os: macos-latest
            AUTOTOOLS_HOST: x86_64-apple-ios
@@ -25,18 +25,21 @@ Unbound can be compiled and installed using:
 ./configure && make && make install
 ```

-You can use libevent if you want. libevent is useful when using many (10000)
-outgoing ports. By default max 256 ports are opened at the same time and the
-builtin alternative is equally capable and a little faster.
-
+You can use libevent if you want. libevent is useful when using many (e.g.,
+10000) outgoing ports.
 Use the `--with-libevent` configure option to compile Unbound with libevent
 support.

+If not, the default builtin alternative opens max 256 ports at the same time
+and is equally capable and a little faster.
+
+
 ## Unbound configuration

-All of Unbound's configuration options are described in the man pages, which
-will be installed and are available on the Unbound
-[documentation page](https://unbound.docs.nlnetlabs.nl/).
+All of Unbound's configuration options are described in the `unbound.conf(5)`
+man page, which will be installed and is also available on the Unbound
+[documentation page](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html)
+for the latest version.

-An example configuration file is located in
+An example configuration file, with minimal documentation, is located in
 [doc/example.conf](https://github.com/NLnetLabs/unbound/blob/master/doc/example.conf.in).
@@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.16.2 -*- Autoconf -*-
+# generated automatically by aclocal 1.16.5 -*- Autoconf -*-

-# Copyright (C) 1996-2020 Free Software Foundation, Inc.
+# Copyright (C) 1996-2021 Free Software Foundation, Inc.

 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -14,7 +14,8 @@
 m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
 # libtool.m4 - Configure libtool for the host system. -*-Autoconf-*-
 #
-#   Copyright (C) 1996-2001, 2003-2015 Free Software Foundation, Inc.
+#   Copyright (C) 1996-2001, 2003-2019, 2021-2022 Free Software
+#   Foundation, Inc.
 #   Written by Gordon Matzigkeit, 1996
 #
 # This file is free software; the Free Software Foundation gives
@@ -45,7 +46,7 @@ m4_define([_LT_COPYING], [dnl
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 ])

-# serial 58 LT_INIT
+# serial 59 LT_INIT


 # LT_PREREQ(VERSION)
@@ -195,6 +196,7 @@ m4_require([_LT_FILEUTILS_DEFAULTS])dnl
 m4_require([_LT_CHECK_SHELL_FEATURES])dnl
 m4_require([_LT_PATH_CONVERSION_FUNCTIONS])dnl
 m4_require([_LT_CMD_RELOAD])dnl
+m4_require([_LT_DECL_FILECMD])dnl
 m4_require([_LT_CHECK_MAGIC_METHOD])dnl
 m4_require([_LT_CHECK_SHAREDLIB_FROM_LINKLIB])dnl
 m4_require([_LT_CMD_OLD_ARCHIVE])dnl
@@ -233,8 +235,8 @@ esac
 ofile=libtool
 can_build_shared=yes

-# All known linkers require a '.a' archive for static linking (except MSVC,
-# which needs '.lib').
+# All known linkers require a '.a' archive for static linking (except MSVC and
+# ICC, which need '.lib').
 libext=a

 with_gnu_ld=$lt_cv_prog_gnu_ld
@@ -736,7 +738,6 @@ _LT_CONFIG_SAVE_COMMANDS([
    cat <<_LT_EOF >> "$cfgfile"
 #! $SHELL
 # Generated automatically by $as_me ($PACKAGE) $VERSION
-# Libtool was configured on host `(hostname || uname -n) 2>/dev/null | sed 1q`:
 # NOTE: Changes made to this file will be lost: look at ltmain.sh.

 # Provide generalized library-building support services.
@@ -786,7 +787,7 @@ _LT_EOF
  # if finds mixed CR/LF and LF-only lines.  Since sed operates in
  # text mode, it properly converts lines to CR/LF.  This bash problem
  # is reportedly fixed, but why not run on old versions too?
-  sed '$q' "$ltmain" >> "$cfgfile" \
+  $SED '$q' "$ltmain" >> "$cfgfile" \
     || (rm -f "$cfgfile"; exit 1)

   mv -f "$cfgfile" "$ofile" ||
@@ -1048,8 +1049,8 @@ int forced_loaded() { return 2;}
 _LT_EOF
      echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&AS_MESSAGE_LOG_FD
      $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&AS_MESSAGE_LOG_FD
-      echo "$AR cru libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
-      $AR cru libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
+      echo "$AR $AR_FLAGS libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
+      $AR $AR_FLAGS libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
      echo "$RANLIB libconftest.a" >&AS_MESSAGE_LOG_FD
      $RANLIB libconftest.a 2>&AS_MESSAGE_LOG_FD
      cat > conftest.c << _LT_EOF
@@ -1073,17 +1074,12 @@ _LT_EOF
      _lt_dar_allow_undefined='$wl-undefined ${wl}suppress' ;;
    darwin1.*)
      _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
-    darwin*) # darwin 5.x on
-      # if running on 10.5 or later, the deployment target defaults
-      # to the OS version, if on x86, and 10.4, the deployment
-      # target defaults to 10.4. Don't you love it?
-      case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in
-	10.0,*86*-darwin8*|10.0,*-darwin[[91]]*)
-	  _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
-	10.[[012]][[,.]]*)
-	  _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
-	10.*)
-	  _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
+    darwin*)
+      case $MACOSX_DEPLOYMENT_TARGET,$host in
+        10.[[012]],*|,*powerpc*-darwin[[5-8]]*)
+          _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
+        *)
+          _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
      esac
    ;;
  esac
@@ -1132,12 +1128,12 @@ m4_defun([_LT_DARWIN_LINKER_FEATURES],
    output_verbose_link_cmd=func_echo_all
    _LT_TAGVAR(archive_cmds, $1)="\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dsymutil"
    _LT_TAGVAR(module_cmds, $1)="\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dsymutil"
-    _LT_TAGVAR(archive_expsym_cmds, $1)="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
-    _LT_TAGVAR(module_expsym_cmds, $1)="sed -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
+    _LT_TAGVAR(archive_expsym_cmds, $1)="$SED 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
+    _LT_TAGVAR(module_expsym_cmds, $1)="$SED -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
    m4_if([$1], [CXX],
 [   if test yes != "$lt_cv_apple_cc_single_mod"; then
      _LT_TAGVAR(archive_cmds, $1)="\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dsymutil"
-      _LT_TAGVAR(archive_expsym_cmds, $1)="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil"
+      _LT_TAGVAR(archive_expsym_cmds, $1)="$SED 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil"
    fi
 ],[])
  else
@@ -1251,7 +1247,8 @@ _LT_DECL([], [ECHO], [1], [An echo program that protects backslashes])
 # _LT_WITH_SYSROOT
 # ----------------
 AC_DEFUN([_LT_WITH_SYSROOT],
-[AC_MSG_CHECKING([for sysroot])
+[m4_require([_LT_DECL_SED])dnl
+AC_MSG_CHECKING([for sysroot])
 AC_ARG_WITH([sysroot],
 [AS_HELP_STRING([--with-sysroot@<:@=DIR@:>@],
  [Search for dependent libraries within DIR (or the compiler's sysroot
@@ -1268,7 +1265,7 @@ case $with_sysroot in #(
   fi
   ;; #(
 /*)
-   lt_sysroot=`echo "$with_sysroot" | sed -e "$sed_quote_subst"`
+   lt_sysroot=`echo "$with_sysroot" | $SED -e "$sed_quote_subst"`
   ;; #(
 no|'')
   ;; #(
@@ -1298,7 +1295,7 @@ ia64-*-hpux*)
  # options accordingly.
  echo 'int i;' > conftest.$ac_ext
  if AC_TRY_EVAL(ac_compile); then
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
      *ELF-32*)
 	HPUX_IA64_MODE=32
 	;;
@@ -1315,7 +1312,7 @@ ia64-*-hpux*)
  echo '[#]line '$LINENO' "configure"' > conftest.$ac_ext
  if AC_TRY_EVAL(ac_compile); then
    if test yes = "$lt_cv_prog_gnu_ld"; then
-      case `/usr/bin/file conftest.$ac_objext` in
+      case `$FILECMD conftest.$ac_objext` in
 	*32-bit*)
 	  LD="${LD-ld} -melf32bsmip"
 	  ;;
@@ -1327,7 +1324,7 @@ ia64-*-hpux*)
 	;;
      esac
    else
-      case `/usr/bin/file conftest.$ac_objext` in
+      case `$FILECMD conftest.$ac_objext` in
 	*32-bit*)
 	  LD="${LD-ld} -32"
 	  ;;
@@ -1349,7 +1346,7 @@ mips64*-*linux*)
  echo '[#]line '$LINENO' "configure"' > conftest.$ac_ext
  if AC_TRY_EVAL(ac_compile); then
    emul=elf
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
      *32-bit*)
 	emul="${emul}32"
 	;;
@@ -1357,7 +1354,7 @@ mips64*-*linux*)
 	emul="${emul}64"
 	;;
    esac
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
      *MSB*)
 	emul="${emul}btsmip"
 	;;
@@ -1365,7 +1362,7 @@ mips64*-*linux*)
 	emul="${emul}ltsmip"
 	;;
    esac
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
      *N32*)
 	emul="${emul}n32"
 	;;
@@ -1385,14 +1382,14 @@ s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
  # not appear in the list.
  echo 'int i;' > conftest.$ac_ext
  if AC_TRY_EVAL(ac_compile); then
-    case `/usr/bin/file conftest.o` in
+    case `$FILECMD conftest.o` in
      *32-bit*)
 	case $host in
 	  x86_64-*kfreebsd*-gnu)
 	    LD="${LD-ld} -m elf_i386_fbsd"
 	    ;;
 	  x86_64-*linux*)
-	    case `/usr/bin/file conftest.o` in
+	    case `$FILECMD conftest.o` in
 	      *x86-64*)
 		LD="${LD-ld} -m elf32_x86_64"
 		;;
@@ -1460,7 +1457,7 @@ s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
  # options accordingly.
  echo 'int i;' > conftest.$ac_ext
  if AC_TRY_EVAL(ac_compile); then
-    case `/usr/bin/file conftest.o` in
+    case `$FILECMD conftest.o` in
    *64-bit*)
      case $lt_cv_prog_gnu_ld in
      yes*)
@@ -1499,9 +1496,22 @@ need_locks=$enable_libtool_lock
 m4_defun([_LT_PROG_AR],
 [AC_CHECK_TOOLS(AR, [ar], false)
 : ${AR=ar}
-: ${AR_FLAGS=cru}
 _LT_DECL([], [AR], [1], [The archiver])
-_LT_DECL([], [AR_FLAGS], [1], [Flags to create an archive])
+
+# Use ARFLAGS variable as AR's operation code to sync the variable naming with
+# Automake.  If both AR_FLAGS and ARFLAGS are specified, AR_FLAGS should have
+# higher priority because thats what people were doing historically (setting
+# ARFLAGS for automake and AR_FLAGS for libtool).  FIXME: Make the AR_FLAGS
+# variable obsoleted/removed.
+
+test ${AR_FLAGS+y} || AR_FLAGS=${ARFLAGS-cr}
+lt_ar_flags=$AR_FLAGS
+_LT_DECL([], [lt_ar_flags], [0], [Flags to create an archive (by configure)])
+
+# Make AR_FLAGS overridable by 'make ARFLAGS='.  Don't try to run-time override
+# by AR_FLAGS because that was never working and AR_FLAGS is about to die.
+_LT_DECL([], [AR_FLAGS], [\@S|@{ARFLAGS-"\@S|@lt_ar_flags"}],
+         [Flags to create an archive])

 AC_CACHE_CHECK([for archiver @FILE support], [lt_cv_ar_at_file],
  [lt_cv_ar_at_file=no
@@ -1720,7 +1730,7 @@ AC_CACHE_VAL([lt_cv_sys_max_cmd_len], [dnl
    lt_cv_sys_max_cmd_len=8192;
    ;;

-  bitrig* | darwin* | dragonfly* | freebsd* | netbsd* | openbsd*)
+  bitrig* | darwin* | dragonfly* | freebsd* | midnightbsd* | netbsd* | openbsd*)
    # This has been around since 386BSD, at least.  Likely further.
    if test -x /sbin/sysctl; then
      lt_cv_sys_max_cmd_len=`/sbin/sysctl -n kern.argmax`
@@ -1763,7 +1773,7 @@ AC_CACHE_VAL([lt_cv_sys_max_cmd_len], [dnl
  sysv5* | sco5v6* | sysv4.2uw2*)
    kargmax=`grep ARG_MAX /etc/conf/cf.d/stune 2>/dev/null`
    if test -n "$kargmax"; then
-      lt_cv_sys_max_cmd_len=`echo $kargmax | sed 's/.*[[	 ]]//'`
+      lt_cv_sys_max_cmd_len=`echo $kargmax | $SED 's/.*[[	 ]]//'`
    else
      lt_cv_sys_max_cmd_len=32768
    fi
@@ -2213,26 +2223,35 @@ m4_defun([_LT_CMD_STRIPLIB],
 striplib=
 old_striplib=
 AC_MSG_CHECKING([whether stripping libraries is possible])
-if test -n "$STRIP" && $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then
-  test -z "$old_striplib" && old_striplib="$STRIP --strip-debug"
-  test -z "$striplib" && striplib="$STRIP --strip-unneeded"
-  AC_MSG_RESULT([yes])
+if test -z "$STRIP"; then
+  AC_MSG_RESULT([no])
 else
-# FIXME - insert some real tests, host_os isn't really good enough
-  case $host_os in
-  darwin*)
-    if test -n "$STRIP"; then
+  if $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then
+    old_striplib="$STRIP --strip-debug"
+    striplib="$STRIP --strip-unneeded"
+    AC_MSG_RESULT([yes])
+  else
+    case $host_os in
+    darwin*)
+      # FIXME - insert some real tests, host_os isn't really good enough
      striplib="$STRIP -x"
      old_striplib="$STRIP -S"
      AC_MSG_RESULT([yes])
-    else
+      ;;
+    freebsd*)
+      if $STRIP -V 2>&1 | $GREP "elftoolchain" >/dev/null; then
+        old_striplib="$STRIP --strip-debug"
+        striplib="$STRIP --strip-unneeded"
+        AC_MSG_RESULT([yes])
+      else
+        AC_MSG_RESULT([no])
+      fi
+      ;;
+    *)
      AC_MSG_RESULT([no])
-    fi
-    ;;
-  *)
-    AC_MSG_RESULT([no])
-    ;;
-  esac
+      ;;
+    esac
+  fi
 fi
 _LT_DECL([], [old_striplib], [1], [Commands to strip libraries])
 _LT_DECL([], [striplib], [1])
@@ -2555,7 +2574,7 @@ cygwin* | mingw* | pw32* | cegcc*)
    case $host_os in
    cygwin*)
      # Cygwin DLLs use 'cyg' prefix rather than 'lib'
-      soname_spec='`echo $libname | sed -e 's/^lib/cyg/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
+      soname_spec='`echo $libname | $SED -e 's/^lib/cyg/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
 m4_if([$1], [],[
      sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/lib/w32api"])
      ;;
@@ -2565,14 +2584,14 @@ m4_if([$1], [],[
      ;;
    pw32*)
      # pw32 DLLs use 'pw' prefix rather than 'lib'
-      library_names_spec='`echo $libname | sed -e 's/^lib/pw/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
+      library_names_spec='`echo $libname | $SED -e 's/^lib/pw/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
      ;;
    esac
    dynamic_linker='Win32 ld.exe'
    ;;

-  *,cl*)
-    # Native MSVC
+  *,cl* | *,icl*)
+    # Native MSVC or ICC
    libname_spec='$name'
    soname_spec='$libname`echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
    library_names_spec='$libname.dll.lib'
@@ -2591,7 +2610,7 @@ m4_if([$1], [],[
      done
      IFS=$lt_save_ifs
      # Convert to MSYS style.
-      sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | sed -e 's|\\\\|/|g' -e 's| \\([[a-zA-Z]]\\):| /\\1|g' -e 's|^ ||'`
+      sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e 's|\\\\|/|g' -e 's| \\([[a-zA-Z]]\\):| /\\1|g' -e 's|^ ||'`
      ;;
    cygwin*)
      # Convert to unix form, then to dos form, then back to unix form
@@ -2628,7 +2647,7 @@ m4_if([$1], [],[
    ;;

  *)
-    # Assume MSVC wrapper
+    # Assume MSVC and ICC wrapper
    library_names_spec='$libname`echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext $libname.lib'
    dynamic_linker='Win32 ld.exe'
    ;;
@@ -2661,7 +2680,7 @@ dgux*)
  shlibpath_var=LD_LIBRARY_PATH
  ;;

-freebsd* | dragonfly*)
+freebsd* | dragonfly* | midnightbsd*)
  # DragonFly does not have aout.  When/if they implement a new
  # versioning mechanism, adjust this.
  if test -x /usr/bin/objformat; then
@@ -2873,9 +2892,6 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
  # before this can be enabled.
  hardcode_into_libs=yes

-  # Add ABI-specific directories to the system library path.
-  sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /lib /usr/lib"
-
  # Ideally, we could use ldconfig to report *all* directores which are
  # searched for libraries, however this is still not possible.  Aside from not
  # being certain /sbin/ldconfig is available, command
@@ -2884,7 +2900,7 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
  # appending ld.so.conf contents (and includes) to the search path.
  if test -f /etc/ld.so.conf; then
    lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \[$]2)); skip = 1; } { if (!skip) print \[$]0; skip = 0; }' < /etc/ld.so.conf | $SED -e 's/#.*//;/^[	 ]*hwcap[	 ]/d;s/[:,	]/ /g;s/=[^=]*$//;s/=[^= ]* / /g;s/"//g;/^$/d' | tr '\n' ' '`
-    sys_lib_dlsearch_path_spec="$sys_lib_dlsearch_path_spec $lt_ld_extra"
+    sys_lib_dlsearch_path_spec="/lib /usr/lib $lt_ld_extra"
  fi

  # We used to test for /lib/ld.so.1 and disable shared libraries on
@@ -2896,6 +2912,18 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
  dynamic_linker='GNU/Linux ld.so'
  ;;

+netbsdelf*-gnu)
+  version_type=linux
+  need_lib_prefix=no
+  need_version=no
+  library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major ${libname}${shared_ext}'
+  soname_spec='${libname}${release}${shared_ext}$major'
+  shlibpath_var=LD_LIBRARY_PATH
+  shlibpath_overrides_runpath=no
+  hardcode_into_libs=yes
+  dynamic_linker='NetBSD ld.elf_so'
+  ;;
+
 netbsd*)
  version_type=sunos
  need_lib_prefix=no
@@ -3463,7 +3491,7 @@ beos*)

 bsdi[[45]]*)
  lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (shared object|dynamic lib)'
-  lt_cv_file_magic_cmd='/usr/bin/file -L'
+  lt_cv_file_magic_cmd='$FILECMD -L'
  lt_cv_file_magic_test_file=/shlib/libc.so
  ;;

@@ -3497,14 +3525,14 @@ darwin* | rhapsody*)
  lt_cv_deplibs_check_method=pass_all
  ;;

-freebsd* | dragonfly*)
+freebsd* | dragonfly* | midnightbsd*)
  if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then
    case $host_cpu in
    i*86 )
      # Not sure whether the presence of OpenBSD here was a mistake.
      # Let's accept both of them until this is cleared up.
      lt_cv_deplibs_check_method='file_magic (FreeBSD|OpenBSD|DragonFly)/i[[3-9]]86 (compact )?demand paged shared library'
-      lt_cv_file_magic_cmd=/usr/bin/file
+      lt_cv_file_magic_cmd=$FILECMD
      lt_cv_file_magic_test_file=`echo /usr/lib/libc.so.*`
      ;;
    esac
@@ -3518,7 +3546,7 @@ haiku*)
  ;;

 hpux10.20* | hpux11*)
-  lt_cv_file_magic_cmd=/usr/bin/file
+  lt_cv_file_magic_cmd=$FILECMD
  case $host_cpu in
  ia64*)
    lt_cv_deplibs_check_method='file_magic (s[[0-9]][[0-9]][[0-9]]|ELF-[[0-9]][[0-9]]) shared object file - IA64'
@@ -3555,7 +3583,7 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
  lt_cv_deplibs_check_method=pass_all
  ;;

-netbsd*)
+netbsd* | netbsdelf*-gnu)
  if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then
    lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\.[[0-9]]+\.[[0-9]]+|_pic\.a)$'
  else
@@ -3565,7 +3593,7 @@ netbsd*)

 newos6*)
  lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (executable|dynamic lib)'
-  lt_cv_file_magic_cmd=/usr/bin/file
+  lt_cv_file_magic_cmd=$FILECMD
  lt_cv_file_magic_test_file=/usr/lib/libnls.so
  ;;

@@ -3692,13 +3720,13 @@ else
 	mingw*) lt_bad_file=conftest.nm/nofile ;;
 	*) lt_bad_file=/dev/null ;;
 	esac
-	case `"$tmp_nm" -B $lt_bad_file 2>&1 | sed '1q'` in
+	case `"$tmp_nm" -B $lt_bad_file 2>&1 | $SED '1q'` in
 	*$lt_bad_file* | *'Invalid file or object type'*)
 	  lt_cv_path_NM="$tmp_nm -B"
 	  break 2
 	  ;;
 	*)
-	  case `"$tmp_nm" -p /dev/null 2>&1 | sed '1q'` in
+	  case `"$tmp_nm" -p /dev/null 2>&1 | $SED '1q'` in
 	  */dev/null*)
 	    lt_cv_path_NM="$tmp_nm -p"
 	    break 2
@@ -3724,7 +3752,7 @@ else
    # Let the user override the test.
  else
    AC_CHECK_TOOLS(DUMPBIN, [dumpbin "link -dump"], :)
-    case `$DUMPBIN -symbols -headers /dev/null 2>&1 | sed '1q'` in
+    case `$DUMPBIN -symbols -headers /dev/null 2>&1 | $SED '1q'` in
    *COFF*)
      DUMPBIN="$DUMPBIN -symbols -headers"
      ;;
@@ -3964,7 +3992,7 @@ esac

 if test "$lt_cv_nm_interface" = "MS dumpbin"; then
  # Gets list of data symbols to import.
-  lt_cv_sys_global_symbol_to_import="sed -n -e 's/^I .* \(.*\)$/\1/p'"
+  lt_cv_sys_global_symbol_to_import="$SED -n -e 's/^I .* \(.*\)$/\1/p'"
  # Adjust the below global symbol transforms to fixup imported variables.
  lt_cdecl_hook=" -e 's/^I .* \(.*\)$/extern __declspec(dllimport) char \1;/p'"
  lt_c_name_hook=" -e 's/^I .* \(.*\)$/  {\"\1\", (void *) 0},/p'"
@@ -3982,20 +4010,20 @@ fi
 # Transform an extracted symbol line into a proper C declaration.
 # Some systems (esp. on ia64) link data and code symbols differently,
 # so use this general approach.
-lt_cv_sys_global_symbol_to_cdecl="sed -n"\
+lt_cv_sys_global_symbol_to_cdecl="$SED -n"\
 $lt_cdecl_hook\
 " -e 's/^T .* \(.*\)$/extern int \1();/p'"\
 " -e 's/^$symcode$symcode* .* \(.*\)$/extern char \1;/p'"

 # Transform an extracted symbol line into symbol name and symbol address
-lt_cv_sys_global_symbol_to_c_name_address="sed -n"\
+lt_cv_sys_global_symbol_to_c_name_address="$SED -n"\
 $lt_c_name_hook\
 " -e 's/^: \(.*\) .*$/  {\"\1\", (void *) 0},/p'"\
 " -e 's/^$symcode$symcode* .* \(.*\)$/  {\"\1\", (void *) \&\1},/p'"

 # Transform an extracted symbol line into symbol name with lib prefix and
 # symbol address.
-lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="sed -n"\
+lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="$SED -n"\
 $lt_c_name_lib_hook\
 " -e 's/^: \(.*\) .*$/  {\"\1\", (void *) 0},/p'"\
 " -e 's/^$symcode$symcode* .* \(lib.*\)$/  {\"\1\", (void *) \&\1},/p'"\
@@ -4019,7 +4047,7 @@ for ac_symprfx in "" "_"; do
  if test "$lt_cv_nm_interface" = "MS dumpbin"; then
    # Fake it for dumpbin and say T for any non-static function,
    # D for any global variable and I for any imported variable.
-    # Also find C++ and __fastcall symbols from MSVC++,
+    # Also find C++ and __fastcall symbols from MSVC++ or ICC,
    # which start with @ or ?.
    lt_cv_sys_global_symbol_pipe="$AWK ['"\
 "     {last_section=section; section=\$ 3};"\
@@ -4037,9 +4065,9 @@ for ac_symprfx in "" "_"; do
 "     s[1]~prfx {split(s[1],t,\"@\"); print f,t[1],substr(t[1],length(prfx))}"\
 "     ' prfx=^$ac_symprfx]"
  else
-    lt_cv_sys_global_symbol_pipe="sed -n -e 's/^.*[[	 ]]\($symcode$symcode*\)[[	 ]][[	 ]]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'"
+    lt_cv_sys_global_symbol_pipe="$SED -n -e 's/^.*[[	 ]]\($symcode$symcode*\)[[	 ]][[	 ]]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'"
  fi
-  lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe | sed '/ __gnu_lto/d'"
+  lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe | $SED '/ __gnu_lto/d'"

  # Check to see that the pipe works correctly.
  pipe_works=no
@@ -4061,7 +4089,8 @@ _LT_EOF
  if AC_TRY_EVAL(ac_compile); then
    # Now try to grab the symbols.
    nlist=conftest.nm
-    if AC_TRY_EVAL(NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist) && test -s "$nlist"; then
+    $ECHO "$as_me:$LINENO: $NM conftest.$ac_objext | $lt_cv_sys_global_symbol_pipe > $nlist" >&AS_MESSAGE_LOG_FD
+    if eval "$NM" conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist 2>&AS_MESSAGE_LOG_FD && test -s "$nlist"; then
      # Try sorting and uniquifying the output.
      if sort "$nlist" | uniq > "$nlist"T; then
 	mv -f "$nlist"T "$nlist"
@@ -4326,7 +4355,7 @@ m4_if([$1], [CXX], [
 	    ;;
 	esac
 	;;
-      freebsd* | dragonfly*)
+      freebsd* | dragonfly* | midnightbsd*)
 	# FreeBSD uses GNU C++
 	;;
      hpux9* | hpux10* | hpux11*)
@@ -4409,7 +4438,7 @@ m4_if([$1], [CXX], [
 	    _LT_TAGVAR(lt_prog_compiler_static, $1)='-qstaticlink'
 	    ;;
 	  *)
-	    case `$CC -V 2>&1 | sed 5q` in
+	    case `$CC -V 2>&1 | $SED 5q` in
 	    *Sun\ C*)
 	      # Sun C++ 5.9
 	      _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
@@ -4433,7 +4462,7 @@ m4_if([$1], [CXX], [
 	    ;;
 	esac
 	;;
-      netbsd*)
+      netbsd* | netbsdelf*-gnu)
 	;;
      *qnx* | *nto*)
        # QNX uses GNU C++, but need to define -shared option too, otherwise
@@ -4701,6 +4730,12 @@ m4_if([$1], [CXX], [
 	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
 	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
        ;;
+      # flang / f18. f95 an alias for gfortran or flang on Debian
+      flang* | f18* | f95*)
+	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
+	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
+	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
+        ;;
      # icc used to be incompatible with GCC.
      # ICC 10 doesn't accept -KPIC any more.
      icc* | ifort*)
@@ -4745,7 +4780,7 @@ m4_if([$1], [CXX], [
 	_LT_TAGVAR(lt_prog_compiler_static, $1)='-qstaticlink'
 	;;
      *)
-	case `$CC -V 2>&1 | sed 5q` in
+	case `$CC -V 2>&1 | $SED 5q` in
 	*Sun\ Ceres\ Fortran* | *Sun*Fortran*\ [[1-7]].* | *Sun*Fortran*\ 8.[[0-3]]*)
 	  # Sun Fortran 8.3 passes all unrecognized flags to the linker
 	  _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
@@ -4928,7 +4963,7 @@ m4_if([$1], [CXX], [
    if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then
      _LT_TAGVAR(export_symbols_cmds, $1)='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && ([substr](\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols'
    else
-      _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
+      _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "L") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
    fi
    ;;
  pw32*)
@@ -4936,7 +4971,7 @@ m4_if([$1], [CXX], [
    ;;
  cygwin* | mingw* | cegcc*)
    case $cc_basename in
-    cl*)
+    cl* | icl*)
      _LT_TAGVAR(exclude_expsyms, $1)='_NULL_IMPORT_DESCRIPTOR|_IMPORT_DESCRIPTOR_.*'
      ;;
    *)
@@ -4945,6 +4980,9 @@ m4_if([$1], [CXX], [
      ;;
    esac
    ;;
+  linux* | k*bsd*-gnu | gnu*)
+    _LT_TAGVAR(link_all_deplibs, $1)=no
+    ;;
  *)
    _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED '\''s/.* //'\'' | sort | uniq > $export_symbols'
    ;;
@@ -4993,20 +5031,23 @@ dnl Note also adjust exclude_expsyms for C++ above.

  case $host_os in
  cygwin* | mingw* | pw32* | cegcc*)
-    # FIXME: the MSVC++ port hasn't been tested in a loooong time
+    # FIXME: the MSVC++ and ICC port hasn't been tested in a loooong time
    # When not using gcc, we currently assume that we are using
-    # Microsoft Visual C++.
+    # Microsoft Visual C++ or Intel C++ Compiler.
    if test yes != "$GCC"; then
      with_gnu_ld=no
    fi
    ;;
  interix*)
-    # we just hope/assume this is gcc and not c89 (= MSVC++)
+    # we just hope/assume this is gcc and not c89 (= MSVC++ or ICC)
    with_gnu_ld=yes
    ;;
  openbsd* | bitrig*)
    with_gnu_ld=no
    ;;
+  linux* | k*bsd*-gnu | gnu*)
+    _LT_TAGVAR(link_all_deplibs, $1)=no
+    ;;
  esac

  _LT_TAGVAR(ld_shlibs, $1)=yes
@@ -5053,7 +5094,7 @@ dnl Note also adjust exclude_expsyms for C++ above.
      _LT_TAGVAR(whole_archive_flag_spec, $1)=
    fi
    supports_anon_versioning=no
-    case `$LD -v | $SED -e 's/([^)]\+)\s\+//' 2>&1` in
+    case `$LD -v | $SED -e 's/([[^)]]\+)\s\+//' 2>&1` in
      *GNU\ gold*) supports_anon_versioning=yes ;;
      *\ [[01]].* | *\ 2.[[0-9]].* | *\ 2.10.*) ;; # catch versions < 2.11
      *\ 2.11.93.0.2\ *) supports_anon_versioning=yes ;; # RH7.3 ...
@@ -5165,6 +5206,7 @@ _LT_EOF
 	emximp -o $lib $output_objdir/$libname.def'
      _LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
      _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
+      _LT_TAGVAR(file_list_spec, $1)='@'
      ;;

    interix[[3-9]]*)
@@ -5179,7 +5221,7 @@ _LT_EOF
      # 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link
      # time.  Moving up from 0x10000000 also allows more sbrk(2) space.
      _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
-      _LT_TAGVAR(archive_expsym_cmds, $1)='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
+      _LT_TAGVAR(archive_expsym_cmds, $1)='$SED "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
      ;;

    gnu* | linux* | tpf* | k*bsd*-gnu | kopensolaris*-gnu)
@@ -5222,7 +5264,7 @@ _LT_EOF
 	  _LT_TAGVAR(compiler_needs_object, $1)=yes
 	  ;;
 	esac
-	case `$CC -V 2>&1 | sed 5q` in
+	case `$CC -V 2>&1 | $SED 5q` in
 	*Sun\ C*)			# Sun C 5.9
 	  _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`new_convenience=; for conv in $convenience\"\"; do test -z \"$conv\" || new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive'
 	  _LT_TAGVAR(compiler_needs_object, $1)=yes
@@ -5234,13 +5276,14 @@ _LT_EOF

        if test yes = "$supports_anon_versioning"; then
          _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
-            cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
+            cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
            echo "local: *; };" >> $output_objdir/$libname.ver~
            $CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib'
        fi

 	case $cc_basename in
 	tcc*)
+	  _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir'
 	  _LT_TAGVAR(export_dynamic_flag_spec, $1)='-rdynamic'
 	  ;;
 	xlf* | bgf* | bgxlf* | mpixlf*)
@@ -5250,7 +5293,7 @@ _LT_EOF
 	  _LT_TAGVAR(archive_cmds, $1)='$LD -shared $libobjs $deplibs $linker_flags -soname $soname -o $lib'
 	  if test yes = "$supports_anon_versioning"; then
 	    _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
-              cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
+              cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
              echo "local: *; };" >> $output_objdir/$libname.ver~
              $LD -shared $libobjs $deplibs $linker_flags -soname $soname -version-script $output_objdir/$libname.ver -o $lib'
 	  fi
@@ -5261,7 +5304,7 @@ _LT_EOF
      fi
      ;;

-    netbsd*)
+    netbsd* | netbsdelf*-gnu)
      if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib'
 	wlarc=
@@ -5382,7 +5425,7 @@ _LT_EOF
 	if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then
 	  _LT_TAGVAR(export_symbols_cmds, $1)='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && ([substr](\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols'
 	else
-	  _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
+	  _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "L") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
 	fi
 	aix_use_runtimelinking=no

@@ -5565,12 +5608,12 @@ _LT_EOF

    cygwin* | mingw* | pw32* | cegcc*)
      # When not using gcc, we currently assume that we are using
-      # Microsoft Visual C++.
+      # Microsoft Visual C++ or Intel C++ Compiler.
      # hardcode_libdir_flag_spec is actually meaningless, as there is
      # no search path for DLLs.
      case $cc_basename in
-      cl*)
-	# Native MSVC
+      cl* | icl*)
+	# Native MSVC or ICC
 	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
 	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
 	_LT_TAGVAR(always_export_symbols, $1)=yes
@@ -5611,7 +5654,7 @@ _LT_EOF
          fi'
 	;;
      *)
-	# Assume MSVC wrapper
+	# Assume MSVC and ICC wrapper
 	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
 	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
 	# Tell ltmain to make .lib files, not .a files.
@@ -5659,7 +5702,7 @@ _LT_EOF
      ;;

    # FreeBSD 3 and greater uses gcc -shared to do shared libraries.
-    freebsd* | dragonfly*)
+    freebsd* | dragonfly* | midnightbsd*)
      _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
      _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir'
      _LT_TAGVAR(hardcode_direct, $1)=yes
@@ -5782,6 +5825,7 @@ _LT_EOF
 	if test yes = "$lt_cv_irix_exported_symbol"; then
          _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib'
 	fi
+	_LT_TAGVAR(link_all_deplibs, $1)=no
      else
 	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
 	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -exports_file $export_symbols -o $lib'
@@ -5799,11 +5843,12 @@ _LT_EOF
 	# Fabrice Bellard et al's Tiny C Compiler
 	_LT_TAGVAR(ld_shlibs, $1)=yes
 	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
+	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir'
 	;;
      esac
      ;;

-    netbsd*)
+    netbsd* | netbsdelf*-gnu)
      if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags'  # a.out
      else
@@ -5870,6 +5915,7 @@ _LT_EOF
 	emximp -o $lib $output_objdir/$libname.def'
      _LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
      _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
+      _LT_TAGVAR(file_list_spec, $1)='@'
      ;;

    osf3*)
@@ -6425,7 +6471,7 @@ if test yes != "$_lt_caught_CXX_error"; then
      # Commands to make compiler produce verbose output that lists
      # what "hidden" libraries, object files and flags are used when
      # linking a shared library.
-      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'

    else
      GXX=no
@@ -6636,8 +6682,8 @@ if test yes != "$_lt_caught_CXX_error"; then

      cygwin* | mingw* | pw32* | cegcc*)
 	case $GXX,$cc_basename in
-	,cl* | no,cl*)
-	  # Native MSVC
+	,cl* | no,cl* | ,icl* | no,icl*)
+	  # Native MSVC or ICC
 	  # hardcode_libdir_flag_spec is actually meaningless, as there is
 	  # no search path for DLLs.
 	  _LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
@@ -6735,6 +6781,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	  emximp -o $lib $output_objdir/$libname.def'
 	_LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
 	_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
+	_LT_TAGVAR(file_list_spec, $1)='@'
 	;;

      dgux*)
@@ -6765,7 +6812,7 @@ if test yes != "$_lt_caught_CXX_error"; then
        _LT_TAGVAR(archive_cmds_need_lc, $1)=no
        ;;

-      freebsd* | dragonfly*)
+      freebsd* | dragonfly* | midnightbsd*)
        # FreeBSD 3 and later use GNU C++ and GNU ld with standard ELF
        # conventions
        _LT_TAGVAR(ld_shlibs, $1)=yes
@@ -6800,7 +6847,7 @@ if test yes != "$_lt_caught_CXX_error"; then
            # explicitly linking system object files so we need to strip them
            # from the output so that they don't get included in the library
            # dependencies.
-            output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
+            output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP " \-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
            ;;
          *)
            if test yes = "$GXX"; then
@@ -6865,7 +6912,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	    # explicitly linking system object files so we need to strip them
 	    # from the output so that they don't get included in the library
 	    # dependencies.
-	    output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
+	    output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP " \-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
 	    ;;
          *)
 	    if test yes = "$GXX"; then
@@ -6902,7 +6949,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	# 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link
 	# time.  Moving up from 0x10000000 also allows more sbrk(2) space.
 	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
-	_LT_TAGVAR(archive_expsym_cmds, $1)='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
+	_LT_TAGVAR(archive_expsym_cmds, $1)='$SED "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
 	;;
      irix5* | irix6*)
        case $cc_basename in
@@ -7042,13 +7089,13 @@ if test yes != "$_lt_caught_CXX_error"; then
 	    _LT_TAGVAR(archive_cmds, $1)='$CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
 	    if test yes = "$supports_anon_versioning"; then
 	      _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
-                cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
+                cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
                echo "local: *; };" >> $output_objdir/$libname.ver~
                $CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib'
 	    fi
 	    ;;
 	  *)
-	    case `$CC -V 2>&1 | sed 5q` in
+	    case `$CC -V 2>&1 | $SED 5q` in
 	    *Sun\ C*)
 	      # Sun C++ 5.9
 	      _LT_TAGVAR(no_undefined_flag, $1)=' -zdefs'
@@ -7204,7 +7251,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	      # Commands to make compiler produce verbose output that lists
 	      # what "hidden" libraries, object files and flags are used when
 	      # linking a shared library.
-	      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'

 	    else
 	      # FIXME: insert proper C++ library support
@@ -7288,7 +7335,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	        # Commands to make compiler produce verbose output that lists
 	        # what "hidden" libraries, object files and flags are used when
 	        # linking a shared library.
-	        output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	        output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 	      else
 	        # g++ 2.7 appears to require '-G' NOT '-shared' on this
 	        # platform.
@@ -7299,7 +7346,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	        # Commands to make compiler produce verbose output that lists
 	        # what "hidden" libraries, object files and flags are used when
 	        # linking a shared library.
-	        output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	        output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 	      fi

 	      _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R $wl$libdir'
@@ -8186,6 +8233,14 @@ _LT_DECL([], [DLLTOOL], [1], [DLL creation program])
 AC_SUBST([DLLTOOL])
 ])

+# _LT_DECL_FILECMD
+# ----------------
+# Check for a file(cmd) program that can be used to detect file type and magic
+m4_defun([_LT_DECL_FILECMD],
+[AC_CHECK_TOOL([FILECMD], [file], [:])
+_LT_DECL([], [FILECMD], [1], [A file(cmd) program that detects file types])
+])# _LD_DECL_FILECMD
+
 # _LT_DECL_SED
 # ------------
 # Check for a fully-functional sed program, that truncates
@@ -8365,8 +8420,8 @@ _LT_DECL([to_tool_file_cmd], [lt_cv_to_tool_file_cmd],

 # Helper functions for option handling.                    -*- Autoconf -*-
 #
-#   Copyright (C) 2004-2005, 2007-2009, 2011-2015 Free Software
-#   Foundation, Inc.
+#   Copyright (C) 2004-2005, 2007-2009, 2011-2019, 2021-2022 Free
+#   Software Foundation, Inc.
 #   Written by Gary V. Vaughan, 2004
 #
 # This file is free software; the Free Software Foundation gives
@@ -8797,7 +8852,7 @@ LT_OPTION_DEFINE([LTDL_INIT], [convenience],

 # ltsugar.m4 -- libtool m4 base layer.                         -*-Autoconf-*-
 #
-# Copyright (C) 2004-2005, 2007-2008, 2011-2015 Free Software
+# Copyright (C) 2004-2005, 2007-2008, 2011-2019, 2021-2022 Free Software
 # Foundation, Inc.
 # Written by Gary V. Vaughan, 2004
 #
@@ -8922,7 +8977,8 @@ m4_define([lt_dict_filter],

 # ltversion.m4 -- version numbers			-*- Autoconf -*-
 #
-#   Copyright (C) 2004, 2011-2015 Free Software Foundation, Inc.
+#   Copyright (C) 2004, 2011-2019, 2021-2022 Free Software Foundation,
+#   Inc.
 #   Written by Scott James Remnant, 2004
 #
 # This file is free software; the Free Software Foundation gives
@@ -8931,23 +8987,23 @@ m4_define([lt_dict_filter],

 # @configure_input@

-# serial 4179 ltversion.m4
+# serial 4245 ltversion.m4
 # This file is part of GNU Libtool

-m4_define([LT_PACKAGE_VERSION], [2.4.6])
-m4_define([LT_PACKAGE_REVISION], [2.4.6])
+m4_define([LT_PACKAGE_VERSION], [2.4.7])
+m4_define([LT_PACKAGE_REVISION], [2.4.7])

 AC_DEFUN([LTVERSION_VERSION],
-[macro_version='2.4.6'
-macro_revision='2.4.6'
+[macro_version='2.4.7'
+macro_revision='2.4.7'
 _LT_DECL(, macro_version, 0, [Which release of libtool.m4 was used?])
 _LT_DECL(, macro_revision, 0)
 ])

 # lt~obsolete.m4 -- aclocal satisfying obsolete definitions.    -*-Autoconf-*-
 #
-#   Copyright (C) 2004-2005, 2007, 2009, 2011-2015 Free Software
-#   Foundation, Inc.
+#   Copyright (C) 2004-2005, 2007, 2009, 2011-2019, 2021-2022 Free
+#   Software Foundation, Inc.
 #   Written by Scott James Remnant, 2004.
 #
 # This file is free software; the Free Software Foundation gives
@@ -9044,8 +9100,8 @@ m4_ifndef([_LT_PROG_F77],		[AC_DEFUN([_LT_PROG_F77])])
 m4_ifndef([_LT_PROG_FC],		[AC_DEFUN([_LT_PROG_FC])])
 m4_ifndef([_LT_PROG_CXX],		[AC_DEFUN([_LT_PROG_CXX])])

-# pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
-# serial 11 (pkg-config-0.29.1)
+# pkg.m4 - Macros to locate and use pkg-config.   -*- Autoconf -*-
+# serial 12 (pkg-config-0.29.2)

 dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
 dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
@@ -9087,7 +9143,7 @@ dnl
 dnl See the "Since" comment for each macro you use to see what version
 dnl of the macros you require.
 m4_defun([PKG_PREREQ],
-[m4_define([PKG_MACROS_VERSION], [0.29.1])
+[m4_define([PKG_MACROS_VERSION], [0.29.2])
 m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1,
    [m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])])
 ])dnl PKG_PREREQ
@@ -9132,7 +9188,7 @@ dnl Check to see whether a particular set of modules exists. Similar to
 dnl PKG_CHECK_MODULES(), but does not set variables or print errors.
 dnl
 dnl Please remember that m4 expands AC_REQUIRE([PKG_PROG_PKG_CONFIG])
-dnl only at the first occurence in configure.ac, so if the first place
+dnl only at the first occurrence in configure.ac, so if the first place
 dnl it's called might be skipped (such as if it is within an "if", you
 dnl have to call PKG_CHECK_EXISTS manually
 AC_DEFUN([PKG_CHECK_EXISTS],
@@ -9188,7 +9244,7 @@ AC_ARG_VAR([$1][_CFLAGS], [C compiler flags for $1, overriding pkg-config])dnl
 AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl

 pkg_failed=no
-AC_MSG_CHECKING([for $1])
+AC_MSG_CHECKING([for $2])

 _PKG_CONFIG([$1][_CFLAGS], [cflags], [$2])
 _PKG_CONFIG([$1][_LIBS], [libs], [$2])
@@ -9198,17 +9254,17 @@ and $1[]_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details.])

 if test $pkg_failed = yes; then
-   	AC_MSG_RESULT([no])
+        AC_MSG_RESULT([no])
        _PKG_SHORT_ERRORS_SUPPORTED
        if test $_pkg_short_errors_supported = yes; then
-	        $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
-        else 
-	        $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
+                $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
+        else
+                $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
        fi
-	# Put the nasty error message in config.log where it belongs
-	echo "$$1[]_PKG_ERRORS" >&AS_MESSAGE_LOG_FD
+        # Put the nasty error message in config.log where it belongs
+        echo "$$1[]_PKG_ERRORS" >&AS_MESSAGE_LOG_FD

-	m4_default([$4], [AC_MSG_ERROR(
+        m4_default([$4], [AC_MSG_ERROR(
 [Package requirements ($2) were not met:

 $$1_PKG_ERRORS
@@ -9219,8 +9275,8 @@ installed software in a non-standard prefix.
 _PKG_TEXT])[]dnl
        ])
 elif test $pkg_failed = untried; then
-     	AC_MSG_RESULT([no])
-	m4_default([$4], [AC_MSG_FAILURE(
+        AC_MSG_RESULT([no])
+        m4_default([$4], [AC_MSG_FAILURE(
 [The pkg-config script could not be found or is too old.  Make sure it
 is in your PATH or set the PKG_CONFIG environment variable to the full
 path to pkg-config.
@@ -9230,10 +9286,10 @@ _PKG_TEXT
 To get pkg-config, see <http://pkg-config.freedesktop.org/>.])[]dnl
        ])
 else
-	$1[]_CFLAGS=$pkg_cv_[]$1[]_CFLAGS
-	$1[]_LIBS=$pkg_cv_[]$1[]_LIBS
+        $1[]_CFLAGS=$pkg_cv_[]$1[]_CFLAGS
+        $1[]_LIBS=$pkg_cv_[]$1[]_LIBS
        AC_MSG_RESULT([yes])
-	$3
+        $3
 fi[]dnl
 ])dnl PKG_CHECK_MODULES

@@ -9390,7 +9446,7 @@ AS_IF([test "$AS_TR_SH([with_]m4_tolower([$1]))" = "yes"],

 # AM_CONDITIONAL                                            -*- Autoconf -*-

-# Copyright (C) 1997-2020 Free Software Foundation, Inc.
+# Copyright (C) 1997-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -9421,7 +9477,7 @@ AC_CONFIG_COMMANDS_PRE(
 Usually this means the macro was only invoked conditionally.]])
 fi])])

-# Copyright (C) 2006-2020 Free Software Foundation, Inc.
+# Copyright (C) 2006-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -143,6 +143,12 @@ redis_connect(const char* host, int port, const char* path,
 {
 	struct timeval now_val;
 	redisContext* ctx;
+#ifdef THREADS_DISABLED
+	/* Fix attribute unused warning.
+	 * wait_lock is only used with lock_basic_* functions that are nop'ed
+	 * when compiled without thread support. */
+	(void)wait_lock;
+#endif /* THREADS_DISABLED */

 	/* See if the redis server is down, and reconnect has to wait. */
 	if(*reconnect_attempts > REDIS_RECONNECT_ATTEMPT_LIMIT) {
@@ -12,14 +12,14 @@ sinclude(dnscrypt/dnscrypt.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[24])
-m4_define([VERSION_MICRO],[1])
+m4_define([VERSION_MICRO],[2])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])

 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=34
+LIBUNBOUND_REVISION=35
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -121,6 +121,7 @@ LIBUNBOUND_AGE=1
 # 1.23.1 had 9:32:1
 # 1.24.0 had 9:33:1
 # 1.24.1 had 9:34:1
+# 1.24.2 had 9:35:1

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -1253,7 +1254,7 @@ case "$enable_ecdsa" in
 	      # see if OPENSSL 1.0.0 or later (has EVP MD and Verify independency)
 	      AC_MSG_CHECKING([if openssl supports SHA2 and ECDSA with EVP])
 	      if grep OPENSSL_VERSION_TEXT $ssldir_include/openssl/opensslv.h | grep "OpenSSL" >/dev/null; then
-		if grep OPENSSL_VERSION_NUMBER $ssldir_include/openssl/opensslv.h | grep 0x0 >/dev/null; then
+		if grep OPENSSL_VERSION_TEXT $ssldir_include/openssl/opensslv.h | grep "OpenSSL 0\." >/dev/null; then
 		  AC_MSG_RESULT([no])
 		  AC_DEFINE_UNQUOTED([USE_ECDSA_EVP_WORKAROUND], [1], [Define this to enable an EVP workaround for older openssl])
 		else
@@ -1673,10 +1674,12 @@ if test x_$enable_static_exe = x_yes; then
 			LIBS="$LIBS -lgdi32"
 		fi
 		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
-		if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
-			:
-		else
-			LIBS="$LIBS -l:libssp.a"
+		if echo "$host" | $GREP -i -e linux >/dev/null; then
+			if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
+				:
+			else
+				LIBS="$LIBS -l:libssp.a"
+			fi
 		fi
 	fi
 fi
@@ -1694,10 +1697,12 @@ if test x_$enable_fully_static = x_yes; then
 			LIBS="$LIBS -lgdi32"
 		fi
 		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
-		if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
-			:
-		else
-			LIBS="$LIBS -l:libssp.a"
+		if echo "$host" | $GREP -i -e linux >/dev/null; then
+			if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
+				:
+			else
+				LIBS="$LIBS -l:libssp.a"
+			fi
 		fi
 	fi
 fi
@@ -1,21 +1,22 @@
 #!/usr/bin/env bash
+OPENSSL_VERSION=1.1.1d

 echo "Downloading OpenSSL"
-if ! curl -L -k -s -o openssl-1.1.1d.tar.gz https://www.openssl.org/source/openssl-1.1.1d.tar.gz;
+if ! curl -L -k -s -o openssl-$OPENSSL_VERSION.tar.gz https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz;
 then
    echo "Failed to download OpenSSL"
    exit 1
 fi

 echo "Unpacking OpenSSL"
-rm -rf ./openssl-1.1.1d
-if ! tar -xf openssl-1.1.1d.tar.gz;
+rm -rf ./openssl-$OPENSSL_VERSION
+if ! tar -xf openssl-$OPENSSL_VERSION.tar.gz;
 then
    echo "Failed to unpack OpenSSL"
    exit 1
 fi

-cd openssl-1.1.1d || exit 1
+cd openssl-$OPENSSL_VERSION || exit 1

 if ! cp ../contrib/ios/15-ios.conf Configurations/; then
    echo "Failed to copy OpenSSL ios config"
@@ -27,7 +28,8 @@ fi
 # Also see https://github.com/openssl/openssl/issues/7607.
 if ! patch -u -p0 < ../contrib/ios/openssl.patch; then
    echo "Failed to patch OpenSSL"
-    exit 1
+    # the partial patch may be useful.
+    #exit 1
 fi

 echo "Configuring OpenSSL"
@@ -175,6 +175,7 @@ fi
 # For example, remove 4.3, 6.2, and 6.1 if they are not installed. We go back to
 # the 1.0 SDKs because Apple WatchOS uses low numbers, like 2.0 and 2.1.
 XCODE_SDK=
+if test -z "$SDK_VERSION"; then
 for i in $(seq -f "%.1f" 30.0 -0.1 1.0)
 do
    if [ -d "$XCODE_DEVELOPER_SDK/Developer/SDKs/$IOS_SDK$i.sdk" ]; then
@@ -182,6 +183,10 @@ do
        break
    fi
 done
+else
+    i="$SDK_VERSION"
+    XCODE_SDK="$IOS_SDK$i.sdk"
+fi

 # Error checking
 if [ -z "$XCODE_SDK" ]; then
@@ -77,6 +77,7 @@
 #include "util/storage/lookup3.h"
 #include "util/storage/slabhash.h"
 #include "util/tcp_conn_limit.h"
+#include "util/allow_response_list.h"
 #include "util/edns.h"
 #include "services/listen_dnsport.h"
 #include "services/cache/rrset.h"
@@ -298,6 +299,16 @@ daemon_init(void)
 		free(daemon);
 		return NULL;
 	}
+	daemon->arl = arl_list_create();
+	if(!daemon->arl) {
+		acl_list_delete(daemon->acl_interface);
+		acl_list_delete(daemon->acl);
+		tcl_list_delete(daemon->tcl);
+		edns_known_options_delete(daemon->env);
+		free(daemon->env);
+		free(daemon);
+		return NULL;
+	}
 	listen_setup_locks();
 	if(gettimeofday(&daemon->time_boot, NULL) < 0)
 		log_err("gettimeofday: %s", strerror(errno));
@@ -306,6 +317,7 @@ daemon_init(void)
 		acl_list_delete(daemon->acl_interface);
 		acl_list_delete(daemon->acl);
 		tcl_list_delete(daemon->tcl);
+		arl_list_delete(daemon->arl);
 		edns_known_options_delete(daemon->env);
 		free(daemon->env);
 		free(daemon);
@@ -316,6 +328,7 @@ daemon_init(void)
 		acl_list_delete(daemon->acl_interface);
 		acl_list_delete(daemon->acl);
 		tcl_list_delete(daemon->tcl);
+		arl_list_delete(daemon->arl);
 		edns_known_options_delete(daemon->env);
 		free(daemon->env);
 		free(daemon);
@@ -326,6 +339,7 @@ daemon_init(void)
 		acl_list_delete(daemon->acl_interface);
 		acl_list_delete(daemon->acl);
 		tcl_list_delete(daemon->tcl);
+		arl_list_delete(daemon->arl);
 		edns_known_options_delete(daemon->env);
 		edns_strings_delete(daemon->env->edns_strings);
 		free(daemon->env);
@@ -741,6 +755,8 @@ daemon_fork(struct daemon* daemon)
 		fatal_exit("Could not setup interface control list");
 	if(!tcl_list_apply_cfg(daemon->tcl, daemon->cfg))
 		fatal_exit("Could not setup TCP connection limits");
+	if(!arl_list_apply_cfg(daemon->arl, daemon->cfg))
+		fatal_exit("Could not setup allow response list");
 	if(daemon->cfg->dnscrypt) {
 #ifdef USE_DNSCRYPT
 		daemon->dnscenv = dnsc_create();
@@ -968,6 +984,7 @@ daemon_delete(struct daemon* daemon)
 	acl_list_delete(daemon->acl);
 	acl_list_delete(daemon->acl_interface);
 	tcl_list_delete(daemon->tcl);
+	arl_list_delete(daemon->arl);
 	cookie_secrets_delete(daemon->cookie_secrets);
 	listen_desetup_locks();
 	free(daemon->chroot);
@@ -133,6 +133,8 @@ struct daemon {
 	struct acl_list* acl_interface;
 	/** TCP connection limit, limit connections from client IPs */
 	struct tcl_list* tcl;
+	/** allow response list, to cache responses send by client IPs */
+	struct arl_list* arl;
 	/** local authority zones */
 	struct local_zones* local_zones;
 	/** last time of statistics printout */
@@ -97,6 +97,7 @@
 #include "sldns/sbuffer.h"
 #include "util/timeval_func.h"
 #include "util/tcp_conn_limit.h"
+#include "util/allow_response_list.h"
 #include "util/edns.h"
 #include "util/tsig.h"
 #ifdef USE_CACHEDB
@@ -4646,6 +4647,8 @@ struct fast_reload_construct {
 	struct acl_list* acl_interface;
 	/** construct for tcp connection limit */
 	struct tcl_list* tcl;
+	/** construct for allow response list */
+	struct arl_list* arl;
 	/** tsig key table */
 	struct tsig_key_table* tsig_key_table;
 	/** construct for local zones */
@@ -5034,6 +5037,7 @@ fr_construct_clear(struct fast_reload_construct* ct)
 	acl_list_delete(ct->acl);
 	acl_list_delete(ct->acl_interface);
 	tcl_list_delete(ct->tcl);
+	arl_list_delete(ct->arl);
 	tsig_key_table_delete(ct->tsig_key_table);
 	edns_strings_delete(ct->edns_strings);
 	anchors_delete(ct->anchors);
@@ -5233,6 +5237,7 @@ config_file_getmem(struct config_file* cfg)
 	m += getmem_config_str3list(cfg->acl_tag_datas);
 	m += getmem_config_str2list(cfg->acl_view);
 	m += getmem_config_str2list(cfg->interface_actions);
+	m += getmem_config_str2list(cfg->allow_response_list);
 	m += getmem_config_strbytelist(cfg->interface_tags);
 	m += getmem_config_str3list(cfg->interface_tag_actions);
 	m += getmem_config_str3list(cfg->interface_tag_datas);
@@ -5307,6 +5312,7 @@ fr_printmem(struct fast_reload_thread* fr,
 	mem += acl_list_get_mem(ct->acl);
 	mem += acl_list_get_mem(ct->acl_interface);
 	mem += tcl_list_get_mem(ct->tcl);
+	mem += arl_list_get_mem(ct->arl);
 	mem += edns_strings_get_mem(ct->edns_strings);
 	mem += anchors_get_mem(ct->anchors);
 	mem += sizeof(*ct->oldcfg);
@@ -5596,6 +5602,17 @@ fr_construct_from_config(struct fast_reload_thread* fr,
 	if(fr_poll_for_quit(fr))
 		return 1;

+	if(!(ct->arl = arl_list_create())) {
+		fr_construct_clear(ct);
+		return 0;
+	}
+	if(!arl_list_apply_cfg(ct->arl, newcfg)) {
+		fr_construct_clear(ct);
+		return 0;
+	}
+	if(fr_poll_for_quit(fr))
+		return 1;
+
 	if(!(ct->tsig_key_table = tsig_key_table_create())) {
 		fr_construct_clear(ct);
 		return 0;
@@ -6061,6 +6078,7 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	*/
 	COPY_VAR_ptr(acl_view);
 	COPY_VAR_ptr(interface_actions);
+	COPY_VAR_ptr(allow_response_list);
 	/* These reference tags
 	COPY_VAR_ptr(interface_tags);
 	COPY_VAR_ptr(interface_tag_actions);
@@ -6203,6 +6221,7 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_ptr(ipset_name_v6);
 #endif
 	COPY_VAR_int(ede);
+	COPY_VAR_int(iter_scrub_promiscuous);
 }
 #endif /* ATOMIC_POINTER_LOCK_FREE && HAVE_LINK_ATOMIC_STORE */

@@ -6418,6 +6437,7 @@ fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg,
 	acl_list_swap_tree(daemon->acl, ct->acl);
 	acl_list_swap_tree(daemon->acl_interface, ct->acl_interface);
 	tcl_list_swap_tree(daemon->tcl, ct->tcl);
+	arl_list_swap_tree(daemon->arl, ct->arl);
 	tsig_key_table_swap_tree(daemon->env->tsig_key_table,
 		ct->tsig_key_table);
 	local_zones_swap_tree(daemon->local_zones, ct->local_zones);
@@ -43,6 +43,7 @@
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/random.h"
+#include "util/tsig.h"
 #include "daemon/worker.h"
 #include "daemon/daemon.h"
 #include "daemon/remote.h"
@@ -79,11 +80,13 @@
 #include "respip/respip.h"
 #include "libunbound/context.h"
 #include "libunbound/libworker.h"
+#include "sldns/parseutil.h"
 #include "sldns/sbuffer.h"
 #include "sldns/wire2str.h"
 #include "util/shm_side/shm_main.h"
 #include "dnscrypt/dnscrypt.h"
 #include "dnstap/dtstream.h"
+#include "util/allow_response_list.h"

 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
@@ -273,6 +276,11 @@ worker_handle_service_reply(struct comm_point* c, void* arg, int error,
 	return 0;
 }

+#define REQUEST_OK        0
+#define DROP_REQUEST     -1
+#define RESPONSE_MESSAGE -2
+
+
 /** ratelimit error replies
 * @param worker: the worker struct with ratelimit counter
 * @param err: error code that would be wanted.
@@ -284,7 +292,7 @@ worker_err_ratelimit(struct worker* worker, int err)
 	if(worker->err_limit_time == *worker->env.now) {
 		/* see if limit is exceeded for this second */
 		if(worker->err_limit_count++ > ERROR_RATELIMIT)
-			return -1;
+			return DROP_REQUEST;
 	} else {
 		/* new second, new limits */
 		worker->err_limit_time = *worker->env.now;
@@ -297,6 +305,9 @@ worker_err_ratelimit(struct worker* worker, int err)
 * Structure holding the result of the worker_check_request function.
 * Based on configuration it could be called up to four times; ideally should
 * be called once.
+ * When value is a positive number, it contains the error to return.
+ * Otherwise DROP_REQUEST (-1) is returned, or RESPONSE_MESSAGE (-2) in
+ * case the qr bit was set. Value is set to REQUEST_OK (0) if all is good.
 */
 struct check_request_result {
 	int checked;
@@ -315,18 +326,18 @@ worker_check_request(sldns_buffer* pkt, struct worker* worker,
 	out->checked = 1;
 	if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) {
 		verbose(VERB_QUERY, "request too short, discarded");
-		out->value = -1;
+		out->value = DROP_REQUEST;
 		return;
 	}
 	if(sldns_buffer_limit(pkt) > NORMAL_UDP_SIZE &&
 		worker->daemon->cfg->harden_large_queries) {
 		verbose(VERB_QUERY, "request too large, discarded");
-		out->value = -1;
+		out->value = DROP_REQUEST;
 		return;
 	}
 	if(LDNS_QR_WIRE(sldns_buffer_begin(pkt))) {
-		verbose(VERB_QUERY, "request has QR bit on, discarded");
-		out->value = -1;
+		/* verbose(VERB_QUERY, "request has QR bit on, discarded"); */
+		out->value = RESPONSE_MESSAGE;
 		return;
 	}
 	if(LDNS_TC_WIRE(sldns_buffer_begin(pkt))) {
@@ -368,10 +379,39 @@ worker_check_request(sldns_buffer* pkt, struct worker* worker,
 		out->value = worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 		return;
 	}
-	out->value = 0;
+	out->value = REQUEST_OK;
 	return;
 }

+/** check response sanity.
+ * @param pkt: the wire packet to examine for sanity.
+ * @param worker: parameters for checking.
+ * @param out: 1 on success, otherwise 0.
+*/
+static int
+worker_check_response(sldns_buffer* pkt, struct worker* worker)
+{
+	if(LDNS_TC_WIRE(sldns_buffer_begin(pkt))) {
+		LDNS_TC_CLR(sldns_buffer_begin(pkt));
+		verbose(VERB_QUERY, "response bad, has TC bit on");
+		return 0;
+	}
+	if(LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_QUERY) {
+		verbose(VERB_QUERY, "not a query response");
+		return 0;
+	}
+	if(LDNS_QDCOUNT(sldns_buffer_begin(pkt)) != 1) {
+		verbose(VERB_QUERY, "request wrong nr qd=%d",
+			LDNS_QDCOUNT(sldns_buffer_begin(pkt)));
+		return 0;
+	}
+	if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) == 0) {
+		verbose(VERB_QUERY, "response must be an answer message");
+		return 0;
+	}
+	return 1;
+}
+
 /**
 * Send fast-reload acknowledgement to the mainthread in one byte.
 * This signals that this worker has received the previous command.
@@ -1265,8 +1305,8 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		if(worker->stats.extended)
 			worker->stats.unwanted_queries++;
 		worker_check_request(c->buffer, worker, check_result);
-		if(check_result->value != 0) {
-			if(check_result->value != -1) {
+		if(check_result->value != REQUEST_OK) {
+			if(check_result->value > 0) {
 				LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
 					check_result->value);
@@ -1543,7 +1583,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		char buf[LDNS_MAX_DOMAINLEN];
 		/* Check if this is unencrypted and asking for certs */
 		worker_check_request(c->buffer, worker, &check_result);
-		if(check_result.value != 0) {
+		if(check_result.value != REQUEST_OK) {
 			verbose(VERB_ALGO,
 				"dnscrypt: worker check request: bad query.");
 			log_addr(VERB_CLIENT,"from",&repinfo->client_addr,
@@ -1606,10 +1646,95 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	}

 	worker_check_request(c->buffer, worker, &check_result);
-	if(check_result.value != 0) {
+	if (check_result.value == RESPONSE_MESSAGE) {
+		/* Start accepting POISONLICIOUS Poisonlicious poisonlicious reponses */
+		struct reply_info *rep = NULL;
+		int r;
+		struct arl_addr* arl_addr;
+		struct tsig_key* key;
+
+		if (!worker_check_response(c->buffer, worker)) {
+			verbose(VERB_ALGO, "bad response");
+			log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
+			comm_point_drop_reply(repinfo);
+			return 0;
+		}
+		arl_addr = arl_addr_lookup(worker->daemon->arl,
+				&repinfo->client_addr, repinfo->client_addrlen);
+		if(!arl_addr) {
+			verbose(VERB_ALGO, "ip not in \"allow-response:\" list");
+			log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
+			comm_point_drop_reply(repinfo);
+			if(worker->stats.extended)
+				worker->stats.unwanted_queries++;
+			return 0;
+		}
+		if(arl_addr->tsig_key_name == NULL ||
+				arl_addr->tsig_key_name == TSIG_BLOCKED) {
+			verbose(VERB_ALGO, "ip blocked in \"allow-response:\" list");
+			log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
+			comm_point_drop_reply(repinfo);
+			if(worker->stats.extended)
+				worker->stats.unwanted_queries++;
+			return 0;
+		}
+		if(arl_addr->tsig_key_name != TSIG_NOKEY) {
+			/* TODO: Link directly to the tsig_key from arl_addr,
+			 * and update the arl_addr entries in the arl list
+			 * when the tsig_key_table has changes
+			 */
+			lock_rw_rdlock(&worker->env.tsig_key_table->lock);
+			key = tsig_key_table_search_fromstr(worker->env.tsig_key_table,
+					arl_addr->tsig_key_name);
+			if (!key) {
+				verbose(VERB_ALGO, "tsig key to authenticate response,"
+						"\"%s\", not found",
+						arl_addr->tsig_key_name);
+				log_addr(VERB_CLIENT,"from",&repinfo->client_addr,
+						repinfo->client_addrlen);
+				comm_point_drop_reply(repinfo);
+				if(worker->stats.extended)
+					worker->stats.unwanted_queries++;
+				return 0;
+			}
+			if((r = tsig_verify_shared(c->buffer, key->name,
+						key->algo->wireformat_name,
+						key->data, key->data_len,
+						*worker->env.now))) {
+				lock_rw_unlock(&worker->env.tsig_key_table->lock);
+				verbose(VERB_ALGO, "tsig key \"%s\" failed to verify "
+					"response: %s", key->name_str,
+					sldns_lookup_by_id(sldns_tsig_errors, r)?
+					sldns_lookup_by_id(sldns_tsig_errors, r)->name:"??");
+				log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
+				comm_point_drop_reply(repinfo);
+				return 0;
+			}
+			lock_rw_unlock(&worker->env.tsig_key_table->lock);
+		}
+		if((r = reply_info_parse(c->buffer, worker->env.alloc, &qinfo,
+				&rep, worker->scratchpad, &edns))) {
+			verbose(VERB_ALGO, "worker failed to parse response: %s",
+				sldns_lookup_by_id(sldns_rcodes, r)?
+				sldns_lookup_by_id(sldns_rcodes, r)->name:"??");
+			log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
+			comm_point_drop_reply(repinfo);
+			return 0;
+		}
+		log_query_info(VERB_ALGO, "storing response in cache", &qinfo);
+		log_addr(VERB_CLIENT,"for",&repinfo->client_addr, repinfo->client_addrlen);
+
+		dns_cache_store(&worker->env, &qinfo, rep, 0 /* is_referral */,
+				0 /* leeway */, 0 /* pside */,
+				NULL /* region */, 0 /* flags */,
+				*worker->env.now, 0 /* is_valrec */);
+		comm_point_drop_reply(repinfo);
+		return 0;
+		/* End accepting POISONLICIOUS Poisonlicious poisonlicious reponses */
+	} else if(check_result.value != REQUEST_OK) {
 		verbose(VERB_ALGO, "worker check request: bad query.");
 		log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
-		if(check_result.value != -1) {
+		if(check_result.value > REQUEST_OK) {
 			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
 				check_result.value);
@@ -2315,7 +2440,8 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		worker->daemon->connect_dot_sslctx, cfg->delay_close,
 		cfg->tls_use_sni, dtenv, cfg->udp_connect,
 		cfg->max_reuse_tcp_queries, cfg->tcp_reuse_timeout,
-		cfg->tcp_auth_query_timeout);
+		cfg->tcp_auth_query_timeout, (const char**)cfg->dist,
+		(const char**)cfg->dist_tsig, cfg->num_dist);
 	if(!worker->back) {
 		log_err("could not create outgoing sockets");
 		worker_delete(worker);
@@ -1,3 +1,52 @@
+27 October 2025: Yorgos
+	- Merge #1331 from Jitka Plesníková: Replace deprecated $function by
+	  new $action, for SWIG.
+	- Fix #1165, document the possible circular dependency when using
+	  host names instead of IP addresses for name servers in stub/forward
+	  zones and log a warning when spotted in the configuration.
+
+24 October 2025: Yorgos
+	- unbound.conf man page updates to include a preview of the section
+	  clauses and some reformatting around the use of "clause", "option"
+	  and "attributes". Based on Havard Eidnes' suggestions on the
+	  mailing list.
+	- Fix unused attribute warning in redis.c when threads are not
+	  supported.
+	- For #1364, use OPENSSL_VERSION_TEXT instead of OPENSSL_VERSION_NUMBER
+	  for part of the configure script. OPENSSL_VERSION_TEXT is more
+	  consistent across versions.
+
+22 October 2025: Yorgos
+	- Tag for 1.24.1 release.
+	  The repository continues with version 1.24.2.
+
+15 October 2025: Wouter
+	- Fix to drop UDP for discard-timeout, but not stream connections.
+	- Fix to reply with SERVFAIL when the wait-limit is exceeded.
+	- Add extended dns error code for invalid query type to definition
+	  list.
+	- Fix unbound.conf man page entry for root-hints to say it can
+	  be used without strongly recommending it.
+	- Remove iPhone armv7s, and iPhoneSimulator i386 from ios ci.
+	  The lib system does not provide symbols for it on the new macos
+	  runner.
+	- Fix to exclude libssp for windows compiles.
+
+10 October 2025: Wouter
+	- Fix #1358 Enabling FIPS in OpenSSL causes unit test to fail.
+
+3 October 2025: Yorgos
+	- Note 'respip' and 'dns64' module order in the unbound.conf
+	  man page.
+	- Note clearly that 'wait-limit: 0' disables all wait limits.
+	- 'wait-limit-cookie: 0' can now disable cookie validated wait
+	  limits.
+
+2 October 2025: Wouter
+	- Fix that https is set up as enabled when the port is listed in
+	  interface-automatic-ports. Also for the set up of quic it is
+	  enabled when listed there.
+
 30 September 2025: Wouter
 	- Fix for #1344: Fix that respip and dns64 can be enabled at the
 	  same time, the client info is copied for attach_sub and add_sub
@@ -196,6 +196,10 @@ server:
 	# Limit on upstream queries for an incoming query and its recursion.
 	# max-global-quota: 200

+	# Should the scrubber remove promiscuous NS from positive answers,
+	# protects against poison attempts.
+	# iter-scrub-promiscuous: yes
+
 	# msec for waiting for an unknown server to reply.  Increase if you
 	# are behind a slow satellite link, to eg. 1128.
 	# unknown-server-time-limit: 376
@@ -922,6 +926,22 @@ server:
 	# add a netblock specific override to a localzone, with zone type
 	# local-zone-override: "example.com" 192.0.2.0/24 refuse

+	# Action to apply when the IP address in an AAAA or A RR in the answer
+	# section of a response matches the specified IP netblock.
+	# Requires use of the respip module.
+	# response-ip: 192.0.2.0/24 redirect
+
+	# Redirect as specified by the "resource record string" when the IP
+	# address in an AAAA or A RR in the answer section of a response
+	# matches the specified IP netblock.
+	# Requires use of the respip module.
+	# response-ip-data: 192.0.2.0/24 "example. A 192.0.2.1"
+
+	# Apply tag(s) when the IP address in an AAAA or A RR in the answer
+	# section of a response matches the specified IP netblock.
+	# Requires use of the respip module.
+	# response-ip-tag: 192.0.2.0/24 "tag1 tag2"
+
 	# service clients over TLS (on the TCP sockets) with plain DNS inside
 	# the TLS stream, and over HTTPS using HTTP/2 as specified in RFC8484.
 	# Give the certificate to use and private key.
@@ -1267,10 +1287,11 @@ remote-control:
 #	zonefile: "example.org.zone"

 # Views
-# Create named views. Name must be unique. Map views to requests using
-# the access-control-view option. Views can contain zero or more local-zone
-# and local-data options. Options from matching views will override global
-# options. Global options will be used if no matching view is found.
+# Create named views. Name must be unique.
+# Map views to requests using the access-control-view/interface-view options.
+# Views can contain zero or more local-zone and local-data options.
+# Options from matching views will override global options.
+# Global options will be used if no matching view is found.
 # With view-first yes, it will try to answer using the global local-zone and
 # local-data elements if there is no view specific match.
 # view:
@@ -1278,6 +1299,8 @@ remote-control:
 #	local-zone: "example.com" redirect
 #	local-data: "example.com A 192.0.2.3"
 #	local-data-ptr: "192.0.2.3 www.example.com"
+#	response-ip: 192.0.2.0/24 redirect
+#	response-ip-data: 192.0.2.0/24 "example. A 192.0.2.1"
 #	view-first: no
 # view:
 #	name: "anotherview"
@@ -167,6 +167,7 @@ ipset,
 \fI\%tcp\-reuse\-timeout\fP,
 \fI\%tcp\-auth\-query\-timeout\fP,
 \fI\%delay\-close\fP\&.
+\fI\%iter\-scrub\-promiscuous\fP\&.
 .sp
 It does not work with
 \fI\%interface\fP and
@@ -170,6 +170,7 @@ There are several commands that the server understands.
    :ref:`tcp-reuse-timeout<unbound.conf.tcp-reuse-timeout>`,
    :ref:`tcp-auth-query-timeout<unbound.conf.tcp-auth-query-timeout>`,
    :ref:`delay-close<unbound.conf.delay-close>`.
+    :ref:`iter-scrub-promiscuous<unbound.conf.iter-scrub-promiscuous>`.

    It does not work with
    :ref:`interface<unbound.conf.interface>` and
@@ -36,44 +36,49 @@ unbound.conf \- Unbound @version@ configuration file.
 .SH DESCRIPTION
 .sp
 \fBunbound.conf\fP is used to configure \fI\%unbound(8)\fP\&.
-The file format has attributes and values.
-Some attributes have attributes inside them.
-The notation is: \fBattribute: value\fP\&.
-.sp
-Comments start with \fB#\fP and last to the end of line.
-Empty lines are ignored as is whitespace at the beginning of a line.
 .sp
 The utility \fI\%unbound\-checkconf(8)\fP can be
 used to check \fBunbound.conf\fP prior to usage.
+.SH FILE FORMAT
+.sp
+Whitespace is used to separate keywords.
+Whitespace indentation is insignificant, but is still recommended for visual
+clarity.
+Comments start with \fB#\fP and last to the end of line.
+Empty lines are ignored, as is whitespace at the beginning of a line.
+.sp
+Attribute keywords end with a colon (\fB:\fP) and they are either options or
+section clauses (group options together).
+.sp
+The configuration file is logically divided into \fBsections\fP where each section
+is introduced by a \fI\%section clause\fP\&.
 .SH EXAMPLE
 .sp
-An example config file is shown below.
-Copy this to \fB/etc/unbound/unbound.conf\fP and start the server with:
+An example minimal config file is shown below; most settings are the defaults.
+Copy this to \fB@ub_conf_file@\fP and start the server with:
 .INDENT 0.0
 .INDENT 3.5
 .sp
 .nf
 .ft C
-$ unbound \-c /etc/unbound/unbound.conf
+$ unbound \-c @ub_conf_file@
 .ft P
 .fi
 .UNINDENT
 .UNINDENT
 .sp
-Most settings are the defaults.
 Stop the server with:
 .INDENT 0.0
 .INDENT 3.5
 .sp
 .nf
 .ft C
-$ kill \(gacat /etc/unbound/unbound.pid\(ga
+$ kill \(gacat @UNBOUND_PIDFILE@\(ga
 .ft P
 .fi
 .UNINDENT
 .UNINDENT
 .sp
-Below is a minimal config file.
 The source distribution contains an extensive \fBexample.conf\fP file with
 all the options.
 .INDENT 0.0
@@ -83,15 +88,15 @@ all the options.
 .ft C
 # unbound.conf(5) config file for unbound(8).
 server:
-    directory: \(dq/etc/unbound\(dq
+    directory: \(dq@UNBOUND_RUN_DIR@\(dq
    username: unbound
    # make sure unbound can access entropy from inside the chroot.
    # e.g. on linux the use these commands (on BSD, devfs(8) is used):
-    #      mount \-\-bind \-n /dev/urandom /etc/unbound/dev/urandom
-    # and  mount \-\-bind \-n /dev/log /etc/unbound/dev/log
-    chroot: \(dq/etc/unbound\(dq
-    # logfile: \(dq/etc/unbound/unbound.log\(dq  #uncomment to use logfile.
-    pidfile: \(dq/etc/unbound/unbound.pid\(dq
+    #      mount \-\-bind \-n /dev/urandom @UNBOUND_RUN_DIR@/dev/urandom
+    # and  mount \-\-bind \-n /dev/log @UNBOUND_RUN_DIR@/dev/log
+    chroot: \(dq@UNBOUND_CHROOT_DIR@\(dq
+    # logfile: \(dq@UNBOUND_RUN_DIR@/unbound.log\(dq  #uncomment to use logfile.
+    pidfile: \(dq@UNBOUND_PIDFILE@\(dq
    # verbosity: 1      # uncomment and increase to get more logging.
    # listen on all interfaces, answer queries from the local subnet.
    interface: 0.0.0.0
@@ -102,14 +107,68 @@ server:
 .fi
 .UNINDENT
 .UNINDENT
-.SH FILE FORMAT
+.SH SECTION CLAUSES
 .sp
-There must be whitespace between keywords.
-Attribute keywords end with a colon \fB\(aq:\(aq\fP\&.
-An attribute is followed by a value, or its containing attributes in which case
-it is referred to as a clause.
-Clauses can be repeated throughout the file (or included files) to group
-attributes under the same clause.
+The recognized section clauses are:
+.INDENT 0.0
+.INDENT 3.5
+.INDENT 0.0
+.TP
+.B \fI\%server:\fP
+Most of the configuration is found in this section.
+.TP
+.B \fI\%remote\-control:\fP
+Configuration for the facility used by
+\fI\%unbound\-control(8)\fP\&.
+.TP
+.B \fI\%stub\-zone:\fP
+Configuration for a zone that redirects to specific authoritative name
+servers, e.g. for zones not generally available on the greater
+Internet.
+.TP
+.B \fI\%forward\-zone:\fP
+Configuration for a zone that forwards to specific DNS resolvers.
+.TP
+.B \fI\%auth\-zone:\fP
+Configuration for local authoritative zones.
+.TP
+.B \fI\%view:\fP
+Overriding a small subset of configuration for incoming requests.
+Requests are mapped to views with
+\fI\%access\-control\-view\fP and
+\fI\%interface\-view\fP\&.
+.TP
+.B \fI\%python:\fP
+Configuration for the optional \fBpython\fP script module.
+.TP
+.B \fI\%dynlib:\fP
+Configuration for the optional \fBdynlib\fP module that loads dynamic
+libraries into Unbound.
+.TP
+.B \fI\%dnscrypt:\fP
+Configuration for the optional DNSCrypt feature.
+.TP
+.B \fI\%cachedb:\fP
+Configuration for the optional \fBcachedb\fP module that can interface
+with second level caches, currently Redis or Redis\-complatible
+databases.
+.TP
+.B \fI\%dnstap:\fP
+Configuration of the optional dnstap logging feature; a flexible,
+structured binary log format for DNS software.
+.TP
+.B \fI\%rpz:\fP
+Configuration for Response Policy Zones that allows for DNS filtering.
+Requires the \fBrespip\fP module.
+.UNINDENT
+.UNINDENT
+.UNINDENT
+.sp
+Section clauses can be repeated throughout the file (or included files) to
+logically group options in one visually cohesive group.
+This may be particularly useful for the \fBserver:\fP clause with its myriad of
+options.
+.SH INCLUDING FILES
 .sp
 Files can be included using the \fBinclude:\fP directive.
 It can appear anywhere, it accepts a single file name as argument.
@@ -124,11 +183,11 @@ Wildcards can be used to include multiple files, see \fIglob(7)\fP\&.
 .sp
 For a more structural include option, the \fBinclude\-toplevel:\fP directive can
 be used.
-This closes whatever clause is currently active (if any) and forces the use of
-clauses in the included files and right after this directive.
-.SS Server Options
+This closes whatever section clause is currently active (if any) and forces the
+use of section clauses in the included files and right after this directive.
+.SH SERVER OPTIONS
 .sp
-These options are part of the \fBserver:\fP clause.
+These options are part of the \fBserver:\fP section.
 .INDENT 0.0
 .TP
 .B verbosity: \fI<number>\fP 
@@ -539,6 +598,9 @@ Default: 376
 The wait time in msec where recursion requests are dropped.
 This is to stop a large number of replies from accumulating.
 They receive no reply, the work item continues to recurse.
+For UDP the replies are dropped, for stream connections the reply
+is not dropped if the stream connection is still open ready to receive
+answers.
 It is nice to be a bit larger than
 \fI\%serve\-expired\-client\-timeout\fP
 if that is enabled.
@@ -554,7 +616,7 @@ The number of replies that can wait for recursion, for an IP address.
 This makes a ratelimit per IP address of waiting replies for recursion.
 It stops very large amounts of queries waiting to be returned to one
 destination.
-The value \fB0\fP disables wait limits.
+The value \fB0\fP disables all wait limits.
 .sp
 Default: 1000
 .UNINDENT
@@ -563,7 +625,11 @@ Default: 1000
 .B wait\-limit\-cookie: \fI<number>\fP 
 The number of replies that can wait for recursion, for an IP address
 that sent the query with a valid DNS Cookie.
-Since the cookie validates the client address, this limit can be higher.
+Since the cookie already validates the client address, this option allows
+to override a configured
+\fI\%wait\-limit\fP value usually with a higher one
+for cookie validated queries.
+The value \fB0\fP disables wait limits for cookie validated queries.
 .sp
 Default: 10000
 .UNINDENT
@@ -1153,8 +1219,8 @@ Default: no
 .INDENT 0.0
 .TP
 .B tls\-system\-cert: \fI<yes or no>\fP 
-This the same attribute as the
-\fI\%tls\-win\-cert\fP attribute, under a
+This the same as the
+\fI\%tls\-win\-cert\fP option, under a
 different name.
 Because it is not windows specific.
 .UNINDENT
@@ -1607,8 +1673,8 @@ implicit default \(dqaccess\-control: 127.0.0.0/8 allow\(dq option.
 .INDENT 3.5
 The interface needs to be already specified with
 \fI\%interface\fP and that any
-\fBaccess\-control*:\fP attribute overrides all \fBinterface\-*:\fP
-attributes for targeted clients.
+\fBaccess\-control*:\fP option overrides all \fBinterface\-*:\fP
+options for targeted clients.
 .UNINDENT
 .UNINDENT
 .UNINDENT
@@ -1623,8 +1689,8 @@ for interfaces.
 .INDENT 3.5
 The interface needs to be already specified with
 \fI\%interface\fP and that any
-\fBaccess\-control*:\fP attribute overrides all \fBinterface\-*:\fP
-attributes for targeted clients.
+\fBaccess\-control*:\fP option overrides all \fBinterface\-*:\fP
+options for targeted clients.
 .UNINDENT
 .UNINDENT
 .UNINDENT
@@ -1640,8 +1706,8 @@ but for interfaces.
 .INDENT 3.5
 The interface needs to be already specified with
 \fI\%interface\fP and that any
-\fBaccess\-control*:\fP attribute overrides all \fBinterface\-*:\fP
-attributes for targeted clients.
+\fBaccess\-control*:\fP option overrides all \fBinterface\-*:\fP
+options for targeted clients.
 .UNINDENT
 .UNINDENT
 .UNINDENT
@@ -1657,8 +1723,8 @@ for interfaces.
 .INDENT 3.5
 The interface needs to be already specified with
 \fI\%interface\fP and that any
-\fBaccess\-control*:\fP attribute overrides all \fBinterface\-*:\fP
-attributes for targeted clients.
+\fBaccess\-control*:\fP option overrides all \fBinterface\-*:\fP
+options for targeted clients.
 .UNINDENT
 .UNINDENT
 .UNINDENT
@@ -1673,8 +1739,8 @@ but for interfaces.
 .INDENT 3.5
 The interface needs to be already specified with
 \fI\%interface\fP and that any
-\fBaccess\-control*:\fP attribute overrides all \fBinterface\-*:\fP
-attributes for targeted clients.
+\fBaccess\-control*:\fP option overrides all \fBinterface\-*:\fP
+options for targeted clients.
 .UNINDENT
 .UNINDENT
 .UNINDENT
@@ -1751,7 +1817,7 @@ The logfile is appended to, in the following format:
 .UNINDENT
 .sp
 If this option is given, the \fI\%use\-syslog\fP
-attribute is internally set to \fBno\fP\&.
+option is internally set to \fBno\fP\&.
 .sp
 The logfile is reopened (for append) when the config file is reread, on
 SIGHUP.
@@ -1899,8 +1965,8 @@ Read the root hints from this file.
 Default is nothing, using builtin hints for the IN class.
 The file has the format of zone files, with root nameserver names and
 addresses only.
-The default may become outdated, when servers change, therefore it is good
-practice to use a root hints file.
+The default may become outdated, when servers change, and then it is
+possible to use a root hints file with specific servers.
 .sp
 Default: \(dq\(dq
 .UNINDENT
@@ -3368,7 +3434,7 @@ This specifies the action data for
 \fI\%response\-ip\fP with action being to redirect
 as specified by \fI<\(dqresource record string\(dq>\fP\&.
 \fI<\(dqResource record string\(dq>\fP is similar to that of
-\fI\%access\-control\-tag\-action\fP,
+\fI\%access\-control\-tag\-data\fP,
 but it must be of either AAAA, A or CNAME types.
 If the \fI<IP\-netblock>\fP is an IPv6/IPv4 prefix, the record must be AAAA/A
 respectively, unless it is a CNAME (which can be used for both versions of
@@ -3689,6 +3755,15 @@ Default: 200
 .UNINDENT
 .INDENT 0.0
 .TP
+.B iter\-scrub\-promiscuous: \fI<yes or no>\fP 
+Should the iterator scrubber remove promiscuous NS from positive answers.
+This protects against poisonous contents, that could affect names in the
+same zone as a spoofed packet.
+.sp
+Default: yes
+.UNINDENT
+.INDENT 0.0
+.TP
 .B fast\-server\-permil: \fI<number>\fP 
 Specify how many times out of 1000 to pick from the set of fastest servers.
 0 turns the feature off.
@@ -3829,17 +3904,18 @@ enabled to increase privacy on the outgoing reports.
 .sp
 Default: no
 .UNINDENT
-.SS Remote Control Options
+.SH REMOTE CONTROL OPTIONS
+.sp
+These options are part of the \fBremote\-control:\fP section and are the
+declarations for the remote control facility.
 .sp
-In the \fBremote\-control:\fP clause are the declarations for the remote control
-facility.
 If this is enabled, the \fI\%unbound\-control(8)\fP
 utility can be used to send commands to the running Unbound server.
-The server uses these clauses to setup TLSv1 security for the connection.
-The \fI\%unbound\-control(8)\fP utility also reads the
-\fBremote\-control:\fP section for options.
+The server uses these options to setup TLS security for the connection.
+The \fI\%unbound\-control(8)\fP utility also reads
+this \fBremote\-control:\fP section for options.
 To setup the correct self\-signed certificates use the
-\fIunbound\-control\-setup(8)\fP utility.
+\fBunbound\-control\-setup(8)\fP utility.
 .INDENT 0.0
 .TP
 .B control\-enable: \fI<yes or no>\fP 
@@ -3939,9 +4015,11 @@ This file is used by \fI\%unbound\-control(8)\fP\&.
 .sp
 Default: unbound_control.pem
 .UNINDENT
-.SS Stub Zone Options
+.SH STUB ZONE OPTIONS
 .sp
-There may be multiple \fBstub\-zone:\fP clauses.
+These options are part of the \fBstub\-zone:\fP section.
+.sp
+There may be multiple \fBstub\-zone:\fP sections.
 Each with a \fI\%name\fP and zero or more hostnames or
 IP addresses.
 For the stub zone this list of nameservers is used.
@@ -3980,9 +4058,10 @@ Consider adding \fI\%server\fP statements for
 \fI\%domain\-insecure\fP and for
 \fI\%local\-zone: <name> nodefault\fP
 for the zone if it is a locally served zone.
-The insecure clause stops DNSSEC from invalidating the zone.
+The \fI\%domain\-insecure\fP option stops DNSSEC
+from invalidating the zone.
 The \fI\%local\-zone: nodefault\fP (or
-\fI\%transparent\fP) clause makes the
+\fI\%transparent\fP) option makes the
 (reverse\-) zone bypass Unbound\(aqs filtering of \fI\%RFC 1918\fP zones.
 .INDENT 0.0
 .TP
@@ -3996,6 +4075,23 @@ This is the full domain name of the zone.
 Name of stub zone nameserver.
 Is itself resolved before it is used.
 .sp
+\fBCAUTION:\fP
+.INDENT 7.0
+.INDENT 3.5
+If the domain (or a subdomain) from this zone is used as the host, it
+will unavoidably introduce a circular dependency on retrieving the IP
+addresses of the name server.
+In that case, it is suggested to use
+\fI\%stub\-addr\fP instead.
+Alternatively,
+\fI\%stub\-first: yes\fP can also work
+around the circular dependency by trying resolution outside of this
+zone.
+However this has the caveat that it would allow escaping this zone when
+any resolution attempt fails within this zone.
+.UNINDENT
+.UNINDENT
+.sp
 To use a non\-default port for DNS communication append \fB\(aq@\(aq\fP with the
 port number.
 .sp
@@ -4036,9 +4132,9 @@ Default: no
 .INDENT 0.0
 .TP
 .B stub\-first: \fI<yes or no>\fP 
-If enabled, a query is attempted without the stub clause if it fails.
+If enabled, a query is attempted without this stub section if it fails.
 The data could not be retrieved and would have caused SERVFAIL because the
-servers are unreachable, instead it is tried without this clause.
+servers are unreachable, instead it is tried without this stub section.
 .sp
 Default: no
 .UNINDENT
@@ -4071,9 +4167,11 @@ This is useful when you want immediate changes to be visible.
 .sp
 Default: no
 .UNINDENT
-.SS Forward Zone Options
+.SH FORWARD ZONE OPTIONS
 .sp
-There may be multiple \fBforward\-zone:\fP clauses.
+These options are part of the \fBforward\-zone:\fP section.
+.sp
+There may be multiple \fBforward\-zone:\fP sections.
 Each with a \fI\%name\fP and zero or more hostnames
 or IP addresses.
 For the forward zone this list of nameservers is used to forward the queries
@@ -4104,6 +4202,23 @@ This is the full domain name of the zone.
 Name of server to forward to.
 Is itself resolved before it is used.
 .sp
+\fBCAUTION:\fP
+.INDENT 7.0
+.INDENT 3.5
+If the domain (or a subdomain) from this zone is used as the host, it
+will unavoidably introduce a circular dependency on retrieving the IP
+addresses of the name server.
+In that case, it is suggested to use
+\fI\%forward\-addr\fP instead.
+Alternatively,
+\fI\%forward\-first: yes\fP can also
+work around the circular dependency by trying resolution outside of
+this zone.
+However this has the caveat that it would allow escaping this zone when
+any resolution attempt fails within this zone.
+.UNINDENT
+.UNINDENT
+.sp
 To use a non\-default port for DNS communication append \fB\(aq@\(aq\fP with the
 port number.
 .sp
@@ -4180,12 +4295,14 @@ This is useful when you want immediate changes to be visible.
 .sp
 Default: no
 .UNINDENT
-.SS Authority Zone Options
+.SH AUTHORITY ZONE OPTIONS
+.sp
+These options are part of the \fBauth\-zone:\fP section.
 .sp
 Authority zones are configured with \fBauth\-zone:\fP, and each one must have a
 \fI\%name\fP\&.
-There can be multiple ones, by listing multiple auth\-zone clauses, each with a
-different name, pertaining to that part of the namespace.
+There can be multiple ones, by listing multiple \fBauth\-zone\fP section clauses,
+each with a different name, pertaining to that part of the namespace.
 The authority zone with the name closest to the name looked up is used.
 Authority zones can be processed on two distinct, non\-exclusive, configurable
 stages.
@@ -4216,7 +4333,7 @@ consult the local zone data while resolving.
 In this case, the aforementioned CNAME example will result in a thoroughly
 resolved answer.
 .sp
-Authority zones can be read from zonefile.
+Authority zones can be read from a zonefile.
 And can be kept updated via AXFR and IXFR.
 After update the zonefile is rewritten.
 The update mechanism uses the SOA timer values and performs SOA UDP queries to
@@ -4401,18 +4518,20 @@ If not given then no zonefile is used.
 If the file does not exist or is empty, Unbound will attempt to fetch zone
 data (eg. from the primary servers).
 .UNINDENT
-.SS View Options
+.SH VIEW OPTIONS
 .sp
-There may be multiple \fBview:\fP clauses.
+These options are part of the \fBview:\fP section.
+.sp
+There may be multiple \fBview:\fP sections.
 Each with a \fI\%name\fP and zero or more
 \fI\%local\-zone\fP and
-\fI\%local\-data\fP attributes.
+\fI\%local\-data\fP options.
 Views can also contain \fI\%view\-first\fP,
 \fI\%response\-ip\fP,
 \fI\%response\-ip\-data\fP and
-\fI\%local\-data\-ptr\fP attributes.
+\fI\%local\-data\-ptr\fP options.
 View can be mapped to requests by specifying the view name in an
-\fI\%access\-control\-view\fP attribute.
+\fI\%access\-control\-view\fP option.
 Options from matching views will override global options.
 Global options will be used if no matching view is found, or when the matching
 view does not have the option specified.
@@ -4422,7 +4541,7 @@ view does not have the option specified.
 Name of the view.
 Must be unique.
 This name is used in the
-\fI\%access\-control\-view\fP attribute.
+\fI\%access\-control\-view\fP option.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -4455,6 +4574,22 @@ Has the same behaviour as the global
 .UNINDENT
 .INDENT 0.0
 .TP
+.B response\-ip: \fI<IP\-netblock> <action>\fP 
+This requires use of the \fBrespip\fP module.
+.sp
+Similar to \fI\%response\-ip\fP but
+only applies to this view.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B response\-ip\-data: \fI<IP\-netblock> <\(dqresource record string\(dq>\fP 
+This requires use of the \fBrespip\fP module.
+.sp
+Similar to \fI\%response\-ip\-data\fP but
+only applies to this view.
+.UNINDENT
+.INDENT 0.0
+.TP
 .B view\-first: \fI<yes or no>\fP 
 If enabled, it attempts to use the global
 \fI\%local\-zone\fP and
@@ -4463,9 +4598,11 @@ view specific options.
 .sp
 Default: no
 .UNINDENT
-.SS Python Module Options
+.SH PYTHON MODULE OPTIONS
 .sp
-The \fBpython:\fP clause gives the settings for the \fIpython(1)\fP script module.
+These options are part of the \fBpython:\fP section.
+.sp
+The \fBpython:\fP section gives the settings for the \fIpython(1)\fP script module.
 This module acts like the iterator and validator modules do, on queries and
 answers.
 To enable the script module it has to be compiled into the daemon, and the word
@@ -4488,14 +4625,16 @@ The script file to load.
 Repeat this option for every python module instance added to the
 \fI\%module\-config\fP option.
 .UNINDENT
-.SS Dynamic Library Module Options
+.SH DYNAMIC LIBRARY MODULE OPTIONS
 .sp
-The \fBdynlib:\fP clause gives the settings for the \fBdynlib\fP module.
+These options are part of the \fBdynlib:\fP section.
+.sp
+The \fBdynlib:\fP section gives the settings for the \fBdynlib\fP module.
 This module is only a very small wrapper that allows dynamic modules to be
 loaded on runtime instead of being compiled into the application.
 To enable the dynlib module it has to be compiled into the daemon, and the word
 \fBdynlib\fP has to be put in the
-\fI\%module\-config\fP attribute.
+\fI\%module\-config\fP option.
 Multiple instances of dynamic libraries are supported by adding the word
 \fBdynlib\fP more than once.
 .sp
@@ -4510,7 +4649,9 @@ The dynamic library file to load.
 Repeat this option for every dynlib module instance added to the
 \fI\%module\-config\fP option.
 .UNINDENT
-.SS DNS64 Module Options
+.SH DNS64 MODULE OPTIONS
+.sp
+These options are part of the \fBserver:\fP section.
 .sp
 The \fBdns64\fP module must be configured in the
 \fI\%module\-config\fP directive, e.g.:
@@ -4530,7 +4671,11 @@ and be compiled into the daemon to be enabled.
 \fBNOTE:\fP
 .INDENT 0.0
 .INDENT 3.5
-These settings go in the \fI\%server:\fP section.
+If combining the \fBrespip\fP and \fBdns64\fP modules, the \fBrespip\fP module
+needs to appear before the \fBdns64\fP module in the
+\fI\%module\-config\fP
+configuration option so that response IP and/or RPZ feeds can properly
+filter responses regardless of DNS64 synthesis.
 .UNINDENT
 .UNINDENT
 .INDENT 0.0
@@ -4566,12 +4711,12 @@ Can be entered multiple times, list a new domain for which it applies, one
 per line.
 Applies also to names underneath the name given.
 .UNINDENT
-.SS NAT64 Operation
+.SH NAT64 OPTIONS
+.sp
+These options are part of the \fBserver:\fP section.
 .sp
 NAT64 operation allows using a NAT64 prefix for outbound requests to IPv4\-only
 servers.
-It is controlled by two options in the
-\fI\%server:\fP section:
 .INDENT 0.0
 .TP
 .B do\-nat64: \fI<yes or no>\fP 
@@ -4589,9 +4734,11 @@ The prefix length must be one of /32, /40, /48, /56, /64 or /96.
 .sp
 Default: 64:ff9b::/96 (same as \fI\%dns64\-prefix\fP)
 .UNINDENT
-.SS DNSCrypt Options
+.SH DNSCRYPT OPTIONS
 .sp
-The \fBdnscrypt:\fP clause gives the settings of the dnscrypt channel.
+These options are part of the \fBdnscrypt:\fP section.
+.sp
+The \fBdnscrypt:\fP section gives the settings of the dnscrypt channel.
 While those options are available, they are only meaningful if Unbound was
 compiled with \fB\-\-enable\-dnscrypt\fP\&.
 Currently certificate and secret/public keys cannot be generated by Unbound.
@@ -4721,7 +4868,9 @@ If left unconfigured, it will be configured automatically to be a power of
 .sp
 Default: (unconfigured)
 .UNINDENT
-.SS EDNS Client Subnet Module Options
+.SH EDNS CLIENT SUBNET MODULE OPTIONS
+.sp
+These options are part of the \fBserver:\fP section.
 .sp
 The ECS module must be configured in the
 \fI\%module\-config\fP directive, e.g.:
@@ -4738,13 +4887,6 @@ module\-config: \(dqsubnetcache validator iterator\(dq
 .sp
 and be compiled into the daemon to be enabled.
 .sp
-\fBNOTE:\fP
-.INDENT 0.0
-.INDENT 3.5
-These settings go in the \fI\%server:\fP section.
-.UNINDENT
-.UNINDENT
-.sp
 If the destination address is allowed in the configuration Unbound will add the
 EDNS0 option to the query containing the relevant part of the client\(aqs address.
 When an answer contains the ECS option the response and the option are placed
@@ -4866,7 +5008,9 @@ This number applies for each qname/qclass/qtype tuple.
 .sp
 Default: 100
 .UNINDENT
-.SS Opportunistic IPsec Support Module Options
+.SH OPPORTUNISTIC IPSEC SUPPORT MODULE OPTIONS
+.sp
+These options are part of the \fBserver:\fP section.
 .sp
 The IPsec module must be configured in the
 \fI\%module\-config\fP directive, e.g.:
@@ -4883,13 +5027,6 @@ module\-config: \(dqipsecmod validator iterator\(dq
 .sp
 and be compiled into Unbound by using \fB\-\-enable\-ipsecmod\fP to be enabled.
 .sp
-\fBNOTE:\fP
-.INDENT 0.0
-.INDENT 3.5
-These settings go in the \fI\%server:\fP section.
-.UNINDENT
-.UNINDENT
-.sp
 When Unbound receives an A/AAAA query that is not in the cache and finds a
 valid answer, it will withhold returning the answer and instead will generate
 an IPSECKEY subquery for the same domain name.
@@ -4987,7 +5124,9 @@ If the option is not specified, all domains are treated as being allowed
 .B ipsecmod\-whitelist: \fI<domain>\fP 
 Alternate syntax for \fI\%ipsecmod\-allow\fP\&.
 .UNINDENT
-.SS Cache DB Module Options
+.SH CACHE DB MODULE OPTIONS
+.sp
+These options are part of the \fBcachedb:\fP section.
 .sp
 The Cache DB module must be configured in the
 \fI\%module\-config\fP directive, e.g.:
@@ -5049,7 +5188,7 @@ If connection close or timeout happens too often, Unbound will be effectively
 unusable with this backend.
 It\(aqs the administrator\(aqs responsibility to make the assumption hold.
 .sp
-The \fBcachedb:\fP clause gives custom settings of the cache DB module.
+The \fBcachedb:\fP section gives custom settings of the cache DB module.
 .INDENT 0.0
 .TP
 .B backend: \fI<backend name>\fP 
@@ -5277,10 +5416,13 @@ for the Redis replica server.
 .sp
 Default: 0
 .UNINDENT
-.SS DNSTAP Logging Options
+.SH DNSTAP OPTIONS
 .sp
-DNSTAP support, when compiled in by using \fB\-\-enable\-dnstap\fP, is enabled in
-the \fBdnstap:\fP section.
+These options are part of the \fBdnstap:\fP section.
+.sp
+DNSTAP is a flexible, structured binary log format for DNS software.
+When compiled in by using \fB\-\-enable\-dnstap\fP, it can be enabled in the
+\fBdnstap:\fP section.
 This starts an extra thread (when compiled with threading) that writes the log
 information to the destination.
 If Unbound is compiled without threading it does not spawn a thread, but
@@ -5446,15 +5588,18 @@ Enable to log forwarder response messages.
 .sp
 Default: no
 .UNINDENT
-.SS Response Policy Zone Options
+.SH RESPONSE POLICY ZONE OPTIONS
 .sp
-Response Policy Zones are configured with \fBrpz:\fP, and each one must have a
-\fI\%name\fP attribute.
-There can be multiple ones, by listing multiple RPZ clauses, each with a
-different name.
-RPZ clauses are applied in order of configuration and any match from an earlier
-RPZ zone will terminate the RPZ lookup.
+These options are part of the \fBrpz:\fP section.
+.sp
+Response Policy Zones are configured with \fBrpz:\fP section clauses, and each
+one must have a \fI\%name\fP option.
+There can be multiple ones, by listing multiple \fBrpz:\fP section clauses, each
+with a different name.
+RPZ sections are applied in order of configuration and any match from an
+earlier RPZ zone will terminate the RPZ lookup.
 Note that a PASSTHRU action is still considered a match.
+.sp
 The respip module needs to be added to the
 \fI\%module\-config\fP, e.g.:
 .INDENT 0.0
@@ -5468,6 +5613,17 @@ module\-config: \(dqrespip validator iterator\(dq
 .UNINDENT
 .UNINDENT
 .sp
+\fBNOTE:\fP
+.INDENT 0.0
+.INDENT 3.5
+If combining the \fBrespip\fP and \fBdns64\fP modules, the \fBrespip\fP module
+needs to appear before the \fBdns64\fP module in the
+\fI\%module\-config\fP
+configuration option so that response IP and/or RPZ feeds can properly
+filter responses regardless of DNS64 synthesis.
+.UNINDENT
+.UNINDENT
+.sp
 QNAME, Response IP Address, nsdname, nsip and clientip triggers are supported.
 Supported actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp\-only
 and drop.
@@ -5536,9 +5692,6 @@ A 192.0.2.1                  answer with this IP address
 .sp
 Other records like AAAA, TXT and other CNAMEs (not rpz\-..) can also be used to
 answer queries with that content.
-.sp
-The RPZ zones can be configured in the config file with these settings in the
-\fBrpz:\fP block.
 .INDENT 0.0
 .TP
 .B name: \fI<zone name>\fP 
@@ -5677,7 +5830,7 @@ Default: no
 .INDENT 0.0
 .TP
 .B tags: \fI\(dq<list of tags>\(dq\fP 
-Limit the policies from this RPZ clause to clients with a matching tag.
+Limit the policies from this RPZ section to clients with a matching tag.
 .sp
 Tags need to be defined in \fI\%define\-tag\fP and
 can be assigned to client addresses using
@@ -5685,7 +5838,7 @@ can be assigned to client addresses using
 \fI\%interface\-tag\fP\&.
 Enclose list of tags in quotes (\fB\(dq\(dq\fP) and put spaces between tags.
 .sp
-If no tags are specified the policies from this clause will be applied for
+If no tags are specified the policies from this section will be applied for
 all clients.
 .UNINDENT
 .SH MEMORY CONTROL EXAMPLE
@@ -46,34 +46,41 @@ Description
 -----------

 **unbound.conf** is used to configure :doc:`unbound(8)</manpages/unbound>`.
-The file format has attributes and values.
-Some attributes have attributes inside them.
-The notation is: ``attribute: value``.
-
-Comments start with ``#`` and last to the end of line.
-Empty lines are ignored as is whitespace at the beginning of a line.

 The utility :doc:`unbound-checkconf(8)</manpages/unbound-checkconf>` can be
 used to check ``unbound.conf`` prior to usage.

+File Format
+-----------
+
+Whitespace is used to separate keywords.
+Whitespace indentation is insignificant, but is still recommended for visual
+clarity.
+Comments start with ``#`` and last to the end of line.
+Empty lines are ignored, as is whitespace at the beginning of a line.
+
+Attribute keywords end with a colon (``:``) and they are either options or
+section clauses (group options together).
+
+The configuration file is logically divided into **sections** where each section
+is introduced by a :ref:`section clause<unbound.conf.clauses>`.
+
 Example
 -------

-An example config file is shown below.
-Copy this to :file:`/etc/unbound/unbound.conf` and start the server with:
+An example minimal config file is shown below; most settings are the defaults.
+Copy this to ``@ub_conf_file@`` and start the server with:

 .. code-block:: text

-    $ unbound -c /etc/unbound/unbound.conf
+    $ unbound -c @ub_conf_file@

-Most settings are the defaults.
 Stop the server with:

 .. code-block:: text

-    $ kill `cat /etc/unbound/unbound.pid`
+    $ kill `cat @UNBOUND_PIDFILE@`

-Below is a minimal config file.
 The source distribution contains an extensive :file:`example.conf` file with
 all the options.

@@ -81,15 +88,15 @@ all the options.

    # unbound.conf(5) config file for unbound(8).
    server:
-        directory: "/etc/unbound"
+        directory: "@UNBOUND_RUN_DIR@"
        username: unbound
        # make sure unbound can access entropy from inside the chroot.
        # e.g. on linux the use these commands (on BSD, devfs(8) is used):
-        #      mount --bind -n /dev/urandom /etc/unbound/dev/urandom
-        # and  mount --bind -n /dev/log /etc/unbound/dev/log
-        chroot: "/etc/unbound"
-        # logfile: "/etc/unbound/unbound.log"  #uncomment to use logfile.
-        pidfile: "/etc/unbound/unbound.pid"
+        #      mount --bind -n /dev/urandom @UNBOUND_RUN_DIR@/dev/urandom
+        # and  mount --bind -n /dev/log @UNBOUND_RUN_DIR@/dev/log
+        chroot: "@UNBOUND_CHROOT_DIR@"
+        # logfile: "@UNBOUND_RUN_DIR@/unbound.log"  #uncomment to use logfile.
+        pidfile: "@UNBOUND_PIDFILE@"
        # verbosity: 1      # uncomment and increase to get more logging.
        # listen on all interfaces, answer queries from the local subnet.
        interface: 0.0.0.0
@@ -97,19 +104,71 @@ all the options.
        access-control: 10.0.0.0/8 allow
        access-control: 2001:DB8::/64 allow

-File Format
-----------
+.. _unbound.conf.clauses:

-There must be whitespace between keywords.
-Attribute keywords end with a colon ``':'``.
-An attribute is followed by a value, or its containing attributes in which case
-it is referred to as a clause.
-Clauses can be repeated throughout the file (or included files) to group
-attributes under the same clause.
+Section Clauses
+---------------
+
+The recognized section clauses are:
+
+    :ref:`server:<unbound.conf.server>`
+        Most of the configuration is found in this section.
+
+    :ref:`remote-control:<unbound.conf.remote>`
+        Configuration for the facility used by
+        :doc:`unbound-control(8)</manpages/unbound-control>`.
+
+    :ref:`stub-zone:<unbound.conf.stub>`
+        Configuration for a zone that redirects to specific authoritative name
+        servers, e.g. for zones not generally available on the greater
+        Internet.
+
+    :ref:`forward-zone:<unbound.conf.forward>`
+        Configuration for a zone that forwards to specific DNS resolvers.
+
+    :ref:`auth-zone:<unbound.conf.auth>`
+        Configuration for local authoritative zones.
+
+    :ref:`view:<unbound.conf.view>`
+        Overriding a small subset of configuration for incoming requests.
+        Requests are mapped to views with
+        :ref:`access-control-view<unbound.conf.access-control-view>` and
+        :ref:`interface-view<unbound.conf.interface-view>`.
+
+    :ref:`python:<unbound.conf.python>`
+        Configuration for the optional ``python`` script module.
+
+    :ref:`dynlib:<unbound.conf.dynlib>`
+        Configuration for the optional ``dynlib`` module that loads dynamic
+        libraries into Unbound.
+
+    :ref:`dnscrypt:<unbound.conf.dnscrypt>`
+        Configuration for the optional DNSCrypt feature.
+
+    :ref:`cachedb:<unbound.conf.cachedb>`
+        Configuration for the optional ``cachedb`` module that can interface
+        with second level caches, currently Redis or Redis-complatible
+        databases.
+
+    :ref:`dnstap:<unbound.conf.dnstap>`
+        Configuration of the optional dnstap logging feature; a flexible,
+        structured binary log format for DNS software.
+
+    :ref:`rpz:<unbound.conf.rpz>`
+        Configuration for Response Policy Zones that allows for DNS filtering.
+        Requires the ``respip`` module.
+
+Section clauses can be repeated throughout the file (or included files) to
+logically group options in one visually cohesive group.
+This may be particularly useful for the ``server:`` clause with its myriad of
+options.

 .. _unbound.conf.include:

-Files can be included using the **include:** directive.
+Including Files
+---------------
+
+Files can be included using the ``include:`` directive.
 It can appear anywhere, it accepts a single file name as argument.
 Processing continues as if the text from the included file was copied into the
 config file at that point.
@@ -122,17 +181,17 @@ Wildcards can be used to include multiple files, see *glob(7)*.

 .. _unbound.conf.include-toplevel:

-For a more structural include option, the **include-toplevel:** directive can
+For a more structural include option, the ``include-toplevel:`` directive can
 be used.
-This closes whatever clause is currently active (if any) and forces the use of
-clauses in the included files and right after this directive.
+This closes whatever section clause is currently active (if any) and forces the
+use of section clauses in the included files and right after this directive.

 .. _unbound.conf.server:

 Server Options
-^^^^^^^^^^^^^^
+--------------

-These options are part of the **server:** clause.
+These options are part of the ``server:`` section.


@@UAHL@unbound.conf@verbosity@@: *<number>*
@@ -496,6 +555,9 @@ These options are part of the **server:** clause.
    The wait time in msec where recursion requests are dropped.
    This is to stop a large number of replies from accumulating.
    They receive no reply, the work item continues to recurse.
+    For UDP the replies are dropped, for stream connections the reply
+    is not dropped if the stream connection is still open ready to receive
+    answers.
    It is nice to be a bit larger than
    :ref:`serve-expired-client-timeout<unbound.conf.serve-expired-client-timeout>`
    if that is enabled.
@@ -510,7 +572,7 @@ These options are part of the **server:** clause.
    This makes a ratelimit per IP address of waiting replies for recursion.
    It stops very large amounts of queries waiting to be returned to one
    destination.
-    The value ``0`` disables wait limits.
+    The value ``0`` disables all wait limits.

    Default: 1000

@@ -518,7 +580,11 @@ These options are part of the **server:** clause.
@@UAHL@unbound.conf@wait-limit-cookie@@: *<number>*
    The number of replies that can wait for recursion, for an IP address
    that sent the query with a valid DNS Cookie.
-    Since the cookie validates the client address, this limit can be higher.
+    Since the cookie already validates the client address, this option allows
+    to override a configured
+    :ref:`wait-limit<unbound.conf.wait-limit>` value usually with a higher one
+    for cookie validated queries.
+    The value ``0`` disables wait limits for cookie validated queries.

    Default: 10000

@@ -1049,8 +1115,8 @@ These options are part of the **server:** clause.


@@UAHL@unbound.conf@tls-system-cert@@: *<yes or no>*
-    This the same attribute as the
-    :ref:`tls-win-cert<unbound.conf.tls-win-cert>` attribute, under a
+    This the same as the
+    :ref:`tls-win-cert<unbound.conf.tls-win-cert>` option, under a
    different name.
    Because it is not windows specific.

@@ -1437,8 +1503,8 @@ These options are part of the **server:** clause.
    .. note::
        The interface needs to be already specified with
        :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** attribute overrides all **interface-\*:**
-        attributes for targeted clients.
+        **access-control\*:** option overrides all **interface-\*:**
+        options for targeted clients.


@@UAHL@unbound.conf@interface-tag@@: *<ip address or interface name [@port]> <"list of tags">*
@@ -1448,8 +1514,8 @@ These options are part of the **server:** clause.
    .. note::
        The interface needs to be already specified with
        :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** attribute overrides all **interface-\*:**
-        attributes for targeted clients.
+        **access-control\*:** option overrides all **interface-\*:**
+        options for targeted clients.


@@UAHL@unbound.conf@interface-tag-action@@: *<ip address or interface name [@port]> <tag> <action>*
@@ -1460,8 +1526,8 @@ These options are part of the **server:** clause.
    .. note::
        The interface needs to be already specified with
        :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** attribute overrides all **interface-\*:**
-        attributes for targeted clients.
+        **access-control\*:** option overrides all **interface-\*:**
+        options for targeted clients.


@@UAHL@unbound.conf@interface-tag-data@@: *<ip address or interface name [@port]> <tag> <"resource record string">*
@@ -1472,8 +1538,8 @@ These options are part of the **server:** clause.
    .. note::
        The interface needs to be already specified with
        :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** attribute overrides all **interface-\*:**
-        attributes for targeted clients.
+        **access-control\*:** option overrides all **interface-\*:**
+        options for targeted clients.


@@UAHL@unbound.conf@interface-view@@: *<ip address or interface name [@port]> <view name>*
@@ -1483,8 +1549,8 @@ These options are part of the **server:** clause.
    .. note::
        The interface needs to be already specified with
        :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** attribute overrides all **interface-\*:**
-        attributes for targeted clients.
+        **access-control\*:** option overrides all **interface-\*:**
+        options for targeted clients.


@@UAHL@unbound.conf@chroot@@: *<directory>*
@@ -1549,7 +1615,7 @@ These options are part of the **server:** clause.
        [seconds since 1970] unbound[pid:tid]: type: message.

    If this option is given, the :ref:`use-syslog<unbound.conf.use-syslog>`
-    attribute is internally set to ``no``.
+    option is internally set to ``no``.

    The logfile is reopened (for append) when the config file is reread, on
    SIGHUP.
@@ -1673,8 +1739,8 @@ These options are part of the **server:** clause.
    Default is nothing, using builtin hints for the IN class.
    The file has the format of zone files, with root nameserver names and
    addresses only.
-    The default may become outdated, when servers change, therefore it is good
-    practice to use a root hints file.
+    The default may become outdated, when servers change, and then it is
+    possible to use a root hints file with specific servers.

    Default: ""

@@ -2883,7 +2949,7 @@ These options are part of the **server:** clause.
    :ref:`response-ip<unbound.conf.response-ip>` with action being to redirect
    as specified by *<"resource record string">*.
    *<"Resource record string">* is similar to that of
-    :ref:`access-control-tag-action<unbound.conf.access-control-tag-action>`,
+    :ref:`access-control-tag-data<unbound.conf.access-control-tag-data>`,
    but it must be of either AAAA, A or CNAME types.
    If the *<IP-netblock>* is an IPv6/IPv4 prefix, the record must be AAAA/A
    respectively, unless it is a CNAME (which can be used for both versions of
@@ -3178,6 +3244,14 @@ These options are part of the **server:** clause.
    Default: 200


+@@UAHL@unbound.conf@iter-scrub-promiscuous@@: *<yes or no>*
+    Should the iterator scrubber remove promiscuous NS from positive answers.
+    This protects against poisonous contents, that could affect names in the
+    same zone as a spoofed packet.
+
+    Default: yes
+
+
@@UAHL@unbound.conf@fast-server-permil@@: *<number>*
    Specify how many times out of 1000 to pick from the set of fastest servers.
    0 turns the feature off.
@@ -3304,17 +3378,18 @@ These options are part of the **server:** clause.
 .. _unbound.conf.remote:

 Remote Control Options
-^^^^^^^^^^^^^^^^^^^^^^
+----------------------
+
+These options are part of the ``remote-control:`` section and are the
+declarations for the remote control facility.

-In the **remote-control:** clause are the declarations for the remote control
-facility.
 If this is enabled, the :doc:`unbound-control(8)</manpages/unbound-control>`
 utility can be used to send commands to the running Unbound server.
-The server uses these clauses to setup TLSv1 security for the connection.
-The :doc:`unbound-control(8)</manpages/unbound-control>` utility also reads the
-**remote-control:** section for options.
+The server uses these options to setup TLS security for the connection.
+The :doc:`unbound-control(8)</manpages/unbound-control>` utility also reads
+this ``remote-control:`` section for options.
 To setup the correct self-signed certificates use the
-*unbound-control-setup(8)* utility.
+``unbound-control-setup(8)`` utility.


@@UAHL@unbound.conf.remote@control-enable@@: *<yes or no>*
@@ -3406,9 +3481,11 @@ To setup the correct self-signed certificates use the
 .. _unbound.conf.stub:

 Stub Zone Options
-^^^^^^^^^^^^^^^^^
+-----------------

-There may be multiple **stub-zone:** clauses.
+These options are part of the ``stub-zone:`` section.
+
+There may be multiple ``stub-zone:`` sections.
 Each with a :ref:`name<unbound.conf.stub.name>` and zero or more hostnames or
 IP addresses.
 For the stub zone this list of nameservers is used.
@@ -3441,9 +3518,10 @@ Consider adding :ref:`server<unbound.conf.server>` statements for
 :ref:`domain-insecure<unbound.conf.domain-insecure>` and for
 :ref:`local-zone: \<name\> nodefault<unbound.conf.local-zone.type.nodefault>`
 for the zone if it is a locally served zone.
-The insecure clause stops DNSSEC from invalidating the zone.
+The :ref:`domain-insecure<unbound.conf.domain-insecure>` option stops DNSSEC
+from invalidating the zone.
 The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or
-:ref:`transparent<unbound.conf.local-zone.type.transparent>`) clause makes the
+:ref:`transparent<unbound.conf.local-zone.type.transparent>`) option makes the
 (reverse-) zone bypass Unbound's filtering of :rfc:`1918` zones.


@@ -3456,6 +3534,19 @@ The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or
    Name of stub zone nameserver.
    Is itself resolved before it is used.

+    .. caution::
+        If the domain (or a subdomain) from this zone is used as the host, it
+        will unavoidably introduce a circular dependency on retrieving the IP
+        addresses of the name server.
+        In that case, it is suggested to use
+        :ref:`stub-addr<unbound.conf.stub.stub-addr>` instead.
+        Alternatively,
+        :ref:`stub-first: yes<unbound.conf.stub.stub-first>` can also work
+        around the circular dependency by trying resolution outside of this
+        zone.
+        However this has the caveat that it would allow escaping this zone when
+        any resolution attempt fails within this zone.
+
    To use a non-default port for DNS communication append ``'@'`` with the
    port number.

@@ -3493,9 +3584,9 @@ The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or


@@UAHL@unbound.conf.stub@stub-first@@: *<yes or no>*
-    If enabled, a query is attempted without the stub clause if it fails.
+    If enabled, a query is attempted without this stub section if it fails.
    The data could not be retrieved and would have caused SERVFAIL because the
-    servers are unreachable, instead it is tried without this clause.
+    servers are unreachable, instead it is tried without this stub section.

    Default: no

@@ -3527,9 +3618,11 @@ The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or
 .. _unbound.conf.forward:

 Forward Zone Options
-^^^^^^^^^^^^^^^^^^^^
+--------------------

-There may be multiple **forward-zone:** clauses.
+These options are part of the ``forward-zone:`` section.
+
+There may be multiple ``forward-zone:`` sections.
 Each with a :ref:`name<unbound.conf.forward.name>` and zero or more hostnames
 or IP addresses.
 For the forward zone this list of nameservers is used to forward the queries
@@ -3559,6 +3652,19 @@ cache).
    Name of server to forward to.
    Is itself resolved before it is used.

+    .. caution::
+        If the domain (or a subdomain) from this zone is used as the host, it
+        will unavoidably introduce a circular dependency on retrieving the IP
+        addresses of the name server.
+        In that case, it is suggested to use
+        :ref:`forward-addr<unbound.conf.forward.forward-addr>` instead.
+        Alternatively,
+        :ref:`forward-first: yes<unbound.conf.forward.forward-first>` can also
+        work around the circular dependency by trying resolution outside of
+        this zone.
+        However this has the caveat that it would allow escaping this zone when
+        any resolution attempt fails within this zone.
+
    To use a non-default port for DNS communication append ``'@'`` with the
    port number.

@@ -3632,12 +3738,14 @@ cache).
 .. _unbound.conf.auth:

 Authority Zone Options
-^^^^^^^^^^^^^^^^^^^^^^
+----------------------

-Authority zones are configured with **auth-zone:**, and each one must have a
+These options are part of the ``auth-zone:`` section.
+
+Authority zones are configured with ``auth-zone:``, and each one must have a
 :ref:`name<unbound.conf.auth.name>`.
-There can be multiple ones, by listing multiple auth-zone clauses, each with a
-different name, pertaining to that part of the namespace.
+There can be multiple ones, by listing multiple ``auth-zone`` section clauses,
+each with a different name, pertaining to that part of the namespace.
 The authority zone with the name closest to the name looked up is used.
 Authority zones can be processed on two distinct, non-exclusive, configurable
 stages.
@@ -3668,7 +3776,7 @@ consult the local zone data while resolving.
 In this case, the aforementioned CNAME example will result in a thoroughly
 resolved answer.

-Authority zones can be read from zonefile.
+Authority zones can be read from a zonefile.
 And can be kept updated via AXFR and IXFR.
 After update the zonefile is rewritten.
 The update mechanism uses the SOA timer values and performs SOA UDP queries to
@@ -3704,9 +3812,11 @@ fallback activates to fetch from the upstream instead of the SERVFAIL.
    :ref:`url<unbound.conf.auth.url>` to download the zonefile as a text file
    from a webserver that would work.

-    If you specify the hostname, you cannot use the domain from the zonefile,
-    because it may not have that when retrieving that data, instead use a plain
-    IP address to avoid a circular dependency on retrieving that IP address.
+    .. caution::
+        If you specify the hostname, you cannot use the domain from the
+        zonefile, because it may not have that when retrieving that data,
+        instead use a plain IP address to avoid a circular dependency on
+        retrieving that IP address.


@@UAHL@unbound.conf.auth@master@@: *<IP address or host name>*
@@ -3849,18 +3959,20 @@ fallback activates to fetch from the upstream instead of the SERVFAIL.
 .. _unbound.conf.view:

 View Options
-^^^^^^^^^^^^
+------------

-There may be multiple **view:** clauses.
+These options are part of the ``view:`` section.
+
+There may be multiple ``view:`` sections.
 Each with a :ref:`name<unbound.conf.view.name>` and zero or more
 :ref:`local-zone<unbound.conf.view.local-zone>` and
-:ref:`local-data<unbound.conf.view.local-data>` attributes.
+:ref:`local-data<unbound.conf.view.local-data>` options.
 Views can also contain :ref:`view-first<unbound.conf.view.view-first>`,
 :ref:`response-ip<unbound.conf.response-ip>`,
 :ref:`response-ip-data<unbound.conf.response-ip-data>` and
-:ref:`local-data-ptr<unbound.conf.view.local-data-ptr>` attributes.
+:ref:`local-data-ptr<unbound.conf.view.local-data-ptr>` options.
 View can be mapped to requests by specifying the view name in an
-:ref:`access-control-view<unbound.conf.access-control-view>` attribute.
+:ref:`access-control-view<unbound.conf.access-control-view>` option.
 Options from matching views will override global options.
 Global options will be used if no matching view is found, or when the matching
 view does not have the option specified.
@@ -3870,7 +3982,7 @@ view does not have the option specified.
    Name of the view.
    Must be unique.
    This name is used in the
-    :ref:`access-control-view<unbound.conf.access-control-view>` attribute.
+    :ref:`access-control-view<unbound.conf.access-control-view>` option.


@@UAHL@unbound.conf.view@local-zone@@: *<zone> <type>*
@@ -3899,6 +4011,20 @@ view does not have the option specified.
    :ref:`local-data-ptr<unbound.conf.local-data-ptr>` elements.


+@@UAHL@unbound.conf.view@response-ip@@: *<IP-netblock> <action>*
+    This requires use of the ``respip`` module.
+
+    Similar to :ref:`response-ip<unbound.conf.response-ip>` but
+    only applies to this view.
+
+
+@@UAHL@unbound.conf.view@response-ip-data@@: *<IP-netblock> <"resource record string">*
+    This requires use of the ``respip`` module.
+
+    Similar to :ref:`response-ip-data<unbound.conf.response-ip-data>` but
+    only applies to this view.
+
+
@@UAHL@unbound.conf.view@view-first@@: *<yes or no>*
    If enabled, it attempts to use the global
    :ref:`local-zone<unbound.conf.local-zone>` and
@@ -3907,10 +4033,14 @@ view does not have the option specified.

    Default: no

-Python Module Options
-^^^^^^^^^^^^^^^^^^^^^
+.. _unbound.conf.python:

-The **python:** clause gives the settings for the *python(1)* script module.
+Python Module Options
+---------------------
+
+These options are part of the ``python:`` section.
+
+The ``python:`` section gives the settings for the *python(1)* script module.
 This module acts like the iterator and validator modules do, on queries and
 answers.
 To enable the script module it has to be compiled into the daemon, and the word
@@ -3933,15 +4063,19 @@ path to the working directory.
    Repeat this option for every python module instance added to the
    :ref:`module-config<unbound.conf.module-config>` option.

-Dynamic Library Module Options
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+.. _unbound.conf.dynlib:

-The **dynlib:** clause gives the settings for the ``dynlib`` module.
+Dynamic Library Module Options
+------------------------------
+
+These options are part of the ``dynlib:`` section.
+
+The ``dynlib:`` section gives the settings for the ``dynlib`` module.
 This module is only a very small wrapper that allows dynamic modules to be
 loaded on runtime instead of being compiled into the application.
 To enable the dynlib module it has to be compiled into the daemon, and the word
 ``dynlib`` has to be put in the
-:ref:`module-config<unbound.conf.module-config>` attribute.
+:ref:`module-config<unbound.conf.module-config>` option.
 Multiple instances of dynamic libraries are supported by adding the word
 ``dynlib`` more than once.

@@ -3957,7 +4091,9 @@ directory.
    :ref:`module-config<unbound.conf.module-config>` option.

 DNS64 Module Options
-^^^^^^^^^^^^^^^^^^^^
+--------------------
+
+These options are part of the ``server:`` section.

 The ``dns64`` module must be configured in the
 :ref:`module-config<unbound.conf.module-config>` directive, e.g.:
@@ -3969,7 +4105,11 @@ The ``dns64`` module must be configured in the
 and be compiled into the daemon to be enabled.

 .. note::
-    These settings go in the :ref:`server:<unbound.conf.server>` section.
+    If combining the ``respip`` and ``dns64`` modules, the ``respip`` module
+    needs to appear before the ``dns64`` module in the
+    :ref:`module-config<unbound.conf.module-config>`
+    configuration option so that response IP and/or RPZ feeds can properly
+    filter responses regardless of DNS64 synthesis.


@@UAHL@unbound.conf.dns64@dns64-prefix@@: *<IPv6 prefix>*
@@ -3995,13 +4135,13 @@ and be compiled into the daemon to be enabled.
    per line.
    Applies also to names underneath the name given.

-NAT64 Operation
-^^^^^^^^^^^^^^^
+NAT64 Options
+-------------
+
+These options are part of the ``server:`` section.

 NAT64 operation allows using a NAT64 prefix for outbound requests to IPv4-only
 servers.
-It is controlled by two options in the
-:ref:`server:<unbound.conf.server>` section:


@@UAHL@unbound.conf.nat64@do-nat64@@: *<yes or no>*
@@ -4018,10 +4158,14 @@ It is controlled by two options in the

    Default: 64:ff9b::/96 (same as :ref:`dns64-prefix<unbound.conf.dns64.dns64-prefix>`)

-DNSCrypt Options
-^^^^^^^^^^^^^^^^
+.. _unbound.conf.dnscrypt:

-The **dnscrypt:** clause gives the settings of the dnscrypt channel.
+DNSCrypt Options
+----------------
+
+These options are part of the ``dnscrypt:`` section.
+
+The ``dnscrypt:`` section gives the settings of the dnscrypt channel.
 While those options are available, they are only meaningful if Unbound was
 compiled with ``--enable-dnscrypt``.
 Currently certificate and secret/public keys cannot be generated by Unbound.
@@ -4128,7 +4272,9 @@ https://github.com/cofyc/dnscrypt-wrapper/blob/master/README.md#usage
    Default: (unconfigured)

 EDNS Client Subnet Module Options
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+---------------------------------
+
+These options are part of the ``server:`` section.

 The ECS module must be configured in the
 :ref:`module-config<unbound.conf.module-config>` directive, e.g.:
@@ -4139,9 +4285,6 @@ The ECS module must be configured in the

 and be compiled into the daemon to be enabled.

-.. note::
-    These settings go in the :ref:`server:<unbound.conf.server>` section.
-
 If the destination address is allowed in the configuration Unbound will add the
 EDNS0 option to the query containing the relevant part of the client's address.
 When an answer contains the ECS option the response and the option are placed
@@ -4256,7 +4399,9 @@ This module does not interact with the
    Default: 100

 Opportunistic IPsec Support Module Options
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+------------------------------------------
+
+These options are part of the ``server:`` section.

 The IPsec module must be configured in the
 :ref:`module-config<unbound.conf.module-config>` directive, e.g.:
@@ -4267,9 +4412,6 @@ The IPsec module must be configured in the

 and be compiled into Unbound by using ``--enable-ipsecmod`` to be enabled.

-.. note::
-    These settings go in the :ref:`server:<unbound.conf.server>` section.
-
 When Unbound receives an A/AAAA query that is not in the cache and finds a
 valid answer, it will withhold returning the answer and instead will generate
 an IPSECKEY subquery for the same domain name.
@@ -4359,8 +4501,12 @@ answer given from cache is still relevant for opportunistic IPsec.
@@UAHL@unbound.conf@ipsecmod-whitelist@@: *<domain>*
    Alternate syntax for :ref:`ipsecmod-allow<unbound.conf.ipsecmod-allow>`.

+.. _unbound.conf.cachedb:
+
 Cache DB Module Options
-^^^^^^^^^^^^^^^^^^^^^^^
+-----------------------
+
+These options are part of the ``cachedb:`` section.

 The Cache DB module must be configured in the
 :ref:`module-config<unbound.conf.module-config>` directive, e.g.:
@@ -4412,7 +4558,7 @@ If connection close or timeout happens too often, Unbound will be effectively
 unusable with this backend.
 It's the administrator's responsibility to make the assumption hold.

-The **cachedb:** clause gives custom settings of the cache DB module.
+The ``cachedb:`` section gives custom settings of the cache DB module.


@@UAHL@unbound.conf.cachedb@backend@@: *<backend name>*
@@ -4460,7 +4606,7 @@ The **cachedb:** clause gives custom settings of the cache DB module.

    Default: yes

-The following **cachedb:** options are specific to the ``redis`` backend.
+The following ``cachedb:`` options are specific to the ``redis`` backend.


@@UAHL@unbound.conf.cachedb@redis-server-host@@: *<server address or name>*
@@ -4619,11 +4765,14 @@ The following **cachedb:** options are specific to the ``redis`` backend.

 .. _unbound.conf.dnstap:

-DNSTAP Logging Options
-^^^^^^^^^^^^^^^^^^^^^^
+DNSTAP Options
+--------------

-DNSTAP support, when compiled in by using ``--enable-dnstap``, is enabled in
-the **dnstap:** section.
+These options are part of the ``dnstap:`` section.
+
+DNSTAP is a flexible, structured binary log format for DNS software.
+When compiled in by using ``--enable-dnstap``, it can be enabled in the
+``dnstap:`` section.
 This starts an extra thread (when compiled with threading) that writes the log
 information to the destination.
 If Unbound is compiled without threading it does not spawn a thread, but
@@ -4773,15 +4922,18 @@ connects per-process to the destination.
 .. _unbound.conf.rpz:

 Response Policy Zone Options
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+----------------------------

-Response Policy Zones are configured with **rpz:**, and each one must have a
-:ref:`name<unbound.conf.rpz.name>` attribute.
-There can be multiple ones, by listing multiple RPZ clauses, each with a
-different name.
-RPZ clauses are applied in order of configuration and any match from an earlier
-RPZ zone will terminate the RPZ lookup.
+These options are part of the ``rpz:`` section.
+
+Response Policy Zones are configured with ``rpz:`` section clauses, and each
+one must have a :ref:`name<unbound.conf.rpz.name>` option.
+There can be multiple ones, by listing multiple ``rpz:`` section clauses, each
+with a different name.
+RPZ sections are applied in order of configuration and any match from an
+earlier RPZ zone will terminate the RPZ lookup.
 Note that a PASSTHRU action is still considered a match.
+
 The respip module needs to be added to the
 :ref:`module-config<unbound.conf.module-config>`, e.g.:

@@ -4789,6 +4941,13 @@ The respip module needs to be added to the

    module-config: "respip validator iterator"

+.. note::
+    If combining the ``respip`` and ``dns64`` modules, the ``respip`` module
+    needs to appear before the ``dns64`` module in the
+    :ref:`module-config<unbound.conf.module-config>`
+    configuration option so that response IP and/or RPZ feeds can properly
+    filter responses regardless of DNS64 synthesis.
+
 QNAME, Response IP Address, nsdname, nsip and clientip triggers are supported.
 Supported actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp-only
 and drop.
@@ -4840,9 +4999,6 @@ The actions are specified with the record on the right
 Other records like AAAA, TXT and other CNAMEs (not rpz-..) can also be used to
 answer queries with that content.

-The RPZ zones can be configured in the config file with these settings in the
-**rpz:** block.
-

@@UAHL@unbound.conf.rpz@name@@: *<zone name>*
    Name of the authority zone.
@@ -4970,7 +5126,7 @@ The RPZ zones can be configured in the config file with these settings in the


@@UAHL@unbound.conf.rpz@tags@@: *"<list of tags>"*
-    Limit the policies from this RPZ clause to clients with a matching tag.
+    Limit the policies from this RPZ section to clients with a matching tag.

    Tags need to be defined in :ref:`define-tag<unbound.conf.define-tag>` and
    can be assigned to client addresses using
@@ -4978,7 +5134,7 @@ The RPZ zones can be configured in the config file with these settings in the
    :ref:`interface-tag<unbound.conf.interface-tag>`.
    Enclose list of tags in quotes (``""``) and put spaces between tags.

-    If no tags are specified the policies from this clause will be applied for
+    If no tags are specified the policies from this section will be applied for
    all clients.

 .. _unbound.conf.tsig-key:
@@ -228,6 +228,11 @@ read_fwds_host(struct config_stub* s, struct delegpt* dp)
 				s->name, p->str);
 			return 0;
 		}
+		if(dname_subdomain_c(dname, dp->name)) {
+			log_warn("forward-host '%s' may have a circular "
+				"dependency on forward-zone '%s'",
+				p->str, s->name);
+		}
 #if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
 		if(tls_auth_name)
 			log_err("no name verification functionality in "
@@ -231,6 +231,11 @@ read_stubs_host(struct config_stub* s, struct delegpt* dp)
 				s->name, p->str);
 			return 0;
 		}
+		if(dname_subdomain_c(dname, dp->name)) {
+			log_warn("stub-host '%s' may have a circular "
+				"dependency on stub-zone '%s'",
+				p->str, s->name);
+		}
 #if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
 		if(tls_auth_name)
 			log_err("no name verification functionality in "
@@ -634,6 +634,22 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					"RRset:", pkt, msg, prev, &rrset);
 				continue;
 			}
+			/* If the NS set is a promiscuous NS set, scrub that
+			 * to remove potential for poisonous contents that
+			 * affects other names in the same zone. Remove
+			 * promiscuous NS sets in positive answers, that
+			 * thus have records in the answer section. Nodata
+			 * and nxdomain promiscuous NS sets have been removed
+			 * already. Since the NS rrset is scrubbed, its
+			 * address records are also not marked to be allowed
+			 * and are removed later. */
+			if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR &&
+				msg->an_rrsets != 0 &&
+				env->cfg->iter_scrub_promiscuous) {
+				remove_rrset("normalize: removing promiscuous "
+					"RRset:", pkt, msg, prev, &rrset);
+				continue;
+			}
 			if(nsset == NULL) {
 				nsset = rrset;
 			} else {
@@ -229,7 +229,9 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb)
 		cfg->do_udp || cfg->udp_upstream_without_downstream, w->sslctx,
 		cfg->delay_close, cfg->tls_use_sni, NULL, cfg->udp_connect,
 		cfg->max_reuse_tcp_queries, cfg->tcp_reuse_timeout,
-		cfg->tcp_auth_query_timeout);
+		cfg->tcp_auth_query_timeout, (const char**)cfg->dist,
+		(const char**)cfg->dist_tsig,
+		cfg->num_dist);
 	w->env->outnet = w->back;
 	if(!w->is_bg || w->is_bg_thread) {
 		lock_basic_unlock(&ctx->cfglock);
@@ -853,7 +853,7 @@ Result: ['74.125.43.147', '74.125.43.99', '74.125.43.103', '74.125.43.104']
 %{ 
  //printf("resolve_start(%lX)\n",(long unsigned int)arg1);
  Py_BEGIN_ALLOW_THREADS 
-  $function 
+  $action
  Py_END_ALLOW_THREADS 
  //printf("resolve_stop()\n");
 %} 
@@ -700,7 +700,5 @@ cleanup
 storehash unbound-$version.tar.gz
 echo "create unbound-$version.tar.gz.asc with:"
 echo "  gpg --armor --detach-sign --digest-algo SHA256 unbound-$version.tar.gz"
-echo "  gpg --armor --detach-sign --digest-algo SHA256 unbound-$version.zip"
-echo "  gpg --armor --detach-sign --digest-algo SHA256 unbound_setup_$version.exe"

 info "Unbound distribution created successfully."
@@ -1269,7 +1269,8 @@ int infra_wait_limit_allowed(struct infra_cache* infra, struct comm_reply* rep,
 	int cookie_valid, struct config_file* cfg)
 {
 	struct lruhash_entry* entry;
-	if(cfg->wait_limit == 0)
+	if(cfg->wait_limit == 0 ||
+		(cookie_valid && cfg->wait_limit_cookie == 0))
 		return 1;

 	entry = infra_find_ip_ratedata(infra, &rep->client_addr,
@@ -45,6 +45,7 @@
 #include "config.h"
 #include "services/mesh.h"
 #include "services/outbound_list.h"
+#include "services/outside_network.h"
 #include "services/cache/dns.h"
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
@@ -58,6 +59,7 @@
 #include "util/alloc.h"
 #include "util/config_file.h"
 #include "util/edns.h"
+#include "sldns/parseutil.h"
 #include "sldns/sbuffer.h"
 #include "sldns/wire2str.h"
 #include "services/localzone.h"
@@ -65,6 +67,8 @@
 #include "respip/respip.h"
 #include "services/listen_dnsport.h"
 #include "util/timeval_func.h"
+#include "util/allow_response_list.h"
+#include "util/tsig.h"

 #ifdef CLIENT_SUBNET
 #include "edns-subnet/subnetmod.h"
@@ -441,9 +445,18 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	if(!infra_wait_limit_allowed(mesh->env->infra_cache, rep,
 		edns->cookie_valid, mesh->env->cfg)) {
 		verbose(VERB_ALGO, "Too many queries waiting from the IP. "
-			"dropping incoming query.");
-		comm_point_drop_reply(rep);
+			"servfail incoming query.");
 		mesh->num_queries_wait_limit++;
+		edns_opt_list_append_ede(&edns->opt_list_out,
+			mesh->env->scratch, LDNS_EDE_OTHER,
+			"Too many queries queued up and waiting from the IP");
+		if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL, NULL,
+			LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv))
+				edns->opt_list_inplace_cb_out = NULL;
+		error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
+			qinfo, qid, qflags, edns);
+		regional_free_all(mesh->env->scratch);
+		comm_point_send_reply(rep);
 		return;
 	}
 	if(!unique)
@@ -1727,29 +1740,101 @@ void mesh_query_done(struct mesh_state* mstate)
 	if(mstate->reply_list && mstate->s.env->cfg->dns_error_reporting)
 		dns_error_reporting(&mstate->s, rep);

+	if(mstate->reply_list && rep) {
+		uint8_t data[8192];
+		struct sldns_buffer dest;
+		int i;
+
+		sldns_buffer_init_frm_data(&dest, data, sizeof(data));
+		reply_info_answer_encode(&mstate->s.qinfo, rep, 0 /* id */,
+				0 /* qflags */, &dest, 0 /* current time */,
+				1 /* cached */, mstate->s.env->scratch,
+				sizeof(data) /* udpsize */, NULL /* edns */,
+				1 /* dnssec */, 0 /* secure */);
+		log_err("Answer to be send to %d other unbounds, size: %d",
+				mstate->s.env->outnet->num_dist,
+				(int)sldns_buffer_limit(&dest));
+		for(i = 0; i < mstate->s.env->outnet->num_dist; i++) {
+			struct tsig_key* key;
+			int r;
+			uint8_t data_signed[8192];
+			struct sldns_buffer dest_signed;
+
+			if(mstate->s.env->outnet->dist[i] == -1
+			|| mstate->s.env->outnet->dist_tsig[i] == NULL)
+				continue;
+			if(mstate->s.env->outnet->dist_tsig[i] == TSIG_NOKEY) {
+				send(mstate->s.env->outnet->dist[i],
+					data, sldns_buffer_limit(&dest), 0);
+				continue;
+			}
+			lock_rw_rdlock(&mstate->s.env->tsig_key_table->lock);
+			key = tsig_key_table_search_fromstr(
+					mstate->s.env->tsig_key_table,
+					mstate->s.env->outnet->dist_tsig[i]);
+			if(!key) {
+				lock_rw_unlock(
+					&mstate->s.env->tsig_key_table->lock);
+				log_err("tsig key \"%s\" not found when "
+					"distributing responses", 
+					mstate->s.env->outnet->dist_tsig[i]);
+				continue;
+			}
+			sldns_buffer_init_frm_data(&dest_signed,
+					data_signed, sizeof(data_signed));
+			sldns_buffer_write(&dest_signed,
+					data, sldns_buffer_limit(&dest));
+			if((r = tsig_sign_shared(&dest_signed, key->name,
+					key->algo->wireformat_name,
+					key->data, key->data_len,
+					*mstate->s.env->now))) {
+				lock_rw_unlock(
+					&mstate->s.env->tsig_key_table->lock);
+				log_err("tsig key \"%s\" failed to sign"
+					"distributing response: %s",
+					key->name_str,
+					sldns_lookup_by_id(sldns_tsig_errors, r)?
+                                        sldns_lookup_by_id(sldns_tsig_errors, r)->name:"??");
+				continue;
+			}
+			lock_rw_unlock(&mstate->s.env->tsig_key_table->lock);
+			send(mstate->s.env->outnet->dist[i], data_signed,
+					sldns_buffer_position(&dest_signed), 0);
+		}
+	}
+
 	for(r = mstate->reply_list; r; r = r->next) {
-		struct timeval old;
-		timeval_subtract(&old, mstate->s.env->now_tv, &r->start_time);
-		if(mstate->s.env->cfg->discard_timeout != 0 &&
-			((int)old.tv_sec)*1000+((int)old.tv_usec)/1000 >
-			mstate->s.env->cfg->discard_timeout) {
-			/* Drop the reply, it is too old */
-			/* briefly set the reply_list to NULL, so that the
-			 * tcp req info cleanup routine that calls the mesh
-			 * to deregister the meshstate for it is not done
-			 * because the list is NULL and also accounting is not
-			 * done there, but instead we do that here. */
-			struct mesh_reply* reply_list = mstate->reply_list;
-			verbose(VERB_ALGO, "drop reply, it is older than discard-timeout");
-			infra_wait_limit_dec(mstate->s.env->infra_cache,
-				&r->query_reply, mstate->s.env->cfg);
-			mstate->reply_list = NULL;
-			if(r->query_reply.c->use_h2)
-				http2_stream_remove_mesh_state(r->h2_stream);
-			comm_point_drop_reply(&r->query_reply);
-			mstate->reply_list = reply_list;
-			mstate->s.env->mesh->num_queries_discard_timeout++;
-			continue;
+		if(mesh_is_udp(r)) {
+			/* For UDP queries, the old replies are discarded.
+			 * This stops a large volume of old replies from
+			 * building up.
+			 * The stream replies, are not discarded. The
+			 * stream is open, the other side is waiting.
+			 * Some answer is needed, even if servfail, but the
+			 * real reply is ready to go, so that is given. */
+			struct timeval old;
+			timeval_subtract(&old, mstate->s.env->now_tv, &r->start_time);
+			if(mstate->s.env->cfg->discard_timeout != 0 &&
+				((int)old.tv_sec)*1000+((int)old.tv_usec)/1000 >
+				mstate->s.env->cfg->discard_timeout) {
+				/* Drop the reply, it is too old */
+				/* briefly set the reply_list to NULL, so that the
+				 * tcp req info cleanup routine that calls the mesh
+				 * to deregister the meshstate for it is not done
+				 * because the list is NULL and also accounting is not
+				 * done there, but instead we do that here. */
+				struct mesh_reply* reply_list = mstate->reply_list;
+				verbose(VERB_ALGO, "drop reply, it is older than discard-timeout");
+				infra_wait_limit_dec(mstate->s.env->infra_cache,
+					&r->query_reply, mstate->s.env->cfg);
+				mstate->reply_list = NULL;
+				if(r->query_reply.c->use_h2)
+					http2_stream_remove_mesh_state(r->h2_stream);
+				comm_point_drop_reply(&r->query_reply);
+				mstate->reply_list = reply_list;
+				mstate->s.env->mesh->num_queries_discard_timeout++;
+				continue;
+			}
 		}

 		i++;
@@ -59,6 +59,7 @@
 #include "util/random.h"
 #include "util/fptr_wlist.h"
 #include "util/edns.h"
+#include "util/allow_response_list.h"
 #include "sldns/sbuffer.h"
 #include "dnstap/dnstap.h"
 #ifdef HAVE_OPENSSL_SSL_H
@@ -1678,7 +1679,8 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 	void (*unwanted_action)(void*), void* unwanted_param, int do_udp,
 	void* sslctx, int delayclose, int tls_use_sni, struct dt_env* dtenv,
 	int udp_connect, int max_reuse_tcp_queries, int tcp_reuse_timeout,
-	int tcp_auth_query_timeout)
+	int tcp_auth_query_timeout, const char** dist, const char** dist_tsig,
+	int num_dist)
 {
 	struct outside_network* outnet = (struct outside_network*)
 		calloc(1, sizeof(struct outside_network));
@@ -1819,6 +1821,32 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 			}
 		}
 	}
+	if (!(outnet->num_dist = num_dist))
+		outnet->dist = NULL;
+	else if ((outnet->dist = calloc(num_dist, sizeof(int))) &&
+	         (outnet->dist_tsig = calloc(num_dist, sizeof(const char*)))) {
+		int i;
+
+		for(i = 0; i < num_dist; i++) {
+			struct sockaddr_storage addr;
+			socklen_t addrlen;
+			int s = -1;
+
+			if(!extstrtoaddr(dist[i], &addr, &addrlen, UNBOUND_DNS_PORT)
+			|| (s = socket(addr.ss_family, SOCK_DGRAM, 0)) == -1
+			|| !fd_set_nonblock(s)
+			|| connect(s, (struct sockaddr*)&addr, addrlen)) {
+				if(s != -1)
+					close(s);
+				s = -1;
+			}
+			outnet->dist[i] = s;
+			outnet->dist_tsig[i] = dist_tsig[i] == NULL ? NULL
+			                     : strcmp(dist_tsig[i], TSIG_NOKEY)
+			                     ? strdup(dist_tsig[i])
+			                     : TSIG_NOKEY;
+		}
+	}
 	return outnet;
 }

@@ -1949,6 +1977,8 @@ outside_network_delete(struct outside_network* outnet)
 			p = np;
 		}
 	}
+	if(outnet->num_dist > 0 && outnet->dist != NULL)
+		free(outnet->dist);
 	free(outnet);
 }

@@ -190,6 +190,12 @@ struct outside_network {
 	struct waiting_tcp* tcp_wait_first;
 	/** last of waiting query list */
 	struct waiting_tcp* tcp_wait_last;
+	/** number of IP addresses to send to be cached responses to */
+	int num_dist;
+	/** udp sockets to the addresses to send to be cached responses to */
+	int* dist;
+	/** names of TSIG keys with which to sign the outgoing responses */
+	const char** dist_tsig;
 };

 /**
@@ -570,7 +576,8 @@ struct outside_network* outside_network_create(struct comm_base* base,
 	void (*unwanted_action)(void*), void* unwanted_param, int do_udp,
 	void* sslctx, int delayclose, int tls_use_sni, struct dt_env *dtenv,
 	int udp_connect, int max_reuse_tcp_queries, int tcp_reuse_timeout,
-	int tcp_auth_query_timeout);
+	int tcp_auth_query_timeout, const char** dist, const char** dist_tsig,
+	int num_dist);

 /**
 * Delete outside_network structure.
@@ -480,7 +480,8 @@ enum sldns_enum_ede_code
 	LDNS_EDE_TOO_EARLY = 26,
 	LDNS_EDE_UNSUPPORTED_NSEC3_ITERATIONS = 27,
 	LDNS_EDE_BADPROXYPOLICY = 28,
-	LDNS_EDE_SYNTHESIZED = 29
+	LDNS_EDE_SYNTHESIZED = 29,
+	LDNS_EDE_INVALID_QUERY_TYPE = 30
 };
 typedef enum sldns_enum_ede_code sldns_ede_code;

@@ -233,6 +233,7 @@ static sldns_lookup_table sldns_edns_ede_codes_data[] = {
 	{ LDNS_EDE_UNSUPPORTED_NSEC3_ITERATIONS, "Unsupported NSEC3 Iterations Value" },
 	{ LDNS_EDE_BADPROXYPOLICY, "Unable to Conform to Policy" },
 	{ LDNS_EDE_SYNTHESIZED, "Synthesized Answer" },
+	{ LDNS_EDE_INVALID_QUERY_TYPE, "Invalid Query Type" },
 	{ 0, NULL}
 };
 sldns_lookup_table* sldns_edns_ede_codes = sldns_edns_ede_codes_data;
@@ -1134,7 +1134,8 @@ outside_network_create(struct comm_base* base, size_t bufsize,
 	int ATTR_UNUSED(delayclose), int ATTR_UNUSED(tls_use_sni),
 	struct dt_env* ATTR_UNUSED(dtenv), int ATTR_UNUSED(udp_connect),
 	int ATTR_UNUSED(max_reuse_tcp_queries), int ATTR_UNUSED(tcp_reuse_timeout),
-	int ATTR_UNUSED(tcp_auth_query_timeout))
+	int ATTR_UNUSED(tcp_auth_query_timeout), const char** ATTR_UNUSED(dist),
+	const char** ATTR_UNUSED(dist_tsig), int ATTR_UNUSED(num_dist))
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)base;
 	struct outside_network* outnet =  calloc(1,
@@ -631,6 +631,7 @@ rh_allow_sha1_signatures_disabled(void)
 void 
 verify_test(void)
 {
+	int do_sha1 = 1;
 	unit_show_feature("signature verify");

 #if defined(HAVE_SSL) && defined(USE_SHA1)
@@ -643,27 +644,40 @@ verify_test(void)
 #else
 		_putenv("OPENSSL_ENABLE_SHA1_SIGNATURES=1");
 #endif
+		do_sha1 = 1;
 	}
+#ifdef HAVE_EVP_DEFAULT_PROPERTIES_IS_FIPS_ENABLED
+	if (EVP_default_properties_is_fips_enabled(NULL))
+		do_sha1 = 0;
 #endif
+#endif /* HAVE_SSL and USE_SHA1 */

 #ifdef USE_SHA1
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.1", "20070818005004");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.1", "20070818005004");
+	}
 #endif
 #if defined(USE_DSA) && defined(USE_SHA1)
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.2", "20080414005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.3", "20080416005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.4", "20080416005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.5", "20080416005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.6", "20080416005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.7", "20070829144150");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.2", "20080414005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.3", "20080416005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.4", "20080416005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.5", "20080416005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.6", "20080416005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.7", "20070829144150");
+	}
 #endif /* USE_DSA */
 #ifdef USE_SHA1
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.8", "20070829144150");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.8", "20070829144150");
+	}
 #endif
 #if (defined(HAVE_EVP_SHA256) || defined(HAVE_NSS) || defined(HAVE_NETTLE)) && defined(USE_SHA2)
 	verifytest_file(SRCDIRSTR "/testdata/test_sigs.rsasha256", "20070829144150");
 #  ifdef USE_SHA1
-	verifytest_file(SRCDIRSTR "/testdata/test_sigs.sha1_and_256", "20070829144150");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_sigs.sha1_and_256", "20070829144150");
+	}
 #  endif
 	verifytest_file(SRCDIRSTR "/testdata/test_sigs.rsasha256_draft", "20090101000000");
 #endif
@@ -672,8 +686,10 @@ verify_test(void)
 	verifytest_file(SRCDIRSTR "/testdata/test_signatures.9", "20171215000000");
 #endif
 #ifdef USE_SHA1
-	verifytest_file(SRCDIRSTR "/testdata/test_sigs.hinfo", "20090107100022");
-	verifytest_file(SRCDIRSTR "/testdata/test_sigs.revoked", "20080414005004");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_sigs.hinfo", "20090107100022");
+		verifytest_file(SRCDIRSTR "/testdata/test_sigs.revoked", "20080414005004");
+	}
 #endif
 #ifdef USE_GOST
 	if(sldns_key_EVP_load_gost_id())
@@ -699,7 +715,9 @@ verify_test(void)
 	}
 #endif
 #ifdef USE_SHA1
-	dstest_file(SRCDIRSTR "/testdata/test_ds.sha1");
+	if(do_sha1) {
+		dstest_file(SRCDIRSTR "/testdata/test_ds.sha1");
+	}
 #endif
 	nsectest();
 	nsec3_hash_test(SRCDIRSTR "/testdata/test_nsec3_hash.1");
@@ -5,6 +5,7 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -5,6 +5,7 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -5,6 +5,7 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -5,6 +5,7 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -8,6 +8,7 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	rrset-roundrobin: no

 stub-zone:
@@ -8,6 +8,7 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	rrset-roundrobin: no

 stub-zone:
@@ -5,6 +5,7 @@ server:
 	qname-minimisation: "no"
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	disable-edns-do: yes

 stub-zone:
@@ -7,6 +7,7 @@ server:
 	dns64-ignore-aaaa: ip6ignore.example.com
 	dns64-ignore-aaaa: ip6only.example.com
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -5,6 +5,7 @@ server:
 	module-config: "dns64 iterator"
 	dns64-prefix: 64:ff9b::0/96
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	prefetch: yes

 stub-zone:
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -2,6 +2,7 @@
 ; config options go here.
 server:
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 forward-zone: name: "." forward-addr: 216.0.0.1
 CONFIG_END

@@ -10,6 +10,7 @@ server:
 	username: ""
 	do-not-query-localhost: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	rrset-roundrobin: no
 forward-zone:
 	name: "."
@@ -5,6 +5,7 @@ server:
 	; is fine for that, not removed by minimal-responses.
 	access-control: 127.0.0.1 allow_snoop
 	minimal-responses: yes
+	iter-scrub-promiscuous: no
 forward-zone: name: "." forward-addr: 216.0.0.1
 CONFIG_END

@@ -9,6 +9,7 @@ server:
 	qname-minimisation: "no"
 	# test that default value of harden-dnssec-stripped is still yes.
 	fake-sha1: yes
+	iter-scrub-promiscuous: no
 	trust-anchor-signaling: no
 	access-control: 127.0.0.1 allow_snoop
 	module-config: "ipsecmod validator iterator"
@@ -11,6 +11,7 @@ server:
 	ipsecmod-enabled: no
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -18,6 +18,7 @@ server:
 	ipsecmod-ignore-bogus: yes
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -10,6 +10,7 @@ server:
 	ipsecmod-max-ttl: 200
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -10,6 +10,7 @@ server:
 	ipsecmod-max-ttl: 200
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -11,6 +11,7 @@ server:
 	ipsecmod-whitelist: white.example.com
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -8,6 +8,7 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -4,6 +4,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -8,6 +8,7 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -8,6 +8,7 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no
        tcp-upstream: no
        #tls-upstream:no  # same case but not testable in rpl.

@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	discard-timeout: 86400

 stub-zone:
@@ -4,6 +4,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0 "
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -4,6 +4,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	rrset-roundrobin: no

 stub-zone:
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	rrset-roundrobin: no

 stub-zone:
@@ -4,6 +4,7 @@ server:
 	qname-minimisation: "no"
 	module-config: "iterator"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "3 2 1 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	rrset-roundrobin: no

 stub-zone:
@@ -4,6 +4,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
@@ -8,6 +8,7 @@ server:
 	access-control: 127.0.0.1 allow_snoop
 	qname-minimisation: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	rrset-roundrobin: no

 stub-zone:
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	rrset-roundrobin: no

 stub-zone:
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	rrset-roundrobin: no

 stub-zone:
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	do-ip6: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -4,6 +4,7 @@ server:
 	qname-minimisation: "no"
 	prefetch: "yes"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	prefetch: "yes"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	prefetch: "yes"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -4,6 +4,7 @@ server:
 	qname-minimisation: "no"
 	prefetch: "yes"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	prefetch: "yes"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -4,6 +4,7 @@ server:
 	qname-minimisation: "no"
 	prefetch: "yes"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -8,6 +8,7 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 	private-address: 10.0.0.0/8
 	private-address: 172.16.0.0/12
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	rrset-roundrobin: no

 stub-zone:
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	rrset-roundrobin: no

 stub-zone:
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	rrset-roundrobin: no

 stub-zone:
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -2,6 +2,7 @@
 server:
 	target-fetch-policy: "0 0 0 0 0"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: yes
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Willem Toorop	c834ee635c	Fix function signature for compiling test	2025-11-03 11:15:11 +01:00
Willem Toorop	7977ef28f5	distribute can send out responses tsig signed	2025-11-01 14:32:09 +01:00
Willem Toorop	c86c267b8b	Forgot to include util/allow_response_list.[ch]	2025-11-01 13:12:35 +01:00
Willem Toorop	3963af8d0b	configurable ranges and tsig to allow responses Configurable with the "allow-response:" option in the "server:" section. Usage: allow-response: <IP netblock> <tsig key-name \| NOKEY \| BLOCKED>	2025-11-01 12:52:48 +01:00
Willem Toorop	3d6a4c7d6e	Const string for tsig lookups	2025-10-31 15:45:34 +01:00
Willem Toorop	2217c9b96e	Merge branch 'master' into update-with-branches/poisonlicious	2025-10-30 09:48:57 +01:00
Willem Toorop	6592c73d56	Merge branch 'xfr-tsig' into update-with-branches/poisonlicious	2025-10-30 09:45:11 +01:00
Yorgos Thessalonikefs	1a808e2978	- Fix typo; spotted by T3rm1.	2025-10-28 14:42:20 +01:00
Yorgos Thessalonikefs	56ded934de	- Fix #1165 , document the possible circular dependency when using host names instead of IP addresses for name servers in stub/forward zones and log a warning when spotted in the configuration.	2025-10-27 14:01:10 +01:00
Yorgos Thessalonikefs	98952f11d1	Changelog entry for #1331 : - Merge #1331 from Jitka Plesníková: Replace deprecated $function by new $action, for SWIG.	2025-10-27 09:59:35 +01:00
Yorgos ThessalonikefsandGitHub	cb4b3de62f	Merge pull request #1331 from jplesnik/master Replace deprecated $function by new $action	2025-10-27 09:57:59 +01:00
Yorgos Thessalonikefs	c8dcfc0853	- For #1364 , use OPENSSL_VERSION_TEXT instead of OPENSSL_VERSION_NUMBER for part of the configure script. OPENSSL_VERSION_TEXT is more consistent across versions.	2025-10-24 15:43:22 +02:00
Yorgos Thessalonikefs	2bb28fdf12	- Fix unused attribute warning in redis.c when threads are not supported.	2025-10-24 14:44:58 +02:00
Yorgos Thessalonikefs	6ad26909dd	- Note Havard Eidnes for his suggestions on the mailing list.	2025-10-24 14:26:08 +02:00
Yorgos Thessalonikefs	9602973c86	- unbound.conf man page updates to include a preview of the section clauses and some reformatting around the use of "clause", "option" and "attributes".	2025-10-24 14:23:53 +02:00
Yorgos Thessalonikefs	713b1783d4	- Tag for 1.24.1 release. The repository continues with version 1.24.2.	2025-10-22 12:49:29 +02:00
Yorgos Thessalonikefs	e06b7eb3f1	Merge branch 'branch-1.24.1'	2025-10-22 12:44:59 +02:00
Yorgos Thessalonikefs	a33f0638e1	- Fix CVE-2025-11411 (possible domain hijacking attack), reported by Yuxiao Wu, Yunyi Zhang, Baojun Liu and Haixin Duan from Tsinghua University.	2025-10-22 10:54:57 +02:00
Yorgos Thessalonikefs	bbeee42e25	- Set version to 1.24.1.	2025-10-22 10:50:18 +02:00
Yorgos Thessalonikefs	1cb9595a42	- Update the unbound.conf online man page link and some text reformatting in README.md.	2025-10-20 14:34:40 +02:00
Wouter WijngaardsandGitHub	aa21e38b3a	Fix for analysis and ports workflows iOS, Windows (#1361 ) * - Remove SDK_VERSION and only run failed jobs, echo windows config.log * Use commented out to fix syntax of ci. * - Turn off succeeded tests, only link libssp for cross compile, use no-shared for openssl ios. * - Remove iPhone armv7s, and iPhoneSimulator i386 from ios ci. The lib system does not provide symbols for it on the new macos runner. - Fix to exclude libssp for windows compiles.	2025-10-15 16:12:39 +02:00
W.C.A. Wijngaards	964848b94a	- Fix unbound.conf man page entry for root-hints to say it can be used without strongly recommending it.	2025-10-15 15:40:47 +02:00
Yorgos Thessalonikefs	a4dd321fd8	- Remove extra gpg instructions from makedist.sh output.	2025-10-15 14:59:48 +02:00
Yorgos Thessalonikefs	d23a28a693	- ci: don't fail fast for the analysis_port workflow.	2025-10-15 14:10:20 +02:00
W.C.A. Wijngaards	5423c0a8e9	Update ios ci with older sdk version to use.	2025-10-15 13:41:36 +02:00
W.C.A. Wijngaards	6a5385f291	- Fix to update openssl version in ios ci.	2025-10-15 12:25:44 +02:00
W.C.A. Wijngaards	16f3478048	- Add extended dns error code for invalid query type to definition list.	2025-10-15 11:39:58 +02:00
W.C.A. Wijngaards	c8860a5fb6	- Fix to reply with SERVFAIL when the wait-limit is exceeded.	2025-10-15 11:36:29 +02:00
W.C.A. Wijngaards	735c96aac7	- Fix to drop UDP for discard-timeout, but not stream connections.	2025-10-15 11:04:22 +02:00
W.C.A. Wijngaards	a75ea01a15	- Fix #1358 Enabling FIPS in OpenSSL causes unit test to fail.	2025-10-10 09:17:08 +02:00
Yorgos Thessalonikefs	21f02a0865	- Note clearly that 'wait-limit: 0' disables all wait limits. - 'wait-limit-cookie: 0' can now disable cookie validated wait limits.	2025-10-03 16:44:44 +02:00
Yorgos Thessalonikefs	e017d66fc1	- Note 'respip' and 'dns64' module order in the unbound.conf man page.	2025-10-03 11:27:26 +02:00
W.C.A. Wijngaards	adaf5dab49	- Fix that https is set up as enabled when the port is listed in interface-automatic-ports. Also for the set up of quic it is enabled when listed there.	2025-10-02 10:16:06 +02:00
Jitka Plesnikova	1d3d78dff5	Replace deprecated $function by new $action The long-deprecated $function was removed from future SWIG 4.4.0. It can be safely replaced by $action.	2025-09-08 10:11:49 +02:00
Willem Toorop	b5a2de1292	allow-response: config option	2025-07-20 13:30:29 +02:00
Willem Toorop	5ed0840dc2	Poisonlicious PoC with new tsig code	2025-07-19 15:19:00 +02:00
Willem Toorop	9bbb34fc38	Link tsig.lo only once	2025-07-19 15:11:15 +02:00
Willem Toorop	433bb1c7bc	Merge branch 'updated-with-master/xfr-tsig' into hackathon/poisonlicious-new-tsig-code	2025-07-19 15:02:30 +02:00
Willem Toorop	f3b960e72b	Merge branch 'master' into xfr-tsig-update	2025-07-19 14:42:44 +02:00
Willem Toorop	5bd31c9569	A typo and a reorder (without impact)	2025-07-19 14:35:38 +02:00
Willem Toorop	4f245e0e5b	Merge branch 'master' into hackathon/poisonlicious-update	2025-07-19 14:23:50 +02:00
Willem Toorop	3674e4813c	A bit better TSIG handling	2025-03-25 16:46:42 +01:00
Willem Toorop	5d11af34dc	Verification of incoming responses with TSIG For now with a hardcoded TSIG key	2025-03-17 09:25:13 +01:00
Willem Toorop	e29ee129a3	Fix CI	2025-03-16 10:17:53 +01:00
Willem Toorop	86526c75a3	Send responses just before they enter the cache Configured with the `distribute:` option in the `server:` section in the config.	2025-03-16 09:21:11 +01:00
Willem Toorop	d9d6dd31dc	Store responses received on listen interface in cache	2025-03-15 16:22:29 +01:00